@sema-agent/core 5.45.0 → 5.47.0

package/dist/core/runner/runtask.js

@@ -1,5 +1,6 @@
 import { persistedReadDenyEntryProblem } from "../../tools/fs/read-deny.js";
 import { createSafeNotifier, observeThenableRejection } from "../safe-notify.js";
+import { mintSystemReminder, openSystemReminder } from "../reminder-mint.js";
 import { deliverDelegationLifecycle, deliverEngineNotice, undrainedUserInputNotices } from "../types.js";
 import { AgentHarness, DEFAULT_COMPACTION_SETTINGS, uuidv7 } from "../../internal/harness.js";
 import { snapshotActorAssertion } from "../../internal/llm.js";
@@ -122,12 +123,12 @@ const SNAPSHOT_TIMEOUT_MS = 30_000;
 const SNAPSHOT_TOO_LARGE_TTL_MS = 30 * 60_000;
 const LIMIT_APPROACH_DEFAULT_THRESHOLDS = [0.8, 0.95];
 const DEFAULT_PRECALL_OUTPUT_TOKENS = 4096;
-function limitApproachFrames(index, axis, percent) {
+function limitApproachFrames(index, axis, percent, mark) {
     return index === 0
-        ? `<system-reminder>[limit approach] This task has used about ${percent}% of its ${axis}. ` +
+        ? `${openSystemReminder(mark)}[limit approach] This task has used about ${percent}% of its ${axis}. ` +
             `Start converging: finish the step you are on, drop work that is not required for the deliverable, and ` +
             `avoid starting anything you cannot complete within what is left.</system-reminder>`
-        : `<system-reminder>[limit approach] About ${percent}% of the ${axis} is gone. Deliver now: ` +
+        : `${openSystemReminder(mark)}[limit approach] About ${percent}% of the ${axis} is gone. Deliver now: ` +
             `stop exploring, write up what you have — including what is incomplete and what you would do next — ` +
             `and end the task. Work that is not reported before the allowance runs out is lost.</system-reminder>`;
 }
@@ -244,16 +245,16 @@ function assertOutcomeText(value, field) {
         throw new CheckpointError("checkpoint.invalid_outcome", `resume \`${field}\` is not a plain string (got ${typeof value}) — a decide's text payload is an operator's plain data, not a live object; refusing pre-CAS, the checkpoint stays pending`);
     }
 }
-function resumeContinuation(resume) {
+function resumeContinuation(resume, mark) {
     if (resume.outcome.gate === "wake") {
         return formatHookFeedback("You were WOKEN from a parked pause by an operator. Before continuing, re-orient from the workspace: " +
             "run `git status` and review your recent changes / last commits to confirm what is already done, then " +
-            "continue the remaining work. Do NOT restart the task or re-run work that is already committed.");
+            "continue the remaining work. Do NOT restart the task or re-run work that is already committed.", mark);
     }
     if (resume.outcome.gate === "resource_limit") {
         return formatHookFeedback("You were resumed after a pause. Before continuing, re-orient from the workspace: run `git status` and " +
             "review your recent changes / last commits to confirm what is already done, then continue the " +
-            "remaining work. Do NOT restart the task or re-run work that is already committed.");
+            "remaining work. Do NOT restart the task or re-run work that is already committed.", mark);
     }
     if (resume.outcome.gate === "dry_run_review") {
         const verdict = resume.outcome.decision === "approve"
@@ -261,31 +262,31 @@ function resumeContinuation(resume) {
             : `Your predicted change was REVIEWED and REJECTED${resume.outcome.reason ? `: ${delimitUntrusted("reviewer note", resume.outcome.reason, REVIEWER_NOTE_MAX_BODY)}` : ""}; it was NOT applied`;
         return formatHookFeedback(`You were resumed after a dry-run review. ${verdict}. Before continuing, re-orient from the workspace ` +
             "(run `git status` and review your recent changes) to confirm the current state, then continue the " +
-            "remaining work. Do NOT restart the task or re-run work that is already done.");
+            "remaining work. Do NOT restart the task or re-run work that is already done.", mark);
     }
     if (resume.outcome.gate === "plan_review") {
         if (resume.outcome.decision === "approve") {
             return formatHookFeedback("Your proposed PLAN was REVIEWED and APPROVED. Proceed with that plan now — begin executing it. " +
-                "This is a RESUMED task; do NOT re-plan or restart from scratch, just carry out the approved plan.");
+                "This is a RESUMED task; do NOT re-plan or restart from scratch, just carry out the approved plan.", mark);
         }
         if (resume.outcome.decision === "edit") {
             if (!resume.outcome.editedPlan) {
                 return formatHookFeedback("Your proposed PLAN was REVIEWED and EDITED, but no revised plan text was supplied — proceed with your " +
-                    "ORIGINAL plan as-is, begin executing it now. This is a RESUMED task; do NOT re-plan or restart from scratch.");
+                    "ORIGINAL plan as-is, begin executing it now. This is a RESUMED task; do NOT re-plan or restart from scratch.", mark);
             }
             return formatHookFeedback("Your proposed PLAN was REVIEWED and EDITED by a human reviewer. Proceed with the REVISED plan below " +
                 "(it supersedes your earlier plan); begin executing it now. This is a RESUMED task; do NOT re-plan " +
                 "or restart from scratch, just carry out the revised plan.\n\nThe REVISED plan to follow is:\n" +
-                delimitUntrusted("revised plan", resume.outcome.editedPlan));
+                delimitUntrusted("revised plan", resume.outcome.editedPlan), mark);
         }
         const why = resume.outcome.reason ? ` Reviewer note: ${delimitUntrusted("reviewer note", resume.outcome.reason, REVIEWER_NOTE_MAX_BODY)}` : "";
         return formatHookFeedback(`Your proposed PLAN was REVIEWED and REJECTED; it was NOT executed.${why} Produce a NEW plan that ` +
             "addresses the concern, then continue. This is a RESUMED task — re-plan from the current state; do " +
-            "NOT execute the rejected plan.");
+            "NOT execute the rejected plan.", mark);
     }
     const { pendingAction } = resume.cp;
     if (pendingAction.kind !== "tool_approval") {
-        return formatHookFeedback("This is a RESUMED task — continue from where you left off without restarting or re-running prior work.");
+        return formatHookFeedback("This is a RESUMED task — continue from where you left off without restarting or re-running prior work.", mark);
     }
     const decided = resume.outcome.decision === "allow"
         ? "was APPROVED and has now been executed — its result is in the tool results above"
@@ -297,7 +298,7 @@ function resumeContinuation(resume) {
     return formatHookFeedback(`The pending tool call "${pendingAction.toolName}" ${decided}.${batchNote} ` +
         `This is a RESUMED task — every step before this point is already done and its results are in the ` +
         `conversation above. Do NOT restart the task or re-run any tool you already ran; continue from this ` +
-        `exact point, building on the existing results, and finish the remaining work.`);
+        `exact point, building on the existing results, and finish the remaining work.`, mark);
 }
 const ENV_DUE_GOVERNANCE_READ_BUDGET_MS = 5_000;
 const MAX_TIMER_DELAY_MS = 2_147_483_647;
@@ -514,7 +515,7 @@ function makeTurnBoundary(prepared, stats, rs, deps) {
             if (tightest !== undefined && tightest.ratio >= thresholds[index]) {
                 rs.counters.approachNoticesSent += 1;
                 const percent = Math.min(100, Math.round(tightest.ratio * 100));
-                const body = limitApproachFrames(index === 0 ? 0 : 1, tightest.axis, percent);
+                const body = limitApproachFrames(index === 0 ? 0 : 1, tightest.axis, percent, prepared.reminderMark);
                 void prepared.harness.steer(body, { engineMinted: true }).catch(() => undefined);
                 queue.push({ type: "steering_injected", source: "limit_approach", preview: body.slice(0, 220), ...ident() });
                 boundarySteered = true;
@@ -739,7 +740,7 @@ function makeTurnBoundary(prepared, stats, rs, deps) {
                 }
             }
             if (due.length > 0) {
-                attachmentsPayload = due.map((a) => `<system-reminder>\n${sanitizeUntrustedText(a.body)}\n</system-reminder>`).join("\n");
+                attachmentsPayload = due.map((a) => mintSystemReminder(sanitizeUntrustedText(a.body), prepared.reminderMark)).join("\n");
                 for (const a of due)
                     boundaryAttachmentBytes += Buffer.byteLength(a.body, "utf8");
                 rs.attach.attachmentsInjected += due.length;
@@ -766,7 +767,7 @@ function makeTurnBoundary(prepared, stats, rs, deps) {
                             const clipped = clipToBytes(body, budget) === body
                                 ? body
                                 : `${clipToBytes(body, budget - Buffer.byteLength(BATCH_TRUNCATION_MARKER, "utf8"))}${BATCH_TRUNCATION_MARKER}`;
-                            batchContextBlock = `<system-reminder>\n${clipped}\n</system-reminder>`;
+                            batchContextBlock = mintSystemReminder(clipped, prepared.reminderMark);
                         }
                     }
                 }
@@ -1000,8 +1001,8 @@ function makeTurnBoundary(prepared, stats, rs, deps) {
     };
     return onTurnBoundary;
 }
-function wrapGitFrame(body) {
-    return `<system-reminder>\n${sanitizeUntrustedText(body)}\n</system-reminder>`;
+function wrapGitFrame(body, mark) {
+    return mintSystemReminder(sanitizeUntrustedText(body), mark);
 }
 async function resolveGitLegDelivery(prepared, cpMirror, report) {
     const ref = prepared.gitStatusRef;
@@ -1044,7 +1045,7 @@ async function resolveGitLegDelivery(prepared, cpMirror, report) {
     }
     if (prior !== undefined && !pending && prior.entryId !== undefined) {
         try {
-            const newest = newestEngineGitFrame(await prepared.session.getBranch());
+            const newest = newestEngineGitFrame(await prepared.session.getBranch(), prepared.reminderMark);
             if (newest === undefined || newest.entryId !== prior.entryId)
                 pending = true;
         }
@@ -1060,7 +1061,7 @@ async function resolveGitLegDelivery(prepared, cpMirror, report) {
         if (prior === undefined && !pending) {
             let mustDisown;
             try {
-                mustDisown = branchCarriesVisiblePositiveGitFrame(await prepared.session.getBranch());
+                mustDisown = branchCarriesVisiblePositiveGitFrame(await prepared.session.getBranch(), prepared.reminderMark);
             }
             catch (err) {
                 mustDisown = true;
@@ -1073,9 +1074,9 @@ async function resolveGitLegDelivery(prepared, cpMirror, report) {
         return frame.body;
     }
     if (!pending && prior !== undefined && prior.kind === frame.kind && prior.hash === frame.hash) {
-        ref.protectedText = wrapGitFrame(frame.body);
+        ref.protectedText = wrapGitFrame(frame.body, prepared.reminderMark);
         if (frame.kind === "full" && frame.shrunk !== undefined) {
-            ref.wrappedShrink = { find: ref.protectedText, replace: wrapGitFrame(frame.shrunk.body) };
+            ref.wrappedShrink = { find: ref.protectedText, replace: wrapGitFrame(frame.shrunk.body, prepared.reminderMark) };
         }
         return undefined;
     }
@@ -1759,9 +1760,9 @@ export class Runner {
                 const actorIn = options?.actor;
                 const actor = actorIn === undefined ? undefined : snapshotActorAssertion(actorIn);
                 const projected = projectHumanInput({ text, actor, source: "steer" });
-                const payload = trusted ? formatHookFeedback(projected) : projected;
-                const mintsAFrame = payload.trim().length !== 0;
-                const replay = { payload, trusted, ...(actor !== undefined ? { actor } : {}) };
+                let payload;
+                let mintsAFrame;
+                let replay;
                 const noteAccepted = (h) => {
                     if (!mintsAFrame)
                         return;
@@ -1790,6 +1791,9 @@ export class Runner {
                     const h = handle ?? (await orTimeout(ready));
                     if (!h)
                         throw steeringError("the task is not running");
+                    payload = trusted ? formatHookFeedback(projected, h.reminderMark) : projected;
+                    mintsAFrame = payload.trim().length !== 0;
+                    replay = { payload, trusted, ...(actor !== undefined ? { actor } : {}) };
                     if (typeof inputId === "string") {
                         const prior = acceptedSteerInputs.get(inputId);
                         if (prior !== undefined) {
@@ -2099,7 +2103,7 @@ export class Runner {
             }
         }
         const loopLatch = { ended: false };
-        onReady({ harness: prepared.harness, abortController: prepared.abortController, loop: loopLatch });
+        onReady({ harness: prepared.harness, abortController: prepared.abortController, loop: loopLatch, reminderMark: prepared.reminderMark });
         const stats = { turns: 0, tokens: 0, toolCalls: 0, promptTokens: 0, totalInputTokens: 0, cachedTokens: 0, cacheWriteTokens: 0, cacheWriteTokensLong: 0, outputTokens: 0, costMicroUsd: 0 };
         prepared.liveSpendRef.get = () => ({ costMicroUsd: stats.costMicroUsd, tokens: stats.tokens, turns: stats.turns, walltimeMs: Math.round(performance.now() - rs.telemetry.taskStartMonotonic) });
         if (resume &&
@@ -2313,12 +2317,12 @@ export class Runner {
                             return [];
                         const full = textOf(e.message);
                         if (m.engineMinted === true)
-                            return [stripGitStatusUnits(full)];
+                            return [stripGitStatusUnits(full, prepared.reminderMark)];
                         if (Array.isArray(m.engineSegments) && m.engineSegments.length > 0) {
-                            return m.engineSegments.map((s) => stripGitStatusUnits(full.slice(Math.max(0, s.start), Math.max(0, s.end))));
+                            return m.engineSegments.map((s) => stripGitStatusUnits(full.slice(Math.max(0, s.start), Math.max(0, s.end)), prepared.reminderMark));
                         }
                         if (typeof m.enginePrefixChars === "number" && m.enginePrefixChars > 0)
-                            return [stripGitStatusUnits(full.slice(0, m.enginePrefixChars))];
+                            return [stripGitStatusUnits(full.slice(0, m.enginePrefixChars), prepared.reminderMark)];
                         return [];
                     });
                 }
@@ -2407,7 +2411,8 @@ export class Runner {
                         const text = typeof m.content === "string"
                             ? m.content
                             : m.content.map((b) => (b !== null && typeof b === "object" && b.type === "text" ? String(b.text ?? "") : "")).join("\n");
-                        if (text.includes("<system-reminder>[final verification]") && rs.counters.finalVerifyInjections < 2)
+                        const fvMarked = m.engineMinted === true && text.includes(`<system-reminder mark="${prepared.reminderMark}">[final verification]`);
+                        if ((fvMarked || text.includes("<system-reminder>[final verification]")) && rs.counters.finalVerifyInjections < 2)
                             rs.counters.finalVerifyInjections += 1;
                     }
                     else if (m.role === "toolResult" && !rs.counters.wroteThisRun && (prepared.toolEffects.get(m.toolName) ?? "write") !== "read") {
@@ -2687,7 +2692,8 @@ export class Runner {
                     finalVerifyBudgetFill() < 0.9) {
                     rs.counters.finalVerifyInjections += 1;
                     if (rs.counters.finalVerifyInjections === 2) {
-                        const reentryBody = "<system-reminder>[final verification] Your tool calls in this run worked with raw bytes, structural parsing, " +
+                        const reentryBody = openSystemReminder(prepared.reminderMark) +
+                            "[final verification] Your tool calls in this run worked with raw bytes, structural parsing, " +
                             "or checksum/digest computation — the deliverable very likely embeds verifiable structure (structural fields, an " +
                             "embedded checksum-family value, reference data it must match, or a replayable deterministic path). You MUST " +
                             "execute the grounding check that structure supports — recompute the embedded value and compare it against the " +
@@ -2706,7 +2712,8 @@ export class Runner {
                             },
                         ];
                     }
-                    const nudgeBody = "<system-reminder>[final verification] Before finishing: re-verify the FINAL deliverable through its REAL entry point, " +
+                    const nudgeBody = openSystemReminder(prepared.reminderMark) +
+                        "[final verification] Before finishing: re-verify the FINAL deliverable through its REAL entry point, " +
                         "exactly as the acceptance criteria would exercise it — execute the binary/function/endpoint directly and read the ACTUAL " +
                         "output and exit code. Do NOT rely on earlier self-tests, shell redirections, or assumptions (a program that prints to " +
                         "stdout is not a program that writes the required file). If anything mismatches the task's requirements, fix it before " +
@@ -2770,7 +2777,7 @@ export class Runner {
                     messages.push({
                         role: "user",
                         engineMinted: true,
-                        content: formatHookFeedback(`Stop hook additional context: ${result.additionalContext}`),
+                        content: formatHookFeedback(`Stop hook additional context: ${result.additionalContext}`, prepared.reminderMark),
                         timestamp: Date.now(),
                     });
                 }
@@ -2790,7 +2797,7 @@ export class Runner {
                     messages.push({
                         role: "user",
                         engineMinted: true,
-                        content: formatHookFeedback(`Stop hook stopped continuation: ${result.block}`),
+                        content: formatHookFeedback(`Stop hook stopped continuation: ${result.block}`, prepared.reminderMark),
                         timestamp: Date.now(),
                     });
                 }
@@ -2912,7 +2919,7 @@ export class Runner {
             const use = ref.overBudgetShrunk && frame.shrunk !== undefined
                 ? { kind: "degraded", body: frame.shrunk.body, hash: frame.shrunk.hash }
                 : { kind: frame.kind, body: frame.body, hash: frame.hash };
-            const wrapped = wrapGitFrame(use.body);
+            const wrapped = wrapGitFrame(use.body, prepared.reminderMark);
             try {
                 const entryId = await prepared.session.appendMessage({
                     role: "user",
@@ -2923,7 +2930,7 @@ export class Runner {
                 ref.announced = { kind: use.kind, hash: use.hash, entryId };
                 ref.protectedText = wrapped;
                 if (use.kind === "full" && frame.shrunk !== undefined) {
-                    ref.wrappedShrink = { find: wrapped, replace: wrapGitFrame(frame.shrunk.body) };
+                    ref.wrappedShrink = { find: wrapped, replace: wrapGitFrame(frame.shrunk.body, prepared.reminderMark) };
                 }
                 else {
                     delete ref.wrappedShrink;
@@ -3045,13 +3052,13 @@ export class Runner {
                     rs.limits.budgetAxis = "cost";
                 }
                 else {
-                    let continuation = resumeContinuation(resume);
+                    let continuation = resumeContinuation(resume, prepared.reminderMark);
                     const bgSnapshot = resume.cp.state.runningBackgroundTasks;
                     if (bgSnapshot !== undefined && bgSnapshot.length > 0) {
                         const alive = new Set(prepared.listBackgroundTasks().map((t) => t.id));
                         const orphans = bgSnapshot.filter((t) => !alive.has(t.id));
                         if (orphans.length > 0) {
-                            continuation += "\n\n" + formatHookFeedback(renderOrphanedBackgroundTasks(orphans));
+                            continuation += "\n\n" + formatHookFeedback(renderOrphanedBackgroundTasks(orphans), prepared.reminderMark);
                         }
                     }
                     let gitResumeDelivered;
@@ -3065,11 +3072,11 @@ export class Runner {
                         });
                         const gitFrame = prepared.gitStatusRef.frame;
                         if (gitBody !== undefined && gitFrame !== undefined) {
-                            const wrappedGit = wrapGitFrame(gitBody);
+                            const wrappedGit = wrapGitFrame(gitBody, prepared.reminderMark);
                             continuation += "\n\n" + wrappedGit;
                             gitResumeDelivered = { kind: gitFrame.kind, hash: gitFrame.hash, wrapped: wrappedGit };
                             if (gitFrame.kind === "full" && gitFrame.shrunk !== undefined) {
-                                prepared.gitStatusRef.wrappedShrink = { find: wrappedGit, replace: wrapGitFrame(gitFrame.shrunk.body) };
+                                prepared.gitStatusRef.wrappedShrink = { find: wrappedGit, replace: wrapGitFrame(gitFrame.shrunk.body, prepared.reminderMark) };
                             }
                         }
                     }
@@ -3083,7 +3090,7 @@ export class Runner {
                         const projected = projectHumanInput({ text: steer.text, actor: steer.actor, source });
                         continuation +=
                             "\n\n" +
-                                (steer.trusted ? formatHookFeedback(projected) : delimitUntrusted("supervisor steering message", projected));
+                                (steer.trusted ? formatHookFeedback(projected, prepared.reminderMark) : delimitUntrusted("supervisor steering message", projected));
                         if (steer.trusted)
                             engineSegments.push({ start, end: continuation.length });
                         queue.push({
@@ -3131,11 +3138,11 @@ export class Runner {
                     try {
                         const decision = await userPromptSubmit(spec.objective, { identity: prepared.hookIdentity });
                         if (decision?.block) {
-                            prepared.blockedRef.reason = formatHookFeedback(decision.block);
+                            prepared.blockedRef.reason = formatHookFeedback(decision.block, prepared.reminderMark);
                             promptBlocked = true;
                         }
                         else if (decision?.additionalContext) {
-                            effectiveObjective = `${formatHookFeedback(decision.additionalContext)}\n\n${projectedObjective}`;
+                            effectiveObjective = `${formatHookFeedback(decision.additionalContext, prepared.reminderMark)}\n\n${projectedObjective}`;
                         }
                     }
                     catch (hookErr) {
@@ -3146,7 +3153,7 @@ export class Runner {
                         catch {
                         }
                         prepared.blockedRef.reason = formatHookFeedback(`the deployment's userPromptSubmit hook crashed while screening this prompt (${err.message}); ` +
-                            `the prompt was NOT submitted (fail-closed)`);
+                            `the prompt was NOT submitted (fail-closed)`, prepared.reminderMark);
                         promptBlocked = true;
                     }
                 }
@@ -3161,13 +3168,13 @@ export class Runner {
                     });
                     const gitFrame = prepared.gitStatusRef.frame;
                     if (gitBody !== undefined && gitFrame !== undefined) {
-                        const wrappedGit = wrapGitFrame(gitBody);
+                        const wrappedGit = wrapGitFrame(gitBody, prepared.reminderMark);
                         const standalone = spec.images !== undefined && spec.images.length > 0;
                         if (!standalone)
                             effectiveObjective = `${wrappedGit}\n${effectiveObjective}`;
                         gitLegDelivered = { kind: gitFrame.kind, hash: gitFrame.hash, standalone, wrapped: wrappedGit };
                         if (gitFrame.kind === "full" && gitFrame.shrunk !== undefined) {
-                            prepared.gitStatusRef.wrappedShrink = { find: wrappedGit, replace: wrapGitFrame(gitFrame.shrunk.body) };
+                            prepared.gitStatusRef.wrappedShrink = { find: wrappedGit, replace: wrapGitFrame(gitFrame.shrunk.body, prepared.reminderMark) };
                         }
                     }
                 }
@@ -3205,7 +3212,7 @@ export class Runner {
                         }
                     }
                     if (firstFrames.length > 0) {
-                        effectiveObjective = `${firstFrames.map((f) => `<system-reminder>\n${sanitizeUntrustedText(f.body)}\n</system-reminder>`).join("\n")}\n${effectiveObjective}`;
+                        effectiveObjective = `${firstFrames.map((f) => mintSystemReminder(sanitizeUntrustedText(f.body), prepared.reminderMark)).join("\n")}\n${effectiveObjective}`;
                     }
                 }
                 const gitQueuedChars = gitLegDelivered !== undefined && gitLegDelivered.standalone ? gitLegDelivered.wrapped.length : 0;
@@ -4385,8 +4392,8 @@ export class Runner {
                     return l !== undefined && l !== name ? { label: l } : {};
                 })();
                 emit({ type: "tool_start", toolCallId: id, toolName: name, ...displayLabel, args: deferredArgs.get(id) ?? {} });
-                emit({ type: "tool_end", toolCallId: id, toolName: name, ...displayLabel, isError: true, ...toolEndBodyFrom({ content: formatHookFeedback(DEFERRED_REISSUE) }, true) });
-                const eid = await prepared.session.appendMessage(toolResultMsg(id, name, formatHookFeedback(DEFERRED_REISSUE), true));
+                emit({ type: "tool_end", toolCallId: id, toolName: name, ...displayLabel, isError: true, ...toolEndBodyFrom({ content: formatHookFeedback(DEFERRED_REISSUE, prepared.reminderMark) }, true) });
+                const eid = await prepared.session.appendMessage(toolResultMsg(id, name, formatHookFeedback(DEFERRED_REISSUE, prepared.reminderMark), true));
                 emitCommitted(eid, "toolResult", id);
             }
         }
@@ -4407,8 +4414,8 @@ export class Runner {
                     ? `The approval for the pending tool call "${pendingAction.toolName}" ended without anyone deciding it (it was cancelled or could not be delivered), so it was not executed.`
                     : `The pending tool call "${pendingAction.toolName}" was denied by an approver.`;
             const reason = outcome.reason ? delimitUntrusted("reviewer note", outcome.reason, REVIEWER_NOTE_MAX_BODY) : defaultDenial;
-            emitEnd(true, { content: formatHookFeedback(reason) });
-            const eid = await prepared.session.appendMessage(toolResultMsg(pendingAction.toolCallId, pendingAction.toolName, formatHookFeedback(reason), true));
+            emitEnd(true, { content: formatHookFeedback(reason, prepared.reminderMark) });
+            const eid = await prepared.session.appendMessage(toolResultMsg(pendingAction.toolCallId, pendingAction.toolName, formatHookFeedback(reason, prepared.reminderMark), true));
             emitCommitted(eid, "toolResult", pendingAction.toolCallId);
             return;
         }
@@ -4431,7 +4438,7 @@ export class Runner {
             const beltUnsafe = rechecked.action === "deny" ||
                 (rechecked.updatedInput !== undefined && !deepJsonEqual(rechecked.updatedInput, resolvedArgs));
             if (beltUnsafe) {
-                const editedDenial = formatHookFeedback(`The approver EDITED this call's input; the edited call is refused by the deployment's tool policy and was not executed${rechecked.action === "deny" && rechecked.message ? `: ${rechecked.message}` : " (the policy rewrote the edit to a value that was not approved)"}.`);
+                const editedDenial = formatHookFeedback(`The approver EDITED this call's input; the edited call is refused by the deployment's tool policy and was not executed${rechecked.action === "deny" && rechecked.message ? `: ${rechecked.message}` : " (the policy rewrote the edit to a value that was not approved)"}.`, prepared.reminderMark);
                 emitEnd(true, { content: editedDenial });
                 const eid = await prepared.session.appendMessage(toolResultMsg(pendingAction.toolCallId, pendingAction.toolName, editedDenial, true));
                 emitCommitted(eid, "toolResult", pendingAction.toolCallId);
@@ -4441,7 +4448,7 @@ export class Runner {
         const gateRealApproval = resume.cp.gate.kind === "irreversible_ask" ? resume.cp.gate.realApproval : undefined;
         const gateOrgGoverned = gateRealApproval?.origin === "org_rule" || gateRealApproval?.origin === "org_unavailable";
         if (gateOrgGoverned && prepared.permissionRuleOrg === undefined) {
-            const unwiredDenial = formatHookFeedback(`The approved tool call "${pendingAction.toolName}" was not executed: its approval was minted under organization governance (${gateRealApproval.origin}), and this worker has no org adjudication wiring — a governed approval may only be redeemed where governance can be enforced. This approval is spent; re-issue the call on an org-wired worker.`);
+            const unwiredDenial = formatHookFeedback(`The approved tool call "${pendingAction.toolName}" was not executed: its approval was minted under organization governance (${gateRealApproval.origin}), and this worker has no org adjudication wiring — a governed approval may only be redeemed where governance can be enforced. This approval is spent; re-issue the call on an org-wired worker.`, prepared.reminderMark);
             emitEnd(true, { content: unwiredDenial });
             const eid = await prepared.session.appendMessage(toolResultMsg(pendingAction.toolCallId, pendingAction.toolName, unwiredDenial, true));
             emitCommitted(eid, "toolResult", pendingAction.toolCallId);
@@ -4472,7 +4479,7 @@ export class Runner {
                 const orgDisclosures = org.status === "unavailable" && org.disclosures.length > 0
                     ? ` Governance disclosures: ${inlineUntrusted(org.disclosures.join("; "), ORG_DISCLOSURE_MAX_CHARS)}.`
                     : "";
-                const orgDenial = formatHookFeedback(`The approved tool call "${pendingAction.toolName}" was not executed: ${blocked}.${orgDisclosures} This approval is spent — the call has to be re-issued and approved again once organization policy permits it.`);
+                const orgDenial = formatHookFeedback(`The approved tool call "${pendingAction.toolName}" was not executed: ${blocked}.${orgDisclosures} This approval is spent — the call has to be re-issued and approved again once organization policy permits it.`, prepared.reminderMark);
                 emitEnd(true, { content: orgDenial });
                 const eid = await prepared.session.appendMessage(toolResultMsg(pendingAction.toolCallId, pendingAction.toolName, orgDenial, true));
                 emitCommitted(eid, "toolResult", pendingAction.toolCallId);
@@ -4488,7 +4495,7 @@ export class Runner {
                 ...(prepared.cwdRef !== undefined ? { cwd: prepared.cwdRef.current } : {}),
             }, prepared.abortController.signal));
             if (narrowed.action === "deny") {
-                const narrowedDenial = formatHookFeedback(`The approved tool call "${pendingAction.toolName}" is now denied by a session rule and was not executed${narrowed.message ? `: ${narrowed.message}` : ""}.`);
+                const narrowedDenial = formatHookFeedback(`The approved tool call "${pendingAction.toolName}" is now denied by a session rule and was not executed${narrowed.message ? `: ${narrowed.message}` : ""}.`, prepared.reminderMark);
                 emitEnd(true, { content: narrowedDenial });
                 const eid = await prepared.session.appendMessage(toolResultMsg(pendingAction.toolCallId, pendingAction.toolName, narrowedDenial, true));
                 emitCommitted(eid, "toolResult", pendingAction.toolCallId);

package/dist/core/session-reconcile.js

@@ -9,7 +9,8 @@ const INTERRUPTED_IDEMPOTENT = "[INTERRUPTED] The previous run ended before this
     "may not have taken effect. It is safe to REPLAY: re-issuing the same call converges the state to " +
     "what you intended. If you decide not to re-issue it, verify the current state first.";
 const INTERRUPTED_NEVER_STARTED = "[INTERRUPTED] The run was aborted before this tool call started. It was never executed and had " +
-    "no side effects — it is safe to re-issue this call if you still need it.";
+    "no side effects. If the run was stopped by a pending approval or an unresolved gate, wait for it " +
+    "to be resolved before re-issuing; re-issuing is otherwise safe if you still need this call.";
 const INTERRUPTED_REPEAT_UNKNOWN = "[INTERRUPTED] Same as an earlier interrupted call in this batch: no result was recorded and the outcome is " +
     "UNKNOWN — verify before relying on it.";
 const INTERRUPTED_REPEAT_SAFE = "[INTERRUPTED] Same as an earlier interrupted call in this batch: this tool is read-only/idempotent, so just " +
@@ -17,7 +18,7 @@ const INTERRUPTED_REPEAT_SAFE = "[INTERRUPTED] Same as an earlier interrupted ca
 const INTERRUPTED_REPEAT_IDEMPOTENT = "[INTERRUPTED] Same as an earlier interrupted call in this batch: it is safe to REPLAY — re-issue it, or verify " +
     "the current state if you decide not to.";
 const INTERRUPTED_REPEAT_NEVER_STARTED = "[INTERRUPTED] Same as an earlier interrupted call in this batch: it never started and had no side effects — " +
-    "safe to re-issue.";
+    "re-issuing is safe once whatever stopped the run is resolved.";
 const REPEAT_TEXT = {
     never_started: INTERRUPTED_REPEAT_NEVER_STARTED,
     read: INTERRUPTED_REPEAT_SAFE,

package/dist/core/side-query.d.ts

@@ -1,5 +1,5 @@
 import type { AssistantMessage, StopReason, Tool, ToolResultMessage, Usage, UserMessage } from "../internal/llm.js";
-import type { Brain, Model, ModelRef, ModelRole, ModelRoles, ThinkingLevel } from "./types.js";
+import type { Brain, Model, ModelRef, ModelRole, ModelRoles, TaskSpec, ThinkingLevel } from "./types.js";
 import { type DegradationInfo } from "../brain/degrading.js";
 /** A tool DEFINITION exposed to the model in a side query (never executed by the engine). */
 export interface SideQueryToolDef {
@@ -54,6 +54,16 @@ export interface SideQuerySpec {
     tools?: SideQueryToolDef[];
     /** Per-request output cap (provider max_tokens). */
     maxOutputTokens?: number;
+    /**
+     * Per-model auth — MIRRORS {@link TaskSpec.getApiKeyAndHeaders} (same signature, resolved per
+     * call against the RESOLVED model, exactly like the task path's per-call hook). The brain
+     * contract is `options.apiKey ?? config.apiKey`, and a model's own `baseUrl` outranks the
+     * brain's — so before this seat existed, a side query routed to a model carrying its own
+     * `baseUrl` + per-model key fell back to the brain's construction-time credential and sent the
+     * GATEWAY key to the per-model (possibly external) URL: a credential leak the task path already
+     * prevents. Absent ⇒ construction-time credentials apply, options byte-identical to before.
+     */
+    getApiKeyAndHeaders?: TaskSpec["getApiKeyAndHeaders"];
     signal?: AbortSignal;
 }
 export interface SideQueryResult {

package/dist/core/side-query.js

@@ -44,10 +44,13 @@ export async function runSideQuery(spec, deps) {
             : {}),
     };
     const thinking = resolved.thinking ?? resolved.model.defaultThinking;
+    const auth = await spec.getApiKeyAndHeaders?.(resolved.model);
     const options = {
         ...(spec.signal !== undefined ? { signal: spec.signal } : {}),
         ...(spec.maxOutputTokens !== undefined ? { maxTokens: spec.maxOutputTokens } : {}),
         ...(thinking !== undefined ? { reasoning: thinking } : {}),
+        ...(auth?.apiKey !== undefined ? { apiKey: auth.apiKey } : {}),
+        ...(auth?.headers !== undefined ? { headers: auth.headers } : {}),
     };
     const stream = await Promise.resolve(deps.brain.stream(resolved.model, context, options));
     const msg = (await stream.result());