@sema-agent/core 5.49.0 → 5.51.0

package/dist/core/memory-engine/layout.js

@@ -1504,6 +1504,65 @@ export function recordChallengedHistory(controlDir, rows, now) {
 export function readChallengedHistory(controlDir) {
     return coerceChallengedHistory(readSidecarJson(controlDir, CHALLENGED_HISTORY_FILE));
 }
+export const PROJECTION_DEBTS_FILE = "projection-debts.json";
+function coerceProjectionDebts(raw) {
+    if (raw === undefined)
+        return { version: 1, rows: [] };
+    const rec = raw;
+    if (typeof rec !== "object" || rec === null || rec.version !== 1 || !Array.isArray(rec.rows)) {
+        throw new ControlPlaneCorruptError("memory projection-debt ledger has the wrong shape — refusing (fail-closed; an unreadable debt account must not read as 'no debts')");
+    }
+    for (const r of rec.rows) {
+        const row = r;
+        if (typeof row !== "object" ||
+            row === null ||
+            typeof row.relPath !== "string" ||
+            row.relPath.length === 0 ||
+            row.relPath.startsWith("/") ||
+            row.relPath.split(/[\\/]/).includes("..") ||
+            typeof row.entryId !== "string" ||
+            row.entryId.length === 0 ||
+            typeof row.rev !== "string" ||
+            row.rev.length === 0 ||
+            typeof row.at !== "number" ||
+            !Number.isFinite(row.at)) {
+            throw new ControlPlaneCorruptError("memory projection-debt ledger: a row is malformed — refusing (fail-closed)");
+        }
+    }
+    return rec;
+}
+export function stageProjectionDebts(controlDir, rows, now) {
+    if (rows.length === 0)
+        return { refused: [] };
+    const at = now();
+    return lockedStrictUpdate(controlDir, PROJECTION_DEBTS_FILE, "memory projection-debt ledger", coerceProjectionDebts, (rec) => {
+        const byPath = new Map(rec.rows.map((r) => [r.relPath, r]));
+        const refused = [];
+        for (const r of rows) {
+            const existing = byPath.get(r.relPath);
+            if (existing !== undefined && existing.entryId !== r.entryId && existing.entryId !== r.replaces) {
+                refused.push({ relPath: r.relPath, entryId: r.entryId });
+                continue;
+            }
+            byPath.set(r.relPath, { relPath: r.relPath, entryId: r.entryId, rev: r.rev, at });
+        }
+        return { next: { version: 1, rows: [...byPath.values()] }, result: { refused } };
+    });
+}
+export function settleProjectionDebts(controlDir, rows) {
+    if (rows.length === 0)
+        return;
+    const drop = new Set(rows.map((r) => JSON.stringify([r.entryId, r.relPath])));
+    lockedStrictUpdate(controlDir, PROJECTION_DEBTS_FILE, "memory projection-debt ledger", coerceProjectionDebts, (rec) => {
+        const kept = rec.rows.filter((r) => !drop.has(JSON.stringify([r.entryId, r.relPath])));
+        if (kept.length === rec.rows.length)
+            return { result: undefined };
+        return { next: { version: 1, rows: kept }, result: undefined };
+    });
+}
+export function readProjectionDebts(controlDir) {
+    return coerceProjectionDebts(readStrictSidecar(controlDir, PROJECTION_DEBTS_FILE, "memory projection-debt ledger")).rows;
+}
 export function writeAllSync(fd, data) {
     const buf = Buffer.from(data, "utf8");
     let written = 0;

package/dist/core/memory-engine/memory-backend-contract.js

@@ -426,6 +426,93 @@ export async function memoryBackendContract(hooks) {
         const flat = await b.search("same words", ["s1"], { limit: 3 });
         assert.deepStrictEqual(flat.map((h) => h.id), ["id-band-a-01", "id-band-b-01", "id-band-c-01"]);
     });
+    defer("design/336 §4 hold protocol (update form): mid-hold writes apply plainly (backend is hold-unaware); the release replay at the capture anchor is a reported conflict carrying currentRev; a clean release applies and the snapshot face answers its committed triple", async () => {
+        const b = await hooks.make();
+        const e1v0 = entry("id-hold-upd1", "s1", "held-clean", "committed v0");
+        assert.deepStrictEqual((await b.applyPatches([{ op: "add", id: e1v0.id, entry: e1v0 }])).conflicts, []);
+        const e1rel = entry("id-hold-upd1", "s1", "held-clean", "the released capture");
+        const rep1 = await b.applyPatches([{ op: "update", id: e1v0.id, entry: e1rel, baseRev: e1v0.rev }]);
+        assert.deepStrictEqual(rep1.conflicts, [], "a release onto an untouched anchor applies");
+        const snapFace = b.committedSnapshotOf;
+        if (typeof snapFace === "function") {
+            const snap = await snapFace.call(b, e1v0.id);
+            assert.strictEqual(snap.state, "row");
+            if (snap.state === "row") {
+                assert.strictEqual(snap.rev, e1rel.rev, "the snapshot tracks the UPDATE — not the add-time state");
+                assert.strictEqual(snap.binding.state, "bound");
+                if (snap.binding.state === "bound") {
+                    assert.strictEqual(snap.binding.scope, "s1");
+                    assert.strictEqual(snap.binding.slug, "held-clean");
+                }
+            }
+        }
+        const rep1b = await b.applyPatches([{ op: "update", id: e1v0.id, entry: e1rel, baseRev: e1v0.rev }]);
+        assert.strictEqual(rep1b.applied.length, 0);
+        assert.strictEqual(rep1b.conflicts.length, 1);
+        assert.strictEqual(rep1b.conflicts[0]?.currentRev, e1rel.rev, "currentRev is the retry's idempotency evidence");
+        const e2v0 = entry("id-hold-upd2", "s1", "held-raced", "committed v0");
+        assert.deepStrictEqual((await b.applyPatches([{ op: "add", id: e2v0.id, entry: e2v0 }])).conflicts, []);
+        const mid = entry("id-hold-upd2", "s1", "held-raced", "mid-hold edit by another writer");
+        const repMid = await b.applyPatches([{ op: "update", id: e2v0.id, entry: mid, baseRev: e2v0.rev }]);
+        assert.deepStrictEqual(repMid.conflicts, [], "a mid-hold write applies plainly — the backend is hold-unaware");
+        assert.strictEqual((await b.getByIds([e2v0.id])).length, 1, "the held id keeps serving reads during the pendency window");
+        const e2rel = entry("id-hold-upd2", "s1", "held-raced", "the captured bytes");
+        const rep2 = await b.applyPatches([{ op: "update", id: e2v0.id, entry: e2rel, baseRev: e2v0.rev }]);
+        assert.strictEqual(rep2.applied.length, 0, "the release never blind-writes over a mid-hold winner");
+        assert.strictEqual(rep2.conflicts.length, 1);
+        assert.strictEqual(rep2.conflicts[0]?.baseRev, e2v0.rev);
+        assert.strictEqual(rep2.conflicts[0]?.currentRev, mid.rev, "the conflict names the winner — the dispose('conflict') evidence");
+        assert.strictEqual((await b.getByIds([e2v0.id]))[0]?.body.replace(/\s+$/, ""), "mid-hold edit by another writer", "the winner's content survives");
+    });
+    defer("design/336 §4 hold protocol (add form): a guard-absent release applies onto a free id; the crash retry re-applies idempotently (one row, original slug); a concurrent claim answers the guarded conflict with currentRev and survives", async () => {
+        const b = await hooks.make();
+        const rel = entry("id-hold-add1", "s1", "held-note", "instruction body");
+        assert.deepStrictEqual((await b.applyPatches([{ op: "add", id: rel.id, entry: rel, guard: "absent" }])).conflicts, []);
+        const rep2 = await b.applyPatches([{ op: "add", id: rel.id, entry: rel, guard: "absent" }]);
+        assert.deepStrictEqual(rep2.conflicts, [], "the crash retry of a committed release re-applies idempotently");
+        assert.deepStrictEqual(rep2.applied, [{ op: "add", id: rel.id, slug: "held-note" }]);
+        assert.deepStrictEqual((await b.listHeaders(["s1"])).filter((h) => h.id === rel.id).map((h) => h.slug), ["held-note"], "ONE row at the ORIGINAL slug — never a suffixed duplicate");
+        const claimed = entry("id-hold-add2", "s1", "claimed-note", "the claimant's content");
+        assert.deepStrictEqual((await b.applyPatches([{ op: "add", id: claimed.id, entry: claimed }])).conflicts, []);
+        const rel2 = entry("id-hold-add2", "s1", "claimed-note", "the captured bytes");
+        const rep3 = await b.applyPatches([{ op: "add", id: rel2.id, entry: rel2, guard: "absent" }]);
+        assert.strictEqual(rep3.applied.length, 0);
+        assert.strictEqual(rep3.conflicts.length, 1);
+        assert.match(rep3.conflicts[0]?.reason ?? "", /add_guard_absent_conflict/);
+        assert.strictEqual(rep3.conflicts[0]?.currentRev, claimed.rev, "currentRev distinguishes 'claimed by another writer' from the idempotent retry");
+        assert.strictEqual((await b.getByIds([claimed.id]))[0]?.body.replace(/\s+$/, ""), "the claimant's content", "the claimant survives");
+    });
+    defer("design/336: the whitewash judgment precedes CAS — an origin/trust strip with a STALE baseRev still answers the malformed refusal, never the rev-mismatch conflict", async () => {
+        const b = await hooks.make();
+        const origin = { taint: "external", cause: "observed", at: 1700000000900 };
+        const m0 = { id: "id-prec-0001", scope: "s1", slug: "prec-marked", frontmatter: { name: "prec", origin }, body: "b0", rev: "" };
+        m0.rev = computeEntryRev(m0);
+        assert.deepStrictEqual((await b.applyPatches([{ op: "add", id: m0.id, entry: m0 }])).conflicts, []);
+        const m1 = { ...m0, body: "b1", rev: "" };
+        m1.rev = computeEntryRev(m1);
+        assert.deepStrictEqual((await b.applyPatches([{ op: "update", id: m0.id, entry: m1, baseRev: m0.rev }])).conflicts, []);
+        const stripped = { id: m0.id, scope: "s1", slug: "prec-marked", frontmatter: { name: "prec" }, body: "b2", rev: "" };
+        stripped.rev = computeEntryRev(stripped);
+        const rep = await b.applyPatches([{ op: "update", id: m0.id, entry: stripped, baseRev: m0.rev }]);
+        assert.strictEqual(rep.applied.length, 0);
+        assert.strictEqual(rep.conflicts.length, 1);
+        assert.match(rep.conflicts[0]?.reason ?? "", /malformed patch refused/, "the stronger refusal answers — a CAS conflict here would hide the whitewash");
+        const prov = { kind: "repo_file", path: "AGENTS.md", contentHash: "sha256:cccc3333", ingestedAt: 1700000001000 };
+        const p0 = { id: "id-prec-0002", scope: "s1", slug: "prec-repo", frontmatter: { name: "prec-repo", provenance: prov, trust: "untrusted" }, body: "p0", rev: "" };
+        p0.rev = computeEntryRev(p0);
+        assert.deepStrictEqual((await b.applyPatches([{ op: "add", id: p0.id, entry: p0 }])).conflicts, []);
+        const p1 = { ...p0, body: "p1", rev: "" };
+        p1.rev = computeEntryRev(p1);
+        assert.deepStrictEqual((await b.applyPatches([{ op: "update", id: p0.id, entry: p1, baseRev: p0.rev }])).conflicts, []);
+        const strippedTrust = { id: p0.id, scope: "s1", slug: "prec-repo", frontmatter: { name: "prec-repo", provenance: prov }, body: "p2", rev: "" };
+        strippedTrust.rev = computeEntryRev(strippedTrust);
+        const rep2 = await b.applyPatches([{ op: "update", id: p0.id, entry: strippedTrust, baseRev: p0.rev }]);
+        assert.strictEqual(rep2.applied.length, 0);
+        assert.strictEqual(rep2.conflicts.length, 1);
+        assert.match(rep2.conflicts[0]?.reason ?? "", /malformed patch refused/);
+        assert.deepStrictEqual((await b.getByIds([m0.id]))[0]?.frontmatter.origin, origin);
+        assert.strictEqual((await b.getByIds([p0.id]))[0]?.frontmatter.trust, "untrusted");
+    });
     defer("consolidation cursor round-trips per scope; unset → undefined", async () => {
         const b = await hooks.make();
         assert.strictEqual(await b.getConsolidationCursor("s1"), undefined);

package/dist/core/memory-engine/types.d.ts

@@ -254,6 +254,18 @@ export interface MemoryBackend {
      *   earlier delete in the same batch does not blank the baseline). The one legal exit is the
      *   COMMITTED tombstone: after a delete commits, the marker's life ends with the id (a fresh id —
      *   or the same id in a LATER batch — starts an unmarked life; the engine re-judges its session);
+     * - PRECEDENCE (FAM-1 #5, every whitewash spelling): the malformed judgment answers BEFORE
+     *   guard/CAS arithmetic — a strip riding a stale `baseRev` (or a guard conflict) still answers
+     *   /malformed patch refused/, never the ordinary rev-mismatch conflict (a whitewash is illegal
+     *   at ANY rev, and the weaker conflict would tell the caller's ladder to rebase and retry it);
+     * - design/336 §4 hold protocol: the backend is hold-UNAWARE — instruction holds live on the
+     *   ENGINE's control plane, so a held id keeps serving reads and ordinary add/update patches for
+     *   it apply plainly (no queueing, no refusal). The settlement-period write interaction resolves
+     *   at release time through the clauses above: the release replays the capture-time anchor
+     *   (update+`baseRev` / `guard: "absent"` add), a mid-hold winner surfaces as the REPORTED
+     *   conflict carrying `currentRev` (the engine's conflict-disposition evidence), and the
+     *   crash-idempotent retry reads the optional committed-snapshot face (post-update rev + bound
+     *   projection) — all asserted by the suite's two hold-protocol cases;
      * - conflicts are per-patch and non-fatal: the rest of the batch still applies.
      */
     applyPatches(patches: readonly NotePatch[]): Promise<PatchReport>;
@@ -338,7 +350,7 @@ export interface MemorySessionHandle {
     adoptionRestricted?: boolean;
 }
 /** Stable rejection codes a harvest gate can produce (model-visible gate events — 镜头 I). */
-export type HarvestRejectionCode = "outside_root" | "symlink" | "secret" | "injection" | "filename" | "too_large" | "file_cap" | "readonly_layer" | "stub_modified" | "nested_too_deep" | "quarantine_failed" | "unreadable" | "polluted" | "restricted_divergence" | "invalid";
+export type HarvestRejectionCode = "outside_root" | "symlink" | "secret" | "injection" | "filename" | "too_large" | "file_cap" | "readonly_layer" | "stub_modified" | "nested_too_deep" | "quarantine_failed" | "unreadable" | "deferred" | "polluted" | "restricted_divergence" | "invalid";
 /** One rejected file: path (relative to the memory dir), stable code, and a model-readable reason. */
 export interface HarvestRejection {
     path: string;

package/dist/core/runner/assemble-result.d.ts

@@ -112,6 +112,12 @@ export interface ResultFlags {
      *  Pure pass-through — assembly neither adds nor filters (a rewind that FAILED never reaches here; it
      *  throws at prepare and lands in the `threw` slot as a terminal errorCode). */
     rewindNotes?: TaskResult["rewindNotes"];
+    /** The run's final turn was halted by a person's BARE rejection of a tool call (the parent-thread
+     *  control-flow boundary) — echoed on `TaskResult.haltedOnUserRejection`. Pure pass-through on
+     *  every terminal: the fact is about the leg that ran, whatever terminal it reached (on the normal
+     *  path the terminal is `completed`, and this is what tells that completion apart from a natural
+     *  one — the model did not finish; the person stopped it and the run awaits their direction). */
+    haltedOnUserRejection?: boolean;
     /** design/174 final-round: call ids of answered-but-never-collected questions, echoed on
      *  `TaskResult.strandedHumanAnswers`. Pure pass-through; empty/absent ⇒ the field is omitted. The
      *  optional `onError` alert is NOT the disclosure — this mandatory result face is. */

package/dist/core/runner/assemble-result.js

@@ -165,5 +165,5 @@ export function assembleResult(spec, sessionId, final, stats, flags) {
     void _internalCompaction;
     if (flags.unpricedSpend)
         delete publicStats.costMicroUsd;
-    return { taskId, sessionId, status, ...(flags.model !== undefined ? { model: flags.model } : {}), result: result.trim(), salvagedOutput, blockedReason, errorMessage, errorCode, ...(retryAfterMs !== undefined ? { retryAfterMs } : {}), checkpointToken, ...(checkpointId !== undefined ? { checkpointId } : {}), checkpointGate, ...(workspaceRestoreMode !== undefined ? { workspaceRestoreMode } : {}), ...(flags.rewindNotes !== undefined && flags.rewindNotes.length > 0 ? { rewindNotes: flags.rewindNotes } : {}), ...(flags.remoteEnvFailures !== undefined && flags.remoteEnvFailures.length > 0 ? { remoteEnvFailures: flags.remoteEnvFailures } : {}), ...(flags.strandedHumanAnswers !== undefined && flags.strandedHumanAnswers.length > 0 ? { strandedHumanAnswers: flags.strandedHumanAnswers } : {}), ...(flags.effectiveReadFace !== undefined ? { effectiveReadFace: flags.effectiveReadFace } : {}), ...(flags.effectiveReadDenyPatterns !== undefined && flags.effectiveReadDenyPatterns.length > 0 ? { effectiveReadDenyPatterns: flags.effectiveReadDenyPatterns } : {}), ...(flags.effectiveMemoryScopes !== undefined ? { effectiveMemoryScopes: flags.effectiveMemoryScopes } : {}), ...(flags.effectiveReasoning !== undefined ? { effectiveReasoning: flags.effectiveReasoning } : {}), stats: publicStats };
+    return { taskId, sessionId, status, ...(flags.model !== undefined ? { model: flags.model } : {}), result: result.trim(), salvagedOutput, blockedReason, errorMessage, errorCode, ...(retryAfterMs !== undefined ? { retryAfterMs } : {}), checkpointToken, ...(checkpointId !== undefined ? { checkpointId } : {}), checkpointGate, ...(workspaceRestoreMode !== undefined ? { workspaceRestoreMode } : {}), ...(flags.rewindNotes !== undefined && flags.rewindNotes.length > 0 ? { rewindNotes: flags.rewindNotes } : {}), ...(flags.haltedOnUserRejection === true ? { haltedOnUserRejection: true } : {}), ...(flags.remoteEnvFailures !== undefined && flags.remoteEnvFailures.length > 0 ? { remoteEnvFailures: flags.remoteEnvFailures } : {}), ...(flags.strandedHumanAnswers !== undefined && flags.strandedHumanAnswers.length > 0 ? { strandedHumanAnswers: flags.strandedHumanAnswers } : {}), ...(flags.effectiveReadFace !== undefined ? { effectiveReadFace: flags.effectiveReadFace } : {}), ...(flags.effectiveReadDenyPatterns !== undefined && flags.effectiveReadDenyPatterns.length > 0 ? { effectiveReadDenyPatterns: flags.effectiveReadDenyPatterns } : {}), ...(flags.effectiveMemoryScopes !== undefined ? { effectiveMemoryScopes: flags.effectiveMemoryScopes } : {}), ...(flags.effectiveReasoning !== undefined ? { effectiveReasoning: flags.effectiveReasoning } : {}), stats: publicStats };
 }

package/dist/core/runner/prepare-task.d.ts

@@ -200,7 +200,22 @@ export interface Prepared {
     approvalSettlement: Map<string, {
         settledBy?: import("../tool-policy.js").ApprovalSettledBy;
         approver?: string;
+        resolution?: import("../tool-policy.js").AskDenyResolution;
     }>;
+    /**
+     * The parent-thread human-rejection halt fact (see `maybeHumanRejectionHalt`): present from the
+     * moment a bare human rejection halts the turn's batch until the run ends or the NEXT provider
+     * request begins (user input continuing the run clears it). Consumers: the runner's stop gate
+     * (suppress natural-end pushback / final-verify injection — engine continuations must not restart
+     * a run a person just stopped), the turn-boundary engine steers (same reason), and the result
+     * stamp (`TaskResult.haltedOnUserRejection` — a human-halted run must not read as an ordinary
+     * completion). Engine-owned sideband, same trust reasoning as `approvalSettlement` above.
+     */
+    batchHaltRef: {
+        current?: {
+            rejectedToolCallId: string;
+        };
+    };
     /** Summed usage of nested sub-runs (sub-agents) spawned by this task's tools. */
     nestedStats: NestedUsageAccum;
     /** RB-430-a: prepare-time rewind disclosures (conversation-only branch / no snapshot backend / no file

package/dist/core/runner/prepare-task.js

@@ -20,7 +20,7 @@ import { createSubagentWorktreeHelper, forkGovernanceDenial, resolveDelegationEn
 import { createAgentTranscriptTool, AGENT_TRANSCRIPT_TOOL_NAME } from "../../agents/agent-transcript-tool.js";
 import { createSendMessageTool, SEND_MESSAGE_TOOL_NAME } from "../../agents/send-message-tool.js";
 import { SubagentRetainLedger } from "../../agents/retain-ledger.js";
-import { askApproverIdentity, checkToolPolicyProjection, combinePolicies, constraintChainDigest, constraintChainEntryOf, isApprovalSettledBy, screenApproverAttribution, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, describeThrown, refuseOutOfContractDecision, resolveAsk, toolPolicyNameSets, tryCloneArgs } from "../tool-policy.js";
+import { askApproverIdentity, checkToolPolicyProjection, combinePolicies, constraintChainDigest, constraintChainEntryOf, isApprovalSettledBy, isAskDenyResolution, screenApproverAttribution, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, describeThrown, refuseOutOfContractDecision, resolveAsk, toolPolicyNameSets, tryCloneArgs } from "../tool-policy.js";
 const PERSISTED_RULE_TOOL = "Bash";
 import { findAdmittingRule, suggestRulesForCommand } from "../permission-rule-model.js";
 import { ActiveSkillScope, createActiveSkillScopePolicy } from "./active-skill-scope.js";
@@ -277,6 +277,19 @@ function raceAbort(p, signal, onAbort) {
         p.then(finish, () => finish(onAbort()));
     });
 }
+function mcpRevocationWiring(deps) {
+    if (deps.mcpRevocations === undefined)
+        return undefined;
+    const ledger = deps.mcpRevocations;
+    return {
+        isRevoked: (name) => ledger.isRevoked(name),
+        onProbeFailure: (e) => deliverEngineNotice(deps.onNotice, {
+            code: "mcp.revocation_probe_failed",
+            message: `the mcpRevocations.isRevoked probe threw — MCP dispatch fails OPEN (no server treated as revoked) until the probe recovers: ${e instanceof Error ? e.message : String(e)}`,
+            detail: { message: e instanceof Error ? e.message : String(e) },
+        }),
+    };
+}
 async function forgetQuietly(sessions, sessionId) {
     try {
         if (sessions.forget)
@@ -301,11 +314,72 @@ function screenGateSettlement(result, settling) {
     if (attribution.defect !== undefined) {
         defects.push(`a tool-gate settlement reported an attribution this engine refuses: ${attribution.defect}; the frame carries no approver`);
     }
+    const reportedResolution = result.resolution;
+    let resolution;
+    if (reportedResolution !== undefined) {
+        if (!isAskDenyResolution(reportedResolution) || !settling) {
+            defects.push(`a tool-gate settlement reported a deny resolution "${String(reportedResolution)}" on ${settling ? "a blocked" : "an executing"} call — ` +
+                `it is one of the closed ask-deny vocabulary and only a BLOCKED call can carry one; the frame carries no resolution`);
+        }
+        else
+            resolution = reportedResolution;
+    }
     const record = {
         ...(settledBy !== undefined ? { settledBy } : {}),
         ...(attribution.approver !== undefined ? { approver: attribution.approver } : {}),
+        ...(resolution !== undefined ? { resolution } : {}),
     };
-    return { ...(settledBy !== undefined || attribution.approver !== undefined ? { record } : {}), defects };
+    return { ...(settledBy !== undefined || attribution.approver !== undefined || resolution !== undefined ? { record } : {}), defects };
+}
+function maybeHumanRejectionHalt(input) {
+    if (!input.bare || input.settledBy !== "human" || input.isDelegatedChild)
+        return undefined;
+    return {
+        reason: `This tool call was NOT executed: the user rejected the "${input.toolName}" tool call in the same ` +
+            `assistant message, which stops the rest of the batch. Nothing was run for this call — ` +
+            `re-issue it after the user's direction only if it is still needed.`,
+        details: {
+            error: "gate.batch_halted",
+            code: "gate.batch_halted",
+            rejectedToolCallId: input.toolCallId,
+            rejectedToolName: input.toolName,
+        },
+    };
+}
+const sanitizePreview = (node, depth = 0) => {
+    if (depth > 6)
+        return undefined;
+    if (typeof node === "string") {
+        return node.replace(/[\u0000-\u0008\u000b-\u001f\u007f]/g, "\u2400");
+    }
+    if (node === null || typeof node !== "object")
+        return node;
+    if (Array.isArray(node))
+        return node.map((v) => sanitizePreview(v, depth + 1));
+    const out = {};
+    for (const [k, v] of Object.entries(node)) {
+        out[sanitizePreview(k, depth + 1)] = sanitizePreview(v, depth + 1);
+    }
+    return out;
+};
+function resolveApprovalPreview(tools, toolName, args) {
+    const t = tools.find((x) => x.name === toolName || (x.aliases?.includes(toolName) ?? false));
+    if (t?.approvalPreview === undefined)
+        return undefined;
+    try {
+        const raw = t.approvalPreview(args);
+        if (raw === undefined)
+            return undefined;
+        const bytes = JSON.stringify(raw);
+        if (bytes === undefined)
+            return undefined;
+        if (bytes.length > 16_384)
+            return { truncated: true, note: `approval preview exceeded 16KiB (${bytes.length} chars serialized)` };
+        return sanitizePreview(raw);
+    }
+    catch {
+        return undefined;
+    }
 }
 function inheritedAskRuleEvidence(deps) {
     const org = deps.permissionRuleOrg === undefined ? "not_wired" : "not_adjudicated";
@@ -1030,6 +1104,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 parentThinking: () => harnessRef.current?.getThinkingLevel() ?? thinking,
                 parentReadFace: () => carrierReadFace(),
                 parentReadDenyPatterns: () => (readDenyAdditionsNormalized.length > 0 ? readDenyAdditionsNormalized : undefined),
+                ...(spec.handsReadOnly === true ? { parentHandsReadOnly: true } : {}), ...(spec.interactiveTools === false ? { parentInteractiveTools: false } : {}),
                 onNotice: deps.onNotice,
                 parentCheckpointStoreDisabled: spec.checkpointStore === null,
                 parentCenterArtifactDigest: () => centerAdoption?.artifact.artifactDigest,
@@ -1101,7 +1176,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             tools.push(createOutputTool(outputRef, spec.outputSchema, compiled.strict ? compiled.modelSchema : undefined));
         }
         mcp = lockedPreflight.mcp?.length
-            ? await materializeMcpTools(lockedPreflight.mcp, spec.principal, deps.onElicit, deps.mcpImageResizer, { reminderMark, counts: reminderDisclosureCounts })
+            ? await materializeMcpTools(lockedPreflight.mcp, spec.principal, deps.onElicit, deps.mcpImageResizer, { reminderMark, counts: reminderDisclosureCounts }, mcpRevocationWiring(deps))
             : { tools: [], toolAxes: [], warnings: [], serverInstructions: [], instructionsDelta: { pendingAdds: [], pendingRemovals: [] }, droppedTools: [], statuses: [], refresh: async () => [], dispose: async () => { } };
         for (const w of mcp.warnings)
             deps.onError?.(w, { phase: "mcp", sessionId });
@@ -3277,6 +3352,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         const preToolContexts = new Map();
         const blockedToolCalls = new Set();
         const approvalSettlement = new Map();
+        const humanBareRejections = new Set();
+        const batchHaltRef = {};
         const blockedTracked = Boolean(hooks?.postToolUse || hooks?.preToolUse || hooks?.postToolUseFailure || hooks?.postToolBatch);
         const restoreSurfaceGap = ownedEnv !== undefined && isRemoteExecutionEnv(ownedEnv) && ownedEnv.capabilities.suspendable ? missingRestoreSurface(ownedEnv) : [];
         const incompleteSuspendAdapter = restoreSurfaceGap.length > 0 ? restoreSurfaceGap : undefined;
@@ -3380,41 +3457,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     message: "policy check aborted (task timed out or cancelled)",
                 }))
                 : undefined;
-            const sanitizePreview = (node, depth = 0) => {
-                if (depth > 6)
-                    return undefined;
-                if (typeof node === "string") {
-                    return node.replace(/[\u0000-\u0008\u000b-\u001f\u007f]/g, "\u2400");
-                }
-                if (node === null || typeof node !== "object")
-                    return node;
-                if (Array.isArray(node))
-                    return node.map((v) => sanitizePreview(v, depth + 1));
-                const out = {};
-                for (const [k, v] of Object.entries(node)) {
-                    out[sanitizePreview(k, depth + 1)] = sanitizePreview(v, depth + 1);
-                }
-                return out;
-            };
-            const approvalPreviewOf = (toolName, args) => {
-                const t = tools.find((x) => x.name === toolName || (x.aliases?.includes(toolName) ?? false));
-                if (t?.approvalPreview === undefined)
-                    return undefined;
-                try {
-                    const raw = t.approvalPreview(args);
-                    if (raw === undefined)
-                        return undefined;
-                    const bytes = JSON.stringify(raw);
-                    if (bytes === undefined)
-                        return undefined;
-                    if (bytes.length > 16_384)
-                        return { truncated: true, note: `approval preview exceeded 16KiB (${bytes.length} chars serialized)` };
-                    return sanitizePreview(raw);
-                }
-                catch {
-                    return undefined;
-                }
-            };
+            const approvalPreviewOf = (toolName, args) => resolveApprovalPreview(tools, toolName, args);
             const resolveAskBound = async (decision, req) => {
                 if (inheritedUnavailableAsks.delete(req.toolCallId)) {
                     return {
@@ -3475,6 +3518,9 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         ...(toolArg !== undefined ? { toolArg } : {}),
                     });
                 }
+                if (resolved.action === "deny" && resolved.settledBy === "human" && resolved.humanRefusalNote !== true) {
+                    humanBareRejections.add(req.toolCallId);
+                }
                 return resolved;
             };
             const hooksWithPermissionDenied = hooks?.permissionDenied ? hooks : undefined;
@@ -4183,6 +4229,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 harness.on("tool_call", async (e) => {
                     blockedToolCalls.delete(e.toolCallId);
                     inheritedAskGrants.delete(e.toolCallId);
+                    humanBareRejections.delete(e.toolCallId);
                     {
                         const complianceDeny = complianceCallDenial(complianceDenies, e.toolName);
                         if (complianceDeny !== undefined) {
@@ -4209,6 +4256,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         };
                     }
                     let result;
+                    let humanBareRejection = false;
                     try {
                         result = await runToolGate({
                             onNotifyError: (f) => emitTrace(deps.tracer, () => ({ kind: "observer.notify_failed", version: 1, taskId: spec.taskId ?? sessionId, site: f.site, message: f.error.message, ts: Date.now() })),
@@ -4280,6 +4328,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         inheritedUnavailableAsks.delete(e.toolCallId);
                         inheritedAskGrants.delete(e.toolCallId);
                         foldAskClasses.delete(e.toolCallId);
+                        humanBareRejection = humanBareRejections.delete(e.toolCallId);
                     }
                     const ancestorAdmitted = ancestorSandboxAdmissions.get(e.toolCallId);
                     ancestorSandboxAdmissions.delete(e.toolCallId);
@@ -4298,11 +4347,21 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         deps.onError?.(new Error(defect), { phase: "config", sessionId });
                     if (settlement.record !== undefined)
                         approvalSettlement.set(e.toolCallId, settlement.record);
-                    return result.block
-                        ? { block: true, reason: result.reason }
-                        : result.updatedInput !== undefined
-                            ? { updatedInput: result.updatedInput }
-                            : undefined;
+                    if (result.block) {
+                        const haltRemaining = maybeHumanRejectionHalt({
+                            bare: humanBareRejection,
+                            settledBy: result.settledBy,
+                            isDelegatedChild: delegation.isDelegatedChild === true,
+                            toolName: e.toolName,
+                            toolCallId: e.toolCallId,
+                        });
+                        if (haltRemaining !== undefined) {
+                            batchHaltRef.current = { rejectedToolCallId: e.toolCallId };
+                            return { block: true, reason: result.reason, haltRemaining };
+                        }
+                        return { block: true, reason: result.reason };
+                    }
+                    return result.updatedInput !== undefined ? { updatedInput: result.updatedInput } : undefined;
                 });
             }
         }
@@ -4360,6 +4419,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         const guardAt = guardBudget(model);
         const charsPerToken = model.charsPerToken ?? DEFAULT_CHARS_PER_TOKEN;
         harness.on("context", async ({ messages }) => {
+            batchHaltRef.current = undefined;
             const healed = dropEmptyFailureAssistants(messages);
             const capped = await capAggregateToolResults(healed, {
                 store: offloadStore,
@@ -4624,7 +4684,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         const effectiveReadFaceObserved = carrierReadFace();
         const effectiveReadDenyObserved = readDenyAdditionsNormalized.length > 0 ? readDenyAdditionsNormalized.map((e) => ({ ...e })) : undefined;
         const preparedHolder = {};
-        const buildPrepared = () => ({ harness, session, sessionId, reminderMark, reminderDisclosureCounts, taskRootPath: taskRootFinal, model, thinking, compModel, mcp: mcp, ...(a2a !== undefined && a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, approvalSettlement, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), ...(effectiveReadFaceObserved !== undefined ? { effectiveReadFace: effectiveReadFaceObserved } : {}), ...(effectiveReadDenyObserved !== undefined ? { effectiveReadDenyPatterns: effectiveReadDenyObserved } : {}), effectiveMemoryScopes: memoryEffectiveScopes, cwdRef: handsCwdRef, ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), denyNarrowingPolicy, ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, suspendRef, suspendProgressRef, reviewRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, brainCallGuardrailRef, suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, gitStatusRef, listBackgroundTasks, hookIdentity, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}) });
+        const buildPrepared = () => ({ harness, session, sessionId, reminderMark, reminderDisclosureCounts, taskRootPath: taskRootFinal, model, thinking, compModel, mcp: mcp, ...(a2a !== undefined && a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, approvalSettlement, batchHaltRef, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), ...(effectiveReadFaceObserved !== undefined ? { effectiveReadFace: effectiveReadFaceObserved } : {}), ...(effectiveReadDenyObserved !== undefined ? { effectiveReadDenyPatterns: effectiveReadDenyObserved } : {}), effectiveMemoryScopes: memoryEffectiveScopes, cwdRef: handsCwdRef, ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), denyNarrowingPolicy, ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, suspendRef, suspendProgressRef, reviewRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, brainCallGuardrailRef, suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, gitStatusRef, listBackgroundTasks, hookIdentity, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}) });
         const prepared = buildPrepared();
         preparedHolder.current = prepared;
         return prepared;

package/dist/core/runner/runtask.d.ts

@@ -84,7 +84,10 @@ settledBy?: ApprovalSettledBy,
 /** design/252 G-7 — WHOSE settlement, from the same caller and the same channel as `settledBy`, and
  *  for the same reason it is a parameter: an attribution read out of a tool's own result would let a
  *  tool name the person who approved it. Omitted ⇒ this call's settlement named nobody. */
-approver?: string): {
+approver?: string, 
+/** The ask resolver's deny-arm classification — same caller, same engine-owned channel and the same
+ *  never-derived-from-`result` posture as the two above. Omitted ⇒ not an ask-resolution deny. */
+resolution?: import("../tool-policy.js").AskDenyResolution): {
     output?: unknown;
     truncated?: boolean;
     totalChars?: number;
@@ -92,6 +95,7 @@ approver?: string): {
     errorCode?: string;
     settledBy?: ApprovalSettledBy;
     approver?: string;
+    resolution?: import("../tool-policy.js").AskDenyResolution;
 };
 /**
  * scan-1/A1 — the BODY of the synthetic `tool_end` that closes a reconcile-recovered orphan. ONE

package/dist/core/runner/runtask.js

@@ -141,7 +141,7 @@ function resumeDecisionWasNegative(resume) {
 }
 const DEFERRED_REISSUE = "[DEFERRED] This tool call shared a batch with a call that suspended for durable approval, so it was " +
     "NOT executed on resume. If you still need it, issue it again now.";
-function toolEndBodyFrom(result, isError, settledBy, approver) {
+function toolEndBodyFrom(result, isError, settledBy, approver, resolution) {
     const o = toolOutputFrom(result);
     const st = structuredFrom(result);
     const det = isError ? result?.details : undefined;
@@ -154,6 +154,7 @@ function toolEndBodyFrom(result, isError, settledBy, approver) {
         ...(typeof code === "string" ? { errorCode: code } : {}),
         ...(settledBy !== undefined ? { settledBy } : {}),
         ...(approver !== undefined ? { approver } : {}),
+        ...(resolution !== undefined ? { resolution } : {}),
     };
 }
 export function reconciledToolEndBody(orphan) {
@@ -487,6 +488,7 @@ function makeTurnBoundary(prepared, stats, rs, deps) {
             rs.counters.approachNoticesSent < LIMIT_APPROACH_DEFAULT_THRESHOLDS.length &&
             prepared.suspendForResource === undefined &&
             rs.turn.lastTurnHadToolCalls &&
+            prepared.batchHaltRef.current === undefined &&
             !boundarySteered &&
             !prepared.abortController.signal.aborted) {
             const thresholds = approachCfg?.at ?? LIMIT_APPROACH_DEFAULT_THRESHOLDS;
@@ -534,7 +536,10 @@ function makeTurnBoundary(prepared, stats, rs, deps) {
             }
             emitTrace(rs.telemetry.tracer, () => ({ kind: "review.dropped", version: 1, taskId: rs.telemetry.taskId, ts: Date.now() }));
         }
-        if (prepared.lspDiagnostics && !prepared.lspDiagnostics.registry.isEmpty() && !prepared.abortController.signal.aborted) {
+        if (prepared.lspDiagnostics &&
+            !prepared.lspDiagnostics.registry.isEmpty() &&
+            !prepared.abortController.signal.aborted &&
+            prepared.batchHaltRef.current === undefined) {
             const files = prepared.lspDiagnostics.registry.drain(prepared.lspDiagnostics.runIdent);
             if (files.length > 0) {
                 queue.push({ type: "diagnostics", files, isNew: true, ...ident() });
@@ -550,6 +555,7 @@ function makeTurnBoundary(prepared, stats, rs, deps) {
             rs.attach.sizeGuidelineState !== undefined ||
             rs.attach.attachState !== undefined) &&
             !boundarySteered &&
+            prepared.batchHaltRef.current === undefined &&
             rs.counters.finalVerifyInjections === 0 &&
             !prepared.abortController.signal.aborted) {
             const due = [];
@@ -780,7 +786,7 @@ function makeTurnBoundary(prepared, stats, rs, deps) {
                 }
             }
         }
-        if (attachmentsPayload !== undefined || batchContextBlock !== undefined) {
+        if ((attachmentsPayload !== undefined || batchContextBlock !== undefined) && prepared.batchHaltRef.current === undefined) {
             const payload = attachmentsPayload !== undefined && batchContextBlock !== undefined ? `${attachmentsPayload}\n${batchContextBlock}` : (attachmentsPayload ?? batchContextBlock);
             void prepared.harness.steer(payload, { engineMinted: true }).catch(() => { });
         }
@@ -1293,7 +1299,7 @@ function makeHarnessHandlers(prepared, stats, rs, deps) {
                 reduceToolEnd(rs.attach.attachState, det);
         }
         if (postToolBatchHook !== undefined) {
-            if (prepared.blockedToolCalls.delete(event.toolCallId)) {
+            if (prepared.blockedToolCalls.delete(event.toolCallId) || event.notExecuted === true) {
                 batchArgs?.delete(event.toolCallId);
             }
             else {
@@ -1338,7 +1344,7 @@ function makeHarnessHandlers(prepared, stats, rs, deps) {
             toolName: event.toolName,
             ...(toolLabels.get(event.toolName) !== undefined ? { label: toolLabels.get(event.toolName) } : {}),
             isError: event.isError,
-            ...toolEndBodyFrom(event.result, event.isError, settlement?.settledBy, settlement?.approver),
+            ...toolEndBodyFrom(event.result, event.isError, settlement?.settledBy, settlement?.approver, settlement?.resolution),
             ...ident(),
         });
         announceWorkspaceMove();
@@ -2006,7 +2012,7 @@ export class Runner {
         };
         const unsubscribeTaskNotifications = taskNotificationQueue.subscribe((item) => {
             queue.push({ type: "task_notification", notification: item.payload, ...notificationIdent() });
-            if (notificationHarness) {
+            if (notificationHarness && prepared.batchHaltRef.current === undefined) {
                 const xml = renderTaskNotificationXml(item.payload);
                 const deliver = notificationHarness.steer(xml, { provenance: "engine-note", enginePayload: item.payload });
                 void deliver.then(() => item.onDisposition?.("queued"), () => {
@@ -2698,7 +2704,7 @@ export class Runner {
         if (stopHook || finalVerificationOn) {
             let consecutiveBlocks = 0;
             prepared.harness.setStopGate(async () => {
-                if (prepared.abortController.signal.aborted || prepared.suspendRef.token !== undefined)
+                if (prepared.abortController.signal.aborted || prepared.suspendRef.token !== undefined || prepared.batchHaltRef.current !== undefined)
                     return [];
                 if (finalVerificationOn &&
                     (rs.counters.finalVerifyInjections === 0 || (rs.counters.finalVerifyInjections === 1 && rs.counters.groundingSignalPreR9 && !rs.counters.groundingSignalPostR9)) &&
@@ -3480,6 +3486,7 @@ export class Runner {
                 model: prepared.model.id,
                 unpricedSpend: rs.telemetry.unpricedSpend,
                 rewindNotes: prepared.rewindNotes,
+                haltedOnUserRejection: prepared.batchHaltRef.current !== undefined,
                 strandedHumanAnswers,
                 remoteEnvFailures: prepared.remoteEnvFailures,
                 effectiveReadFace: prepared.effectiveReadFace,