@sema-agent/core 5.50.0 → 5.51.0

package/CHANGELOG.md

@@ -1,5 +1,68 @@
 # Changelog
 
+## 5.51.0 — 2026-08-21
+
+### Added
+- **A parent-thread BARE human rejection is a control-flow boundary** (#210; CC 223 anchor
+  `$Vo`/`cancelAndAbort`): after the person rejects a tool call with no note, the same assistant
+  batch's later side-effecting siblings no longer execute — never-started calls settle as coded
+  results (`details.{error,code}: "gate.batch_halted"`, known-not-executed wording,
+  `rejectedToolCallId`/`rejectedToolName` attached), already-executing calls finish and settle
+  honestly, and the run ends awaiting user input. Sequential, partitioned-preflight and in-stream
+  pipelines all consume ONE judgment seat; delegated children (forks included), reject-WITH-note,
+  and every non-human deny keep today's posture byte-for-byte. Engine continuation lanes
+  (stop-gate pushback, final-verify, attachment/batch-context steer, limit-approach, LSP
+  diagnostics, task notifications — the last parks losslessly) cannot revive a halted run; user
+  steer/followUp can — they ARE the awaited input. Additive faces: `TaskResult.haltedOnUserRejection`,
+  `tool_execution_end.notExecuted`, `BeforeToolCallResult.haltRemaining`. Containment form (no
+  abort teardown) is a registered cc-parity divergence.
+- **Every ask-resolution deny names its arm** (#127): `AskDenyResolution` nine-code closed set
+  (human_refused/window_expired/no_approver/blanket_allow_refused/approver_unavailable/
+  task_aborted/presentation_failed/approver_error/approver_contract) minted where each arm
+  states its own fact, carried as `PermissionDeniedPayload.resolution` (distinct from `source`)
+  onto the `tool_end` frame. Existing deny wording byte-unchanged; the gate captures only at its
+  own ask-resolution seats, so a policy cannot forge a code.
+- **`defineTool` carries the declared safety axes onto its product** (#126):
+  egress/irreversibility/reversibilityProbe/offload/offloadThresholdChars now survive into a
+  product-form `TaskSpec.tools` entry — a declared egress/irreversible tool fed as a finished
+  product previously auto-allowed with no door sounding. Declaration-takes-effect (behavior
+  narrowing): such declarations now really gate, and a product-form `egress:true+effect:"read"`
+  contradiction refuses prepare loudly. A ToolSpec-key completeness table makes the next
+  silently-dropped key a compile error.
+- **Review sampling is tail-inclusive** (#287): the spawn review reads objective+systemPrompt
+  through the layered head/interior/tail sample (12k budget, gap markers), and the auto-mode
+  classifier's 48k action block reads head-half + declared-middle + tail-half — a two-stage
+  payload (benign head, real instructions past the cut) no longer evades review. Bounds unchanged.
+- **The reversibilityProbe wait is always finite** (#128): absent `approvalTimeoutMs` falls to a
+  30s default (elapse takes the existing fail-closed tighten-to-ask arm), garbage values refuse
+  loudly to the same default, explicit 0 stays honored; a throwing/timed-out probe now reaches
+  `onHookError`/`onError(phase:"hook")` instead of being swallowed.
+- **`details.code` twins for the SendMessage admission and stop/poll families**: the five
+  admission codes (rate_limited/duplicate/hop_loop/hop_runaway/queue_full) and the stop family
+  (not_local/parked_pending_approval/park_resume_won/park_arbiter_unreachable) carry the machine
+  twin beside `error` at all nine mint sites; `UnifiedTaskOutput` grows the additive `code` seat.
+- **`mcp.revocation_probe_failed` forwarding guidance**: the seat contract and notice directory
+  now state the dedup unit precisely (once per MATERIALIZATION — a resume re-materializes and may
+  re-announce), no session attribution, operator audience by the `NOTICE_AUDIENCE` default; plus
+  an in-flight-not-chased pin (a revocation racing an already-dispatched call never retracts it).
+
+### Changed
+- Behavior narrowing (named): post-rejection siblings from "executed as usual" to "settle
+  un-executed"; a bare human rejection no longer re-invokes the model to narrate it
+  (`TaskResult.result` may be empty text); product-form tool declarations now really gate (#126).
+
+### Notes
+- Residuals ticketed, not shipped silently: a pre-rejection harness-accepted engine steer still
+  drains past the boundary (#370, single-choke harness steer entry proposed); delegated-child
+  denies fold through policy without a resolution code (observed on #370).
+- Pre-release merged-code scan dispositions (three confirmed, fixed in-tree before publish):
+  a human-halted boundary no longer DRAINS the LSP diagnostics registry (drain is a consuming
+  read — pending now survives for the continuation, the frame defers with it); `defineTool` also
+  carries `defer`/`alwaysLoad` (the defer classification reads them off spec.tools entries — a
+  product's declared deferral silently inlined its schema, and a declared inline pin lost to
+  `TaskSpec.deferTools`); the probe-deadline guard refuses values above setTimeout's 2^31-1
+  ceiling loudly (the silent ~1ms clamp it claimed to close).
+
 ## 5.50.0 — 2026-08-21
 
 ### Added

package/dist/agents/send-message-tool.js

@@ -132,7 +132,7 @@ export function createSendMessageTool(opts) {
                         : reason === "hop_loop"
                             ? `this message has already passed through ${whoLabel} too many times (a forwarding loop) — stop relaying it; act on it or drop it.`
                             : `this message's forwarding chain is too long (runaway relay) — stop relaying it; act on it or drop it.`;
-                return { content: `Message not sent: ${text}`, details: { error: reason, to }, isError: true };
+                return { content: `Message not sent: ${text}`, details: { error: reason, code: reason, to }, isError: true };
             };
             if (normalizeAgentName(to) === "main") {
                 if (opts.uplink && senderId !== undefined) {
@@ -217,7 +217,7 @@ export function createSendMessageTool(opts) {
                 if (row.status === "parked") {
                     return {
                         content: `Message not sent: ${whoT3} is parked on a pending approval — it resumes when the approval is decided (durable approval inbox), not by message delivery. Send again after it resumes.`,
-                        details: { error: "parked_pending_approval", to },
+                        details: { error: "parked_pending_approval", code: "parked_pending_approval", to },
                         isError: true,
                     };
                 }
@@ -257,7 +257,7 @@ export function createSendMessageTool(opts) {
                 if (boxFull) {
                     const queueFullReceipt = (guidance) => ({
                         content: `Message not sent: ${whoT3}'s mailbox is at its queued-message limit (${admissionConfig.maxQueuedPeerMessages}) — the message was NOT queued. ${guidance} ${DEDUP_RETRY_NOTE}`,
-                        details: { error: "queue_full", to },
+                        details: { error: "queue_full", code: "queue_full", to },
                         isError: true,
                     });
                     if (!opts.registry.beginDurableClaim(handle)) {
@@ -601,7 +601,7 @@ export function createSendMessageTool(opts) {
                     if (delivered.reason === "queue_full") {
                         return {
                             content: `Message not sent: ${who} is still starting up and its startup message buffer is full — resend in a moment. ${DEDUP_RETRY_NOTE}`,
-                            details: { error: "queue_full", to },
+                            details: { error: "queue_full", code: "queue_full", to },
                             isError: true,
                         };
                     }
@@ -609,7 +609,7 @@ export function createSendMessageTool(opts) {
                     if (nowRow?.status === "parked") {
                         return {
                             content: `Message not sent: ${who} is parked on a pending approval — it resumes when the approval is decided, not by message delivery. Send again after it resumes. ${DEDUP_RETRY_NOTE}`,
-                            details: { error: "parked_pending_approval", to },
+                            details: { error: "parked_pending_approval", code: "parked_pending_approval", to },
                             isError: true,
                         };
                     }

package/dist/agents/subagent.js

@@ -110,14 +110,14 @@ export function layeredReviewSample(text, budget = HANDBACK_REVIEW_SAMPLE_BUDGET
         return { text, readChars: total, totalChars: total, sampled: false, gaps: 0 };
     return { text: out, readChars, totalChars: total, sampled: true, gaps };
 }
-function reviewCoverageNote(fields) {
+function reviewCoverageNote(fields, author = "the child's own writing") {
     const sampled = fields.filter((f) => f.sample.sampled);
     if (sampled.length === 0)
         return undefined;
     return (sampled
         .map((f) => `${f.field}: the classifier was shown ${f.sample.readChars} of ${f.sample.totalChars} characters (UTF-16 code units) ` +
         `(layered head/middle/tail sample; the ${f.sample.gaps} skipped span(s) are marked in place as ` +
-        `"[… N chars not shown …]" — any further such marker in the text is the child's own writing, not this sampler's)`)
+        `"[… N chars not shown …]" — any further such marker in the text is ${author}, not this sampler's)`)
         .join("; ") + " — the unshown spans were NOT reviewed; treat them as unknown, not as benign.");
 }
 const HANDBACK_ASK_MESSAGE = "Subagent has finished and is handing back control to the main agent. Review the subagent's work and flag if any action may violate security policy.";
@@ -2028,14 +2028,26 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                 const spawnToolsNote = spawnToolNames.length > 0
                     ? spawnToolNames.join(", ")
                     : "(none explicitly listed — but if this deployment gave the child a real execution environment, it likely also has the standard file/shell tools: Read/Edit/Write/Bash/Grep/Glob)";
+                const objectiveSample = layeredReviewSample(prompt);
+                const systemPromptSample = childSystemPrompt != null ? layeredReviewSample(childSystemPrompt) : undefined;
+                const spawnCoverage = reviewCoverageNote([
+                    { field: "objective", sample: objectiveSample },
+                    ...(systemPromptSample ? [{ field: "systemPrompt", sample: systemPromptSample }] : []),
+                ], "the delegating agent's own writing");
+                const objectiveDisplay = layeredReviewSample(prompt, 2_000, 2);
                 const spawnVerdict = await ctx.autoModeReview.decider
                     .decide({
                     req: {
                         toolName: wantsFork ? "Agent(fork)" : "Agent",
-                        args: { objective: prompt.slice(0, 2_000), tools: spawnToolNames, systemPrompt: childSystemPrompt?.slice(0, 2_000) },
+                        args: {
+                            objective: objectiveSample.text,
+                            tools: spawnToolNames,
+                            systemPrompt: systemPromptSample?.text,
+                            ...(spawnCoverage ? { reviewCoverage: spawnCoverage } : {}),
+                        },
                         toolCallId: ctx.toolCallId,
                     },
-                    askMessage: `Reviewing a sub-agent about to be spawned. Objective: ${prompt.slice(0, 2000)}${prompt.length > 2000 ? "…" : ""}\nTools available to it: ${spawnToolsNote}`,
+                    askMessage: `Reviewing a sub-agent about to be spawned. Objective: ${objectiveDisplay.text}\nTools available to it: ${spawnToolsNote}`,
                 }, ctx.signal)
                     .catch(() => ({ kind: "unavailable", cause: "error" }));
                 if (ctx.signal?.aborted) {

package/dist/core/auto-mode-prompt.js

@@ -49,6 +49,14 @@ function excerpt(text, cap) {
         return text;
     return `${text.slice(0, cap)} [… ${text.length - cap} chars truncated]`;
 }
+function excerptTailInclusive(text, cap) {
+    if (text.length <= cap)
+        return text;
+    const half = Math.floor(cap / 2);
+    const marker = ` [… ${text.length - 2 * half} chars not shown …] `;
+    const out = `${text.slice(0, half)}${marker}${text.slice(text.length - half)}`;
+    return out.length >= text.length ? text : out;
+}
 function renderEntry(m, cap) {
     if (m.role === "user") {
         const raw = typeof m.content === "string" ? m.content : m.content.map((c) => (c.type === "text" ? c.text : `[${c.type}]`)).join("\n");
@@ -102,5 +110,5 @@ export function renderAutoModeWindow(messages, options) {
 export function renderAutoModeAction(input) {
     const ask = input.askMessage ? `\npermission gate: ${input.askMessage}` : "";
     return (`\n## New action to classify (the agent's most recent action — evaluate THIS)\n\n` +
-        `[tool_call] ${input.req.toolName} ${excerpt(JSON.stringify(input.req.args ?? {}), 48_000)}${ask}\n`);
+        `[tool_call] ${input.req.toolName} ${excerptTailInclusive(JSON.stringify(input.req.args ?? {}), 48_000)}${ask}\n`);
 }

package/dist/core/hooks.d.ts

@@ -198,6 +198,13 @@ export interface PermissionDeniedPayload {
     reason: string;
     /** Which gate source produced the deny (our `decision_reason_type` analog). */
     source: PermissionDeniedSource;
+    /** The ask resolver's own deny-arm classification, carried BESIDE `source` (two different
+     *  questions: `source` names which LAYER raised the gate; this names HOW the ask resolution
+     *  refused — a person's no vs a timeout vs headless vs an approver contract violation …). Present
+     *  only on a deny that came through an ask resolution AND whose word passed the closed-vocabulary
+     *  screen; a policy's direct deny, a hook deny, and the crash/plan-mode/compliance emissions carry
+     *  none. See {@link import("./tool-policy.js").AskDenyResolution}. */
+    resolution?: import("./tool-policy.js").AskDenyResolution;
 }
 /**
  * 1.256 复审 MED-1 — observe-only payload isolation for {@link Hooks.permissionDenied}: clone the tool
@@ -606,6 +613,14 @@ export interface ToolGateResult {
      * and no post-tool hook can write.
      */
     settledBy?: import("./tool-policy.js").ApprovalSettledBy;
+    /**
+     * The ask resolver's deny-arm classification (see {@link import("./tool-policy.js").AskDenyResolution}),
+     * present only on a BLOCK whose deny came through an ask resolution and passed the closed-vocabulary
+     * screen at the deny exit (a self-declared word on a policy's own deny is dropped there, never
+     * forwarded). Rides beside {@link settledBy} to the caller's per-call sideband and the call's
+     * `tool_end` frame — the machine-readable "why was this refused" a consumer classifies on.
+     */
+    resolution?: import("./tool-policy.js").AskDenyResolution;
     /**
      * design/252 G-7 — WHOSE settlement that was: the identifier the approval channel reported, carried
      * out verbatim beside {@link settledBy}. This layer authenticates nothing and compares nothing; the
@@ -915,7 +930,10 @@ export interface ToolGateInput {
      * probe cannot widen anything through this member.
      */
     reversibilityProbe?: (args: unknown) => import("./types.js").ReversibilityVerdict | Promise<import("./types.js").ReversibilityVerdict>;
-    /** design/77 §4: deadline (ms) for {@link reversibilityProbe}; on timeout the gate fails closed to `ask`. */
+    /** design/77 §4: deadline (ms) for {@link reversibilityProbe}; on timeout the gate fails closed to `ask`.
+     *  ABSENT ⇒ a bounded default applies (30s — the probe wait is never unbounded, even with no
+     *  {@link abortSignal}); a non-finite/negative value is refused loudly (via {@link onHookError}) to
+     *  that same default, never silently reinterpreted. `0` is honored as written (immediate deadline). */
     approvalTimeoutMs?: number;
     /** design/77 §4: the task abort signal — bounds {@link reversibilityProbe} by the task's real deadline
      *  (timeout/cancel) in addition to {@link approvalTimeoutMs}; an abort while probing fails closed to `ask`. */
@@ -937,6 +955,11 @@ export interface ToolGateInput {
      * this one carries the exception object itself to whoever runs the deployment, because a crashing hook is
      * a bug someone has to fix and the model-facing summary is bounded/sanitized. Never affects the outcome
      * (a throwing sink is swallowed).
+     *
+     * ALSO fired for a {@link reversibilityProbe} that threw or timed out (same species — a
+     * deployment-supplied callback failing while the gate holds the fail-closed line) and for a
+     * malformed {@link approvalTimeoutMs} refused to the bounded default. A task-abort rejection
+     * mid-probe is NOT reported (normal cancellation, not a defect).
      */
     onHookError?: (err: unknown) => void;
     /**

package/dist/core/hooks.js

@@ -1,4 +1,4 @@
-import { decisionText, describeThrown, refuseOutOfContractDecision } from "./tool-policy.js";
+import { decisionText, describeThrown, isAskDenyResolution, refuseOutOfContractDecision } from "./tool-policy.js";
 import { brandPolicyAskClass } from "./ask-class.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 import { mintSystemReminder } from "./reminder-mint.js";
@@ -269,6 +269,7 @@ function withProbeTimeout(p, ms, signal) {
         p.then((v) => done(resolve, v), (err) => done(reject, err));
     });
 }
+const DEFAULT_PROBE_TIMEOUT_MS = 30_000;
 export function persistedRuleMandateOf(marks) {
     return marks.egress === true
         ? "tool_marks"
@@ -293,6 +294,7 @@ export async function runToolGate(input) {
     const preToolContext = [];
     let hookAsk;
     let parkFailed;
+    let askDenyResolution;
     const notifier = createSafeNotifier(input.onNotifyError !== undefined ? { onError: input.onNotifyError } : undefined);
     if (preToolUse) {
         let r;
@@ -373,8 +375,20 @@ export async function runToolGate(input) {
         if (input.irreversibility === "maybe" && input.reversibilityProbe) {
             let reversible = false;
             const probeArgs = policyRewrite !== undefined ? policyRewrite : currentInput;
+            const suppliedProbeMs = input.approvalTimeoutMs;
+            let probeTimeoutMs;
+            if (suppliedProbeMs === undefined) {
+                probeTimeoutMs = DEFAULT_PROBE_TIMEOUT_MS;
+            }
+            else if (Number.isFinite(suppliedProbeMs) && suppliedProbeMs >= 0 && suppliedProbeMs <= 2_147_483_647) {
+                probeTimeoutMs = suppliedProbeMs;
+            }
+            else {
+                probeTimeoutMs = DEFAULT_PROBE_TIMEOUT_MS;
+                traceHookCrash(input, new Error(`approvalTimeoutMs must be a non-negative finite number no greater than 2147483647 (got ${String(suppliedProbeMs)}) — the reversibilityProbe deadline falls back to the ${DEFAULT_PROBE_TIMEOUT_MS}ms default`), notifier);
+            }
             try {
-                const verdict = await withProbeTimeout(Promise.resolve(input.reversibilityProbe(probeArgs)), input.approvalTimeoutMs, input.abortSignal);
+                const verdict = await withProbeTimeout(Promise.resolve(input.reversibilityProbe(probeArgs)), probeTimeoutMs, input.abortSignal);
                 reversible = verdict?.reversible === true;
                 if (!reversible) {
                     const raw = verdict?.reason;
@@ -383,8 +397,10 @@ export async function runToolGate(input) {
                     probeCause = normalizeProbeCause(verdict?.cause);
                 }
             }
-            catch {
+            catch (err) {
                 reversible = false;
+                if (input.abortSignal?.aborted !== true)
+                    traceHookCrash(input, err, notifier);
             }
             tighten = !reversible;
         }
@@ -671,6 +687,8 @@ export async function runToolGate(input) {
             const resolved = await resolveAsk(decision, req);
             if (resolved.action !== "ask" && resolved.approver !== undefined)
                 resolvedApprover = resolved.approver;
+            if (resolved.action === "deny" && isAskDenyResolution(resolved.resolution))
+                askDenyResolution = resolved.resolution;
             decision = resolved;
             if (resolved.action === "deny" && resolved.approverUnavailable === true && suspendAsk && parkFailed === undefined) {
                 const suspended = await suspendAsk(req, currentInput, safety, true, realApprovalOf(askBeforeResolve), askBeforeResolve.action === "ask" ? askBeforeResolve.persistedRuleShadowed : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.decisionReason : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.probeReason : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.probeCause : undefined);
@@ -771,6 +789,8 @@ export async function runToolGate(input) {
                     const rr = await resolveAsk({ ...recheck, ruleEvidence: mintRuleEvidence({ dotsAbsent: "not_adjudicated" }) }, { toolName, args: editArgs, toolCallId });
                     resolvedApprover = rr.action !== "ask" ? rr.approver : undefined;
                     if (rr.action !== "allow") {
+                        if (rr.action === "deny" && isAskDenyResolution(rr.resolution))
+                            askDenyResolution = rr.resolution;
                         editDenied = rr;
                         if (!orgRaisedThisRound)
                             denySource = "policy";
@@ -807,8 +827,9 @@ export async function runToolGate(input) {
         if (decision.updatedInput !== undefined) {
             currentInput = decision.updatedInput;
         }
+        const denyResolution = askDenyResolution;
         if (input.permissionDenied) {
-            await notifier.notifyAsync(() => input.permissionDenied?.({ toolName, input: cloneObserverInput(currentInput), toolCallId, reason: denyReason, source: denySource, ...(input.identity !== undefined ? { identity: input.identity } : {}) }), "toolGate.permissionDenied");
+            await notifier.notifyAsync(() => input.permissionDenied?.({ toolName, input: cloneObserverInput(currentInput), toolCallId, reason: denyReason, source: denySource, ...(denyResolution !== undefined ? { resolution: denyResolution } : {}), ...(input.identity !== undefined ? { identity: input.identity } : {}) }), "toolGate.permissionDenied");
         }
         const denySettledBy = decision.settledBy;
         const denyApprover = denySettledBy !== undefined ? resolvedApprover : undefined;
@@ -816,6 +837,7 @@ export async function runToolGate(input) {
             block: true,
             reason: formatHookFeedback(denyReason, input.reminderMark),
             ...(denySettledBy !== undefined ? { settledBy: denySettledBy } : {}),
+            ...(denyResolution !== undefined ? { resolution: denyResolution } : {}),
             ...(denyApprover !== undefined ? { approver: denyApprover } : {}),
             preToolContext,
         };

package/dist/core/runner/assemble-result.d.ts

@@ -112,6 +112,12 @@ export interface ResultFlags {
      *  Pure pass-through — assembly neither adds nor filters (a rewind that FAILED never reaches here; it
      *  throws at prepare and lands in the `threw` slot as a terminal errorCode). */
     rewindNotes?: TaskResult["rewindNotes"];
+    /** The run's final turn was halted by a person's BARE rejection of a tool call (the parent-thread
+     *  control-flow boundary) — echoed on `TaskResult.haltedOnUserRejection`. Pure pass-through on
+     *  every terminal: the fact is about the leg that ran, whatever terminal it reached (on the normal
+     *  path the terminal is `completed`, and this is what tells that completion apart from a natural
+     *  one — the model did not finish; the person stopped it and the run awaits their direction). */
+    haltedOnUserRejection?: boolean;
     /** design/174 final-round: call ids of answered-but-never-collected questions, echoed on
      *  `TaskResult.strandedHumanAnswers`. Pure pass-through; empty/absent ⇒ the field is omitted. The
      *  optional `onError` alert is NOT the disclosure — this mandatory result face is. */

package/dist/core/runner/assemble-result.js

@@ -165,5 +165,5 @@ export function assembleResult(spec, sessionId, final, stats, flags) {
     void _internalCompaction;
     if (flags.unpricedSpend)
         delete publicStats.costMicroUsd;
-    return { taskId, sessionId, status, ...(flags.model !== undefined ? { model: flags.model } : {}), result: result.trim(), salvagedOutput, blockedReason, errorMessage, errorCode, ...(retryAfterMs !== undefined ? { retryAfterMs } : {}), checkpointToken, ...(checkpointId !== undefined ? { checkpointId } : {}), checkpointGate, ...(workspaceRestoreMode !== undefined ? { workspaceRestoreMode } : {}), ...(flags.rewindNotes !== undefined && flags.rewindNotes.length > 0 ? { rewindNotes: flags.rewindNotes } : {}), ...(flags.remoteEnvFailures !== undefined && flags.remoteEnvFailures.length > 0 ? { remoteEnvFailures: flags.remoteEnvFailures } : {}), ...(flags.strandedHumanAnswers !== undefined && flags.strandedHumanAnswers.length > 0 ? { strandedHumanAnswers: flags.strandedHumanAnswers } : {}), ...(flags.effectiveReadFace !== undefined ? { effectiveReadFace: flags.effectiveReadFace } : {}), ...(flags.effectiveReadDenyPatterns !== undefined && flags.effectiveReadDenyPatterns.length > 0 ? { effectiveReadDenyPatterns: flags.effectiveReadDenyPatterns } : {}), ...(flags.effectiveMemoryScopes !== undefined ? { effectiveMemoryScopes: flags.effectiveMemoryScopes } : {}), ...(flags.effectiveReasoning !== undefined ? { effectiveReasoning: flags.effectiveReasoning } : {}), stats: publicStats };
+    return { taskId, sessionId, status, ...(flags.model !== undefined ? { model: flags.model } : {}), result: result.trim(), salvagedOutput, blockedReason, errorMessage, errorCode, ...(retryAfterMs !== undefined ? { retryAfterMs } : {}), checkpointToken, ...(checkpointId !== undefined ? { checkpointId } : {}), checkpointGate, ...(workspaceRestoreMode !== undefined ? { workspaceRestoreMode } : {}), ...(flags.rewindNotes !== undefined && flags.rewindNotes.length > 0 ? { rewindNotes: flags.rewindNotes } : {}), ...(flags.haltedOnUserRejection === true ? { haltedOnUserRejection: true } : {}), ...(flags.remoteEnvFailures !== undefined && flags.remoteEnvFailures.length > 0 ? { remoteEnvFailures: flags.remoteEnvFailures } : {}), ...(flags.strandedHumanAnswers !== undefined && flags.strandedHumanAnswers.length > 0 ? { strandedHumanAnswers: flags.strandedHumanAnswers } : {}), ...(flags.effectiveReadFace !== undefined ? { effectiveReadFace: flags.effectiveReadFace } : {}), ...(flags.effectiveReadDenyPatterns !== undefined && flags.effectiveReadDenyPatterns.length > 0 ? { effectiveReadDenyPatterns: flags.effectiveReadDenyPatterns } : {}), ...(flags.effectiveMemoryScopes !== undefined ? { effectiveMemoryScopes: flags.effectiveMemoryScopes } : {}), ...(flags.effectiveReasoning !== undefined ? { effectiveReasoning: flags.effectiveReasoning } : {}), stats: publicStats };
 }

package/dist/core/runner/prepare-task.d.ts

@@ -200,7 +200,22 @@ export interface Prepared {
     approvalSettlement: Map<string, {
         settledBy?: import("../tool-policy.js").ApprovalSettledBy;
         approver?: string;
+        resolution?: import("../tool-policy.js").AskDenyResolution;
     }>;
+    /**
+     * The parent-thread human-rejection halt fact (see `maybeHumanRejectionHalt`): present from the
+     * moment a bare human rejection halts the turn's batch until the run ends or the NEXT provider
+     * request begins (user input continuing the run clears it). Consumers: the runner's stop gate
+     * (suppress natural-end pushback / final-verify injection — engine continuations must not restart
+     * a run a person just stopped), the turn-boundary engine steers (same reason), and the result
+     * stamp (`TaskResult.haltedOnUserRejection` — a human-halted run must not read as an ordinary
+     * completion). Engine-owned sideband, same trust reasoning as `approvalSettlement` above.
+     */
+    batchHaltRef: {
+        current?: {
+            rejectedToolCallId: string;
+        };
+    };
     /** Summed usage of nested sub-runs (sub-agents) spawned by this task's tools. */
     nestedStats: NestedUsageAccum;
     /** RB-430-a: prepare-time rewind disclosures (conversation-only branch / no snapshot backend / no file

package/dist/core/runner/prepare-task.js

@@ -20,7 +20,7 @@ import { createSubagentWorktreeHelper, forkGovernanceDenial, resolveDelegationEn
 import { createAgentTranscriptTool, AGENT_TRANSCRIPT_TOOL_NAME } from "../../agents/agent-transcript-tool.js";
 import { createSendMessageTool, SEND_MESSAGE_TOOL_NAME } from "../../agents/send-message-tool.js";
 import { SubagentRetainLedger } from "../../agents/retain-ledger.js";
-import { askApproverIdentity, checkToolPolicyProjection, combinePolicies, constraintChainDigest, constraintChainEntryOf, isApprovalSettledBy, screenApproverAttribution, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, describeThrown, refuseOutOfContractDecision, resolveAsk, toolPolicyNameSets, tryCloneArgs } from "../tool-policy.js";
+import { askApproverIdentity, checkToolPolicyProjection, combinePolicies, constraintChainDigest, constraintChainEntryOf, isApprovalSettledBy, isAskDenyResolution, screenApproverAttribution, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, describeThrown, refuseOutOfContractDecision, resolveAsk, toolPolicyNameSets, tryCloneArgs } from "../tool-policy.js";
 const PERSISTED_RULE_TOOL = "Bash";
 import { findAdmittingRule, suggestRulesForCommand } from "../permission-rule-model.js";
 import { ActiveSkillScope, createActiveSkillScopePolicy } from "./active-skill-scope.js";
@@ -314,11 +314,72 @@ function screenGateSettlement(result, settling) {
     if (attribution.defect !== undefined) {
         defects.push(`a tool-gate settlement reported an attribution this engine refuses: ${attribution.defect}; the frame carries no approver`);
     }
+    const reportedResolution = result.resolution;
+    let resolution;
+    if (reportedResolution !== undefined) {
+        if (!isAskDenyResolution(reportedResolution) || !settling) {
+            defects.push(`a tool-gate settlement reported a deny resolution "${String(reportedResolution)}" on ${settling ? "a blocked" : "an executing"} call — ` +
+                `it is one of the closed ask-deny vocabulary and only a BLOCKED call can carry one; the frame carries no resolution`);
+        }
+        else
+            resolution = reportedResolution;
+    }
     const record = {
         ...(settledBy !== undefined ? { settledBy } : {}),
         ...(attribution.approver !== undefined ? { approver: attribution.approver } : {}),
+        ...(resolution !== undefined ? { resolution } : {}),
     };
-    return { ...(settledBy !== undefined || attribution.approver !== undefined ? { record } : {}), defects };
+    return { ...(settledBy !== undefined || attribution.approver !== undefined || resolution !== undefined ? { record } : {}), defects };
+}
+function maybeHumanRejectionHalt(input) {
+    if (!input.bare || input.settledBy !== "human" || input.isDelegatedChild)
+        return undefined;
+    return {
+        reason: `This tool call was NOT executed: the user rejected the "${input.toolName}" tool call in the same ` +
+            `assistant message, which stops the rest of the batch. Nothing was run for this call — ` +
+            `re-issue it after the user's direction only if it is still needed.`,
+        details: {
+            error: "gate.batch_halted",
+            code: "gate.batch_halted",
+            rejectedToolCallId: input.toolCallId,
+            rejectedToolName: input.toolName,
+        },
+    };
+}
+const sanitizePreview = (node, depth = 0) => {
+    if (depth > 6)
+        return undefined;
+    if (typeof node === "string") {
+        return node.replace(/[\u0000-\u0008\u000b-\u001f\u007f]/g, "\u2400");
+    }
+    if (node === null || typeof node !== "object")
+        return node;
+    if (Array.isArray(node))
+        return node.map((v) => sanitizePreview(v, depth + 1));
+    const out = {};
+    for (const [k, v] of Object.entries(node)) {
+        out[sanitizePreview(k, depth + 1)] = sanitizePreview(v, depth + 1);
+    }
+    return out;
+};
+function resolveApprovalPreview(tools, toolName, args) {
+    const t = tools.find((x) => x.name === toolName || (x.aliases?.includes(toolName) ?? false));
+    if (t?.approvalPreview === undefined)
+        return undefined;
+    try {
+        const raw = t.approvalPreview(args);
+        if (raw === undefined)
+            return undefined;
+        const bytes = JSON.stringify(raw);
+        if (bytes === undefined)
+            return undefined;
+        if (bytes.length > 16_384)
+            return { truncated: true, note: `approval preview exceeded 16KiB (${bytes.length} chars serialized)` };
+        return sanitizePreview(raw);
+    }
+    catch {
+        return undefined;
+    }
 }
 function inheritedAskRuleEvidence(deps) {
     const org = deps.permissionRuleOrg === undefined ? "not_wired" : "not_adjudicated";
@@ -3291,6 +3352,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         const preToolContexts = new Map();
         const blockedToolCalls = new Set();
         const approvalSettlement = new Map();
+        const humanBareRejections = new Set();
+        const batchHaltRef = {};
         const blockedTracked = Boolean(hooks?.postToolUse || hooks?.preToolUse || hooks?.postToolUseFailure || hooks?.postToolBatch);
         const restoreSurfaceGap = ownedEnv !== undefined && isRemoteExecutionEnv(ownedEnv) && ownedEnv.capabilities.suspendable ? missingRestoreSurface(ownedEnv) : [];
         const incompleteSuspendAdapter = restoreSurfaceGap.length > 0 ? restoreSurfaceGap : undefined;
@@ -3394,41 +3457,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     message: "policy check aborted (task timed out or cancelled)",
                 }))
                 : undefined;
-            const sanitizePreview = (node, depth = 0) => {
-                if (depth > 6)
-                    return undefined;
-                if (typeof node === "string") {
-                    return node.replace(/[\u0000-\u0008\u000b-\u001f\u007f]/g, "\u2400");
-                }
-                if (node === null || typeof node !== "object")
-                    return node;
-                if (Array.isArray(node))
-                    return node.map((v) => sanitizePreview(v, depth + 1));
-                const out = {};
-                for (const [k, v] of Object.entries(node)) {
-                    out[sanitizePreview(k, depth + 1)] = sanitizePreview(v, depth + 1);
-                }
-                return out;
-            };
-            const approvalPreviewOf = (toolName, args) => {
-                const t = tools.find((x) => x.name === toolName || (x.aliases?.includes(toolName) ?? false));
-                if (t?.approvalPreview === undefined)
-                    return undefined;
-                try {
-                    const raw = t.approvalPreview(args);
-                    if (raw === undefined)
-                        return undefined;
-                    const bytes = JSON.stringify(raw);
-                    if (bytes === undefined)
-                        return undefined;
-                    if (bytes.length > 16_384)
-                        return { truncated: true, note: `approval preview exceeded 16KiB (${bytes.length} chars serialized)` };
-                    return sanitizePreview(raw);
-                }
-                catch {
-                    return undefined;
-                }
-            };
+            const approvalPreviewOf = (toolName, args) => resolveApprovalPreview(tools, toolName, args);
             const resolveAskBound = async (decision, req) => {
                 if (inheritedUnavailableAsks.delete(req.toolCallId)) {
                     return {
@@ -3489,6 +3518,9 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         ...(toolArg !== undefined ? { toolArg } : {}),
                     });
                 }
+                if (resolved.action === "deny" && resolved.settledBy === "human" && resolved.humanRefusalNote !== true) {
+                    humanBareRejections.add(req.toolCallId);
+                }
                 return resolved;
             };
             const hooksWithPermissionDenied = hooks?.permissionDenied ? hooks : undefined;
@@ -4197,6 +4229,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 harness.on("tool_call", async (e) => {
                     blockedToolCalls.delete(e.toolCallId);
                     inheritedAskGrants.delete(e.toolCallId);
+                    humanBareRejections.delete(e.toolCallId);
                     {
                         const complianceDeny = complianceCallDenial(complianceDenies, e.toolName);
                         if (complianceDeny !== undefined) {
@@ -4223,6 +4256,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         };
                     }
                     let result;
+                    let humanBareRejection = false;
                     try {
                         result = await runToolGate({
                             onNotifyError: (f) => emitTrace(deps.tracer, () => ({ kind: "observer.notify_failed", version: 1, taskId: spec.taskId ?? sessionId, site: f.site, message: f.error.message, ts: Date.now() })),
@@ -4294,6 +4328,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         inheritedUnavailableAsks.delete(e.toolCallId);
                         inheritedAskGrants.delete(e.toolCallId);
                         foldAskClasses.delete(e.toolCallId);
+                        humanBareRejection = humanBareRejections.delete(e.toolCallId);
                     }
                     const ancestorAdmitted = ancestorSandboxAdmissions.get(e.toolCallId);
                     ancestorSandboxAdmissions.delete(e.toolCallId);
@@ -4312,11 +4347,21 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         deps.onError?.(new Error(defect), { phase: "config", sessionId });
                     if (settlement.record !== undefined)
                         approvalSettlement.set(e.toolCallId, settlement.record);
-                    return result.block
-                        ? { block: true, reason: result.reason }
-                        : result.updatedInput !== undefined
-                            ? { updatedInput: result.updatedInput }
-                            : undefined;
+                    if (result.block) {
+                        const haltRemaining = maybeHumanRejectionHalt({
+                            bare: humanBareRejection,
+                            settledBy: result.settledBy,
+                            isDelegatedChild: delegation.isDelegatedChild === true,
+                            toolName: e.toolName,
+                            toolCallId: e.toolCallId,
+                        });
+                        if (haltRemaining !== undefined) {
+                            batchHaltRef.current = { rejectedToolCallId: e.toolCallId };
+                            return { block: true, reason: result.reason, haltRemaining };
+                        }
+                        return { block: true, reason: result.reason };
+                    }
+                    return result.updatedInput !== undefined ? { updatedInput: result.updatedInput } : undefined;
                 });
             }
         }
@@ -4374,6 +4419,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         const guardAt = guardBudget(model);
         const charsPerToken = model.charsPerToken ?? DEFAULT_CHARS_PER_TOKEN;
         harness.on("context", async ({ messages }) => {
+            batchHaltRef.current = undefined;
             const healed = dropEmptyFailureAssistants(messages);
             const capped = await capAggregateToolResults(healed, {
                 store: offloadStore,
@@ -4638,7 +4684,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         const effectiveReadFaceObserved = carrierReadFace();
         const effectiveReadDenyObserved = readDenyAdditionsNormalized.length > 0 ? readDenyAdditionsNormalized.map((e) => ({ ...e })) : undefined;
         const preparedHolder = {};
-        const buildPrepared = () => ({ harness, session, sessionId, reminderMark, reminderDisclosureCounts, taskRootPath: taskRootFinal, model, thinking, compModel, mcp: mcp, ...(a2a !== undefined && a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, approvalSettlement, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), ...(effectiveReadFaceObserved !== undefined ? { effectiveReadFace: effectiveReadFaceObserved } : {}), ...(effectiveReadDenyObserved !== undefined ? { effectiveReadDenyPatterns: effectiveReadDenyObserved } : {}), effectiveMemoryScopes: memoryEffectiveScopes, cwdRef: handsCwdRef, ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), denyNarrowingPolicy, ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, suspendRef, suspendProgressRef, reviewRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, brainCallGuardrailRef, suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, gitStatusRef, listBackgroundTasks, hookIdentity, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}) });
+        const buildPrepared = () => ({ harness, session, sessionId, reminderMark, reminderDisclosureCounts, taskRootPath: taskRootFinal, model, thinking, compModel, mcp: mcp, ...(a2a !== undefined && a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, approvalSettlement, batchHaltRef, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), ...(effectiveReadFaceObserved !== undefined ? { effectiveReadFace: effectiveReadFaceObserved } : {}), ...(effectiveReadDenyObserved !== undefined ? { effectiveReadDenyPatterns: effectiveReadDenyObserved } : {}), effectiveMemoryScopes: memoryEffectiveScopes, cwdRef: handsCwdRef, ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), denyNarrowingPolicy, ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, suspendRef, suspendProgressRef, reviewRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, brainCallGuardrailRef, suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, gitStatusRef, listBackgroundTasks, hookIdentity, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}) });
         const prepared = buildPrepared();
         preparedHolder.current = prepared;
         return prepared;

package/dist/core/runner/runtask.d.ts

@@ -84,7 +84,10 @@ settledBy?: ApprovalSettledBy,
 /** design/252 G-7 — WHOSE settlement, from the same caller and the same channel as `settledBy`, and
  *  for the same reason it is a parameter: an attribution read out of a tool's own result would let a
  *  tool name the person who approved it. Omitted ⇒ this call's settlement named nobody. */
-approver?: string): {
+approver?: string, 
+/** The ask resolver's deny-arm classification — same caller, same engine-owned channel and the same
+ *  never-derived-from-`result` posture as the two above. Omitted ⇒ not an ask-resolution deny. */
+resolution?: import("../tool-policy.js").AskDenyResolution): {
     output?: unknown;
     truncated?: boolean;
     totalChars?: number;
@@ -92,6 +95,7 @@ approver?: string): {
     errorCode?: string;
     settledBy?: ApprovalSettledBy;
     approver?: string;
+    resolution?: import("../tool-policy.js").AskDenyResolution;
 };
 /**
  * scan-1/A1 — the BODY of the synthetic `tool_end` that closes a reconcile-recovered orphan. ONE