@sema-agent/core 5.50.0 → 5.52.0

package/dist/core/trace.d.ts

@@ -142,7 +142,7 @@ export type TraceEvent = {
 } | {
     /**
      * How a task's requested reasoning intensity RESOLVED against the model's real capability (design/96 S6).
-     * Emitted once at task start when thinking is on, so a deployment can SEE — not silently swallow (§E
+     * Emitted at task start when thinking is on, so a deployment can SEE — not silently swallow (§E
      * honesty red-line) — that a binary provider ignored the tier (`graded:false`), that an effort endpoint
      * clamped it down (`clamped:true`), or that a NON-reasoning model dropped the request entirely
      * (`dropped:true` — the frame fires for that model too; it used to be the one arm with no report).
@@ -150,6 +150,18 @@ export type TraceEvent = {
      * task's PRIMARY serving model at leg entry (same law as `TaskResult.model`): a mid-run
      * degradation does not re-emit this frame — the switch is observed on its own seats
      * (`TaskResult.degraded`).
+     *
+     * A SECOND frame follows, for the same taskId, in exactly one case: the leg's FIRST
+     * committed request reported wire facts that CHANGE the resolution the task-start frame claimed
+     * (today: the anthropic budget path's cap-wins skip, where a hard per-request output cap too small
+     * to host a legal thinking budget deletes the thinking block — so the honest report is
+     * `dropped:true`, not the gradient the entry frame guessed). The correction is deduped (a first
+     * request that changes nothing emits nothing) and capped at one (only the FIRST committed request
+     * is consumed, so the leg's nested internal calls — compaction summary, side query — cannot
+     * rewrite the leg's posture). A consumer that keeps only the LATEST frame per taskId is therefore
+     * always reading the truth, and one that kept only the first now under-reports a drop it could not
+     * have seen before. The result-face twin `TaskResult.effectiveReasoning` moves with it — the two
+     * faces are one mint at every instant.
      */
     kind: "reasoning.resolved";
     version: 1;

package/dist/core/types.d.ts

@@ -270,7 +270,8 @@ export interface ToolSpec<TParams extends TSchema = TSchema> {
      * design/77 §4: optional deployment-injected probe for an `irreversibility:"maybe"` tool. Given the call's
      * (post-hook) args, it reports whether THIS specific call is reversible. The gate calls it ONLY when the
      * surviving decision is `allow` and `irreversibility` resolves to `"maybe"`; it is time-bounded (the
-     * approval timeout) and **fail-closed**: a non-`reversible` verdict, a timeout, or a throw all tighten to
+     * approval timeout when configured, a 30s default when absent — the probe wait is always finite) and
+     * **fail-closed**: a non-`reversible` verdict, a timeout, or a throw all tighten to
      * `ask`. Declaring this probe defaults `irreversibility` to `"maybe"`. It is read from the spec at
      * prepare-time and captured in a closure — NOT a tool argument — so the model cannot monkey-patch it.
      *
@@ -2898,15 +2899,25 @@ export interface TaskResult {
      * (`requested`/`effective`/`graded`/`clamped`/`format`/`endpoint`, plus `dropped:true` when a
      * non-reasoning model dropped the request entirely — field semantics on
      * {@link import("../brain/reasoning.js").ResolvedReasoning}). It is the SAME resolver output the
-     * `reasoning.resolved` trace frame carries, computed once per leg — the two faces cannot tell different
-     * stories; this seat serves consumers without a tracer (the trace frame is the deployment-observability
-     * face, this is the caller face).
+     * `reasoning.resolved` trace frame carries — the two faces cannot tell different stories; this seat
+     * serves consumers without a tracer (the trace frame is the deployment-observability face, this is the
+     * caller face).
      *
      * **In-presence condition** — mirrors the trace frame exactly: present on every terminal of a leg that ran
      * with a REQUESTED thinking tier other than off/unset (the `spec > role > model.defaultThinking` chain);
      * absent when thinking was off/unset for the leg, and on prepare failures (the resolution is minted after
      * prepare). On a resumed task each leg re-resolves against the leg's own serving model.
      *
+     * **Per-request correction** — the leg-entry mint runs before any request exists, so it can only
+     * describe the model's CAPABILITY. When the leg's FIRST committed request reports wire facts that change
+     * that answer, the seat is re-resolved against them by the same resolver and the trace twin is re-emitted
+     * with it. Today that is one arm: the anthropic budget path's cap-wins skip — a HARD per-request output
+     * cap too small to host a legal thinking budget deletes the thinking block, so a leg capped that way now
+     * reports `effective:"off"`/`dropped:true` instead of claiming the gradient the wire never carried. Only
+     * the FIRST committed request is consumed: the seat stays a leg-ENTRY snapshot (see the degradation law
+     * below), and the leg's nested internal brain calls (compaction summary, tool-invoked side query) carry
+     * their own caps and must never restate the leg's posture.
+     *
      * **Degradation law** — same as {@link model}, whose resolution this is: the seat describes the leg's
      * PRIMARY serving model at leg entry. A mid-run degradation (reactive fallback / near-budget switch)
      * changes the serving model WITHOUT re-minting this seat or its trace twin — read {@link degraded} to see
@@ -3107,6 +3118,19 @@ export interface TaskResult {
         /** Human-readable statement of what did NOT happen and why — safe to show a user verbatim. */
         message: string;
     }>;
+    /**
+     * Present (`true`) exactly when the run's FINAL turn was halted by a person's BARE rejection of a
+     * tool call — the parent-thread control-flow boundary: the rejected call's same-message siblings
+     * that had not started were settled un-executed (each an error result coded `gate.batch_halted`),
+     * and the engine deliberately did NOT re-invoke the model, so the run ends awaiting the user's
+     * direction. On this path `status` is still `"completed"` (nothing failed, nothing is suspended,
+     * the session is continuable as ever) — this field is what tells such an end apart from a natural
+     * finish: `result` text is whatever the model had produced BEFORE the rejection (often empty), and
+     * a consumer surface should read the state as "stopped by the user, awaiting their direction",
+     * never as "the task finished its work". Absent everywhere else — including when queued user input
+     * (a steer/follow-up) continued the run past the rejection and it later ended naturally.
+     */
+    haltedOnUserRejection?: true;
     /**
      * The deliveries of AskUserQuestion calls a person ANSWERED but whose call never executed to collect
      * the answer (the leg ended first — abort, batch teardown, or a loop failure). Rides EVERY terminal
@@ -3665,6 +3689,21 @@ export type TaskEvent = ({
      * must not treat "absent" as "a human decided".
      */
     settledBy?: import("./tool-policy.js").ApprovalSettledBy;
+    /**
+     * HOW the ask resolution refused, when this frame closes a call an in-process ask resolution
+     * DENIED — the closed vocabulary of {@link import("./tool-policy.js").AskDenyResolution}
+     * (`"human_refused"`, `"window_expired"`, `"no_approver"`, `"blanket_allow_refused"`,
+     * `"approver_unavailable"`, `"task_aborted"`, `"presentation_failed"`, `"approver_error"`,
+     * `"approver_contract"`). Finer-grained than {@link settledBy} (which only says what KIND of
+     * end a settled wait had): this classifies the REFUSAL ARM itself, minted by the resolver at
+     * the arm that composed the deny and carried verbatim on the engine-owned settlement sideband
+     * — never derived from the result text or writable by a tool/policy (an out-of-vocabulary or
+     * self-declared word is dropped at the screens, with a defect reported on the deployment's
+     * error face). ABSENT on every frame that was not such a deny — every executed call, every
+     * policy/hook direct deny, and the durable/decide lane's settlements (which carry their own
+     * `settledBy`/reason instead). A consumer must not read a semantic out of the absence.
+     */
+    resolution?: import("./tool-policy.js").AskDenyResolution;
     /**
      * design/252 G-7 — WHOSE settlement that was: the identifier the approval channel reported for
      * the party that ended this wait, beside the {@link settledBy} word that says what KIND of end
@@ -4732,7 +4771,9 @@ export interface EngineNotice {
      *    child build, not de-duplicated across builds: each spec is a distinct fact.
      *  - `"mcp.revocation_probe_failed"` (design/338) — the deployment's `mcpRevocations.isRevoked`
      *    probe threw; MCP dispatch FAILS OPEN (revocation is a tightening face) and this announces
-     *    once per run. `detail: { message }`. The refusal itself (`mcp.server_revoked`) is a tool
+     *    once per materialization (a resume re-materializes and may announce again). `detail: { message }`
+     *    — no sessionId (a deployment wiring fact, not session-attributed), `"operator"` audience by
+     *    the {@link NOTICE_AUDIENCE} default. The refusal itself (`mcp.server_revoked`) is a tool
      *    RESULT code, not a notice.
      *  - `"config.models_swapped"` — `Runner.swapModels` replaced the model catalog generation
      *    (zero-restart model switching). `detail: { models, tiers }` — key COUNTS only, never the
@@ -4910,7 +4951,11 @@ export interface RunnerDeps {
      * `mcp.server_revoked` with known-not-executed wording; in-flight calls a revocation raced are
      * deliberately not chased (the threat shape is "new calls after removal"). Absent seat = the
      * pre-338 semantics. A THROWING probe fails open (revocation is a tightening face — a broken
-     * probe must not brick every MCP call) with a once-per-run `mcp.revocation_probe_failed` notice.
+     * probe must not brick every MCP call) with a once-per-MATERIALIZATION `mcp.revocation_probe_failed`
+     * notice (a resume re-materializes and may announce again — the standing condition is re-news at
+     * each fresh mount, never per-call). The notice is a deployment wiring fact: `detail: { message }`
+     * only, no session attribution, `"operator"` audience by the {@link NOTICE_AUDIENCE} default — a
+     * wire projector forwards it operator-tier and needs no per-session de-duplication of its own.
      */
     mcpRevocations?: {
         isRevoked(serverName: string): boolean;

package/dist/engine/harness/agent-harness.d.ts

@@ -20,6 +20,13 @@ export interface UserMessageProvenance {
     /** [c209-C] R3: engine-injected note whose content must stay VISIBLE in derived views (diagnostics,
      *  task notifications, steering, recall) but never under user authority — see UserMessage.provenance. */
     provenance?: "engine-note";
+    /** The frame's CONTENT is caller/supervisor speech relayed by the engine (a TaskStream steer), not
+     *  engine-authored guidance. Rides only WITH `provenance:"engine-note"` (the projection semantics are
+     *  identical — visible, never `[user]` authority); what it changes is the run-control judgment: the
+     *  human-halt hold below treats a caller-authored frame as USER-provenance input (always passes),
+     *  while an engine-authored one is held. Minter-stated at the single relay seam that mints such
+     *  frames — never inferred from text. Metadata only; not persisted on the message. */
+    callerAuthored?: true;
     /** RB-30 terminal fix — an OPAQUE payload the engine rides on this queued message (the runner's
      *  task-notification frame). Never serialized, never interpreted by the harness: if the message is
      *  still undrained at agent_end, the payload is handed back through `onUndrainedEngineNotes` so
@@ -98,6 +105,22 @@ export declare class AgentHarness<TSkill extends Skill = Skill, TPromptTemplate
      *  Advisory (swallow-guarded at the call sites via the runner's own closure); never re-entered
      *  for the same payload — consumption deletes the sidecar entry in the same step. */
     onEngineNoteConsumed?: (payload: unknown) => void;
+    /** Runner-set HOLD — the single gate for every engine-authored injection against the run's live
+     *  human-halt fact. When it reports true (a person's bare rejection halted the run at this
+     *  boundary, and only that person's own input may continue it):
+     *   · a NEW engine-authored steer/followUp is refused at entry (the caller's existing rejection
+     *     path parks the payload for the session's next run — same lane an idle-race refusal takes);
+     *   · engine-authored frames ALREADY queued are not drained — they stay queued, delayed past the
+     *     halted boundary: delivered at the next un-halted boundary if the user's own queued input
+     *     legitimately continues the run, otherwise handed to the terminal sweep (payload frames park
+     *     losslessly; payload-less boundary advisories end with the run, the same best-effort fate
+     *     their mint sites already accept for a final turn).
+     *  Caller/user-provenance input always passes — it is the awaited direction. One predicate here
+     *  instead of a per-lane check at every injection site: a future engine lane that never heard of
+     *  the halt is held by construction rather than by remembering. `nextTurn` is deliberately NOT
+     *  gated: its splice opens a NEW run (idle-park redelivery), and a halt belongs to the run that
+     *  minted it. */
+    engineInjectionsHeld?: () => boolean;
     /** RB-30 codex F1/F2: shared recovery sweep — collects engine-note payloads from the given queues
      *  in DELIVERY order (steer before followUp, each queue forward — the live loop serves steering
      *  first, so the recovered redelivery must not present "later" frames ahead of "now/next"),
@@ -203,6 +226,13 @@ export declare class AgentHarness<TSkill extends Skill = Skill, TPromptTemplate
      *  The idle check is deliberately NOT here: its message differs per lane, and nextTurn() legitimately has
      *  none (queueing the NEXT prompt while idle is exactly what it is for). */
     private enqueueInjection;
+    /** The human-halt hold's ENTRY half (see {@link engineInjectionsHeld}): a new engine-authored
+     *  injection during a halt is refused before it can queue — the refusal is the caller's park
+     *  signal (the same posture as the backlog-cap refusal above: pend per session, redeliver on the
+     *  session's next run; nothing is lost). Belt-and-braces beside the drain-side hold: today's
+     *  engine lanes each check the halt fact before injecting, so this arm exists for the lane that
+     *  does not — including the one not written yet. */
+    private refuseHeldEngineInjection;
     steer(text: string, options?: {
         images?: ImageContent[];
     } & UserMessageProvenance): Promise<void>;

package/dist/engine/harness/agent-harness.js

@@ -34,6 +34,14 @@ function createUserMessage(text, images, provenance) {
     };
 }
 const engineNotePayloads = new WeakMap();
+const engineAuthoredInjections = new WeakSet();
+function isEngineAuthoredInjection(options) {
+    if (options === undefined)
+        return false;
+    if (options.engineMinted === true || options.enginePayload !== undefined)
+        return true;
+    return options.provenance === "engine-note" && options.callerAuthored !== true;
+}
 const ENGINE_NOTE_STEER_BACKLOG_CAP = 50;
 function createFailureMessage(model, error, aborted) {
     return {
@@ -160,6 +168,7 @@ export class AgentHarness {
     onUndrainedEngineNotes;
     onUndrainedUserInputs;
     onEngineNoteConsumed;
+    engineInjectionsHeld;
     recoverUndrainedEngineNotes() {
         this.sweepUndrainedEngineNotes([this.nextTurnQueue, this.steerQueue, this.followUpQueue]);
     }
@@ -184,7 +193,10 @@ export class AgentHarness {
         }
     }
     announceUndrainedUserInputs() {
-        const counts = { steer: this.steerQueue.length, followUp: this.followUpQueue.length };
+        const counts = {
+            steer: this.steerQueue.filter((m) => !engineAuthoredInjections.has(m)).length,
+            followUp: this.followUpQueue.filter((m) => !engineAuthoredInjections.has(m)).length,
+        };
         if ((counts.steer > 0 || counts.followUp > 0) && this.onUndrainedUserInputs) {
             try {
                 this.onUndrainedUserInputs(counts);
@@ -439,13 +451,26 @@ export class AgentHarness {
         };
     }
     async drainQueuedMessages(queue, mode) {
-        let count = mode === "all" ? queue.length : 1;
-        if (mode !== "all" && queue.length > 1 && engineNotePayloads.has(queue[0])) {
-            count = 1;
-            while (count < queue.length && engineNotePayloads.has(queue[count]))
-                count++;
+        let messages;
+        if (this.engineInjectionsHeld?.() === true) {
+            messages = [];
+            const limit = mode === "all" ? Number.POSITIVE_INFINITY : 1;
+            for (let i = 0; i < queue.length && messages.length < limit; i++) {
+                if (engineAuthoredInjections.has(queue[i]))
+                    continue;
+                messages.push(...queue.splice(i, 1));
+                i--;
+            }
+        }
+        else {
+            let count = mode === "all" ? queue.length : 1;
+            if (mode !== "all" && queue.length > 1 && engineNotePayloads.has(queue[0])) {
+                count = 1;
+                while (count < queue.length && engineNotePayloads.has(queue[count]))
+                    count++;
+            }
+            messages = queue.splice(0, count);
         }
-        const messages = queue.splice(0, count);
         if (messages.length === 0) {
             return messages;
         }
@@ -759,19 +784,28 @@ export class AgentHarness {
         const m = createUserMessage(text, options?.images, options);
         if (options?.enginePayload !== undefined)
             engineNotePayloads.set(m, options.enginePayload);
+        if (isEngineAuthoredInjection(options))
+            engineAuthoredInjections.add(m);
         queue.push(m);
         await this.emitQueueUpdate();
     }
+    refuseHeldEngineInjection(options) {
+        if (isEngineAuthoredInjection(options) && this.engineInjectionsHeld?.() === true) {
+            throw new AgentHarnessError("invalid_state", "engine-authored injection refused: the run is halted awaiting the user's own direction — park the payload for the session's next run");
+        }
+    }
     async steer(text, options) {
         if (this.phase === "idle") {
             throw new AgentHarnessError("invalid_state", "Cannot steer while idle");
         }
+        this.refuseHeldEngineInjection(options);
         await this.enqueueInjection(this.steerQueue, text, options);
     }
     async followUp(text, options) {
         if (this.phase === "idle") {
             throw new AgentHarnessError("invalid_state", "Cannot follow up while idle");
         }
+        this.refuseHeldEngineInjection(options);
         await this.enqueueInjection(this.followUpQueue, text, options);
     }
     async nextTurn(text, options) {

package/dist/engine/loop/agent-loop.js

@@ -490,12 +490,14 @@ async function executeToolCallsSequential(currentContext, assistantMessage, tool
         });
         const preparation = await prepareToolCall(currentContext, assistantMessage, toolCall, config, signal);
         let finalized;
+        let halt;
         if (preparation.kind === "immediate") {
             finalized = {
                 toolCall,
                 result: preparation.result,
                 isError: preparation.isError,
             };
+            halt = preparation.halt;
         }
         else {
             finalized = await executePreparedWithDisclosure(currentContext, assistantMessage, preparation, config, signal, emit);
@@ -505,6 +507,16 @@ async function executeToolCallsSequential(currentContext, assistantMessage, tool
         await emitToolResultMessage(toolResultMessage, emit);
         finalizedCalls.push(finalized);
         messages.push(toolResultMessage);
+        if (halt !== undefined) {
+            for (const remaining of toolCalls.slice(i + 1)) {
+                if (signal?.aborted)
+                    break;
+                const settled = await settleHaltedToolCall(remaining, halt, emit);
+                finalizedCalls.push(settled.finalized);
+                messages.push(settled.message);
+            }
+            return { messages, terminate: true };
+        }
         if (signal?.aborted) {
             break;
         }
@@ -514,6 +526,33 @@ async function executeToolCallsSequential(currentContext, assistantMessage, tool
         terminate: shouldTerminateToolBatch(finalizedCalls),
     };
 }
+async function settleHaltedToolCall(toolCall, halt, emit) {
+    await emit({
+        type: "tool_execution_start",
+        toolCallId: toolCall.id,
+        toolName: toolCall.name,
+        args: toolCall.arguments,
+    });
+    const finalized = {
+        toolCall,
+        result: {
+            content: [{ type: "text", text: truncateError(halt.reason) }],
+            details: halt.details !== undefined ? { ...halt.details } : {},
+        },
+        isError: true,
+    };
+    await emit({
+        type: "tool_execution_end",
+        toolCallId: finalized.toolCall.id,
+        toolName: finalized.toolCall.name,
+        result: finalized.result,
+        isError: true,
+        notExecuted: true,
+    });
+    const message = createToolResultMessage(finalized);
+    await emitToolResultMessage(message, emit);
+    return { finalized, message };
+}
 function isCallConcurrencySafe(tool, args) {
     if (!tool)
         return false;
@@ -587,6 +626,7 @@ async function executeToolCallsPartitioned(currentContext, assistantMessage, too
     const allFinalized = [];
     const messages = [];
     const remainingCalls = [];
+    let halt;
     for (const toolCall of toolCalls) {
         const held = executor?.take(toolCall.id);
         if (!held) {
@@ -599,6 +639,8 @@ async function executeToolCallsPartitioned(currentContext, assistantMessage, too
         await emitToolResultMessage(toolResultMessage, emit);
         allFinalized.push(finalized);
         messages.push(toolResultMessage);
+        if (held.immediate?.halt !== undefined)
+            halt ??= held.immediate.halt;
     }
     if (executor) {
         for (const orphan of executor.remaining()) {
@@ -606,33 +648,54 @@ async function executeToolCallsPartitioned(currentContext, assistantMessage, too
             await closeOrphanedStreamEntry(orphan, emit);
         }
     }
-    const batches = partitionToolCalls(remainingCalls, currentContext.tools);
-    outer: for (const batch of batches) {
-        if (signal?.aborted)
-            break;
-        const entries = [];
-        for (const toolCall of batch.calls) {
-            await emit({
-                type: "tool_execution_start",
-                toolCallId: toolCall.id,
-                toolName: toolCall.name,
-                args: toolCall.arguments,
-            });
-            const preparation = await prepareToolCall(currentContext, assistantMessage, toolCall, config, signal);
-            if (preparation.kind === "immediate") {
-                const finalized = { toolCall, result: preparation.result, isError: preparation.isError };
-                await emitToolExecutionEnd(finalized, emit);
-                entries.push({ finalized, toolCall });
-            }
-            else {
-                entries.push({ prepared: preparation, toolCall });
-            }
-            if (signal?.aborted) {
-                await settleBatch(entries, true);
-                break outer;
+    if (halt === undefined) {
+        const batches = partitionToolCalls(remainingCalls, currentContext.tools);
+        outer: for (const batch of batches) {
+            if (signal?.aborted)
+                break;
+            const entries = [];
+            for (const toolCall of batch.calls) {
+                await emit({
+                    type: "tool_execution_start",
+                    toolCallId: toolCall.id,
+                    toolName: toolCall.name,
+                    args: toolCall.arguments,
+                });
+                const preparation = await prepareToolCall(currentContext, assistantMessage, toolCall, config, signal);
+                if (preparation.kind === "immediate") {
+                    const finalized = { toolCall, result: preparation.result, isError: preparation.isError };
+                    await emitToolExecutionEnd(finalized, emit);
+                    entries.push({ finalized, toolCall });
+                    if (preparation.halt !== undefined) {
+                        halt = preparation.halt;
+                        break;
+                    }
+                }
+                else {
+                    entries.push({ prepared: preparation, toolCall });
+                }
+                if (signal?.aborted) {
+                    await settleBatch(entries, true);
+                    break outer;
+                }
             }
+            await settleBatch(entries, batch.safe);
+            if (halt !== undefined)
+                break;
         }
-        await settleBatch(entries, batch.safe);
+    }
+    if (halt !== undefined && !signal?.aborted) {
+        const settledIds = new Set(messages.map((m) => m.toolCallId));
+        for (const toolCall of toolCalls) {
+            if (settledIds.has(toolCall.id))
+                continue;
+            if (signal?.aborted)
+                break;
+            const settled = await settleHaltedToolCall(toolCall, halt, emit);
+            allFinalized.push(settled.finalized);
+            messages.push(settled.message);
+        }
+        return { messages, terminate: true };
     }
     return { messages, terminate: shouldTerminateToolBatch(allFinalized) };
     async function settleBatch(entries, concurrent) {
@@ -720,6 +783,8 @@ class StreamToolExecutor {
             const preparation = await prepareToolCall(this.context, partialAssistant, entry.toolCall, this.config, this.signal);
             if (preparation.kind === "immediate") {
                 entry.immediate = preparation;
+                if (preparation.halt !== undefined)
+                    this.barrier = true;
                 return;
             }
             entry.prepared = preparation;
@@ -873,11 +938,11 @@ async function prepareToolCall(currentContext, assistantMessage, toolCall, confi
                 };
             }
             if (beforeResult?.block) {
-                return {
-                    kind: "immediate",
-                    result: createErrorToolResult(beforeResult.reason || "Tool execution was blocked"),
-                    isError: true,
-                };
+                const blocked = createErrorToolResult(beforeResult.reason || "Tool execution was blocked");
+                if (beforeResult.haltRemaining !== undefined) {
+                    return { kind: "immediate", result: blocked, isError: true, halt: beforeResult.haltRemaining };
+                }
+                return { kind: "immediate", result: blocked, isError: true };
             }
             if (beforeResult?.updatedInput !== undefined) {
                 finalArgs = validateToolArguments(tool, {

package/dist/engine/loop/types.d.ts

@@ -48,11 +48,34 @@ export type AgentToolCall = Extract<AssistantMessage["content"][number], {
  *
  * Keep in sync with the harness hook result `ToolCallResult` (harness/types.ts), which the harness's
  * `beforeToolCall` callback returns verbatim.
+ *
+ * `haltRemaining` (additive) makes the block a CONTROL-FLOW BOUNDARY for the whole assistant batch:
+ * honored only beside `block: true`, it tells the loop that every tool call of the same assistant
+ * message whose preparation had not yet begun must NOT begin — each settles as an error tool result
+ * built from the directive (so the transcript still answers every tool call), and the batch votes
+ * terminate (the loop starts no further assistant turn; queued follow-up/steering messages still
+ * run — they are the input the boundary is waiting for). Calls already executing when the block
+ * lands run to completion and settle with their real outcomes; preparation/adjudication is strictly
+ * source-ordered in every lane, so "not yet begun" is exactly "after the blocked call". The loop
+ * stays policy-agnostic: WHY a block halts the batch (e.g. a person's bare rejection) is entirely
+ * the gate owner's judgment, made once, at the site that returns this.
  */
 export interface BeforeToolCallResult {
     block?: boolean;
     reason?: string;
     updatedInput?: unknown;
+    haltRemaining?: HaltRemainingDirective;
+}
+/**
+ * The settlement {@link BeforeToolCallResult.haltRemaining} instructs the loop to apply to each
+ * same-batch tool call that never started: `reason` is the model-facing error text (bounded by the
+ * loop's standard error truncator), `details` is attached to each settled result verbatim (shallow-
+ * copied per call) so a machine-readable mark (e.g. `{ code }`) reaches every not-executed sibling's
+ * end frame and transcript entry.
+ */
+export interface HaltRemainingDirective {
+    reason: string;
+    details?: Record<string, unknown>;
 }
 /**
  * Partial override returned from `afterToolCall`.
@@ -629,4 +652,13 @@ export type AgentEvent = {
     toolName: string;
     result: unknown;
     isError: boolean;
+    /**
+     * Present (`true`) exactly when this end frame closes a call the loop settled WITHOUT
+     * executing it — a never-started sibling under a batch-halt directive (see
+     * {@link BeforeToolCallResult.haltRemaining}). LOOP-AUTHORED: it rides the event, never the
+     * tool result, so a tool cannot claim it about itself; a consumer that scopes
+     * post-execution machinery to executed calls (batch observers, execution audits) keys on
+     * this the way it keys on its own blocked-call records. Absent on every executed call.
+     */
+    notExecuted?: true;
 };

package/dist/index.d.ts

@@ -136,7 +136,7 @@ export type { SchedulerCapability, SchedulerErrorCode, ScheduledIntent, Schedule
 export { createSchedulerTools, type SchedulerToolContext, SCHEDULE_WAKEUP_TOOL_NAME, AUTONOMOUS_LOOP_SENTINEL, AUTONOMOUS_LOOP_DYNAMIC_SENTINEL, } from "./tools/scheduler-tools.js";
 export { resolveAutonomousLoopPrompt, AUTONOMOUS_LOOP_PREAMBLE, AUTONOMOUS_LOOP_PREAMBLE_PERSISTENT, type AutonomousLoopPromptOptions, } from "./tools/loop-tick.js";
 export { tightenTaskSpec, TaskSpecTightenError } from "./core/tighten-task-spec.js";
-export { createAllowDenyPolicy, createApprovalPolicy, COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, findUnverifiableRecursiveDelete, combinePolicies, decisionText, resolveAsk, toolPolicyNameSets, type ToolPolicyNameSets, type NamedToolPolicy, type ToolPolicyProjection, type ToolPolicyProjectionComponent, type ConstraintChainEntry, checkToolPolicyProjection, constraintChainEntryOf, constraintChainDigest, type ToolPolicy, type ToolCallRequest, type PermissionResult, type DecisionReason, type ApprovalSettledBy, APPROVAL_SETTLED_BY_VALUES, isApprovalSettledBy, screenApproverAttribution, APPROVER_ATTRIBUTION_MAX_CHARS, type OnAsk, type AskOutcome, type ResolvedAsk, type AskRequest, type AskDelegationProvenance, type AskRuleEvidence, type AskEvidenceAbsence, ASK_EVIDENCE_ABSENCE_VALUES, } from "./core/tool-policy.js";
+export { createAllowDenyPolicy, createApprovalPolicy, COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, findUnverifiableRecursiveDelete, combinePolicies, decisionText, resolveAsk, toolPolicyNameSets, type ToolPolicyNameSets, type NamedToolPolicy, type ToolPolicyProjection, type ToolPolicyProjectionComponent, type ConstraintChainEntry, checkToolPolicyProjection, constraintChainEntryOf, constraintChainDigest, type ToolPolicy, type ToolCallRequest, type PermissionResult, type DecisionReason, type ApprovalSettledBy, APPROVAL_SETTLED_BY_VALUES, isApprovalSettledBy, type AskDenyResolution, ASK_DENY_RESOLUTION_VALUES, isAskDenyResolution, screenApproverAttribution, APPROVER_ATTRIBUTION_MAX_CHARS, type OnAsk, type AskOutcome, type ResolvedAsk, type AskRequest, type AskDelegationProvenance, type AskRuleEvidence, type AskEvidenceAbsence, ASK_EVIDENCE_ABSENCE_VALUES, } from "./core/tool-policy.js";
 export { parseAutoModeResponse, createAutoModeDecider, type AutoModeVerdict, type AutoModeDecider, type AutoModeDeciderOptions, type AutoModeClassifyFn, type AutoModeClassifyInput, } from "./core/auto-mode.js";
 export { buildAutoModePrompt, renderAutoModeWindow, renderAutoModeAction, AUTO_MODE_DEFAULTS_SENTINEL, type AutoModeRules, type BuildAutoModePromptOptions, type AutoModeWindowOptions, } from "./core/auto-mode-prompt.js";
 export { AUTO_MODE_BASE_PROMPT, AUTO_MODE_PERMISSIONS_EXTERNAL } from "./core/auto-mode-prompt-assets.js";

package/dist/index.js

@@ -113,7 +113,7 @@ export { hasScheduler, isValidCronExpr, SchedulerError } from "./core/scheduler.
 export { createSchedulerTools, SCHEDULE_WAKEUP_TOOL_NAME, AUTONOMOUS_LOOP_SENTINEL, AUTONOMOUS_LOOP_DYNAMIC_SENTINEL, } from "./tools/scheduler-tools.js";
 export { resolveAutonomousLoopPrompt, AUTONOMOUS_LOOP_PREAMBLE, AUTONOMOUS_LOOP_PREAMBLE_PERSISTENT, } from "./tools/loop-tick.js";
 export { tightenTaskSpec, TaskSpecTightenError } from "./core/tighten-task-spec.js";
-export { createAllowDenyPolicy, createApprovalPolicy, COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, findUnverifiableRecursiveDelete, combinePolicies, decisionText, resolveAsk, toolPolicyNameSets, checkToolPolicyProjection, constraintChainEntryOf, constraintChainDigest, APPROVAL_SETTLED_BY_VALUES, isApprovalSettledBy, screenApproverAttribution, APPROVER_ATTRIBUTION_MAX_CHARS, ASK_EVIDENCE_ABSENCE_VALUES, } from "./core/tool-policy.js";
+export { createAllowDenyPolicy, createApprovalPolicy, COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, findUnverifiableRecursiveDelete, combinePolicies, decisionText, resolveAsk, toolPolicyNameSets, checkToolPolicyProjection, constraintChainEntryOf, constraintChainDigest, APPROVAL_SETTLED_BY_VALUES, isApprovalSettledBy, ASK_DENY_RESOLUTION_VALUES, isAskDenyResolution, screenApproverAttribution, APPROVER_ATTRIBUTION_MAX_CHARS, ASK_EVIDENCE_ABSENCE_VALUES, } from "./core/tool-policy.js";
 export { parseAutoModeResponse, createAutoModeDecider, } from "./core/auto-mode.js";
 export { buildAutoModePrompt, renderAutoModeWindow, renderAutoModeAction, AUTO_MODE_DEFAULTS_SENTINEL, } from "./core/auto-mode-prompt.js";
 export { AUTO_MODE_BASE_PROMPT, AUTO_MODE_PERMISSIONS_EXTERNAL } from "./core/auto-mode-prompt-assets.js";

package/dist/tools/web.d.ts

@@ -78,7 +78,16 @@ export interface WebFetchGrounding {
 export declare function htmlToText(html: string): string;
 export declare function webFetchToolSpec(config?: WebFetchConfig): ToolSpec;
 /** Defined (harness) form of web_fetch — back-compat for direct execution / tests. For `spec.tools`, use the raw
- *  {@link webFetchToolSpec} (prepare-task defineTool-wraps spec.tools entries). */
+ *  {@link webFetchToolSpec} (prepare-task defineTool-wraps spec.tools entries).
+ *
+ *  ⚠️ CTX-DEPENDENT BEHAVIOR: this factory takes no `enrichCtx`, so the product it returns is sealed
+ *  around the pre-RB-409 minimal `{toolCallId, signal}` ctx. Fed into `TaskSpec.tools`, a finished
+ *  product is mounted AS-IS (prepare-task's brand branch — there is no ctx seat on
+ *  `AgentTool.execute` to inject through), so every `ctx.*` read inside {@link webFetchToolSpec}
+ *  reads absent — including `reminderMark`/`reminderDisclosureCounts`, i.e. the design/319 exact-mark
+ *  DEFUSE and its observation counters silently do not run for that mount. Two ways to keep them:
+ *  hand `spec.tools` the raw {@link webFetchToolSpec} (the Runner then wraps it with its own trusted
+ *  ctx builder), or call `defineTool(webFetchToolSpec(config), { enrichCtx })` yourself. */
 export declare function createWebFetchTool(config?: WebFetchConfig): AgentTool;
 /** {@link createWebFetchSummarizer}'s truncation bound — CC's `MAX_MARKDOWN_LENGTH`
  *  (WebFetchTool/utils.ts:128). Exported so a deployment wiring the reference summarizer doesn't need

package/dist/tools/web.js

@@ -1,7 +1,7 @@
 import { Type } from "typebox";
 import { defineTool, errorResult } from "../core/tools.js";
 import { delimitUntrusted, inlineUntrusted } from "../core/untrusted-text.js";
-import { discloseReminderShaped } from "../core/reminder-disclosure.js";
+import { discloseReminderShaped, observeReminderMarkEcho } from "../core/reminder-disclosure.js";
 import { redactSecrets } from "../core/untrusted-egress.js";
 import { isPrivateHost } from "../core/runner/image.js";
 import { binaryMagicFormat } from "./fs/safety.js";
@@ -493,6 +493,7 @@ export function webFetchToolSpec(config = {}) {
                 const content = (excerpt
                     ? `${headline}\nThe error response body${trimmed.length > excerpt.length ? ` (first ${ERROR_BODY_EXCERPT_CHARS} chars)` : ""} follows:\n\n${delimitUntrusted(`WebFetch ${parsed.hostname}`, excerpt)}`
                     : headline) + bodyStateNote + promptNote;
+                observeReminderMarkEcho({ text: content, mark: ctx.reminderMark, outlet: "webFetch", counts: ctx.reminderDisclosureCounts });
                 return {
                     content,
                     details: {
@@ -908,9 +909,9 @@ export function createWebSearchTool(config) {
                 const msg = redactSecrets(e instanceof Error ? e.message : String(e)).trim();
                 const headline = "Error (WebSearch): the search backend failed.";
                 const verdict = classifySearchFailure(msg);
-                return errorResult((msg
-                    ? `${headline} The backend's error text follows:\n\n${delimitUntrusted("WebSearch backend error", msg, SEARCH_ERROR_EXCERPT_CHARS)}`
-                    : headline) + `\n\n${verdict.hint}`, failCard({ retryable: verdict.retryable }));
+                const composed = (msg ? `${headline} The backend's error text follows:\n\n${delimitUntrusted("WebSearch backend error", msg, SEARCH_ERROR_EXCERPT_CHARS)}` : headline) + `\n\n${verdict.hint}`;
+                observeReminderMarkEcho({ text: composed, mark: ctx.reminderMark, outlet: "webSearch", counts: ctx.reminderDisclosureCounts });
+                return errorResult(composed, failCard({ retryable: verdict.retryable }));
             }
             finally {
                 clearTimeout(timer);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "5.50.0",
+  "version": "5.52.0",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",

package/test/export-surface.snapshot.json

@@ -1,6 +1,6 @@
 {
   "_comment": "design/87 L3 — frozen public export surface of src/index.ts (name -> kind). DO NOT edit by hand to silence a red test. A removed/changed entry = a SemVer-BREAKING change; bump MAJOR and update this fixture in the SAME commit (design/87 §4.2 / §5.2). Regenerate via REGEN in test/export-surface.test.ts.",
-  "count": 1646,
+  "count": 1649,
   "exports": {
     "A2ATaskState": "type",
     "A2ATaskStateReversal": "type",
@@ -21,6 +21,7 @@
     "APPROVAL_SETTLED_BY_VALUES": "variable",
     "APPROVER_ATTRIBUTION_MAX_CHARS": "variable",
     "ARTIFACT_LIMITS": "variable",
+    "ASK_DENY_RESOLUTION_VALUES": "variable",
     "ASK_EVIDENCE_ABSENCE_VALUES": "variable",
     "AUTONOMOUS_LOOP_DYNAMIC_SENTINEL": "variable",
     "AUTONOMOUS_LOOP_PREAMBLE": "variable",
@@ -59,6 +60,7 @@
     "ArtifactVerifyResult": "type",
     "AskAnswerContinuationSource": "type",
     "AskDelegationProvenance": "interface",
+    "AskDenyResolution": "type",
     "AskEffective": "type",
     "AskEvidenceAbsence": "type",
     "AskOutcome": "type",
@@ -1371,6 +1373,7 @@
     "inlineUntrusted": "function",
     "inspectDegenerate": "function",
     "isApprovalSettledBy": "function",
+    "isAskDenyResolution": "function",
     "isDelegatedAgentTerminal": "function",
     "isInstructionEntry": "function",
     "isIsolated": "function",