@sema-agent/core 5.51.0 → 5.53.0

package/dist/core/tool-policy.js

@@ -271,37 +271,37 @@ export function createApprovalPolicy(opts) {
             }
             if (need.has(toolName)) {
                 if (signal?.aborted) {
-                    return { action: "deny", message: `approval aborted for "${req.toolName}" (task ended)`, settledBy: "aborted" };
+                    return withCoreMintedResolution({ action: "deny", message: `approval aborted for "${req.toolName}" (task ended)`, settledBy: "aborted" }, "task_aborted", req);
                 }
                 let ok;
                 try {
                     ok = await withTimeout(Promise.resolve(opts.approve(req, signal)), opts.approvalTimeoutMs, () => DEADLINE_ELAPSED);
                 }
                 catch (err) {
-                    return {
+                    return withCoreMintedResolution({
                         action: "deny",
                         message: `approval errored for "${req.toolName}": ${describeThrown(err)}`,
                         settledBy: "aborted",
-                    };
+                    }, "approver_error", req);
                 }
                 if (ok === DEADLINE_ELAPSED) {
-                    return {
+                    return withCoreMintedResolution({
                         action: "deny",
                         message: `no one answered the approval request for "${req.toolName}" — the approval window elapsed ` +
                             `(${opts.approvalTimeoutMs}ms) with no answer; denied fail-closed`,
                         settledBy: "timeout",
-                    };
+                    }, "window_expired", req);
                 }
                 if (signal?.aborted) {
-                    return { action: "deny", message: `approval aborted for "${req.toolName}" (task ended)`, settledBy: "aborted" };
+                    return withCoreMintedResolution({ action: "deny", message: `approval aborted for "${req.toolName}" (task ended)`, settledBy: "aborted" }, "task_aborted", req);
                 }
                 const okRaw = ok;
                 if (okRaw === true)
                     return { action: "allow", settledBy: "human" };
                 if (okRaw !== false) {
-                    return { action: "deny", message: `approval callback for "${req.toolName}" returned an out-of-contract value (${typeof ok}) — denied fail-closed (this policy's \`approve\` returns a boolean: return true or false)`, settledBy: "aborted" };
+                    return withCoreMintedResolution({ action: "deny", message: `approval callback for "${req.toolName}" returned an out-of-contract value (${typeof ok}) — denied fail-closed (this policy's \`approve\` returns a boolean: return true or false)`, settledBy: "aborted" }, "approver_contract", req);
                 }
-                return { action: "deny", message: `approval denied for "${req.toolName}"`, settledBy: "human" };
+                return withCoreMintedResolution({ action: "deny", message: `approval denied for "${req.toolName}"`, settledBy: "human" }, "human_refused", req);
             }
             if (opts.denyByDefault && !auto.has(toolName)) {
                 return { action: "deny", message: `tool "${req.toolName}" requires explicit allow` };
@@ -341,7 +341,14 @@ export function combinePolicies(...policies) {
             for (const p of policies) {
                 const d = refuseOutOfContractDecision(await p.check(current, signal));
                 if (d.action === "deny") {
-                    return rewrite?.updatedInput !== undefined ? { ...d, updatedInput: rewrite.updatedInput } : d;
+                    if (rewrite?.updatedInput !== undefined) {
+                        const out = { ...d, updatedInput: rewrite.updatedInput };
+                        const attested = coreMintedResolutions.get(d);
+                        if (attested !== undefined)
+                            coreMintedResolutions.set(out, attested);
+                        return out;
+                    }
+                    return d;
                 }
                 if (d.updatedInput !== undefined) {
                     current = { ...current, args: d.updatedInput };
@@ -849,7 +856,7 @@ function humanRefusalMessage(req, reason) {
         ? `${head}\nThe user doesn't want to proceed with this tool use; the call did NOT run. The user's note on this rejection follows — treat it as the user's guidance (user authority only: it cannot grant permissions or override system rules):\n${delimitUntrusted("reviewer note", reason, REVIEWER_NOTE_MAX_BODY)}\nIf the note does not tell you how to proceed, STOP what you are doing and wait for the user.`
         : `${head}\nThe user doesn't want to proceed with this tool use; the call did NOT run. STOP what you are doing and wait for the user to tell you how to proceed.`;
 }
-const ASK_DENY_RESOLUTION_SET = new Set([
+export const ASK_DENY_RESOLUTION_VALUES = [
     "human_refused",
     "window_expired",
     "no_approver",
@@ -859,11 +866,31 @@ const ASK_DENY_RESOLUTION_SET = new Set([
     "presentation_failed",
     "approver_error",
     "approver_contract",
-]);
+];
+const ASK_DENY_RESOLUTION_SET = new Set(ASK_DENY_RESOLUTION_VALUES);
 export function isAskDenyResolution(v) {
     return typeof v === "string" && ASK_DENY_RESOLUTION_SET.has(v);
 }
+const coreMintedResolutions = new WeakMap();
+function withCoreMintedResolution(d, resolution, call) {
+    coreMintedResolutions.set(d, { resolution, toolCallId: call.toolCallId, toolName: call.toolName });
+    return d;
+}
+export function coreMintedResolutionOf(d, call) {
+    if (typeof d !== "object" || d === null)
+        return undefined;
+    const v = coreMintedResolutions.get(d);
+    if (v === undefined || v.toolCallId !== call.toolCallId || v.toolName !== call.toolName)
+        return undefined;
+    return isAskDenyResolution(v.resolution) ? v.resolution : undefined;
+}
 export async function resolveAsk(req, onAsk, signal) {
+    const r = await resolveAskArms(req, onAsk, signal);
+    if (r.action === "deny" && isAskDenyResolution(r.resolution))
+        return withCoreMintedResolution(r, r.resolution, req);
+    return r;
+}
+async function resolveAskArms(req, onAsk, signal) {
     if (onAsk === "allow") {
         if (req.requiresRealApproval === true) {
             return {

package/dist/core/trace.d.ts

@@ -142,7 +142,7 @@ export type TraceEvent = {
 } | {
     /**
      * How a task's requested reasoning intensity RESOLVED against the model's real capability (design/96 S6).
-     * Emitted once at task start when thinking is on, so a deployment can SEE — not silently swallow (§E
+     * Emitted at task start when thinking is on, so a deployment can SEE — not silently swallow (§E
      * honesty red-line) — that a binary provider ignored the tier (`graded:false`), that an effort endpoint
      * clamped it down (`clamped:true`), or that a NON-reasoning model dropped the request entirely
      * (`dropped:true` — the frame fires for that model too; it used to be the one arm with no report).
@@ -150,6 +150,18 @@ export type TraceEvent = {
      * task's PRIMARY serving model at leg entry (same law as `TaskResult.model`): a mid-run
      * degradation does not re-emit this frame — the switch is observed on its own seats
      * (`TaskResult.degraded`).
+     *
+     * A SECOND frame follows, for the same taskId, in exactly one case: the leg's FIRST
+     * committed request reported wire facts that CHANGE the resolution the task-start frame claimed
+     * (today: the anthropic budget path's cap-wins skip, where a hard per-request output cap too small
+     * to host a legal thinking budget deletes the thinking block — so the honest report is
+     * `dropped:true`, not the gradient the entry frame guessed). The correction is deduped (a first
+     * request that changes nothing emits nothing) and capped at one (only the FIRST committed request
+     * is consumed, so the leg's nested internal calls — compaction summary, side query — cannot
+     * rewrite the leg's posture). A consumer that keeps only the LATEST frame per taskId is therefore
+     * always reading the truth, and one that kept only the first now under-reports a drop it could not
+     * have seen before. The result-face twin `TaskResult.effectiveReasoning` moves with it — the two
+     * faces are one mint at every instant.
      */
     kind: "reasoning.resolved";
     version: 1;

package/dist/core/types.d.ts

@@ -2899,15 +2899,25 @@ export interface TaskResult {
      * (`requested`/`effective`/`graded`/`clamped`/`format`/`endpoint`, plus `dropped:true` when a
      * non-reasoning model dropped the request entirely — field semantics on
      * {@link import("../brain/reasoning.js").ResolvedReasoning}). It is the SAME resolver output the
-     * `reasoning.resolved` trace frame carries, computed once per leg — the two faces cannot tell different
-     * stories; this seat serves consumers without a tracer (the trace frame is the deployment-observability
-     * face, this is the caller face).
+     * `reasoning.resolved` trace frame carries — the two faces cannot tell different stories; this seat
+     * serves consumers without a tracer (the trace frame is the deployment-observability face, this is the
+     * caller face).
      *
      * **In-presence condition** — mirrors the trace frame exactly: present on every terminal of a leg that ran
      * with a REQUESTED thinking tier other than off/unset (the `spec > role > model.defaultThinking` chain);
      * absent when thinking was off/unset for the leg, and on prepare failures (the resolution is minted after
      * prepare). On a resumed task each leg re-resolves against the leg's own serving model.
      *
+     * **Per-request correction** — the leg-entry mint runs before any request exists, so it can only
+     * describe the model's CAPABILITY. When the leg's FIRST committed request reports wire facts that change
+     * that answer, the seat is re-resolved against them by the same resolver and the trace twin is re-emitted
+     * with it. Today that is one arm: the anthropic budget path's cap-wins skip — a HARD per-request output
+     * cap too small to host a legal thinking budget deletes the thinking block, so a leg capped that way now
+     * reports `effective:"off"`/`dropped:true` instead of claiming the gradient the wire never carried. Only
+     * the FIRST committed request is consumed: the seat stays a leg-ENTRY snapshot (see the degradation law
+     * below), and the leg's nested internal brain calls (compaction summary, tool-invoked side query) carry
+     * their own caps and must never restate the leg's posture.
+     *
      * **Degradation law** — same as {@link model}, whose resolution this is: the seat describes the leg's
      * PRIMARY serving model at leg entry. A mid-run degradation (reactive fallback / near-budget switch)
      * changes the serving model WITHOUT re-minting this seat or its trace twin — read {@link degraded} to see

package/dist/engine/harness/agent-harness.d.ts

@@ -20,6 +20,13 @@ export interface UserMessageProvenance {
     /** [c209-C] R3: engine-injected note whose content must stay VISIBLE in derived views (diagnostics,
      *  task notifications, steering, recall) but never under user authority — see UserMessage.provenance. */
     provenance?: "engine-note";
+    /** The frame's CONTENT is caller/supervisor speech relayed by the engine (a TaskStream steer), not
+     *  engine-authored guidance. Rides only WITH `provenance:"engine-note"` (the projection semantics are
+     *  identical — visible, never `[user]` authority); what it changes is the run-control judgment: the
+     *  human-halt hold below treats a caller-authored frame as USER-provenance input (always passes),
+     *  while an engine-authored one is held. Minter-stated at the single relay seam that mints such
+     *  frames — never inferred from text. Metadata only; not persisted on the message. */
+    callerAuthored?: true;
     /** RB-30 terminal fix — an OPAQUE payload the engine rides on this queued message (the runner's
      *  task-notification frame). Never serialized, never interpreted by the harness: if the message is
      *  still undrained at agent_end, the payload is handed back through `onUndrainedEngineNotes` so
@@ -98,6 +105,22 @@ export declare class AgentHarness<TSkill extends Skill = Skill, TPromptTemplate
      *  Advisory (swallow-guarded at the call sites via the runner's own closure); never re-entered
      *  for the same payload — consumption deletes the sidecar entry in the same step. */
     onEngineNoteConsumed?: (payload: unknown) => void;
+    /** Runner-set HOLD — the single gate for every engine-authored injection against the run's live
+     *  human-halt fact. When it reports true (a person's bare rejection halted the run at this
+     *  boundary, and only that person's own input may continue it):
+     *   · a NEW engine-authored steer/followUp is refused at entry (the caller's existing rejection
+     *     path parks the payload for the session's next run — same lane an idle-race refusal takes);
+     *   · engine-authored frames ALREADY queued are not drained — they stay queued, delayed past the
+     *     halted boundary: delivered at the next un-halted boundary if the user's own queued input
+     *     legitimately continues the run, otherwise handed to the terminal sweep (payload frames park
+     *     losslessly; payload-less boundary advisories end with the run, the same best-effort fate
+     *     their mint sites already accept for a final turn).
+     *  Caller/user-provenance input always passes — it is the awaited direction. One predicate here
+     *  instead of a per-lane check at every injection site: a future engine lane that never heard of
+     *  the halt is held by construction rather than by remembering. `nextTurn` is deliberately NOT
+     *  gated: its splice opens a NEW run (idle-park redelivery), and a halt belongs to the run that
+     *  minted it. */
+    engineInjectionsHeld?: () => boolean;
     /** RB-30 codex F1/F2: shared recovery sweep — collects engine-note payloads from the given queues
      *  in DELIVERY order (steer before followUp, each queue forward — the live loop serves steering
      *  first, so the recovered redelivery must not present "later" frames ahead of "now/next"),
@@ -203,6 +226,13 @@ export declare class AgentHarness<TSkill extends Skill = Skill, TPromptTemplate
      *  The idle check is deliberately NOT here: its message differs per lane, and nextTurn() legitimately has
      *  none (queueing the NEXT prompt while idle is exactly what it is for). */
     private enqueueInjection;
+    /** The human-halt hold's ENTRY half (see {@link engineInjectionsHeld}): a new engine-authored
+     *  injection during a halt is refused before it can queue — the refusal is the caller's park
+     *  signal (the same posture as the backlog-cap refusal above: pend per session, redeliver on the
+     *  session's next run; nothing is lost). Belt-and-braces beside the drain-side hold: today's
+     *  engine lanes each check the halt fact before injecting, so this arm exists for the lane that
+     *  does not — including the one not written yet. */
+    private refuseHeldEngineInjection;
     steer(text: string, options?: {
         images?: ImageContent[];
     } & UserMessageProvenance): Promise<void>;

package/dist/engine/harness/agent-harness.js

@@ -34,6 +34,14 @@ function createUserMessage(text, images, provenance) {
     };
 }
 const engineNotePayloads = new WeakMap();
+const engineAuthoredInjections = new WeakSet();
+function isEngineAuthoredInjection(options) {
+    if (options === undefined)
+        return false;
+    if (options.engineMinted === true || options.enginePayload !== undefined)
+        return true;
+    return options.provenance === "engine-note" && options.callerAuthored !== true;
+}
 const ENGINE_NOTE_STEER_BACKLOG_CAP = 50;
 function createFailureMessage(model, error, aborted) {
     return {
@@ -160,6 +168,7 @@ export class AgentHarness {
     onUndrainedEngineNotes;
     onUndrainedUserInputs;
     onEngineNoteConsumed;
+    engineInjectionsHeld;
     recoverUndrainedEngineNotes() {
         this.sweepUndrainedEngineNotes([this.nextTurnQueue, this.steerQueue, this.followUpQueue]);
     }
@@ -184,7 +193,10 @@ export class AgentHarness {
         }
     }
     announceUndrainedUserInputs() {
-        const counts = { steer: this.steerQueue.length, followUp: this.followUpQueue.length };
+        const counts = {
+            steer: this.steerQueue.filter((m) => !engineAuthoredInjections.has(m)).length,
+            followUp: this.followUpQueue.filter((m) => !engineAuthoredInjections.has(m)).length,
+        };
         if ((counts.steer > 0 || counts.followUp > 0) && this.onUndrainedUserInputs) {
             try {
                 this.onUndrainedUserInputs(counts);
@@ -439,13 +451,26 @@ export class AgentHarness {
         };
     }
     async drainQueuedMessages(queue, mode) {
-        let count = mode === "all" ? queue.length : 1;
-        if (mode !== "all" && queue.length > 1 && engineNotePayloads.has(queue[0])) {
-            count = 1;
-            while (count < queue.length && engineNotePayloads.has(queue[count]))
-                count++;
+        let messages;
+        if (this.engineInjectionsHeld?.() === true) {
+            messages = [];
+            const limit = mode === "all" ? Number.POSITIVE_INFINITY : 1;
+            for (let i = 0; i < queue.length && messages.length < limit; i++) {
+                if (engineAuthoredInjections.has(queue[i]))
+                    continue;
+                messages.push(...queue.splice(i, 1));
+                i--;
+            }
+        }
+        else {
+            let count = mode === "all" ? queue.length : 1;
+            if (mode !== "all" && queue.length > 1 && engineNotePayloads.has(queue[0])) {
+                count = 1;
+                while (count < queue.length && engineNotePayloads.has(queue[count]))
+                    count++;
+            }
+            messages = queue.splice(0, count);
         }
-        const messages = queue.splice(0, count);
         if (messages.length === 0) {
             return messages;
         }
@@ -759,19 +784,28 @@ export class AgentHarness {
         const m = createUserMessage(text, options?.images, options);
         if (options?.enginePayload !== undefined)
             engineNotePayloads.set(m, options.enginePayload);
+        if (isEngineAuthoredInjection(options))
+            engineAuthoredInjections.add(m);
         queue.push(m);
         await this.emitQueueUpdate();
     }
+    refuseHeldEngineInjection(options) {
+        if (isEngineAuthoredInjection(options) && this.engineInjectionsHeld?.() === true) {
+            throw new AgentHarnessError("invalid_state", "engine-authored injection refused: the run is halted awaiting the user's own direction — park the payload for the session's next run");
+        }
+    }
     async steer(text, options) {
         if (this.phase === "idle") {
             throw new AgentHarnessError("invalid_state", "Cannot steer while idle");
         }
+        this.refuseHeldEngineInjection(options);
         await this.enqueueInjection(this.steerQueue, text, options);
     }
     async followUp(text, options) {
         if (this.phase === "idle") {
             throw new AgentHarnessError("invalid_state", "Cannot follow up while idle");
         }
+        this.refuseHeldEngineInjection(options);
         await this.enqueueInjection(this.followUpQueue, text, options);
     }
     async nextTurn(text, options) {

package/dist/index.d.ts

@@ -136,7 +136,7 @@ export type { SchedulerCapability, SchedulerErrorCode, ScheduledIntent, Schedule
 export { createSchedulerTools, type SchedulerToolContext, SCHEDULE_WAKEUP_TOOL_NAME, AUTONOMOUS_LOOP_SENTINEL, AUTONOMOUS_LOOP_DYNAMIC_SENTINEL, } from "./tools/scheduler-tools.js";
 export { resolveAutonomousLoopPrompt, AUTONOMOUS_LOOP_PREAMBLE, AUTONOMOUS_LOOP_PREAMBLE_PERSISTENT, type AutonomousLoopPromptOptions, } from "./tools/loop-tick.js";
 export { tightenTaskSpec, TaskSpecTightenError } from "./core/tighten-task-spec.js";
-export { createAllowDenyPolicy, createApprovalPolicy, COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, findUnverifiableRecursiveDelete, combinePolicies, decisionText, resolveAsk, toolPolicyNameSets, type ToolPolicyNameSets, type NamedToolPolicy, type ToolPolicyProjection, type ToolPolicyProjectionComponent, type ConstraintChainEntry, checkToolPolicyProjection, constraintChainEntryOf, constraintChainDigest, type ToolPolicy, type ToolCallRequest, type PermissionResult, type DecisionReason, type ApprovalSettledBy, APPROVAL_SETTLED_BY_VALUES, isApprovalSettledBy, screenApproverAttribution, APPROVER_ATTRIBUTION_MAX_CHARS, type OnAsk, type AskOutcome, type ResolvedAsk, type AskRequest, type AskDelegationProvenance, type AskRuleEvidence, type AskEvidenceAbsence, ASK_EVIDENCE_ABSENCE_VALUES, } from "./core/tool-policy.js";
+export { createAllowDenyPolicy, createApprovalPolicy, COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, findUnverifiableRecursiveDelete, combinePolicies, decisionText, resolveAsk, toolPolicyNameSets, type ToolPolicyNameSets, type NamedToolPolicy, type ToolPolicyProjection, type ToolPolicyProjectionComponent, type ConstraintChainEntry, checkToolPolicyProjection, constraintChainEntryOf, constraintChainDigest, type ToolPolicy, type ToolCallRequest, type PermissionResult, type DecisionReason, type ApprovalSettledBy, APPROVAL_SETTLED_BY_VALUES, isApprovalSettledBy, type AskDenyResolution, ASK_DENY_RESOLUTION_VALUES, isAskDenyResolution, screenApproverAttribution, APPROVER_ATTRIBUTION_MAX_CHARS, type OnAsk, type AskOutcome, type ResolvedAsk, type AskRequest, type AskDelegationProvenance, type AskRuleEvidence, type AskEvidenceAbsence, ASK_EVIDENCE_ABSENCE_VALUES, } from "./core/tool-policy.js";
 export { parseAutoModeResponse, createAutoModeDecider, type AutoModeVerdict, type AutoModeDecider, type AutoModeDeciderOptions, type AutoModeClassifyFn, type AutoModeClassifyInput, } from "./core/auto-mode.js";
 export { buildAutoModePrompt, renderAutoModeWindow, renderAutoModeAction, AUTO_MODE_DEFAULTS_SENTINEL, type AutoModeRules, type BuildAutoModePromptOptions, type AutoModeWindowOptions, } from "./core/auto-mode-prompt.js";
 export { AUTO_MODE_BASE_PROMPT, AUTO_MODE_PERMISSIONS_EXTERNAL } from "./core/auto-mode-prompt-assets.js";

package/dist/index.js

@@ -113,7 +113,7 @@ export { hasScheduler, isValidCronExpr, SchedulerError } from "./core/scheduler.
 export { createSchedulerTools, SCHEDULE_WAKEUP_TOOL_NAME, AUTONOMOUS_LOOP_SENTINEL, AUTONOMOUS_LOOP_DYNAMIC_SENTINEL, } from "./tools/scheduler-tools.js";
 export { resolveAutonomousLoopPrompt, AUTONOMOUS_LOOP_PREAMBLE, AUTONOMOUS_LOOP_PREAMBLE_PERSISTENT, } from "./tools/loop-tick.js";
 export { tightenTaskSpec, TaskSpecTightenError } from "./core/tighten-task-spec.js";
-export { createAllowDenyPolicy, createApprovalPolicy, COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, findUnverifiableRecursiveDelete, combinePolicies, decisionText, resolveAsk, toolPolicyNameSets, checkToolPolicyProjection, constraintChainEntryOf, constraintChainDigest, APPROVAL_SETTLED_BY_VALUES, isApprovalSettledBy, screenApproverAttribution, APPROVER_ATTRIBUTION_MAX_CHARS, ASK_EVIDENCE_ABSENCE_VALUES, } from "./core/tool-policy.js";
+export { createAllowDenyPolicy, createApprovalPolicy, COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, findUnverifiableRecursiveDelete, combinePolicies, decisionText, resolveAsk, toolPolicyNameSets, checkToolPolicyProjection, constraintChainEntryOf, constraintChainDigest, APPROVAL_SETTLED_BY_VALUES, isApprovalSettledBy, ASK_DENY_RESOLUTION_VALUES, isAskDenyResolution, screenApproverAttribution, APPROVER_ATTRIBUTION_MAX_CHARS, ASK_EVIDENCE_ABSENCE_VALUES, } from "./core/tool-policy.js";
 export { parseAutoModeResponse, createAutoModeDecider, } from "./core/auto-mode.js";
 export { buildAutoModePrompt, renderAutoModeWindow, renderAutoModeAction, AUTO_MODE_DEFAULTS_SENTINEL, } from "./core/auto-mode-prompt.js";
 export { AUTO_MODE_BASE_PROMPT, AUTO_MODE_PERMISSIONS_EXTERNAL } from "./core/auto-mode-prompt-assets.js";

package/dist/tools/web.d.ts

@@ -78,7 +78,16 @@ export interface WebFetchGrounding {
 export declare function htmlToText(html: string): string;
 export declare function webFetchToolSpec(config?: WebFetchConfig): ToolSpec;
 /** Defined (harness) form of web_fetch — back-compat for direct execution / tests. For `spec.tools`, use the raw
- *  {@link webFetchToolSpec} (prepare-task defineTool-wraps spec.tools entries). */
+ *  {@link webFetchToolSpec} (prepare-task defineTool-wraps spec.tools entries).
+ *
+ *  ⚠️ CTX-DEPENDENT BEHAVIOR: this factory takes no `enrichCtx`, so the product it returns is sealed
+ *  around the pre-RB-409 minimal `{toolCallId, signal}` ctx. Fed into `TaskSpec.tools`, a finished
+ *  product is mounted AS-IS (prepare-task's brand branch — there is no ctx seat on
+ *  `AgentTool.execute` to inject through), so every `ctx.*` read inside {@link webFetchToolSpec}
+ *  reads absent — including `reminderMark`/`reminderDisclosureCounts`, i.e. the design/319 exact-mark
+ *  DEFUSE and its observation counters silently do not run for that mount. Two ways to keep them:
+ *  hand `spec.tools` the raw {@link webFetchToolSpec} (the Runner then wraps it with its own trusted
+ *  ctx builder), or call `defineTool(webFetchToolSpec(config), { enrichCtx })` yourself. */
 export declare function createWebFetchTool(config?: WebFetchConfig): AgentTool;
 /** {@link createWebFetchSummarizer}'s truncation bound — CC's `MAX_MARKDOWN_LENGTH`
  *  (WebFetchTool/utils.ts:128). Exported so a deployment wiring the reference summarizer doesn't need

package/dist/tools/web.js

@@ -1,7 +1,7 @@
 import { Type } from "typebox";
 import { defineTool, errorResult } from "../core/tools.js";
 import { delimitUntrusted, inlineUntrusted } from "../core/untrusted-text.js";
-import { discloseReminderShaped } from "../core/reminder-disclosure.js";
+import { discloseReminderShaped, observeReminderMarkEcho } from "../core/reminder-disclosure.js";
 import { redactSecrets } from "../core/untrusted-egress.js";
 import { isPrivateHost } from "../core/runner/image.js";
 import { binaryMagicFormat } from "./fs/safety.js";
@@ -493,6 +493,7 @@ export function webFetchToolSpec(config = {}) {
                 const content = (excerpt
                     ? `${headline}\nThe error response body${trimmed.length > excerpt.length ? ` (first ${ERROR_BODY_EXCERPT_CHARS} chars)` : ""} follows:\n\n${delimitUntrusted(`WebFetch ${parsed.hostname}`, excerpt)}`
                     : headline) + bodyStateNote + promptNote;
+                observeReminderMarkEcho({ text: content, mark: ctx.reminderMark, outlet: "webFetch", counts: ctx.reminderDisclosureCounts });
                 return {
                     content,
                     details: {
@@ -908,9 +909,9 @@ export function createWebSearchTool(config) {
                 const msg = redactSecrets(e instanceof Error ? e.message : String(e)).trim();
                 const headline = "Error (WebSearch): the search backend failed.";
                 const verdict = classifySearchFailure(msg);
-                return errorResult((msg
-                    ? `${headline} The backend's error text follows:\n\n${delimitUntrusted("WebSearch backend error", msg, SEARCH_ERROR_EXCERPT_CHARS)}`
-                    : headline) + `\n\n${verdict.hint}`, failCard({ retryable: verdict.retryable }));
+                const composed = (msg ? `${headline} The backend's error text follows:\n\n${delimitUntrusted("WebSearch backend error", msg, SEARCH_ERROR_EXCERPT_CHARS)}` : headline) + `\n\n${verdict.hint}`;
+                observeReminderMarkEcho({ text: composed, mark: ctx.reminderMark, outlet: "webSearch", counts: ctx.reminderDisclosureCounts });
+                return errorResult(composed, failCard({ retryable: verdict.retryable }));
             }
             finally {
                 clearTimeout(timer);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "5.51.0",
+  "version": "5.53.0",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",

package/test/export-surface.snapshot.json

@@ -1,6 +1,6 @@
 {
   "_comment": "design/87 L3 — frozen public export surface of src/index.ts (name -> kind). DO NOT edit by hand to silence a red test. A removed/changed entry = a SemVer-BREAKING change; bump MAJOR and update this fixture in the SAME commit (design/87 §4.2 / §5.2). Regenerate via REGEN in test/export-surface.test.ts.",
-  "count": 1646,
+  "count": 1649,
   "exports": {
     "A2ATaskState": "type",
     "A2ATaskStateReversal": "type",
@@ -21,6 +21,7 @@
     "APPROVAL_SETTLED_BY_VALUES": "variable",
     "APPROVER_ATTRIBUTION_MAX_CHARS": "variable",
     "ARTIFACT_LIMITS": "variable",
+    "ASK_DENY_RESOLUTION_VALUES": "variable",
     "ASK_EVIDENCE_ABSENCE_VALUES": "variable",
     "AUTONOMOUS_LOOP_DYNAMIC_SENTINEL": "variable",
     "AUTONOMOUS_LOOP_PREAMBLE": "variable",
@@ -59,6 +60,7 @@
     "ArtifactVerifyResult": "type",
     "AskAnswerContinuationSource": "type",
     "AskDelegationProvenance": "interface",
+    "AskDenyResolution": "type",
     "AskEffective": "type",
     "AskEvidenceAbsence": "type",
     "AskOutcome": "type",
@@ -1371,6 +1373,7 @@
     "inlineUntrusted": "function",
     "inspectDegenerate": "function",
     "isApprovalSettledBy": "function",
+    "isAskDenyResolution": "function",
     "isDelegatedAgentTerminal": "function",
     "isInstructionEntry": "function",
     "isIsolated": "function",