@sema-agent/core 5.54.0 → 5.56.0

package/dist/core/runner/runtask.js

@@ -31,23 +31,23 @@ import { toImageContent } from "./image.js";
 import { OUTPUT_TOOL_NAME, SKILLS_LISTING_PROBE_HEADER, resolveOutputRetries } from "./synthetic-tools.js";
 import { cacheFamilyOf, usageCostMicroUsd } from "./usage-accounting.js";
 import { assembleResult, errorCodeOf } from "./assemble-result.js";
-import { ATTACHMENT_BYTE_CAP, CHANGED_FILES_MAX, AGENT_LISTING_REMOVED_HEADER, SKILLS_LISTING_DELTA_HEADER, SKILLS_LISTING_REMOVED_HEADER, advanceCadenceClock, agentListingDeltaHeader, agentListingInitialHeader, replayAnnouncedListing, replayAnnouncedModels, clipToBytes, collectDateChange, collectDueAttachments, collectInstructionsChange, commitAgentListing, commitInstructionsChange, commitSkillsListing, createAttachmentState, rebaseCadenceWindows, reduceToolEnd, renderAgentListingDelta, renderMcpDroppedTools, renderMcpInstructionsDelta, renderOrphanedBackgroundTasks, selectMcpDroppedBatch, renderSkillsListingDelta, renderToolsDelta, stampWriteAnchor } from "./turn-attachments.js";
+import { ATTACHMENT_BYTE_CAP, CHANGED_FILES_MAX, AGENT_LISTING_REMOVED_HEADER, SKILLS_LISTING_DELTA_HEADER, SKILLS_LISTING_REMOVED_HEADER, advanceCadenceClock, agentListingDeltaHeader, attachmentEnvelopeTags, agentListingInitialHeader, replayAnnouncedListing, replayAnnouncedModels, clipToBytes, collectDateChange, collectDueAttachments, collectInstructionsChange, commitAgentListing, commitInstructionsChange, commitSkillsListing, createAttachmentState, rebaseCadenceWindows, reduceToolEnd, renderAgentListingDelta, renderMcpDroppedTools, renderMcpInstructionsDelta, renderOrphanedBackgroundTasks, selectMcpDroppedBatch, renderSkillsListingDelta, renderToolsDelta, stampWriteAnchor } from "./turn-attachments.js";
 import { buildWorkingFileAttachments, centerAdoptionOption, emitInputTruncated, forkContextOption } from "./compaction-call-options.js";
-import { prepareTask, resolveCheckpointStore } from "./prepare-task.js";
+import { gatedCallIdOf, prepareTask, resolveCheckpointStore } from "./prepare-task.js";
 import { settleTeardownLeg } from "./teardown-bounded.js";
 import { TOOL_SEARCH_NAME } from "./tool-disclosure.js";
 import { hasVerifiableStructureSignal } from "./grounding-signal.js";
 import { hasDestroy, isIsolated } from "../remote-env.js";
 import { hasBackgroundShell, sweepBackgroundShells } from "../background-shell.js";
-import { cloneObserverInput, formatHookFeedback } from "../hooks.js";
-import { buildHumanInputEvent, projectHumanInput } from "../human-input-projection.js";
-import { delimitUntrusted, inlineUntrusted, REVIEWER_NOTE_MAX_BODY, sanitizeUntrustedText } from "../untrusted-text.js";
-import { reconcileInterruptedSession } from "../session-reconcile.js";
+import { cloneObserverInput, formatHookFeedback, hookSeatExpiredError, resolveHookTimeoutMs, runHookSeat } from "../hooks.js";
+import { buildHumanInputEvent, frameMidTurnUserInput, projectHumanInput } from "../human-input-projection.js";
+import { delimitUntrusted, inlineUntrusted, REVIEWER_NOTE_MAX_BODY, sanitizeUntrustedText, SHELLED_BODY_ENVELOPE_TAGS } from "../untrusted-text.js";
+import { appendInterruptionMarker, reconcileInterruptedSession } from "../session-reconcile.js";
 import { RunnerSharedToolResultStore } from "../tool-result-store.js";
 import { formatDiagnosticsBlock } from "../lsp-diagnostics.js";
 import { checkToolPolicyProjection, constraintChainDigest, constraintChainEntryOf, isApprovalSettledBy, refuseOutOfContractDecision, screenApproverAttribution, toolPolicyNameSets } from "../tool-policy.js";
 import { defaultTaskRegistry } from "../task-registry.js";
-import { discloseDroppedPending, isDelegatedAgentTerminal, PendingSessionNotifications, renderTaskNotificationXml, SystemInjectionQueue, taskNotificationDedupKey } from "../task-notification.js";
+import { discloseDroppedPending, isDelegatedAgentTerminal, isSystemInjectionPriority, PendingSessionNotifications, renderTaskNotificationXml, SYSTEM_INJECTION_PRIORITIES, SystemInjectionQueue, taskNotificationDedupKey } from "../task-notification.js";
 import { ToolDetachHub } from "../tool-detach.js";
 import { createPeerInboundChainRef, createPeerSelfRef } from "../../agents/peer-admission.js";
 import { workflowSizeGuidelineChangeNotice } from "../../orchestration/workflow-size-guideline.js";
@@ -141,17 +141,19 @@ function resumeDecisionWasNegative(resume) {
 }
 const DEFERRED_REISSUE = "[DEFERRED] This tool call shared a batch with a call that suspended for durable approval, so it was " +
     "NOT executed on resume. If you still need it, issue it again now.";
-function toolEndBodyFrom(result, isError, settledBy, approver, resolution) {
+function toolEndBodyFrom(result, isError, settledBy, approver, resolution, gatedCallIdOfRun) {
     const o = toolOutputFrom(result);
     const st = structuredFrom(result);
     const det = isError ? result?.details : undefined;
     const codeRaw = det?.code;
     const kindRaw = det?.errorKind;
     const code = typeof codeRaw === "string" ? codeRaw : typeof kindRaw === "string" ? kindRaw : undefined;
+    const gatedCallId = code === "gate.parked" ? gatedCallIdOfRun : undefined;
     return {
         ...(o !== undefined ? { output: o.output, ...(o.truncated ? { truncated: true } : {}), ...(o.totalChars !== undefined ? { totalChars: o.totalChars } : {}) } : {}),
         ...(st !== undefined ? { structured: st } : {}),
         ...(typeof code === "string" ? { errorCode: code } : {}),
+        ...(gatedCallId !== undefined ? { gatedCallId } : {}),
         ...(settledBy !== undefined ? { settledBy } : {}),
         ...(approver !== undefined ? { approver } : {}),
         ...(resolution !== undefined ? { resolution } : {}),
@@ -543,7 +545,7 @@ function makeTurnBoundary(prepared, stats, rs, deps) {
             const files = prepared.lspDiagnostics.registry.drain(prepared.lspDiagnostics.runIdent);
             if (files.length > 0) {
                 queue.push({ type: "diagnostics", files, isNew: true, ...ident() });
-                const block = formatDiagnosticsBlock(files);
+                const block = mintSystemReminder(formatDiagnosticsBlock(files), prepared.reminderMark);
                 void prepared.harness.steer(block, { provenance: "engine-note" }).catch(() => undefined);
                 boundarySteered = true;
             }
@@ -746,7 +748,7 @@ function makeTurnBoundary(prepared, stats, rs, deps) {
                 }
             }
             if (due.length > 0) {
-                attachmentsPayload = due.map((a) => mintSystemReminder(sanitizeUntrustedText(a.body), prepared.reminderMark)).join("\n");
+                attachmentsPayload = due.map((a) => mintSystemReminder(sanitizeUntrustedText(a.body, attachmentEnvelopeTags(a.source)), prepared.reminderMark)).join("\n");
                 for (const a of due)
                     boundaryAttachmentBytes += Buffer.byteLength(a.body, "utf8");
                 rs.attach.attachmentsInjected += due.length;
@@ -765,9 +767,13 @@ function makeTurnBoundary(prepared, stats, rs, deps) {
             const injectedThisTurn = finalVerifyInjectedThisTurn ? "final_verification" : undefined;
             if (!boundarySteered && !prepared.abortController.signal.aborted) {
                 try {
-                    const r = await postToolBatchHook(batch, injectedThisTurn !== undefined ? { injectedThisTurn } : undefined, { identity: prepared.hookIdentity });
+                    const batchSeat = await runHookSeat("postToolBatch", { timeoutMs: prepared.hookTimeoutMs, signal: prepared.abortController.signal }, (sig) => postToolBatchHook(batch, injectedThisTurn !== undefined ? { injectedThisTurn } : undefined, { identity: prepared.hookIdentity, signal: sig }));
+                    if (batchSeat.expired) {
+                        runnerHooks.onError?.(hookSeatExpiredError("postToolBatch", prepared.hookTimeoutMs, batchSeat.cause, "the boundary observation was abandoned and its additionalContext dropped; the turn boundary itself is unchanged"), { phase: "hook", sessionId: prepared.sessionId });
+                    }
+                    const r = batchSeat.expired ? undefined : batchSeat.value;
                     if (r?.additionalContext && injectedThisTurn === undefined) {
-                        const body = sanitizeUntrustedText(r.additionalContext);
+                        const body = sanitizeUntrustedText(r.additionalContext, SHELLED_BODY_ENVELOPE_TAGS);
                         const budget = ATTACHMENT_BYTE_CAP - boundaryAttachmentBytes;
                         if (budget >= BATCH_CONTEXT_MIN_KEEP_BYTES) {
                             const clipped = clipToBytes(body, budget) === body
@@ -1008,7 +1014,7 @@ function makeTurnBoundary(prepared, stats, rs, deps) {
     return onTurnBoundary;
 }
 function wrapGitFrame(body, mark) {
-    return mintSystemReminder(sanitizeUntrustedText(body), mark);
+    return mintSystemReminder(sanitizeUntrustedText(body, SHELLED_BODY_ENVELOPE_TAGS), mark);
 }
 async function resolveGitLegDelivery(prepared, cpMirror, report) {
     const ref = prepared.gitStatusRef;
@@ -1344,7 +1350,7 @@ function makeHarnessHandlers(prepared, stats, rs, deps) {
             toolName: event.toolName,
             ...(toolLabels.get(event.toolName) !== undefined ? { label: toolLabels.get(event.toolName) } : {}),
             isError: event.isError,
-            ...toolEndBodyFrom(event.result, event.isError, settlement?.settledBy, settlement?.approver, settlement?.resolution),
+            ...toolEndBodyFrom(event.result, event.isError, settlement?.settledBy, settlement?.approver, settlement?.resolution, prepared.abortController.signal.aborted ? gatedCallIdOf(prepared) : undefined),
             ...ident(),
         });
         announceWorkspaceMove();
@@ -1502,6 +1508,7 @@ export class Runner {
                 ...(typeof h.postCompact === "function" ? { postCompact: (c) => h.postCompact(c) } : {}),
                 ...(typeof h.stopFailure === "function" ? { stopFailure: (c) => h.stopFailure(c) } : {}),
                 ...(typeof h.permissionDenied === "function" ? { permissionDenied: (p) => h.permissionDenied(p) } : {}),
+                ...(h.timeoutMs !== undefined ? { timeoutMs: h.timeoutMs } : {}),
             }
             : undefined;
         return {
@@ -1781,6 +1788,13 @@ export class Runner {
                 const actorIn = options?.actor;
                 const actor = actorIn === undefined ? undefined : snapshotActorAssertion(actorIn);
                 const projected = projectHumanInput({ text, actor, source: "steer" });
+                const effectiveInputId = typeof inputId === "string" ? inputId : uuidv7();
+                const parkRecord = {
+                    text,
+                    trusted,
+                    inputId: effectiveInputId,
+                    ...(actor !== undefined ? { actor } : {}),
+                };
                 let payload;
                 let mintsAFrame;
                 let replay;
@@ -1795,7 +1809,7 @@ export class Runner {
                             source: "steer",
                             delivery: "queued",
                             sessionSeq: nextHumanInputSeq(h.harness),
-                            ...(typeof inputId === "string" ? { inputId } : {}),
+                            inputId: effectiveInputId,
                             ...(actor !== undefined ? { actor } : {}),
                             ...(actor?.issuer !== undefined ? { issuer: actor.issuer } : {}),
                             ...(spec.principal !== undefined ? { principal: spec.principal } : {}),
@@ -1812,7 +1826,7 @@ export class Runner {
                     const h = handle ?? (await orTimeout(ready));
                     if (!h)
                         throw steeringError("the task is not running");
-                    payload = trusted ? formatHookFeedback(projected, h.reminderMark) : projected;
+                    payload = trusted ? formatHookFeedback(projected, h.reminderMark) : frameMidTurnUserInput(projected);
                     mintsAFrame = payload.trim().length !== 0;
                     replay = { payload, trusted, ...(actor !== undefined ? { actor } : {}) };
                     if (typeof inputId === "string") {
@@ -1828,7 +1842,7 @@ export class Runner {
                         }
                     }
                     try {
-                        await h.harness.steer(payload, { provenance: "engine-note", callerAuthored: true, ...(actor !== undefined ? { actor } : {}) });
+                        await h.harness.steer(payload, { provenance: "engine-note", callerAuthored: true, parkRecord, ...(actor !== undefined ? { actor } : {}) });
                         noteAccepted(h);
                         return;
                     }
@@ -1839,7 +1853,7 @@ export class Runner {
                     const birthDeadline = Date.now() + READY_TIMEOUT_MS;
                     while (resultValue === undefined && !h.loop.ended && Date.now() < birthDeadline) {
                         try {
-                            await h.harness.steer(payload, { provenance: "engine-note", callerAuthored: true, ...(actor !== undefined ? { actor } : {}) });
+                            await h.harness.steer(payload, { provenance: "engine-note", callerAuthored: true, parkRecord, ...(actor !== undefined ? { actor } : {}) });
                             noteAccepted(h);
                             return;
                         }
@@ -1880,6 +1894,9 @@ export class Runner {
                 if (input.source !== undefined && typeof input.source !== "string") {
                     throw notifyError("input.source must be a string when present", "notify.invalid_payload");
                 }
+                if (opts?.priority !== undefined && !isSystemInjectionPriority(opts.priority)) {
+                    throw notifyError(`opts.priority must be one of ${SYSTEM_INJECTION_PRIORITIES.join("/")} when present`, "notify.invalid_payload");
+                }
                 const payload = {
                     task_id: input.task_id,
                     task_type: "external",
@@ -1943,6 +1960,8 @@ export class Runner {
                 const h = handle ?? (await orTimeout(ready));
                 if (!h)
                     return;
+                if (!h.abortController.signal.aborted)
+                    h.loop.userInterrupted = true;
                 h.abortController.abort();
                 void h.harness.abort();
             },
@@ -2027,7 +2046,18 @@ export class Runner {
         });
         const upstreamTaskNotification = internals?.onTaskNotification;
         const deliveredAtTurnOpen = new Set();
+        let priorityNowDisclosed = false;
         const injectTaskNotification = (notification, opts) => {
+            if (opts?.priority === "now" && !priorityNowDisclosed) {
+                priorityNowDisclosed = true;
+                deliverEngineNotice(this.deps.onNotice, {
+                    code: "task.injection_priority_unimplemented",
+                    message: `a notification was injected with priority "now", which this engine does not implement: all injection ` +
+                        `priorities deliver at the NEXT turn boundary and none aborts the running turn. The notification is ` +
+                        `delivered — only the interrupting semantics are absent.`,
+                    detail: { priority: "now", ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}) },
+                });
+            }
             if (deliveredAtTurnOpen.has(taskNotificationDedupKey(notification)))
                 return Promise.resolve("dropped_duplicate");
             if (!notificationLaneLive) {
@@ -2096,7 +2126,12 @@ export class Runner {
                 this.pendingSessionNotifications.pend(notificationSessionId, p);
         };
         prepared.harness.engineInjectionsHeld = () => prepared.batchHaltRef.current !== undefined;
+        let undrainedUserAtEnd;
         prepared.harness.onUndrainedUserInputs = (counts) => {
+            if (prepared.suspendRef.token !== undefined || prepared.reviewRef.token !== undefined) {
+                undrainedUserAtEnd = counts;
+                return;
+            }
             for (const notice of undrainedUserInputNotices(counts, spec.taskId)) {
                 deliverEngineNotice(this.deps.onNotice, notice);
             }
@@ -2125,7 +2160,7 @@ export class Runner {
                 }
             }
         }
-        const loopLatch = { ended: false };
+        const loopLatch = { ended: false, userInterrupted: false };
         onReady({ harness: prepared.harness, abortController: prepared.abortController, loop: loopLatch, reminderMark: prepared.reminderMark });
         const stats = { turns: 0, tokens: 0, toolCalls: 0, promptTokens: 0, totalInputTokens: 0, cachedTokens: 0, cacheWriteTokens: 0, cacheWriteTokensLong: 0, outputTokens: 0, costMicroUsd: 0 };
         prepared.liveSpendRef.get = () => ({ costMicroUsd: stats.costMicroUsd, tokens: stats.tokens, turns: stats.turns, walltimeMs: Math.round(performance.now() - rs.telemetry.taskStartMonotonic) });
@@ -2807,12 +2842,21 @@ export class Runner {
                     return [];
                 let result;
                 try {
-                    result = await stopHook({
+                    const stopSeat = await runHookSeat("stop", { timeoutMs: prepared.hookTimeoutMs, signal: prepared.abortController.signal, abortEnds: true }, (sig) => stopHook({
                         stopHookActive: consecutiveBlocks > 0,
                         consecutiveBlocks,
                         getBranch: () => prepared.session.getBranch(),
                         identity: prepared.hookIdentity,
-                    });
+                        signal: sig,
+                    }));
+                    if (stopSeat.expired) {
+                        if (stopSeat.cause === "timeout") {
+                            this.deps.onError?.(hookSeatExpiredError("stop", prepared.hookTimeoutMs, stopSeat.cause, "the run was allowed to END (the seat's own no-opinion answer); no pushback and no additional context were injected"), { phase: "hook", sessionId: prepared.sessionId });
+                        }
+                        consecutiveBlocks = 0;
+                        return [];
+                    }
+                    result = stopSeat.value;
                 }
                 catch (err) {
                     this.deps.onError?.(err instanceof Error ? err : new Error(String(err)), { phase: "hook", sessionId: prepared.sessionId });
@@ -2887,7 +2931,7 @@ export class Runner {
                             ...this.seamCCompactionOptions(prepared),
                             ...gitRestateOption(prepared),
                             ...windowSafetyOptions(prepared.harness.getModel()),
-                            ...this.compactionHookOptions(spec, prepared.sessionId, "forced", prepared.hookIdentity),
+                            ...this.compactionHookOptions(spec, prepared.sessionId, "forced", prepared.hookIdentity, { timeoutMs: prepared.hookTimeoutMs, signal: prepared.abortController.signal }),
                         });
                         if (comp.compacted) {
                             compactionBreaker.failures = 0;
@@ -2952,7 +2996,7 @@ export class Runner {
             runnerHooks: {
                 onError: this.deps.onError,
                 seamCCompactionOptions: (p) => this.seamCCompactionOptions(p),
-                compactionHookOptions: (s, sid, trig) => this.compactionHookOptions(s, sid, trig, prepared.hookIdentity),
+                compactionHookOptions: (s, sid, trig) => this.compactionHookOptions(s, sid, trig, prepared.hookIdentity, { timeoutMs: prepared.hookTimeoutMs, signal: prepared.abortController.signal }),
                 recordCompactionReuse: (p, c) => this.recordCompactionReuse(p, c),
             },
         });
@@ -3055,6 +3099,7 @@ export class Runner {
         let final;
         let threw;
         let abortedLive = false;
+        let userInterruptedLive = false;
         let strandedHumanAnswers = [];
         try {
             if (prepared.abortController.signal.aborted) {
@@ -3182,7 +3227,23 @@ export class Runner {
                 const userPromptSubmit = (spec.hooks ?? this.deps.hooks)?.userPromptSubmit;
                 if (userPromptSubmit) {
                     try {
-                        const decision = await userPromptSubmit(spec.objective, { identity: prepared.hookIdentity });
+                        const promptSeat = await runHookSeat("userPromptSubmit", { timeoutMs: prepared.hookTimeoutMs, signal: prepared.abortController.signal, abortEnds: true }, (sig) => userPromptSubmit(spec.objective, { identity: prepared.hookIdentity, signal: sig }));
+                        if (promptSeat.expired) {
+                            if (promptSeat.cause === "timeout") {
+                                try {
+                                    this.deps.onError?.(hookSeatExpiredError("userPromptSubmit", prepared.hookTimeoutMs, promptSeat.cause, "the prompt was NOT submitted (fail-closed) and the task ends blocked"), { phase: "hook", sessionId: prepared.sessionId });
+                                }
+                                catch {
+                                }
+                            }
+                            prepared.blockedRef.reason = formatHookFeedback(promptSeat.cause === "timeout"
+                                ? `the deployment's userPromptSubmit hook did not answer within its ${prepared.hookTimeoutMs}ms bound while screening this prompt; ` +
+                                    `the prompt was NOT submitted (fail-closed)`
+                                : `the task was cancelled while the deployment's userPromptSubmit hook was still screening this prompt; ` +
+                                    `the prompt was NOT submitted (fail-closed)`, prepared.reminderMark);
+                            promptBlocked = true;
+                        }
+                        const decision = promptSeat.expired ? undefined : promptSeat.value;
                         if (decision?.block) {
                             prepared.blockedRef.reason = formatHookFeedback(decision.block, prepared.reminderMark);
                             promptBlocked = true;
@@ -3258,7 +3319,7 @@ export class Runner {
                         }
                     }
                     if (firstFrames.length > 0) {
-                        effectiveObjective = `${firstFrames.map((f) => mintSystemReminder(sanitizeUntrustedText(f.body), prepared.reminderMark)).join("\n")}\n${effectiveObjective}`;
+                        effectiveObjective = `${firstFrames.map((f) => mintSystemReminder(sanitizeUntrustedText(f.body, attachmentEnvelopeTags(f.source)), prepared.reminderMark)).join("\n")}\n${effectiveObjective}`;
                     }
                 }
                 const gitQueuedChars = gitLegDelivered !== undefined && gitLegDelivered.standalone ? gitLegDelivered.wrapped.length : 0;
@@ -3351,6 +3412,7 @@ export class Runner {
             }
             loopLatch.ended = true;
             abortedLive = prepared.abortController.signal.aborted;
+            userInterruptedLive = loopLatch.userInterrupted;
         }
         catch (err) {
             loopLatch.ended = true;
@@ -3362,6 +3424,7 @@ export class Runner {
             }
             threw = err;
             abortedLive = prepared.abortController.signal.aborted;
+            userInterruptedLive = loopLatch.userInterrupted;
         }
         finally {
             timeout.clear();
@@ -3399,13 +3462,17 @@ export class Runner {
         const durablyPaused = suspended || reviewPaused;
         const interrupted = !durablyPaused &&
             (threw !== undefined || timeout.fired || rs.limits.turnsExceeded || rs.limits.budgetHit !== undefined || abortedLive || final?.stopReason === "aborted");
+        let orphansClosed = 0;
+        let reconcileComplete = false;
         if (interrupted) {
             try {
                 const report = await reconcileInterruptedSession(prepared.session, prepared.toolEffects, undefined, startedToolCallIds);
+                orphansClosed = report.recovered.length;
                 for (const orphan of report.recovered) {
                     queue.push({ type: "tool_end", toolCallId: orphan.toolCallId, toolName: orphan.toolName, ...(toolLabels.has(orphan.toolName) ? { label: toolLabels.get(orphan.toolName) } : {}), isError: true, ...reconciledToolEndBody(orphan), ...ident() });
                     emitCommitted(orphan.entryId, "toolResult", orphan.toolCallId);
                 }
+                reconcileComplete = true;
             }
             catch (reconcileErr) {
                 this.deps.onError?.(reconcileErr instanceof Error ? reconcileErr : new Error(String(reconcileErr)), {
@@ -3423,6 +3490,52 @@ export class Runner {
                 });
             }
         }
+        if (interrupted && userInterruptedLive && reconcileComplete) {
+            try {
+                const entryId = await appendInterruptionMarker(prepared.session, { toolUseInFlight: orphansClosed > 0 });
+                emitCommitted(entryId, "user");
+            }
+            catch (markerErr) {
+                this.deps.onError?.(markerErr instanceof Error ? markerErr : new Error(String(markerErr)), {
+                    phase: "interrupt-reconcile",
+                    sessionId: prepared.sessionId,
+                });
+            }
+        }
+        let migratedParked = { steer: 0, followUp: 0 };
+        const parkToken = prepared.suspendRef.token ?? prepared.reviewRef.token;
+        const parkScope = prepared.suspendRef.token !== undefined ? prepared.suspendRef.scope : prepared.reviewRef.scope;
+        if (durablyPaused && parkToken !== undefined && parkScope !== undefined && this.deps.checkpointStore !== undefined) {
+            const store = this.deps.checkpointStore;
+            const carried = [];
+            for (const record of prepared.harness.readParkableUserInputs()) {
+                try {
+                    if (!(await store.setPendingSteer(parkToken, parkScope, record)))
+                        break;
+                    carried.push(record);
+                }
+                catch (parkErr) {
+                    this.deps.onError?.(parkErr instanceof Error ? parkErr : new Error(String(parkErr)), {
+                        phase: "config",
+                        sessionId: prepared.sessionId,
+                    });
+                    const parkCode = errorCodeOf(parkErr);
+                    if (parkCode === "steering.invalid_content" || parkCode === "steering.queue_full")
+                        continue;
+                    break;
+                }
+            }
+            migratedParked = prepared.harness.dropParkedUserInputs(carried);
+        }
+        if (undrainedUserAtEnd !== undefined) {
+            const remaining = {
+                steer: Math.max(0, undrainedUserAtEnd.steer - migratedParked.steer),
+                followUp: Math.max(0, undrainedUserAtEnd.followUp - migratedParked.followUp),
+            };
+            for (const notice of undrainedUserInputNotices(remaining, spec.taskId)) {
+                deliverEngineNotice(this.deps.onNotice, notice);
+            }
+        }
         if (rs.attach.attachState?.postCompactPending === true && (rs.attach.attachmentsCfg?.backgroundTasks ?? eventDefaultOn("background_tasks")) === true) {
             emitTrace(rs.telemetry.tracer, () => ({ kind: "compaction.announce_dropped", version: 1, taskId: rs.telemetry.taskId, ts: Date.now() }));
         }
@@ -3432,6 +3545,7 @@ export class Runner {
             brain: compactionBrain,
             windowSafety: windowSafetyOptions(prepared.model),
             onCompactionFailed: (reason) => queue.push({ type: "compaction_outcome", outcome: "failed", trigger: "auto", reason, ...ident() }),
+            cancelled: abortedLive,
         });
         try {
             if (comp?.compacted) {
@@ -3594,12 +3708,20 @@ export class Runner {
                 !abortedLive &&
                 result.errorCode !== "conflict") {
                 try {
-                    await stopFailureHook({
+                    const failureSeat = await runHookSeat("stopFailure", { timeoutMs: prepared.hookTimeoutMs }, (sig) => stopFailureHook({
                         identity: prepared.hookIdentity,
                         error: result.errorMessage ?? "model error",
                         ...(result.errorCode !== undefined ? { errorKind: result.errorCode } : {}),
                         turns: stats.turns,
-                    });
+                        signal: sig,
+                    }));
+                    if (failureSeat.expired) {
+                        try {
+                            this.deps.onError?.(hookSeatExpiredError("stopFailure", prepared.hookTimeoutMs, failureSeat.cause, "the terminal observation was abandoned; the assembled TaskResult is unchanged"), { phase: "hook", sessionId: prepared.sessionId });
+                        }
+                        catch {
+                        }
+                    }
                 }
                 catch (err) {
                     try {
@@ -4610,10 +4732,12 @@ export class Runner {
             consecutiveProviderReuse: prepared.compactionReuseRef.consecutive,
         };
     }
-    compactionHookOptions(spec, sessionId, trigger, identity) {
+    compactionHookOptions(spec, sessionId, trigger, identity, seatBound) {
         const hooks = spec.hooks ?? this.deps.hooks;
         const pre = hooks?.preCompact;
         const post = hooks?.postCompact;
+        const seatMs = seatBound?.timeoutMs ?? resolveHookTimeoutMs(hooks?.timeoutMs);
+        const seatSignal = seatBound?.signal;
         const withIdentity = (ctx) => identity !== undefined ? { ...ctx, identity } : ctx;
         return {
             trigger,
@@ -4629,7 +4753,12 @@ export class Runner {
                             }
                         };
                         try {
-                            const r = await pre.call(hooks, ctx);
+                            const seat = await runHookSeat("preCompact", { timeoutMs: seatMs, ...(seatSignal !== undefined ? { signal: seatSignal } : {}) }, (sig) => pre.call(hooks, { ...ctx, signal: sig }));
+                            if (seat.expired) {
+                                report(hookSeatExpiredError("preCompact", seatMs, seat.cause, `the "${ctx.trigger}" compaction PROCEEDED unblocked and with no additional instructions`));
+                                return undefined;
+                            }
+                            const r = seat.value;
                             if (r?.block && ctx.trigger === "forced") {
                                 report(new Error(`a preCompact callback blocked a "forced" compaction — ignored (PTL/trim-pressure compaction is not optional): ${r.block}`));
                             }
@@ -4646,7 +4775,14 @@ export class Runner {
                 ? {
                     postCompact: async (rawCtx) => {
                         try {
-                            await post.call(hooks, withIdentity(rawCtx));
+                            const seat = await runHookSeat("postCompact", { timeoutMs: seatMs, ...(seatSignal !== undefined ? { signal: seatSignal } : {}) }, (sig) => post.call(hooks, { ...withIdentity(rawCtx), signal: sig }));
+                            if (seat.expired) {
+                                try {
+                                    this.deps.onError?.(hookSeatExpiredError("postCompact", seatMs, seat.cause, "the observation was abandoned; the compaction that already landed is unchanged"), { phase: "hook", sessionId });
+                                }
+                                catch {
+                                }
+                            }
                         }
                         catch (err) {
                             try {
@@ -4690,7 +4826,10 @@ export class Runner {
                     ...(prepared.onCompactionApplied ? { onApplied: prepared.onCompactionApplied } : {}),
                     ...this.seamCCompactionOptions(prepared),
                     ...gitRestateOption(prepared),
-                    ...this.compactionHookOptions(spec, prepared.sessionId, "auto", prepared.hookIdentity),
+                    ...this.compactionHookOptions(spec, prepared.sessionId, "auto", prepared.hookIdentity, {
+                        timeoutMs: prepared.hookTimeoutMs,
+                        ...(opts?.cancelled === true ? { signal: prepared.abortController.signal } : {}),
+                    }),
                 });
                 this.recordCompactionReuse(prepared, finishComp);
                 if (finishComp.unevaluableWindow) {

package/dist/core/runner/session-rule-policy.js

@@ -1,6 +1,6 @@
 import { canonicalizeTarget, writeTargetPath } from "../../tools/fs/safety.js";
 import { isWinFormPath } from "../../tools/fs/safety.js";
-import { createCoarseCommandNamePolicy } from "../tool-policy.js";
+import { createCoarseCommandNamePolicy, namespacedCoveringEntries, namespacedCoveringHit } from "../tool-policy.js";
 export const PATH_WRITE_TOOLS = new Set(["Write", "Edit", "MultiEdit"]);
 export const PATH_CONFINABLE_WRITE_TOOLS = new Set([...PATH_WRITE_TOOLS, "NotebookEdit"]);
 export function isWithin(root, p) {
@@ -24,6 +24,8 @@ export function createSessionRulePolicy(rules, opts) {
     const { env, rootPath, toolEffects } = opts;
     const toolDeny = new Set(rules.toolDeny ?? []);
     const toolAllow = rules.toolAllow ? new Set(rules.toolAllow) : undefined;
+    const toolDenyCovering = namespacedCoveringEntries(rules.toolDeny);
+    const toolAllowCovering = namespacedCoveringEntries(rules.toolAllow);
     const cmdPolicy = rules.commandAllow || rules.commandDeny
         ? createCoarseCommandNamePolicy({
             ...(rules.commandAllow ? { allow: rules.commandAllow } : {}),
@@ -36,9 +38,9 @@ export function createSessionRulePolicy(rules, opts) {
         nameSets: [{ ...(rules.toolDeny?.length ? { deny: [...rules.toolDeny] } : {}), ...(rules.toolAllow?.length ? { allow: [...rules.toolAllow] } : {}) }],
         async check(req, signal) {
             const toolName = req.toolName;
-            if (toolDeny.has(toolName))
+            if (toolDeny.has(toolName) || namespacedCoveringHit(toolDenyCovering, toolName))
                 return deny(`tool "${req.toolName}" is denied by a session rule`);
-            if (toolAllow && !toolAllow.has(toolName)) {
+            if (toolAllow && !toolAllow.has(toolName) && !namespacedCoveringHit(toolAllowCovering, toolName)) {
                 return deny(`tool "${req.toolName}" is not in the session-rule allowlist`);
             }
             if (cmdPolicy) {

package/dist/core/runner/synthetic-tools.js

@@ -1,5 +1,6 @@
 import { Type } from "typebox";
 import { defineTool } from "../tools.js";
+import { sanitizeUntrustedText, SHELLED_BODY_ENVELOPE_TAGS } from "../untrusted-text.js";
 export const OUTPUT_TOOL_NAME = "StructuredOutput";
 export const REPORT_BLOCKED_TOOL_NAME = "ReportBlocked";
 export const REPORT_FINDINGS_TOOL_NAME = "ReportFindings";
@@ -123,7 +124,8 @@ export function skillListingLine(s) {
     const desc = s.description.length > SKILL_DESC_MAX_CHARS
         ? `${s.description.slice(0, SKILL_DESC_MAX_CHARS - 1)}…`
         : s.description;
-    return `- ${s.name}: ${desc}${skillFilesSuffix(s.files)}`;
+    const safe = (t) => sanitizeUntrustedText(t, SHELLED_BODY_ENVELOPE_TAGS);
+    return `- ${safe(s.name)}: ${safe(desc)}${safe(skillFilesSuffix(s.files))}`;
 }
 const SKILLS_BLOCK_CAP_MARKER = "(block size cap reached — lower-priority skills are listed name-only; descriptions via the tool)";
 export function buildSkillsBlock(skills) {
@@ -141,7 +143,7 @@ export function buildSkillsBlock(skills) {
     const lineCost = (l) => bytes(l) + 1;
     const budget = SKILLS_BLOCK_MAX_BYTES - bytes(render([]));
     const fullLines = skills.map((s) => skillListingLine(s));
-    const nameLines = skills.map((s) => `- ${s.name}`);
+    const nameLines = skills.map((s) => `- ${sanitizeUntrustedText(s.name, SHELLED_BODY_ENVELOPE_TAGS)}`);
     const fullTotal = fullLines.reduce((acc, l) => acc + lineCost(l), 0);
     if (fullTotal <= budget)
         return render(fullLines);

package/dist/core/runner/turn-attachments.d.ts

@@ -65,6 +65,7 @@ export interface BackgroundTaskSnapshot {
     description?: string;
     status: string;
 }
+export declare function attachmentEnvelopeTags(source: AttachmentSource): string[];
 /** One due reminder. `body` is the inner text — the steerer adds the `<system-reminder>` wrapper (F3). */
 export interface TurnAttachment {
     source: AttachmentSource;
@@ -638,7 +639,9 @@ export declare function replayAnnouncedListing(texts: readonly string[], headers
 }): Set<string> | undefined;
 /** Removal-frame header for the agent-type roster (single-sourced for renderer + replay parser). */
 export declare const AGENT_LISTING_REMOVED_HEADER = "The following agent types are no longer available:";
-/** CC-verbatim roster-drift header — same single-source rationale as {@link agentListingInitialHeader}. */
+/** CC-verbatim roster-drift header — same single-source rationale as {@link agentListingInitialHeader}.
+ *  The interpolated tool name is neutralized on both headers: a caller renames the delegation tool, so
+ *  the name is deployment text arriving on the marked-reminder lane like every other field here. */
 export declare function agentListingDeltaHeader(toolName: string): string;
 /**
  * G1 续批 — agent-type roster announce (CC 2.1.198 `agent_listing_delta`, bundle pretty.js:599199-599223,
@@ -745,11 +748,18 @@ export declare const MCP_INSTRUCTIONS_MAX_CHARS: number;
  * — fenced on the delta lane, RAW-INTERPOLATED (no fence, no bound) into the stable prompt. A single
  * source makes the divergence unrepresentable.
  *
- * Truncation is DISCLOSED (§25 honesty): `delimitUntrusted` clips silently with an ellipsis, which
- * reads to the model as the server's own text. The trailing note lives OUTSIDE the fence, on a
- * trusted line, so the model can tell "the server said less" from "we cut it". The over-length test
- * mirrors `delimitUntrusted`'s own internal condition exactly (both transforms are idempotent, so
- * re-running them here is a no-op and cannot drift from the clip actually applied).
+ * Truncation is DISCLOSED (§25 honesty): the fence clips silently with an ellipsis, which reads to the
+ * model as the server's own text. The trailing note lives OUTSIDE the fence, on a trusted line, so the
+ * model can tell "the server said less" from "we cut it".
+ *
+ * The clip verdict comes FROM the fence (`delimitUntrustedWithClip`), never from a length test
+ * re-derived here. The earlier shape did re-derive it — a local `sanitizeUntrustedText` pre-pass with
+ * the DEFAULT (reminder-only) tag set, measured against the cap — and that mirror silently stopped
+ * matching once the fence widened its neutralization to the whole authority-envelope family: each
+ * widened-family tag occurrence adds a ZWSP the pre-count never saw, so a server could land its text
+ * in the `(cap − N, cap]` window and get the body clipped with the honesty note withheld, N being its
+ * own choice of tag count. One measurement, taken where the cut happens, is the only shape that cannot
+ * drift.
  */
 export declare function fenceMcpServerInstructions(server: string, text: string): string;
 /**