@sema-agent/core 5.55.0 → 5.56.0

package/dist/core/runner/prepare-task.js

@@ -30,7 +30,7 @@ import { isValidReminderMark, mintReminderMark, reminderMarkDeclaration } from "
 import { policyAskClassOf } from "../ask-class.js";
 import { emitTrace } from "../trace.js";
 import { createSessionRulePolicy, PATH_CONFINABLE_WRITE_TOOLS } from "./session-rule-policy.js";
-import { cloneObserverInput, createHookEnvCapabilities, createPreToolUseConstraintPolicy, formatHookFeedback, mintHookInvocationIdentity, persistedRuleMandateOf, runToolGate } from "../hooks.js";
+import { cloneObserverInput, createHookEnvCapabilities, createPreToolUseConstraintPolicy, formatHookFeedback, mintHookInvocationIdentity, persistedRuleMandateOf, resolveHookTimeoutMs, runHookSeat, hookSeatExpiredError, runToolGate } from "../hooks.js";
 import { createWriteProtectionCheck } from "../write-protect.js";
 import { orgRuleVerdictFor } from "../permission-rule-org.js";
 import { CacheBreakDetector, toolsToFingerprintInputs } from "../cache-break-detector.js";
@@ -39,7 +39,7 @@ import { STALL_CONNECT_MS, STALL_FIRST_TOKEN_MS, STALL_IDLE_MS, withBrainCallGua
 import { defineTool, isDefineToolProduct } from "../tools.js";
 import { RETIRED_TOOL_NAMES } from "../tool-name-aliases.js";
 import { protocolOf } from "../protocol-table.js";
-import { isMcpCoveringRuleName, mcpRuleNameCovers } from "../permission-rules.js";
+import { isNamespacedCoveringRuleName, namespacedRuleNameCovers } from "../permission-rules.js";
 import { pathToUri } from "../lsp-protocol.js";
 import { DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, createOffloadPersist, firstPartyOffloadPolicy, InMemoryToolResultStore, RunnerSharedToolResultStore, ScopedToolResultStore, isVolatileOffloadStore, OFFLOAD_TOOL_NAME, createReadToolResultTool, withToolResultOffload, } from "../tool-result-store.js";
 import { OUTPUT_TOOL_NAME, REPORT_FINDINGS_TOOL_NAME, SKILL_CONTENT_MAX_CHARS, SKILL_TOOL_NAME, createOutputTool, createReportBlockedTool, createReportFindingsTool, createSkillTool, normalizeSkills } from "./synthetic-tools.js";
@@ -302,6 +302,20 @@ function raceAbort(p, signal, onAbort) {
         p.then(finish, () => finish(onAbort()));
     });
 }
+function createDenyObserverNotifier(hooks, hookTimeoutMs, signal, report) {
+    if (hooks?.permissionDenied === undefined)
+        return undefined;
+    return async (payload) => {
+        try {
+            const seat = await runHookSeat("permissionDenied", { timeoutMs: hookTimeoutMs, signal }, (sig) => hooks.permissionDenied({ ...payload, signal: sig }));
+            if (seat.expired)
+                report(hookSeatExpiredError("permissionDenied", hookTimeoutMs, seat.cause, "the deny observation was abandoned; the deny itself is unchanged"));
+        }
+        catch (err) {
+            report(err);
+        }
+    };
+}
 function mcpRevocationWiring(deps) {
     if (deps.mcpRevocations === undefined)
         return undefined;
@@ -859,7 +873,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     pc.autoMode?.decider === autoModeDecider)
                 ? [
                     {
-                        policy: createPreToolUseConstraintPolicy(ownPreToolUse, hookEnvFace, notifyOwnHookCrash),
+                        policy: createPreToolUseConstraintPolicy(ownPreToolUse, hookEnvFace, notifyOwnHookCrash, hookTimeoutMs),
                         preToolUse: ownPreToolUse,
                         ...(hookEnvSource !== undefined ? { hookEnv: hookEnvSource } : {}),
                         ...(frozenOnAsk !== undefined ? { onAsk: frozenOnAsk } : {}),
@@ -2711,7 +2725,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         for (const n of list ?? []) {
                             if (known.has(n))
                                 continue;
-                            if (isMcpCoveringRuleName(n) && [...known].some((k) => mcpRuleNameCovers(n, k)))
+                            if (isNamespacedCoveringRuleName(n) && [...known].some((k) => namespacedRuleNameCovers(n, k)))
                                 continue;
                             const retired = RETIRED_TOOL_NAMES.get(n);
                             if (retired !== undefined) {
@@ -2795,6 +2809,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         const denyNarrowingPolicy = narrowingLayers.length === 0 ? undefined : narrowingLayers.length === 1 ? narrowingLayers[0] : combinePolicies(...narrowingLayers);
         const basePolicyForResumeEdit = lockedPreflight.basePolicyForResumeEdit ?? lockedPreflight.toolPolicy;
         const hooks = spec.hooks ?? deps.hooks;
+        const hookTimeoutMs = resolveHookTimeoutMs(hooks?.timeoutMs, notifyOwnHookCrash, hooks);
         const preToolUseObservational = hooks?.preToolUse !== undefined && hooks.preToolUseObservational === true;
         const ownGatePreToolUse = !preToolUseObservational
             ? hooks?.preToolUse
@@ -3571,21 +3586,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 }
                 return resolved;
             };
-            const hooksWithPermissionDenied = hooks?.permissionDenied ? hooks : undefined;
-            const notifyPermissionDenied = hooksWithPermissionDenied
-                ? async (payload) => {
-                    try {
-                        await hooksWithPermissionDenied.permissionDenied(payload);
-                    }
-                    catch (err) {
-                        try {
-                            deps.onError?.(err instanceof Error ? err : new Error(String(err)), { phase: "hook", sessionId });
-                        }
-                        catch {
-                        }
-                    }
-                }
-                : undefined;
+            const notifyPermissionDenied = createDenyObserverNotifier(hooks, hookTimeoutMs, abortController.signal, notifyOwnHookCrash);
             const notifyHookError = (err) => {
                 try {
                     deps.onError?.(err instanceof Error ? err : new Error(String(err)), { phase: "hook", sessionId });
@@ -4302,6 +4303,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             identity: hookIdentity,
                             reminderMark,
                             preToolUse: ownGatePreToolUse,
+                            hookTimeoutMs,
+                            ...(handsCwdRef !== undefined ? { trackedCwd: () => handsCwdRef.current } : {}),
                             ...(hookEnvFace !== undefined ? { hookEnv: hookEnvFace } : {}),
                             adjudicate,
                             resolveAsk: resolveAskBound,
@@ -4418,7 +4421,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         }
                         catch {
                         }
-                        const patch = await hooks.postToolUseFailure(e.toolName, e.input, {
+                        const failureSeat = await runHookSeat("postToolUseFailure", { timeoutMs: hookTimeoutMs, signal: abortController.signal }, (sig) => hooks.postToolUseFailure(e.toolName, e.input, {
                             error: e.content
                                 .filter((c) => c.type === "text")
                                 .map((c) => c.text)
@@ -4426,7 +4429,11 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             isInterrupt: abortController.signal.aborted || spec.signal?.aborted === true,
                             content: e.content.map((c) => ({ ...c })),
                             details: clonedDetails,
-                        }, { toolCallId: e.toolCallId, toolName: e.toolName, ...(hookEnvFace !== undefined ? { env: hookEnvFace } : {}), identity: hookIdentity });
+                        }, { toolCallId: e.toolCallId, toolName: e.toolName, signal: sig, ...(handsCwdRef?.current !== undefined ? { cwd: handsCwdRef.current } : {}), ...(hookEnvFace !== undefined ? { env: hookEnvFace } : {}), identity: hookIdentity }));
+                        if (failureSeat.expired) {
+                            notifyOwnHookCrash(hookSeatExpiredError("postToolUseFailure", hookTimeoutMs, failureSeat.cause, "the observation was abandoned and its additionalContext dropped; the failure result itself is unchanged"));
+                        }
+                        const patch = failureSeat.expired ? undefined : failureSeat.value;
                         if (patch?.additionalContext) {
                             content = [...content, { type: "text", text: formatHookFeedback(patch.additionalContext, reminderMark) }];
                             changed = true;
@@ -4434,7 +4441,11 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     }
                 }
                 else if (hooks?.postToolUse) {
-                    const patch = await hooks.postToolUse(e.toolName, e.input, { content: e.content, details: e.details, isError: e.isError }, { toolCallId: e.toolCallId, toolName: e.toolName, ...(hookEnvFace !== undefined ? { env: hookEnvFace } : {}), identity: hookIdentity });
+                    const successSeat = await runHookSeat("postToolUse", { timeoutMs: hookTimeoutMs, signal: abortController.signal }, (sig) => hooks.postToolUse(e.toolName, e.input, { content: e.content, details: e.details, isError: e.isError }, { toolCallId: e.toolCallId, toolName: e.toolName, signal: sig, ...(handsCwdRef?.current !== undefined ? { cwd: handsCwdRef.current } : {}), ...(hookEnvFace !== undefined ? { env: hookEnvFace } : {}), identity: hookIdentity }));
+                    if (successSeat.expired) {
+                        notifyOwnHookCrash(hookSeatExpiredError("postToolUse", hookTimeoutMs, successSeat.cause, "the seat was abandoned; the tool result is delivered to the model UNMODIFIED (no updatedOutput, no additionalContext)"));
+                    }
+                    const patch = successSeat.expired ? undefined : successSeat.value;
                     if (patch?.updatedOutput) {
                         content = patch.updatedOutput;
                         changed = true;
@@ -4722,7 +4733,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         const effectiveReadFaceObserved = carrierReadFace();
         const effectiveReadDenyObserved = readDenyAdditionsNormalized.length > 0 ? readDenyAdditionsNormalized.map((e) => ({ ...e })) : undefined;
         const preparedHolder = {};
-        const buildPrepared = () => ({ harness, session, sessionId, reminderMark, reminderDisclosureCounts, taskRootPath: taskRootFinal, model, thinking, compModel, mcp: mcp, ...(a2a !== undefined && a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, approvalSettlement, batchHaltRef, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), ...(effectiveReadFaceObserved !== undefined ? { effectiveReadFace: effectiveReadFaceObserved } : {}), ...(effectiveReadDenyObserved !== undefined ? { effectiveReadDenyPatterns: effectiveReadDenyObserved } : {}), effectiveMemoryScopes: memoryEffectiveScopes, cwdRef: handsCwdRef, ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), denyNarrowingPolicy, ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, suspendRef, suspendProgressRef, reviewRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, brainCallGuardrailRef, suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, gitStatusRef, listBackgroundTasks, hookIdentity, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}) });
+        const buildPrepared = () => ({ harness, session, sessionId, reminderMark, reminderDisclosureCounts, taskRootPath: taskRootFinal, model, thinking, compModel, mcp: mcp, ...(a2a !== undefined && a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, approvalSettlement, batchHaltRef, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), ...(effectiveReadFaceObserved !== undefined ? { effectiveReadFace: effectiveReadFaceObserved } : {}), ...(effectiveReadDenyObserved !== undefined ? { effectiveReadDenyPatterns: effectiveReadDenyObserved } : {}), effectiveMemoryScopes: memoryEffectiveScopes, cwdRef: handsCwdRef, ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), denyNarrowingPolicy, ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, suspendRef, suspendProgressRef, reviewRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, brainCallGuardrailRef, suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, gitStatusRef, listBackgroundTasks, hookIdentity, hookTimeoutMs, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}) });
         const prepared = buildPrepared();
         preparedHolder.current = prepared;
         return prepared;

package/dist/core/runner/runtask.js

@@ -39,15 +39,15 @@ import { TOOL_SEARCH_NAME } from "./tool-disclosure.js";
 import { hasVerifiableStructureSignal } from "./grounding-signal.js";
 import { hasDestroy, isIsolated } from "../remote-env.js";
 import { hasBackgroundShell, sweepBackgroundShells } from "../background-shell.js";
-import { cloneObserverInput, formatHookFeedback } from "../hooks.js";
-import { buildHumanInputEvent, projectHumanInput } from "../human-input-projection.js";
+import { cloneObserverInput, formatHookFeedback, hookSeatExpiredError, resolveHookTimeoutMs, runHookSeat } from "../hooks.js";
+import { buildHumanInputEvent, frameMidTurnUserInput, projectHumanInput } from "../human-input-projection.js";
 import { delimitUntrusted, inlineUntrusted, REVIEWER_NOTE_MAX_BODY, sanitizeUntrustedText, SHELLED_BODY_ENVELOPE_TAGS } from "../untrusted-text.js";
-import { reconcileInterruptedSession } from "../session-reconcile.js";
+import { appendInterruptionMarker, reconcileInterruptedSession } from "../session-reconcile.js";
 import { RunnerSharedToolResultStore } from "../tool-result-store.js";
 import { formatDiagnosticsBlock } from "../lsp-diagnostics.js";
 import { checkToolPolicyProjection, constraintChainDigest, constraintChainEntryOf, isApprovalSettledBy, refuseOutOfContractDecision, screenApproverAttribution, toolPolicyNameSets } from "../tool-policy.js";
 import { defaultTaskRegistry } from "../task-registry.js";
-import { discloseDroppedPending, isDelegatedAgentTerminal, PendingSessionNotifications, renderTaskNotificationXml, SystemInjectionQueue, taskNotificationDedupKey } from "../task-notification.js";
+import { discloseDroppedPending, isDelegatedAgentTerminal, isSystemInjectionPriority, PendingSessionNotifications, renderTaskNotificationXml, SYSTEM_INJECTION_PRIORITIES, SystemInjectionQueue, taskNotificationDedupKey } from "../task-notification.js";
 import { ToolDetachHub } from "../tool-detach.js";
 import { createPeerInboundChainRef, createPeerSelfRef } from "../../agents/peer-admission.js";
 import { workflowSizeGuidelineChangeNotice } from "../../orchestration/workflow-size-guideline.js";
@@ -767,7 +767,11 @@ function makeTurnBoundary(prepared, stats, rs, deps) {
             const injectedThisTurn = finalVerifyInjectedThisTurn ? "final_verification" : undefined;
             if (!boundarySteered && !prepared.abortController.signal.aborted) {
                 try {
-                    const r = await postToolBatchHook(batch, injectedThisTurn !== undefined ? { injectedThisTurn } : undefined, { identity: prepared.hookIdentity });
+                    const batchSeat = await runHookSeat("postToolBatch", { timeoutMs: prepared.hookTimeoutMs, signal: prepared.abortController.signal }, (sig) => postToolBatchHook(batch, injectedThisTurn !== undefined ? { injectedThisTurn } : undefined, { identity: prepared.hookIdentity, signal: sig }));
+                    if (batchSeat.expired) {
+                        runnerHooks.onError?.(hookSeatExpiredError("postToolBatch", prepared.hookTimeoutMs, batchSeat.cause, "the boundary observation was abandoned and its additionalContext dropped; the turn boundary itself is unchanged"), { phase: "hook", sessionId: prepared.sessionId });
+                    }
+                    const r = batchSeat.expired ? undefined : batchSeat.value;
                     if (r?.additionalContext && injectedThisTurn === undefined) {
                         const body = sanitizeUntrustedText(r.additionalContext, SHELLED_BODY_ENVELOPE_TAGS);
                         const budget = ATTACHMENT_BYTE_CAP - boundaryAttachmentBytes;
@@ -1504,6 +1508,7 @@ export class Runner {
                 ...(typeof h.postCompact === "function" ? { postCompact: (c) => h.postCompact(c) } : {}),
                 ...(typeof h.stopFailure === "function" ? { stopFailure: (c) => h.stopFailure(c) } : {}),
                 ...(typeof h.permissionDenied === "function" ? { permissionDenied: (p) => h.permissionDenied(p) } : {}),
+                ...(h.timeoutMs !== undefined ? { timeoutMs: h.timeoutMs } : {}),
             }
             : undefined;
         return {
@@ -1783,6 +1788,13 @@ export class Runner {
                 const actorIn = options?.actor;
                 const actor = actorIn === undefined ? undefined : snapshotActorAssertion(actorIn);
                 const projected = projectHumanInput({ text, actor, source: "steer" });
+                const effectiveInputId = typeof inputId === "string" ? inputId : uuidv7();
+                const parkRecord = {
+                    text,
+                    trusted,
+                    inputId: effectiveInputId,
+                    ...(actor !== undefined ? { actor } : {}),
+                };
                 let payload;
                 let mintsAFrame;
                 let replay;
@@ -1797,7 +1809,7 @@ export class Runner {
                             source: "steer",
                             delivery: "queued",
                             sessionSeq: nextHumanInputSeq(h.harness),
-                            ...(typeof inputId === "string" ? { inputId } : {}),
+                            inputId: effectiveInputId,
                             ...(actor !== undefined ? { actor } : {}),
                             ...(actor?.issuer !== undefined ? { issuer: actor.issuer } : {}),
                             ...(spec.principal !== undefined ? { principal: spec.principal } : {}),
@@ -1814,7 +1826,7 @@ export class Runner {
                     const h = handle ?? (await orTimeout(ready));
                     if (!h)
                         throw steeringError("the task is not running");
-                    payload = trusted ? formatHookFeedback(projected, h.reminderMark) : projected;
+                    payload = trusted ? formatHookFeedback(projected, h.reminderMark) : frameMidTurnUserInput(projected);
                     mintsAFrame = payload.trim().length !== 0;
                     replay = { payload, trusted, ...(actor !== undefined ? { actor } : {}) };
                     if (typeof inputId === "string") {
@@ -1830,7 +1842,7 @@ export class Runner {
                         }
                     }
                     try {
-                        await h.harness.steer(payload, { provenance: "engine-note", callerAuthored: true, ...(actor !== undefined ? { actor } : {}) });
+                        await h.harness.steer(payload, { provenance: "engine-note", callerAuthored: true, parkRecord, ...(actor !== undefined ? { actor } : {}) });
                         noteAccepted(h);
                         return;
                     }
@@ -1841,7 +1853,7 @@ export class Runner {
                     const birthDeadline = Date.now() + READY_TIMEOUT_MS;
                     while (resultValue === undefined && !h.loop.ended && Date.now() < birthDeadline) {
                         try {
-                            await h.harness.steer(payload, { provenance: "engine-note", callerAuthored: true, ...(actor !== undefined ? { actor } : {}) });
+                            await h.harness.steer(payload, { provenance: "engine-note", callerAuthored: true, parkRecord, ...(actor !== undefined ? { actor } : {}) });
                             noteAccepted(h);
                             return;
                         }
@@ -1882,6 +1894,9 @@ export class Runner {
                 if (input.source !== undefined && typeof input.source !== "string") {
                     throw notifyError("input.source must be a string when present", "notify.invalid_payload");
                 }
+                if (opts?.priority !== undefined && !isSystemInjectionPriority(opts.priority)) {
+                    throw notifyError(`opts.priority must be one of ${SYSTEM_INJECTION_PRIORITIES.join("/")} when present`, "notify.invalid_payload");
+                }
                 const payload = {
                     task_id: input.task_id,
                     task_type: "external",
@@ -1945,6 +1960,8 @@ export class Runner {
                 const h = handle ?? (await orTimeout(ready));
                 if (!h)
                     return;
+                if (!h.abortController.signal.aborted)
+                    h.loop.userInterrupted = true;
                 h.abortController.abort();
                 void h.harness.abort();
             },
@@ -2029,7 +2046,18 @@ export class Runner {
         });
         const upstreamTaskNotification = internals?.onTaskNotification;
         const deliveredAtTurnOpen = new Set();
+        let priorityNowDisclosed = false;
         const injectTaskNotification = (notification, opts) => {
+            if (opts?.priority === "now" && !priorityNowDisclosed) {
+                priorityNowDisclosed = true;
+                deliverEngineNotice(this.deps.onNotice, {
+                    code: "task.injection_priority_unimplemented",
+                    message: `a notification was injected with priority "now", which this engine does not implement: all injection ` +
+                        `priorities deliver at the NEXT turn boundary and none aborts the running turn. The notification is ` +
+                        `delivered — only the interrupting semantics are absent.`,
+                    detail: { priority: "now", ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}) },
+                });
+            }
             if (deliveredAtTurnOpen.has(taskNotificationDedupKey(notification)))
                 return Promise.resolve("dropped_duplicate");
             if (!notificationLaneLive) {
@@ -2098,7 +2126,12 @@ export class Runner {
                 this.pendingSessionNotifications.pend(notificationSessionId, p);
         };
         prepared.harness.engineInjectionsHeld = () => prepared.batchHaltRef.current !== undefined;
+        let undrainedUserAtEnd;
         prepared.harness.onUndrainedUserInputs = (counts) => {
+            if (prepared.suspendRef.token !== undefined || prepared.reviewRef.token !== undefined) {
+                undrainedUserAtEnd = counts;
+                return;
+            }
             for (const notice of undrainedUserInputNotices(counts, spec.taskId)) {
                 deliverEngineNotice(this.deps.onNotice, notice);
             }
@@ -2127,7 +2160,7 @@ export class Runner {
                 }
             }
         }
-        const loopLatch = { ended: false };
+        const loopLatch = { ended: false, userInterrupted: false };
         onReady({ harness: prepared.harness, abortController: prepared.abortController, loop: loopLatch, reminderMark: prepared.reminderMark });
         const stats = { turns: 0, tokens: 0, toolCalls: 0, promptTokens: 0, totalInputTokens: 0, cachedTokens: 0, cacheWriteTokens: 0, cacheWriteTokensLong: 0, outputTokens: 0, costMicroUsd: 0 };
         prepared.liveSpendRef.get = () => ({ costMicroUsd: stats.costMicroUsd, tokens: stats.tokens, turns: stats.turns, walltimeMs: Math.round(performance.now() - rs.telemetry.taskStartMonotonic) });
@@ -2809,12 +2842,21 @@ export class Runner {
                     return [];
                 let result;
                 try {
-                    result = await stopHook({
+                    const stopSeat = await runHookSeat("stop", { timeoutMs: prepared.hookTimeoutMs, signal: prepared.abortController.signal, abortEnds: true }, (sig) => stopHook({
                         stopHookActive: consecutiveBlocks > 0,
                         consecutiveBlocks,
                         getBranch: () => prepared.session.getBranch(),
                         identity: prepared.hookIdentity,
-                    });
+                        signal: sig,
+                    }));
+                    if (stopSeat.expired) {
+                        if (stopSeat.cause === "timeout") {
+                            this.deps.onError?.(hookSeatExpiredError("stop", prepared.hookTimeoutMs, stopSeat.cause, "the run was allowed to END (the seat's own no-opinion answer); no pushback and no additional context were injected"), { phase: "hook", sessionId: prepared.sessionId });
+                        }
+                        consecutiveBlocks = 0;
+                        return [];
+                    }
+                    result = stopSeat.value;
                 }
                 catch (err) {
                     this.deps.onError?.(err instanceof Error ? err : new Error(String(err)), { phase: "hook", sessionId: prepared.sessionId });
@@ -2889,7 +2931,7 @@ export class Runner {
                             ...this.seamCCompactionOptions(prepared),
                             ...gitRestateOption(prepared),
                             ...windowSafetyOptions(prepared.harness.getModel()),
-                            ...this.compactionHookOptions(spec, prepared.sessionId, "forced", prepared.hookIdentity),
+                            ...this.compactionHookOptions(spec, prepared.sessionId, "forced", prepared.hookIdentity, { timeoutMs: prepared.hookTimeoutMs, signal: prepared.abortController.signal }),
                         });
                         if (comp.compacted) {
                             compactionBreaker.failures = 0;
@@ -2954,7 +2996,7 @@ export class Runner {
             runnerHooks: {
                 onError: this.deps.onError,
                 seamCCompactionOptions: (p) => this.seamCCompactionOptions(p),
-                compactionHookOptions: (s, sid, trig) => this.compactionHookOptions(s, sid, trig, prepared.hookIdentity),
+                compactionHookOptions: (s, sid, trig) => this.compactionHookOptions(s, sid, trig, prepared.hookIdentity, { timeoutMs: prepared.hookTimeoutMs, signal: prepared.abortController.signal }),
                 recordCompactionReuse: (p, c) => this.recordCompactionReuse(p, c),
             },
         });
@@ -3057,6 +3099,7 @@ export class Runner {
         let final;
         let threw;
         let abortedLive = false;
+        let userInterruptedLive = false;
         let strandedHumanAnswers = [];
         try {
             if (prepared.abortController.signal.aborted) {
@@ -3184,7 +3227,23 @@ export class Runner {
                 const userPromptSubmit = (spec.hooks ?? this.deps.hooks)?.userPromptSubmit;
                 if (userPromptSubmit) {
                     try {
-                        const decision = await userPromptSubmit(spec.objective, { identity: prepared.hookIdentity });
+                        const promptSeat = await runHookSeat("userPromptSubmit", { timeoutMs: prepared.hookTimeoutMs, signal: prepared.abortController.signal, abortEnds: true }, (sig) => userPromptSubmit(spec.objective, { identity: prepared.hookIdentity, signal: sig }));
+                        if (promptSeat.expired) {
+                            if (promptSeat.cause === "timeout") {
+                                try {
+                                    this.deps.onError?.(hookSeatExpiredError("userPromptSubmit", prepared.hookTimeoutMs, promptSeat.cause, "the prompt was NOT submitted (fail-closed) and the task ends blocked"), { phase: "hook", sessionId: prepared.sessionId });
+                                }
+                                catch {
+                                }
+                            }
+                            prepared.blockedRef.reason = formatHookFeedback(promptSeat.cause === "timeout"
+                                ? `the deployment's userPromptSubmit hook did not answer within its ${prepared.hookTimeoutMs}ms bound while screening this prompt; ` +
+                                    `the prompt was NOT submitted (fail-closed)`
+                                : `the task was cancelled while the deployment's userPromptSubmit hook was still screening this prompt; ` +
+                                    `the prompt was NOT submitted (fail-closed)`, prepared.reminderMark);
+                            promptBlocked = true;
+                        }
+                        const decision = promptSeat.expired ? undefined : promptSeat.value;
                         if (decision?.block) {
                             prepared.blockedRef.reason = formatHookFeedback(decision.block, prepared.reminderMark);
                             promptBlocked = true;
@@ -3353,6 +3412,7 @@ export class Runner {
             }
             loopLatch.ended = true;
             abortedLive = prepared.abortController.signal.aborted;
+            userInterruptedLive = loopLatch.userInterrupted;
         }
         catch (err) {
             loopLatch.ended = true;
@@ -3364,6 +3424,7 @@ export class Runner {
             }
             threw = err;
             abortedLive = prepared.abortController.signal.aborted;
+            userInterruptedLive = loopLatch.userInterrupted;
         }
         finally {
             timeout.clear();
@@ -3401,13 +3462,17 @@ export class Runner {
         const durablyPaused = suspended || reviewPaused;
         const interrupted = !durablyPaused &&
             (threw !== undefined || timeout.fired || rs.limits.turnsExceeded || rs.limits.budgetHit !== undefined || abortedLive || final?.stopReason === "aborted");
+        let orphansClosed = 0;
+        let reconcileComplete = false;
         if (interrupted) {
             try {
                 const report = await reconcileInterruptedSession(prepared.session, prepared.toolEffects, undefined, startedToolCallIds);
+                orphansClosed = report.recovered.length;
                 for (const orphan of report.recovered) {
                     queue.push({ type: "tool_end", toolCallId: orphan.toolCallId, toolName: orphan.toolName, ...(toolLabels.has(orphan.toolName) ? { label: toolLabels.get(orphan.toolName) } : {}), isError: true, ...reconciledToolEndBody(orphan), ...ident() });
                     emitCommitted(orphan.entryId, "toolResult", orphan.toolCallId);
                 }
+                reconcileComplete = true;
             }
             catch (reconcileErr) {
                 this.deps.onError?.(reconcileErr instanceof Error ? reconcileErr : new Error(String(reconcileErr)), {
@@ -3425,6 +3490,52 @@ export class Runner {
                 });
             }
         }
+        if (interrupted && userInterruptedLive && reconcileComplete) {
+            try {
+                const entryId = await appendInterruptionMarker(prepared.session, { toolUseInFlight: orphansClosed > 0 });
+                emitCommitted(entryId, "user");
+            }
+            catch (markerErr) {
+                this.deps.onError?.(markerErr instanceof Error ? markerErr : new Error(String(markerErr)), {
+                    phase: "interrupt-reconcile",
+                    sessionId: prepared.sessionId,
+                });
+            }
+        }
+        let migratedParked = { steer: 0, followUp: 0 };
+        const parkToken = prepared.suspendRef.token ?? prepared.reviewRef.token;
+        const parkScope = prepared.suspendRef.token !== undefined ? prepared.suspendRef.scope : prepared.reviewRef.scope;
+        if (durablyPaused && parkToken !== undefined && parkScope !== undefined && this.deps.checkpointStore !== undefined) {
+            const store = this.deps.checkpointStore;
+            const carried = [];
+            for (const record of prepared.harness.readParkableUserInputs()) {
+                try {
+                    if (!(await store.setPendingSteer(parkToken, parkScope, record)))
+                        break;
+                    carried.push(record);
+                }
+                catch (parkErr) {
+                    this.deps.onError?.(parkErr instanceof Error ? parkErr : new Error(String(parkErr)), {
+                        phase: "config",
+                        sessionId: prepared.sessionId,
+                    });
+                    const parkCode = errorCodeOf(parkErr);
+                    if (parkCode === "steering.invalid_content" || parkCode === "steering.queue_full")
+                        continue;
+                    break;
+                }
+            }
+            migratedParked = prepared.harness.dropParkedUserInputs(carried);
+        }
+        if (undrainedUserAtEnd !== undefined) {
+            const remaining = {
+                steer: Math.max(0, undrainedUserAtEnd.steer - migratedParked.steer),
+                followUp: Math.max(0, undrainedUserAtEnd.followUp - migratedParked.followUp),
+            };
+            for (const notice of undrainedUserInputNotices(remaining, spec.taskId)) {
+                deliverEngineNotice(this.deps.onNotice, notice);
+            }
+        }
         if (rs.attach.attachState?.postCompactPending === true && (rs.attach.attachmentsCfg?.backgroundTasks ?? eventDefaultOn("background_tasks")) === true) {
             emitTrace(rs.telemetry.tracer, () => ({ kind: "compaction.announce_dropped", version: 1, taskId: rs.telemetry.taskId, ts: Date.now() }));
         }
@@ -3434,6 +3545,7 @@ export class Runner {
             brain: compactionBrain,
             windowSafety: windowSafetyOptions(prepared.model),
             onCompactionFailed: (reason) => queue.push({ type: "compaction_outcome", outcome: "failed", trigger: "auto", reason, ...ident() }),
+            cancelled: abortedLive,
         });
         try {
             if (comp?.compacted) {
@@ -3596,12 +3708,20 @@ export class Runner {
                 !abortedLive &&
                 result.errorCode !== "conflict") {
                 try {
-                    await stopFailureHook({
+                    const failureSeat = await runHookSeat("stopFailure", { timeoutMs: prepared.hookTimeoutMs }, (sig) => stopFailureHook({
                         identity: prepared.hookIdentity,
                         error: result.errorMessage ?? "model error",
                         ...(result.errorCode !== undefined ? { errorKind: result.errorCode } : {}),
                         turns: stats.turns,
-                    });
+                        signal: sig,
+                    }));
+                    if (failureSeat.expired) {
+                        try {
+                            this.deps.onError?.(hookSeatExpiredError("stopFailure", prepared.hookTimeoutMs, failureSeat.cause, "the terminal observation was abandoned; the assembled TaskResult is unchanged"), { phase: "hook", sessionId: prepared.sessionId });
+                        }
+                        catch {
+                        }
+                    }
                 }
                 catch (err) {
                     try {
@@ -4612,10 +4732,12 @@ export class Runner {
             consecutiveProviderReuse: prepared.compactionReuseRef.consecutive,
         };
     }
-    compactionHookOptions(spec, sessionId, trigger, identity) {
+    compactionHookOptions(spec, sessionId, trigger, identity, seatBound) {
         const hooks = spec.hooks ?? this.deps.hooks;
         const pre = hooks?.preCompact;
         const post = hooks?.postCompact;
+        const seatMs = seatBound?.timeoutMs ?? resolveHookTimeoutMs(hooks?.timeoutMs);
+        const seatSignal = seatBound?.signal;
         const withIdentity = (ctx) => identity !== undefined ? { ...ctx, identity } : ctx;
         return {
             trigger,
@@ -4631,7 +4753,12 @@ export class Runner {
                             }
                         };
                         try {
-                            const r = await pre.call(hooks, ctx);
+                            const seat = await runHookSeat("preCompact", { timeoutMs: seatMs, ...(seatSignal !== undefined ? { signal: seatSignal } : {}) }, (sig) => pre.call(hooks, { ...ctx, signal: sig }));
+                            if (seat.expired) {
+                                report(hookSeatExpiredError("preCompact", seatMs, seat.cause, `the "${ctx.trigger}" compaction PROCEEDED unblocked and with no additional instructions`));
+                                return undefined;
+                            }
+                            const r = seat.value;
                             if (r?.block && ctx.trigger === "forced") {
                                 report(new Error(`a preCompact callback blocked a "forced" compaction — ignored (PTL/trim-pressure compaction is not optional): ${r.block}`));
                             }
@@ -4648,7 +4775,14 @@ export class Runner {
                 ? {
                     postCompact: async (rawCtx) => {
                         try {
-                            await post.call(hooks, withIdentity(rawCtx));
+                            const seat = await runHookSeat("postCompact", { timeoutMs: seatMs, ...(seatSignal !== undefined ? { signal: seatSignal } : {}) }, (sig) => post.call(hooks, { ...withIdentity(rawCtx), signal: sig }));
+                            if (seat.expired) {
+                                try {
+                                    this.deps.onError?.(hookSeatExpiredError("postCompact", seatMs, seat.cause, "the observation was abandoned; the compaction that already landed is unchanged"), { phase: "hook", sessionId });
+                                }
+                                catch {
+                                }
+                            }
                         }
                         catch (err) {
                             try {
@@ -4692,7 +4826,10 @@ export class Runner {
                     ...(prepared.onCompactionApplied ? { onApplied: prepared.onCompactionApplied } : {}),
                     ...this.seamCCompactionOptions(prepared),
                     ...gitRestateOption(prepared),
-                    ...this.compactionHookOptions(spec, prepared.sessionId, "auto", prepared.hookIdentity),
+                    ...this.compactionHookOptions(spec, prepared.sessionId, "auto", prepared.hookIdentity, {
+                        timeoutMs: prepared.hookTimeoutMs,
+                        ...(opts?.cancelled === true ? { signal: prepared.abortController.signal } : {}),
+                    }),
                 });
                 this.recordCompactionReuse(prepared, finishComp);
                 if (finishComp.unevaluableWindow) {

package/dist/core/runner/session-rule-policy.js

@@ -1,6 +1,6 @@
 import { canonicalizeTarget, writeTargetPath } from "../../tools/fs/safety.js";
 import { isWinFormPath } from "../../tools/fs/safety.js";
-import { createCoarseCommandNamePolicy, mcpCoveringEntries, mcpCoveringHit } from "../tool-policy.js";
+import { createCoarseCommandNamePolicy, namespacedCoveringEntries, namespacedCoveringHit } from "../tool-policy.js";
 export const PATH_WRITE_TOOLS = new Set(["Write", "Edit", "MultiEdit"]);
 export const PATH_CONFINABLE_WRITE_TOOLS = new Set([...PATH_WRITE_TOOLS, "NotebookEdit"]);
 export function isWithin(root, p) {
@@ -24,8 +24,8 @@ export function createSessionRulePolicy(rules, opts) {
     const { env, rootPath, toolEffects } = opts;
     const toolDeny = new Set(rules.toolDeny ?? []);
     const toolAllow = rules.toolAllow ? new Set(rules.toolAllow) : undefined;
-    const toolDenyCovering = mcpCoveringEntries(rules.toolDeny);
-    const toolAllowCovering = mcpCoveringEntries(rules.toolAllow);
+    const toolDenyCovering = namespacedCoveringEntries(rules.toolDeny);
+    const toolAllowCovering = namespacedCoveringEntries(rules.toolAllow);
     const cmdPolicy = rules.commandAllow || rules.commandDeny
         ? createCoarseCommandNamePolicy({
             ...(rules.commandAllow ? { allow: rules.commandAllow } : {}),
@@ -38,9 +38,9 @@ export function createSessionRulePolicy(rules, opts) {
         nameSets: [{ ...(rules.toolDeny?.length ? { deny: [...rules.toolDeny] } : {}), ...(rules.toolAllow?.length ? { allow: [...rules.toolAllow] } : {}) }],
         async check(req, signal) {
             const toolName = req.toolName;
-            if (toolDeny.has(toolName) || mcpCoveringHit(toolDenyCovering, toolName))
+            if (toolDeny.has(toolName) || namespacedCoveringHit(toolDenyCovering, toolName))
                 return deny(`tool "${req.toolName}" is denied by a session rule`);
-            if (toolAllow && !toolAllow.has(toolName) && !mcpCoveringHit(toolAllowCovering, toolName)) {
+            if (toolAllow && !toolAllow.has(toolName) && !namespacedCoveringHit(toolAllowCovering, toolName)) {
                 return deny(`tool "${req.toolName}" is not in the session-rule allowlist`);
             }
             if (cmdPolicy) {

package/dist/core/session-reconcile.d.ts

@@ -84,6 +84,38 @@ export interface ReconcileReport {
  * `runner.resume()` uses a checkpoint-aware entry that bypasses this reconcile entirely for those calls.
  */
 export declare function findOrphanToolCalls(messages: AgentMessage[], suspendedBatch?: ReadonlySet<string>): OrphanToolCall[];
+/**
+ * backlog #389 伴生 (D-2) — CC 2.1.223's interruption markers, VERBATIM (`$U`/`CR` @ `CC:151120-151121`,
+ * minted as a USER message by `Jce` @ `CC:640141-640154`). CC mints one on every abort whose reason is
+ * outside `{"interrupt","refusal-fallback-edit"}` — and the interactive Esc / remote cancel, which is
+ * what `TaskStream.interrupt()` corresponds to, is precisely on the minting side (`CC:1033698-1033733`).
+ * The suppressed reason is the one case where the user's own replacement message is already the context.
+ *
+ * Taken verbatim rather than reworded: this string is an INPUT to later reasoning in CC (its own
+ * "interrupted then immediately retried the same action" rule reads it back), and the constitution's
+ * standing rule is that a question CC has answered is answered in CC's form.
+ */
+export declare const INTERRUPTED_BY_USER_MARKER = "[Request interrupted by user]";
+/** backlog #389 伴生 — the tool-use variant (`CR`): the run was cut while a tool batch was in flight. */
+export declare const INTERRUPTED_BY_USER_FOR_TOOL_USE_MARKER = "[Request interrupted by user for tool use]";
+/**
+ * backlog #389 伴生 (D-2) — append the interruption marker so the SESSION records that a person stopped
+ * this run.
+ *
+ * Without it, an interrupt that lands on the model stream (no tool call in flight) leaves literally no
+ * trace: the orphan reconcile has nothing to close, and the empty aborted assistant is deliberately not
+ * persisted (`isEmptyFailureAssistant`). The next run on that session then reads a transcript in which
+ * the half-finished work simply stops, and continues as if it had ended by itself.
+ *
+ * MUST be called AFTER {@link reconcileInterruptedSession} on the same interruption: a user message
+ * placed between an assistant's tool calls and their results is exactly the invalid sequence the
+ * reconcile exists to prevent.
+ *
+ * Returns the persisted entry id so the caller can mint its `message_committed` frame.
+ */
+export declare function appendInterruptionMarker(session: Session, opts: {
+    toolUseInFlight: boolean;
+}): Promise<string>;
 /**
  * Reconcile a resumed session's active branch: close any orphan tool calls with a synthetic
  * interrupted `toolResult` (never re-running the tool). Returns what was recovered.

package/dist/core/session-reconcile.js

@@ -81,6 +81,21 @@ export function findOrphanToolCalls(messages, suspendedBatch) {
     });
     return orphans;
 }
+export const INTERRUPTED_BY_USER_MARKER = "[Request interrupted by user]";
+export const INTERRUPTED_BY_USER_FOR_TOOL_USE_MARKER = "[Request interrupted by user for tool use]";
+export async function appendInterruptionMarker(session, opts) {
+    return await session.appendMessage({
+        role: "user",
+        content: [
+            {
+                type: "text",
+                text: opts.toolUseInFlight ? INTERRUPTED_BY_USER_FOR_TOOL_USE_MARKER : INTERRUPTED_BY_USER_MARKER,
+            },
+        ],
+        provenance: "engine-note",
+        timestamp: Date.now(),
+    });
+}
 export async function reconcileInterruptedSession(session, toolEffects, suspendedBatch, startedToolCallIds) {
     const { messages } = await session.buildContext();
     const orphans = findOrphanToolCalls(messages, suspendedBatch).filter((o) => o.kind !== "result");