@sema-agent/core 5.55.0 → 5.57.0

package/dist/core/runner/runtask.js

@@ -20,6 +20,7 @@ import { emitTaskOutcome } from "../task-outcome.js";
 import { isDegenerateCutMessage } from "../../brain/terminal-cause.js";
 import { primaryActivityArg } from "../arg-summary.js";
 import { resolveReasoning } from "../../brain/reasoning.js";
+import { adjudicateDerivedRoute, authCarrierFingerprint, fallbackToPrimaryNotice, normalizeBaseUrl, sameRouteIdentity } from "../../brain/route-adjudicator.js";
 import { readDegradation } from "../../brain/degrading.js";
 import { runWithBrainTelemetry, runWithReasoningWireFacts, runWithStatusSink } from "../../brain/status-sink.js";
 import { expandTiers, resolveModel, resolveTaskModel } from "../roles.js";
@@ -39,15 +40,15 @@ import { TOOL_SEARCH_NAME } from "./tool-disclosure.js";
 import { hasVerifiableStructureSignal } from "./grounding-signal.js";
 import { hasDestroy, isIsolated } from "../remote-env.js";
 import { hasBackgroundShell, sweepBackgroundShells } from "../background-shell.js";
-import { cloneObserverInput, formatHookFeedback } from "../hooks.js";
-import { buildHumanInputEvent, projectHumanInput } from "../human-input-projection.js";
+import { cloneObserverInput, formatHookFeedback, hookSeatExpiredError, resolveHookTimeoutMs, runHookSeat } from "../hooks.js";
+import { buildHumanInputEvent, frameMidTurnUserInput, projectHumanInput } from "../human-input-projection.js";
 import { delimitUntrusted, inlineUntrusted, REVIEWER_NOTE_MAX_BODY, sanitizeUntrustedText, SHELLED_BODY_ENVELOPE_TAGS } from "../untrusted-text.js";
-import { reconcileInterruptedSession } from "../session-reconcile.js";
+import { appendInterruptionMarker, reconcileInterruptedSession } from "../session-reconcile.js";
 import { RunnerSharedToolResultStore } from "../tool-result-store.js";
 import { formatDiagnosticsBlock } from "../lsp-diagnostics.js";
 import { checkToolPolicyProjection, constraintChainDigest, constraintChainEntryOf, isApprovalSettledBy, refuseOutOfContractDecision, screenApproverAttribution, toolPolicyNameSets } from "../tool-policy.js";
 import { defaultTaskRegistry } from "../task-registry.js";
-import { discloseDroppedPending, isDelegatedAgentTerminal, PendingSessionNotifications, renderTaskNotificationXml, SystemInjectionQueue, taskNotificationDedupKey } from "../task-notification.js";
+import { discloseDroppedPending, isDelegatedAgentTerminal, isSystemInjectionPriority, PendingSessionNotifications, renderTaskNotificationXml, SYSTEM_INJECTION_PRIORITIES, SystemInjectionQueue, taskNotificationDedupKey } from "../task-notification.js";
 import { ToolDetachHub } from "../tool-detach.js";
 import { createPeerInboundChainRef, createPeerSelfRef } from "../../agents/peer-admission.js";
 import { workflowSizeGuidelineChangeNotice } from "../../orchestration/workflow-size-guideline.js";
@@ -767,7 +768,11 @@ function makeTurnBoundary(prepared, stats, rs, deps) {
             const injectedThisTurn = finalVerifyInjectedThisTurn ? "final_verification" : undefined;
             if (!boundarySteered && !prepared.abortController.signal.aborted) {
                 try {
-                    const r = await postToolBatchHook(batch, injectedThisTurn !== undefined ? { injectedThisTurn } : undefined, { identity: prepared.hookIdentity });
+                    const batchSeat = await runHookSeat("postToolBatch", { timeoutMs: prepared.hookTimeoutMs, signal: prepared.abortController.signal }, (sig) => postToolBatchHook(batch, injectedThisTurn !== undefined ? { injectedThisTurn } : undefined, { identity: prepared.hookIdentity, signal: sig }));
+                    if (batchSeat.expired) {
+                        runnerHooks.onError?.(hookSeatExpiredError("postToolBatch", prepared.hookTimeoutMs, batchSeat.cause, "the boundary observation was abandoned and its additionalContext dropped; the turn boundary itself is unchanged"), { phase: "hook", sessionId: prepared.sessionId });
+                    }
+                    const r = batchSeat.expired ? undefined : batchSeat.value;
                     if (r?.additionalContext && injectedThisTurn === undefined) {
                         const body = sanitizeUntrustedText(r.additionalContext, SHELLED_BODY_ENVELOPE_TAGS);
                         const budget = ATTACHMENT_BYTE_CAP - boundaryAttachmentBytes;
@@ -1504,8 +1509,25 @@ export class Runner {
                 ...(typeof h.postCompact === "function" ? { postCompact: (c) => h.postCompact(c) } : {}),
                 ...(typeof h.stopFailure === "function" ? { stopFailure: (c) => h.stopFailure(c) } : {}),
                 ...(typeof h.permissionDenied === "function" ? { permissionDenied: (p) => h.permissionDenied(p) } : {}),
+                ...(h.timeoutMs !== undefined ? { timeoutMs: h.timeoutMs } : {}),
             }
             : undefined;
+        const MIRRORED_HOOK_KEYS = [
+            "preToolUse",
+            "preToolUseObservational",
+            "postToolUse",
+            "userPromptSubmit",
+            "stop",
+            "postToolUseFailure",
+            "postToolBatch",
+            "preCompact",
+            "postCompact",
+            "stopFailure",
+            "permissionDenied",
+            "timeoutMs",
+        ];
+        const _mirrorIsComplete = true;
+        void _mirrorIsComplete;
         return {
             ...(deps.toolPolicy !== undefined
                 ? {
@@ -1547,6 +1569,17 @@ export class Runner {
         }
         const tiers = Object.hasOwn(next, "tiers") ? next.tiers : this.deps.tiers;
         const expanded = tiers && Object.keys(tiers).length > 0 ? expandTiers({ ...next.models }, tiers) : { ...next.models };
+        const movedEntries = [];
+        for (const [name, nextModel] of Object.entries(expanded ?? {})) {
+            const prior = this.deps.models?.[name];
+            if (!prior)
+                continue;
+            const from = normalizeBaseUrl(prior.baseUrl);
+            const to = normalizeBaseUrl(nextModel.baseUrl);
+            if (from !== to && authCarrierFingerprint(prior.headers) === authCarrierFingerprint(nextModel.headers)) {
+                movedEntries.push({ modelId: name, from, to });
+            }
+        }
         this.deps = { ...this.deps, models: expanded, ...(tiers !== undefined ? { tiers } : {}) };
         if (tiers === undefined)
             delete this.deps.tiers;
@@ -1555,6 +1588,18 @@ export class Runner {
             message: `model catalog swapped: ${Object.keys(next.models).length} model(s), ${tiers ? Object.keys(tiers).length : 0} tier binding(s); in-flight tasks finish on their resolved models, new tasks resolve against the new catalog`,
             detail: { models: Object.keys(next.models).length, tiers: tiers ? Object.keys(tiers).length : 0 },
         });
+        if (movedEntries.length > 0) {
+            const RENDER_CAP = 8;
+            const rendered = movedEntries.slice(0, RENDER_CAP);
+            deliverEngineNotice(this.deps.onNotice, {
+                code: "route.base_url_changed_key_unchanged",
+                message: `model catalog swap moved ${movedEntries.length} entry/entries to a new baseUrl while the Model-visible credential half stayed unchanged: ` +
+                    rendered.map((e) => `"${e.modelId}" ${e.from || "(config root)"} → ${e.to || "(config root)"}`).join("; ") +
+                    (movedEntries.length > rendered.length ? `; +${movedEntries.length - rendered.length} more` : "") +
+                    " — if the provider changed (not just its domain), update the credential reference in the same step",
+                detail: { entries: rendered, total: movedEntries.length },
+            });
+        }
     }
     sideQuery(spec) {
         return runWithReasoningWireFacts(() => { }, () => runSideQuery(spec, { brain: this.deps.brain, models: this.deps.models, roles: this.deps.roles }));
@@ -1783,6 +1828,13 @@ export class Runner {
                 const actorIn = options?.actor;
                 const actor = actorIn === undefined ? undefined : snapshotActorAssertion(actorIn);
                 const projected = projectHumanInput({ text, actor, source: "steer" });
+                const effectiveInputId = typeof inputId === "string" ? inputId : uuidv7();
+                const parkRecord = {
+                    text,
+                    trusted,
+                    inputId: effectiveInputId,
+                    ...(actor !== undefined ? { actor } : {}),
+                };
                 let payload;
                 let mintsAFrame;
                 let replay;
@@ -1797,7 +1849,7 @@ export class Runner {
                             source: "steer",
                             delivery: "queued",
                             sessionSeq: nextHumanInputSeq(h.harness),
-                            ...(typeof inputId === "string" ? { inputId } : {}),
+                            inputId: effectiveInputId,
                             ...(actor !== undefined ? { actor } : {}),
                             ...(actor?.issuer !== undefined ? { issuer: actor.issuer } : {}),
                             ...(spec.principal !== undefined ? { principal: spec.principal } : {}),
@@ -1814,7 +1866,7 @@ export class Runner {
                     const h = handle ?? (await orTimeout(ready));
                     if (!h)
                         throw steeringError("the task is not running");
-                    payload = trusted ? formatHookFeedback(projected, h.reminderMark) : projected;
+                    payload = trusted ? formatHookFeedback(projected, h.reminderMark) : frameMidTurnUserInput(projected);
                     mintsAFrame = payload.trim().length !== 0;
                     replay = { payload, trusted, ...(actor !== undefined ? { actor } : {}) };
                     if (typeof inputId === "string") {
@@ -1830,7 +1882,7 @@ export class Runner {
                         }
                     }
                     try {
-                        await h.harness.steer(payload, { provenance: "engine-note", callerAuthored: true, ...(actor !== undefined ? { actor } : {}) });
+                        await h.harness.steer(payload, { provenance: "engine-note", callerAuthored: true, parkRecord, ...(actor !== undefined ? { actor } : {}) });
                         noteAccepted(h);
                         return;
                     }
@@ -1841,7 +1893,7 @@ export class Runner {
                     const birthDeadline = Date.now() + READY_TIMEOUT_MS;
                     while (resultValue === undefined && !h.loop.ended && Date.now() < birthDeadline) {
                         try {
-                            await h.harness.steer(payload, { provenance: "engine-note", callerAuthored: true, ...(actor !== undefined ? { actor } : {}) });
+                            await h.harness.steer(payload, { provenance: "engine-note", callerAuthored: true, parkRecord, ...(actor !== undefined ? { actor } : {}) });
                             noteAccepted(h);
                             return;
                         }
@@ -1882,6 +1934,9 @@ export class Runner {
                 if (input.source !== undefined && typeof input.source !== "string") {
                     throw notifyError("input.source must be a string when present", "notify.invalid_payload");
                 }
+                if (opts?.priority !== undefined && !isSystemInjectionPriority(opts.priority)) {
+                    throw notifyError(`opts.priority must be one of ${SYSTEM_INJECTION_PRIORITIES.join("/")} when present`, "notify.invalid_payload");
+                }
                 const payload = {
                     task_id: input.task_id,
                     task_type: "external",
@@ -1945,6 +2000,8 @@ export class Runner {
                 const h = handle ?? (await orTimeout(ready));
                 if (!h)
                     return;
+                if (!h.abortController.signal.aborted)
+                    h.loop.userInterrupted = true;
                 h.abortController.abort();
                 void h.harness.abort();
             },
@@ -2029,7 +2086,18 @@ export class Runner {
         });
         const upstreamTaskNotification = internals?.onTaskNotification;
         const deliveredAtTurnOpen = new Set();
+        let priorityNowDisclosed = false;
         const injectTaskNotification = (notification, opts) => {
+            if (opts?.priority === "now" && !priorityNowDisclosed) {
+                priorityNowDisclosed = true;
+                deliverEngineNotice(this.deps.onNotice, {
+                    code: "task.injection_priority_unimplemented",
+                    message: `a notification was injected with priority "now", which this engine does not implement: all injection ` +
+                        `priorities deliver at the NEXT turn boundary and none aborts the running turn. The notification is ` +
+                        `delivered — only the interrupting semantics are absent.`,
+                    detail: { priority: "now", ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}) },
+                });
+            }
             if (deliveredAtTurnOpen.has(taskNotificationDedupKey(notification)))
                 return Promise.resolve("dropped_duplicate");
             if (!notificationLaneLive) {
@@ -2098,7 +2166,12 @@ export class Runner {
                 this.pendingSessionNotifications.pend(notificationSessionId, p);
         };
         prepared.harness.engineInjectionsHeld = () => prepared.batchHaltRef.current !== undefined;
+        let undrainedUserAtEnd;
         prepared.harness.onUndrainedUserInputs = (counts) => {
+            if (prepared.suspendRef.token !== undefined || prepared.reviewRef.token !== undefined) {
+                undrainedUserAtEnd = counts;
+                return;
+            }
             for (const notice of undrainedUserInputNotices(counts, spec.taskId)) {
                 deliverEngineNotice(this.deps.onNotice, notice);
             }
@@ -2127,7 +2200,7 @@ export class Runner {
                 }
             }
         }
-        const loopLatch = { ended: false };
+        const loopLatch = { ended: false, userInterrupted: false };
         onReady({ harness: prepared.harness, abortController: prepared.abortController, loop: loopLatch, reminderMark: prepared.reminderMark });
         const stats = { turns: 0, tokens: 0, toolCalls: 0, promptTokens: 0, totalInputTokens: 0, cachedTokens: 0, cacheWriteTokens: 0, cacheWriteTokensLong: 0, outputTokens: 0, costMicroUsd: 0 };
         prepared.liveSpendRef.get = () => ({ costMicroUsd: stats.costMicroUsd, tokens: stats.tokens, turns: stats.turns, walltimeMs: Math.round(performance.now() - rs.telemetry.taskStartMonotonic) });
@@ -2809,12 +2882,21 @@ export class Runner {
                     return [];
                 let result;
                 try {
-                    result = await stopHook({
+                    const stopSeat = await runHookSeat("stop", { timeoutMs: prepared.hookTimeoutMs, signal: prepared.abortController.signal, abortEnds: true }, (sig) => stopHook({
                         stopHookActive: consecutiveBlocks > 0,
                         consecutiveBlocks,
                         getBranch: () => prepared.session.getBranch(),
                         identity: prepared.hookIdentity,
-                    });
+                        signal: sig,
+                    }));
+                    if (stopSeat.expired) {
+                        if (stopSeat.cause === "timeout") {
+                            this.deps.onError?.(hookSeatExpiredError("stop", prepared.hookTimeoutMs, stopSeat.cause, "the run was allowed to END (the seat's own no-opinion answer); no pushback and no additional context were injected"), { phase: "hook", sessionId: prepared.sessionId });
+                        }
+                        consecutiveBlocks = 0;
+                        return [];
+                    }
+                    result = stopSeat.value;
                 }
                 catch (err) {
                     this.deps.onError?.(err instanceof Error ? err : new Error(String(err)), { phase: "hook", sessionId: prepared.sessionId });
@@ -2889,7 +2971,7 @@ export class Runner {
                             ...this.seamCCompactionOptions(prepared),
                             ...gitRestateOption(prepared),
                             ...windowSafetyOptions(prepared.harness.getModel()),
-                            ...this.compactionHookOptions(spec, prepared.sessionId, "forced", prepared.hookIdentity),
+                            ...this.compactionHookOptions(spec, prepared.sessionId, "forced", prepared.hookIdentity, { timeoutMs: prepared.hookTimeoutMs, signal: prepared.abortController.signal }),
                         });
                         if (comp.compacted) {
                             compactionBreaker.failures = 0;
@@ -2954,7 +3036,7 @@ export class Runner {
             runnerHooks: {
                 onError: this.deps.onError,
                 seamCCompactionOptions: (p) => this.seamCCompactionOptions(p),
-                compactionHookOptions: (s, sid, trig) => this.compactionHookOptions(s, sid, trig, prepared.hookIdentity),
+                compactionHookOptions: (s, sid, trig) => this.compactionHookOptions(s, sid, trig, prepared.hookIdentity, { timeoutMs: prepared.hookTimeoutMs, signal: prepared.abortController.signal }),
                 recordCompactionReuse: (p, c) => this.recordCompactionReuse(p, c),
             },
         });
@@ -3057,6 +3139,7 @@ export class Runner {
         let final;
         let threw;
         let abortedLive = false;
+        let userInterruptedLive = false;
         let strandedHumanAnswers = [];
         try {
             if (prepared.abortController.signal.aborted) {
@@ -3184,7 +3267,23 @@ export class Runner {
                 const userPromptSubmit = (spec.hooks ?? this.deps.hooks)?.userPromptSubmit;
                 if (userPromptSubmit) {
                     try {
-                        const decision = await userPromptSubmit(spec.objective, { identity: prepared.hookIdentity });
+                        const promptSeat = await runHookSeat("userPromptSubmit", { timeoutMs: prepared.hookTimeoutMs, signal: prepared.abortController.signal, abortEnds: true }, (sig) => userPromptSubmit(spec.objective, { identity: prepared.hookIdentity, signal: sig }));
+                        if (promptSeat.expired) {
+                            if (promptSeat.cause === "timeout") {
+                                try {
+                                    this.deps.onError?.(hookSeatExpiredError("userPromptSubmit", prepared.hookTimeoutMs, promptSeat.cause, "the prompt was NOT submitted (fail-closed) and the task ends blocked"), { phase: "hook", sessionId: prepared.sessionId });
+                                }
+                                catch {
+                                }
+                            }
+                            prepared.blockedRef.reason = formatHookFeedback(promptSeat.cause === "timeout"
+                                ? `the deployment's userPromptSubmit hook did not answer within its ${prepared.hookTimeoutMs}ms bound while screening this prompt; ` +
+                                    `the prompt was NOT submitted (fail-closed)`
+                                : `the task was cancelled while the deployment's userPromptSubmit hook was still screening this prompt; ` +
+                                    `the prompt was NOT submitted (fail-closed)`, prepared.reminderMark);
+                            promptBlocked = true;
+                        }
+                        const decision = promptSeat.expired ? undefined : promptSeat.value;
                         if (decision?.block) {
                             prepared.blockedRef.reason = formatHookFeedback(decision.block, prepared.reminderMark);
                             promptBlocked = true;
@@ -3353,6 +3452,7 @@ export class Runner {
             }
             loopLatch.ended = true;
             abortedLive = prepared.abortController.signal.aborted;
+            userInterruptedLive = loopLatch.userInterrupted;
         }
         catch (err) {
             loopLatch.ended = true;
@@ -3364,6 +3464,7 @@ export class Runner {
             }
             threw = err;
             abortedLive = prepared.abortController.signal.aborted;
+            userInterruptedLive = loopLatch.userInterrupted;
         }
         finally {
             timeout.clear();
@@ -3401,13 +3502,17 @@ export class Runner {
         const durablyPaused = suspended || reviewPaused;
         const interrupted = !durablyPaused &&
             (threw !== undefined || timeout.fired || rs.limits.turnsExceeded || rs.limits.budgetHit !== undefined || abortedLive || final?.stopReason === "aborted");
+        let orphansClosed = 0;
+        let reconcileComplete = false;
         if (interrupted) {
             try {
                 const report = await reconcileInterruptedSession(prepared.session, prepared.toolEffects, undefined, startedToolCallIds);
+                orphansClosed = report.recovered.length;
                 for (const orphan of report.recovered) {
                     queue.push({ type: "tool_end", toolCallId: orphan.toolCallId, toolName: orphan.toolName, ...(toolLabels.has(orphan.toolName) ? { label: toolLabels.get(orphan.toolName) } : {}), isError: true, ...reconciledToolEndBody(orphan), ...ident() });
                     emitCommitted(orphan.entryId, "toolResult", orphan.toolCallId);
                 }
+                reconcileComplete = true;
             }
             catch (reconcileErr) {
                 this.deps.onError?.(reconcileErr instanceof Error ? reconcileErr : new Error(String(reconcileErr)), {
@@ -3425,6 +3530,52 @@ export class Runner {
                 });
             }
         }
+        if (interrupted && userInterruptedLive && reconcileComplete) {
+            try {
+                const entryId = await appendInterruptionMarker(prepared.session, { toolUseInFlight: orphansClosed > 0 });
+                emitCommitted(entryId, "user");
+            }
+            catch (markerErr) {
+                this.deps.onError?.(markerErr instanceof Error ? markerErr : new Error(String(markerErr)), {
+                    phase: "interrupt-reconcile",
+                    sessionId: prepared.sessionId,
+                });
+            }
+        }
+        let migratedParked = { steer: 0, followUp: 0 };
+        const parkToken = prepared.suspendRef.token ?? prepared.reviewRef.token;
+        const parkScope = prepared.suspendRef.token !== undefined ? prepared.suspendRef.scope : prepared.reviewRef.scope;
+        if (durablyPaused && parkToken !== undefined && parkScope !== undefined && this.deps.checkpointStore !== undefined) {
+            const store = this.deps.checkpointStore;
+            const carried = [];
+            for (const record of prepared.harness.readParkableUserInputs()) {
+                try {
+                    if (!(await store.setPendingSteer(parkToken, parkScope, record)))
+                        break;
+                    carried.push(record);
+                }
+                catch (parkErr) {
+                    this.deps.onError?.(parkErr instanceof Error ? parkErr : new Error(String(parkErr)), {
+                        phase: "config",
+                        sessionId: prepared.sessionId,
+                    });
+                    const parkCode = errorCodeOf(parkErr);
+                    if (parkCode === "steering.invalid_content" || parkCode === "steering.queue_full")
+                        continue;
+                    break;
+                }
+            }
+            migratedParked = prepared.harness.dropParkedUserInputs(carried);
+        }
+        if (undrainedUserAtEnd !== undefined) {
+            const remaining = {
+                steer: Math.max(0, undrainedUserAtEnd.steer - migratedParked.steer),
+                followUp: Math.max(0, undrainedUserAtEnd.followUp - migratedParked.followUp),
+            };
+            for (const notice of undrainedUserInputNotices(remaining, spec.taskId)) {
+                deliverEngineNotice(this.deps.onNotice, notice);
+            }
+        }
         if (rs.attach.attachState?.postCompactPending === true && (rs.attach.attachmentsCfg?.backgroundTasks ?? eventDefaultOn("background_tasks")) === true) {
             emitTrace(rs.telemetry.tracer, () => ({ kind: "compaction.announce_dropped", version: 1, taskId: rs.telemetry.taskId, ts: Date.now() }));
         }
@@ -3434,6 +3585,7 @@ export class Runner {
             brain: compactionBrain,
             windowSafety: windowSafetyOptions(prepared.model),
             onCompactionFailed: (reason) => queue.push({ type: "compaction_outcome", outcome: "failed", trigger: "auto", reason, ...ident() }),
+            cancelled: abortedLive,
         });
         try {
             if (comp?.compacted) {
@@ -3596,12 +3748,20 @@ export class Runner {
                 !abortedLive &&
                 result.errorCode !== "conflict") {
                 try {
-                    await stopFailureHook({
+                    const failureSeat = await runHookSeat("stopFailure", { timeoutMs: prepared.hookTimeoutMs }, (sig) => stopFailureHook({
                         identity: prepared.hookIdentity,
                         error: result.errorMessage ?? "model error",
                         ...(result.errorCode !== undefined ? { errorKind: result.errorCode } : {}),
                         turns: stats.turns,
-                    });
+                        signal: sig,
+                    }));
+                    if (failureSeat.expired) {
+                        try {
+                            this.deps.onError?.(hookSeatExpiredError("stopFailure", prepared.hookTimeoutMs, failureSeat.cause, "the terminal observation was abandoned; the assembled TaskResult is unchanged"), { phase: "hook", sessionId: prepared.sessionId });
+                        }
+                        catch {
+                        }
+                    }
                 }
                 catch (err) {
                     try {
@@ -3770,6 +3930,14 @@ export class Runner {
             }
             catch {
             }
+            if (!sameRouteIdentity(model, prepared.model)) {
+                const verdict = await adjudicateDerivedRoute({ brain: this.deps.brain, model, getApiKeyAndHeaders: spec.getApiKeyAndHeaders });
+                if (verdict !== undefined && !verdict.ok) {
+                    deliverEngineNotice(this.deps.onNotice, fallbackToPrimaryNotice({ seat: "prompt-suggestions", from: model.id, to: prepared.model.id, verdict }));
+                    model = prepared.model;
+                    thinking = prepared.thinking;
+                }
+            }
             const pricing = this.deps.pricing?.[model.id] ?? modelCostToPricing(model.cost);
             const ctx = await prepared.session.buildContext();
             const transcript = ctx.messages.slice(-SUGGESTIONS_TRANSCRIPT_MESSAGES);
@@ -4612,10 +4780,12 @@ export class Runner {
             consecutiveProviderReuse: prepared.compactionReuseRef.consecutive,
         };
     }
-    compactionHookOptions(spec, sessionId, trigger, identity) {
+    compactionHookOptions(spec, sessionId, trigger, identity, seatBound) {
         const hooks = spec.hooks ?? this.deps.hooks;
         const pre = hooks?.preCompact;
         const post = hooks?.postCompact;
+        const seatMs = seatBound?.timeoutMs ?? resolveHookTimeoutMs(hooks?.timeoutMs);
+        const seatSignal = seatBound?.signal;
         const withIdentity = (ctx) => identity !== undefined ? { ...ctx, identity } : ctx;
         return {
             trigger,
@@ -4631,7 +4801,12 @@ export class Runner {
                             }
                         };
                         try {
-                            const r = await pre.call(hooks, ctx);
+                            const seat = await runHookSeat("preCompact", { timeoutMs: seatMs, ...(seatSignal !== undefined ? { signal: seatSignal } : {}) }, (sig) => pre.call(hooks, { ...ctx, signal: sig }));
+                            if (seat.expired) {
+                                report(hookSeatExpiredError("preCompact", seatMs, seat.cause, `the "${ctx.trigger}" compaction PROCEEDED unblocked and with no additional instructions`));
+                                return undefined;
+                            }
+                            const r = seat.value;
                             if (r?.block && ctx.trigger === "forced") {
                                 report(new Error(`a preCompact callback blocked a "forced" compaction — ignored (PTL/trim-pressure compaction is not optional): ${r.block}`));
                             }
@@ -4648,7 +4823,14 @@ export class Runner {
                 ? {
                     postCompact: async (rawCtx) => {
                         try {
-                            await post.call(hooks, withIdentity(rawCtx));
+                            const seat = await runHookSeat("postCompact", { timeoutMs: seatMs, ...(seatSignal !== undefined ? { signal: seatSignal } : {}) }, (sig) => post.call(hooks, { ...withIdentity(rawCtx), signal: sig }));
+                            if (seat.expired) {
+                                try {
+                                    this.deps.onError?.(hookSeatExpiredError("postCompact", seatMs, seat.cause, "the observation was abandoned; the compaction that already landed is unchanged"), { phase: "hook", sessionId });
+                                }
+                                catch {
+                                }
+                            }
                         }
                         catch (err) {
                             try {
@@ -4692,7 +4874,10 @@ export class Runner {
                     ...(prepared.onCompactionApplied ? { onApplied: prepared.onCompactionApplied } : {}),
                     ...this.seamCCompactionOptions(prepared),
                     ...gitRestateOption(prepared),
-                    ...this.compactionHookOptions(spec, prepared.sessionId, "auto", prepared.hookIdentity),
+                    ...this.compactionHookOptions(spec, prepared.sessionId, "auto", prepared.hookIdentity, {
+                        timeoutMs: prepared.hookTimeoutMs,
+                        ...(opts?.cancelled === true ? { signal: prepared.abortController.signal } : {}),
+                    }),
                 });
                 this.recordCompactionReuse(prepared, finishComp);
                 if (finishComp.unevaluableWindow) {

package/dist/core/runner/session-rule-policy.js

@@ -1,6 +1,6 @@
 import { canonicalizeTarget, writeTargetPath } from "../../tools/fs/safety.js";
 import { isWinFormPath } from "../../tools/fs/safety.js";
-import { createCoarseCommandNamePolicy, mcpCoveringEntries, mcpCoveringHit } from "../tool-policy.js";
+import { createCoarseCommandNamePolicy, namespacedCoveringEntries, namespacedCoveringHit } from "../tool-policy.js";
 export const PATH_WRITE_TOOLS = new Set(["Write", "Edit", "MultiEdit"]);
 export const PATH_CONFINABLE_WRITE_TOOLS = new Set([...PATH_WRITE_TOOLS, "NotebookEdit"]);
 export function isWithin(root, p) {
@@ -24,8 +24,8 @@ export function createSessionRulePolicy(rules, opts) {
     const { env, rootPath, toolEffects } = opts;
     const toolDeny = new Set(rules.toolDeny ?? []);
     const toolAllow = rules.toolAllow ? new Set(rules.toolAllow) : undefined;
-    const toolDenyCovering = mcpCoveringEntries(rules.toolDeny);
-    const toolAllowCovering = mcpCoveringEntries(rules.toolAllow);
+    const toolDenyCovering = namespacedCoveringEntries(rules.toolDeny);
+    const toolAllowCovering = namespacedCoveringEntries(rules.toolAllow);
     const cmdPolicy = rules.commandAllow || rules.commandDeny
         ? createCoarseCommandNamePolicy({
             ...(rules.commandAllow ? { allow: rules.commandAllow } : {}),
@@ -38,9 +38,9 @@ export function createSessionRulePolicy(rules, opts) {
         nameSets: [{ ...(rules.toolDeny?.length ? { deny: [...rules.toolDeny] } : {}), ...(rules.toolAllow?.length ? { allow: [...rules.toolAllow] } : {}) }],
         async check(req, signal) {
             const toolName = req.toolName;
-            if (toolDeny.has(toolName) || mcpCoveringHit(toolDenyCovering, toolName))
+            if (toolDeny.has(toolName) || namespacedCoveringHit(toolDenyCovering, toolName))
                 return deny(`tool "${req.toolName}" is denied by a session rule`);
-            if (toolAllow && !toolAllow.has(toolName) && !mcpCoveringHit(toolAllowCovering, toolName)) {
+            if (toolAllow && !toolAllow.has(toolName) && !namespacedCoveringHit(toolAllowCovering, toolName)) {
                 return deny(`tool "${req.toolName}" is not in the session-rule allowlist`);
             }
             if (cmdPolicy) {

package/dist/core/scheduler.d.ts

@@ -147,6 +147,11 @@ export interface SchedulerCapability {
          * 不得热翻）——工具壳的门控读与 `schedule()` 是两次操作，中途翻位会让 session intent 落到不会 reap 的
          * backend 上。防线双置：声明面不可变 + `schedule()` 实现 MUST 自行拒绝它无法履行 reap 契约的
          * `lifetime:"session"` intent（fail-closed 兜底，不依赖工具壳的先行探测）。
+         *
+         * 「诚实拒绝」条款的适用边界：它约束**携带 session 语义字段的调用**（CronCreate 的 `durable` 形）。
+         * 一个没有 durable 逃生口的工具（ScheduleWakeup 形）对不支持位的 backend 走的是另一臂——发送
+         * 历史 durable intent 并在回执与工具描述上**披露**该 wakeup 不随会话终结（披露≠静默；拒绝会在
+         * 零收益下拿掉该宿主的整只工具）。该臂为既裁形（capability 位 opt-out 裁定），非本条款的违例。
          */
         readonly supportsSessionLifetime?: boolean;
         /**

package/dist/core/session-reconcile.d.ts

@@ -84,6 +84,38 @@ export interface ReconcileReport {
  * `runner.resume()` uses a checkpoint-aware entry that bypasses this reconcile entirely for those calls.
  */
 export declare function findOrphanToolCalls(messages: AgentMessage[], suspendedBatch?: ReadonlySet<string>): OrphanToolCall[];
+/**
+ * backlog #389 伴生 (D-2) — CC 2.1.223's interruption markers, VERBATIM (`$U`/`CR` @ `CC:151120-151121`,
+ * minted as a USER message by `Jce` @ `CC:640141-640154`). CC mints one on every abort whose reason is
+ * outside `{"interrupt","refusal-fallback-edit"}` — and the interactive Esc / remote cancel, which is
+ * what `TaskStream.interrupt()` corresponds to, is precisely on the minting side (`CC:1033698-1033733`).
+ * The suppressed reason is the one case where the user's own replacement message is already the context.
+ *
+ * Taken verbatim rather than reworded: this string is an INPUT to later reasoning in CC (its own
+ * "interrupted then immediately retried the same action" rule reads it back), and the constitution's
+ * standing rule is that a question CC has answered is answered in CC's form.
+ */
+export declare const INTERRUPTED_BY_USER_MARKER = "[Request interrupted by user]";
+/** backlog #389 伴生 — the tool-use variant (`CR`): the run was cut while a tool batch was in flight. */
+export declare const INTERRUPTED_BY_USER_FOR_TOOL_USE_MARKER = "[Request interrupted by user for tool use]";
+/**
+ * backlog #389 伴生 (D-2) — append the interruption marker so the SESSION records that a person stopped
+ * this run.
+ *
+ * Without it, an interrupt that lands on the model stream (no tool call in flight) leaves literally no
+ * trace: the orphan reconcile has nothing to close, and the empty aborted assistant is deliberately not
+ * persisted (`isEmptyFailureAssistant`). The next run on that session then reads a transcript in which
+ * the half-finished work simply stops, and continues as if it had ended by itself.
+ *
+ * MUST be called AFTER {@link reconcileInterruptedSession} on the same interruption: a user message
+ * placed between an assistant's tool calls and their results is exactly the invalid sequence the
+ * reconcile exists to prevent.
+ *
+ * Returns the persisted entry id so the caller can mint its `message_committed` frame.
+ */
+export declare function appendInterruptionMarker(session: Session, opts: {
+    toolUseInFlight: boolean;
+}): Promise<string>;
 /**
  * Reconcile a resumed session's active branch: close any orphan tool calls with a synthetic
  * interrupted `toolResult` (never re-running the tool). Returns what was recovered.

package/dist/core/session-reconcile.js

@@ -81,6 +81,21 @@ export function findOrphanToolCalls(messages, suspendedBatch) {
     });
     return orphans;
 }
+export const INTERRUPTED_BY_USER_MARKER = "[Request interrupted by user]";
+export const INTERRUPTED_BY_USER_FOR_TOOL_USE_MARKER = "[Request interrupted by user for tool use]";
+export async function appendInterruptionMarker(session, opts) {
+    return await session.appendMessage({
+        role: "user",
+        content: [
+            {
+                type: "text",
+                text: opts.toolUseInFlight ? INTERRUPTED_BY_USER_FOR_TOOL_USE_MARKER : INTERRUPTED_BY_USER_MARKER,
+            },
+        ],
+        provenance: "engine-note",
+        timestamp: Date.now(),
+    });
+}
 export async function reconcileInterruptedSession(session, toolEffects, suspendedBatch, startedToolCallIds) {
     const { messages } = await session.buildContext();
     const orphans = findOrphanToolCalls(messages, suspendedBatch).filter((o) => o.kind !== "result");

package/dist/core/side-query.d.ts

@@ -57,11 +57,18 @@ export interface SideQuerySpec {
     /**
      * Per-model auth — MIRRORS {@link TaskSpec.getApiKeyAndHeaders} (same signature, resolved per
      * call against the RESOLVED model, exactly like the task path's per-call hook). The brain
-     * contract is `options.apiKey ?? config.apiKey`, and a model's own `baseUrl` outranks the
-     * brain's — so before this seat existed, a side query routed to a model carrying its own
-     * `baseUrl` + per-model key fell back to the brain's construction-time credential and sent the
-     * GATEWAY key to the per-model (possibly external) URL: a credential leak the task path already
-     * prevents. Absent ⇒ construction-time credentials apply, options byte-identical to before.
+     * contract is the route pairing law (route-adjudicator.ts): a per-model credential (this hook,
+     * or an auth header on `Model.headers`) always rides; the deployment credential rides only where
+     * its pairing is verifiable-or-unpinned — a declared `config.baseUrl` with an off-root model is
+     * refused (`route.credential_mismatch` / `route.credential_missing`), never silently followed.
+     * Historically the fallback was unconditional (`options.apiKey ?? config.apiKey`, with a model's
+     * own `baseUrl` outranking the brain's), so a side query routed to a model carrying its own
+     * `baseUrl` + per-model key sent the GATEWAY key to the per-model (possibly external) URL — the
+     * credential leak the pairing law now stops. Absent seat ⇒ no options are minted (byte-identical
+     * to before): on an UNDECLARED root the construction-time credential still applies (the
+     * quick-start posture), while a declared-root brain + off-root model hard-fails the side query
+     * with the loud refusal (`stopReason: "error"`) instead of leaking — there is no primary model
+     * for a side query to fall back to.
      */
     getApiKeyAndHeaders?: TaskSpec["getApiKeyAndHeaders"];
     signal?: AbortSignal;