@sema-agent/core 5.58.0 → 5.59.0

package/dist/core/permission-rule-model.js

@@ -1,5 +1,6 @@
 import { parsePermissionRule } from "./permission-rules.js";
 import { parseLeadingCommandName, splitShellCompoundSegments } from "../tools/fs/bash-readonly-classifier.js";
+import { inlineUntrusted } from "./untrusted-text.js";
 export const MAX_RULE_TEXT_CHARS = 512;
 export const BARE_INTERPRETER_NAMES = new Set([
     "node", "deno", "bun", "python", "python2", "python3", "perl", "ruby", "php", "osascript",
@@ -162,6 +163,17 @@ export function escapeForDisclosure(value) {
     });
     return escaped.length <= DISCLOSED_RULE_TEXT_MAX_CHARS ? escaped : `${escaped.slice(0, DISCLOSED_RULE_TEXT_MAX_CHARS)}…`;
 }
+const DISPLAY_STRIP_FORMAT_RE = /\p{Cf}/gu;
+export function renderUntrustedCommandText(text, maxLen = DISCLOSED_RULE_TEXT_MAX_CHARS) {
+    let raw;
+    try {
+        raw = typeof text === "string" ? text : String(text);
+    }
+    catch {
+        return "<unprintable>";
+    }
+    return inlineUntrusted(raw.replace(DISPLAY_STRIP_FORMAT_RE, ""), maxLen);
+}
 export function hasUnrenderableCharacters(text) {
     return CONTROL_CHARS_RE.test(text);
 }

package/dist/core/runner/prepare-task.js

@@ -482,7 +482,7 @@ async function derivedRouteFallsBack(args) {
         const verdict = await adjudicateDerivedRoute({ brain: args.brain, model: args.derived, getApiKeyAndHeaders: args.getApiKeyAndHeaders });
         if (verdict === undefined || verdict.ok)
             return false;
-        deliverEngineNotice(args.onNotice, fallbackToPrimaryNotice({ seat: args.seat, from: args.derived.id, to: args.primary.id, verdict }));
+        deliverEngineNotice(args.onNotice, fallbackToPrimaryNotice({ seat: args.seat, from: args.derived.id, to: args.primary.id, verdict, ...(args.sessionId !== undefined ? { sessionId: args.sessionId } : {}) }));
         return true;
     }
     catch {
@@ -509,7 +509,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
     let effectiveCompModel = compModel;
     if (spec.compactionModel === undefined &&
         compModel !== undefined &&
-        (await derivedRouteFallsBack({ seat: "compaction-summary", derived: compModel, primary: model, brain: deps.brain, getApiKeyAndHeaders: spec.getApiKeyAndHeaders, onNotice: deps.onNotice }))) {
+        (await derivedRouteFallsBack({ seat: "compaction-summary", derived: compModel, primary: model, brain: deps.brain, getApiKeyAndHeaders: spec.getApiKeyAndHeaders, onNotice: deps.onNotice, sessionId }))) {
         effectiveCompModel = undefined;
     }
     warnCompactionWindowHazard(deps.tracer, spec, model, effectiveCompModel, hostTaskId);
@@ -1096,7 +1096,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             catch {
                 classifierModel = model;
             }
-            if (await derivedRouteFallsBack({ seat: "auto-mode-classifier", derived: classifierModel, primary: model, brain: deps.brain, getApiKeyAndHeaders: spec.getApiKeyAndHeaders, onNotice: deps.onNotice })) {
+            if (await derivedRouteFallsBack({ seat: "auto-mode-classifier", derived: classifierModel, primary: model, brain: deps.brain, getApiKeyAndHeaders: spec.getApiKeyAndHeaders, onNotice: deps.onNotice, sessionId })) {
                 classifierModel = model;
             }
             const classifierSystemPrompt = buildAutoModePrompt(am);

package/dist/core/runner/runtask.js

@@ -2095,7 +2095,7 @@ export class Runner {
                     message: `a notification was injected with priority "now", which this engine does not implement: all injection ` +
                         `priorities deliver at the NEXT turn boundary and none aborts the running turn. The notification is ` +
                         `delivered — only the interrupting semantics are absent.`,
-                    detail: { priority: "now", ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}) },
+                    detail: { priority: "now", ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), sessionId: prepared.sessionId },
                 });
             }
             if (deliveredAtTurnOpen.has(taskNotificationDedupKey(notification)))
@@ -2172,7 +2172,7 @@ export class Runner {
                 undrainedUserAtEnd = counts;
                 return;
             }
-            for (const notice of undrainedUserInputNotices(counts, spec.taskId)) {
+            for (const notice of undrainedUserInputNotices(counts, spec.taskId, prepared.sessionId)) {
                 deliverEngineNotice(this.deps.onNotice, notice);
             }
         };
@@ -3572,7 +3572,7 @@ export class Runner {
                 steer: Math.max(0, undrainedUserAtEnd.steer - migratedParked.steer),
                 followUp: Math.max(0, undrainedUserAtEnd.followUp - migratedParked.followUp),
             };
-            for (const notice of undrainedUserInputNotices(remaining, spec.taskId)) {
+            for (const notice of undrainedUserInputNotices(remaining, spec.taskId, prepared.sessionId)) {
                 deliverEngineNotice(this.deps.onNotice, notice);
             }
         }
@@ -3933,7 +3933,7 @@ export class Runner {
             if (!sameRouteIdentity(model, prepared.model)) {
                 const verdict = await adjudicateDerivedRoute({ brain: this.deps.brain, model, getApiKeyAndHeaders: spec.getApiKeyAndHeaders });
                 if (verdict !== undefined && !verdict.ok) {
-                    deliverEngineNotice(this.deps.onNotice, fallbackToPrimaryNotice({ seat: "prompt-suggestions", from: model.id, to: prepared.model.id, verdict }));
+                    deliverEngineNotice(this.deps.onNotice, fallbackToPrimaryNotice({ seat: "prompt-suggestions", from: model.id, to: prepared.model.id, verdict, sessionId: prepared.sessionId }));
                     model = prepared.model;
                     thinking = prepared.thinking;
                 }

package/dist/core/tool-policy.d.ts

@@ -576,6 +576,13 @@ export declare function createAllowDenyPolicy(opts: {
  * Human-in-the-loop approval for selected tools. Tools in `requireApproval` call `approve(req)` and
  * are allowed only if it resolves true; tools in `deny` are always blocked; everything else is allowed
  * (override with `denyByDefault: true` to allow only `requireApproval` + an explicit `autoAllow`).
+ *
+ * This seat receives a bare `ToolCallRequest`, NOT the ask surface: the decision settles in-place
+ * inside the policy, no AskRequest is minted and `resolveAsk` is never entered — so none of the
+ * ask-side approval members (`hasBidiControls`, `boundInputHash`, `preview`, `riskAxes`, …) exist
+ * here. A surface rendering the command text for a human on this seat must render through
+ * {@link import("./permission-rule-model.js").renderUntrustedCommandText} (the display baseline)
+ * or run its own screen — absence of the warning bit is "not on this surface", never "clean".
  */
 export declare function createApprovalPolicy(opts: {
     /** Tools that need an approval decision. */
@@ -952,6 +959,43 @@ export interface AskRequest {
      *  so this — like `principal`/`sourceTaskId` — exists only on the synchronous resolution path.
      *  See {@link AskDelegationProvenance} for the trust posture of each member. */
     readonly delegation?: AskDelegationProvenance;
+    /**
+     * PRESENCE ONLY: the command/argument text this ask is about carries at least one DIRECTIONAL
+     * format control ({@link BIDI_CONTROL_RE} — the closed set: U+061C, U+200E/U+200F, the embeddings
+     * and overrides U+202A–U+202E, the isolates U+2066–U+2069). Those characters change nothing about
+     * what EXECUTES and everything about what a terminal or a card SHOWS: bytes that run
+     * `rm -rf /` can display as a benign line, which is precisely the deception an approval surface
+     * cannot afford to render unannotated.
+     *
+     * A WARNING BIT, not a verdict and not a transform. Core does NOT strip, reorder, refuse or rewrite
+     * anything on account of it — {@link args} is delivered byte-identical either way, and the decision
+     * stays the approver's. What a surface owes the person is a visible "the text below can display
+     * differently from what it runs" and a rendering that neutralizes the controls (see
+     * {@link import("./permission-rule-model.js").renderUntrustedCommandText} for the display baseline).
+     *
+     * Read it as PRESENCE-or-nothing: the field is either `true` or ABSENT. It is never written `false`,
+     * because absence means "not detected", which honestly covers both "clean" and "the bounded scan did
+     * not reach it" (a pathologically deep or huge argument graph stops at the scan budget) — a `false`
+     * would claim a proof the scan does not offer. Judged over the EXECUTING argument snapshot and the
+     * tool's own {@link preview} projection, i.e. the payload; {@link message} is deliberately out of
+     * scope (engine/policy-composed prose, not the thing that runs).
+     *
+     * Filled at the `resolveAsk` chokepoint, beside {@link boundInputHash} — every wired `onAsk`
+     * approver call crosses it, so an ask mint site added later is covered by construction. Optional
+     * on the type because a deployment may invoke its approver function directly.
+     *
+     * SCOPE, stated so absence is not read as a clean bill on the other routes: this is the
+     * SYNCHRONOUS `onAsk` ask, like `principal`/`sourceTaskId` — the closure claim is over AskRequest
+     * mint sites, not over every approval callback. Two human-decision routes never receive it:
+     * ① a durable park/suspend never invokes `onAsk`, so a parked approval row carries no twin of
+     * this bit today — an inbox rendering `RiskDescriptor` must run its own screen (or the display
+     * baseline above) rather than infer "no bit, no problem"; ② {@link createApprovalPolicy}'s
+     * `approve` seat resolves in-place inside the policy and mints no AskRequest at all — its
+     * callback receives a bare `ToolCallRequest` (no bit, no {@link boundInputHash}, none of this
+     * surface), so a deployment doing HITL through that seat must render through
+     * {@link import("./permission-rule-model.js").renderUntrustedCommandText} or run its own screen.
+     */
+    readonly hasBidiControls?: true;
 }
 /**
  * How an `ask` decision is resolved when a policy/hook requests human confirmation (design/37):
@@ -1176,6 +1220,20 @@ export type ResolvedAsk = PermissionResult & {
      *  frame), so a consumer classifies a refusal by code instead of parsing its text. */
     resolution?: AskDenyResolution;
 };
+/**
+ * Does any string reachable in `value` carry a {@link BIDI_CONTROL_RE} member? Bounded, cycle-safe,
+ * and never throwing — the one caller is on the approval path, where a scan that failed must degrade
+ * to "not detected" rather than turn an ask into an error (the `deliverEngineNotice` posture: a
+ * derived disclosure must never become the failure of the thing it describes).
+ *
+ * OBJECT KEYS are scanned as well as values: a key is displayed text too, and an argument object
+ * `{ "cmd<RLO>": … }` renders its own reordering in any card that prints the shape (the marker
+ * is spelled out here on purpose — a literal one in this comment would reorder the comment).
+ *
+ * Not a public export: the contract is the {@link AskRequest.hasBidiControls} bit, and a second
+ * spelling of "does this carry bidi" on the public surface would be one more thing to keep in step.
+ */
+export declare function carriesBidiControls(value: unknown): boolean;
 /**
  * Resolve an `ask` decision to a terminal `allow`/`deny` via {@link OnAsk}. Centralizes the headless
  * auto-deny default, fail-closed error handling, and stable deny reasons so every ask site is

package/dist/core/tool-policy.js

@@ -900,6 +900,78 @@ export function coreMintedResolutionOf(d, call) {
         return undefined;
     return isAskDenyResolution(v.resolution) ? v.resolution : undefined;
 }
+const BIDI_CONTROL_RE = /[\u061C\u200E\u200F\u202A-\u202E\u2066-\u2069]/u;
+const BIDI_SCAN_MAX_NODES = 5_000;
+const BIDI_SCAN_MAX_CHARS = 1_000_000;
+export function carriesBidiControls(value) {
+    let budget = BIDI_SCAN_MAX_NODES;
+    let charBudget = BIDI_SCAN_MAX_CHARS;
+    const seen = new WeakSet();
+    const scan = (s) => {
+        if (charBudget <= 0)
+            return false;
+        const window = s.length <= charBudget ? s : s.slice(0, charBudget);
+        charBudget -= window.length;
+        return BIDI_CONTROL_RE.test(window);
+    };
+    const walk = (v) => {
+        if (budget-- <= 0)
+            return false;
+        if (typeof v === "string")
+            return scan(v);
+        if (typeof v !== "object" || v === null)
+            return false;
+        if (seen.has(v))
+            return false;
+        seen.add(v);
+        if (Array.isArray(v)) {
+            for (const el of v) {
+                if (walk(el))
+                    return true;
+                if (budget <= 0)
+                    return false;
+            }
+            return false;
+        }
+        if (v instanceof Map) {
+            for (const [k, val] of v) {
+                if (walk(k) || walk(val))
+                    return true;
+                if (budget <= 0)
+                    return false;
+            }
+            return false;
+        }
+        if (v instanceof Set) {
+            for (const el of v) {
+                if (walk(el))
+                    return true;
+                if (budget <= 0)
+                    return false;
+            }
+            return false;
+        }
+        for (const k in v) {
+            if (budget-- <= 0)
+                return false;
+            if (!Object.prototype.hasOwnProperty.call(v, k))
+                continue;
+            if (scan(k))
+                return true;
+            if (walk(v[k]))
+                return true;
+            if (budget <= 0 || charBudget <= 0)
+                return false;
+        }
+        return false;
+    };
+    try {
+        return walk(value);
+    }
+    catch {
+        return false;
+    }
+}
 export async function resolveAsk(req, onAsk, signal) {
     const r = await resolveAskArms(req, onAsk, signal);
     if (r.action === "deny" && isAskDenyResolution(r.resolution))
@@ -954,7 +1026,14 @@ async function resolveAskArms(req, onAsk, signal) {
                 settledBy: "aborted",
             };
         }
-        ok = await onAsk({ ...req, boundInputHash: boundInputHashOf(presented.value), args: approverView.value }, signal);
+        const bidi = carriesBidiControls(presented.value) || carriesBidiControls(req.preview);
+        const { hasBidiControls: _carried, ...bare } = req;
+        ok = await onAsk({
+            ...bare,
+            boundInputHash: boundInputHashOf(presented.value),
+            args: approverView.value,
+            ...(bidi ? { hasBidiControls: true } : {}),
+        }, signal);
     }
     catch (err) {
         return {

package/dist/core/types.d.ts

@@ -4850,8 +4850,9 @@ export interface EngineNotice {
      *    probe threw; MCP dispatch FAILS OPEN (revocation is a tightening face) and this announces
      *    once per materialization (a resume re-materializes and may announce again). `detail: { message }`
      *    — no sessionId (a deployment wiring fact, not session-attributed), `"operator"` audience by
-     *    the {@link NOTICE_AUDIENCE} default. The refusal itself (`mcp.server_revoked`) is a tool
-     *    RESULT code, not a notice.
+     *    its explicit {@link NOTICE_AUDIENCE} row (#433 made the registry total over the catalog —
+     *    no engine-minted code is audience-defaulted any more). The refusal itself
+     *    (`mcp.server_revoked`) is a tool RESULT code, not a notice.
      *  - `"config.models_swapped"` — `Runner.swapModels` replaced the model catalog generation
      *    (zero-restart model switching). `detail: { models, tiers }` — key COUNTS only, never the
      *    catalog itself. In-flight tasks finish on the models they resolved at prepare (natural
@@ -4860,8 +4861,11 @@ export interface EngineNotice {
      *  - `"route.fallback_to_primary"` (key↔URL pairing, `src/brain/route-adjudicator.ts`) — a
      *    DERIVED-leg model (role/tier/system-default resolution, never a caller-explicit one) failed
      *    the pairing pre-flight and the seat fell back to the primary model instead of sinking the
-     *    task; the notice is the loud half of that swap. `detail: { seat, from, to, cause, fixHint }`
-     *    — `cause` is the refusal code (`route.credential_mismatch` / `route.credential_missing`).
+     *    task; the notice is the loud half of that swap.
+     *    `detail: { seat, from, to, cause, fixHint, sessionId? }` — `cause` is the refusal code
+     *    (`route.credential_mismatch` / `route.credential_missing`); `sessionId` (#433, additive)
+     *    rides when the adjudicating seat knows its session — a correlation key only, the audience
+     *    stays `"operator"` (see the registry's entitlement-not-routability note).
      *    Explicitly-named models never mint this: they refuse at the brain's request gate instead.
      *  - `"route.base_url_changed_key_unchanged"` (key↔URL pairing) — `Runner.swapModels` moved a
      *    same-name entry's `baseUrl` while its Model-visible credential half (auth-bearing headers)
@@ -4906,8 +4910,10 @@ export interface EngineNotice {
      *    frame's two count keys). They are NOT redelivered (a steer aimed at a finished run must not
      *    fire at the next one — unlike ENGINE notes, which pend per session); the loud half of the
      *    #257 contract's "accepted = enqueued, not consumed" sentence;
-     *    `detail: { steer, taskId? }` / `{ followUp, taskId? }`. Per-run, at most once per family
-     *    (the terminal sweep is a single site).
+     *    `detail: { steer, taskId?, sessionId? }` / `{ followUp, taskId?, sessionId? }` (`sessionId`
+     *    = #433's routing half for these two `"user"`-audience rows — see
+     *    {@link undrainedUserInputNotices}; omitted when the caller has none, never fabricated).
+     *    Per-run, at most once per family (the terminal sweep is a single site).
      *    **#389 (two corrections).** ① The family now fires on the INTERRUPT path too: `abort()` used
      *    to empty both queues before agent_end could count them, so the one loss path an operator most
      *    needs to hear about was the one path that stayed silent. ② On a DURABLE PARK the verdict is
@@ -4924,7 +4930,10 @@ export interface EngineNotice {
      *    notification would be the worse error); what is announced is that the knob's promise is not
      *    honored, so an operator can stop building on it. Once per run (the injection funnel is a
      *    single site, and a busy lane must not narrate the same gap once per frame);
-     *    `detail: { priority, taskId? }`. An UNKNOWN priority value is a different fact with a
+     *    `detail: { priority, taskId?, sessionId }` — `sessionId` (#433, ALWAYS present: the funnel
+     *    sits past prepare, which owns a session unconditionally) is a correlation key only, the
+     *    audience stays `"operator"` (the party building on the unhonored knob is whoever called
+     *    notify, not the end user). An UNKNOWN priority value is a different fact with a
      *    different posture — `TaskStream.notify` refuses it typed (`notify.invalid_payload`).
      *
      *  - `"memory.session_polluted"` (design/178 §3, #324a; message mode-aware since design/336) —
@@ -4994,10 +5003,13 @@ export interface EngineNotice {
      *    `ConsolidationRunStopReason` set), cycles done, and the residue (write-failure or
      *    fuse-refused groups by name). Advisory: committed cycles stand (add-only, never rolled
      *    back); the recovery verb is re-running the host driver, which resumes the same pending run.
-     *  - `"memory.consolidation_driver_superseded"` (same family) — a concurrent driver invocation
-     *    took over this scope's run row (attempt fencing): the losing worker stops with this code
-     *    and MUST NOT retry into the winner's account. Coordination fact between two host calls,
-     *    not a principal ruling — listed in the non-governance disposition table.
+     *  - `"memory.consolidation_driver_superseded"` is an ERROR code, not a notice (named here only
+     *    to keep the family's spellings in one place): a concurrent driver invocation took over this
+     *    scope's run row (attempt fencing) and the losing worker's call THROWS with this `code` —
+     *    it never crosses {@link deliverEngineNotice}, is deliberately absent from
+     *    {@link ENGINE_NOTICE_CODES}/{@link NOTICE_AUDIENCE}, and sits in the non-governance
+     *    disposition table with the error dispositions. The loser MUST NOT retry into the winner's
+     *    account. A consumer diffing its own table against the catalog must not add a row for it.
      *
      *  - `"delegation.transcript_integrity"` (subagent transcript persistence) — a durable agent row
      *    with a BOUND transcript sessionId met a session store that attests `not_found` for it: the
@@ -5005,8 +5017,7 @@ export interface EngineNotice {
      *    most once per (scope, handle, process) — `detail: { handle, scope? }`, scope = the resolved
      *    access scope of the read that found the gap — from the continuation read faces (SendMessage preflight /
      *    AgentTranscript's durable leg); the per-call honest refusals are unchanged, and the declared
-     *    tier is NOT auto-downgraded (declaration-制 — observation reports, it never re-adjudicates);
-     *    `detail: { handle }`.
+     *    tier is NOT auto-downgraded (declaration-制 — observation reports, it never re-adjudicates).
      *
      *  - `"memory.consolidation_recommended"` (design/339 §2.2/§6.2) — the engine-minted per-scope
      *    session count crossed the consolidation thresholds (time gate open ∧ enough distinct
@@ -5039,11 +5050,15 @@ export interface EngineNotice {
     message: string;
     /** Machine-readable facts of the notice (knob names, arriving values, values in force). */
     detail?: Record<string, unknown>;
-    /** The owning session, when the notice HAS one — the wire-routing attribution key (a
-     *  session-scoped notice can be projected onto that session's event stream; a session-less code
-     *  structurally cannot). Mint sites do not set this: {@link deliverEngineNotice} — the ONE
-     *  delivery throat — lifts a string `detail.sessionId` here, so the typed key and the detail
-     *  carriage can never disagree. Optional and absent for process/config-scoped codes. */
+    /** The owning session, when the notice HAS one — an ATTRIBUTION/correlation key, never a
+     *  projection permission: whether a notice may be surfaced onto that session's user-facing
+     *  stream is decided by the code's {@link NOTICE_AUDIENCE} row alone ("audience is entitlement,
+     *  not routability" — several `"operator"` rows carry a sessionId purely for correlation, and a
+     *  projector keying on presence would push deployment facts at end users). Presence only makes
+     *  routing structurally POSSIBLE; a session-less code structurally cannot be routed at all.
+     *  Mint sites do not set this: {@link deliverEngineNotice} — the ONE delivery throat — lifts a
+     *  string `detail.sessionId` here, so the typed key and the detail carriage can never disagree.
+     *  Optional and absent for process/config-scoped codes. */
     sessionId?: string;
 }
 /** Test seam (mirrors `__resetBashTimeoutAnnouncements`): never called by production code. */
@@ -5073,11 +5088,19 @@ export declare function deliverEngineNotice(onNotice: ((notice: EngineNotice) =>
  * a consumer routing on `code` alone must never mistake a stranded follow-up for a stranded steer, so
  * the code carries exactly the semantics its name claims — the same two-key split the settled frame
  * uses. Pure (the terminal sweep race window is not constructible deterministically; this seam is).
+ *
+ * `sessionId` (#433, additive and optional): these two codes are the `"user"` audience rows whose
+ * subject is the END USER's own lost input, and a disclosure that cannot say WHICH session lost it
+ * has nowhere to be delivered — the audience registry and the routing key are the two halves of one
+ * answer. Carried in `detail` like every other session-attributed code, so {@link deliverEngineNotice}
+ * — the one throat — lifts it to the typed top-level key and the two spellings cannot disagree.
+ * Omitted when the caller has none (never fabricated: the message is what the run lost, and a made-up
+ * routing key would deliver it to the wrong stream).
  */
 export declare function undrainedUserInputNotices(counts: {
     steer: number;
     followUp: number;
-}, taskId?: string): EngineNotice[];
+}, taskId?: string, sessionId?: string): EngineNotice[];
 /** Runtime dependencies shared across tasks. */
 export interface RunnerDeps {
     brain: Brain;
@@ -5094,7 +5117,9 @@ export interface RunnerDeps {
      * probe must not brick every MCP call) with a once-per-MATERIALIZATION `mcp.revocation_probe_failed`
      * notice (a resume re-materializes and may announce again — the standing condition is re-news at
      * each fresh mount, never per-call). The notice is a deployment wiring fact: `detail: { message }`
-     * only, no session attribution, `"operator"` audience by the {@link NOTICE_AUDIENCE} default — a
+     * only, no session attribution, `"operator"` audience by its explicit {@link NOTICE_AUDIENCE}
+     * row (#433 made the registry total over the catalog — no engine-minted code is
+     * audience-defaulted any more) — a
      * wire projector forwards it operator-tier and needs no per-session de-duplication of its own.
      */
     mcpRevocations?: {

package/dist/core/types.js

@@ -52,22 +52,23 @@ export function deliverEngineNotice(onNotice, notice) {
     }
     console.warn(notice.message);
 }
-export function undrainedUserInputNotices(counts, taskId) {
+export function undrainedUserInputNotices(counts, taskId, sessionId) {
     const tid = taskId !== undefined ? { taskId } : {};
+    const sid = sessionId !== undefined ? { sessionId } : {};
     const tail = `accepted as "queued" were never consumed — the run ended first. They are NOT redelivered; re-send against a live run if still wanted.`;
     const out = [];
     if (counts.steer > 0) {
         out.push({
             code: "task.user_steer_undrained",
             message: `${counts.steer} user steer(s) ${tail}`,
-            detail: { steer: counts.steer, ...tid },
+            detail: { steer: counts.steer, ...tid, ...sid },
         });
     }
     if (counts.followUp > 0) {
         out.push({
             code: "task.user_followup_undrained",
             message: `${counts.followUp} user follow-up(s) ${tail}`,
-            detail: { followUp: counts.followUp, ...tid },
+            detail: { followUp: counts.followUp, ...tid, ...sid },
         });
     }
     return out;

package/dist/index.d.ts

@@ -61,7 +61,7 @@ export { BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, WEB_FETCH_TOOL_NAME
 export { admitMemoryScopes, foldAdmissionFreeze, type OwnOrgAdmissionVerdict, type MemoryAdmissionInput, type MemoryAdmissionOutcome, type MemoryAdmissionVerdict, type MemoryScopeAdmission, type MemoryScopeOrigin, type MemoryScopeRequest, } from "./core/memory-admission.js";
 export { assertRetentionCapability, type ManagedRetentionCapability, type RetentionDeclaration, type RetentionDeclaring, type RetentionPolicy, type RetentionReceipt, } from "./core/retention.js";
 export { GOVERNANCE_CODES, governanceRetryClass, type GovernanceCode, type GovernanceRetryClass } from "./core/governance-codes.js";
-export { NOTICE_AUDIENCE, noticeAudienceOf } from "./core/governance-codes.js";
+export { NOTICE_AUDIENCE, noticeAudienceOf, ENGINE_NOTICE_CODES, type EngineNoticeCode, type NoticeAudience } from "./core/governance-codes.js";
 export { TtlSessionStore, type TtlSessionStoreOptions, type EvictPolicy } from "./core/session-store.js";
 export { reconcileInterruptedSession, findOrphanToolCalls, type OrphanToolCall, type ReconcileReport, } from "./core/session-reconcile.js";
 export { StoredSession, InMemorySessionRepo, InMemorySessionStorage, BaseSessionStorage, leafIdAfterEntry, validateEntriesForImport, StreamingImportValidator, boundedTail, SessionError, isSessionConflict, hasSessionFork, uuidv7, type Session, type SessionStore, type AcquiredSession, type SessionStoreSummary, type SessionStorage, type SessionRepo, type SessionMetadata, type SessionTreeEntry, type SessionWriteOptions, type SessionPlacement, type SessionPlacementRecord, type PlacedSessionRow, } from "./core/session.js";
@@ -156,7 +156,7 @@ export { createPermissionRulePolicy, validatePermissionRules, parsePermissionRul
  * and nothing more. Removal is exported without ceremony, because narrowing on a user's behalf is
  * allowed and widening is not.
  */
-export { parseAllowRuleText, formatAllowRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, type PersistedAllowRule, type RuleTombstone, type RuleScope, type RuleDot, type RuleAdd, type RuleAddOrigin, type RuleOffer, type SegmentRuleSuggestion, type SegmentCoverage, type RuleReject, type RuleRejectCode, type ParsedAllowRule, type PersistedRuleTool, type PersistedRuleMatch, } from "./core/permission-rule-model.js";
+export { parseAllowRuleText, formatAllowRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, type PersistedAllowRule, type RuleTombstone, type RuleScope, type RuleDot, type RuleAdd, type RuleAddOrigin, type RuleOffer, type SegmentRuleSuggestion, type SegmentCoverage, type RuleReject, type RuleRejectCode, type ParsedAllowRule, type PersistedRuleTool, type PersistedRuleMatch, } from "./core/permission-rule-model.js";
 export { removePersistedRule, applyTombstones, sameScope, InMemoryPermissionRuleStore, EMPTY_RULE_STORE, type PermissionRuleStore, type PermissionRuleStoreProvider, type StoredAllowRules, type RemoveResult, type PutResult, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, type RuleSyncState, type RuleSyncFrontier, type RuleSyncDrop, type RuleSyncLandingReport, type RuleOwner, type QuarantinedRuleAdd, PERMISSION_RULE_WRITER, writerOf, foldDelta, addDotsOf, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, type PermissionRuleWriter, type WritablePermissionRuleStore, type RuleWriteDelta, type RuleAddDelta, type RuleDeleteDelta, type RuleSyncJoinDelta, type RawRuleSyncState, type RedemptionAuthorization, } from "./core/permission-rule-store.js";
 export { syncPermissionRules, parseRuleSyncResponse, PERMISSION_RULE_SYNC_PATH, LOCAL_OWNER_UNSYNCABLE_CODE, type PermissionRuleSyncTransport, type PermissionRuleSyncResult, type RuleSyncRequestBody, type RuleSyncResponseBody, } from "./core/permission-rule-sync.js";
 export { createOrgRuleOverlay, orgRuleVerdictFor, effectivePermissionRules, orgRuleStatePersistenceOf, ORG_UNAVAILABLE_DECISION_REASON, ORG_RULE_DECISION_REASON, ORG_ADJUDICATION_TIMEOUT_MS, type OrgPermissionRule, type OrgRuleSnapshot, type OrgRuleSnapshotProvider, type OrgRuleStatePersistence, type PersistedOrgRuleState, type OrgRuleOverlay, type OrgOverlayResolution, type OrgOverlayStatus, type EffectivePermissionRule, } from "./core/permission-rule-org.js";
@@ -168,7 +168,7 @@ export { AdoptionError, assertAdoptionBootGate, readRootAdoptionFile, writeRootA
 export { adoptLocalDataRoot, ackAdoptionConfig, witnessAdoptionConfig, listAdoptionQuarantine, readAdoptionStatus, type AdoptionStatus, type AdoptLocalDataRootOptions, type AdoptLocalDataRootResult, type AdoptionCarriageLeg, type AdoptionCarriageLegContext, type AdoptionConfigWitnessReceipt, } from "./stores/file/adoption/adopt.js";
 export { formatHookFeedback, runToolGate, createHookEnvCapabilities, createPreToolUseConstraintPolicy, type PersistedRuleHit, type PersistedRuleHitRule, type PersistedRuleUnreadable, type PersistedRuleCoverage, type PersistedRuleAnswer, normalizePersistedRuleHit, type Hooks, type HookToolContext, type HookInvocationIdentity, type UserPromptSubmitContext, type PostToolBatchContext, type HookEnvCapabilities, type HookToolOutput, type PreToolUseResult, type PostToolUseResult, type UserPromptSubmitResult, type HookToolFailure, type PostToolUseFailureResult, type PostToolBatchCall, type PostToolBatchResult, type PreCompactContext, type PreCompactResult, type PostCompactContext, type StopFailureContext, type PermissionDeniedPayload, type PermissionDeniedSource, } from "./core/hooks.js";
 export { InMemoryMemoryStore, composeMemoryBlock, composeLayeredMemoryBlock, normalizeMemorySpec, type NormalizedMemorySpec, type MemorySpecInput, supportsConsolidation, supportsPeriodicConsolidation, firstSentence, expandLexicalTerms, lexicalSearchMatch, type Embedder, classifyPromotable, enforcePromotableWriteGate, guardedMemoryStore, MemoryGateError, detectSecret, enforceSecretWriteGate, enforceStructuredNoteSecretGate, type UtilityGate, type MemoryStore, type MemoryVectorMode, type ScoredMemory, type MemoryNoteHeader, type MemoryNoteRecord, type MemoryNoteType, type StructuredNoteInput, } from "./core/memory.js";
-export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, type MemoryBackendContractHooks, buildMemoryInstruction, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_ORIGIN_CAUSES, committedOriginOf, originEquals, ambiguousOriginRepresentation, committedDistilledOf, distilledEquals, type MemoryEntryDistilled, type MemoryEntryDistilledInput, CONSOLIDATION_DEFAULTS, ConsolidationRefusedError, MEMORY_SEARCH_SUPERSEDED_TAG, consolidationTypeEligible, deriveSupersededSet, memorySupersededNote, readIntentCredentials, supersessionFuseCeiling, memoryConsolidationRecommendedNotice, memoryConsolidationCommittedNotice, memoryConsolidationConflictNotice, memoryConsolidationIncompleteNotice, memoryConsolidationRefusedNotice, type ConsolidationGateRow, type ConsolidationIntent, type ConsolidationIntentCredentialRow, type ConsolidationLeaseSeat, type ConsolidationProductProposal, type ConsolidationProposal, type MemoryConsolidationOptions, type ConsolidationCommitReceipt, type ConsolidationReconcileReport, type ConsolidationResolveReceipt, type ConsolidationPlanSummary, DISTILLER_DEFAULT_MAX_INPUTS_PER_PRODUCT, LLM_DISTILLER_CONTRACT, LLM_DISTILLER_CONTRACT_DL2, LLM_DISTILLER_CONTRACT_DL3, LLM_DISTILLER_CONTRACTS, MEMORY_DISTILLER_CONTRACT_V1, contractGroupingDiff, driveConsolidationToFixpoint, isAliasModelId, llmPlanDistiller, mintLlmConsolidationPlan, openAiCompatChatSeat, parseJsonAnswer, planParseRepairs, sanitizeLlmGroups, scheduleUnderFuse, type ConsolidationDistillFn, type ConsolidationDriveCycleRow, type ConsolidationDriveEngine, type ConsolidationDriveResult, type ConsolidationFoldState, type DistillerCandidate, type DistillerChatAnswer, type DistillerChatFn, type DistillerChatRequest, type FuseSchedule, type LlmConsolidationPlan, type LlmConsolidationPlanProduct, type LlmDistillerContract, type MintLlmConsolidationPlanResult, type PlanParseRepairs, type SanitizedLlmGroups, CONSOLIDATION_DRIVER_PLANS_DIR, CONSOLIDATION_DRIVER_RUNS_FILE, CONSOLIDATION_RUN_STOP_REASONS, archiveDistillerPlan, readConsolidationDriverRun, runMemoryConsolidationDriver, type ConsolidationDriverEngine, type ConsolidationDriverRunRow, type ConsolidationRunReceipt, type ConsolidationRunStopReason, type RunMemoryConsolidationOptions, isInstructionEntry, type MemoryEntryOrigin, type MemoryOriginCause, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, readV2HeaderHints, type V2HeaderHints, LINEAGE_FILE, CHALLENGES_FILE, CHALLENGED_HISTORY_FILE, CHALLENGE_LEDGER_MAX_EVENTS, rebuildStrictControlPlaneLedger, type ControlPlaneRebuildReceipt, type StrictControlPlaneLedger, type ChallengeAssignment, type ChallengeEvent, type ChallengedHistoryRow, type LineagePendingTxn, type LineagePromotion, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, type MemorySearchDetails, type MemorySearchHit, type CleanMemorySearchHit, type ExposedMemorySearchHit, MEMORY_EXPOSURE_BANNER, MEMORY_EXPOSURE_HANDLE_TAG, memoryExposureIndexRow, type MemoryGetDetails, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, type MemoryAnnouncement, type ScanFinding, type MemoryEngineOptions, type MemoryInjection, type EntryProvenanceAccount, type TransferEvidence, type CommittedBinding, type CommittedEntrySnapshot, type CommittedScopeSnapshots, type EntryCustodyReport, erasureSelectHash, type EraseMemoryEntriesInput, type ErasureSelect, type ErasedBinding, type MemoryErasureAttestation, computeMemoryBundleHash, type MemoryExportBundle, type MemoryImportReport, type MemoryExportSnapshot, type MemoryBundleImportPlan, type BundleChallengeRow, type BundleLineageRow, type BundlePollutedSession, type MemoryBackend, type MemoryEntry, type MemoryEntryFrontmatter, type MemoryEntryHeader, type ScoredMemoryEntry, type NotePatch, type PatchReport, type MaterializedFile, type MemorySessionHandle, type HarvestReport, type HarvestRejection, type HarvestRejectionCode, type ParsedEntryFile, type ScannedEntryFile, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, type ParsedScopeKey, migrateScope, type MigrateScopeReport, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, type RemoteMemoryFile, type RemoteMemoryBaseline, type RemoteMaterialization, type RemoteHarvestResult, type InboundEntryFinding, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, type MemorySyncCursor, type MemorySyncConflict, type MemorySyncPlan, type RecallSource, syncMemoryScope, type MemorySyncTransport, type MemorySyncRequestBody, type MemorySyncResponseBody, type MemorySyncClientConflict, type SyncMemoryScopeOptions, type MemorySyncClientResult, } from "./core/memory-engine/index.js";
+export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, type MemoryBackendContractHooks, buildMemoryInstruction, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_ORIGIN_CAUSES, committedOriginOf, originEquals, ambiguousOriginRepresentation, type OriginClearanceRow, type OriginClearanceEvent, committedDistilledOf, distilledEquals, type MemoryEntryDistilled, type MemoryEntryDistilledInput, CONSOLIDATION_DEFAULTS, ConsolidationRefusedError, MEMORY_SEARCH_SUPERSEDED_TAG, consolidationTypeEligible, deriveSupersededSet, memorySupersededNote, readIntentCredentials, supersessionFuseCeiling, memoryConsolidationRecommendedNotice, memoryConsolidationCommittedNotice, memoryConsolidationConflictNotice, memoryConsolidationIncompleteNotice, memoryConsolidationRefusedNotice, type ConsolidationGateRead, type ConsolidationGateRow, type ConsolidationIntent, type ConsolidationIntentCredentialRow, type ConsolidationLeaseSeat, type ConsolidationProductProposal, type ConsolidationProposal, type MemoryConsolidationOptions, type ConsolidationCommitReceipt, type ConsolidationReconcileReport, type ConsolidationResolveReceipt, type ConsolidationPlanSummary, type ConsolidationPlanFoldEvidence, DISTILLER_DEFAULT_MAX_INPUTS_PER_PRODUCT, LLM_DISTILLER_CONTRACT, LLM_DISTILLER_CONTRACT_DL2, LLM_DISTILLER_CONTRACT_DL3, LLM_DISTILLER_CONTRACTS, MEMORY_DISTILLER_CONTRACT_V1, contractGroupingDiff, driveConsolidationToFixpoint, isAliasModelId, llmPlanDistiller, mintLlmConsolidationPlan, openAiCompatChatSeat, parseJsonAnswer, planParseRepairs, sanitizeLlmGroups, scheduleUnderFuse, type ConsolidationDistillFn, type ConsolidationDriveCycleRow, type ConsolidationDriveEngine, type ConsolidationDriveResult, type ConsolidationFoldState, type DistillerCandidate, type DistillerChatAnswer, type DistillerChatFn, type DistillerChatRequest, type FuseSchedule, type LlmConsolidationPlan, type LlmConsolidationPlanProduct, type LlmDistillerContract, type MintLlmConsolidationPlanResult, type PlanParseRepairs, type SanitizedLlmGroups, CONSOLIDATION_DRIVER_PLANS_DIR, CONSOLIDATION_DRIVER_RUNS_FILE, CONSOLIDATION_RUN_STOP_REASONS, archiveDistillerPlan, readConsolidationDriverRun, runMemoryConsolidationDriver, type ConsolidationDriverEngine, type ConsolidationDriverRunRow, type ConsolidationRunReceipt, type ConsolidationRunStopReason, type RunMemoryConsolidationOptions, isInstructionEntry, type MemoryEntryOrigin, type MemoryOriginCause, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, readV2HeaderHints, type V2HeaderHints, LINEAGE_FILE, CHALLENGES_FILE, CHALLENGED_HISTORY_FILE, CHALLENGE_LEDGER_MAX_EVENTS, rebuildStrictControlPlaneLedger, type ControlPlaneRebuildReceipt, type StrictControlPlaneLedger, type ChallengeAssignment, type ChallengeEvent, type ChallengedHistoryRow, type LineagePendingTxn, type LineagePromotion, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, type MemorySearchDetails, type MemorySearchHit, type CleanMemorySearchHit, type ExposedMemorySearchHit, MEMORY_EXPOSURE_BANNER, MEMORY_EXPOSURE_HANDLE_TAG, memoryExposureIndexRow, type MemoryGetDetails, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, type MemoryAnnouncement, type ScanFinding, type MemoryEngineOptions, type MemoryInjection, type EntryProvenanceAccount, type TransferEvidence, type CommittedBinding, type CommittedEntrySnapshot, type CommittedScopeSnapshots, type EntryCustodyReport, erasureSelectHash, type EraseMemoryEntriesInput, type ErasureSelect, type ErasedBinding, type MemoryErasureAttestation, computeMemoryBundleHash, type MemoryExportBundle, type MemoryImportReport, type MemoryExportSnapshot, type MemoryBundleImportPlan, type BundleChallengeRow, type BundleLineageRow, type BundlePollutedSession, type MemoryBackend, type MemoryEntry, type MemoryEntryFrontmatter, type MemoryEntryHeader, type MemoryScopeEnumeration, type ScoredMemoryEntry, type NotePatch, type PatchReport, type MaterializedFile, type MemorySessionHandle, type HarvestReport, type HarvestRejection, type HarvestRejectionCode, type ParsedEntryFile, type ScannedEntryFile, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, type ParsedScopeKey, migrateScope, type MigrateScopeReport, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, type RemoteMemoryFile, type RemoteMemoryBaseline, type RemoteMaterialization, type RemoteHarvestResult, type InboundEntryFinding, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, type MemorySyncCursor, type MemorySyncConflict, type MemorySyncPlan, type RecallSource, syncMemoryScope, type MemorySyncTransport, type MemorySyncRequestBody, type MemorySyncResponseBody, type MemorySyncClientConflict, type SyncMemoryScopeOptions, type MemorySyncClientResult, } from "./core/memory-engine/index.js";
 export { SHARED_MEMORY_READ_CAP_BYTES, SHARED_MEMORY_LIST_PAGE_SIZE, SharedMemoryStoreError, type SharedMemoryStoreProvider, type SharedMemoryStoreReader, type SharedMemoryPagedList, type SharedMemoryStoreInfo, type SharedMemoryDocumentEntry, type SharedMemorySnapshot, type SharedMemoryRequestContext, type MemoryListDetails, type MemoryReadDetails, } from "./core/shared-memory/types.js";
 export { sharedMemoryStoreContract, type SharedMemoryFixture, type SharedMemoryStoreContractHooks, } from "./core/shared-memory/contract.js";
 export { termSet, jaccardDistance, cosineDistance } from "./core/memory-vector.js";

package/dist/index.js

@@ -49,7 +49,7 @@ export { BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, WEB_FETCH_TOOL_NAME
 export { admitMemoryScopes, foldAdmissionFreeze, } from "./core/memory-admission.js";
 export { assertRetentionCapability, } from "./core/retention.js";
 export { GOVERNANCE_CODES, governanceRetryClass } from "./core/governance-codes.js";
-export { NOTICE_AUDIENCE, noticeAudienceOf } from "./core/governance-codes.js";
+export { NOTICE_AUDIENCE, noticeAudienceOf, ENGINE_NOTICE_CODES } from "./core/governance-codes.js";
 export { TtlSessionStore } from "./core/session-store.js";
 export { reconcileInterruptedSession, findOrphanToolCalls, } from "./core/session-reconcile.js";
 export { StoredSession, InMemorySessionRepo, InMemorySessionStorage, BaseSessionStorage, leafIdAfterEntry, validateEntriesForImport, StreamingImportValidator, boundedTail, SessionError, isSessionConflict, hasSessionFork, uuidv7, } from "./core/session.js";
@@ -118,7 +118,7 @@ export { parseAutoModeResponse, createAutoModeDecider, } from "./core/auto-mode.
 export { buildAutoModePrompt, renderAutoModeWindow, renderAutoModeAction, AUTO_MODE_DEFAULTS_SENTINEL, } from "./core/auto-mode-prompt.js";
 export { AUTO_MODE_BASE_PROMPT, AUTO_MODE_PERMISSIONS_EXTERNAL } from "./core/auto-mode-prompt-assets.js";
 export { createPermissionRulePolicy, validatePermissionRules, parsePermissionRule, wildcardMatch, } from "./core/permission-rules.js";
-export { parseAllowRuleText, formatAllowRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, } from "./core/permission-rule-model.js";
+export { parseAllowRuleText, formatAllowRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, } from "./core/permission-rule-model.js";
 export { removePersistedRule, applyTombstones, sameScope, InMemoryPermissionRuleStore, EMPTY_RULE_STORE, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, PERMISSION_RULE_WRITER, writerOf, foldDelta, addDotsOf, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, } from "./core/permission-rule-store.js";
 export { syncPermissionRules, parseRuleSyncResponse, PERMISSION_RULE_SYNC_PATH, LOCAL_OWNER_UNSYNCABLE_CODE, } from "./core/permission-rule-sync.js";
 export { createOrgRuleOverlay, orgRuleVerdictFor, effectivePermissionRules, orgRuleStatePersistenceOf, ORG_UNAVAILABLE_DECISION_REASON, ORG_RULE_DECISION_REASON, ORG_ADJUDICATION_TIMEOUT_MS, } from "./core/permission-rule-org.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "5.58.0",
+  "version": "5.59.0",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",