@sema-agent/core 5.58.0 → 5.60.0

package/dist/core/runner/prepare-config-doors.js

@@ -83,10 +83,45 @@ export function resolveModelPromptTraits(model, spec, internals) {
         fableMitigations: isFableFamilyModelId(model.id),
     };
 }
+function microCompactConfigError(field, value, legal) {
+    let shown;
+    try {
+        shown = JSON.stringify(value) ?? String(value);
+    }
+    catch {
+        try {
+            shown = String(value);
+        }
+        catch {
+            shown = `[unrepresentable ${typeof value}]`;
+        }
+    }
+    const seat = field === undefined ? "microCompact" : `microCompact.${field}`;
+    const e = new Error(`${seat} ${shown} is not ${legal} — an unevaluable declaration is refused loudly, ` +
+        `never folded to the default: a silently-ignored opt-in would run the pre-374 machine while the ` +
+        `deployment believes it opted in.`);
+    e.code = "config.microcompact_invalid";
+    return e;
+}
+export function resolveMicroCompactKnob(bag) {
+    if (bag !== undefined && (typeof bag !== "object" || bag === null || Array.isArray(bag))) {
+        throw microCompactConfigError(undefined, bag, "an object carrying optional machine/clearOnRejection keys");
+    }
+    const declaredMachine = bag?.machine;
+    if (declaredMachine !== undefined && declaredMachine !== "legacy" && declaredMachine !== "cc") {
+        throw microCompactConfigError("machine", declaredMachine, `"legacy" | "cc"`);
+    }
+    const declaredClearOnRejection = bag?.clearOnRejection;
+    if (declaredClearOnRejection !== undefined && typeof declaredClearOnRejection !== "boolean") {
+        throw microCompactConfigError("clearOnRejection", declaredClearOnRejection, "a boolean");
+    }
+    return { machine: declaredMachine ?? "legacy", clearOnRejection: declaredClearOnRejection === true };
+}
 export function prepareConfigDoors(input) {
     const { deps, sessions, resume, internals } = input;
     let spec = input.spec;
     assertRestoreGatedToolsValue(spec.restoreGatedTools);
+    const microCompactKnob = resolveMicroCompactKnob(deps.microCompact);
     const assertToolNameListValue = (value, seat) => {
         if (value === undefined)
             return;
@@ -318,6 +353,7 @@ export function prepareConfigDoors(input) {
         promptProfile,
         lockedPreflight,
         resolvedInteractionPosture,
+        microCompactKnob,
         resolvedRole,
         model,
         thinking,

package/dist/core/runner/prepare-task.d.ts

@@ -20,6 +20,7 @@ import type { MemoryEngine } from "../memory-engine/engine.js";
 import { type GitStatusLaneRef } from "./git-status-frame.js";
 import { type ToolManifestRow } from "../../prompt-assembly/tool-catalog.js";
 import type { ToolDisclosureManifest } from "../trace.js";
+import { type ClearedProjectionLedger, type ContextEditMachine, type OccurrenceIndex } from "../context-edit.js";
 import type { TaskNotificationPayload } from "../task-notification.js";
 import { type CwdRef, type ReadFace } from "../../tools/fs/index.js";
 import { type WorkflowSizeGuideline } from "../../orchestration/workflow-size-guideline.js";
@@ -134,7 +135,6 @@ export declare function checkpointScopeOf(spec: {
 export { resolveCheckpointStore } from "../checkpoint-store.js";
 export { isFableFamilyModelId, resolveModelPromptTraits, resolveTaskLimits } from "./prepare-config-doors.js";
 export { rebaseWorkspacePath, rebaseWorkspacePathAcross } from "./prepare-workspace-restore.js";
-/** Everything the run loop needs, built once by {@link prepareTask} (task setup, isolated from the loop). */
 export interface Prepared {
     harness: AgentHarness;
     /** The CONCRETE built-in session (engine-internal: prepare constructs/acquires `StoredSession` itself,
@@ -876,6 +876,33 @@ export interface Prepared {
     trimPressureRef: {
         droppedMessages: boolean;
     };
+    /** design/374 slices 1b/2 — the microCompact machine state this run: the selected clearing
+     *  machine, the cleared-projection ledger (request-view application, durable decisions — see
+     *  `context-edit.ts`'s ledger note; per-run in-memory, so durable resume / `resumeAt` rebuilds
+     *  start EMPTY by construction), the last request's projection seat (what the provider actually
+     *  saw — the MC-R rejection arm computes its candidates and savings on THIS view, never on the
+     *  raw session rebuild), and the MC-R knob. Default machine "legacy" + MC-R off ⇒ the ledger
+     *  never gains an entry and every replay is a same-reference no-op (default bytes unchanged). */
+    microCompact: PreparedMicroCompact;
+}
+/** See {@link Prepared.microCompact}. */
+export interface PreparedMicroCompact {
+    machine: ContextEditMachine;
+    /** MC-R (design/374 §3.2): one-shot clear-and-retry on a provider input-too-long rejection.
+     *  Default false (X2: lands with the machinery, flips with slice 3). */
+    clearOnRejection: boolean;
+    ledger: ClearedProjectionLedger;
+    projectionRef: {
+        current?: {
+            /** The FINAL projected view of the last provider request (post trim/sweep). */
+            messages: AgentMessage[];
+            /** Occurrence coordinates of that view (object-identity first, unambiguous-group fallback). */
+            keyOf: OccurrenceIndex["keyOf"];
+        };
+    };
+    /** The same offload persist seat the frontier machine uses (write-once, idempotent), so MC-R
+     *  clears compose identical markers. Absent when no offload store is configured. */
+    offloadPersist?: (toolCallId: string, fullText: string) => string;
 }
 /**
  * WHICH tool call a committed durable park is holding this run — `undefined` when nothing parked, or

package/dist/core/runner/prepare-task.js

@@ -20,7 +20,7 @@ import { createSubagentWorktreeHelper, forkGovernanceDenial, resolveDelegationEn
 import { createAgentTranscriptTool, AGENT_TRANSCRIPT_TOOL_NAME } from "../../agents/agent-transcript-tool.js";
 import { createSendMessageTool, SEND_MESSAGE_TOOL_NAME } from "../../agents/send-message-tool.js";
 import { SubagentRetainLedger } from "../../agents/retain-ledger.js";
-import { askApproverIdentity, checkToolPolicyProjection, combinePolicies, constraintChainDigest, constraintChainEntryOf, isApprovalSettledBy, isAskDenyResolution, screenApproverAttribution, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, describeThrown, refuseOutOfContractDecision, resolveAsk, toolPolicyNameSets, tryCloneArgs } from "../tool-policy.js";
+import { askApproverIdentity, carriesBidiControls, checkToolPolicyProjection, combinePolicies, constraintChainDigest, constraintChainEntryOf, isApprovalSettledBy, isAskDenyResolution, screenApproverAttribution, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, describeThrown, refuseOutOfContractDecision, resolveAsk, toolPolicyNameSets, tryCloneArgs } from "../tool-policy.js";
 const PERSISTED_RULE_TOOL = "Bash";
 import { findAdmittingRule, segmentCoverageOf, suggestRulesForCommand } from "../permission-rule-model.js";
 import { ActiveSkillScope, createActiveSkillScopePolicy } from "./active-skill-scope.js";
@@ -70,7 +70,7 @@ import { resolveEpochAgainstBundled } from "../../prompt-assembly/epoch.js";
 import { artifactDeclarations } from "../../prompt-assembly/artifact.js";
 import { buildTurnPromptSnapshot } from "../../prompt-assembly/turn-snapshot.js";
 import { SEMA_DEFAULT_PACK } from "../../prompt-assembly/packs/sema-default.js";
-import { clearStaleToolResults, dropEmptyFailureAssistants, editBudget } from "../context-edit.js";
+import { clearStaleToolResults, createClearedProjectionLedger, dropEmptyFailureAssistants, editBudget, replayClearedProjection, resolveTriggerWindow, } from "../context-edit.js";
 import { capAggregateToolResults } from "../tool-result-budget.js";
 import { capAggregateMediaBytes, AGGREGATE_MEDIA_BUDGET_BYTES } from "../media-byte-cap.js";
 import { dropOrphanToolResults, guardBudget, insertTrimNotice, trimToBudget } from "../context-guard.js";
@@ -124,7 +124,7 @@ function warnCompactionWindowHazard(tracer, spec, model, compModel, hostTaskId)
     if (compModel === undefined)
         return;
     const compWindow = compModel.contextTokens ?? compModel.contextWindow;
-    const mainWindow = model.autoCompactTokens ?? model.contextTokens ?? model.contextWindow;
+    const mainWindow = resolveTriggerWindow(model).window;
     if (compWindow > 0 && mainWindow > 0 && compWindow < mainWindow) {
         const merged = { ...DEFAULT_COMPACTION_SETTINGS, ...spec.compaction };
         const sanitized = sanitizeCompactionSettings(merged, mainWindow);
@@ -195,6 +195,33 @@ function announceToolModelGate(onNotice, modelId, gate) {
         }
     }
 }
+function announceDeclaredMcpContentClasses(args) {
+    for (const entry of args.entries ?? []) {
+        const declaredClass = entry.contentOrigin;
+        if (declaredClass === undefined)
+            continue;
+        const server = inlineUntrusted(String(entry.name), 160);
+        const toolCount = args.statuses?.find((s) => s.name === entry.name)?.toolNames?.length ?? 0;
+        const resourceFaceCaveat = " (Not covered: the cross-server resource faces — ListMcpResourcesTool/ReadMcpResourceTool/ReadMcpResourceDirTool — stay externally classified and still mark.)";
+        const posture = declaredClass === "local"
+            ? `this server's mounted tools' invocations will not mark this session's memory as externally exposed.${resourceFaceCaveat}`
+            : declaredClass === "execution"
+                ? `this server's mounted tools' invocations will not mark this session's memory unless the execIsExternalContent strict upgrade is armed (currently: ${args.execIsExternalContent ? "armed" : "off"}).${resourceFaceCaveat}`
+                : "its tools stay externally classified and this declaration PINS that — the trustedTools allowlist no longer exempts them, and invocations mark this session's memory.";
+        deliverEngineNotice(args.onNotice, {
+            code: "memory.content_class_declared",
+            message: `MCP server "${server}" (${toolCount} tool(s) mounted) is declared ` +
+                `contentOrigin "${declaredClass}" by this deployment's configuration — ${posture}`,
+            detail: {
+                server,
+                contentOrigin: declaredClass,
+                toolCount,
+                ...(declaredClass === "execution" ? { execIsExternalContent: args.execIsExternalContent } : {}),
+                sessionId: args.sessionId,
+            },
+        });
+    }
+}
 export { __resetReadFaceClampAnnouncement } from "./prepare-hands-readface.js";
 const DEFAULT_MAX_SUSPENDS = 5;
 const ULTRA_REASONING_TIERS = new Set(["xhigh", "max"]);
@@ -242,6 +269,49 @@ class ParkRefusal extends Error {
 export { resolveCheckpointStore } from "../checkpoint-store.js";
 export { isFableFamilyModelId, resolveModelPromptTraits, resolveTaskLimits } from "./prepare-config-doors.js";
 export { rebaseWorkspacePath, rebaseWorkspacePathAcross } from "./prepare-workspace-restore.js";
+function buildMicroCompactState(deps, model, sessionId, offloadStore, knob) {
+    const triggerWindow = resolveTriggerWindow(model);
+    if (triggerWindow.clamped) {
+        deliverEngineNotice(deps.onNotice, {
+            code: "config.autocompact_window_clamped",
+            message: `model "${model.id}" declares autoCompactTokens=${triggerWindow.declaredAutoCompactTokens} ABOVE its physical window ` +
+                `${triggerWindow.physicalWindow}; the autocompact window only ever LOWERS the trigger-side geometry, so the value was ` +
+                `clamped to the physical window — fix the model config (declare a value at or below the physical window, or omit it)`,
+            detail: {
+                modelId: model.id,
+                declaredAutoCompactTokens: triggerWindow.declaredAutoCompactTokens,
+                physicalWindow: triggerWindow.physicalWindow,
+                sessionId,
+            },
+        });
+    }
+    return {
+        machine: knob.machine,
+        clearOnRejection: knob.clearOnRejection,
+        ledger: createClearedProjectionLedger(),
+        projectionRef: {},
+        ...(offloadStore ? { offloadPersist: createOffloadPersist(offloadStore, sessionId, deps.onNotice) } : {}),
+    };
+}
+function recordFrontierClears(args) {
+    for (const { index } of args.pass.clears) {
+        const at = args.index.keyAt(index);
+        const clearedMsg = args.edited[index];
+        const markerText = clearedMsg.content?.[0]?.text;
+        if (at !== undefined && typeof markerText === "string") {
+            args.ledger.entries.set(at.key, { marker: markerText, groupCount: at.groupCount, fp: at.fp });
+        }
+    }
+    emitTrace(args.tracer, () => ({
+        kind: "context.mc_clear",
+        version: 1,
+        taskId: args.taskId,
+        clearedCount: args.pass.clears.length,
+        tokensSavedEstimate: args.pass.tokensSavedEstimate,
+        trigger: "frontier",
+        ts: Date.now(),
+    }));
+}
 export function gatedCallIdOf(p) {
     if (p.suspendRef.token !== undefined)
         return p.suspendRef.gatedCallId;
@@ -482,7 +552,7 @@ async function derivedRouteFallsBack(args) {
         const verdict = await adjudicateDerivedRoute({ brain: args.brain, model: args.derived, getApiKeyAndHeaders: args.getApiKeyAndHeaders });
         if (verdict === undefined || verdict.ok)
             return false;
-        deliverEngineNotice(args.onNotice, fallbackToPrimaryNotice({ seat: args.seat, from: args.derived.id, to: args.primary.id, verdict }));
+        deliverEngineNotice(args.onNotice, fallbackToPrimaryNotice({ seat: args.seat, from: args.derived.id, to: args.primary.id, verdict, ...(args.sessionId !== undefined ? { sessionId: args.sessionId } : {}) }));
         return true;
     }
     catch {
@@ -492,7 +562,7 @@ async function derivedRouteFallsBack(args) {
 export async function prepareTask(spec, deps, sessions, resume, internals, runnerSelf) {
     const doors = prepareConfigDoors({ spec, deps, sessions, resume, internals });
     spec = doors.spec;
-    const { toolFaceSnapshot, promptProfile, lockedPreflight, resolvedInteractionPosture, resolvedRole, model, thinking, compModel, fableMitigations, memoryDelegationEvidence, memoryProvenance, usageWindows, brainCallGuardrailRef, brainCallGuardrailMs } = doors;
+    const { toolFaceSnapshot, promptProfile, lockedPreflight, resolvedInteractionPosture, microCompactKnob, resolvedRole, model, thinking, compModel, fableMitigations, memoryDelegationEvidence, memoryProvenance, usageWindows, brainCallGuardrailRef, brainCallGuardrailMs } = doors;
     announceToolModelGate(deps.onNotice, model.id, doors.modelGate);
     const { toolEffects, egressTools, irreversibleTools, irreversibilityTier, axisExplicitNegatives, reversibilityProbes, ownToolNames } = prepareSafetyScan({ spec, deps });
     let shellGatedBash = false;
@@ -509,7 +579,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
     let effectiveCompModel = compModel;
     if (spec.compactionModel === undefined &&
         compModel !== undefined &&
-        (await derivedRouteFallsBack({ seat: "compaction-summary", derived: compModel, primary: model, brain: deps.brain, getApiKeyAndHeaders: spec.getApiKeyAndHeaders, onNotice: deps.onNotice }))) {
+        (await derivedRouteFallsBack({ seat: "compaction-summary", derived: compModel, primary: model, brain: deps.brain, getApiKeyAndHeaders: spec.getApiKeyAndHeaders, onNotice: deps.onNotice, sessionId }))) {
         effectiveCompModel = undefined;
     }
     warnCompactionWindowHazard(deps.tracer, spec, model, effectiveCompModel, hostTaskId);
@@ -1096,7 +1166,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             catch {
                 classifierModel = model;
             }
-            if (await derivedRouteFallsBack({ seat: "auto-mode-classifier", derived: classifierModel, primary: model, brain: deps.brain, getApiKeyAndHeaders: spec.getApiKeyAndHeaders, onNotice: deps.onNotice })) {
+            if (await derivedRouteFallsBack({ seat: "auto-mode-classifier", derived: classifierModel, primary: model, brain: deps.brain, getApiKeyAndHeaders: spec.getApiKeyAndHeaders, onNotice: deps.onNotice, sessionId })) {
                 classifierModel = model;
             }
             const classifierSystemPrompt = buildAutoModePrompt(am);
@@ -2079,6 +2149,13 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             const trustedTools = effectiveSafety.trustedTools;
             const execIsExternalContent = effectiveSafety.execIsExternalContent;
             provenanceForChildrenRef.current = { trustedTools: [...trustedTools], execIsExternalContent };
+            announceDeclaredMcpContentClasses({
+                entries: lockedPreflight.mcp,
+                statuses: mcp?.statuses,
+                execIsExternalContent,
+                sessionId,
+                onNotice: deps.onNotice,
+            });
             if (memoryEngineSession?.settlement !== undefined) {
                 delegationSettlementRef.current = { controlDir: memoryEngineSession.settlement.controlDir, sessionId: memoryEngineSession.settlement.sessionId };
             }
@@ -4229,7 +4306,11 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                                 args: parkedArgs,
                                 ...(() => {
                                     const preview = approvalPreviewOf(req.toolName, parkedArgs);
-                                    return preview !== undefined ? { preview } : {};
+                                    const bidi = carriesBidiControls(parkedArgs) || carriesBidiControls(preview);
+                                    return {
+                                        ...(preview !== undefined ? { preview } : {}),
+                                        ...(bidi ? { hasBidiControls: true } : {}),
+                                    };
                                 })(),
                                 ...ruleOffersOf(req.toolName, parkedArgs, {
                                     ...(realApproval !== undefined ? { requiresRealApproval: true } : {}),
@@ -4502,11 +4583,14 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         }
         const editAt = editBudget(model);
         const guardAt = guardBudget(model);
+        const microCompact = buildMicroCompactState(deps, model, sessionId, offloadStore, microCompactKnob);
         const charsPerToken = model.charsPerToken ?? DEFAULT_CHARS_PER_TOKEN;
         harness.on("context", async ({ messages }) => {
             batchHaltRef.current = undefined;
             const healed = dropEmptyFailureAssistants(messages);
-            const capped = await capAggregateToolResults(healed, {
+            const replay = replayClearedProjection(healed, microCompact.ledger);
+            const replayed = replay.messages;
+            const capped = await capAggregateToolResults(replayed, {
                 store: offloadStore,
                 sessionId,
                 onCapped: (info) => emitTrace(deps.tracer, () => ({
@@ -4523,8 +4607,17 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 limitBytes: deps.mediaByteCapBytes ?? AGGREGATE_MEDIA_BUDGET_BYTES,
                 onStripped: deps.onMediaStripped,
             });
+            let ccPass;
             const edited = clearStaleToolResults(mediaCapped, {
                 budgetTokens: editAt,
+                ...(microCompact.machine === "cc" || microCompact.clearOnRejection ? { recognizeCcMarkers: true } : {}),
+                ...(microCompact.machine === "cc"
+                    ? {
+                        machine: "cc",
+                        clearSource: replayed,
+                        onCleared: (pass) => { ccPass = pass; },
+                    }
+                    : {}),
                 anchoredTotalTokens: estimateContextTokens(mediaCapped, charsPerToken).tokens,
                 charsPerToken,
                 ...(offloadStore
@@ -4535,6 +4628,9 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     }
                     : {}),
             });
+            if (ccPass !== undefined) {
+                recordFrontierClears({ pass: ccPass, index: replay.index, edited, ledger: microCompact.ledger, tracer: deps.tracer, taskId: spec.taskId ?? sessionId });
+            }
             let trimmed = trimToBudget(edited, guardAt, estimateContextTokens(edited, charsPerToken).tokens, charsPerToken);
             const trimDroppedMessages = trimmed.length < edited.length;
             if (trimDroppedMessages) {
@@ -4575,12 +4671,14 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 }
             }
             requestLossyRef.current =
-                capped !== healed ||
+                replayed !== healed ||
+                    capped !== replayed ||
                     mediaCapped !== capped ||
                     edited !== mediaCapped ||
                     trimDroppedMessages ||
                     swept.dropped.length > 0 ||
                     gitStatusRef.overBudgetShrunk === true;
+            microCompact.projectionRef.current = { messages: swept.messages, keyOf: replay.index.keyOf };
             return { messages: swept.messages };
         });
         const cacheBreakDetector = deps.cacheBreakDetection === false ? undefined : new CacheBreakDetector();
@@ -4769,7 +4867,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         const effectiveReadFaceObserved = carrierReadFace();
         const effectiveReadDenyObserved = readDenyAdditionsNormalized.length > 0 ? readDenyAdditionsNormalized.map((e) => ({ ...e })) : undefined;
         const preparedHolder = {};
-        const buildPrepared = () => ({ harness, session, sessionId, reminderMark, reminderDisclosureCounts, taskRootPath: taskRootFinal, model, thinking, compModel: effectiveCompModel, mcp: mcp, ...(a2a !== undefined && a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, approvalSettlement, batchHaltRef, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), ...(effectiveReadFaceObserved !== undefined ? { effectiveReadFace: effectiveReadFaceObserved } : {}), ...(effectiveReadDenyObserved !== undefined ? { effectiveReadDenyPatterns: effectiveReadDenyObserved } : {}), effectiveMemoryScopes: memoryEffectiveScopes, cwdRef: handsCwdRef, ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), denyNarrowingPolicy, ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, suspendRef, suspendProgressRef, reviewRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, brainCallGuardrailRef, suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, gitStatusRef, listBackgroundTasks, hookIdentity, hookTimeoutMs, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}) });
+        const buildPrepared = () => ({ harness, session, sessionId, reminderMark, reminderDisclosureCounts, taskRootPath: taskRootFinal, model, thinking, compModel: effectiveCompModel, mcp: mcp, ...(a2a !== undefined && a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, approvalSettlement, batchHaltRef, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), ...(effectiveReadFaceObserved !== undefined ? { effectiveReadFace: effectiveReadFaceObserved } : {}), ...(effectiveReadDenyObserved !== undefined ? { effectiveReadDenyPatterns: effectiveReadDenyObserved } : {}), effectiveMemoryScopes: memoryEffectiveScopes, cwdRef: handsCwdRef, ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), denyNarrowingPolicy, ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, suspendRef, suspendProgressRef, reviewRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, brainCallGuardrailRef, suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, microCompact, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, gitStatusRef, listBackgroundTasks, hookIdentity, hookTimeoutMs, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}) });
         const prepared = buildPrepared();
         preparedHolder.current = prepared;
         return prepared;

package/dist/core/runner/runtask.js

@@ -2,6 +2,7 @@ import { persistedReadDenyEntryProblem } from "../../tools/fs/read-deny.js";
 import { createSafeNotifier, observeThenableRejection } from "../safe-notify.js";
 import { mintSystemReminder, openSystemReminder } from "../reminder-mint.js";
 import { deliverDelegationLifecycle, deliverEngineNotice, undrainedUserInputNotices } from "../types.js";
+import { planRejectionClears, resolveTriggerWindow } from "../context-edit.js";
 import { AgentHarness, DEFAULT_COMPACTION_SETTINGS, uuidv7 } from "../../internal/harness.js";
 import { snapshotActorAssertion } from "../../internal/llm.js";
 import { CheckpointError, BINDING_CHECKPOINT_VERSION, checkpointVersionOf, F012_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, FACE_CHECKPOINT_VERSION, remainingBudgetMicroUsd, readPendingSteerQueue, remainingTokens, LEGACY_PENDING_STEER_INPUT_ID, MAX_STEER_INPUT_ID_CHARS, validatePendingSteer, winnerFromOutcome, } from "../checkpoint-store.js";
@@ -2095,7 +2096,7 @@ export class Runner {
                     message: `a notification was injected with priority "now", which this engine does not implement: all injection ` +
                         `priorities deliver at the NEXT turn boundary and none aborts the running turn. The notification is ` +
                         `delivered — only the interrupting semantics are absent.`,
-                    detail: { priority: "now", ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}) },
+                    detail: { priority: "now", ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), sessionId: prepared.sessionId },
                 });
             }
             if (deliveredAtTurnOpen.has(taskNotificationDedupKey(notification)))
@@ -2172,7 +2173,7 @@ export class Runner {
                 undrainedUserAtEnd = counts;
                 return;
             }
-            for (const notice of undrainedUserInputNotices(counts, spec.taskId)) {
+            for (const notice of undrainedUserInputNotices(counts, spec.taskId, prepared.sessionId)) {
                 deliverEngineNotice(this.deps.onNotice, notice);
             }
         };
@@ -2734,7 +2735,7 @@ export class Runner {
         const withinTaskCompaction = (spec.compaction?.enabled ?? true) && (spec.compaction?.withinTask ?? true);
         const compactionBreaker = { failures: 0 };
         if (spec.compaction?.enabled ?? true) {
-            const prefixWindow = prepared.model.autoCompactTokens ?? prepared.model.contextTokens ?? prepared.model.contextWindow;
+            const prefixWindow = resolveTriggerWindow(prepared.model).window;
             if (Number.isFinite(prefixWindow) && prefixWindow > 0) {
                 const prefixSettings = sanitizeCompactionSettings({ ...DEFAULT_COMPACTION_SETTINGS, ...spec.compaction }, prefixWindow);
                 const prefixCompactAt = prefixWindow - prefixSettings.reserveTokens;
@@ -2940,13 +2941,49 @@ export class Runner {
             thinkingOnly: {},
             degenerateOutput: { detect: (m) => isDegenerateCutMessage(m) },
             promptTooLong: {
-                recover: async () => {
+                recover: async (attempt) => {
+                    if (prepared.abortController.signal.aborted || prepared.suspendRef.token !== undefined)
+                        return false;
+                    if (prepared.microCompact.clearOnRejection && attempt === 1) {
+                        const proj = prepared.microCompact.projectionRef.current;
+                        const compactionAvailable = (spec.compaction?.enabled ?? true) && compactionBreaker.failures < MAX_CONSECUTIVE_COMPACTION_FAILURES;
+                        const declineArm = compactionAvailable ? "forced_compaction" : "none";
+                        const plan = proj === undefined
+                            ? { declined: "no_candidates" }
+                            : planRejectionClears(proj.messages, {
+                                keyOf: proj.keyOf,
+                                ...(prepared.microCompact.offloadPersist ? { offload: { persist: prepared.microCompact.offloadPersist } } : {}),
+                            });
+                        if ("declined" in plan) {
+                            emitTrace(rs.telemetry.tracer, () => ({
+                                kind: "context.mc_null",
+                                version: 1,
+                                taskId: rs.telemetry.taskId,
+                                reason: plan.declined,
+                                nextArm: declineArm,
+                                ts: Date.now(),
+                            }));
+                        }
+                        else {
+                            for (const e of plan.cleared) {
+                                prepared.microCompact.ledger.entries.set(e.key, { marker: e.marker, groupCount: e.groupCount, fp: e.fp });
+                            }
+                            emitTrace(rs.telemetry.tracer, () => ({
+                                kind: "context.mc_clear",
+                                version: 1,
+                                taskId: rs.telemetry.taskId,
+                                clearedCount: plan.cleared.length,
+                                tokensSavedEstimate: plan.tokensSavedEstimate,
+                                trigger: "refusal",
+                                ts: Date.now(),
+                            }));
+                            return true;
+                        }
+                    }
                     if (!(spec.compaction?.enabled ?? true))
                         return false;
                     if (compactionBreaker.failures >= MAX_CONSECUTIVE_COMPACTION_FAILURES)
                         return false;
-                    if (prepared.abortController.signal.aborted || prepared.suspendRef.token !== undefined)
-                        return false;
                     try {
                         const comp = await maybeCompact({
                             session: prepared.session,
@@ -3572,7 +3609,7 @@ export class Runner {
                 steer: Math.max(0, undrainedUserAtEnd.steer - migratedParked.steer),
                 followUp: Math.max(0, undrainedUserAtEnd.followUp - migratedParked.followUp),
             };
-            for (const notice of undrainedUserInputNotices(remaining, spec.taskId)) {
+            for (const notice of undrainedUserInputNotices(remaining, spec.taskId, prepared.sessionId)) {
                 deliverEngineNotice(this.deps.onNotice, notice);
             }
         }
@@ -3933,7 +3970,7 @@ export class Runner {
             if (!sameRouteIdentity(model, prepared.model)) {
                 const verdict = await adjudicateDerivedRoute({ brain: this.deps.brain, model, getApiKeyAndHeaders: spec.getApiKeyAndHeaders });
                 if (verdict !== undefined && !verdict.ok) {
-                    deliverEngineNotice(this.deps.onNotice, fallbackToPrimaryNotice({ seat: "prompt-suggestions", from: model.id, to: prepared.model.id, verdict }));
+                    deliverEngineNotice(this.deps.onNotice, fallbackToPrimaryNotice({ seat: "prompt-suggestions", from: model.id, to: prepared.model.id, verdict, sessionId: prepared.sessionId }));
                     model = prepared.model;
                     thinking = prepared.thinking;
                 }

package/dist/core/store-contracts/checkpoint-store-contract.js

@@ -180,6 +180,38 @@ export async function checkpointStoreContract(make, runAssertion) {
         assert.equal(list[0].token, pending.token);
         assert.equal((await store.get(pending.token)).status, "pending");
     });
+    run("#438 hasBidiControls three-form matrix: a row's `true` survives + projects; absent stays absent (clean args); an out-of-contract `false` reads as absent; a bit-less marked row backfills at projection", async () => {
+        const store = make();
+        const RLO = String.fromCodePoint(0x202e);
+        const asserted = createCheckpointFixture({ token: mintCheckpointToken(), sessionId: "bidi-true" });
+        asserted.pendingAction.hasBidiControls = true;
+        const absent = createCheckpointFixture({ token: mintCheckpointToken(), sessionId: "bidi-absent" });
+        const falsed = createCheckpointFixture({ token: mintCheckpointToken(), sessionId: "bidi-false" });
+        falsed.pendingAction.hasBidiControls = false;
+        const bitless = createCheckpointFixture({
+            token: mintCheckpointToken(),
+            sessionId: "bidi-bitless",
+            pendingAction: {
+                kind: "tool_approval",
+                toolCallId: "call-3",
+                toolName: "Write",
+                args: { path: `/x/${RLO}txt.exe` },
+                boundInputHash: "h0",
+                batchToolCallIds: ["call-3"],
+                completedCallIds: [],
+            },
+        });
+        for (const cp of [asserted, absent, falsed, bitless])
+            await store.put(cp.token, cp);
+        const byId = new Map((await store.listByScope("tenant-a")).map((s) => [s.sessionId, s]));
+        assert.equal(byId.get("bidi-true")?.hasBidiControls, true);
+        assert.equal("hasBidiControls" in byId.get("bidi-absent"), false, "clean+absent must project the key OMITTED, not null/false");
+        assert.equal("hasBidiControls" in byId.get("bidi-false"), false, "a written false is out-of-contract and must read as absent, never project");
+        assert.equal(byId.get("bidi-bitless")?.hasBidiControls, true, "a marked row without the bit must be backfilled at projection time");
+        assert.equal(byId.get("bidi-bitless").toolInput.includes(RLO), true);
+        const stored = (await store.get(bitless.token)).pendingAction;
+        assert.equal("hasBidiControls" in stored, false, "projection backfill must not write back to the row");
+    });
     await settle();
 }
 const sortByToken = (a, b) => a.token.localeCompare(b.token);

package/dist/core/tool-policy.d.ts

@@ -576,6 +576,13 @@ export declare function createAllowDenyPolicy(opts: {
  * Human-in-the-loop approval for selected tools. Tools in `requireApproval` call `approve(req)` and
  * are allowed only if it resolves true; tools in `deny` are always blocked; everything else is allowed
  * (override with `denyByDefault: true` to allow only `requireApproval` + an explicit `autoAllow`).
+ *
+ * This seat receives a bare `ToolCallRequest`, NOT the ask surface: the decision settles in-place
+ * inside the policy, no AskRequest is minted and `resolveAsk` is never entered — so none of the
+ * ask-side approval members (`hasBidiControls`, `boundInputHash`, `preview`, `riskAxes`, …) exist
+ * here. A surface rendering the command text for a human on this seat must render through
+ * {@link import("./permission-rule-model.js").renderUntrustedCommandText} (the display baseline)
+ * or run its own screen — absence of the warning bit is "not on this surface", never "clean".
  */
 export declare function createApprovalPolicy(opts: {
     /** Tools that need an approval decision. */
@@ -952,6 +959,48 @@ export interface AskRequest {
      *  so this — like `principal`/`sourceTaskId` — exists only on the synchronous resolution path.
      *  See {@link AskDelegationProvenance} for the trust posture of each member. */
     readonly delegation?: AskDelegationProvenance;
+    /**
+     * PRESENCE ONLY: the command/argument text this ask is about carries at least one DIRECTIONAL
+     * format control ({@link BIDI_CONTROL_RE} — the closed set: U+061C, U+200E/U+200F, the embeddings
+     * and overrides U+202A–U+202E, the isolates U+2066–U+2069). Those characters change nothing about
+     * what EXECUTES and everything about what a terminal or a card SHOWS: bytes that run
+     * `rm -rf /` can display as a benign line, which is precisely the deception an approval surface
+     * cannot afford to render unannotated.
+     *
+     * A WARNING BIT, not a verdict and not a transform. Core does NOT strip, reorder, refuse or rewrite
+     * anything on account of it — {@link args} is delivered byte-identical either way, and the decision
+     * stays the approver's. What a surface owes the person is a visible "the text below can display
+     * differently from what it runs" and a rendering that neutralizes the controls (see
+     * {@link import("./permission-rule-model.js").renderUntrustedCommandText} for the display baseline).
+     *
+     * Read it as PRESENCE-or-nothing: the field is either `true` or ABSENT. It is never written `false`,
+     * because absence means "not detected", which honestly covers both "clean" and "the bounded scan did
+     * not reach it" (a pathologically deep or huge argument graph stops at the scan budget) — a `false`
+     * would claim a proof the scan does not offer. Judged over the EXECUTING argument snapshot and the
+     * tool's own {@link preview} projection, i.e. the payload; {@link message} is deliberately out of
+     * scope (engine/policy-composed prose, not the thing that runs).
+     *
+     * Filled at the `resolveAsk` chokepoint, beside {@link boundInputHash} — every wired `onAsk`
+     * approver call crosses it, so an ask mint site added later is covered by construction. Optional
+     * on the type because a deployment may invoke its approver function directly.
+     *
+     * SCOPE, stated so absence is not read as a clean bill on the other routes: this is the
+     * SYNCHRONOUS `onAsk` ask, like `principal`/`sourceTaskId` — the closure claim is over AskRequest
+     * mint sites, not over every approval callback. The other two human-decision routes:
+     * ① a durable park/suspend never invokes `onAsk` and never mints an AskRequest — its twin of this
+     * bit is the PERSISTED `PendingAction.tool_approval.hasBidiControls` on the parked row (judged at
+     * the park mint over the row's own fidelity-projected args snapshot + preview, so the two faces
+     * can honestly differ on a shape-changing backend), projected to the inbox as
+     * `CheckpointSummary.hasBidiControls` — see those fields in `checkpoint-store.ts` for the reading
+     * contract; absence there is still "not detected", never a clean bill, and an inbox rendering
+     * `RiskDescriptor` still owes its own screen (or the display baseline above);
+     * ② {@link createApprovalPolicy}'s
+     * `approve` seat resolves in-place inside the policy and mints no AskRequest at all — its
+     * callback receives a bare `ToolCallRequest` (no bit, no {@link boundInputHash}, none of this
+     * surface), so a deployment doing HITL through that seat must render through
+     * {@link import("./permission-rule-model.js").renderUntrustedCommandText} or run its own screen.
+     */
+    readonly hasBidiControls?: true;
 }
 /**
  * How an `ask` decision is resolved when a policy/hook requests human confirmation (design/37):
@@ -1176,6 +1225,31 @@ export type ResolvedAsk = PermissionResult & {
      *  frame), so a consumer classifies a refusal by code instead of parsing its text. */
     resolution?: AskDenyResolution;
 };
+/**
+ * Does any string reachable in `value` carry a {@link BIDI_CONTROL_RE} member? Bounded, cycle-safe,
+ * and never throwing — every caller is on an approval/projection path, where a scan that failed must
+ * degrade to "not detected" rather than turn an ask into an error (the `deliverEngineNotice`
+ * posture: a derived disclosure must never become the failure of the thing it describes).
+ *
+ * OBJECT KEYS are scanned as well as values: a key is displayed text too, and an argument object
+ * `{ "cmd<RLO>": … }` renders its own reordering in any card that prints the shape (the marker
+ * is spelled out here on purpose — a literal one in this comment would reorder the comment).
+ *
+ * `limits` parameterizes the two budgets WITHOUT opening a second reader: the character class and
+ * the traversal stay defined exactly here, only the allowance varies by caller. Omitted ⇒ the mint
+ * tier above (the resolveAsk chokepoint and the durable park mint, which scan one call's own
+ * payload). A per-row projection caller (the checkpoint summary backfill, which may face
+ * deployment-written rows of arbitrary size on a many-row read) passes its own smaller tier so one
+ * row's work is bounded regardless of the row's provenance. Both members are required when the
+ * object is given — a half-specified tier would silently mix two tiers in one scan.
+ *
+ * Not a public export: the contract is the {@link AskRequest.hasBidiControls} bit, and a second
+ * spelling of "does this carry bidi" on the public surface would be one more thing to keep in step.
+ */
+export declare function carriesBidiControls(value: unknown, limits?: {
+    maxNodes: number;
+    maxChars: number;
+}): boolean;
 /**
  * Resolve an `ask` decision to a terminal `allow`/`deny` via {@link OnAsk}. Centralizes the headless
  * auto-deny default, fail-closed error handling, and stable deny reasons so every ask site is