@sema-agent/core 5.58.0 → 5.60.0

package/dist/core/tool-policy.js

@@ -900,6 +900,78 @@ export function coreMintedResolutionOf(d, call) {
         return undefined;
     return isAskDenyResolution(v.resolution) ? v.resolution : undefined;
 }
+const BIDI_CONTROL_RE = /[\u061C\u200E\u200F\u202A-\u202E\u2066-\u2069]/u;
+const BIDI_SCAN_MAX_NODES = 5_000;
+const BIDI_SCAN_MAX_CHARS = 1_000_000;
+export function carriesBidiControls(value, limits) {
+    let budget = limits?.maxNodes ?? BIDI_SCAN_MAX_NODES;
+    let charBudget = limits?.maxChars ?? BIDI_SCAN_MAX_CHARS;
+    const seen = new WeakSet();
+    const scan = (s) => {
+        if (charBudget <= 0)
+            return false;
+        const window = s.length <= charBudget ? s : s.slice(0, charBudget);
+        charBudget -= window.length;
+        return BIDI_CONTROL_RE.test(window);
+    };
+    const walk = (v) => {
+        if (budget-- <= 0)
+            return false;
+        if (typeof v === "string")
+            return scan(v);
+        if (typeof v !== "object" || v === null)
+            return false;
+        if (seen.has(v))
+            return false;
+        seen.add(v);
+        if (Array.isArray(v)) {
+            for (const el of v) {
+                if (walk(el))
+                    return true;
+                if (budget <= 0)
+                    return false;
+            }
+            return false;
+        }
+        if (v instanceof Map) {
+            for (const [k, val] of v) {
+                if (walk(k) || walk(val))
+                    return true;
+                if (budget <= 0)
+                    return false;
+            }
+            return false;
+        }
+        if (v instanceof Set) {
+            for (const el of v) {
+                if (walk(el))
+                    return true;
+                if (budget <= 0)
+                    return false;
+            }
+            return false;
+        }
+        for (const k in v) {
+            if (budget-- <= 0)
+                return false;
+            if (!Object.prototype.hasOwnProperty.call(v, k))
+                continue;
+            if (scan(k))
+                return true;
+            if (walk(v[k]))
+                return true;
+            if (budget <= 0 || charBudget <= 0)
+                return false;
+        }
+        return false;
+    };
+    try {
+        return walk(value);
+    }
+    catch {
+        return false;
+    }
+}
 export async function resolveAsk(req, onAsk, signal) {
     const r = await resolveAskArms(req, onAsk, signal);
     if (r.action === "deny" && isAskDenyResolution(r.resolution))
@@ -954,7 +1026,14 @@ async function resolveAskArms(req, onAsk, signal) {
                 settledBy: "aborted",
             };
         }
-        ok = await onAsk({ ...req, boundInputHash: boundInputHashOf(presented.value), args: approverView.value }, signal);
+        const bidi = carriesBidiControls(presented.value) || carriesBidiControls(req.preview);
+        const { hasBidiControls: _carried, ...bare } = req;
+        ok = await onAsk({
+            ...bare,
+            boundInputHash: boundInputHashOf(presented.value),
+            args: approverView.value,
+            ...(bidi ? { hasBidiControls: true } : {}),
+        }, signal);
     }
     catch (err) {
         return {

package/dist/core/tools.js

@@ -45,7 +45,7 @@ export function defineTool(spec, options) {
         executionMode,
         ...(spec.isConcurrencySafe ? { isConcurrencySafe: spec.isConcurrencySafe } : {}),
         ...(spec.effect ? { effect: spec.effect } : {}),
-        ...(spec.contentOrigin ? { contentOrigin: spec.contentOrigin } : {}),
+        ...(spec.contentOrigin !== undefined ? { contentOrigin: spec.contentOrigin } : {}),
         ...(spec.egress ? { egress: true } : {}),
         ...(spec.irreversibility !== undefined ? { irreversibility: spec.irreversibility } : {}),
         ...(spec.reversibilityProbe ? { reversibilityProbe: spec.reversibilityProbe } : {}),

package/dist/core/trace.d.ts

@@ -729,6 +729,42 @@ export type TraceEvent = {
     /** Messages dropped from THIS request view. */
     dropped: number;
     ts: number;
+} | {
+    /** design/374 (G11) — the microCompact clearing machine FIRED: `clearedCount` tool-result
+     *  occurrences were replaced with markers in one pass. `trigger` names the arm: `"frontier"`
+     *  = the proactive request-build pass (anchored estimate crossed the edit budget),
+     *  `"refusal"` = the MC-R rejection-recovery arm (provider said input-too-long), `"blocking"`
+     *  = the slice-3 pre-guard arm (reserved; not emitted before slice 3). SCOPE (X1): emitted
+     *  only when the design/374 machinery is enabled — the `"frontier"` arm requires
+     *  `microCompact.machine: "cc"`, the `"refusal"` arm requires `microCompact.clearOnRejection`;
+     *  the legacy DEFAULT machine clears silently exactly as pre-374 (its clears are ledger-less
+     *  and re-fire per request, so a frame there would re-count the same occurrences and break
+     *  this frame's cardinality clause). Cardinality: exactly ONE frame per firing pass — a retry
+     *  chain re-sending an already-cleared view emits none. A `"refusal"` frame also marks one
+     *  attempt of the shared prompt-too-long recovery budget spent (the MC-R arm's retry rides
+     *  the same per-chain account the forced-compaction arm draws on — the knob doc on
+     *  `RunnerDeps.microCompact` carries the full accounting). */
+    kind: "context.mc_clear";
+    version: 1;
+    taskId: string;
+    clearedCount: number;
+    /** The pass's structural savings estimate (the ≥20k gate's own number). */
+    tokensSavedEstimate: number;
+    trigger: "frontier" | "refusal" | "blocking";
+    ts: number;
+} | {
+    /** design/374 (G11) — the MC-R rejection arm ran and DECLINED to clear: `reason` says why
+     *  (`"no_candidates"` = nothing clearable beyond the keep window on the rejected projection;
+     *  `"below_min_savings"` = clearable but under the 20k gate), `nextArm` names where the
+     *  recovery chain goes instead (`"forced_compaction"` when the compaction arm is available,
+     *  `"none"` when it is disabled/tripped — the turn will surface the provider error). Emitted
+     *  only on the refusal arm; the frontier pass declines silently every request by design. */
+    kind: "context.mc_null";
+    version: 1;
+    taskId: string;
+    reason: "no_candidates" | "below_min_savings";
+    nextArm: "forced_compaction" | "none";
+    ts: number;
 } | {
     /** C8 — the per-turn aggregate tool-result budget capped a result (offloaded to the store, or
      *  degraded to a self-contained truncation preview when the store failed/absent). */

package/dist/core/types.d.ts

@@ -353,7 +353,14 @@ export interface ToolSpec<TParams extends TSchema = TSchema> {
      *  - `"local"` — purely local reads/computation.
      * Classification is single-sourced with the tool definition: core built-ins declare theirs here;
      * a HOST tool that omits it is classified fail-closed as `"external"` (unknown = external) unless
-     * the deployment exempts the name via `TaskSpec.memory.trustedTools`.
+     * the deployment exempts the name via `TaskSpec.memory.trustedTools`. A declaration BEATS that
+     * allowlist (the allowlist is the channel for UNDECLARED tools, never a lever to re-grade a tool
+     * that classified itself), and only a member of the closed vocabulary counts as one — an unreadable
+     * value classifies `"external"` rather than exempting anything.
+     *
+     * Tools core mints on the deployment's behalf get the same seat one level up: an MCP server's whole
+     * tool set is declared at its entry ({@link McpServerSpec.contentOrigin}, design/378), because the
+     * host never touches those tool objects.
      */
     contentOrigin?: ToolContentOrigin;
     /**
@@ -1299,7 +1306,11 @@ export interface McpServerSpec {
          */
         principalHeader?: string;
     };
-    /** Optional allowlist of tool names to expose (others are dropped). */
+    /** Optional allowlist of tool names to expose (others are dropped). ORTHOGONAL to
+     *  {@link contentOrigin} and usefully paired with it (design/378 §2): the class declaration follows
+     *  the server's roster, so a high-assurance deployment that wants a CLOSED tool set writes both —
+     *  a tool a later refresh adds then lands outside this list and is simply not mounted. Existing
+     *  semantics, no new mechanism; the refresh receipt still names every added tool either way. */
     allowTools?: string[];
     /**
      * design/99 §E23 — opt in to INBOUND elicitation for THIS server: when `true` AND a {@link RunnerDeps.onElicit}
@@ -1316,12 +1327,66 @@ export interface McpServerSpec {
      * override is AUTHORITATIVE and may LOWER an effect (vouch a tool is `read`/`idempotent`) as well as raise it
      * (`egress` / irreversible). This is the ONLY trusted way to drop an MCP tool below the fail-closed `write`
      * default (design F). Folds over the server hints in prepare-task (caller > server hint > fail-closed write).
+     *
+     * A DIFFERENT AXIS from {@link contentOrigin}: this one is about what a call DOES (repeat-safety,
+     * blast radius, reversibility — it feeds the approval gate); the content class is about what a call
+     * BRINGS BACK (memory-write governance, no gate/policy/roster effect). Neither implies the other —
+     * a read-only tool can return third-party text, and a deployment's own writer brings back nothing
+     * external — so vouching on one axis never quietly vouches on the other.
      */
     toolAxes?: Record<string, {
         effect?: ToolEffect;
         egress?: boolean;
         irreversibility?: "always" | "never";
     }>;
+    /**
+     * design/378 — declare {@link ToolSpec.contentOrigin} on behalf of THIS SERVER'S ENTIRE TOOL SET
+     * (tools a mid-task refresh adds included), with the same authority and the same responsibility a
+     * directly-mounted host tool's own declaration carries.
+     *
+     * WHY THE SEAT EXISTS. Without it the class keys on the MOUNT SHAPE rather than on lineage: a tool
+     * the deployment wrote and runs itself is structurally `"external"` the moment it arrives over the
+     * MCP protocol namespace, so every call marks the session's memory externally exposed. The
+     * per-name channels cannot express the fact either — {@link import("./memory.js").MemorySpecInput.trustedTools}
+     * is a per-REQUEST allowlist keyed on the MINTED name (the host would have to predict the charset
+     * normalization) whose own definition is "the exception channel for UNDECLARED tools", and it says
+     * nothing about tools the server adds later.
+     *
+     * THIS IS A TRUST DECLARATION, not a routing hint. Use it only for servers inside the deployment's
+     * trust boundary — a process, socket or service the deployment itself runs. Declaring a THIRD-PARTY
+     * server means treating its output as content the deployment wrote: the class names are
+     * BOUNDARY-relative, never topological, so neither the transport kind nor the address is evidence
+     * of lineage (a stdio child can be an untrusted package; a loopback URL can be your own service) and
+     * core deliberately does not gate on either. The declaration covers THE PEER THIS ENTRY CONNECTS TO
+     * — authenticating that peer (socket permissions, credentials) is the host's mounting duty.
+     *
+     * SEMANTICS. `"local"` ⇒ invocations no longer mark this session's memory; `"execution"` ⇒ the same,
+     * except that {@link import("./memory.js").MemorySpecInput.execIsExternalContent} can still upgrade
+     * the class for a strict deployment (which is why this seat takes the three-value vocabulary and not
+     * a single "mine" flag — an execution-shaped tool mounted over MCP must stay inside that knob's
+     * reach); `"external"` is an explicit PIN, and pins are not no-ops — a declaration beats the
+     * `trustedTools` allowlist, so writing it forecloses the per-name exemption for this server's tools.
+     * ABSENT ⇒ the pre-378 behavior byte for byte: the protocol namespace classifies the tools
+     * `"external"` (fail-closed). A value outside the vocabulary is refused at the preparation door
+     * (`config.mcp_content_class`), never folded to a class.
+     *
+     * COVERAGE, stated honestly: the class rides this server's own mounted tools. The cross-server
+     * resource faces (ListMcpResourcesTool / ReadMcpResourceTool / ReadMcpResourceDirTool) aggregate
+     * over every connected server in one call, so they stay `"external"` and still mark — over-marking,
+     * the safe direction. A delegated child's pool is a separate static declaration surface
+     * ({@link ToolSpec.agentToolPool} entries carry their own `contentOrigin`): a deployment handing
+     * this server's tools to children mirrors the value there, and not mirroring it over-marks.
+     *
+     * TRUST SOURCE — a DEPLOYMENT-plane key. It redefines where the trust boundary runs, which puts it
+     * on the same authority plane as {@link RunnerDeps} wiring, not on the request plane. Core sees one
+     * `TaskSpec` and cannot tell a deployment-baseline entry from one a request supplied, so any
+     * assembly layer that accepts REQUEST-side MCP entries must reject or strip this key from them:
+     * "allowed to mount a server" is not "allowed to redefine the deployment's trust boundary", and a
+     * caller-supplied `"local"` would otherwise be self-authorization around the session mark. A
+     * single-tenant superuser surface (a host reading its own `--mcp-config` file) IS the deployment
+     * plane and needs no such gate.
+     */
+    contentOrigin?: ToolContentOrigin;
 }
 /**
  * Definition of one A2A (agent-to-agent protocol) PEER to talk to for the duration of one task.
@@ -4830,6 +4895,11 @@ export interface ProjectMemoryLoad {
  */
 export interface EngineNotice {
     /** Stable machine-readable family, dot-namespaced. Current families:
+     *  - `"config.autocompact_window_clamped"` (design/374 slice 1b) — a model declared
+     *    `autoCompactTokens` ABOVE its physical window; the trigger-side geometry was clamped to the
+     *    physical window (an autocompact window only ever lowers the trigger) and the bad value is
+     *    announced once per prepared task; `detail: { modelId, declaredAutoCompactTokens,
+     *    physicalWindow, sessionId }`.
      *  - `"config.env_timeout_discarded"` — a Bash timeout knob (option or env) held a value that is not
      *    the value in force; `detail: { knob, raw, usedMs }`.
      *  - `"config.materialize_env_discarded"` — `SEMA_TOOL_MATERIALIZE_STRATEGY` held a value outside the
@@ -4850,8 +4920,9 @@ export interface EngineNotice {
      *    probe threw; MCP dispatch FAILS OPEN (revocation is a tightening face) and this announces
      *    once per materialization (a resume re-materializes and may announce again). `detail: { message }`
      *    — no sessionId (a deployment wiring fact, not session-attributed), `"operator"` audience by
-     *    the {@link NOTICE_AUDIENCE} default. The refusal itself (`mcp.server_revoked`) is a tool
-     *    RESULT code, not a notice.
+     *    its explicit {@link NOTICE_AUDIENCE} row (#433 made the registry total over the catalog —
+     *    no engine-minted code is audience-defaulted any more). The refusal itself
+     *    (`mcp.server_revoked`) is a tool RESULT code, not a notice.
      *  - `"config.models_swapped"` — `Runner.swapModels` replaced the model catalog generation
      *    (zero-restart model switching). `detail: { models, tiers }` — key COUNTS only, never the
      *    catalog itself. In-flight tasks finish on the models they resolved at prepare (natural
@@ -4860,8 +4931,11 @@ export interface EngineNotice {
      *  - `"route.fallback_to_primary"` (key↔URL pairing, `src/brain/route-adjudicator.ts`) — a
      *    DERIVED-leg model (role/tier/system-default resolution, never a caller-explicit one) failed
      *    the pairing pre-flight and the seat fell back to the primary model instead of sinking the
-     *    task; the notice is the loud half of that swap. `detail: { seat, from, to, cause, fixHint }`
-     *    — `cause` is the refusal code (`route.credential_mismatch` / `route.credential_missing`).
+     *    task; the notice is the loud half of that swap.
+     *    `detail: { seat, from, to, cause, fixHint, sessionId? }` — `cause` is the refusal code
+     *    (`route.credential_mismatch` / `route.credential_missing`); `sessionId` (#433, additive)
+     *    rides when the adjudicating seat knows its session — a correlation key only, the audience
+     *    stays `"operator"` (see the registry's entitlement-not-routability note).
      *    Explicitly-named models never mint this: they refuse at the brain's request gate instead.
      *  - `"route.base_url_changed_key_unchanged"` (key↔URL pairing) — `Runner.swapModels` moved a
      *    same-name entry's `baseUrl` while its Model-visible credential half (auth-bearing headers)
@@ -4906,8 +4980,10 @@ export interface EngineNotice {
      *    frame's two count keys). They are NOT redelivered (a steer aimed at a finished run must not
      *    fire at the next one — unlike ENGINE notes, which pend per session); the loud half of the
      *    #257 contract's "accepted = enqueued, not consumed" sentence;
-     *    `detail: { steer, taskId? }` / `{ followUp, taskId? }`. Per-run, at most once per family
-     *    (the terminal sweep is a single site).
+     *    `detail: { steer, taskId?, sessionId? }` / `{ followUp, taskId?, sessionId? }` (`sessionId`
+     *    = #433's routing half for these two `"user"`-audience rows — see
+     *    {@link undrainedUserInputNotices}; omitted when the caller has none, never fabricated).
+     *    Per-run, at most once per family (the terminal sweep is a single site).
      *    **#389 (two corrections).** ① The family now fires on the INTERRUPT path too: `abort()` used
      *    to empty both queues before agent_end could count them, so the one loss path an operator most
      *    needs to hear about was the one path that stayed silent. ② On a DURABLE PARK the verdict is
@@ -4924,7 +5000,10 @@ export interface EngineNotice {
      *    notification would be the worse error); what is announced is that the knob's promise is not
      *    honored, so an operator can stop building on it. Once per run (the injection funnel is a
      *    single site, and a busy lane must not narrate the same gap once per frame);
-     *    `detail: { priority, taskId? }`. An UNKNOWN priority value is a different fact with a
+     *    `detail: { priority, taskId?, sessionId }` — `sessionId` (#433, ALWAYS present: the funnel
+     *    sits past prepare, which owns a session unconditionally) is a correlation key only, the
+     *    audience stays `"operator"` (the party building on the unhonored knob is whoever called
+     *    notify, not the end user). An UNKNOWN priority value is a different fact with a
      *    different posture — `TaskStream.notify` refuses it typed (`notify.invalid_payload`).
      *
      *  - `"memory.session_polluted"` (design/178 §3, #324a; message mode-aware since design/336) —
@@ -4988,16 +5067,40 @@ export interface EngineNotice {
      *    `detail: { reason, subagentType?, sessionId? }` — `reason` is the same sentence the waived
      *    mark would have carried, neutralized/length-bounded (tool and agent-type names are
      *    host/model-controlled inputs).
+     *  - `"memory.content_class_declared"` (design/378) — an `McpServerSpec` entry carries an explicit
+     *    {@link McpServerSpec.contentOrigin}: the deployment declared this server's whole tool set to
+     *    be inside (or explicitly outside) its trust boundary, so the protocol namespace's structural
+     *    `"external"` no longer decides. The AUDIT line for a trust boundary an operator drew by
+     *    configuration — which is why it announces on the explicit `"external"` value too: pinning is
+     *    not a no-op (a declaration beats the `trustedTools` allowlist, so it forecloses the per-name
+     *    exemption for this server's tools). One line per DECLARED ENTRY per prepared task leg, minted
+     *    once at preparation and never per call (the declaration's whole effect is that calls stop
+     *    marking; narrating each call would trade the saved mark for equal noise). Armed on the SAME
+     *    condition as the classification it talks about — a leg with no engine-memory session and no
+     *    provenance recorder classifies nothing, so there is no posture to report and no line is
+     *    minted. `detail: { server,
+     *    contentOrigin, toolCount, execIsExternalContent?, sessionId? }` — `server` is the
+     *    host-authored entry name, neutralized/length-bounded; `toolCount` is what this entry actually
+     *    mounted (0 for a server that failed to connect — the declaration still stands and is still
+     *    disclosed); `execIsExternalContent` rides the `"execution"` value only and reports the strict
+     *    knob AS RESOLVED FOR THIS RUN, because that arm's posture depends on it. The message's closing
+     *    clause is written per value so it can never describe a posture the run does not have. The
+     *    entry's TRANSPORT is deliberately absent: it is a claim about a mutable host-owned object made
+     *    long after the dial, and D-10 already rules topology is not evidence of the lineage this line
+     *    audits — connection facts live on `MaterializedMcp.statuses` instead.
      *
      *  - `"memory.consolidation_incomplete"` (design/376, LLM consolidation driver) — a driver run
      *    settled without reaching the fixpoint: `detail` names the stop reason (the closed
      *    `ConsolidationRunStopReason` set), cycles done, and the residue (write-failure or
      *    fuse-refused groups by name). Advisory: committed cycles stand (add-only, never rolled
      *    back); the recovery verb is re-running the host driver, which resumes the same pending run.
-     *  - `"memory.consolidation_driver_superseded"` (same family) — a concurrent driver invocation
-     *    took over this scope's run row (attempt fencing): the losing worker stops with this code
-     *    and MUST NOT retry into the winner's account. Coordination fact between two host calls,
-     *    not a principal ruling — listed in the non-governance disposition table.
+     *  - `"memory.consolidation_driver_superseded"` is an ERROR code, not a notice (named here only
+     *    to keep the family's spellings in one place): a concurrent driver invocation took over this
+     *    scope's run row (attempt fencing) and the losing worker's call THROWS with this `code` —
+     *    it never crosses {@link deliverEngineNotice}, is deliberately absent from
+     *    {@link ENGINE_NOTICE_CODES}/{@link NOTICE_AUDIENCE}, and sits in the non-governance
+     *    disposition table with the error dispositions. The loser MUST NOT retry into the winner's
+     *    account. A consumer diffing its own table against the catalog must not add a row for it.
      *
      *  - `"delegation.transcript_integrity"` (subagent transcript persistence) — a durable agent row
      *    with a BOUND transcript sessionId met a session store that attests `not_found` for it: the
@@ -5005,8 +5108,7 @@ export interface EngineNotice {
      *    most once per (scope, handle, process) — `detail: { handle, scope? }`, scope = the resolved
      *    access scope of the read that found the gap — from the continuation read faces (SendMessage preflight /
      *    AgentTranscript's durable leg); the per-call honest refusals are unchanged, and the declared
-     *    tier is NOT auto-downgraded (declaration-制 — observation reports, it never re-adjudicates);
-     *    `detail: { handle }`.
+     *    tier is NOT auto-downgraded (declaration-制 — observation reports, it never re-adjudicates).
      *
      *  - `"memory.consolidation_recommended"` (design/339 §2.2/§6.2) — the engine-minted per-scope
      *    session count crossed the consolidation thresholds (time gate open ∧ enough distinct
@@ -5039,11 +5141,15 @@ export interface EngineNotice {
     message: string;
     /** Machine-readable facts of the notice (knob names, arriving values, values in force). */
     detail?: Record<string, unknown>;
-    /** The owning session, when the notice HAS one — the wire-routing attribution key (a
-     *  session-scoped notice can be projected onto that session's event stream; a session-less code
-     *  structurally cannot). Mint sites do not set this: {@link deliverEngineNotice} — the ONE
-     *  delivery throat — lifts a string `detail.sessionId` here, so the typed key and the detail
-     *  carriage can never disagree. Optional and absent for process/config-scoped codes. */
+    /** The owning session, when the notice HAS one — an ATTRIBUTION/correlation key, never a
+     *  projection permission: whether a notice may be surfaced onto that session's user-facing
+     *  stream is decided by the code's {@link NOTICE_AUDIENCE} row alone ("audience is entitlement,
+     *  not routability" — several `"operator"` rows carry a sessionId purely for correlation, and a
+     *  projector keying on presence would push deployment facts at end users). Presence only makes
+     *  routing structurally POSSIBLE; a session-less code structurally cannot be routed at all.
+     *  Mint sites do not set this: {@link deliverEngineNotice} — the ONE delivery throat — lifts a
+     *  string `detail.sessionId` here, so the typed key and the detail carriage can never disagree.
+     *  Optional and absent for process/config-scoped codes. */
     sessionId?: string;
 }
 /** Test seam (mirrors `__resetBashTimeoutAnnouncements`): never called by production code. */
@@ -5073,11 +5179,19 @@ export declare function deliverEngineNotice(onNotice: ((notice: EngineNotice) =>
  * a consumer routing on `code` alone must never mistake a stranded follow-up for a stranded steer, so
  * the code carries exactly the semantics its name claims — the same two-key split the settled frame
  * uses. Pure (the terminal sweep race window is not constructible deterministically; this seam is).
+ *
+ * `sessionId` (#433, additive and optional): these two codes are the `"user"` audience rows whose
+ * subject is the END USER's own lost input, and a disclosure that cannot say WHICH session lost it
+ * has nowhere to be delivered — the audience registry and the routing key are the two halves of one
+ * answer. Carried in `detail` like every other session-attributed code, so {@link deliverEngineNotice}
+ * — the one throat — lifts it to the typed top-level key and the two spellings cannot disagree.
+ * Omitted when the caller has none (never fabricated: the message is what the run lost, and a made-up
+ * routing key would deliver it to the wrong stream).
  */
 export declare function undrainedUserInputNotices(counts: {
     steer: number;
     followUp: number;
-}, taskId?: string): EngineNotice[];
+}, taskId?: string, sessionId?: string): EngineNotice[];
 /** Runtime dependencies shared across tasks. */
 export interface RunnerDeps {
     brain: Brain;
@@ -5094,7 +5208,9 @@ export interface RunnerDeps {
      * probe must not brick every MCP call) with a once-per-MATERIALIZATION `mcp.revocation_probe_failed`
      * notice (a resume re-materializes and may announce again — the standing condition is re-news at
      * each fresh mount, never per-call). The notice is a deployment wiring fact: `detail: { message }`
-     * only, no session attribution, `"operator"` audience by the {@link NOTICE_AUDIENCE} default — a
+     * only, no session attribution, `"operator"` audience by its explicit {@link NOTICE_AUDIENCE}
+     * row (#433 made the registry total over the catalog — no engine-minted code is
+     * audience-defaulted any more) — a
      * wire projector forwards it operator-tier and needs no per-session de-duplication of its own.
      */
     mcpRevocations?: {
@@ -6045,6 +6161,40 @@ export interface RunnerDeps {
      * ~20000; set `0` or `Infinity` to disable offloading. Per-tool override via `ToolSpec.offloadThresholdChars`.
      */
     toolResultThresholdChars?: number;
+    /**
+     * design/374 — microCompact machine-alignment knobs (EXPERIMENTAL until the slice-3 default
+     * flip; both default OFF so a deployment that never touches this bag runs the pre-374 machine
+     * byte for byte).
+     *
+     *  - `machine`: which stale-tool-result clearing machine the request pipeline runs —
+     *    `"legacy"` (default; the historical keep-3 / clear-to-budget machine) or `"cc"` (the CC
+     *    2.1.223 rejection-leg form: keep 5, ≥20k minimum-savings gate, one deep clear beyond the
+     *    keep window, CC marker bytes). ⚠️ Read the P-form warning on
+     *    {@link import("./context-edit.js").ContextEditMachine} before selecting `"cc"`: until the
+     *    slice-3 fallback re-ordering ships, the 20k gate sits in front of the only reduction while
+     *    the message-dropping guard trim still backstops — opting in is accepting that trade.
+     *  - `clearOnRejection` (MC-R, slice 2): on a provider input-too-long rejection, run ONE cheap
+     *    deterministic clear over the rejected projection (same cc machine, savings ≥20k or nothing)
+     *    and retry inside the turn BEFORE the forced-compaction recovery. Default false (X2: the
+     *    machinery lands dark; the default flips together with the machine in slice 3). Independent
+     *    of `machine` — an enabled MC-R always clears in the cc form (the rejection arm has no
+     *    budget coordinate for the legacy incremental form to stop at). BUDGET ACCOUNTING (design/374
+     *    §3.2.1, stated here because it is otherwise invisible to a deployment): a successful MC-R
+     *    clear-and-retry SPENDS one attempt of the shared prompt-too-long recovery budget (default 2
+     *    attempts per chain), so a chain that clears and is rejected AGAIN has one forced-compaction
+     *    attempt left where the knob-off chain nominally had two — the trade costs no effective
+     *    compaction pass, because the second forced-compaction call of the off chain is structurally
+     *    a no-op whenever the first one landed (the branch leaf is already a compaction entry).
+     *
+     *  A declaration outside the closed vocabulary (a `machine` string not in the union, a
+     *  non-boolean `clearOnRejection` — JSON/env-derived config the type cannot guard) refuses the
+     *  whole prepare loudly (`code: "config.microcompact_invalid"`, no silent re-default): folding it
+     *  would run the pre-374 machine while the deployment believes it opted in.
+     */
+    microCompact?: {
+        machine?: "legacy" | "cc";
+        clearOnRejection?: boolean;
+    };
     /**
      * Two-phase prefix-cache-break detection (design/31): per turn, fingerprint the prefix and, on a
      * confirmed `cacheRead` drop, emit a root-cause finding via `onError(phase:"prompt-cache")`. Cheap

package/dist/core/types.js

@@ -52,22 +52,23 @@ export function deliverEngineNotice(onNotice, notice) {
     }
     console.warn(notice.message);
 }
-export function undrainedUserInputNotices(counts, taskId) {
+export function undrainedUserInputNotices(counts, taskId, sessionId) {
     const tid = taskId !== undefined ? { taskId } : {};
+    const sid = sessionId !== undefined ? { sessionId } : {};
     const tail = `accepted as "queued" were never consumed — the run ended first. They are NOT redelivered; re-send against a live run if still wanted.`;
     const out = [];
     if (counts.steer > 0) {
         out.push({
             code: "task.user_steer_undrained",
             message: `${counts.steer} user steer(s) ${tail}`,
-            detail: { steer: counts.steer, ...tid },
+            detail: { steer: counts.steer, ...tid, ...sid },
         });
     }
     if (counts.followUp > 0) {
         out.push({
             code: "task.user_followup_undrained",
             message: `${counts.followUp} user follow-up(s) ${tail}`,
-            detail: { followUp: counts.followUp, ...tid },
+            detail: { followUp: counts.followUp, ...tid, ...sid },
         });
     }
     return out;

package/dist/core/untrusted-text.d.ts

@@ -393,6 +393,17 @@ export declare function defuseControlChars(text: string): string;
  * Defense-in-depth, NOT a guarantee (same posture as the rest of this module).
  */
 export declare function inlineUntrusted(text: string, maxLen?: number): string;
+/** backlog #239: the per-ENTRY ceiling inside a `ProbeCause` operand family (checkpoint-store's
+ *  structured probe account), sized like the descriptor's own `touchedPaths` entries (the same thing
+ *  on the same card). Per entry, not per cause: that is the whole point of the structured shape —
+ *  one pathological path costs only itself, where a single joined string let it consume every other
+ *  entry's room. HOMED HERE (the leaf neutralizer module) rather than with the `ProbeCause` types:
+ *  its two consumers — the shell probe that sanitizes at the entry boundary (tools/fs) and the
+ *  descriptor builder that re-sanitizes at the persist boundary (core/checkpoint-store) — sit on
+ *  opposite sides of a value-import boundary, and a value import from the shell tool back into
+ *  checkpoint-store closed an ESM evaluation cycle (checkpoint-store → tool-policy → tools/fs →
+ *  checkpoint-store, a latent TDZ). Both already import this module; one cap, no cycle. */
+export declare const PROBE_CAUSE_PATH_MAX = 200;
 /** The one body bound every "reviewer note" relay passes to {@link delimitUntrusted} — the decider's
  *  free text attached to a deny (sync `AskOutcome.reason` and the durable `ResumeOutcome` `reason`
  *  legs alike). A note is steering, not payload: unbounded it can flood the transcript/context the

package/dist/core/untrusted-text.js

@@ -568,6 +568,7 @@ export function inlineUntrusted(text, maxLen = LABEL_MAX) {
 function sanitizeLabel(label) {
     return inlineUntrusted(label, LABEL_MAX);
 }
+export const PROBE_CAUSE_PATH_MAX = 200;
 export const REVIEWER_NOTE_MAX_BODY = 2048;
 export function delimitUntrusted(label, text, maxBody) {
     return delimitUntrustedWithClip(label, text, maxBody).text;

package/dist/engine/llm/types.d.ts

@@ -413,8 +413,27 @@ export interface AssistantMessage {
      *  ⚠️ Brain OBLIGATION (RB-482 #12, 5.1.0): stamping this field on every cut turn is part of the
      *  Brain contract — the sentinel-prose fallback readers are RETIRED, so a custom Brain that stamps
      *  only `errorMessage` prose is no longer recognized as a cut (terminal-cause.ts reads this field
-     *  and nothing else). Widening note: exhaustive switches on this union gain arms as it grows. */
-    errorKind?: "length_empty" | "degenerate";
+     *  and nothing else). Widening note: exhaustive switches on this union gain arms as it grows.
+     *
+     *  `"input_too_long"` (design/374 slice 2): the provider refused because the request INPUT alone
+     *  exceeds its context limit — classified at the brain boundary from provenance-checked signals
+     *  only (`brain/input-too-long.ts`: the diagnostic field of a JSON error envelope, anchored
+     *  provider openings, the OpenAI `context_length_exceeded` structural code, HTTP 413, and the
+     *  Anthropic in-band `model_context_window_exceeded` stop / streamed `invalid_request_error`
+     *  twin). The loop's prompt-too-long recovery reads THIS seat first; the historic prose regex
+     *  over `errorMessage` remains as the fallback for brains that do not stamp it (additive — the
+     *  stamping obligation above extends to this member for cuts a Brain can classify structurally,
+     *  but unlike the two cut kinds there is no retired fallback: prose detection still works). */
+    errorKind?: "length_empty" | "degenerate" | "input_too_long";
+    /** design/374 slice 2, the AUTHORITATIVE-NEGATIVE twin of `errorKind: "input_too_long"`: the
+     *  brain's provenance-checked classifier RAN and ruled this failure NOT input-too-long (wrong
+     *  status family, or the provider's own diagnostic envelope states a different error). The
+     *  loop's prompt-too-long recovery treats it as a hard negative and SKIPS its prose fallback —
+     *  a "prompt is too long" sentence reflected inside an unrelated error body must never drive a
+     *  context-shrinking recovery (adversarial-review r1). Absent = classification could not
+     *  establish provenance (prose-only gateway, truncated body, non-classifying custom Brain), and
+     *  the historic prose fallback keeps its reach. Mutually exclusive with the positive stamp. */
+    inputTooLongRuledOut?: true;
     /**
      * design/124 tier A: this final message was PARTIALLY FINALIZED after a mid-stream connection
      * loss/stall — the substantive streamed prefix (text and/or completed tool calls) was promoted to

package/dist/engine/loop/agent-loop.js

@@ -39,7 +39,13 @@ function isBlankFailureContent(message) {
     return message.content.every((c) => c.type === "text" ? c.text.trim() === "" : c.type === "thinking" ? c.thinking.trim() === "" : false);
 }
 function defaultDetectPromptTooLong(message) {
-    return message.stopReason === "error" && PROMPT_TOO_LONG_RE.test(message.errorMessage ?? "");
+    if (message.stopReason !== "error")
+        return false;
+    if (message.errorKind === "input_too_long")
+        return true;
+    if (message.inputTooLongRuledOut === true)
+        return false;
+    return PROMPT_TOO_LONG_RE.test(message.errorMessage ?? "");
 }
 function createPtlWithholdBuffer(emit, detect) {
     const held = [];

package/dist/engine/loop/types.d.ts

@@ -161,7 +161,10 @@ export interface LoopPromptTooLongRecovery {
      * Contract: must not throw or reject.
      */
     recover: (messages: AgentMessage[], attempt: number) => Promise<AgentMessage[] | undefined>;
-    /** Override the prompt-too-long classifier. Default: a conservative provider-message pattern. */
+    /** Override the prompt-too-long classifier. Default (design/374 slice 2): the TYPED cause first
+     *  (`errorKind: "input_too_long"`, stamped by the brains from provenance-checked provider
+     *  signals), then the conservative provider-message prose pattern as the fallback for brains
+     *  that do not stamp it. */
     detect?: (message: AssistantMessage) => boolean;
     /** Max recovery retries per turn. Default: 2. */
     maxRetries?: number;