@sema-agent/core 5.59.0 → 5.60.0

package/CHANGELOG.md

@@ -1,5 +1,45 @@
 # Changelog
 
+## 5.60.0 — 2026-08-25
+
+### Added
+- **CC clearing machine + micro-compact recovery (design/374 slices 1a/1b/2/4; every default byte-identical)**:
+  `ContextEditOptions.machine: "legacy" | "cc"` selects the clearing machine — `cc` is CC's rejection-leg
+  form carried whole (keep 5, a >=20000-token minimum-savings gate with the field-exact `Sby` estimator,
+  one deep clear, a window base over ALL compactable occurrences, five cleared-predicate forms);
+  `RunnerDeps.microCompact { machine, clearOnRejection }` (both default off). A typed `input_too_long`
+  cause classifies real provider context refusals (position-0 anchored family over the parsed envelope
+  diagnostic; reflected copies stay ruled out) and feeds an MC-R recovery arm at the head of the
+  recovery chain (attempt-1 latch; plan over the rejected projection; a projection LEDGER — occurrence
+  keys (toolCallId, timestamp, dup ordinal), new-machine writes only — is the clear's sole survival
+  channel across per-request rebuilds). `resolveTriggerWindow` becomes the one trigger-window source
+  (four consumers); a clamped window announces `config.autocompact_window_clamped` once per task.
+  Trace frames `context.mc_clear`/`context.mc_null`. Nine CC divergences registered (cc-parity ledger).
+- **Durable park rows carry the bidi twin (design/377, #438)**: `PendingAction.tool_approval.hasBidiControls?: true`
+  minted at park over the fidelity-projected args snapshot + preview; `CheckpointSummary.hasBidiControls`
+  projected, bit-less legacy rows BACKFILLED at projection from their own bounded materials (32K units /
+  512 nodes per row; never written back; a stored `false` reads as absent). Checkpoint version unchanged.
+- **MCP entry-level content-trust declaration (design/378, #439; default byte-identical)**:
+  `McpServerSpec.contentOrigin?: "local" | "execution" | "external"` (the existing ToolContentOrigin
+  vocabulary), minted once at intake from a frozen copy; `memory.content_class_declared` announces one
+  per-value line per declared entry per prepared leg (explicit `"external"` announces too — it
+  forecloses the trustedTools exemption); malformed declarations refuse at preparation
+  (`config.mcp_content_class`).
+
+### Changed — narrowings (named)
+- **Inbox display family goes Cf-safe (two byte generations)**: descriptor-owned `RiskDescriptor` seats
+  (`summary` both arms, `touchedPaths`, `shadowedRule`) render through `renderUntrustedCommandText` —
+  newly-minted rows strip the `\p{Cf}` format class (emoji ZWJ sequences display decomposed); persisted
+  rows keep their old bytes forever. Byte-pinning consumers must read per row generation.
+- **Confirm-face refusal messages stop interpolating raw command bytes (#430)**: >120-code-point
+  commands cap with an ellipsis, control bytes render `\uXXXX`; short clean commands byte-identical.
+  Two `record_malformed` damage sentences escape record-sourced values.
+- **Vocabulary-outside `declared` content origins now classify `external`** (previously escaped marking
+  silently — a fail-open hole closed; untyped host-mounted tools with garbage declarations are the
+  affected shape).
+- **`approvalRecordDamageOf` gains the reverse integrity clause (#441)**: an orphan candidate row
+  (belonging to no offer) answers `record_malformed` at all three consent entries.
+
 ## 5.59.0 — 2026-08-24
 
 ### BREAKING (narrow, named)

package/dist/brain/anthropic.js

@@ -1,5 +1,6 @@
 import {} from "../internal/llm.js";
 import { BrainError } from "./errors.js";
+import { startsWithInputTooLongAnchor } from "./input-too-long.js";
 import { DEGENERATE_MESSAGE, trimDegenerateTail } from "./repetition.js";
 import { createRepetitionPoll, parseStreamedToolArgs } from "./stream-shared.js";
 import { mintFallbackToolCallId } from "./tool-call-id.js";
@@ -178,6 +179,8 @@ function anthropicStreamErrorCode(t) {
             return "auth";
         case "invalid_request_error":
             return "invalid_request";
+        case "request_too_large":
+            return "invalid_request";
         default:
             return "server";
     }
@@ -501,8 +504,13 @@ export function createAnthropicBrain(config = {}) {
                             break;
                         }
                         case "error": {
-                            const e = evt.error;
-                            throw new BrainError(anthropicStreamErrorCode(e?.type), `anthropic stream error (${e?.type ?? "unknown"}): ${e?.message ?? ""}`);
+                            const rawError = evt.error;
+                            const e = typeof rawError === "object" && rawError !== null && !Array.isArray(rawError)
+                                ? rawError
+                                : undefined;
+                            const inputTooLong = e?.type === "request_too_large" ||
+                                (e?.type === "invalid_request_error" && typeof e.message === "string" && startsWithInputTooLongAnchor(e.message));
+                            throw new BrainError(anthropicStreamErrorCode(e?.type), `anthropic stream error (${e?.type ?? "unknown"}): ${e?.message ?? ""}`, undefined, e === undefined ? undefined : inputTooLong ? { inputTooLong: true } : { inputTooLongRuledOut: true });
                         }
                         default:
                             break;
@@ -654,9 +662,11 @@ export function createAnthropicBrain(config = {}) {
                             (truncatedEmpty && !dynamicCut && !staticReasoningCut);
                         const errorKind = degenerate
                             ? "degenerate"
-                            : !safetyCut && toolError === undefined && truncatedEmpty && !dynamicCut && !staticReasoningCut
-                                ? "length_empty"
-                                : undefined;
+                            : !safetyCut && contextWindowExceeded
+                                ? "input_too_long"
+                                : !safetyCut && toolError === undefined && truncatedEmpty && !dynamicCut && !staticReasoningCut
+                                    ? "length_empty"
+                                    : undefined;
                         const finalMessage = {
                             ...partial,
                             content: finalContent.length > 0 ? finalContent : [{ type: "text", text: "" }],

package/dist/brain/errors.d.ts

@@ -34,7 +34,24 @@ export declare const IN_BAND_OUTPUT_CODES: ReadonlySet<BrainErrorCode>;
 export declare class BrainError extends Error {
     readonly code: BrainErrorCode;
     readonly status?: number;
-    constructor(code: BrainErrorCode, detail: string, status?: number);
+    /** design/374 slice 2 — STRUCTURAL cause seat: the provider stated (in a provenance-checked
+     *  diagnostic field or status, see `input-too-long.ts`) that the request INPUT exceeds its
+     *  context limit. The engine's terminal-shell mint lifts it onto `AssistantMessage.errorKind:
+     *  "input_too_long"`, which the loop's prompt-too-long classifier reads instead of regexing the
+     *  human-facing message. Never inferred from `detail` prose after construction. */
+    readonly inputTooLong?: true;
+    /** The AUTHORITATIVE-NEGATIVE half (adversarial-review r1): the classifier RAN with provenance
+     *  and this failure is NOT input-too-long (wrong status family, or the provider's own envelope
+     *  states a different error). Lifted onto `AssistantMessage.inputTooLongRuledOut`, which
+     *  suppresses the loop's prose fallback — a reflected "prompt is too long" inside an unrelated
+     *  error body must not drive a context-shrinking recovery. Mutually exclusive with
+     *  `inputTooLong`; BOTH absent = classification could not establish provenance ("unknown"),
+     *  and the prose fallback keeps its historic reach. */
+    readonly inputTooLongRuledOut?: true;
+    constructor(code: BrainErrorCode, detail: string, status?: number, opts?: {
+        inputTooLong?: boolean;
+        inputTooLongRuledOut?: boolean;
+    });
 }
 /** Map an HTTP status to an error class. 401/403 = auth (don't retry); 429 = rate limit; 5xx = server. */
 export declare function classifyHttp(status: number): BrainErrorCode;

package/dist/brain/errors.js

@@ -12,11 +12,17 @@ export const IN_BAND_OUTPUT_CODES = new Set(["stream_torn", "refusal", "length_e
 export class BrainError extends Error {
     code;
     status;
-    constructor(code, detail, status) {
+    inputTooLong;
+    inputTooLongRuledOut;
+    constructor(code, detail, status, opts) {
         super(`[${code}] ${detail}`);
         this.name = "BrainError";
         this.code = code;
         this.status = status;
+        if (opts?.inputTooLong === true)
+            this.inputTooLong = true;
+        else if (opts?.inputTooLongRuledOut === true)
+            this.inputTooLongRuledOut = true;
     }
 }
 export function classifyHttp(status) {

package/dist/brain/input-too-long.d.ts

@@ -0,0 +1,57 @@
+/**
+ * design/374 slice 2 — TYPED input-too-long classification for provider refusals.
+ *
+ * "The request INPUT alone exceeds the model's context limit" used to be recognized only by the
+ * loop's prose regex over the human-facing `errorMessage` — a classifier that (a) cannot tell a
+ * provider's own diagnostic from caller text a gateway reflected, and (b) breaks the moment a
+ * provider rewords. This module classifies at the BRAIN boundary, where provenance is decidable,
+ * and the verdict rides `BrainError.inputTooLong` → `AssistantMessage.errorKind: "input_too_long"`
+ * (the same typed lane `degenerate`/`length_empty` already use).
+ *
+ * PROVENANCE DISCIPLINE (mirrors `context-overflow.ts`, the sibling classifier for the
+ * input+max_tokens overflow — a DIFFERENT error: there the input fits and lowering the output cap
+ * self-heals; here the input alone does not fit and only shrinking the input helps):
+ *   - The only text source is the provider's diagnostic FIELD: `error.message` of a JSON object
+ *     body whose `error` is itself an object (both the Anthropic `{type:"error",error:{…}}` and
+ *     the OpenAI `{error:{…}}` envelopes reduce to this). A plain-text body, a string `error`, a
+ *     top-level `message` — refused: each is a guess about gateway formatting that would trade a
+ *     hypothetical classification for a field a gateway may fill with caller content.
+ *   - Prose is matched ANCHORED at the start of that field only, against the conservative
+ *     context-limit FAMILY below (case-INsensitive since the r2 family form — the family note owns
+ *     the reasoning and the member list). A gateway that inlines the offending request
+ *     ("validation failed; offending prompt: prompt is too long…") therefore cannot classify:
+ *     caller text must never steer a retry.
+ *   - Structural signals need no prose at all: OpenAI-family `error.code ===
+ *     "context_length_exceeded"`, and HTTP 413 (the transport's own "request entity too large").
+ *
+ * Misclassification cost note (updated with the r1 three-state verdict — the original "a miss
+ * keeps exactly the pre-374 behavior" claim died with the binary form): inside a PARSED provider
+ * envelope a miss is an AUTHORITATIVE negative that SUPPRESSES the loop's prose fallback — which
+ * is why the family must carry every observed genuine opening (the r2/r3/r4 additions below);
+ * prose-only bodies keep the pre-374 fallback reach via "unknown". A FALSE HIT costs one bounded
+ * recovery attempt — but only on a 400/413/422 the request already failed on.
+ */
+/** True when the (provider-authored) diagnostic OPENS with the context-limit refusal family. */
+export declare function startsWithInputTooLongAnchor(diagnostic: string): boolean;
+/**
+ * Three-state classification verdict (adversarial-review r1: a binary answer conflated "the
+ * provider said something ELSE" with "we could not read the provider", and the loop's prose
+ * fallback then re-opened the reflected-text hole for exactly the errors this module HAD
+ * examined):
+ *  - `"yes"`     — provenance-checked input-too-long; the caller stamps the typed cause.
+ *  - `"no"`      — the classification is AUTHORITATIVE-NEGATIVE: either the status can never carry
+ *                  this refusal (5xx, auth, rate limit — reflected prose in those bodies must not
+ *                  drive a context-shrinking recovery), or the provider's own diagnostic envelope
+ *                  parsed and states a different error. The caller marks the terminal shell
+ *                  ruled-out, which SUPPRESSES the loop's prose fallback for this message.
+ *  - `"unknown"` — a PTL-capable status whose body established no provenance (text/plain gateway,
+ *                  truncated read): nothing is stamped either way, and the loop's historic prose
+ *                  fallback keeps working for gateways that speak prose only.
+ */
+export type InputTooLongVerdict = "yes" | "no" | "unknown";
+/**
+ * Classify an HTTP refusal as input-too-long. `body` is the (bounded) error-body text as read;
+ * a truncated read that no longer parses as JSON answers `"unknown"` (413 excepted — the status
+ * alone is the provider's statement).
+ */
+export declare function classifyInputTooLong(status: number, body: string): InputTooLongVerdict;

package/dist/brain/input-too-long.js

@@ -0,0 +1,35 @@
+const INPUT_TOO_LONG_ANCHORED_RE = /^(?:prompt is too long|input is too long|this model's maximum context length is |context.{0,3}length|context window (?:limit|exceeded)|reached its context window|too many tokens|maximum context|input length and `max_tokens` exceed context limit|(?:the )?request(?: \([^)]{0,40}\))? exceeds|(?:the )?input token count(?: \([^)]{0,40}\))? exceeds|requested tokens(?: \([^)]{0,40}\))? exceed|your input exceeds|(?:the )?number of tokens in the request exceeds)/i;
+const INPUT_TOO_LONG_STATUSES = new Set([400, 413, 422]);
+export function startsWithInputTooLongAnchor(diagnostic) {
+    return INPUT_TOO_LONG_ANCHORED_RE.test(diagnostic.trimStart());
+}
+function providerErrorObject(body) {
+    const trimmed = body.trim();
+    if (!trimmed.startsWith("{"))
+        return undefined;
+    let parsed;
+    try {
+        parsed = JSON.parse(trimmed);
+    }
+    catch {
+        return undefined;
+    }
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed))
+        return undefined;
+    const err = parsed.error;
+    if (typeof err !== "object" || err === null || Array.isArray(err))
+        return undefined;
+    return err;
+}
+export function classifyInputTooLong(status, body) {
+    if (!INPUT_TOO_LONG_STATUSES.has(status))
+        return "no";
+    if (status === 413)
+        return "yes";
+    const err = providerErrorObject(body);
+    if (err === undefined)
+        return "unknown";
+    if (err.code === "context_length_exceeded")
+        return "yes";
+    return typeof err.message === "string" && startsWithInputTooLongAnchor(err.message) ? "yes" : "no";
+}

package/dist/brain/stream-engine.js

@@ -1,6 +1,7 @@
 import { createAssistantMessageEventStream, } from "../internal/llm.js";
 import { FLOOR_OUTPUT_TOKENS, parseContextOverflow, planOutputCapAdjustment } from "./context-overflow.js";
 import { BrainError, classifyConnectFailure, classifyHttp, describeNetworkError } from "./errors.js";
+import { classifyInputTooLong } from "./input-too-long.js";
 import { FAST_MAX_BACKOFF_MS, providerWaitHint, retryBackoffMs } from "./retry.js";
 import { emitBrainStatus, emitBrainTelemetry } from "./status-sink.js";
 import { createConnectController, resolveStallTimeoutMs } from "./timeout.js";
@@ -258,6 +259,12 @@ export function runStreamingBrain(args) {
         const errorMsg = emptyAssistant(model);
         errorMsg.stopReason = aborted ? "aborted" : "error";
         errorMsg.errorMessage = err instanceof Error ? err.message : String(err);
+        if (!aborted && err instanceof BrainError) {
+            if (err.inputTooLong === true)
+                errorMsg.errorKind = "input_too_long";
+            else if (err.inputTooLongRuledOut === true)
+                errorMsg.inputTooLongRuledOut = true;
+        }
         errorMsg.usageMissing = true;
         out.push({ type: "error", reason: aborted ? "aborted" : "error", error: errorMsg });
     })
@@ -429,7 +436,8 @@ export function runStreamingBrain(args) {
                         throw new BrainError("network", describeNetworkError(netErr));
                     const detail = overflowBody ?? (r ? (await readErrorBody(r, signal)).text : "");
                     const status = r?.status ?? 0;
-                    throw new BrainError(classifyHttp(status), `${httpLabel} HTTP ${status || "ERR"}: ${detail.slice(0, 500)}${overflowDeclineNote}`, status);
+                    const itl = classifyInputTooLong(status, detail);
+                    throw new BrainError(classifyHttp(status), `${httpLabel} HTTP ${status || "ERR"}: ${detail.slice(0, 500)}${overflowDeclineNote}`, status, itl === "yes" ? { inputTooLong: true } : itl === "no" ? { inputTooLongRuledOut: true } : undefined);
                 }
                 finally {
                     cc.abort();

package/dist/core/auto-compaction.js

@@ -1,6 +1,6 @@
 import { DEFAULT_CHARS_PER_TOKEN, DEFAULT_CLAMP_TOLERANCE, DEFAULT_COMPACTION_SETTINGS, CompactionError, compact, computeFileLists, dryRunSummarizationClamp, estimateContextTokens, estimateTokens, formatFileOperations, formatPersistedOutputRefs, prepareCompaction, shouldCompact, } from "../internal/harness.js";
 import { fileArgPath } from "../tools/fs/safety.js";
-import { contextEditFrontier } from "./context-edit.js";
+import { contextEditFrontier, resolveTriggerWindow } from "./context-edit.js";
 import { selectCompactionEpoch } from "../prompt-assembly/epoch.js";
 import { SEMA_DEFAULT_PACK } from "../prompt-assembly/packs/sema-default.js";
 import { brainToRuntime } from "./runtime.js";
@@ -81,7 +81,7 @@ export async function maybeCompact(opts) {
     const structuralTokens = ctx.messages.reduce((sum, m) => sum + estimateTokens(m, cpt), 0);
     const anchorStale = est.usageTokens > 0 && est.tokens > structuralTokens * STALE_ANCHOR_STRUCTURAL_MARGIN + overhead;
     const tokens = anchorStale || est.usageTokens === 0 ? structuralTokens + overhead : est.tokens;
-    const window = opts.model.autoCompactTokens ?? opts.model.contextTokens ?? opts.model.contextWindow;
+    const window = resolveTriggerWindow(opts.model).window;
     const windowKnown = Number.isFinite(window) && window > 0;
     const windowField = opts.model.autoCompactTokens != null ? "autoCompactTokens" : opts.model.contextTokens != null ? "contextTokens" : "contextWindow";
     const settings = sanitizeCompactionSettings(rawSettings, window);

package/dist/core/checkpoint-store.d.ts

@@ -135,19 +135,41 @@ export interface RiskDescriptor {
      *  answer that in the field. */
     shellGateDoctrine?: "classify" | "always";
     /** A REDACTED, length-capped ONE-LINE summary of the call (the command for a shell gate; a brief key-arg
-     *  digest otherwise) for the inbox preview. NEUTRALIZED via {@link import("./untrusted-text.js").inlineUntrusted}
-     *  + length-capped (it is persisted + shown to a human inbox, so a crafted tool arg carrying a
-     *  `</system-reminder>` variant / newline / huge string must NOT inject into the render or bloat storage).
+     *  digest otherwise) for the inbox preview. NEUTRALIZED via
+     *  {@link import("./permission-rule-model.js").renderUntrustedCommandText} + length-capped (it is
+     *  persisted + shown to a human inbox, so a crafted tool arg carrying a `</system-reminder>` variant /
+     *  newline / huge string must NOT inject into the render or bloat storage — and, since #438, a
+     *  directional/zero-width `\p{Cf}` marker cannot ride into the render either: the display baseline
+     *  STRIPS the format class, so what the line shows is what the args carry, in the order they carry it).
+     *  GENERATIONAL, like every mint-time seat: the summary is minted ONCE at park mint and persisted, so
+     *  rows minted before the #438 render change keep their old bytes (which may carry `\p{Cf}`) forever —
+     *  a consumer must not assume one byte-form across row generations, and the display obligation
+     *  (render through the baseline, or screen) is the same for both. One benign visible consequence on
+     *  new rows: an emoji ZWJ sequence in a command displays decomposed here (raw bytes stay in
+     *  `pendingAction.args`/`toolInput` — this seat is DISPLAY, not identity).
      *  NEVER raw secrets / full args / env. Deterministic. Optional (omitted when nothing safe to summarize). */
     summary?: string;
     /** Best-effort file paths the action touches (fs-tool `path` args; shell parsing is deliberately NOT
-     *  attempted — over-reaching a shell parse risks a wrong/forgeable path). Each path `inlineUntrusted`-capped.
+     *  attempted — over-reaching a shell parse risks a wrong/forgeable path). Each path rendered through the
+     *  same {@link import("./permission-rule-model.js").renderUntrustedCommandText} baseline as
+     *  {@link summary} (a path name can carry the same reordering hazard as a command) + capped.
      *  Omitted when none derivable. */
     touchedPaths?: string[];
     /** #144 (additive): a persisted allow rule MATCHED this call but could not clear the mandated ask —
-     *  the matched rule text (`inlineUntrusted`-capped), threaded to the mint so the durable-park route
-     *  carries the same disclosure the synchronous ask does. The inbox renders "their rule is alive,
-     *  just outranked" instead of the person concluding their rule silently broke. */
+     *  the matched rule text (rendered through the same display baseline as {@link summary}, capped),
+     *  threaded to the mint so the durable-park route carries the same disclosure the synchronous ask
+     *  does. The inbox renders "their rule is alive, just outranked" instead of the person concluding
+     *  their rule silently broke. (The baseline is a FAMILY-UNIFORMITY choice AND, on this seat, a
+     *  disclosed one-face NARROWING: the feeding path is the permission-rule store's READ leg, which
+     *  does not re-screen stored rule text through the validator — the bytes may be model-authored or
+     *  a custom provider's, and a store-sourced string can legally carry `\p{Cf}`. For
+     *  validator-screened text the render coincides with the previous `inlineUntrusted` treatment
+     *  (the two differ only on the `\p{Cf}` class, and both fold the width-bearing controls it admits
+     *  (a tab) identically); for a Cf carrier this durable seat STRIPS what the synchronous ask's
+     *  `persistedRuleShadowed` preserves — same value, two byte-forms, diverging exactly on `\p{Cf}`,
+     *  the durable face stripping MORE (the safe direction). This seat carries NO cross-face
+     *  same-value contract (unlike `probeReason`/`probeCause` below), which is why the one-face move
+     *  is legal — a byte-pinning consumer must read per face.) */
     shadowedRule?: string;
     /** backlog #239 (additive): WHY the reversibility probe did not clear this call, in the probe's own
      *  words — the cause the tighten acted on, which until now existed only inside the probe and left the
@@ -157,7 +179,14 @@ export interface RiskDescriptor {
      *  boundary, so it is DISPLAY/TRIAGE metadata only, never adjudication input.
      *
      *  The UNSTRUCTURED face: a deployment's own probe writes prose here and this engine cannot say what it
-     *  means. An engine-minted cause uses {@link probeCause} instead — see that field for why. */
+     *  means. An engine-minted cause uses {@link probeCause} instead — see that field for why.
+     *
+     *  RESIDUAL, disclosed (#438): unlike the descriptor-owned display family above, this seat does
+     *  NOT strip the `\p{Cf}` display-reordering class — a directional/zero-width marker in the
+     *  probe's prose survives here byte-for-byte, because the seat carries a documented SAME-VALUE
+     *  contract with its synchronous `AskRequest.probeReason` twin (one string, two faces) and a
+     *  one-face re-render would break it. A consumer rendering this seat owes its own screen (or the
+     *  descriptor family's display baseline). */
     probeReason?: string;
     /** backlog #239 (additive): the STRUCTURED cause, for a probe whose verdict this engine understands —
      *  the built-in shell probe is the first. Carries a machine-readable {@link ProbeCause.code} and the
@@ -178,7 +207,12 @@ export interface RiskDescriptor {
  *  command text. */
 export interface ProbeCauseOperands {
     /** The named entries. Each `inlineUntrusted`-neutralized and capped at {@link PROBE_CAUSE_PATH_MAX}
-     *  INDIVIDUALLY, so one pathological entry costs only itself. Bounded in count by the minting probe. */
+     *  INDIVIDUALLY, so one pathological entry costs only itself. Bounded in count by the minting probe.
+     *  RESIDUAL, disclosed (#438): `inlineUntrusted` does NOT strip the `\p{Cf}` display-reordering
+     *  class the descriptor's own display family strips — a directional/zero-width marker in a path
+     *  survives on this seat (cross-face byte parity with the synchronous `AskRequest.probeCause`
+     *  twin; see that same-value contract for why a one-face re-render is off the table). A consumer
+     *  rendering these entries owes its own screen (or the descriptor family's display baseline). */
     readonly shown: readonly string[];
     /** How many entries the family has in total — `shown.length` when nothing was elided. A non-negative
      *  integer; never a lie by omission. */
@@ -218,11 +252,6 @@ export interface ProbeCause {
  *  that sanitizes at the entry boundary and the descriptor builder that re-sanitizes at the persist
  *  boundary cannot cap the same value at two different lengths. */
 export declare const PROBE_REASON_MAX = 200;
-/** backlog #239: the per-ENTRY ceiling inside a {@link ProbeCause} operand family, sized like the
- *  descriptor's own {@link RiskDescriptor.touchedPaths} entries (the same thing on the same card). Per
- *  entry, not per cause: that is the whole point of the structured shape — one pathological path costs
- *  only itself, where a single joined string let it consume every other entry's room. */
-export declare const PROBE_CAUSE_PATH_MAX = 200;
 /**
  * backlog #239: the ONE validator for a {@link ProbeCause} arriving from a probe.
  *
@@ -346,11 +375,19 @@ export interface PendingSteerInput {
  * degrade an inbox preview, never a permission outcome.
  *
  * **Redaction is load-bearing** (the `summary`/`touchedPaths` are PERSISTED + surfaced to a human inbox):
- * every model-controlled value goes through {@link inlineUntrusted} (folds CR/LF/Unicode separators to one
- * space, defuses `</system-reminder>` variants + `<<<`/`>>>` fence sentinels) AND a length cap, so a
- * crafted arg carrying a break-out tag / newline / huge string can neither inject into the inbox render nor
- * bloat the durable row. NEVER dumps full args / env / secrets — only a bash command string or a short
- * `name=value` digest of the SHOWN args.
+ * every model-controlled value in the DESCRIPTOR-OWNED display family (`summary` both arms,
+ * `touchedPaths`, `shadowedRule`) goes through
+ * {@link import("./permission-rule-model.js").renderUntrustedCommandText} — which STRIPS the `\p{Cf}`
+ * format class (directional controls / zero-width formatters, the display-reordering hazard the
+ * `hasBidiControls` bit warns about; #438) and then applies the shared inline form (folds CR/LF/Unicode
+ * separators to one space, defuses `</system-reminder>` variants + `<<<`/`>>>` fence sentinels) — AND a
+ * length cap, so a crafted arg carrying a break-out tag / newline / huge string / RLO can neither inject
+ * into the inbox render nor display as something other than what runs nor bloat the durable row.
+ * TWO SEATS ARE DELIBERATELY NOT IN THE FAMILY: `probeCause` and `probeReason` carry a documented
+ * SAME-VALUE contract with their synchronous `AskRequest` twins (their docs say so verbatim), so
+ * changing their bytes here alone would break that cross-face contract — they keep the shared
+ * `inlineUntrusted`/`normalizeProbeCause` treatment (a residual their docs disclose). NEVER dumps full
+ * args / env / secrets — only a bash command string or a short `name=value` digest of the SHOWN args.
  *
  * `summary` for a shell gate = the `command` string (capped 200 cp); otherwise a `name=value` digest of the
  * call's top-level string/number/boolean args (each value capped), omitted when nothing safe to summarize.
@@ -728,6 +765,33 @@ export type PendingAction = {
      * pre-1a.2 checkpoint (deserialized without it), in which case the resume skips the hash check.
      */
     boundInputHash: string;
+    /**
+     * #438 (additive; no checkpoint-version bump — the `reminderMark` precedent: an optional field an
+     * older reader ignores. Unlike that precedent seat — which resume DOES read, through its
+     * verify-then-adopt port — nothing reads THIS bit at all, per the echo-only clause below):
+     * PRESENCE ONLY — the row's execution
+     * payload carries at least one DIRECTIONAL format control. The durable twin of the synchronous
+     * {@link import("./tool-policy.js").AskRequest.hasBidiControls} (ONE contract, two faces — that
+     * field's doc owns the character class, the hazard and the warning-not-verdict posture; everything
+     * there applies here unchanged). What is stated per face:
+     *
+     *  - JUDGED AT THE PARK MINT over THIS ROW's materialized payload: the fidelity-projected `args`
+     *    snapshot (the bytes a human approves and a resume executes) plus the row's own `preview`
+     *    projection. The row's bit describes the row's bytes — on a shape-narrowing backend (a Map key
+     *    under a JSON codec) a marker the synchronous face detected can be GONE from the row, and the
+     *    honest bit for the row is then ABSENT: the inbox renders the row's snapshot, and the bit
+     *    agrees with what it renders. The two faces coincide whenever the projection is shape-preserving.
+     *  - `true` or ABSENT, never `false` (absence = "not detected": clean, or the bounded scan did not
+     *    reach it — a `false` would claim a proof the scan does not offer).
+     *  - A DEPLOYMENT-WRITTEN park row (the design/144 convention's deployment half) may carry `true`
+     *    (taken at its word — over-warning is the safe direction, and a writer with row access holds
+     *    the args themselves already) or omit it (the summary projection then runs its own bounded
+     *    backfill scan — see {@link CheckpointSummary.hasBidiControls}). A written `false` is
+     *    out-of-contract and is read as ABSENT everywhere; it never reaches a projection.
+     *  - ECHO-ONLY, like {@link CheckpointSummary.toolInput}: NO resume / gate / CAS /
+     *    `winnerFromOutcome` path reads it — it is a display warning, never a control input.
+     */
+    hasBidiControls?: true;
     /** All tool-call ids in the suspending assistant message, in emission order. */
     batchToolCallIds: string[];
     /** Ids of calls already executed (results in the session) when the suspend fired — #1..k-1. */
@@ -1615,6 +1679,39 @@ export interface CheckpointSummary {
      *  contextually escape), ECHO-ONLY (no gate/CAS/resume reads it), and surfaces SHOULD show the
      *  bound raw args (`toolInput`/`pendingAction.args`) alongside — the preview never replaces them. */
     preview?: unknown;
+    /**
+     * #438: PRESENCE ONLY — this pending `tool_approval` row's payload carries at least one DIRECTIONAL
+     * format control (the {@link import("./tool-policy.js").AskRequest.hasBidiControls} character class;
+     * that doc owns the hazard). Only ever for a `tool_approval` pendingAction; OMITTED for every other
+     * kind (the {@link toolCallId} ABSENCE-SHAPE contract applies: never `null`, never present-but-
+     * `undefined`, never `false` — a re-projecting BFF must not materialize any of those on the way out).
+     *
+     * WHERE THE ANSWER COMES FROM: the row's own persisted bit when present (the park mint is the
+     * authority — one look, one answer, never re-derived); else a bounded BACKFILL scan run AT PROJECTION
+     * TIME over this projection's OWN bounded materials — the truncated {@link toolInput} string just
+     * derived plus the row's `preview`, under a small per-row budget — so a pre-#438 row and a
+     * deployment-written row still get a bit exactly where the inbox reads. The backfill judges THE BYTES
+     * THIS PROJECTION HANDS THE INBOX: a marker buried past the `toolInput` truncation point (or past the
+     * per-row scan budget) is honestly reported as absent — new-engine-minted rows carry the mint-time bit
+     * (judged over the full parked args) for exactly that reason. The backfill NEVER writes back to the
+     * row: `summarizeCheckpoint` stays a pure projection.
+     *
+     * HOW TO READ IT: `true` = core detected the class in this row's payload (or took a deployment row's
+     * own `true` at its word — over-warning is the safe direction); render a visible "the text below can
+     * display differently from what it runs" annotation. ABSENT = NOT DETECTED, never "clean" — it covers
+     * clean, budget-exhausted, and a `false`-writing out-of-contract producer (read as absent, never
+     * projected). The bit changes NO rendering obligation a surface already had: with or without it,
+     * `toolInput` / `toolName` / a summary string go through
+     * {@link import("./permission-rule-model.js").renderUntrustedCommandText} (or the surface's own
+     * screen) before a human reads them; for the structured `args`/`preview` the FIRST-CHOICE display
+     * material is the bounded projections core already minted (`toolInput`, the descriptor `summary`) —
+     * do not re-serialize the whole args for a list render, and a drill-in that must show everything owes
+     * itself a TOTAL, bounded traversal (cycle-safe, per-type output forms, throwing getters to a
+     * placeholder, depth/node/char budgets with a truncation marker — never "full `JSON.stringify` then
+     * truncate", which does all the work and takes all the throws before the cap). ECHO-ONLY, like
+     * {@link sourceTaskId}: a warning to a person, never a control input — resume/gate/CAS never read it.
+     */
+    hasBidiControls?: true;
 }
 /**
  * design/80 assistant-scheduler seam #1: project a single PENDING {@link Checkpoint} to its lightweight

package/dist/core/checkpoint-store.js

@@ -1,6 +1,8 @@
 import { randomBytes, randomUUID } from "node:crypto";
 import { uuidv7 } from "../internal/harness.js";
-import { inlineUntrusted, sanitizeUntrustedText } from "./untrusted-text.js";
+import { PROBE_CAUSE_PATH_MAX, inlineUntrusted, sanitizeUntrustedText } from "./untrusted-text.js";
+import { carriesBidiControls } from "./tool-policy.js";
+import { renderUntrustedCommandText } from "./permission-rule-model.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "./ask-question.js";
 export function mintCheckpointToken() {
     return randomBytes(16).toString("hex");
@@ -9,7 +11,6 @@ export function mintCheckpointId() {
     return `cp_${randomUUID()}`;
 }
 export const PROBE_REASON_MAX = 200;
-export const PROBE_CAUSE_PATH_MAX = 200;
 const PROBE_CAUSE_MAX_SHOWN = 8;
 export function normalizeProbeCause(value) {
     if (!isPlainRecord(value))
@@ -62,6 +63,8 @@ const MAX_TOUCHED_PATHS = 8;
 const MAX_DIGEST_KEYS = 16;
 const MAX_DIGEST_SCAN_KEYS = 256;
 export const MAX_TOOL_INPUT_PREVIEW_CHARS = 512;
+const BIDI_BACKFILL_MAX_CHARS = 32_000;
+const BIDI_BACKFILL_MAX_NODES = 512;
 export const MAX_PENDING_STEER_CHARS = 16_000;
 export const PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES = 48_000;
 export const MAX_PENDING_STEER_ENTRIES = Math.floor(PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES / MAX_PENDING_STEER_CHARS);
@@ -121,7 +124,7 @@ export function buildRiskDescriptor(input) {
         if (shell || toolName === "Bash") {
             const cmd = isPlainRecord(args) ? safeDataValue(args, "command") : undefined;
             if (typeof cmd === "string" && cmd.length > 0)
-                summary = inlineUntrusted(cmd, SUMMARY_CMD_MAX);
+                summary = renderUntrustedCommandText(cmd, SUMMARY_CMD_MAX);
             const bg = isPlainRecord(args) ? safeDataValue(args, "run_in_background") : undefined;
             if (bg === true)
                 summary = `[background persistent process — no per-step recheck] ${summary ?? ""}`.trimEnd();
@@ -135,20 +138,20 @@ export function buildRiskDescriptor(input) {
                     const v = safeDataValue(args, key);
                     if (typeof v === "string" || typeof v === "number" || typeof v === "boolean") {
                         const encDigest = (s) => s.replace(/%/g, "%25").replace(/=/g, "%3D").replace(/ /g, "%20");
-                        const k = encDigest(inlineUntrusted(key, 40));
-                        const val = encDigest(inlineUntrusted(String(v), SUMMARY_VALUE_MAX));
+                        const k = encDigest(renderUntrustedCommandText(key, 40));
+                        const val = encDigest(renderUntrustedCommandText(String(v), SUMMARY_VALUE_MAX));
                         parts.push(`${k}=${val}`);
                     }
                 }
                 if (parts.length > 0)
-                    summary = inlineUntrusted(parts.join(" "), SUMMARY_TOTAL_MAX);
+                    summary = renderUntrustedCommandText(parts.join(" "), SUMMARY_TOTAL_MAX);
             }
         }
         const touched = [];
         if (!shell && toolName !== "Bash") {
             const p = fsPathArg(args);
             if (p !== undefined)
-                touched.push(inlineUntrusted(p, PATH_MAX));
+                touched.push(renderUntrustedCommandText(p, PATH_MAX));
         }
         const touchedPaths = touched.length > 0 ? touched.slice(0, MAX_TOUCHED_PATHS) : undefined;
         return {
@@ -156,7 +159,7 @@ export function buildRiskDescriptor(input) {
             axes,
             toolName,
             ...(input.shellGated && input.shellGateDoctrine !== undefined ? { shellGateDoctrine: input.shellGateDoctrine } : {}),
-            ...(input.shadowedRule !== undefined ? { shadowedRule: inlineUntrusted(input.shadowedRule, 200) } : {}),
+            ...(input.shadowedRule !== undefined ? { shadowedRule: renderUntrustedCommandText(input.shadowedRule, 200) } : {}),
             ...(input.probeReason !== undefined ? { probeReason: inlineUntrusted(input.probeReason, PROBE_REASON_MAX) } : {}),
             ...(() => {
                 if (input.probeCause === undefined)
@@ -235,6 +238,9 @@ export function summarizeCheckpoint(cp) {
             toolInput = undefined;
         }
     }
+    const hasBidi = tool !== undefined &&
+        (tool.hasBidiControls === true ||
+            carriesBidiControls([toolInput, tool.preview], { maxNodes: BIDI_BACKFILL_MAX_NODES, maxChars: BIDI_BACKFILL_MAX_CHARS }));
     return {
         token: cp.token,
         ...(cp.checkpointId !== undefined ? { checkpointId: cp.checkpointId } : {}),
@@ -254,6 +260,7 @@ export function summarizeCheckpoint(cp) {
             ? { restoreMode: cp.state.workspaceHandle.restoreMode === "park_only" ? "park_only" : "snapshot" }
             : {}),
         ...(tool?.preview !== undefined ? { preview: tool.preview } : {}),
+        ...(hasBidi ? { hasBidiControls: true } : {}),
     };
 }
 export class CheckpointError extends Error {