@sema-agent/core 5.61.0 → 5.62.0

package/dist/core/checkpoint-store.d.ts

@@ -705,10 +705,7 @@ export type ResumeOutcome = {
  *  resolve CAS: a second wake of the same token loses the CAS (`checkpoint.already_resolved`). */
  | {
     gate: "wake";
-    message?: {
-        text: string;
-        trusted: boolean;
-    };
+    message?: PendingSteerInput;
 } | {
     gate: "task_done";
     result: TaskResult;
@@ -737,6 +734,17 @@ export type PendingAction = {
      *  **UNTRUSTED, ADVISORY**: inboxes must escape contextually and surface `args` alongside.
      *  NEVER read by the resume path (args + boundInputHash stay the sole execution contract). */
     preview?: unknown;
+    /** #457 ② (additive; no checkpoint-version bump — the `hasBidiControls` precedent below: an
+     *  optional field an older reader ignores and the resume path never reads) — the PARK twin of
+     *  `AskRequest.previewWithheld`: present ⇔ this tool declares an approval preview and the mint
+     *  could not present a usable one, `"oversize"` (produced but past the 16KiB display bound — the
+     *  stub still rides {@link preview}) or `"unavailable"` (threw / no JSON serialization). ABSENT
+     *  covers "no preview declared", "the projection declined" and "it worked" — read presence, never
+     *  absence. A DISCLOSURE for the approval inbox's card, never a verdict: {@link args} and
+     *  {@link boundInputHash} are carried either way and the resume contract is untouched. Judged over
+     *  THIS row's fidelity-projected args snapshot, so it can honestly differ from the synchronous
+     *  face on a shape-changing backend — exactly as {@link hasBidiControls} can. */
+    previewWithheld?: "oversize" | "unavailable";
     /** design/179 §4, re-formed by design/375 §3.1/§3.3 (BREAKING — replaces the retired
      *  `ruleSuggestions` seat; a pre-375 inbox reading a new row simply finds no offers and renders
      *  no "don't ask again" option, fail toward asking) — the persistable allow-rule OFFERS this
@@ -1689,6 +1697,18 @@ export interface CheckpointSummary {
      *  contextually escape), ECHO-ONLY (no gate/CAS/resume reads it), and surfaces SHOULD show the
      *  bound raw args (`toolInput`/`pendingAction.args`) alongside — the preview never replaces them. */
     preview?: unknown;
+    /** #457 ② — the row's `PendingAction.tool_approval.previewWithheld`, projected BESIDE {@link preview}
+     *  for the same reason that one is: without it the ONE-CALL inbox cannot tell "this tool declares no
+     *  preview" from "the projection failed", which is the exact collapse the determinant exists to
+     *  remove — and re-opening the row with an N+1 `get` just to answer it defeats `listByScope`.
+     *  `"oversize"` (produced but past the 16KiB mint bound — the truncation stub still rides
+     *  {@link preview}) or `"unavailable"` (threw / no JSON serialization). The {@link toolCallId}
+     *  ABSENCE-SHAPE contract applies: OMITTED otherwise, never `null`/`false`/present-but-`undefined`.
+     *  A pure echo of the row's own persisted value — unlike {@link hasBidiControls}, there is no
+     *  projection-time backfill, because whether a tool DECLARED a preview is not knowable from the
+     *  projection's own materials (a pre-#457 row therefore reads absent, which is honest: unreported).
+     *  ECHO-ONLY display metadata; nothing gates on it. */
+    previewWithheld?: "oversize" | "unavailable";
     /**
      * #438: PRESENCE ONLY — this pending `tool_approval` row's payload carries at least one DIRECTIONAL
      * format control (the {@link import("./tool-policy.js").AskRequest.hasBidiControls} character class;
@@ -1799,6 +1819,12 @@ export declare class CheckpointError extends Error {
      *  second operator's instruction — the exact silent loss the queue replaced. Retry with a fresh id.
      *  Nothing is written on this path. */
      | "steering.duplicate_input_id"
+    /** design/373 §4.3 (D2): the deployment's `userPromptSubmit` hook refused a wake resume's
+     *  `message` at the entrance screen (block verdict, or a fail-closed timeout/crash — the
+     *  message discriminates). Pre-CAS: the checkpoint stays `pending` and byte-identical, so the
+     *  SAME token is redeemable once the screen clears — a refusal burns nothing. The live steer
+     *  verb refuses under the same code word (its own Error face); one vocabulary, two entrances. */
+     | "steering.blocked_by_hook"
     /** design/144 §3 (governance-gate purity, fail-closed pre-CAS): a `wake` outcome was supplied for a
      *  checkpoint that awaits a PENDING GATE DECISION (tool approval / dry-run review / plan review /
      *  resource-limit continue). Wake is a pure un-park verb and must never circumvent an approval — resume
@@ -1948,6 +1974,12 @@ export declare class CheckpointError extends Error {
      *  second operator's instruction — the exact silent loss the queue replaced. Retry with a fresh id.
      *  Nothing is written on this path. */
      | "steering.duplicate_input_id"
+    /** design/373 §4.3 (D2): the deployment's `userPromptSubmit` hook refused a wake resume's
+     *  `message` at the entrance screen (block verdict, or a fail-closed timeout/crash — the
+     *  message discriminates). Pre-CAS: the checkpoint stays `pending` and byte-identical, so the
+     *  SAME token is redeemable once the screen clears — a refusal burns nothing. The live steer
+     *  verb refuses under the same code word (its own Error face); one vocabulary, two entrances. */
+     | "steering.blocked_by_hook"
     /** design/144 §3 (governance-gate purity, fail-closed pre-CAS): a `wake` outcome was supplied for a
      *  checkpoint that awaits a PENDING GATE DECISION (tool approval / dry-run review / plan review /
      *  resource-limit continue). Wake is a pure un-park verb and must never circumvent an approval — resume

package/dist/core/checkpoint-store.js

@@ -260,6 +260,7 @@ export function summarizeCheckpoint(cp) {
             ? { restoreMode: cp.state.workspaceHandle.restoreMode === "park_only" ? "park_only" : "snapshot" }
             : {}),
         ...(tool?.preview !== undefined ? { preview: tool.preview } : {}),
+        ...(tool?.previewWithheld === "oversize" || tool?.previewWithheld === "unavailable" ? { previewWithheld: tool.previewWithheld } : {}),
         ...(hasBidi ? { hasBidiControls: true } : {}),
     };
 }

package/dist/core/governance-codes.d.ts

@@ -93,7 +93,7 @@ export type NoticeAudience = "user" | "operator";
  * src/ for notice mint shapes and names any code that is minted but unregistered, or registered but
  * no longer minted.
  */
-export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.read_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "delegation.transcript_integrity", "mcp.revocation_probe_failed", "workflow.governance_key_stripped", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "route.fallback_to_primary", "route.base_url_changed_key_unchanged", "task.user_steer_undrained", "task.user_followup_undrained", "task.turn_interrupted", "tool_result.offload_put_failed"];
+export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.read_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "delegation.transcript_integrity", "mcp.revocation_probe_failed", "workflow.governance_key_stripped", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "route.fallback_to_primary", "route.base_url_changed_key_unchanged", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "tool_result.offload_put_failed"];
 /** A code this engine mints (see {@link ENGINE_NOTICE_CODES}). NOT the type of
  *  `EngineNotice.code`, which stays `string` — a host forwarding its own notices through the same
  *  sink is a supported shape, and narrowing that field would break it. */

package/dist/core/governance-codes.js

@@ -113,6 +113,7 @@ export const ENGINE_NOTICE_CODES = [
     "route.base_url_changed_key_unchanged",
     "task.user_steer_undrained",
     "task.user_followup_undrained",
+    "steering.parked_input_blocked",
     "task.turn_interrupted",
     "tool_result.offload_put_failed",
 ];
@@ -126,6 +127,7 @@ const NOTICE_AUDIENCE_TABLE = {
     "task.user_steer_undrained": "user",
     "task.user_followup_undrained": "user",
     "task.turn_interrupted": "user",
+    "steering.parked_input_blocked": "user",
     "config.autocompact_window_clamped": "operator",
     "config.env_timeout_discarded": "operator",
     "config.materialize_env_discarded": "operator",

package/dist/core/hooks.d.ts

@@ -1,4 +1,4 @@
-import type { DocumentContent, ImageContent, TextContent } from "../internal/llm.js";
+import type { ActorAssertion, DocumentContent, ImageContent, TextContent } from "../internal/llm.js";
 import type { ExecutionEnv, FileError, Result, SessionTreeEntry } from "../internal/harness-types.js";
 import type { DecisionReason, PermissionResult, ResolvedAsk, ToolCallRequest, ToolPolicy } from "./tool-policy.js";
 import { type AskClass } from "./ask-class.js";
@@ -85,9 +85,36 @@ export interface Hooks {
      */
     preToolUseObservational?: true;
     postToolUse?(toolName: string, input: unknown, output: HookToolOutput, ctx: HookToolContext): PostToolUseResult | undefined | Promise<PostToolUseResult | undefined>;
+    /**
+     * design/373 §4.3 (D2) ⚠️ WIDENED INVOCATION SET: this seat now screens EVERY user-lane entrance,
+     * not just the objective — a live `TaskStream.steer`, a wake resume's message (pre-CAS, at the
+     * verb), and a parked steer's resume redelivery (any draining resume kind) all pass through it, discriminated by
+     * {@link UserPromptSubmitContext.source}. A hook that blocks unconditionally therefore starts
+     * refusing steers too — branch on `ctx.source` (+ `ctx.actor`) to scope a verdict. The screen's
+     * domain is caller/operator PROSE only: engine-authored frames (task notifications, diagnostics,
+     * recall) never pass here — external `notify()` text takes the sanitized DATA-frame lane instead
+     * (ruled: notification frames are not prompts; see the notify contract). The same input can
+     * legally arrive twice under two sources (live + parked redelivery) — idempotency is the hook's,
+     * keyed on `ctx.inputId`. Block semantics per entrance: objective ⇒ the task ends `blocked`;
+     * live steer ⇒ typed `steering.blocked_by_hook` to the steer caller; resume message ⇒ typed
+     * pre-CAS refusal (the checkpoint stays pending); parked redelivery ⇒ the frame is withheld
+     * with a `steering.parked_input_blocked` notice + a `delivery:"blocked"` human_input account,
+     * and the resume itself proceeds (a blocked instruction must never wedge a wake).
+     *
+     * ⚠️ RE-ENTRANT within one leg: the steer verb goes live the moment the run's handle publishes —
+     * BEFORE the objective seat runs — so a steer screen can overlap the objective screen (and a
+     * resume-message screen, which fires pre-CAS at the verb) in flight. A stateful implementation
+     * (per-call temp files, a single in-flight latch, a shared accumulator) must tolerate concurrent
+     * entry; only steer-vs-steer is serialized. And that serialization has a LATENCY face: queued
+     * steers screen strictly FIFO, so each waits behind its predecessor's ENTIRE hook bound (the
+     * resolved `timeoutMs`, default 600s) — a slow or wedged screen delays every steer behind it by
+     * up to the full bound, which is a reason to declare a short `timeoutMs` on deployments that
+     * screen steers.
+     */
     userPromptSubmit?(prompt: string, 
     /** #281 件A (additive): the run/leg identity envelope — an implementation declaring only
-     *  `(prompt)` keeps working. Always supplied on the engine's emission. */
+     *  `(prompt)` keeps working. Always supplied on the engine's emission. design/373: carries the
+     *  entrance discriminator (`source`/`inputId`/`actor`) — see {@link UserPromptSubmitContext}. */
     ctx?: UserPromptSubmitContext): UserPromptSubmitResult | undefined | Promise<UserPromptSubmitResult | undefined>;
     /**
      * roadmap #5 (CC 198 Stop hook, :473831-): runs when the agent WOULD OTHERWISE END its run (no
@@ -819,12 +846,55 @@ export interface PostToolUseResult {
     additionalContext?: string;
 }
 /** #281 件A — the context of a {@link Hooks.userPromptSubmit} invocation (second parameter,
- *  additive). Carries only the identity envelope today; an object so later additions stay additive. */
+ *  additive). An object so later additions stay additive; design/373 §4.3 (D2) grew the
+ *  entrance-discrimination trio below. */
 export interface UserPromptSubmitContext {
     /** The run/leg identity envelope — see {@link HookInvocationIdentity} for the presence law. */
     identity?: HookInvocationIdentity;
     /** {@link HookSeatSignal} — this invocation's own abort signal. */
     signal?: AbortSignal;
+    /**
+     * design/373 §4.3 (D2) — WHICH user-lane entrance this text is entering through. The screen now
+     * sits at every user-lane entrance, so a hook that used to see only the objective can (and, if it
+     * blocks unconditionally, MUST) branch on this: `"objective"` = the task's opening prompt (the
+     * pre-373 only caller); `"steer"` = a live mid-run TaskStream.steer; `"resume_message"` = the
+     * message riding a wake resume (screened at the verb, pre-CAS); `"parked_redelivery"` = a parked
+     * steer being re-screened on the CURRENT process's hook when a resume redelivers it — ANY resume
+     * kind that drains parked steers (policy_ask / dry_run_review / plan_review / resource_limit,
+     * wake included), because a park's screening cannot be carried across processes (hooks are
+     * process-local config). ⚠️ DOUBLE ARRIVAL IS CONTRACTUAL:
+     * the same input can reach a hook twice with different sources (screened live as `"steer"`,
+     * parked, re-screened as `"parked_redelivery"`); idempotency is the hook's to hold — a stateful
+     * hook keys on {@link inputId}. `"followUp"` is a RESERVED spelling (spec seat only): the Runner
+     * face has no user-lane followUp verb today, so no invocation carries it yet — if/when that face
+     * lands it arrives screened under this name (never a silent widening).
+     * Absent ⇒ an emission from a pre-373 engine (old engines stamped nothing); every current engine
+     * seat stamps its name, so treat absence as "version unknown", never as a sixth entrance.
+     */
+    source?: "objective" | "steer" | "resume_message" | "followUp" | "parked_redelivery";
+    /**
+     * design/373 §4.3 (D2) — the screened input's correlation id. Present on EVERY entrance except
+     * the objective seat (no id exists on that face — nothing is fabricated there):
+     *  - `"steer"` — the effective `inputId` (caller-supplied or engine-minted — the SAME id the
+     *    `human_input` event and any parked copy carry);
+     *  - `"parked_redelivery"` — the parked entry's STORED id (stable across redeliveries);
+     *  - `"resume_message"` — always present too: the caller's id verbatim when it supplied one,
+     *    otherwise MINTED PER CALL by the wake validator. ⚠️ Per call, not per message: the screen
+     *    sits above every retryable pre-CAS refusal, so a retried wake that supplies no caller id
+     *    re-screens identical text under a FRESH id. A dedup/quota hook keying its ledger here gets
+     *    cross-attempt stability only when the CALLER supplies the id — a host that retries wakes
+     *    should mint its own.
+     * This is the dedup key for the double-arrival contract on {@link source}: a quota-charging hook
+     * that must not double-charge one input keys its ledger here.
+     */
+    inputId?: string;
+    /**
+     * design/373 §4.3 (D2) — the API-boundary actor snapshot attributed to this input (the same
+     * snapshot the `human_input` event reports), when the caller supplied one. Attribution only,
+     * never authority — a hook wanting to exempt its own supervisor lane branches on this PLUS
+     * {@link source}, and absence means "anonymous caller", exactly as on the event face.
+     */
+    actor?: ActorAssertion;
 }
 /** #281 件A — the context of a {@link Hooks.postToolBatch} invocation (third parameter, additive —
  *  deliberately NOT folded into `meta`, whose presence already means "the engine injected here"). */
@@ -1199,7 +1269,16 @@ export interface ToolGateInput {
     /** design/375 §5.2②: the surviving ask's engine-stamped `segmentCoverage` — threaded so the park
      *  mint's offer factory reads the same coverage snapshot on the durable route as the synchronous
      *  mints read off the decision (absent ⇒ all segments uncovered ⇒ over-offer, the safe way). */
-    segmentCoverage?: readonly import("./permission-rule-model.js").SegmentCoverage[]) => Promise<ToolGateResult["suspend"] | ParkAttemptFailed | undefined>;
+    segmentCoverage?: readonly import("./permission-rule-model.js").SegmentCoverage[], 
+    /** #457 ④: the surviving ask's `matchedAskRule` — threaded for the SAME errand as
+     *  `askDecisionReason`: the park mint's rule-suggestion door must know that an EXPLICIT `ask` rule
+     *  matched this call, because the persisted-rule lane refuses to clear such an ask (the
+     *  `decision.matchedAskRule === undefined` conjunct on its allow arm), so the parked card must not
+     *  offer to mint a rule that would never silence it. APPENDED at the tail deliberately: every
+     *  parameter here is positional and `probeReason` is also a `string`, so inserting this beside its
+     *  logical neighbour would silently re-bind three existing call sites' arguments with no type
+     *  error to catch it. */
+    matchedAskRule?: string) => Promise<ToolGateResult["suspend"] | ParkAttemptFailed | undefined>;
     /**
      * design/174 — route a policy `ask` on the reserved question tool to this run's CONTENT-ask channel
      * before it can become a park or a refusal. Called in the `ask` branch with the FINAL post-hook,

package/dist/core/hooks.js

@@ -841,7 +841,7 @@ export async function runToolGate(input) {
             ? { origin: orgAskOrigin !== undefined ? `org_${orgAskOrigin}` : "policy" }
             : undefined;
         if (suspendAsk && decision.action === "ask") {
-            const suspended = await suspendAsk(req, currentInput, safety, undefined, realApprovalOf(decision), decision.action === "ask" ? decision.persistedRuleShadowed : undefined, decision.action === "ask" ? decision.decisionReason : undefined, decision.action === "ask" ? decision.probeReason : undefined, decision.action === "ask" ? decision.probeCause : undefined, decision.action === "ask" ? decision.segmentCoverage : undefined);
+            const suspended = await suspendAsk(req, currentInput, safety, undefined, realApprovalOf(decision), decision.action === "ask" ? decision.persistedRuleShadowed : undefined, decision.action === "ask" ? decision.decisionReason : undefined, decision.action === "ask" ? decision.probeReason : undefined, decision.action === "ask" ? decision.probeCause : undefined, decision.action === "ask" ? decision.segmentCoverage : undefined, decision.action === "ask" ? decision.matchedAskRule : undefined);
             if (suspended) {
                 if ("parkFailed" in suspended)
                     parkFailed = suspended.parkFailed;
@@ -860,7 +860,7 @@ export async function runToolGate(input) {
                     req.args = outcome.presentedInput;
                 }
                 if (suspendAsk && outcome.parkDeclined && parkFailed === undefined) {
-                    const suspended = await suspendAsk(req, currentInput, safety, true, realApprovalOf(decision), decision.action === "ask" ? decision.persistedRuleShadowed : undefined, decision.action === "ask" ? decision.decisionReason : undefined, decision.action === "ask" ? decision.probeReason : undefined, decision.action === "ask" ? decision.probeCause : undefined, decision.action === "ask" ? decision.segmentCoverage : undefined);
+                    const suspended = await suspendAsk(req, currentInput, safety, true, realApprovalOf(decision), decision.action === "ask" ? decision.persistedRuleShadowed : undefined, decision.action === "ask" ? decision.decisionReason : undefined, decision.action === "ask" ? decision.probeReason : undefined, decision.action === "ask" ? decision.probeCause : undefined, decision.action === "ask" ? decision.segmentCoverage : undefined, decision.action === "ask" ? decision.matchedAskRule : undefined);
                     if (suspended) {
                         if ("parkFailed" in suspended)
                             parkFailed = suspended.parkFailed;
@@ -892,7 +892,7 @@ export async function runToolGate(input) {
                 askDenyResolution = resolved.resolution;
             decision = resolved;
             if (resolved.action === "deny" && resolved.approverUnavailable === true && suspendAsk && parkFailed === undefined) {
-                const suspended = await suspendAsk(req, currentInput, safety, true, realApprovalOf(askBeforeResolve), askBeforeResolve.action === "ask" ? askBeforeResolve.persistedRuleShadowed : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.decisionReason : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.probeReason : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.probeCause : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.segmentCoverage : undefined);
+                const suspended = await suspendAsk(req, currentInput, safety, true, realApprovalOf(askBeforeResolve), askBeforeResolve.action === "ask" ? askBeforeResolve.persistedRuleShadowed : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.decisionReason : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.probeReason : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.probeCause : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.segmentCoverage : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.matchedAskRule : undefined);
                 if (suspended) {
                     if ("parkFailed" in suspended)
                         parkFailed = suspended.parkFailed;

package/dist/core/park-selfcheck.js

@@ -71,6 +71,8 @@ function syntheticCheckpoint(scope) {
             args: { probe: true, nested: { depth: 2, list: [1, 2, 3] } },
             boundInputHash: boundInputHashOf({ probe: true, nested: { depth: 2, list: [1, 2, 3] } }),
             hasBidiControls: true,
+            preview: { probe: true, note: "park wiring self-check display stub" },
+            previewWithheld: "oversize",
             batchToolCallIds: [`${scope}:call`],
             completedCallIds: [],
         },

package/dist/core/pricing.d.ts

@@ -37,6 +37,30 @@ export interface TokenCounts {
  * pricing the cache subset separately instead of trusting the brain's possibly-overstated cost total.
  */
 export declare function computeCostMicroUsd(counts: TokenCounts, pricing: ModelPricing): number;
+/**
+ * RB-368's predicate, single-sourced: does a price table EXIST for this model — an id-keyed
+ * `RunnerDeps.pricing` entry, or the model's own `cost` declaration? When neither does,
+ * `modelCostToPricing(undefined)` yields an all-zero table and every computed cost is a fabricated 0,
+ * indistinguishable from "declared free". Every consumer that must keep those apart (the disclosure faces
+ * that go absent rather than lie; the deployment $ governance window that refuses rather than charge a
+ * fabricated 0) asks HERE, so the two can never drift into two different answers.
+ */
+export declare function isModelPriced(model: {
+    id: string;
+    cost?: unknown;
+}, pricing: Record<string, ModelPricing> | undefined): boolean;
+/**
+ * The first UNEVALUABLE member of a price table (`"inputPer1M"`, …), or `undefined` when every declared
+ * price is a finite, non-negative number.
+ *
+ * {@link isModelPriced} answers "does a table EXIST", which is the RB-368 question. It is deliberately not
+ * the same question as "can this table price anything": a `NaN` rate silently computes a cost of ZERO (the
+ * `price && tokens` guard treats NaN as absent) and a negative rate computes a negative one, so a table of
+ * garbage looks priced and prices everything at nothing. Wherever a number from this table becomes a
+ * CEILING rather than a report, the caller must ask this too — a bad value has to be loud, never folded
+ * into a silent default.
+ */
+export declare function malformedPricingField(pricing: ModelPricing): string | undefined;
 /** Map a vendor `Model.cost` (already per-1M absolute) to `ModelPricing`. We don't emit 1h cache
  *  writes, so `cacheWriteLongPer1M` defaults to the 5-min write price (irrelevant while that count is 0). */
 export declare function modelCostToPricing(cost: {

package/dist/core/pricing.js

@@ -11,6 +11,24 @@ export function computeCostMicroUsd(counts, pricing) {
         per1M(counts.outputTokens, pricing.outputPer1M);
     return Math.round(usd * 1e6);
 }
+export function isModelPriced(model, pricing) {
+    return pricing?.[model.id] !== undefined || model.cost !== undefined;
+}
+export function malformedPricingField(pricing) {
+    for (const f of ["inputPer1M", "outputPer1M"]) {
+        const v = pricing[f];
+        if (typeof v !== "number" || !Number.isFinite(v) || v < 0)
+            return f;
+    }
+    for (const f of ["cacheReadPer1M", "cacheWritePer1M", "cacheWriteLongPer1M"]) {
+        const v = pricing[f];
+        if (v === undefined)
+            continue;
+        if (typeof v !== "number" || !Number.isFinite(v) || v < 0)
+            return f;
+    }
+    return undefined;
+}
 export function modelCostToPricing(cost) {
     return {
         inputPer1M: cost?.input ?? 0,

package/dist/core/runner/prepare-config-doors.d.ts

@@ -46,6 +46,40 @@ export declare function limitConfigError(code: string, message: string): Error &
  *    sentinel, and on the budget axes it is an exhausted window (absurd but honest).
  */
 export declare function resolveTaskLimits(limits: TaskLimits | undefined): TaskLimits | undefined;
+/**
+ * RB-318 — validate the MODE-VALUED members of `TaskSpec.attachments` at the same door, and return the
+ * config unchanged. Today that is exactly one member, `totalTokensReminderMode`.
+ *
+ * WHY A DOOR AT ALL (坏值响亮度律): a knob whose bad value silently folds to the default is a knob the
+ * deployment believes is armed. `totalTokensReminderMode: "padded_countdown"` (underscore) or
+ * `"Countdown"` are the near-misses a hand-written config produces, and both would otherwise read as
+ * "absent" and take the default arm — a DIFFERENT readout than the one that was asked for, with nothing
+ * anywhere saying so.
+ *
+ * DELIBERATELY NARROW, twice over:
+ *  - no unknown-KEY refusal (the `resolveTaskLimits` half that has no counterpart here): a wire caller
+ *    that sends an attachment flag this engine does not know is asking for a lane that stays off, which
+ *    is the family's own default posture — not a ceiling silently disarmed. Widening it would also be a
+ *    behavior change for every existing caller, which this additive lane does not license.
+ *  - the pre-existing `todoReminderMode` is NOT validated here. It has the same shape and the same
+ *    weakness, but tightening it would refuse specs that run today; recorded as a follow-up rather than
+ *    folded into this lane's change.
+ *
+ * A NON-OBJECT CONTAINER (`attachments: null` off a wire, above all) is neither refused nor crashed on
+ * (review finding, verified by reading): every consumer reads this config through `attachmentsCfg?.…`,
+ * so a null container already means "no lanes are wired" and the spec RUNS today. An unguarded property
+ * read here — the first cut — turned that running spec into an untyped `TypeError` from inside a door
+ * that promises a typed `config.attachment_invalid`, and refusing it instead would newly reject a spec
+ * that works. There is no container-shape door in this family yet; that is a separate widening, not
+ * something this lane gets to invent on the way past.
+ *
+ * The bypass is narrowed to values that CANNOT supply attachment fields (round-2 review finding): a
+ * plain-JS caller can hand this a FUNCTION carrying `totalTokensReminderMode` as a property, and every
+ * downstream `attachmentsCfg?.…` read would happily find it — so skipping a function here would fold a
+ * typo'd mode to the default through exactly the hole this door exists to close. Functions are
+ * property-bearing containers and are validated like objects; only `null` and primitives pass through.
+ */
+export declare function resolveAttachmentsConfig(attachments: TaskSpec["attachments"]): TaskSpec["attachments"];
 /**
  * R2 双形轴(追加令 2026-07-18): CC 2.1.212's fable-variant prompt gate (b9e —
  * `fable_5_mitigations` capability / claude-mythos-5), ORTHOGONAL to the simple/classic profile.

package/dist/core/runner/prepare-config-doors.js

@@ -1,12 +1,14 @@
 import { resolveBrainCallGuardrailMs } from "../../brain/timeout.js";
 import { assertReadFaceValue } from "../../tools/fs/index.js";
 import { resolveCheckpointStore } from "../checkpoint-store.js";
+import { isModelPriced, malformedPricingField, modelCostToPricing } from "../pricing.js";
 import { preflightLockedConfig } from "../locked-config.js";
 import { assertRetentionCapability } from "../retention.js";
 import { resolveModel, resolveTaskModel, roleModelIfSet } from "../roles.js";
 import { applyToolModelGate, assertRestoreGatedToolsValue, modelIdTail } from "../tool-model-gate.js";
 import { resolveUsageWindows } from "../usage-window-store.js";
 import { deriveAskEffective, resolveAskSeamForm, resolveQuestionSeam } from "../wiring-manifest.js";
+import { TOTAL_TOKENS_REMINDER_MODES } from "./turn-attachments.js";
 const TASK_LIMIT_KEY_DICT = {
     maxTokens: true,
     maxCostUsd: true,
@@ -31,6 +33,16 @@ export function limitConfigError(code, message) {
     e.code = code;
     return e;
 }
+function describeRejectedValue(value) {
+    try {
+        const quoted = JSON.stringify(value);
+        if (quoted !== undefined)
+            return quoted;
+    }
+    catch {
+    }
+    return `a ${typeof value} value`;
+}
 export function resolveTaskLimits(limits) {
     if (limits === undefined)
         return undefined;
@@ -73,6 +85,19 @@ export function resolveTaskLimits(limits) {
     }
     return limits;
 }
+export function resolveAttachmentsConfig(attachments) {
+    if (attachments === null || (typeof attachments !== "object" && typeof attachments !== "function"))
+        return attachments;
+    const mode = attachments.totalTokensReminderMode;
+    if (mode !== undefined) {
+        const legal = TOTAL_TOKENS_REMINDER_MODES;
+        if (typeof mode !== "string" || !legal.includes(mode)) {
+            throw limitConfigError("config.attachment_invalid", `TaskSpec.attachments.totalTokensReminderMode must be one of ${TOTAL_TOKENS_REMINDER_MODES.map((m) => `"${m}"`).join(", ")} ` +
+                `(got ${describeRejectedValue(mode)}) — refused rather than folded to the default, which would publish a different readout than the one the deployment asked for.`);
+        }
+    }
+    return attachments;
+}
 export function isFableFamilyModelId(id) {
     const tail = modelIdTail(id);
     return /^claude-fable-\d/.test(tail) || /^claude-mythos-5(?!\d)/.test(tail);
@@ -290,6 +315,7 @@ export function prepareConfigDoors(input) {
         }
     }
     resolveTaskLimits(spec.limits);
+    resolveAttachmentsConfig(spec.attachments);
     if (spec.resourceSuspend !== undefined) {
         const rsus = spec.resourceSuspend;
         if (typeof rsus.scope !== "string" || rsus.scope === "") {
@@ -327,6 +353,35 @@ export function prepareConfigDoors(input) {
     }
     const resolvedRole = resolveTaskModel(spec, deps);
     const model = resolvedRole.model;
+    if (usageWindows !== undefined && deps.usageWindowStore !== undefined) {
+        const costed = usageWindows.find((w) => w.maxCostUsd !== undefined);
+        const why = costed === undefined
+            ? undefined
+            : !isModelPriced(model, deps.pricing)
+                ? `model ${JSON.stringify(model.id)} is unpriced — it has neither a RunnerDeps.pricing entry nor a Model.cost declaration, so this run produces NO cost figure to charge the window with (an unpriced run has no cost, which is not the same as a cost of 0). Price the model, or drop maxCostUsd from the window.`
+                : (() => {
+                    const bad = malformedPricingField(deps.pricing?.[model.id] ?? modelCostToPricing(model.cost));
+                    return bad === undefined
+                        ? undefined
+                        : `the price table for model ${JSON.stringify(model.id)} declares an unevaluable ${bad} — every rate must be a finite, non-negative number of USD per 1M tokens. A table like this prices every turn at zero (or below), so the ceiling would never fill: refused rather than enforced in name only.`;
+                })();
+        if (costed !== undefined && why !== undefined) {
+            const e = new Error(`RunnerDeps.usageWindows declares a cost ceiling (maxCostUsd ${String(costed.maxCostUsd)} over ${String(costed.windowMs)}ms, ${costed.anchor}) but ${why}`);
+            e.code = "config.usage_window_unpriced";
+            throw e;
+        }
+    }
+    const dollarCeiling = spec.limits?.maxCostUsd !== undefined
+        ? "limits.maxCostUsd"
+        : spec.resourceSuspend?.totalBudgetUsd !== undefined
+            ? "resourceSuspend.totalBudgetUsd"
+            : undefined;
+    if (dollarCeiling !== undefined && isModelPriced(model, deps.pricing)) {
+        const bad = malformedPricingField(deps.pricing?.[model.id] ?? modelCostToPricing(model.cost));
+        if (bad !== undefined) {
+            throw limitConfigError("config.limit_invalid", `TaskSpec.${dollarCeiling} is a money ceiling, but the price table for model ${JSON.stringify(model.id)} declares an unevaluable ${bad} — every rate must be a finite, non-negative number of USD per 1M tokens. A table like this prices every turn at zero (or below), so the ceiling would never trip: refused rather than enforced in name only.`);
+        }
+    }
     const fableMitigations = resolveModelPromptTraits(model, spec, internals).fableMitigations;
     const gateDecision = applyToolModelGate({
         tools: spec.tools,

package/dist/core/runner/prepare-task.d.ts

@@ -73,14 +73,24 @@ export declare const USAGE_WINDOW_REAP_MARGIN_MS: number;
 export interface UsageGovernance {
     /** The ledger key this run is governed under — the principal, or the shared global key. */
     readonly key: string;
+    /** Does any governed window carry a MONEY ceiling? Read by the run loop's pricing seats: only a
+     *  cost-governing deployment has to treat an unevaluable price table as unpriced spend. */
+    readonly governsCost: boolean;
     /** Ms the caller must wait before ANY window would admit work again, or `undefined` when none is
      *  exhausted as of `now`. Reads the ledger; propagates a store failure (an unreadable ceiling must not
      *  read as an open one). */
     check(now: number): Promise<number | undefined>;
-    /** Charge whatever of `cumulativeTokens` has not been charged yet. Takes the run's CUMULATIVE total
-     *  rather than a delta so no caller can double-charge by calling twice, and so a caller that skips a
-     *  boundary loses nothing. */
-    commit(cumulativeTokens: number, now: number): Promise<void>;
+    /**
+     * Charge whatever of the run's cumulative spend has not been charged yet. Takes the run's CUMULATIVE
+     * totals rather than deltas so no caller can double-charge by calling twice, and so a caller that skips
+     * a boundary loses nothing.
+     *
+     * `cumulativeCostMicroUsd` is the MONEY half (integer micro-USD, `stats.costMicroUsd`). Pass `undefined`
+     * when the run's spend has no cost figure at all (RB-368's unpriced state) — a deployment governing a
+     * `maxCostUsd` window then REFUSES here rather than charging the fabricated 0 that would let the ceiling
+     * silently stop applying. A token-only deployment ignores the argument entirely.
+     */
+    commit(cumulativeTokens: number, cumulativeCostMicroUsd: number | undefined, now: number): Promise<void>;
 }
 /**
  * design/164 件四 — resolve the moment an env's lifetime EXPIRES (epoch ms), or `undefined` when the env
@@ -133,7 +143,7 @@ export declare function checkpointScopeOf(spec: {
     principal?: string;
 }): string;
 export { resolveCheckpointStore } from "../checkpoint-store.js";
-export { isFableFamilyModelId, resolveModelPromptTraits, resolveTaskLimits } from "./prepare-config-doors.js";
+export { isFableFamilyModelId, resolveAttachmentsConfig, resolveModelPromptTraits, resolveTaskLimits } from "./prepare-config-doors.js";
 export { rebaseWorkspacePath, rebaseWorkspacePathAcross } from "./prepare-workspace-restore.js";
 export interface Prepared {
     harness: AgentHarness;
@@ -1463,8 +1473,8 @@ export interface RunInternals {
      * receive a subagent's live `task_progress` ticks (which otherwise stay in the child's ISOLATED stream). Threaded
      * recursively down the delegation tree (via `ctx.forwardEvent`), so every nested subagent's ticks bubble to the
      * SAME sink. The Runner's ctx wrapper forwards `task_progress` always; when the run's spec sets
-     * `forwardSubagentEvents: true` it ALSO forwards the child's content events (`text_delta` / `reasoning_delta` /
-     * `tool_start` / `tool_end` — the subagent viewing pane, carrying the same UNTRUSTED-RAW/consumer-must-redact
+     * `forwardSubagentEvents: true` it ALSO forwards the child's content events (`text_delta` / `text_end` (#447) /
+     * `reasoning_delta` / `tool_start` / `tool_end` — the subagent viewing pane, carrying the same UNTRUSTED-RAW/consumer-must-redact
      * contract as the main stream's tool events). Either way the child stream is NEVER merged into the parent's
      * MODEL context (this is purely a render channel). Absent unless the deployment opted in.
      */
@@ -1629,6 +1639,35 @@ export interface ResolvedWorkspace {
      *  which `cwd` is a host path a consumer may diff / merge / remove. */
     remote: boolean;
 }
+/**
+ * RB-330 + 5.38 r2 件2 — the SINGLE effective-delegation derivation for a leg, minted once per prepare
+ * and read by EVERY consumer face; two facets, one source:
+ *
+ *  - `isDelegatedChild` — the raw delegation fact, forks included. Trusted internals first; on a
+ *    resume leg where the caller supplied NO delegation fact, the checkpoint's persisted axis
+ *    ({@link import("../checkpoint-store.js").CheckpointState.isDelegatedChild}) stands in — else a
+ *    deps-only `resume(token, outcome, config)` of a parked delegation read `false` at every station:
+ *    persona flip (subagent consent/notes pack dropped), ask refusal texts on the parent-thread arm
+ *    ("wait for the user" in a transcript no user turn ever lands in), and a lifecycle-observer gate
+ *    that never opened. Consumed by `askSourceIdentity` (a fork's refusal posture is the child's) and
+ *    the `hookIdentity` mint.
+ *  - `isNonForkChild` — the fact minus forks, for the authority/context faces: the `loadProjectMemory`
+ *    ctx flag ({@link RunnerDeps.loadProjectMemory} `isSubagent`) and the prompt runtime fact
+ *    `isSubagent` (RB-204's `SUBAGENT_CONSENT_NOTICE` gate). A FORK is excluded on both, deliberately:
+ *    a fork IS the parent continuing (design/110), so it inherits the parent's authority — and, on the
+ *    memory face, the parent's own project context; trimming a fork's CLAUDE.md would hand the
+ *    continuation LESS context than the run it continues. (RB-330 history: the memory face once used
+ *    `parentTaskId !== undefined` alone, which {@link RunInternals.isDelegatedChild}'s own docstring
+ *    forbids — a directly-started workflow's children have no nameable parent.)
+ *
+ * `insideFork` is NOT persisted (the checkpoint's documented honest absence), so on a deps-only resume
+ * a FORK child reads as a plain delegated child on the non-fork facet — the honest residue is written
+ * on the checkpoint field's own list, not papered over with a new persistence axis.
+ */
+export declare function effectiveDelegationFacts(internals: Pick<RunInternals, "isDelegatedChild" | "insideFork"> | undefined, seedIsDelegatedChild: boolean | undefined): {
+    isDelegatedChild: boolean;
+    isNonForkChild: boolean;
+};
 /**
  * From the resumed/active transcript, the batch position of `currentId` (design/45 §4.ter): the tool-call
  * ids of the assistant message that issued it (the batch), and the subset already resolved (executed