@sema-agent/core 5.61.0 → 5.62.0

package/dist/core/runner/prepare-task.js

@@ -95,7 +95,7 @@ import { BINDING_CHECKPOINT_VERSION, mintCheckpointId, mintCheckpointToken, ORG_
 import { boundInputHashOf } from "../canonical-json.js";
 import { countElicitOptIns, deriveWiringManifest, resolveAskSeamForm, resolveDeclaredDurability, resolveElicitSeam, resolveQuestionSeam, resolveSubagentTranscriptTier } from "../wiring-manifest.js";
 import { durableParkGapFor } from "../park-selfcheck.js";
-import { GLOBAL_USAGE_KEY, usageRetryAfterMs } from "../usage-window-store.js";
+import { GLOBAL_USAGE_KEY, usageRetryAfterMs, windowsGovernCost } from "../usage-window-store.js";
 import { deliverEngineNotice } from "../types.js";
 let announcedMaterializeEnvBySink = new WeakMap();
 const announcedMaterializeEnvConsole = new Set();
@@ -228,6 +228,61 @@ const ULTRA_REASONING_TIERS = new Set(["xhigh", "max"]);
 const DEFAULT_RESOURCE_TTL_MS = 30 * 24 * 60 * 60 * 1000;
 export const ENV_LIFETIME_SUSPEND_MARGIN_MS = 60_000;
 export const USAGE_WINDOW_REAP_MARGIN_MS = 60 * 60 * 1000;
+function buildUsageGovernance(windows, deps, principal, sessionId) {
+    if (windows === undefined || windows.length === 0)
+        return undefined;
+    const store = deps.usageWindowStore;
+    if (store === undefined) {
+        deps.onError?.(new Error("RunnerDeps.usageWindows is set but INACTIVE: no `usageWindowStore` is wired, so cross-task usage cannot be counted and no window can be enforced. Wire InMemoryUsageWindowStore (process-local) or FileUsageWindowStore (restart-surviving)."), { phase: "config", sessionId });
+        return undefined;
+    }
+    const key = principal || GLOBAL_USAGE_KEY;
+    const governsCost = windowsGovernCost(windows);
+    let chargedTokens = 0;
+    let chargedCostMicroUsd = 0;
+    let announcedCostGap = false;
+    let recordedUnpricedGap = false;
+    return {
+        key,
+        governsCost,
+        async check(now) {
+            const readings = await store.read(key, windows, now);
+            if (!announcedCostGap && readings.some((r) => r.costUnknown === true)) {
+                announcedCostGap = true;
+                deps.onError?.(new Error(`the usage window for ledger key ${JSON.stringify(key)} holds spend that nothing could price, so its maxCostUsd ceiling is being evaluated against a LOWER BOUND until that charge ages out of the window. Price every model this deployment can reach (including degrade targets and the compaction model).`), { phase: "config", sessionId });
+            }
+            return usageRetryAfterMs(readings, windows);
+        },
+        async commit(cumulativeTokens, cumulativeCostMicroUsd, now) {
+            if (!governsCost) {
+                const delta = cumulativeTokens - chargedTokens;
+                if (delta <= 0)
+                    return;
+                await store.charge(key, delta, now, windows);
+                chargedTokens = cumulativeTokens;
+                return;
+            }
+            if (cumulativeCostMicroUsd === undefined) {
+                const tokenDelta = cumulativeTokens - chargedTokens;
+                if (tokenDelta > 0 || !recordedUnpricedGap) {
+                    await store.charge(key, Math.max(0, tokenDelta), now, windows, null);
+                    chargedTokens = Math.max(chargedTokens, cumulativeTokens);
+                    recordedUnpricedGap = true;
+                }
+                const e = new Error("a deployment usage window declares maxCostUsd, but this run's spend has NO cost figure (RB-368 unpriced: a model served without a RunnerDeps.pricing entry or a Model.cost declaration). Refused rather than charged a fabricated 0 — the money ceiling would have silently stopped applying. Price every model this run can reach, or drop maxCostUsd from the window.");
+                e.code = "config.usage_window_unpriced";
+                throw e;
+            }
+            const tokenDelta = cumulativeTokens - chargedTokens;
+            const costDelta = cumulativeCostMicroUsd - chargedCostMicroUsd;
+            if (tokenDelta <= 0 && costDelta <= 0)
+                return;
+            await store.charge(key, Math.max(0, tokenDelta), now, windows, Math.max(0, costDelta));
+            chargedTokens = cumulativeTokens;
+            chargedCostMicroUsd = cumulativeCostMicroUsd;
+        },
+    };
+}
 export function resolveEnvLifetimeExpiry(env, observedAt) {
     const lifetimeMs = env.lifetimeMs;
     if (lifetimeMs === undefined)
@@ -267,7 +322,7 @@ class ParkRefusal extends Error {
     }
 }
 export { resolveCheckpointStore } from "../checkpoint-store.js";
-export { isFableFamilyModelId, resolveModelPromptTraits, resolveTaskLimits } from "./prepare-config-doors.js";
+export { isFableFamilyModelId, resolveAttachmentsConfig, resolveModelPromptTraits, resolveTaskLimits } from "./prepare-config-doors.js";
 export { rebaseWorkspacePath, rebaseWorkspacePathAcross } from "./prepare-workspace-restore.js";
 function buildMicroCompactState(deps, model, sessionId, offloadStore, knob) {
     const triggerWindow = resolveTriggerWindow(model);
@@ -339,7 +394,7 @@ function publishCommittedSuspend(refs, token, gate, scope, remoteHandle, checkpo
 function hasConversationContent(branch) {
     return branch.some((e) => e.type === "message" || e.type === "custom_message" || e.type === "compaction");
 }
-function effectiveDelegationFacts(internals, seedIsDelegatedChild) {
+export function effectiveDelegationFacts(internals, seedIsDelegatedChild) {
     const isDelegatedChild = internals?.isDelegatedChild !== undefined ? internals.isDelegatedChild === true : seedIsDelegatedChild === true;
     return { isDelegatedChild, isNonForkChild: isDelegatedChild && internals?.insideFork !== true };
 }
@@ -475,20 +530,21 @@ const sanitizePreview = (node, depth = 0) => {
 function resolveApprovalPreview(tools, toolName, args) {
     const t = tools.find((x) => x.name === toolName || (x.aliases?.includes(toolName) ?? false));
     if (t?.approvalPreview === undefined)
-        return undefined;
+        return {};
     try {
         const raw = t.approvalPreview(args);
         if (raw === undefined)
-            return undefined;
+            return {};
         const bytes = JSON.stringify(raw);
         if (bytes === undefined)
-            return undefined;
-        if (bytes.length > 16_384)
-            return { truncated: true, note: `approval preview exceeded 16KiB (${bytes.length} chars serialized)` };
-        return sanitizePreview(raw);
+            return { withheld: "unavailable" };
+        if (bytes.length > 16_384) {
+            return { preview: { truncated: true, note: `approval preview exceeded 16KiB (${bytes.length} chars serialized)` }, withheld: "oversize" };
+        }
+        return { preview: sanitizePreview(raw) };
     }
     catch {
-        return undefined;
+        return { withheld: "unavailable" };
     }
 }
 function inheritedAskRuleEvidence(deps) {
@@ -839,7 +895,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 if (e.type === "task_progress")
                     forwardSink(e);
                 else if (spec.forwardSubagentEvents === true &&
-                    (e.type === "text_delta" || e.type === "reasoning_delta" || e.type === "tool_start" || e.type === "tool_end")) {
+                    (e.type === "text_delta" || e.type === "text_end" || e.type === "reasoning_delta" || e.type === "tool_start" || e.type === "tool_end")) {
                     forwardSink(e);
                 }
             }
@@ -3140,6 +3196,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             if (ask?.requiresRealApproval === true ||
                 ask?.persistedRuleShadowed !== undefined ||
                 ask?.decisionReason === "hook" ||
+                ask?.matchedAskRule !== undefined ||
                 ask?.inheritedUnresolved === true ||
                 ask?.ancestorResolved === true) {
                 return {};
@@ -3550,31 +3607,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 sessionId,
             });
         }
-        const usageGovernance = (() => {
-            if (usageWindows === undefined || usageWindows.length === 0)
-                return undefined;
-            const store = deps.usageWindowStore;
-            if (store === undefined) {
-                deps.onError?.(new Error("RunnerDeps.usageWindows is set but INACTIVE: no `usageWindowStore` is wired, so cross-task usage cannot be counted and no window can be enforced. Wire InMemoryUsageWindowStore (process-local) or FileUsageWindowStore (restart-surviving)."), { phase: "config", sessionId });
-                return undefined;
-            }
-            const key = spec.principal || GLOBAL_USAGE_KEY;
-            const windows = usageWindows;
-            let charged = 0;
-            return {
-                key,
-                async check(now) {
-                    return usageRetryAfterMs(await store.read(key, windows, now));
-                },
-                async commit(cumulativeTokens, now) {
-                    const delta = cumulativeTokens - charged;
-                    if (delta <= 0)
-                        return;
-                    await store.charge(key, delta, now, windows);
-                    charged = cumulativeTokens;
-                },
-            };
-        })();
+        const usageGovernance = buildUsageGovernance(usageWindows, deps, spec.principal, sessionId);
         const platformSuspendArmed = durableSuspendInfraReady && (envLifetimeSuspendAt !== undefined || usageGovernance !== undefined);
         const checkpointStore = resolveCheckpointStore(spec, deps);
         const durableApproval = spec.durableApproval ??
@@ -3667,8 +3700,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     toolCallId: req.toolCallId,
                     args: req.args,
                     ...(() => {
-                        const preview = approvalPreviewOf(req.toolName, req.args);
-                        return preview !== undefined ? { preview } : {};
+                        const p = approvalPreviewOf(req.toolName, req.args);
+                        return { ...(p.preview !== undefined ? { preview: p.preview } : {}), ...(p.withheld !== undefined ? { previewWithheld: p.withheld } : {}) };
                     })(),
                     ...ruleOffersOf(req.toolName, req.args, decision.action === "ask" ? decision : undefined),
                     message: decision.message ?? `approval required for "${req.toolName}"`,
@@ -4148,7 +4181,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 }
             };
             const suspendAsk = parkLaneArmed && checkpointStore !== undefined
-                ? async (req, postHookArgs, safety, liveFaceUnavailable, realApproval, shadowedRule, askDecisionReason, probeReason, probeCause, segmentCoverage) => {
+                ? async (req, postHookArgs, safety, liveFaceUnavailable, realApproval, shadowedRule, askDecisionReason, probeReason, probeCause, segmentCoverage, matchedAskRule) => {
                     const syncFirstEligible = req.toolName === ASK_USER_QUESTION_TOOL_NAME ? contentAskRoutable(req.toolCallId) : isLiveApproverSeat(onAsk);
                     if (syncFirstEligible &&
                         runtimeCaps?.forceDurableGate !== true &&
@@ -4306,10 +4339,11 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                                 toolName: req.toolName,
                                 args: parkedArgs,
                                 ...(() => {
-                                    const preview = approvalPreviewOf(req.toolName, parkedArgs);
-                                    const bidi = carriesBidiControls(parkedArgs) || carriesBidiControls(preview);
+                                    const p = approvalPreviewOf(req.toolName, parkedArgs);
+                                    const bidi = carriesBidiControls(parkedArgs) || carriesBidiControls(p.preview);
                                     return {
-                                        ...(preview !== undefined ? { preview } : {}),
+                                        ...(p.preview !== undefined ? { preview: p.preview } : {}),
+                                        ...(p.withheld !== undefined ? { previewWithheld: p.withheld } : {}),
                                         ...(bidi ? { hasBidiControls: true } : {}),
                                     };
                                 })(),
@@ -4317,6 +4351,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                                     ...(realApproval !== undefined ? { requiresRealApproval: true } : {}),
                                     ...(shadowedRule !== undefined ? { persistedRuleShadowed: shadowedRule } : {}),
                                     ...(askDecisionReason !== undefined ? { decisionReason: askDecisionReason } : {}),
+                                    ...(matchedAskRule !== undefined ? { matchedAskRule } : {}),
                                     ...(inheritedUnavailableAsks.has(req.toolCallId) ? { inheritedUnresolved: true } : {}),
                                     ...(segmentCoverage !== undefined ? { segmentCoverage } : {}),
                                 }),

package/dist/core/runner/runtask.d.ts

@@ -51,6 +51,13 @@ interface ResumeRun {
      *  wake message second), each under its own trusted framing — the old merge-into-the-slot shape
      *  silently DISPLACED the parked (undelivered) supervisor steer. Wake outcomes only. */
     wakeMessage?: Omit<PendingSteerEntry, "seq">;
+    /** design/373 §4.3 (D2) — the userPromptSubmit screen's `additionalContext` for {@link wakeMessage},
+     *  captured at the resume ENTRY (the message is screened once, pre-CAS, on the resuming process's
+     *  hook) and delivered by the drain as the engine's own reminder AHEAD of the wake frame — carrying
+     *  it forward is what keeps the hook single-run (re-screening at the drain would be the double-run
+     *  §4.3-3 reserves for the cross-process parked leg). Present only when a wake message passed a
+     *  screen that supplied context. */
+    wakeMessageHookContext?: string;
     /** Compensation hook (design/45/49): called iff the resumed run fails with `resume.env_failed` (post-CAS
      *  workspace `resumeVM` failed) OR `resume.tool_unavailable` (P-7: the approved tool vanished) — in both
      *  the CAS already consumed the checkpoint but the pending action never ran. `resumeStream` supplies a

package/dist/core/runner/runtask.js

@@ -15,7 +15,7 @@ import { eventDefaultOn } from "../../prompt-assembly/event-registry.js";
 import { DEFAULT_COMPACTION_INSTRUCTIONS, createRapidRefillState, isCompactionManualCancel, maybeCompact, nextTrimForceBackoff, recordCompactionAndCheckRapidRefill, sanitizeCompactionSettings } from "../auto-compaction.js";
 import { ASK_USER_QUESTION_TOOL_NAME, canonicalizeCapturedPlainData, classifyQuestionOutcome, isLiveQuestionFace, markBoundOnlyQuestionFace } from "../ask-question.js";
 import { boundInputHashOf } from "../canonical-json.js";
-import { computeCostMicroUsd, modelCostToPricing } from "../pricing.js";
+import { computeCostMicroUsd, isModelPriced, malformedPricingField, modelCostToPricing } from "../pricing.js";
 import { emitTrace } from "../trace.js";
 import { ORG_ADJUDICATION_TIMEOUT_MS, settleOrgVerdictWithin } from "../permission-rule-org.js";
 import { emitTaskOutcome } from "../task-outcome.js";
@@ -36,13 +36,13 @@ import { cacheFamilyOf, usageCostMicroUsd } from "./usage-accounting.js";
 import { assembleResult, errorCodeOf } from "./assemble-result.js";
 import { ATTACHMENT_BYTE_CAP, CHANGED_FILES_MAX, AGENT_LISTING_REMOVED_HEADER, SKILLS_LISTING_DELTA_HEADER, SKILLS_LISTING_REMOVED_HEADER, advanceCadenceClock, agentListingDeltaHeader, attachmentEnvelopeTags, agentListingInitialHeader, replayAnnouncedListing, replayAnnouncedModels, clipToBytes, collectDateChange, collectDueAttachments, collectInstructionsChange, commitAgentListing, commitInstructionsChange, commitSkillsListing, createAttachmentState, rebaseCadenceWindows, reduceToolEnd, renderAgentListingDelta, renderMcpDroppedTools, renderMcpInstructionsDelta, renderOrphanedBackgroundTasks, selectMcpDroppedBatch, renderSkillsListingDelta, renderToolsDelta, stampWriteAnchor } from "./turn-attachments.js";
 import { buildWorkingFileAttachments, centerAdoptionOption, emitInputTruncated, forkContextOption } from "./compaction-call-options.js";
-import { gatedCallIdOf, prepareTask, resolveCheckpointStore } from "./prepare-task.js";
+import { effectiveDelegationFacts, gatedCallIdOf, prepareTask, resolveCheckpointStore } from "./prepare-task.js";
 import { settleTeardownLeg } from "./teardown-bounded.js";
 import { TOOL_SEARCH_NAME } from "./tool-disclosure.js";
 import { hasVerifiableStructureSignal } from "./grounding-signal.js";
 import { hasDestroy, isIsolated } from "../remote-env.js";
 import { hasBackgroundShell, sweepBackgroundShells } from "../background-shell.js";
-import { cloneObserverInput, formatHookFeedback, hookSeatExpiredError, resolveHookTimeoutMs, runHookSeat } from "../hooks.js";
+import { cloneObserverInput, formatHookFeedback, hookSeatExpiredError, mintHookInvocationIdentity, resolveHookTimeoutMs, runHookSeat } from "../hooks.js";
 import { buildHumanInputEvent, frameMidTurnUserInput, projectHumanInput } from "../human-input-projection.js";
 import { delimitUntrusted, inlineUntrusted, REVIEWER_NOTE_MAX_BODY, sanitizeUntrustedText, SHELLED_BODY_ENVELOPE_TAGS } from "../untrusted-text.js";
 import { appendInterruptionMarker, reconcileInterruptedSession } from "../session-reconcile.js";
@@ -395,7 +395,7 @@ function makeTurnBoundary(prepared, stats, rs, deps) {
                 const governance = prepared.usageGovernance;
                 try {
                     const at = Date.now();
-                    await awaitChargeWithSlowDisclosure(governance.commit(stats.tokens, at), () => runnerHooks.onError?.(new Error("the usage ledger CHARGE has not settled after 10s — still waiting (a charge is never abandoned: walking away would double-charge on the end-of-task flush). A wedged ledger store wedges this boundary, now visibly."), { phase: "config", sessionId: prepared.sessionId }));
+                    await awaitChargeWithSlowDisclosure(governance.commit(stats.tokens, rs.telemetry.unpricedSpend ? undefined : stats.costMicroUsd, at), () => runnerHooks.onError?.(new Error("the usage ledger CHARGE has not settled after 10s — still waiting (a charge is never abandoned: walking away would double-charge on the end-of-task flush). A wedged ledger store wedges this boundary, now visibly."), { phase: "config", sessionId: prepared.sessionId }));
                     const windowRead = governance.check(at);
                     let answer;
                     if (ledgerReadDeadline !== undefined) {
@@ -606,6 +606,7 @@ function makeTurnBoundary(prepared, stats, rs, deps) {
                 const mcpRemovals = mcpInstructionsOn && mcpDelta.pendingRemovals.length > 0 ? [...mcpDelta.pendingRemovals] : undefined;
                 const mcpDropped = mcpInstructionsOn && prepared.mcp.droppedTools.length > 0 ? selectMcpDroppedBatch(prepared.mcp.droppedTools) : undefined;
                 const budgetUsdOn = rs.attach.attachmentsCfg?.budgetUsd === true && rs.budget.maxCostMicroUsd !== undefined && rs.turn.lastTurnHadToolCalls;
+                const totalTokensOn = rs.attach.attachmentsCfg?.totalTokensReminder === true && rs.turn.lastTurnHadToolCalls;
                 const toolSearchReminderOn = rs.attach.attachmentsCfg?.toolSearchReminder === true && prepared.deferredToolNames !== undefined;
                 const undiscoveredTools = toolSearchReminderOn
                     ? [...prepared.deferredToolNames].filter((n) => !prepared.activeTools.has(n)).sort()
@@ -623,6 +624,10 @@ function makeTurnBoundary(prepared, stats, rs, deps) {
                         changedFiles: changedFilesOn,
                         planModeReminder: rs.attach.attachmentsCfg?.planModeReminder === true,
                         budgetUsd: budgetUsdOn,
+                        totalTokensReminder: totalTokensOn,
+                        ...(rs.attach.attachmentsCfg?.totalTokensReminderMode !== undefined
+                            ? { totalTokensReminderMode: rs.attach.attachmentsCfg.totalTokensReminderMode }
+                            : {}),
                         backgroundTasks: backgroundTasksOn,
                         toolsDelta: toolsDeltaOn,
                         agentListing: rs.attach.agentListingOn,
@@ -636,6 +641,9 @@ function makeTurnBoundary(prepared, stats, rs, deps) {
                     ...(budgetUsdOn && rs.budget.maxCostMicroUsd !== undefined
                         ? { budgetUsd: { used: stats.costMicroUsd / 1e6, total: rs.budget.maxCostMicroUsd / 1e6 } }
                         : {}),
+                    ...(totalTokensOn && rs.budget.maxTokensWindow !== undefined
+                        ? { totalTokens: { used: stats.tokens, total: rs.budget.maxTokensWindow } }
+                        : {}),
                     ...(bgTasks !== undefined ? { backgroundTasks: bgTasks } : {}),
                     ...(pendingTools !== undefined ? { newTools: pendingTools } : {}),
                     ...(prepared.toolMaterializeStatic ? { newToolsStaticFace: true } : {}),
@@ -1131,6 +1139,9 @@ function makeHarnessHandlers(prepared, stats, rs, deps) {
                 rs.turn.firstTokenAt = Date.now();
             pushContent({ type: "text_delta", delta: ev.delta, ...ident() });
         }
+        else if (ev.type === "text_end" && typeof ev.content === "string" && ev.content.length !== 0) {
+            pushContent({ type: "text_end", content: ev.content, ...ident() });
+        }
         else if (ev.type === "thinking_delta" && ev.delta) {
             pushContent({ type: "reasoning_delta", delta: ev.delta, ...ident() });
         }
@@ -1892,6 +1903,47 @@ export class Runner {
                             return;
                         }
                     }
+                    if (resultValue !== undefined || h.loop.ended)
+                        throw steeringError("the task is no longer running");
+                    if (mintsAFrame) {
+                        const screen = (spec.hooks ?? this.deps.hooks)?.userPromptSubmit;
+                        if (screen !== undefined) {
+                            let decision;
+                            try {
+                                const seat = await runHookSeat("userPromptSubmit", { timeoutMs: h.hookTimeoutMs, signal: h.abortController.signal, abortEnds: true }, (sig) => screen(text, { identity: h.hookIdentity, signal: sig, source: "steer", inputId: effectiveInputId, ...(actor !== undefined ? { actor: snapshotActorAssertion(actor) } : {}) }));
+                                if (seat.expired) {
+                                    if (seat.cause === "timeout") {
+                                        try {
+                                            this.deps.onError?.(hookSeatExpiredError("userPromptSubmit", h.hookTimeoutMs, seat.cause, "the steering input was NOT accepted (fail-closed) and the caller was refused typed"), { phase: "hook", sessionId: h.sessionId });
+                                        }
+                                        catch {
+                                        }
+                                    }
+                                    throw steeringError(seat.cause === "timeout"
+                                        ? `the deployment's userPromptSubmit hook did not answer within its ${h.hookTimeoutMs}ms bound while screening this steering input; the input was NOT accepted (fail-closed)`
+                                        : `the task was cancelled while the deployment's userPromptSubmit hook was still screening this steering input; the input was NOT accepted (fail-closed)`, "steering.blocked_by_hook");
+                                }
+                                decision = seat.value;
+                            }
+                            catch (hookErr) {
+                                if (hookErr instanceof Error && hookErr.code === "steering.blocked_by_hook")
+                                    throw hookErr;
+                                const err = hookErr instanceof Error ? hookErr : new Error(String(hookErr));
+                                try {
+                                    this.deps.onError?.(err, { phase: "hook", sessionId: h.sessionId });
+                                }
+                                catch {
+                                }
+                                throw steeringError(`the deployment's userPromptSubmit hook crashed while screening this steering input (${inlineUntrusted(err.message)}); the input was NOT accepted (fail-closed)`, "steering.blocked_by_hook");
+                            }
+                            if (decision?.block !== undefined && decision.block !== "") {
+                                throw steeringError(`the deployment's userPromptSubmit hook blocked this steering input: ${inlineUntrusted(decision.block)}`, "steering.blocked_by_hook");
+                            }
+                            if (decision?.additionalContext !== undefined && decision.additionalContext !== "") {
+                                payload = `${formatHookFeedback(decision.additionalContext, h.reminderMark)}\n\n${payload}`;
+                            }
+                        }
+                    }
                     const injectFramed = async () => {
                         const noteOptions = { provenance: "engine-note", callerAuthored: true, parkRecord, ...(actor !== undefined ? { actor } : {}) };
                         if (priority === "later") {
@@ -2236,7 +2288,7 @@ export class Runner {
             }
         }
         const loopLatch = { ended: false, userInterrupted: false };
-        onReady({ harness: prepared.harness, abortController: prepared.abortController, loop: loopLatch, reminderMark: prepared.reminderMark, sessionId: prepared.sessionId });
+        onReady({ harness: prepared.harness, abortController: prepared.abortController, loop: loopLatch, reminderMark: prepared.reminderMark, sessionId: prepared.sessionId, hookTimeoutMs: prepared.hookTimeoutMs, hookIdentity: prepared.hookIdentity });
         const stats = { turns: 0, tokens: 0, toolCalls: 0, promptTokens: 0, totalInputTokens: 0, cachedTokens: 0, cacheWriteTokens: 0, cacheWriteTokensLong: 0, outputTokens: 0, costMicroUsd: 0 };
         prepared.liveSpendRef.get = () => ({ costMicroUsd: stats.costMicroUsd, tokens: stats.tokens, turns: stats.turns, walltimeMs: Math.round(performance.now() - rs.telemetry.taskStartMonotonic) });
         if (resume &&
@@ -2258,7 +2310,7 @@ export class Runner {
         const rs = createRunState();
         rs.telemetry.cacheFamily = cacheFamilyOf(prepared.model);
         rs.telemetry.pricing = this.deps.pricing?.[prepared.model.id] ?? modelCostToPricing(prepared.model.cost);
-        rs.telemetry.pricingConfigured = this.deps.pricing?.[prepared.model.id] !== undefined || prepared.model.cost !== undefined;
+        rs.telemetry.pricingConfigured = isModelPriced(prepared.model, this.deps.pricing);
         if (spec.limits?.degrade) {
             try {
                 rs.degrade.degradeToModel = resolveModel(spec.limits.degrade.to, modelCatalog);
@@ -2298,6 +2350,12 @@ export class Runner {
         catch (err) {
             discloseNoteTaskRunFailure(err);
         }
+        const noteUnevaluablePriceTable = (p) => {
+            if (prepared.usageGovernance?.governsCost !== true)
+                return;
+            if (malformedPricingField(p) !== undefined)
+                rs.telemetry.unpricedSpend = true;
+        };
         rs.degrade.recordDegraded = (info, toModel) => {
             if (rs.degrade.degraded !== undefined)
                 return;
@@ -2312,13 +2370,15 @@ export class Runner {
             }
             if (m) {
                 rs.telemetry.pricing = this.deps.pricing?.[m.id] ?? modelCostToPricing(m.cost);
-                rs.telemetry.pricingConfigured = this.deps.pricing?.[m.id] !== undefined || m.cost !== undefined;
+                rs.telemetry.pricingConfigured = isModelPriced(m, this.deps.pricing);
+                noteUnevaluablePriceTable(rs.telemetry.pricing);
                 rs.telemetry.cacheFamily = cacheFamilyOf(m);
             }
             else {
                 if (this.deps.pricing?.[info.to]) {
                     rs.telemetry.pricing = this.deps.pricing[info.to];
                     rs.telemetry.pricingConfigured = true;
+                    noteUnevaluablePriceTable(rs.telemetry.pricing);
                 }
                 else {
                     rs.telemetry.pricingConfigured = false;
@@ -2737,9 +2797,10 @@ export class Runner {
                 return;
             const fam = cacheFamilyOf(m);
             const price = this.deps.pricing?.[m.id] ?? modelCostToPricing(m.cost);
-            const priced = this.deps.pricing?.[m.id] !== undefined || m.cost !== undefined;
+            const priced = isModelPriced(m, this.deps.pricing);
             if (!priced)
                 rs.telemetry.unpricedSpend = true;
+            noteUnevaluablePriceTable(price);
             const { totalInputTokens, uncachedInputTokens, costMicroUsd } = usageCostMicroUsd(fam, u, price);
             stats.tokens += u.totalTokens || 0;
             stats.promptTokens += uncachedInputTokens;
@@ -3312,6 +3373,72 @@ export class Runner {
                         ...(resume.wakeMessage !== undefined ? [{ entry: resume.wakeMessage, source: "wake" }] : []),
                     ];
                     for (const { entry: steer, source } of resumeFrames) {
+                        if (source === "wake" && resume.wakeMessageHookContext !== undefined) {
+                            const hookStart = continuation.length;
+                            continuation += "\n\n" + formatHookFeedback(resume.wakeMessageHookContext, prepared.reminderMark);
+                            engineSegments.push({ start: hookStart, end: continuation.length });
+                        }
+                        if (source === "steer") {
+                            const parkedScreen = (spec.hooks ?? this.deps.hooks)?.userPromptSubmit;
+                            if (parkedScreen !== undefined) {
+                                let outcome;
+                                try {
+                                    const seat = await runHookSeat("userPromptSubmit", { timeoutMs: prepared.hookTimeoutMs, signal: prepared.abortController.signal, abortEnds: true }, (sig) => parkedScreen(steer.text, {
+                                        identity: prepared.hookIdentity,
+                                        signal: sig,
+                                        source: "parked_redelivery",
+                                        ...(steer.inputId !== undefined ? { inputId: steer.inputId } : {}),
+                                        ...(steer.actor !== undefined ? { actor: snapshotActorAssertion(steer.actor) } : {}),
+                                    }));
+                                    outcome = seat.expired
+                                        ? { blocked: seat.cause === "timeout" ? `the screen did not answer within its ${prepared.hookTimeoutMs}ms bound (fail-closed)` : "the run was cancelled while the screen was still deciding (fail-closed)" }
+                                        : seat.value?.block !== undefined && seat.value.block !== ""
+                                            ? { blocked: inlineUntrusted(seat.value.block) }
+                                            : { ...(seat.value?.additionalContext !== undefined && seat.value.additionalContext !== "" ? { context: seat.value.additionalContext } : {}) };
+                                }
+                                catch (hookErr) {
+                                    const err = hookErr instanceof Error ? hookErr : new Error(String(hookErr));
+                                    try {
+                                        this.deps.onError?.(err, { phase: "hook", sessionId: prepared.sessionId });
+                                    }
+                                    catch {
+                                    }
+                                    outcome = { blocked: `the screen crashed (${inlineUntrusted(err.message)}; fail-closed)` };
+                                }
+                                if ("blocked" in outcome) {
+                                    deliverEngineNotice(this.deps.onNotice, {
+                                        code: "steering.parked_input_blocked",
+                                        message: "a parked steering input was withheld by the deployment's userPromptSubmit screen when this resume redelivered it: " +
+                                            `${outcome.blocked}. The parked row was consumed with the checkpoint; the instruction never reached the model — ` +
+                                            "re-issue it if it still applies.",
+                                        detail: {
+                                            ...(steer.inputId !== undefined ? { inputId: steer.inputId } : {}),
+                                            sessionId: prepared.sessionId,
+                                            ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}),
+                                        },
+                                    });
+                                    queue.push({
+                                        ...buildHumanInputEvent({
+                                            carrier: source,
+                                            source,
+                                            delivery: "blocked",
+                                            sessionSeq: nextHumanInputSeq(prepared.harness),
+                                            ...(steer.inputId !== undefined ? { inputId: steer.inputId } : {}),
+                                            ...(steer.actor !== undefined ? { actor: steer.actor } : {}),
+                                            ...(steer.actor?.issuer !== undefined ? { issuer: steer.actor.issuer } : {}),
+                                            ...(spec.principal !== undefined ? { principal: spec.principal } : {}),
+                                        }),
+                                        ...ident(),
+                                    });
+                                    continue;
+                                }
+                                if ("context" in outcome && outcome.context !== undefined) {
+                                    const hookStart = continuation.length;
+                                    continuation += "\n\n" + formatHookFeedback(outcome.context, prepared.reminderMark);
+                                    engineSegments.push({ start: hookStart, end: continuation.length });
+                                }
+                            }
+                        }
                         const start = continuation.length;
                         const projected = projectHumanInput({ text: steer.text, actor: steer.actor, source });
                         continuation +=
@@ -3362,7 +3489,7 @@ export class Runner {
                 const userPromptSubmit = (spec.hooks ?? this.deps.hooks)?.userPromptSubmit;
                 if (userPromptSubmit) {
                     try {
-                        const promptSeat = await runHookSeat("userPromptSubmit", { timeoutMs: prepared.hookTimeoutMs, signal: prepared.abortController.signal, abortEnds: true }, (sig) => userPromptSubmit(spec.objective, { identity: prepared.hookIdentity, signal: sig }));
+                        const promptSeat = await runHookSeat("userPromptSubmit", { timeoutMs: prepared.hookTimeoutMs, signal: prepared.abortController.signal, abortEnds: true }, (sig) => userPromptSubmit(spec.objective, { identity: prepared.hookIdentity, signal: sig, source: "objective", ...(objectiveActor !== undefined ? { actor: snapshotActorAssertion(objectiveActor) } : {}) }));
                         if (promptSeat.expired) {
                             if (promptSeat.cause === "timeout") {
                                 try {
@@ -3586,7 +3713,7 @@ export class Runner {
         }
         if (prepared.usageGovernance !== undefined) {
             try {
-                await awaitChargeWithSlowDisclosure(prepared.usageGovernance.commit(stats.tokens, Date.now()), () => this.deps.onError?.(new Error("the usage ledger's FINAL charge has not settled after 10s — still waiting (a charge is never abandoned: walking away would double-charge on a later flush). A wedged ledger store wedges this teardown, now visibly."), { phase: "config", sessionId: prepared.sessionId }));
+                await awaitChargeWithSlowDisclosure(prepared.usageGovernance.commit(stats.tokens, rs.telemetry.unpricedSpend ? undefined : stats.costMicroUsd, Date.now()), () => this.deps.onError?.(new Error("the usage ledger's FINAL charge has not settled after 10s — still waiting (a charge is never abandoned: walking away would double-charge on a later flush). A wedged ledger store wedges this teardown, now visibly."), { phase: "config", sessionId: prepared.sessionId }));
             }
             catch (flushErr) {
                 this.deps.onError?.(flushErr, { phase: "config", sessionId: prepared.sessionId });
@@ -4169,7 +4296,9 @@ export class Runner {
             }
         }
         let wakeMessage;
+        let wakeHookContext;
         const outcomeGate = outcome.gate;
+        const resumeSignal = taskConfig.signal;
         let suppliedMessage;
         if (outcomeGate === "wake") {
             suppliedMessage = outcome.message;
@@ -4207,6 +4336,62 @@ export class Runner {
             }
             if (suppliedMessage !== undefined) {
                 wakeMessage = validatePendingSteer(suppliedMessage);
+                {
+                    const resumeScreenHooks = taskConfig.hooks ?? this.deps.hooks;
+                    const screen = resumeScreenHooks?.userPromptSubmit;
+                    if (screen !== undefined && resumeSignal?.aborted !== true) {
+                        const screenedMessage = wakeMessage;
+                        const identity = mintHookInvocationIdentity({
+                            sessionId: cp.sessionId,
+                            taskId: taskConfig.taskId ?? cp.sessionId,
+                            legKind: "resume",
+                            isDelegatedChild: effectiveDelegationFacts(internals, cp.state.isDelegatedChild).isDelegatedChild,
+                            ...(internals?.insideFork === true ? { insideFork: true } : {}),
+                            ...(internals?.agentName !== undefined ? { agentName: internals.agentName } : {}),
+                            ...(internals?.parentToolCallId !== undefined ? { parentToolCallId: internals.parentToolCallId } : {}),
+                        });
+                        const screenTimeoutMs = resolveHookTimeoutMs(resumeScreenHooks?.timeoutMs, (badErr) => {
+                            try {
+                                this.deps.onError?.(badErr instanceof Error ? badErr : new Error(String(badErr)), { phase: "hook", sessionId: cp.sessionId });
+                            }
+                            catch {
+                            }
+                        }, resumeScreenHooks);
+                        let decision;
+                        try {
+                            const seat = await runHookSeat("userPromptSubmit", { timeoutMs: screenTimeoutMs, ...(resumeSignal !== undefined ? { signal: resumeSignal } : {}), abortEnds: true }, (sig) => screen(screenedMessage.text, {
+                                identity,
+                                signal: sig,
+                                source: "resume_message",
+                                ...(screenedMessage.inputId !== undefined ? { inputId: screenedMessage.inputId } : {}),
+                                ...(screenedMessage.actor !== undefined ? { actor: snapshotActorAssertion(screenedMessage.actor) } : {}),
+                            }));
+                            if (seat.expired) {
+                                throw new CheckpointError("steering.blocked_by_hook", seat.cause === "timeout"
+                                    ? `the deployment's userPromptSubmit hook did not answer within its ${screenTimeoutMs}ms bound while screening this wake message; the resume was refused (fail-closed) and the checkpoint stays pending`
+                                    : `the resume was cancelled while the deployment's userPromptSubmit hook was still screening this wake message; the checkpoint stays pending`);
+                            }
+                            decision = seat.value;
+                        }
+                        catch (hookErr) {
+                            if (hookErr instanceof CheckpointError)
+                                throw hookErr;
+                            const err = hookErr instanceof Error ? hookErr : new Error(String(hookErr));
+                            try {
+                                this.deps.onError?.(err, { phase: "hook", sessionId: cp.sessionId });
+                            }
+                            catch {
+                            }
+                            throw new CheckpointError("steering.blocked_by_hook", `the deployment's userPromptSubmit hook crashed while screening this wake message (${inlineUntrusted(err.message)}); the resume was refused (fail-closed) and the checkpoint stays pending`);
+                        }
+                        if (decision?.block !== undefined && decision.block !== "") {
+                            throw new CheckpointError("steering.blocked_by_hook", `the deployment's userPromptSubmit hook blocked this wake message: ${inlineUntrusted(decision.block)}`);
+                        }
+                        if (decision?.additionalContext !== undefined && decision.additionalContext !== "") {
+                            wakeHookContext = decision.additionalContext;
+                        }
+                    }
+                }
             }
             else if (readPendingSteerQueue(cp.state).length === 0) {
                 throw new CheckpointError("wake.nothing_to_deliver", "cannot wake: no message was supplied and the checkpoint holds no parked pendingSteer — an empty " +
@@ -4454,7 +4639,7 @@ export class Runner {
                 "resuming here would run the leg with that ceiling unenforced. Rejected pre-CAS (the checkpoint stays pending): finish it on a worker of the " +
                 "previous release, or start a fresh task bounded by resourceSuspend.totalTokens / totalBudgetUsd.");
         }
-        if (taskConfig.signal?.aborted === true && cp.status === "pending") {
+        if (resumeSignal?.aborted === true && cp.status === "pending") {
             throw new CheckpointError("checkpoint.resume_aborted", "the resume was handed an ALREADY-ABORTED signal — refusing to consume the approval on a leg that cannot run it (the checkpoint stays pending and is resumable with a live signal)");
         }
         if (cp.state.workspaceHandle !== undefined && this.deps.executionEnvFactory === undefined) {
@@ -4528,7 +4713,7 @@ export class Runner {
                 const preCasWindows = resolveUsageWindows(this.deps.usageWindows);
                 if (preCasWindows !== undefined && preCasWindows.length > 0) {
                     const ledgerKey = (suppliedPrincipal ?? rowPrincipal) || GLOBAL_USAGE_KEY;
-                    const wait = usageRetryAfterMs(await this.deps.usageWindowStore.read(ledgerKey, preCasWindows, Date.now()));
+                    const wait = usageRetryAfterMs(await this.deps.usageWindowStore.read(ledgerKey, preCasWindows, Date.now()), preCasWindows);
                     if (wait !== undefined) {
                         throw new CheckpointError("resume.usage_window_exhausted", `a deployment usage window for ledger key ${JSON.stringify(ledgerKey)} is exhausted, and this checkpoint still owes a delivery a re-mint cannot carry — ` +
                             `refused pre-CAS (nothing consumed, nothing unpinned): the same token and the same decision are redeemable once the window frees, in ${String(wait)}ms`, { retryAfterMs: wait });
@@ -4688,7 +4873,7 @@ export class Runner {
                     ? new CheckpointError("checkpoint.reopen_failed", "the resume was aborted before the approved action could run AND the store refused to reopen the checkpoint — the approval is terminally consumed and the suspended work was not executed; a retry needs a fresh approval")
                     : new CheckpointError("checkpoint.reopen_failed", "the resume was aborted before the approved action could run and the reopen attempt FAILED IN FLIGHT — the checkpoint's state is unprovable from here: it may already be pending again. Re-read it before deciding; do NOT issue a fresh approval on the assumption the old one is dead (the approved action did NOT run either way)");
         }
-        return this.runTaskStream(spec, { cp, outcome: outcomeForStore, onEnvRestoreFailed, ...(wakeMessage !== undefined ? { wakeMessage } : {}) }, resumeInternals);
+        return this.runTaskStream(spec, { cp, outcome: outcomeForStore, onEnvRestoreFailed, ...(wakeMessage !== undefined ? { wakeMessage } : {}), ...(wakeHookContext !== undefined ? { wakeMessageHookContext: wakeHookContext } : {}) }, resumeInternals);
     }
     async applyResumeDecision(prepared, resume, emit, emitCommitted, onResolvedToolSuccess, onExecuteStart) {
         const { pendingAction } = resume.cp;