@sema-agent/core 5.64.0 → 6.0.0

package/dist/core/auto-mode-arming.js

@@ -0,0 +1,181 @@
+import { AUTO_MODE_DEFAULT_FAILURE_THRESHOLD, AUTO_MODE_DEFAULT_TIMEOUT_MS, AUTO_MODE_DEFAULT_WINDOW_MAX_CHARS, AUTO_MODE_DEFAULT_WINDOW_MAX_ENTRIES, AUTO_MODE_DEFAULTS_SENTINEL, } from "./auto-mode-defaults.js";
+export const AUTO_MODE_ARMING_RECIPE_VERSION = 1;
+const isPlainRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+function canonicalStrings(v) {
+    if (v === undefined)
+        return undefined;
+    if (!Array.isArray(v))
+        return null;
+    for (let i = 0; i < v.length; i++) {
+        if (!(i in v) || typeof v[i] !== "string")
+            return null;
+    }
+    return v.length === 0 ? undefined : v.slice();
+}
+function canonicalRuleSection(v) {
+    const list = canonicalStrings(v);
+    if (list === null || list === undefined)
+        return list;
+    let seen = false;
+    const deduped = list.filter((r) => (r === AUTO_MODE_DEFAULTS_SENTINEL ? (seen ? false : ((seen = true), true)) : true));
+    if (deduped.length === 0)
+        return undefined;
+    return deduped.length === 1 && deduped[0] === AUTO_MODE_DEFAULTS_SENTINEL ? undefined : deduped;
+}
+function canonicalNumber(v, min, floor) {
+    if (v === undefined)
+        return undefined;
+    if (typeof v !== "number" || !Number.isFinite(v))
+        return null;
+    const n = floor ? Math.floor(v) : v;
+    return n < min ? null : n;
+}
+export function sanitizeAutoModeArmingRecipe(value) {
+    if (!isPlainRecord(value))
+        return undefined;
+    if (value.v !== AUTO_MODE_ARMING_RECIPE_VERSION)
+        return undefined;
+    const settingsDenyRules = canonicalStrings(value.settingsDenyRules);
+    const sessionContext = canonicalStrings(value.sessionContext);
+    const timeoutMs = canonicalNumber(value.timeoutMs, 1, false);
+    const failureThreshold = canonicalNumber(value.failureThreshold, 1, true);
+    if (settingsDenyRules === null || sessionContext === null || timeoutMs === null || failureThreshold === null)
+        return undefined;
+    let rules;
+    if (value.rules !== undefined) {
+        if (!isPlainRecord(value.rules))
+            return undefined;
+        const allow = canonicalRuleSection(value.rules.allow);
+        const softDeny = canonicalRuleSection(value.rules.softDeny);
+        const hardDeny = canonicalRuleSection(value.rules.hardDeny);
+        const environment = canonicalRuleSection(value.rules.environment);
+        if (allow === null || softDeny === null || hardDeny === null || environment === null)
+            return undefined;
+        const merged = {
+            ...(allow !== undefined ? { allow } : {}),
+            ...(softDeny !== undefined ? { softDeny } : {}),
+            ...(hardDeny !== undefined ? { hardDeny } : {}),
+            ...(environment !== undefined ? { environment } : {}),
+        };
+        if (Object.keys(merged).length > 0)
+            rules = merged;
+    }
+    let window;
+    if (value.window !== undefined) {
+        if (!isPlainRecord(value.window))
+            return undefined;
+        const maxEntries = canonicalNumber(value.window.maxEntries, 0, true);
+        const maxCharsPerEntry = canonicalNumber(value.window.maxCharsPerEntry, 0, true);
+        if (maxEntries === null || maxCharsPerEntry === null)
+            return undefined;
+        const merged = {
+            ...(maxEntries !== undefined && maxEntries !== AUTO_MODE_DEFAULT_WINDOW_MAX_ENTRIES ? { maxEntries } : {}),
+            ...(maxCharsPerEntry !== undefined && maxCharsPerEntry !== AUTO_MODE_DEFAULT_WINDOW_MAX_CHARS ? { maxCharsPerEntry } : {}),
+        };
+        if (Object.keys(merged).length > 0)
+            window = merged;
+    }
+    const settingsEpoch = value.settingsEpoch;
+    if (settingsEpoch !== undefined && typeof settingsEpoch !== "string")
+        return undefined;
+    const promptDigest = value.promptDigest;
+    if (promptDigest !== undefined && (typeof promptDigest !== "string" || promptDigest === ""))
+        return undefined;
+    return {
+        v: AUTO_MODE_ARMING_RECIPE_VERSION,
+        ...(promptDigest !== undefined ? { promptDigest } : {}),
+        ...(rules !== undefined ? { rules } : {}),
+        ...(settingsDenyRules !== undefined ? { settingsDenyRules } : {}),
+        ...(sessionContext !== undefined ? { sessionContext } : {}),
+        ...(window !== undefined ? { window } : {}),
+        ...(timeoutMs !== undefined ? { timeoutMs } : {}),
+        ...(failureThreshold !== undefined ? { failureThreshold } : {}),
+        ...(settingsEpoch !== undefined && settingsEpoch !== "" ? { settingsEpoch } : {}),
+    };
+}
+export function autoModeArmingRecipeOf(face, bind) {
+    return sanitizeAutoModeArmingRecipe({
+        v: AUTO_MODE_ARMING_RECIPE_VERSION,
+        ...(bind?.promptDigest !== undefined ? { promptDigest: bind.promptDigest } : {}),
+        ...(face.rules !== undefined ? { rules: face.rules } : {}),
+        ...(face.settingsDenyRules !== undefined ? { settingsDenyRules: face.settingsDenyRules } : {}),
+        ...(face.sessionContext !== undefined ? { sessionContext: face.sessionContext } : {}),
+        ...(face.window !== undefined ? { window: face.window } : {}),
+        ...(face.timeoutMs !== undefined ? { timeoutMs: face.timeoutMs } : {}),
+        ...(face.failureThreshold !== undefined ? { failureThreshold: face.failureThreshold } : {}),
+        ...(face.settingsEpoch !== undefined ? { settingsEpoch: face.settingsEpoch } : {}),
+    });
+}
+function sameArmingBody(a, b) {
+    const body = (r) => JSON.stringify([
+        r.rules?.allow ?? null,
+        r.rules?.softDeny ?? null,
+        r.rules?.hardDeny ?? null,
+        r.rules?.environment ?? null,
+        r.settingsDenyRules ?? null,
+        r.sessionContext ?? null,
+        r.window?.maxEntries ?? null,
+        r.window?.maxCharsPerEntry ?? null,
+    ]);
+    return body(a) === body(b);
+}
+export function foldAutoModeArming(recorded, current) {
+    const rec = sanitizeAutoModeArmingRecipe(recorded);
+    if (rec === undefined) {
+        return {
+            ok: false,
+            reason: "malformed_recipe",
+            message: "the recorded auto-mode arming recipe is not readable by this build (unknown recipe version, or not plain recipe data) — " +
+                "no classifier is rebuilt; the redemption keeps its honest refusal and the inherited ask flows the original chain",
+        };
+    }
+    if (current === undefined) {
+        return {
+            ok: false,
+            reason: "current_settings_missing",
+            message: "no current auto-mode settings were declared for this rebuild, so nothing bounds it — the recorded arming is refused " +
+                "rather than rebuilt unbounded (pass the redeeming deployment's own face through autoModeArmingRecipeOf; a deployment " +
+                "with no overrides of its own still declares that, and the declaration is what the bound is made of)",
+        };
+    }
+    const cur = sanitizeAutoModeArmingRecipe(current);
+    if (cur === undefined) {
+        return {
+            ok: false,
+            reason: "malformed_current_settings",
+            message: "the redeeming deployment's own auto-mode settings did not canonicalize into a recipe, so the recorded arming cannot be " +
+                "bounded by the settings in force — no classifier is rebuilt (fail-closed: an unbounded rebuild is the one outcome this fold exists to prevent)",
+        };
+    }
+    if (!sameArmingBody(rec, cur)) {
+        const sameEpoch = rec.settingsEpoch !== undefined && rec.settingsEpoch === cur.settingsEpoch;
+        return sameEpoch
+            ? {
+                ok: false,
+                reason: "epoch_inconsistent",
+                message: `the recorded arming and the current settings both declare settings epoch ${JSON.stringify(rec.settingsEpoch)} while their ` +
+                    "prompt bodies differ — one of the two is mislabelled; refusing to rebuild rather than choosing which set of rules is the policy in force",
+            }
+            : {
+                ok: false,
+                reason: "settings_moved",
+                message: "the auto-mode settings moved between the recorded arming and this deployment's current ones (rule sections / settings-deny rules / " +
+                    "session context / window bounds differ), and free-text rule sets have no sound stricter-than ordering — refusing to rebuild " +
+                    "(the strictest decidable answer: the inherited ask flows the original chain to a human)",
+            };
+    }
+    const minKnob = (a, b, fallback) => Math.min(a ?? fallback, b ?? fallback);
+    const timeoutMs = minKnob(rec.timeoutMs, cur.timeoutMs, AUTO_MODE_DEFAULT_TIMEOUT_MS);
+    const failureThreshold = minKnob(rec.failureThreshold, cur.failureThreshold, AUTO_MODE_DEFAULT_FAILURE_THRESHOLD);
+    return {
+        ok: true,
+        recorded: rec,
+        effective: {
+            ...rec,
+            timeoutMs,
+            failureThreshold,
+            ...(cur.settingsEpoch !== undefined ? { settingsEpoch: cur.settingsEpoch } : {}),
+        },
+        tightened: timeoutMs < (rec.timeoutMs ?? AUTO_MODE_DEFAULT_TIMEOUT_MS) || failureThreshold < (rec.failureThreshold ?? AUTO_MODE_DEFAULT_FAILURE_THRESHOLD),
+    };
+}

package/dist/core/auto-mode-defaults.d.ts

@@ -0,0 +1,13 @@
+/** Hard cap on one classification round-trip when `AutoModeDeciderOptions.timeoutMs` is omitted. */
+export declare const AUTO_MODE_DEFAULT_TIMEOUT_MS = 15000;
+/** Consecutive-failure streak that opens the session breaker when `failureThreshold` is omitted. */
+export declare const AUTO_MODE_DEFAULT_FAILURE_THRESHOLD = 3;
+/** Newest transcript entries in the classify window when `AutoModeWindowOptions.maxEntries` is omitted. */
+export declare const AUTO_MODE_DEFAULT_WINDOW_MAX_ENTRIES = 40;
+/** Per-entry excerpt cap when `AutoModeWindowOptions.maxCharsPerEntry` is omitted. */
+export declare const AUTO_MODE_DEFAULT_WINDOW_MAX_CHARS = 2000;
+/** The sentinel a deployment puts INSIDE a paired rule list to splice the CC default rules back in at
+ *  that position (CC `XYt = "$defaults"`). It lives here, beside the other defaults, because the #503
+ *  recipe canonicalizer needs its VALUE and must not load the assembly face (and its SHA-locked assets)
+ *  to get it; `auto-mode-prompt.js` re-exports it, so the public name and its module face are unchanged. */
+export declare const AUTO_MODE_DEFAULTS_SENTINEL = "$defaults";

package/dist/core/auto-mode-defaults.js

@@ -0,0 +1,5 @@
+export const AUTO_MODE_DEFAULT_TIMEOUT_MS = 15_000;
+export const AUTO_MODE_DEFAULT_FAILURE_THRESHOLD = 3;
+export const AUTO_MODE_DEFAULT_WINDOW_MAX_ENTRIES = 40;
+export const AUTO_MODE_DEFAULT_WINDOW_MAX_CHARS = 2_000;
+export const AUTO_MODE_DEFAULTS_SENTINEL = "$defaults";

package/dist/core/auto-mode-prompt.d.ts

@@ -1,8 +1,10 @@
 import type { AutoModeClassifyInput } from "./auto-mode.js";
 import type { Message } from "../internal/llm.js";
 /** The sentinel a deployment puts INSIDE a rule list to splice the CC default rules back in at that
- *  position (CC `XYt = "$defaults"`). Without it, a non-empty user list REPLACES the default section. */
-export declare const AUTO_MODE_DEFAULTS_SENTINEL = "$defaults";
+ *  position (CC `XYt = "$defaults"`). Without it, a non-empty user list REPLACES the default section.
+ *  DECLARED in `./auto-mode-defaults.js` (the leaf the #503 recipe canonicalizer can reach without
+ *  loading these assets) and re-exported here, where every caller already looks for it. */
+export { AUTO_MODE_DEFAULTS_SENTINEL } from "./auto-mode-defaults.js";
 /** Deployment-authored rule overrides for the four paired sections of the permissions document.
  *  Each entry is ONE rule (rendered as a `- ` bullet); omit a field (or pass an empty array) to keep
  *  the CC default rules for that section verbatim. */
@@ -29,7 +31,8 @@ export interface BuildAutoModePromptOptions {
  */
 export declare function buildAutoModePrompt(options?: BuildAutoModePromptOptions): string;
 export interface AutoModeWindowOptions {
-    /** Newest transcript entries included (default 40). */
+    /** Newest transcript entries INCLUDED (default 40). Zero includes none — the classifier judges the
+     *  action with no run history, and the omission line still names every entry left out. */
     maxEntries?: number;
     /** Per-entry excerpt cap in characters (default 2_000 — tool results and long turns are truncated
      *  head-first with a `[… N chars truncated]` marker; the classifier weighs shape over bulk). */
@@ -39,6 +42,14 @@ export interface AutoModeWindowOptions {
  * Render the transcript window half of the classifier's user prompt: the newest `maxEntries` messages,
  * oldest→newest, each labeled by lane. Plain data — see the module header for the declared v1 gap vs
  * CC's entry-formatter stack.
+ *
+ * `maxEntries` counts the entries INCLUDED, so a bound of zero includes none and says so. That case is
+ * handled explicitly rather than left to `slice`: `slice(-0)` is `slice(0)`, i.e. the WHOLE transcript,
+ * which inverts a declared bound into "unbounded" — and silently, because the omitted count would then
+ * be zero and the omission header would not render either. The recipe canonicalizer admits zero for both
+ * window knobs deliberately (its sibling knobs use a minimum of one), so a deployment can genuinely
+ * declare "classify the action with no transcript context"; a negative bound is not a coherent window
+ * either and takes the same arm rather than `slice`'s "drop the oldest N".
  */
 export declare function renderAutoModeWindow(messages: readonly Message[], options?: AutoModeWindowOptions): string;
 /**

package/dist/core/auto-mode-prompt.js

@@ -1,6 +1,7 @@
+import { AUTO_MODE_DEFAULT_WINDOW_MAX_CHARS, AUTO_MODE_DEFAULT_WINDOW_MAX_ENTRIES, AUTO_MODE_DEFAULTS_SENTINEL } from "./auto-mode-defaults.js";
 import { AUTO_MODE_BASE_PROMPT, AUTO_MODE_PERMISSIONS_EXTERNAL } from "./auto-mode-prompt-assets.js";
 import { cutEnginePrefix, cutEngineSegments, flattenableUserText } from "./untrusted-text.js";
-export const AUTO_MODE_DEFAULTS_SENTINEL = "$defaults";
+export { AUTO_MODE_DEFAULTS_SENTINEL } from "./auto-mode-defaults.js";
 function mergeRuleSection(user, defaultsInner) {
     if (!user?.length)
         return defaultsInner;
@@ -98,14 +99,16 @@ function renderEntry(m, cap) {
     return `[assistant]\n${parts.join("\n")}`;
 }
 export function renderAutoModeWindow(messages, options) {
-    const maxEntries = options?.maxEntries ?? 40;
-    const cap = options?.maxCharsPerEntry ?? 2_000;
-    const window = messages.slice(-maxEntries);
-    if (window.length === 0)
+    const maxEntries = options?.maxEntries ?? AUTO_MODE_DEFAULT_WINDOW_MAX_ENTRIES;
+    const cap = options?.maxCharsPerEntry ?? AUTO_MODE_DEFAULT_WINDOW_MAX_CHARS;
+    const window = maxEntries > 0 ? messages.slice(-maxEntries) : [];
+    if (messages.length === 0)
         return "(transcript empty — this is the run's first gated action)\n";
     const dropped = messages.length - window.length;
-    const head = dropped > 0 ? `(… ${dropped} earlier transcript entries omitted)\n\n` : "";
-    return head + window.map((m) => renderEntry(m, cap)).join("\n\n") + "\n";
+    const head = dropped > 0 ? `(… ${dropped} earlier transcript entries omitted)\n` : "";
+    if (window.length === 0)
+        return head;
+    return `${head}${head === "" ? "" : "\n"}${window.map((m) => renderEntry(m, cap)).join("\n\n")}\n`;
 }
 export function renderAutoModeAction(input) {
     const ask = input.askMessage ? `\npermission gate: ${input.askMessage}` : "";

package/dist/core/auto-mode-rebuild.d.ts

@@ -0,0 +1,75 @@
+import { type AutoModeDecider, type AutoModeDeciderOptions } from "./auto-mode.js";
+import { type AutoModeArmingRecipe, type AutoModeRebuildRefusal } from "./auto-mode-arming.js";
+import type { Message } from "../internal/llm.js";
+/** The redeeming deployment's FRESH model leg: one tool-less completion over a prompt CORE assembles.
+ *  The split is the trust gate's: rules reach the prompt only through the recipe (a deployment-authored
+ *  object), never through the leg — the leg dispatches, it does not compose. */
+export type AutoModeClassifierCompletion = (call: {
+    systemPrompt: string;
+    userPrompt: string;
+}, signal?: AbortSignal) => Promise<string>;
+export interface AutoModeRebuildOptions {
+    /** The recipe read off the parked chain entry (`ConstraintChainEntryMeta.autoModeArming`). */
+    recorded: unknown;
+    /** The redeeming deployment's CURRENT auto-mode settings, minted with `autoModeArmingRecipeOf` from
+     *  its own face. REQUIRED: bound ② is "the rebuilt arming is bounded by the settings in force", and a
+     *  caller that declares none has put nothing in force — see {@link foldAutoModeArming}. A deployment
+     *  with no overrides of its own still declares that (an empty face mints a bare recipe). */
+    current: unknown;
+    /** The fresh model leg. */
+    complete: AutoModeClassifierCompletion;
+    /**
+     * The transcript the classifier judges the action IN CONTEXT of — the REDEEMING leg's own messages,
+     * read at classify time (the window is rebuilt per classification, exactly as the live arming does).
+     *
+     * REQUIRED, and the reason is a permissiveness one rather than a quality one: the 207 process judges an
+     * action against the run that produced it (session linking, earlier writes), so a classifier handed no
+     * history can allow what the same classifier would block having seen it — and the empty window renders
+     * an affirmative claim, "this is the run's first gated action", that would simply be false. A provider
+     * that returns `[]` is DECLARING the transcript empty, which is a different statement from an engine
+     * that silently had none to show. A provider that throws fails the classification closed
+     * (`unavailable` ⇒ the original chain), never into a blind verdict.
+     */
+    transcript: () => readonly Message[] | Promise<readonly Message[]>;
+    /** The redeeming process's breaker alarm (the recorded arming cannot carry the ancestor's closure). */
+    onBreakerOpen?: AutoModeDeciderOptions["onBreakerOpen"];
+}
+export type AutoModeRebuildResult = {
+    ok: true;
+    /** A decider carrying the ancestor's criteria, over the caller's model leg. */
+    decider: AutoModeDecider;
+    /**
+     * The RECORDED recipe, canonical — put THIS back on the re-supplied chain entry
+     * (`parentConstraints[].autoMode.arming`) so the constraint-chain digest matches the parked row.
+     * Deliberately not `effective`: the digest binds what the ANCESTOR recorded, and a local tighten
+     * must not read as a different ancestor chain.
+     */
+    arming: AutoModeArmingRecipe;
+    /** What the rebuilt decider actually runs under (the tighten-only fold of recorded ∧ current). */
+    effective: AutoModeArmingRecipe;
+    /** True iff the current settings pulled a knob in. */
+    tightened: boolean;
+} | {
+    ok: false;
+    reason: AutoModeRebuildRefusal;
+    message: string;
+};
+/**
+ * Rebuild a decider with a PARKED ancestor's criteria from its recorded recipe plus a fresh model leg.
+ *
+ * What is reproduced: the assembled system prompt (`buildAutoModePrompt` over the recorded rule
+ * overrides / settings-deny rules / session context), the transcript-window bounds, the round-trip
+ * timeout and the breaker threshold — i.e. every input the ancestor's own `createAutoModeDecider` call
+ * had except the model leg and the alarm closure.
+ *
+ * What is NOT reproduced, deliberately: the ancestor's BREAKER STATE. The rebuilt decider starts closed,
+ * and that is sound only because a recipe is never recorded from a decider whose breaker is open OR whose
+ * failure streak is non-zero (bound ①, at the persistence point) — either state means the ancestor's own
+ * budget was spent or spending, and the row then carries no recipe at all.
+ *
+ * Also NOT reproduced: this build's PROMPT ASSETS are its own. The recipe records the deployment's
+ * overrides, so the assembled prompt is checked against the digest the arming recorded — a fleet running
+ * two asset versions refuses to rebuild rather than enforce a different set of default rules under the
+ * ancestor's name.
+ */
+export declare function rebuildAutoModeDecider(opts: AutoModeRebuildOptions): AutoModeRebuildResult;

package/dist/core/auto-mode-rebuild.js

@@ -0,0 +1,41 @@
+import { createHash } from "node:crypto";
+import { createAutoModeDecider } from "./auto-mode.js";
+import { buildAutoModePrompt, renderAutoModeAction, renderAutoModeWindow } from "./auto-mode-prompt.js";
+import { foldAutoModeArming, } from "./auto-mode-arming.js";
+export function rebuildAutoModeDecider(opts) {
+    const folded = foldAutoModeArming(opts.recorded, opts.current);
+    if (!folded.ok)
+        return folded;
+    const effective = folded.effective;
+    const promptOptions = {
+        ...(effective.rules !== undefined ? { rules: effective.rules } : {}),
+        ...(effective.settingsDenyRules !== undefined ? { settingsDenyRules: effective.settingsDenyRules } : {}),
+        ...(effective.sessionContext !== undefined ? { sessionContext: effective.sessionContext } : {}),
+    };
+    const systemPrompt = buildAutoModePrompt(promptOptions);
+    const assembledDigest = `apv1:${createHash("sha256").update(systemPrompt).digest("hex")}`;
+    if (folded.recorded.promptDigest !== assembledDigest) {
+        return {
+            ok: false,
+            reason: "prompt_assets_moved",
+            message: folded.recorded.promptDigest === undefined
+                ? "the recorded arming carries no classifier-prompt digest, so this build cannot establish that the prompt it assembles is " +
+                    "the one the ancestor enforced (the recipe records overrides; the base shell and permissions document come from the build's " +
+                    "own assets) — refusing to rebuild rather than enforce criteria that may not be the ancestor's"
+                : "this build assembles a DIFFERENT classifier prompt than the recorded arming did (prompt-asset version skew across the fleet: " +
+                    `recorded ${folded.recorded.promptDigest}, assembled here ${assembledDigest}) — the overrides match but the default rules they ` +
+                    "merge into do not, so the rebuilt classifier would enforce criteria the ancestor never ran; refusing to rebuild",
+        };
+    }
+    const decider = createAutoModeDecider({
+        ...(effective.timeoutMs !== undefined ? { timeoutMs: effective.timeoutMs } : {}),
+        ...(effective.failureThreshold !== undefined ? { failureThreshold: effective.failureThreshold } : {}),
+        ...(opts.onBreakerOpen !== undefined ? { onBreakerOpen: opts.onBreakerOpen } : {}),
+        classify: async (input, signal) => {
+            const messages = await opts.transcript();
+            const userPrompt = renderAutoModeWindow(messages, effective.window) + renderAutoModeAction(input);
+            return opts.complete({ systemPrompt, userPrompt }, signal);
+        },
+    });
+    return { ok: true, decider, arming: folded.recorded, effective, tightened: folded.tightened };
+}

package/dist/core/auto-mode.d.ts

@@ -77,6 +77,21 @@ export interface AutoModeDecider {
     /** True once the session breaker has opened (it never half-opens: is a SESSION fallback
      *  to non-auto, not a retry window — a flapping classifier must not oscillate the permission mode). */
     breakerOpen(): boolean;
+    /**
+     * The CURRENT consecutive-failure streak — the part of the breaker's state that `breakerOpen()` alone
+     * cannot express. A latch that has not tripped yet still carries how much budget is left before it
+     * does, and #503 needs exactly that: an arming recorded for cross-process rebuild starts a FRESH
+     * decider, so recording one from a decider that is already 2 failures into a threshold of 3 would hand
+     * the redemption more tolerance for a failing classifier than the ancestor had left — the redeemed leg
+     * stays auto-classified through failures that would have dropped the ancestor back to non-auto.
+     * {@link import("./tool-policy.js").constraintChainEntryOfLayer} therefore records an arming only at a
+     * ZERO streak, and reads a decider that does not implement this member as unknown (⇒ records nothing).
+     *
+     * OPTIONAL so that hand-built deciders keep type-checking; the engine's own
+     * {@link createAutoModeDecider} always implements it. A deployment that hand-rolls a decider and wants
+     * the persisted-arming path must implement it too — the conservative reading of absence is deliberate.
+     */
+    consecutiveFailures?(): number;
 }
 /**
  * Session-scoped decider: timeout + fail-closed error mapping + a one-way circuit breaker.

package/dist/core/auto-mode.js

@@ -1,3 +1,4 @@
+import { AUTO_MODE_DEFAULT_FAILURE_THRESHOLD, AUTO_MODE_DEFAULT_TIMEOUT_MS } from "./auto-mode-defaults.js";
 export function parseAutoModeResponse(text) {
     const t = text
         .replace(/<thinking>[\s\S]*?<\/thinking>/g, "")
@@ -16,8 +17,8 @@ export function parseAutoModeResponse(text) {
     return { kind: "block", category, reason };
 }
 export function createAutoModeDecider(opts) {
-    const timeoutMs = opts.timeoutMs ?? 15_000;
-    const threshold = Math.max(1, Math.floor(opts.failureThreshold ?? 3));
+    const timeoutMs = opts.timeoutMs ?? AUTO_MODE_DEFAULT_TIMEOUT_MS;
+    const threshold = Math.max(1, Math.floor(opts.failureThreshold ?? AUTO_MODE_DEFAULT_FAILURE_THRESHOLD));
     let consecutiveFailures = 0;
     let open = false;
     const recordFailure = (cause) => {
@@ -33,6 +34,7 @@ export function createAutoModeDecider(opts) {
     };
     return {
         breakerOpen: () => open,
+        consecutiveFailures: () => consecutiveFailures,
         async decide(input, signal) {
             if (open)
                 return { kind: "unavailable", cause: "breaker_open" };

package/dist/core/checkpoint-store.d.ts

@@ -768,6 +768,24 @@ export type PendingAction = {
      *  original-index preservation. The park→resume redemption chain walks the same consent
      *  protocol as the synchronous card — there is no second form. */
     ruleOffers?: readonly import("./permission-rule-model.js").RuleOffer[];
+    /** #490 修② (additive; no checkpoint-version bump — the `previewWithheld`/`hasBidiControls`
+     *  precedents above: an optional field an older reader ignores and the resume path never reads)
+     *  — the PARK twin of `AskRequest.ruleOffersAbsence`, minted by the SAME one factory as
+     *  {@link ruleOffers} so the parked card and the live card cannot answer differently. Present ⇔
+     *  the rule-offer lane is in play for this call and has nothing to give, naming which door
+     *  closed: `"mandated"` (no persisted rule could ever clear this ask — a real-approval demand,
+     *  the tool's own mandate marks, a hook-raised ask, an ancestor's authority, or — #502 — a
+     *  demotion this CALL's reversibility probe declared structural, which for the built-in shell
+     *  probe means a read outside the directories the session declared; an inbox must NOT point at
+     *  rule-writing on this arm, nor at a directory grant, which does not exist in this version),
+     *  `"shadowed"` (a rule the person already wrote is
+     *  speaking and does not clear it), `"lane_cannot_speak"` (this card has no rule to offer — the
+     *  grammar has no text for the command, or the card's array-order contract declines to present
+     *  the one text that exists; it is NOT a claim that no rule could ever be written).
+     *  Mutually exclusive with {@link ruleOffers}. ABSENCE is not a claim — it also covers
+     *  "there are offers" and the structural doors (no lane wired, another tool, a task that cannot
+     *  hold a rule) — so read presence. See the synchronous seat's doc for the full contract. */
+    ruleOffersAbsence?: "mandated" | "lane_cannot_speak" | "shadowed";
     /**
      * design/80 D-1 §2 (slice 1a.2): the server-minted **opaque** boundInputHash of {@link args} — a
      * SHA-256 (hex) via {@link import("./canonical-json.js").boundInputHashOf}, computed ONCE here at
@@ -1160,6 +1178,43 @@ export interface CheckpointState {
      * delegated child (never `false` — presence-coded like the other monotonic bits here).
      */
     isDelegatedChild?: true;
+    /**
+     * design/380 O1③ — the run TREE's placement fixed point at suspend: the SAME three-segment fold the
+     * env-factory ctx mint uses (explicit `RunInternals.placementRoot` > the delegation lanes'
+     * `rootSessionId` > the leg's own resolved session), stamped from TRUSTED internals so a durable
+     * resume can restore it instead of falling back to the parked leg's own session (a target-bound
+     * factory keys its placement lookup on the fixed point — the self fallback read a resumed leg as a
+     * NEW placement). Restore is the `isDelegatedChild` posture replayed on the placement axis: an
+     * EXPLICIT live `internals.placementRoot` wins when re-supplied; otherwise THIS key restores into
+     * `internals.placementRoot` at prepare so descendants and the NEXT re-suspend mint inherit it too
+     * — outranking a supplied `rootSessionId`, which is DELEGATION IDENTITY (the peer/registry axis a
+     * revive leg re-supplies from its row), never a placement claim (rescan C1: reading it as one
+     * permanently stuck every parked agent spawned under an explicit placement root). The resume entry
+     * ALSO reads this key as an identity record: a resume whose supplied `internals.placementRoot`
+     * CONTRADICTS it is refused pre-CAS (`resume.placement_mismatch`); either side absent skips the
+     * check (an older row / a claim-less resume — the honest degradation arm), and `""` reads as
+     * absence (the identity fields' discipline). Schema ADDITION (additive, old readers ignore it — the Q5 posture;
+     * deliberately NOT version-gated: same rolling-deployment account as {@link Checkpoint.principal},
+     * whose doc records version-gating as a design candidate — any new stamp is a lattice-wide window
+     * rewrite, owned by that ticket, not ad-hoc here). Absent ⇒ minted before the field, or the fold
+     * resolved empty on a factory-less run (never persisted as garbage).
+     */
+    placementRootSessionId?: string;
+    /**
+     * design/380 O9a — MONOTONIC presence bit: this run's hand-tool content fold was EXTERNAL-TARGET
+     * armed (the env declared `ExecutionEnv.externalContentTarget`, or an earlier leg of this suspend
+     * chain did). Stamped at the suspend mint from the run's RESOLVED fold state — never from first
+     * tool use, so a park landing BEFORE the first hand call is covered too. Presence-coded like
+     * {@link isDelegatedChild} (absent = never armed; never `false`). The resume side folds
+     * **persisted OR live declaration** (a monotonic join, never a downgrade): a run minted under a
+     * declaring adapter keeps its memory fold and its prompt disclosure when resumed on an
+     * undeclared/older adapter — the downgrade is closed in the derivation itself, deliberately
+     * WITHOUT a new refusal arm (one fewer failure path, same safety). Feeds the memory face and the
+     * prompt disclosure only — no gate/policy/roster behavior reads it (the design/378 red line).
+     * Schema ADDITION (additive, Q5 posture; the version-gate residual is shared with
+     * {@link placementRootSessionId} above and owned by the same version-lattice ticket).
+     */
+    externalContentTarget?: true;
 }
 /**
  * {@link CheckpointState} with **every** field made required-PRESENT, while each value keeps its original
@@ -1869,6 +1924,30 @@ export declare class CheckpointError extends Error {
      *  refusal exists to close. Rejected PRE-CAS (the checkpoint stays `pending`); re-resume with the
      *  original principal, or omit the field to inherit the recorded one. */
      | "resume.principal_mismatch"
+    /** design/380 O1③ (placement identity continuity — the `resume.principal_mismatch` rung's twin
+     *  on the placement axis): the resume supplied trusted internals whose EXPLICIT
+     *  `placementRoot` differs from the {@link CheckpointState.placementRootSessionId} recorded at
+     *  the suspend mint. A target-bound env factory keys its placement lookup on that fixed point,
+     *  so silently resuming under a different one would re-place the leg — and every descendant
+     *  the child-internals chain hands it to — on another target than the parked workspace lives
+     *  on. A supplied `rootSessionId` deliberately does NOT take this refusal (rescan C1): it is
+     *  delegation identity, re-supplied by every revive leg, and legitimately differs from the
+     *  recorded root whenever the spawner carried an explicit placement — the recorded root simply
+     *  outranks it in prepare's restore fold. Rejected PRE-CAS (the checkpoint stays `pending`);
+     *  re-resume with the recorded root, or omit `internals.placementRoot` to inherit it. Either
+     *  side absent (an older row / a claim-less resume) skips the check, and `""` reads as absence
+     *  — the honest degradation arm. */
+     | "resume.placement_mismatch"
+    /** design/380 O2: the deployment's `RunnerDeps.resumePreflight` refused this resume — an
+     *  explicit refusal verdict, a throw, a timeout past its bounded deadline, or an unreadable
+     *  answer (all fail-closed). The LAST rung before the CAS, so nothing was consumed. Two arms,
+     *  discriminated by the message: the default `retry_later` arm leaves the checkpoint `pending`
+     *  and the SAME token redeemable once the obstacle clears (`detail.retryAfterMs` carries the
+     *  deployment's wait hint when it gave one — the #449 G1 carrier); the explicit `terminal` arm
+     *  has ALREADY settled the row out of `pending` via the single-shot `expire` CAS (reaper
+     *  parity) before this throw — the token is NOT redeemable, by the deployment's own permanent
+     *  verdict (a dead binding must not be redialed forever). */
+     | "resume.preflight_rejected"
     /** F-012 L3: the resume carried an approver EDIT (`updatedInput`) and a FROZEN inherited ancestor
      *  constraint (the persisted projection chain) — or the deployment's resume-edit policy — DENIES the
      *  edited args. Refused PRE-CAS with fresh-redecision semantics: the checkpoint stays `pending` and
@@ -1896,8 +1975,11 @@ export declare class CheckpointError extends Error {
      *  discriminant. */
     readonly detail?: {
         field?: "boundCallId" | "boundInputHash" | "answer" | "settledBy" | "approver";
-        /** #449 G1 — on `resume.usage_window_exhausted` ONLY: how long until the binding window frees
-         *  (the same wait a suspended row carries as `gate.resumeAfterMs`). Absent on every other code. */
+        /** #449 G1 — on `resume.usage_window_exhausted`: how long until the binding window frees
+         *  (the same wait a suspended row carries as `gate.resumeAfterMs`). design/380 O2 — on a
+         *  retry-later `resume.preflight_rejected`: the deployment preflight's own wait hint, when it
+         *  gave one (same carrier, same semantics: retry the SAME token after the wait). Absent on
+         *  every other code. */
         retryAfterMs?: number;
         /** WHICH pre-CAS refusal arm fired, where one `code` covers several (requested 2026-08-10: a
          *  deployment retry policy needs to tell "a newer worker can redeem this row" from "this row is
@@ -2024,6 +2106,30 @@ export declare class CheckpointError extends Error {
      *  refusal exists to close. Rejected PRE-CAS (the checkpoint stays `pending`); re-resume with the
      *  original principal, or omit the field to inherit the recorded one. */
      | "resume.principal_mismatch"
+    /** design/380 O1③ (placement identity continuity — the `resume.principal_mismatch` rung's twin
+     *  on the placement axis): the resume supplied trusted internals whose EXPLICIT
+     *  `placementRoot` differs from the {@link CheckpointState.placementRootSessionId} recorded at
+     *  the suspend mint. A target-bound env factory keys its placement lookup on that fixed point,
+     *  so silently resuming under a different one would re-place the leg — and every descendant
+     *  the child-internals chain hands it to — on another target than the parked workspace lives
+     *  on. A supplied `rootSessionId` deliberately does NOT take this refusal (rescan C1): it is
+     *  delegation identity, re-supplied by every revive leg, and legitimately differs from the
+     *  recorded root whenever the spawner carried an explicit placement — the recorded root simply
+     *  outranks it in prepare's restore fold. Rejected PRE-CAS (the checkpoint stays `pending`);
+     *  re-resume with the recorded root, or omit `internals.placementRoot` to inherit it. Either
+     *  side absent (an older row / a claim-less resume) skips the check, and `""` reads as absence
+     *  — the honest degradation arm. */
+     | "resume.placement_mismatch"
+    /** design/380 O2: the deployment's `RunnerDeps.resumePreflight` refused this resume — an
+     *  explicit refusal verdict, a throw, a timeout past its bounded deadline, or an unreadable
+     *  answer (all fail-closed). The LAST rung before the CAS, so nothing was consumed. Two arms,
+     *  discriminated by the message: the default `retry_later` arm leaves the checkpoint `pending`
+     *  and the SAME token redeemable once the obstacle clears (`detail.retryAfterMs` carries the
+     *  deployment's wait hint when it gave one — the #449 G1 carrier); the explicit `terminal` arm
+     *  has ALREADY settled the row out of `pending` via the single-shot `expire` CAS (reaper
+     *  parity) before this throw — the token is NOT redeemable, by the deployment's own permanent
+     *  verdict (a dead binding must not be redialed forever). */
+     | "resume.preflight_rejected"
     /** F-012 L3: the resume carried an approver EDIT (`updatedInput`) and a FROZEN inherited ancestor
      *  constraint (the persisted projection chain) — or the deployment's resume-edit policy — DENIES the
      *  edited args. Refused PRE-CAS with fresh-redecision semantics: the checkpoint stays `pending` and
@@ -2051,8 +2157,11 @@ export declare class CheckpointError extends Error {
      *  discriminant. */
     detail?: {
         field?: "boundCallId" | "boundInputHash" | "answer" | "settledBy" | "approver";
-        /** #449 G1 — on `resume.usage_window_exhausted` ONLY: how long until the binding window frees
-         *  (the same wait a suspended row carries as `gate.resumeAfterMs`). Absent on every other code. */
+        /** #449 G1 — on `resume.usage_window_exhausted`: how long until the binding window frees
+         *  (the same wait a suspended row carries as `gate.resumeAfterMs`). design/380 O2 — on a
+         *  retry-later `resume.preflight_rejected`: the deployment preflight's own wait hint, when it
+         *  gave one (same carrier, same semantics: retry the SAME token after the wait). Absent on
+         *  every other code. */
         retryAfterMs?: number;
         /** WHICH pre-CAS refusal arm fired, where one `code` covers several (requested 2026-08-10: a
          *  deployment retry policy needs to tell "a newer worker can redeem this row" from "this row is