@sema-agent/core 5.65.0 → 7.0.0

package/dist/core/auto-mode-arming.js

@@ -0,0 +1,181 @@
+import { AUTO_MODE_DEFAULT_FAILURE_THRESHOLD, AUTO_MODE_DEFAULT_TIMEOUT_MS, AUTO_MODE_DEFAULT_WINDOW_MAX_CHARS, AUTO_MODE_DEFAULT_WINDOW_MAX_ENTRIES, AUTO_MODE_DEFAULTS_SENTINEL, } from "./auto-mode-defaults.js";
+export const AUTO_MODE_ARMING_RECIPE_VERSION = 1;
+const isPlainRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+function canonicalStrings(v) {
+    if (v === undefined)
+        return undefined;
+    if (!Array.isArray(v))
+        return null;
+    for (let i = 0; i < v.length; i++) {
+        if (!(i in v) || typeof v[i] !== "string")
+            return null;
+    }
+    return v.length === 0 ? undefined : v.slice();
+}
+function canonicalRuleSection(v) {
+    const list = canonicalStrings(v);
+    if (list === null || list === undefined)
+        return list;
+    let seen = false;
+    const deduped = list.filter((r) => (r === AUTO_MODE_DEFAULTS_SENTINEL ? (seen ? false : ((seen = true), true)) : true));
+    if (deduped.length === 0)
+        return undefined;
+    return deduped.length === 1 && deduped[0] === AUTO_MODE_DEFAULTS_SENTINEL ? undefined : deduped;
+}
+function canonicalNumber(v, min, floor) {
+    if (v === undefined)
+        return undefined;
+    if (typeof v !== "number" || !Number.isFinite(v))
+        return null;
+    const n = floor ? Math.floor(v) : v;
+    return n < min ? null : n;
+}
+export function sanitizeAutoModeArmingRecipe(value) {
+    if (!isPlainRecord(value))
+        return undefined;
+    if (value.v !== AUTO_MODE_ARMING_RECIPE_VERSION)
+        return undefined;
+    const settingsDenyRules = canonicalStrings(value.settingsDenyRules);
+    const sessionContext = canonicalStrings(value.sessionContext);
+    const timeoutMs = canonicalNumber(value.timeoutMs, 1, false);
+    const failureThreshold = canonicalNumber(value.failureThreshold, 1, true);
+    if (settingsDenyRules === null || sessionContext === null || timeoutMs === null || failureThreshold === null)
+        return undefined;
+    let rules;
+    if (value.rules !== undefined) {
+        if (!isPlainRecord(value.rules))
+            return undefined;
+        const allow = canonicalRuleSection(value.rules.allow);
+        const softDeny = canonicalRuleSection(value.rules.softDeny);
+        const hardDeny = canonicalRuleSection(value.rules.hardDeny);
+        const environment = canonicalRuleSection(value.rules.environment);
+        if (allow === null || softDeny === null || hardDeny === null || environment === null)
+            return undefined;
+        const merged = {
+            ...(allow !== undefined ? { allow } : {}),
+            ...(softDeny !== undefined ? { softDeny } : {}),
+            ...(hardDeny !== undefined ? { hardDeny } : {}),
+            ...(environment !== undefined ? { environment } : {}),
+        };
+        if (Object.keys(merged).length > 0)
+            rules = merged;
+    }
+    let window;
+    if (value.window !== undefined) {
+        if (!isPlainRecord(value.window))
+            return undefined;
+        const maxEntries = canonicalNumber(value.window.maxEntries, 0, true);
+        const maxCharsPerEntry = canonicalNumber(value.window.maxCharsPerEntry, 0, true);
+        if (maxEntries === null || maxCharsPerEntry === null)
+            return undefined;
+        const merged = {
+            ...(maxEntries !== undefined && maxEntries !== AUTO_MODE_DEFAULT_WINDOW_MAX_ENTRIES ? { maxEntries } : {}),
+            ...(maxCharsPerEntry !== undefined && maxCharsPerEntry !== AUTO_MODE_DEFAULT_WINDOW_MAX_CHARS ? { maxCharsPerEntry } : {}),
+        };
+        if (Object.keys(merged).length > 0)
+            window = merged;
+    }
+    const settingsEpoch = value.settingsEpoch;
+    if (settingsEpoch !== undefined && typeof settingsEpoch !== "string")
+        return undefined;
+    const promptDigest = value.promptDigest;
+    if (promptDigest !== undefined && (typeof promptDigest !== "string" || promptDigest === ""))
+        return undefined;
+    return {
+        v: AUTO_MODE_ARMING_RECIPE_VERSION,
+        ...(promptDigest !== undefined ? { promptDigest } : {}),
+        ...(rules !== undefined ? { rules } : {}),
+        ...(settingsDenyRules !== undefined ? { settingsDenyRules } : {}),
+        ...(sessionContext !== undefined ? { sessionContext } : {}),
+        ...(window !== undefined ? { window } : {}),
+        ...(timeoutMs !== undefined ? { timeoutMs } : {}),
+        ...(failureThreshold !== undefined ? { failureThreshold } : {}),
+        ...(settingsEpoch !== undefined && settingsEpoch !== "" ? { settingsEpoch } : {}),
+    };
+}
+export function autoModeArmingRecipeOf(face, bind) {
+    return sanitizeAutoModeArmingRecipe({
+        v: AUTO_MODE_ARMING_RECIPE_VERSION,
+        ...(bind?.promptDigest !== undefined ? { promptDigest: bind.promptDigest } : {}),
+        ...(face.rules !== undefined ? { rules: face.rules } : {}),
+        ...(face.settingsDenyRules !== undefined ? { settingsDenyRules: face.settingsDenyRules } : {}),
+        ...(face.sessionContext !== undefined ? { sessionContext: face.sessionContext } : {}),
+        ...(face.window !== undefined ? { window: face.window } : {}),
+        ...(face.timeoutMs !== undefined ? { timeoutMs: face.timeoutMs } : {}),
+        ...(face.failureThreshold !== undefined ? { failureThreshold: face.failureThreshold } : {}),
+        ...(face.settingsEpoch !== undefined ? { settingsEpoch: face.settingsEpoch } : {}),
+    });
+}
+function sameArmingBody(a, b) {
+    const body = (r) => JSON.stringify([
+        r.rules?.allow ?? null,
+        r.rules?.softDeny ?? null,
+        r.rules?.hardDeny ?? null,
+        r.rules?.environment ?? null,
+        r.settingsDenyRules ?? null,
+        r.sessionContext ?? null,
+        r.window?.maxEntries ?? null,
+        r.window?.maxCharsPerEntry ?? null,
+    ]);
+    return body(a) === body(b);
+}
+export function foldAutoModeArming(recorded, current) {
+    const rec = sanitizeAutoModeArmingRecipe(recorded);
+    if (rec === undefined) {
+        return {
+            ok: false,
+            reason: "malformed_recipe",
+            message: "the recorded auto-mode arming recipe is not readable by this build (unknown recipe version, or not plain recipe data) — " +
+                "no classifier is rebuilt; the redemption keeps its honest refusal and the inherited ask flows the original chain",
+        };
+    }
+    if (current === undefined) {
+        return {
+            ok: false,
+            reason: "current_settings_missing",
+            message: "no current auto-mode settings were declared for this rebuild, so nothing bounds it — the recorded arming is refused " +
+                "rather than rebuilt unbounded (pass the redeeming deployment's own face through autoModeArmingRecipeOf; a deployment " +
+                "with no overrides of its own still declares that, and the declaration is what the bound is made of)",
+        };
+    }
+    const cur = sanitizeAutoModeArmingRecipe(current);
+    if (cur === undefined) {
+        return {
+            ok: false,
+            reason: "malformed_current_settings",
+            message: "the redeeming deployment's own auto-mode settings did not canonicalize into a recipe, so the recorded arming cannot be " +
+                "bounded by the settings in force — no classifier is rebuilt (fail-closed: an unbounded rebuild is the one outcome this fold exists to prevent)",
+        };
+    }
+    if (!sameArmingBody(rec, cur)) {
+        const sameEpoch = rec.settingsEpoch !== undefined && rec.settingsEpoch === cur.settingsEpoch;
+        return sameEpoch
+            ? {
+                ok: false,
+                reason: "epoch_inconsistent",
+                message: `the recorded arming and the current settings both declare settings epoch ${JSON.stringify(rec.settingsEpoch)} while their ` +
+                    "prompt bodies differ — one of the two is mislabelled; refusing to rebuild rather than choosing which set of rules is the policy in force",
+            }
+            : {
+                ok: false,
+                reason: "settings_moved",
+                message: "the auto-mode settings moved between the recorded arming and this deployment's current ones (rule sections / settings-deny rules / " +
+                    "session context / window bounds differ), and free-text rule sets have no sound stricter-than ordering — refusing to rebuild " +
+                    "(the strictest decidable answer: the inherited ask flows the original chain to a human)",
+            };
+    }
+    const minKnob = (a, b, fallback) => Math.min(a ?? fallback, b ?? fallback);
+    const timeoutMs = minKnob(rec.timeoutMs, cur.timeoutMs, AUTO_MODE_DEFAULT_TIMEOUT_MS);
+    const failureThreshold = minKnob(rec.failureThreshold, cur.failureThreshold, AUTO_MODE_DEFAULT_FAILURE_THRESHOLD);
+    return {
+        ok: true,
+        recorded: rec,
+        effective: {
+            ...rec,
+            timeoutMs,
+            failureThreshold,
+            ...(cur.settingsEpoch !== undefined ? { settingsEpoch: cur.settingsEpoch } : {}),
+        },
+        tightened: timeoutMs < (rec.timeoutMs ?? AUTO_MODE_DEFAULT_TIMEOUT_MS) || failureThreshold < (rec.failureThreshold ?? AUTO_MODE_DEFAULT_FAILURE_THRESHOLD),
+    };
+}

package/dist/core/auto-mode-defaults.d.ts

@@ -0,0 +1,13 @@
+/** Hard cap on one classification round-trip when `AutoModeDeciderOptions.timeoutMs` is omitted. */
+export declare const AUTO_MODE_DEFAULT_TIMEOUT_MS = 15000;
+/** Consecutive-failure streak that opens the session breaker when `failureThreshold` is omitted. */
+export declare const AUTO_MODE_DEFAULT_FAILURE_THRESHOLD = 3;
+/** Newest transcript entries in the classify window when `AutoModeWindowOptions.maxEntries` is omitted. */
+export declare const AUTO_MODE_DEFAULT_WINDOW_MAX_ENTRIES = 40;
+/** Per-entry excerpt cap when `AutoModeWindowOptions.maxCharsPerEntry` is omitted. */
+export declare const AUTO_MODE_DEFAULT_WINDOW_MAX_CHARS = 2000;
+/** The sentinel a deployment puts INSIDE a paired rule list to splice the CC default rules back in at
+ *  that position (CC `XYt = "$defaults"`). It lives here, beside the other defaults, because the #503
+ *  recipe canonicalizer needs its VALUE and must not load the assembly face (and its SHA-locked assets)
+ *  to get it; `auto-mode-prompt.js` re-exports it, so the public name and its module face are unchanged. */
+export declare const AUTO_MODE_DEFAULTS_SENTINEL = "$defaults";

package/dist/core/auto-mode-defaults.js

@@ -0,0 +1,5 @@
+export const AUTO_MODE_DEFAULT_TIMEOUT_MS = 15_000;
+export const AUTO_MODE_DEFAULT_FAILURE_THRESHOLD = 3;
+export const AUTO_MODE_DEFAULT_WINDOW_MAX_ENTRIES = 40;
+export const AUTO_MODE_DEFAULT_WINDOW_MAX_CHARS = 2_000;
+export const AUTO_MODE_DEFAULTS_SENTINEL = "$defaults";

package/dist/core/auto-mode-prompt.d.ts

@@ -1,8 +1,10 @@
 import type { AutoModeClassifyInput } from "./auto-mode.js";
 import type { Message } from "../internal/llm.js";
 /** The sentinel a deployment puts INSIDE a rule list to splice the CC default rules back in at that
- *  position (CC `XYt = "$defaults"`). Without it, a non-empty user list REPLACES the default section. */
-export declare const AUTO_MODE_DEFAULTS_SENTINEL = "$defaults";
+ *  position (CC `XYt = "$defaults"`). Without it, a non-empty user list REPLACES the default section.
+ *  DECLARED in `./auto-mode-defaults.js` (the leaf the #503 recipe canonicalizer can reach without
+ *  loading these assets) and re-exported here, where every caller already looks for it. */
+export { AUTO_MODE_DEFAULTS_SENTINEL } from "./auto-mode-defaults.js";
 /** Deployment-authored rule overrides for the four paired sections of the permissions document.
  *  Each entry is ONE rule (rendered as a `- ` bullet); omit a field (or pass an empty array) to keep
  *  the CC default rules for that section verbatim. */
@@ -29,7 +31,8 @@ export interface BuildAutoModePromptOptions {
  */
 export declare function buildAutoModePrompt(options?: BuildAutoModePromptOptions): string;
 export interface AutoModeWindowOptions {
-    /** Newest transcript entries included (default 40). */
+    /** Newest transcript entries INCLUDED (default 40). Zero includes none — the classifier judges the
+     *  action with no run history, and the omission line still names every entry left out. */
     maxEntries?: number;
     /** Per-entry excerpt cap in characters (default 2_000 — tool results and long turns are truncated
      *  head-first with a `[… N chars truncated]` marker; the classifier weighs shape over bulk). */
@@ -39,6 +42,14 @@ export interface AutoModeWindowOptions {
  * Render the transcript window half of the classifier's user prompt: the newest `maxEntries` messages,
  * oldest→newest, each labeled by lane. Plain data — see the module header for the declared v1 gap vs
  * CC's entry-formatter stack.
+ *
+ * `maxEntries` counts the entries INCLUDED, so a bound of zero includes none and says so. That case is
+ * handled explicitly rather than left to `slice`: `slice(-0)` is `slice(0)`, i.e. the WHOLE transcript,
+ * which inverts a declared bound into "unbounded" — and silently, because the omitted count would then
+ * be zero and the omission header would not render either. The recipe canonicalizer admits zero for both
+ * window knobs deliberately (its sibling knobs use a minimum of one), so a deployment can genuinely
+ * declare "classify the action with no transcript context"; a negative bound is not a coherent window
+ * either and takes the same arm rather than `slice`'s "drop the oldest N".
  */
 export declare function renderAutoModeWindow(messages: readonly Message[], options?: AutoModeWindowOptions): string;
 /**

package/dist/core/auto-mode-prompt.js

@@ -1,6 +1,7 @@
+import { AUTO_MODE_DEFAULT_WINDOW_MAX_CHARS, AUTO_MODE_DEFAULT_WINDOW_MAX_ENTRIES, AUTO_MODE_DEFAULTS_SENTINEL } from "./auto-mode-defaults.js";
 import { AUTO_MODE_BASE_PROMPT, AUTO_MODE_PERMISSIONS_EXTERNAL } from "./auto-mode-prompt-assets.js";
 import { cutEnginePrefix, cutEngineSegments, flattenableUserText } from "./untrusted-text.js";
-export const AUTO_MODE_DEFAULTS_SENTINEL = "$defaults";
+export { AUTO_MODE_DEFAULTS_SENTINEL } from "./auto-mode-defaults.js";
 function mergeRuleSection(user, defaultsInner) {
     if (!user?.length)
         return defaultsInner;
@@ -98,14 +99,16 @@ function renderEntry(m, cap) {
     return `[assistant]\n${parts.join("\n")}`;
 }
 export function renderAutoModeWindow(messages, options) {
-    const maxEntries = options?.maxEntries ?? 40;
-    const cap = options?.maxCharsPerEntry ?? 2_000;
-    const window = messages.slice(-maxEntries);
-    if (window.length === 0)
+    const maxEntries = options?.maxEntries ?? AUTO_MODE_DEFAULT_WINDOW_MAX_ENTRIES;
+    const cap = options?.maxCharsPerEntry ?? AUTO_MODE_DEFAULT_WINDOW_MAX_CHARS;
+    const window = maxEntries > 0 ? messages.slice(-maxEntries) : [];
+    if (messages.length === 0)
         return "(transcript empty — this is the run's first gated action)\n";
     const dropped = messages.length - window.length;
-    const head = dropped > 0 ? `(… ${dropped} earlier transcript entries omitted)\n\n` : "";
-    return head + window.map((m) => renderEntry(m, cap)).join("\n\n") + "\n";
+    const head = dropped > 0 ? `(… ${dropped} earlier transcript entries omitted)\n` : "";
+    if (window.length === 0)
+        return head;
+    return `${head}${head === "" ? "" : "\n"}${window.map((m) => renderEntry(m, cap)).join("\n\n")}\n`;
 }
 export function renderAutoModeAction(input) {
     const ask = input.askMessage ? `\npermission gate: ${input.askMessage}` : "";

package/dist/core/auto-mode-rebuild.d.ts

@@ -0,0 +1,75 @@
+import { type AutoModeDecider, type AutoModeDeciderOptions } from "./auto-mode.js";
+import { type AutoModeArmingRecipe, type AutoModeRebuildRefusal } from "./auto-mode-arming.js";
+import type { Message } from "../internal/llm.js";
+/** The redeeming deployment's FRESH model leg: one tool-less completion over a prompt CORE assembles.
+ *  The split is the trust gate's: rules reach the prompt only through the recipe (a deployment-authored
+ *  object), never through the leg — the leg dispatches, it does not compose. */
+export type AutoModeClassifierCompletion = (call: {
+    systemPrompt: string;
+    userPrompt: string;
+}, signal?: AbortSignal) => Promise<string>;
+export interface AutoModeRebuildOptions {
+    /** The recipe read off the parked chain entry (`ConstraintChainEntryMeta.autoModeArming`). */
+    recorded: unknown;
+    /** The redeeming deployment's CURRENT auto-mode settings, minted with `autoModeArmingRecipeOf` from
+     *  its own face. REQUIRED: bound ② is "the rebuilt arming is bounded by the settings in force", and a
+     *  caller that declares none has put nothing in force — see {@link foldAutoModeArming}. A deployment
+     *  with no overrides of its own still declares that (an empty face mints a bare recipe). */
+    current: unknown;
+    /** The fresh model leg. */
+    complete: AutoModeClassifierCompletion;
+    /**
+     * The transcript the classifier judges the action IN CONTEXT of — the REDEEMING leg's own messages,
+     * read at classify time (the window is rebuilt per classification, exactly as the live arming does).
+     *
+     * REQUIRED, and the reason is a permissiveness one rather than a quality one: the 207 process judges an
+     * action against the run that produced it (session linking, earlier writes), so a classifier handed no
+     * history can allow what the same classifier would block having seen it — and the empty window renders
+     * an affirmative claim, "this is the run's first gated action", that would simply be false. A provider
+     * that returns `[]` is DECLARING the transcript empty, which is a different statement from an engine
+     * that silently had none to show. A provider that throws fails the classification closed
+     * (`unavailable` ⇒ the original chain), never into a blind verdict.
+     */
+    transcript: () => readonly Message[] | Promise<readonly Message[]>;
+    /** The redeeming process's breaker alarm (the recorded arming cannot carry the ancestor's closure). */
+    onBreakerOpen?: AutoModeDeciderOptions["onBreakerOpen"];
+}
+export type AutoModeRebuildResult = {
+    ok: true;
+    /** A decider carrying the ancestor's criteria, over the caller's model leg. */
+    decider: AutoModeDecider;
+    /**
+     * The RECORDED recipe, canonical — put THIS back on the re-supplied chain entry
+     * (`parentConstraints[].autoMode.arming`) so the constraint-chain digest matches the parked row.
+     * Deliberately not `effective`: the digest binds what the ANCESTOR recorded, and a local tighten
+     * must not read as a different ancestor chain.
+     */
+    arming: AutoModeArmingRecipe;
+    /** What the rebuilt decider actually runs under (the tighten-only fold of recorded ∧ current). */
+    effective: AutoModeArmingRecipe;
+    /** True iff the current settings pulled a knob in. */
+    tightened: boolean;
+} | {
+    ok: false;
+    reason: AutoModeRebuildRefusal;
+    message: string;
+};
+/**
+ * Rebuild a decider with a PARKED ancestor's criteria from its recorded recipe plus a fresh model leg.
+ *
+ * What is reproduced: the assembled system prompt (`buildAutoModePrompt` over the recorded rule
+ * overrides / settings-deny rules / session context), the transcript-window bounds, the round-trip
+ * timeout and the breaker threshold — i.e. every input the ancestor's own `createAutoModeDecider` call
+ * had except the model leg and the alarm closure.
+ *
+ * What is NOT reproduced, deliberately: the ancestor's BREAKER STATE. The rebuilt decider starts closed,
+ * and that is sound only because a recipe is never recorded from a decider whose breaker is open OR whose
+ * failure streak is non-zero (bound ①, at the persistence point) — either state means the ancestor's own
+ * budget was spent or spending, and the row then carries no recipe at all.
+ *
+ * Also NOT reproduced: this build's PROMPT ASSETS are its own. The recipe records the deployment's
+ * overrides, so the assembled prompt is checked against the digest the arming recorded — a fleet running
+ * two asset versions refuses to rebuild rather than enforce a different set of default rules under the
+ * ancestor's name.
+ */
+export declare function rebuildAutoModeDecider(opts: AutoModeRebuildOptions): AutoModeRebuildResult;

package/dist/core/auto-mode-rebuild.js

@@ -0,0 +1,41 @@
+import { createHash } from "node:crypto";
+import { createAutoModeDecider } from "./auto-mode.js";
+import { buildAutoModePrompt, renderAutoModeAction, renderAutoModeWindow } from "./auto-mode-prompt.js";
+import { foldAutoModeArming, } from "./auto-mode-arming.js";
+export function rebuildAutoModeDecider(opts) {
+    const folded = foldAutoModeArming(opts.recorded, opts.current);
+    if (!folded.ok)
+        return folded;
+    const effective = folded.effective;
+    const promptOptions = {
+        ...(effective.rules !== undefined ? { rules: effective.rules } : {}),
+        ...(effective.settingsDenyRules !== undefined ? { settingsDenyRules: effective.settingsDenyRules } : {}),
+        ...(effective.sessionContext !== undefined ? { sessionContext: effective.sessionContext } : {}),
+    };
+    const systemPrompt = buildAutoModePrompt(promptOptions);
+    const assembledDigest = `apv1:${createHash("sha256").update(systemPrompt).digest("hex")}`;
+    if (folded.recorded.promptDigest !== assembledDigest) {
+        return {
+            ok: false,
+            reason: "prompt_assets_moved",
+            message: folded.recorded.promptDigest === undefined
+                ? "the recorded arming carries no classifier-prompt digest, so this build cannot establish that the prompt it assembles is " +
+                    "the one the ancestor enforced (the recipe records overrides; the base shell and permissions document come from the build's " +
+                    "own assets) — refusing to rebuild rather than enforce criteria that may not be the ancestor's"
+                : "this build assembles a DIFFERENT classifier prompt than the recorded arming did (prompt-asset version skew across the fleet: " +
+                    `recorded ${folded.recorded.promptDigest}, assembled here ${assembledDigest}) — the overrides match but the default rules they ` +
+                    "merge into do not, so the rebuilt classifier would enforce criteria the ancestor never ran; refusing to rebuild",
+        };
+    }
+    const decider = createAutoModeDecider({
+        ...(effective.timeoutMs !== undefined ? { timeoutMs: effective.timeoutMs } : {}),
+        ...(effective.failureThreshold !== undefined ? { failureThreshold: effective.failureThreshold } : {}),
+        ...(opts.onBreakerOpen !== undefined ? { onBreakerOpen: opts.onBreakerOpen } : {}),
+        classify: async (input, signal) => {
+            const messages = await opts.transcript();
+            const userPrompt = renderAutoModeWindow(messages, effective.window) + renderAutoModeAction(input);
+            return opts.complete({ systemPrompt, userPrompt }, signal);
+        },
+    });
+    return { ok: true, decider, arming: folded.recorded, effective, tightened: folded.tightened };
+}

package/dist/core/auto-mode.d.ts

@@ -77,6 +77,21 @@ export interface AutoModeDecider {
     /** True once the session breaker has opened (it never half-opens: is a SESSION fallback
      *  to non-auto, not a retry window — a flapping classifier must not oscillate the permission mode). */
     breakerOpen(): boolean;
+    /**
+     * The CURRENT consecutive-failure streak — the part of the breaker's state that `breakerOpen()` alone
+     * cannot express. A latch that has not tripped yet still carries how much budget is left before it
+     * does, and #503 needs exactly that: an arming recorded for cross-process rebuild starts a FRESH
+     * decider, so recording one from a decider that is already 2 failures into a threshold of 3 would hand
+     * the redemption more tolerance for a failing classifier than the ancestor had left — the redeemed leg
+     * stays auto-classified through failures that would have dropped the ancestor back to non-auto.
+     * {@link import("./tool-policy.js").constraintChainEntryOfLayer} therefore records an arming only at a
+     * ZERO streak, and reads a decider that does not implement this member as unknown (⇒ records nothing).
+     *
+     * OPTIONAL so that hand-built deciders keep type-checking; the engine's own
+     * {@link createAutoModeDecider} always implements it. A deployment that hand-rolls a decider and wants
+     * the persisted-arming path must implement it too — the conservative reading of absence is deliberate.
+     */
+    consecutiveFailures?(): number;
 }
 /**
  * Session-scoped decider: timeout + fail-closed error mapping + a one-way circuit breaker.

package/dist/core/auto-mode.js

@@ -1,3 +1,4 @@
+import { AUTO_MODE_DEFAULT_FAILURE_THRESHOLD, AUTO_MODE_DEFAULT_TIMEOUT_MS } from "./auto-mode-defaults.js";
 export function parseAutoModeResponse(text) {
     const t = text
         .replace(/<thinking>[\s\S]*?<\/thinking>/g, "")
@@ -16,8 +17,8 @@ export function parseAutoModeResponse(text) {
     return { kind: "block", category, reason };
 }
 export function createAutoModeDecider(opts) {
-    const timeoutMs = opts.timeoutMs ?? 15_000;
-    const threshold = Math.max(1, Math.floor(opts.failureThreshold ?? 3));
+    const timeoutMs = opts.timeoutMs ?? AUTO_MODE_DEFAULT_TIMEOUT_MS;
+    const threshold = Math.max(1, Math.floor(opts.failureThreshold ?? AUTO_MODE_DEFAULT_FAILURE_THRESHOLD));
     let consecutiveFailures = 0;
     let open = false;
     const recordFailure = (cause) => {
@@ -33,6 +34,7 @@ export function createAutoModeDecider(opts) {
     };
     return {
         breakerOpen: () => open,
+        consecutiveFailures: () => consecutiveFailures,
         async decide(input, signal) {
             if (open)
                 return { kind: "unavailable", cause: "breaker_open" };

package/dist/core/checkpoint-store.d.ts

@@ -768,6 +768,24 @@ export type PendingAction = {
      *  original-index preservation. The park→resume redemption chain walks the same consent
      *  protocol as the synchronous card — there is no second form. */
     ruleOffers?: readonly import("./permission-rule-model.js").RuleOffer[];
+    /** #490 修② (additive; no checkpoint-version bump — the `previewWithheld`/`hasBidiControls`
+     *  precedents above: an optional field an older reader ignores and the resume path never reads)
+     *  — the PARK twin of `AskRequest.ruleOffersAbsence`, minted by the SAME one factory as
+     *  {@link ruleOffers} so the parked card and the live card cannot answer differently. Present ⇔
+     *  the rule-offer lane is in play for this call and has nothing to give, naming which door
+     *  closed: `"mandated"` (no persisted rule could ever clear this ask — a real-approval demand,
+     *  the tool's own mandate marks, a hook-raised ask, an ancestor's authority, or — #502 — a
+     *  demotion this CALL's reversibility probe declared structural, which for the built-in shell
+     *  probe means a read outside the directories the session declared; an inbox must NOT point at
+     *  rule-writing on this arm, nor at a directory grant, which does not exist in this version),
+     *  `"shadowed"` (a rule the person already wrote is
+     *  speaking and does not clear it), `"lane_cannot_speak"` (this card has no rule to offer — the
+     *  grammar has no text for the command, or the card's array-order contract declines to present
+     *  the one text that exists; it is NOT a claim that no rule could ever be written).
+     *  Mutually exclusive with {@link ruleOffers}. ABSENCE is not a claim — it also covers
+     *  "there are offers" and the structural doors (no lane wired, another tool, a task that cannot
+     *  hold a rule) — so read presence. See the synchronous seat's doc for the full contract. */
+    ruleOffersAbsence?: "mandated" | "lane_cannot_speak" | "shadowed";
     /**
      * design/80 D-1 §2 (slice 1a.2): the server-minted **opaque** boundInputHash of {@link args} — a
      * SHA-256 (hex) via {@link import("./canonical-json.js").boundInputHashOf}, computed ONCE here at

package/dist/core/context-edit.d.ts

@@ -67,6 +67,32 @@ export declare function contextEditFrontier(window: number): number;
  * re-run when the frontier pass is off → in-turn forced compaction behind the adopt seam → trim
  * demoted to the disaster-only last resort), so the default configuration never hands an
  * under-20k refusal straight to a message-dropping trim.
+ *
+ * WHOLE-MACHINE CROSS-CHECK against the 2.1.250 corpus (design/374 slice 4 — the "the knob number
+ * was copied, the machine was not" disease is checked by naming the machine's parts, not the one
+ * number). CC's four load-bearing parts, each against its 250 coordinate, all verified present here:
+ *   ① the ≥20000-token minimum-savings gate — {@link MIN_CLEAR_SAVINGS_TOKENS} vs `Mnn`
+ *      (cli250.js:41714, `BBn`: `if (tokensSaved < Mnn) return null`). CC gates TWICE (execution +
+ *      before asking the server to reject); sema has one point because the "ask for the rejection"
+ *      half needs a cooperating server (see ④).
+ *   ② the nine-member clearable whitelist — {@link COMPACTABLE_TOOLS} vs `eQt` (cli250.js:41714),
+ *      re-resolved member-by-member off the 250 corpus, byte-identical (see that constant).
+ *   ③ cleared-but-recoverable — CC replaces the content with a POINTER, not a void
+ *      (`<persisted-output>Tool result saved to: {path}\n\nUse Read to view</persisted-output>`,
+ *      cli250.js:40044), which is what makes a keep window of 5 survivable at all. Ours is the same
+ *      construction in this engine's carrier: the full text is offloaded first and the marker
+ *      carries the store ref ({@link ContextEditOptions.offload} → {@link clearOneResult}), read
+ *      back through ReadToolResult instead of a filesystem path (registered divergence D-9). The
+ *      runner wires it on BOTH arms by default — the frontier pass and the MC-R rejection arm share
+ *      one persist closure — so the shipped default clears to a pointer, never to a dead end.
+ *   ④ the TRIGGER — CC's client machine fires ONLY on the server's `context_hint` 422/424 refusal
+ *      (cli250.js:58375; `tengu_time_based_microcompact` is a historical event name, its `trigger`
+ *      is the constant `"context_hint"`). Under BYOM there is no such server, so the ask half is
+ *      unportable and the refusal half is aligned on wire truth (the MC-R arm classifies the
+ *      provider's own context-overflow refusal) — registered divergence D-3. sema additionally
+ *      keeps a PROACTIVE frontier trigger CC's client does not have, anchored to Anthropic's
+ *      platform context-management policy rather than to CC-CLI — registered divergence D-1, and
+ *      re-stated at {@link clearStaleToolResults}'s ANCHOR paragraph.
  */
 export type ContextEditMachine = "legacy" | "cc";
 /**
@@ -82,8 +108,10 @@ export type ContextEditMachine = "legacy" | "cc";
  *    exactly the terminal-batch shape that needs it. This is why the slice-3 "keep default 3→5"
  *    flip rides the MACHINE default, not this constant: painting 5 onto the opt-out machine would
  *    recreate the probed failure inside the escape hatch.
- *  - CC machine (the default since slice 3): 5 (2.1.223 `uAp`; same value on CC 88's
- *    `timeBasedMCConfig` — stable across both corpus generations). The #384 adjudication adopted 5
+ *  - CC machine (the default since slice 3): 5 (2.1.223 `uAp`; 2.1.250 `var k = 5` at the call site
+ *    cli250.js:58375, and 2.1.245 carries the same value — zero drift across 245→250; same value
+ *    again on CC 88's `timeBasedMCConfig`, i.e. stable across all three corpus generations, and it
+ *    is a hard-coded constant upstream, not a setting). The #384 adjudication adopted 5
  *    CONDITIONAL on the whole machine coming with it (20k gate + deep clear + re-ordered
  *    backstops); the cc machine carries that condition, and slice 3's backstop re-ordering
  *    completed it — 5 is now the effective default keep, and the 200k probe above is answered by
@@ -92,7 +120,8 @@ export type ContextEditMachine = "legacy" | "cc";
  */
 export declare const DEFAULT_KEEP_RECENT_TOOL_RESULTS = 3;
 export declare const CC_DEFAULT_KEEP_RECENT_TOOL_RESULTS = 5;
-/** design/374 §3.1 — CC's minimum-savings gate (`vUs` :397773): the cc machine refuses to clear at
+/** design/374 §3.1 — CC's minimum-savings gate (`vUs` :397773; 2.1.250 `Mnn` cli250.js:41714, same
+ *  value): the cc machine refuses to clear at
  *  all unless the structural estimate of what WOULD be cleared reaches this many tokens. Rationale
  *  (independent of "CC does it"): every clear breaks the provider prefix cache once, so a clear that
  *  saves less than the re-prefill it causes is a net loss; the gate prices that trade. The LEGACY
@@ -105,7 +134,18 @@ export declare const MIN_KEEP_RECENT_TOOL_RESULTS = 1;
  * checklist #54 (CC microCompact.ts:41-50 `COMPACTABLE_TOOLS` parity): the INCLUSION whitelist of
  * tools whose results may be content-cleared by the stale-result pass. CC's set is exactly
  * { Read, Bash, PowerShell (SHELL_TOOL_NAMES), Grep, Glob, WebSearch, WebFetch, Edit, Write } —
- * cheap-to-regenerate I/O. Everything else is PRESERVED: expensive/decision-bearing results
+ * cheap-to-regenerate I/O.
+ *
+ * RE-VERIFIED against the 2.1.250 corpus (design/374 slice 4, member-by-member — a set is exactly
+ * the shape where "the count still matches" is not evidence): `eQt = new Set([wt, ...VD, Yo, Xo,
+ * yO, Yr, tn, er])` at cli250.js:41714, whose aliases resolve to `wt`="Read", `VD`=[`Xe`="Bash",
+ * `Nt`="PowerShell"], `Yo`="Grep", `Xo`="Glob", `yO`="WebSearch", `Yr`="WebFetch", `tn`="Edit",
+ * `er`="Write" — nine members, byte-identical to the set below, zero drift from the 223 reading.
+ * The exclusion side is the load-bearing half and is unchanged too: everything NOT here is
+ * PRESERVED (Agent/Task/Skill/ToolSearch/TodoWrite/Monitor/SendMessage/NotebookEdit and ALL MCP
+ * tools are never content-cleared by this pass, upstream or here).
+ *
+ * Everything else is PRESERVED: expensive/decision-bearing results
  * (Agent subagent reports, Task* registry state, TodoWrite acks, Monitor, MCP tools, custom
  * ToolSpecs) survive to the harder defenses (compaction summarizes them instead of blanking them).
  * PowerShell is kept for CC fidelity even though sema does not mount it. Overridable per call via
@@ -184,7 +224,9 @@ export interface ContextEditOptions {
      * Absent ⇒ legacy structural gate + accounting (byte-identical behavior).
      */
     anchoredTotalTokens?: number;
-    /** design/123 D2 — structural coefficient (`Model.charsPerToken`); default 4. */
+    /** design/123 D2 — structural coefficient (`Model.charsPerToken`); default 3 (design/374 slice 4;
+     *  it was 4 before). Note this does NOT reach the cc machine's ≥20k gate, which is CC-exactly
+     *  hard-coded to 4 — see {@link structuralClearSavings}. */
     charsPerToken?: number;
     /**
      * checklist #54 — which tools' results are clearable. Defaults to {@link COMPACTABLE_TOOLS}

package/dist/core/context-guard.d.ts

@@ -16,7 +16,7 @@ import type { Model } from "../internal/llm.js";
  * message AT/BEFORE the anchor reduces it by ZERO (the anchor usage was billed with that content —
  * a request-view drop only pays off on the NEXT request), so the trim keeps cutting deeper until
  * the anchored total meets the budget or only the minimal tail is left. Absent ⇒ legacy structural
- * behavior, byte-identical. `charsPerToken` (design/123 D2): structural coefficient, default 4.
+ * behavior, byte-identical. `charsPerToken` (design/123 D2): structural coefficient, default 3 (design/374 slice 4).
  */
 export declare function trimToBudget(messages: AgentMessage[], budgetTokens: number, anchoredTotalTokens?: number, charsPerToken?: number): AgentMessage[];
 /**