@sema-agent/core 7.1.0 → 7.2.0

package/dist/core/runner/prepare-task.js

@@ -23,7 +23,8 @@ import { createSendMessageTool, SEND_MESSAGE_TOOL_NAME } from "../../agents/send
 import { SubagentRetainLedger } from "../../agents/retain-ledger.js";
 import { askApproverIdentity, carriesBidiControls, checkToolPolicyProjection, combinePolicies, constraintChainDigest, constraintChainEntryOfLayer, isApprovalSettledBy, isAskDenyResolution, screenApproverAttribution, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, describeThrown, refuseOutOfContractDecision, resolveAsk, toolPolicyNameSets, tryCloneArgs } from "../tool-policy.js";
 const PERSISTED_RULE_TOOL = "Bash";
-import { findAdmittingRule, segmentCoverageOf, suggestRulesForCommand } from "../permission-rule-model.js";
+const DIRECTORY_RULE_TOOL = "Read";
+import { directoryRuleAdmits, eligiblePersisted, findAdmittingRule, lexicalNormalAbsolutePathOf, segmentCoverageOf, suggestRulesForCommand } from "../permission-rule-model.js";
 import { normalizePersistedRule } from "../permission-rule-store.js";
 import { ActiveSkillScope, createActiveSkillScopePolicy } from "./active-skill-scope.js";
 import { CHANGED_FILES_MTIME_EPS_MS, fenceMcpServerInstructions, renderAgentListingDelta } from "./turn-attachments.js";
@@ -76,7 +77,7 @@ import { capAggregateToolResults } from "../tool-result-budget.js";
 import { capAggregateMediaBytes, AGGREGATE_MEDIA_BUDGET_BYTES } from "../media-byte-cap.js";
 import { dropOrphanToolResults, guardBudget, insertTrimNotice, trimToBudget } from "../context-guard.js";
 import { StubExecutionEnv } from "../stub-env.js";
-import { hasDestroy, isIsolated, isRemoteExecutionEnv, isSuspendable, missingRestoreSurface } from "../remote-env.js";
+import { hasDestroy, isIsolated, isRemoteExecutionEnv, isSuspendable, missingRestoreSurface, RemoteExecutionError } from "../remote-env.js";
 import { settleTeardownLeg } from "./teardown-bounded.js";
 import { hasBackgroundShell, sweepBackgroundShells } from "../background-shell.js";
 import { createTaskOutputTool, createTaskStopTool, defaultTaskRegistry } from "../task-registry.js";
@@ -713,6 +714,93 @@ function consumeInheritedAskGrant(grants, onAsk, humanReviewRef, decision, req)
     });
     return { action: "allow", presentedInput: grant.presented };
 }
+function raceSettlementAgainstSignal(p, signal) {
+    const settled = p.then((value) => ({ tag: "value", value }), (error) => ({ tag: "threw", error }));
+    if (signal.aborted)
+        return Promise.resolve({ tag: "aborted" });
+    return new Promise((resolve) => {
+        let done = false;
+        const finish = (r) => {
+            if (done)
+                return;
+            done = true;
+            signal.removeEventListener("abort", onAbortEvent);
+            resolve(r);
+        };
+        const onAbortEvent = () => finish({ tag: "aborted" });
+        signal.addEventListener("abort", onAbortEvent, { once: true });
+        void settled.then(finish);
+    });
+}
+const PARK_COMPENSATION_TIMEOUT_MS = 30_000;
+export async function compensateUnparkedPause(remoteEnv, snapshotId, io) {
+    const boundCtl = new AbortController();
+    const boundTimer = setTimeout(() => boundCtl.abort(), io.boundMs);
+    const bound = boundCtl.signal;
+    let phase = "resumeVM";
+    let restoreAttempts = 1;
+    let vmRunning = false;
+    const work = (async () => {
+        const { outcome: back, attempts: backAttempts } = await restoreWorkspaceWithRetry(remoteEnv, snapshotId, { abortSignal: bound }, (attempt) => (restoreAttempts = attempt));
+        if (!back.ok) {
+            io.noteFailure(remoteEnvFailureNote("resumeVM", back.error, backAttempts));
+            io.disclose(back.error);
+            return { ok: false, reason: `resumeVM failed (${back.error.code}) while compensating an unparked pause` };
+        }
+        vmRunning = true;
+        if (bound.aborted) {
+            return { ok: false, reason: "resumeVM settled only after the decision bound" };
+        }
+        phase = "postResumeInit";
+        const init = await remoteEnv.postResumeInit({ abortSignal: bound });
+        if (!init.ok) {
+            io.noteFailure(remoteEnvFailureNote("postResumeInit", init.error, 1));
+            io.disclose(init.error);
+            return { ok: false, reason: `postResumeInit failed (${init.error.code}) while compensating an unparked pause` };
+        }
+        return { ok: true };
+    })();
+    const raced = await raceSettlementAgainstSignal(work, bound);
+    clearTimeout(boundTimer);
+    if (raced.tag === "value")
+        return raced.value;
+    if (raced.tag === "threw") {
+        io.noteFailure(remoteEnvFailureNote(phase, raced.error instanceof RemoteExecutionError
+            ? raced.error
+            : new RemoteExecutionError("unknown", `the pause compensation's ${phase} call threw: ${raced.error instanceof Error ? raced.error.message : String(raced.error)}`), phase === "resumeVM" ? restoreAttempts : 1));
+        io.disclose(raced.error);
+        return {
+            ok: false,
+            reason: "the pause compensation threw (adapter contract violation; the deployment's error face carries the exception)",
+        };
+    }
+    const timedOut = new RemoteExecutionError("timeout", `the pause compensation's ${phase} call did not settle within the ${io.boundMs}ms decision bound`);
+    io.noteFailure(remoteEnvFailureNote(phase, timedOut, phase === "resumeVM" ? restoreAttempts : 1));
+    io.disclose(timedOut);
+    const destroyOwnerlessLate = () => {
+        io.disclose(new Error(`park compensation settled after its ${io.boundMs}ms decision bound: the VM is running with no run ` +
+            `left to own it — destroying the env (an ownerless running VM must not linger; the run already took ` +
+            `the fail-closed arm when the bound fired)`));
+        void Promise.resolve()
+            .then(() => remoteEnv.destroy())
+            .catch((destroyErr) => io.disclose(destroyErr));
+    };
+    void work.then((late) => {
+        if (vmRunning) {
+            destroyOwnerlessLate();
+            return;
+        }
+        void late;
+    }, (lateErr) => {
+        io.disclose(lateErr);
+        if (vmRunning)
+            destroyOwnerlessLate();
+    });
+    return {
+        ok: false,
+        reason: `the pause compensation did not settle within ${io.boundMs}ms — treated as failed (a late-restored VM is destroyed; a late restore failure is disclosed)`,
+    };
+}
 function raceAbort(p, signal, onAbort) {
     if (signal.aborted)
         return Promise.resolve(onAbort());
@@ -869,6 +957,87 @@ function persistedRuleHitOf(admitting) {
         ? undefined
         : { rules: admitting.map((r) => ({ rule: r.rule, dots: r.adds.map((a) => ({ actor: a.dot.actor, counter: a.dot.counter })) })) };
 }
+function directoryRuleLaneAnswer(table, args, ctx) {
+    const filePath = args?.file_path;
+    if (typeof filePath !== "string" || filePath === "")
+        return undefined;
+    const spelled = filePath.startsWith("/") ? filePath : `${(ctx.liveCwd ?? ctx.root ?? "").replace(/\/+$/, "")}/${filePath}`;
+    const target = lexicalNormalAbsolutePathOf(spelled);
+    if (target === undefined)
+        return undefined;
+    const hit = table.find((r) => eligiblePersisted(r, { tool: DIRECTORY_RULE_TOOL, cwd: ctx.root, sessionId: ctx.sessionId }) && directoryRuleAdmits(r, target));
+    return hit !== undefined ? persistedRuleHitOf([hit]) : undefined;
+}
+function makeRuleOffersOf(cfg) {
+    return (toolName, args, ask) => {
+        if (!cfg.laneArmed || toolName !== PERSISTED_RULE_TOOL)
+            return {};
+        if ((cfg.principal === undefined || cfg.principal === "") && !cfg.localOwnerDeclared)
+            return {};
+        const closedDoor = (() => {
+            if (ask?.requiresRealApproval === true)
+                return "mandated";
+            if (ask?.persistedRuleShadowed !== undefined)
+                return "shadowed";
+            if (ask?.decisionReason === "hook")
+                return "mandated";
+            if (ask?.matchedAskRule !== undefined)
+                return "shadowed";
+            if (ask?.inheritedUnresolved === true)
+                return "mandated";
+            if (ask?.ancestorResolved === true)
+                return "mandated";
+            return undefined;
+        })();
+        if (closedDoor !== undefined)
+            return { ruleOffersAbsence: closedDoor };
+        if (persistedRuleMandateOf({
+            egress: cfg.egressTools.has(toolName),
+            irreversibility: cfg.irreversibilityTier.get(toolName),
+            shellGated: cfg.shellGatedBash,
+            probeMandated: ask?.probeMandated === true,
+        }) !== undefined) {
+            return { ruleOffersAbsence: "mandated" };
+        }
+        const command = args?.command;
+        if (typeof command !== "string")
+            return { ruleOffersAbsence: "lane_cannot_speak" };
+        const offers = suggestRulesForCommand(command, {
+            ...(ask?.segmentCoverage !== undefined ? { coverage: ask.segmentCoverage } : {}),
+            ...(cfg.taskRoot !== undefined ? { scope: { kind: "project", root: cfg.taskRoot }, cwd: cfg.taskRoot } : {}),
+            ...(cfg.cwdRef?.current !== undefined ? { execCwd: cfg.cwdRef.current } : {}),
+            ...(cfg.deniesDirectoryRead !== undefined ? { deniesDirectoryRead: cfg.deniesDirectoryRead } : {}),
+        });
+        return offers.length > 0
+            ? { ruleOffers: offers, ...(cfg.cwdRef?.current !== undefined ? { execCwd: cfg.cwdRef.current } : {}) }
+            : { ruleOffersAbsence: "lane_cannot_speak" };
+    };
+}
+function makeOrgAdjudicationLane(overlay, questionToolMounted, onRevisionDefect) {
+    if (overlay === undefined)
+        return undefined;
+    return {
+        adjudicate: async (req) => {
+            if (req.toolName === ASK_USER_QUESTION_TOOL_NAME && questionToolMounted)
+                return { status: "available" };
+            let resolution;
+            try {
+                resolution = await overlay.resolve();
+            }
+            catch (err) {
+                return { status: "unavailable", disclosures: [`the org rule overlay threw: ${err instanceof Error ? err.message : String(err)}`] };
+            }
+            if (resolution.status === "unavailable")
+                return { status: "unavailable", disclosures: resolution.disclosures };
+            const revisionCell = orgRevisionEvidenceOf(resolution, onRevisionDefect);
+            const command = req.args?.command;
+            if (req.toolName !== PERSISTED_RULE_TOOL || typeof command !== "string")
+                return { status: "available", ...revisionCell };
+            const verdict = orgRuleVerdictFor(resolution.rules, { tool: req.toolName, command });
+            return verdict === undefined ? { status: "available", ...revisionCell } : { status: "available", verdict, ...revisionCell };
+        },
+    };
+}
 function cwdConflictsRestoreError(requestedCwd) {
     const e = new Error(`RunInternals.requestedCwd ("${requestedCwd}") cannot be combined with a checkpoint workspace restore — ` +
         `the restored workspace's own mount path is authoritative for the task root, so a requested cwd on this leg ` +
@@ -2037,10 +2206,13 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         handsLessResolvedFace = handsReadFace.handsLessResolvedFace;
         shellGatedBash = handsReadFace.shellGatedBash;
         shellGatedMonitor = handsReadFace.shellGatedMonitor;
-        if (backgroundTaskToolsActive || workflowToolsActive) {
-            toolEffects.set("TaskOutput", "read");
-            toolEffects.set("TaskStop", "write");
-            tools.push(firstPartyOffload(createTaskOutputTool({ registry: defaultTaskRegistry, owner: hostTaskId, scope: taskScope, sessionId, workflowStore: deps.workflowRunStore, agentStore: deps.backgroundAgentStore, notificationWired: internals?.onTaskNotification !== undefined, oneShot: spec.oneShot, toolResultStore: offloadStore })), firstPartyOffload(createTaskStopTool({ registry: defaultTaskRegistry, owner: hostTaskId, scope: taskScope, sessionId, workflowStore: deps.workflowRunStore, agentStore: deps.backgroundAgentStore })));
+        const delegationSurfaceActive = backgroundTaskToolsActive || workflowToolsActive;
+        if (delegationSurfaceActive || internals?.parentNotify !== undefined) {
+            if (delegationSurfaceActive) {
+                toolEffects.set("TaskOutput", "read");
+                toolEffects.set("TaskStop", "write");
+                tools.push(firstPartyOffload(createTaskOutputTool({ registry: defaultTaskRegistry, owner: hostTaskId, scope: taskScope, sessionId, workflowStore: deps.workflowRunStore, agentStore: deps.backgroundAgentStore, notificationWired: internals?.onTaskNotification !== undefined, oneShot: spec.oneShot, toolResultStore: offloadStore })), firstPartyOffload(createTaskStopTool({ registry: defaultTaskRegistry, owner: hostTaskId, scope: taskScope, sessionId, workflowStore: deps.workflowRunStore, agentStore: deps.backgroundAgentStore })));
+            }
             if (runnerSelf && !(spec.tools ?? []).some((t) => t.name === SEND_MESSAGE_TOOL_NAME)) {
                 toolEffects.set(SEND_MESSAGE_TOOL_NAME, "write");
                 axisExplicitNegatives.set(SEND_MESSAGE_TOOL_NAME, { ...axisExplicitNegatives.get(SEND_MESSAGE_TOOL_NAME), egress: false });
@@ -2070,7 +2242,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     owner: hostTaskId,
                     scope: taskScope,
                     ...(sessionId !== undefined ? { sessionId } : {}),
-                    ...(internals?.onTaskNotification !== undefined ? { notify: internals.onTaskNotification } : {}), ...(spec.oneShot !== undefined ? { oneShot: spec.oneShot } : {}),
+                    ...(internals?.onTaskNotification !== undefined ? { notify: internals.onTaskNotification } : {}), ...(spec.oneShot !== undefined ? { oneShot: spec.oneShot } : {}), retrievalToolMounted: delegationSurfaceActive,
                     ...(internals?.onSubagentSpawn !== undefined ? { sink: internals.onSubagentSpawn } : {}),
                     ...(internals?.parentNotify !== undefined
                         ? { uplink: internals.parentNotify, ...(internals.parentPeerRef !== undefined ? { uplinkRecipient: internals.parentPeerRef } : {}) }
@@ -2095,7 +2267,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         detail: { handle, ...(scope !== undefined ? { scope } : {}) },
                     }),
                 })));
-                if (!(spec.tools ?? []).some((t) => t.name === AGENT_TRANSCRIPT_TOOL_NAME)) {
+                if (delegationSurfaceActive && !(spec.tools ?? []).some((t) => t.name === AGENT_TRANSCRIPT_TOOL_NAME)) {
                     tools.push(firstPartyOffload(createAgentTranscriptTool({
                         runner: runnerSelf,
                         registry: defaultTaskRegistry,
@@ -3659,10 +3831,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     const anonymous = spec.principal === undefined || spec.principal === "";
                     if (anonymous && !localOwnerDeclared)
                         return undefined;
-                    if (req.toolName !== PERSISTED_RULE_TOOL)
-                        return undefined;
-                    const command = req.args?.command;
-                    if (typeof command !== "string")
+                    if (req.toolName !== PERSISTED_RULE_TOOL && req.toolName !== DIRECTORY_RULE_TOOL)
                         return undefined;
                     let listed;
                     try {
@@ -3682,76 +3851,32 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         return { unreadable: true };
                     }
                     const table = await spliceSessionOverlayRows(deps.sessionPermissionRules, sessionId, listed.rules, deps.tracer, hostTaskId);
-                    const admitting = findAdmittingRule(table, { tool: req.toolName, command, cwd: root, sessionId });
+                    if (req.toolName === DIRECTORY_RULE_TOOL) {
+                        return directoryRuleLaneAnswer(table, req.args, { root, sessionId, liveCwd: handsCwdRef?.current });
+                    }
+                    const command = req.args?.command;
+                    if (typeof command !== "string")
+                        return undefined;
+                    const admitting = findAdmittingRule(table, { tool: req.toolName, command, cwd: root, sessionId, ...(handsCwdRef?.current !== undefined ? { execCwd: handsCwdRef.current } : {}) });
                     if (admitting !== undefined)
                         return persistedRuleHitOf(admitting);
-                    const coverage = segmentCoverageOf(command, { persisted: table }, { tool: req.toolName, cwd: root, sessionId });
+                    const coverage = segmentCoverageOf(command, { persisted: table }, { tool: req.toolName, cwd: root, sessionId, ...(handsCwdRef?.current !== undefined ? { execCwd: handsCwdRef.current } : {}) });
                     return coverage !== undefined ? { segmentCoverage: coverage } : undefined;
                 },
             };
         })();
-        const permissionRuleOrgLane = (() => {
-            const overlay = deps.permissionRuleOrg;
-            if (overlay === undefined)
-                return undefined;
-            return {
-                adjudicate: async (req) => {
-                    if (req.toolName === ASK_USER_QUESTION_TOOL_NAME && questionToolMounted)
-                        return { status: "available" };
-                    let resolution;
-                    try {
-                        resolution = await overlay.resolve();
-                    }
-                    catch (err) {
-                        return { status: "unavailable", disclosures: [`the org rule overlay threw: ${err instanceof Error ? err.message : String(err)}`] };
-                    }
-                    if (resolution.status === "unavailable")
-                        return { status: "unavailable", disclosures: resolution.disclosures };
-                    const revisionCell = orgRevisionEvidenceOf(resolution, (message) => deps.onError?.(new Error(message), { phase: "config", sessionId }));
-                    const command = req.args?.command;
-                    if (req.toolName !== PERSISTED_RULE_TOOL || typeof command !== "string")
-                        return { status: "available", ...revisionCell };
-                    const verdict = orgRuleVerdictFor(resolution.rules, { tool: req.toolName, command });
-                    return verdict === undefined ? { status: "available", ...revisionCell } : { status: "available", verdict, ...revisionCell };
-                },
-            };
-        })();
-        const ruleOffersOf = (toolName, args, ask) => {
-            if (permissionRuleLane === undefined || toolName !== PERSISTED_RULE_TOOL)
-                return {};
-            if ((spec.principal === undefined || spec.principal === "") && deps.localOwnerRules !== true)
-                return {};
-            const closedDoor = (() => {
-                if (ask?.requiresRealApproval === true)
-                    return "mandated";
-                if (ask?.persistedRuleShadowed !== undefined)
-                    return "shadowed";
-                if (ask?.decisionReason === "hook")
-                    return "mandated";
-                if (ask?.matchedAskRule !== undefined)
-                    return "shadowed";
-                if (ask?.inheritedUnresolved === true)
-                    return "mandated";
-                if (ask?.ancestorResolved === true)
-                    return "mandated";
-                return undefined;
-            })();
-            if (closedDoor !== undefined)
-                return { ruleOffersAbsence: closedDoor };
-            if (persistedRuleMandateOf({
-                egress: egressTools.has(toolName),
-                irreversibility: irreversibilityTier.get(toolName),
-                shellGated: shellGatedBash,
-                probeMandated: ask?.probeMandated === true,
-            }) !== undefined) {
-                return { ruleOffersAbsence: "mandated" };
-            }
-            const command = args?.command;
-            if (typeof command !== "string")
-                return { ruleOffersAbsence: "lane_cannot_speak" };
-            const offers = suggestRulesForCommand(command, ask?.segmentCoverage !== undefined ? { coverage: ask.segmentCoverage } : undefined);
-            return offers.length > 0 ? { ruleOffers: offers } : { ruleOffersAbsence: "lane_cannot_speak" };
-        };
+        const permissionRuleOrgLane = makeOrgAdjudicationLane(deps.permissionRuleOrg, questionToolMounted, (message) => deps.onError?.(new Error(message), { phase: "config", sessionId }));
+        const ruleOffersOf = makeRuleOffersOf({
+            laneArmed: permissionRuleLane !== undefined,
+            principal: spec.principal,
+            localOwnerDeclared: deps.localOwnerRules === true,
+            egressTools,
+            irreversibilityTier,
+            shellGatedBash,
+            taskRoot: taskRootFinal,
+            cwdRef: handsCwdRef,
+            deniesDirectoryRead: readDenyMatcher !== undefined ? (d) => readDenyMatcher.matchPath(d) !== null : undefined,
+        });
         const frozenClassifierExcluded = (d) => d.decisionReason === "hook" || d.matchedAskRule !== undefined;
         const recheckApprovedEdit = async (pol, onAskOf, creq, edit, csignal, ancestorDecider) => {
             let editArgs = edit;
@@ -4359,11 +4484,33 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 placementRootSessionId: stampPlacementRootSessionId(placementRootResolved),
                 externalContentTarget: externalContentTargetActive ? true : undefined,
             });
-            const commitSuspendSaga = async (token, cp, remoteEnv, remoteHandle) => {
+            const compensatePausedVM = (remoteEnv, snapshotId) => compensateUnparkedPause(remoteEnv, snapshotId, {
+                boundMs: PARK_COMPENSATION_TIMEOUT_MS,
+                noteFailure: (note) => remoteEnvFailures.push(note),
+                disclose: (err) => {
+                    try {
+                        deps.onError?.(err, { phase: "config", sessionId });
+                    }
+                    catch {
+                    }
+                },
+            });
+            const commitSuspendSaga = async (token, cp, remoteEnv, remoteHandle, cutSignal) => {
                 if (!checkpointStore)
-                    return { ok: false };
+                    return { tag: "absent" };
                 if (memoryEngineSession)
                     await memoryEngineSession.harvest("checkpoint");
+                if (cutSignal?.aborted) {
+                    if (remoteEnv !== undefined && remoteHandle?.snapshotId !== undefined) {
+                        const back = await compensatePausedVM(remoteEnv, remoteHandle.snapshotId);
+                        if (!back.ok) {
+                            abortController.abort();
+                            void harness.abort();
+                            return { tag: "compensation_failed", reason: back.reason };
+                        }
+                    }
+                    return { tag: "cut" };
+                }
                 const announceCommittedScreeningPark = () => {
                     const committedCount = cp.state.inheritedGate?.parentConstraintCount;
                     if (cp.state.inheritedGate?.requiresParentConstraint === true &&
@@ -4401,7 +4548,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 try {
                     await checkpointStore.put(token, cp);
                     announceCommittedScreeningPark();
-                    return { ok: true };
+                    return { tag: "committed" };
                 }
                 catch (putErr) {
                     deps.onError?.(putErr, { phase: "config", sessionId });
@@ -4417,7 +4564,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         catch {
                         }
                         announceCommittedScreeningPark();
-                        return { ok: true };
+                        return { tag: "committed" };
                     }
                     if (confirmed === "unknown") {
                         const unknownReason = "the approval checkpoint's state cannot be established (the store rejected the write and then could not be read back; a committed-but-unacknowledged row may exist) — the run is stopped rather than continued past an approval whose durable record is unknown";
@@ -4432,29 +4579,18 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         }
                         abortController.abort();
                         void harness.abort();
-                        return { ok: false, reason: unknownReason };
+                        return { tag: "unknown", reason: unknownReason };
                     }
                     const reason = "the approval checkpoint could not be persisted (the store rejected the write; the deployment's error face carries the store's own message)";
                     if (remoteEnv !== undefined && remoteHandle?.snapshotId !== undefined) {
-                        const { outcome: back, attempts: backAttempts } = await restoreWorkspaceWithRetry(remoteEnv, remoteHandle.snapshotId, {
-                            abortSignal: abortController.signal,
-                        });
-                        if (back.ok) {
-                            const init = await remoteEnv.postResumeInit();
-                            if (init.ok)
-                                return { ok: false, reason };
-                            remoteEnvFailures.push(remoteEnvFailureNote("postResumeInit", init.error, 1));
-                            deps.onError?.(init.error, { phase: "config", sessionId });
-                        }
-                        else {
-                            remoteEnvFailures.push(remoteEnvFailureNote("resumeVM", back.error, backAttempts));
-                            deps.onError?.(back.error, { phase: "config", sessionId });
-                        }
+                        const back = await compensatePausedVM(remoteEnv, remoteHandle.snapshotId);
+                        if (back.ok)
+                            return { tag: "absent", reason };
                         abortController.abort();
                         void harness.abort();
-                        return { ok: false, reason };
+                        return { tag: "compensation_failed", reason };
                     }
-                    return { ok: false, reason };
+                    return { tag: "absent", reason };
                 }
             };
             const suspendLoopCapHit = (count, cap, detail) => {
@@ -4536,7 +4672,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     ...(spec.durableApproval !== undefined ? { durableApproval: { ...spec.durableApproval } } : {}),
                     ...(spec.principal ? { principal: spec.principal } : {}),
                 };
-                if (!(await commitSuspendSaga(token, cp, suspendableEnv, remoteHandle)).ok)
+                if ((await commitSuspendSaga(token, cp, suspendableEnv, remoteHandle)).tag !== "committed")
                     return false;
                 publishCommittedSuspend({ suspendRef, reviewRef }, token, gate, scope, remoteHandle, cp.checkpointId, cp.pendingAction);
                 try {
@@ -4622,7 +4758,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         ...(spec.principal ? { principal: spec.principal } : {}),
                         ...(spec.durableApproval !== undefined ? { durableApproval: { ...spec.durableApproval } } : {}),
                     };
-                    if (!(await commitSuspendSaga(token, cp, suspendableEnv, remoteHandle)).ok)
+                    if ((await commitSuspendSaga(token, cp, suspendableEnv, remoteHandle)).tag !== "committed")
                         return false;
                     publishCommittedSuspend({ suspendRef, reviewRef }, token, gate, scope, remoteHandle, cp.checkpointId, cp.pendingAction);
                     try {
@@ -4718,7 +4854,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 }
             };
             const suspendAsk = parkLaneArmed && checkpointStore !== undefined
-                ? async (req, postHookArgs, safety, liveFaceUnavailable, realApproval, shadowedRule, askDecisionReason, probeReason, probeCause, segmentCoverage, matchedAskRule, probeMandated) => {
+                ? async (req, postHookArgs, safety, liveFaceUnavailable, realApproval, shadowedRule, askDecisionReason, probeReason, probeCause, segmentCoverage, matchedAskRule, probeMandated, callSignal) => {
                     const syncFirstEligible = req.toolName === ASK_USER_QUESTION_TOOL_NAME ? contentAskRoutable(req.toolCallId) : isLiveApproverSeat(onAsk);
                     if (syncFirstEligible &&
                         runtimeCaps?.forceDurableGate !== true &&
@@ -4726,6 +4862,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         !inheritedUnavailableAsks.has(req.toolCallId)) {
                         return undefined;
                     }
+                    const cutSignal = composedCallSignal(callSignal);
                     let token;
                     let gate;
                     let cp;
@@ -4761,13 +4898,18 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             if (!presented.ok) {
                                 throw new ParkRefusal(`the stored form of "${req.toolName}"'s arguments could not be presented for re-adjudication (${describeThrown(presented.cause)})`, { cause: presented.cause });
                             }
-                            const reprojected = refuseOutOfContractDecision(await basePolicyForResumeEdit.check({
+                            const reprojectedRaced = await raceSettlementAgainstSignal(Promise.resolve(basePolicyForResumeEdit.check({
                                 toolName: req.toolName,
                                 args: presented.value,
                                 toolCallId: req.toolCallId,
                                 budget: budgetSnapshot,
                                 ...(handsCwdRef !== undefined ? { cwd: handsCwdRef.current } : {}),
-                            }, abortController.signal));
+                            }, cutSignal)), cutSignal);
+                            if (reprojectedRaced.tag === "aborted")
+                                return undefined;
+                            if (reprojectedRaced.tag === "threw")
+                                throw reprojectedRaced.error;
+                            const reprojected = refuseOutOfContractDecision(reprojectedRaced.value);
                             const demanded = reprojected.updatedInput !== undefined ? tryCloneArgs(reprojected.updatedInput) : undefined;
                             const rewroteTheFiledValue = reprojected.updatedInput !== undefined &&
                                 !(demanded?.ok === true &&
@@ -4798,7 +4940,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         }
                         const { messages } = await session.buildContext();
                         const { batchToolCallIds, completedCallIds } = batchContextAt(messages, req.toolCallId);
-                        if (abortController.signal.aborted) {
+                        if (cutSignal.aborted) {
                             return undefined;
                         }
                         if (suspendLoopCapHit(suspendChainBase(), maxSuspends, ` for tool "${req.toolName}" — likely a resume/restart loop.`))
@@ -4806,12 +4948,20 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         if (remoteEnv !== undefined) {
                             if (hasBackgroundShell(remoteEnv))
                                 await sweepBackgroundShells(remoteEnv, defaultTaskRegistry);
-                            const snap = await remoteEnv.suspendVM({ abortSignal: abortController.signal });
+                            const snap = await remoteEnv.suspendVM({ abortSignal: cutSignal });
                             if (!snap.ok) {
                                 remoteEnvFailures.push(remoteEnvFailureNote("suspendVM", snap.error, 1));
                                 throw new Error(`suspendVM failed (${snap.error.code}): ${snap.error.message}`, { cause: snap.error });
                             }
                             remoteHandle = { ...remoteEnv.workspaceHandle(), snapshotId: snap.value };
+                            if (cutSignal.aborted) {
+                                const back = await compensatePausedVM(remoteEnv, snap.value);
+                                if (!back.ok) {
+                                    abortController.abort();
+                                    void harness.abort();
+                                }
+                                return undefined;
+                            }
                         }
                         else if (parkOnlyRemoteEnv !== undefined) {
                             if (hasBackgroundShell(parkOnlyRemoteEnv) && spec.retainBackgroundProcesses !== true)
@@ -4917,16 +5067,31 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         };
                     }
                     catch (err) {
-                        deps.onError?.(err, { phase: "config", sessionId });
-                        return {
-                            parkFailed: err instanceof ParkRefusal
-                                ? err.message
-                                : "the durable approval park could not be prepared (the deployment's error face carries the exception)",
-                        };
+                        const cutWon = cutSignal.aborted;
+                        const preselected = cutWon
+                            ? undefined
+                            : {
+                                parkFailed: err instanceof ParkRefusal
+                                    ? err.message
+                                    : "the durable approval park could not be prepared (the deployment's error face carries the exception)",
+                            };
+                        try {
+                            deps.onError?.(err, { phase: "config", sessionId });
+                        }
+                        catch {
+                        }
+                        return preselected;
                     }
-                    const committed = await commitSuspendSaga(token, cp, remoteEnv, remoteHandle);
-                    if (!committed.ok) {
-                        return committed.reason !== undefined ? { parkFailed: committed.reason } : undefined;
+                    const committed = await commitSuspendSaga(token, cp, remoteEnv, remoteHandle, cutSignal);
+                    if (committed.tag !== "committed") {
+                        if (committed.tag === "cut")
+                            return undefined;
+                        if (committed.tag === "absent") {
+                            if (cutSignal.aborted)
+                                return undefined;
+                            return committed.reason !== undefined ? { parkFailed: committed.reason } : undefined;
+                        }
+                        return { parkFailed: committed.reason };
                     }
                     publishCommittedSuspend({ suspendRef, reviewRef }, token, gate, cp.scope, remoteHandle, cp.checkpointId, cp.pendingAction);
                     try {

package/dist/core/runner/prepare-workspace-restore.d.ts

@@ -32,7 +32,12 @@ export declare function remoteEnvFailureNote(op: RemoteEnvFailureNote["op"], err
  * decides. A code outside the retryable family (`unsupported`, `auth_failed`) returns on the first
  * attempt — `withRetry` will not spend a second call on a permanent refusal.
  */
-export declare function restoreWorkspaceWithRetry(env: RemoteExecutionEnv, snapshotId: SnapshotId, options: VmLifecycleOptions): Promise<{
+export declare function restoreWorkspaceWithRetry(env: RemoteExecutionEnv, snapshotId: SnapshotId, options: VmLifecycleOptions, 
+/** design/384 slice 2 (additive): observe each attempt AS IT STARTS. The returned `attempts` is
+ *  only readable after settlement, and a caller whose wait on this promise is BOUNDED (the park
+ *  compensation) must report the live attempt count when its bound fires mid-call — without this
+ *  seat a deaf second attempt was reported as `attempts: 1`. */
+onAttempt?: (attempt: number) => void): Promise<{
     outcome: Awaited<ReturnType<RemoteExecutionEnv["resumeVM"]>>;
     attempts: number;
 }>;

package/dist/core/runner/prepare-workspace-restore.js

@@ -19,10 +19,11 @@ export function remoteEnvFailureNote(op, error, attempts) {
 }
 const REMOTE_RESTORE_MAX_ATTEMPTS = 2;
 const REMOTE_RESTORE_BACKOFF_MS = 200;
-export async function restoreWorkspaceWithRetry(env, snapshotId, options) {
+export async function restoreWorkspaceWithRetry(env, snapshotId, options, onAttempt) {
     let attempts = 0;
     const outcome = await withRetry(async (attempt) => {
         attempts = attempt;
+        onAttempt?.(attempt);
         return env.resumeVM(snapshotId, options);
     }, { retryableCodes: RETRYABLE_REMOTE_ERROR_CODES, maxAttempts: REMOTE_RESTORE_MAX_ATTEMPTS, backoffMs: () => REMOTE_RESTORE_BACKOFF_MS }, { ...(options.abortSignal !== undefined ? { signal: options.abortSignal } : {}) });
     return { outcome, attempts };

package/dist/core/runner/runtask.js

@@ -5080,12 +5080,22 @@ export class Runner {
                 await recheckGovernanceWindow();
         }
         this.locallyClaimedTokens.add(token);
-        const won = await store.resolve(token, cp.scope, outcomeForStore, { rev: cp.rev ?? 0 });
+        let won;
+        let claimLossStatus;
+        if (store.claimTerminal !== undefined) {
+            const claim = await store.claimTerminal(token, cp.scope, { kind: "resolve", outcome: outcomeForStore, expect: { rev: cp.rev ?? 0 } });
+            won = claim.claimed;
+            if (!claim.claimed)
+                claimLossStatus = claim.current.status;
+        }
+        else {
+            won = await store.resolve(token, cp.scope, outcomeForStore, { rev: cp.rev ?? 0 });
+        }
         if (!won)
             this.locallyClaimedTokens.delete(token);
         if (!won) {
-            const live = await store.get(token);
-            if (live?.status === "pending") {
+            const stillPending = claimLossStatus !== undefined ? claimLossStatus === "pending" : (await store.get(token))?.status === "pending";
+            if (stillPending) {
                 throw new CheckpointError("checkpoint.reopened_concurrently", "checkpoint changed concurrently (its revision advanced via a resolve/reopen cycle since this resume validated) — not executed; re-resume against the current state");
             }
             this.parentConstraintRegistry.delete(token);