@sema-agent/core 7.17.6 → 7.18.0

package/dist/core/task-notification.js

@@ -115,8 +115,74 @@ export function isDelegatedAgentTerminal(n) {
 export function isTerminalTaskNotification(n) {
     return TERMINAL_STATUSES.has(n.status);
 }
+export function createLiveNotificationLane(seat) {
+    const handedOff = new Set();
+    const enter = (admits) => (payload, priority, onDisposition) => {
+        const dedupKey = taskNotificationDedupKey(payload);
+        if (seat.alreadyDelivered(dedupKey))
+            return "duplicate";
+        if (!admits(dedupKey))
+            return "unavailable";
+        const accepted = seat.queue.enqueue({ kind: "task_notification", priority, dedupKey, payload, ...(onDisposition !== undefined ? { onDisposition } : {}) });
+        if (!accepted)
+            return "pending";
+        return "taken";
+    };
+    return {
+        take: enter(() => seat.isLive()),
+        takeAsDestination: enter((dedupKey) => seat.isLive() && seat.canTakeNow() && !handedOff.has(dedupKey)),
+        handOff: (payload) => {
+            if (!seat.isLive())
+                return;
+            handedOff.add(taskNotificationDedupKey(payload));
+            if (handedOff.size > MAX_DEDUP_KEYS) {
+                for (const k of handedOff) {
+                    handedOff.delete(k);
+                    if (handedOff.size <= MAX_DEDUP_KEYS)
+                        break;
+                }
+            }
+        },
+        release: () => handedOff.clear(),
+    };
+}
+export class SessionLiveNotificationLanes {
+    lanes = new Map();
+    register(sessionId, lane) {
+        const existing = this.lanes.get(sessionId);
+        if (existing === undefined)
+            this.lanes.set(sessionId, [lane]);
+        else if (!existing.includes(lane))
+            existing.push(lane);
+    }
+    unregister(sessionId, lane) {
+        const existing = this.lanes.get(sessionId);
+        if (existing === undefined)
+            return;
+        const at = existing.indexOf(lane);
+        if (at !== -1)
+            existing.splice(at, 1);
+        if (existing.length === 0)
+            this.lanes.delete(sessionId);
+    }
+    deliver(sessionId, payload, priority, opts) {
+        const existing = this.lanes.get(sessionId);
+        if (existing === undefined)
+            return "unavailable";
+        for (let i = existing.length - 1; i >= 0; i -= 1) {
+            const outcome = existing[i](payload, priority, opts?.onDisposition);
+            if (outcome !== "unavailable")
+                return outcome;
+        }
+        return "unavailable";
+    }
+    get size() {
+        return this.lanes.size;
+    }
+}
 export class PendingSessionNotifications {
     sessions = new Map();
+    liveLanes = new SessionLiveNotificationLanes();
     droppedSessions = 0;
     evictedSessions = new Map();
     unattributedDrops = 0;
@@ -163,6 +229,7 @@ export class PendingSessionNotifications {
             evictOldest(s, () => true);
     }
     drain(sessionId) {
+        this.routed.delete(sessionId);
         const s = this.sessions.get(sessionId);
         if (s !== undefined) {
             this.sessions.delete(sessionId);
@@ -182,10 +249,49 @@ export class PendingSessionNotifications {
         out.droppedWholeSession = (out.droppedWholeSession ?? 0) + (tomb ?? 0) + carried;
         return out;
     }
+    routed = new Map();
+    holdsKey(sessionId, dedupKey) {
+        return this.sessions.get(sessionId)?.keys.has(dedupKey) === true || this.routed.get(sessionId)?.has(dedupKey) === true;
+    }
+    markDelivered(sessionId, dedupKey) {
+        let mine = this.routed.get(sessionId);
+        if (mine === undefined) {
+            if (this.routed.size >= MAX_PENDING_SESSIONS) {
+                const oldest = this.routed.keys().next().value;
+                if (oldest !== undefined)
+                    this.routed.delete(oldest);
+            }
+            mine = new Set();
+            this.routed.set(sessionId, mine);
+        }
+        mine.add(dedupKey);
+        if (mine.size > MAX_PENDING_EVENTS_PER_SESSION) {
+            for (const k of mine) {
+                mine.delete(k);
+                if (mine.size <= MAX_PENDING_EVENTS_PER_SESSION)
+                    break;
+            }
+        }
+    }
     get size() {
         return this.sessions.size;
     }
 }
+export function routeOrParkNotification(store, sessionId, payload, priority, onDisposition) {
+    const dedupKey = taskNotificationDedupKey(payload);
+    if (store.holdsKey(sessionId, dedupKey)) {
+        onDisposition?.("parked");
+        return;
+    }
+    const routed = store.liveLanes.deliver(sessionId, payload, priority, { ...(onDisposition !== undefined ? { onDisposition } : {}) });
+    if (routed === "unavailable") {
+        store.pend(sessionId, payload, priority);
+        onDisposition?.("parked");
+    }
+    else if (routed !== "taken") {
+        onDisposition?.("queued");
+    }
+}
 function evictOldest(s, match) {
     let idx = s.items.findIndex((i) => match(i) && !TERMINAL_STATUSES.has(i.status));
     if (idx === -1)

package/dist/core/task-result.d.ts

@@ -541,7 +541,15 @@ export interface TaskResult {
      * `"open"` observation is never forwarded) closes that escape for ANY follow-on, not just the
      * verifier. See {@link effectiveReadDenyPatterns} for the deny-set half.
      */
-    effectiveReadFace?: import("../tools/fs/read-face.js").ReadFace;
+    effectiveReadFace?: import("../tools/fs/containment-face.js").ContainmentFace;
+    /**
+     * The WRITE-face containment state in force on this leg, the read seat's twin as an engine-filled
+     * OBSERVATION. Same in-presence condition as {@link effectiveReadFace} (every leg that completes
+     * prepare; absent only on prepare-failure terminals) and the same purpose: a POST-COMPLETION follow-on
+     * leg folds it stricter-wins into its own spec. Only `"roots"` is ever worth forwarding; an `"open"`
+     * observation never widens anything by itself.
+     */
+    effectiveWriteFace?: import("../tools/fs/containment-face.js").ContainmentFace;
     /**
      * The sensitive-path deny ADDITIONS in force on this leg beyond the
      * built-in table, normalized (deployment ∪ task ∪ checkpoint-frozen seed), as an engine-filled

package/dist/core/task-spec.d.ts

@@ -795,15 +795,32 @@ export interface TaskSpec {
     readDenyPatterns?: readonly import("../tools/fs/read-deny.js").ReadDenyEntry[];
     /**
      * design/199 件A — the TASK layer's read-face containment declaration
-     * ({@link import("../tools/fs/read-face.js").ReadFace}). "roots" pins this task (and, via the
+     * ({@link import("../tools/fs/containment-face.js").ContainmentFace}). "roots" pins this task (and, via the
      * tighten-only clamp, its whole delegation subtree) to the historical containment; "open" lifts
      * the roots judgment for the structured read faces — refused loudly under org governance (the
      * task layer only tightens there; the deployment opens via {@link RunnerDeps.readFace}) and
      * beside `handsReadOnly: true` (the verifier containment is load-bearing). Absent ⇒ the
      * deployment seat, then the engine default ("roots" — D-1b: an upgrade never opens implicitly).
-     * Bad values refuse loudly (#123). Never affects the write faces.
+     * Bad values refuse loudly (#123). Never affects the write faces — that is {@link writeFace}, a
+     * separate seat with its own default.
      */
-    readFace?: import("../tools/fs/read-face.js").ReadFace;
+    readFace?: import("../tools/fs/containment-face.js").ContainmentFace;
+    /**
+     * The TASK layer's WRITE-face containment declaration
+     * ({@link import("../tools/fs/containment-face.js").ContainmentFace}) — the read seat's twin,
+     * resolved through the SAME order (`resolveContainmentFace`, one body, one set of rows). "roots"
+     * pins this task (and, via the tighten-only clamp, its whole delegation subtree) to the historical
+     * write fence; "open" lifts the roots judgment for the structured WRITE faces (`edit_file` /
+     * `write_file` / `notebook_edit`) — refused loudly under org governance (the task layer only
+     * tightens there; the deployment opens via {@link RunnerDeps.writeFace}) and beside
+     * `handsReadOnly: true` (that mount carries no write faces at all). Absent ⇒ the deployment seat,
+     * then the engine default ("roots" — an upgrade never opens implicitly). Bad values refuse loudly.
+     *
+     * What "open" does NOT change: the write-side sensitive-path policy, the blocked-device gate, the
+     * UNC out-of-set refusal, the read-before-edit requirement and the deployment's approval policy. Seat
+     * independence is owned by `fs.containment_face.seat_independence` ({@link import("../tools/fs/containment-face.js").resolveContainmentFace}).
+     */
+    writeFace?: import("../tools/fs/containment-face.js").ContainmentFace;
     /**
      * design/80 D-B — opt in to PLAN MODE: mount the first-party `present_plan` tool (CC `ExitPlanMode` parity).
      * The model calls it to present a plan; the engine then pauses with a durable `plan_review` checkpoint

package/dist/core/tighten-task-spec.js

@@ -25,11 +25,13 @@ export function tightenTaskSpec(base, overrides) {
             merged[field] = [...new Set([...(b ?? []), ...(o ?? [])])];
         }
     }
-    if (base.readFace === "roots" && overrides.readFace === "open") {
-        throw new TaskSpecTightenError('tightenTaskSpec: cannot loosen readFace from "roots" to "open" (override may only tighten)');
-    }
-    if (base.readFace !== undefined || overrides.readFace !== undefined) {
-        merged.readFace = base.readFace === "roots" || overrides.readFace === "roots" ? "roots" : (overrides.readFace ?? base.readFace);
+    for (const faceKey of ["readFace", "writeFace"]) {
+        if (base[faceKey] === "roots" && overrides[faceKey] === "open") {
+            throw new TaskSpecTightenError(`tightenTaskSpec: cannot loosen ${faceKey} from "roots" to "open" (override may only tighten)`);
+        }
+        if (base[faceKey] !== undefined || overrides[faceKey] !== undefined) {
+            merged[faceKey] = base[faceKey] === "roots" || overrides[faceKey] === "roots" ? "roots" : (overrides[faceKey] ?? base[faceKey]);
+        }
     }
     if (base.readDenyPatterns !== undefined || overrides.readDenyPatterns !== undefined) {
         const seen = new Set();

package/dist/core/tool-model-gate.d.ts

@@ -67,7 +67,7 @@ export declare const TOOL_MODEL_GATE_CLASSES: Readonly<Record<string, ToolModelG
  */
 export declare function isModelGatedForClass(modelId: string, rule: ToolModelGateRule): boolean;
 /**
- * #123 value screen for `TaskSpec.restoreGatedTools` (same posture as `assertReadFaceValue`: the
+ * #123 value screen for `TaskSpec.restoreGatedTools` (same posture as `assertContainmentFaceValue`: the
  * VALUE is screened at the door, unconditionally — a garbage restore list must refuse loudly on
  * every leg, never be silently read as "no restore" in the narrowing direction). Legal: absent,
  * literal `true` (restore every class), or an array of strings (wire names; unknown names are

package/dist/core/tool-search-setting.d.ts

@@ -0,0 +1,78 @@
+/**
+ * The deferral gate's POLICY SEAT as vocabulary: the three states a deployment may declare
+ * (`RunnerDeps.toolSearch`), the word a disclosure reports, and the ONE reader that lowers the seat to the
+ * single number the gate compares against. Pure — no harness, no roster, no I/O. `runner/tool-defer-gate.ts`
+ * owns the gate that consumes the number.
+ */
+/** The default threshold percent: with no seat, the candidate set defers when its inlined size reaches this
+ *  percent of the model's context window. `DEFER_THRESHOLD_FRACTION` is derived from it. */
+export declare const TOOL_SEARCH_DEFAULT_THRESHOLD_PERCENT = 10;
+/** The typed refusal a `toolSearch` seat outside its domain raises: a bad value never selects an arm
+ *  silently and never folds back to the default gate. */
+export declare const TOOL_SEARCH_INVALID_CODE = "config.tool_search_invalid";
+/**
+ * The deployment's deferral-gate SETTING: `true` = the candidate set defers on every request, `false` = it never defers (and with no caller list no
+ * ToolSearch mounts), `{mode:"auto", thresholdPercent}` = the threshold gate at that percent of the context window (omitted ⇒
+ * {@link TOOL_SEARCH_DEFAULT_THRESHOLD_PERCENT}). Absent ⇒ that default — the pre-seat behavior.
+ *
+ * @contract defer_gate.one_threshold — the three states are THREE VALUES OF ONE NUMBER, never three code paths: {@link resolveToolSearch} lowers the seat to
+ * one threshold fraction (`true` ⇒ `0`, so every candidate byte is over budget; `false` ⇒ `Infinity`, so no candidate set reaches it; `auto:N` ⇒ `N/100`) and
+ * `deferralGate` keeps its ONE comparison `gatedChars ≥ thresholdChars`; a second arm for a new state breaks this contract rather than extending it. It
+ * governs rule ② ONLY — `TaskSpec.deferTools` still defers under every state, `alwaysLoadTools` still pins first, and `RunnerDeps.deferMode` remains the
+ * orthogonal knob that WIDENS rule ②'s candidate set.
+ */
+export type ToolSearchSetting = boolean | {
+    mode: "auto";
+    thresholdPercent?: number;
+};
+/** The three arms of {@link ToolSearchSetting} as one word — the disclosure face's vocabulary. */
+export declare const TOOL_SEARCH_POLICIES: readonly ["always", "never", "auto"];
+export type ToolSearchPolicy = (typeof TOOL_SEARCH_POLICIES)[number];
+/** The lowered seat: the word a disclosure reports, and the ONE number the gate compares against. */
+export interface ResolvedToolSearch {
+    policy: ToolSearchPolicy;
+    /** Present iff `policy === "auto"` — the percent the deployment asked for (or the default). */
+    thresholdPercent?: number;
+    /** The fraction of the context window the candidate set must reach: `0` (always) / `Infinity` (never) /
+     *  `thresholdPercent / 100`. This is the gate's only input from the seat. */
+    fraction: number;
+}
+/**
+ * The ONE reader of {@link ToolSearchSetting} (`@contract defer_gate.one_threshold`). A value outside the domain refuses loudly with
+ * {@link TOOL_SEARCH_INVALID_CODE} — an unparseable knob must not fall back to the default gate while the deployment believes its declaration took effect.
+ * The object form's MEMBER SET is part of that domain (`mode` + `thresholdPercent`, nothing else): an unknown key is the same silent fold one level down,
+ * since a misspelled percent lowers to the default while the declaration looks like it took effect.
+ * `thresholdPercent` must be a finite number in `[0, 100]`, and the two ends are NOT symmetric: `auto:0` is
+ * an exact alias for `true` (threshold 0), while `auto:100` is the FULL-WINDOW threshold, not `false`. Only
+ * `false` never defers.
+ */
+export declare function resolveToolSearch(setting: ToolSearchSetting | undefined): ResolvedToolSearch;
+/**
+ * Describe a REJECTED value for a refusal message — the ONE describer the config seats share — without ever
+ * throwing, and without letting the rejected value NARRATE ITSELF.
+ *
+ * Two failures, one root. `JSON.stringify` is not total (a BigInt and a circular object make it throw, and a
+ * formatter that throws inside a refusal replaces the coded refusal with an uncoded `TypeError`) — and where
+ * it does not throw it calls the VALUE'S OWN `toJSON`, i.e. it asks the thing being rejected to say what it
+ * is. Measured: `{ toJSON: () => "open" }` described itself as `"open"`, so a refusal of an illegal object
+ * read as a refusal of a legal word; `{ toJSON: () => undefined }` fell through to `String(value)` and read
+ * `[object Object]`; a function printed its whole source (unbounded, and equally forgeable through
+ * `toString`); and `NaN` / `Infinity` — the two numbers these seats reject most — both came out as `null`,
+ * the spelling of a value the caller never wrote.
+ *
+ * So: PRIMITIVES are spelled exactly (a number through `String`, which is total and keeps `NaN`, `Infinity`
+ * and the `-0` a caller can only have written deliberately); anything else is DESCRIBED structurally — its
+ * shape, its constructor's name and its own top-level keys, bounded. Reading those may still hit a proxy's
+ * traps (every read is guarded), but NOTHING a read hands back is turned into text unless it is already a
+ * primitive of the expected domain — a formatting hook of the value is never what writes this sentence. A description is worth less to a reader than the value would be; a WRONG value is worth less than
+ * nothing, because it sends them to fix something they did not write.
+ */
+export declare function describeRejectedValue(value: unknown): string;
+/**
+ * The INERT spelling of a lowered policy — the exact seat value that lowers back to it, with no accessor,
+ * proxy or prototype left on the path. A nested accessor (`get thresholdPercent()`) answers every later read
+ * differently, so a phase that runs several passes over one cached object still measures several different
+ * numbers. Round-trip: `resolveToolSearch(toolSearchSettingOf(r))` deep-equals `r` for every `r` this module
+ * mints.
+ */
+export declare function toolSearchSettingOf(resolved: ResolvedToolSearch): ToolSearchSetting;

package/dist/core/tool-search-setting.js

@@ -0,0 +1,90 @@
+export const TOOL_SEARCH_DEFAULT_THRESHOLD_PERCENT = 10;
+export const TOOL_SEARCH_INVALID_CODE = "config.tool_search_invalid";
+export const TOOL_SEARCH_POLICIES = ["always", "never", "auto"];
+export function resolveToolSearch(setting) {
+    if (setting === undefined)
+        return { policy: "auto", thresholdPercent: TOOL_SEARCH_DEFAULT_THRESHOLD_PERCENT, fraction: TOOL_SEARCH_DEFAULT_THRESHOLD_PERCENT / 100 };
+    if (setting === true)
+        return { policy: "always", fraction: 0 };
+    if (setting === false)
+        return { policy: "never", fraction: Number.POSITIVE_INFINITY };
+    if (typeof setting !== "object" || setting === null) {
+        throw toolSearchRefusal(`invalid value ${describeRejectedValue(setting)} — expected true, false, {mode:"auto"} or {mode:"auto", thresholdPercent:N}`);
+    }
+    let mode;
+    let percent;
+    let keys = [];
+    try {
+        keys = Object.keys(setting);
+        mode = setting.mode;
+        percent = setting.thresholdPercent;
+    }
+    catch {
+        throw toolSearchRefusal(`its members could not be read (a throwing accessor, or a revoked proxy) — expected true, false, {mode:"auto"} or {mode:"auto", thresholdPercent:N}`);
+    }
+    if (mode !== "auto") {
+        throw toolSearchRefusal(`invalid value ${describeRejectedValue(setting)} — expected true, false, {mode:"auto"} or {mode:"auto", thresholdPercent:N}`);
+    }
+    const stray = keys.find((k) => k !== "mode" && k !== "thresholdPercent");
+    if (stray !== undefined) {
+        throw toolSearchRefusal(`unknown member ${JSON.stringify(stray)} — the object form carries mode and thresholdPercent only`);
+    }
+    if (percent === undefined)
+        return { policy: "auto", thresholdPercent: TOOL_SEARCH_DEFAULT_THRESHOLD_PERCENT, fraction: TOOL_SEARCH_DEFAULT_THRESHOLD_PERCENT / 100 };
+    if (typeof percent !== "number" || !Number.isFinite(percent) || percent < 0 || percent > 100) {
+        throw toolSearchRefusal(`thresholdPercent ${describeRejectedValue(percent)} is not a finite percent in [0, 100]`);
+    }
+    return { policy: "auto", thresholdPercent: percent, fraction: percent / 100 };
+}
+export function describeRejectedValue(value) {
+    try {
+        switch (typeof value) {
+            case "bigint":
+                return `${value}n`;
+            case "symbol":
+                return String(value);
+            case "string":
+                return JSON.stringify(value);
+            case "number":
+                return Object.is(value, -0) ? "-0" : String(value);
+            case "boolean":
+            case "undefined":
+                return String(value);
+            case "function":
+                return "a function";
+        }
+        if (value === null || value === undefined)
+            return String(value);
+        let ctor = "";
+        try {
+            const name = value.constructor?.name;
+            if (typeof name === "string" && name !== "" && name !== "Object" && name !== "Array")
+                ctor = ` (${name.slice(0, 40)})`;
+        }
+        catch {
+        }
+        if (Array.isArray(value)) {
+            const n = value.length;
+            return `an array${ctor}${typeof n === "number" && Number.isSafeInteger(n) && n >= 0 ? ` of ${n} member(s)` : ""}`;
+        }
+        const keys = Object.keys(value);
+        if (keys.length === 0)
+            return `an object${ctor} with no keys`;
+        return `an object${ctor} with keys [${keys.slice(0, 5).map((k) => k.slice(0, 40)).join(", ")}${keys.length > 5 ? ", …" : ""}]`;
+    }
+    catch {
+        return `a value of type ${value === null ? "null" : typeof value} that cannot be described`;
+    }
+}
+export function toolSearchSettingOf(resolved) {
+    if (resolved.policy === "always")
+        return true;
+    if (resolved.policy === "never")
+        return false;
+    return { mode: "auto", thresholdPercent: resolved.thresholdPercent ?? TOOL_SEARCH_DEFAULT_THRESHOLD_PERCENT };
+}
+function toolSearchRefusal(problem) {
+    const e = new Error(`RunnerDeps.toolSearch: ${problem}; a bad value refuses loudly, nothing falls back to the default gate.`);
+    e.code = TOOL_SEARCH_INVALID_CODE;
+    return e;
+}

package/dist/core/tool-spec.d.ts

@@ -852,6 +852,14 @@ export interface ToolExecuteContext {
      * ONLY as the delegation carrier — no tool adapts its model-facing behavior on it.
      */
     readFace?: "roots";
+    /**
+     * The WRITE-face clamp carrier ({@link TaskSpec.writeFace}), the read carrier's twin: present (as
+     * "roots") ONLY when this run RESOLVED to the roots write face, so a delegation tool pins every
+     * child spec to roots — without it a roots-narrowed parent's children would resolve the shared
+     * deployment seat (possibly "open") and write wider than the parent could. Strictly a tightening
+     * carrier, and independent of {@link readFace}.
+     */
+    writeFace?: "roots";
     /**
      * design/199 件B — the parent task's OWN deny-set additions ({@link TaskSpec.readDenyPatterns}),
      * traveling the delegation tree add-only (a child judges at least every entry its parent judged).

package/dist/core/types.d.ts

@@ -28,5 +28,5 @@ export type { BackgroundChildEvent, DelegationLifecycleEvent } from "./delegatio
 export { __resetMalformedDelegationSeatAnnouncement, deliverDelegationLifecycle } from "./delegation-frames.js";
 export type { ProjectMemoryLoad, ResumePreflightInfo, ResumePreflightVerdict, RunnerDeps } from "./runner-deps.js";
 export type { EngineNotice } from "./engine-notice.js";
-export { __resetMalformedNoticeSeatAnnouncement, deliverEngineNotice, undrainedUserInputNotices } from "./engine-notice.js";
+export { __resetMalformedNoticeSeatAnnouncement, deliverEngineNotice, owedUserInputCounts, undrainedUserInputNotices } from "./engine-notice.js";
 export type { AgentTool, Model, StreamFn, ThinkingLevel, ToolInputValidationContext, ToolInputVerdict };

package/dist/core/types.js

@@ -1,3 +1,3 @@
 export { AUTO_MODE_DENY_SOURCES, isAutoModeDenySource } from "./runtime-caps.js";
 export { __resetMalformedDelegationSeatAnnouncement, deliverDelegationLifecycle } from "./delegation-frames.js";
-export { __resetMalformedNoticeSeatAnnouncement, deliverEngineNotice, undrainedUserInputNotices } from "./engine-notice.js";
+export { __resetMalformedNoticeSeatAnnouncement, deliverEngineNotice, owedUserInputCounts, undrainedUserInputNotices } from "./engine-notice.js";

package/dist/core/wiring-manifest.d.ts

@@ -22,6 +22,7 @@
  */
 import type { RunnerDeps, TaskSpec } from "./types.js";
 import { type StoreDurability } from "./checkpoint-store.js";
+import type { WiringManifestHookEntry } from "./hook-seats.js";
 import type { McpDelivered, McpFailureKind } from "./mcp-failure.js";
 export type { StoreDurability };
 /** The manifest-face projection of {@link StoreDurability}: `"declared_durable"` (the name says it —
@@ -110,11 +111,27 @@ export interface WiringManifestMcpEntry {
     error?: string;
     toolCount: number;
 }
+/** Which LSP lanes this leg armed. The two lanes are INDEPENDENT and the word is their product: `tool` = the
+ *  code-intelligence tool mounted and nothing more; `diagnostics` = the push lane armed (a registry-feeding
+ *  manager, write-capable hands, no opt-out) while the tool is NOT on the roster; `tool_and_diagnostics` =
+ *  both. A leg whose `LSP` tool was excluded can still be pushing diagnostics. */
+export declare const LSP_LANES: readonly ["tool", "diagnostics", "tool_and_diagnostics"];
+export type LspLane = (typeof LSP_LANES)[number];
+/** The contract id the LSP tool mounts under (`createLspTool`) — the roster's structural discriminator, which
+ *  a disclosure keys on instead of re-spelling the wire name. */
+export declare const LSP_CONTRACT_ID = "core.lsp@1";
+/** The manifest's LSP seam from its two INDEPENDENT facts (see {@link WiringManifest.lsp}): the lane word is
+ *  their product, and is absent only when neither lane is live. */
+export declare function deriveLspSeam(mounted: boolean, diagnosticsLive: boolean): {
+    mounted: boolean;
+    lane?: LspLane;
+};
 /**
  * design/173 §2.2/§8.4 — the wiring manifest. Consumers MUST ignore unknown fields
  * (`schemaVersion` bumps only on a semantic break of an EXISTING field). The TaskEvent face is the
  * host/operator plane — the manifest never enters model context.
  */
+export type { WiringManifestHookEntry };
 export interface WiringManifest {
     schemaVersion: 1;
     /** Present on EFFECTIVE (per-leg) manifests only; the static half has no leg. */
@@ -280,6 +297,28 @@ export interface WiringManifest {
      * `tool_roster_delta` event, never as a re-emitted manifest.
      */
     tools?: import("./tool-roster.js").ToolRoster;
+    /**
+     * EFFECTIVE half only: the hook seats this leg wired, one entry per family, in {@link import("./hook-seats.js").HOOK_FAMILIES} order. PRESENT IFF at least one
+     * seat is wired — a deployment that wires none reports nothing here and its manifest (and {@link configFingerprint}) is byte-for-byte what it was; an empty
+     * array is never emitted, so absence reads as "this leg wired no hook RECORD of its own" — NOT as "no hook runs": a delegated child with no local record can
+     * still be screened (and refused) by an ancestor's `preToolUse` through the gate's constraint fold, which this face deliberately does not call a hook of
+     * this leg. Every entry is deployment code the engine awaits on the critical path, fail-closed on the two decision seats. EXCLUDED from
+     * {@link configFingerprint}: the record is a per-task seat, so one assembly's legs legitimately differ on it.
+     */
+    hooks?: readonly WiringManifestHookEntry[];
+    /**
+     * EFFECTIVE half only: the LSP code-intelligence seam. PRESENT IFF a manager seat resolved
+     * (`spec.lspManager ?? deps.lspManager`); a deployment that wires none reports nothing (byte-for-byte
+     * unchanged, fingerprint included). `mounted` is the ROSTER fact, not the seat fact — a wired manager
+     * whose `LSP` tool was excluded reports `false` — and `lane` is INDEPENDENT of it: the diagnostics push
+     * lane arms on the manager, the hands and the opt-out, never on the mount, so
+     * `{mounted:false, lane:"diagnostics"}` is a real and reachable state. `lane` is absent only when
+     * neither lane is live.
+     */
+    lsp?: {
+        mounted: boolean;
+        lane?: LspLane;
+    };
     /** EFFECTIVE half only — a short, non-sensitive fingerprint (sha256 prefix over the canonical
      *  JSON of this manifest's own resolved facts; every field here is an enum/boolean/count, no
      *  secrets) so an operator can correlate legs that ran under the same resolved assembly. */
@@ -351,6 +390,13 @@ export interface WiringFacts {
     mcp?: readonly WiringManifestMcpEntry[];
     /** Effective half only — the leg's minted tool roster (see {@link WiringManifest.tools}). */
     tools?: import("./tool-roster.js").ToolRoster;
+    /** Effective half only — the wired hook seats ({@link WiringManifest.hooks}); an empty array and an absent value derive the same thing (no section). */
+    hooks?: readonly WiringManifestHookEntry[];
+    /** Effective half only — the LSP seam ({@link WiringManifest.lsp}); absent ⇒ no manager wired. */
+    lsp?: {
+        mounted: boolean;
+        lane?: LspLane;
+    };
 }
 /** Named view of the deps seats the static half reads (a `Pick` of the real {@link RunnerDeps} —
  *  single-source shapes, no parallel hand-copied interface). */

package/dist/core/wiring-manifest.js

@@ -4,6 +4,12 @@ import { resolveCheckpointStore } from "./checkpoint-store.js";
 import { isLiveQuestionFace } from "./ask-question.js";
 import { AUTO_MODE_DENY_SOURCES, isAutoModeDenySource } from "./runtime-caps.js";
 export const AUTO_MODE_ARM_REASONS = ["armed", "no_intent", "no_face", "denied", "resolver_fault"];
+export const LSP_LANES = ["tool", "diagnostics", "tool_and_diagnostics"];
+export const LSP_CONTRACT_ID = "core.lsp@1";
+export function deriveLspSeam(mounted, diagnosticsLive) {
+    const lane = mounted ? (diagnosticsLive ? "tool_and_diagnostics" : "tool") : diagnosticsLive ? "diagnostics" : undefined;
+    return { mounted, ...(lane !== undefined ? { lane } : {}) };
+}
 export function resolveDeclaredDurability(store, storeName) {
     const declared = store?.durability;
     if (declared === undefined)
@@ -133,9 +139,11 @@ export function deriveWiringManifest(facts) {
         ...(facts.half === "effective" && facts.autoMode !== undefined ? { autoMode: readAutoModeFact(facts.autoMode) } : {}),
         ...(facts.half === "effective" && facts.mcp !== undefined ? { mcp: facts.mcp.map((e) => ({ ...e })) } : {}),
         ...(facts.half === "effective" && facts.tools !== undefined ? { tools: facts.tools } : {}),
+        ...(facts.half === "effective" && facts.hooks !== undefined && facts.hooks.length > 0 ? { hooks: facts.hooks.map((h) => ({ ...h })) } : {}),
+        ...(facts.half === "effective" && facts.lsp !== undefined ? { lsp: { ...facts.lsp } } : {}),
     };
     if (facts.half === "effective") {
-        const { leg: _leg, mcp: _mcp, tools: _tools, ...assembly } = manifest;
+        const { leg: _leg, mcp: _mcp, tools: _tools, lsp: _lsp, hooks: _hooks, ...assembly } = manifest;
         const { provenance: _askSeat, ...askForHash } = assembly.ask;
         const { provenance: _questionSeat, ...questionForHash } = assembly.question;
         manifest.configFingerprint = createHash("sha256")

package/dist/engine/execution-env/node-execution-env.js

@@ -359,7 +359,7 @@ export class NodeExecutionEnv {
             const stderrTail = new RollingTailBuffer();
             let settled = false;
             let timedOut = false;
-            let abortKillInFlight = false;
+            let terminationInFlight = false;
             let callbackError;
             let child;
             const timeoutRef = {};
@@ -391,7 +391,7 @@ export class NodeExecutionEnv {
                 return { stdout: markTruncated(so.text, so.droppedBytes), stderr: markTruncated(se.text, se.droppedBytes) };
             };
             const onAbort = () => {
-                abortKillInFlight = true;
+                terminationInFlight = true;
                 if (child?.pid) {
                     const abortTarget = child;
                     killProcessTree(child.pid, { stillRunning: () => abortTarget.exitCode === null && abortTarget.signalCode === null });
@@ -480,10 +480,11 @@ export class NodeExecutionEnv {
                 timeoutMs === undefined
                     ? undefined
                     : setTimeout(() => {
-                        if (options?.autoBackgroundOnTimeout && !abortKillInFlight && adoptOnTimeoutRef.current) {
+                        if (options?.autoBackgroundOnTimeout && !terminationInFlight && adoptOnTimeoutRef.current) {
                             adoptOnTimeoutRef.current();
                             return;
                         }
+                        terminationInFlight = true;
                         timedOut = true;
                         if (child?.pid) {
                             const timeoutTarget = child;
@@ -598,9 +599,11 @@ export class NodeExecutionEnv {
                 spoolPumpRef.current.unref?.();
             }
             const onDetach = (cause) => {
-                if (settled || !child)
+                if (settled || terminationInFlight || !child)
                     return false;
                 pumpSpoolRef.current?.();
+                if (settled || terminationInFlight)
+                    return false;
                 const shellId = this.adoptRunningChild(child, stdoutTail.result(), stderrTail.result(), execSpoolRef.current !== undefined ? { spool: execSpoolRef.current, cursors: { out: spoolCursor.out, err: spoolCursor.err } } : undefined);
                 if (shellId === undefined)
                     return false;
@@ -616,6 +619,9 @@ export class NodeExecutionEnv {
             adoptOnTimeoutRef.current = () => {
                 if (onDetach("timeout"))
                     return;
+                if (terminationInFlight)
+                    return;
+                terminationInFlight = true;
                 timedOut = true;
                 if (child?.pid) {
                     const adoptFallbackTarget = child;