@sema-agent/core 7.17.7 → 7.19.0

package/dist/agents/send-message-tool.js

@@ -999,6 +999,7 @@ export function createSendMessageTool(opts) {
                     currentClamps: {
                         ...(ctx.handsReadOnly === true ? { handsReadOnly: true } : {}),
                         ...(ctx.readFace === "roots" ? { readFaceRoots: true } : {}),
+                        ...(ctx.writeFace === "roots" ? { writeFaceRoots: true } : {}),
                         ...(ctx.readDenyPatterns !== undefined ? { readDenyPatterns: ctx.readDenyPatterns } : {}),
                         ...(ctx.interactiveTools === false ? { interactiveTools: false } : {}),
                         ...(ctx.oneShot === true ? { oneShot: true } : {}),

package/dist/agents/subagent.d.ts

@@ -468,6 +468,7 @@ export declare function createSubagentResume(deps: {
         oneShot?: true;
         memoryPersistenceCapable?: false;
         readFaceRoots?: true;
+        writeFaceRoots?: true;
         readDenyPatterns?: readonly import("../tools/fs/read-deny.js").ReadDenyEntry[];
     };
     /** The RESUMING caller's own handback-review seat (its trusted `ToolExecuteContext.autoModeReview`),

package/dist/agents/subagent.js

@@ -558,6 +558,7 @@ export function createSubagentResume(deps) {
                 ...(deps.currentOnQuestion !== undefined ? { onQuestion: deps.currentOnQuestion } : {}),
                 ...(entry.specSnapshot.handsReadOnly === true || deps.currentClamps?.handsReadOnly === true ? { handsReadOnly: true } : {}),
                 ...(entry.specSnapshot.readFace === "roots" || deps.currentClamps?.readFaceRoots === true ? { readFace: "roots" } : {}),
+                ...(entry.specSnapshot.writeFace === "roots" || deps.currentClamps?.writeFaceRoots === true ? { writeFace: "roots" } : {}),
                 ...(entry.specSnapshot.readDenyPatterns !== undefined || deps.currentClamps?.readDenyPatterns !== undefined
                     ? { readDenyPatterns: [...(entry.specSnapshot.readDenyPatterns ?? []), ...(deps.currentClamps?.readDenyPatterns ?? [])] }
                     : {}),
@@ -1903,6 +1904,9 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                     ...(ctx.alwaysLoadTools !== undefined ? { alwaysLoadTools: [...ctx.alwaysLoadTools] } : {}),
                     ...(ctx.restoreGatedTools !== undefined ? { restoreGatedTools: ctx.restoreGatedTools === true ? true : [...ctx.restoreGatedTools] } : {}),
                     ...(ctx.promptProfile !== undefined ? { promptProfile: ctx.promptProfile } : {}),
+                    ...(ctx.readFace === "roots" ? { readFace: "roots" } : {}),
+                    ...(ctx.writeFace === "roots" ? { writeFace: "roots" } : {}),
+                    ...(ctx.readDenyPatterns !== undefined ? { readDenyPatterns: [...ctx.readDenyPatterns] } : {}),
                     enableBlockedReport: false,
                     limits: {
                         maxTurns: typeof observerDef.maxTurns === "number" && Number.isFinite(observerDef.maxTurns) && observerDef.maxTurns > 0 ? observerDef.maxTurns : 8,
@@ -2159,6 +2163,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                 ...(ctx.interactiveTools === false ? { interactiveTools: false } : {}),
                 ...(ctx.handsReadOnly === true ? { handsReadOnly: true } : {}),
                 ...(ctx.readFace === "roots" ? { readFace: "roots" } : {}),
+                ...(ctx.writeFace === "roots" ? { writeFace: "roots" } : {}),
                 ...(ctx.readDenyPatterns !== undefined ? { readDenyPatterns: [...ctx.readDenyPatterns] } : {}),
                 ...(ctx.excludeTools !== undefined ? { excludeTools: [...ctx.excludeTools] } : {}),
                 ...(ctx.deferTools !== undefined ? { deferTools: [...ctx.deferTools] } : {}),

package/dist/agents/teacher.js

@@ -257,6 +257,7 @@ async function runTeacherCore(runner, studentSpec, teacher) {
         ...(studentSpec.promptProfile !== undefined ? { promptProfile: studentSpec.promptProfile } : {}),
         ...(studentSpec.handsReadOnly === true ? { handsReadOnly: true } : {}),
         ...(studentSpec.readFace === "roots" ? { readFace: "roots" } : {}),
+        ...(studentSpec.writeFace === "roots" ? { writeFace: "roots" } : {}),
         ...(studentSpec.readDenyPatterns !== undefined ? { readDenyPatterns: [...studentSpec.readDenyPatterns] } : {}),
         ...(studentSpec.interactiveTools === false ? { interactiveTools: false } : {}),
         ...(studentSpec.excludeTools !== undefined

package/dist/agents/verify.js

@@ -109,6 +109,7 @@ export async function verifyCompleted(runner, result, specBase, objective, confi
     const notifier = createSafeNotifier(config.onNotifyError !== undefined ? { onError: config.onNotifyError } : undefined);
     const verifierTools = config.verifierTools ?? (specBase.tools ?? []).filter((t) => t.effect === "read");
     const foldedRootsFace = specBase.readFace === "roots" || result.effectiveReadFace === "roots";
+    const foldedRootsWriteFace = specBase.writeFace === "roots" || result.effectiveWriteFace === "roots";
     const foldedReadDeny = [...(specBase.readDenyPatterns ?? []), ...(result.effectiveReadDenyPatterns ?? [])];
     const carryFrozenPosture = (r) => {
         const face = result.effectiveReadFace === "roots" ? "roots" : r.effectiveReadFace;
@@ -143,6 +144,7 @@ export async function verifyCompleted(runner, result, specBase, objective, confi
             tools: verifierTools,
             handsReadOnly: config.verifierHandsReadOnly ?? true,
             ...(foldedRootsFace ? { readFace: "roots" } : {}),
+            ...(foldedRootsWriteFace ? { writeFace: "roots" } : {}),
             ...(foldedReadDeny.length > 0 ? { readDenyPatterns: [...foldedReadDeny] } : {}),
             interactiveTools: false,
             outputSchema: VerdictSchema,
@@ -244,6 +246,7 @@ export async function verifyCompleted(runner, result, specBase, objective, confi
             sessionId: current.sessionId,
             objective: fixObjective(outcome.findings),
             ...(foldedRootsFace ? { readFace: "roots" } : {}),
+            ...(foldedRootsWriteFace ? { writeFace: "roots" } : {}),
             ...(foldedReadDeny.length > 0 ? { readDenyPatterns: [...foldedReadDeny] } : {}),
         }, legInternals());
         spend += (current.stats.costMicroUsd ?? 0) + (current.stats.nested?.costMicroUsd ?? 0);

package/dist/brain/anthropic.js

@@ -2,7 +2,7 @@ import {} from "../internal/llm.js";
 import { BrainError } from "./errors.js";
 import { startsWithInputTooLongAnchor } from "./input-too-long.js";
 import { DEGENERATE_MESSAGE, trimDegenerateTail } from "./repetition.js";
-import { createRepetitionPoll, parseStreamedToolArgs } from "./stream-shared.js";
+import { STREAM_TORN_WARNING, createRepetitionPoll, parseStreamedToolArgs } from "./stream-shared.js";
 import { mintFallbackToolCallId } from "./tool-call-id.js";
 import { emitBrainTelemetry, reportReasoningWireFacts } from "./status-sink.js";
 import { errorResultMediaNote, IMAGE_OMITTED_NO_VISION, modelSupportsVision, sendableImages } from "./media-degrade.js";
@@ -560,7 +560,7 @@ export function createAnthropicBrain(config = {}) {
                         }
                         handleEvent(evt);
                     },
-                    finalize() {
+                    finalize(opts) {
                         const finalContent = [];
                         const toolCalls = [];
                         const malformed = [];
@@ -666,6 +666,8 @@ export function createAnthropicBrain(config = {}) {
                             emptyNoFinish ||
                             (toolError !== undefined && noUsableContent) ||
                             (truncatedEmpty && !dynamicCut && !staticReasoningCut);
+                        const tornWithContent = !errored && opts?.truncated !== true && stopReason == null && !noUsableContent && !degenerate;
+                        const errorMessageOut = tornWithContent ? (errorMessage ? `${errorMessage}\n${STREAM_TORN_WARNING}` : STREAM_TORN_WARNING) : errorMessage;
                         const errorKind = degenerate
                             ? "degenerate"
                             : !safetyCut && contextWindowExceeded
@@ -680,8 +682,9 @@ export function createAnthropicBrain(config = {}) {
                             usage: computeUsage(model, usageRaw),
                             ...(Object.keys(usageRaw).length === 0 ? { usageMissing: true } : {}),
                             timestamp: Date.now(),
-                            ...(errorMessage ? { errorMessage } : {}),
+                            ...(errorMessageOut ? { errorMessage: errorMessageOut } : {}),
                             ...(errorKind ? { errorKind } : {}),
+                            ...(tornWithContent ? { partialFinalized: true } : {}),
                             ...(rep.cut !== undefined || rep.spared.length > 0
                                 ? { repetition: { ...(rep.cut !== undefined ? { cut: rep.cut } : {}), ...(rep.spared.length > 0 ? { spared: rep.spared } : {}) } }
                                 : {}),

package/dist/brain/open-responses.js

@@ -1,7 +1,7 @@
 import {} from "../internal/llm.js";
 import { BrainError } from "./errors.js";
 import { DEGENERATE_MESSAGE, trimDegenerateTail } from "./repetition.js";
-import { createRepetitionPoll, parseStreamedToolArgs } from "./stream-shared.js";
+import { STREAM_TORN_WARNING, createRepetitionPoll, parseStreamedToolArgs } from "./stream-shared.js";
 import { mintFallbackToolCallId } from "./tool-call-id.js";
 import { emitBrainTelemetry } from "./status-sink.js";
 import { errorResultMediaNote, IMAGE_OMITTED_NO_VISION, imagesOmittedNoVisionNote, modelSupportsVision, sendableImages } from "./media-degrade.js";
@@ -195,6 +195,7 @@ function responsesErrorCode(code) {
 }
 const INCOMPLETE_MAX_OUTPUT_TOKENS = "max_output_tokens";
 const INCOMPLETE_CONTENT_FILTER = "content_filter";
+const RESPONSE_INCOMPLETE_WARNING = 'The response above may be incomplete: the endpoint reported status "incomplete" with no reason this client recognises.';
 function closeFunctionCall(acc) {
     if (acc.closedTc)
         return acc.closedTc;
@@ -688,7 +689,8 @@ export function createOpenResponsesBrain(config = {}) {
                         const staticReasoningCut = truncatedEmpty && !dynamicCut && reasoningSeen && options?.staticReasoningCutDowngrade === true;
                         const safetyCut = incompleteReason === INCOMPLETE_CONTENT_FILTER;
                         const refused = accumRefusal.trim().length > 0;
-                        const emptyNoFinish = noUsableContent && terminalStatus === undefined && !degenerate;
+                        const incompleteUnmapped = terminalStatus === "incomplete" && incompleteReason !== INCOMPLETE_MAX_OUTPUT_TOKENS && incompleteReason !== INCOMPLETE_CONTENT_FILTER;
+                        const emptyNoFinish = noUsableContent && (terminalStatus === undefined || incompleteUnmapped) && !degenerate;
                         const maxTokensNote = sentMaxTokens !== undefined
                             ? `effective max_output_tokens=${sentMaxTokens} (from ${sentMaxTokensLane === "options"
                                 ? "options.maxTokens"
@@ -708,7 +710,7 @@ export function createOpenResponsesBrain(config = {}) {
                                                 ? `[length_empty] response truncated at max_output_tokens (${maxTokensNote}) with no answer text — the model spent the whole budget on reasoning; raise the cap, or lower the reasoning effort for this task.`
                                                 : `[length_empty] response truncated at max_output_tokens (${maxTokensNote}) with no answer text — raise the cap`
                                             : emptyNoFinish
-                                                ? `[stream_torn] model stream ended with no content and no terminal response event — the response was lost (a torn stream or an in-band provider error frame)${malformedFrames > 0 ? ` — ${malformedFrames} unparseable data frame(s) were dropped on this stream (first sample: ${JSON.stringify(malformedSample)})` : ""}`
+                                                ? `[stream_torn] model stream ended with no content and ${terminalStatus === undefined ? "no terminal response event" : `a terminal status "${terminalStatus}" with no reason this client recognises (incomplete_details.reason=${incompleteReason ?? "absent"})`} — the response was lost (a torn stream or an in-band provider error frame)${malformedFrames > 0 ? ` — ${malformedFrames} unparseable data frame(s) were dropped on this stream (first sample: ${JSON.stringify(malformedSample)})` : ""}`
                                                 : undefined));
                         const errored = degenerate ||
                             safetyCut ||
@@ -716,6 +718,9 @@ export function createOpenResponsesBrain(config = {}) {
                             emptyNoFinish ||
                             (toolError !== undefined && noUsableContent) ||
                             (truncatedEmpty && !dynamicCut && !staticReasoningCut);
+                        const tornWithContent = !errored && opts?.truncated !== true && (terminalStatus === undefined || incompleteUnmapped) && !noUsableContent && !degenerate;
+                        const partialWarning = terminalStatus === undefined ? STREAM_TORN_WARNING : RESPONSE_INCOMPLETE_WARNING;
+                        const errorMessageOut = tornWithContent ? (errorMessage ? `${errorMessage}\n${partialWarning}` : partialWarning) : errorMessage;
                         const errorKind = degenerate
                             ? "degenerate"
                             : !safetyCut && !refused && toolError === undefined && truncatedEmpty && !dynamicCut && !staticReasoningCut
@@ -732,8 +737,9 @@ export function createOpenResponsesBrain(config = {}) {
                             ...(usageRaw === undefined ? { usageMissing: true } : {}),
                             timestamp: Date.now(),
                             ...(responseId !== undefined ? { responseId } : {}),
-                            ...(errorMessage ? { errorMessage } : {}),
+                            ...(errorMessageOut ? { errorMessage: errorMessageOut } : {}),
                             ...(errorKind ? { errorKind } : {}),
+                            ...(tornWithContent ? { partialFinalized: true } : {}),
                             ...(rep.cut !== undefined || rep.spared.length > 0
                                 ? { repetition: { ...(rep.cut !== undefined ? { cut: rep.cut } : {}), ...(rep.spared.length > 0 ? { spared: rep.spared } : {}) } }
                                 : {}),

package/dist/brain/openai.js

@@ -1,7 +1,7 @@
 import {} from "../internal/llm.js";
 import { repairTextToolCalls } from "./tool-call-repair.js";
 import { DEGENERATE_MESSAGE, trimDegenerateTail } from "./repetition.js";
-import { createRepetitionPoll, parseStreamedToolArgs } from "./stream-shared.js";
+import { STREAM_TORN_WARNING, createRepetitionPoll, parseStreamedToolArgs } from "./stream-shared.js";
 import { mintFallbackToolCallId } from "./tool-call-id.js";
 import { emitBrainTelemetry } from "./status-sink.js";
 import { errorResultMediaNote, IMAGE_OMITTED_NO_VISION, imagesOmittedNoVisionNote, modelSupportsVision, sendableImages } from "./media-degrade.js";
@@ -619,6 +619,8 @@ export function createOpenAIBrain(config = {}) {
                             emptyNoFinish ||
                             (toolError !== undefined && noUsableContent) ||
                             (truncatedEmpty && !dynamicCut);
+                        const tornWithContent = !errored && opts?.truncated !== true && finishReason == null && !noUsableContent && !degenerate;
+                        const errorMessageOut = tornWithContent ? (errorMessage ? `${errorMessage}\n${STREAM_TORN_WARNING}` : STREAM_TORN_WARNING) : errorMessage;
                         const errorKind = degenerate
                             ? "degenerate"
                             : !safetyCut && !refused && toolError === undefined && truncatedEmpty && !dynamicCut
@@ -631,8 +633,9 @@ export function createOpenAIBrain(config = {}) {
                             usage: computeUsage(model, usageRaw),
                             ...(usageRaw === undefined ? { usageMissing: true } : {}),
                             timestamp: Date.now(),
-                            ...(errorMessage ? { errorMessage } : {}),
+                            ...(errorMessageOut ? { errorMessage: errorMessageOut } : {}),
                             ...(errorKind ? { errorKind } : {}),
+                            ...(tornWithContent ? { partialFinalized: true } : {}),
                             ...(rep.cut !== undefined || rep.spared.length > 0
                                 ? { repetition: { ...(rep.cut !== undefined ? { cut: rep.cut } : {}), ...(rep.spared.length > 0 ? { spared: rep.spared } : {}) } }
                                 : {}),

package/dist/brain/reasoning.d.ts

@@ -117,25 +117,25 @@ export interface OffCapabilityModel {
  * "none" tier), on an endpoint that takes an effort value at all (`supportsReasoningEffort` not
  * false) — else `undefined`: there is nothing to send. The effort formats have no disable key, and an
  * effort VALUE is never off (it enables reasoning at that tier), so off on those wires is spelled only
- * when the deployment says how. The two appliers and {@link thinkingOffExpressible} read this ONE
+ * when the deployment says how. The two appliers and {@link thinkingOffSpelled} read this ONE
  * function, so what the wire carries and what the capability table claims cannot disagree.
  */
 export declare function declaredOffSpelling(model: OffCapabilityModel): string | undefined;
 /**
- * Whether this model's wire can SAY "off". A model that does not reason at all (`reasoning` falsy)
- * never thinks, so off is trivially expressible. Otherwise, per wire: the anthropic budget form spells
- * `{type:"disabled"}` (the ADAPTIVE form rejects it — those models think on every request); deepseek
- * `{type:"disabled"}`, the binary enable keys at `false`, openrouter/together `reasoning:{enabled:false}`
- * all say it; the effort-only wires (stock openai completions, the Responses lane) say it only through
- * a deployment-declared off spelling ({@link declaredOffSpelling}).
+ * Whether the wire will CARRY a disable key for this model — off is SPELLED, never assumed. Per wire: the
+ * anthropic budget form spells `{type:"disabled"}` (the ADAPTIVE form rejects it — those models think on
+ * every request); deepseek `{type:"disabled"}`, the binary enable keys at `false`, openrouter/together
+ * `reasoning:{enabled:false}` all spell it; the effort-only wires (stock openai completions, the Responses
+ * lane) spell it only through a deployment-declared off spelling ({@link declaredOffSpelling}).
  *
- * A caller that sizes an output cap for an ANSWER alone (the auto-mode classifier's block-verdict
- * contract) applies the cap only when this is true: a model that will think regardless cannot have its
- * cap derived from the answer's contract, and keeps its own budget. What this table cannot see is a
- * model that IGNORES its wire's disable key (a thinking-only build served through a format that has
- * one) — that is a per-model fact the compat declaration does not yet carry.
+ * A model whose `reasoning` is FALSY spells NOTHING: every applier returns before writing any key for it, so
+ * the request is the gateway's own default — and a default-on gateway thinks regardless (three of four live
+ * endpoints, 2026-09-15). This arm used to answer `true` ("a non-reasoning model never thinks"): the engine
+ * may size a request by what it SENT, never by what it hopes a gateway does when told nothing. What this
+ * table cannot see is a gateway that IGNORES the key it was sent — the classifier's re-ask on a no-verdict
+ * reply is the seat that learns that from the reply.
  */
-export declare function thinkingOffExpressible(model: OffCapabilityModel): boolean;
+export declare function thinkingOffSpelled(model: OffCapabilityModel): boolean;
 /**
  * OPTIONAL per-request facts for {@link resolveReasoning} — what the wire's budget arm knows at
  * request build that a per-leg eager resolution cannot: the resolved output cap and whether it is a

package/dist/brain/reasoning.js

@@ -30,9 +30,9 @@ export function declaredOffSpelling(model) {
     const mapped = model.thinkingLevelMap?.off;
     return typeof mapped === "string" && mapped !== "" ? mapped : undefined;
 }
-export function thinkingOffExpressible(model) {
+export function thinkingOffSpelled(model) {
     if (!model.reasoning)
-        return true;
+        return false;
     const compat = (model.compat ?? {});
     if (model.api === "anthropic-messages")
         return compat.thinkingMode !== "adaptive";

package/dist/brain/route-adjudicator.d.ts

@@ -197,6 +197,24 @@ export declare function fallbackToPrimaryNotice(args: {
     sessionId?: string;
     runId?: string;
 }): EngineNotice;
+/**
+ * The TWIN of {@link fallbackToPrimaryNotice}, for a seat whose deployment declared NO fallback
+ * (`RunnerDeps.autoMode.classifierFallback: "none"`): the pairing is broken, nothing was swapped, and the
+ * seat's own calls are refused at the request gate — which is what that declaration asked for. Same `detail`
+ * keys as its twin MINUS `to`, because nothing moved and a `to` naming a model that was not used is the one
+ * lie a consumer cannot detect; `action` is the discriminator, so the posture is read rather than inferred
+ * from an absence. `primary` is named in the SENTENCE (what was declined) and not in the detail.
+ */
+export declare function unroutableSeatNotice(args: {
+    seat: string;
+    from: string;
+    primary: string;
+    verdict: Extract<RouteAdjudication, {
+        ok: false;
+    }>;
+    sessionId?: string;
+    runId?: string;
+}): EngineNotice;
 /** The auth carriers of a header bag, canonicalized (case-fold name → value, sorted) — the
  *  Model-visible credential fingerprint used by catalog-change disclosure (a same-name entry whose
  *  URL moved while this fingerprint did not is the "address changed, credential reference did not"

package/dist/brain/route-adjudicator.js

@@ -184,6 +184,22 @@ export function fallbackToPrimaryNotice(args) {
         },
     };
 }
+export function unroutableSeatNotice(args) {
+    return {
+        code: "route.classifier_unroutable",
+        message: `derived model "${args.from}" (${args.seat}) is not routable (${args.verdict.code}) and this deployment declared no fallback — ` +
+            `the seat is kept and its calls are refused rather than served by "${args.primary}". ${args.verdict.detail.fixHint}`,
+        detail: {
+            seat: args.seat,
+            from: args.from,
+            cause: args.verdict.code,
+            fixHint: args.verdict.detail.fixHint,
+            action: "refused",
+            ...(args.sessionId !== undefined ? { sessionId: args.sessionId } : {}),
+            ...(args.runId !== undefined ? { runId: args.runId } : {}),
+        },
+    };
+}
 export function authCarrierFingerprint(headers) {
     if (!headers)
         return "";

package/dist/brain/stream-engine.js

@@ -1,4 +1,5 @@
 import { createAssistantMessageEventStream, } from "../internal/llm.js";
+import { STREAM_TORN_WARNING } from "./stream-shared.js";
 import { FLOOR_OUTPUT_TOKENS, parseContextOverflow, planOutputCapAdjustment } from "./context-overflow.js";
 import { BrainError, classifyConnectFailure, classifyHttp, describeNetworkError, namesTheFailure, readProviderRequestId } from "./errors.js";
 import { classifyInputTooLong } from "./input-too-long.js";
@@ -650,7 +651,7 @@ export function runStreamingBrain(args) {
                 midstreamWarning =
                     failure.kind === "stalled"
                         ? "Response stalled mid-stream. The response above may be incomplete."
-                        : "Connection closed mid-response. The response above may be incomplete.";
+                        : STREAM_TORN_WARNING;
                 parser.finalize({ truncated: true });
                 return;
             }

package/dist/brain/stream-shared.d.ts

@@ -24,6 +24,9 @@ import { type RepetitionEvent } from "./repetition.js";
  * means "do not emit a `toolcall_end` for this call"; callers must NOT cache that outcome — finalize retries
  * the parse against the complete accumulation.
  */
+/** The CC-verbatim warning stamped beside `partialFinalized` when a stream ended before its close — by the
+ *  mid-stream promotion (the body threw) and by the parsers' own finalize (content arrived, no finish frame). */
+export declare const STREAM_TORN_WARNING = "Connection closed mid-response. The response above may be incomplete.";
 export declare function parseStreamedToolArgs(json: string): Record<string, unknown> | undefined;
 /** Repetition telemetry for ONE stream — the cut event plus the allowance-spared hits. */
 export interface RepetitionPoll {

package/dist/brain/stream-shared.js

@@ -1,4 +1,5 @@
 import { inspectDegenerate } from "./repetition.js";
+export const STREAM_TORN_WARNING = "Connection closed mid-response. The response above may be incomplete.";
 export function parseStreamedToolArgs(json) {
     if (!json)
         return {};

package/dist/core/agent-definition.d.ts

@@ -169,4 +169,14 @@ export interface SkillSpec {
         path: string;
         content: string;
     }>;
+    /**
+     * The skill's own DIRECTORY on the machine the tools run on, so the model can reach its bundled material
+     * by path instead of searching the workspace. Core does not resolve it, read it, or check that it exists
+     * (the brain-outside posture {@link files} states). Core does exactly two textual things with it: the
+     * result opens with `Base directory for this skill: <baseDir>`, and both root placeholder spellings
+     * (`${SKILL_ROOT}`, `${CLAUDE_PLUGIN_ROOT}`) are substituted for it in the body and in every attachment's
+     * content, with `files[].path` then read RELATIVE to it. Absent ⇒ no line, no substitution, a
+     * byte-identical result; a placeholder with no directory stays verbatim.
+     */
+    baseDir?: string;
 }

package/dist/core/artifact-host.d.ts

@@ -1,3 +1,11 @@
+/**
+ * The Artifacts hosting seam: the deployment-injected `ArtifactHost` (the `RunnerDeps.artifactHost` seat),
+ * its capability declaration, the call context the engine mints for every host call, the request /
+ * outcome shapes, and the closed word sets the tool face is assembled from. A host declares WHAT it
+ * supports (`capabilities()`); the engine assembles the `Artifact` tool from that declaration alone and
+ * never inspects the implementation. `localArtifactStub` (src/tools/artifact/local-stub.ts) is the first
+ * implementation of this interface; a server's hosting plane is the second.
+ */
 import type { AssertAllKeysHandled } from "./ask-origin.js";
 /** The model-facing action words. `publish` is the default action and the one every host must declare. */
 export declare const ARTIFACT_ACTIONS: readonly ["publish", "list", "read", "list_files", "read_file"];
@@ -6,6 +14,17 @@ export type ArtifactAction = (typeof ARTIFACT_ACTIONS)[number];
  *  `"hosted"` = a hosting plane that mints its own URLs. Declared by the host, never detected. */
 export declare const ARTIFACT_PLANES: readonly ["hosted", "local-stub"];
 export type ArtifactPlane = (typeof ARTIFACT_PLANES)[number];
+/** How a throw out of `publish` relates to the host's commit point. `"throw_means_uncommitted"`: every fallible
+ *  step precedes the commit, so a throw proves nothing was committed; `"uncertain"`: a throw may follow it. */
+export declare const ARTIFACT_COMMIT_CERTAINTIES: readonly ["throw_means_uncommitted", "uncertain"];
+export type ArtifactCommitCertainty = (typeof ARTIFACT_COMMIT_CERTAINTIES)[number];
+/** The `artifact.host_error` outcome word the tool reports when the host THREW, by declaration. An aborted or
+ *  malformed answer is `"unknown"` under every declaration: the throw guarantee says nothing about those arms. */
+export declare const ARTIFACT_COMMIT_THROW_OUTCOME: {
+    readonly throw_means_uncommitted: "not_executed";
+    readonly uncertain: "unknown";
+};
+export type ThrowOutcomeTableCoversEveryCommitCertainty = AssertAllKeysHandled<Exclude<ArtifactCommitCertainty, keyof typeof ARTIFACT_COMMIT_THROW_OUTCOME>>;
 /** The `publishContext` word a publish carries (default `"plain"`). */
 export declare const ARTIFACT_PUBLISH_CONTEXTS: readonly ["pr_review", "workshop", "whiteboard", "prototype", "plain"];
 export type ArtifactPublishContext = (typeof ARTIFACT_PUBLISH_CONTEXTS)[number];
@@ -31,6 +50,16 @@ export declare const ARTIFACT_ACTION_HOST_METHOD: {
     readonly read_file: "readFile";
 };
 export type HostMethodTableCoversEveryAction = AssertAllKeysHandled<Exclude<ArtifactAction, keyof typeof ARTIFACT_ACTION_HOST_METHOD>>;
+/** Whether a call of the action may run inside a parallel batch: the read family is (host reads, no host write); a
+ *  publish is not (it writes the host and the tool's path-binding state). Read by the tool's `isConcurrencySafe`. */
+export declare const ARTIFACT_ACTION_CONCURRENCY_SAFE: {
+    readonly publish: false;
+    readonly list: true;
+    readonly read: true;
+    readonly list_files: true;
+    readonly read_file: true;
+};
+export type ConcurrencyTableCoversEveryAction = AssertAllKeysHandled<Exclude<ArtifactAction, keyof typeof ARTIFACT_ACTION_CONCURRENCY_SAFE>>;
 /** The typed failure words a host outcome may carry (`ok: false`). */
 export declare const ARTIFACT_HOST_FAILURE_CODES: readonly ["conflict", "url_foreign", "forbidden", "payload_too_large", "not_found", "force_refused", "refused"];
 export type ArtifactHostFailureCode = (typeof ARTIFACT_HOST_FAILURE_CODES)[number];
@@ -56,11 +85,16 @@ export declare const ARTIFACT_CARD = "artifact";
  * containing `"publish"`; `plane: "local-stub"` ⇒ `actions` is exactly `["publish"]`;
  * `defaultVisibility` is `"private"`; both byte limits are positive finite integers; `multiFile` is a
  * boolean; every declared action's host method exists; `plane: "local-stub"` ⇒ `storageDir` is a non-empty
- * absolute path.
+ * fully qualified path under its own spelling family (`C:\\…` / UNC / `/…` — read from the spelling, never from
+ * `process.platform`); `commit` is a word of {@link ARTIFACT_COMMIT_CERTAINTIES} (no default — an undeclared
+ * commit protocol is an invalid declaration, never read as either word).
  */
 export interface ArtifactHostCapabilities {
     plane: ArtifactPlane;
     actions: ReadonlyArray<ArtifactAction>;
+    /** What a throw out of `publish` proves about the commit (see {@link ARTIFACT_COMMIT_CERTAINTIES}); the tool words
+     *  its host-fault result from this and from nothing else about the host. */
+    commit: ArtifactCommitCertainty;
     /** The on-disk store of a `"local-stub"` plane (required there; ignored on `"hosted"`). Contract: the store
      *  must lie OUTSIDE every root the run may write or read (the task root, `additionalDirectories`,
      *  `additionalReadDirectories`) — a store the model can reach through the fs tools is not a trust boundary;
@@ -77,9 +111,12 @@ export interface ArtifactHostCapabilities {
  * Engine-minted call attribution and idempotency keys — closure-supplied, never a tool parameter.
  * `taskId` / `sessionId` / `agentName` are audit attribution, never an authorization subject: a host
  * instance is bound to one principal at construction. `runId` and `attemptId` are engine-minted trusted
- * keys: `runId` is the same value `onMount` received; `attemptId` is one opaque value per tool call,
- * stable across any host retry of that call, so a host MUST replay the first outcome for a repeated
- * `attemptId` (a fresh publish never mints a second page, an update never advances twice).
+ * keys: `runId` is the same value `onMount` received; `attemptId` is one opaque value per HOST CALL — the
+ * engine mints a fresh one for every call it makes, so two calls of a single tool invocation (the probing
+ * `read` that establishes ownership and the `list_files` it gates, say) never arrive under one key — and it
+ * is stable across any retry the HOST makes of that call, so a host MUST replay the first outcome for a
+ * repeated `attemptId` (a fresh publish never mints a second page, an update never advances twice). The rule
+ * is keyed on the value alone: a host may hold one attempt ledger for all its methods.
  */
 export interface ArtifactCallContext {
     taskId: string;

package/dist/core/artifact-host.js

@@ -1,6 +1,11 @@
-import { isAbsolute } from "node:path";
+import { isAbsoluteForFamily, pathFamilyOf } from "../tools/fs/safety.js";
 export const ARTIFACT_ACTIONS = ["publish", "list", "read", "list_files", "read_file"];
 export const ARTIFACT_PLANES = ["hosted", "local-stub"];
+export const ARTIFACT_COMMIT_CERTAINTIES = ["throw_means_uncommitted", "uncertain"];
+export const ARTIFACT_COMMIT_THROW_OUTCOME = {
+    throw_means_uncommitted: "not_executed",
+    uncertain: "unknown",
+};
 export const ARTIFACT_PUBLISH_CONTEXTS = ["pr_review", "workshop", "whiteboard", "prototype", "plain"];
 export const ARTIFACT_LIST_SCOPES = ["mine", "shared", "all"];
 export const ARTIFACT_PLANE_CONTENT_ORIGIN = {
@@ -14,6 +19,13 @@ export const ARTIFACT_ACTION_HOST_METHOD = {
     list_files: "listFiles",
     read_file: "readFile",
 };
+export const ARTIFACT_ACTION_CONCURRENCY_SAFE = {
+    publish: false,
+    list: true,
+    read: true,
+    list_files: true,
+    read_file: true,
+};
 export const ARTIFACT_HOST_FAILURE_CODES = ["conflict", "url_foreign", "forbidden", "payload_too_large", "not_found", "force_refused", "refused"];
 export const ARTIFACT_FAILURE_RESULT_CODE = {
     conflict: "artifact.publish_conflict",
@@ -59,6 +71,9 @@ export function readArtifactHostCapabilities(host) {
         return { ok: false, problem: 'capabilities.actions must include "publish"' };
     if (plane === "local-stub" && (actions.length !== 1 || actions[0] !== "publish"))
         return { ok: false, problem: 'a "local-stub" plane must declare exactly ["publish"]' };
+    const commit = c["commit"];
+    if (!wordOf(ARTIFACT_COMMIT_CERTAINTIES, commit))
+        return { ok: false, problem: `capabilities.commit must be one of ${ARTIFACT_COMMIT_CERTAINTIES.join(" | ")}` };
     if (c["defaultVisibility"] !== "private")
         return { ok: false, problem: 'capabilities.defaultVisibility must be "private"' };
     if (!isPositiveInt(c["maxFileBytes"]))
@@ -68,7 +83,7 @@ export function readArtifactHostCapabilities(host) {
     if (typeof c["multiFile"] !== "boolean")
         return { ok: false, problem: "capabilities.multiFile must be a boolean" };
     const storageDir = c["storageDir"];
-    if (plane === "local-stub" && (typeof storageDir !== "string" || storageDir.length === 0 || !isAbsolute(storageDir)))
+    if (plane === "local-stub" && (typeof storageDir !== "string" || storageDir.length === 0 || !isAbsoluteForFamily(pathFamilyOf({ root: storageDir }), storageDir)))
         return { ok: false, problem: 'a "local-stub" plane must declare its absolute storageDir' };
     if (storageDir !== undefined && typeof storageDir !== "string")
         return { ok: false, problem: "capabilities.storageDir must be a string when present" };
@@ -82,6 +97,7 @@ export function readArtifactHostCapabilities(host) {
         capabilities: Object.freeze({
             plane,
             actions: Object.freeze([...actions]),
+            commit,
             defaultVisibility: "private",
             maxFileBytes: c["maxFileBytes"],
             maxTotalBytes: c["maxTotalBytes"],

package/dist/core/ask-origin.d.ts

@@ -133,6 +133,22 @@ export interface AskOriginFacts {
 export declare function askOriginOf(decision: Extract<PermissionResult, {
     action: "ask";
 }>, facts: AskOriginFacts): AskOrigin;
+/**
+ * Stamp the ask's origin word — and withdraw the disclosures that speak for the TIGHTEN alone when some
+ * layer above it is the reason this call is being asked about. Today that is one member: the read
+ * boundary's directory offer, whose claim holds only while the tighten is the whole reason. Every higher
+ * rung is a layer with a reason of its own — a standing `ask` row, an unreadable rule store, an org
+ * verdict, a hook, the denial-limit fallback — which no directory grant answers, so the ask would stand
+ * after the grant and the offer would have promised a clearing it cannot deliver (measured: `cat
+ * <out-of-root>` under a standing `Bash(cat:*)` ask rule offered the directory and kept asking after it).
+ * It lives at the one derivation rather than the three stamp sites: the withdrawal's input IS the origin
+ * word, so a site that stamped without it would be a second, quieter answer to one question.
+ */
+export declare function stampAskOrigin<T extends Extract<PermissionResult, {
+    action: "ask";
+}>>(decision: T, facts: AskOriginFacts): T & {
+    origin: AskOrigin;
+};
 /**
  * Which origins IMPLY the `requiresRealApproval` bit, and WHERE that implication is verified — the
  * consistency table {@link askOriginOf} reads. An ask of a must-carry origin exists so that no automatic

package/dist/core/ask-origin.js

@@ -15,6 +15,14 @@ export function askOriginOf(decision, facts) {
     }
     return origin;
 }
+const TIGHTEN_ONLY_ORIGINS = new Set(["shell_gate_tighten", "safety_tighten"]);
+export function stampAskOrigin(decision, facts) {
+    const origin = askOriginOf(decision, facts);
+    if (decision.probeReadRootCandidate === undefined || TIGHTEN_ONLY_ORIGINS.has(origin))
+        return { ...decision, origin };
+    const { probeReadRootCandidate: _withdrawn, ...kept } = decision;
+    return { ...kept, origin };
+}
 function originLadder(decision, facts) {
     if (facts.contentQuestion)
         return "content_question";

package/dist/core/auto-mode-arming.d.ts

@@ -180,5 +180,11 @@ export type AutoModeArmingFold = {
  *   nevertheless declare the same epoch — that is a deployment telling us its settings did not move
  *   while its own data says otherwise, and picking either side would be a guess about which one is the
  *   policy in force.
+ *
+ * @contract auto_mode.arming.absent_timeout_reads_recorded_default — a parked arming's absent `timeoutMs` is
+ * read as the default in force when it was recorded (`AUTO_MODE_RECORDED_ABSENT_TIMEOUT_MS`, 15_000 ms), not
+ * the default in force when it is redeemed: persisted data is read under the contract it was written under,
+ * so a default that moves can never widen an ancestor's bound at redemption; every recipe minted since
+ * materialises the knob, so absence dates the recording.
  */
 export declare function foldAutoModeArming(recorded: unknown, current: unknown): AutoModeArmingFold;

package/dist/core/auto-mode-arming.js

@@ -1,4 +1,4 @@
-import { AUTO_MODE_DEFAULT_TIMEOUT_MS, AUTO_MODE_DEFAULT_WINDOW_MAX_CHARS, AUTO_MODE_DEFAULT_WINDOW_MAX_ENTRIES, AUTO_MODE_DEFAULTS_SENTINEL, AUTO_MODE_DENIAL_AUTO_DENY_DEFAULT_MS, AUTO_MODE_DENIAL_LIMIT_DEFAULTS, } from "./auto-mode-defaults.js";
+import { AUTO_MODE_DEFAULT_TIMEOUT_MS, AUTO_MODE_RECORDED_ABSENT_TIMEOUT_MS, AUTO_MODE_DEFAULT_WINDOW_MAX_CHARS, AUTO_MODE_DEFAULT_WINDOW_MAX_ENTRIES, AUTO_MODE_DEFAULTS_SENTINEL, AUTO_MODE_DENIAL_AUTO_DENY_DEFAULT_MS, AUTO_MODE_DENIAL_LIMIT_DEFAULTS, } from "./auto-mode-defaults.js";
 export const AUTO_MODE_ARMING_RECIPE_VERSION = 2;
 const isPlainRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 function canonicalStrings(v) {
@@ -143,7 +143,7 @@ export function autoModeArmingRecipeOf(face, bind) {
         ...(face.settingsDenyRules !== undefined ? { settingsDenyRules: face.settingsDenyRules } : {}),
         ...(face.sessionContext !== undefined ? { sessionContext: face.sessionContext } : {}),
         ...(face.window !== undefined ? { window: face.window } : {}),
-        ...(face.timeoutMs !== undefined ? { timeoutMs: face.timeoutMs } : {}),
+        timeoutMs: face.timeoutMs ?? AUTO_MODE_DEFAULT_TIMEOUT_MS,
         ...(face.denialLimit !== undefined ? { denialLimit: face.denialLimit } : {}),
         ...(face.settingsEpoch !== undefined ? { settingsEpoch: face.settingsEpoch } : {}),
         ...(face.crossSessionMessagesRule !== undefined ? { crossSessionMessagesRule: face.crossSessionMessagesRule } : {}),
@@ -208,8 +208,8 @@ export function foldAutoModeArming(recorded, current) {
                     "(the strictest decidable answer: the inherited ask flows the original chain to a human)",
             };
     }
-    const minKnob = (a, b, fallback) => Math.min(a ?? fallback, b ?? fallback);
-    const timeoutMs = minKnob(rec.timeoutMs, cur.timeoutMs, AUTO_MODE_DEFAULT_TIMEOUT_MS);
+    const recordedTimeoutMs = rec.timeoutMs ?? AUTO_MODE_RECORDED_ABSENT_TIMEOUT_MS;
+    const timeoutMs = Math.min(recordedTimeoutMs, cur.timeoutMs ?? AUTO_MODE_DEFAULT_TIMEOUT_MS);
     const denialLimit = tightenDenialLimit(rec.denialLimit, cur.denialLimit);
     const recordedDenial = tightenDenialLimit(rec.denialLimit, rec.denialLimit);
     return {
@@ -221,7 +221,7 @@ export function foldAutoModeArming(recorded, current) {
             denialLimit,
             ...(cur.settingsEpoch !== undefined ? { settingsEpoch: cur.settingsEpoch } : {}),
         },
-        tightened: timeoutMs < (rec.timeoutMs ?? AUTO_MODE_DEFAULT_TIMEOUT_MS) ||
+        tightened: timeoutMs < recordedTimeoutMs ||
             denialLimit.maxConsecutive < recordedDenial.maxConsecutive ||
             denialLimit.maxTotal < recordedDenial.maxTotal ||
             denialLimit.autoDenyAfterMs !== recordedDenial.autoDenyAfterMs,