@sema-agent/core 7.17.7 → 7.19.0

package/dist/core/gate-outcome.js

@@ -1,4 +1,5 @@
 import { isAskOrigin } from "./ask-origin.js";
+import { isAutoModeFallbackCause } from "./auto-mode.js";
 export const SETTLEMENT_KINDS = [
     "human_allowed",
     "human_refused",
@@ -17,6 +18,13 @@ const SETTLEMENT_KIND_SET = new Set(SETTLEMENT_KINDS);
 export function isSettlementKind(v) {
     return SETTLEMENT_KIND_SET.has(v);
 }
+export function decidersNote(text) {
+    return text === "" ? undefined : text;
+}
+export function settledByPerson(kind, approver, note) {
+    const given = decidersNote(note);
+    return { kind, who: { party: "person", ...(approver !== undefined ? { approver } : {}) }, when: Date.now(), ...(given !== undefined ? { note: given } : {}) };
+}
 export const SETTLEMENT_IS_REFUSAL = {
     human_allowed: false,
     human_refused: true,
@@ -89,5 +97,20 @@ export function screenGateOutcome(g) {
         else if (isDeniedBy(d.deniedBy) && !DENIED_BY_MAY_CARRY_CAUSE[d.deniedBy])
             defects.push(`I5: a classifier cause cannot stand beside deniedBy "${d.deniedBy}"`);
     }
+    const attribution = d.classifier;
+    if (attribution !== undefined) {
+        const named = (v) => typeof v === "string" && v !== "";
+        if (!named(attribution.modelRequested) || !named(attribution.modelUsed))
+            defects.push("I6: disposition.classifier must name both the model the round was for and the model that answered");
+        const fb = attribution.fallback;
+        if (fb !== undefined) {
+            if (!named(fb.from) || !named(fb.to))
+                defects.push("I6: disposition.classifier.fallback must name the rung it left and the rung it arrived at");
+            else if (fb.to !== attribution.modelUsed)
+                defects.push(`I6: the fallback landed on "${fb.to}" but the record names "${attribution.modelUsed}" as the model that answered`);
+            if (!isAutoModeFallbackCause(fb.cause))
+                defects.push(`I6: fallback cause "${String(fb.cause)}" is outside the closed set`);
+        }
+    }
     return defects;
 }

package/dist/core/governance-codes.d.ts

@@ -104,7 +104,7 @@ export type NoticeAudience = "user" | "operator";
  * src/ for notice mint shapes and names any code that is minted but unregistered, or registered but
  * no longer minted.
  */
-export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.read_face_swapped", "config.read_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.artifact_host_invalid", "config.tool_card_undeclared", "config.tool_face_undeclared", "config.tool_face_invalid", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "checkpoint.execution_outcome_unrecorded", "delegation.transcript_integrity", "delegation.ask_unresolvable", "mcp.injection_dropped", "mcp.revocation_probe_failed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "route.fallback_to_primary", "route.base_url_changed_key_unchanged", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "task.interrupt_unconsumed", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "tool_result.offload_put_failed"];
+export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.read_face_swapped", "config.read_face_deployment_clamped", "config.write_face_swapped", "config.write_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.artifact_host_invalid", "config.tool_card_undeclared", "config.tool_face_undeclared", "config.tool_face_invalid", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "classifier.fallback", "classifier.role_defaulted", "classifier.contract_broken", "checkpoint.execution_outcome_unrecorded", "delegation.transcript_integrity", "delegation.ask_unresolvable", "mcp.injection_dropped", "mcp.revocation_probe_failed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "route.fallback_to_primary", "route.classifier_unroutable", "route.base_url_changed_key_unchanged", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "task.interrupt_unconsumed", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "skills.listing_truncated", "tool_result.offload_put_failed"];
 /** A code this engine mints (see {@link ENGINE_NOTICE_CODES}). NOT the type of
  *  `EngineNotice.code`, which stays `string` — a host forwarding its own notices through the same
  *  sink is a supported shape, and narrowing that field would break it. */

package/dist/core/governance-codes.js

@@ -102,6 +102,8 @@ export const ENGINE_NOTICE_CODES = [
     "config.models_swapped",
     "config.read_face_swapped",
     "config.read_face_deployment_clamped",
+    "config.write_face_swapped",
+    "config.write_face_deployment_clamped",
     "config.tool_model_gate_removed",
     "config.tool_model_gate_unknown_class",
     "config.tool_model_gate_env_invalid",
@@ -116,6 +118,9 @@ export const ENGINE_NOTICE_CODES = [
     "peer.held_settled",
     "peer.idle_subscription",
     "classifier.denial_limit",
+    "classifier.fallback",
+    "classifier.role_defaulted",
+    "classifier.contract_broken",
     "checkpoint.execution_outcome_unrecorded",
     "delegation.transcript_integrity",
     "delegation.ask_unresolvable",
@@ -137,6 +142,7 @@ export const ENGINE_NOTICE_CODES = [
     "memory.consolidation_refused",
     "memory.consolidation_withheld",
     "route.fallback_to_primary",
+    "route.classifier_unroutable",
     "route.base_url_changed_key_unchanged",
     "task.user_steer_undrained",
     "task.user_followup_undrained",
@@ -147,6 +153,7 @@ export const ENGINE_NOTICE_CODES = [
     "task.interrupt_unconsumed",
     "memory.capture_opted_out",
     "memory.capture_optout_unpersisted",
+    "skills.listing_truncated",
     "tool_result.offload_put_failed",
 ];
 const NOTICE_AUDIENCE_TABLE = {
@@ -159,6 +166,9 @@ const NOTICE_AUDIENCE_TABLE = {
     "task.user_steer_undrained": "user",
     "task.user_followup_undrained": "user",
     "classifier.denial_limit": "user",
+    "classifier.fallback": "operator",
+    "classifier.role_defaulted": "operator",
+    "classifier.contract_broken": "operator",
     "task.turn_interrupted": "user",
     "steering.parked_input_blocked": "user",
     "task.halt_unconsumed": "user",
@@ -175,6 +185,8 @@ const NOTICE_AUDIENCE_TABLE = {
     "config.models_swapped": "operator",
     "config.read_face_swapped": "operator",
     "config.read_face_deployment_clamped": "operator",
+    "config.write_face_swapped": "operator",
+    "config.write_face_deployment_clamped": "operator",
     "config.tool_model_gate_removed": "operator",
     "config.tool_model_gate_unknown_class": "operator",
     "config.tool_model_gate_env_invalid": "operator",
@@ -200,7 +212,9 @@ const NOTICE_AUDIENCE_TABLE = {
     "memory.consolidation_incomplete": "operator",
     "memory.consolidation_refused": "operator",
     "route.fallback_to_primary": "operator",
+    "route.classifier_unroutable": "operator",
     "route.base_url_changed_key_unchanged": "operator",
+    "skills.listing_truncated": "operator",
     "tool_result.offload_put_failed": "operator",
 };
 export const NOTICE_AUDIENCE = NOTICE_AUDIENCE_TABLE;

package/dist/core/hook-seats.d.ts

@@ -0,0 +1,66 @@
+/**
+ * The hook seam's SEAT discipline and its disclosure vocabulary: which callback seats exist, what a
+ * deployment is allowed to put in one, and how a wiring disclosure names the ones that are wired.
+ *
+ * Kept beside the interface rather than inside it: `hooks.ts` owns the seam's BEHAVIOUR, and this module owns
+ * the seat as a CONFIGURATION VALUE — the same split `wiring-manifest.ts` keeps for the ask/question seats.
+ */
+import type { Hooks } from "./hooks.js";
+import type { AssertAllKeysHandled } from "./ask-origin.js";
+import type { SeamProvenance } from "./wiring-manifest.js";
+/**
+ * The CALLBACK SEATS of {@link Hooks} as a word list — the vocabulary a wiring disclosure names a wired seam
+ * by (`WiringManifest.hooks[].family`), in declaration order. `preToolUseObservational` is deliberately NOT a
+ * member (it is a DECLARATION ABOUT `preToolUse`); `timeoutMs` is not a seat either.
+ */
+export declare const HOOK_FAMILIES: readonly ["preToolUse", "postToolUse", "userPromptSubmit", "stop", "postToolUseFailure", "postToolBatch", "preCompact", "postCompact", "stopFailure", "permissionDenied"];
+/**
+ * One hook seat's name.
+ *
+ * @contract hooks.family_vocabulary — {@link HOOK_FAMILIES} is the only spelling of a hook seat's name on any
+ * disclosure face, and {@link HookFamiliesCoverEverySeat} makes a new callback member of {@link Hooks} red at
+ * `tsc` until it has a word there — a disclosure that omits a seat under-states what runs on the critical path.
+ */
+export type HookFamily = (typeof HOOK_FAMILIES)[number];
+/** Every CALLBACK member of {@link Hooks} — derived from the interface, never a hand-kept second list. */
+type HookCallbackSeat = {
+    [K in keyof Hooks]-?: NonNullable<Hooks[K]> extends (...args: never[]) => unknown ? K : never;
+}[keyof Hooks];
+/** The closed-set fence: `never` while every callback seat has a word, the MISSING SEAT'S NAME when one does
+ *  not (the constraint form names it; a conditional type says only "something changed"). */
+export type HookFamiliesCoverEverySeat = AssertAllKeysHandled<Exclude<HookCallbackSeat, HookFamily>>;
+/** The typed refusal a hook seat holding a present NON-CALLBACK value raises at prepare. */
+export declare const HOOKS_INVALID_CODE = "config.hooks_invalid";
+/**
+ * Screen the resolved hook record's seats (`spec.hooks ?? deps.hooks`).
+ *
+ * @contract hooks.seat_value — a hook seat is a FUNCTION or it is absent. A PRESENT non-function
+ * (`preToolUse: null`, a string, a bare object) is a configuration error and refuses the whole prepare with
+ * {@link HOOKS_INVALID_CODE}, naming the family and the type received. It is not folded to "unwired": the tool
+ * gate arms on PRESENCE (`hooks?.preToolUse !== undefined`) and would invoke the non-function and fail closed
+ * on every call, while a callability-based disclosure reported no hooks at all. The sibling seams already
+ * refuse the same way (`resolveQuestionSeam` / `resolveElicitSeam`). `undefined` stays exactly what it was:
+ * an unwired seat, silent.
+ */
+export declare function assertHookSeatsCallable(hooks: Hooks | undefined, provenance: SeamProvenance): void;
+/**
+ * One WIRED HOOK SEAT of this leg. `family` is the seat's name; `owner` is WHICH SEAT supplied the record, the
+ * `spec > deps` provenance the ask/question seams report. Deliberately no third owner word: core mounts NO
+ * engine-owned hooks, and a delegated child's inherited `preToolUse` rides the gate's constraint fold.
+ */
+export interface WiringManifestHookEntry {
+    family: HookFamily;
+    owner: SeamProvenance;
+    /** Only on the `preToolUse` entry, and only when the deployment DECLARED the face observational
+     *  (`Hooks.preToolUseObservational`) — it still runs on every call but is not folded into a delegated
+     *  child's inherited constraints. Absence means "not declared", never "declared false". */
+    observational?: true;
+}
+/**
+ * The wiring manifest's hook read face ({@link WiringManifestHookEntry}): one entry per CALLBACK seat the
+ * resolved record wires, in the vocabulary's declaration order. The VOCABULARY is the judge — families are
+ * walked, never the record's own keys. `owner` is a property of the RECORD, so every entry agrees. Callability
+ * and presence cannot diverge here: {@link assertHookSeatsCallable} has already refused the leg where they would.
+ */
+export declare function wiredHookEntries(hooks: Hooks | undefined, owner: SeamProvenance, preToolUseObservational: boolean): WiringManifestHookEntry[];
+export {};

package/dist/core/hook-seats.js

@@ -0,0 +1,37 @@
+export const HOOK_FAMILIES = [
+    "preToolUse",
+    "postToolUse",
+    "userPromptSubmit",
+    "stop",
+    "postToolUseFailure",
+    "postToolBatch",
+    "preCompact",
+    "postCompact",
+    "stopFailure",
+    "permissionDenied",
+];
+export const HOOKS_INVALID_CODE = "config.hooks_invalid";
+export function assertHookSeatsCallable(hooks, provenance) {
+    if (hooks === undefined)
+        return;
+    for (const family of HOOK_FAMILIES) {
+        const seat = hooks[family];
+        if (seat === undefined || typeof seat === "function")
+            continue;
+        const e = new Error(`the resolved hooks record (${provenance}) holds ${seat === null ? "null" : typeof seat} at \`${family}\` — a hook seat is a callback or it is absent. ` +
+            `A present non-callback is not an unwired seat: the tool gate arms on presence and would refuse every call through it. Omit the key, or wire a function.`);
+        e.code = HOOKS_INVALID_CODE;
+        throw e;
+    }
+}
+export function wiredHookEntries(hooks, owner, preToolUseObservational) {
+    if (hooks === undefined)
+        return [];
+    const entries = [];
+    for (const family of HOOK_FAMILIES) {
+        if (typeof hooks[family] !== "function")
+            continue;
+        entries.push({ family, owner, ...(family === "preToolUse" && preToolUseObservational ? { observational: true } : {}) });
+    }
+    return entries;
+}

package/dist/core/hooks.d.ts

@@ -1354,7 +1354,7 @@ export interface ToolGateInput {
      * (the write-protection tighten below). Absent ⇒ the deployment replaced the table with `[]` (or
      * the caller runs the gate without one) and the decision path is byte-identical.
      */
-    writeProtectionCheck?: (toolName: string, args: unknown, face?: import("./tool-registry.js").ToolCallLike["face"]) => import("./write-protect.js").WriteProtectedHit | null;
+    writeProtectionCheck?: (toolName: string, args: unknown, face?: import("./tool-registry.js").ToolCallLike["face"], cwd?: string) => import("./write-protect.js").WriteProtectedHit | null;
     /**
      * design/143 批2 (A, CC 2.1.207 auto mode): when present, a surviving `ask` is routed to the
      * small-model policy CLASSIFIER before any human/durable resolution:

package/dist/core/read-root-candidate.d.ts

@@ -0,0 +1,12 @@
+/** The display bound on a grant candidate's directory: generous next to a real `PATH_MAX`, tight enough
+ *  that the seat cannot become an unbounded prose channel onto an approval card. */
+export declare const READ_ROOT_CANDIDATE_DIR_MAX = 1024;
+/**
+ * The validator for a probe's {@link import("./tool-spec.js").ReversibilityVerdict.readRootCandidate}: the
+ * errand `normalizeProbeCause` does for the cause, fail-closed on the disclosure alone — a malformed value
+ * yields `undefined`, the ask stands, the card carries no offer. It REFUSES where the cause NEUTRALIZES,
+ * per `shell.read_boundary.grant_candidate_is_the_grant`: the cause is prose, so folding a separator out of
+ * it keeps it true, while this string IS the grant, and a card showing one spelling while the deployment
+ * applies another is the failure the seat prevents.
+ */
+export declare function normalizeReadRootCandidate(value: unknown): import("./tool-spec.js").ReadRootGrantCandidate | undefined;

package/dist/core/read-root-candidate.js

@@ -0,0 +1,24 @@
+import { isPlainRecord, safeDataValue } from "./checkpoint-store.js";
+import { hasWin32AliasedComponent, isAbsolutePathForm, normalizeAbsPathLexically, pathFamilyOf, win32NamespaceScreen } from "../tools/fs/safety.js";
+export const READ_ROOT_CANDIDATE_DIR_MAX = 1024;
+export function normalizeReadRootCandidate(value) {
+    if (!isPlainRecord(value))
+        return undefined;
+    if (safeDataValue(value, "clearsThisAsk") !== true)
+        return undefined;
+    const dir = safeDataValue(value, "dir");
+    if (typeof dir !== "string" || dir.length === 0 || dir.length > READ_ROOT_CANDIDATE_DIR_MAX)
+        return undefined;
+    if (/[\u0000-\u001f\u007f\u2028\u2029]/.test(dir))
+        return undefined;
+    if (!isAbsolutePathForm(dir))
+        return undefined;
+    const folded = normalizeAbsPathLexically(dir);
+    if (folded !== dir || normalizeAbsPathLexically(`${dir}/..`) === dir)
+        return undefined;
+    if (hasWin32AliasedComponent(dir))
+        return undefined;
+    if (!win32NamespaceScreen(dir, pathFamilyOf({ root: dir })).ok)
+        return undefined;
+    return { dir, clearsThisAsk: true };
+}

package/dist/core/roles.d.ts

@@ -1,6 +1,6 @@
 import type { ThinkingLevel } from "../internal/harness-types.js";
 import type { Model } from "../internal/llm.js";
-import type { ModelRef, ModelRole, ModelRoles } from "./types.js";
+import type { ModelRef, ModelRole, ModelRoles, RoleSpec } from "./types.js";
 export type { ModelRole, RoleSpec, ModelRoles } from "./types.js";
 /** Resolve a string ModelRef against the catalog (a Model object passes through). */
 export declare function resolveModel(ref: ModelRef, models?: Record<string, Model>): Model;
@@ -87,6 +87,14 @@ export declare function parseModelMention(text: string, allowedNames: Iterable<s
  * (即使 catalog 恰有裸模型名 `pro`/`flash` 也不入档位路由——INERT 靠配置成立,不靠键名运气)。
  */
 export declare const ROLE_TIER_DEFAULTS: Readonly<Partial<Record<ModelRole, string>>>;
+/**
+ * Whether a RoleSpec NAMES a model — a string ref, a Model object, or a config object carrying `model` or
+ * `select` — as opposed to a preset-only object (`{ thinking }`, `{ systemPrompt }`) that shapes the role's
+ * request but leaves its model to the defaults. The classifier seat's own default (the tier below the run's
+ * main model, `classifier-ladder.ts`) applies exactly when this is false: a `{select}` keeps its selection, a
+ * preset-only role does not disable the relative pick. One reader, the same parts {@link specParts} reads.
+ */
+export declare function roleSpecNamesModel(spec: RoleSpec | undefined): boolean;
 export interface ResolvedRole {
     model: Model;
     /** The effective thinking level: explicit `spec.thinking` wins, else the role's default. */

package/dist/core/roles.js

@@ -130,6 +130,10 @@ function specParts(s) {
     const cfg = s;
     return { model: cfg.model, select: cfg.select, thinking: cfg.thinking, systemPrompt: cfg.systemPrompt };
 }
+export function roleSpecNamesModel(spec) {
+    const parts = specParts(spec);
+    return parts.model !== undefined || parts.select !== undefined;
+}
 function toConfig(s) {
     if (s == null) {
         return undefined;

package/dist/core/runner/advertised-writable-dirs.d.ts

@@ -21,9 +21,14 @@
  * no marker and an absent directory narrows.
  *
  * Reverse check (the seat's own invariant): nothing enters `roots` except through `admit`, and every
- * caller of `admit` is an advertiser deciding its advertisement off the returned verdict — so there is
- * no directory the fence opens that the prompt does not advertise, and none the prompt advertises
- * that the fence refuses.
+ * caller of `admit` is an advertiser deciding its advertisement off the returned verdict — so no
+ * directory reaches the ROOTS FENCE through this seat without the prompt advertising it, and none
+ * the prompt advertises is refused by that fence.
+ *
+ * The invariant is about this seat, not about the whole write surface: under an open write face
+ * ({@link import("../../tools/fs/containment-face.js").ContainmentFace}) the roots fence judges
+ * nothing, so what the prompt advertises is a floor rather than the whole list — the `# Environment`
+ * block says so in its own line, and the advertisement stays true (these directories ARE writable).
  */
 import type { ExecutionEnv } from "../../internal/harness.js";
 export interface AdvertisedWritableDir {

package/dist/core/runner/assemble-result.d.ts

@@ -153,11 +153,12 @@ export interface ResultFlags {
      *  distinct codes from arriving as one anonymous `limits.max_turns_exceeded`. Empty/absent ⇒ the field is omitted. */
     remoteEnvFailures?: TaskResult["remoteEnvFailures"];
     /** The run's effective read posture (resolved face + normalized deny
-     *  additions), echoed on `TaskResult.effectiveReadFace` / `.effectiveReadDenyPatterns`. Pure
+     *  additions), echoed on `TaskResult.effectiveReadFace` / `.effectiveWriteFace` / `.effectiveReadDenyPatterns`. Pure
      *  pass-through (assembly neither adds nor filters) and INDEPENDENT of the status/errorCode chain:
      *  the posture is a fact about the leg that ran, whatever terminal it reached — a post-completion
      *  spawner folds it stricter-wins into follow-on legs; every other consumer may ignore it. */
     effectiveReadFace?: TaskResult["effectiveReadFace"];
+    effectiveWriteFace?: TaskResult["effectiveWriteFace"];
     effectiveReadDenyPatterns?: TaskResult["effectiveReadDenyPatterns"];
     /** The memory-visibility observation, echoed on
      *  `TaskResult.effectiveMemoryScopes`. Pure pass-through on every terminal, same law as the

package/dist/core/runner/assemble-result.js

@@ -166,5 +166,5 @@ export function assembleResult(spec, sessionId, final, stats, flags) {
     if (flags.unpricedSpend)
         delete publicStats.costMicroUsd;
     const stampHaltedByUser = haltConsumed(flags.haltConsumption);
-    return { taskId, ...(flags.runId !== undefined ? { runId: flags.runId } : {}), sessionId, terminal, ...(flags.model !== undefined ? { model: flags.model } : {}), result: result.trim(), salvagedOutput, ...(apiFailure !== undefined ? { apiFailure } : {}), ...(retryAfterMs !== undefined ? { retryAfterMs } : {}), ...(flags.rewindNotes !== undefined && flags.rewindNotes.length > 0 ? { rewindNotes: flags.rewindNotes } : {}), ...(flags.editedFiles !== undefined && flags.editedFiles.length > 0 ? { editedFiles: flags.editedFiles } : {}), ...(flags.haltedOnUserRejection === true ? { haltedOnUserRejection: true } : {}), ...(stampHaltedByUser ? { haltedByUser: true } : {}), ...(flags.remoteEnvFailures !== undefined && flags.remoteEnvFailures.length > 0 ? { remoteEnvFailures: [...flags.remoteEnvFailures] } : {}), ...(flags.strandedHumanAnswers !== undefined && flags.strandedHumanAnswers.length > 0 ? { strandedHumanAnswers: flags.strandedHumanAnswers } : {}), ...(flags.effectiveReadFace !== undefined ? { effectiveReadFace: flags.effectiveReadFace } : {}), ...(flags.effectiveReadDenyPatterns !== undefined && flags.effectiveReadDenyPatterns.length > 0 ? { effectiveReadDenyPatterns: flags.effectiveReadDenyPatterns } : {}), ...(flags.effectiveMemoryScopes !== undefined ? { effectiveMemoryScopes: flags.effectiveMemoryScopes } : {}), ...(flags.effectiveReasoning !== undefined ? { effectiveReasoning: flags.effectiveReasoning } : {}), stats: publicStats };
+    return { taskId, ...(flags.runId !== undefined ? { runId: flags.runId } : {}), sessionId, terminal, ...(flags.model !== undefined ? { model: flags.model } : {}), result: result.trim(), salvagedOutput, ...(apiFailure !== undefined ? { apiFailure } : {}), ...(retryAfterMs !== undefined ? { retryAfterMs } : {}), ...(flags.rewindNotes !== undefined && flags.rewindNotes.length > 0 ? { rewindNotes: flags.rewindNotes } : {}), ...(flags.editedFiles !== undefined && flags.editedFiles.length > 0 ? { editedFiles: flags.editedFiles } : {}), ...(flags.haltedOnUserRejection === true ? { haltedOnUserRejection: true } : {}), ...(stampHaltedByUser ? { haltedByUser: true } : {}), ...(flags.remoteEnvFailures !== undefined && flags.remoteEnvFailures.length > 0 ? { remoteEnvFailures: [...flags.remoteEnvFailures] } : {}), ...(flags.strandedHumanAnswers !== undefined && flags.strandedHumanAnswers.length > 0 ? { strandedHumanAnswers: flags.strandedHumanAnswers } : {}), ...(flags.effectiveReadFace !== undefined ? { effectiveReadFace: flags.effectiveReadFace } : {}), ...(flags.effectiveWriteFace !== undefined ? { effectiveWriteFace: flags.effectiveWriteFace } : {}), ...(flags.effectiveReadDenyPatterns !== undefined && flags.effectiveReadDenyPatterns.length > 0 ? { effectiveReadDenyPatterns: flags.effectiveReadDenyPatterns } : {}), ...(flags.effectiveMemoryScopes !== undefined ? { effectiveMemoryScopes: flags.effectiveMemoryScopes } : {}), ...(flags.effectiveReasoning !== undefined ? { effectiveReasoning: flags.effectiveReasoning } : {}), stats: publicStats };
 }

package/dist/core/runner/classifier-ladder.d.ts

@@ -0,0 +1,227 @@
+/**
+ * The auto-mode classifier's CANDIDATE LADDER, as one module: which models a classification may be asked on
+ * (and which model stands in when no `classifier` role names one), its per-rung reasoning seat and the
+ * per-attempt user-message tail, how a rung's reply is read for a re-ask or a failure, and the once-per-run
+ * disclosures its first move and its broken contract mint.
+ *
+ * Beside `derived-route-fallback.ts` and in the same family — both are seats the caps phase's classifier
+ * arming reaches DOWN for, and both answer "this leg's model did not work out" one layer apart. Which is why
+ * the rung comparison here borrows the route adjudicator's own identity law instead of inventing one.
+ *
+ * THE TWO LAYERS, since one sentence ("the classifier seat did not work out ⇒ use the run's main model") is
+ * spelled in two places. They are ordered, and each has its own trigger and its own record face:
+ *
+ *   ① PRE-FLIGHT — `derivedRouteFallsBack`, BEFORE any call. Trigger: the classifier model's route differs
+ *      from the primary's AND the brain's own route judge finds the credential/URL pairing broken. Effect:
+ *      the arming SWAPS the seat, so the ladder below is built from the main model and rung 0 IS the main
+ *      model. Record: the once-per-run operator notice `route.fallback_to_primary` (`detail.{seat, from, to,
+ *      cause}`) — and only that. `GateDisposition.classifier.modelRequested` reads the MAIN model's id,
+ *      because the ladder it describes never carried the configured seat; the gate record answers "which
+ *      model was asked", and "what did the deployment configure, and was it swapped" is the notice's
+ *      question. `classifierFallback` governs THIS layer too: under `"none"` the pre-flight does not swap —
+ *      it keeps the declared seat and announces `route.classifier_unroutable`, so the deployment that said
+ *      "deny rather than fall back" gets the denial (the seat's calls are refused at the request gate)
+ *      instead of a silent fallback the knob had just declined.
+ *   ② THE LADDER — here, AFTER a call. Trigger: the rung produced no RULING. Effect: the next rung is asked.
+ *      Record: `GateDisposition.classifier.fallback` on every classification this run's own gate decided (an
+ *      inherited-ancestor chain carries the form and no attribution) + the throttled `classifier.fallback`.
+ *
+ * They FOLD rather than stack: after a ① SWAP the seat and the main model are the same route, so
+ * {@link classifierLadderRungs} returns ONE rung and ② cannot fire in the same run (and under `"none"`, where
+ * ① does not swap, the ladder is one rung by the knob). The split's cost is the
+ * `modelRequested` reading above; the unification (the pre-flight as rung 0 under its own cause word, one
+ * record face for both) changes the notice set and is a ticket, not a repair.
+ */
+import type { AssistantMessage, Model } from "../../internal/llm.js";
+import { type AutoModeClassified } from "../auto-mode.js";
+import type { RunnerDeps } from "../types.js";
+/**
+ * The rungs a classification walks, in order: the classifier seat, and — under `classifierFallback: "main"` (the
+ * default) — the run's main model behind it. The knob is screened by `autoModeClassifierFallbackOf`, here and
+ * (idempotently) at the caps phase that reads the same word for the pre-flight's posture, so a value outside
+ * the closed set refuses the prepare loudly (`config.auto_mode_classifier_fallback_invalid`) instead of
+ * reading as the default.
+ *
+ * ONE RUNG when the two resolve to the SAME ROUTE. Route identity, not `Model.id`: two catalog entries may
+ * legitimately share a wire id while pointing at different endpoints (the route adjudicator's own law, and
+ * the split its pre-flight exists for) — an id-only comparison would collapse a healthy main endpoint and a
+ * broken classifier endpoint into one rung, turning the ladder off for the deployment that needs it most.
+ * The collapse where it does apply is deliberate: re-asking the SAME model is a retry, which is what CC's
+ * `unavailableOuterRetries` does and what this ladder is not. A catalog value the identity law cannot
+ * normalize (a non-string `baseUrl` — it throws) reads as TWO rungs: being wrong that way costs one extra
+ * call on a broken catalog, the other way turns the feature off invisibly, and the bad value still earns its
+ * loud refusal at the brain's request gate.
+ */
+export declare function classifierLadderRungs(knob: unknown, classifier: Model, main: Model): readonly Model[];
+/**
+ * WHY the classifier seat is the model it is when no `classifier` role names one — the closed set behind the
+ * `classifier.role_defaulted` notice's `reason`. `tier_below_main` = the nearest directly-bound tier below the
+ * run's main model; `tier_table` = the static `flash` row (a main bound to no tier); `role_fallback` = the
+ * `summarize → default` chain (no tiers at all); `main_only` = the main model is the only model there is (a
+ * single-model catalog, or nothing bound below the main's tier); `role_unresolvable` = a `classifier` role
+ * NAMED a model the catalog cannot resolve (a stale or misspelled reference), so the main model stands in —
+ * the pre-#805 leg fell back the same way, silently.
+ */
+export declare const CLASSIFIER_ROLE_DEFAULT_REASONS: readonly ["tier_below_main", "tier_table", "role_fallback", "main_only", "role_unresolvable"];
+export type ClassifierRoleDefaultReason = (typeof CLASSIFIER_ROLE_DEFAULT_REASONS)[number];
+/** What {@link classifierSeatModel} returns: the model, and — when no role NAMED it — why it is that one. */
+export type ClassifierSeat = {
+    readonly model: Model;
+    readonly defaulted?: ClassifierRoleDefaultReason;
+};
+/**
+ * The model the classifier SEAT resolves to for this run — ONE resolver for "which model classifies":
+ *   · a `classifier` role that NAMES a model (`roleSpecNamesModel`: a string ref, a Model object, `{model}`,
+ *     `{select}`) ⇒ the role resolver's answer, exactly as before (a preset-only role — `{thinking}` alone —
+ *     does not name one and takes the default below);
+ *   · else, with tier bindings declared (`deps.tiers`) and a main model on a tier ⇒ the nearest tier strictly
+ *     BELOW the main's whose route differs from the main's — `tier_below_main`; the main's tier is the LOWEST
+ *     tier its route sits on (a route bound as both `max` and `flash` is a `flash` main: deterministic, and
+ *     the cheaper reading); nothing below ⇒ the main itself, `main_only`. Read off the expanded catalog's
+ *     tier keys, the Runner's own resolution of a tier word: a key synthesised for an unbound tier falls DOWN
+ *     to the next bound tier, which is the model this walk reaches anyway, and a catalog key spelled like a
+ *     tier shadows the binding here as it does everywhere. No thinking preference: whether a model's
+ *     thinking can be turned off is the SEAT's business ({@link classifierRungSeat}), not routing's;
+ *   · else the role resolver's own fallback (the static tier row `classifier → flash` when tiers are active,
+ *     `tier_table`; the `summarize → default` chain otherwise, `role_fallback`); a catalog with no roles at
+ *     all ⇒ the main model, `main_only`.
+ * The relative pick follows the run's MAIN model on purpose: a side channel that resolved without it is the
+ * misfit the ticket names (a `flash` classifier above a `lite` main; two tiers below a `max` main).
+ */
+export declare function classifierSeatModel(args: {
+    deps: Pick<RunnerDeps, "models" | "roles" | "tiers">;
+    main: Model;
+}): ClassifierSeat;
+/**
+ * The `classifier.role_defaulted` line — minted ONCE per run by the arming, AFTER the route pre-flight, so it
+ * names the seat actually asked (a pre-flight swap to the main model is its own line,
+ * `route.fallback_to_primary`, same run). Silent when a role named the model: nothing was defaulted.
+ */
+export declare function announceClassifierRoleDefaulted(args: {
+    onNotice: RunnerDeps["onNotice"];
+    seat: ClassifierSeat;
+    sessionId?: string;
+    runId?: string;
+}): void;
+/**
+ * The classifier's REASONING SEAT, read off the model a classification is actually asked on — ONE predicate:
+ * does the wire SPELL off ({@link thinkingOffSpelled})? Yes ⇒ `off` + the verdict-sized cap (the request pays
+ * for the answer alone); no ⇒ `low` + the verdict cap + the low allowance (a model whose thinking the wire
+ * cannot turn off is asked for the least it can grade, in the room that costs — CC 2.1.259 `MU`: spell off,
+ * or leave thinking to the provider and pay 2048). A model that declares no reasoning at all is on the `low`
+ * seat too: its wire carries nothing either way, so the request is the gateway's default, and a default-on
+ * gateway thinks — the arm that used to read it as "never thinks" is the one the field report was about.
+ * PER RUNG, not once per arming: the second rung is a different model with its own wire.
+ *
+ * The THINK seat is the RE-ASK seat ({@link classifierReplyAsksAgain}): a first attempt that produced no
+ * verdict is asked once more with thinking allowed the room of CC's stage-2 classifier (8192) — an unknown
+ * model that answered NOTHING at its cap has just told us it thinks past it, and is re-asked as one that does.
+ */
+export declare const CLASSIFIER_OFF_SEAT: {
+    reasoning: "off";
+    maxTokens: number;
+};
+export declare const CLASSIFIER_LOW_SEAT: {
+    reasoning: "low";
+    maxTokens: number;
+};
+export declare const CLASSIFIER_THINK_SEAT: {
+    reasoning: "low";
+    maxTokens: number;
+};
+export type ClassifierSeatRequest = typeof CLASSIFIER_OFF_SEAT | typeof CLASSIFIER_LOW_SEAT | typeof CLASSIFIER_THINK_SEAT;
+/**
+ * The seat for one rung's FIRST attempt — see the seat table above.
+ *
+ * @contract classifier.budget_is_room — every classifier output cap is ROOM the request asks for, never a
+ * bound the engine can vouch for: a gateway may exclude reasoning tokens from `max_tokens` (a vLLM-fronted
+ * Qwen gateway answered a cap of 128 with 938 output tokens and `stop`), so an over-long think is cut by the
+ * round-trip timeout (`unavailable` / `timeout`), not by the cap (`parse_error` on an empty reply), and the
+ * two are attested as the two different facts they are.
+ */
+export declare function classifierRungSeat(model: Model): typeof CLASSIFIER_OFF_SEAT | typeof CLASSIFIER_LOW_SEAT;
+/**
+ * The user-message TAIL of each attempt — CC 2.1.259's classifier suffixes, verbatim: the FIRST attempt
+ * carries the fast-mode suffix (`$ns`: the answer must begin with `<block>`, no preamble), the RE-ASK carries
+ * the thinking-stage suffix (`Uns`: think in `<thinking>` first, then answer). The base prompt (2.1.250 `KRg`)
+ * already says "no preamble" once; upstream repeats it at the END of the user message, and it is the repeat
+ * that lands — live 2026-09-15, a Qwen 3.8 with thinking off went from 70% tagged replies (1.2–3.9k chars of
+ * "Looking at this action…" prose) to 90% at 8 output tokens with the first suffix, and the re-ask suffix
+ * had it write its reasoning inside `<thinking>` (stripped by the reader) before the tag.
+ */
+export declare const CLASSIFIER_ATTEMPT_SUFFIX: {
+    readonly first: "\nErr on the side of blocking. Your ENTIRE response MUST begin with <block>. Do NOT output any analysis, reasoning, or commentary before <block>. No \"Looking at...\" or similar preamble.";
+    readonly reask: "\nReview the classification process and follow it carefully, making sure you deny actions that should be blocked. As a reminder, explicit (not suggestive or implicit) user confirmation is required to override blocks. Use <thinking> before responding with <block>. Think longer on ambiguous or borderline actions; keep reasoning brief for clear-cut ones.";
+};
+/** The classifier reply's answer text — every text block joined; thinking blocks are not the verdict. */
+export declare function classifierReplyText(reply: AssistantMessage): string;
+/**
+ * CC 2.1.259 `$Tt`: an EMPTY reply that stopped at the output cap is "unparseable" — a reply to ask for again,
+ * not a refusal and not a verdict. The engine's brains report that cut two ways: `stopReason:"length"` (an
+ * engine-shrunk cap) or `stopReason:"error"` with `errorKind:"length_empty"` (a static cap — the classifier's
+ * own). An empty reply with any OTHER stop is CC's `policy_refusal` arm: not re-asked.
+ */
+export declare function classifierReplyEmptyAtCap(reply: AssistantMessage): boolean;
+/**
+ * A reply that may answer in the TAG form only: its text is not a complete answer of its own. Output cut by the cap
+ * (`stopReason: "length"`), a dropped connection or a stalled stream (`partialFinalized`, with a synthesised
+ * `stop`), and a reply that CALLED A TOOL (`stopReason: "toolUse"`, or a tool-call block in the content — the
+ * classifier is given no tools, and the openai brain reports a length cut with a surviving call as `toolUse`):
+ * whatever text arrived is a prefix or a fragment — a `No` on its way to `No, this must be blocked` — so it may
+ * carry a verdict only through a `<block>` tag, which reads a `<block>no` prefix as CC does; the bare-answer arm
+ * never sees it.
+ */
+export declare function classifierReplyTagOnly(reply: AssistantMessage): boolean;
+/**
+ * The text the DECIDER reads for its verdict: the reply's answer text, except that a tag-only reply
+ * ({@link classifierReplyTagOnly}) whose text carries NO tagged answer reads as EMPTY — a cut prefix must not
+ * reach the bare-answer arm as if it were the whole reply (adversarial passes 2–3: a connection cut after `No`,
+ * and a scratch `<block>` mention before a cut `No`, executed the gated tool). Judged by the reader itself with
+ * its bare arm closed, so "no tagged verdict" and "no verdict" cannot drift. Only the MISSING form is emptied:
+ * a tag-only reply that carries a CONFLICT keeps its text, so the decider records the conflict and the leg
+ * does not re-ask it (adversarial pass 4: emptying every parse failure had turned a cut conflict into a
+ * missing reply, and the re-ask into an allow). The decider then records `parse_error` / `missing` for the
+ * emptied text, the same word an empty reply gets.
+ */
+export declare function classifierReplyVerdictText(reply: AssistantMessage): string;
+/**
+ * Whether a first attempt is asked AGAIN on the THINK seat — ONE rule: the reply is MISSING a verdict, either
+ * empty at the cap ({@link classifierReplyEmptyAtCap}), cut or fragmentary without a tagged verdict
+ * ({@link classifierReplyTagOnly}), or text in which the reader finds no answer at all (`parse_error` of form
+ * `missing`: prose, a thinking-only reply). Not a CONFLICT (two `<block>` answers — it carries a `yes`, and a second attempt that answered `no`
+ * would erase it: the fail-closed `parse_error` it is stands) and not an empty reply with a non-cap stop
+ * (CC's refusal arm). CC 2.1.259 `Vrr` re-asks an unparseable reply up to `maxRetries` times; sema re-asks
+ * ONCE, on the stage-2 room, so a rung costs at most two calls. A failed reply ({@link classifierReplyFailure})
+ * is judged before this and never reaches it.
+ */
+export declare function classifierReplyAsksAgain(reply: AssistantMessage): boolean;
+/**
+ * A reply that is a LEG FAILURE rather than an answer — the brains RETURN a provider error as a message
+ * (`stopReason: "error"` with the provider's text on `errorMessage`: an HTTP 4xx/5xx, a quota refusal, an
+ * overloaded gateway) and a cancelled request as `"aborted"`; neither is a reply the reader may judge. Read as
+ * text they were `parse_error` — a card saying "the classifier's reply carried no verdict" about a model that
+ * never answered, a ladder record blaming `parse_error` instead of `error`. The leg THROWS what this returns
+ * and the decider maps the throw to `unavailable` (`error`), as it maps every leg failure; the sibling
+ * side-channel legs (compaction, consolidation) already read an error stop this way. The cap-cut form
+ * (`errorKind: "length_empty"`) is not a failure: it is the empty-at-cap reply the re-ask owns.
+ */
+export declare function classifierReplyFailure(reply: AssistantMessage): Error | undefined;
+/**
+ * The per-decision READ of a classification, as one seat: the `auto_mode.classified` trace frame (wall time,
+ * verdict, cause), the ladder's throttled `classifier.fallback` disclosure and the per-model
+ * `classifier.contract_broken` streak. All are observers — a throwing sink never reaches the gate (the decider
+ * swallows it), and none changes a verdict.
+ *
+ * The frame's `model` is the model the classification RAN ON, which is what the field has always meant (its
+ * declaration reads "the resolved classifier role, or the main model it fell back to"): the route
+ * pre-flight's swap and the ladder's walk are two ways to reach that same sentence. `seatModelId` is the
+ * fallback for a classification that carries no attribution at all.
+ */
+export declare function classifierRoundObserver(args: {
+    tracer: RunnerDeps["tracer"];
+    onNotice: RunnerDeps["onNotice"];
+    taskId: string;
+    seatModelId: string;
+    sessionId?: string;
+    runId?: string;
+}): (info: AutoModeClassified) => void;