@sema-agent/core 7.18.0 → 7.20.0

package/dist/agents/subagent.js

@@ -1,6 +1,7 @@
 import { Type } from "typebox";
 import { isAbsolute } from "node:path";
 import { applyParentSpecSeat, parentSpecSeatOfCtx } from "../core/parent-spec-seat.js";
+import { childClampSeats } from "../core/child-clamp-seats.js";
 import { stripSpawnTurnQuestionFace } from "../core/ask-question.js";
 import { withDelegationProvenance } from "../core/tool-policy.js";
 import { errorResult } from "../core/tools.js";
@@ -20,6 +21,7 @@ import { SUBAGENT_PROMPT } from "../prompts/default.js";
 import { hasSessionFork } from "../core/session.js";
 import { isDurablePause, pauseFamily } from "./suspend-guard.js";
 import { terminalProjection } from "../core/runner/terminal-projection.js";
+import { forwardSafely } from "../core/runner/forward-sink.js";
 import { delimitUntrusted, inlineUntrusted } from "../core/untrusted-text.js";
 import { createSafeNotifier } from "../core/safe-notify.js";
 import { boundedRedactedSummary } from "../core/untrusted-egress.js";
@@ -556,13 +558,13 @@ export function createSubagentResume(deps) {
                 sessionId: entry.childSessionId,
                 requireExistingSession: true,
                 ...(deps.currentOnQuestion !== undefined ? { onQuestion: deps.currentOnQuestion } : {}),
-                ...(entry.specSnapshot.handsReadOnly === true || deps.currentClamps?.handsReadOnly === true ? { handsReadOnly: true } : {}),
-                ...(entry.specSnapshot.readFace === "roots" || deps.currentClamps?.readFaceRoots === true ? { readFace: "roots" } : {}),
-                ...(entry.specSnapshot.writeFace === "roots" || deps.currentClamps?.writeFaceRoots === true ? { writeFace: "roots" } : {}),
-                ...(entry.specSnapshot.readDenyPatterns !== undefined || deps.currentClamps?.readDenyPatterns !== undefined
-                    ? { readDenyPatterns: [...(entry.specSnapshot.readDenyPatterns ?? []), ...(deps.currentClamps?.readDenyPatterns ?? [])] }
-                    : {}),
-                ...(entry.specSnapshot.interactiveTools === false || deps.currentClamps?.interactiveTools === false ? { interactiveTools: false } : {}),
+                ...childClampSeats({
+                    handsReadOnly: entry.specSnapshot.handsReadOnly === true || deps.currentClamps?.handsReadOnly === true,
+                    interactiveTools: entry.specSnapshot.interactiveTools === false || deps.currentClamps?.interactiveTools === false ? false : undefined,
+                    readFace: entry.specSnapshot.readFace === "roots" || deps.currentClamps?.readFaceRoots === true ? "roots" : entry.specSnapshot.readFace,
+                    writeFace: entry.specSnapshot.writeFace === "roots" || deps.currentClamps?.writeFaceRoots === true ? "roots" : entry.specSnapshot.writeFace,
+                    readDenyPatterns: [...(entry.specSnapshot.readDenyPatterns ?? []), ...(deps.currentClamps?.readDenyPatterns ?? [])],
+                }),
                 ...(entry.specSnapshot.oneShot === true || deps.currentClamps?.oneShot === true ? { oneShot: true } : {}),
                 ...(entry.specSnapshot.memoryPersistenceCapable === false || deps.currentClamps?.memoryPersistenceCapable === false
                     ? { memoryPersistenceCapable: false }
@@ -643,11 +645,7 @@ export function createSubagentResume(deps) {
                     ? {
                         onForwardEvent: (e) => {
                             resumeStepRecorder.record(e);
-                            try {
-                                entry.internalsSnapshot.onForwardEvent?.(deps.taskId !== undefined ? { ...e, bgAgentId: deps.taskId } : e);
-                            }
-                            catch {
-                            }
+                            forwardSafely(entry.internalsSnapshot, deps.taskId !== undefined ? { ...e, bgAgentId: deps.taskId } : e);
                             reviveActivityBeat(e);
                             if (reviveEmit !== undefined && e.type === "task_progress") {
                                 reviveEmit({
@@ -1904,9 +1902,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                     ...(ctx.alwaysLoadTools !== undefined ? { alwaysLoadTools: [...ctx.alwaysLoadTools] } : {}),
                     ...(ctx.restoreGatedTools !== undefined ? { restoreGatedTools: ctx.restoreGatedTools === true ? true : [...ctx.restoreGatedTools] } : {}),
                     ...(ctx.promptProfile !== undefined ? { promptProfile: ctx.promptProfile } : {}),
-                    ...(ctx.readFace === "roots" ? { readFace: "roots" } : {}),
-                    ...(ctx.writeFace === "roots" ? { writeFace: "roots" } : {}),
-                    ...(ctx.readDenyPatterns !== undefined ? { readDenyPatterns: [...ctx.readDenyPatterns] } : {}),
+                    ...childClampSeats({ handsReadOnly: ctx.handsReadOnly, interactiveTools: ctx.interactiveTools, readFace: ctx.readFace, writeFace: ctx.writeFace, readDenyPatterns: ctx.readDenyPatterns }),
                     enableBlockedReport: false,
                     limits: {
                         maxTurns: typeof observerDef.maxTurns === "number" && Number.isFinite(observerDef.maxTurns) && observerDef.maxTurns > 0 ? observerDef.maxTurns : 8,
@@ -2160,11 +2156,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                 ...(def?.memoryPersistenceCapable !== undefined ? { memoryPersistenceCapable: def.memoryPersistenceCapable } : {}),
                 ...(ctx.checkpointStoreForChildren !== undefined ? { checkpointStore: ctx.checkpointStoreForChildren } : {}),
                 ...(childOnAsk !== undefined ? { onAsk: childOnAsk } : {}),
-                ...(ctx.interactiveTools === false ? { interactiveTools: false } : {}),
-                ...(ctx.handsReadOnly === true ? { handsReadOnly: true } : {}),
-                ...(ctx.readFace === "roots" ? { readFace: "roots" } : {}),
-                ...(ctx.writeFace === "roots" ? { writeFace: "roots" } : {}),
-                ...(ctx.readDenyPatterns !== undefined ? { readDenyPatterns: [...ctx.readDenyPatterns] } : {}),
+                ...childClampSeats({ handsReadOnly: ctx.handsReadOnly, interactiveTools: ctx.interactiveTools, readFace: ctx.readFace, writeFace: ctx.writeFace, readDenyPatterns: ctx.readDenyPatterns }),
                 ...(ctx.excludeTools !== undefined ? { excludeTools: [...ctx.excludeTools] } : {}),
                 ...(ctx.deferTools !== undefined ? { deferTools: [...ctx.deferTools] } : {}),
                 ...(ctx.alwaysLoadTools !== undefined ? { alwaysLoadTools: [...ctx.alwaysLoadTools] } : {}),

package/dist/agents/teacher.js

@@ -1,6 +1,7 @@
 import { randomUUID } from "node:crypto";
 import { MAX_STRATEGY_INJECTION_TOTAL_BYTES, MAX_STRATEGY_PROBLEM_BYTES, MAX_STRATEGY_TEXT_BYTES } from "../core/strategy-store.js";
 import { createSafeNotifier, observeThenableRejection } from "../core/safe-notify.js";
+import { childClampSeats } from "../core/child-clamp-seats.js";
 import { mapNestedSuspend, isDurablePause } from "./suspend-guard.js";
 import { isDefineToolProduct, rebindDefineToolCtx, stampDefineToolBrand } from "../core/tools.js";
 import { delimitUntrusted, inlineUntrusted } from "../core/untrusted-text.js";
@@ -255,11 +256,7 @@ async function runTeacherCore(runner, studentSpec, teacher) {
         ...(studentSpec.principal !== undefined ? { principal: studentSpec.principal } : {}),
         ...(studentSpec.clientContext !== undefined ? { clientContext: studentSpec.clientContext } : {}),
         ...(studentSpec.promptProfile !== undefined ? { promptProfile: studentSpec.promptProfile } : {}),
-        ...(studentSpec.handsReadOnly === true ? { handsReadOnly: true } : {}),
-        ...(studentSpec.readFace === "roots" ? { readFace: "roots" } : {}),
-        ...(studentSpec.writeFace === "roots" ? { writeFace: "roots" } : {}),
-        ...(studentSpec.readDenyPatterns !== undefined ? { readDenyPatterns: [...studentSpec.readDenyPatterns] } : {}),
-        ...(studentSpec.interactiveTools === false ? { interactiveTools: false } : {}),
+        ...childClampSeats({ handsReadOnly: studentSpec.handsReadOnly, interactiveTools: studentSpec.interactiveTools, readFace: studentSpec.readFace, writeFace: studentSpec.writeFace, readDenyPatterns: studentSpec.readDenyPatterns }),
         ...(studentSpec.excludeTools !== undefined
             ? { excludeTools: Array.isArray(studentSpec.excludeTools) ? [...studentSpec.excludeTools] : studentSpec.excludeTools }
             : {}),

package/dist/agents/verify.js

@@ -1,6 +1,7 @@
 import { Type } from "typebox";
 import { CODE_AGENT_PROMPT } from "../prompts/default.js";
 import { releaseSession } from "./session-util.js";
+import { childClampSeats } from "../core/child-clamp-seats.js";
 import { mapNestedSuspend, isDurablePause, pauseFamily } from "./suspend-guard.js";
 import { delimitUntrusted, sanitizeUntrustedText } from "../core/untrusted-text.js";
 import { createSafeNotifier } from "../core/safe-notify.js";
@@ -136,17 +137,21 @@ export async function verifyCompleted(runner, result, specBase, objective, confi
     const runVerifier = async (impl, round) => {
         refuseUnhonorableInternals(internals, "before_leg");
         const roundEvidence = round === 1 ? config.evidence : undefined;
-        const v = await runner.runTask({
+        const verifierSpec = {
             objective: verifierObjective(objective, impl, roundEvidence),
             systemPrompt: verifierPrompt,
             ...(config.verifierModel ? { model: config.verifierModel } : { modelRole: "verifier" }),
             roles: specBase.roles,
             tools: verifierTools,
             handsReadOnly: config.verifierHandsReadOnly ?? true,
-            ...(foldedRootsFace ? { readFace: "roots" } : {}),
-            ...(foldedRootsWriteFace ? { writeFace: "roots" } : {}),
-            ...(foldedReadDeny.length > 0 ? { readDenyPatterns: [...foldedReadDeny] } : {}),
             interactiveTools: false,
+            ...childClampSeats({
+                handsReadOnly: specBase.handsReadOnly,
+                interactiveTools: specBase.interactiveTools,
+                readFace: foldedRootsFace ? "roots" : undefined,
+                writeFace: foldedRootsWriteFace ? "roots" : undefined,
+                readDenyPatterns: foldedReadDeny,
+            }),
             outputSchema: VerdictSchema,
             enableBlockedReport: false,
             limits: { ...(specBase.limits?.maxWalltimeMs !== undefined ? { maxWalltimeMs: specBase.limits.maxWalltimeMs } : {}) },
@@ -167,7 +172,8 @@ export async function verifyCompleted(runner, result, specBase, objective, confi
             ...(specBase.clientContext !== undefined ? { clientContext: { ...specBase.clientContext } } : {}),
             ...(specBase.promptProfile !== undefined ? { promptProfile: specBase.promptProfile } : {}),
             signal: specBase.signal,
-        }, legInternals());
+        };
+        const v = await runner.runTask(verifierSpec, legInternals());
         try {
             const cost = (v.stats.costMicroUsd ?? 0) + (v.stats.nested?.costMicroUsd ?? 0);
             return { verdict: v.structuredOutput, cost, ...(isDurablePause(v.terminal) ? { paused: { ...v, terminal: v.terminal } } : {}) };
@@ -241,14 +247,19 @@ export async function verifyCompleted(runner, result, specBase, objective, confi
         if (config.costCeilingMicroUsd != null && spend >= config.costCeilingMicroUsd)
             break;
         refuseUnhonorableInternals(internals, "before_leg");
-        current = await runner.runTask({
+        const fixLegSpec = {
             ...specBase,
             sessionId: current.sessionId,
             objective: fixObjective(outcome.findings),
-            ...(foldedRootsFace ? { readFace: "roots" } : {}),
-            ...(foldedRootsWriteFace ? { writeFace: "roots" } : {}),
-            ...(foldedReadDeny.length > 0 ? { readDenyPatterns: [...foldedReadDeny] } : {}),
-        }, legInternals());
+            ...childClampSeats({
+                handsReadOnly: specBase.handsReadOnly,
+                interactiveTools: specBase.interactiveTools,
+                readFace: foldedRootsFace ? "roots" : specBase.readFace,
+                writeFace: foldedRootsWriteFace ? "roots" : specBase.writeFace,
+                readDenyPatterns: foldedReadDeny,
+            }),
+        };
+        current = await runner.runTask(fixLegSpec, legInternals());
         spend += (current.stats.costMicroUsd ?? 0) + (current.stats.nested?.costMicroUsd ?? 0);
         implAccount.add(current.stats);
         if (isDurablePause(current.terminal)) {

package/dist/brain/anthropic.js

@@ -2,7 +2,7 @@ import {} from "../internal/llm.js";
 import { BrainError } from "./errors.js";
 import { startsWithInputTooLongAnchor } from "./input-too-long.js";
 import { DEGENERATE_MESSAGE, trimDegenerateTail } from "./repetition.js";
-import { createRepetitionPoll, parseStreamedToolArgs } from "./stream-shared.js";
+import { STREAM_TORN_WARNING, createRepetitionPoll, parseStreamedToolArgs } from "./stream-shared.js";
 import { mintFallbackToolCallId } from "./tool-call-id.js";
 import { emitBrainTelemetry, reportReasoningWireFacts } from "./status-sink.js";
 import { errorResultMediaNote, IMAGE_OMITTED_NO_VISION, modelSupportsVision, sendableImages } from "./media-degrade.js";
@@ -365,6 +365,7 @@ export function createAnthropicBrain(config = {}) {
                 const blocks = new Map();
                 const usageRaw = {};
                 let stopReason = null;
+                const terminalFrameSeen = () => stopReason != null;
                 let stopDetails;
                 let nextContentIndex = 0;
                 let malformedFrames = 0;
@@ -532,6 +533,7 @@ export function createAnthropicBrain(config = {}) {
                             hasSubstantiveText,
                             hasCompletedToolCall,
                             hasOnlyThinking: hasThinking && !hasSubstantiveText && !hasCompletedToolCall,
+                            terminalFrameSeen: terminalFrameSeen(),
                         };
                     },
                     sealForRetry() {
@@ -560,7 +562,7 @@ export function createAnthropicBrain(config = {}) {
                         }
                         handleEvent(evt);
                     },
-                    finalize() {
+                    finalize(opts) {
                         const finalContent = [];
                         const toolCalls = [];
                         const malformed = [];
@@ -666,6 +668,8 @@ export function createAnthropicBrain(config = {}) {
                             emptyNoFinish ||
                             (toolError !== undefined && noUsableContent) ||
                             (truncatedEmpty && !dynamicCut && !staticReasoningCut);
+                        const tornWithContent = !errored && opts?.truncated !== true && !terminalFrameSeen() && !noUsableContent && !degenerate;
+                        const errorMessageOut = tornWithContent ? (errorMessage ? `${errorMessage}\n${STREAM_TORN_WARNING}` : STREAM_TORN_WARNING) : errorMessage;
                         const errorKind = degenerate
                             ? "degenerate"
                             : !safetyCut && contextWindowExceeded
@@ -680,8 +684,9 @@ export function createAnthropicBrain(config = {}) {
                             usage: computeUsage(model, usageRaw),
                             ...(Object.keys(usageRaw).length === 0 ? { usageMissing: true } : {}),
                             timestamp: Date.now(),
-                            ...(errorMessage ? { errorMessage } : {}),
+                            ...(errorMessageOut ? { errorMessage: errorMessageOut } : {}),
                             ...(errorKind ? { errorKind } : {}),
+                            ...(tornWithContent ? { partialFinalized: true } : {}),
                             ...(rep.cut !== undefined || rep.spared.length > 0
                                 ? { repetition: { ...(rep.cut !== undefined ? { cut: rep.cut } : {}), ...(rep.spared.length > 0 ? { spared: rep.spared } : {}) } }
                                 : {}),

package/dist/brain/open-responses.js

@@ -1,7 +1,7 @@
 import {} from "../internal/llm.js";
 import { BrainError } from "./errors.js";
 import { DEGENERATE_MESSAGE, trimDegenerateTail } from "./repetition.js";
-import { createRepetitionPoll, parseStreamedToolArgs } from "./stream-shared.js";
+import { STREAM_TORN_WARNING, createRepetitionPoll, parseStreamedToolArgs } from "./stream-shared.js";
 import { mintFallbackToolCallId } from "./tool-call-id.js";
 import { emitBrainTelemetry } from "./status-sink.js";
 import { errorResultMediaNote, IMAGE_OMITTED_NO_VISION, imagesOmittedNoVisionNote, modelSupportsVision, sendableImages } from "./media-degrade.js";
@@ -195,6 +195,7 @@ function responsesErrorCode(code) {
 }
 const INCOMPLETE_MAX_OUTPUT_TOKENS = "max_output_tokens";
 const INCOMPLETE_CONTENT_FILTER = "content_filter";
+const RESPONSE_INCOMPLETE_WARNING = 'The response above may be incomplete: the endpoint reported status "incomplete" with no reason this client recognises.';
 function closeFunctionCall(acc) {
     if (acc.closedTc)
         return acc.closedTc;
@@ -302,6 +303,7 @@ export function createOpenResponsesBrain(config = {}) {
                 let usageRaw;
                 let responseId;
                 let terminalStatus;
+                const terminalFrameSeen = () => terminalStatus !== undefined;
                 let incompleteReason;
                 let accumRefusal = "";
                 const capabilityNotes = [];
@@ -572,6 +574,7 @@ export function createOpenResponsesBrain(config = {}) {
                             hasSubstantiveText,
                             hasCompletedToolCall,
                             hasOnlyThinking: hasReasoning && !hasSubstantiveText && !hasCompletedToolCall,
+                            terminalFrameSeen: terminalFrameSeen(),
                         };
                     },
                     sealForRetry() {
@@ -688,7 +691,8 @@ export function createOpenResponsesBrain(config = {}) {
                         const staticReasoningCut = truncatedEmpty && !dynamicCut && reasoningSeen && options?.staticReasoningCutDowngrade === true;
                         const safetyCut = incompleteReason === INCOMPLETE_CONTENT_FILTER;
                         const refused = accumRefusal.trim().length > 0;
-                        const emptyNoFinish = noUsableContent && terminalStatus === undefined && !degenerate;
+                        const incompleteUnmapped = terminalStatus === "incomplete" && incompleteReason !== INCOMPLETE_MAX_OUTPUT_TOKENS && incompleteReason !== INCOMPLETE_CONTENT_FILTER;
+                        const emptyNoFinish = noUsableContent && (!terminalFrameSeen() || incompleteUnmapped) && !degenerate;
                         const maxTokensNote = sentMaxTokens !== undefined
                             ? `effective max_output_tokens=${sentMaxTokens} (from ${sentMaxTokensLane === "options"
                                 ? "options.maxTokens"
@@ -708,7 +712,7 @@ export function createOpenResponsesBrain(config = {}) {
                                                 ? `[length_empty] response truncated at max_output_tokens (${maxTokensNote}) with no answer text — the model spent the whole budget on reasoning; raise the cap, or lower the reasoning effort for this task.`
                                                 : `[length_empty] response truncated at max_output_tokens (${maxTokensNote}) with no answer text — raise the cap`
                                             : emptyNoFinish
-                                                ? `[stream_torn] model stream ended with no content and no terminal response event — the response was lost (a torn stream or an in-band provider error frame)${malformedFrames > 0 ? ` — ${malformedFrames} unparseable data frame(s) were dropped on this stream (first sample: ${JSON.stringify(malformedSample)})` : ""}`
+                                                ? `[stream_torn] model stream ended with no content and ${terminalStatus === undefined ? "no terminal response event" : `a terminal status "${terminalStatus}" with no reason this client recognises (incomplete_details.reason=${incompleteReason ?? "absent"})`} — the response was lost (a torn stream or an in-band provider error frame)${malformedFrames > 0 ? ` — ${malformedFrames} unparseable data frame(s) were dropped on this stream (first sample: ${JSON.stringify(malformedSample)})` : ""}`
                                                 : undefined));
                         const errored = degenerate ||
                             safetyCut ||
@@ -716,6 +720,9 @@ export function createOpenResponsesBrain(config = {}) {
                             emptyNoFinish ||
                             (toolError !== undefined && noUsableContent) ||
                             (truncatedEmpty && !dynamicCut && !staticReasoningCut);
+                        const tornWithContent = !errored && opts?.truncated !== true && (!terminalFrameSeen() || incompleteUnmapped) && !noUsableContent && !degenerate;
+                        const partialWarning = terminalStatus === undefined ? STREAM_TORN_WARNING : RESPONSE_INCOMPLETE_WARNING;
+                        const errorMessageOut = tornWithContent ? (errorMessage ? `${errorMessage}\n${partialWarning}` : partialWarning) : errorMessage;
                         const errorKind = degenerate
                             ? "degenerate"
                             : !safetyCut && !refused && toolError === undefined && truncatedEmpty && !dynamicCut && !staticReasoningCut
@@ -732,8 +739,9 @@ export function createOpenResponsesBrain(config = {}) {
                             ...(usageRaw === undefined ? { usageMissing: true } : {}),
                             timestamp: Date.now(),
                             ...(responseId !== undefined ? { responseId } : {}),
-                            ...(errorMessage ? { errorMessage } : {}),
+                            ...(errorMessageOut ? { errorMessage: errorMessageOut } : {}),
                             ...(errorKind ? { errorKind } : {}),
+                            ...(tornWithContent ? { partialFinalized: true } : {}),
                             ...(rep.cut !== undefined || rep.spared.length > 0
                                 ? { repetition: { ...(rep.cut !== undefined ? { cut: rep.cut } : {}), ...(rep.spared.length > 0 ? { spared: rep.spared } : {}) } }
                                 : {}),

package/dist/brain/openai.js

@@ -1,7 +1,7 @@
 import {} from "../internal/llm.js";
 import { repairTextToolCalls } from "./tool-call-repair.js";
 import { DEGENERATE_MESSAGE, trimDegenerateTail } from "./repetition.js";
-import { createRepetitionPoll, parseStreamedToolArgs } from "./stream-shared.js";
+import { STREAM_TORN_WARNING, createRepetitionPoll, parseStreamedToolArgs } from "./stream-shared.js";
 import { mintFallbackToolCallId } from "./tool-call-id.js";
 import { emitBrainTelemetry } from "./status-sink.js";
 import { errorResultMediaNote, IMAGE_OMITTED_NO_VISION, imagesOmittedNoVisionNote, modelSupportsVision, sendableImages } from "./media-degrade.js";
@@ -373,6 +373,7 @@ export function createOpenAIBrain(config = {}) {
                 let textIndex = 0;
                 const toolAccum = new Map();
                 let finishReason = null;
+                const terminalFrameSeen = () => finishReason != null;
                 let usageRaw;
                 let malformedFrames = 0;
                 let malformedSample;
@@ -438,6 +439,7 @@ export function createOpenAIBrain(config = {}) {
                             hasSubstantiveText,
                             hasCompletedToolCall,
                             hasOnlyThinking: accumReasoning.length > 0 && !hasSubstantiveText && !hasCompletedToolCall,
+                            terminalFrameSeen: terminalFrameSeen(),
                         };
                     },
                     sealForRetry() {
@@ -619,6 +621,8 @@ export function createOpenAIBrain(config = {}) {
                             emptyNoFinish ||
                             (toolError !== undefined && noUsableContent) ||
                             (truncatedEmpty && !dynamicCut);
+                        const tornWithContent = !errored && opts?.truncated !== true && !terminalFrameSeen() && !noUsableContent && !degenerate;
+                        const errorMessageOut = tornWithContent ? (errorMessage ? `${errorMessage}\n${STREAM_TORN_WARNING}` : STREAM_TORN_WARNING) : errorMessage;
                         const errorKind = degenerate
                             ? "degenerate"
                             : !safetyCut && !refused && toolError === undefined && truncatedEmpty && !dynamicCut
@@ -631,8 +635,9 @@ export function createOpenAIBrain(config = {}) {
                             usage: computeUsage(model, usageRaw),
                             ...(usageRaw === undefined ? { usageMissing: true } : {}),
                             timestamp: Date.now(),
-                            ...(errorMessage ? { errorMessage } : {}),
+                            ...(errorMessageOut ? { errorMessage: errorMessageOut } : {}),
                             ...(errorKind ? { errorKind } : {}),
+                            ...(tornWithContent ? { partialFinalized: true } : {}),
                             ...(rep.cut !== undefined || rep.spared.length > 0
                                 ? { repetition: { ...(rep.cut !== undefined ? { cut: rep.cut } : {}), ...(rep.spared.length > 0 ? { spared: rep.spared } : {}) } }
                                 : {}),

package/dist/brain/reasoning.d.ts

@@ -117,25 +117,25 @@ export interface OffCapabilityModel {
  * "none" tier), on an endpoint that takes an effort value at all (`supportsReasoningEffort` not
  * false) — else `undefined`: there is nothing to send. The effort formats have no disable key, and an
  * effort VALUE is never off (it enables reasoning at that tier), so off on those wires is spelled only
- * when the deployment says how. The two appliers and {@link thinkingOffExpressible} read this ONE
+ * when the deployment says how. The two appliers and {@link thinkingOffSpelled} read this ONE
  * function, so what the wire carries and what the capability table claims cannot disagree.
  */
 export declare function declaredOffSpelling(model: OffCapabilityModel): string | undefined;
 /**
- * Whether this model's wire can SAY "off". A model that does not reason at all (`reasoning` falsy)
- * never thinks, so off is trivially expressible. Otherwise, per wire: the anthropic budget form spells
- * `{type:"disabled"}` (the ADAPTIVE form rejects it — those models think on every request); deepseek
- * `{type:"disabled"}`, the binary enable keys at `false`, openrouter/together `reasoning:{enabled:false}`
- * all say it; the effort-only wires (stock openai completions, the Responses lane) say it only through
- * a deployment-declared off spelling ({@link declaredOffSpelling}).
+ * Whether the wire will CARRY a disable key for this model — off is SPELLED, never assumed. Per wire: the
+ * anthropic budget form spells `{type:"disabled"}` (the ADAPTIVE form rejects it — those models think on
+ * every request); deepseek `{type:"disabled"}`, the binary enable keys at `false`, openrouter/together
+ * `reasoning:{enabled:false}` all spell it; the effort-only wires (stock openai completions, the Responses
+ * lane) spell it only through a deployment-declared off spelling ({@link declaredOffSpelling}).
  *
- * A caller that sizes an output cap for an ANSWER alone (the auto-mode classifier's block-verdict
- * contract) applies the cap only when this is true: a model that will think regardless cannot have its
- * cap derived from the answer's contract, and keeps its own budget. What this table cannot see is a
- * model that IGNORES its wire's disable key (a thinking-only build served through a format that has
- * one) — that is a per-model fact the compat declaration does not yet carry.
+ * A model whose `reasoning` is FALSY spells NOTHING: every applier returns before writing any key for it, so
+ * the request is the gateway's own default — and a default-on gateway thinks regardless (three of four live
+ * endpoints, 2026-09-15). This arm used to answer `true` ("a non-reasoning model never thinks"): the engine
+ * may size a request by what it SENT, never by what it hopes a gateway does when told nothing. What this
+ * table cannot see is a gateway that IGNORES the key it was sent — the classifier's re-ask on a no-verdict
+ * reply is the seat that learns that from the reply.
  */
-export declare function thinkingOffExpressible(model: OffCapabilityModel): boolean;
+export declare function thinkingOffSpelled(model: OffCapabilityModel): boolean;
 /**
  * OPTIONAL per-request facts for {@link resolveReasoning} — what the wire's budget arm knows at
  * request build that a per-leg eager resolution cannot: the resolved output cap and whether it is a

package/dist/brain/reasoning.js

@@ -30,9 +30,9 @@ export function declaredOffSpelling(model) {
     const mapped = model.thinkingLevelMap?.off;
     return typeof mapped === "string" && mapped !== "" ? mapped : undefined;
 }
-export function thinkingOffExpressible(model) {
+export function thinkingOffSpelled(model) {
     if (!model.reasoning)
-        return true;
+        return false;
     const compat = (model.compat ?? {});
     if (model.api === "anthropic-messages")
         return compat.thinkingMode !== "adaptive";

package/dist/brain/stream-engine.d.ts

@@ -194,11 +194,15 @@ export interface StreamParser {
      * - `hasOnlyThinking` — thinking streamed but nothing substantive (no non-blank text, no completed
      *   tool call) → tier B (seal + whole-turn retry). A dangling tool-call accumulation alongside the
      *   thinking does not veto this (nothing was admitted; the retry's snapshot replacement drops it).
+     * - `terminalFrameSeen` — the provider TERMINATED this stream (openai `finish_reason`, anthropic
+     *   `message_delta.stop_reason`, responses `response.completed`/`response.incomplete`). A FACT, not a tier:
+     *   the parser reports it off the same state its own finalize reads, and the tiering owns what it means.
      */
     snapshot(): {
         hasSubstantiveText: boolean;
         hasCompletedToolCall: boolean;
         hasOnlyThinking: boolean;
+        terminalFrameSeen: boolean;
     };
     /**
      * design/124 §0.5-2 tier B: seal the UI stream before a whole-turn retry — emit `thinking_end` for

package/dist/brain/stream-engine.js

@@ -1,4 +1,5 @@
 import { createAssistantMessageEventStream, } from "../internal/llm.js";
+import { STREAM_TORN_WARNING } from "./stream-shared.js";
 import { FLOOR_OUTPUT_TOKENS, parseContextOverflow, planOutputCapAdjustment } from "./context-overflow.js";
 import { BrainError, classifyConnectFailure, classifyHttp, describeNetworkError, namesTheFailure, readProviderRequestId } from "./errors.js";
 import { classifyInputTooLong } from "./input-too-long.js";
@@ -646,11 +647,15 @@ export function runStreamingBrain(args) {
                 return;
             }
             const snap = parser.snapshot();
+            if (snap.terminalFrameSeen) {
+                parser.finalize();
+                return;
+            }
             if (snap.hasSubstantiveText || snap.hasCompletedToolCall) {
                 midstreamWarning =
                     failure.kind === "stalled"
                         ? "Response stalled mid-stream. The response above may be incomplete."
-                        : "Connection closed mid-response. The response above may be incomplete.";
+                        : STREAM_TORN_WARNING;
                 parser.finalize({ truncated: true });
                 return;
             }

package/dist/brain/stream-shared.d.ts

@@ -24,6 +24,9 @@ import { type RepetitionEvent } from "./repetition.js";
  * means "do not emit a `toolcall_end` for this call"; callers must NOT cache that outcome — finalize retries
  * the parse against the complete accumulation.
  */
+/** The CC-verbatim warning stamped beside `partialFinalized` when a stream ended before its close — by the
+ *  mid-stream promotion (the body threw) and by the parsers' own finalize (content arrived, no finish frame). */
+export declare const STREAM_TORN_WARNING = "Connection closed mid-response. The response above may be incomplete.";
 export declare function parseStreamedToolArgs(json: string): Record<string, unknown> | undefined;
 /** Repetition telemetry for ONE stream — the cut event plus the allowance-spared hits. */
 export interface RepetitionPoll {

package/dist/brain/stream-shared.js

@@ -1,4 +1,5 @@
 import { inspectDegenerate } from "./repetition.js";
+export const STREAM_TORN_WARNING = "Connection closed mid-response. The response above may be incomplete.";
 export function parseStreamedToolArgs(json) {
     if (!json)
         return {};

package/dist/core/ask-origin.d.ts

@@ -133,6 +133,22 @@ export interface AskOriginFacts {
 export declare function askOriginOf(decision: Extract<PermissionResult, {
     action: "ask";
 }>, facts: AskOriginFacts): AskOrigin;
+/**
+ * Stamp the ask's origin word — and withdraw the disclosures that speak for the TIGHTEN alone when some
+ * layer above it is the reason this call is being asked about. Today that is one member: the read
+ * boundary's directory offer, whose claim holds only while the tighten is the whole reason. Every higher
+ * rung is a layer with a reason of its own — a standing `ask` row, an unreadable rule store, an org
+ * verdict, a hook, the denial-limit fallback — which no directory grant answers, so the ask would stand
+ * after the grant and the offer would have promised a clearing it cannot deliver (measured: `cat
+ * <out-of-root>` under a standing `Bash(cat:*)` ask rule offered the directory and kept asking after it).
+ * It lives at the one derivation rather than the three stamp sites: the withdrawal's input IS the origin
+ * word, so a site that stamped without it would be a second, quieter answer to one question.
+ */
+export declare function stampAskOrigin<T extends Extract<PermissionResult, {
+    action: "ask";
+}>>(decision: T, facts: AskOriginFacts): T & {
+    origin: AskOrigin;
+};
 /**
  * Which origins IMPLY the `requiresRealApproval` bit, and WHERE that implication is verified — the
  * consistency table {@link askOriginOf} reads. An ask of a must-carry origin exists so that no automatic

package/dist/core/ask-origin.js

@@ -15,6 +15,14 @@ export function askOriginOf(decision, facts) {
     }
     return origin;
 }
+const TIGHTEN_ONLY_ORIGINS = new Set(["shell_gate_tighten", "safety_tighten"]);
+export function stampAskOrigin(decision, facts) {
+    const origin = askOriginOf(decision, facts);
+    if (decision.probeReadRootCandidate === undefined || TIGHTEN_ONLY_ORIGINS.has(origin))
+        return { ...decision, origin };
+    const { probeReadRootCandidate: _withdrawn, ...kept } = decision;
+    return { ...kept, origin };
+}
 function originLadder(decision, facts) {
     if (facts.contentQuestion)
         return "content_question";

package/dist/core/auto-mode-arming.d.ts

@@ -180,5 +180,11 @@ export type AutoModeArmingFold = {
  *   nevertheless declare the same epoch — that is a deployment telling us its settings did not move
  *   while its own data says otherwise, and picking either side would be a guess about which one is the
  *   policy in force.
+ *
+ * @contract auto_mode.arming.absent_timeout_reads_recorded_default — a parked arming's absent `timeoutMs` is
+ * read as the default in force when it was recorded (`AUTO_MODE_RECORDED_ABSENT_TIMEOUT_MS`, 15_000 ms), not
+ * the default in force when it is redeemed: persisted data is read under the contract it was written under,
+ * so a default that moves can never widen an ancestor's bound at redemption; every recipe minted since
+ * materialises the knob, so absence dates the recording.
  */
 export declare function foldAutoModeArming(recorded: unknown, current: unknown): AutoModeArmingFold;

package/dist/core/auto-mode-arming.js

@@ -1,4 +1,4 @@
-import { AUTO_MODE_DEFAULT_TIMEOUT_MS, AUTO_MODE_DEFAULT_WINDOW_MAX_CHARS, AUTO_MODE_DEFAULT_WINDOW_MAX_ENTRIES, AUTO_MODE_DEFAULTS_SENTINEL, AUTO_MODE_DENIAL_AUTO_DENY_DEFAULT_MS, AUTO_MODE_DENIAL_LIMIT_DEFAULTS, } from "./auto-mode-defaults.js";
+import { AUTO_MODE_DEFAULT_TIMEOUT_MS, AUTO_MODE_RECORDED_ABSENT_TIMEOUT_MS, AUTO_MODE_DEFAULT_WINDOW_MAX_CHARS, AUTO_MODE_DEFAULT_WINDOW_MAX_ENTRIES, AUTO_MODE_DEFAULTS_SENTINEL, AUTO_MODE_DENIAL_AUTO_DENY_DEFAULT_MS, AUTO_MODE_DENIAL_LIMIT_DEFAULTS, } from "./auto-mode-defaults.js";
 export const AUTO_MODE_ARMING_RECIPE_VERSION = 2;
 const isPlainRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 function canonicalStrings(v) {
@@ -143,7 +143,7 @@ export function autoModeArmingRecipeOf(face, bind) {
         ...(face.settingsDenyRules !== undefined ? { settingsDenyRules: face.settingsDenyRules } : {}),
         ...(face.sessionContext !== undefined ? { sessionContext: face.sessionContext } : {}),
         ...(face.window !== undefined ? { window: face.window } : {}),
-        ...(face.timeoutMs !== undefined ? { timeoutMs: face.timeoutMs } : {}),
+        timeoutMs: face.timeoutMs ?? AUTO_MODE_DEFAULT_TIMEOUT_MS,
         ...(face.denialLimit !== undefined ? { denialLimit: face.denialLimit } : {}),
         ...(face.settingsEpoch !== undefined ? { settingsEpoch: face.settingsEpoch } : {}),
         ...(face.crossSessionMessagesRule !== undefined ? { crossSessionMessagesRule: face.crossSessionMessagesRule } : {}),
@@ -208,8 +208,8 @@ export function foldAutoModeArming(recorded, current) {
                     "(the strictest decidable answer: the inherited ask flows the original chain to a human)",
             };
     }
-    const minKnob = (a, b, fallback) => Math.min(a ?? fallback, b ?? fallback);
-    const timeoutMs = minKnob(rec.timeoutMs, cur.timeoutMs, AUTO_MODE_DEFAULT_TIMEOUT_MS);
+    const recordedTimeoutMs = rec.timeoutMs ?? AUTO_MODE_RECORDED_ABSENT_TIMEOUT_MS;
+    const timeoutMs = Math.min(recordedTimeoutMs, cur.timeoutMs ?? AUTO_MODE_DEFAULT_TIMEOUT_MS);
     const denialLimit = tightenDenialLimit(rec.denialLimit, cur.denialLimit);
     const recordedDenial = tightenDenialLimit(rec.denialLimit, rec.denialLimit);
     return {
@@ -221,7 +221,7 @@ export function foldAutoModeArming(recorded, current) {
             denialLimit,
             ...(cur.settingsEpoch !== undefined ? { settingsEpoch: cur.settingsEpoch } : {}),
         },
-        tightened: timeoutMs < (rec.timeoutMs ?? AUTO_MODE_DEFAULT_TIMEOUT_MS) ||
+        tightened: timeoutMs < recordedTimeoutMs ||
             denialLimit.maxConsecutive < recordedDenial.maxConsecutive ||
             denialLimit.maxTotal < recordedDenial.maxTotal ||
             denialLimit.autoDenyAfterMs !== recordedDenial.autoDenyAfterMs,