@sema-agent/core 7.18.0 → 7.20.0

package/dist/core/runner/listing-fold.js

@@ -0,0 +1,75 @@
+import { sanitizeUntrustedText, SHELLED_BODY_ENVELOPE_TAGS } from "../untrusted-text.js";
+export function foldListingWithin(items, spec) {
+    if (items.length === 0)
+        return undefined;
+    const bytes = (s) => Buffer.byteLength(s, "utf8");
+    const render = spec.frame;
+    const lineCost = (l) => bytes(l) + 1;
+    const bodyBudget = spec.blockMaxBytes - bytes(render([]));
+    const fullLines = items.map((it) => spec.full(it));
+    const fullTotal = fullLines.reduce((acc, l) => acc + lineCost(l), 0);
+    if (fullTotal <= bodyBudget)
+        return { text: render(fullLines), nameOnly: [], dropped: [] };
+    const nameLines = items.map((it) => spec.nameOnly(it));
+    const namePrefix = new Array(nameLines.length + 1);
+    namePrefix[0] = 0;
+    for (let i = 0; i < nameLines.length; i++)
+        namePrefix[i + 1] = namePrefix[i] + lineCost(nameLines[i]);
+    const markerCost = lineCost(spec.capMarker);
+    const floorCost = markerCost + namePrefix[nameLines.length];
+    if (floorCost <= bodyBudget) {
+        let slack = bodyBudget - floorCost;
+        const byPriority = items
+            .map((it, i) => ({ i, rank: spec.rank?.(it, i) ?? i }))
+            .toSorted((a, b) => a.rank - b.rank || a.i - b.i);
+        const withFull = new Set();
+        for (const { i } of byPriority) {
+            const delta = lineCost(fullLines[i]) - lineCost(nameLines[i]);
+            if (delta <= slack) {
+                withFull.add(i);
+                slack -= delta;
+            }
+        }
+        return {
+            text: render([spec.capMarker, ...items.map((_it, i) => (withFull.has(i) ? fullLines[i] : nameLines[i]))]),
+            nameOnly: items.filter((_it, i) => !withFull.has(i)).map((it) => spec.nameOf(it)),
+            dropped: [],
+        };
+    }
+    for (let m = items.length - 1; m >= 0; m--) {
+        const overflow = spec.overflowLine(items.length - m);
+        if (markerCost + namePrefix[m] + lineCost(overflow) <= bodyBudget) {
+            return {
+                text: render([spec.capMarker, ...nameLines.slice(0, m), overflow]),
+                nameOnly: items.slice(0, m).map((it) => spec.nameOf(it)),
+                dropped: items.slice(m).map((it) => spec.nameOf(it)),
+            };
+        }
+    }
+    return {
+        text: render([spec.capMarker, spec.overflowLine(items.length)]),
+        nameOnly: [],
+        dropped: items.map((it) => spec.nameOf(it)),
+    };
+}
+export function removalArmFloor(header, count) {
+    return [header, `(… +${count} more are no longer available)`].join("\n");
+}
+export function foldRemovalArmWithin(removed, header, maxBytes) {
+    const bytes = (s) => Buffer.byteLength(s, "utf8");
+    const lines = removed.map((n) => `- ${sanitizeUntrustedText(n, SHELLED_BODY_ENVELOPE_TAGS)}`);
+    const head = bytes(header);
+    const lineCost = (l) => bytes(l) + 1;
+    const prefix = new Array(lines.length + 1);
+    prefix[0] = 0;
+    for (let i = 0; i < lines.length; i++)
+        prefix[i + 1] = prefix[i] + lineCost(lines[i]);
+    if (head + prefix[lines.length] <= maxBytes)
+        return [header, ...lines].join("\n");
+    for (let m = lines.length - 1; m >= 0; m--) {
+        const tail = `(… +${lines.length - m} more are no longer available)`;
+        if (head + prefix[m] + lineCost(tail) <= maxBytes)
+            return [header, ...lines.slice(0, m), tail].join("\n");
+    }
+    return removalArmFloor(header, lines.length);
+}

package/dist/core/runner/prepare-ask-lane.js

@@ -102,6 +102,7 @@ export function prepareAskLane(input) {
             ...(decision.action === "ask" ? gateAskCarry(decision, isLiveApproverSeat(onAsk), autoModeDenialTracking) : {}),
             ...(decision.action === "ask" && decision.probeReason !== undefined ? { probeReason: decision.probeReason } : {}),
             ...(decision.action === "ask" && decision.probeCause !== undefined ? { probeCause: decision.probeCause } : {}),
+            ...(decision.action === "ask" && decision.probeReadRootCandidate !== undefined ? { readRootCandidate: decision.probeReadRootCandidate } : {}),
             ...(decision.action === "ask" && decision.ruleEvidence !== undefined ? { ruleEvidence: decision.ruleEvidence } : {}),
         }, onAsk, composedCallSignal(callSignal), lateAskSettlementObserver({ toolName: req.toolName, toolCallId: req.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice, onError: deps.onError }));
         const waitMs = Math.max(0, now() - t0);

package/dist/core/runner/prepare-caps-and-workflow.js

@@ -11,26 +11,14 @@ import { autoModeClassifierFallbackOf, autoModeRoundNotAsked, createAutoModeDeci
 import { checkpointStoreOfSeat } from "../checkpoint-seat.js";
 import { COMPLIANCE_CAPABILITIES, WEB_FETCH_TOOL_NAME, resolveComplianceDenies } from "../compliance.js";
 import { createPresentPlanTool, createEnterPlanModeTool } from "../present-plan-tool.js";
-import { resolveTaskModel } from "../roles.js";
 import { brainToRuntime } from "../runtime.js";
 import { defaultTaskRegistry } from "../task-registry.js";
 import { defineTool, isDefineToolProduct, rebindDefineToolCtx } from "../tools.js";
 const MOUNT_REMEDY = "author it as a plain-object ToolSpec (own `name` and `execute`), hand the defineTool product itself, or wrap a product through the supported wrapper form (a fresh object re-stamped with `stampDefineToolBrand` whose rebind re-wraps the rebound product)";
 import { AUTO_MODE_DENY_SOURCES, isAutoModeDenySource } from "../runtime-caps.js";
 import { derivedRouteFallsBack } from "./derived-route-fallback.js";
-import { CLASSIFIER_LOW_SEAT, CLASSIFIER_OFF_SEAT, classifierLadderRungs, classifierRoundObserver, classifierRungSeat } from "./classifier-ladder.js";
+import { CLASSIFIER_ATTEMPT_SUFFIX, CLASSIFIER_THINK_SEAT, announceClassifierRoleDefaulted, classifierLadderRungs, classifierReplyAsksAgain, classifierReplyFailure, classifierReplyVerdictText, classifierRoundObserver, classifierRungSeat, classifierSeatModel } from "./classifier-ladder.js";
 import { REPORT_FINDINGS_TOOL_NAME, createReportBlockedTool, createReportFindingsTool } from "./synthetic-tools.js";
-function classifierReplyText(reply) {
-    return reply.content
-        .filter((c) => c.type === "text")
-        .map((c) => c.text)
-        .join("");
-}
-function classifierReplyEmptyAtCap(reply) {
-    if (classifierReplyText(reply) !== "")
-        return false;
-    return reply.stopReason === "length" || (reply.stopReason === "error" && reply.errorKind === "length_empty");
-}
 import { RosterBuilder, callerMountSource } from "../tool-roster.js";
 function assembleParentCaptureState(o, i, ctl, ancestors) {
     const build = (optedOut, indeterminate) => ({
@@ -209,16 +197,12 @@ export async function prepareCapsAndWorkflow(input) {
     const autoModeArmReason = autoModeArmReasonOf(autoModeIntent, deps.autoMode !== undefined, runtimeCaps, runtimeCapsFaulted);
     if (autoModeIntent && deps.autoMode !== undefined && runtimeCaps?.autoMode !== false) {
         const am = deps.autoMode;
-        let classifierModel;
-        try {
-            classifierModel = resolveTaskModel({ modelRole: "classifier" }, deps).model;
-        }
-        catch {
-            classifierModel = model;
-        }
+        const classifierSeat = classifierSeatModel({ deps, main: model });
+        let classifierModel = classifierSeat.model;
         if (await derivedRouteFallsBack({ seat: "auto-mode-classifier", derived: classifierModel, primary: model, brain: deps.brain, getApiKeyAndHeaders: spec.getApiKeyAndHeaders, onNotice: deps.onNotice, sessionId, runId, onBrokenPairing: autoModeClassifierFallbackOf(am.classifierFallback) === "none" ? "refuse" : "fall_back" })) {
             classifierModel = model;
         }
+        announceClassifierRoleDefaulted({ onNotice: deps.onNotice, seat: { ...classifierSeat, model: classifierModel }, ...(sessionId !== undefined ? { sessionId } : {}), ...(runId !== undefined ? { runId } : {}) });
         const classifierLaneRule = peerLaneActive && peerSendMessageBuiltIn;
         const classifierSystemPrompt = buildAutoModePrompt(classifierLaneRule ? { ...am, crossSessionMessagesRule: CROSS_SESSION_CLASSIFIER_RULE } : am);
         const classifierRuntime = brainToRuntime(deps.brain);
@@ -245,17 +229,22 @@ export async function prepareCapsAndWorkflow(input) {
                 }
                 const userPrompt = await build.catch((e) => { throw autoModeRoundNotAsked(e); });
                 const classifierAuth = await spec.getApiKeyAndHeaders?.(rungModel);
-                const request = (seat) => classifierRuntime.completeSimple(rungModel, { systemPrompt: classifierSystemPrompt, messages: [{ role: "user", content: userPrompt, timestamp: Date.now() }] }, {
-                    signal,
-                    ...seat,
-                    ...(classifierAuth?.apiKey !== undefined ? { apiKey: classifierAuth.apiKey } : {}),
-                    ...(classifierAuth?.headers !== undefined ? { headers: classifierAuth.headers } : {}),
-                });
-                const rungSeat = classifierRungSeat(rungModel);
-                let response = await request(rungSeat);
-                if (rungSeat === CLASSIFIER_OFF_SEAT && classifierReplyEmptyAtCap(response))
-                    response = await request(CLASSIFIER_LOW_SEAT);
-                return classifierReplyText(response);
+                const request = async (seat, suffix) => {
+                    const response = await classifierRuntime.completeSimple(rungModel, { systemPrompt: classifierSystemPrompt, messages: [{ role: "user", content: userPrompt + suffix, timestamp: Date.now() }] }, {
+                        signal,
+                        ...seat,
+                        ...(classifierAuth?.apiKey !== undefined ? { apiKey: classifierAuth.apiKey } : {}),
+                        ...(classifierAuth?.headers !== undefined ? { headers: classifierAuth.headers } : {}),
+                    });
+                    const failure = classifierReplyFailure(response);
+                    if (failure !== undefined)
+                        throw failure;
+                    return response;
+                };
+                let response = await request(classifierRungSeat(rungModel), CLASSIFIER_ATTEMPT_SUFFIX.first);
+                if (classifierReplyAsksAgain(response) && signal?.aborted !== true)
+                    response = await request(CLASSIFIER_THINK_SEAT, CLASSIFIER_ATTEMPT_SUFFIX.reask);
+                return classifierReplyVerdictText(response);
             },
         });
         if (am.persistArming === true)

package/dist/core/runner/prepare-config-doors.d.ts

@@ -25,6 +25,7 @@ import type { ThinkingLevel } from "../../internal/harness.js";
 import { type MicroCompactMachine } from "../context-edit.js";
 import { type LockedPreflight } from "../locked-config.js";
 import { type ResolvedRole } from "../roles.js";
+import { type ResolvedSkillListingBudget } from "../skill-listing-budget.js";
 import type { SessionStore } from "../session.js";
 import type { RunnerDeps, TaskLimits, TaskSpec } from "../types.js";
 import { type UsageWindow } from "../usage-window-store.js";
@@ -184,6 +185,11 @@ export interface PrepareConfigDoorsResult {
      *  mutated (or getter-backed) after the door must not present an unscreened value to the mark
      *  branch (the read-once posture). */
     memoryDelegationEvidence: "static-face" | "attested-only";
+    /** owned — the lowered skills-listing budget seats (`TaskSpec.skillListingBudgetFraction` /
+     *  `skillListingMaxDescChars`): the renderer's two numbers, resolved once against the resolved main
+     *  model's window. Read at the door so a bad value refuses BEFORE session acquisition, and carried so
+     *  the listing phase and the boundary renderer measure against the same resolution. */
+    skillListingBudget: ResolvedSkillListingBudget;
     /** owned — the NORMALIZED memory-provenance mode: the deps seat read ONCE in
    *  the synchronous pre-await stretch, screened, absent folded to the `"carry"` default.
      *  The memory phase constructs every engine with THIS value — never a live deps re-read. */

package/dist/core/runner/prepare-config-doors.js

@@ -7,6 +7,8 @@ import { isModelPriced, malformedPricingField, modelCostToPricing } from "../pri
 import { preflightLockedConfig } from "../locked-config.js";
 import { assertRetentionCapability } from "../retention.js";
 import { resolveModel, resolveTaskModel, roleModelIfSet } from "../roles.js";
+import { resolveSkillListingBudget } from "../skill-listing-budget.js";
+import { describeRejectedValue } from "../tool-search-setting.js";
 import { applyToolModelGate, assertRestoreGatedToolsValue, modelIdTail } from "../tool-model-gate.js";
 import { resolveUsageWindows } from "../usage-window-store.js";
 import { deriveAskEffective, resolveAskSeamForm, resolveQuestionSeam } from "../wiring-manifest.js";
@@ -35,16 +37,6 @@ export function limitConfigError(code, message) {
     e.code = code;
     return e;
 }
-function describeRejectedValue(value) {
-    try {
-        const quoted = JSON.stringify(value);
-        if (quoted !== undefined)
-            return quoted;
-    }
-    catch {
-    }
-    return `a ${typeof value} value`;
-}
 export function resolveTaskLimits(limits) {
     if (limits === undefined)
         return undefined;
@@ -416,6 +408,11 @@ export function prepareConfigDoors(input) {
     if (gateDecision.survivors !== undefined) {
         spec = { ...spec, tools: gateDecision.survivors };
     }
+    const skillListingBudget = resolveSkillListingBudget({
+        fraction: spec.skillListingBudgetFraction,
+        maxDescChars: spec.skillListingMaxDescChars,
+        model,
+    });
     const modelGate = Object.freeze({
         removedByClass: gateDecision.removedByClass,
         unknownClasses: gateDecision.unknownClasses,
@@ -439,6 +436,7 @@ export function prepareConfigDoors(input) {
         fableMitigations,
         modelGate,
         memoryDelegationEvidence,
+        skillListingBudget,
         memoryProvenance,
         memoryCapturePolicy,
         usageWindows,

package/dist/core/runner/prepare-execution-env.d.ts

@@ -14,7 +14,7 @@ export interface OwnedEnvSeat {
 export interface PrepareExecutionEnvInput {
     /** borrowed-readonly — the deployment's env seats: the per-task factory (wins), the static env, the
      *  declared root fence, and the incident sink for the bounded teardown legs. */
-    deps: Pick<RunnerDeps, "executionEnvFactory" | "executionEnv" | "rootPath" | "onError">;
+    deps: Pick<RunnerDeps, "executionEnvFactory" | "executionEnv" | "rootPath" | "onError" | "onNotice">;
     /** borrowed-readonly — the REBOUND spec; only the caller's task id rides into the factory ctx. */
     spec: Pick<TaskSpec, "taskId">;
     /** borrowed-readonly — the trusted spawn-side requests: the explicit cwd (a contract), the isolation

package/dist/core/runner/prepare-execution-env.js

@@ -1,5 +1,6 @@
 import { StubExecutionEnv } from "../stub-env.js";
 import { hasDestroy } from "../remote-env.js";
+import { announceMalformedCapabilities } from "./env-capability-census.js";
 import { settleTeardownLeg } from "./teardown-bounded.js";
 export async function prepareExecutionEnv(input) {
     const { deps, spec, internals, resume, placementRootResolved, sessionId, forgetOnThrow, rollback } = input;
@@ -39,6 +40,7 @@ export async function prepareExecutionEnv(input) {
         });
     }
     const executionEnv = ownedEnv ?? deps.executionEnv ?? new StubExecutionEnv();
+    announceMalformedCapabilities(executionEnv, deps.onNotice);
     if (internals?.requestedCwd !== undefined) {
         const canon = async (p) => {
             const r = await executionEnv.canonicalPath(p);

package/dist/core/runner/prepare-gate-stations.d.ts

@@ -23,6 +23,7 @@
  * gate outcome; nothing here changes a word, a source or an order — the stations are moved, not re-adjudicated.
  */
 import type { AgentHarness, AgentTool } from "../../internal/harness.js";
+import type { ExecutionEnv } from "../../internal/harness-types.js";
 import type { AskClass } from "../ask-class.js";
 import type { AutoModeDecider, AutoModeDenialTracker } from "../auto-mode.js";
 import { type ComplianceCapability } from "../compliance.js";
@@ -147,6 +148,13 @@ export interface PrepareGateStationsInput {
     handsCwdRef: CwdRef | undefined;
     /** borrowed-readonly — the read-only env capability face every hook context carries, or undefined. */
     hookEnvFace: HookEnvCapabilities | undefined;
+    /** borrowed-readonly — the HANDS' execution environment (the one the write tools resolve against), or
+     *  undefined when the run has no hands: the write-protection judge's target view resolves in it, and with
+     *  none the judge answers by the spelling alone. */
+    handsEnv: ExecutionEnv | undefined;
+    /** borrowed-readonly — the resolved task root, the base a `base: "root"` write tool's relative spelling
+     *  resolves against (the same seat the path policies read as `rootPath`). */
+    taskRootFinal: string;
     /** borrowed-readonly — the per-tool irreversibility tier handed to the gate per call. */
     irreversibilityTier: IrreversibilityTier;
     /** borrowed-readonly — the per-tool reversibility probes handed to the gate per call. */

package/dist/core/runner/prepare-gate-stations.js

@@ -42,7 +42,7 @@ export function maybeHumanRejectionHalt(input) {
     };
 }
 export function prepareGateStations(input) {
-    const { askLane, parkAsk, tools, toolRosterDeltas, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, hooks, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, gateOutcomes, batchHaltRef, blockedTracked, hookIdentity, reminderMark, planModeRef, hostTaskId, sessionId, ownGatePreToolUse, hookTimeoutMs, handsCwdRef, hookEnvFace, irreversibilityTier, reversibilityProbes, abortController, shellGatedTools, autoModeDecider, autoModeDenialTracking, stopForDenialLimit, permissionRuleLane, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, notifyOwnHookCrash } = input;
+    const { askLane, parkAsk, tools, toolRosterDeltas, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, hooks, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, gateOutcomes, batchHaltRef, blockedTracked, hookIdentity, reminderMark, planModeRef, hostTaskId, sessionId, ownGatePreToolUse, hookTimeoutMs, handsCwdRef, hookEnvFace, handsEnv, taskRootFinal, irreversibilityTier, reversibilityProbes, abortController, shellGatedTools, autoModeDecider, autoModeDenialTracking, stopForDenialLimit, permissionRuleLane, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, notifyOwnHookCrash } = input;
     if (askLane !== undefined && parkAsk !== undefined) {
         const { adjudicate, resolveAskBound, notifyPermissionDenied, notifyHookError } = askLane;
         const { resolveContentAsk, suspendAsk } = parkAsk;
@@ -51,7 +51,11 @@ export function prepareGateStations(input) {
             if (eff !== undefined && !toolEffects.has(t.name))
                 toolEffects.set(t.name, eff);
         }
-        const writeProtectionCheck = createWriteProtectionCheck(deps.writeProtectedPaths, deps.memoryEngineDir !== undefined ? { dataRoot: deps.memoryEngineDir } : undefined);
+        const writeProtectionCheck = createWriteProtectionCheck(deps.writeProtectedPaths, {
+            ...(deps.memoryEngineDir !== undefined ? { dataRoot: deps.memoryEngineDir } : {}),
+            ...(handsEnv !== undefined ? { env: handsEnv } : {}),
+            rootPath: taskRootFinal,
+        });
         const writeProtectionArmed = writeProtectionCheck !== undefined && tools.some((t) => PATH_CONFINABLE_WRITE_TOOLS.has(t.name));
         toolCallGateArmedRef.armed =
             effectivePolicy !== undefined ||

package/dist/core/runner/prepare-hands-readface.d.ts

@@ -110,6 +110,10 @@ export interface PrepareHandsReadFaceInput {
     /** borrowed-readonly — B-4's settled root (T6 FINAL semantics); the containment root every face
      *  in this phase canonicalizes from. */
     taskRootFinal: string;
+    /** borrowed-readonly — the same root, resolved to the spelling the fence compares with, by the ONE
+     *  resolver at the driver's root receiving point ({@link import("./task-root-canonical.js").resolveTaskRootCanonical}):
+     *  taken as an input, never re-canonicalized here, so the fence and the root notice cannot disagree. */
+    taskRootCanonical: string;
     /** borrowed-readonly — B-4's checkpoint-path rebaser (T7): identity unless a divergent restore
      *  armed it; applied to the readFileState seed keys and the handsCwd seed. */
     rebaseRestoredPath: (p: string) => string;

package/dist/core/runner/prepare-hands-readface.js

@@ -152,7 +152,7 @@ export function resolveHandsLessReadFace(input) {
 }
 export async function prepareHandsMount(input) {
     const envHandToolNames = new Set();
-    const { handsEnabled, executionEnv, taskRootFinal, rebaseRestoredPath, resume, session, sessionId, hostTaskId, taskScope, fullShellReachable, effectiveShellGate, toolFaceSnapshot, model, spec, deps, internals, memoryWriteGate, advertisedWritableDirs, firstPartyOffload, roster, egressTools, irreversibilityTier, irreversibleTools, reversibilityProbes } = input;
+    const { handsEnabled, executionEnv, taskRootCanonical, rebaseRestoredPath, resume, session, sessionId, hostTaskId, taskScope, fullShellReachable, effectiveShellGate, toolFaceSnapshot, model, spec, deps, internals, memoryWriteGate, advertisedWritableDirs, firstPartyOffload, roster, egressTools, irreversibilityTier, irreversibleTools, reversibilityProbes } = input;
     assertStringArraySeat(spec.additionalDirectories, "TaskSpec.additionalDirectories", "strings");
     assertStringArraySeat(spec.additionalReadDirectories, "TaskSpec.additionalReadDirectories", "strings");
     assertStringArraySeat(deps.readDenyPatterns, "RunnerDeps.readDenyPatterns", "compiler-owned");
@@ -176,15 +176,13 @@ export async function prepareHandsMount(input) {
     let attachmentRootCanonical;
     let readDenyMatcher;
     if (handsEnabled) {
-        const rootRaw = taskRootFinal;
-        const canon = await executionEnv.canonicalPath(rootRaw);
-        const rootCanonical = canon.ok ? canon.value : rootRaw;
+        const rootCanonical = taskRootCanonical;
         attachmentRootCanonical = rootCanonical;
         const canonicalizeExtraDirs = async (dirs, field, sink) => {
             for (const dir of dirs ?? []) {
                 if (!dir || !dir.trim())
                     continue;
-                const c = await executionEnv.canonicalPath(dir);
+                const c = await (advertisedWritableDirs?.canonicalizeDeclaredRoot(dir) ?? executionEnv.canonicalPath(dir));
                 if (c.ok) {
                     sink.push(c.value);
                 }

package/dist/core/runner/prepare-listings.d.ts

@@ -17,6 +17,7 @@ import type { AgentTool } from "../../internal/harness.js";
 import type { TaskSpec } from "../types.js";
 import type { AnnounceOnceSink, Prepared, PrepareResume, ToolFaceSnapshot } from "./contracts.js";
 import type { AnnouncedListingSnapshot } from "../../internal/harness.js";
+import type { ResolvedSkillListingBudget } from "../skill-listing-budget.js";
 export interface PrepareListingsInput {
     /** borrowed-readonly — the REBOUND spec (`spec′`). Read: `agents` (the audit's subject), `tools`
      *  (the roster-bearing delegation tool, by its `agentListing` marker), `sessionId` (continuation
@@ -44,6 +45,8 @@ export interface PrepareListingsInput {
     /** borrowed-readonly — the project-context phase's skills-listing projection; read only for the
      *  skills opt-out advisory (entries.length). */
     skillsListing: Prepared["skillsListing"];
+    /** borrowed-readonly — the listing family's resolved budget; the agent roster frames fold into it. */
+    listingBudget: ResolvedSkillListingBudget;
     /** borrowed-mutable — the deferred roster's ToolSearch RIDE seat (declared by the disclosure
      *  mount, read at activation time through `listingRideRef.current?.(newly)`). Written here, once,
      *  on a deferred roster face; no later writer. Identity is the contract (the mount's closures read

package/dist/core/runner/prepare-listings.js

@@ -2,7 +2,7 @@ import { formatLocalDate } from "../../prompts/default.js";
 import { SKILL_TOOL_NAME } from "./synthetic-tools.js";
 import { renderAgentListingDelta } from "./turn-attachments.js";
 export function prepareListings(input) {
-    const { spec, tools, onceLedger, sessionId, toolFaceSnapshot, activeTools, resume, skillsListing, listingRideRef, renderWithDate, envFacts, tzValid, userTz } = input;
+    const { spec, tools, onceLedger, sessionId, toolFaceSnapshot, activeTools, resume, skillsListing, listingBudget, listingRideRef, renderWithDate, envFacts, tzValid, userTz } = input;
     if (spec.agents !== undefined && spec.agents.length > 0) {
         const known = new Set(tools.flatMap((t) => [t.name, ...(t.aliases ?? [])]));
         for (const def of spec.agents) {
@@ -39,6 +39,7 @@ export function prepareListings(input) {
         ? {
             entries: agentListingSpec.agentListing,
             toolName: agentListingSpec.name,
+            budget: listingBudget,
             seedAnnounced: resume !== undefined || spec.sessionId !== undefined,
             ...(agentListingSpec.agentModels !== undefined ? { models: agentListingSpec.agentModels } : {}),
         }
@@ -48,6 +49,7 @@ export function prepareListings(input) {
                     {
                         entries: [],
                         toolName: (spec.tools ?? []).find((t) => t.agentListing !== undefined)?.name ?? "Agent",
+                        budget: listingBudget,
                         seedAnnounced: true,
                     }
                 : undefined;
@@ -66,7 +68,7 @@ export function prepareListings(input) {
                 return undefined;
             if ((announcedListingsRef.agents?.length ?? 0) > 0)
                 return undefined;
-            return renderAgentListingDelta({ announcedAgentTypes: undefined }, rideEntries, rosterBearingSpec.name, rideModels);
+            return renderAgentListingDelta({ announcedAgentTypes: undefined }, rideEntries, rosterBearingSpec.name, rideModels, listingBudget);
         };
     }
     const dateChange = renderWithDate

package/dist/core/runner/prepare-memory.js

@@ -4,7 +4,7 @@ import { admitMemoryScopes } from "../memory-admission.js";
 import { adoptLegacyRepoDirs, canonicalize, deriveRepoControlPlaneDir, deriveProjectControlDir, deriveProjectMemoryDir, deriveRepoMemoryDir, drainMemoryAnnouncements, enqueueMemoryAnnouncement, isContainedIn, lookupProjectIdHint, recordProjectIdHint, resolveMemoryEngineRoot } from "../memory-engine/layout.js";
 import { classifyScopePlanes, derivePersonalControlDir, derivePersonalMemoryDir, mergeHarvestReports, mergeInjections, needsDualRoots, parsedProjectPlane } from "../memory-engine/dual-root.js";
 import { normalizeMemorySpec } from "../memory.js";
-import { MEMORY_ANNOUNCEMENT_CAPTURE_OPTOUT_CODA, MEMORY_ANNOUNCEMENT_READONLY_CODA, MEMORY_CAPTURE_INDETERMINATE_NOTICE, MEMORY_CAPTURE_OPTOUT_NOTICE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, MemoryEngine, entryFileHeadCarriesOrigin, memoryCaptureOptedOutNotice, memoryCaptureOptOutUnpersistedNotice, memoryConsolidationRecommendedNotice, memoryHarvestQuarantinedNotice, memoryHoldNotices, memoryRecallDisciplineSegment, memorySessionPollutedNotice, pollutionContainmentCounts, } from "../memory-engine/engine.js";
+import { MEMORY_ANNOUNCEMENT_CAPTURE_OPTOUT_CODA, MEMORY_ANNOUNCEMENT_READONLY_CODA, MEMORY_CAPTURE_INDETERMINATE_NOTICE, MEMORY_CAPTURE_OPTOUT_NOTICE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, MemoryEngine, entryFileHeadCarriesOrigin, memoryCaptureOptedOutNotice, memoryCaptureOptOutUnpersistedNotice, memoryConsolidationRecommendedNotice, memoryHarvestQuarantinedNotice, memoryHoldNotices, memoryRecallDisciplineSegment, memoryRestoreWithheldNotice, memorySessionPollutedNotice, pollutionContainmentCounts, } from "../memory-engine/engine.js";
 import { adjudicateCaptureOptOut, captureOptOutDeniedError, captureOptOutUnpersistedError } from "./memory-capture-optout.js";
 import { readSessionCaptureOptOut } from "../memory-engine/layout.js";
 import { createMemoryEngineTools } from "../memory-engine/tools.js";
@@ -522,6 +522,9 @@ export async function prepareMemory(input) {
                     }
                     deliverEngineNotice(deps.onNotice, memoryHarvestQuarantinedNotice({ count, moved, escalated, ...(report.reportId !== undefined ? { reportId: report.reportId } : {}), ...(reason !== undefined ? { reason } : {}), sessionId, provenance: input.memoryProvenance, ...(indexOnly ? { indexRolledBack: true } : {}) }));
                 }
+                if (report.restoreWithheld !== undefined && report.restoreWithheld.length > 0) {
+                    deliverEngineNotice(deps.onNotice, memoryRestoreWithheldNotice({ paths: report.restoreWithheld, sessionId }));
+                }
                 for (const notice of memoryHoldNotices(report, sessionId))
                     deliverEngineNotice(deps.onNotice, notice);
                 const consolidationNotice = memoryConsolidationRecommendedNotice(report, sessionId);
@@ -615,6 +618,9 @@ export async function prepareMemory(input) {
                             }
                         }
                         const sweep = await writeEngine.sweepSessionCaptureResidue(writeHandle);
+                        if (sweep.withheld.length > 0) {
+                            deliverEngineNotice(deps.onNotice, memoryRestoreWithheldNotice({ paths: sweep.withheld, sessionId }));
+                        }
                         if (sweep.failures.length > 0) {
                             const named = sweep.failures
                                 .slice(0, 5)

package/dist/core/runner/prepare-policy-chain.js

@@ -303,9 +303,9 @@ export async function preparePolicyChain(input) {
             }
             if (re.updatedInput !== undefined)
                 editArgs = re.updatedInput;
-            const judged = await judgeInheritedClassifier({ autoMode: ancestorDecider !== undefined ? { decider: ancestorDecider, denialTracking: ancestorTracker } : undefined, ask: re, req: { ...creq, args: editArgs }, signal: csignal ?? abortController.signal, subject: "the approved edit" });
+            const judged = await judgeInheritedClassifier({ autoMode: ancestorDecider !== undefined ? { decider: ancestorDecider, denialTracking: ancestorTracker } : undefined, ask: re, req: { ...creq, args: editArgs }, signal: csignal ?? abortController.signal, subject: "the approved edit", allowRewrite: editArgs });
             if (judged.kind === "allow")
-                return { action: "allow", updatedInput: editArgs };
+                return judged.result;
             if (judged.kind === "deny")
                 return judged.result;
             const { ask: editAsk, fallback: editFallback, mintedHere: editMintedHere } = judged;
@@ -371,7 +371,7 @@ export async function preparePolicyChain(input) {
                     }
                     const judged = await judgeInheritedClassifier({ autoMode: pc.autoMode, ask: first, req: creq, signal: csignal ?? abortController.signal, subject: "this call" });
                     if (judged.kind === "allow")
-                        return { action: "allow" };
+                        return judged.result;
                     if (judged.kind === "deny")
                         return judged.result;
                     const { ask: inheritedAsk, fallback, mintedHere } = judged;
@@ -439,9 +439,9 @@ export async function preparePolicyChain(input) {
                         return mandateUnreconstructibleDeny(creq);
                     }
                     const presentedArgs = decision.updatedInput !== undefined ? decision.updatedInput : creq.args;
-                    const judged = await judgeInheritedClassifier({ autoMode: pc.autoMode, ask: decision, req: { ...creq, args: presentedArgs }, signal: csignal ?? abortController.signal, subject: "this call" });
+                    const judged = await judgeInheritedClassifier({ autoMode: pc.autoMode, ask: decision, req: { ...creq, args: presentedArgs }, signal: csignal ?? abortController.signal, subject: "this call", allowRewrite: decision.updatedInput });
                     if (judged.kind === "allow")
-                        return decision.updatedInput !== undefined ? { action: "allow", updatedInput: decision.updatedInput } : { action: "allow" };
+                        return judged.result;
                     if (judged.kind === "deny")
                         return judged.result;
                     const { ask: inheritedAsk, fallback, mintedHere } = judged;

package/dist/core/runner/prepare-project-context.d.ts

@@ -1,3 +1,4 @@
+import type { ResolvedSkillListingBudget } from "../skill-listing-budget.js";
 import { type StoredSession } from "../session.js";
 import type { RunnerDeps, TaskSpec, ToolSpec } from "../types.js";
 import type { ActiveSkillScope } from "./active-skill-scope.js";
@@ -8,7 +9,7 @@ export interface PrepareProjectContextInput {
     /** borrowed-readonly — the deployment seams this phase reads: `loadProjectMemory` (the snapshot),
      *  `onError` (the operator lane for a throwing seam / seeding / oversize skill), `sharedMemoryStores`
      *  (the shared-memory pair's switch: wired ⇒ mount). Receiver preserved (`deps.onError?.(…)`). */
-    deps: Pick<RunnerDeps, "loadProjectMemory" | "onError" | "sharedMemoryStores">;
+    deps: Pick<RunnerDeps, "loadProjectMemory" | "onError" | "sharedMemoryStores" | "onNotice">;
     /** borrowed-readonly — the REBOUND spec (`spec′`). Read: `sessionId` (phase derivation + the
      *  continuation projections), `skills` (the roster), `principal` (the shared-memory tools' trusted
      *  identity). Never mutated. */
@@ -69,6 +70,9 @@ export interface PrepareProjectContextInput {
     /** borrowed-readonly — the durable-resume carrier; read for `!== undefined` (seedAnnounced) and
      *  `seed.announcedListings.skills` (the removal-to-zero projection's gate). */
     resume: Pick<PrepareResume, "seed"> | undefined;
+    /** borrowed-readonly — the lowered listing-budget seats from the config door. The listing projection
+     *  carries it to the boundary renderer, and the over-budget disclosure below is priced against it. */
+    skillListingBudget: ResolvedSkillListingBudget;
 }
 export interface PrepareProjectContextResult {
     /** owned — the memory block with the project layer appended at the tail (unchanged when the seam is

package/dist/core/runner/prepare-project-context.js

@@ -9,7 +9,7 @@ import { SKILL_CONTENT_MAX_CHARS, SKILL_TOOL_NAME, createSkillTool, normalizeSki
 import { substitutedSkillLength } from "./skill-base-dir.js";
 import { RosterBuilder } from "../tool-roster.js";
 export async function prepareProjectContext(input) {
-    const { deps, spec, internals, session, sessionId, hostTaskId, taskRootFinal, handsEnabled, delegation, seedContextFiles, memoryBlockFromEngine, skillScope, roster, toolFaceSnapshot, onceLedger, memoryTools, memoryEngineSession, memorySearchToolsPlanned, memoryPairExcludedName, memoryPairOccupiedName, resume } = input;
+    const { deps, spec, internals, session, sessionId, hostTaskId, taskRootFinal, handsEnabled, delegation, seedContextFiles, memoryBlockFromEngine, skillScope, roster, toolFaceSnapshot, onceLedger, memoryTools, memoryEngineSession, memorySearchToolsPlanned, memoryPairExcludedName, memoryPairOccupiedName, resume, skillListingBudget } = input;
     const tools = roster.tools;
     let memoryBlock = memoryBlockFromEngine;
     let instructionSources;
@@ -142,11 +142,12 @@ export async function prepareProjectContext(input) {
                 ...(declaredSkillRank.get(s.name) !== undefined ? { declaredRank: declaredSkillRank.get(s.name) } : {}),
             })),
             seedAnnounced: resume !== undefined || spec.sessionId !== undefined,
+            budget: skillListingBudget,
         }
         :
             (resume?.seed.announcedListings?.skills?.length ?? 0) > 0 || spec.sessionId !== undefined
                 ?
-                    { entries: [], seedAnnounced: true }
+                    { entries: [], seedAnnounced: true, budget: skillListingBudget }
                 : undefined;
     return { memoryBlock, instructionSources, projectInstructionContent, skillSpecs, hasSkillManifest, skillsListing, sharedMemoryPairMounted, memoryEnginePairMounted };
 }

package/dist/core/runner/prepare-prompt-inputs.d.ts

@@ -117,8 +117,8 @@ export interface PreparePromptInputsResult {
     tzValid: boolean;
     /** owned — the client's declared zone as given (paired with `tzValid`; unvalidated on its own). */
     userTz: string | undefined;
-    /** owned — the git-status lane's run-local state (empty on a hands-less leg); the run loop and the
-     *  checkpoint serializer mutate its fields from here on (`announced`, `pendingReceipt`, …). */
+    /** owned — the git-status lane's run-local state (empty on a hands-less leg); the run loop and the checkpoint
+     *  serializer mutate its fields from here on (`announced`, `mirrorOwed`, …; the frame's receipt rides the leg's shared `Prepared.frameReceipts`). */
     gitStatusRef: GitStatusLaneRef;
 }
 /** The M10 phase body — prepareTask's prompt-inputs stretch, verbatim (see the module header). */

package/dist/core/runner/prepare-run-refs.d.ts

@@ -28,8 +28,10 @@ export interface PrepareRunRefsInput {
      *  worktree helper). Never mutated. */
     spec: Pick<TaskSpec, "forwardSubagentEvents" | "retainSubagentSessions" | "handsReadOnly">;
     /** borrowed-readonly — the trusted spawn-side channel; only `onForwardEvent` (the deployment's display
-     *  sink) is read, once, to decide whether a forwarding wrapper exists at all. */
-    internals: Pick<RunInternals, "onForwardEvent"> | undefined;
+     *  sink) is read, to decide whether a forwarding wrapper exists at all, and `forwardScope` (the run's
+     *  forwarding containment, read by the door). The OBJECT is what the wrapper hands the door rather than
+     *  the pulled-out function: the sink keeps its receiver and the run keeps one failure count. */
+    internals: Pick<RunInternals, "onForwardEvent" | "forwardScope"> | undefined;
     /** borrowed-readonly — the run's resolved env; the worktree helper closes over it (lazy: no I/O until a
      *  delegation actually mints a worktree). */
     executionEnv: ExecutionEnv;

package/dist/core/runner/prepare-run-refs.js

@@ -1,6 +1,7 @@
 import { createSubagentWorktreeHelper } from "../../agents/subagent.js";
 import { SubagentRetainLedger } from "../../agents/retain-ledger.js";
 import { ActiveSkillScope } from "./active-skill-scope.js";
+import { forwardSafely } from "./forward-sink.js";
 import { createEditedFilesLedger } from "./edited-files-ledger.js";
 export function forwardsSubagentEvents(spec) {
     return spec.forwardSubagentEvents === true;
@@ -14,14 +15,14 @@ export function prepareRunRefs(input) {
     const harnessRef = {};
     const toolProgressRef = {};
     const skillScope = new ActiveSkillScope();
-    const forwardSink = internals?.onForwardEvent;
-    const forwardEvent = forwardSink
+    const sinkWired = internals?.onForwardEvent !== undefined;
+    const forwardEvent = sinkWired
         ? (e) => {
             if (e.type === "task_progress")
-                forwardSink(e);
+                forwardSafely(internals, e);
             else if (spec.forwardSubagentEvents === true &&
                 (e.type === "text_delta" || e.type === "text_end" || e.type === "reasoning_delta" || e.type === "tool_start" || e.type === "tool_progress" || e.type === "tool_end")) {
-                forwardSink(e);
+                forwardSafely(internals, e);
             }
         }
         : undefined;