@sema-agent/core 7.2.0 → 7.3.1

package/dist/core/permission-rule-model.js

@@ -171,6 +171,9 @@ export function escapeForDisclosure(value) {
     return escaped.length <= DISCLOSED_RULE_TEXT_MAX_CHARS ? escaped : `${escaped.slice(0, DISCLOSED_RULE_TEXT_MAX_CHARS)}…`;
 }
 const DISPLAY_STRIP_FORMAT_RE = /\p{Cf}/gu;
+export function stripFormatCharacters(text) {
+    return text.replace(DISPLAY_STRIP_FORMAT_RE, "");
+}
 export function renderUntrustedCommandText(text, maxLen = DISCLOSED_RULE_TEXT_MAX_CHARS) {
     let raw;
     try {
@@ -179,7 +182,7 @@ export function renderUntrustedCommandText(text, maxLen = DISCLOSED_RULE_TEXT_MA
     catch {
         return "<unprintable>";
     }
-    return inlineUntrusted(raw.replace(DISPLAY_STRIP_FORMAT_RE, ""), maxLen);
+    return inlineUntrusted(stripFormatCharacters(raw), maxLen);
 }
 export function hasUnrenderableCharacters(text) {
     return CONTROL_CHARS_RE.test(text);

package/dist/core/runner/prepare-task.d.ts

@@ -41,6 +41,13 @@ export declare function __resetMaterializeEnvAnnouncements(): void;
  *  seam below (console latch only): tests here legitimately reuse ONE sink across prepares to pin
  *  the per-sink dedup itself, so the seam must be able to re-arm a still-referenced sink. */
 export declare function __resetToolModelGateAnnouncements(): void;
+/**
+ * The model gate's per-session READ face ({@link WiringManifest.modelGate}) — projected from the SAME
+ * gate decision {@link announceToolModelGate} reads (one source; the notice is the operator-sink
+ * dialect, this the manifest dialect). `undefined` when no default-mounted tool was trimmed on this
+ * run. The restore sentence is the notice's, verbatim.
+ */
+export declare const TOOL_MODEL_GATE_RESTORE_SENTENCE = "restore via TaskSpec.restoreGatedTools, SEMA_TOOL_MODEL_GATE=off, or RunnerDeps.toolModelGate: false";
 export { __resetReadFaceClampAnnouncement } from "./prepare-hands-readface.js";
 /**
  * design/164 件四 — how long before an execution environment's declared `lifetimeMs` expires the engine
@@ -1177,6 +1184,19 @@ export interface InheritedGate {
     }>;
     /** The chain's effective shell-gate doctrine — the child folds it by max-rank with its own spec. */
     shellGate?: "off" | "always" | "classify";
+    /**
+     * The chain's AUTO-MODE INTENT (`TaskSpec.autoModeRequested`, session-wide like a permission mode):
+     * emitted when the spawning task carried the intent itself or inherited it, so an engine-spawned
+     * child of an auto-mode task arms its OWN per-run classifier exactly as its parent did — the
+     * intent half only; the child's deny bit (`RuntimeCaps.autoMode === false`) and deployment face
+     * (`RunnerDeps.autoMode`) are evaluated for the child. Trusted chain data (Runner-assembled, never a
+     * model-authored argument); absent ⇒ the child is an auto-mode task only if its own spec says so.
+     * Persists on the checkpoint's data half (`CheckpointState.inheritedGate.autoModeRequested`) so a
+     * redemption in another process — no seat re-passed, no waking chain — reads the same intent the
+     * suspend leg had; the intent folds by OR across seat, live chain and seed, while the deny bit and
+     * the deployment face stay per-leg.
+     */
+    autoModeRequested?: true;
     /**
      * Org-memory admission freeze (ruled 2026-08-05): the spawning chain's FROZEN admitted org-scope
      * set — every org memory scope the parent actually mounted (deployment-origin + admitted request).

package/dist/core/runner/prepare-task.js

@@ -83,6 +83,8 @@ import { hasBackgroundShell, sweepBackgroundShells } from "../background-shell.j
 import { createTaskOutputTool, createTaskStopTool, defaultTaskRegistry } from "../task-registry.js";
 import { createMonitorTool } from "../../tools/monitor.js";
 import { createWorktreeTools } from "../../tools/worktree.js";
+import { announcePeerLaneMount, bindPeerLaneDrain, listAgentsMountable, mountListAgents, peerLaneSendMessageSeats } from "../../agents/peer-session-drain.js";
+import { CROSS_SESSION_CLASSIFIER_RULE } from "../../agents/cross-session-envelope.js";
 import { applyCompactionToReadFileState, isReadDedupStubResult, FULL_SHELL_CONTRACT_ID, HAND_TOOL_EFFECTS } from "../../tools/fs/index.js";
 import { decodeTextBytes } from "../../tools/fs/encoding.js";
 import { ASK_USER_QUESTION_TOOL_NAME, createAskUserQuestionTool, classifyQuestionOutcome, isLiveQuestionFace, validateAskQuestions, } from "../ask-question.js";
@@ -198,6 +200,20 @@ function announceToolModelGate(onNotice, modelId, gate) {
         }
     }
 }
+export const TOOL_MODEL_GATE_RESTORE_SENTENCE = "restore via TaskSpec.restoreGatedTools, SEMA_TOOL_MODEL_GATE=off, or RunnerDeps.toolModelGate: false";
+function toolModelGateManifest(gate) {
+    let firstClass;
+    const removed = [];
+    for (const [gateClass, names] of gate.removedByClass) {
+        if (names.length === 0)
+            continue;
+        firstClass ??= gateClass;
+        for (const n of names)
+            if (!removed.includes(n))
+                removed.push(n);
+    }
+    return firstClass === undefined ? undefined : { class: firstClass, removed, restore: TOOL_MODEL_GATE_RESTORE_SENTENCE };
+}
 function announceDeclaredMcpContentClasses(args) {
     for (const entry of args.entries ?? []) {
         const declaredClass = entry.contentOrigin;
@@ -1161,14 +1177,113 @@ function refuseRequireExistingWithoutSession(spec) {
         throw e;
     }
 }
+function screenAutoModeCap(caps, onError, sessionId) {
+    if (caps === undefined)
+        return { caps, faulted: false };
+    if (typeof caps !== "object" || caps === null || Array.isArray(caps)) {
+        onError?.(new Error(`runtimeCapsResolver returned a non-record value (${JSON.stringify(caps)}) — read as a resolver fault: every per-principal capability is DENIED for this run (auto mode is not armed; asks flow the original chain). Return a RuntimeCaps object or undefined.`), { phase: "config", sessionId });
+        return { caps: { allowWorkflows: false, allowFork: false, autoMode: false }, faulted: true };
+    }
+    const record = caps;
+    if (record.autoMode === undefined || typeof record.autoMode === "boolean")
+        return { caps: record, faulted: false };
+    onError?.(new Error(`runtimeCapsResolver returned a non-boolean autoMode (${JSON.stringify(record.autoMode)}) — read as a resolver fault: auto mode is DENIED for this run (the classifier is not armed; asks flow the original chain). Return true, false, or omit the key.`), { phase: "config", sessionId });
+    return { caps: { ...record, autoMode: false }, faulted: true };
+}
+function mintPersistedArming(am, laneRule, classifierSystemPrompt, onError, sessionId) {
+    const arming = autoModeArmingRecipeOf(laneRule ? { ...am, crossSessionMessagesRule: true } : am, {
+        promptDigest: `apv1:${createHash("sha256").update(classifierSystemPrompt).digest("hex")}`,
+    });
+    if (arming === undefined) {
+        onError?.(new Error("RunnerDeps.autoMode.persistArming is set but the auto-mode face did not canonicalize into an arming recipe " +
+            "(a rule list carrying a non-string, or a non-finite/out-of-range timeoutMs / failureThreshold / window bound) — " +
+            "NO arming recipe is recorded on this run's parked constraint chain, and a cross-process redemption keeps the " +
+            "conservative behavior (the ancestor classifier answers unavailable and the inherited ask flows to a human)"), { phase: "config", sessionId });
+    }
+    return arming;
+}
+function autoModeLatchHealthy(d) {
+    try {
+        return d.breakerOpen() !== true && typeof d.consecutiveFailures === "function" && d.consecutiveFailures() === 0;
+    }
+    catch {
+        return false;
+    }
+}
+function autoModeArmReasonOf(intent, facePresent, capsAutoMode, capsFaulted) {
+    if (!intent)
+        return "no_intent";
+    if (!facePresent)
+        return "no_face";
+    if (capsAutoMode === false)
+        return capsFaulted ? "resolver_fault" : "denied";
+    return "armed";
+}
+function validateInputFaultNotice(onError, sessionId) {
+    return ({ toolName, toolCallId, error }) => onError?.(new Error(`tool input pre-validation (validateInput) threw for ${toolName} (call ${toolCallId}) — read as no verdict; the call proceeded to the gate: ${error instanceof Error ? error.message : String(error)}`), { phase: "hook", sessionId });
+}
+function refuseInvalidAutoModeSeat(spec) {
+    if (spec.autoModeRequested !== undefined && spec.autoModeRequested !== true) {
+        const e = new Error(`autoModeRequested must be the literal true when present (got ${JSON.stringify(spec.autoModeRequested)}) — omit it for a non-auto task; a non-boolean or false value is refused rather than read as either polarity.`);
+        e.code = "config.auto_mode_requested_invalid";
+        throw e;
+    }
+    return spec.autoModeRequested === true;
+}
+function announceDurableGateUnavailable(args) {
+    if (!args.forceDurableGate || args.storeWired)
+        return;
+    const cause = args.taskStoreNull ? "task_store_null" : "no_deployment_store";
+    const inheritedContentMandate = (args.parentConstraints ?? []).some((pc) => pc.contentMandate === true);
+    const liveQuestionFace = args.liveQuestionFace && !inheritedContentMandate;
+    deliverEngineNotice(args.onNotice, {
+        code: "config.durable_gate_unavailable",
+        message: `Durable approval gate mandated but unavailable: the runtime entitlement forceDurableGate is in force for this ` +
+            `principal, but ${cause === "task_store_null" ? "this task disabled the checkpoint store (checkpointStore: null)" : "this deployment wired no checkpoint store"}, ` +
+            `so no interactive ask of this task can be parked for a durable answer. Asks resolve on the live chain instead ` +
+            `(${args.liveApprover ? "a live approver answers permission asks in-stream" : "permission asks are denied fail-closed — no live approver is wired"}; ` +
+            `${liveQuestionFace ? "a live question face answers AskUserQuestion in-stream" : args.liveQuestionFace ? "AskUserQuestion is withheld from the live face by an inherited durable mandate and refused" : "AskUserQuestion has no live face and is refused"}) ` +
+            `and NO durable approval record is written. ${cause === "task_store_null" ? "Run this task with its store, or withdraw the entitlement for principals whose runs are machine-started." : "Wire a checkpoint store on this deployment, or withdraw the entitlement for principals served here."}`,
+        detail: {
+            sessionId: args.sessionId,
+            runId: args.runId,
+            ...(args.principal ? { principal: args.principal } : {}),
+            cause,
+            liveApprover: args.liveApprover,
+            liveQuestionFace,
+        },
+    });
+}
+function buildTier3ReviveSpawn(delegationForRevive, enrichSpecToolCtx) {
+    if (delegationForRevive === undefined)
+        return undefined;
+    return async (req) => {
+        const out = await delegationForRevive.execute({
+            description: req.row.description ?? "revived teammate",
+            prompt: req.prompt,
+            run_in_background: true,
+            ...(req.row.agentType !== undefined ? { subagent_type: req.row.agentType } : {}),
+            ...(req.row.name !== undefined ? { name: req.row.name } : {}),
+            ...(req.row.model !== undefined ? { model: req.row.model } : {}),
+        }, enrichSpecToolCtx({ toolCallId: `rv-${randomBytes(8).toString("hex")}`, reviveClaim: { row: req.row, rev: req.rev, ...(req.peerSeed !== undefined ? { peerSeed: req.peerSeed } : {}) } }));
+        const o = (typeof out === "string" ? { content: out } : out);
+        return {
+            content: typeof o.content === "string" ? o.content : JSON.stringify(o.content),
+            ...(o.isError === true ? { isError: true } : {}),
+            ...(o.details !== undefined ? { details: o.details } : {}),
+        };
+    };
+}
 export async function prepareTask(spec, deps, sessions, resume, internals, runnerSelf, runIdSink) {
     const runId = uuidv7();
     if (runIdSink !== undefined)
         runIdSink.runId = runId;
     const doors = prepareConfigDoors({ spec, deps, sessions, resume, internals });
     spec = doors.spec;
+    const autoModeSeat = refuseInvalidAutoModeSeat(spec);
     const { toolFaceSnapshot, promptProfile, lockedPreflight, resolvedInteractionPosture, microCompactKnob, resolvedRole, model, thinking, compModel, fableMitigations, memoryDelegationEvidence, memoryProvenance, memoryCapturePolicy, usageWindows, brainCallGuardrailRef, brainCallGuardrailMs } = doors;
     announceToolModelGate(deps.onNotice, model.id, doors.modelGate);
+    const modelGateManifest = toolModelGateManifest(doors.modelGate);
     const { toolEffects, egressTools, irreversibleTools, irreversibilityTier, axisExplicitNegatives, reversibilityProbes, ownToolNames } = prepareSafetyScan({ spec, deps });
     let shellGatedBash = false;
     let shellGatedMonitor = false;
@@ -1188,6 +1303,9 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
     const taskScope = internals?.registryScope ?? spec.principal ?? "default";
     internals?.peerSelfRef?.addAxis("s", sessionId);
     internals?.peerSelfRef?.addAxis("t", hostTaskId);
+    const peerLaneActive = announcePeerLaneMount(deps, { sessionId, runId });
+    const peerLaneRefs = {};
+    const peerSendMessageBuiltIn = runnerSelf !== undefined && !(toolFaceSnapshot.exclude ?? []).includes(SEND_MESSAGE_TOOL_NAME) && !(spec.tools ?? []).some((t) => t.name === SEND_MESSAGE_TOOL_NAME);
     const { reminderMark, reminderDisclosureCounts } = await adoptReminderMark(session, sessionId, resume?.seed.reminderMark, internals?.reminderMark, deps.onError);
     const offloadScope = spec.principal ?? "default";
     if (internals?.registryScope !== undefined && internals.registryScope !== offloadScope) {
@@ -1575,6 +1693,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     ? liveShellGate
                     : seedShellGate;
         const inheritedParentConstraints = liveInheritedGate?.parentConstraints;
+        const autoModeIntent = autoModeSeat || liveInheritedGate?.autoModeRequested === true || seedInheritedGate?.autoModeRequested === true;
         const liveAdmittedOrg = liveInheritedGate?.admittedOrgScopes;
         const seedAdmittedOrg = seedInheritedGate?.admittedOrgScopes;
         const inheritedAdmittedOrgScopes = liveAdmittedOrg === undefined ? seedAdmittedOrg : seedAdmittedOrg === undefined ? liveAdmittedOrg : liveAdmittedOrg.filter((s) => seedAdmittedOrg.includes(s));
@@ -1687,6 +1806,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             return {
                 ...(ancestorRules.length > 0 ? { ancestorRules } : {}),
                 ...(effectiveShellGate !== "off" ? { shellGate: effectiveShellGate } : {}),
+                ...(autoModeIntent ? { autoModeRequested: true } : {}),
                 ...(parentConstraints.length > 0 ? { parentConstraints } : {}),
                 admittedOrgScopes: memoryAdmittedOrgScopesRef.current,
                 ...(orgGovernedProvenance ? { orgAdmissionGoverned: true } : {}),
@@ -1827,9 +1947,12 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             }
             catch (err) {
                 deps.onError?.(err instanceof Error ? err : new Error(String(err)), { phase: "config", sessionId });
-                runtimeCaps = { allowWorkflows: false, allowFork: false };
+                runtimeCaps = { allowWorkflows: false, allowFork: false, autoMode: false };
                 runtimeCapsFaulted = true;
             }
+            const screened = screenAutoModeCap(runtimeCaps, deps.onError, sessionId);
+            runtimeCaps = screened.caps;
+            runtimeCapsFaulted ||= screened.faulted;
         }
         let complianceDenies = new Set();
         let complianceDegraded = false;
@@ -1866,7 +1989,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         }
         agentForkDenial = forkGovernanceDenial(spec.enableFork, runtimeCaps?.allowFork);
         observersActive = runtimeCaps?.allowObservers === true;
-        if (runtimeCaps?.autoMode === true && deps.autoMode !== undefined) {
+        const autoModeArmReason = autoModeArmReasonOf(autoModeIntent, deps.autoMode !== undefined, runtimeCaps?.autoMode, runtimeCapsFaulted);
+        if (autoModeIntent && deps.autoMode !== undefined && runtimeCaps?.autoMode !== false) {
             const am = deps.autoMode;
             let classifierModel;
             try {
@@ -1878,7 +2002,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             if (await derivedRouteFallsBack({ seat: "auto-mode-classifier", derived: classifierModel, primary: model, brain: deps.brain, getApiKeyAndHeaders: spec.getApiKeyAndHeaders, onNotice: deps.onNotice, sessionId, runId })) {
                 classifierModel = model;
             }
-            const classifierSystemPrompt = buildAutoModePrompt(am);
+            const classifierLaneRule = peerLaneActive && peerSendMessageBuiltIn;
+            const classifierSystemPrompt = buildAutoModePrompt(classifierLaneRule ? { ...am, crossSessionMessagesRule: CROSS_SESSION_CLASSIFIER_RULE } : am);
             const classifierRuntime = brainToRuntime(deps.brain);
             autoModeDecider = createAutoModeDecider({
                 ...(am.timeoutMs !== undefined ? { timeoutMs: am.timeoutMs } : {}),
@@ -1901,17 +2026,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         .join("");
                 },
             });
-            if (am.persistArming === true) {
-                autoModeArming = autoModeArmingRecipeOf(am, {
-                    promptDigest: `apv1:${createHash("sha256").update(classifierSystemPrompt).digest("hex")}`,
-                });
-                if (autoModeArming === undefined) {
-                    deps.onError?.(new Error("RunnerDeps.autoMode.persistArming is set but the auto-mode face did not canonicalize into an arming recipe " +
-                        "(a rule list carrying a non-string, or a non-finite/out-of-range timeoutMs / failureThreshold / window bound) — " +
-                        "NO arming recipe is recorded on this run's parked constraint chain, and a cross-process redemption keeps the " +
-                        "conservative behavior (the ancestor classifier answers unavailable and the inherited ask flows to a human)"), { phase: "config", sessionId });
-                }
-            }
+            if (am.persistArming === true)
+                autoModeArming = mintPersistedArming(am, classifierLaneRule, classifierSystemPrompt, deps.onError, sessionId);
         }
         const deploymentWorkflowReady = runnerSelf !== undefined && isSelfOrchestrationActive(spec, deps);
         const selfOrchestrationActive = deploymentWorkflowReady && runtimeCaps?.allowWorkflows !== false;
@@ -2207,7 +2323,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         shellGatedBash = handsReadFace.shellGatedBash;
         shellGatedMonitor = handsReadFace.shellGatedMonitor;
         const delegationSurfaceActive = backgroundTaskToolsActive || workflowToolsActive;
-        if (delegationSurfaceActive || internals?.parentNotify !== undefined) {
+        if (delegationSurfaceActive || internals?.parentNotify !== undefined || peerLaneActive) {
             if (delegationSurfaceActive) {
                 toolEffects.set("TaskOutput", "read");
                 toolEffects.set("TaskStop", "write");
@@ -2217,24 +2333,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 toolEffects.set(SEND_MESSAGE_TOOL_NAME, "write");
                 axisExplicitNegatives.set(SEND_MESSAGE_TOOL_NAME, { ...axisExplicitNegatives.get(SEND_MESSAGE_TOOL_NAME), egress: false });
                 const delegationForRevive = (spec.tools ?? []).find((t) => t.agentListing !== undefined);
-                const reviveSpawn = delegationForRevive !== undefined && deps.backgroundAgentStore !== undefined && deps.mailboxStore !== undefined
-                    ? async (req) => {
-                        const out = await delegationForRevive.execute({
-                            description: req.row.description ?? "revived teammate",
-                            prompt: req.prompt,
-                            run_in_background: true,
-                            ...(req.row.agentType !== undefined ? { subagent_type: req.row.agentType } : {}),
-                            ...(req.row.name !== undefined ? { name: req.row.name } : {}),
-                            ...(req.row.model !== undefined ? { model: req.row.model } : {}),
-                        }, enrichSpecToolCtx({ toolCallId: `rv-${randomBytes(8).toString("hex")}`, reviveClaim: { row: req.row, rev: req.rev, ...(req.peerSeed !== undefined ? { peerSeed: req.peerSeed } : {}) } }));
-                        const o = (typeof out === "string" ? { content: out } : out);
-                        return {
-                            content: typeof o.content === "string" ? o.content : JSON.stringify(o.content),
-                            ...(o.isError === true ? { isError: true } : {}),
-                            ...(o.details !== undefined ? { details: o.details } : {}),
-                        };
-                    }
-                    : undefined;
+                const reviveSpawn = deps.backgroundAgentStore !== undefined && deps.mailboxStore !== undefined ? buildTier3ReviveSpawn(delegationForRevive, enrichSpecToolCtx) : undefined;
                 tools.push(firstPartyOffload(createSendMessageTool({
                     runner: runnerSelf,
                     registry: defaultTaskRegistry,
@@ -2260,6 +2359,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     ...(deps.backgroundAgentStore !== undefined ? { agentStore: deps.backgroundAgentStore } : {}),
                     ...(deps.mailboxStore !== undefined ? { mailbox: deps.mailboxStore } : {}),
                     ...(reviveSpawn !== undefined ? { reviveSpawn } : {}),
+                    ...(peerLaneActive ? peerLaneSendMessageSeats({ peerDirectory: deps.peerDirectory, sessionId, scope: taskScope, ...(internals?.explicitAgentName !== undefined ? { name: internals.explicitAgentName } : {}), refs: peerLaneRefs, listingMounted: listAgentsMountable({ exclude: toolFaceSnapshot.exclude, specTools: spec.tools ?? [] }) }) : {}),
                     onNotifyError: (f) => emitTrace(deps.tracer, () => ({ kind: "observer.notify_failed", version: 1, taskId: hostTaskId, site: f.site, message: f.error.message, ts: Date.now() })),
                     onTranscriptIntegrityGap: (handle, scope) => deliverEngineNotice(deps.onNotice, {
                         code: "delegation.transcript_integrity",
@@ -2285,6 +2385,9 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 }
             }
         }
+        const listAgents = peerLaneActive && peerSendMessageBuiltIn && listAgentsMountable({ exclude: toolFaceSnapshot.exclude, specTools: spec.tools ?? [] }) ? mountListAgents({ peerDirectory: deps.peerDirectory, sessionId, scope: taskScope, hostTaskId, ...(internals?.parentTaskId !== undefined ? { parentTaskId: internals.parentTaskId } : {}), ...(internals?.parentSessionId !== undefined ? { parentSessionId: internals.parentSessionId } : {}), registry: defaultTaskRegistry, ...(deps.rosterStore !== undefined ? { roster: deps.rosterStore } : {}), specTools: spec.tools ?? [], toolEffects }) : undefined;
+        if (listAgents !== undefined)
+            tools.push(firstPartyOffload(listAgents));
         if (backgroundTaskToolsActive) {
             toolEffects.set("Monitor", "write");
             envHandToolNames.add("Monitor");
@@ -2331,10 +2434,13 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         const liveQuestionFace = isLiveQuestionFace(onQuestion) ? onQuestion : undefined;
         const contentAskBindings = new Map();
         const CONTENT_ASK_BINDING_CAP = 32;
+        const checkpointStore = resolveCheckpointStore(spec, deps);
+        const questionParkStoreWired = checkpointStore !== undefined;
+        const questionDurableMandateBinding = runtimeCaps?.forceDurableGate === true && questionParkStoreWired;
         const contentAskRoutable = (toolCallId) => liveQuestionFace !== undefined &&
             mountedQuestionTool !== undefined &&
             tools.includes(mountedQuestionTool) &&
-            runtimeCaps?.forceDurableGate !== true &&
+            !questionDurableMandateBinding &&
             !inheritedUnavailableAsks.has(toolCallId);
         const lateStrandedAnswers = [];
         const discloseStrandedAnswers = (records, why) => {
@@ -2361,8 +2467,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 byDelivery.set(r.deliveryId, r);
             return [...byDelivery.values()];
         };
-        const durableQuestionFace = resolveCheckpointStore(spec, deps) !== undefined &&
-            (spec.durableApproval !== undefined || runtimeCaps?.forceDurableGate === true);
+        const durableQuestionFace = questionParkStoreWired && (spec.durableApproval !== undefined || runtimeCaps?.forceDurableGate === true);
         const mountedQuestionFace = liveQuestionFace !== undefined
             ? async (req, signal) => {
                 const bound = contentAskBindings.get(req.toolCallId);
@@ -3522,6 +3627,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             };
         const harness = new AgentHarness({
             abortResultDetails: () => parkContaminationMarker({ suspendRef, reviewRef }),
+            onToolInputValidationFault: validateInputFaultNotice(deps.onError, sessionId),
             ...(spec.limits?.maxOutputTokens !== undefined && spec.limits.maxOutputTokens > 0
                 ? { maxOutputTokens: spec.limits.maxOutputTokens }
                 : {}),
@@ -4272,7 +4378,6 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         }
         const usageGovernance = buildUsageGovernance(usageWindows, deps, spec.principal, sessionId);
         const platformSuspendArmed = durableSuspendInfraReady && (envLifetimeSuspendAt !== undefined || usageGovernance !== undefined);
-        const checkpointStore = resolveCheckpointStore(spec, deps);
         const durableApproval = spec.durableApproval ??
             (runtimeCaps?.forceDurableGate ? { scope: spec.principal || DEFAULT_IRREVERSIBLE_SCOPE } : undefined);
         const wiringQuestionSeam = resolveQuestionSeam(spec, deps);
@@ -4308,8 +4413,15 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             complianceWired: deps.compliancePostureResolver !== undefined,
             memoryAdmissionWired: deps.memoryScopeAdmission !== undefined,
             retentionPolicyWired: deps.retentionPolicy !== undefined,
+            ...(modelGateManifest !== undefined ? { modelGate: modelGateManifest } : {}),
+            autoMode: { armed: autoModeArmReason === "armed", reason: autoModeArmReason },
         });
+        peerLaneRefs.askEffective = wiringManifest.ask.effective;
+        if (peerLaneActive && internals?.onTaskNotification !== undefined) {
+            bindPeerLaneDrain(harness, { deps, sessionId, runId, scope: taskScope, inject: internals.onTaskNotification, ownTokens: () => internals?.peerSelfRef?.current.ownTokens ?? [], refs: peerLaneRefs });
+        }
         const parkLaneArmed = wiringManifest.parkLane.effective === true;
+        announceDurableGateUnavailable({ onNotice: deps.onNotice, forceDurableGate: runtimeCaps?.forceDurableGate === true, storeWired: checkpointStore !== undefined, taskStoreNull: spec.checkpointStore === null, liveApprover: isLiveApproverSeat(frozenOnAsk), liveQuestionFace: liveQuestionFace !== undefined, parentConstraints: liveInheritedGate?.parentConstraints, sessionId, runId, principal: spec.principal });
         const hookIdentity = mintHookInvocationIdentity({
             sessionId,
             taskId: hostTaskId,
@@ -4449,8 +4561,10 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     const constraintDigest = (inheritedParentConstraints?.length ?? 0) > 0
                         ? constraintChainDigest(constraintChain)
                         : seedInheritedGate?.constraintDigest;
+                    const autoModeIntentCarried = autoModeIntent && (autoModeDecider === undefined || autoModeLatchHealthy(autoModeDecider));
                     return inheritedAncestorRules !== undefined ||
                         inheritedShellGate !== undefined ||
+                        autoModeIntentCarried ||
                         inheritedAdmittedOrgScopes !== undefined ||
                         ownOrgVerdictRef.current !== undefined ||
                         orgGovernedProvenance ||
@@ -4458,6 +4572,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         ? {
                             ...(inheritedAncestorRules !== undefined ? { ancestorRules: structuredClone(inheritedAncestorRules) } : {}),
                             ...(inheritedShellGate !== undefined ? { shellGate: inheritedShellGate } : {}),
+                            ...(autoModeIntentCarried ? { autoModeRequested: true } : {}),
                             ...(inheritedAdmittedOrgScopes !== undefined ? { admittedOrgScopes: [...inheritedAdmittedOrgScopes] } : {}),
                             ...(ownOrgVerdictRef.current !== undefined
                                 ? { ownAdmittedOrgScopes: [...ownOrgVerdictRef.current.scopes], ownAdmittedOrgWriteScope: ownOrgVerdictRef.current.writeScope }

package/dist/core/runner/runtask.js

@@ -21,6 +21,7 @@ import { ORG_ADJUDICATION_TIMEOUT_MS, settleOrgVerdictWithin } from "../permissi
 import { emitTaskOutcome } from "../task-outcome.js";
 import { isDegenerateCutMessage } from "../../brain/terminal-cause.js";
 import { primaryActivityArg } from "../arg-summary.js";
+import { redactThenCut } from "../../agents/subagent-steps.js";
 import { resolveReasoning } from "../../brain/reasoning.js";
 import { adjudicateDerivedRoute, authCarrierFingerprint, fallbackToPrimaryNotice, normalizeBaseUrl, sameRouteIdentity } from "../../brain/route-adjudicator.js";
 import { readDegradation } from "../../brain/degrading.js";
@@ -773,7 +774,7 @@ function makeTurnBoundary(prepared, stats, rs, deps) {
                     boundaryAttachmentBytes += Buffer.byteLength(a.body, "utf8");
                 rs.attach.attachmentsInjected += due.length;
                 for (const a of due) {
-                    queue.push({ type: "steering_injected", source: a.source, preview: a.body.slice(0, 220), ...ident() });
+                    queue.push({ type: "steering_injected", source: a.source, preview: redactThenCut(a.body, 220), ...ident() });
                 }
             }
         }
@@ -2871,6 +2872,8 @@ export class Runner {
                 ...(s.retryInSec !== undefined ? { retryInSec: s.retryInSec } : {}),
                 ...(s.retryInMs !== undefined ? { retryInMs: s.retryInMs } : {}),
                 ...(s.retryAtMs !== undefined ? { retryAtMs: s.retryAtMs } : {}),
+                ...(s.elapsedMs !== undefined ? { elapsedMs: s.elapsedMs } : {}),
+                ...(s.timeoutMs !== undefined ? { timeoutMs: s.timeoutMs } : {}),
                 ...(s.attempt !== undefined ? { attempt: s.attempt } : {}),
                 ...(s.maxRetries !== undefined ? { maxRetries: s.maxRetries } : {}),
                 ...(s.errClass !== undefined ? { errClass: s.errClass } : {}),
@@ -3821,7 +3824,7 @@ export class Runner {
                     }
                     for (const f of firstFrames) {
                         f.commit();
-                        queue.push({ type: "steering_injected", source: f.source, preview: f.body.slice(0, 220), ...ident() });
+                        queue.push({ type: "steering_injected", source: f.source, preview: redactThenCut(f.body, 220), ...ident() });
                     }
                     rs.attach.attachmentsInjected += firstFrames.length;
                     if (firstFrames.length > 0)

package/dist/core/runner/tool-output-projection.js

@@ -64,6 +64,7 @@ const CC_DETAIL_TYPES = new Set([
     "task-stop", "tool-search", "repo-map", "fork", "enter-plan-mode", "exit-plan-mode",
     "monitor-start", "path_not_in_root", "read_path_denied", "readonly_out_of_root", "bash_invalid_timeout",
     "report-findings", "schedule-wakeup", "send-message", "agent-transcript", "a2a", "document",
+    "list-agents",
 ]);
 export const structuredFrom = (result) => {
     const details = result !== null && typeof result === "object" ? result.details : undefined;

package/dist/core/store-contracts/mailbox-store-contract.d.ts

@@ -46,6 +46,29 @@ export declare function mailboxAckOwnershipContract(mk: () => MailboxStore, runA
  * 放宽」:核心层没有一条为了任何后端而弱化。第三方后端若有租户轴,应当也挂这一层。
  */
 export declare function mailboxBundledOnlyContract(mk: () => MailboxStore, runAssertion?: ContractAssertionRunner): Promise<void>;
+export interface MailboxCrossProcessContractHooks {
+    /** Open ONE fresh, empty storage location TWICE: `local` in this process and `peer` served by ANOTHER
+     *  OS process over the same storage (the peer is a real second process — an in-process second
+     *  instance proves nothing here). `dispose` closes both and may remove the storage. The kit calls it
+     *  once per case. */
+    openPair: () => Promise<{
+        local: MailboxStore;
+        peer: MailboxStore;
+        dispose: () => Promise<void>;
+    }>;
+    runAssertion?: ContractAssertionRunner;
+}
+/**
+ * T2 可选能力层(cross-process 分册,design/385 §1.2⑥ / G11)—— 声明 `crossProcessSafe: true` 的后端必须
+ * 过的全套判据。钉的是**整套**(跨进程 seq 单铸 + lease/ack 不交叉 + 一方的 housekeeping 不丢另一方的
+ * 已落盘 append + reap/drop 的 seq 语义跨进程成立),不是「有锁」:一把锁配一份陈旧缓存照样在锁内铸
+ * 重号、照样把别人的消息压缩掉——所以每一条都从**对方进程的视角**回读。
+ *
+ * 受众:文件后端(本仓捆绑)、SQL 后端(事务天然过)。进程内 Map 的参照实现与 CC inbox 适配器不声明,
+ * 也不挂——它们不是「没做到所以放宽」,而是根本不在跨进程车道上(挂载判据 `mailboxCrossProcessMountVerdict`
+ * 对未声明的后端响亮拒)。
+ */
+export declare function mailboxCrossProcessContract(hooks: MailboxCrossProcessContractHooks): Promise<void>;
 export interface MailboxTombstonedRecipientContractHooks {
     /** Put `(scope, handle)` into the deployment's PRE-DELETE state — whatever that is for this
      *  backend (a cascade marking the session row, a `deleting` column, a tombstone table). Core does