@sema-agent/core 7.3.1 → 7.4.0

package/dist/agents/send-message-tool.js

@@ -6,6 +6,8 @@ import { uuidv7 } from "../internal/harness.js";
 import { MAILBOX_TOMBSTONED_RECIPIENT_CODE, mailboxCrossProcessMountVerdict } from "../core/mailbox-store.js";
 import { peerSendVerdictSeverity } from "./cross-session-judge.js";
 import { parsePeerSessionAddress, peerSessionBoxHandle, resolvePeerSessions } from "./peer-directory.js";
+import { peerIdleMachineFor } from "./peer-idle.js";
+import { PEER_IDLE_OUTSTANDING_CAP, PEER_IDLE_SUBSCRIPTION_TTL_MS, peerIdleNoticeLabel } from "./peer-notices.js";
 import { escapeAttributeValue, escapeEnvelopeTag, isObserverTaskId, OBSERVER_SENDMESSAGE_SENDER_REFUSAL, OBSERVER_SENDMESSAGE_TARGET_REFUSAL, } from "./observer.js";
 import { inlineUntrusted } from "../core/untrusted-text.js";
 import { neutralizePeerBody } from "./cross-session-envelope.js";
@@ -50,6 +52,11 @@ function targetLaneKey(scope, targetId) {
 const OPERATOR_CONTINUATION_CTX = Symbol("sema.operator_continuation");
 export function createSendMessageTool(opts) {
     const tier3Capable = opts.agentStore !== undefined && opts.mailbox !== undefined && opts.reviveSpawn !== undefined;
+    const notifyWhenIdleParameter = {
+        notify_when_idle: Type.Optional(Type.Boolean({
+            description: "Ask a peer SESSION of this engine to send you ONE notice when it next goes idle (finishes its turn with nothing queued) or exits — opt-in, one-shot, no polling. With a message: deliver it now AND subscribe. Without a message (omit it): a pure subscription that costs the other session nothing. Peer sessions only (not agents or teammates), and only from the main conversation.",
+        })),
+    };
     const peerLane = (() => {
         if (opts.peerDirectory === undefined)
             return { active: false };
@@ -58,6 +65,14 @@ export function createSendMessageTool(opts) {
         const verdict = mailboxCrossProcessMountVerdict(opts.mailbox);
         return verdict.ok ? { active: true } : { active: false, reason: verdict.reason };
     })();
+    const baseParameters = Type.Object({
+        to: Type.String({ description: 'Recipient: the agent\'s name, or its task_id (a…) returned by the Agent tool with run_in_background. "main" is reserved for the spawning conversation.' }),
+        message: Type.String({ description: "The follow-up request. The agent continues from its full prior context." }),
+        summary: Type.Optional(Type.String({ maxLength: 200, description: "A 5-10 word summary shown as a preview in the UI (required when message is a string)" })),
+    });
+    const sendMessageParameters = peerLane.active
+        ? Type.Object({ ...baseParameters.properties, message: Type.Optional(Type.String({ description: `${baseParameters.properties.message.description ?? ""} Optional only for a pure notify_when_idle subscription.`.trim() })), ...notifyWhenIdleParameter })
+        : baseParameters;
     const retrievalMounted = opts.retrievalToolMounted;
     const retrievalHedge = retrievalMounted === undefined ? " (where that tool is mounted)" : "";
     const RETRIEVE_NOW = retrievalMounted === false
@@ -144,19 +159,16 @@ export function createSendMessageTool(opts) {
             (peerLane.active
                 ? ` Peer SESSIONS — other sessions of this engine for the same user${opts.peerListingMounted === false ? "" : opts.peerListingMounted === true ? " (list them with ListAgents)" : " (list them with ListAgents where that tool is mounted)"} — are addressed by name, by \`name [ref]\` when a name is ambiguous, or by their \`session.<id>\` address. A message to a peer is parked durably in its session box and read at its next turn boundary (an offline peer reads it when it next runs); the receipt confirms the box accepted it, not that the peer acted on it.`
                 : ""),
-        parameters: Type.Object({
-            to: Type.String({ description: 'Recipient: the agent\'s name, or its task_id (a…) returned by the Agent tool with run_in_background. "main" is reserved for the spawning conversation.' }),
-            message: Type.String({ description: "The follow-up request. The agent continues from its full prior context." }),
-            summary: Type.Optional(Type.String({ maxLength: 200, description: "A 5-10 word summary shown as a preview in the UI (required when message is a string)" })),
-        }),
+        parameters: sendMessageParameters,
         execute: async (args, ctx) => {
             const a = args;
             const operatorUserInitiated = ctx[OPERATOR_CONTINUATION_CTX] === true;
             const to = String(a.to ?? "").trim();
             const message = String(a.message ?? "").trim();
+            const notifyWhenIdle = a.notify_when_idle === true;
             if (!to)
                 return { content: "Message not sent: 'to' was empty. Pass the agent's task_id (a…).", details: { error: "empty to" }, isError: true };
-            if (!message)
+            if (!message && !notifyWhenIdle)
                 return { content: "Message not sent: 'message' was empty.", details: { error: "empty message" }, isError: true };
             if (to === "*") {
                 return {
@@ -173,7 +185,7 @@ export function createSendMessageTool(opts) {
                 };
             }
             const summaryArg = typeof a.summary === "string" ? a.summary.trim() : "";
-            if (summaryArg === "") {
+            if (summaryArg === "" && message !== "") {
                 return {
                     content: "Message not sent: summary is required when message is a string — pass a 5-10 word summary of the follow-up.",
                     details: { error: "summary_required", to },
@@ -192,7 +204,7 @@ export function createSendMessageTool(opts) {
             if (isObserverTaskId(to)) {
                 return { content: OBSERVER_SENDMESSAGE_TARGET_REFUSAL, details: { error: "observer_target", to }, isError: true };
             }
-            const admissionConfig = resolvePeerAdmissionConfig(opts.admission);
+            const admissionConfig = resolvePeerAdmissionConfig(opts.admission, opts.onNotice);
             const guardScope = ctx.principal ?? opts.scope ?? opts.peerSelfSession?.scope;
             const selfRef = ctx.peerSelfRef ?? opts.peerSelf;
             const directMountSessionId = ctx.sessionId ?? opts.sessionId ?? opts.peerSelfSession?.sessionId;
@@ -244,11 +256,8 @@ export function createSendMessageTool(opts) {
                 if (record.inboundPosture === "unavailable") {
                     return peerRefusal("peer_send.recipient_refuses", `${peerLabel} advertises that it does not accept cross-session messages (its crossSessionInbound is "refuse"). Nothing was parked.`);
                 }
-                const recipientKey = peerAxisToken(peerScope, "s", record.sessionId);
-                const storedContent = `[${summary}] ${clipCarrierMessage(message)}`;
-                const sendVerdict = judgePeerAdmission(peerScope, recipientKey, { senderKey, body: storedContent, prospectiveChain, ownTokens: [recipientKey] }, admissionConfig, undefined, "send");
-                if (!sendVerdict.ok)
-                    return admissionRefusal(sendVerdict.reason, peerLabel);
+                const modeClass = opts.peerSelfSession?.modeClass?.();
+                const now = Date.now();
                 let boxFull = false;
                 try {
                     boxFull = (await opts.mailbox.peekCount(peerScope, handle)) >= admissionConfig.maxQueuedPeerMessages;
@@ -258,23 +267,56 @@ export function createSendMessageTool(opts) {
                 if (boxFull) {
                     return { content: `Message not sent: ${inlineUntrusted(peerLabel, 200)}'s session box is at its queued-message limit (${admissionConfig.maxQueuedPeerMessages.toFixed(0)}) — the message was NOT queued; it drains the box at its next turn. Resend later. ${DEDUP_RETRY_NOTE.slice(0, 200)}`, details: { error: "queue_full", code: "queue_full", to }, isError: true };
                 }
-                const modeClass = opts.peerSelfSession?.modeClass?.();
-                const peerMeta = {
-                    ...(peerSelfSessionId !== undefined ? { fromSession: peerSelfSessionId } : {}),
-                    ...(modeClass === "bypass" || modeClass === "prompting" ? { fromMode: modeClass } : {}),
-                    ...(senderKey !== undefined ? { senderKey } : {}),
-                    kind: "peer_message",
-                };
-                const now = Date.now();
                 let seq;
-                try {
-                    seq = await opts.mailbox.append(peerScope, handle, { from: ownRowName ?? opts.peerSelfSession?.name ?? senderLabel, content: storedContent, sentAt: now, hopChain: prospectiveChain, peerMeta });
+                if (message !== "") {
+                    const recipientKey = peerAxisToken(peerScope, "s", record.sessionId);
+                    const storedContent = `[${summary}] ${clipCarrierMessage(message)}`;
+                    const sendVerdict = judgePeerAdmission(peerScope, recipientKey, { senderKey, body: storedContent, prospectiveChain, ownTokens: [recipientKey] }, admissionConfig, undefined, "send");
+                    if (!sendVerdict.ok)
+                        return admissionRefusal(sendVerdict.reason, peerLabel);
+                    const peerMeta = {
+                        ...(peerSelfSessionId !== undefined ? { fromSession: peerSelfSessionId } : {}),
+                        ...(modeClass === "bypass" || modeClass === "prompting" ? { fromMode: modeClass } : {}),
+                        ...(senderKey !== undefined ? { senderKey } : {}),
+                        kind: "peer_message",
+                    };
+                    try {
+                        seq = await opts.mailbox.append(peerScope, handle, { from: ownRowName ?? opts.peerSelfSession?.name ?? senderLabel, content: storedContent, sentAt: now, hopChain: prospectiveChain, peerMeta });
+                    }
+                    catch (e) {
+                        if (e?.code === MAILBOX_TOMBSTONED_RECIPIENT_CODE) {
+                            return peerRefusal("peer_send.invalid_target", `${peerLabel} is being deleted — its box no longer accepts messages. Nothing was parked; do not retry.`);
+                        }
+                        return peerRefusal("peer_send.other", `the session box refused the message (${e instanceof Error ? e.message : String(e)}) — nothing was parked. ${DEDUP_RETRY_NOTE}`);
+                    }
                 }
-                catch (e) {
-                    if (e?.code === MAILBOX_TOMBSTONED_RECIPIENT_CODE) {
-                        return peerRefusal("peer_send.invalid_target", `${peerLabel} is being deleted — its box no longer accepts messages. Nothing was parked; do not retry.`);
+                let subscription;
+                let subscriptionSeq;
+                if (notifyWhenIdle) {
+                    if (peerSelfSessionId === undefined) {
+                        subscription = { ok: false, code: "peer_send.other", severity: "error", message: "this mount has no session identity, so no idle notice could be addressed back to it — no subscription was made." };
+                    }
+                    else {
+                        const ask = peerIdleMachineFor(peerScope, peerSelfSessionId).requester.request(record.sessionId, peerIdleNoticeLabel(record.name) ?? handle);
+                        if (!ask.ok) {
+                            subscription = { ok: false, code: "peer_send.subscription_cap", severity: peerSendVerdictSeverity("peer_send.subscription_cap"), message: `you already hold ${PEER_IDLE_OUTSTANDING_CAP} outstanding idle subscriptions — no new one was made; wait for a notice or for one to expire.` };
+                        }
+                        else {
+                            const subMeta = {
+                                fromSession: peerSelfSessionId,
+                                ...(modeClass === "bypass" || modeClass === "prompting" ? { fromMode: modeClass } : {}),
+                                kind: "idle_subscription",
+                            };
+                            try {
+                                subscriptionSeq = await opts.mailbox.append(peerScope, handle, { from: ownRowName ?? opts.peerSelfSession?.name ?? senderLabel, content: `[idle subscription] ${ownRowName ?? opts.peerSelfSession?.name ?? senderLabel} asked to be told once when this session next goes idle`, sentAt: now, hopChain: [], peerMeta: subMeta });
+                                subscription = { ok: true, disposition: record.liveness !== "live" ? "parked_offline" : "queued", via: "store" };
+                            }
+                            catch (e) {
+                                peerIdleMachineFor(peerScope, peerSelfSessionId).requester.settle(record.sessionId, "unavailable");
+                                subscription = { ok: false, code: e?.code === MAILBOX_TOMBSTONED_RECIPIENT_CODE ? "peer_send.invalid_target" : "peer_send.other", severity: "error", message: `the session box refused the subscription record (${(e instanceof Error ? e.message : String(e)).slice(0, 200)}) — no subscription was made.` };
+                            }
+                        }
                     }
-                    return peerRefusal("peer_send.other", `the session box refused the message (${e instanceof Error ? e.message : String(e)}) — nothing was parked. ${DEDUP_RETRY_NOTE}`);
                 }
                 let rowRestored = "present";
                 try {
@@ -294,12 +336,26 @@ export function createSendMessageTool(opts) {
                         ? " Note: that session was DELETED while this message was being parked — its box is being retired and this message will not be read; do not resend to it."
                         : "";
                 const offline = record.liveness !== "live";
+                const subscriptionNote = subscription === undefined
+                    ? ""
+                    : subscription.ok
+                        ? ` Idle subscription recorded (one-shot, expires unheard after ${PEER_IDLE_SUBSCRIPTION_TTL_MS / 3_600_000} h): you will get ONE automated notice when that session next goes idle or exits${offline ? " — it is offline now, so the ask waits in its box with the message" : ""}. Do not poll for it.`
+                        : ` Idle subscription NOT made (${subscription.code}): ${subscription.message}`;
+                if (seq === undefined) {
+                    if (subscription === undefined || !subscription.ok) {
+                        return { content: `Subscription not made: ${subscription?.message ?? "nothing to do"}`, details: { error: subscription?.code ?? "peer_send.other", code: subscription?.code ?? "peer_send.other", to, ...(subscription !== undefined ? { subscription } : {}) }, isError: true };
+                    }
+                    return {
+                        content: `Idle subscription recorded for ${peerLabel} (record seq ${subscriptionSeq}): you will get ONE automated notice when that session next goes idle or exits (one-shot; it expires unheard after ${PEER_IDLE_SUBSCRIPTION_TTL_MS / 3_600_000} h). No message was sent. Do not poll for it; continue with your task.${rowNote}`,
+                        details: { type: "send-message", status: "peer_idle_subscribed", to, address: handle, subscription, ...(subscriptionSeq !== undefined ? { subscriptionSeq } : {}), ...(rowRestored !== "present" ? { directoryRow: rowRestored } : {}) },
+                    };
+                }
                 const verdict = { ok: true, disposition: offline ? "parked_offline" : "queued", via: "store" };
                 return {
                     content: offline
-                        ? `Message parked for ${peerLabel}: that session is offline, so the message was parked durably in its session box (seq ${seq}) and will be delivered when it next runs — subject to the deployment's mailbox retirement policy, which does not notify you. Continue with your task; do not resend the same content.${rowNote}`
-                        : `Message queued for ${peerLabel} (seq ${seq}): it is parked durably in that session's box and will be read at its next turn boundary. This receipt confirms acceptance into the box, not the peer's judgment of the message. Continue with your task; do not resend the same content.${rowNote}`,
-                    details: { type: "send-message", status: offline ? "peer_parked_offline" : "peer_queued", to, address: handle, seq, verdict, ...(rowRestored !== "present" ? { directoryRow: rowRestored } : {}) },
+                        ? `Message parked for ${peerLabel}: that session is offline, so the message was parked durably in its session box (seq ${seq}) and will be delivered when it next runs — subject to the deployment's mailbox retirement policy, which does not notify you. Continue with your task; do not resend the same content.${subscriptionNote}${rowNote}`
+                        : `Message queued for ${peerLabel} (seq ${seq}): it is parked durably in that session's box and will be read at its next turn boundary. This receipt confirms acceptance into the box, not the peer's judgment of the message. Continue with your task; do not resend the same content.${subscriptionNote}${rowNote}`,
+                    details: { type: "send-message", status: offline ? "peer_parked_offline" : "peer_queued", to, address: handle, seq, verdict, ...(subscription !== undefined ? { subscription } : {}), ...(subscriptionSeq !== undefined ? { subscriptionSeq } : {}), ...(rowRestored !== "present" ? { directoryRow: rowRestored } : {}) },
                 };
             };
             const settlePeerResolution = async (r) => {
@@ -329,6 +385,16 @@ export function createSendMessageTool(opts) {
                     }
                 }
             };
+            if (notifyWhenIdle) {
+                if (!peerLane.active) {
+                    return peerRefusal("peer_send.invalid_target", peerLane.reason !== undefined ? `notify_when_idle is only supported for peer sessions of this engine, and the cross-session lane is unavailable on this mount — ${peerLane.reason}. Nothing was sent.` : `notify_when_idle is only supported for peer sessions of this engine, and cross-session addressing is not mounted here (no peer-session directory). Nothing was sent.`);
+                }
+                if (senderIsChild) {
+                    return peerRefusal("peer_send.invalid_target", "notify_when_idle is only available from the main conversation of this session (not from a subagent or teammate). Nothing was sent.");
+                }
+                const settled = await settlePeerResolution(await resolvePeerTarget());
+                return settled ?? peerRefusal("peer_send.invalid_target", `notify_when_idle is only supported for peer sessions of this engine (not teammates, subagents or agents), and no peer session is registered as "${inlineUntrusted(to, 120)}". Nothing was sent.`);
+            }
             if (parsePeerSessionAddress(to) !== undefined) {
                 if (!peerLane.active) {
                     return peerRefusal("peer_send.invalid_target", peerLane.reason !== undefined ? `cross-session addressing is unavailable on this mount — ${peerLane.reason}. Nothing was sent.` : `cross-session addressing is not mounted here (no peer-session directory), so "${inlineUntrusted(to, 120)}" cannot be delivered.`);

package/dist/agents/subagent.js

@@ -2113,6 +2113,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                         : ctx.parentCwd !== undefined
                             ? { parentCwd: ctx.parentCwd }
                             : {}),
+                ...(reviveClaim === undefined && ctx.fileHistoryLineage !== undefined ? { fileHistoryLineage: ctx.fileHistoryLineage } : {}),
                 ...(ctx.onSubagentSpawn ? { onSubagentSpawn: ctx.onSubagentSpawn } : {}),
             };
             const childThinking = def?.thinking ?? ctx.thinkingLevel;

package/dist/core/auto-mode-defaults.d.ts

@@ -11,3 +11,14 @@ export declare const AUTO_MODE_DEFAULT_WINDOW_MAX_CHARS = 2000;
  *  recipe canonicalizer needs its VALUE and must not load the assembly face (and its SHA-locked assets)
  *  to get it; `auto-mode-prompt.js` re-exports it, so the public name and its module face are unchanged. */
 export declare const AUTO_MODE_DEFAULTS_SENTINEL = "$defaults";
+/** CC 2.1.250 `FO = {maxConsecutive: 3, maxTotal: 20}` — the classifier DENIAL LIMITS applied when
+ *  `RunnerDeps.autoMode.denialLimit` omits a bound. Count-then-judge: the block that reaches a bound is
+ *  itself the one that falls back to a person (the 3rd consecutive block asks; the 20th total asks). */
+export declare const AUTO_MODE_DENIAL_LIMIT_DEFAULTS: Readonly<{
+    maxConsecutive: number;
+    maxTotal: number;
+}>;
+/** CC 2.1.250 `AKe = 120000` — the fallback ask's auto-deny window (ms) when `autoDenyAfterMs` is omitted.
+ *  `0` disarms the window (the ask waits on the approver alone — the upstream original "fall back to
+ *  prompting" shape). */
+export declare const AUTO_MODE_DENIAL_AUTO_DENY_DEFAULT_MS = 120000;

package/dist/core/auto-mode-defaults.js

@@ -3,3 +3,5 @@ export const AUTO_MODE_DEFAULT_FAILURE_THRESHOLD = 3;
 export const AUTO_MODE_DEFAULT_WINDOW_MAX_ENTRIES = 40;
 export const AUTO_MODE_DEFAULT_WINDOW_MAX_CHARS = 2_000;
 export const AUTO_MODE_DEFAULTS_SENTINEL = "$defaults";
+export const AUTO_MODE_DENIAL_LIMIT_DEFAULTS = Object.freeze({ maxConsecutive: 3, maxTotal: 20 });
+export const AUTO_MODE_DENIAL_AUTO_DENY_DEFAULT_MS = 120_000;

package/dist/core/auto-mode.d.ts

@@ -98,3 +98,62 @@ export interface AutoModeDecider {
  * One instance per run/session — the breaker state is the session's "退回非 auto" latch.
  */
 export declare function createAutoModeDecider(opts: AutoModeDeciderOptions): AutoModeDecider;
+/** The deployment's bounds for the denial limit (`RunnerDeps.autoMode.denialLimit`). Every member
+ *  optional; an omitted member takes its CC default. A present member with a bad value is REFUSED
+ *  loudly at construction (never clamped, never read as the default). */
+export interface AutoModeDenialLimitOptions {
+    /** Consecutive classifier blocks (no classifier/human allow between them) that fall back to a person.
+     *  Default 3. A positive integer. */
+    maxConsecutive?: number;
+    /** Total classifier blocks per run that fall back to a person and reset the budget. Default 20. A
+     *  positive integer. */
+    maxTotal?: number;
+    /** The fallback ask's auto-deny window, ms. Default 120_000; `0` = no window (the ask waits on the
+     *  approver alone). A non-negative integer no greater than 2147483647 (a host timer truncates larger
+     *  delays and fires at once — the fail-closed direction, and invisible). */
+    autoDenyAfterMs?: number;
+}
+/** The additive member a denial-limit fallback ask carries (`PermissionResult` ask arm, `AskRequest`):
+ *  the counts that tripped the bound and the auto-deny window this particular ask runs under. */
+export interface DenialLimitFallback {
+    /** Consecutive blocks INCLUDING the one that tripped the bound. */
+    readonly consecutive: number;
+    /** Total blocks this run INCLUDING the one that tripped the bound (read before the total-bound reset). */
+    readonly total: number;
+    /** Which bound tripped. */
+    readonly limit: "consecutive" | "total";
+    /** The auto-deny window for THIS ask, ms; `0` = none (disarmed by configuration, or the timed card was
+     *  already shown for this streak). The ask resolver reads this member to arm its deadline. */
+    readonly autoDenyAfterMs: number;
+}
+export type DenialLimitVerdict = {
+    limitReached: false;
+} | {
+    limitReached: true;
+    fallback: DenialLimitFallback;
+};
+/** The per-run denial tracker. Lives beside {@link AutoModeDecider} (same owner, same lifetime). */
+export interface AutoModeDenialTracker {
+    /** A classifier `block`: count first, judge second (CC `eme` → `tme`). Returns whether THIS block is
+     *  the one that falls back to a person, with the fallback's own snapshot. */
+    recordBlock(): DenialLimitVerdict;
+    /** A classifier `allow`, or a person's allow of a fallback ask (CC `yR`): consecutive → 0 and the
+     *  timed-card mark cleared. A rule/fast-path allow must NOT call this. */
+    recordAllow(): void;
+    /** The current counts (diagnostics / pins). */
+    snapshot(): {
+        consecutive: number;
+        total: number;
+        timedFallbackShown: boolean;
+    };
+}
+/** Build the per-run tracker. Bad knob values throw (the deployment face is read at prepare; a refusal
+ *  there is the loud exit the knob doctrine requires). */
+export declare function createAutoModeDenialTracker(opts?: AutoModeDenialLimitOptions): AutoModeDenialTracker;
+/** The fallback ask's text — CC's sentence family, single-sourced for every mint site (the main gate
+ *  and the inherited-lane arms): `Classifier denial limit exceeded, falling back to prompting: <limit
+ *  sentence>` + a blank line + `Latest blocked action: <the classifier's own reason, or the tool name>`.
+ *  The reason is the classifier MODEL's text — the caller neutralizes it before it gets here. */
+export declare function denialLimitFallbackMessage(fallback: DenialLimitFallback, latestBlockedAction: string): string;
+/** The limit sentence alone (CC's two forms) — shared by the fallback ask and the headless terminal. */
+export declare function denialLimitSentence(fallback: DenialLimitFallback): string;

package/dist/core/auto-mode.js

@@ -1,4 +1,4 @@
-import { AUTO_MODE_DEFAULT_FAILURE_THRESHOLD, AUTO_MODE_DEFAULT_TIMEOUT_MS } from "./auto-mode-defaults.js";
+import { AUTO_MODE_DEFAULT_FAILURE_THRESHOLD, AUTO_MODE_DEFAULT_TIMEOUT_MS, AUTO_MODE_DENIAL_AUTO_DENY_DEFAULT_MS, AUTO_MODE_DENIAL_LIMIT_DEFAULTS } from "./auto-mode-defaults.js";
 export function parseAutoModeResponse(text) {
     const t = text
         .replace(/<thinking>[\s\S]*?<\/thinking>/g, "")
@@ -99,3 +99,59 @@ class AutoModeTimeout extends Error {
         super("auto-mode classify timeout");
     }
 }
+const MAX_TIMER_DELAY_MS = 2_147_483_647;
+export function createAutoModeDenialTracker(opts = {}) {
+    const bound = (name, v, dflt) => {
+        if (v === undefined)
+            return dflt;
+        if (!Number.isInteger(v) || v < 1) {
+            throw new Error(`RunnerDeps.autoMode.denialLimit.${name} must be a positive integer (got ${JSON.stringify(v)}) — omit it for the default ${dflt}`);
+        }
+        return v;
+    };
+    const maxConsecutive = bound("maxConsecutive", opts.maxConsecutive, AUTO_MODE_DENIAL_LIMIT_DEFAULTS.maxConsecutive);
+    const maxTotal = bound("maxTotal", opts.maxTotal, AUTO_MODE_DENIAL_LIMIT_DEFAULTS.maxTotal);
+    let autoDenyAfterMs = AUTO_MODE_DENIAL_AUTO_DENY_DEFAULT_MS;
+    if (opts.autoDenyAfterMs !== undefined) {
+        if (!Number.isInteger(opts.autoDenyAfterMs) || opts.autoDenyAfterMs < 0 || opts.autoDenyAfterMs > MAX_TIMER_DELAY_MS) {
+            throw new Error(`RunnerDeps.autoMode.denialLimit.autoDenyAfterMs must be an integer between 0 and ${MAX_TIMER_DELAY_MS} (got ${JSON.stringify(opts.autoDenyAfterMs)}) — 0 disarms the window; omit it for the default ${AUTO_MODE_DENIAL_AUTO_DENY_DEFAULT_MS}`);
+        }
+        autoDenyAfterMs = opts.autoDenyAfterMs;
+    }
+    let consecutive = 0;
+    let total = 0;
+    let timedFallbackShown = false;
+    return {
+        recordBlock() {
+            consecutive += 1;
+            total += 1;
+            if (consecutive < maxConsecutive && total < maxTotal)
+                return { limitReached: false };
+            const totalTripped = total >= maxTotal;
+            const windowMs = timedFallbackShown || totalTripped ? 0 : autoDenyAfterMs;
+            const fallback = { consecutive, total, limit: totalTripped ? "total" : "consecutive", autoDenyAfterMs: windowMs };
+            if (totalTripped) {
+                consecutive = 0;
+                total = 0;
+                timedFallbackShown = false;
+            }
+            else if (windowMs > 0) {
+                timedFallbackShown = true;
+            }
+            return { limitReached: true, fallback };
+        },
+        recordAllow() {
+            consecutive = 0;
+            timedFallbackShown = false;
+        },
+        snapshot: () => ({ consecutive, total, timedFallbackShown }),
+    };
+}
+export function denialLimitFallbackMessage(fallback, latestBlockedAction) {
+    return `Classifier denial limit exceeded, falling back to prompting: ${denialLimitSentence(fallback)}\n\nLatest blocked action: ${latestBlockedAction}`;
+}
+export function denialLimitSentence(fallback) {
+    return fallback.limit === "total"
+        ? `${fallback.total} actions were blocked this session. Please review the transcript before continuing.`
+        : `${fallback.consecutive} consecutive actions were blocked. Please review the transcript before continuing.`;
+}

package/dist/core/checkpoint-store.js

@@ -125,7 +125,7 @@ export function buildRiskDescriptor(input) {
         if (shell || toolName === "Bash") {
             const cmd = isPlainRecord(args) ? safeDataValue(args, "command") : undefined;
             if (typeof cmd === "string" && cmd.length > 0)
-                summary = renderUntrustedCommandText(redactSecrets(stripFormatCharacters(cmd)), SUMMARY_CMD_MAX);
+                summary = renderUntrustedCommandText(stripFormatCharacters(redactSecrets(cmd)), SUMMARY_CMD_MAX);
             const bg = isPlainRecord(args) ? safeDataValue(args, "run_in_background") : undefined;
             if (bg === true)
                 summary = `[background persistent process — no per-step recheck] ${summary ?? ""}`.trimEnd();
@@ -140,7 +140,7 @@ export function buildRiskDescriptor(input) {
                     if (typeof v === "string" || typeof v === "number" || typeof v === "boolean") {
                         const encDigest = (s) => s.replace(/%/g, "%25").replace(/=/g, "%3D").replace(/ /g, "%20");
                         const k = encDigest(renderUntrustedCommandText(key, 40));
-                        const val = encDigest(renderUntrustedCommandText(redactSecrets(stripFormatCharacters(String(v))), SUMMARY_VALUE_MAX));
+                        const val = encDigest(renderUntrustedCommandText(stripFormatCharacters(redactSecrets(String(v))), SUMMARY_VALUE_MAX));
                         parts.push(`${k}=${val}`);
                     }
                 }

package/dist/core/governance-codes.d.ts

@@ -103,7 +103,7 @@ export type NoticeAudience = "user" | "operator";
  * src/ for notice mint shapes and names any code that is minted but unregistered, or registered but
  * no longer minted.
  */
-export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.read_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.durable_gate_unavailable", "config.peer_lane_unmounted", "peer.inbound_disposition", "delegation.transcript_integrity", "mcp.revocation_probe_failed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "route.fallback_to_primary", "route.base_url_changed_key_unchanged", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "tool_result.offload_put_failed"];
+export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.read_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "delegation.transcript_integrity", "mcp.revocation_probe_failed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "route.fallback_to_primary", "route.base_url_changed_key_unchanged", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "tool_result.offload_put_failed"];
 /** A code this engine mints (see {@link ENGINE_NOTICE_CODES}). NOT the type of
  *  `EngineNotice.code`, which stays `string` — a host forwarding its own notices through the same
  *  sink is a supported shape, and narrowing that field would break it. */

package/dist/core/governance-codes.js

@@ -102,8 +102,12 @@ export const ENGINE_NOTICE_CODES = [
     "config.tool_model_gate_unknown_class",
     "config.tool_model_gate_env_invalid",
     "config.durable_gate_unavailable",
+    "config.peer_admission_out_of_range",
     "config.peer_lane_unmounted",
     "peer.inbound_disposition",
+    "peer.held_settled",
+    "peer.idle_subscription",
+    "classifier.denial_limit",
     "delegation.transcript_integrity",
     "mcp.revocation_probe_failed",
     "workflow.governance_key_stripped",
@@ -142,6 +146,7 @@ const NOTICE_AUDIENCE_TABLE = {
     "memory.hold_disposed": "user",
     "task.user_steer_undrained": "user",
     "task.user_followup_undrained": "user",
+    "classifier.denial_limit": "user",
     "task.turn_interrupted": "user",
     "steering.parked_input_blocked": "user",
     "task.halt_unconsumed": "user",
@@ -159,7 +164,10 @@ const NOTICE_AUDIENCE_TABLE = {
     "config.tool_model_gate_unknown_class": "operator",
     "config.tool_model_gate_env_invalid": "operator",
     "config.peer_lane_unmounted": "operator",
+    "config.peer_admission_out_of_range": "operator",
     "peer.inbound_disposition": "user",
+    "peer.held_settled": "user",
+    "peer.idle_subscription": "user",
     "delegation.transcript_integrity": "operator",
     "mcp.revocation_probe_failed": "operator",
     "workflow.governance_key_stripped": "operator",

package/dist/core/hooks.d.ts

@@ -2,6 +2,7 @@ import type { ActorAssertion, DocumentContent, ImageContent, TextContent } from
 import type { ExecutionEnv, FileError, Result, SessionTreeEntry } from "../internal/harness-types.js";
 import type { DecisionReason, PermissionResult, ResolvedAsk, ToolCallRequest, ToolPolicy } from "./tool-policy.js";
 import { type AskClass } from "./ask-class.js";
+import { type AutoModeDenialTracker } from "./auto-mode.js";
 import type { WiringLegKind } from "./wiring-manifest.js";
 /**
  * In-process hook seam (design/37) — a provider-agnostic interception layer modeled on CC's hooks,
@@ -429,6 +430,10 @@ export interface PermissionDeniedPayload {
      *  screen; a policy's direct deny, a hook deny, and the crash/plan-mode/compliance emissions carry
      *  none. See {@link import("./tool-policy.js").AskDenyResolution}. */
     resolution?: import("./tool-policy.js").AskDenyResolution;
+    /** #548 — the deny is the classifier denial-limit fallback's AUTO-DENY (core's own window elapsed;
+     *  see {@link import("./tool-policy.js").ResolvedAsk.autoDenied}). Carried verbatim from the resolver;
+     *  absent on every other deny. */
+    autoDenied?: true;
     /** {@link HookSeatSignal} — this invocation's own abort signal. On an OBSERVATION seat the deny has
      *  already happened and nothing this callback does can change it, so the signal says exactly one
      *  thing: stop reading, nobody is waiting for your answer any more. */
@@ -1458,7 +1463,32 @@ export interface ToolGateInput {
      */
     autoMode?: {
         decider: import("./auto-mode.js").AutoModeDecider;
+        /**
+         * #548 — the per-run DENIAL-LIMIT tracker beside the decider (CC 2.1.250 `FO`/`Wie`; same owner,
+         * same lifetime). Absent ⇒ the pre-#548 chain byte for byte: every block is a deny, without bound.
+         * Present ⇒ a block first counts, then judges; the block that reaches a bound becomes the fallback
+         * ask (`requiresRealApproval: true` + `denialLimitFallback`), and a classifier allow or a person's
+         * allow of that ask resets the consecutive count. The Runner builds it from
+         * `RunnerDeps.autoMode.denialLimit`; a host driving the gate directly may hand its own.
+         */
+        denialTracking?: AutoModeDenialTracker;
     };
+    /**
+     * #548 — the HEADLESS arm of the denial-limit fallback: the fallback ask was resolved by a deny no
+     * person made (no approver wired; a blanket `"allow"` refused as no approver; an approver that
+     * reported unavailable with no park to take it). The fallback had nowhere to go, so the caller — which
+     * owns the run — stops it (`TaskResult.errorCode = "classifier.denial_limit"`, CC's "too many
+     * classifier denials in headless mode" abort). The deny itself still stands; this gate only names the
+     * fact. A TOP-LEVEL seat, deliberately NOT under `autoMode`: the fallback can arrive from an ANCESTOR's
+     * frozen tracker through the fold (a delegated child with no armed classifier of its own), and that
+     * child's run is the one that has to stop. Observe-only for the gate: a throwing seat never alters
+     * the deny.
+     */
+    onHeadlessDenialLimit?: (info: {
+        toolName: string;
+        toolCallId: string;
+        fallback: import("./auto-mode.js").DenialLimitFallback;
+    }) => void;
     /**
      * design/153 §2/§7.4 (件4 复审, MED): true means this call's ask is MARKED — an inherited ancestor
      * constraint already determined "no synchronous layer may resolve this ask" (the ancestor's frozen

package/dist/core/hooks.js

@@ -1,5 +1,6 @@
-import { coreMintedResolutionOf, decisionText, describeThrown, isAskDenyResolution, refuseOutOfContractDecision } from "./tool-policy.js";
+import { coreMintedAutoDeniedOf, coreMintedResolutionOf, decisionText, describeThrown, isAskDenyResolution, refuseOutOfContractDecision } from "./tool-policy.js";
 import { brandPolicyAskClass } from "./ask-class.js";
+import { denialLimitFallbackMessage } from "./auto-mode.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 import { mintSystemReminder } from "./reminder-mint.js";
 import { PROBE_REASON_MAX, normalizeProbeCause } from "./checkpoint-store.js";
@@ -443,6 +444,7 @@ export async function runToolGate(input) {
     let hookAsk;
     let parkFailed;
     let askDenyResolution;
+    let askAutoDenied = false;
     const notifier = createSafeNotifier(input.onNotifyError !== undefined ? { onError: input.onNotifyError } : undefined);
     const hookSeatMs = resolveHookTimeoutMs(input.hookTimeoutMs, (err) => traceHookCrash(input, err, notifier));
     const seatBound = (abortEnds) => ({
@@ -804,12 +806,14 @@ export async function runToolGate(input) {
             decision.action === "ask" &&
             decision.decisionReason !== "hook" &&
             decision.matchedAskRule === undefined &&
+            decision.denialLimitFallback === undefined &&
             req.toolName !== ASK_USER_QUESTION_TOOL_NAME &&
             input.isMarkedUnresolvable?.(input.event.toolCallId) !== true) {
             const verdict = await input.autoMode.decider
                 .decide({ req, askMessage: decisionText(decision) }, input.abortSignal)
                 .catch(() => ({ kind: "unavailable", cause: "error" }));
             if (verdict.kind === "allow") {
+                input.autoMode.denialTracking?.recordAllow();
                 decision = {
                     action: "allow",
                     message: "auto-mode classifier allowed this call",
@@ -820,12 +824,25 @@ export async function runToolGate(input) {
             else if (verdict.kind === "block") {
                 const reason = verdict.reason ? inlineUntrusted(verdict.reason) : "";
                 const category = verdict.category ? inlineUntrusted(verdict.category) : "";
-                decision = {
-                    action: "deny",
-                    message: `auto-mode classifier blocked this call${reason ? `: ${reason}` : category ? `: [${category}]` : ""}`,
-                    decisionReason: "classifier",
-                };
-                denySource = "classifier";
+                const tracked = input.autoMode.denialTracking?.recordBlock();
+                if (tracked?.limitReached === true) {
+                    decision = {
+                        ...decision,
+                        message: denialLimitFallbackMessage(tracked.fallback, reason || category || toolName),
+                        decisionReason: "classifier",
+                        requiresRealApproval: true,
+                        denialLimitFallback: tracked.fallback,
+                    };
+                    denySource = "classifier";
+                }
+                else {
+                    decision = {
+                        action: "deny",
+                        message: `auto-mode classifier blocked this call${reason ? `: ${reason}` : category ? `: [${category}]` : ""}`,
+                        decisionReason: "classifier",
+                    };
+                    denySource = "classifier";
+                }
             }
         }
         if (input.sandboxAdmission !== undefined &&
@@ -910,6 +927,8 @@ export async function runToolGate(input) {
                 resolvedApprover = resolved.approver;
             if (resolved.action === "deny" && isAskDenyResolution(resolved.resolution))
                 askDenyResolution = resolved.resolution;
+            if (resolved.action === "deny" && resolved.autoDenied === true)
+                askAutoDenied = true;
             decision = resolved;
             if (resolved.action === "deny" && resolved.approverUnavailable === true && suspendAsk && parkFailed === undefined) {
                 const parkArgs = [req, currentInput, safety, true, realApprovalOf(askBeforeResolve), askBeforeResolve.action === "ask" ? askBeforeResolve.persistedRuleShadowed : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.decisionReason : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.probeReason : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.probeCause : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.segmentCoverage : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.matchedAskRule : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.probeMandated : undefined];
@@ -921,6 +940,21 @@ export async function runToolGate(input) {
                         return { suspend: suspended, preToolContext };
                 }
             }
+            if (askBeforeResolve.action === "ask" && askBeforeResolve.denialLimitFallback !== undefined) {
+                if (decision.action === "allow") {
+                    input.autoMode?.denialTracking?.recordAllow();
+                }
+                else if (askDenyResolution === "no_approver" ||
+                    askDenyResolution === "blanket_allow_refused" ||
+                    askDenyResolution === "approver_unavailable" ||
+                    resolved.approverUnavailable === true) {
+                    try {
+                        input.onHeadlessDenialLimit?.({ toolName, toolCallId, fallback: askBeforeResolve.denialLimitFallback });
+                    }
+                    catch {
+                    }
+                }
+            }
             if (decision.action === "allow" && decision.updatedInput !== undefined) {
                 let editArgs = decision.updatedInput;
                 let editDenied;
@@ -1062,7 +1096,8 @@ export async function runToolGate(input) {
             currentInput = decision.updatedInput;
         }
         const denyResolution = askDenyResolution ?? coreMintedResolutionOf(decision, { toolCallId, toolName });
-        await notifyPermissionDeniedSeat({ toolName, input: cloneObserverInput(currentInput), toolCallId, reason: denyReason, source: denySource, ...(denyResolution !== undefined ? { resolution: denyResolution } : {}), ...(input.identity !== undefined ? { identity: input.identity } : {}) });
+        const denyAutoDenied = askAutoDenied || coreMintedAutoDeniedOf(decision, { toolCallId, toolName });
+        await notifyPermissionDeniedSeat({ toolName, input: cloneObserverInput(currentInput), toolCallId, reason: denyReason, source: denySource, ...(denyResolution !== undefined ? { resolution: denyResolution } : {}), ...(denyAutoDenied ? { autoDenied: true } : {}), ...(input.identity !== undefined ? { identity: input.identity } : {}) });
         const denySettledBy = decision.settledBy;
         const denyApprover = denySettledBy !== undefined ? resolvedApprover : undefined;
         return {