@sema-agent/core 7.3.1 → 7.4.0

package/dist/core/runner/prepare-task.js

@@ -5,7 +5,8 @@ import { AgentHarness, DEFAULT_CHARS_PER_TOKEN, DEFAULT_CLAMP_TOLERANCE, DEFAULT
 const PROMPT_HASH_SALT = randomBytes(16);
 import { sanitizeCompactionSettings } from "../auto-compaction.js";
 import { projectStaleToolResults, resolveStaleToolResultOffload } from "./compaction-call-options.js";
-import { createAutoModeDecider } from "../auto-mode.js";
+import { createAutoModeDecider, createAutoModeDenialTracker } from "../auto-mode.js";
+import { attachRebuiltDenialTrackers, createDenialLimitStop, headlessDenyAtFold, headlessDenyAtRecheck, judgeInheritedClassifier, settleDenialLimitFallback } from "./denial-limit-arms.js";
 import { autoModeArmingRecipeOf } from "../auto-mode-arming.js";
 import { buildAutoModePrompt, renderAutoModeAction, renderAutoModeWindow } from "../auto-mode-prompt.js";
 import { resolveTaskModel } from "../roles.js";
@@ -63,6 +64,7 @@ import { limitConfigError, prepareConfigDoors } from "./prepare-config-doors.js"
 import { NAMESPACED_NAME_SHAPES, prepareSafetyScan } from "./prepare-safety-scan.js";
 import { prepareAcquireReconcile } from "./prepare-acquire-reconcile.js";
 import { prepareHandsMount, resolveHandsLessReadFace } from "./prepare-hands-readface.js";
+import { createEditedFilesLedger } from "./edited-files-ledger.js";
 import { prepareWorkspaceRestore, remoteEnvFailureNote, restoreWorkspaceWithRetry } from "./prepare-workspace-restore.js";
 import { defaultPromptProvider, buildEnvironmentContext, formatLocalDate, isValidTimeZone, PROJECT_CONTEXT_FRAMING } from "../../prompts/default.js";
 import { applyGitFrameGuard, probeGitStatusLane } from "./git-status-frame.js";
@@ -85,6 +87,7 @@ import { createMonitorTool } from "../../tools/monitor.js";
 import { createWorktreeTools } from "../../tools/worktree.js";
 import { announcePeerLaneMount, bindPeerLaneDrain, listAgentsMountable, mountListAgents, peerLaneSendMessageSeats } from "../../agents/peer-session-drain.js";
 import { CROSS_SESSION_CLASSIFIER_RULE } from "../../agents/cross-session-envelope.js";
+import { NodeExecutionEnv } from "../../engine/execution-env/node-execution-env.js";
 import { applyCompactionToReadFileState, isReadDedupStubResult, FULL_SHELL_CONTRACT_ID, HAND_TOOL_EFFECTS } from "../../tools/fs/index.js";
 import { decodeTextBytes } from "../../tools/fs/encoding.js";
 import { ASK_USER_QUESTION_TOOL_NAME, createAskUserQuestionTool, classifyQuestionOutcome, isLiveQuestionFace, validateAskQuestions, } from "../ask-question.js";
@@ -635,6 +638,45 @@ function createFileHistoryBoundarySeat(opts) {
         },
     };
 }
+async function resolveFileHistoryCoordinates(enabled, env, taskRoot, lineage, sessionId) {
+    if (!enabled)
+        return { historyRoot: taskRoot, historyScope: sessionId, historyFs: "" };
+    const canonRoot = await env.canonicalPath(taskRoot);
+    const historyRoot = canonRoot.ok ? canonRoot.value : taskRoot;
+    const historyFs = fileHistoryFilesystemIdentity(env);
+    return { historyRoot, historyScope: resolveFileHistoryScope(lineage, historyRoot, historyFs, sessionId), historyFs };
+}
+export function resolveFileHistoryScope(lineage, historyRoot, historyFs, sessionId) {
+    if (lineage === undefined || lineage.scope === "" || lineage.root !== historyRoot || lineage.fs !== historyFs)
+        return sessionId;
+    return lineage.scope;
+}
+const envFilesystemTokens = new WeakMap();
+let envFilesystemSeq = 0;
+export function fileHistoryFilesystemIdentity(env) {
+    if (isRemoteExecutionEnv(env)) {
+        try {
+            const h = env.workspaceHandle();
+            return JSON.stringify(["remote", h.provider, h.sandboxId, h.deviceId !== undefined && h.deviceId !== "" ? h.deviceId : null]);
+        }
+        catch {
+        }
+    }
+    else if (env.hostLocalPaths === true || (env.hostLocalPaths === undefined && env instanceof NodeExecutionEnv)) {
+        return "host";
+    }
+    let token = envFilesystemTokens.get(env);
+    if (token === undefined) {
+        token = `instance:${++envFilesystemSeq}`;
+        envFilesystemTokens.set(env, token);
+    }
+    return token;
+}
+function childScopeRewindRefusal(rootScope, target) {
+    const e = new Error(`rewind-files: this run is a delegated child recording its edits into the ROOT session "${rootScope}"'s file history, so restoring files to entry "${target}" is the root session's action (rewindFilesTo / resumeAt+restoreFiles on that session), not the child's — the files were NOT rewound`);
+    e.code = "rewind.child_scope_unsupported";
+    return e;
+}
 export function gatedCallIdOf(p) {
     if (p.suspendRef.token !== undefined)
         return p.suspendRef.gatedCallId;
@@ -1486,9 +1528,6 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             throw e;
         }
         const fileHistoryStore = resolveWiredFileHistoryStore(deps.fileHistoryStore);
-        if (fileHistoryStore !== undefined) {
-            await adoptForkedFileHistory(fileHistoryStore, session, sessionId, deps.onError);
-        }
         const legacyRewindFiles = spec.rewindFiles;
         if (legacyRewindFiles === true) {
             if (spec.resumeAt !== undefined) {
@@ -1521,12 +1560,11 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             });
         }
         const fileHistoryEnabled = fileHistoryStore !== undefined && handsEnabled;
-        let historyRoot = taskRootFinal;
-        if (fileHistoryEnabled) {
-            const canonRoot = await executionEnv.canonicalPath(taskRootFinal);
-            if (canonRoot.ok)
-                historyRoot = canonRoot.value;
-        }
+        const { historyRoot, historyScope, historyFs } = await resolveFileHistoryCoordinates(fileHistoryEnabled, executionEnv, taskRootFinal, internals?.fileHistoryLineage, sessionId);
+        if (fileHistoryStore !== undefined && internals?.fileHistoryLineage === undefined)
+            await adoptForkedFileHistory(fileHistoryStore, session, sessionId, deps.onError);
+        if (rewindTarget !== undefined && historyScope !== sessionId)
+            throw childScopeRewindRefusal(historyScope, rewindTarget);
         if (fileHistoryStore === undefined) {
             if (rewindTarget !== undefined) {
                 const e = new Error(`rewind-files: restoring files to entry "${rewindTarget}" requires a history backend, but this deployment wired no RunnerDeps.fileHistoryStore — no file history was ever recorded, so the files were NOT rewound`);
@@ -1603,14 +1641,14 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         }
         const trackFileEdit = fileHistoryEnabled
             ? async (req) => {
-                const r = await fileHistoryStore.trackEdit(sessionId, req.key, executionEnv, historyRoot, req.signal);
+                const r = await fileHistoryStore.trackEdit(historyScope, req.key, executionEnv, historyRoot, req.signal);
                 if (r.ok) {
                     if (!r.minted)
                         return { ok: true };
                     return {
                         ok: true,
                         annul: async (proof) => {
-                            const a = await fileHistoryStore.annulTrack(sessionId, req.key, historyRoot, proof === "verify" ? { env: executionEnv, ...(req.signal !== undefined ? { signal: req.signal } : {}) } : undefined);
+                            const a = await fileHistoryStore.annulTrack(historyScope, req.key, historyRoot, proof === "verify" ? { env: executionEnv, ...(req.signal !== undefined ? { signal: req.signal } : {}) } : undefined);
                             if (a.ok)
                                 return;
                             try {
@@ -1635,7 +1673,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 };
             }
             : undefined;
-        const fileHistoryBoundary = fileHistoryEnabled
+        const { note: noteFileEdited, snapshot: editedFilesSnapshot } = createEditedFilesLedger();
+        const fileHistoryBoundary = fileHistoryEnabled && historyScope === sessionId
             ? createFileHistoryBoundarySeat({ store: fileHistoryStore, sessionId, env: executionEnv, root: historyRoot, onError: deps.onError })
             : undefined;
         const harnessRef = {};
@@ -1692,7 +1731,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 : shellGateRank[liveShellGate] >= shellGateRank[seedShellGate]
                     ? liveShellGate
                     : seedShellGate;
-        const inheritedParentConstraints = liveInheritedGate?.parentConstraints;
+        const inheritedParentConstraints = attachRebuiltDenialTrackers(liveInheritedGate?.parentConstraints, deps.autoMode?.denialLimit);
         const autoModeIntent = autoModeSeat || liveInheritedGate?.autoModeRequested === true || seedInheritedGate?.autoModeRequested === true;
         const liveAdmittedOrg = liveInheritedGate?.admittedOrgScopes;
         const seedAdmittedOrg = seedInheritedGate?.admittedOrgScopes;
@@ -1781,7 +1820,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         ...(durableMandate ? { durableMandate: true } : {}),
                         ...(contentMandate ? { contentMandate: true } : {}),
                         ...(autoModeDecider !== undefined
-                            ? { autoMode: { decider: autoModeDecider, ...(autoModeArming !== undefined ? { arming: autoModeArming } : {}) } }
+                            ? { autoMode: { decider: autoModeDecider, ...(autoModeDenialTracking !== undefined ? { denialTracking: autoModeDenialTracking } : {}), ...(autoModeArming !== undefined ? { arming: autoModeArming } : {}) } }
                             : {}),
                     },
                 ]
@@ -1797,7 +1836,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             ...(durableMandate ? { durableMandate: true } : {}),
                             ...(contentMandate ? { contentMandate: true } : {}),
                             ...(autoModeDecider !== undefined
-                                ? { autoMode: { decider: autoModeDecider, ...(autoModeArming !== undefined ? { arming: autoModeArming } : {}) } }
+                                ? { autoMode: { decider: autoModeDecider, ...(autoModeDenialTracking !== undefined ? { denialTracking: autoModeDenialTracking } : {}), ...(autoModeArming !== undefined ? { arming: autoModeArming } : {}) } }
                                 : {}),
                         },
                     ]
@@ -1823,6 +1862,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             spec.handsReadOnly !== true &&
             !(toolFaceSnapshot.exclude?.includes("Bash") ?? false);
         let autoModeDecider;
+        let autoModeDenialTracking;
+        const { gateStopRef, stopForDenialLimit } = createDenialLimitStop({ sessionId, runId, onNotice: deps.onNotice, abort: () => { abortController.abort(); void harness.abort(); } });
         let autoModeArming;
         const delegationEntryCapsResolved = resolveDelegationEntryCaps(deps.delegationEntryCaps);
         const enrichSpecToolCtx = (ctx) => ({
@@ -1864,6 +1905,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             },
             getApiKeyAndHeaders: spec.getApiKeyAndHeaders,
             parentCwd: taskRootFinal,
+            ...(fileHistoryEnabled ? { fileHistoryLineage: { scope: historyScope, root: historyRoot, fs: historyFs } } : {}),
             reminderMark,
             reminderDisclosureCounts,
             ...(centerAdoption !== undefined ? { centerArtifactDigest: centerAdoption.artifact.artifactDigest } : {}),
@@ -2005,6 +2047,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             const classifierLaneRule = peerLaneActive && peerSendMessageBuiltIn;
             const classifierSystemPrompt = buildAutoModePrompt(classifierLaneRule ? { ...am, crossSessionMessagesRule: CROSS_SESSION_CLASSIFIER_RULE } : am);
             const classifierRuntime = brainToRuntime(deps.brain);
+            autoModeDenialTracking = createAutoModeDenialTracker(am.denialLimit);
             autoModeDecider = createAutoModeDecider({
                 ...(am.timeoutMs !== undefined ? { timeoutMs: am.timeoutMs } : {}),
                 ...(am.failureThreshold !== undefined ? { failureThreshold: am.failureThreshold } : {}),
@@ -2314,7 +2357,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         foldProtocolAxes(a2a.toolAxes, "A2A");
         const callIssuedAtRef = {};
         const memoryWriteGateRef = {};
-        const handsReadFaceInput = { handsEnabled, executionEnv, taskRootFinal, rebaseRestoredPath, resume, session, sessionId, hostTaskId, taskScope, fullShellReachable, effectiveShellGate, toolFaceSnapshot, model, spec, deps, internals, memoryWriteGateRef, firstPartyOffload, tools, egressTools, irreversibilityTier, irreversibleTools, reversibilityProbes, reminderMark, reminderDisclosureCounts, ...(trackFileEdit !== undefined ? { trackFileEdit } : {}), ...(restoredFilePaths.length > 0 ? { restoredFilePaths } : {}) };
+        const handsReadFaceInput = { handsEnabled, executionEnv, taskRootFinal, rebaseRestoredPath, resume, session, sessionId, hostTaskId, taskScope, fullShellReachable, effectiveShellGate, toolFaceSnapshot, model, spec, deps, internals, memoryWriteGateRef, firstPartyOffload, tools, egressTools, irreversibilityTier, irreversibleTools, reversibilityProbes, reminderMark, reminderDisclosureCounts, ...(trackFileEdit !== undefined ? { trackFileEdit } : {}), onFileEdited: noteFileEdited, ...(restoredFilePaths.length > 0 ? { restoredFilePaths } : {}) };
         const handsReadFace = handsEnabled ? await prepareHandsMount(handsReadFaceInput) : resolveHandsLessReadFace(handsReadFaceInput);
         const { readFileStateForCheckpoint, seedContextFiles, handsCwdRef, workspaceStateSettle, wsSnapshot, rebaseWsPath, backgroundTaskToolsActive, additionalRootsCanonical, additionalReadRootsCanonical, attachmentRootCanonical, readDenyMatcher, envHandToolNames, sealReadStateSeat } = handsReadFace;
         resolvedReadFace = handsReadFace.resolvedReadFace;
@@ -2353,6 +2396,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     enrichCtx: enrichSpecToolCtx,
                     ...(deps.rosterStore !== undefined ? { roster: deps.rosterStore } : {}),
                     ...(deps.peerAdmission !== undefined ? { admission: deps.peerAdmission } : {}),
+                    ...(deps.onNotice !== undefined ? { onNotice: deps.onNotice } : {}),
                     ...(internals?.peerSelfRef !== undefined ? { peerSelf: internals.peerSelfRef } : {}),
                     ...(internals?.peerInboundChainRef !== undefined ? { peerInbound: internals.peerInboundChainRef } : {}),
                     ...(deps.onBackgroundChildEvent ? { onBackgroundChildEvent: deps.onBackgroundChildEvent } : {}),
@@ -3626,7 +3670,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 stream: withBrainCallGuardrail((m, c, o) => deps.brain.stream(m, c, o), brainCallGuardrailMs, brainCallGuardrailRef),
             };
         const harness = new AgentHarness({
-            abortResultDetails: () => parkContaminationMarker({ suspendRef, reviewRef }),
+            abortResultDetails: () => (gateStopRef.terminal !== undefined ? { code: gateStopRef.terminal.code } : parkContaminationMarker({ suspendRef, reviewRef })),
             onToolInputValidationFault: validateInputFaultNotice(deps.onError, sessionId),
             ...(spec.limits?.maxOutputTokens !== undefined && spec.limits.maxOutputTokens > 0
                 ? { maxOutputTokens: spec.limits.maxOutputTokens }
@@ -3983,8 +4027,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             cwdRef: handsCwdRef,
             deniesDirectoryRead: readDenyMatcher !== undefined ? (d) => readDenyMatcher.matchPath(d) !== null : undefined,
         });
-        const frozenClassifierExcluded = (d) => d.decisionReason === "hook" || d.matchedAskRule !== undefined;
-        const recheckApprovedEdit = async (pol, onAskOf, creq, edit, csignal, ancestorDecider) => {
+        const recheckApprovedEdit = async (pol, onAskOf, creq, edit, csignal, ancestorDecider, ancestorTracker) => {
             let editArgs = edit;
             for (let round = 0;; round++) {
                 if (round >= 3) {
@@ -4010,22 +4053,13 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 }
                 if (re.updatedInput !== undefined)
                     editArgs = re.updatedInput;
-                if (ancestorDecider !== undefined && !frozenClassifierExcluded(re)) {
-                    const verdict = await ancestorDecider
-                        .decide({ req: { ...creq, args: editArgs }, ...(re.message !== undefined ? { askMessage: re.message } : {}) }, csignal ?? abortController.signal)
-                        .catch(() => ({ kind: "unavailable", cause: "error" }));
-                    if (verdict.kind === "allow")
-                        return { action: "allow", updatedInput: editArgs };
-                    if (verdict.kind === "block") {
-                        const reason = verdict.reason ? inlineUntrusted(verdict.reason) : "";
-                        const category = verdict.category ? inlineUntrusted(verdict.category) : "";
-                        return {
-                            action: "deny",
-                            message: `auto-mode classifier blocked the approved edit at an inherited ancestor layer${reason ? `: ${reason}` : category ? `: [${category}]` : ""}`,
-                            decisionReason: "classifier",
-                        };
-                    }
-                }
+                const judged = await judgeInheritedClassifier({ autoMode: ancestorDecider !== undefined ? { decider: ancestorDecider, denialTracking: ancestorTracker } : undefined, ask: re, req: { ...creq, args: editArgs }, signal: csignal ?? abortController.signal, subject: "the approved edit" });
+                if (judged.kind === "allow")
+                    return { action: "allow", updatedInput: editArgs };
+                if (judged.kind === "deny")
+                    return judged.result;
+                const { ask: editAsk, fallback: editFallback, mintedHere: editMintedHere } = judged;
+                re = editAsk;
                 const rr = await resolveAsk({
                     toolName: creq.toolName,
                     toolCallId: creq.toolCallId,
@@ -4036,8 +4070,10 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     ...riskAxesOf(creq.toolName),
                     ...(re.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
                     ...(re.persistedRuleShadowed !== undefined ? { persistedRuleShadowed: re.persistedRuleShadowed } : {}),
+                    ...(editFallback !== undefined ? { denialLimitFallback: editFallback } : {}),
                     ruleEvidence: inheritedAskEvidence,
-                }, onAskOf, csignal ?? abortController.signal);
+                }, onAskOf, csignal ?? abortController.signal, lateAskSettlementObserver({ toolName: creq.toolName, toolCallId: creq.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice, onError: deps.onError }));
+                settleDenialLimitFallback({ fallback: editFallback, mintedHere: editMintedHere, tracker: ancestorTracker, resolved: rr, headless: headlessDenyAtRecheck, stop: stopForDenialLimit, toolName: creq.toolName, toolCallId: creq.toolCallId });
                 if (rr.action !== "allow")
                     return rr;
                 if (rr.updatedInput === undefined)
@@ -4090,23 +4126,13 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                                     `ask cannot be reconstructed in a delegated child; denied fail-closed (tighten-only)`,
                             };
                         }
-                        if (pc.autoMode !== undefined && !frozenClassifierExcluded(first)) {
-                            const verdict = await pc.autoMode.decider
-                                .decide({ req: creq, ...(first.message !== undefined ? { askMessage: first.message } : {}) }, csignal ?? abortController.signal)
-                                .catch(() => ({ kind: "unavailable", cause: "error" }));
-                            if (verdict.kind === "allow")
-                                return { action: "allow" };
-                            if (verdict.kind === "block") {
-                                const reason = verdict.reason ? inlineUntrusted(verdict.reason) : "";
-                                const category = verdict.category ? inlineUntrusted(verdict.category) : "";
-                                return {
-                                    action: "deny",
-                                    message: `auto-mode classifier blocked this call at an inherited ancestor layer${reason ? `: ${reason}` : category ? `: [${category}]` : ""}`,
-                                    decisionReason: "classifier",
-                                };
-                            }
-                        }
-                        if (sandboxAdmissionArmed && policyAskClassOf(pc.policy) === "sandbox_local" && !sandboxBoundaryCapable(creq.toolName)) {
+                        const judged = await judgeInheritedClassifier({ autoMode: pc.autoMode, ask: first, req: creq, signal: csignal ?? abortController.signal, subject: "this call" });
+                        if (judged.kind === "allow")
+                            return { action: "allow" };
+                        if (judged.kind === "deny")
+                            return judged.result;
+                        const { ask: inheritedAsk, fallback, mintedHere } = judged;
+                        if (fallback === undefined && sandboxAdmissionArmed && policyAskClassOf(pc.policy) === "sandbox_local" && !sandboxBoundaryCapable(creq.toolName)) {
                             recordAncestorSandboxAdmission(creq.toolCallId, creq.toolName);
                             return { action: "allow" };
                         }
@@ -4116,27 +4142,29 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             toolName: creq.toolName,
                             toolCallId: creq.toolCallId,
                             args: presentedArgs,
-                            ...ruleOffersOf(creq.toolName, presentedArgs, { ...(first.action === "ask" ? first : {}), ancestorResolved: true }),
-                            message: first.message ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
+                            ...ruleOffersOf(creq.toolName, presentedArgs, { ...(inheritedAsk.action === "ask" ? inheritedAsk : {}), ancestorResolved: true }),
+                            message: inheritedAsk.message ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
                             ...askSourceIdentity(),
                             ...riskAxesOf(creq.toolName),
-                            ...(first.action === "ask" && first.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
-                            ...(first.action === "ask" && first.persistedRuleShadowed !== undefined ? { persistedRuleShadowed: first.persistedRuleShadowed } : {}),
+                            ...(inheritedAsk.action === "ask" && inheritedAsk.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
+                            ...(inheritedAsk.action === "ask" && inheritedAsk.persistedRuleShadowed !== undefined ? { persistedRuleShadowed: inheritedAsk.persistedRuleShadowed } : {}),
+                            ...(fallback !== undefined ? { denialLimitFallback: fallback } : {}),
                             ruleEvidence: inheritedAskEvidence,
-                        }, pc.onAsk, csignal ?? abortController.signal);
+                        }, pc.onAsk, csignal ?? abortController.signal, lateAskSettlementObserver({ toolName: creq.toolName, toolCallId: creq.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice, onError: deps.onError }));
                         const askWaitMs = Math.max(0, now() - askT0);
                         if (resolved.action === "deny" && resolved.approverUnavailable === true) {
                             if (markInheritedUnavailable(creq.toolCallId))
-                                return first;
+                                return inheritedAsk;
                             return {
                                 action: "deny",
                                 message: `no approver is reachable for the inherited approval of "${creq.toolName}" and the marker channel is at capacity — denied fail-closed`,
                             };
                         }
+                        settleDenialLimitFallback({ fallback, mintedHere, tracker: pc.autoMode?.denialTracking, resolved, headless: headlessDenyAtFold, stop: stopForDenialLimit, toolName: creq.toolName, toolCallId: creq.toolCallId });
                         if (resolved.action !== "allow")
                             return resolved;
                         if (resolved.updatedInput !== undefined) {
-                            return recheckApprovedEdit(pc.policy, pc.onAsk, creq, resolved.updatedInput, csignal, pc.autoMode?.decider);
+                            return recheckApprovedEdit(pc.policy, pc.onAsk, creq, resolved.updatedInput, csignal, pc.autoMode?.decider, pc.autoMode?.denialTracking);
                         }
                         recordInheritedAskGrant(creq.toolCallId, pc.onAsk, resolved.presentedInput, askWaitMs);
                         return { action: "allow" };
@@ -4178,24 +4206,13 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             };
                         }
                         const presentedArgs = decision.updatedInput !== undefined ? decision.updatedInput : creq.args;
-                        if (pc.autoMode !== undefined && !frozenClassifierExcluded(decision)) {
-                            const verdict = await pc.autoMode.decider
-                                .decide({ req: { ...creq, args: presentedArgs }, ...(decision.message !== undefined ? { askMessage: decision.message } : {}) }, csignal ?? abortController.signal)
-                                .catch(() => ({ kind: "unavailable", cause: "error" }));
-                            if (verdict.kind === "allow") {
-                                return decision.updatedInput !== undefined ? { action: "allow", updatedInput: decision.updatedInput } : { action: "allow" };
-                            }
-                            if (verdict.kind === "block") {
-                                const reason = verdict.reason ? inlineUntrusted(verdict.reason) : "";
-                                const category = verdict.category ? inlineUntrusted(verdict.category) : "";
-                                return {
-                                    action: "deny",
-                                    message: `auto-mode classifier blocked this call at an inherited ancestor layer${reason ? `: ${reason}` : category ? `: [${category}]` : ""}`,
-                                    decisionReason: "classifier",
-                                };
-                            }
-                        }
-                        if (sandboxAdmissionArmed && policyAskClassOf(pc.policy) === "sandbox_local" && !sandboxBoundaryCapable(creq.toolName)) {
+                        const judged = await judgeInheritedClassifier({ autoMode: pc.autoMode, ask: decision, req: { ...creq, args: presentedArgs }, signal: csignal ?? abortController.signal, subject: "this call" });
+                        if (judged.kind === "allow")
+                            return decision.updatedInput !== undefined ? { action: "allow", updatedInput: decision.updatedInput } : { action: "allow" };
+                        if (judged.kind === "deny")
+                            return judged.result;
+                        const { ask: inheritedAsk, fallback, mintedHere } = judged;
+                        if (fallback === undefined && sandboxAdmissionArmed && policyAskClassOf(pc.policy) === "sandbox_local" && !sandboxBoundaryCapable(creq.toolName)) {
                             recordAncestorSandboxAdmission(creq.toolCallId, creq.toolName);
                             return decision.updatedInput !== undefined ? { action: "allow", updatedInput: decision.updatedInput } : { action: "allow" };
                         }
@@ -4204,27 +4221,29 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             toolName: creq.toolName,
                             toolCallId: creq.toolCallId,
                             args: presentedArgs,
-                            ...ruleOffersOf(creq.toolName, presentedArgs, { ...(decision.action === "ask" ? decision : {}), ancestorResolved: true }),
-                            message: decision.message ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
+                            ...ruleOffersOf(creq.toolName, presentedArgs, { ...(inheritedAsk.action === "ask" ? inheritedAsk : {}), ancestorResolved: true }),
+                            message: inheritedAsk.message ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
                             ...askSourceIdentity(),
                             ...riskAxesOf(creq.toolName),
-                            ...(decision.action === "ask" && decision.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
-                            ...(decision.action === "ask" && decision.persistedRuleShadowed !== undefined ? { persistedRuleShadowed: decision.persistedRuleShadowed } : {}),
+                            ...(inheritedAsk.action === "ask" && inheritedAsk.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
+                            ...(inheritedAsk.action === "ask" && inheritedAsk.persistedRuleShadowed !== undefined ? { persistedRuleShadowed: inheritedAsk.persistedRuleShadowed } : {}),
+                            ...(fallback !== undefined ? { denialLimitFallback: fallback } : {}),
                             ruleEvidence: inheritedAskEvidence,
-                        }, pc.onAsk, csignal ?? abortController.signal);
+                        }, pc.onAsk, csignal ?? abortController.signal, lateAskSettlementObserver({ toolName: creq.toolName, toolCallId: creq.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice, onError: deps.onError }));
                         const askWaitMs = Math.max(0, now() - askT0);
                         if (resolved.action === "deny" && resolved.approverUnavailable === true) {
                             if (markInheritedUnavailable(creq.toolCallId))
-                                return decision;
+                                return inheritedAsk;
                             return {
                                 action: "deny",
                                 message: `no approver is reachable for the inherited approval of "${creq.toolName}" and the marker channel is at capacity — denied fail-closed`,
                             };
                         }
+                        settleDenialLimitFallback({ fallback, mintedHere, tracker: pc.autoMode?.denialTracking, resolved, headless: headlessDenyAtFold, stop: stopForDenialLimit, toolName: creq.toolName, toolCallId: creq.toolCallId });
                         if (resolved.action !== "allow")
                             return resolved;
                         if (resolved.updatedInput !== undefined) {
-                            return recheckApprovedEdit(pc.policy, pc.onAsk, creq, resolved.updatedInput, csignal, pc.autoMode?.decider);
+                            return recheckApprovedEdit(pc.policy, pc.onAsk, creq, resolved.updatedInput, csignal, pc.autoMode?.decider, pc.autoMode?.denialTracking);
                         }
                         if (pc.preToolUse === undefined) {
                             recordInheritedAskGrant(creq.toolCallId, pc.onAsk, resolved.presentedInput, askWaitMs);
@@ -4418,7 +4437,17 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         });
         peerLaneRefs.askEffective = wiringManifest.ask.effective;
         if (peerLaneActive && internals?.onTaskNotification !== undefined) {
-            bindPeerLaneDrain(harness, { deps, sessionId, runId, scope: taskScope, inject: internals.onTaskNotification, ownTokens: () => internals?.peerSelfRef?.current.ownTokens ?? [], refs: peerLaneRefs });
+            bindPeerLaneDrain(harness, {
+                deps,
+                sessionId,
+                runId,
+                scope: taskScope,
+                inject: internals.onTaskNotification,
+                ownTokens: () => internals?.peerSelfRef?.current.ownTokens ?? [],
+                refs: peerLaneRefs,
+                selfName: () => internals?.explicitAgentName,
+                parked: () => suspendRef.token !== undefined || reviewRef.token !== undefined,
+            });
         }
         const parkLaneArmed = wiringManifest.parkLane.effective === true;
         announceDurableGateUnavailable({ onNotice: deps.onNotice, forceDurableGate: runtimeCaps?.forceDurableGate === true, storeWired: checkpointStore !== undefined, taskStoreNull: spec.checkpointStore === null, liveApprover: isLiveApproverSeat(frozenOnAsk), liveQuestionFace: liveQuestionFace !== undefined, parentConstraints: liveInheritedGate?.parentConstraints, sessionId, runId, principal: spec.principal });
@@ -4480,6 +4509,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     ...riskAxesOf(req.toolName),
                     ...(decision.action === "ask" && decision.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
                     ...(decision.action === "ask" && decision.persistedRuleShadowed !== undefined ? { persistedRuleShadowed: decision.persistedRuleShadowed } : {}),
+                    ...(decision.action === "ask" && decision.denialLimitFallback !== undefined ? { denialLimitFallback: decision.denialLimitFallback } : {}),
                     ...(decision.action === "ask" && decision.probeReason !== undefined ? { probeReason: decision.probeReason } : {}),
                     ...(decision.action === "ask" && decision.probeCause !== undefined ? { probeCause: decision.probeCause } : {}),
                     ...(decision.action === "ask" && decision.ruleEvidence !== undefined ? { ruleEvidence: decision.ruleEvidence } : {}),
@@ -5291,7 +5321,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             ...(notifyPermissionDenied ? { permissionDenied: notifyPermissionDenied } : {}),
                             onHookError: notifyHookError,
                             shellGated: (e.toolName === "Bash" && shellGatedBash) || (e.toolName === "Monitor" && shellGatedMonitor),
-                            ...(autoModeDecider ? { autoMode: { decider: autoModeDecider } } : {}),
+                            ...(autoModeDecider ? { autoMode: { decider: autoModeDecider, ...(autoModeDenialTracking !== undefined ? { denialTracking: autoModeDenialTracking } : {}) } } : {}),
+                            onHeadlessDenialLimit: stopForDenialLimit,
                             ...(permissionRuleLane
                                 ? {
                                     persistedRules: {
@@ -5729,7 +5760,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         const effectiveReadFaceObserved = carrierReadFace();
         const effectiveReadDenyObserved = readDenyAdditionsNormalized.length > 0 ? readDenyAdditionsNormalized.map((e) => ({ ...e })) : undefined;
         const preparedHolder = {};
-        const buildPrepared = () => ({ harness, session, sessionId, runId, reminderMark, reminderDisclosureCounts, taskRootPath: taskRootFinal, model, thinking, compModel: effectiveCompModel, mcp: mcp, ...(a2a !== undefined && a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, approvalSettlement, batchHaltRef, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), ...(fileHistoryBoundary !== undefined ? { fileHistoryBoundary } : {}), ...(effectiveReadFaceObserved !== undefined ? { effectiveReadFace: effectiveReadFaceObserved } : {}), ...(effectiveReadDenyObserved !== undefined ? { effectiveReadDenyPatterns: effectiveReadDenyObserved } : {}), effectiveMemoryScopes: memoryEffectiveScopes, cwdRef: handsCwdRef, ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), ...(sealReadStateSeat !== undefined ? { sealReadStateSeat } : {}), denyNarrowingPolicy, ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, suspendRef, suspendProgressRef, reviewRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, brainCallGuardrailRef, suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, microCompact, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(projectInstructionContent !== undefined ? { projectInstructionContent } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, gitStatusRef, listBackgroundTasks, hookIdentity, hookTimeoutMs, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}) });
+        const buildPrepared = () => ({ harness, session, sessionId, runId, reminderMark, reminderDisclosureCounts, editedFilesSnapshot, taskRootPath: taskRootFinal, model, thinking, compModel: effectiveCompModel, mcp: mcp, ...(a2a !== undefined && a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, approvalSettlement, batchHaltRef, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), ...(fileHistoryBoundary !== undefined ? { fileHistoryBoundary } : {}), ...(effectiveReadFaceObserved !== undefined ? { effectiveReadFace: effectiveReadFaceObserved } : {}), ...(effectiveReadDenyObserved !== undefined ? { effectiveReadDenyPatterns: effectiveReadDenyObserved } : {}), effectiveMemoryScopes: memoryEffectiveScopes, cwdRef: handsCwdRef, ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), ...(sealReadStateSeat !== undefined ? { sealReadStateSeat } : {}), denyNarrowingPolicy, ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, suspendRef, suspendProgressRef, reviewRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, brainCallGuardrailRef, gateStopRef, suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, microCompact, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(projectInstructionContent !== undefined ? { projectInstructionContent } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, gitStatusRef, listBackgroundTasks, hookIdentity, hookTimeoutMs, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}) });
         const prepared = buildPrepared();
         preparedHolder.current = prepared;
         return prepared;

package/dist/core/runner/runtask.js

@@ -1779,6 +1779,10 @@ export class Runner {
                 ...(remoteEnvFailure !== undefined ? { remoteEnvFailures: remoteEnvFailure } : {}),
                 ...(taskIdRef.effectiveMemoryScopes !== undefined ? { effectiveMemoryScopes: taskIdRef.effectiveMemoryScopes } : {}),
                 ...(taskIdRef.effectiveReasoning !== undefined ? { effectiveReasoning: taskIdRef.effectiveReasoning } : {}),
+                ...(() => {
+                    const observed = taskIdRef.editedFiles?.();
+                    return observed !== undefined && observed.length > 0 ? { editedFiles: observed } : {};
+                })(),
                 ...(() => {
                     const hinted = err.retryAfterMs;
                     return code === "memory.admission_required" && typeof hinted === "number" && Number.isFinite(hinted) && hinted > 0
@@ -2349,6 +2353,8 @@ export class Runner {
         notificationSessionId = prepared.sessionId;
         if (taskIdRef)
             taskIdRef.effectiveMemoryScopes = prepared.effectiveMemoryScopes;
+        if (taskIdRef)
+            taskIdRef.editedFiles = prepared.editedFilesSnapshot;
         const runSourceTaskId = spec.taskId ?? prepared.sessionId;
         const parentToolCallId = internals?.parentToolCallId;
         const ident = () => parentToolCallId !== undefined ? { eventId: uuidv7(), parentToolCallId, sourceTaskId: runSourceTaskId } : { eventId: uuidv7() };
@@ -3888,6 +3894,9 @@ export class Runner {
         if (threw === undefined && prepared.brainCallGuardrailRef.timedOut !== undefined) {
             threw = prepared.brainCallGuardrailRef.timedOut;
         }
+        if (threw === undefined && prepared.gateStopRef.terminal !== undefined) {
+            threw = prepared.gateStopRef.terminal;
+        }
         if (rs.limits.platformTerminal !== undefined) {
             threw = rs.limits.platformTerminal;
         }
@@ -4071,6 +4080,7 @@ export class Runner {
                 model: prepared.model.id,
                 unpricedSpend: rs.telemetry.unpricedSpend,
                 rewindNotes: prepared.rewindNotes,
+                editedFiles: prepared.editedFilesSnapshot(),
                 haltedOnUserRejection: prepared.batchHaltRef.current !== undefined,
                 userHalted: loopLatch.userHalted,
                 strandedHumanAnswers,

package/dist/core/sensitive-path-policy.d.ts

@@ -15,12 +15,22 @@ import type { ToolPolicy } from "./tool-policy.js";
  * segments is a wiring ERROR (it would guard nothing) and throws rather than being dropped.
  * Remember this policy guards WRITES only; reads are out of scope by design.
  *
- * NOT listed, deliberately (HRD-PRM-10): sema's own data root (`$AGENT_DATA_DIR ?? ~/.ai-agent`). Its
- * `sessions/` subtree is already owned by `createTranscriptIntegrityPolicy`, which is wired ALWAYS-ON by
- * the runner and answers `ask` — the design's deliberate verdict, since «reading transcripts is routine»
- * and a legitimate operator write must remain clearable by judgment. A deny here would outrank that ask
- * under the deny > ask > allow fold and silently convert it into a hard refusal for every deployment
- * that wires this list.
+ * HRD-PRM-10 — sema's own data root (`$AGENT_DATA_DIR ?? ~/.ai-agent`) is excluded BY CONSTRUCTION,
+ * not by the absence of an entry. The exclusion used to be "just don't add a pattern that names it",
+ * which held only as long as no entry happened to match one of its ANCESTOR segments. That assumption
+ * died the moment the shell's own config root joined the list: the shell sets
+ * `AGENT_DATA_DIR = <configRoot>/engine-data` with a configRoot of `~/.sema`, so every path under the
+ * data root carries a `.sema` segment, and a pattern guarding the config root swallowed the whole data
+ * root with it — including the memory library the model is INSTRUCTED to write with the Write tool
+ * (`MEMORY_INSTRUCTION_TEMPLATE`), i.e. every memory write refused, on a default server wiring.
+ * So the exclusion is now mechanical: a target INSIDE the data root is matched on its path RELATIVE to
+ * that root (see {@link createSensitivePathPolicy}'s `dataRoot`), so the root's own ancestry is not the
+ * target's business, while a genuinely sensitive path INSIDE it (`<dataRoot>/x/.ssh/id_rsa`) still
+ * matches. The `sessions/` subtree keeps its own owner: `createTranscriptIntegrityPolicy` is wired
+ * ALWAYS-ON by the runner and answers `ask` — the design's deliberate verdict, since «reading
+ * transcripts is routine» and a legitimate operator write must remain clearable by judgment — and a
+ * deny here would outrank that ask under the deny > ask > allow fold and silently convert it into a
+ * hard refusal for every deployment that wires this list.
  */
 export declare const RECOMMENDED_SENSITIVE_PATTERNS: readonly string[];
 /**
@@ -46,6 +56,17 @@ export declare function createSensitivePathPolicy(opts: {
     /** `readonly` accepted so {@link RECOMMENDED_SENSITIVE_PATTERNS} can be passed as-is (widening, non-breaking). */
     patterns: readonly string[];
     rootPath?: string;
+    /**
+     * HRD-PRM-10 — the engine data root this deployment runs on. Default
+     * `$AGENT_DATA_DIR ?? ~/.ai-agent`, the same resolution
+     * {@link import("./tool-policy.js").createTranscriptIntegrityPolicy} performs for its own default.
+     * A target inside it is judged on its path RELATIVE to it, so the root's own ancestor segments
+     * (`.sema`, when a deployment sites its data root under its config root) cannot make the whole
+     * subtree — the memory library the model is instructed to WRITE included — read as a guarded path.
+     * Pass it explicitly whenever the deployment passes `memoryEngineDir`/a custom data root, so this
+     * gate and the transcript gate keep speaking about the same directory.
+     */
+    dataRoot?: string;
     /** Override the guarded tool set (default: `Write`, `Edit`, `MultiEdit`-legacy → Edit, `NotebookEdit`). */
     tools?: string[];
 }): ToolPolicy;