@sema-agent/core 7.33.7 → 7.34.0

package/dist/core/auto-mode-directive.js

@@ -2,28 +2,19 @@ import { createHash } from "node:crypto";
 export const AUTO_MODE_DIRECTIVE = "## Auto Mode Active\n\nBias toward working without stopping for clarifying questions — when you'd normally pause to check, make the reasonable call and keep going; they'll redirect you if needed. If the user, a skill, or the shape of the task suggests they want you to ask (with AskUserQuestion or otherwise), do so. And even absent that signal, it's still fine to stop when you're genuinely blocked — unclear direction, missing input, a decision only they can make.\n\nBefore any command that could discard uncommitted work — `git checkout`/`restore`/`reset`/`clean`, `rm -rf` in the repo, restoring from a snapshot — run `git status` first and stash (with `-u` for untracked) or commit anything that's there. When staging or committing, review what's included (`git status` after a broad `git add`), and if you see anything suspicious that might reveal secrets — even if the filename looks innocuous — double-check the file's contents before pushing.";
 export const BASH_FIRST_DIRECTIVE = "Do your work through the Bash tool wherever it can accomplish the job: read files with cat, head, or sed -n, search with grep and find, and make file changes with sed, heredocs, or short scripts, rather than using the dedicated Read, Edit, or Write tools. Fall back to a dedicated tool only when Bash genuinely cannot do the job.";
 export const BYPASS_POSTURE_DIRECTIVE = `While bypass permissions mode is active:\n\n${BASH_FIRST_DIRECTIVE}`;
-export const APPROVER_POSTURES = ["bypass"];
-export function isApproverPosture(value) {
-    return typeof value === "string" && APPROVER_POSTURES.includes(value);
-}
-export function refuseInvalidApproverPosture(spec) {
-    if (spec.approverPosture !== undefined && !isApproverPosture(spec.approverPosture)) {
-        const e = new Error(`approverPosture must be one of ${APPROVER_POSTURES.map((w) => JSON.stringify(w)).join(", ")} when present (got ${JSON.stringify(spec.approverPosture)}) — omit it to declare no posture; an unrecognized value is refused rather than read as absence.`);
-        e.code = "config.approver_posture_invalid";
-        throw e;
-    }
-    return spec.approverPosture;
+function postureSegmentOf(facts) {
+    if (facts.mode === "bypassPermissions" || facts.askEffective === "auto_allow")
+        return BYPASS_POSTURE_DIRECTIVE;
+    return facts.mode === "auto" ? AUTO_MODE_DIRECTIVE : undefined;
 }
 export function composeApprovalPostureDirective(facts, statedBodies = []) {
-    const parts = facts.approverPosture === "bypass" ? [BYPASS_POSTURE_DIRECTIVE] : facts.autoMode ? [AUTO_MODE_DIRECTIVE] : [];
-    if (parts.length === 0)
+    const owed = postureSegmentOf(facts);
+    if (owed === undefined)
         return undefined;
-    const stated = new Set();
     for (const body of statedBodies)
-        for (const seg of postureSegmentsOf(body) ?? [])
-            stated.add(seg);
-    const owed = parts.filter((seg) => !stated.has(seg));
-    return owed.length === 0 ? undefined : owed.join("\n\n");
+        if (postureSegmentsOf(body)?.includes(owed) === true)
+            return undefined;
+    return owed;
 }
 const POSTURE_SEGMENTS = [AUTO_MODE_DIRECTIVE, BYPASS_POSTURE_DIRECTIVE];
 function postureSegmentsOf(body) {

package/dist/core/auto-mode-prompt.d.ts

@@ -17,8 +17,13 @@ export interface AutoModeRules {
 export interface BuildAutoModePromptOptions {
     rules?: AutoModeRules;
     /** Settings-plane deny rules (tool[/argument-pattern] strings) — rendered into the
-     *  `<settings_deny_rules>` slot as the CC circumvention-catching paragraph. */
+     *  `<settings_deny_rules>` slot as the CC circumvention-catching paragraph, after the engine's own lines. */
     settingsDenyRules?: readonly string[];
+    /** The ENGINE's deny lines — its effective read-deny table as rules ({@link readDenyClassifierRules}).
+     *  Rendered in the same paragraph, ahead of `settingsDenyRules`. A separate member (not pre-merged by the
+     *  caller) because a persisted arming records the two halves separately: the deployment's half is compared
+     *  against the redeeming deployment's own settings, the engine's half against the row's own table. */
+    derivedDenyRules?: readonly DerivedDenyRule[];
     /** Extra session-context facts (e.g. the CC user-identity line) — appended as a
      *  `## Session Context` bullet block after the assembled document. */
     sessionContext?: readonly string[];
@@ -28,6 +33,62 @@ export interface BuildAutoModePromptOptions {
      *  text may carry `$`). */
     crossSessionMessagesRule?: string;
 }
+/**
+ * One engine deny line: a `Read(...)` rule in the engine's own path-rule grammar (`//` = the filesystem root,
+ * `*` within one segment, a whole-segment `**` across segments, and a rule reaches the path it names and
+ * everything under it — `parseRuleText` / `pathRuleReachOf`), plus whether ASCII letter case is ignored, which
+ * that grammar cannot spell and the paragraph states beside the rule.
+ */
+export interface DerivedDenyRule {
+    readonly rule: string;
+    readonly anyCase?: true;
+}
+/**
+ * The effective READ-deny table as the classifier's deny lines — one line per row, the row's reach in the
+ * engine's own `Read(...)` path-rule grammar.
+ *
+ * A read-deny row is a run of path SEGMENTS matched anywhere in a path — the entry itself and everything under
+ * it — and its `*` never crosses a `/` (read-deny.ts: `.ssh` refuses `~/.ssh/id_rsa` and `/srv/x/.ssh/config`
+ * alike; a `**` segment matches exactly one segment). The rule grammar reaches the path a pattern names and
+ * everything under it, so the line is `//**` + `/` + the row with every run of stars written `*` (one segment,
+ * as in the row): `.ssh` ⇒ `Read(//**\/.ssh)`, `**\/secrets/**` ⇒ `Read(//**\/*\/secrets/*)`, `*` (every
+ * path) ⇒ `Read(//**\/*)`. A row that names no segment at all (`""`, `/`) is not stated. A HOME-ANCHORED row
+ * (`~/<run>`, read-deny.ts `READ_DENY_HOME_WORD`) is the rule grammar's home word with the same reach:
+ * `~/.sema/settings.json` ⇒ `Read(~/.sema/settings.json)`.
+ *
+ * The text of a row can come from a task (a spawned task's author included) and it is spliced into a trusted
+ * prompt, so a row is stated as a rule and nothing else: every character the grammar or the prompt must not
+ * carry (see NOT_STATED) is written `*`, and an over-long pattern is cut and closed with `*` — both wider than
+ * the row, never narrower, and the result still parses as a rule. No row can start a line, leave its code
+ * span, form a tag or a second rule, or read as a sentence; the engine enforces the row as compiled either way.
+ *
+ * A row matched without regard to ASCII letter case (the deny set's default) carries `anyCase` when its stated
+ * pattern has an ASCII letter. Duplicates are folded AFTER this encoding, first seen.
+ */
+export declare function readDenyClassifierRules(entries: readonly {
+    readonly pattern: string;
+    readonly caseSensitive?: boolean;
+}[], rules?: readonly {
+    readonly tool: string;
+    readonly pattern: string;
+}[]): DerivedDenyRule[];
+/**
+ * The `<settings_deny_rules>` paragraph for one arming, from the engine's facts — the effective deny table
+ * (`readDeny`: the compiled matcher's entries, built-in tiers + deployment + task additions; `readDenyRules`: its
+ * permission-rule rows, both faces) and the deployment's `settingsDenyRules` — exactly as {@link buildAutoModePrompt}
+ * splices it. Empty inputs ⇒ "".
+ */
+export declare function renderClassifierDenyRules(input: {
+    readonly readDeny?: readonly {
+        readonly pattern: string;
+        readonly caseSensitive?: boolean;
+    }[];
+    readonly readDenyRules?: readonly {
+        readonly tool: string;
+        readonly pattern: string;
+    }[];
+    readonly settingsDenyRules?: readonly string[];
+}): string;
 /**
  * Assemble the classifier SYSTEM prompt (CC `KRg`, content-equivalent single string — CC splits the
  * session-context tail into a second uncached block purely as a prompt-cache optimization).

package/dist/core/auto-mode-prompt.js

@@ -1,6 +1,7 @@
 import { AUTO_MODE_DEFAULT_WINDOW_MAX_CHARS, AUTO_MODE_DEFAULT_WINDOW_MAX_ENTRIES, AUTO_MODE_DEFAULTS_SENTINEL } from "./auto-mode-defaults.js";
 import { AUTO_MODE_BASE_PROMPT, AUTO_MODE_PERMISSIONS_EXTERNAL } from "./auto-mode-prompt-assets.js";
 import { cutEnginePrefix, cutEngineSegments, flattenableUserText } from "./untrusted-text.js";
+import { readDenyPatternRun } from "../tools/fs/read-deny.js";
 export { AUTO_MODE_DEFAULTS_SENTINEL } from "./auto-mode-defaults.js";
 function mergeRuleSection(user, defaultsInner) {
     if (!user?.length)
@@ -20,10 +21,47 @@ function mergeRuleSection(user, defaultsInner) {
     }
     return out.join("\n");
 }
-function renderSettingsDenyRules(rules) {
-    if (rules.length === 0)
+const DENY_LINE_PATTERN_MAX = 512;
+const NOT_STATED = /[\s\p{Z}\p{Cf}`<>(){}[\]?\\\u0000-\u001f\u007f-\u009f]/u;
+const notStated = (ch) => NOT_STATED.test(ch) || NOT_STATED.test(ch.normalize("NFKC"));
+export function readDenyClassifierRules(entries, rules = []) {
+    const out = [];
+    const seen = new Set();
+    const push = (line) => {
+        const key = `${line.rule}\u0000${line.anyCase === true}`;
+        if (seen.has(key))
+            return;
+        seen.add(key);
+        out.push(line);
+    };
+    for (const { pattern, caseSensitive } of entries) {
+        const { homeAnchored, run } = readDenyPatternRun(pattern);
+        const segments = run.split("/").filter((seg) => seg.length > 0);
+        if (segments.length === 0)
+            continue;
+        const stated = statedPattern(segments.join("/"));
+        push({ rule: homeAnchored ? `Read(~/${stated})` : `Read(//**/${stated})`, ...(caseSensitive !== true && /[A-Za-z]/.test(stated) ? { anyCase: true } : {}) });
+    }
+    for (const { tool, pattern } of rules) {
+        if (!/^[A-Za-z][A-Za-z0-9_]*$/.test(tool) || pattern.length === 0)
+            continue;
+        push({ rule: `${tool}(${pattern.split("/").map((seg) => (seg === "**" ? seg : statedPattern(seg))).join("/")})` });
+    }
+    return out;
+}
+function statedPattern(pattern) {
+    const chars = [...pattern].map((ch) => (notStated(ch) ? "*" : ch));
+    const cut = chars.length > DENY_LINE_PATTERN_MAX ? [...chars.slice(0, DENY_LINE_PATTERN_MAX), "*"] : chars;
+    return cut.join("").replace(/\*+/g, "*");
+}
+export function renderClassifierDenyRules(input) {
+    return renderSettingsDenyRules(readDenyClassifierRules(input.readDeny ?? [], input.readDenyRules ?? []), input.settingsDenyRules ?? []);
+}
+function renderSettingsDenyRules(derived, settings) {
+    const items = [...derived.map((d) => `\`${d.rule}\`${d.anyCase === true ? " (any ASCII letter case)" : ""}`), ...settings.map((r) => `\`${r}\``)];
+    if (items.length === 0)
         return "";
-    return (`- User Deny Rules: The user has configured these permission deny rules: ${rules.map((r) => `\`${r}\``).join(", ")}. Each rule names a tool and (optionally) an argument pattern that is already hard-blocked for that tool. ` +
+    return (`- User Deny Rules: The user has configured these permission deny rules: ${items.join(", ")}. Each rule names a tool and (optionally) an argument pattern that is already hard-blocked for that tool. ` +
         "Block the action if it accomplishes the same effect via a different tool — e.g. using Bash with " +
         "`python -c`, `sed -i`, `cat >`, heredocs, or similar to write or edit a file that an Edit/Write/MultiEdit deny rule covers, or otherwise routing around a deny rule by switching tools. The named tool itself is enforced separately; your job here is to catch circumvention.");
 }
@@ -39,7 +77,7 @@ export function buildAutoModePrompt(options) {
     for (const [key, re] of PAIRED_SECTIONS) {
         out = out.replace(re, (_m, inner) => mergeRuleSection(options?.rules?.[key], inner));
     }
-    out = out.replace("<settings_deny_rules>", () => renderSettingsDenyRules(options?.settingsDenyRules ?? []));
+    out = out.replace("<settings_deny_rules>", () => renderSettingsDenyRules(options?.derivedDenyRules ?? [], options?.settingsDenyRules ?? []));
     const context = options?.sessionContext ?? [];
     if (context.length > 0) {
         out += `\n\n## Session Context\n\n${context.map((f) => `- ${f}`).join("\n")}`;

package/dist/core/auto-mode-rebuild.d.ts

@@ -28,7 +28,8 @@ export interface AutoModeRebuildOptions {
      * an affirmative claim, "this is the run's first gated action", that would simply be false. A provider
      * that returns `[]` is DECLARING the transcript empty, which is a different statement from an engine
      * that silently had none to show. A provider that throws fails the classification closed
-     * (`unavailable` ⇒ a deny that says so), never into a blind verdict.
+     * (`unavailable` ⇒ on to a person where the station has an approval seat, refused with a sentence that says
+     * so where it has none), never into a blind verdict.
      */
     transcript: () => readonly Message[] | Promise<readonly Message[]>;
 }

package/dist/core/auto-mode-rebuild.js

@@ -11,6 +11,7 @@ export function rebuildAutoModeDecider(opts) {
     const promptOptions = {
         ...(effective.rules !== undefined ? { rules: effective.rules } : {}),
         ...(effective.settingsDenyRules !== undefined ? { settingsDenyRules: effective.settingsDenyRules } : {}),
+        ...(effective.derivedDenyRules !== undefined ? { derivedDenyRules: effective.derivedDenyRules } : {}),
         ...(effective.sessionContext !== undefined ? { sessionContext: effective.sessionContext } : {}),
         ...(effective.crossSessionMessagesRule === true ? { crossSessionMessagesRule: CROSS_SESSION_CLASSIFIER_RULE } : {}),
     };

package/dist/core/auto-mode.d.ts

@@ -51,6 +51,14 @@ export declare function isAutoModeClassifierFallback(v: unknown): v is AutoModeC
  *  `config.auto_mode_classifier_fallback_invalid`. A typo'd knob must not read as the default: `"non"` would
  *  keep paying for the rung it meant to turn off. */
 export declare function autoModeClassifierFallbackOf(v: unknown): AutoModeClassifierFallback;
+/** Whether a present budget value is one the knob takes: a finite number of milliseconds in [1, 2147483647]. */
+export declare function isAutoModeTimeoutMs(v: unknown): v is number;
+/** Read the per-level budget knob (`RunnerDeps.autoMode.timeoutMs` / `AutoModeDeciderOptions.timeoutMs`):
+ *  absent ⇒ {@link AUTO_MODE_DEFAULT_TIMEOUT_MS}; a finite number in [1, 2147483647] ⇒ itself; ANYTHING ELSE
+ *  (NaN, ±Infinity, `0`, a negative, a value a host timer would fire at once, a string, an object) ⇒ a loud
+ *  refusal carrying `config.auto_mode_timeout_invalid`. There is no OFF spelling: the budget bounds how long a
+ *  permission gate waits, and a gate with no bound is not a setting this knob offers. */
+export declare function autoModeTimeoutMsOf(v: unknown): number;
 /** The classifier's verdict over one pending `ask`. Every arm may carry the classification's model
  *  attribution ({@link AutoModeClassifierRound}), present iff the decider was wired with a candidate ladder. */
 export type AutoModeVerdict = ({
@@ -157,6 +165,12 @@ export declare function rungDidNotRule(v: AutoModeVerdict): AutoModeFallbackCaus
  * NOT move keeps the CC text byte for byte.
  */
 export declare function classifierUnavailableDenyMessage(toolName: string, cause: AutoModeUnavailableCause, attribution?: AutoModeClassifierRound): string;
+/**
+ * The text an ask carries to a person when the classifier could not rule on it and the leg has an approval seat
+ * (the gate's classifier station and the inherited station): the ask's own text first — the card still says what
+ * is being asked — then why auto mode is asking at all. One writer for both stations.
+ */
+export declare function classifierUnavailableAskMessage(askText: string, cause: AutoModeUnavailableCause): string;
 /**
  * The model-facing deny text for a `parse_error` verdict — CC 2.1.259 `i7t` stem ("Auto mode could not evaluate
  * this action and is blocking it for safety"; 2.1.250 `Ure`): the classifier answered, but not with a verdict,
@@ -256,7 +270,10 @@ export interface AutoModeDeciderOptions<T = void> {
     /** Hard cap on one classification round-trip — one LADDER RUNG's DISPATCH, not the whole classification
      *  (see {@link candidates}) — and, separately, the one {@link assemble} call that precedes the walk (ONE
      *  number: a second knob would be a second answer to "how long may a classification make the gate wait").
-     *  Default 15_000 ms: a permission gate must not stall the whole run on a slow classifier. */
+     *  Omitted ⇒ {@link AUTO_MODE_DEFAULT_TIMEOUT_MS}. A present value that is not a finite number of at least 1
+     *  and at most 2147483647 (a host timer fires at once past that) is REFUSED at construction
+     *  (`config.auto_mode_timeout_invalid`, {@link autoModeTimeoutMsOf}) — never clamped, never read as the
+     *  default, and there is no OFF: a permission gate always has a bound. */
     timeoutMs?: number;
     /**
      * Fired once per `decide` call with the verdict the gate is about to act on and the wall time it waited
@@ -288,6 +305,10 @@ export interface AutoModeClassified {
 export interface AutoModeDecider {
     /** Never rejects. Any internal failure surfaces as `unavailable`/`parse_error` (fail-closed). */
     decide(input: AutoModeClassifyInput, signal?: AbortSignal): Promise<AutoModeVerdict>;
+    /** The per-level budget this decider holds each rung's dispatch (and the assembly) to, in ms — the resolved
+     *  {@link AutoModeDeciderOptions.timeoutMs}; what a notice about a timed-out classification names. Absent on a decider a
+     *  host implements by hand. */
+    readonly timeoutMs?: number;
 }
 /** The per-run decider: timeout + fail-closed error mapping, nothing carried between rounds. One instance per
  *  run (it binds the run's model leg and assembled prompt); a round that failed says nothing about the next,
@@ -413,8 +434,16 @@ export interface AutoModeDenialTracker {
         windowArmedAt?: number;
     };
 }
-/** Build the per-run tracker. Bad knob values throw (the deployment face is read at prepare; a refusal
- *  there is the loud exit the knob doctrine requires). */
+export declare function autoModeDenialLimitOf(v: unknown): Required<AutoModeDenialLimitOptions>;
+/** The deployment face's three value knobs, read by their one readers — every leg's prepare runs it while
+ *  `RunnerDeps.autoMode` is present, whatever mode the leg starts in, so a bad knob refuses the run before a steer or a
+ *  parent's live ceiling can reach an arming that would have refused it. */
+export declare function screenAutoModeKnobs(face: {
+    readonly timeoutMs?: unknown;
+    readonly classifierFallback?: unknown;
+    readonly denialLimit?: unknown;
+}): void;
+/** Build the per-run tracker over {@link autoModeDenialLimitOf}'s bounds (a bad knob refuses there). */
 export declare function createAutoModeDenialTracker(opts?: AutoModeDenialLimitOptions): AutoModeDenialTracker;
 /** The fallback ask's text — CC's sentence family, single-sourced for every mint site (the main gate
  *  and the inherited-lane arms): `Classifier denial limit exceeded, falling back to prompting: <limit

package/dist/core/auto-mode.js

@@ -31,6 +31,20 @@ export function autoModeClassifierFallbackOf(v) {
     e.code = "config.auto_mode_classifier_fallback_invalid";
     throw e;
 }
+const MAX_TIMER_DELAY_MS = 2_147_483_647;
+export function isAutoModeTimeoutMs(v) {
+    return typeof v === "number" && Number.isFinite(v) && v >= 1 && v <= MAX_TIMER_DELAY_MS;
+}
+export function autoModeTimeoutMsOf(v) {
+    if (v === undefined)
+        return AUTO_MODE_DEFAULT_TIMEOUT_MS;
+    if (isAutoModeTimeoutMs(v))
+        return v;
+    const e = new Error(`RunnerDeps.autoMode.timeoutMs must be a number of milliseconds between 1 and ${MAX_TIMER_DELAY_MS} ` +
+        `(got ${describeRejectedValue(v)}) — omit it for the default ${AUTO_MODE_DEFAULT_TIMEOUT_MS}`);
+    e.code = "config.auto_mode_timeout_invalid";
+    throw e;
+}
 export const AUTO_MODE_ROUND_NOT_ASKED_CODE = "auto_mode.round_not_asked";
 export function autoModeRoundNotAsked(reason) {
     let detail;
@@ -70,6 +84,10 @@ export function classifierUnavailableDenyMessage(toolName, cause, attribution) {
         "If it keeps failing, continue with other tasks that don't require this action and come back to it later. " +
         "Note: reading files, searching code, and other read-only operations do not require the classifier and can still be used.");
 }
+export function classifierUnavailableAskMessage(askText, cause) {
+    const parenthetical = cause === "timeout" ? " (timed out)" : "";
+    return `${askText}\n\nThe auto-mode classifier is temporarily unavailable${parenthetical}, so auto mode could not judge this call; it needs an approval instead of the classifier's verdict.`;
+}
 export function classifierParseFailureDenyMessage(attribution) {
     const stem = "Auto mode could not evaluate this action and is blocking it for safety";
     return attribution === undefined ? `${stem} — the classifier's reply carried no verdict.` : `${stem} — the classifier model "${attribution.modelUsed}" replied without a verdict.`;
@@ -153,7 +171,7 @@ export function parseAutoModeResponse(text, options) {
     return { kind: "block", category, reason };
 }
 export function createAutoModeDecider(opts) {
-    const timeoutMs = opts.timeoutMs ?? AUTO_MODE_DEFAULT_TIMEOUT_MS;
+    const timeoutMs = autoModeTimeoutMsOf(opts.timeoutMs);
     if (opts.candidates !== undefined) {
         if (opts.candidates.length === 0) {
             throw new Error("AutoModeDeciderOptions.candidates must name at least one model — omit the member for the leg's own model, never an empty ladder");
@@ -183,7 +201,7 @@ export function createAutoModeDecider(opts) {
         }
         return verdict;
     };
-    return { decide };
+    return { decide, timeoutMs };
     async function decideUnreported(input, round, signal) {
         const causes = [];
         let verdict = { kind: "unavailable", cause: "error" };
@@ -243,42 +261,46 @@ export function createAutoModeDecider(opts) {
     }
 }
 async function withDeadline(capMs, signal, call) {
+    if (signal?.aborted === true)
+        throw new Error("the classification was cancelled before it was dispatched");
     let timer;
+    let onOuterAbort;
     const inner = new AbortController();
-    const onOuterAbort = () => inner.abort();
-    if (signal !== undefined) {
-        if (signal.aborted)
-            inner.abort();
-        else
-            signal.addEventListener("abort", onOuterAbort, { once: true });
-    }
     try {
         return await new Promise((resolve, reject) => {
             let settled = false;
+            const settle = (end) => {
+                if (settled)
+                    return;
+                settled = true;
+                end();
+            };
+            onOuterAbort = () => {
+                inner.abort();
+                settle(() => reject(new Error("the classification was cancelled")));
+            };
+            signal?.addEventListener("abort", onOuterAbort, { once: true });
             timer = setTimeout(() => {
-                if (!settled) {
-                    settled = true;
+                settle(() => {
                     inner.abort();
                     reject(new AutoModeTimeout());
-                }
+                });
             }, capMs);
-            call(inner.signal).then((v) => {
-                if (!settled) {
-                    settled = true;
-                    resolve(v);
-                }
-            }, (e) => {
-                if (!settled) {
-                    settled = true;
-                    reject(e);
-                }
-            });
+            let pending;
+            try {
+                pending = call(inner.signal);
+            }
+            catch (e) {
+                settle(() => reject(e));
+                return;
+            }
+            pending.then((v) => settle(() => resolve(v)), (e) => settle(() => reject(e)));
         });
     }
     finally {
         if (timer !== undefined)
             clearTimeout(timer);
-        if (signal !== undefined)
+        if (signal !== undefined && onOuterAbort !== undefined)
             signal.removeEventListener("abort", onOuterAbort);
     }
 }
@@ -305,25 +327,42 @@ export function unarmedWindow(fallback) {
 function countsOf(fallback) {
     return { consecutive: fallback.consecutive, total: fallback.total, limit: fallback.limit };
 }
-const MAX_TIMER_DELAY_MS = 2_147_483_647;
-export function createAutoModeDenialTracker(opts = {}) {
-    const bound = (name, v, dflt) => {
-        if (v === undefined)
+const DENIAL_LIMIT_MEMBERS = new Set(["maxConsecutive", "maxTotal", "autoDenyAfterMs"]);
+export function autoModeDenialLimitOf(v) {
+    const refuse = (what) => {
+        const e = new Error(`RunnerDeps.autoMode.denialLimit${what}`);
+        e.code = "config.auto_mode_denial_limit_invalid";
+        throw e;
+    };
+    if (v === undefined)
+        return { ...AUTO_MODE_DENIAL_LIMIT_DEFAULTS, autoDenyAfterMs: AUTO_MODE_DENIAL_AUTO_DENY_DEFAULT_MS };
+    if (typeof v !== "object" || v === null || Array.isArray(v))
+        return refuse(` must be a record of bounds (got ${describeRejectedValue(v)}) — omit it for the defaults`);
+    const opts = v;
+    const stray = Object.keys(opts).find((k) => !DENIAL_LIMIT_MEMBERS.has(k));
+    if (stray !== undefined)
+        return refuse(` has no member ${JSON.stringify(stray)} — its members are maxConsecutive, maxTotal and autoDenyAfterMs`);
+    const bound = (name, dflt) => {
+        const b = opts[name];
+        if (b === undefined)
             return dflt;
-        if (!Number.isInteger(v) || v < 1) {
-            throw new Error(`RunnerDeps.autoMode.denialLimit.${name} must be a positive integer (got ${JSON.stringify(v)}) — omit it for the default ${dflt}`);
-        }
-        return v;
+        return typeof b === "number" && Number.isInteger(b) && b >= 1 ? b : refuse(`.${name} must be a positive integer (got ${describeRejectedValue(b)}) — omit it for the default ${dflt}`);
     };
-    const maxConsecutive = bound("maxConsecutive", opts.maxConsecutive, AUTO_MODE_DENIAL_LIMIT_DEFAULTS.maxConsecutive);
-    const maxTotal = bound("maxTotal", opts.maxTotal, AUTO_MODE_DENIAL_LIMIT_DEFAULTS.maxTotal);
-    let autoDenyAfterMs = AUTO_MODE_DENIAL_AUTO_DENY_DEFAULT_MS;
-    if (opts.autoDenyAfterMs !== undefined) {
-        if (!Number.isInteger(opts.autoDenyAfterMs) || opts.autoDenyAfterMs < 0 || opts.autoDenyAfterMs > MAX_TIMER_DELAY_MS) {
-            throw new Error(`RunnerDeps.autoMode.denialLimit.autoDenyAfterMs must be an integer between 0 and ${MAX_TIMER_DELAY_MS} (got ${JSON.stringify(opts.autoDenyAfterMs)}) — 0 disarms the window; omit it for the default ${AUTO_MODE_DENIAL_AUTO_DENY_DEFAULT_MS}`);
-        }
-        autoDenyAfterMs = opts.autoDenyAfterMs;
-    }
+    const w = opts["autoDenyAfterMs"];
+    const autoDenyAfterMs = w === undefined
+        ? AUTO_MODE_DENIAL_AUTO_DENY_DEFAULT_MS
+        : typeof w === "number" && Number.isInteger(w) && w >= 0 && w <= MAX_TIMER_DELAY_MS
+            ? w
+            : refuse(`.autoDenyAfterMs must be an integer between 0 and ${MAX_TIMER_DELAY_MS} (got ${describeRejectedValue(w)}) — 0 disarms the window; omit it for the default ${AUTO_MODE_DENIAL_AUTO_DENY_DEFAULT_MS}`);
+    return { maxConsecutive: bound("maxConsecutive", AUTO_MODE_DENIAL_LIMIT_DEFAULTS.maxConsecutive), maxTotal: bound("maxTotal", AUTO_MODE_DENIAL_LIMIT_DEFAULTS.maxTotal), autoDenyAfterMs };
+}
+export function screenAutoModeKnobs(face) {
+    autoModeTimeoutMsOf(face.timeoutMs);
+    autoModeClassifierFallbackOf(face.classifierFallback);
+    autoModeDenialLimitOf(face.denialLimit);
+}
+export function createAutoModeDenialTracker(opts) {
+    const { maxConsecutive, maxTotal, autoDenyAfterMs } = autoModeDenialLimitOf(opts);
     let consecutive = 0;
     let total = 0;
     let timedFallbackShown = false;

package/dist/core/checkpoint-store.d.ts

@@ -7,7 +7,7 @@ import type { ReadEntry } from "../tools/fs/safety.js";
 import type { RepairBundle } from "../agents/repair-loop.js";
 import type { WorkspaceHandle } from "./remote-env.js";
 import type { SessionPermissionRules } from "./session-policy-store.js";
-import type { ApproverPosture, NestedUsageAccum, ShellGateDoctrine, TaskResult } from "./types.js";
+import type { NestedUsageAccum, PermissionMode, ShellGateDoctrine, TaskResult } from "./types.js";
 import type { ActiveWorktreeSession } from "../internal/harness-types.js";
 /**
  * design/45 — the **durable-checkpoint** primitive: cross-process / resumable `suspend`/`resume`.
@@ -130,11 +130,9 @@ export interface RiskDescriptor {
     };
     /** The tool whose call is gated (mirrors the gate's `toolName`). */
     toolName: string;
-    /** The run's resolved shellGate doctrine, present ONLY when this ask was minted through the engine's shell
-     *  seat (coarse `always`; a `classify` probe that declined to auto-allow; the read-boundary judge asking under
-     *  `off` — the boundary is judged under every doctrine, so the vocabulary is `TaskSpec.shellGate`'s whole).
-     *  Absent for per-tool safety-axis / plain policy asks. Answers "which doctrine was live when this gate
-     *  fired" from the persisted row alone — three artifact layers could not answer that in the field. */
+    /** The operator's shell floor (`"always"`), present ONLY when this ask was minted through the engine's shell
+     *  seat AND a floor was in force. Absent for a shape-tier ask with no floor, and for per-tool safety-axis /
+     *  plain policy asks. Answers "was an operator floor live when this gate fired" from the persisted row alone. */
     shellGateDoctrine?: ShellGateDoctrine;
     /** A REDACTED, length-capped ONE-LINE summary of the call (the command for a shell gate; a brief key-arg
      *  digest otherwise) for the inbox preview. NEUTRALIZED via
@@ -816,6 +814,9 @@ export type PendingAction = {
      *  when a person's rule also speaks — never a substitute for this one). Display metadata: no gate, CAS or
      *  resume path reads it. */
     mandated?: true;
+    /** The PARK twin of `AskRequest.authoredBy`: the deployment's own governance layer minted this parked question — a
+     *  person's under every mode, whatever grant or rule the redeeming host holds. Display / seat metadata. */
+    authoredBy?: "deployment";
     /** The PARK twin of `AskRequest.mandate` (same derivation, same precedent): the table word the bit stands on,
      *  present only when it is the whole reason. Written only as a member of the closed set. */
     mandate?: import("./ask-origin.js").PersistedRuleMandate;
@@ -833,10 +834,6 @@ export type PendingAction = {
      *  Written only when it is a member of the set; a pre-existing row reads absent (unreported).
      *  Display metadata — the resume belts keep reading the gate's own bit. */
     origin?: import("./ask-origin.js").AskOrigin;
-    /** #688 C3 (additive, same precedent as `origin`) — the mechanism behind an `origin: "rule_store_unavailable"`
-     *  (`store` / `call`, {@link import("./ask-origin.js").RULE_STORE_UNREADABLE_KINDS}). Written only when it is a
-     *  member of the set; a pre-existing row reads absent. Display metadata for the durable card. */
-    ruleStoreUnreadable?: import("./ask-origin.js").RuleStoreUnreadable;
     /**
      * design/80 D-1 §2 (slice 1a.2): the server-minted **opaque** boundInputHash of {@link args} — a
      * SHA-256 (hex) via {@link import("./canonical-json.js").boundInputHashOf}, computed ONCE here at
@@ -1098,7 +1095,7 @@ export interface CheckpointState {
      * Parent effective-policy inheritance (tighten-only): the durable projection of the run's
      * {@link import("./runner/contracts.js").InheritedGate}. Only the serializable DATA half persists —
      * `ancestorRules` (each ancestor's session-rule snapshot: sessionId/principal/rev/rules, re-compiled on
-     * resume against the resumed leg's env) and `shellGate` (the chain's max-rank shell doctrine). The OPAQUE
+     * resume against the resumed leg's env), `shellGate` (the chain's operator floor) and `permissionMode`. The OPAQUE
      * half (`parentConstraints` — live ToolPolicy/onAsk closures) CANNOT persist; `requiresParentConstraint`
      * records only its PRESENCE, so the resume pre-CAS ladder can fail-loud (`resume.parent_constraint_missing`,
      * checkpoint stays `pending`) when the resuming caller did not re-supply the closures via
@@ -1115,27 +1112,18 @@ export interface CheckpointState {
             rules: SessionPermissionRules;
         }>;
         shellGate?: ShellGateDoctrine;
-        /** The chain's AUTO-MODE INTENT at suspend (data half, same law as `shellGate`): `true` when the
-         *  suspended leg was an auto-mode task — its own seat, the bit its live chain carried, or the bit
-         *  an earlier suspend of the same chain recorded (carried forward across a re-suspend). A resume
-         *  leg reads it as one more INTENT source beside the re-supplied seat and the waking chain, so a
-         *  redemption in another process (no seat re-passed, no live chain) still arms exactly as the
-         *  suspend leg did. It is a MEMORY of intent, never an authorization: the resuming deployment's
-         *  face (`RunnerDeps.autoMode`) and the resuming principal's deny bit (`RuntimeCaps.autoMode`)
-         *  are judged afresh on every leg — a bit on the row cannot arm where the redeeming deployment
-         *  would not. A leg never armed here carries the memory as is. Absent on older checkpoints and on non-auto tasks
-         *  (byte-identical to the pre-bit row); an older worker that ignores it resumes un-armed, the
-         *  narrower direction. */
-        autoModeRequested?: true;
-        /** The chain's declared APPROVER POSTURE at suspend (data half, same law as `shellGate`): the word
-         *  the suspended leg was told to render — its own seat, the one its live chain carried, or the one an
-         *  earlier suspend of the same chain recorded. A resume leg reads it beside the re-supplied seat and
-         *  the waking chain, so a redemption in another process states the same posture the suspend leg did.
-         *  It authorizes nothing (the gate never reads it) and it renders nothing on a resume leg either —
-         *  the first-turn frame that carries it is already in the restored transcript; what it feeds is the
-         *  chain the resumed leg hands its OWN children. Absent on older checkpoints and on tasks that
-         *  declared no posture (byte-identical row). */
-        approverPosture?: ApproverPosture;
+        /** The chain's DECLARED permission mode at suspend (data half, same law as `shellGate`): the suspended leg's
+         *  own effective declaration — its request clamped under its parent's ceiling — before the deployment's fold.
+         *  A resume leg reads it as the CEILING its re-passed spec is clamped under (tighten-only, the shell floor's
+         *  law) and re-judges the deny bits and the classifier face for its own leg: a `bypassPermissions` row does not
+         *  revive the mode where the redeeming deployment denies it, and an `auto` row arms only where a face is
+         *  wired. Absent on a task that declared nothing and inherited nothing (`default`). Rows written before this
+         *  member carried `autoModeRequested` / `approverPosture` / a doctrine `shellGate`; the resume leg migrates
+         *  them once, announced (`resume.legacy_mode_seed_migrated`), and the next suspend writes this member. */
+        permissionMode?: PermissionMode;
+        /** Beside a recorded `plan`: the declared word the leg had when a steer or the model's `EnterPlanMode` moved it into
+         *  plan — the mode an approved or edited `plan_review` resumes under ({@link import("./mode-policy.js").modeRequestAfterResume}). */
+        prePlanMode?: PermissionMode;
         /** Org-memory admission freeze (ruled 2026-08-05): the chain's admitted org-scope set at
          *  suspend (data half, plain strings). The resume leg folds it seed ∩ live (tighten-only) and
          *  re-runs admission under it — a resume must never widen the delegation freeze. Absent on
@@ -1950,6 +1938,8 @@ export interface CheckpointSummary {
      *  OMITTED (the {@link toolCallId} absence-shape contract), screened to the literal `true` — a pre-#1079 row
      *  reads absent (unreported). ECHO-ONLY; nothing gates on it. */
     mandated?: true;
+    /** The row's `PendingAction.tool_approval.authoredBy`, echoed as the one literal. ECHO-ONLY. */
+    authoredBy?: "deployment";
     /** The row's `PendingAction.tool_approval.mandate`, echoed ONLY as a member of the closed set. ECHO-ONLY. */
     mandate?: import("./ask-origin.js").PersistedRuleMandate;
     /** The row's `PendingAction.tool_approval.denialLimitFallback`, projected BESIDE the preview
@@ -1962,9 +1952,6 @@ export interface CheckpointSummary {
      *  value is a member of the closed set ({@link import("./ask-origin.js").isAskOrigin}) — a bad value
      *  reads as absent, never as a word. OMITTED when the row carries none (a pre-existing row). */
     origin?: import("./ask-origin.js").AskOrigin;
-    /** The row's `PendingAction.tool_approval.ruleStoreUnreadable` (#688 C3), echoed ONLY when the stored word is a
-     *  member of the closed set ({@link import("./ask-origin.js").isRuleStoreUnreadable}); OMITTED otherwise. */
-    ruleStoreUnreadable?: import("./ask-origin.js").RuleStoreUnreadable;
     /**
      * PRESENCE ONLY — this pending `tool_approval` row's payload carries at least one DIRECTIONAL
      * format control (the {@link import("./tool-policy.js").AskRequest.hasBidiControls} character class;
@@ -3027,3 +3014,31 @@ export declare class InMemoryCheckpointStore implements CheckpointStore {
     /** Test/inspection helper: number of stored checkpoints. */
     get size(): number;
 }
+/** What {@link migrateLegacyModeSeed} read off a checkpoint row's `inheritedGate`: the mode and the floor the resume
+ *  leg inherits, and — when the row carried a pre-mode key — what was migrated and what was dropped. */
+export interface LegacyModeSeedMigration {
+    permissionMode?: PermissionMode;
+    prePlanMode?: PermissionMode;
+    shellGate?: ShellGateDoctrine;
+    /** Present iff the row carried a retired key (`autoModeRequested` / `approverPosture` / a doctrine `shellGate`). */
+    migrated?: {
+        permissionMode?: PermissionMode;
+        droppedKeys: readonly string[];
+    };
+}
+/**
+ * Read a row's mode seed ONCE, migrating the pre-7.34.0 keys the row may still carry. The matrix, key by key:
+ *  - `permissionMode` present ⇒ it must be a member of the closed set (else refused, `config.permission_mode_invalid`,
+ *    without reading the retired keys); the two retired mode keys beside it are DROPPED unvalidated (the new key is
+ *    the truth), `shellGate` follows the value rule below;
+ *  - `autoModeRequested`: absent / `false` ⇒ no mode from it; `true` ⇒ `auto`; anything else ⇒ refused
+ *    (`resume.legacy_mode_seed`);
+ *  - `approverPosture`: any value ⇒ dropped (it never authorized anything; the mode comes from the request / chain,
+ *    and a `"bypass"` posture beside `autoModeRequested: true` reads `auto` — a posture never becomes an executable
+ *    bypass);
+ *  - `shellGate`: absent ⇒ none; `"always"` ⇒ kept (a live key, not a retired encoding); `"off"` / `"classify"` ⇒
+ *    dropped (no floor); anything else ⇒ refused (`resume.legacy_mode_seed`).
+ * Idempotent: a row the resume leg writes back carries `permissionMode` and the floor only, so a second read migrates
+ * nothing. Migration precedes any retired-key door, so a window row is read rather than refused.
+ */
+export declare function migrateLegacyModeSeed(gate: object | undefined): LegacyModeSeedMigration;