@sema-agent/core 7.33.8 → 7.35.0

package/dist/core/auto-mode-directive.d.ts

@@ -1,4 +1,6 @@
-import type { ApproverPosture } from "./task-spec.js";
+import type { AskEffective } from "./wiring-manifest.js";
+/** The permission-mode words the composition reads (the engine's closed set, as the wire spells it). */
+import type { PermissionMode } from "./ask-origin.js";
 /** The auto-mode directive body (title + the two paragraphs). Rendered when the run's auto-mode
  *  INTENT is resolved true — the seat, the chain it inherited, or the bit a suspend recorded. */
 export declare const AUTO_MODE_DIRECTIVE: string;
@@ -8,39 +10,25 @@ export declare const BASH_FIRST_DIRECTIVE: string;
 /** The bypass-posture directive body: the reference implementation's heading over the shell-first
  *  paragraph, the exact pair its bypass arm renders. */
 export declare const BYPASS_POSTURE_DIRECTIVE: string;
-/** The posture words this engine accepts, as literals (the door refuses anything else loudly). The
- *  TYPE is declared beside the seat it belongs to ({@link ApproverPosture}, task-spec.ts); this array
- *  is its runtime twin, and the assignment below is the compile-time tie between them. */
-export declare const APPROVER_POSTURES: readonly ApproverPosture[];
-/** Value-shape check for the word — used by the spec door below and by the chain/checkpoint readers. */
-export declare function isApproverPosture(value: unknown): value is ApproverPosture;
-/** The SEAT's door screen, declared beside the vocabulary it screens against. The renderer keys on the
- *  exact word, so any other present value would render zero bytes and be indistinguishable from "no
- *  posture declared"; it is refused instead. The value that passed is the value RETURNED — the render
- *  reads that snapshot, never the caller's spec object again. */
-export declare function refuseInvalidApproverPosture(spec: {
-    approverPosture?: ApproverPosture;
-}): ApproverPosture | undefined;
-/** The resolved posture facts of one leg: both already folded across seat, chain and checkpoint. */
+/** The mode facts of one leg, both the ENGINE's own resolution — never a requested value, never spec shape. */
 export interface ApprovalPostureFacts {
-    /** The run's resolved auto-mode intent (seat ∨ inherited chain ∨ checkpoint seed). */
-    autoMode: boolean;
-    /** The declared approver posture, absent when the host declared none. */
-    approverPosture?: ApproverPosture;
+    /** The leg's EFFECTIVE permission mode (a requested mode the deployment refused has already folded back). */
+    mode: PermissionMode;
+    /** The wiring manifest's ask derivation — `auto_allow` means no person answers an ask on this leg. */
+    askEffective: AskEffective;
 }
 /**
- * The ONE composition, and the ONE invariant: **the segment the run's posture calls for is stated
- * exactly once in the active model context**. `alreadyStated` is the transcript's ENGINE REGIONS (read
- * by metadata — a caller's own bytes are never in one, so a spliced copy cannot suppress the engine's);
- * a segment already standing there is not restated, and a segment that has left the context — compacted
- * away, or never delivered — is. Returns `undefined` when there is nothing left to say, which is both
- * "no posture declared" (zero bytes, byte-identical to the pre-seat shape) and "already said".
+ * The ONE composition, and the ONE invariant: **the segment the leg's mode calls for is stated exactly
+ * once in the active model context**. `statedBodies` is the transcript's ENGINE REGIONS (read by metadata
+ * — a caller's own bytes are never in one, so a spliced copy cannot suppress the engine's); a segment
+ * already standing there is not restated, and a segment that has left the context — compacted away, or
+ * never delivered — is. Returns `undefined` when there is nothing left to say, which is both "no segment
+ * for this mode" (zero bytes) and "already said".
  *
- * Segment-wise rather than body-wise on purpose: a leg whose posture CHANGES — it gains the bypass fact,
- * so the segment it owes changes — must state the new segment without restating one already standing,
- * and must be able to read a body an earlier leg minted under a composition that joined two. The caller
- * wraps the result in the engine's marked reminder shell; this module never wraps, so the mark stays
- * owned by its own mint home.
+ * Segment-wise rather than body-wise on purpose: a leg whose mode CHANGES — it now runs under bypass, so the
+ * segment it owes changes — must state the new segment without restating one already standing, and must be
+ * able to read a body an earlier leg minted under a composition that joined two. The caller wraps the result
+ * in the engine's marked reminder shell; this module never wraps, so the mark stays owned by its own mint home.
  */
 export declare function composeApprovalPostureDirective(facts: ApprovalPostureFacts, statedBodies?: readonly string[]): string | undefined;
 /** SHA-256 of a directive body — the pins' lock port, so the lock is computed the one way. */

package/dist/core/auto-mode-directive.js

@@ -2,28 +2,19 @@ import { createHash } from "node:crypto";
 export const AUTO_MODE_DIRECTIVE = "## Auto Mode Active\n\nBias toward working without stopping for clarifying questions — when you'd normally pause to check, make the reasonable call and keep going; they'll redirect you if needed. If the user, a skill, or the shape of the task suggests they want you to ask (with AskUserQuestion or otherwise), do so. And even absent that signal, it's still fine to stop when you're genuinely blocked — unclear direction, missing input, a decision only they can make.\n\nBefore any command that could discard uncommitted work — `git checkout`/`restore`/`reset`/`clean`, `rm -rf` in the repo, restoring from a snapshot — run `git status` first and stash (with `-u` for untracked) or commit anything that's there. When staging or committing, review what's included (`git status` after a broad `git add`), and if you see anything suspicious that might reveal secrets — even if the filename looks innocuous — double-check the file's contents before pushing.";
 export const BASH_FIRST_DIRECTIVE = "Do your work through the Bash tool wherever it can accomplish the job: read files with cat, head, or sed -n, search with grep and find, and make file changes with sed, heredocs, or short scripts, rather than using the dedicated Read, Edit, or Write tools. Fall back to a dedicated tool only when Bash genuinely cannot do the job.";
 export const BYPASS_POSTURE_DIRECTIVE = `While bypass permissions mode is active:\n\n${BASH_FIRST_DIRECTIVE}`;
-export const APPROVER_POSTURES = ["bypass"];
-export function isApproverPosture(value) {
-    return typeof value === "string" && APPROVER_POSTURES.includes(value);
-}
-export function refuseInvalidApproverPosture(spec) {
-    if (spec.approverPosture !== undefined && !isApproverPosture(spec.approverPosture)) {
-        const e = new Error(`approverPosture must be one of ${APPROVER_POSTURES.map((w) => JSON.stringify(w)).join(", ")} when present (got ${JSON.stringify(spec.approverPosture)}) — omit it to declare no posture; an unrecognized value is refused rather than read as absence.`);
-        e.code = "config.approver_posture_invalid";
-        throw e;
-    }
-    return spec.approverPosture;
+function postureSegmentOf(facts) {
+    if (facts.mode === "bypassPermissions" || facts.askEffective === "auto_allow")
+        return BYPASS_POSTURE_DIRECTIVE;
+    return facts.mode === "auto" ? AUTO_MODE_DIRECTIVE : undefined;
 }
 export function composeApprovalPostureDirective(facts, statedBodies = []) {
-    const parts = facts.approverPosture === "bypass" ? [BYPASS_POSTURE_DIRECTIVE] : facts.autoMode ? [AUTO_MODE_DIRECTIVE] : [];
-    if (parts.length === 0)
+    const owed = postureSegmentOf(facts);
+    if (owed === undefined)
         return undefined;
-    const stated = new Set();
     for (const body of statedBodies)
-        for (const seg of postureSegmentsOf(body) ?? [])
-            stated.add(seg);
-    const owed = parts.filter((seg) => !stated.has(seg));
-    return owed.length === 0 ? undefined : owed.join("\n\n");
+        if (postureSegmentsOf(body)?.includes(owed) === true)
+            return undefined;
+    return owed;
 }
 const POSTURE_SEGMENTS = [AUTO_MODE_DIRECTIVE, BYPASS_POSTURE_DIRECTIVE];
 function postureSegmentsOf(body) {

package/dist/core/auto-mode-prompt.d.ts

@@ -17,8 +17,13 @@ export interface AutoModeRules {
 export interface BuildAutoModePromptOptions {
     rules?: AutoModeRules;
     /** Settings-plane deny rules (tool[/argument-pattern] strings) — rendered into the
-     *  `<settings_deny_rules>` slot as the CC circumvention-catching paragraph. */
+     *  `<settings_deny_rules>` slot as the CC circumvention-catching paragraph, after the engine's own lines. */
     settingsDenyRules?: readonly string[];
+    /** The ENGINE's deny lines — its effective read-deny table as rules ({@link readDenyClassifierRules}).
+     *  Rendered in the same paragraph, ahead of `settingsDenyRules`. A separate member (not pre-merged by the
+     *  caller) because a persisted arming records the two halves separately: the deployment's half is compared
+     *  against the redeeming deployment's own settings, the engine's half against the row's own table. */
+    derivedDenyRules?: readonly DerivedDenyRule[];
     /** Extra session-context facts (e.g. the CC user-identity line) — appended as a
      *  `## Session Context` bullet block after the assembled document. */
     sessionContext?: readonly string[];
@@ -28,6 +33,62 @@ export interface BuildAutoModePromptOptions {
      *  text may carry `$`). */
     crossSessionMessagesRule?: string;
 }
+/**
+ * One engine deny line: a `Read(...)` rule in the engine's own path-rule grammar (`//` = the filesystem root,
+ * `*` within one segment, a whole-segment `**` across segments, and a rule reaches the path it names and
+ * everything under it — `parseRuleText` / `pathRuleReachOf`), plus whether ASCII letter case is ignored, which
+ * that grammar cannot spell and the paragraph states beside the rule.
+ */
+export interface DerivedDenyRule {
+    readonly rule: string;
+    readonly anyCase?: true;
+}
+/**
+ * The effective READ-deny table as the classifier's deny lines — one line per row, the row's reach in the
+ * engine's own `Read(...)` path-rule grammar.
+ *
+ * A read-deny row is a run of path SEGMENTS matched anywhere in a path — the entry itself and everything under
+ * it — and its `*` never crosses a `/` (read-deny.ts: `.ssh` refuses `~/.ssh/id_rsa` and `/srv/x/.ssh/config`
+ * alike; a `**` segment matches exactly one segment). The rule grammar reaches the path a pattern names and
+ * everything under it, so the line is `//**` + `/` + the row with every run of stars written `*` (one segment,
+ * as in the row): `.ssh` ⇒ `Read(//**\/.ssh)`, `**\/secrets/**` ⇒ `Read(//**\/*\/secrets/*)`, `*` (every
+ * path) ⇒ `Read(//**\/*)`. A row that names no segment at all (`""`, `/`) is not stated. A HOME-ANCHORED row
+ * (`~/<run>`, read-deny.ts `READ_DENY_HOME_WORD`) is the rule grammar's home word with the same reach:
+ * `~/.sema/settings.json` ⇒ `Read(~/.sema/settings.json)`.
+ *
+ * The text of a row can come from a task (a spawned task's author included) and it is spliced into a trusted
+ * prompt, so a row is stated as a rule and nothing else: every character the grammar or the prompt must not
+ * carry (see NOT_STATED) is written `*`, and an over-long pattern is cut and closed with `*` — both wider than
+ * the row, never narrower, and the result still parses as a rule. No row can start a line, leave its code
+ * span, form a tag or a second rule, or read as a sentence; the engine enforces the row as compiled either way.
+ *
+ * A row matched without regard to ASCII letter case (the deny set's default) carries `anyCase` when its stated
+ * pattern has an ASCII letter. Duplicates are folded AFTER this encoding, first seen.
+ */
+export declare function readDenyClassifierRules(entries: readonly {
+    readonly pattern: string;
+    readonly caseSensitive?: boolean;
+}[], rules?: readonly {
+    readonly tool: string;
+    readonly pattern: string;
+}[]): DerivedDenyRule[];
+/**
+ * The `<settings_deny_rules>` paragraph for one arming, from the engine's facts — the effective deny table
+ * (`readDeny`: the compiled matcher's entries, built-in tiers + deployment + task additions; `readDenyRules`: its
+ * permission-rule rows, both faces) and the deployment's `settingsDenyRules` — exactly as {@link buildAutoModePrompt}
+ * splices it. Empty inputs ⇒ "".
+ */
+export declare function renderClassifierDenyRules(input: {
+    readonly readDeny?: readonly {
+        readonly pattern: string;
+        readonly caseSensitive?: boolean;
+    }[];
+    readonly readDenyRules?: readonly {
+        readonly tool: string;
+        readonly pattern: string;
+    }[];
+    readonly settingsDenyRules?: readonly string[];
+}): string;
 /**
  * Assemble the classifier SYSTEM prompt (CC `KRg`, content-equivalent single string — CC splits the
  * session-context tail into a second uncached block purely as a prompt-cache optimization).

package/dist/core/auto-mode-prompt.js

@@ -1,6 +1,7 @@
 import { AUTO_MODE_DEFAULT_WINDOW_MAX_CHARS, AUTO_MODE_DEFAULT_WINDOW_MAX_ENTRIES, AUTO_MODE_DEFAULTS_SENTINEL } from "./auto-mode-defaults.js";
 import { AUTO_MODE_BASE_PROMPT, AUTO_MODE_PERMISSIONS_EXTERNAL } from "./auto-mode-prompt-assets.js";
 import { cutEnginePrefix, cutEngineSegments, flattenableUserText } from "./untrusted-text.js";
+import { readDenyPatternRun } from "../tools/fs/read-deny.js";
 export { AUTO_MODE_DEFAULTS_SENTINEL } from "./auto-mode-defaults.js";
 function mergeRuleSection(user, defaultsInner) {
     if (!user?.length)
@@ -20,10 +21,47 @@ function mergeRuleSection(user, defaultsInner) {
     }
     return out.join("\n");
 }
-function renderSettingsDenyRules(rules) {
-    if (rules.length === 0)
+const DENY_LINE_PATTERN_MAX = 512;
+const NOT_STATED = /[\s\p{Z}\p{Cf}`<>(){}[\]?\\\u0000-\u001f\u007f-\u009f]/u;
+const notStated = (ch) => NOT_STATED.test(ch) || NOT_STATED.test(ch.normalize("NFKC"));
+export function readDenyClassifierRules(entries, rules = []) {
+    const out = [];
+    const seen = new Set();
+    const push = (line) => {
+        const key = `${line.rule}\u0000${line.anyCase === true}`;
+        if (seen.has(key))
+            return;
+        seen.add(key);
+        out.push(line);
+    };
+    for (const { pattern, caseSensitive } of entries) {
+        const { homeAnchored, run } = readDenyPatternRun(pattern);
+        const segments = run.split("/").filter((seg) => seg.length > 0);
+        if (segments.length === 0)
+            continue;
+        const stated = statedPattern(segments.join("/"));
+        push({ rule: homeAnchored ? `Read(~/${stated})` : `Read(//**/${stated})`, ...(caseSensitive !== true && /[A-Za-z]/.test(stated) ? { anyCase: true } : {}) });
+    }
+    for (const { tool, pattern } of rules) {
+        if (!/^[A-Za-z][A-Za-z0-9_]*$/.test(tool) || pattern.length === 0)
+            continue;
+        push({ rule: `${tool}(${pattern.split("/").map((seg) => (seg === "**" ? seg : statedPattern(seg))).join("/")})` });
+    }
+    return out;
+}
+function statedPattern(pattern) {
+    const chars = [...pattern].map((ch) => (notStated(ch) ? "*" : ch));
+    const cut = chars.length > DENY_LINE_PATTERN_MAX ? [...chars.slice(0, DENY_LINE_PATTERN_MAX), "*"] : chars;
+    return cut.join("").replace(/\*+/g, "*");
+}
+export function renderClassifierDenyRules(input) {
+    return renderSettingsDenyRules(readDenyClassifierRules(input.readDeny ?? [], input.readDenyRules ?? []), input.settingsDenyRules ?? []);
+}
+function renderSettingsDenyRules(derived, settings) {
+    const items = [...derived.map((d) => `\`${d.rule}\`${d.anyCase === true ? " (any ASCII letter case)" : ""}`), ...settings.map((r) => `\`${r}\``)];
+    if (items.length === 0)
         return "";
-    return (`- User Deny Rules: The user has configured these permission deny rules: ${rules.map((r) => `\`${r}\``).join(", ")}. Each rule names a tool and (optionally) an argument pattern that is already hard-blocked for that tool. ` +
+    return (`- User Deny Rules: The user has configured these permission deny rules: ${items.join(", ")}. Each rule names a tool and (optionally) an argument pattern that is already hard-blocked for that tool. ` +
         "Block the action if it accomplishes the same effect via a different tool — e.g. using Bash with " +
         "`python -c`, `sed -i`, `cat >`, heredocs, or similar to write or edit a file that an Edit/Write/MultiEdit deny rule covers, or otherwise routing around a deny rule by switching tools. The named tool itself is enforced separately; your job here is to catch circumvention.");
 }
@@ -39,7 +77,7 @@ export function buildAutoModePrompt(options) {
     for (const [key, re] of PAIRED_SECTIONS) {
         out = out.replace(re, (_m, inner) => mergeRuleSection(options?.rules?.[key], inner));
     }
-    out = out.replace("<settings_deny_rules>", () => renderSettingsDenyRules(options?.settingsDenyRules ?? []));
+    out = out.replace("<settings_deny_rules>", () => renderSettingsDenyRules(options?.derivedDenyRules ?? [], options?.settingsDenyRules ?? []));
     const context = options?.sessionContext ?? [];
     if (context.length > 0) {
         out += `\n\n## Session Context\n\n${context.map((f) => `- ${f}`).join("\n")}`;

package/dist/core/auto-mode-rebuild.d.ts

@@ -28,7 +28,8 @@ export interface AutoModeRebuildOptions {
      * an affirmative claim, "this is the run's first gated action", that would simply be false. A provider
      * that returns `[]` is DECLARING the transcript empty, which is a different statement from an engine
      * that silently had none to show. A provider that throws fails the classification closed
-     * (`unavailable` ⇒ a deny that says so), never into a blind verdict.
+     * (`unavailable` ⇒ on to a person where the station has an approval seat, refused with a sentence that says
+     * so where it has none), never into a blind verdict.
      */
     transcript: () => readonly Message[] | Promise<readonly Message[]>;
 }

package/dist/core/auto-mode-rebuild.js

@@ -11,6 +11,7 @@ export function rebuildAutoModeDecider(opts) {
     const promptOptions = {
         ...(effective.rules !== undefined ? { rules: effective.rules } : {}),
         ...(effective.settingsDenyRules !== undefined ? { settingsDenyRules: effective.settingsDenyRules } : {}),
+        ...(effective.derivedDenyRules !== undefined ? { derivedDenyRules: effective.derivedDenyRules } : {}),
         ...(effective.sessionContext !== undefined ? { sessionContext: effective.sessionContext } : {}),
         ...(effective.crossSessionMessagesRule === true ? { crossSessionMessagesRule: CROSS_SESSION_CLASSIFIER_RULE } : {}),
     };

package/dist/core/auto-mode.d.ts

@@ -51,6 +51,14 @@ export declare function isAutoModeClassifierFallback(v: unknown): v is AutoModeC
  *  `config.auto_mode_classifier_fallback_invalid`. A typo'd knob must not read as the default: `"non"` would
  *  keep paying for the rung it meant to turn off. */
 export declare function autoModeClassifierFallbackOf(v: unknown): AutoModeClassifierFallback;
+/** Whether a present budget value is one the knob takes: a finite number of milliseconds in [1, 2147483647]. */
+export declare function isAutoModeTimeoutMs(v: unknown): v is number;
+/** Read the per-level budget knob (`RunnerDeps.autoMode.timeoutMs` / `AutoModeDeciderOptions.timeoutMs`):
+ *  absent ⇒ {@link AUTO_MODE_DEFAULT_TIMEOUT_MS}; a finite number in [1, 2147483647] ⇒ itself; ANYTHING ELSE
+ *  (NaN, ±Infinity, `0`, a negative, a value a host timer would fire at once, a string, an object) ⇒ a loud
+ *  refusal carrying `config.auto_mode_timeout_invalid`. There is no OFF spelling: the budget bounds how long a
+ *  permission gate waits, and a gate with no bound is not a setting this knob offers. */
+export declare function autoModeTimeoutMsOf(v: unknown): number;
 /** The classifier's verdict over one pending `ask`. Every arm may carry the classification's model
  *  attribution ({@link AutoModeClassifierRound}), present iff the decider was wired with a candidate ladder. */
 export type AutoModeVerdict = ({
@@ -157,6 +165,12 @@ export declare function rungDidNotRule(v: AutoModeVerdict): AutoModeFallbackCaus
  * NOT move keeps the CC text byte for byte.
  */
 export declare function classifierUnavailableDenyMessage(toolName: string, cause: AutoModeUnavailableCause, attribution?: AutoModeClassifierRound): string;
+/**
+ * The text an ask carries to a person when the classifier could not rule on it and the leg has an approval seat
+ * (the gate's classifier station and the inherited station): the ask's own text first — the card still says what
+ * is being asked — then why auto mode is asking at all. One writer for both stations.
+ */
+export declare function classifierUnavailableAskMessage(askText: string, cause: AutoModeUnavailableCause): string;
 /**
  * The model-facing deny text for a `parse_error` verdict — CC 2.1.259 `i7t` stem ("Auto mode could not evaluate
  * this action and is blocking it for safety"; 2.1.250 `Ure`): the classifier answered, but not with a verdict,
@@ -256,7 +270,10 @@ export interface AutoModeDeciderOptions<T = void> {
     /** Hard cap on one classification round-trip — one LADDER RUNG's DISPATCH, not the whole classification
      *  (see {@link candidates}) — and, separately, the one {@link assemble} call that precedes the walk (ONE
      *  number: a second knob would be a second answer to "how long may a classification make the gate wait").
-     *  Default 15_000 ms: a permission gate must not stall the whole run on a slow classifier. */
+     *  Omitted ⇒ {@link AUTO_MODE_DEFAULT_TIMEOUT_MS}. A present value that is not a finite number of at least 1
+     *  and at most 2147483647 (a host timer fires at once past that) is REFUSED at construction
+     *  (`config.auto_mode_timeout_invalid`, {@link autoModeTimeoutMsOf}) — never clamped, never read as the
+     *  default, and there is no OFF: a permission gate always has a bound. */
     timeoutMs?: number;
     /**
      * Fired once per `decide` call with the verdict the gate is about to act on and the wall time it waited
@@ -288,6 +305,10 @@ export interface AutoModeClassified {
 export interface AutoModeDecider {
     /** Never rejects. Any internal failure surfaces as `unavailable`/`parse_error` (fail-closed). */
     decide(input: AutoModeClassifyInput, signal?: AbortSignal): Promise<AutoModeVerdict>;
+    /** The per-level budget this decider holds each rung's dispatch (and the assembly) to, in ms — the resolved
+     *  {@link AutoModeDeciderOptions.timeoutMs}; what a notice about a timed-out classification names. Absent on a decider a
+     *  host implements by hand. */
+    readonly timeoutMs?: number;
 }
 /** The per-run decider: timeout + fail-closed error mapping, nothing carried between rounds. One instance per
  *  run (it binds the run's model leg and assembled prompt); a round that failed says nothing about the next,
@@ -413,8 +434,16 @@ export interface AutoModeDenialTracker {
         windowArmedAt?: number;
     };
 }
-/** Build the per-run tracker. Bad knob values throw (the deployment face is read at prepare; a refusal
- *  there is the loud exit the knob doctrine requires). */
+export declare function autoModeDenialLimitOf(v: unknown): Required<AutoModeDenialLimitOptions>;
+/** The deployment face's three value knobs, read by their one readers — every leg's prepare runs it while
+ *  `RunnerDeps.autoMode` is present, whatever mode the leg starts in, so a bad knob refuses the run before a steer or a
+ *  parent's live ceiling can reach an arming that would have refused it. */
+export declare function screenAutoModeKnobs(face: {
+    readonly timeoutMs?: unknown;
+    readonly classifierFallback?: unknown;
+    readonly denialLimit?: unknown;
+}): void;
+/** Build the per-run tracker over {@link autoModeDenialLimitOf}'s bounds (a bad knob refuses there). */
 export declare function createAutoModeDenialTracker(opts?: AutoModeDenialLimitOptions): AutoModeDenialTracker;
 /** The fallback ask's text — CC's sentence family, single-sourced for every mint site (the main gate
  *  and the inherited-lane arms): `Classifier denial limit exceeded, falling back to prompting: <limit

package/dist/core/auto-mode.js

@@ -31,6 +31,20 @@ export function autoModeClassifierFallbackOf(v) {
     e.code = "config.auto_mode_classifier_fallback_invalid";
     throw e;
 }
+const MAX_TIMER_DELAY_MS = 2_147_483_647;
+export function isAutoModeTimeoutMs(v) {
+    return typeof v === "number" && Number.isFinite(v) && v >= 1 && v <= MAX_TIMER_DELAY_MS;
+}
+export function autoModeTimeoutMsOf(v) {
+    if (v === undefined)
+        return AUTO_MODE_DEFAULT_TIMEOUT_MS;
+    if (isAutoModeTimeoutMs(v))
+        return v;
+    const e = new Error(`RunnerDeps.autoMode.timeoutMs must be a number of milliseconds between 1 and ${MAX_TIMER_DELAY_MS} ` +
+        `(got ${describeRejectedValue(v)}) — omit it for the default ${AUTO_MODE_DEFAULT_TIMEOUT_MS}`);
+    e.code = "config.auto_mode_timeout_invalid";
+    throw e;
+}
 export const AUTO_MODE_ROUND_NOT_ASKED_CODE = "auto_mode.round_not_asked";
 export function autoModeRoundNotAsked(reason) {
     let detail;
@@ -70,6 +84,10 @@ export function classifierUnavailableDenyMessage(toolName, cause, attribution) {
         "If it keeps failing, continue with other tasks that don't require this action and come back to it later. " +
         "Note: reading files, searching code, and other read-only operations do not require the classifier and can still be used.");
 }
+export function classifierUnavailableAskMessage(askText, cause) {
+    const parenthetical = cause === "timeout" ? " (timed out)" : "";
+    return `${askText}\n\nThe auto-mode classifier is temporarily unavailable${parenthetical}, so auto mode could not judge this call; it needs an approval instead of the classifier's verdict.`;
+}
 export function classifierParseFailureDenyMessage(attribution) {
     const stem = "Auto mode could not evaluate this action and is blocking it for safety";
     return attribution === undefined ? `${stem} — the classifier's reply carried no verdict.` : `${stem} — the classifier model "${attribution.modelUsed}" replied without a verdict.`;
@@ -153,7 +171,7 @@ export function parseAutoModeResponse(text, options) {
     return { kind: "block", category, reason };
 }
 export function createAutoModeDecider(opts) {
-    const timeoutMs = opts.timeoutMs ?? AUTO_MODE_DEFAULT_TIMEOUT_MS;
+    const timeoutMs = autoModeTimeoutMsOf(opts.timeoutMs);
     if (opts.candidates !== undefined) {
         if (opts.candidates.length === 0) {
             throw new Error("AutoModeDeciderOptions.candidates must name at least one model — omit the member for the leg's own model, never an empty ladder");
@@ -183,7 +201,7 @@ export function createAutoModeDecider(opts) {
         }
         return verdict;
     };
-    return { decide };
+    return { decide, timeoutMs };
     async function decideUnreported(input, round, signal) {
         const causes = [];
         let verdict = { kind: "unavailable", cause: "error" };
@@ -243,42 +261,46 @@ export function createAutoModeDecider(opts) {
     }
 }
 async function withDeadline(capMs, signal, call) {
+    if (signal?.aborted === true)
+        throw new Error("the classification was cancelled before it was dispatched");
     let timer;
+    let onOuterAbort;
     const inner = new AbortController();
-    const onOuterAbort = () => inner.abort();
-    if (signal !== undefined) {
-        if (signal.aborted)
-            inner.abort();
-        else
-            signal.addEventListener("abort", onOuterAbort, { once: true });
-    }
     try {
         return await new Promise((resolve, reject) => {
             let settled = false;
+            const settle = (end) => {
+                if (settled)
+                    return;
+                settled = true;
+                end();
+            };
+            onOuterAbort = () => {
+                inner.abort();
+                settle(() => reject(new Error("the classification was cancelled")));
+            };
+            signal?.addEventListener("abort", onOuterAbort, { once: true });
             timer = setTimeout(() => {
-                if (!settled) {
-                    settled = true;
+                settle(() => {
                     inner.abort();
                     reject(new AutoModeTimeout());
-                }
+                });
             }, capMs);
-            call(inner.signal).then((v) => {
-                if (!settled) {
-                    settled = true;
-                    resolve(v);
-                }
-            }, (e) => {
-                if (!settled) {
-                    settled = true;
-                    reject(e);
-                }
-            });
+            let pending;
+            try {
+                pending = call(inner.signal);
+            }
+            catch (e) {
+                settle(() => reject(e));
+                return;
+            }
+            pending.then((v) => settle(() => resolve(v)), (e) => settle(() => reject(e)));
         });
     }
     finally {
         if (timer !== undefined)
             clearTimeout(timer);
-        if (signal !== undefined)
+        if (signal !== undefined && onOuterAbort !== undefined)
             signal.removeEventListener("abort", onOuterAbort);
     }
 }
@@ -305,25 +327,42 @@ export function unarmedWindow(fallback) {
 function countsOf(fallback) {
     return { consecutive: fallback.consecutive, total: fallback.total, limit: fallback.limit };
 }
-const MAX_TIMER_DELAY_MS = 2_147_483_647;
-export function createAutoModeDenialTracker(opts = {}) {
-    const bound = (name, v, dflt) => {
-        if (v === undefined)
+const DENIAL_LIMIT_MEMBERS = new Set(["maxConsecutive", "maxTotal", "autoDenyAfterMs"]);
+export function autoModeDenialLimitOf(v) {
+    const refuse = (what) => {
+        const e = new Error(`RunnerDeps.autoMode.denialLimit${what}`);
+        e.code = "config.auto_mode_denial_limit_invalid";
+        throw e;
+    };
+    if (v === undefined)
+        return { ...AUTO_MODE_DENIAL_LIMIT_DEFAULTS, autoDenyAfterMs: AUTO_MODE_DENIAL_AUTO_DENY_DEFAULT_MS };
+    if (typeof v !== "object" || v === null || Array.isArray(v))
+        return refuse(` must be a record of bounds (got ${describeRejectedValue(v)}) — omit it for the defaults`);
+    const opts = v;
+    const stray = Object.keys(opts).find((k) => !DENIAL_LIMIT_MEMBERS.has(k));
+    if (stray !== undefined)
+        return refuse(` has no member ${JSON.stringify(stray)} — its members are maxConsecutive, maxTotal and autoDenyAfterMs`);
+    const bound = (name, dflt) => {
+        const b = opts[name];
+        if (b === undefined)
             return dflt;
-        if (!Number.isInteger(v) || v < 1) {
-            throw new Error(`RunnerDeps.autoMode.denialLimit.${name} must be a positive integer (got ${JSON.stringify(v)}) — omit it for the default ${dflt}`);
-        }
-        return v;
+        return typeof b === "number" && Number.isInteger(b) && b >= 1 ? b : refuse(`.${name} must be a positive integer (got ${describeRejectedValue(b)}) — omit it for the default ${dflt}`);
     };
-    const maxConsecutive = bound("maxConsecutive", opts.maxConsecutive, AUTO_MODE_DENIAL_LIMIT_DEFAULTS.maxConsecutive);
-    const maxTotal = bound("maxTotal", opts.maxTotal, AUTO_MODE_DENIAL_LIMIT_DEFAULTS.maxTotal);
-    let autoDenyAfterMs = AUTO_MODE_DENIAL_AUTO_DENY_DEFAULT_MS;
-    if (opts.autoDenyAfterMs !== undefined) {
-        if (!Number.isInteger(opts.autoDenyAfterMs) || opts.autoDenyAfterMs < 0 || opts.autoDenyAfterMs > MAX_TIMER_DELAY_MS) {
-            throw new Error(`RunnerDeps.autoMode.denialLimit.autoDenyAfterMs must be an integer between 0 and ${MAX_TIMER_DELAY_MS} (got ${JSON.stringify(opts.autoDenyAfterMs)}) — 0 disarms the window; omit it for the default ${AUTO_MODE_DENIAL_AUTO_DENY_DEFAULT_MS}`);
-        }
-        autoDenyAfterMs = opts.autoDenyAfterMs;
-    }
+    const w = opts["autoDenyAfterMs"];
+    const autoDenyAfterMs = w === undefined
+        ? AUTO_MODE_DENIAL_AUTO_DENY_DEFAULT_MS
+        : typeof w === "number" && Number.isInteger(w) && w >= 0 && w <= MAX_TIMER_DELAY_MS
+            ? w
+            : refuse(`.autoDenyAfterMs must be an integer between 0 and ${MAX_TIMER_DELAY_MS} (got ${describeRejectedValue(w)}) — 0 disarms the window; omit it for the default ${AUTO_MODE_DENIAL_AUTO_DENY_DEFAULT_MS}`);
+    return { maxConsecutive: bound("maxConsecutive", AUTO_MODE_DENIAL_LIMIT_DEFAULTS.maxConsecutive), maxTotal: bound("maxTotal", AUTO_MODE_DENIAL_LIMIT_DEFAULTS.maxTotal), autoDenyAfterMs };
+}
+export function screenAutoModeKnobs(face) {
+    autoModeTimeoutMsOf(face.timeoutMs);
+    autoModeClassifierFallbackOf(face.classifierFallback);
+    autoModeDenialLimitOf(face.denialLimit);
+}
+export function createAutoModeDenialTracker(opts) {
+    const { maxConsecutive, maxTotal, autoDenyAfterMs } = autoModeDenialLimitOf(opts);
     let consecutive = 0;
     let total = 0;
     let timedFallbackShown = false;