@sema-agent/core 7.37.1 → 7.38.1

package/dist/core/trace.d.ts

@@ -860,13 +860,14 @@ export type TraceEvent = {
 } | {
     /** A provider echo field was refused by {@link import("../brain/errors.js").PROVIDER_ECHO_SHAPE} (visible ASCII,
      *  1–128 characters) and dropped: the response's `request-id` / `x-request-id` header values (`field:
-     *  "requestId"`, read at connect — the id a failure would carry as `apiFailure.requestId`), or the model name
-     *  its frames report (`field: "responseModel"`). One frame per provider response per field; the value itself
-     *  is never carried (metadata-only). A count of these frames is this engine's drop count. */
+     *  "requestId"`, read at connect — the id a failure would carry as `apiFailure.requestId`), the model name
+     *  its frames report (`field: "responseModel"`), or the word a refusal's error envelope states (`field:
+     *  "apiErrorCode"`). One frame per provider response per field; the value itself is never carried
+     *  (metadata-only). A count of these frames is this engine's drop count. */
     kind: "brain.echo_dropped";
     version: 1;
     taskId: string;
-    field: "requestId" | "responseModel";
+    field: "requestId" | "responseModel" | "apiErrorCode";
     ts: number;
 } | {
     /** C10 — a `preemptSignal` fired on a task that is NOT resource-suspend-eligible: the preempt is a

package/dist/core/types.d.ts

@@ -29,6 +29,6 @@ export { AUTO_MODE_DENY_SOURCES, isAutoModeDenySource } from "./runtime-caps.js"
 export type { BackgroundChildEvent, DelegationLifecycleEvent } from "./delegation-frames.js";
 export { __resetMalformedDelegationSeatAnnouncement, deliverDelegationLifecycle } from "./delegation-frames.js";
 export type { ProjectMemoryLoad, ResumePreflightInfo, ResumePreflightVerdict, RunnerDeps } from "./runner-deps.js";
-export type { EngineNotice, OwedUserInputAccount } from "./engine-notice.js";
-export { __resetMalformedNoticeSeatAnnouncement, deliverEngineNotice, owedUserInputCounts, settleOwedUserInput, undrainedUserInputNotices } from "./engine-notice.js";
+export type { EngineNotice, OwedUserInputAccount, UserSteerUndrainedCause } from "./engine-notice.js";
+export { __resetMalformedNoticeSeatAnnouncement, deliverEngineNotice, owedUserInputCounts, settleOwedUserInput, undrainedUserInputNotices, USER_STEER_UNDRAINED_CAUSES } from "./engine-notice.js";
 export type { AgentTool, Model, StreamFn, ThinkingLevel, ToolInputValidationContext, ToolInputVerdict };

package/dist/core/types.js

@@ -1,4 +1,4 @@
 export { MODEL_ROLES } from "./model-seat.js";
 export { AUTO_MODE_DENY_SOURCES, isAutoModeDenySource } from "./runtime-caps.js";
 export { __resetMalformedDelegationSeatAnnouncement, deliverDelegationLifecycle } from "./delegation-frames.js";
-export { __resetMalformedNoticeSeatAnnouncement, deliverEngineNotice, owedUserInputCounts, settleOwedUserInput, undrainedUserInputNotices } from "./engine-notice.js";
+export { __resetMalformedNoticeSeatAnnouncement, deliverEngineNotice, owedUserInputCounts, settleOwedUserInput, undrainedUserInputNotices, USER_STEER_UNDRAINED_CAUSES } from "./engine-notice.js";

package/dist/core/wiring-manifest.js

@@ -5,8 +5,8 @@ import { canonicalize } from "./canonical-json.js";
 import { resolveCheckpointStore } from "./checkpoint-store.js";
 import { isLiveQuestionFace } from "./ask-question.js";
 import { AUTO_MODE_DENY_SOURCES, isAutoModeDenySource } from "./runtime-caps.js";
-export const AUTO_MODE_ARM_REASONS = ["armed", "no_intent", "no_face", "denied", "resolver_fault"];
-export const LSP_LANES = ["tool", "diagnostics", "tool_and_diagnostics"];
+export const AUTO_MODE_ARM_REASONS = Object.freeze(["armed", "no_intent", "no_face", "denied", "resolver_fault"]);
+export const LSP_LANES = Object.freeze(["tool", "diagnostics", "tool_and_diagnostics"]);
 export function deriveHandsSeam(handsMounted) {
     return handsMounted ? { mounted: true } : { mounted: false, reason: "no_execution_env" };
 }

package/dist/core/write-protect.js

@@ -183,7 +183,7 @@ function relativeUnderDataRoot(path, roots) {
     }
     return null;
 }
-export const WRITE_PROTECTION_TARGET_VIEWS = ["spelling-only", "target"];
+export const WRITE_PROTECTION_TARGET_VIEWS = Object.freeze(["spelling-only", "target"]);
 export function compileWriteProtection(entries, opts) {
     const rows = resolveWriteProtectedTable(entries);
     if (rows.length === 0)

package/dist/engine/harness/agent-harness.js

@@ -5,7 +5,7 @@ import { normalizeEngineSegments } from "../../core/untrusted-text.js";
 import { AUTH_CARRIER_NAMES } from "../../brain/request-params.js";
 import { isProviderEchoShape } from "../../brain/errors.js";
 import { convertToLlm } from "./messages.js";
-import { thrownText } from "../../core/thrown-value.js";
+import { readMember, thrownText } from "../../core/thrown-value.js";
 import { AgentHarnessError, CompactionError, SessionError, SYNTHETIC_MESSAGE_MODEL, toError, } from "./types.js";
 const API_FAILURE_RECORD_MAX_CHARS = 2000;
 function createUserMessage(text, images, provenance) {
@@ -784,7 +784,11 @@ export class AgentHarness {
         }
     }
     async recordApiFailure(failure) {
-        const raw = failure.errorMessage?.trim();
+        const errorMessage = readMember(failure, "errorMessage");
+        const apiErrorStatus = readMember(failure, "apiErrorStatus");
+        const requestId = readMember(failure, "requestId");
+        const errorKind = readMember(failure, "errorKind");
+        const raw = typeof errorMessage === "string" ? errorMessage.trim() : undefined;
         const detail = raw !== undefined && raw.length > API_FAILURE_RECORD_MAX_CHARS
             ? `${raw.slice(0, API_FAILURE_RECORD_MAX_CHARS)}… (truncated)`
             : raw;
@@ -795,13 +799,13 @@ export class AgentHarness {
             provider: failure.provider,
             model: SYNTHETIC_MESSAGE_MODEL,
             isApiErrorMessage: true,
-            ...(failure.apiErrorStatus !== undefined ? { apiErrorStatus: failure.apiErrorStatus } : {}),
-            ...(typeof failure.requestId === "string" && isProviderEchoShape(failure.requestId) ? { requestId: failure.requestId } : {}),
+            ...(typeof apiErrorStatus === "number" ? { apiErrorStatus } : {}),
+            ...(typeof requestId === "string" && isProviderEchoShape(requestId) ? { requestId } : {}),
             usage: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, totalTokens: 0, cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, total: 0 } },
             usageMissing: true,
             stopReason: "error",
-            ...(failure.errorMessage !== undefined ? { errorMessage: failure.errorMessage } : {}),
-            ...(failure.errorKind !== undefined ? { errorKind: failure.errorKind } : {}),
+            ...(typeof errorMessage === "string" ? { errorMessage } : {}),
+            ...(errorKind === "length_empty" || errorKind === "degenerate" || errorKind === "input_too_long" ? { errorKind } : {}),
             timestamp: failure.timestamp,
         };
         try {

package/dist/engine/llm/tool-turns.d.ts

@@ -1,12 +1,101 @@
+/**
+ * The request view's TOOL-TURN LAW — the structure every provider lane requires of a tool turn, restored on the
+ * way to the brain (never in the transcript).
+ *
+ * For every assistant message that carries tool calls:
+ *  (i)  the calls are a CONTIGUOUS TAIL of DISTINCT ids — every block that is not a call and stands after the first
+ *       call (between two calls or after the last) moves ahead of the calls; blocks ahead of the first call, thinking
+ *       first, keep their place (a stable partition: non-call blocks in their order, then the calls in theirs); a
+ *       second call carrying an id the message already used is left out (every lane requires a request's call ids to
+ *       be unique), so the message keeps the FIRST call per id and every result for that id answers it;
+ *  (ii) the messages right after it are EXACTLY one result per call — a result recorded later in the transcript
+ *       (behind a user message, a wake frame, another turn) is moved up into the batch, a second result for the
+ *       same call is folded into the first (no recorded result is withheld), an interrupted close
+ *       ({@link isInterruptedClose}) stands in only for a call with no other result (beside a recorded result it
+ *       is void: it says only that none was recorded), and a call with no result at all is closed with the reconcile
+ *       family's synthetic interrupted result ({@link interruptedResults}: the same text and `errorKind` a persisted
+ *       reconcile writes);
+ *  (iii) every result answers a call — a result with no EARLIER assistant message emitting its id (its call is gone,
+ *       or it was recorded ahead of its call) answers nothing in this view and is left out. This is the one rule for
+ *       that shape on every request builder (the harness's request lane and the side query alike).
+ *
+ * The three lanes carry the same requirement in three spellings — the Anthropic Messages API rejects a `tool_use`
+ * followed by any non-`tool_use` block (between two calls as after the last), or whose `tool_result` is not in the
+ * very next message; chat completions requires the `tool` messages right after the assistant's `tool_calls`; the
+ * Responses API requires a `function_call_output` for every `function_call` — and each brain's own builder only ever
+ * merged ADJACENT results. One transcript that
+ * breaks the structure (a result recorded late, a note written after the calls) was therefore rejected on every
+ * later request of its session. Holding the law here, once, at the provider boundary means the three brains read
+ * the canonical form, and a session already carrying a broken turn is repaired on its next request.
+ *
+ * Attribution (some gateways number calls per request, so an id legitimately recurs across turns): a result belongs
+ * to the NEAREST EARLIER assistant message that emitted its id — and to nothing else: its recorded tool name is not a
+ * key. That is the persisted reconcile's positional reading (a call is answered by a result standing after it and
+ * before the id's next use), so the two readers never disagree about which occurrence a result answers; a name-based
+ * reading (7.37.1) reached back past turns the model had already answered.
+ * An earlier occurrence of a reused id that has no result before the next use is therefore closed as
+ * interrupted (outcome unknown), never handed a later occurrence's success; every result after the last use is that
+ * use's (two or more are folded). A result with no earlier call carrying its id is left out (iii). Pure and
+ * deterministic (a moved result keeps its object; a synthesized one takes its assistant's timestamp), so the same
+ * transcript yields the same request bytes and the prefix cache holds.
+ * The close the view synthesizes carries NO tool-effect refinement: the view holds no tool table and no record of
+ * which calls started, so every call it closes reads the reconcile family's conservative "outcome unknown — verify"
+ * wording, whatever the tool. (The persisted reconcile refines with the run's tool effects — a read-only or
+ * idempotent call's close says it may simply be re-issued — and, on a live abort, with the calls it saw start.)
+ * Returns the SAME array when nothing needed restoring.
+ */
+import type { AssertAllKeysHandled } from "../../core/ask-origin.js";
+import type { AssistantMessageDiagnostic } from "./diagnostics.js";
 import type { Message } from "./types.js";
 /** What the law restored — the `forms` of a `context.tool_turn_repaired` notice. */
-export declare const TOOL_TURN_REPAIR_FORMS: readonly ["trailing_text", "late_result", "missing_result", "duplicate_result"];
+export declare const TOOL_TURN_REPAIR_FORMS: readonly ["trailing_text", "late_result", "missing_result", "duplicate_result", "duplicate_call", "orphan_result"];
 export type ToolTurnRepairForm = (typeof TOOL_TURN_REPAIR_FORMS)[number];
-/** One restoration on one assistant message. */
+/** Does the form leave recorded content out of the request (a call, a result), rather than move, fold or add it?
+ *  A request that did is a lossy projection of the session — the harness never seeds a fork summary from it. */
+export declare const TOOL_TURN_REPAIR_DROPS: {
+    readonly trailing_text: false;
+    readonly late_result: false;
+    readonly missing_result: false;
+    readonly duplicate_result: false;
+    readonly duplicate_call: true;
+    readonly orphan_result: true;
+};
+export type DropsTableCoversEveryForm = AssertAllKeysHandled<Exclude<ToolTurnRepairForm, keyof typeof TOOL_TURN_REPAIR_DROPS>>;
+/**
+ * Why a tool turn reached the model incomplete — the `task.tool_turn_incomplete` notice's `detail.cause`, the person's
+ * view of facts the model is already told in the turn itself. Closed:
+ *  · `truncated` — calls whose argument bytes were cut before they parsed: dropped, the model asked to re-issue them;
+ *  · `unnamed` — calls that arrived with no tool name: dropped the same way;
+ *  · `bad_frame` — provider stream frames that were not valid JSON: dropped, so the response may be missing content;
+ *  · `missing_result_synthesized` — a call with no recorded result, closed in the request view as interrupted with its
+ *    outcome unknown (the `missing_result` repair).
+ * The first three are a brain's stream facts ({@link StreamDropCause}), stamped on the turn's own message; the fourth is
+ * the request view's.
+ */
+export declare const TOOL_TURN_INCOMPLETE_CAUSES: readonly ["truncated", "unnamed", "bad_frame", "missing_result_synthesized"];
+export type ToolTurnIncompleteCause = (typeof TOOL_TURN_INCOMPLETE_CAUSES)[number];
+/** The causes a brain's stream parse finds — what a turn's own message can report. */
+export type StreamDropCause = Exclude<ToolTurnIncompleteCause, "missing_result_synthesized">;
+/** One cause a turn's stream dropped content for, and how many calls (or frames) it dropped. */
+export interface StreamDrop {
+    readonly cause: StreamDropCause;
+    readonly count: number;
+}
+/** Stamp a turn's stream drops on its message (`AssistantMessage.diagnostics`); nothing for a turn that dropped none. */
+export declare function stampStreamDrops(message: {
+    diagnostics?: AssistantMessageDiagnostic[];
+}, drops: readonly StreamDrop[]): void;
+/** The stream drops a message reports. A host brain's message is not trusted to be well-formed: an entry counts only
+ *  with a closed-set cause and a positive integer count; anything else reads as no drop. */
+export declare function streamDropsOf(message: {
+    readonly diagnostics?: unknown;
+}): StreamDrop[];
+/** One restoration: on one assistant message, or — for `orphan_result` — on the view as a whole. */
 export interface ToolTurnRepair {
     readonly form: ToolTurnRepairForm;
-    /** The calls concerned, in call order — for `trailing_text` every call of the message; otherwise the calls whose
-     *  result was moved up, synthesized, or folded with a second one. */
+    /** The calls concerned, in call order — for `trailing_text` every call of the message; for `duplicate_call` the
+     *  ids a later call of the message repeated; for `orphan_result` the ids of the results left out, once each, in
+     *  transcript order; otherwise the calls whose result was moved up, synthesized, or folded with a second one. */
     readonly toolCallIds: readonly string[];
 }
 export interface ToolTurnView {

package/dist/engine/llm/tool-turns.js

@@ -1,5 +1,48 @@
 import { interruptedResultMessage, interruptedResults, isInterruptedClose } from "../../core/session-reconcile.js";
-export const TOOL_TURN_REPAIR_FORMS = ["trailing_text", "late_result", "missing_result", "duplicate_result"];
+export const TOOL_TURN_REPAIR_FORMS = Object.freeze(["trailing_text", "late_result", "missing_result", "duplicate_result", "duplicate_call", "orphan_result"]);
+export const TOOL_TURN_REPAIR_DROPS = {
+    trailing_text: false,
+    late_result: false,
+    missing_result: false,
+    duplicate_result: false,
+    duplicate_call: true,
+    orphan_result: true,
+};
+export const TOOL_TURN_INCOMPLETE_CAUSES = Object.freeze(["truncated", "unnamed", "bad_frame", "missing_result_synthesized"]);
+const STREAM_DROPS_DIAGNOSTIC = "stream_drops";
+const STREAM_DROP_CAUSES = new Set(["truncated", "unnamed", "bad_frame"]);
+export function stampStreamDrops(message, drops) {
+    if (drops.length === 0)
+        return;
+    message.diagnostics = [...(message.diagnostics ?? []), { type: STREAM_DROPS_DIAGNOSTIC, timestamp: Date.now(), details: { drops: drops.map(({ cause, count }) => ({ cause, count })) } }];
+}
+export function streamDropsOf(message) {
+    const out = [];
+    try {
+        const diagnostics = message.diagnostics;
+        if (!Array.isArray(diagnostics))
+            return out;
+        const entries = diagnostics;
+        for (const entry of entries) {
+            if (typeof entry !== "object" || entry === null || entry.type !== STREAM_DROPS_DIAGNOSTIC)
+                continue;
+            const drops = (entry.details ?? {}).drops;
+            if (!Array.isArray(drops))
+                continue;
+            const items = drops;
+            for (const d of items) {
+                const cause = d?.cause;
+                const count = d?.count;
+                if (typeof cause === "string" && STREAM_DROP_CAUSES.has(cause) && typeof count === "number" && Number.isInteger(count) && count > 0)
+                    out.push({ cause: cause, count });
+            }
+        }
+    }
+    catch {
+        return [];
+    }
+    return out;
+}
 function callsOf(m) {
     return m.role === "assistant" && Array.isArray(m.content) ? m.content.filter((c) => c?.type === "toolCall") : [];
 }
@@ -10,6 +53,7 @@ export function ensureToolTurnInvariants(messages) {
     const sites = new Map();
     const ownerOf = new Map();
     const resultsOf = new Map();
+    const orphans = new Set();
     messages.forEach((m, i) => {
         if (m.role === "assistant") {
             for (const call of callsOf(m)) {
@@ -23,8 +67,10 @@ export function ensureToolTurnInvariants(messages) {
         if (m.role !== "toolResult")
             return;
         const all = sites.get(m.toolCallId) ?? [];
-        if (all.length === 0)
+        if (all.length === 0) {
+            orphans.add(i);
             return;
+        }
         const owner = all.at(-1);
         ownerOf.set(i, owner);
         const batch = resultsOf.get(owner);
@@ -36,7 +82,7 @@ export function ensureToolTurnInvariants(messages) {
     const repairs = [];
     const out = [];
     messages.forEach((m, i) => {
-        if (ownerOf.has(i))
+        if (ownerOf.has(i) || orphans.has(i))
             return;
         const calls = callsOf(m);
         if (calls.length === 0) {
@@ -44,16 +90,22 @@ export function ensureToolTurnInvariants(messages) {
             return;
         }
         const assistant = m;
-        const firstCall = assistant.content.findIndex((c) => c?.type === "toolCall");
-        const trails = assistant.content.slice(firstCall).some((c) => c?.type !== "toolCall");
-        out.push(trails ? { ...assistant, content: [...assistant.content.filter((c) => c?.type !== "toolCall"), ...calls] } : assistant);
-        if (trails)
-            repairs.push({ form: "trailing_text", toolCallIds: calls.map((c) => c.id) });
         const byId = new Map();
-        for (const call of calls)
+        const repeated = [];
+        for (const call of calls) {
             if (!byId.has(call.id))
                 byId.set(call.id, call);
+            else if (!repeated.includes(call.id))
+                repeated.push(call.id);
+        }
         const ids = [...byId.keys()];
+        const firstCall = assistant.content.findIndex((c) => c?.type === "toolCall");
+        const trails = assistant.content.slice(firstCall).some((c) => c?.type !== "toolCall");
+        out.push(trails || repeated.length > 0 ? { ...assistant, content: [...assistant.content.filter((c) => c?.type !== "toolCall"), ...byId.values()] } : assistant);
+        if (trails)
+            repairs.push({ form: "trailing_text", toolCallIds: ids });
+        if (repeated.length > 0)
+            repairs.push({ form: "duplicate_call", toolCallIds: repeated });
         const recorded = new Map();
         for (const r of resultsOf.get(i) ?? []) {
             const id = messages[r].toolCallId;
@@ -84,6 +136,8 @@ export function ensureToolTurnInvariants(messages) {
         if (duplicate.length > 0)
             repairs.push({ form: "duplicate_result", toolCallIds: inCallOrder(duplicate) });
     });
+    if (orphans.size > 0)
+        repairs.push({ form: "orphan_result", toolCallIds: [...new Set([...orphans].map((i) => messages[i].toolCallId))] });
     return repairs.length === 0 ? { messages, repairs } : { messages: out, repairs };
 }
 function foldResults(first, second) {

package/dist/engine/llm/types.d.ts

@@ -434,6 +434,17 @@ export interface AssistantMessage {
      * as `0`.
      */
     apiErrorStatus?: number;
+    /**
+     * The provider's own word for a REFUSED request, read structurally from its JSON error envelope (`error.code`, else
+     * `error.type`) — e.g. `invalid_request_error`, `context_length_exceeded`. Only meaningful together with
+     * {@link isApiErrorMessage}; provider vocabulary, never an engine closed set.
+     *
+     * PRESENCE: only beside a 4xx {@link apiErrorStatus} (the provider refused the request as sent) whose envelope stated
+     * such a word in the provider echo shape (visible ASCII, 1–128 characters). ABSENT otherwise — any other status, a
+     * plain-text or torn body, an envelope with neither member, or a word outside the shape (dropped whole, never
+     * truncated). The run's `terminal.detail.code` is this value.
+     */
+    apiErrorCode?: string;
     diagnostics?: AssistantMessageDiagnostic[];
     usage: Usage;
     /** TB 尸检 T1-5: the provider never delivered a usage frame for this message (e.g. a

package/dist/index.d.ts

@@ -63,8 +63,10 @@ export { MCP_FAILURE_KINDS, MCP_DELIVERY_VERDICTS, MCP_LIVENESS_STATES, classify
 export { MCP_INJECTION_DROP_REASONS, MCP_INJECTION_DROP_TEXT, mcpInjectionDroppedNotice, type McpInjectionDropReason, type McpInjectionDropFacts } from "./core/mcp-injection-drop.js";
 export { askUnresolvableNotice, type AskUnresolvableFacts } from "./core/ask-unresolvable-notice.js";
 export { ASK_UNRESOLVABLE_CAUSES } from "./core/ask-unresolvable-notice.js";
+export { USER_STEER_UNDRAINED_CAUSES, type UserSteerUndrainedCause } from "./core/engine-notice.js";
+export { TOOL_TURN_INCOMPLETE_CAUSES, type ToolTurnIncompleteCause } from "./internal/llm.js";
 export { DURABLE_MANDATE_SOURCES } from "./core/tool-policy.js";
-export { TERMINAL_CAUSE_IS_REPLAYABLE } from "./core/terminal-cause.js";
+export { TERMINAL_CAUSE_IS_REPLAYABLE, type TerminalFailureDetail } from "./core/terminal-cause.js";
 export { RESERVED_AGENT_NAMES } from "./agents/subagent.js";
 export { WORKFLOW_SIZE_GUIDELINE_AGENT_CAPS } from "./orchestration/workflow-size-guideline.js";
 export { ENGINE_AUTHORITY_ENVELOPE_TAGS } from "./core/untrusted-text.js";
@@ -79,7 +81,7 @@ export { BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, WEB_FETCH_TOOL_NAME
 export { admitMemoryScopes, foldAdmissionFreeze, type OwnOrgAdmissionVerdict, type MemoryAdmissionInput, type MemoryAdmissionOutcome, type MemoryAdmissionVerdict, type MemoryScopeAdmission, type MemoryScopeOrigin, type MemoryScopeRequest, } from "./core/memory-admission.js";
 export { assertRetentionCapability, RETENTION_CASCADE_DOMAINS, RETENTION_CASCADE_EXEMPT, type ManagedRetentionCapability, type RetentionDeclaration, type RetentionDeclaring, type RetentionPolicy, type RetentionReceipt, } from "./core/retention.js";
 export { GOVERNANCE_CODES, governanceRetryClass, TOOL_DECLARATION_CODES, type GovernanceCode, type GovernanceRetryClass, type ToolDeclarationCode } from "./core/governance-codes.js";
-export { NOTICE_AUDIENCE, noticeAudienceOf, ENGINE_NOTICE_CODES, type EngineNoticeCode, type NoticeAudience } from "./core/governance-codes.js";
+export { NOTICE_AUDIENCE, noticeAudienceOf, ENGINE_NOTICE_CODES, NOTICE_MINTER, type EngineNoticeCode, type NoticeAudience, type NoticeMinter } from "./core/governance-codes.js";
 export { TtlSessionStore, type TtlSessionStoreOptions, type EvictPolicy } from "./core/session-store.js";
 export { reconcileInterruptedSession, findOrphanToolCalls, type OrphanToolCall, type ReconcileReport, } from "./core/session-reconcile.js";
 export { StoredSession, InMemorySessionRepo, InMemorySessionStorage, BaseSessionStorage, leafIdAfterEntry, validateEntriesForImport, StreamingImportValidator, boundedTail, SessionError, isSessionConflict, hasSessionFork, uuidv7, type Session, type SessionStore, type AcquiredSession, type SessionStoreSummary, type SessionStorage, type SessionRepo, type SessionMetadata, type SessionTreeEntry, type SessionWriteOptions, type SessionPlacement, type SessionPlacementRecord, type PlacedSessionRow, } from "./core/session.js";
@@ -191,7 +193,7 @@ export { createAllowDenyPolicy, createApprovalPolicy,
  *  `Parameters<typeof createApprovalPolicy>[0]["approve"]`. */
 type ApprovalSeatOutcome, COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, findUnverifiableRecursiveDelete, combinePolicies, wrapToolPolicy, decisionText, resolveAsk, toolPolicyNameSets, toolPolicyPathDenyRules, type ToolPolicyNameSets, type NamedToolPolicy, type ToolPolicyProjection, type ToolPolicyProjectionComponent, type ConstraintChainEntry, checkToolPolicyProjection, constraintChainEntryOf, constraintChainDigest, type ToolPolicy, type ToolCallRequest, type PermissionResult, type DecisionReason, screenApproverAttribution, APPROVER_ATTRIBUTION_MAX_CHARS, type OnAsk, type AskOutcome, type ResolvedAsk, type AskRequest, type AskDelegationProvenance, type AskRuleEvidence, type AskEvidenceAbsence, ASK_EVIDENCE_ABSENCE_VALUES, } from "./core/tool-policy.js";
 export { type ReadRootGrantScreen } from "./core/read-root-grant-screen.js";
-export { type AskOrigin, ASK_ORIGINS, isAskOrigin, ORIGIN_IMPLIES_REAL_APPROVAL, PERSISTED_RULE_MANDATES, type PersistedRuleMandate, isPersistedRuleMandate } from "./core/ask-origin.js";
+export { type AskOrigin, ASK_ORIGINS, isAskOrigin, ORIGIN_IMPLIES_REAL_APPROVAL, PERSISTED_RULE_MANDATES, type PersistedRuleMandate, isPersistedRuleMandate, screenAskClassMembers } from "./core/ask-origin.js";
 export { PERMISSION_MODES, type PermissionMode, isPermissionMode, PERMISSION_MODE_RANK, clampPermissionMode, ASK_CLASSES, type AskClass, isAskClass, MODE_ARBITRATION, type ModeArbitrationRow, RELEASABLE_ASK_CLASSES, MODE_RELEASE_REASONS, type ModeReleaseReason, isModeReleaseReason, RRA_EXPLAINERS, classifyAsk, foldArbitrationRow, type AskClassification, type AskClassFacts, type ToolMarkSource, arbitrateByMode, type Arbitration, fileCommandOptionsSentence } from "./core/ask-origin.js";
 export { modePolicyOf, type ModePolicy, PERMISSION_MODE_FOLD_REASONS, type PermissionModeFoldReason, type PermissionModeReceipt, ACCEPT_EDITS_FILE_COMMANDS, modeAcceptsFileCommand } from "./core/mode-policy.js";
 export { readDenyClassifierRules, renderClassifierDenyRules, type DerivedDenyRule } from "./core/auto-mode-prompt.js";

package/dist/index.js

@@ -49,6 +49,8 @@ export { MCP_FAILURE_KINDS, MCP_DELIVERY_VERDICTS, MCP_LIVENESS_STATES, classify
 export { MCP_INJECTION_DROP_REASONS, MCP_INJECTION_DROP_TEXT, mcpInjectionDroppedNotice } from "./core/mcp-injection-drop.js";
 export { askUnresolvableNotice } from "./core/ask-unresolvable-notice.js";
 export { ASK_UNRESOLVABLE_CAUSES } from "./core/ask-unresolvable-notice.js";
+export { USER_STEER_UNDRAINED_CAUSES } from "./core/engine-notice.js";
+export { TOOL_TURN_INCOMPLETE_CAUSES } from "./internal/llm.js";
 export { DURABLE_MANDATE_SOURCES } from "./core/tool-policy.js";
 export { TERMINAL_CAUSE_IS_REPLAYABLE } from "./core/terminal-cause.js";
 export { RESERVED_AGENT_NAMES } from "./agents/subagent.js";
@@ -65,7 +67,7 @@ export { BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, WEB_FETCH_TOOL_NAME
 export { admitMemoryScopes, foldAdmissionFreeze, } from "./core/memory-admission.js";
 export { assertRetentionCapability, RETENTION_CASCADE_DOMAINS, RETENTION_CASCADE_EXEMPT, } from "./core/retention.js";
 export { GOVERNANCE_CODES, governanceRetryClass, TOOL_DECLARATION_CODES } from "./core/governance-codes.js";
-export { NOTICE_AUDIENCE, noticeAudienceOf, ENGINE_NOTICE_CODES } from "./core/governance-codes.js";
+export { NOTICE_AUDIENCE, noticeAudienceOf, ENGINE_NOTICE_CODES, NOTICE_MINTER } from "./core/governance-codes.js";
 export { TtlSessionStore } from "./core/session-store.js";
 export { reconcileInterruptedSession, findOrphanToolCalls, } from "./core/session-reconcile.js";
 export { StoredSession, InMemorySessionRepo, InMemorySessionStorage, BaseSessionStorage, leafIdAfterEntry, validateEntriesForImport, StreamingImportValidator, boundedTail, SessionError, isSessionConflict, hasSessionFork, uuidv7, } from "./core/session.js";
@@ -156,7 +158,7 @@ export { resolveAutonomousLoopPrompt, AUTONOMOUS_LOOP_PREAMBLE, AUTONOMOUS_LOOP_
 export { tightenTaskSpec, TaskSpecTightenError } from "./core/tighten-task-spec.js";
 export { createAllowDenyPolicy, createApprovalPolicy, COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, findUnverifiableRecursiveDelete, combinePolicies, wrapToolPolicy, decisionText, resolveAsk, toolPolicyNameSets, toolPolicyPathDenyRules, checkToolPolicyProjection, constraintChainEntryOf, constraintChainDigest, screenApproverAttribution, APPROVER_ATTRIBUTION_MAX_CHARS, ASK_EVIDENCE_ABSENCE_VALUES, } from "./core/tool-policy.js";
 export {} from "./core/read-root-grant-screen.js";
-export { ASK_ORIGINS, isAskOrigin, ORIGIN_IMPLIES_REAL_APPROVAL, PERSISTED_RULE_MANDATES, isPersistedRuleMandate } from "./core/ask-origin.js";
+export { ASK_ORIGINS, isAskOrigin, ORIGIN_IMPLIES_REAL_APPROVAL, PERSISTED_RULE_MANDATES, isPersistedRuleMandate, screenAskClassMembers } from "./core/ask-origin.js";
 export { PERMISSION_MODES, isPermissionMode, PERMISSION_MODE_RANK, clampPermissionMode, ASK_CLASSES, isAskClass, MODE_ARBITRATION, RELEASABLE_ASK_CLASSES, MODE_RELEASE_REASONS, isModeReleaseReason, RRA_EXPLAINERS, classifyAsk, foldArbitrationRow, arbitrateByMode, fileCommandOptionsSentence } from "./core/ask-origin.js";
 export { modePolicyOf, PERMISSION_MODE_FOLD_REASONS, ACCEPT_EDITS_FILE_COMMANDS, modeAcceptsFileCommand } from "./core/mode-policy.js";
 export { readDenyClassifierRules, renderClassifierDenyRules } from "./core/auto-mode-prompt.js";

package/dist/internal/llm.d.ts

@@ -4,5 +4,5 @@
  * design/118 ①②: the layer is now first-party (`src/engine/llm/`, naturalized out of the vendored
  * llm-core); the facade stays so consumers never notice which side a symbol lives on.
  */
-export { createAssistantMessageEventStream, ensureToolTurnInvariants, snapshotActorAssertion, stripEngineMetadata } from "../engine/llm/index.js";
-export type { ActorAssertion, AnthropicMessagesCompat, OpenAICompletionsCompat, OpenAIResponsesCompat, AssistantMessage, AssistantMessageDiagnostic, AssistantMessageEvent, CompleteSimpleFn, Context, DocumentContent, ImageContent, Message, Model, ResilienceOptions, RouteAdjudication, RouteCredential, RouteCredentialSource, RoutePairingConfig, RoutePairingPosture, RouteRefusalCode, RouteRefusalDetail, SimpleStreamOptions, StallTimeouts, StopReason, StreamFn, TextContent, ThinkingContent, Tool, ToolCall, ToolResultMessage, ToolTurnRepair, Usage, UserMessage, } from "../engine/llm/index.js";
+export { createAssistantMessageEventStream, ensureToolTurnInvariants, snapshotActorAssertion, stampStreamDrops, streamDropsOf, stripEngineMetadata, TOOL_TURN_INCOMPLETE_CAUSES, TOOL_TURN_REPAIR_DROPS } from "../engine/llm/index.js";
+export type { ActorAssertion, AnthropicMessagesCompat, OpenAICompletionsCompat, OpenAIResponsesCompat, AssistantMessage, AssistantMessageDiagnostic, AssistantMessageEvent, CompleteSimpleFn, Context, DocumentContent, ImageContent, Message, Model, ResilienceOptions, RouteAdjudication, RouteCredential, RouteCredentialSource, RoutePairingConfig, RoutePairingPosture, RouteRefusalCode, RouteRefusalDetail, SimpleStreamOptions, StallTimeouts, StopReason, StreamFn, TextContent, ThinkingContent, Tool, ToolCall, ToolResultMessage, StreamDrop, StreamDropCause, ToolTurnIncompleteCause, ToolTurnRepair, Usage, UserMessage, } from "../engine/llm/index.js";

package/dist/internal/llm.js

@@ -1 +1 @@
-export { createAssistantMessageEventStream, ensureToolTurnInvariants, snapshotActorAssertion, stripEngineMetadata } from "../engine/llm/index.js";
+export { createAssistantMessageEventStream, ensureToolTurnInvariants, snapshotActorAssertion, stampStreamDrops, streamDropsOf, stripEngineMetadata, TOOL_TURN_INCOMPLETE_CAUSES, TOOL_TURN_REPAIR_DROPS } from "../engine/llm/index.js";

package/dist/orchestration/workflow-governance.js

@@ -15,7 +15,7 @@ export class WorkflowModelNotAllowedError extends Error {
         this.name = "WorkflowModelNotAllowedError";
     }
 }
-export const WHITELIST_KEYS = [
+export const WHITELIST_KEYS = Object.freeze([
     "objective",
     "modelName",
     "thinking",
@@ -25,7 +25,7 @@ export const WHITELIST_KEYS = [
     "readFace",
     "writeFace",
     "readDenyPatterns",
-];
+]);
 const WHITELIST_KEY_SET = new Set(WHITELIST_KEYS);
 export const SPEC_KEY_ALIASES = new Map([["model", "modelName"]]);
 export const STRIPPED_KEYS_NOTICE_CODE = "workflow.governance_key_stripped";

package/dist/orchestration/workflow-types.js

@@ -1,5 +1,5 @@
-export const PARK_TRUTH_UNREADABLE_REASONS = ["store_threw", "record_missing", "record_not_terminal", "parks_unreadable", "admission_incomplete", "checkpoint_store_threw", "capability_not_armed"];
-export const PARK_NOT_PENDING_STATUSES = ["resolved", "expired", "absent"];
+export const PARK_TRUTH_UNREADABLE_REASONS = Object.freeze(["store_threw", "record_missing", "record_not_terminal", "parks_unreadable", "admission_incomplete", "checkpoint_store_threw", "capability_not_armed"]);
+export const PARK_NOT_PENDING_STATUSES = Object.freeze(["resolved", "expired", "absent"]);
 export class WorkflowBudgetExceededError extends Error {
     spent;
     total;

package/dist/shell/lex.js

@@ -1,7 +1,7 @@
 export const SHELL_LEX_DIALECT = "bash";
-export const QUOTE_KINDS = ["'", '"', "$'", '$"', "\\"];
-export const EXPANSION_KINDS = ["parameter", "command", "process", "arithmetic", "tilde", "brace", "glob"];
-export const UNRESOLVED_REASONS = ["ansi_c_escape", "locale_string", "parameter_text", "subscript_text", "compound_array_value"];
+export const QUOTE_KINDS = Object.freeze(["'", '"', "$'", '$"', "\\"]);
+export const EXPANSION_KINDS = Object.freeze(["parameter", "command", "process", "arithmetic", "tilde", "brace", "glob"]);
+export const UNRESOLVED_REASONS = Object.freeze(["ansi_c_escape", "locale_string", "parameter_text", "subscript_text", "compound_array_value"]);
 export const UNRESOLVED_SENTENCE = {
     ansi_c_escape: "an ANSI-C quoted word carries an escape this lexer does not fold",
     locale_string: "a locale-translated string carries text this lexer does not read",
@@ -9,7 +9,7 @@ export const UNRESOLVED_SENTENCE = {
     subscript_text: "a subscript carries text this lexer does not read",
     compound_array_value: "a compound assignment value is a list this lexer does not read",
 };
-export const PARSE_FAILURE_REASONS = [
+export const PARSE_FAILURE_REASONS = Object.freeze([
     "unterminated_single_quote",
     "unterminated_double_quote",
     "unterminated_ansi_c",
@@ -23,7 +23,7 @@ export const PARSE_FAILURE_REASONS = [
     "redirect_without_target",
     "heredoc_without_delimiter",
     "heredoc_delimiter_expands",
-];
+]);
 export const PARSE_FAILURE_SENTENCE = {
     unterminated_single_quote: "a single-quoted word never closes",
     unterminated_double_quote: "a double-quoted word never closes",
@@ -39,7 +39,7 @@ export const PARSE_FAILURE_SENTENCE = {
     heredoc_without_delimiter: "a here-document operator names no delimiter",
     heredoc_delimiter_expands: "a here-document delimiter is not a plain word",
 };
-export const BASH_ONLY_CONSTRUCTS = [
+export const BASH_ONLY_CONSTRUCTS = Object.freeze([
     "ansi_c_quoting",
     "locale_string",
     "append_assignment",
@@ -50,7 +50,7 @@ export const BASH_ONLY_CONSTRUCTS = [
     "redirect_both",
     "pipe_both",
     "brace_expansion",
-];
+]);
 export const ANSI_C_ESCAPES = {
     a: "\x07",
     b: "\b",

package/dist/tools/fs/bash-program-position.js

@@ -89,7 +89,7 @@ function launcherOptionStep(row, tok) {
         return 1;
     return undefined;
 }
-export const PROGRAM_POSITION_REFUSAL_KINDS = ["option_at_program_position", "control_syntax_at_program_position"];
+export const PROGRAM_POSITION_REFUSAL_KINDS = Object.freeze(["option_at_program_position", "control_syntax_at_program_position"]);
 export function readProgramPosition(words) {
     const folded = words.map((w) => w.folded);
     const controlWords = [];
@@ -172,7 +172,7 @@ export function argvReentryUnjudged(pos, acceptedTargets) {
     const runs = pos.program?.basename ?? (pos.runsDefaultProgram ? ARGV_REENTRY_DEFAULT_PROGRAM : undefined);
     return runs === undefined || !acceptedTargets.has(runs);
 }
-export const SHELL_SCAN_DECLINES = ["unreadable_program_position", "stream_fed_operands"];
+export const SHELL_SCAN_DECLINES = Object.freeze(["unreadable_program_position", "stream_fed_operands"]);
 export function programPositionRunsShell(pos, shellProgram) {
     if (pos.refusal !== undefined)
         return pos.refusal.kind === "control_syntax_at_program_position" && pos.refusal.runsShell === true;

package/dist/tools/fs/fs-shared.d.ts

@@ -2,6 +2,7 @@ import { Type } from "typebox";
 import type { ExecutionEnv } from "../../internal/harness-types.js";
 import { type FsViolation, type ReadFileState } from "./safety.js";
 import { type DecodedTextFile } from "./encoding.js";
+import { type HomeViewsCarrier } from "./read-deny-home.js";
 import { type ImageDownsampler } from "../../core/mcp.js";
 import { type EngineNotice } from "../../core/types.js";
 /**
@@ -543,7 +544,7 @@ export declare function enoentMessage(env: ExecutionEnv, key: string, cwd: strin
     matchPath(path: string): {
         pattern: string;
     } | null;
-}): Promise<string>;
+} & HomeViewsCarrier): Promise<string>;
 /** Per-task mutable working directory shared by the shell and the path-taking fs tools.
  *  Holds the RAW path (never canonicalized): bash `cd` updates `current`, and the fs tools resolve relative
  *  paths against it. Containment is still enforced per-op by resolveKey (canonicalize + within), so a `cd`

package/dist/tools/fs/fs-shared.js

@@ -345,7 +345,7 @@ export function applyContextShrinkToReadFileState(state, shrink) {
 export async function enoentMessage(env, key, cwd, signal, readDeny) {
     let msg = `File does not exist. Note: your current working directory is ${cwd}.`;
     const sep = Math.max(key.lastIndexOf("/"), key.lastIndexOf("\\"));
-    const views = readDeny !== undefined ? homeViewsOf(env, signal) : undefined;
+    const views = readDeny !== undefined ? homeViewsOf(env, readDeny, signal) : undefined;
     const denied = async (path, leaf) => {
         if (readDeny === undefined || views === undefined)
             return false;

package/dist/tools/fs/index.d.ts

@@ -186,17 +186,24 @@ export interface HandsToolkitOptions {
      *  time (never silently ignored). Deployment seat ONLY, same clamp argument as the tiers key. */
     readDenyBuiltinExclude?: readonly string[];
     /** The spellings of the execution environment's home a home-anchored deny row (`~/…`) is placed under
-     *  ({@link import("./read-deny-home.js").readDenyHomesOf}: the declared home and its canonical spelling). Absolute path
-     *  strings only — any other shape throws at wiring time, naming the seat. The Runner passes the spellings its own judge
-     *  was compiled with. */
+     *  ({@link import("./read-deny-home.js").readDenyHomesOf}: the declared home and the account home, each with its canonical
+     *  spelling). Absolute path strings only — any other shape throws at wiring time, naming the seat. The Runner passes the
+     *  spellings its own judge was compiled with. A list given here is the band's home set as is: the account database is
+     *  not asked and no home is added (each listed home is anchored at its spelling and, where the environment answers one,
+     *  its canonical spelling), and the band's home views (a path spelled through a firmlink or a bind mount of a home,
+     *  judged at the home) read this list and the environment's declared home; an entry that is not the declared home is probed once,
+     *  under a short bound of its own, and a probe of it that fails costs that entry alone. */
     readDenyHomes?: readonly string[];
     /** Where each home-anchored row's literal head leads beyond the home's spellings
      *  ({@link import("./read-deny-home.js").readDenyHomeLinksOf}, keyed by the row's pattern) — the Runner passes the
      *  locations its own judge was compiled with, so the band and the gate judge one placement.
      *  Unless a mount carries both, the band resolves the placement itself the way the Runner does (the homes it carries
-     *  are used as given; {@link import("./read-deny-home.js").placeReadDenyAtHome}), and its read tools (Read / Grep /
-     *  Glob / RepoMap) wait for that placement before they judge anything. A placement that fails leaves the home-anchored
-     *  rows held anywhere. */
+     *  are its home set — the account is not asked and no home is added;
+     *  {@link import("./read-deny-home.js").placeReadDenyAtHome}), and its read tools (Read / Grep / Glob / RepoMap) wait
+     *  for that placement before they judge anything. A placement that fails leaves the home-anchored rows held anywhere.
+     *  Carrying both is the engine's own handoff of ONE placement — its home views travel with it — so
+     *  `readDenyHomes` must then be the very list that placement returned: any other list (a copy) holds the home-anchored
+     *  rows at every location and is named on `console.warn`. */
     readDenyHomeLinks?: ReadonlyMap<string, readonly string[]>;
     /** The permission-rule rows of the deny table ({@link import("./read-deny.js").PathRuleDenyRow}, `ToolPolicy.pathDenyRules`):
      *  the read-face rows join the structured read faces' judge beside the segment rows. The Runner passes the leg's own. */