@sema-agent/core 7.38.2 → 7.39.0

package/dist/core/wiring-manifest.js

@@ -42,7 +42,9 @@ export function resolveSubagentTranscriptTier(agentStoreWired, sessionStore) {
     e.code = "config.store_durability_invalid";
     throw e;
 }
-export function deriveAskEffective(form, parkEffective) {
+export function deriveAskEffective(form, parkEffective, mode) {
+    if (mode === "dontAsk")
+        return "auto_deny";
     switch (form) {
         case "callback":
             return "human_reachable";
@@ -59,6 +61,9 @@ export function deriveAskEffective(form, parkEffective) {
         }
     }
 }
+export function askSeatEffective(manifest) {
+    return deriveAskEffective(manifest.ask.form, manifest.parkLane.effective);
+}
 export function askReachesPerson(ask) {
     const effective = ask.effective ?? "unresolved";
     switch (effective) {
@@ -148,7 +153,7 @@ export function deriveWiringManifest(facts) {
         ask: {
             form: facts.askForm,
             ...(facts.askProvenance !== undefined ? { provenance: facts.askProvenance } : {}),
-            ...(facts.half === "effective" ? { effective: deriveAskEffective(facts.askForm, parkLane.effective) } : {}),
+            ...(facts.half === "effective" ? { effective: deriveAskEffective(facts.askForm, parkLane.effective, facts.permissionMode?.effective) } : {}),
         },
         question: {
             wired: questionChannel,
@@ -200,7 +205,7 @@ export function deriveWiringManifest(facts) {
         const { provenance: _askSeat, ...askForHash } = assembly.ask;
         const { provenance: _questionSeat, ...questionForHash } = assembly.question;
         manifest.configFingerprint = createHash("sha256")
-            .update(canonicalize({ ...assembly, ask: askForHash, question: questionForHash }))
+            .update(canonicalize({ ...assembly, ask: { ...askForHash, effective: deriveAskEffective(facts.askForm, parkLane.effective) }, question: questionForHash }))
             .digest("hex")
             .slice(0, 16);
     }

package/dist/engine/harness/agent-harness.d.ts

@@ -194,6 +194,9 @@ export declare class AgentHarness<TSkill extends Skill = Skill, TPromptTemplate
      *  with every request view that needed one (the transcript is never rewritten, so a broken turn is repaired, and
      *  reported, on each request; the sink owns its dedup). Advisory: a throwing sink never breaks the request. */
     onToolTurnRepaired?: (repairs: readonly ToolTurnRepair[]) => void;
+    /** The assistant messages standing in the transcript when the current run began — what the request view reads as
+     *  "before this run" (a message is the run's own unless it is in here). */
+    private runHistory?;
     /** backlog #259 — USER-authored queue remnants at agent_end: steers/follow-ups whose receipts said
      *  "queued" but that no turn will ever drain (the run ended first). The engine-note sweep above
      *  hands ENGINE payloads back for redelivery; user inputs have no redelivery semantics (a steer
@@ -212,6 +215,13 @@ export declare class AgentHarness<TSkill extends Skill = Skill, TPromptTemplate
      *  Advisory (swallow-guarded at the call sites via the runner's own closure); never re-entered
      *  for the same payload — consumption deletes the sidecar entry in the same step. */
     onEngineNoteConsumed?: (payload: unknown) => void;
+    /** backlog #1273 — runner-set sink fired ONCE per CALLER frame at the moment the frame is in the transcript (its
+     *  `message_end` append — the next request carries it), with the opaque park record the frame rode in on
+     *  ({@link UserMessageProvenance.parkRecord}). The consumption point of a caller input, deliberately NOT the drain:
+     *  a drained frame can still be dropped before its turn starts (a halt latched or an abort landing after the drain)
+     *  and goes back into the park / undrained account, so a drain-time report would announce an input the model never
+     *  saw. Advisory (swallow-guarded); the record is released in the same step, so a delivered frame reports once. */
+    onUserInputConsumed?: (parkRecord: unknown) => void;
     /** #1036 — THE RECEIPT SINK: a frame reached the TRANSCRIPT, reported at the `message_end` append
      *  that proves it, with its carrier and entry id. Advisory. */
     onFrameCommitted?: (carrier: CommittedFrameCarrier, entryId: string) => void;

package/dist/engine/harness/agent-harness.js

@@ -212,12 +212,14 @@ export class AgentHarness {
     thinkingLevel;
     onUndrainedEngineNotes;
     onToolTurnRepaired;
+    runHistory;
     onUndrainedUserInputs;
     onEngineNoteConsumed;
+    onUserInputConsumed;
     onFrameCommitted;
     engineInjectionsHeld;
     holdToolTurnLaw(messages) {
-        const view = ensureToolTurnInvariants(messages);
+        const view = ensureToolTurnInvariants(messages, this.runHistory);
         if (view.repairs.length > 0) {
             try {
                 this.onToolTurnRepaired?.(view.repairs);
@@ -603,7 +605,15 @@ export class AgentHarness {
         if (!this.drainedPendingInjection.includes(message))
             return;
         this.unbookInFlight([message]);
+        const parkRecord = userInputParkRecords.get(message);
         userInputParkRecords.delete(message);
+        if (parkRecord !== undefined) {
+            try {
+                this.onUserInputConsumed?.(parkRecord);
+            }
+            catch {
+            }
+        }
         if (entryId !== undefined) {
             const payload = engineNotePayloads.get(message);
             if (payload !== undefined) {
@@ -878,6 +888,7 @@ export class AgentHarness {
     async executeTurn(turnState, text, options, abortController) {
         let activeTurnState = turnState;
         const userMessage = createUserMessage(text, options?.images, options);
+        this.runHistory = new WeakSet(turnState.messages.filter((m) => m.role === "assistant"));
         const beforeResult = await this.emitHook({
             type: "before_agent_start",
             prompt: text,

package/dist/engine/llm/tool-turns.d.ts

@@ -43,6 +43,13 @@
  * wording, whatever the tool. (The persisted reconcile refines with the run's tool effects — a read-only or
  * idempotent call's close says it may simply be re-issued — and, on a live abort, with the calls it saw start.)
  * Returns the SAME array when nothing needed restoring.
+ *
+ * RUN OWNERSHIP. The caller may hand over the assistant messages that stood in its transcript before its run began
+ * (`priorMessages`, by object). A `missing_result` repair on one of them is marked `beforeRun`: the call went
+ * unanswered before this run started, so closing it on the wire is a fact about the transcript the run inherited, not
+ * an event of the run. Membership is by message, never by position — a request projection that inserts, drops or
+ * replaces other messages cannot move it. The mark says that and nothing else: the repair, the synthesized result and
+ * the operator's account of them are the same with or without it. No `priorMessages` ⇒ no mark.
  */
 import type { AssertAllKeysHandled } from "../../core/ask-origin.js";
 import type { AssistantMessageDiagnostic } from "./diagnostics.js";
@@ -97,6 +104,9 @@ export interface ToolTurnRepair {
      *  ids a later call of the message repeated; for `orphan_result` the ids of the results left out, once each, in
      *  transcript order; otherwise the calls whose result was moved up, synthesized, or folded with a second one. */
     readonly toolCallIds: readonly string[];
+    /** `missing_result` only, and only when the caller handed over its run's prior messages
+     *  ({@link ensureToolTurnInvariants}'s `priorMessages`): the message holding these calls is one of them. */
+    readonly beforeRun?: true;
 }
 export interface ToolTurnView {
     /** The request view — the input array itself when {@link repairs} is empty. */
@@ -105,5 +115,8 @@ export interface ToolTurnView {
 }
 /** The text standing between two results recorded for one call when the view folds them into one. */
 export declare const SECOND_RESULT_SEPARATOR = "[another result was recorded for this same call:]";
-/** Restore the tool-turn law on a provider-bound message list (see the module header). */
-export declare function ensureToolTurnInvariants(messages: Message[]): ToolTurnView;
+/** Restore the tool-turn law on a provider-bound message list (see the module header). `priorMessages` = the calling
+ *  run's inherited assistant messages (module header, RUN OWNERSHIP). */
+export declare function ensureToolTurnInvariants(messages: Message[], priorMessages?: {
+    has(message: object): boolean;
+}): ToolTurnView;

package/dist/engine/llm/tool-turns.js

@@ -47,7 +47,7 @@ function callsOf(m) {
     return m.role === "assistant" && Array.isArray(m.content) ? m.content.filter((c) => c?.type === "toolCall") : [];
 }
 export const SECOND_RESULT_SEPARATOR = "[another result was recorded for this same call:]";
-export function ensureToolTurnInvariants(messages) {
+export function ensureToolTurnInvariants(messages, priorMessages) {
     const anchor = [];
     messages.forEach((m, i) => anchor.push(m.role === "toolResult" && i > 0 ? anchor[i - 1] : i));
     const sites = new Map();
@@ -132,7 +132,7 @@ export function ensureToolTurnInvariants(messages) {
         if (late.length > 0)
             repairs.push({ form: "late_result", toolCallIds: inCallOrder(late) });
         if (missing.length > 0)
-            repairs.push({ form: "missing_result", toolCallIds: missing.map((c) => c.id) });
+            repairs.push({ form: "missing_result", toolCallIds: missing.map((c) => c.id), ...(priorMessages?.has(m) === true ? { beforeRun: true } : {}) });
         if (duplicate.length > 0)
             repairs.push({ form: "duplicate_result", toolCallIds: inCallOrder(duplicate) });
     });

package/dist/index.d.ts

@@ -66,7 +66,7 @@ export { ASK_UNRESOLVABLE_CAUSES } from "./core/ask-unresolvable-notice.js";
 export { USER_STEER_UNDRAINED_CAUSES, type UserSteerUndrainedCause } from "./core/engine-notice.js";
 export { TOOL_TURN_INCOMPLETE_CAUSES, type ToolTurnIncompleteCause } from "./internal/llm.js";
 export { DURABLE_MANDATE_SOURCES } from "./core/tool-policy.js";
-export { TERMINAL_CAUSE_IS_REPLAYABLE, type TerminalFailureDetail } from "./core/terminal-cause.js";
+export { TERMINAL_CAUSE_IS_REPLAYABLE, type TerminalFailureDetail, type TerminalBlockedDetail, PROMPT_BLOCK_CAUSES, type PromptBlockCause, isPromptBlockCause } from "./core/terminal-cause.js";
 export { RESERVED_AGENT_NAMES } from "./agents/subagent.js";
 export { WORKFLOW_SIZE_GUIDELINE_AGENT_CAPS } from "./orchestration/workflow-size-guideline.js";
 export { ENGINE_AUTHORITY_ENVELOPE_TAGS } from "./core/untrusted-text.js";
@@ -191,14 +191,14 @@ export { createAllowDenyPolicy, createApprovalPolicy,
  *  members that seat has no lane for (`"unavailable"`, a routing answer; `updatedInput`, an operator edit a
  *  policy verdict cannot get re-adjudicated). Exported so a host can NAME it instead of deriving it through
  *  `Parameters<typeof createApprovalPolicy>[0]["approve"]`. */
-type ApprovalSeatOutcome, COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, findUnverifiableRecursiveDelete, combinePolicies, wrapToolPolicy, decisionText, resolveAsk, toolPolicyNameSets, toolPolicyPathDenyRules, type ToolPolicyNameSets, type NamedToolPolicy, type ToolPolicyProjection, type ToolPolicyProjectionComponent, type ConstraintChainEntry, checkToolPolicyProjection, constraintChainEntryOf, constraintChainDigest, type ToolPolicy, type ToolCallRequest, type PermissionResult, type DecisionReason, screenApproverAttribution, APPROVER_ATTRIBUTION_MAX_CHARS, type OnAsk, type AskOutcome, type ResolvedAsk, type AskRequest, type AskDelegationProvenance, type AskRuleEvidence, type AskEvidenceAbsence, ASK_EVIDENCE_ABSENCE_VALUES, } from "./core/tool-policy.js";
+type ApprovalSeatOutcome, COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, findUnverifiableRecursiveDelete, combinePolicies, receiveHookResult, isEngineRefusal, wrapToolPolicy, decisionText, resolveAsk, toolPolicyNameSets, toolPolicyPathDenyRules, type ToolPolicyNameSets, type NamedToolPolicy, type ToolPolicyProjection, type ToolPolicyProjectionComponent, type ConstraintChainEntry, checkToolPolicyProjection, constraintChainEntryOf, constraintChainDigest, type ToolPolicy, type ToolCallRequest, type PermissionResult, type DecisionReason, screenApproverAttribution, APPROVER_ATTRIBUTION_MAX_CHARS, type OnAsk, type AskOutcome, type ResolvedAsk, type AskRequest, type AskDelegationProvenance, type AskRuleEvidence, type AskEvidenceAbsence, ASK_EVIDENCE_ABSENCE_VALUES, } from "./core/tool-policy.js";
 export { type ReadRootGrantScreen } from "./core/read-root-grant-screen.js";
 export { type AskOrigin, ASK_ORIGINS, isAskOrigin, ORIGIN_IMPLIES_REAL_APPROVAL, PERSISTED_RULE_MANDATES, type PersistedRuleMandate, isPersistedRuleMandate, screenAskClassMembers } from "./core/ask-origin.js";
 export { PERMISSION_MODES, type PermissionMode, isPermissionMode, PERMISSION_MODE_RANK, clampPermissionMode, ASK_CLASSES, type AskClass, isAskClass, MODE_ARBITRATION, type ModeArbitrationRow, RELEASABLE_ASK_CLASSES, MODE_RELEASE_REASONS, type ModeReleaseReason, isModeReleaseReason, RRA_EXPLAINERS, classifyAsk, foldArbitrationRow, type AskClassification, type AskClassFacts, type ToolMarkSource, arbitrateByMode, type Arbitration, fileCommandOptionsSentence } from "./core/ask-origin.js";
 export { modePolicyOf, type ModePolicy, PERMISSION_MODE_FOLD_REASONS, type PermissionModeFoldReason, type PermissionModeReceipt, ACCEPT_EDITS_FILE_COMMANDS, modeAcceptsFileCommand } from "./core/mode-policy.js";
 export { readDenyClassifierRules, renderClassifierDenyRules, type DerivedDenyRule } from "./core/auto-mode-prompt.js";
 export { AUTO_MODE_DENY_SOURCES, isAutoModeDenySource, type AutoModeDenySource } from "./core/runtime-caps.js";
-export { SETTLEMENT_KINDS, type SettlementKind, isSettlementKind, type Settlement, SETTLEMENT_IS_REFUSAL, DENIED_BY_VALUES, type DeniedBy, isDeniedBy, DENIED_BY_MAY_VETO, CLASSIFIER_DENY_CAUSES, type ClassifierDenyCause, isClassifierDenyCause, DENIED_BY_MAY_CARRY_CAUSE, type GateDisposition, type GateOutcome, type ModeRelease, type ModeRefusal, screenGateOutcome } from "./core/gate-outcome.js";
+export { SETTLEMENT_KINDS, type SettlementKind, isSettlementKind, type Settlement, SETTLEMENT_PARTIES, type SettlementParty, isSettlementParty, SETTLEMENT_IS_REFUSAL, DENIED_BY_VALUES, type DeniedBy, isDeniedBy, DENIED_BY_MAY_VETO, CLASSIFIER_DENY_CAUSES, type ClassifierDenyCause, isClassifierDenyCause, DENIED_BY_MAY_CARRY_CAUSE, type GateDisposition, type GateOutcome, type ModeRelease, type ModeRefusal, screenGateOutcome } from "./core/gate-outcome.js";
 export { type AskCarry } from "./core/hooks.js";
 export { SWAPPABLE_DEP_SEATS, SWAP_SEAT_NOTICE, isSwappableDepSeat, screenSwappableDeps, type SwappableDepSeat, type SwappableDeps } from "./core/swappable-deps.js";
 export { parseAutoModeResponse, createAutoModeDecider, AUTO_MODE_UNAVAILABLE_CAUSES, isAutoModeUnavailableCause, classifierUnavailableDenyMessage, classifierParseFailureDenyMessage, AUTO_MODE_PARSE_FAILURES, isAutoModeParseFailure, type AutoModeParseFailure, type AutoModeUnavailableCause, AUTO_MODE_CLASSIFIER_FALLBACKS, isAutoModeClassifierFallback, AUTO_MODE_FALLBACK_CAUSES, isAutoModeFallbackCause, type AutoModeClassifierFallback, type AutoModeFallbackCause, type AutoModeClassifierRound, type AutoModeLadderRung, type AutoModeVerdict, type AutoModeDecider, type AutoModeDeciderOptions, type AutoModeClassified, type AutoModeClassifyFn, type AutoModeClassifyInput, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow, type AutoModeDenialTracker, type AutoModeDenialLimitOptions, type DenialLimitCounts, type DenialLimitFallbackFace, type UnarmedDenialLimitFallback, type DenialLimitFallback, type DenialLimitVerdict, } from "./core/auto-mode.js";
@@ -264,6 +264,7 @@ export { buildTurnPromptSnapshot, loweringRecordFor, LOWERING_VERSION, PREFIX_IN
 export { CenterPromptSource, FilePromptArtifactStore, FilePromptSourceStateStore, MemoryPromptArtifactStore, MemoryPromptSourceStateStore, type PromptArtifactSource, type PromptArtifactStore, type PromptSourceState, type PromptSourceStateStore, } from "./prompt-assembly/artifact-store.js";
 export { stripEngineMetadata } from "./internal/llm.js";
 export { EVENT_PROMPT_REGISTRY, eventDefaultOn, type CompiledEventPrompt, type EventDedupe, type EventDefaultPolicy } from "./prompt-assembly/event-registry.js";
+export { OUTPUT_STYLE_NAME_MAX } from "./core/output-style.js";
 export { contextUsageSections, type ContextUsageSection } from "./prompt-assembly/section-usage.js";
 export type { CompiledSection, ComposedPrompt, PackSectionDeclaration, PromptCacheClass, PromptCarrier, PromptMutability, PromptOwner, PromptPack, PromptRenderCadence, PromptRuntimeFacts, PromptSlot, PromptTrust, SectionRenderInputs, } from "./prompt-assembly/types.js";
 export { type ReasoningIntensity, type ReasoningResolution, type ResolvedReasoning, type ReasoningFormat, DEFAULT_EFFORT_LEVELS, REASONING_BUDGET_SHARE, isThinkingLevel, rankOf, resolveEffort, reasoningEffortLevelsOf, resolveBinary, reasoningBudgetShare, resolveReasoning, thinkingOffSpelled, declaredOffSpelling, type OffCapabilityModel, resolveReasoningProfile, type ReasoningTier, type ReasoningProfileFlags, } from "./brain/reasoning.js";

package/dist/index.js

@@ -52,7 +52,7 @@ export { ASK_UNRESOLVABLE_CAUSES } from "./core/ask-unresolvable-notice.js";
 export { USER_STEER_UNDRAINED_CAUSES } from "./core/engine-notice.js";
 export { TOOL_TURN_INCOMPLETE_CAUSES } from "./internal/llm.js";
 export { DURABLE_MANDATE_SOURCES } from "./core/tool-policy.js";
-export { TERMINAL_CAUSE_IS_REPLAYABLE } from "./core/terminal-cause.js";
+export { TERMINAL_CAUSE_IS_REPLAYABLE, PROMPT_BLOCK_CAUSES, isPromptBlockCause } from "./core/terminal-cause.js";
 export { RESERVED_AGENT_NAMES } from "./agents/subagent.js";
 export { WORKFLOW_SIZE_GUIDELINE_AGENT_CAPS } from "./orchestration/workflow-size-guideline.js";
 export { ENGINE_AUTHORITY_ENVELOPE_TAGS } from "./core/untrusted-text.js";
@@ -156,14 +156,14 @@ export { hasScheduler, isValidCronExpr, SchedulerError } from "./core/scheduler.
 export { createSchedulerTools, SCHEDULE_WAKEUP_TOOL_NAME, AUTONOMOUS_LOOP_SENTINEL, AUTONOMOUS_LOOP_DYNAMIC_SENTINEL, } from "./tools/scheduler-tools.js";
 export { resolveAutonomousLoopPrompt, AUTONOMOUS_LOOP_PREAMBLE, AUTONOMOUS_LOOP_PREAMBLE_PERSISTENT, } from "./tools/loop-tick.js";
 export { tightenTaskSpec, TaskSpecTightenError } from "./core/tighten-task-spec.js";
-export { createAllowDenyPolicy, createApprovalPolicy, COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, findUnverifiableRecursiveDelete, combinePolicies, wrapToolPolicy, decisionText, resolveAsk, toolPolicyNameSets, toolPolicyPathDenyRules, checkToolPolicyProjection, constraintChainEntryOf, constraintChainDigest, screenApproverAttribution, APPROVER_ATTRIBUTION_MAX_CHARS, ASK_EVIDENCE_ABSENCE_VALUES, } from "./core/tool-policy.js";
+export { createAllowDenyPolicy, createApprovalPolicy, COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, findUnverifiableRecursiveDelete, combinePolicies, receiveHookResult, isEngineRefusal, wrapToolPolicy, decisionText, resolveAsk, toolPolicyNameSets, toolPolicyPathDenyRules, checkToolPolicyProjection, constraintChainEntryOf, constraintChainDigest, screenApproverAttribution, APPROVER_ATTRIBUTION_MAX_CHARS, ASK_EVIDENCE_ABSENCE_VALUES, } from "./core/tool-policy.js";
 export {} from "./core/read-root-grant-screen.js";
 export { ASK_ORIGINS, isAskOrigin, ORIGIN_IMPLIES_REAL_APPROVAL, PERSISTED_RULE_MANDATES, isPersistedRuleMandate, screenAskClassMembers } from "./core/ask-origin.js";
 export { PERMISSION_MODES, isPermissionMode, PERMISSION_MODE_RANK, clampPermissionMode, ASK_CLASSES, isAskClass, MODE_ARBITRATION, RELEASABLE_ASK_CLASSES, MODE_RELEASE_REASONS, isModeReleaseReason, RRA_EXPLAINERS, classifyAsk, foldArbitrationRow, arbitrateByMode, fileCommandOptionsSentence } from "./core/ask-origin.js";
 export { modePolicyOf, PERMISSION_MODE_FOLD_REASONS, ACCEPT_EDITS_FILE_COMMANDS, modeAcceptsFileCommand } from "./core/mode-policy.js";
 export { readDenyClassifierRules, renderClassifierDenyRules } from "./core/auto-mode-prompt.js";
 export { AUTO_MODE_DENY_SOURCES, isAutoModeDenySource } from "./core/runtime-caps.js";
-export { SETTLEMENT_KINDS, isSettlementKind, SETTLEMENT_IS_REFUSAL, DENIED_BY_VALUES, isDeniedBy, DENIED_BY_MAY_VETO, CLASSIFIER_DENY_CAUSES, isClassifierDenyCause, DENIED_BY_MAY_CARRY_CAUSE, screenGateOutcome } from "./core/gate-outcome.js";
+export { SETTLEMENT_KINDS, isSettlementKind, SETTLEMENT_PARTIES, isSettlementParty, SETTLEMENT_IS_REFUSAL, DENIED_BY_VALUES, isDeniedBy, DENIED_BY_MAY_VETO, CLASSIFIER_DENY_CAUSES, isClassifierDenyCause, DENIED_BY_MAY_CARRY_CAUSE, screenGateOutcome } from "./core/gate-outcome.js";
 export {} from "./core/hooks.js";
 export { SWAPPABLE_DEP_SEATS, SWAP_SEAT_NOTICE, isSwappableDepSeat, screenSwappableDeps } from "./core/swappable-deps.js";
 export { parseAutoModeResponse, createAutoModeDecider, AUTO_MODE_UNAVAILABLE_CAUSES, isAutoModeUnavailableCause, classifierUnavailableDenyMessage, classifierParseFailureDenyMessage, AUTO_MODE_PARSE_FAILURES, isAutoModeParseFailure, AUTO_MODE_CLASSIFIER_FALLBACKS, isAutoModeClassifierFallback, AUTO_MODE_FALLBACK_CAUSES, isAutoModeFallbackCause, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow, } from "./core/auto-mode.js";
@@ -212,6 +212,7 @@ export { buildTurnPromptSnapshot, loweringRecordFor, LOWERING_VERSION, PREFIX_IN
 export { CenterPromptSource, FilePromptArtifactStore, FilePromptSourceStateStore, MemoryPromptArtifactStore, MemoryPromptSourceStateStore, } from "./prompt-assembly/artifact-store.js";
 export { stripEngineMetadata } from "./internal/llm.js";
 export { EVENT_PROMPT_REGISTRY, eventDefaultOn } from "./prompt-assembly/event-registry.js";
+export { OUTPUT_STYLE_NAME_MAX } from "./core/output-style.js";
 export { contextUsageSections } from "./prompt-assembly/section-usage.js";
 export { DEFAULT_EFFORT_LEVELS, REASONING_BUDGET_SHARE, isThinkingLevel, rankOf, resolveEffort, reasoningEffortLevelsOf, resolveBinary, reasoningBudgetShare, resolveReasoning, thinkingOffSpelled, declaredOffSpelling, resolveReasoningProfile, } from "./brain/reasoning.js";
 export { DESIGN_REVIEW_PROMPTS, CODE_REVIEW_PROMPT, SCENARIO_REGISTRY, runScenario, } from "./scenarios/scenario-registry.js";

package/dist/prompt-assembly/event-registry.js

@@ -3,7 +3,7 @@ export const EVENT_PROMPT_REGISTRY = new Map([
     { kind: "task_reminder", carrier: "message.user-prefix", trust: "operator", dedupe: "replace-by-key", defaultPolicy: "off", rendererRef: "turn-attachments.ts#TASK_REMINDER_BASE" },
     { kind: "tool_search_usage_reminder", carrier: "message.user-prefix", trust: "operator", dedupe: "replace-by-key", defaultPolicy: "off", rendererRef: "turn-attachments.ts#renderToolSearchUsageReminder" },
     { kind: "changed_files", carrier: "message.user-prefix", trust: "operator", dedupe: "replace-by-key", defaultPolicy: "off", rendererRef: "turn-attachments.ts#renderChangedFiles" },
-    { kind: "plan_mode", carrier: "message.user-prefix", trust: "operator", dedupe: "replace-by-key", defaultPolicy: "off", rendererRef: "turn-attachments.ts#PLAN_MODE_FULL_BODY" },
+    { kind: "output_style", carrier: "message.user-prefix", trust: "operator", dedupe: "repeat", defaultPolicy: "always", rendererRef: "../output-style.ts#renderOutputStyle" },
     { kind: "date_change", carrier: "message.user-prefix", trust: "operator", dedupe: "replace-by-key", defaultPolicy: "always", rendererRef: "turn-attachments.ts#renderDateChange" },
     { kind: "instructions_change", carrier: "message.user-prefix", trust: "operator", dedupe: "replace-by-key", maxBytes: 512, defaultPolicy: "always", rendererRef: "turn-attachments.ts#collectInstructionsChange" },
     { kind: "workflow_size_guideline_change", carrier: "message.user-prefix", trust: "operator", dedupe: "replace-by-key", defaultPolicy: "always", rendererRef: "run-turn-boundary.ts#workflowSizeGuidelineChangeNotice" },
@@ -16,6 +16,7 @@ export const EVENT_PROMPT_REGISTRY = new Map([
     { kind: "mcp_instructions", carrier: "message.user-prefix", trust: "external", dedupe: "replace-by-key", defaultPolicy: "off", rendererRef: "turn-attachments.ts#renderMcpInstructionsDelta" },
     { kind: "mcp_dropped_tools", carrier: "message.user-prefix", trust: "external", dedupe: "replace-by-key", defaultPolicy: "off", rendererRef: "turn-attachments.ts#renderMcpDroppedTools" },
     { kind: "git_status", carrier: "message.user-prefix", trust: "external", dedupe: "replace-by-key", defaultPolicy: "always", rendererRef: "git-status-frame.ts#renderGitStatusFrameBody" },
+    { kind: "permission_posture", carrier: "message.user-prefix", trust: "operator", dedupe: "replace-by-key", defaultPolicy: "always", rendererRef: "../auto-mode-directive.ts#POSTURE_TABLE" },
     { kind: "limit_approach_converge", carrier: "message.user-prefix", trust: "operator", dedupe: "once-per-run", defaultPolicy: "always", rendererRef: "run-turn-boundary.ts#limitApproachFrames" },
     { kind: "limit_approach_deliver", carrier: "message.user-prefix", trust: "operator", dedupe: "once-per-run", defaultPolicy: "always", rendererRef: "run-turn-boundary.ts#limitApproachFrames" },
     { kind: "final_verification", carrier: "message.user-prefix", trust: "operator", dedupe: "once-per-run", defaultPolicy: "always", rendererRef: "runtask.ts#final-verification" },

package/dist/stores/file/fs-atomic.d.ts

@@ -133,10 +133,11 @@ export declare class AppendLog {
      * onto the remnant, so replay dropped BOTH — after that second append had returned and fsync'd. Measured:
      * records [1,2,3] + a torn remnant + appends 5,6 replayed as [1,2,3,6].
      *
-     * Cost on the healthy path is ONE `fstat` per append (the sizes match and we return); the whole-file read
-     * only happens when the file actually moved off a boundary. A legitimate concurrent appender (another
-     * process under the boot-lock handoff) leaves the file newline-terminated, so it is adopted, not truncated; a
-     * whole record it left without its newline is kept and ended, and only a partial one is cut.
+     * Cost on the healthy path is ONE `fstat` per append (the sizes match and we return); the tail read only
+     * happens when the file actually moved off a boundary, and it reads the last segment, not the file. A
+     * legitimate concurrent appender (another process under the boot-lock handoff) leaves the file
+     * newline-terminated, so it is adopted, not truncated; a whole record it left without its newline is kept
+     * and ended, and only a partial one is cut.
      */
     private repairTail;
     /**
@@ -171,6 +172,30 @@ export declare class AppendLog {
     closeForSwap(): void;
     private releaseFd;
 }
+/** Bytes read per positioned read while a file's tail is walked back to its last newline. */
+export declare const JSONL_TAIL_READ_BLOCK: number;
+/**
+ * The longest last segment (in BYTES) a repair station will judge: V8's maximum string length in UTF-16 code units
+ * (Node's `buffer.constants.MAX_STRING_LENGTH`). A segment of N bytes decodes to at most N code units, so one within
+ * the bound can never make `toString` throw. One past it MAY still decode (multi-byte text has fewer units than
+ * bytes) but is left unjudged either way: telling would mean reading and decoding up to three times the bound.
+ */
+export declare const JSONL_TAIL_SEGMENT_LIMIT: number;
+/** A file's last segment (the bytes after its last `\n`, or the whole file when it holds none) — or the fact that it is
+ *  too long to judge. `start` is the segment's offset; a file that ends on a newline has an empty segment at `size`. */
+export type JsonlTailSegment = {
+    unjudgeable: false;
+    start: number;
+    bytes: Buffer;
+} | {
+    unjudgeable: true;
+};
+/**
+ * The last segment of an open file of `size` bytes, found by walking back from the end one block at a time to the
+ * last newline: a read is bounded by the segment's length, never by the file's. The one reader of "what is the tail"
+ * for every repair station; whether the segment is a record is {@link jsonlTextFormOf}'s to say.
+ */
+export declare function readTailSegment(fd: number, size: number, limit?: number): JsonlTailSegment;
 /** Why a {@link BootLock}/{@link acquireStoreDirLock} acquisition was refused, as a branchable code. */
 export type FileStoreLockErrorCode = 
 /** A LIVE process (this one or another) already holds the directory. Steady state: it ends when that

package/dist/stores/file/fs-atomic.js

@@ -1,4 +1,5 @@
 import { appendFileSync, closeSync, constants as FS, existsSync, fstatSync, ftruncateSync, linkSync, mkdirSync, openSync, readFileSync, readSync, renameSync, truncateSync, unlinkSync, writeFileSync, writeSync, fsyncSync, } from "node:fs";
+import { constants as bufferConstants } from "node:buffer";
 import { homedir, hostname, uptime } from "node:os";
 import { hrtime } from "node:process";
 import { basename, dirname, join, resolve as resolvePath } from "node:path";
@@ -285,23 +286,71 @@ export class AppendLog {
         }
     }
 }
+export const JSONL_TAIL_READ_BLOCK = 64 * 1024;
+export const JSONL_TAIL_SEGMENT_LIMIT = bufferConstants.MAX_STRING_LENGTH;
+function readExactly(fd, into, length, position) {
+    let got = 0;
+    while (got < length) {
+        const n = readSync(fd, into, got, length - got, position + got);
+        if (n <= 0)
+            throw new Error(`jsonl tail: the file ended ${length - got} bytes early while its last line was read — it shrank under the reader`);
+        got += n;
+    }
+}
+export function readTailSegment(fd, size, limit = JSONL_TAIL_SEGMENT_LIMIT) {
+    const block = Buffer.allocUnsafe(Math.min(JSONL_TAIL_READ_BLOCK, size));
+    let start = 0;
+    for (let end = size; end > 0;) {
+        const from = Math.max(0, end - JSONL_TAIL_READ_BLOCK);
+        readExactly(fd, block, end - from, from);
+        const newline = block.subarray(0, end - from).lastIndexOf(0x0a);
+        if (newline >= 0) {
+            start = from + newline + 1;
+            break;
+        }
+        end = from;
+        if (size - end > limit)
+            return { unjudgeable: true };
+    }
+    if (size - start > limit)
+        return { unjudgeable: true };
+    const bytes = Buffer.allocUnsafe(size - start);
+    readExactly(fd, bytes, bytes.length, start);
+    return { unjudgeable: false, start, bytes };
+}
 function repairJsonlTail(path) {
-    let bytes;
+    let fd;
     try {
-        bytes = readFileSync(path);
+        fd = openSync(path, "r");
     }
     catch (err) {
         if (err.code === "ENOENT")
             return;
         throw err;
     }
-    if (bytes.length === 0 || bytes[bytes.length - 1] === 0x0a)
+    let segment;
+    try {
+        segment = readTailSegment(fd, fstatSync(fd).size);
+    }
+    finally {
+        closeSync(fd);
+    }
+    if (segment.unjudgeable) {
+        appendFileSync(path, "\n");
+        try {
+            console.warn(`[sema] file store: a tail segment larger than the judgeable bound (${JSONL_TAIL_SEGMENT_LIMIT} bytes) was ended as a line, not judged — ` +
+                `${path}. Its bytes are untouched; a reader meets it as an ordinary line.`);
+        }
+        catch {
+        }
+        return;
+    }
+    if (segment.bytes.length === 0)
         return;
-    const segmentStart = bytes.lastIndexOf(0x0a) + 1;
-    if (jsonlTextFormOf(bytes.toString("utf8", segmentStart)).form === "record")
+    if (jsonlTextFormOf(segment.bytes.toString("utf8")).form === "record")
         appendFileSync(path, "\n");
     else
-        truncateSync(path, segmentStart);
+        truncateSync(path, segment.start);
 }
 export class FileStoreLockError extends Error {
     code;

package/dist/tools/fs/index.d.ts

@@ -192,7 +192,8 @@ export interface HandsToolkitOptions {
      *  not asked and no home is added (each listed home is anchored at its spelling and, where the environment answers one,
      *  its canonical spelling), and the band's home views (a path spelled through a firmlink or a bind mount of a home,
      *  judged at the home) read this list and the environment's declared home; an entry that is not the declared home is probed once,
-     *  under a short bound of its own, and a probe of it that fails costs that entry alone. */
+     *  under a short bound of its own, and a probe of it that fails costs that entry alone. The public shell judgment takes the
+     *  same list as {@link import("./shell-read-check.js").ShellReadJudgeInput.readDenyHomes}. */
     readDenyHomes?: readonly string[];
     /** Where each home-anchored row's literal head leads beyond the home's spellings
      *  ({@link import("./read-deny-home.js").readDenyHomeLinksOf}, keyed by the row's pattern) — the Runner passes the

package/dist/tools/fs/read-deny-home.d.ts

@@ -100,8 +100,9 @@ export declare function placementViewsOf(homes: readonly string[]): HomeViewSour
  *  time: no latch). */
 export declare function sayPlacementLost(): void;
 /** The home views over a home list fixed now — a mount that places nothing itself (a toolkit handed its placement, or
- *  one whose table has no home-anchored row) and the public shell judgment: the declared home, and every entry of
- *  `homes` that is not the declared home as an auxiliary home, read once, at once. */
+ *  one whose table has no home-anchored row) and the public shell judgment (the `readDenyHomes` its boundary's rows were
+ *  compiled under): the declared home, and every entry of `homes` that is not the declared home as an auxiliary home,
+ *  read once, at once. */
 export declare function homeViewsAt(env: HomeViewEnv, homes: readonly string[]): HomeViewSource;
 /** The home views of one judgment, off the judge it judges with: the views of the judge's placement. A judge that
  *  carries none (one built outside a mount) reads the declared home alone. */

package/dist/tools/fs/read-deny-home.js

@@ -312,10 +312,12 @@ export function sayPlacementLost() {
     catch {
     }
 }
-export function homeViewsAt(env, homes) {
+function readAuxiliaryHomes(env, homes, opts, signal) {
     const declared = declaredHomeOf(env);
-    const auxiliary = [...new Set(homes.filter((h) => isAbsolutePathForm(h) && !isDeclared(declared, h)))];
-    return homeViewSourceOver(env, auxiliary.map((home) => readAuxiliaryHome(env, home, {})));
+    return [...new Set(homes.filter((h) => isAbsolutePathForm(h) && !isDeclared(declared, h)))].map((home) => readAuxiliaryHome(env, home, opts, signal));
+}
+export function homeViewsAt(env, homes) {
+    return homeViewSourceOver(env, readAuxiliaryHomes(env, homes, {}));
 }
 export function homeViewsOf(env, judge, signal) {
     return (judge?.homeViews ?? homeViewsAt(env, [])).views(signal);
@@ -338,7 +340,7 @@ export async function placeReadDenyAtHome(env, compile, homes, signal) {
             return heldAnywhere(false);
         declaredAt = [...new Set([...own, ...ownSpellings.spellings])];
     }
-    const auxiliary = listed.homes.filter((h) => !isDeclared(declared, h)).map((home) => readAuxiliaryHome(env, home, { entries }, signal));
+    const auxiliary = readAuxiliaryHomes(env, listed.homes, { entries }, signal);
     const [heads, readings] = await Promise.all([readDenyHomeLinksOf(env, entries, declaredAt, signal), Promise.all(auxiliary)]);
     const at = [...new Set([...declaredAt, ...readings.flatMap((r) => r.place)])];
     const linked = new Map();

package/dist/tools/fs/shell-read-check.d.ts

@@ -163,6 +163,12 @@ export interface ShellReadJudgeInput {
     readonly readers?: ReadonlySet<string>;
     /** The face named in a refusal sentence. Defaults to `Bash`. */
     readonly tool?: string;
+    /** The home list the boundary's deny rows were compiled under (`HandsToolkitOptions.readDenyHomes`'s seat, same list, same
+     *  meaning: absolute home paths, anything else rejects naming `readDenyHomes`). Present ⇒ the judgment's home views are
+     *  that table's — the environment's declared home is always among them, every other entry is read once under a short
+     *  bound of its own — and the account database is not asked and no home is added; `[]` leaves the declared home alone.
+     *  Absent ⇒ the judgment is its own placement: the declared home and the account's home, asked once for this call. */
+    readonly readDenyHomes?: readonly string[];
     /** Handed to the ENVIRONMENT's own primitives (`canonicalPath`, `listDir`) while the reads are
      *  established; whether an abort stops one is the adapter's answer, and a walk short enough to finish
      *  first finishes. It is NOT a deadline and it does not reach `boundary.alsoInside`, whose signature
@@ -196,9 +202,10 @@ export interface ShellReadJudgment {
  * pattern on its spelling alone, so the two diverge in both directions.
  *
  * A read target is also judged at its HOME VIEW (a path spelled through a firmlink or a bind mount of a home, respelled
- * at the home): this judgment is its own placement — the views read the environment's declared home and the account
- * home the account database answers once, for this call (`readDenyHomesOf`'s homes); the account home's probes wait at
- * most a short bound of their own.
+ * at the home). The views read the home list the boundary's rows were compiled under when the input names it
+ * ({@link ShellReadJudgeInput.readDenyHomes}); without it this judgment is its own placement — the environment's declared
+ * home and the account home the account database answers once, for this call (`readDenyHomesOf`'s homes). Every home
+ * beside the declared one waits at most a short bound of its own.
  *
  * It carries NO deadline. Bounding an environment-facing wait and substituting a fail-closed verdict is the
  * gate FOLD's policy on the gate's one deadline seat; the station has never held one on either entry, and a

package/dist/tools/fs/shell-read-check.js

@@ -1,7 +1,7 @@
 import { errorResult } from "../../core/tools.js";
 import { BASH_READONLY_CONFINEMENT_NOTE } from "./fs-shared.js";
 import { isAbsoluteForFamily, normalizeAbsPathLexically, pathFamilyOf, violationDetails, withinAnyRoot } from "./safety.js";
-import { fitMiddle, READ_DENY_SENTENCE_PART_MAX, readDenySentence } from "./read-deny.js";
+import { checkedReadDenyHomes, fitMiddle, READ_DENY_SENTENCE_PART_MAX, readDenySentence } from "./read-deny.js";
 import { NOT_AUTO_ALLOWED, programPositionRefusalSentence, readProgramPosition } from "./bash-program-position.js";
 import { bashClassifyDefaultAllow } from "./bash-readonly-classifier.js";
 import { planShellReads } from "./shell-read-plan.js";
@@ -327,7 +327,7 @@ async function runShellReadStation(tool, command, declared, seat, readers, estab
 }
 export async function judgeShellRead(input) {
     const readers = input.readers ?? new Set(bashClassifyDefaultAllow());
-    const run = await runShellReadStation(input.tool ?? "Bash", input.command, input.boundary, input.seat, readers, createShellReadEstablisher(input.env, input.boundary.roots, { homeViews: homeViewsAt(input.env, declaredReadDenyHomes(input.env)) }), input.env, input.signal);
+    const run = await runShellReadStation(input.tool ?? "Bash", input.command, input.boundary, input.seat, readers, createShellReadEstablisher(input.env, input.boundary.roots, { homeViews: homeViewsAt(input.env, input.readDenyHomes === undefined ? declaredReadDenyHomes(input.env) : checkedReadDenyHomes(input.readDenyHomes)) }), input.env, input.signal);
     const offer = normalizeReadRootCandidate(run.verdict.readRootCandidate);
     return {
         plan: run.plan,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.38.2",
+  "version": "7.39.0",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",