@sema-agent/core 7.49.5 → 7.50.0

package/dist/core/runner/run-leg.js

@@ -6,6 +6,8 @@ import { normalizePersistedRuleHit } from "../rule-lane-reads.js";
 import { decidersNote, SETTLEMENT_NOBODY_JUDGED } from "../gate-outcome.js";
 import { formatHookFeedback, hookSeatExpiredError, runHookSeat } from "../hooks.js";
 import { buildAppliedHumanInputEvent, buildHumanInputEvent, projectHumanInput } from "../human-input-projection.js";
+import { humanInputAttachmentsOf, readObjectiveAttachments, userAttachmentDeclarations } from "../user-attachment.js";
+import { uuidv7 } from "../../internal/harness.js";
 import { ORG_ADJUDICATION_TIMEOUT_MS, settleOrgVerdictWithin } from "../permission-rule-org.js";
 import { applyPersistedTightening, disclosedRuleSet } from "../persisted-rule-arms.js";
 import { parkedSkillApprovalRefusal, skillRowRefusal } from "../skill-grant.js";
@@ -13,7 +15,8 @@ import { SKILL_TOOL_NAME } from "./synthetic-tools.js";
 import { computeCostMicroUsd } from "../pricing.js";
 import { mintSystemReminder } from "../reminder-mint.js";
 import { hasDestroy } from "../remote-env.js";
-import { advertisedWritableRootsSeat, exemptRootsSeat, humanRefusalSentence, policyCannotAnswer, policyRefusalMessage, refuseOutOfContractDecision } from "../tool-policy.js";
+import { advertisedWritableRootsSeat, attestationOf, exemptRootsSeat, humanRefusalSentence, policyCannotAnswer, policyRefusalMessage, refuseOutOfContractDecision } from "../tool-policy.js";
+import { pathDenialCardOf } from "../../tools/fs/safety.js";
 import { callFaceSeat, judgeParkedToolIdentity, parkedRowLiveFace, rosterEntryNamed } from "../tool-roster.js";
 import { deliverEngineNotice } from "../types.js";
 import { delimitUntrusted, inlineUntrusted, REVIEWER_NOTE_MAX_BODY, sanitizeUntrustedText } from "../untrusted-text.js";
@@ -288,7 +291,7 @@ export async function runLeg(input) {
             const userPromptSubmit = (spec.hooks ?? runner.deps.hooks)?.userPromptSubmit;
             if (userPromptSubmit) {
                 try {
-                    const promptSeat = await runHookSeat("userPromptSubmit", { timeoutMs: prepared.hookTimeoutMs, signal: prepared.abortController.signal, abortEnds: true }, (sig) => userPromptSubmit(spec.objective, { identity: prepared.hookIdentity, permissionMode: prepared.permissionMode.observed, signal: sig, source: "objective", ...(objectiveActor !== undefined ? { actor: snapshotActorAssertion(objectiveActor) } : {}) }));
+                    const promptSeat = await runHookSeat("userPromptSubmit", { timeoutMs: prepared.hookTimeoutMs, signal: prepared.abortController.signal, abortEnds: true }, (sig) => userPromptSubmit(spec.objective, { identity: prepared.hookIdentity, permissionMode: prepared.permissionMode.observed, signal: sig, source: "objective", ...(objectiveActor !== undefined ? { actor: snapshotActorAssertion(objectiveActor) } : {}), ...(prepared.userAttachments !== undefined ? { userAttachments: userAttachmentDeclarations(prepared.userAttachments) } : {}) }));
                     if (promptSeat.expired) {
                         if (promptSeat.cause === "timeout") {
                             try {
@@ -326,6 +329,8 @@ export async function runLeg(input) {
                     promptBlocked = true;
                 }
             }
+            const objectiveInputId = uuidv7();
+            const { frames: attachmentFrames, chars: attachmentChars } = await readObjectiveAttachments(prepared, objectiveInputId, promptBlocked);
             let gitLegDelivered;
             if (!promptBlocked) {
                 const gitBody = await resolveGitLegDelivery(prepared, undefined, (err) => {
@@ -401,14 +406,14 @@ export async function runLeg(input) {
             const precallMicroUsd = rs.budget.maxCostMicroUsd === undefined
                 ? 0
                 : computeCostMicroUsd({
-                    totalInputTokens: Math.ceil((effectiveObjective.length + gitQueuedChars) / 4),
+                    totalInputTokens: Math.ceil((effectiveObjective.length + gitQueuedChars + attachmentChars) / 4),
                     cacheReadTokens: 0,
                     cacheWriteTokens: 0,
                     cacheWriteTokensLong: 0,
                     outputTokens: prepared.model.maxTokens ?? DEFAULT_PRECALL_OUTPUT_TOKENS,
                 }, rs.telemetry.pricing);
             const precallCeilingMicroUsd = prepared.suspendForResource !== undefined ? rs.budget.remainingMicroUsd : rs.budget.maxCostMicroUsd;
-            const precallTokens = Math.ceil((effectiveObjective.length + gitQueuedChars) / 4) + (prepared.model.maxTokens ?? DEFAULT_PRECALL_OUTPUT_TOKENS);
+            const precallTokens = Math.ceil((effectiveObjective.length + gitQueuedChars + attachmentChars) / 4) + (prepared.model.maxTokens ?? DEFAULT_PRECALL_OUTPUT_TOKENS);
             const precallCeilingTokens = prepared.suspendForResource !== undefined ? rs.budget.remainingTokens : rs.budget.maxTokensWindow;
             const entryUsageRetryAfterMs = prepared.usageGovernance !== undefined ? await prepared.usageGovernance.check(Date.now()) : undefined;
             if (promptBlocked) {
@@ -470,21 +475,25 @@ export async function runLeg(input) {
                 }
                 const enginePrefixChars = effectiveObjective.length - projectedObjective.length;
                 if (!prepared.abortController.signal.aborted) {
+                    prepared.attachmentDelivery.stage(objectiveInputId, attachmentFrames);
                     queue.push({
                         ...buildHumanInputEvent({
                             carrier: "objective",
                             source: "objective",
                             delivery: "applied",
+                            inputId: objectiveInputId,
                             sessionSeq: nextHumanInputSeq(prepared.harness),
                             ...(objectiveActor !== undefined ? { actor: objectiveActor } : {}),
                             ...(objectiveActor?.issuer !== undefined ? { issuer: objectiveActor.issuer } : {}),
                             ...(spec.principal !== undefined ? { principal: spec.principal } : {}),
+                            ...(attachmentFrames.length > 0 ? { attachments: humanInputAttachmentsOf(attachmentFrames) } : {}),
                         }),
                         ...ident(),
                     });
                     final = await withBrainSinks(() => prepared.harness.prompt(effectiveObjective, {
                         ...(images && images.length > 0 ? { images } : {}),
                         ...(enginePrefixChars > 0 ? { enginePrefixChars } : {}),
+                        ...(attachmentFrames.length > 0 ? { trailing: attachmentFrames.map((f) => f.seed) } : {}),
                         ...(objectiveActor !== undefined ? { actor: objectiveActor } : {}),
                     }));
                     await flushGitMirror();
@@ -579,7 +588,7 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
     const settleEnd = async (isError, result, refusedBy) => {
         if (refusedBy !== undefined)
             occurrences.refuse(pendingAction.toolCallId, refusedBy);
-        const gate = emitSettled(occurrences, callStart, { result, isError }, { push: emit, structured: prepared.structuredProjector }).gate ?? decidedGate;
+        const gate = emitSettled(occurrences, callStart, { result, isError }, { push: emit, structured: prepared.structuredProjector, mediaByteCapBytes: runner.deps.mediaByteCapBytes }).gate ?? decidedGate;
         const word = await resume.recordExecutionOutcome(gate);
         settleExecutionRecord(runner.deps.onNotice, word, { toolName: pendingAction.toolName, gate, sessionId: prepared.sessionId, runId: prepared.runId, scope: resume.cp.scope, ...(resume.cp.checkpointId !== undefined ? { checkpointId: resume.cp.checkpointId } : {}) });
     };
@@ -627,6 +636,10 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
         resourceSpentMicroUsd: prepared.resourceLedger?.spentMicroUsd ?? 0,
         suspendCount: resume.cp.suspendCount ?? 0,
     };
+    const denialCard = (d) => {
+        const card = pathDenialCardOf(attestationOf(d, { toolCallId: pendingAction.toolCallId, toolName: pendingAction.toolName })?.pathDenial);
+        return card !== undefined ? { details: card } : {};
+    };
     const beltStamped = prepared.stampCallTarget?.(beltReq(), prepared.abortController.signal);
     if (beltStamped !== undefined)
         beltReading = (await beltStamped).targetReading;
@@ -643,7 +656,7 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
                     ? " (the call as it would run requires a person's approval, and this decision was the deployment's policy)"
                     : " (the policy rewrote these bytes to a value that was not approved)";
             const editedDenial = formatHookFeedback(`${outcome.updatedInput !== undefined ? "The approver EDITED this call's input; the edited call" : "A PreToolUse hook REWROTE this approved call's input; the rewritten call"} is refused by the deployment's tool policy and was not executed${why}.`, prepared.reminderMark);
-            await settleEnd(true, { content: editedDenial }, "policy");
+            await settleEnd(true, { content: editedDenial, ...denialCard(rechecked) }, "policy");
             const eid = await prepared.session.appendMessage(toolResultMsg(pendingAction.toolCallId, pendingAction.toolName, editedDenial, true));
             emitCommitted(eid, "toolResult", pendingAction.toolCallId);
             return;
@@ -697,7 +710,7 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
         const narrowed = refuseOutOfContractDecision(await prepared.denyNarrowingPolicy.check(beltReq(), prepared.abortController.signal));
         if (narrowed.action === "deny") {
             const narrowedDenial = formatHookFeedback(`The approved tool call "${pendingAction.toolName}" is now denied by ${ruleSourcePhrase("narrowing")} and was not executed${narrowed.message ? `: ${narrowed.message}` : ""}.`, prepared.reminderMark);
-            await settleEnd(true, { content: narrowedDenial }, "policy");
+            await settleEnd(true, { content: narrowedDenial, ...denialCard(narrowed) }, "policy");
             const eid = await prepared.session.appendMessage(toolResultMsg(pendingAction.toolCallId, pendingAction.toolName, narrowedDenial, true));
             emitCommitted(eid, "toolResult", pendingAction.toolCallId);
             return;
@@ -721,7 +734,7 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
             laneRead = Promise.resolve(unreadable);
         }
         const read = await settleOrgVerdictWithin(laneRead, unreadable, { signal: prepared.abortController.signal, timeoutMs: ORG_ADJUDICATION_TIMEOUT_MS, onFallback: (cause) => void (laneWaitCancelled = cause === "aborted") });
-        const tightened = applyPersistedTightening({ action: "allow" }, read);
+        const tightened = applyPersistedTightening({ action: "allow" }, read, beltReq());
         if (laneWaitCancelled || tightened.tightened === "deny" || tightened.tightened === "unreadable") {
             const why = laneWaitCancelled
                 ? "the task was cancelled before your persisted permission rules could be read"
@@ -729,7 +742,7 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
                     ? `a standing deny rule of yours (${disclosedRuleSet(read.hit?.rules ?? [])}) now refuses it`
                     : `it could not be read against your standing deny/ask rules (${read.reason})`;
             const ruleDenial = formatHookFeedback(`The approved tool call "${pendingAction.toolName}" was not executed: ${why}. This approval is spent — the call has to be re-issued and approved again.`, prepared.reminderMark);
-            await settleEnd(true, { content: ruleDenial }, "persisted_rule");
+            await settleEnd(true, { content: ruleDenial, ...denialCard(tightened.decision) }, "persisted_rule");
             const eid = await prepared.session.appendMessage(toolResultMsg(pendingAction.toolCallId, pendingAction.toolName, ruleDenial, true));
             emitCommitted(eid, "toolResult", pendingAction.toolCallId);
             return;

package/dist/core/runner/run-settle-and-teardown.d.ts

@@ -26,10 +26,6 @@ export interface RunSettleAndTeardownInput {
         parentToolCallId?: string;
         sourceTaskId?: string;
     };
-    /** borrowed-readonly — the spawning tool call's id when this task runs AS A SUB-AGENT (gates the terminal tick). */
-    parentToolCallId: string | undefined;
-    /** borrowed-readonly — the sub-agent display name for the terminal tick. */
-    subagentName: string | undefined;
     /** borrowed-readonly — the loop-liveness latch: `userHalted` = the halt verb was ACCEPTED (the unconsumed-halt notice's input; it does not sign the seat). */
     loopLatch: {
         readonly userHalted: boolean;

package/dist/core/runner/run-settle-and-teardown.js

@@ -1,4 +1,5 @@
 import { MAX_CONSECUTIVE_COMPACTION_FAILURES } from "./compaction-knobs.js";
+import { emitsChildRowFrames } from "../delegation-frames.js";
 import { isSyntheticApiErrorMessage } from "../../internal/harness.js";
 import { adjudicateDerivedRoute, fallbackToPrimaryNotice, sameRouteIdentity } from "../../brain/route-adjudicator.js";
 import { isDegenerateCutMessage } from "../../brain/terminal-cause.js";
@@ -21,11 +22,12 @@ import { generatePromptSuggestions } from "./prompt-suggestions.js";
 import { settleTeardownLeg } from "./teardown-bounded.js";
 import { owedDateAnchor } from "./announce-once-ledger.js";
 import { autoRunConsolidationFromRecommendation, autoRunOnRecommendationEffective, scopeHasUnconsumedRecommendation } from "./memory-consolidation-driver.js";
+import { consolidationWriteJudgeOfLeg } from "./memory-consolidation-write-judge.js";
 import { amendTerminal, terminalProjection } from "./terminal-projection.js";
 import { mintCompactedEvent } from "../auto-compaction.js";
 import { asThrownError } from "../thrown-value.js";
 export async function runSettleAndTeardown(input) {
-    const { spec, queue, prepared, resume, internals, rs, stats, ident, parentToolCallId, subagentName, loopLatch, timeout, ownCommittedTailRef, emitDelegationLifecycle, taskIdRef, manualCompactRef, drainManualCompact, final, threw, abortedLive, userInterruptedLive, answerSettled, strandedHumanAnswers, reasoningResolution, comp, compactionBreaker, owedUserInput, setResult, onSuggestions, onSuspend, runner, sessions } = input;
+    const { spec, queue, prepared, resume, internals, rs, stats, ident, loopLatch, timeout, ownCommittedTailRef, emitDelegationLifecycle, taskIdRef, manualCompactRef, drainManualCompact, final, threw, abortedLive, userInterruptedLive, answerSettled, strandedHumanAnswers, reasoningResolution, comp, compactionBreaker, owedUserInput, setResult, onSuggestions, onSuspend, runner, sessions } = input;
     try {
         if (comp?.compacted) {
             queue.push(mintCompactedEvent(comp, "auto", ident()));
@@ -237,7 +239,8 @@ export async function runSettleAndTeardown(input) {
             await settleTeardownLeg(() => mes.harvest(), "memoryEngineSession.harvest (settle leg)", (e) => runner.deps.onError?.(e, { phase: "config", sessionId: prepared.sessionId }));
             const scope = mes.handle.writeScope;
             if (scope !== null && autoRunOnRecommendationEffective(runner.deps) && scopeHasUnconsumedRecommendation(mes.engine, scope)) {
-                void autoRunConsolidationFromRecommendation({ deps: runner.deps, engine: mes.engine, scope, sessionId: prepared.sessionId, onNotice: runner.deps.onNotice, onError: runner.deps.onError });
+                const writeJudge = consolidationWriteJudgeOfLeg(prepared.syntheticWriteVerdict);
+                void autoRunConsolidationFromRecommendation({ deps: runner.deps, engine: mes.engine, scope, sessionId: prepared.sessionId, writeJudge, onNotice: runner.deps.onNotice, onError: runner.deps.onError });
             }
         }
         emitTrace(rs.telemetry.tracer, () => ({
@@ -262,14 +265,14 @@ export async function runSettleAndTeardown(input) {
             ts: Date.now(),
         }));
         setResult(result);
-        if (parentToolCallId !== undefined && result.terminal.kind !== "paused") {
+        if (emitsChildRowFrames(prepared.hookIdentity) && result.terminal.kind !== "paused") {
             const terminalTick = {
                 type: "task_progress",
                 taskId: rs.telemetry.taskId,
                 ...(internals?.delegationTaskType !== undefined ? { taskType: internals.delegationTaskType } : {}),
                 ...(internals?.cycleSeq !== undefined ? { seq: internals.cycleSeq } : {}),
                 ...(internals?.parentTaskId !== undefined ? { parentTaskId: internals.parentTaskId } : {}),
-                ...(subagentName ? { name: subagentName } : {}),
+                ...(prepared.hookIdentity.agentName ? { name: prepared.hookIdentity.agentName } : {}),
                 ...(internals?.explicitAgentName !== undefined ? { spawnName: internals.explicitAgentName } : {}),
                 model: prepared.model.id,
                 usage: { totalTokens: stats.tokens, toolUses: stats.toolCalls, durationMs: Date.now() - rs.telemetry.taskStart },

package/dist/core/runner/run-terminal-adoption.d.ts

@@ -78,7 +78,7 @@ export interface RunTerminalAdoptionInput<R> {
     abortedLive: boolean;
     /** borrowed-readonly — the leg's snapshot of `loopLatch.userInterrupted` (gates the interruption marker). */
     userInterruptedLive: boolean;
-    /** borrowed-readonly — the Runner's deployment deps, read LIVE (`onError`, `checkpointStore`, `onNotice`); the one home of why it is
+    /** borrowed-readonly — the Runner's deployment deps, read LIVE (`onError`, `checkpointStore`, `onNotice`, `mediaByteCapBytes`); the one home of why it is
      *  a seat and not a captured object is {@link RunnerDepsSeat}. */
     runner: RunnerDepsSeat;
     /** borrowed-readonly — the session store: the end-of-task pass touches the leg's session through it (`finish`'s teardown legs). */

package/dist/core/runner/run-terminal-adoption.js

@@ -43,7 +43,7 @@ export async function runTerminalAdoption(input) {
             const report = await reconcileInterruptedSession(prepared.session, prepared.toolEffects, undefined, startedToolCallIds);
             orphansClosed = report.recovered.length;
             for (const orphan of report.recovered) {
-                emitSettled(prepared.toolOccurrences, { toolCallId: orphan.toolCallId, spelledName: orphan.toolName, ...(toolLabels.has(orphan.toolName) ? { label: toolLabels.get(orphan.toolName) } : {}), args: orphan.args }, reconciledEnd(orphan), { push: (f) => queue.push({ ...f, ...ident() }), structured: prepared.structuredProjector });
+                emitSettled(prepared.toolOccurrences, { toolCallId: orphan.toolCallId, spelledName: orphan.toolName, ...(toolLabels.has(orphan.toolName) ? { label: toolLabels.get(orphan.toolName) } : {}), args: orphan.args }, reconciledEnd(orphan), { push: (f) => queue.push({ ...f, ...ident() }), structured: prepared.structuredProjector, mediaByteCapBytes: runner.deps.mediaByteCapBytes });
                 emitCommitted(orphan.entryId, "toolResult", orphan.toolCallId);
             }
             reconcileComplete = true;

package/dist/core/runner/run-turn-boundary.js

@@ -10,7 +10,7 @@ import { buildWorkingFileAttachments, centerAdoptionOption, contextInstructionFi
 import { hookSeatExpiredError, runHookSeat } from "../hooks.js";
 import { sanitizeUntrustedText, SHELLED_BODY_ENVELOPE_TAGS } from "../untrusted-text.js";
 import { droppedToolDigest, withAnnounceDigests } from "./announce-once-ledger.js";
-import { formatDiagnosticsBlock } from "../lsp-diagnostics.js";
+import { formatDiagnosticsBlock, withholdListedDiagnostics } from "../lsp-diagnostics.js";
 import { workflowSizeGuidelineChangeNotice } from "../../orchestration/workflow-size-guideline.js";
 import { awaitChargeWithSlowDisclosure, discloseUnevaluableWindow, ENV_DUE_GOVERNANCE_READ_BUDGET_MS, GOVERNANCE_READ_STALLED, LIMIT_APPROACH_DEFAULT_THRESHOLDS, limitApproachFrames, platformLimitTerminal, raceUntilDeadline } from "./clock-and-limits.js";
 import { appendBoundaryFrames, compactionRestateOptions } from "./compaction-restate.js";
@@ -203,7 +203,7 @@ export function createTurnBoundary(input) {
             !prepared.lspDiagnostics.registry.isEmpty() &&
             !prepared.abortController.signal.aborted &&
             prepared.batchHaltRef.current === undefined) {
-            const files = prepared.lspDiagnostics.registry.drain(prepared.lspDiagnostics.runIdent);
+            const files = await withholdListedDiagnostics(prepared.lspDiagnostics.registry.drain(prepared.lspDiagnostics.runIdent), prepared.lspDiagnostics.withheldOf);
             if (files.length > 0) {
                 queue.push({ type: "diagnostics", files, isNew: true, ...ident() });
                 const block = mintSystemReminder(formatDiagnosticsBlock(files), prepared.reminderMark);

package/dist/core/runner/runtask.js

@@ -45,7 +45,7 @@ import { streamLifecycleVerbs } from "./stream-lifecycle-verbs.js";
 import { streamHaltVerbs } from "./stream-halt-verbs.js";
 import { streamModeVerb } from "./stream-mode-verb.js";
 import { runNotificationLane } from "./run-notification-lane.js";
-import { assertRunnerDepsDoors } from "./construction-doors.js";
+import { retainRunnerDeps } from "./construction-doors.js";
 import { runLeg } from "./run-leg.js";
 import { runTerminalAdoption } from "./run-terminal-adoption.js";
 import { runSettleAndTeardown } from "./run-settle-and-teardown.js";
@@ -77,10 +77,10 @@ export class Runner {
     static PARENT_CONSTRAINT_REGISTRY_CAP = 1024;
     depsSeat;
     constructor(deps) {
-        assertRunnerDepsDoors(deps);
+        const retained = retainRunnerDeps(deps);
         const runner = this;
         this.depsSeat = { get deps() { return runner.deps; } };
-        this.deps = withDeploymentAllowedTools(deps);
+        this.deps = withDeploymentAllowedTools(retained);
         if (this.deps.tiers) {
             this.deps = { ...this.deps, models: expandTiers(this.deps.models, this.deps.tiers) };
         }
@@ -121,7 +121,7 @@ export class Runner {
         if (!this.deps.toolResultStore) {
             this.deps = { ...this.deps, toolResultStore: new RunnerSharedToolResultStore({ maxTotalChars: 64_000_000 }) };
         }
-        this.sessions = deps.sessionStore ?? new TtlSessionStore();
+        this.sessions = this.deps.sessionStore ?? new TtlSessionStore();
     }
     emitTaskOutcome(outcome) {
         emitTaskOutcome(this.deps, outcome);
@@ -465,10 +465,10 @@ export class Runner {
                         const { effectiveTimeoutMs, walltimeMonotonicDeadline, timeout, pushContent, ownCommittedTailRef, emitCommitted } = runClockAndContent({ spec, prepared, queue, internals, rs, ident, parentToolCallId, startedToolCallIds });
                         const toolProgress = createToolProgressLane(pushContent, ident, prepared.toolOccurrences);
                         prepared.toolProgressRef.current = toolProgress;
-                        const { subagentName, withBrainSinks, withExtraBodyDroppedSink } = runBrainSinks({ queue, internals, rs, ident, parentToolCallId, observeReasoningWireFacts, notice: { onNotice: this.deps.onNotice, sessionId: prepared.sessionId, runId: prepared.runId } });
+                        const { withBrainSinks, withExtraBodyDroppedSink } = runBrainSinks({ queue, internals, rs, ident, observeReasoningWireFacts, notice: { onNotice: this.deps.onNotice, sessionId: prepared.sessionId, runId: prepared.runId } });
                         const toolLabels = new Map(prepared.tools.flatMap((t) => (t.label !== undefined && t.label !== t.name ? [[t.name, t.label]] : [])));
                         for (const orphan of prepared.wakeRecovered) {
-                            emitSettled(prepared.toolOccurrences, { toolCallId: orphan.toolCallId, spelledName: orphan.toolName, ...(toolLabels.has(orphan.toolName) ? { label: toolLabels.get(orphan.toolName) } : {}), args: orphan.args }, reconciledEnd(orphan), { push: (f) => queue.push({ ...f, ...ident() }), structured: prepared.structuredProjector });
+                            emitSettled(prepared.toolOccurrences, { toolCallId: orphan.toolCallId, spelledName: orphan.toolName, ...(toolLabels.has(orphan.toolName) ? { label: toolLabels.get(orphan.toolName) } : {}), args: orphan.args }, reconciledEnd(orphan), { push: (f) => queue.push({ ...f, ...ident() }), structured: prepared.structuredProjector, mediaByteCapBytes: this.deps.mediaByteCapBytes });
                             emitCommitted(orphan.entryId, "toolResult", orphan.toolCallId);
                         }
                         const postToolBatchHook = (spec.hooks ?? this.deps.hooks)?.postToolBatch;
@@ -477,7 +477,7 @@ export class Runner {
                         const { onMessageUpdate, onMessageEnd, onToolStart, onToolEnd, onTurnEnd, announceWorkspaceMove } = createHarnessHandlers({
                             prepared, stats, rs,
                             deps: {
-                                spec, queue, internals, ident, parentToolCallId, subagentName,
+                                spec, queue, internals, ident, mediaByteCapBytes: this.deps.mediaByteCapBytes,
                                 pushContent, emitCommitted, startedToolCallIds, toolStartAt, toolProgress, writeFamilyOf,
                                 toolLabels, postToolBatchHook, batchArgs, internalsNotifier,
                                 runnerHooks: { onError: (e, info) => this.deps.onError?.(e, info), onNotice: this.deps.onNotice },
@@ -512,7 +512,7 @@ export class Runner {
                                 spec, queue, prepared, rs, stats, ident, emitCommitted, startedToolCallIds, toolLabels, timeout, compactionBrain, compactionBreaker, windowSafetyOptions,
                                 undrainedUserAtEnd, userInputLostAtEnd, final, threw, abortedLive, userInterruptedLive, runner: this.depsSeat, sessions: this.sessions,
                                 next: ({ threw, comp, answerSettled, owedUserInput }) => runSettleAndTeardown({
-                                    spec, queue, prepared, resume, internals, rs, stats, ident, parentToolCallId, subagentName, loopLatch, timeout, ownCommittedTailRef,
+                                    spec, queue, prepared, resume, internals, rs, stats, ident, loopLatch, timeout, ownCommittedTailRef,
                                     emitDelegationLifecycle, taskIdRef, manualCompactRef, drainManualCompact, final, threw, abortedLive, userInterruptedLive, answerSettled, strandedHumanAnswers, reasoningResolution, comp, compactionBreaker, owedUserInput,
                                     setResult, onSuggestions, onSuspend, runner: this.depsSeat, sessions: this.sessions,
                                 }),

package/dist/core/runner/session-file-state-replay.d.ts

@@ -31,15 +31,22 @@
  *     (the model re-reads), which is the pre-existing cost, not a new failure.
  */
 import type { AgentMessage } from "../../internal/harness.js";
-/** The whole text of one file at the moment the transcript recorded it. */
-export interface TranscriptFileRecord {
+import { type UserAttachmentObservation } from "../../internal/llm.js";
+/** What the transcript proves about one file: its whole text at that moment (a tool's card), or the read-state entry an
+ *  attachment frame's delivery committed (its record's observation, verbatim — hash, view and partial-view flag). */
+export type TranscriptFileRecord = {
     /** The path as the tool recorded it — absolute (see {@link wholeFileRecordsFromTranscript}). */
     path: string;
     /** The file's ENTIRE text at that moment, in the decoded coordinate the fs tools hash. */
     content: string;
-    /** The recording tool result's own timestamp — the most honest "last read at" available. */
+    /** The recording message's own timestamp — the most honest "last read at" available. */
     at: number;
-}
+} | {
+    path: string;
+    /** The entry the delivery committed. */
+    observation: UserAttachmentObservation["entry"];
+    at: number;
+};
 /**
  * Per-file, the last whole-file content the transcript proves — in transcript order, last record wins.
  *
@@ -57,6 +64,9 @@ export interface TranscriptFileRecord {
  * the narrowed model-facing union: this reads the branch as the session stores it, and every lane that
  * is not a tool result falls out on the first line of the loop.
  *
+ * A user-attachment frame (`UserMessage.attachment` with an observation) proves the read state its delivery committed,
+ * keyed by the canonical key it carries — the same entry the live commit wrote, so a rebuilt partial view stays one.
+ *
  * Paths are reported only when the tool recorded an ABSOLUTE one. A relative spelling was resolved
  * against the tracked working directory of that moment, which this task cannot reconstruct; re-
  * resolving it here could key the entry to a different file.

package/dist/core/runner/session-file-state-replay.js

@@ -1,3 +1,4 @@
+import { userAttachmentOf } from "../../internal/llm.js";
 import { isAbsoluteForFamily, pathFamilyOf } from "../../tools/fs/safety.js";
 import { applyRecordedEdit } from "../../tools/fs/fs-shared.js";
 import { normalizeFileText } from "../../tools/fs/encoding.js";
@@ -64,6 +65,13 @@ function wholeFileFromReadCard(rest) {
 export function wholeFileRecordsFromTranscript(messages) {
     const byPath = new Map();
     for (const m of messages) {
+        const attachment = userAttachmentOf(m);
+        if (attachment?.observation !== undefined) {
+            const { key, entry } = attachment.observation;
+            if (isAbsoluteForFamily(pathFamilyOf({ root: key }), key))
+                byPath.set(key, { path: key, observation: entry, at: m.timestamp });
+            continue;
+        }
         if (m.role !== "toolResult" || m.isError)
             continue;
         const card = cardOf(m.details);

package/dist/core/runner/stream-steer-verb.js

@@ -13,6 +13,9 @@ export function streamSteerVerb(input) {
     const { spec, internals, queue, acceptedSteerInputs, live, ready, orTimeout, readyTimeoutMs: READY_TIMEOUT_MS, steeringError, runner } = input;
     let steerChain = Promise.resolve();
     const steer = async (text, options) => {
+        if (options?.userAttachments !== undefined) {
+            throw steeringError("a steer carries no attachments — declare them in TaskSpec.userAttachments on the next objective", "steering.invalid_content");
+        }
         const trusted = options?.trusted ? true : false;
         if (trusted && sanitizeUntrustedText(text) !== text) {
             throw steeringError("trusted steering text must not contain a </system-reminder> tag", "steering.invalid_content");

package/dist/core/runner/tool-end-body.d.ts

@@ -32,9 +32,8 @@ export declare function batchResponseDigest(result: unknown): string | undefined
  *  showed an empty body for every durable-approved call. Same projection = same source as the transcript.
  *  Also the one place the gate outcome reaches a frame — see the parameter. */
 export declare function toolEndBodyFrom(result: unknown, isError: boolean, 
-/** The leg's card projector — see the doc above. A parameter, never a module default: a body minted with the engine
- *  set alone would silently drop every declared caller card and never announce. */
-structured: StructuredProjector, 
+/** The leg's card projector (never a module default: the engine set alone drops every declared caller card unannounced) and media budget. */
+leg: Pick<OccurrenceFrames, "structured" | "mediaByteCapBytes">, 
 /** The gate's record of the pass that admitted or refused this call, supplied by the CALLER of this
  *  projection — the end projection ({@link emitSettled}) reads it off the call's occurrence (its latest gate
  *  record). Deliberately a parameter and never derived from `result`: a tool's own `details`
@@ -63,10 +62,12 @@ export type OccurrenceFrame = Omit<Extract<TaskEvent, {
 }>, keyof TaskEventIdentity> | Omit<Extract<TaskEvent, {
     type: "tool_end";
 }>, keyof TaskEventIdentity>;
-/** Where an occurrence's frames go: the leg's push (it stamps the identity and picks the queue) and its card projector. */
+/** Where an occurrence's frames go: the leg's push (it stamps the identity and picks the queue), its card projector and its media budget. */
 export interface OccurrenceFrames {
     push(frame: OccurrenceFrame): void;
     structured: StructuredProjector;
+    /** `RunnerDeps.mediaByteCapBytes` as given — the request strip's budget, read through the same `mediaBudgetBytes`; required, so no site reads a second one. */
+    mediaByteCapBytes: number | undefined;
 }
 /** The START projection: the call's occurrence opens and its start frame goes out. Every leg that announces a call
  *  comes through here (the live loop's `tool_execution_start`, the resumed leg's approved call). */

package/dist/core/runner/tool-end-body.js

@@ -33,9 +33,9 @@ export function batchResponseDigest(result) {
         ? `${text.slice(0, BATCH_RESPONSE_MAX_CHARS)}…[+${text.length - BATCH_RESPONSE_MAX_CHARS} chars truncated]`
         : text;
 }
-export function toolEndBodyFrom(result, isError, structured, gate, gatedCallIdOfRun) {
-    const o = toolOutputFrom(result);
-    const st = structured(result);
+export function toolEndBodyFrom(result, isError, leg, gate, gatedCallIdOfRun) {
+    const o = toolOutputFrom(result, leg.mediaByteCapBytes);
+    const st = leg.structured(result);
     const det = isError ? readMember(result, "details") : undefined;
     const codeRaw = readMember(det, "code");
     const kindRaw = readMember(det, "errorKind");
@@ -71,7 +71,7 @@ export function emitSettled(table, start, end, frames) {
         toolName: occ.spelledName,
         ...(occ.label !== undefined ? { label: occ.label } : {}),
         isError,
-        ...toolEndBodyFrom(end.result, isError, frames.structured, gate, end.gatedCallIdOfRun),
+        ...toolEndBodyFrom(end.result, isError, frames, gate, end.gatedCallIdOfRun),
         ...(gate?.disposition.kind === "denied" && occ.wireName !== undefined ? { wireName: occ.wireName } : {}),
         ...(end.notExecuted === true ? { notExecuted: true } : {}),
     });

package/dist/core/runner/tool-output-projection.d.ts

@@ -1,14 +1,15 @@
 /**
  * The `tool_end` output/structured projection, verbatim from
  * `runtask.ts`'s runLocked R4 phase. Pure functions over the harness `AgentToolResult`: zero closure
- * state, zero runtask coupling — the ONLY module-level input is the size cap below. Event-sequence
- * snapshot pin (recorded before/after the move, byte-equal) guards the projection semantics.
+ * state, zero runtask coupling — the module-level inputs are the text cap below and the shared media budget default
+ * (`mediaBudgetBytes`); the leg hands in its own `mediaByteCapBytes`.
  */
-export declare const toolOutputFrom: (result: unknown) => {
+type ToolOutput = {
     output: unknown;
     truncated: boolean;
     totalChars?: number;
-} | undefined;
+};
+export declare const toolOutputFrom: (result: unknown, mediaByteCapBytes: number | undefined) => ToolOutput | undefined;
 /** The `tool_end.structured` projection over a harness tool result: the CC card when `details.type` names a card
  *  the leg admits, else undefined. Minted per leg by {@link createStructuredProjector}; every body projection takes it
  *  as a parameter — there is no module-level card set to fall back to. */
@@ -23,3 +24,4 @@ export declare function createStructuredProjector(opts?: {
     declaredCards?: Iterable<string>;
     onUndeclared?: (type: string) => void;
 }): StructuredProjector;
+export {};

package/dist/core/runner/tool-output-projection.js

@@ -1,62 +1,81 @@
+import { isTextBlock, renderContentBlock } from "../../internal/llm.js";
+import { imageBytes, mediaBudgetBytes } from "../media-byte-cap.js";
 import { engineCardTypes } from "../tool-registry.js";
 import { readMember } from "../thrown-value.js";
 const MAX_TOOL_END_OUTPUT_CHARS = 16384;
-const safeJsonLength = (v) => {
-    try {
-        return JSON.stringify(v)?.length;
+const marker = (n) => `…[+${n} chars truncated]`;
+const isMediaBlock = (b) => {
+    const block = b;
+    return (block?.type === "image" || block?.type === "document") && typeof block.data === "string";
+};
+const ownChars = (b) => isTextBlock(b) ? b.text.length + (JSON.stringify({ ...b, type: undefined, text: undefined })?.length ?? 2) - 2 : isMediaBlock(b) ? b.data.length : (JSON.stringify(b)?.length ?? 0);
+const boundTextLane = (blocks, lane) => {
+    const sized = lane.map((i) => ({ i, size: ownChars(blocks[i]) }));
+    const stream = sized.reduce((n, { size }, k) => n + size + (k > 0 ? 1 : 0), 0);
+    const forms = new Map();
+    let used = 0;
+    for (const [k, { i, size }] of sized.entries()) {
+        const sep = k > 0 ? 1 : 0;
+        if (used + sep + size <= MAX_TOOL_END_OUTPUT_CHARS) {
+            used += sep + size;
+            forms.set(i, blocks[i]);
+            continue;
+        }
+        const shown = renderContentBlock(blocks[i]).slice(0, Math.max(0, MAX_TOOL_END_OUTPUT_CHARS - used - sep));
+        const notShown = stream - Math.min(MAX_TOOL_END_OUTPUT_CHARS, used + sep) - (isTextBlock(blocks[i]) ? shown.length : 0);
+        forms.set(i, { type: "text", text: shown + marker(notShown) });
+        return { forms, cut: true };
     }
-    catch {
-        return undefined;
+    return { forms, cut: false };
+};
+const wireBytes = (b) => Buffer.byteLength(JSON.stringify(b)) + 1;
+const SUMMARY_RESERVE = wireBytes({ type: "omitted", blocks: Number.MAX_SAFE_INTEGER, bytes: Number.MAX_SAFE_INTEGER, truncated: true }) + 2;
+const fitMedia = (media, budget) => {
+    let used = 0;
+    let degraded = false;
+    const blocks = [];
+    for (const [i, m] of media.entries()) {
+        const cost = used + m.data.length >= budget ? Infinity : wireBytes(m);
+        const kept = used + cost <= budget;
+        const out = kept ? m : { type: m.type, ...(typeof m.mimeType === "string" && m.mimeType.length <= 255 ? { mimeType: m.mimeType } : {}), bytes: imageBytes(m), truncated: true };
+        const outCost = kept ? cost : wireBytes(out);
+        degraded ||= !kept;
+        if (used + outCost > budget) {
+            const rest = media.slice(i);
+            blocks.push({ type: "omitted", blocks: rest.length, bytes: rest.reduce((n, r) => n + imageBytes(r), 0), truncated: true });
+            break;
+        }
+        used += outCost;
+        blocks.push(out);
     }
+    return { blocks, degraded };
 };
-const trunc = (s) => ({
-    text: s.slice(0, MAX_TOOL_END_OUTPUT_CHARS) + `…[+${s.length - MAX_TOOL_END_OUTPUT_CHARS} chars truncated]`,
-    totalChars: s.length,
-});
-export const toolOutputFrom = (result) => {
-    const content = result !== null && typeof result === "object" ? result.content : result;
-    if (content === undefined)
-        return undefined;
-    if (typeof content === "string") {
-        if (content.length <= MAX_TOOL_END_OUTPUT_CHARS)
+const project = (content, mediaByteCapBytes) => {
+    if (!Array.isArray(content)) {
+        const s = typeof content === "string" ? content : (JSON.stringify(content) ?? "");
+        if (s.length <= MAX_TOOL_END_OUTPUT_CHARS)
             return { output: content, truncated: false };
-        const t = trunc(content);
-        return { output: t.text, truncated: true, totalChars: t.totalChars };
+        return { output: s.slice(0, MAX_TOOL_END_OUTPUT_CHARS) + marker(s.length - MAX_TOOL_END_OUTPUT_CHARS), truncated: true, totalChars: s.length };
     }
-    let serialized;
+    const media = content.map(isMediaBlock);
+    const text = boundTextLane(content, content.flatMap((_, i) => (media[i] ? [] : [i])));
+    const limit = mediaBudgetBytes(mediaByteCapBytes);
+    const textBytes = [...text.forms.values()].reduce((n, f) => n + wireBytes(f), 0);
+    const fit = fitMedia(content.filter((_, i) => media[i]), limit === Infinity ? Infinity : Math.ceil((limit * 4) / 3) - SUMMARY_RESERVE - textBytes);
+    if (!text.cut && !fit.degraded)
+        return { output: content, truncated: false };
+    let next = 0;
+    const output = content.flatMap((_, i) => (media[i] ? (fit.blocks[next++] ?? []) : text.forms.has(i) ? [text.forms.get(i)] : []));
+    return { output, truncated: true, totalChars: content.reduce((n, b) => n + ownChars(b), 0) };
+};
+export const toolOutputFrom = (result, mediaByteCapBytes) => {
     try {
-        serialized = JSON.stringify(content) ?? "";
+        const content = result !== null && typeof result === "object" ? result.content : result;
+        return content === undefined ? undefined : project(content, mediaByteCapBytes);
     }
     catch {
-        return { output: "[unserializable tool output]", truncated: false };
-    }
-    if (serialized.length <= MAX_TOOL_END_OUTPUT_CHARS)
-        return { output: content, truncated: false };
-    let anyNonText = false;
-    let trueChars = 0;
-    const raw = Array.isArray(content)
-        ? content
-            .map((b) => {
-            const block = b;
-            if (block?.type === "text" && typeof block.text === "string") {
-                trueChars += block.text.length;
-                return block.text;
-            }
-            anyNonText = true;
-            trueChars += typeof block?.data === "string" ? block.data.length : (safeJsonLength(block) ?? 0);
-            return `[${typeof block?.type === "string" ? block.type : "block"}${typeof block?.mimeType === "string" ? `: ${block.mimeType}` : ""}]`;
-        })
-            .join("\n")
-        : serialized;
-    const totalChars = Array.isArray(content) ? trueChars : serialized.length;
-    if (raw.length > MAX_TOOL_END_OUTPUT_CHARS) {
-        const t = trunc(raw);
-        return { output: t.text, truncated: true, totalChars };
-    }
-    if (!anyNonText) {
-        return { output: raw, truncated: false };
+        return { output: "[unserializable tool output]", truncated: true };
     }
-    return { output: raw, truncated: true, totalChars };
 };
 const CC_DETAIL_TYPES = engineCardTypes();
 export function createStructuredProjector(opts = {}) {

package/dist/core/runner-deps.d.ts

@@ -852,8 +852,9 @@ export interface RunnerDeps {
      * family this seat complements, not replaces — BCE stays the fleet-row lane with registry `a*`
      * handles and ticks; this seat is the leg-identity lane), and workflow-spawned agents. Frames are
      * minted at the child leg's own runner chokepoint and carry the #281 件A identity envelope plus a
-     * terminal status summary — see {@link DelegationLifecycleEvent} for the emission points, the
-     * per-leg semantics and the recorded honest absences. Wire it once at Runner construction; a
+     * terminal status summary; the `spawn` phase is the projection of the child's `task_started` frame
+     * (once per cycle), the `terminal` phase is per leg — see {@link DelegationLifecycleEvent} for the
+     * emission points and the recorded honest absences. Wire it once at Runner construction; a
      * deployment needs NO RunInternals access to observe delegation any more. Observation only — a
      * throwing or rejecting observer is contained ({@link deliverDelegationLifecycle}) and never
      * faults the child run; a PRESENT non-function value here is announced once per process and the
@@ -1446,7 +1447,9 @@ export interface RunnerDeps {
      * CC 2.1.196 `tengu_media_byte_cap` parity). Image reads (`Read` → ImageContent) are per-image-capped but
      * accumulate across turns; this bounds the SUM in the request by stripping the OLDEST images (replaced with a
      * marker) — request-only, non-destructive (the durable session keeps the image; the model can re-Read it).
-     * Default {@link AGGREGATE_MEDIA_BUDGET_BYTES}; set `Infinity`/`0` to disable.
+     * The same budget bounds the media of one `tool_end.output` (spent there as base64 on the wire, x 4/3); both readers
+     * read it through `mediaBudgetBytes`. Default {@link AGGREGATE_MEDIA_BUDGET_BYTES}; set `Infinity`/`0` to disable. A
+     * non-number, `NaN` or a negative is refused at `new Runner` (`config.invalid_argument`), never read as "no budget".
      */
     mediaByteCapBytes?: number;
     /** Optional telemetry fired when {@link mediaByteCapBytes} strips media in a request (CC's

package/dist/core/shared-memory/types.d.ts

@@ -2,8 +2,8 @@
  * design/177 — the SHARED memory-store seam (connected team/deployment memory libraries the model may
  * BROWSE and READ through two tools) and its model-facing constants.
  *
- * Upstream anchor: CC 2.1.223's `memory_list` / `memory_read` pair. The defining property of that face
- * is READ/WRITE ASYMMETRY: the model side has no write channel at all — write governance is an
+ * Upstream anchor: CC 2.1.223's `memory_list` / `memory_read` pair, whose defining property was READ/WRITE
+ * ASYMMETRY (no model-side write channel); CC no longer has that shape — 2.1.296 also mounts `yd` (cli296.js:242348) "memory_write" — and sema keeps the 223 one (KL-878): write governance is an
  * environment concern, and the tool face's entire participation in it is truthfully reporting each
  * store's `writable` bit. sema keeps that structure and pushes the whole credential/consent half onto
  * the HOST (BYOM: core holds no identity face), so this module's seam is a single pull-shaped snapshot