@sema-agent/core 7.49.5 → 7.50.0

package/dist/engine/execution-env/node-execution-env.js

@@ -43,6 +43,40 @@ function fileKindFromStats(stats) {
     return undefined;
 }
 const HAS_POSIX_MODE_FACE = posixModeBitsMeaningful();
+async function readAllFrom(handle, max, aborted) {
+    const overCap = (bytes) => new FileError("invalid", `The held file is over the ${max}-byte read cap (${bytes} bytes or more); it was not read`);
+    const readAt = async (into, offset, length, position) => {
+        const { bytesRead } = await handle.read(into, offset, length, position);
+        if (aborted())
+            throw new FileError("aborted", "Operation aborted");
+        return bytesRead;
+    };
+    const size = Number((await handle.stat()).size);
+    if (size > max)
+        throw overCap(size);
+    if (size > 0) {
+        const out = Buffer.allocUnsafe(size);
+        let at = 0;
+        while (at < size) {
+            const bytesRead = await readAt(out, at, size - at, at);
+            if (bytesRead === 0)
+                break;
+            at += bytesRead;
+        }
+        return out.subarray(0, at);
+    }
+    const scratch = Buffer.allocUnsafe(Math.min(1 << 16, max + 1));
+    const chunks = [];
+    for (let at = 0;;) {
+        const bytesRead = await readAt(scratch, 0, Math.min(scratch.length, max + 1 - at), at);
+        if (bytesRead === 0)
+            return Buffer.concat(chunks, at);
+        at += bytesRead;
+        if (at > max)
+            throw overCap(at);
+        chunks.push(Buffer.from(scratch.subarray(0, bytesRead)));
+    }
+}
 function fileInfoFromStats(path, stats) {
     const kind = fileKindFromStats(stats);
     if (!kind) {
@@ -1031,6 +1065,97 @@ export class NodeExecutionEnv {
             return err(toFileError(error, resolved));
         }
     }
+    async openBound(path, abortSignal) {
+        const resolved = resolvePath(this.cwd, path);
+        const aborted = abortResult(abortSignal, resolved);
+        if (aborted)
+            return aborted;
+        let handle;
+        try {
+            handle = await open(resolved, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0));
+        }
+        catch (error) {
+            if (isNodeError(error) && error.code === "ELOOP")
+                return err(new FileError("precondition_failed", "The path is now a link, not the object that was checked", resolved));
+            return err(toFileError(error, resolved));
+        }
+        const refuse = async (code, message) => {
+            await handle.close().catch(() => { });
+            return err(new FileError(code, message, resolved));
+        };
+        try {
+            const held = await handle.stat({ bigint: true });
+            if (!(await this.heldIsAt(handle, held, resolved)))
+                return refuse("precondition_failed", "The path named another object than the one opened");
+            if (!held.isFile() && !held.isDirectory())
+                return refuse("invalid", "Neither a regular file nor a directory");
+            const identity = `${held.dev}:${held.ino}`;
+            const kind = held.isDirectory() ? "directory" : "file";
+            return ok({
+                identity,
+                kind,
+                size: async () => {
+                    try {
+                        return ok(Number((await handle.stat()).size));
+                    }
+                    catch (error) {
+                        return err(toFileError(error, resolved));
+                    }
+                },
+                readBytes: async (max, signal) => {
+                    if (kind !== "file")
+                        return err(new FileError("is_directory", "The held object is a directory", resolved));
+                    try {
+                        return ok(await readAllFrom(handle, max, () => abortResult(signal, resolved) !== undefined));
+                    }
+                    catch (error) {
+                        return err(toFileError(error, resolved));
+                    }
+                },
+                list: async (signal) => {
+                    if (kind !== "directory")
+                        return err(new FileError("not_directory", "The held object is a file", resolved));
+                    if (process.platform === "win32")
+                        return err(new FileError("not_supported", "This platform cannot list a held directory", resolved));
+                    try {
+                        return await this.listOpenDirectory(handle, resolved, identity, signal);
+                    }
+                    catch (error) {
+                        return err(toFileError(error, resolved));
+                    }
+                },
+                close: () => handle.close().catch(() => { }),
+            });
+        }
+        catch (error) {
+            return refuse(toFileError(error, resolved).code, error.message ?? "open failed");
+        }
+    }
+    async heldIsAt(handle, held, resolved) {
+        if (process.platform === "linux")
+            return (await readlink(`/proc/self/fd/${handle.fd}`).catch(() => undefined)) === resolved;
+        const named = await lstat(resolved, { bigint: true });
+        return held.dev === named.dev && held.ino === named.ino && (await physicalPathOfAsync(resolved)) === resolved;
+    }
+    async listOpenDirectory(held, resolved, identity, abortSignal) {
+        const throughHandle = process.platform === "linux";
+        const listed = throughHandle ? `/proc/self/fd/${held.fd}` : resolved;
+        const infos = [];
+        for (const entry of await readdir(listed, { withFileTypes: true })) {
+            const loopAbort = abortResult(abortSignal, resolved);
+            if (loopAbort)
+                return loopAbort;
+            const info = fileInfoFromStats(resolve(resolved, entry.name), await lstat(join(listed, entry.name)));
+            if (info.ok)
+                infos.push(info.value);
+        }
+        if (!throughHandle) {
+            const after = await stat(resolved, { bigint: true });
+            if (`${after.dev}:${after.ino}` !== identity)
+                return err(new FileError("precondition_failed", "The path named another directory by the time it was listed", resolved));
+        }
+        return ok(infos);
+    }
     async readLink(path) {
         return readLinkTarget(resolvePath(this.cwd, path));
     }

package/dist/engine/harness/agent-harness.d.ts

@@ -1,4 +1,4 @@
-import type { ActorAssertion, AssistantMessage, ImageContent, Model, UserMessage } from "../llm/index.js";
+import type { ActorAssertion, AssistantMessage, ImageContent, Model, TextContent, UserMessage, UserMessageAttachment } from "../llm/index.js";
 import { type ToolTurnRepair } from "../llm/index.js";
 import { type ExecutedToolCallOutcome } from "../loop/agent-loop.js";
 import type { HaltRemainingDirective } from "../loop/types.js";
@@ -38,6 +38,16 @@ export interface TrailingToolBatchOptions {
  *  their frames are emitted and committed. Not called when a trailing-batch settlement ends the run first — the
  *  caller then still owns whatever the prompt was carrying. */
 export type PromptDeliveredCallback = () => void;
+/** An engine-minted message that TRAILS the prompt's human message in the same request (a user-attachment frame):
+ *  minted from its content blocks, always an engine note, carrying its delivery record. */
+export interface TrailingMessageSeed {
+    readonly content: ReadonlyArray<TextContent | ImageContent>;
+    readonly attachment: UserMessageAttachment;
+}
+/** `prompt()` option: the messages that follow the human message, in order (see {@link TrailingMessageSeed}). */
+export interface PromptTrailing {
+    trailing?: readonly TrailingMessageSeed[];
+}
 export interface UserMessageProvenance {
     /** Exact char length of the engine-prepended prefix on `text` (first-frame reminders etc.).
      *  Sugar for the single segment `[0, chars)` — when `engineSegments` is also supplied, segments win. */
@@ -390,7 +400,7 @@ export declare class AgentHarness<TSkill extends Skill = Skill, TPromptTemplate
         images?: ImageContent[];
         settleUnansweredToolCalls?: TrailingToolBatchOptions;
         onDelivered?: PromptDeliveredCallback;
-    } & UserMessageProvenance): Promise<AssistantMessage | undefined>;
+    } & UserMessageProvenance & PromptTrailing): Promise<AssistantMessage | undefined>;
     /** R2-③: an empty/whitespace-only injection with no images carries ZERO information — it
      *  must not mint a user frame (strict endpoints reject empty user content, and an empty follow-up would
      *  pointlessly extend the run by one turn). No-op, not a throw: injection callers are fire-and-

package/dist/engine/harness/agent-harness.js

@@ -1,4 +1,4 @@
-import { createAssistantMessageEventStream, ensureToolTurnInvariants, snapshotActorAssertion, stripEngineMetadata } from "../llm/index.js";
+import { createAssistantMessageEventStream, ensureToolTurnInvariants, snapshotActorAssertion, stripEngineMetadata, userAttachmentOf } from "../llm/index.js";
 import { finalizeToolOutcome, runAgentLoop } from "../loop/agent-loop.js";
 import { resolveAgentCoreStreamFn } from "../loop/runtime-deps.js";
 import { normalizeEngineSegments } from "../../core/untrusted-text.js";
@@ -38,6 +38,9 @@ function createUserMessage(text, images, provenance) {
             : {}),
     };
 }
+function createTrailingMessage(seed) {
+    return { role: "user", content: [...seed.content], timestamp: Date.now(), provenance: "engine-note", attachment: seed.attachment };
+}
 const engineNotePayloads = new WeakMap();
 const engineAuthoredInjections = new WeakSet();
 const userInputParkRecords = new WeakMap();
@@ -826,6 +829,14 @@ export class AgentHarness {
                     catch {
                     }
                 }
+                const attachment = entryId !== undefined ? userAttachmentOf(event.message) : undefined;
+                if (attachment !== undefined) {
+                    try {
+                        this.onFrameCommitted?.({ kind: "attachment", inputId: attachment.inputId, ordinal: attachment.ordinal }, entryId);
+                    }
+                    catch {
+                    }
+                }
             }
             else if (event.message.isApiErrorMessage === true) {
                 await this.recordApiFailure(event.message);
@@ -877,6 +888,7 @@ export class AgentHarness {
     async executeTurn(turnState, text, options, abortController) {
         let activeTurnState = turnState;
         const userMessage = createUserMessage(text, options?.images, options);
+        const trailingMessages = (options?.trailing ?? []).map(createTrailingMessage);
         this.runHistory = new WeakSet(turnState.messages.filter((m) => m.role === "assistant"));
         const beforeResult = await this.emitHook({
             type: "before_agent_start",
@@ -886,7 +898,7 @@ export class AgentHarness {
             resources: turnState.resources,
         });
         const takePrompts = async () => {
-            let messages = [userMessage];
+            let messages = [userMessage, ...trailingMessages];
             if (this.nextTurnQueue.length > 0) {
                 const queuedMessages = this.nextTurnQueue.splice(0);
                 try {
@@ -907,7 +919,7 @@ export class AgentHarness {
                     }
                     engineNotePayloads.delete(m);
                 }
-                messages = [...queuedMessages, messages[0]];
+                messages = [...queuedMessages, ...messages];
             }
             if (beforeResult?.messages) {
                 messages = [...messages, ...beforeResult.messages];

package/dist/engine/harness/types.d.ts

@@ -271,6 +271,22 @@ export interface FileInfo {
      */
     mode?: number;
 }
+/** A filesystem object held open by {@link FileSystem.openBound}: every answer is about THIS object, whatever the path
+ *  names later. `list` reads a directory's entries through the held object where the backend can; where it cannot, it
+ *  lists the path once and requires the path to name the held object afterwards (the implementation says where). */
+export interface BoundFileObject {
+    /** `<device>:<inode>` of the held object. */
+    readonly identity: string;
+    readonly kind: "file" | "directory";
+    /** The held object's current size in bytes. */
+    size(): Promise<Result<number, FileError>>;
+    /** The held file's whole content, never more than `max` bytes: a file over `max` when the read starts, or a stream that
+     *  passes it while read, is refused (`invalid`) without holding more than `max` of it. */
+    readBytes(max: number, abortSignal?: AbortSignal): Promise<Result<Uint8Array, FileError>>;
+    /** The held directory's direct children (links not followed). */
+    list(abortSignal?: AbortSignal): Promise<Result<FileInfo[], FileError>>;
+    close(): Promise<void>;
+}
 /**
  * @contract fs.canonical_chain.leaf_hops_only — `hops` lists, in order, the target each link on the LEAF chain writes
  * ({@link FileSystem.canonicalChain}): a relative target anchored, unfolded, at its own link's directory (`..` is the
@@ -406,6 +422,11 @@ export interface FileSystem {
     /** OPTIONAL: the identity of the object `path` names, links followed (`<device>:<inode>` on POSIX, exact): equal answers name one object, where
      *  a firmlink or bind mount keeps its own {@link canonicalPath}. Home-anchored deny rows are placed by it; omitted ⇒ by spelling only. */
     fileIdentity?(path: string, abortSignal?: AbortSignal): Promise<Result<string, FileError>>;
+    /** OPTIONAL: open the file or directory at a canonical `path` and HOLD it ({@link BoundFileObject}): the leaf link is not
+     *  followed, and the path must still name that object, through no link, right after the open (else `precondition_failed`).
+     *  A caller judges the held object and then reads, sizes or lists that same object; it closes it. Omitted ⇒ a caller that
+     *  must bind its read to what it judged does not read. */
+    openBound?(path: string, abortSignal?: AbortSignal): Promise<Result<BoundFileObject, FileError>>;
     /** Return false for missing paths. Other errors, such as permission failures, return a {@link FileError}. */
     exists(path: string, abortSignal?: AbortSignal): Promise<Result<boolean, FileError>>;
     /** Create a directory. Defaults: `recursive: true`, no abort signal. */

package/dist/engine/llm/content-block-render.d.ts

@@ -0,0 +1,15 @@
+/**
+ * The one text rendering of a content block, for every model-facing reader that shows a block as text: a text block is
+ * its own text; any other block is its marker — `[image: image/png]`, `[document: application/pdf]`, `[<type>]` — never
+ * its payload. Readers: the `tool_end.output` projection's cut block, the observer digest, the sub-agent step outcome,
+ * the auto-mode classifier window and the user-attachment view. Two readers omit non-text blocks instead of showing them
+ * (no second rendering): the compaction summarizer's message flatten and the host-facing post-tool-batch digest.
+ * A leaf module (no imports); consumers outside `src/engine` reach it through the `src/internal/llm.ts` facade.
+ */
+/** A text block: `{ type: "text", text: string }`. */
+export declare const isTextBlock: (b: unknown) => b is {
+    type: "text";
+    text: string;
+};
+/** The block as text: a text block's text, any other block's marker. */
+export declare const renderContentBlock: (b: unknown) => string;

package/dist/engine/llm/content-block-render.js

@@ -0,0 +1,10 @@
+export const isTextBlock = (b) => {
+    const block = b;
+    return block?.type === "text" && typeof block.text === "string";
+};
+export const renderContentBlock = (b) => {
+    if (isTextBlock(b))
+        return b.text;
+    const block = b;
+    return `[${typeof block?.type === "string" ? block.type : "block"}${typeof block?.mimeType === "string" ? `: ${block.mimeType}` : ""}]`;
+};

package/dist/engine/llm/index.d.ts

@@ -10,3 +10,4 @@ export * from "./diagnostics.js";
 export * from "./event-stream.js";
 export * from "./validation.js";
 export * from "./tool-turns.js";
+export * from "./content-block-render.js";

package/dist/engine/llm/index.js

@@ -3,3 +3,4 @@ export * from "./diagnostics.js";
 export * from "./event-stream.js";
 export * from "./validation.js";
 export * from "./tool-turns.js";
+export * from "./content-block-render.js";

package/dist/engine/llm/types.d.ts

@@ -386,7 +386,83 @@ export interface UserMessage {
      * old-session-verbatim posture as the engine-provenance fields above.
      */
     actor?: ActorAssertion;
+    /**
+     * The DELIVERY RECORD of a user-attachment frame: this message is the engine-minted frame carrying one attachment
+     * the user declared on the human message it follows (it always rides with `provenance:"engine-note"`). The one
+     * source of "what was delivered": read-state commit and rebuild, the `human_input` projection, the receipt, the
+     * derived views, compaction cut points and `resumeAt` read this record, never the frame's text. Metadata only —
+     * never sent to a provider (brains rebuild wire messages field by field; {@link stripEngineMetadata} strips it for a
+     * custom Brain); the session import door strips it (an imported frame is an ordinary engine note).
+     */
+    attachment?: UserMessageAttachment;
+}
+/** What the engine found an attachment to be: the four Read lanes, a directory, or bytes the host supplied. */
+export type UserAttachmentKind = "text" | "notebook" | "image" | "pdf" | "directory" | "client_text" | "client_image";
+/** Who held the bytes: the engine read a path in its workspace, or the host supplied text / an image. */
+export type UserAttachmentSupply = "path" | "content_text" | "content_image";
+/** What reached the model of the attachment's contents (the Read layer's outcome words). */
+export type UserAttachmentOutcome = "attached" | "partial" | "unchanged" | "not_attached";
+/** The read-state entry a path attachment's delivery committed (the Read layer's observation, verbatim). */
+export interface UserAttachmentObservation {
+    readonly key: string;
+    readonly entry: {
+        readonly hash: string;
+        readonly totalLines: number;
+        readonly truncated: boolean;
+        readonly isPartialView?: boolean;
+        readonly view?: {
+            readonly start: number;
+            readonly end: number;
+        };
+    };
+}
+/** See {@link UserMessage.attachment}. */
+export interface UserMessageAttachment {
+    /** The human input the attachment was declared on (its `human_input` event's `inputId`). */
+    readonly inputId: string;
+    /** 1-based position among that input's declared attachments, and how many it declared. */
+    readonly ordinal: number;
+    readonly count: number;
+    /** Absent when the read was refused before the kind was known (never guessed from a name). */
+    readonly kind?: UserAttachmentKind;
+    readonly supply: UserAttachmentSupply;
+    readonly outcome: UserAttachmentOutcome;
+    /** The path or name the frame's data region shows — the frame text and every projection render this value. */
+    readonly label: string;
+    /** Present on a path attachment whose delivery recorded read state. */
+    readonly observation?: UserAttachmentObservation;
+    /** `[start, end)` indices into the message's `content` of the data the attachment delivered (the file's own blocks,
+     *  or the engine's refusal sentence); the engine's marked sentences and the label line sit outside it. */
+    readonly dataBlocks: {
+        readonly start: number;
+        readonly end: number;
+    };
+    /** The kinds of the engine's notes about this delivery, in order (each rendered as a marked sentence). */
+    readonly notes: readonly string[];
+    /** Characters of text data delivered. */
+    readonly chars: number;
+    /** The data is not the whole file: a partial view, or a line range. */
+    readonly truncated: boolean;
 }
+/** Code points that would let a name break the line it is written on, or hide in it: C0/C1 controls, format
+ *  characters, and the line / paragraph separators. */
+export declare const DATA_LABEL_UNSAFE: RegExp;
+/**
+ * A data label (a path, a file name) as a JSON string literal with every C0/C1 control, format character and line /
+ * paragraph separator written as `\uXXXX` — lossless (JSON.parse gives the original back), and one line whatever the
+ * name holds. JSON's own escaping alone leaves U+2028 / U+2029 / U+0085 and the format characters raw.
+ */
+export declare function quoteDataLabel(label: string): string;
+/** The record a user message carries, when it is a well-formed attachment frame; otherwise `undefined` (a malformed
+ *  record reads as none — the message is then an ordinary engine note, the conservative direction). */
+export declare function userAttachmentOf(m: unknown): UserMessageAttachment | undefined;
+/**
+ * A derived view's rendering of one attachment frame (the compaction summarizer's input and the auto-mode classifier's
+ * window read this one function): a header line naming the attachment from its record, then the delivered data — never
+ * the frame's marked sentences, and never under the user's authority. `cap` bounds the data excerpt; the header states
+ * the cut, so the excerpt itself is the data's own characters.
+ */
+export declare function renderUserAttachmentView(m: UserMessage, a: UserMessageAttachment, cap?: number): string;
 /** A cut turn's output-cap facts: the lane's own cap stop fired, the output the provider counted, the cap the request
  *  carried. The cap cut the call when `capStop` or `outputTokens >= capTokens`. */
 export interface OutputLimit {
@@ -533,7 +609,7 @@ export interface AssistantMessage {
      * final content instead of failing the turn (CC 198 queryModelStreaming parity: avoid re-billing +
      * keep the displayed content consistent with the result). `stopReason` is synthesized from the
      * content ("toolUse" when a completed tool call streamed, else "stop"); `errorMessage` carries the
-     * CC-verbatim warning ("Response stalled mid-stream." / "Connection closed mid-response."), visible
+     * warning in CC 2.1.220's words ("Response stalled mid-stream." / "Connection closed mid-response."; gone from 2.1.245 on), visible
      * to the model in the transcript. Downstream semantics (agent-loop): `partialFinalized &&
      * stopReason==="stop"` gets a BOUNDED continue nudge (an unattended run must not book the cut as an
      * incomplete success); `partialFinalized && stopReason==="toolUse"` executes normally (a truncated
@@ -585,10 +661,10 @@ export interface ToolResultMessage<TDetails = unknown> {
 export type Message = UserMessage | AssistantMessage | ToolResultMessage;
 /**
  * RB-3 (stage S4 carry): strip the engine-provenance metadata fields from user messages before
- * serializing a Context to an external wire. The six fields (`enginePrefixChars`/`engineSegments`/
- * `engineMinted`/`provenance`/`actor`/`engineNoteKey`) are INTERNAL coordination between the engine's
+ * serializing a Context to an external wire. The seven fields (`enginePrefixChars`/`engineSegments`/
+ * `engineMinted`/`provenance`/`actor`/`engineNoteKey`/`attachment`) are INTERNAL coordination between the engine's
  * minting side and its consumers (permission classifier, compaction summarizer, prompt suggestions,
- * multiplayer attribution) — they must never reach a provider payload. The built-in brains construct
+ * multiplayer attribution, attachment delivery) — they must never reach a provider payload. The built-in brains construct
  * their own wire shapes and are immune; a CUSTOM Brain that whole-object-serializes messages
  * (`JSON.stringify(context.messages)`) would leak them — run the array through this projection first.
  */

package/dist/engine/llm/types.js

@@ -1,3 +1,4 @@
+import { renderContentBlock } from "./content-block-render.js";
 export function snapshotActorAssertion(actor) {
     return {
         id: actor.id,
@@ -5,11 +6,52 @@ export function snapshotActorAssertion(actor) {
         ...(actor.issuer !== undefined ? { issuer: actor.issuer } : {}),
     };
 }
+export const DATA_LABEL_UNSAFE = /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/u;
+export function quoteDataLabel(label) {
+    let out = "";
+    for (const ch of JSON.stringify(label)) {
+        out += DATA_LABEL_UNSAFE.test(ch) ? `\\u${ch.codePointAt(0).toString(16).padStart(4, "0")}` : ch;
+    }
+    return out;
+}
+export function userAttachmentOf(m) {
+    if (m === null || typeof m !== "object" || m.role !== "user")
+        return undefined;
+    const a = m.attachment;
+    if (a === null || typeof a !== "object")
+        return undefined;
+    const content = m.content;
+    const blocks = Array.isArray(content) ? content.length : 0;
+    const db = a.dataBlocks;
+    const wellFormed = typeof a.inputId === "string" &&
+        typeof a.label === "string" &&
+        typeof a.outcome === "string" &&
+        Number.isInteger(a.ordinal) &&
+        Number.isInteger(a.count) &&
+        a.ordinal >= 1 &&
+        a.ordinal <= a.count &&
+        db !== undefined &&
+        Number.isInteger(db.start) &&
+        Number.isInteger(db.end) &&
+        db.start >= 0 &&
+        db.start <= db.end &&
+        db.end <= blocks;
+    return wellFormed ? a : undefined;
+}
+export function renderUserAttachmentView(m, a, cap) {
+    const blocks = Array.isArray(m.content) ? m.content.slice(a.dataBlocks.start, a.dataBlocks.end) : [];
+    const data = blocks.map(renderContentBlock).join("\n");
+    const cut = cap !== undefined && data.length > cap;
+    const facts = [a.kind ?? "kind unknown", a.outcome, ...(a.truncated ? ["not the whole file"] : []), ...(cut ? [`excerpt: first ${cap} of ${data.length} characters`] : [])];
+    const head = `user attachment ${a.ordinal} of ${a.count} (${facts.join("; ")}): ${quoteDataLabel(a.label)}`;
+    const body = cut ? data.slice(0, cap) : data;
+    return body.length > 0 ? `${head}\n${body}` : head;
+}
 export function stripEngineMetadata(messages) {
     return messages.map((m) => {
         if (m.role !== "user")
             return m;
-        const { enginePrefixChars: _a, engineSegments: _b, engineMinted: _c, provenance: _d, actor: _e, engineNoteKey: _f, ...rest } = m;
+        const { enginePrefixChars: _a, engineSegments: _b, engineMinted: _c, provenance: _d, actor: _e, engineNoteKey: _f, attachment: _g, ...rest } = m;
         return rest;
     });
 }

package/dist/engine/session/import-validate.js

@@ -289,6 +289,8 @@ function normalizeEngineProvenanceStamp(message, preserveActorAssertions = false
             delete m.actor;
         }
     }
+    if (m.attachment !== undefined)
+        delete m.attachment;
     if (m.engineMinted !== undefined && m.engineMinted !== true)
         delete m.engineMinted;
     if (m.provenance !== undefined && m.provenance !== "engine-note")

package/dist/index.d.ts

@@ -99,7 +99,7 @@ export { isSecretEnvKey, scrubSecretEnv } from "./core/secret-env.js";
 export type { SecretEnvFinding, SecretEnvFindingKind } from "./core/secret-env.js";
 export { MAX_EXEC_OUTPUT_BYTES, RollingTailBuffer, markTruncated } from "./core/exec-output-tail.js";
 export { physicalPathOf, physicalPathOfExisting } from "./core/physical-path.js";
-export type { ExecutionEnv, FileInfo, Result, FileErrorCode, ExecutionErrorCode, WriteExpectation, WriteReceipt, SymlinkChain } from "./internal/harness.js";
+export type { ExecutionEnv, FileInfo, Result, FileErrorCode, ExecutionErrorCode, WriteExpectation, WriteReceipt, SymlinkChain, BoundFileObject } from "./internal/harness.js";
 export type { ExecResult } from "./internal/harness.js";
 export { RemoteExecutionError, hasDestroy, isRemoteExecutionEnv, isSuspendable, isIsolated, canonicalPathIsAuthoritative, missingRestoreSurface, isRetryableRemoteErrorCode, RETRYABLE_REMOTE_ERROR_CODES, } from "./core/remote-env.js";
 export { withRetry } from "./core/with-retry.js";
@@ -172,6 +172,8 @@ export { probeParkRoundTrip, durableParkGapOf, durableParkGapFor, PARK_SELFCHECK
 export { type StoreDurability } from "./core/checkpoint-store.js";
 export { type StoreFidelity } from "./core/checkpoint-store.js";
 export { projectHumanInput, buildHumanInputEvent, type HumanInputSource, type HumanInputFrame, type HumanInputEvent, type HumanInputDelivery, } from "./core/human-input-projection.js";
+export { USER_ATTACHMENT_SEAT, USER_ATTACHMENT_KINDS, USER_ATTACHMENT_SUPPLIES, USER_ATTACHMENT_OUTCOMES, USER_ATTACHMENTS_MAX, USER_ATTACHMENT_LABEL_MAX, type UserAttachmentDeclaration, } from "./core/user-attachment.js";
+export type { HumanInputAttachment } from "./core/types.js";
 export { TaskRegistry, defaultTaskRegistry, createTaskOutputTool, createTaskStopTool, type SemaTaskType, type SemaTaskStatus, type SemaTaskHandle, type ParkedClaimTicket, type TaskAccess, type UnifiedTaskOutput, type TaskRetrievalStatus, type StopSource, type RegisterMonitorInput, type MonitorTimers, MONITOR_BATCH_WINDOW_MS, MONITOR_DEFAULT_TIMEOUT_MS, MONITOR_MAX_TIMEOUT_MS, MONITOR_MAX_BATCHES_PER_MINUTE, canAccessWorkflowRun, DURABLE_AGENT_HANDLE_RE, type BackgroundShellHardKillReceipt, } from "./core/task-registry.js";
 export { InMemoryMailboxStore, type MailboxStore, type MailboxMessage, type MailboxLease, MailboxStoreError, type MailboxStoreErrorCode, MAILBOX_TOMBSTONED_RECIPIENT_CODE, type MailboxAppendMessage, type MailboxPeerMeta, type MailboxPeerFromMode, type MailboxPeerRecordKind, type MailboxPeerNoticeMeta, type MailboxPeerNoticeState, MAILBOX_PEER_NOTICE_STATES, MAILBOX_PEER_FROM_MODES, MAILBOX_PEER_RECORD_KINDS, MAILBOX_INVALID_PEER_META_CODE, MAILBOX_CROSS_PROCESS_UNSAFE_CODE, readMailboxPeerMeta, mailboxCrossProcessMountVerdict, type MailboxCrossProcessVerdict, type MailboxAckResult, } from "./core/mailbox-store.js";
 export { FileMailboxStore, type FileMailboxStoreOptions } from "./stores/file/mailbox-store.js";
@@ -253,7 +255,7 @@ export { adoptLocalDataRoot, ackAdoptionConfig, witnessAdoptionConfig, listAdopt
 export { formatHookFeedback, runToolGate, createHookEnvCapabilities, createPreToolUseConstraintPolicy, type PersistedRuleHit, type PersistedRuleHitRule, type PersistedRuleUnreadable, type PersistedRuleCoverage, type PersistedRuleAnswer, normalizePersistedRuleHit, type Hooks, type HookToolContext, type HookInvocationIdentity, type UserPromptSubmitContext, type PostToolBatchContext, type HookEnvCapabilities, type HookToolOutput, type PreToolUseResult, type PostToolUseResult, type UserPromptSubmitResult, type HookToolFailure, type PostToolUseFailureResult, type PostToolBatchCall, type PostToolBatchResult, type PreCompactContext, type PreCompactResult, type PostCompactContext, type StopFailureContext, type PermissionDeniedPayload, } from "./core/hooks.js";
 export { HOOK_FAMILIES, HOOKS_INVALID_CODE, type HookFamily, type WiringManifestHookEntry } from "./core/hook-seats.js";
 export { InMemoryMemoryStore, composeMemoryBlock, composeLayeredMemoryBlock, normalizeMemorySpec, type NormalizedMemorySpec, type MemorySpecInput, supportsConsolidation, supportsPeriodicConsolidation, firstSentence, expandLexicalTerms, lexicalSearchMatch, type Embedder, classifyPromotable, enforcePromotableWriteGate, guardedMemoryStore, MemoryGateError, MemoryProjectionError, detectSecret, enforceSecretWriteGate, enforceStructuredNoteSecretGate, type UtilityGate, type MemoryStore, type MemoryVectorMode, type ScoredMemory, type MemoryNoteHeader, type MemoryNoteRecord, type MemoryNoteType, type StructuredNoteInput, MEMORY_PROJECT_KEY_ABSENT_REASONS, type MemoryProjectKeyAbsentReason, type MemoryProjectKey, } from "./core/memory.js";
-export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, type MemoryBackendContractHooks, buildMemoryInstruction, writableRootOf, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_ORIGIN_CAUSES, committedOriginOf, originEquals, consolidationExposedFrontmatter, ambiguousOriginRepresentation, type OriginClearanceRow, type OriginClearanceEvent, type OriginClearanceShadow, committedDistilledOf, distilledEquals, type MemoryEntryDistilled, type MemoryEntryDistilledInput, CONSOLIDATION_DEFAULTS, ConsolidationRefusedError, MEMORY_SEARCH_SUPERSEDED_TAG, consolidationTypeEligible, deriveSupersededSet, memorySupersededNote, readIntentCredentials, supersessionFuseCeiling, deriveShadowedSet, memoryConsolidationRecommendedNotice, memoryConsolidationCommittedNotice, memoryConsolidationConflictNotice, memoryConsolidationIncompleteNotice, memoryConsolidationRefusedNotice, memoryConsolidationWithheldNotice, type ConsolidationGateRead, type ConsolidationGateRow, type ConsolidationIntent, type ConsolidationIntentCredentialRow, type ConsolidationLeaseSeat, type ConsolidationProductProposal, type ConsolidationProposal, type MemoryConsolidationOptions, type ConsolidationCommitReceipt, type ConsolidationReconcileReport, type ConsolidationResolveReceipt, type ConsolidationPlanSummary, type ConsolidationPlanFoldEvidence, type SessionMemoryStatus, DISTILLER_DEFAULT_MAX_INPUTS_PER_PRODUCT, LLM_DISTILLER_CONTRACT, LLM_DISTILLER_CONTRACT_DL2, LLM_DISTILLER_CONTRACT_DL3, LLM_DISTILLER_CONTRACTS, MEMORY_DISTILLER_CONTRACT_V1, contractGroupingDiff, driveConsolidationToFixpoint, isAliasModelId, llmPlanDistiller, mintExposurePartitionedPlan, mintLlmConsolidationPlan, MEMORY_DISTILLER_PURITY_CONTRACT_V1, detectCleanArmVerbatimLeak, type CleanArmLeakFinding, type CleanArmLeakVerdict, type MemoryDistillerPurityContract, openAiCompatChatSeat, parseJsonAnswer, planParseRepairs, sanitizeLlmGroups, scheduleUnderFuse, type ConsolidationDistillFn, type ConsolidationDriveCycleRow, type ConsolidationDriveEngine, type ConsolidationDriveResult, type ConsolidationFoldState, type DistillerCandidate, type DistillerChatAnswer, type DistillerChatFn, type DistillerChatRequest, type FuseSchedule, type LlmConsolidationPlan, type LlmConsolidationPlanArm, type LlmConsolidationPlanProduct, type LlmDistillerContract, type MintLlmConsolidationPlanResult, type PlanParseRepairs, type SanitizedLlmGroups, CONSOLIDATION_DRIVER_PLANS_DIR, CONSOLIDATION_DRIVER_RUNS_FILE, CONSOLIDATION_RUN_STOP_REASONS, archiveDistillerPlan, readConsolidationDriverRun, runMemoryConsolidationDriver, type ConsolidationDriverEngine, type ConsolidationDriverRunRow, type ConsolidationRunReceipt, type ConsolidationRunStopReason, type RunMemoryConsolidationOptions, isInstructionEntry, type MemoryEntryOrigin, type MemoryOriginCause, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, MEMORY_CAPTURE_OPTOUT_NOTICE, memoryCaptureOptedOutNotice, memoryCaptureOptOutUnpersistedNotice, SESSION_CAPTURE_OPTOUT_DIR, markSessionCaptureOptOut, readSessionCaptureOptOut, listSessionCaptureOptOut, fileSessionCaptureRecordStore, type SessionCaptureOptOutRecord, type SessionCaptureOptOutMarkOutcome, type SessionCaptureRecordStore, readV2HeaderHints, type V2HeaderHints, LINEAGE_FILE, CHALLENGES_FILE, CHALLENGED_HISTORY_FILE, CHALLENGE_LEDGER_MAX_EVENTS, rebuildStrictControlPlaneLedger, type ControlPlaneRebuildReceipt, type StrictControlPlaneLedger, type ChallengeAssignment, type ChallengeEvent, type ChallengedHistoryRow, type LineagePendingTxn, type LineagePromotion, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_INDEX_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, type MemorySearchDetails, type MemorySearchHit, type CleanMemorySearchHit, type ExposedMemorySearchHit, MEMORY_EXPOSURE_BANNER, MEMORY_EXPOSURE_HANDLE_TAG, memoryExposureIndexRow, type MemoryGetDetails, type MemoryIndexDetails, type MemoryIndexRow, type CleanMemoryIndexRow, type ExposedMemoryIndexRow, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, type MemoryAnnouncement, type ScanFinding, type MemoryEngineOptions, type MemoryInjection, type EntryProvenanceAccount, type TransferEvidence, type CommittedBinding, type CommittedEntrySnapshot, type CommittedScopeSnapshots, type EntryCustodyReport, erasureSelectHash, type EraseMemoryEntriesInput, type ErasureSelect, type ErasedBinding, type MemoryErasureAttestation, computeMemoryBundleHash, type MemoryExportBundle, type MemoryImportReport, type MemoryExportSnapshot, type MemoryBundleImportPlan, type BundleChallengeRow, type BundleLineageRow, type BundlePollutedSession, type MemoryBackend, type MemoryEntry, type MemoryEntryFrontmatter, type MemoryEntryHeader, type MemoryScopeEnumeration, type ScoredMemoryEntry, type NotePatch, type PatchReport, type MaterializedFile, type MemorySessionHandle, type HarvestReport, type HarvestRejection, type HarvestRejectionCode, type ParsedEntryFile, type ScannedEntryFile, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, isOrgScopeKey, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, type ParsedScopeKey, migrateScope, type MigrateScopeReport, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, type RemoteMemoryFile, type RemoteMemoryBaseline, type RemoteMaterialization, type RemoteHarvestResult, type InboundEntryFinding, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, type MemorySyncCursor, type MemorySyncConflict, type MemorySyncPlan, type RecallSource, syncMemoryScope, type MemorySyncTransport, type MemorySyncRequestBody, type MemorySyncResponseBody, type MemorySyncClientConflict, type SyncMemoryScopeOptions, type MemorySyncClientResult, } from "./core/memory-engine/index.js";
+export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, type MemoryBackendContractHooks, buildMemoryInstruction, writableRootOf, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_ORIGIN_CAUSES, committedOriginOf, originEquals, consolidationExposedFrontmatter, ambiguousOriginRepresentation, type OriginClearanceRow, type OriginClearanceEvent, type OriginClearanceShadow, committedDistilledOf, distilledEquals, type MemoryEntryDistilled, type MemoryEntryDistilledInput, CONSOLIDATION_DEFAULTS, ConsolidationRefusedError, MEMORY_SEARCH_SUPERSEDED_TAG, consolidationTypeEligible, deriveSupersededSet, memorySupersededNote, readIntentCredentials, supersessionFuseCeiling, deriveShadowedSet, memoryConsolidationRecommendedNotice, memoryConsolidationCommittedNotice, memoryConsolidationConflictNotice, memoryConsolidationIncompleteNotice, memoryConsolidationRefusedNotice, memoryConsolidationWithheldNotice, type ConsolidationGateRead, type ConsolidationGateRow, type ConsolidationIntent, type ConsolidationIntentCredentialRow, type ConsolidationLeaseSeat, type ConsolidationProductProposal, type ConsolidationProposal, type ConsolidationWriteGate, type MemoryConsolidationOptions, type ConsolidationCommitReceipt, type ConsolidationReconcileReport, type ConsolidationResolveReceipt, type ConsolidationPlanSummary, type ConsolidationPlanFoldEvidence, type SessionMemoryStatus, DISTILLER_DEFAULT_MAX_INPUTS_PER_PRODUCT, LLM_DISTILLER_CONTRACT, LLM_DISTILLER_CONTRACT_DL2, LLM_DISTILLER_CONTRACT_DL3, LLM_DISTILLER_CONTRACTS, MEMORY_DISTILLER_CONTRACT_V1, contractGroupingDiff, driveConsolidationToFixpoint, isAliasModelId, llmPlanDistiller, mintExposurePartitionedPlan, mintLlmConsolidationPlan, MEMORY_DISTILLER_PURITY_CONTRACT_V1, detectCleanArmVerbatimLeak, type CleanArmLeakFinding, type CleanArmLeakVerdict, type MemoryDistillerPurityContract, openAiCompatChatSeat, parseJsonAnswer, planParseRepairs, sanitizeLlmGroups, scheduleUnderFuse, type ConsolidationDistillFn, type ConsolidationDriveCycleRow, type ConsolidationDriveEngine, type ConsolidationDriveResult, type ConsolidationFoldState, type DistillerCandidate, type DistillerChatAnswer, type DistillerChatFn, type DistillerChatRequest, type FuseSchedule, type LlmConsolidationPlan, type LlmConsolidationPlanArm, type LlmConsolidationPlanProduct, type LlmDistillerContract, type MintLlmConsolidationPlanResult, type PlanParseRepairs, type SanitizedLlmGroups, CONSOLIDATION_DRIVER_PLANS_DIR, CONSOLIDATION_DRIVER_RUNS_FILE, CONSOLIDATION_RUN_STOP_REASONS, CONSOLIDATION_WRITE_REFUSED_CODE, archiveDistillerPlan, readConsolidationDriverRun, runMemoryConsolidationDriver, type ConsolidationDriverEngine, type ConsolidationDriverRunRow, type ConsolidationRunReceipt, type ConsolidationRunStopReason, type ConsolidationWriteJudge, type ConsolidationWriteTarget, type RunMemoryConsolidationOptions, isInstructionEntry, type MemoryEntryOrigin, type MemoryOriginCause, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, MEMORY_CAPTURE_OPTOUT_NOTICE, memoryCaptureOptedOutNotice, memoryCaptureOptOutUnpersistedNotice, SESSION_CAPTURE_OPTOUT_DIR, markSessionCaptureOptOut, readSessionCaptureOptOut, listSessionCaptureOptOut, fileSessionCaptureRecordStore, type SessionCaptureOptOutRecord, type SessionCaptureOptOutMarkOutcome, type SessionCaptureRecordStore, readV2HeaderHints, type V2HeaderHints, LINEAGE_FILE, CHALLENGES_FILE, CHALLENGED_HISTORY_FILE, CHALLENGE_LEDGER_MAX_EVENTS, rebuildStrictControlPlaneLedger, type ControlPlaneRebuildReceipt, type StrictControlPlaneLedger, type ChallengeAssignment, type ChallengeEvent, type ChallengedHistoryRow, type LineagePendingTxn, type LineagePromotion, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_INDEX_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, type MemorySearchDetails, type MemorySearchHit, type CleanMemorySearchHit, type ExposedMemorySearchHit, MEMORY_EXPOSURE_BANNER, MEMORY_EXPOSURE_HANDLE_TAG, memoryExposureIndexRow, type MemoryGetDetails, type MemoryIndexDetails, type MemoryIndexRow, type CleanMemoryIndexRow, type ExposedMemoryIndexRow, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, type MemoryAnnouncement, type ScanFinding, type MemoryEngineOptions, type MemoryInjection, type EntryProvenanceAccount, type TransferEvidence, type CommittedBinding, type CommittedEntrySnapshot, type CommittedScopeSnapshots, type EntryCustodyReport, erasureSelectHash, type EraseMemoryEntriesInput, type ErasureSelect, type ErasedBinding, type MemoryErasureAttestation, computeMemoryBundleHash, type MemoryExportBundle, type MemoryImportReport, type MemoryExportSnapshot, type MemoryBundleImportPlan, type BundleChallengeRow, type BundleLineageRow, type BundlePollutedSession, type MemoryBackend, type MemoryEntry, type MemoryEntryFrontmatter, type MemoryEntryHeader, type MemoryScopeEnumeration, type ScoredMemoryEntry, type NotePatch, type PatchReport, type MaterializedFile, type MemorySessionHandle, type HarvestReport, type HarvestRejection, type HarvestRejectionCode, type ParsedEntryFile, type ScannedEntryFile, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, isOrgScopeKey, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, type ParsedScopeKey, migrateScope, type MigrateScopeReport, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, type RemoteMemoryFile, type RemoteMemoryBaseline, type RemoteMaterialization, type RemoteHarvestResult, type InboundEntryFinding, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, type MemorySyncCursor, type MemorySyncConflict, type MemorySyncPlan, type RecallSource, syncMemoryScope, type MemorySyncTransport, type MemorySyncRequestBody, type MemorySyncResponseBody, type MemorySyncClientConflict, type SyncMemoryScopeOptions, type MemorySyncClientResult, } from "./core/memory-engine/index.js";
 export { STORE_FORM_REFUSAL_CODES, TARGET_OUTSIDE_STORE, SCOPE_HOME_NOT_DIRECTORY, SCOPE_HOME_FORMS, type StoreFormRefusalCode, type StoreFormRefusalDetail, type StoreFormRefusal, type ScopeHomeForm } from "./core/memory-engine/layout.js";
 export { reanchorMemoryStoreRoot, type StoreRootReanchor } from "./core/memory-engine/layout.js";
 export { SHARED_MEMORY_READ_CAP_BYTES, SHARED_MEMORY_LIST_PAGE_SIZE, SharedMemoryStoreError, type SharedMemoryStoreProvider, type SharedMemoryStoreReader, type SharedMemoryPagedList, type SharedMemoryStoreInfo, type SharedMemoryDocumentEntry, type SharedMemorySnapshot, type SharedMemoryRequestContext, type MemoryListDetails, type MemoryReadDetails, } from "./core/shared-memory/types.js";
@@ -376,8 +378,8 @@ export type { RouteAdjudication, RouteCredential, RouteCredentialSource, RoutePa
 export { ROUTE_ADJUDICATION_CONFORMANCE_CORPUS, type RouteAdjudicationVector } from "./brain/route-conformance.js";
 export { type BrainTimeoutConfig } from "./brain/timeout.js";
 export { createAssistantMessageEventStream } from "./internal/llm.js";
-export type { AssistantMessage, AssistantMessageEvent, CompleteSimpleFn, Context, DocumentContent, ImageContent, Message, StopReason, StreamFn, TextContent, ThinkingContent, ToolCall, ToolResultMessage, Usage, UserMessage, } from "./internal/llm.js";
-export type { AgentDefinition, BeforeWriteHook, BeforeWriteRequest, BeforeWriteResult, TrackFileEditHook, TrackEditRequest, TrackEditResult, FileEditedHook, FileEditedNotice, HandsBandOptions, Brain, BrainStatus, BrainStatusPhase, BrainRetryErrClass, ImageInput, McpElicitRequest, McpElicitResponse, McpServerSpec, A2aServerSpec, OnElicit, Model, ModelRef, ProjectMemoryLoad, RunnerDeps, ResumePreflightInfo, ResumePreflightVerdict, EngineNotice, RuntimeCaps, BackgroundChildEvent, DelegationLifecycleEvent, SkillSpec, TaskEvent, TaskEventIdentity, ToolActivity, TaskLimits, StaleToolResultOffloadOptions, TaskResult, TerminalCause, PausedCause, EffectiveMemoryScopes, RemoteEnvFailureNote, TaskSpec, ShellGateDoctrine, TaskStatus, TaskStream, CompactOutcome, ThinkingLevel, ToolExecuteContext, ToolReturn, ToolSpec, ToolInputVerdict, ToolInputValidationContext, ReversibilityVerdict, ReadRootGrantCandidate, ToolEffect, ToolContentOrigin, WorkflowGovernanceBaseline, DelegationTaskType, } from "./core/types.js";
+export type { AssistantMessage, AssistantMessageEvent, CompleteSimpleFn, Context, DocumentContent, ImageContent, Message, StopReason, StreamFn, TextContent, ThinkingContent, ToolCall, ToolResultMessage, Usage, UserMessage, UserMessageAttachment, UserAttachmentKind, UserAttachmentObservation, UserAttachmentOutcome, UserAttachmentSupply, } from "./internal/llm.js";
+export type { AgentDefinition, BeforeWriteHook, BeforeWriteRequest, BeforeWriteResult, TrackFileEditHook, TrackEditRequest, TrackEditResult, FileEditedHook, FileEditedNotice, HandsBandOptions, Brain, BrainStatus, BrainStatusPhase, BrainRetryErrClass, ImageInput, UserAttachment, McpElicitRequest, McpElicitResponse, McpServerSpec, A2aServerSpec, OnElicit, Model, ModelRef, ProjectMemoryLoad, RunnerDeps, ResumePreflightInfo, ResumePreflightVerdict, EngineNotice, RuntimeCaps, BackgroundChildEvent, DelegationLifecycleEvent, SkillSpec, TaskEvent, TaskEventIdentity, ToolActivity, TaskLimits, StaleToolResultOffloadOptions, TaskResult, TerminalCause, PausedCause, EffectiveMemoryScopes, RemoteEnvFailureNote, TaskSpec, ShellGateDoctrine, TaskStatus, TaskStream, CompactOutcome, ThinkingLevel, ToolExecuteContext, ToolReturn, ToolSpec, ToolInputVerdict, ToolInputValidationContext, ReversibilityVerdict, ReadRootGrantCandidate, ToolEffect, ToolContentOrigin, WorkflowGovernanceBaseline, DelegationTaskType, } from "./core/types.js";
 export { Type } from "typebox";
 export type { TSchema, Static } from "typebox";
 export { explainPromptAssembly, describeDefaultPack, type DefaultPackDescription, type ExplainInput } from "./prompt-assembly/explain.js";

package/dist/index.js

@@ -144,6 +144,7 @@ export { probeParkRoundTrip, durableParkGapOf, durableParkGapFor, PARK_SELFCHECK
 export {} from "./core/checkpoint-store.js";
 export {} from "./core/checkpoint-store.js";
 export { projectHumanInput, buildHumanInputEvent, } from "./core/human-input-projection.js";
+export { USER_ATTACHMENT_SEAT, USER_ATTACHMENT_KINDS, USER_ATTACHMENT_SUPPLIES, USER_ATTACHMENT_OUTCOMES, USER_ATTACHMENTS_MAX, USER_ATTACHMENT_LABEL_MAX, } from "./core/user-attachment.js";
 export { TaskRegistry, defaultTaskRegistry, createTaskOutputTool, createTaskStopTool, MONITOR_BATCH_WINDOW_MS, MONITOR_DEFAULT_TIMEOUT_MS, MONITOR_MAX_TIMEOUT_MS, MONITOR_MAX_BATCHES_PER_MINUTE, canAccessWorkflowRun, DURABLE_AGENT_HANDLE_RE, } from "./core/task-registry.js";
 export { InMemoryMailboxStore, MailboxStoreError, MAILBOX_TOMBSTONED_RECIPIENT_CODE, MAILBOX_PEER_NOTICE_STATES, MAILBOX_PEER_FROM_MODES, MAILBOX_PEER_RECORD_KINDS, MAILBOX_INVALID_PEER_META_CODE, MAILBOX_CROSS_PROCESS_UNSAFE_CODE, readMailboxPeerMeta, mailboxCrossProcessMountVerdict, } from "./core/mailbox-store.js";
 export { FileMailboxStore } from "./stores/file/mailbox-store.js";
@@ -199,7 +200,7 @@ export { adoptLocalDataRoot, ackAdoptionConfig, witnessAdoptionConfig, listAdopt
 export { formatHookFeedback, runToolGate, createHookEnvCapabilities, createPreToolUseConstraintPolicy, normalizePersistedRuleHit, } from "./core/hooks.js";
 export { HOOK_FAMILIES, HOOKS_INVALID_CODE } from "./core/hook-seats.js";
 export { InMemoryMemoryStore, composeMemoryBlock, composeLayeredMemoryBlock, normalizeMemorySpec, supportsConsolidation, supportsPeriodicConsolidation, firstSentence, expandLexicalTerms, lexicalSearchMatch, classifyPromotable, enforcePromotableWriteGate, guardedMemoryStore, MemoryGateError, MemoryProjectionError, detectSecret, enforceSecretWriteGate, enforceStructuredNoteSecretGate, MEMORY_PROJECT_KEY_ABSENT_REASONS, } from "./core/memory.js";
-export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, buildMemoryInstruction, writableRootOf, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_ORIGIN_CAUSES, committedOriginOf, originEquals, consolidationExposedFrontmatter, ambiguousOriginRepresentation, committedDistilledOf, distilledEquals, CONSOLIDATION_DEFAULTS, ConsolidationRefusedError, MEMORY_SEARCH_SUPERSEDED_TAG, consolidationTypeEligible, deriveSupersededSet, memorySupersededNote, readIntentCredentials, supersessionFuseCeiling, deriveShadowedSet, memoryConsolidationRecommendedNotice, memoryConsolidationCommittedNotice, memoryConsolidationConflictNotice, memoryConsolidationIncompleteNotice, memoryConsolidationRefusedNotice, memoryConsolidationWithheldNotice, DISTILLER_DEFAULT_MAX_INPUTS_PER_PRODUCT, LLM_DISTILLER_CONTRACT, LLM_DISTILLER_CONTRACT_DL2, LLM_DISTILLER_CONTRACT_DL3, LLM_DISTILLER_CONTRACTS, MEMORY_DISTILLER_CONTRACT_V1, contractGroupingDiff, driveConsolidationToFixpoint, isAliasModelId, llmPlanDistiller, mintExposurePartitionedPlan, mintLlmConsolidationPlan, MEMORY_DISTILLER_PURITY_CONTRACT_V1, detectCleanArmVerbatimLeak, openAiCompatChatSeat, parseJsonAnswer, planParseRepairs, sanitizeLlmGroups, scheduleUnderFuse, CONSOLIDATION_DRIVER_PLANS_DIR, CONSOLIDATION_DRIVER_RUNS_FILE, CONSOLIDATION_RUN_STOP_REASONS, archiveDistillerPlan, readConsolidationDriverRun, runMemoryConsolidationDriver, isInstructionEntry, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, MEMORY_CAPTURE_OPTOUT_NOTICE, memoryCaptureOptedOutNotice, memoryCaptureOptOutUnpersistedNotice, SESSION_CAPTURE_OPTOUT_DIR, markSessionCaptureOptOut, readSessionCaptureOptOut, listSessionCaptureOptOut, fileSessionCaptureRecordStore, readV2HeaderHints, LINEAGE_FILE, CHALLENGES_FILE, CHALLENGED_HISTORY_FILE, CHALLENGE_LEDGER_MAX_EVENTS, rebuildStrictControlPlaneLedger, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_INDEX_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, MEMORY_EXPOSURE_BANNER, MEMORY_EXPOSURE_HANDLE_TAG, memoryExposureIndexRow, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, erasureSelectHash, computeMemoryBundleHash, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, isOrgScopeKey, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, migrateScope, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, syncMemoryScope, } from "./core/memory-engine/index.js";
+export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, buildMemoryInstruction, writableRootOf, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_ORIGIN_CAUSES, committedOriginOf, originEquals, consolidationExposedFrontmatter, ambiguousOriginRepresentation, committedDistilledOf, distilledEquals, CONSOLIDATION_DEFAULTS, ConsolidationRefusedError, MEMORY_SEARCH_SUPERSEDED_TAG, consolidationTypeEligible, deriveSupersededSet, memorySupersededNote, readIntentCredentials, supersessionFuseCeiling, deriveShadowedSet, memoryConsolidationRecommendedNotice, memoryConsolidationCommittedNotice, memoryConsolidationConflictNotice, memoryConsolidationIncompleteNotice, memoryConsolidationRefusedNotice, memoryConsolidationWithheldNotice, DISTILLER_DEFAULT_MAX_INPUTS_PER_PRODUCT, LLM_DISTILLER_CONTRACT, LLM_DISTILLER_CONTRACT_DL2, LLM_DISTILLER_CONTRACT_DL3, LLM_DISTILLER_CONTRACTS, MEMORY_DISTILLER_CONTRACT_V1, contractGroupingDiff, driveConsolidationToFixpoint, isAliasModelId, llmPlanDistiller, mintExposurePartitionedPlan, mintLlmConsolidationPlan, MEMORY_DISTILLER_PURITY_CONTRACT_V1, detectCleanArmVerbatimLeak, openAiCompatChatSeat, parseJsonAnswer, planParseRepairs, sanitizeLlmGroups, scheduleUnderFuse, CONSOLIDATION_DRIVER_PLANS_DIR, CONSOLIDATION_DRIVER_RUNS_FILE, CONSOLIDATION_RUN_STOP_REASONS, CONSOLIDATION_WRITE_REFUSED_CODE, archiveDistillerPlan, readConsolidationDriverRun, runMemoryConsolidationDriver, isInstructionEntry, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, MEMORY_CAPTURE_OPTOUT_NOTICE, memoryCaptureOptedOutNotice, memoryCaptureOptOutUnpersistedNotice, SESSION_CAPTURE_OPTOUT_DIR, markSessionCaptureOptOut, readSessionCaptureOptOut, listSessionCaptureOptOut, fileSessionCaptureRecordStore, readV2HeaderHints, LINEAGE_FILE, CHALLENGES_FILE, CHALLENGED_HISTORY_FILE, CHALLENGE_LEDGER_MAX_EVENTS, rebuildStrictControlPlaneLedger, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_INDEX_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, MEMORY_EXPOSURE_BANNER, MEMORY_EXPOSURE_HANDLE_TAG, memoryExposureIndexRow, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, erasureSelectHash, computeMemoryBundleHash, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, isOrgScopeKey, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, migrateScope, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, syncMemoryScope, } from "./core/memory-engine/index.js";
 export { STORE_FORM_REFUSAL_CODES, TARGET_OUTSIDE_STORE, SCOPE_HOME_NOT_DIRECTORY, SCOPE_HOME_FORMS } from "./core/memory-engine/layout.js";
 export { reanchorMemoryStoreRoot } from "./core/memory-engine/layout.js";
 export { SHARED_MEMORY_READ_CAP_BYTES, SHARED_MEMORY_LIST_PAGE_SIZE, SharedMemoryStoreError, } from "./core/shared-memory/types.js";

package/dist/internal/harness-types.d.ts

@@ -8,7 +8,7 @@ export type { CompactionPreparation, SummarizationClampDryRun } from "../engine/
 export type { InvokedSkillRetention } from "../engine/compaction/utils.js";
 export type { AgentCoreRuntimeDeps } from "../engine/loop/runtime-deps.js";
 export type { AgentMessage, AgentTool, AgentToolResult, AgentToolUpdateCallback, ThinkingLevel, ToolExecutionMode, ToolInputValidationContext, ToolInputVerdict, } from "../engine/loop/types.js";
-export type { AgentHarnessEvent, CompactionSettings, ExecutionEnv, ExecutionErrorCode, FileError, FileKind, FileErrorCode, FileInfo, Result, WriteExpectation, WriteReceipt, SymlinkChain, Session, SessionMetadata, SessionRepo, SessionStorage, SessionTreeEntry, Skill, } from "../engine/harness/types.js";
+export type { AgentHarnessEvent, CompactionSettings, ExecutionEnv, ExecutionErrorCode, FileError, FileKind, FileErrorCode, FileInfo, Result, WriteExpectation, WriteReceipt, SymlinkChain, BoundFileObject, Session, SessionMetadata, SessionRepo, SessionStorage, SessionTreeEntry, Skill, } from "../engine/harness/types.js";
 export type { ExecutionEnvExecOptions, ExecResult } from "../engine/harness/types.js";
 export type { SessionWriteOptions, CompactionEntry } from "../engine/harness/types.js";
 export type { ActiveWorktreeSession, WorkspaceState } from "../engine/harness/types.js";

package/dist/internal/llm.d.ts

@@ -4,5 +4,5 @@
  * design/118 ①②: the layer is now first-party (`src/engine/llm/`, naturalized out of the vendored
  * llm-core); the facade stays so consumers never notice which side a symbol lives on.
  */
-export { createAssistantMessageEventStream, ensureToolTurnInvariants, MODEL_OUTPUT_INVALID_CAUSES, snapshotActorAssertion, stampStreamDrops, streamDropsOf, stripEngineMetadata, TOOL_TURN_INCOMPLETE_CAUSES, TOOL_TURN_REPAIR_DROPS } from "../engine/llm/index.js";
-export type { ActorAssertion, AnthropicMessagesCompat, OpenAICompletionsCompat, OpenAIResponsesCompat, AssistantMessage, AssistantMessageDiagnostic, AssistantMessageEvent, CompleteSimpleFn, Context, DocumentContent, ImageContent, Message, Model, ModelOutputInvalid, ModelOutputInvalidCause, OutputLimit, ResilienceOptions, RouteAdjudication, RouteCredential, RouteCredentialSource, RoutePairingConfig, RoutePairingPosture, RouteRefusalCode, RouteRefusalDetail, SimpleStreamOptions, StallTimeouts, StopReason, StreamFn, TextContent, ThinkingContent, Tool, ToolCall, ToolResultMessage, StreamDrop, StreamDropCause, ToolTurnIncompleteCause, ToolTurnRepair, Usage, UserMessage, } from "../engine/llm/index.js";
+export { createAssistantMessageEventStream, DATA_LABEL_UNSAFE, ensureToolTurnInvariants, isTextBlock, MODEL_OUTPUT_INVALID_CAUSES, quoteDataLabel, renderContentBlock, renderUserAttachmentView, snapshotActorAssertion, stampStreamDrops, streamDropsOf, stripEngineMetadata, TOOL_TURN_INCOMPLETE_CAUSES, TOOL_TURN_REPAIR_DROPS, userAttachmentOf } from "../engine/llm/index.js";
+export type { ActorAssertion, UserAttachmentKind, UserAttachmentObservation, UserAttachmentOutcome, UserAttachmentSupply, UserMessageAttachment, AnthropicMessagesCompat, OpenAICompletionsCompat, OpenAIResponsesCompat, AssistantMessage, AssistantMessageDiagnostic, AssistantMessageEvent, CompleteSimpleFn, Context, DocumentContent, ImageContent, Message, Model, ModelOutputInvalid, ModelOutputInvalidCause, OutputLimit, ResilienceOptions, RouteAdjudication, RouteCredential, RouteCredentialSource, RoutePairingConfig, RoutePairingPosture, RouteRefusalCode, RouteRefusalDetail, SimpleStreamOptions, StallTimeouts, StopReason, StreamFn, TextContent, ThinkingContent, Tool, ToolCall, ToolResultMessage, StreamDrop, StreamDropCause, ToolTurnIncompleteCause, ToolTurnRepair, Usage, UserMessage, } from "../engine/llm/index.js";

package/dist/internal/llm.js

@@ -1 +1 @@
-export { createAssistantMessageEventStream, ensureToolTurnInvariants, MODEL_OUTPUT_INVALID_CAUSES, snapshotActorAssertion, stampStreamDrops, streamDropsOf, stripEngineMetadata, TOOL_TURN_INCOMPLETE_CAUSES, TOOL_TURN_REPAIR_DROPS } from "../engine/llm/index.js";
+export { createAssistantMessageEventStream, DATA_LABEL_UNSAFE, ensureToolTurnInvariants, isTextBlock, MODEL_OUTPUT_INVALID_CAUSES, quoteDataLabel, renderContentBlock, renderUserAttachmentView, snapshotActorAssertion, stampStreamDrops, streamDropsOf, stripEngineMetadata, TOOL_TURN_INCOMPLETE_CAUSES, TOOL_TURN_REPAIR_DROPS, userAttachmentOf } from "../engine/llm/index.js";