@sema-agent/core 7.49.5 → 7.50.1

package/dist/core/runner/read-root-grant.js

@@ -2,23 +2,7 @@ import { deliverEngineNotice } from "../types.js";
 import { READ_ROOT_CANDIDATE_DIR_MAX } from "../read-root-candidate.js";
 import { DEFAULT_GATE_AWAIT_TIMEOUT_MS } from "../gate-bounded-await.js";
 import { thrownText } from "../thrown-value.js";
-import { pathFamilyOf, withinAnyRoot } from "../../tools/fs/safety.js";
-export function rootAdmittingArtifactStore(storePhysical, rootsCanonical) {
-    const storeFamily = pathFamilyOf({ root: storePhysical });
-    return rootsCanonical.find((root) => pathFamilyOf({ root }) === storeFamily && (withinAnyRoot([root], storePhysical) || withinAnyRoot([storePhysical], root)));
-}
-export function withdrawStandingGrantsAdmitting(storePhysical, ref) {
-    const standing = ref.standing;
-    if (standing === undefined)
-        return [];
-    const withdrawn = standing.keys.filter((key) => rootAdmittingArtifactStore(storePhysical, [key]) !== undefined);
-    for (const key of withdrawn) {
-        const at = standing.readRoots.indexOf(key);
-        if (at >= 0)
-            standing.readRoots.splice(at, 1);
-    }
-    return withdrawn;
-}
+import { rootAdmittingArtifactStore } from "../../tools/fs/safety.js";
 export function readRootGrantOver(seats) {
     const { env, writeRoots, readRoots, artifactStore } = seats;
     return async (candidate, signal) => {

package/dist/core/runner/retired-runner-deps.d.ts

@@ -1,7 +1,7 @@
 import type { RunnerDeps } from "../types.js";
 import type { ResumeTaskConfig, RunInternals } from "./contracts.js";
-/** Runs on the caller's own argument at `new Runner` (the only point that still sees an inherited or
- *  non-enumerable seat — construction spreads deps into plain objects), and again in the pre-first-await
+/** Runs on the caller's own argument at `new Runner` (the only point that still sees an inherited seat — construction then
+ *  reads every own seat once into the plain copy the Runner keeps, `retainRunnerDeps`), and again in the pre-first-await
  *  config-doors phase and pre-CAS on a resume. */
 export declare function assertNoRetiredRunnerDeps(deps: RunnerDeps): void;
 /** The resume ladder's pre-claim door: the retired seats of the deps, then the retired members of the caller policies this

package/dist/core/runner/run-brain-sinks.d.ts

@@ -6,7 +6,7 @@ import type { RunInternals, RunState } from "./contracts.js";
 export interface RunBrainSinksInput {
     /** borrowed-mutable — the run's event queue: the `status` frames. */
     queue: PushQueue<TaskEvent>;
-    /** borrowed-readonly — the trusted run-scoped channel: `agentName` (the display name), `onStatusEvent` (the second sink). */
+    /** borrowed-readonly — the trusted run-scoped channel: `onStatusEvent` (the second sink). */
     internals: RunInternals | undefined;
     /** borrowed-readonly — the run's mutable state, read for the telemetry frames' tracer and task id. */
     rs: RunState;
@@ -16,16 +16,12 @@ export interface RunBrainSinksInput {
         parentToolCallId?: string;
         sourceTaskId?: string;
     };
-    /** borrowed-readonly — the spawning tool call's id when this task runs AS A SUB-AGENT; absent on a top-level run. */
-    parentToolCallId: string | undefined;
     /** borrowed-readonly — the reasoning lane's wire-facts consumer, the third sink the composition installs. */
     observeReasoningWireFacts: (facts: ReasoningWireFacts) => void;
     /** borrowed-readonly — the notice sink and the leg's ids; the fourth sink's announcer is minted from them. */
     notice: ExtraBodyDroppedSeatInput;
 }
 export interface RunBrainSinksResult {
-    /** The subagent's human display name for its `task_progress` ticks, or undefined. */
-    subagentName: string | undefined;
     /** Compose the three brain ALS sinks around a brain-driving call. */
     withBrainSinks: <T>(fn: () => Promise<T>) => Promise<T>;
     withExtraBodyDroppedSink: <T>(fn: () => Promise<T>) => Promise<T>;

package/dist/core/runner/run-brain-sinks.js

@@ -2,10 +2,8 @@ import { runWithBrainTelemetry, runWithReasoningWireFacts, runWithStatusSink } f
 import { createExtraBodyDroppedScope } from "./extra-body-dropped-seat.js";
 import { createSafeNotifier, observeThenableRejection } from "../safe-notify.js";
 import { emitTrace } from "../trace.js";
-import { inlineUntrusted } from "../untrusted-text.js";
 export function runBrainSinks(input) {
-    const { queue, internals, rs, ident, parentToolCallId, observeReasoningWireFacts, notice } = input;
-    const subagentName = parentToolCallId !== undefined && internals?.agentName !== undefined ? inlineUntrusted(internals.agentName.slice(0, 320), 80) : undefined;
+    const { queue, internals, rs, ident, observeReasoningWireFacts, notice } = input;
     const statusSinkNotifier = createSafeNotifier({
         onError: (f) => console.warn(`[sema-core] ${f.site}: run-internals status sink threw (contained; further failures counted, not re-disclosed): ${f.error.message}`),
     });
@@ -62,5 +60,5 @@ export function runBrainSinks(input) {
                         : { kind: "vision.placeholder", version: 1, taskId: rs.telemetry.taskId, count: t.count, ts: Date.now() });
     };
     const withBrainSinks = (fn) => runWithStatusSink(statusEmit, () => runWithBrainTelemetry(telemetryEmit, () => runWithReasoningWireFacts(observeReasoningWireFacts, fn)));
-    return { subagentName, withBrainSinks, withExtraBodyDroppedSink: createExtraBodyDroppedScope(notice) };
+    return { withBrainSinks, withExtraBodyDroppedSink: createExtraBodyDroppedScope(notice) };
 }

package/dist/core/runner/run-harness-handlers.js

@@ -1,5 +1,6 @@
 import { observeThenableRejection } from "../safe-notify.js";
 import { forwardSafely } from "./forward-sink.js";
+import { emitsChildRowFrames } from "../delegation-frames.js";
 import { emitTrace } from "../trace.js";
 import { primaryActivityArg } from "../arg-summary.js";
 import { redactSecrets } from "../untrusted-egress.js";
@@ -22,8 +23,8 @@ export function createHarnessHandlers(input) {
     const toolCallIdFoldSeat = createToolCallIdFoldSeat(deps.runnerHooks.onNotice, { sessionId: prepared.sessionId, runId: prepared.runId });
     const toolTurnIncompleteSeat = createToolTurnIncompleteSeat(deps.runnerHooks.onNotice, { sessionId: prepared.sessionId, runId: prepared.runId });
     const finishReasonSeat = createFinishReasonSeat(deps.runnerHooks.onNotice, { sessionId: prepared.sessionId, runId: prepared.runId });
-    const { spec, queue, internals, ident, parentToolCallId, subagentName, pushContent, emitCommitted, startedToolCallIds, toolStartAt, toolProgress, writeFamilyOf, toolLabels, postToolBatchHook, batchArgs, internalsNotifier } = deps;
-    const frames = { push: (f) => pushContent({ ...f, ...ident() }), structured: prepared.structuredProjector };
+    const { spec, queue, internals, ident, pushContent, emitCommitted, startedToolCallIds, toolStartAt, toolProgress, writeFamilyOf, toolLabels, postToolBatchHook, batchArgs, internalsNotifier, mediaByteCapBytes } = deps;
+    const frames = { push: (f) => pushContent({ ...f, ...ident() }), structured: prepared.structuredProjector, mediaByteCapBytes };
     const startOf = (e) => {
         const label = toolLabels.get(e.toolName);
         return { toolCallId: e.toolCallId, spelledName: e.toolName, wireName: rosterToolName(prepared.toolRosterDeltas.current, e.toolName), ...(label !== undefined ? { label } : {}), args: e.args };
@@ -306,14 +307,14 @@ export function createHarnessHandlers(input) {
         rs.turn.turnUsageMissing = false;
         rs.turn.turnStopReason = undefined;
         rs.turn.turnResponseModel = undefined;
-        if (parentToolCallId !== undefined) {
+        if (emitsChildRowFrames(prepared.hookIdentity)) {
             const progress = {
                 type: "task_progress",
                 taskId: rs.telemetry.taskId,
                 ...(internals?.delegationTaskType !== undefined ? { taskType: internals.delegationTaskType } : {}),
                 ...(internals?.cycleSeq !== undefined ? { seq: internals.cycleSeq } : {}),
                 ...(internals?.parentTaskId !== undefined ? { parentTaskId: internals.parentTaskId } : {}),
-                ...(subagentName ? { name: subagentName } : {}),
+                ...(prepared.hookIdentity.agentName ? { name: prepared.hookIdentity.agentName } : {}),
                 ...(internals?.explicitAgentName !== undefined ? { spawnName: internals.explicitAgentName } : {}),
                 model: prepared.model.id,
                 usage: { totalTokens: stats.tokens, toolUses: stats.toolCalls, durationMs: Date.now() - rs.telemetry.taskStart },

package/dist/core/runner/run-identity-wiring.d.ts

@@ -8,14 +8,14 @@ import type { CaptureOptOutRef, LiveHandle, ManualCompactRef, McpRedialRef, Noti
 export interface RunIdentityWiringInput {
     /** borrowed-readonly — the task spec: the task id and the memory / notification seats it names. */
     spec: TaskSpec;
-    /** borrowed-mutable — the run's event queue: the manifest, roster-delta, compaction_outcome and redelivered
-     *  task_notification frames. */
+    /** borrowed-mutable — the run's event queue: the manifest, roster-delta, task_started, compaction_outcome and
+     *  redelivered task_notification frames. */
     queue: PushQueue<TaskEvent>;
     /** borrowed-mutable — the leg's prepared seat: the harness sinks (`onUndrainedEngineNotes`, `engineInjectionsHeld`,
      *  `onUndrainedUserInputs`, `onEngineNoteConsumed`) are installed, `nextTurn` is appended to; the ids, the identity
      *  envelope, the hold refs, the memory session and the listing / roster faces are read. */
     prepared: Prepared;
-    /** borrowed-readonly — the trusted run-scoped channel: `parentToolCallId`, `onNotifyInjectorReady`. */
+    /** borrowed-readonly — the trusted run-scoped channel: `parentToolCallId`, `onNotifyInjectorReady`, the spawner's delegation facts. */
     internals: RunInternals | undefined;
     /** borrowed-mutable — the stream layer's backstop carrier: the memory scopes, the edited-files reader and the
      *  owed delegation terminal are published here the moment they exist. */
@@ -58,7 +58,7 @@ export interface RunIdentityWiringResult {
         parentToolCallId?: string;
         sourceTaskId?: string;
     };
-    /** The delegation-lifecycle emission closure both stations share (spawn here, terminal in the driver). */
+    /** The delegation-lifecycle emission closure both phases share (spawn here, terminal in the driver). */
     emitDelegationLifecycle: (event: import("../types.js").DelegationLifecycleEvent) => void;
     /** The loop-liveness latch and the two attribution seats (ended / userInterrupted / userHalted). */
     loopLatch: {

package/dist/core/runner/run-identity-wiring.js

@@ -1,5 +1,7 @@
 import { uuidv7 } from "../../internal/harness.js";
 import { createSafeNotifier, observeThenableRejection } from "../safe-notify.js";
+import { forwardSafely } from "./forward-sink.js";
+import { emitsChildRowFrames, taskStartedFrame } from "../delegation-frames.js";
 import { recordFrameReceipt, toolResultReceiptKey } from "../frame-settlement.js";
 import { discloseDroppedPending, renderTaskNotificationXml, taskNotificationDedupKey } from "../task-notification.js";
 import { buildAppliedHumanInputEvent } from "../human-input-projection.js";
@@ -35,7 +37,12 @@ export function runIdentityWiring(input) {
             return;
         deliverDelegationLifecycle(runner.deps.onDelegationLifecycle, event, delegationLifecycleNotifier, "runtask.onDelegationLifecycle");
     };
-    emitDelegationLifecycle({ phase: "spawn", identity: prepared.hookIdentity });
+    if (emitsChildRowFrames(prepared.hookIdentity) && prepared.hookIdentity.legKind !== "resume") {
+        const started = taskStartedFrame({ taskId: runSourceTaskId, sessionId: prepared.sessionId, model: prepared.model.id, identity: prepared.hookIdentity }, internals, ident());
+        queue.push(started);
+        forwardSafely(internals, started);
+        emitDelegationLifecycle({ phase: "spawn", identity: prepared.hookIdentity });
+    }
     if (taskIdRef !== undefined && prepared.hookIdentity.isDelegatedChild && runner.deps.onDelegationLifecycle !== undefined) {
         taskIdRef.delegationTerminalOwed = prepared.hookIdentity;
     }
@@ -79,6 +86,8 @@ export function runIdentityWiring(input) {
         queue.push({ ...buildAppliedHumanInputEvent({ carrier: "steer", source: "steer", sessionSeq: nextHumanInputSeq(prepared.harness), inputId: steer.inputId, actor: steer.actor, principal: spec.principal }), eventId: uuidv7(), ...identity });
     };
     prepared.harness.onFrameCommitted = (carrier, entryId) => {
+        if (carrier.kind === "attachment")
+            return void prepared.attachmentDelivery.settle(carrier.inputId, carrier.ordinal);
         const seam = prepared.frameSettlement;
         if (seam.awaiting.size === 0)
             return;

package/dist/core/runner/run-leg.d.ts

@@ -82,7 +82,7 @@ export interface RunLegInput<R> {
     unsubBoundary: () => void;
     /** borrowed-readonly — the git lane's harness-event release, called third. */
     unsub: () => void;
-    /** borrowed-readonly — the Runner's deployment deps, read LIVE (`onError`, `hooks`, `onNotice`, `allowImageUrl`; the resumed
+    /** borrowed-readonly — the Runner's deployment deps, read LIVE (`onError`, `hooks`, `onNotice`, `allowImageUrl`, `mediaByteCapBytes`; the resumed
      *  decision's resolver files its execution record's word through `onNotice` too); the one home of why it is a seat and not a
      *  captured object is {@link RunnerDepsSeat}. */
     runner: RunnerDepsSeat;

package/dist/core/runner/run-leg.js

@@ -6,6 +6,8 @@ import { normalizePersistedRuleHit } from "../rule-lane-reads.js";
 import { decidersNote, SETTLEMENT_NOBODY_JUDGED } from "../gate-outcome.js";
 import { formatHookFeedback, hookSeatExpiredError, runHookSeat } from "../hooks.js";
 import { buildAppliedHumanInputEvent, buildHumanInputEvent, projectHumanInput } from "../human-input-projection.js";
+import { humanInputAttachmentsOf, readObjectiveAttachments, userAttachmentDeclarations } from "../user-attachment.js";
+import { uuidv7 } from "../../internal/harness.js";
 import { ORG_ADJUDICATION_TIMEOUT_MS, settleOrgVerdictWithin } from "../permission-rule-org.js";
 import { applyPersistedTightening, disclosedRuleSet } from "../persisted-rule-arms.js";
 import { parkedSkillApprovalRefusal, skillRowRefusal } from "../skill-grant.js";
@@ -13,7 +15,8 @@ import { SKILL_TOOL_NAME } from "./synthetic-tools.js";
 import { computeCostMicroUsd } from "../pricing.js";
 import { mintSystemReminder } from "../reminder-mint.js";
 import { hasDestroy } from "../remote-env.js";
-import { advertisedWritableRootsSeat, exemptRootsSeat, humanRefusalSentence, policyCannotAnswer, policyRefusalMessage, refuseOutOfContractDecision } from "../tool-policy.js";
+import { advertisedWritableRootsSeat, attestationOf, exemptRootsSeat, humanRefusalSentence, policyCannotAnswer, policyRefusalMessage, refuseOutOfContractDecision } from "../tool-policy.js";
+import { pathDenialCardOf } from "../../tools/fs/safety.js";
 import { callFaceSeat, judgeParkedToolIdentity, parkedRowLiveFace, rosterEntryNamed } from "../tool-roster.js";
 import { deliverEngineNotice } from "../types.js";
 import { delimitUntrusted, inlineUntrusted, REVIEWER_NOTE_MAX_BODY, sanitizeUntrustedText } from "../untrusted-text.js";
@@ -288,7 +291,7 @@ export async function runLeg(input) {
             const userPromptSubmit = (spec.hooks ?? runner.deps.hooks)?.userPromptSubmit;
             if (userPromptSubmit) {
                 try {
-                    const promptSeat = await runHookSeat("userPromptSubmit", { timeoutMs: prepared.hookTimeoutMs, signal: prepared.abortController.signal, abortEnds: true }, (sig) => userPromptSubmit(spec.objective, { identity: prepared.hookIdentity, permissionMode: prepared.permissionMode.observed, signal: sig, source: "objective", ...(objectiveActor !== undefined ? { actor: snapshotActorAssertion(objectiveActor) } : {}) }));
+                    const promptSeat = await runHookSeat("userPromptSubmit", { timeoutMs: prepared.hookTimeoutMs, signal: prepared.abortController.signal, abortEnds: true }, (sig) => userPromptSubmit(spec.objective, { identity: prepared.hookIdentity, permissionMode: prepared.permissionMode.observed, signal: sig, source: "objective", ...(objectiveActor !== undefined ? { actor: snapshotActorAssertion(objectiveActor) } : {}), ...(prepared.userAttachments !== undefined ? { userAttachments: userAttachmentDeclarations(prepared.userAttachments) } : {}) }));
                     if (promptSeat.expired) {
                         if (promptSeat.cause === "timeout") {
                             try {
@@ -326,6 +329,8 @@ export async function runLeg(input) {
                     promptBlocked = true;
                 }
             }
+            const objectiveInputId = uuidv7();
+            const { frames: attachmentFrames, chars: attachmentChars } = await readObjectiveAttachments(prepared, objectiveInputId, promptBlocked);
             let gitLegDelivered;
             if (!promptBlocked) {
                 const gitBody = await resolveGitLegDelivery(prepared, undefined, (err) => {
@@ -401,14 +406,14 @@ export async function runLeg(input) {
             const precallMicroUsd = rs.budget.maxCostMicroUsd === undefined
                 ? 0
                 : computeCostMicroUsd({
-                    totalInputTokens: Math.ceil((effectiveObjective.length + gitQueuedChars) / 4),
+                    totalInputTokens: Math.ceil((effectiveObjective.length + gitQueuedChars + attachmentChars) / 4),
                     cacheReadTokens: 0,
                     cacheWriteTokens: 0,
                     cacheWriteTokensLong: 0,
                     outputTokens: prepared.model.maxTokens ?? DEFAULT_PRECALL_OUTPUT_TOKENS,
                 }, rs.telemetry.pricing);
             const precallCeilingMicroUsd = prepared.suspendForResource !== undefined ? rs.budget.remainingMicroUsd : rs.budget.maxCostMicroUsd;
-            const precallTokens = Math.ceil((effectiveObjective.length + gitQueuedChars) / 4) + (prepared.model.maxTokens ?? DEFAULT_PRECALL_OUTPUT_TOKENS);
+            const precallTokens = Math.ceil((effectiveObjective.length + gitQueuedChars + attachmentChars) / 4) + (prepared.model.maxTokens ?? DEFAULT_PRECALL_OUTPUT_TOKENS);
             const precallCeilingTokens = prepared.suspendForResource !== undefined ? rs.budget.remainingTokens : rs.budget.maxTokensWindow;
             const entryUsageRetryAfterMs = prepared.usageGovernance !== undefined ? await prepared.usageGovernance.check(Date.now()) : undefined;
             if (promptBlocked) {
@@ -470,21 +475,25 @@ export async function runLeg(input) {
                 }
                 const enginePrefixChars = effectiveObjective.length - projectedObjective.length;
                 if (!prepared.abortController.signal.aborted) {
+                    prepared.attachmentDelivery.stage(objectiveInputId, attachmentFrames);
                     queue.push({
                         ...buildHumanInputEvent({
                             carrier: "objective",
                             source: "objective",
                             delivery: "applied",
+                            inputId: objectiveInputId,
                             sessionSeq: nextHumanInputSeq(prepared.harness),
                             ...(objectiveActor !== undefined ? { actor: objectiveActor } : {}),
                             ...(objectiveActor?.issuer !== undefined ? { issuer: objectiveActor.issuer } : {}),
                             ...(spec.principal !== undefined ? { principal: spec.principal } : {}),
+                            ...(attachmentFrames.length > 0 ? { attachments: humanInputAttachmentsOf(attachmentFrames) } : {}),
                         }),
                         ...ident(),
                     });
                     final = await withBrainSinks(() => prepared.harness.prompt(effectiveObjective, {
                         ...(images && images.length > 0 ? { images } : {}),
                         ...(enginePrefixChars > 0 ? { enginePrefixChars } : {}),
+                        ...(attachmentFrames.length > 0 ? { trailing: attachmentFrames.map((f) => f.seed) } : {}),
                         ...(objectiveActor !== undefined ? { actor: objectiveActor } : {}),
                     }));
                     await flushGitMirror();
@@ -579,7 +588,7 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
     const settleEnd = async (isError, result, refusedBy) => {
         if (refusedBy !== undefined)
             occurrences.refuse(pendingAction.toolCallId, refusedBy);
-        const gate = emitSettled(occurrences, callStart, { result, isError }, { push: emit, structured: prepared.structuredProjector }).gate ?? decidedGate;
+        const gate = emitSettled(occurrences, callStart, { result, isError }, { push: emit, structured: prepared.structuredProjector, mediaByteCapBytes: runner.deps.mediaByteCapBytes }).gate ?? decidedGate;
         const word = await resume.recordExecutionOutcome(gate);
         settleExecutionRecord(runner.deps.onNotice, word, { toolName: pendingAction.toolName, gate, sessionId: prepared.sessionId, runId: prepared.runId, scope: resume.cp.scope, ...(resume.cp.checkpointId !== undefined ? { checkpointId: resume.cp.checkpointId } : {}) });
     };
@@ -627,6 +636,10 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
         resourceSpentMicroUsd: prepared.resourceLedger?.spentMicroUsd ?? 0,
         suspendCount: resume.cp.suspendCount ?? 0,
     };
+    const denialCard = (d) => {
+        const card = pathDenialCardOf(attestationOf(d, { toolCallId: pendingAction.toolCallId, toolName: pendingAction.toolName })?.pathDenial);
+        return card !== undefined ? { details: card } : {};
+    };
     const beltStamped = prepared.stampCallTarget?.(beltReq(), prepared.abortController.signal);
     if (beltStamped !== undefined)
         beltReading = (await beltStamped).targetReading;
@@ -643,7 +656,7 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
                     ? " (the call as it would run requires a person's approval, and this decision was the deployment's policy)"
                     : " (the policy rewrote these bytes to a value that was not approved)";
             const editedDenial = formatHookFeedback(`${outcome.updatedInput !== undefined ? "The approver EDITED this call's input; the edited call" : "A PreToolUse hook REWROTE this approved call's input; the rewritten call"} is refused by the deployment's tool policy and was not executed${why}.`, prepared.reminderMark);
-            await settleEnd(true, { content: editedDenial }, "policy");
+            await settleEnd(true, { content: editedDenial, ...denialCard(rechecked) }, "policy");
             const eid = await prepared.session.appendMessage(toolResultMsg(pendingAction.toolCallId, pendingAction.toolName, editedDenial, true));
             emitCommitted(eid, "toolResult", pendingAction.toolCallId);
             return;
@@ -697,7 +710,7 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
         const narrowed = refuseOutOfContractDecision(await prepared.denyNarrowingPolicy.check(beltReq(), prepared.abortController.signal));
         if (narrowed.action === "deny") {
             const narrowedDenial = formatHookFeedback(`The approved tool call "${pendingAction.toolName}" is now denied by ${ruleSourcePhrase("narrowing")} and was not executed${narrowed.message ? `: ${narrowed.message}` : ""}.`, prepared.reminderMark);
-            await settleEnd(true, { content: narrowedDenial }, "policy");
+            await settleEnd(true, { content: narrowedDenial, ...denialCard(narrowed) }, "policy");
             const eid = await prepared.session.appendMessage(toolResultMsg(pendingAction.toolCallId, pendingAction.toolName, narrowedDenial, true));
             emitCommitted(eid, "toolResult", pendingAction.toolCallId);
             return;
@@ -721,7 +734,7 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
             laneRead = Promise.resolve(unreadable);
         }
         const read = await settleOrgVerdictWithin(laneRead, unreadable, { signal: prepared.abortController.signal, timeoutMs: ORG_ADJUDICATION_TIMEOUT_MS, onFallback: (cause) => void (laneWaitCancelled = cause === "aborted") });
-        const tightened = applyPersistedTightening({ action: "allow" }, read);
+        const tightened = applyPersistedTightening({ action: "allow" }, read, beltReq());
         if (laneWaitCancelled || tightened.tightened === "deny" || tightened.tightened === "unreadable") {
             const why = laneWaitCancelled
                 ? "the task was cancelled before your persisted permission rules could be read"
@@ -729,7 +742,7 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
                     ? `a standing deny rule of yours (${disclosedRuleSet(read.hit?.rules ?? [])}) now refuses it`
                     : `it could not be read against your standing deny/ask rules (${read.reason})`;
             const ruleDenial = formatHookFeedback(`The approved tool call "${pendingAction.toolName}" was not executed: ${why}. This approval is spent — the call has to be re-issued and approved again.`, prepared.reminderMark);
-            await settleEnd(true, { content: ruleDenial }, "persisted_rule");
+            await settleEnd(true, { content: ruleDenial, ...denialCard(tightened.decision) }, "persisted_rule");
             const eid = await prepared.session.appendMessage(toolResultMsg(pendingAction.toolCallId, pendingAction.toolName, ruleDenial, true));
             emitCommitted(eid, "toolResult", pendingAction.toolCallId);
             return;

package/dist/core/runner/run-settle-and-teardown.d.ts

@@ -26,10 +26,6 @@ export interface RunSettleAndTeardownInput {
         parentToolCallId?: string;
         sourceTaskId?: string;
     };
-    /** borrowed-readonly — the spawning tool call's id when this task runs AS A SUB-AGENT (gates the terminal tick). */
-    parentToolCallId: string | undefined;
-    /** borrowed-readonly — the sub-agent display name for the terminal tick. */
-    subagentName: string | undefined;
     /** borrowed-readonly — the loop-liveness latch: `userHalted` = the halt verb was ACCEPTED (the unconsumed-halt notice's input; it does not sign the seat). */
     loopLatch: {
         readonly userHalted: boolean;

package/dist/core/runner/run-settle-and-teardown.js

@@ -1,4 +1,5 @@
 import { MAX_CONSECUTIVE_COMPACTION_FAILURES } from "./compaction-knobs.js";
+import { emitsChildRowFrames } from "../delegation-frames.js";
 import { isSyntheticApiErrorMessage } from "../../internal/harness.js";
 import { adjudicateDerivedRoute, fallbackToPrimaryNotice, sameRouteIdentity } from "../../brain/route-adjudicator.js";
 import { isDegenerateCutMessage } from "../../brain/terminal-cause.js";
@@ -21,11 +22,12 @@ import { generatePromptSuggestions } from "./prompt-suggestions.js";
 import { settleTeardownLeg } from "./teardown-bounded.js";
 import { owedDateAnchor } from "./announce-once-ledger.js";
 import { autoRunConsolidationFromRecommendation, autoRunOnRecommendationEffective, scopeHasUnconsumedRecommendation } from "./memory-consolidation-driver.js";
+import { consolidationWriteJudgeOfLeg } from "./memory-consolidation-write-judge.js";
 import { amendTerminal, terminalProjection } from "./terminal-projection.js";
 import { mintCompactedEvent } from "../auto-compaction.js";
 import { asThrownError } from "../thrown-value.js";
 export async function runSettleAndTeardown(input) {
-    const { spec, queue, prepared, resume, internals, rs, stats, ident, parentToolCallId, subagentName, loopLatch, timeout, ownCommittedTailRef, emitDelegationLifecycle, taskIdRef, manualCompactRef, drainManualCompact, final, threw, abortedLive, userInterruptedLive, answerSettled, strandedHumanAnswers, reasoningResolution, comp, compactionBreaker, owedUserInput, setResult, onSuggestions, onSuspend, runner, sessions } = input;
+    const { spec, queue, prepared, resume, internals, rs, stats, ident, loopLatch, timeout, ownCommittedTailRef, emitDelegationLifecycle, taskIdRef, manualCompactRef, drainManualCompact, final, threw, abortedLive, userInterruptedLive, answerSettled, strandedHumanAnswers, reasoningResolution, comp, compactionBreaker, owedUserInput, setResult, onSuggestions, onSuspend, runner, sessions } = input;
     try {
         if (comp?.compacted) {
             queue.push(mintCompactedEvent(comp, "auto", ident()));
@@ -237,7 +239,8 @@ export async function runSettleAndTeardown(input) {
             await settleTeardownLeg(() => mes.harvest(), "memoryEngineSession.harvest (settle leg)", (e) => runner.deps.onError?.(e, { phase: "config", sessionId: prepared.sessionId }));
             const scope = mes.handle.writeScope;
             if (scope !== null && autoRunOnRecommendationEffective(runner.deps) && scopeHasUnconsumedRecommendation(mes.engine, scope)) {
-                void autoRunConsolidationFromRecommendation({ deps: runner.deps, engine: mes.engine, scope, sessionId: prepared.sessionId, onNotice: runner.deps.onNotice, onError: runner.deps.onError });
+                const writeJudge = consolidationWriteJudgeOfLeg(prepared.syntheticWriteVerdict);
+                void autoRunConsolidationFromRecommendation({ deps: runner.deps, engine: mes.engine, scope, sessionId: prepared.sessionId, writeJudge, onNotice: runner.deps.onNotice, onError: runner.deps.onError });
             }
         }
         emitTrace(rs.telemetry.tracer, () => ({
@@ -262,14 +265,14 @@ export async function runSettleAndTeardown(input) {
             ts: Date.now(),
         }));
         setResult(result);
-        if (parentToolCallId !== undefined && result.terminal.kind !== "paused") {
+        if (emitsChildRowFrames(prepared.hookIdentity) && result.terminal.kind !== "paused") {
             const terminalTick = {
                 type: "task_progress",
                 taskId: rs.telemetry.taskId,
                 ...(internals?.delegationTaskType !== undefined ? { taskType: internals.delegationTaskType } : {}),
                 ...(internals?.cycleSeq !== undefined ? { seq: internals.cycleSeq } : {}),
                 ...(internals?.parentTaskId !== undefined ? { parentTaskId: internals.parentTaskId } : {}),
-                ...(subagentName ? { name: subagentName } : {}),
+                ...(prepared.hookIdentity.agentName ? { name: prepared.hookIdentity.agentName } : {}),
                 ...(internals?.explicitAgentName !== undefined ? { spawnName: internals.explicitAgentName } : {}),
                 model: prepared.model.id,
                 usage: { totalTokens: stats.tokens, toolUses: stats.toolCalls, durationMs: Date.now() - rs.telemetry.taskStart },

package/dist/core/runner/run-terminal-adoption.d.ts

@@ -78,7 +78,7 @@ export interface RunTerminalAdoptionInput<R> {
     abortedLive: boolean;
     /** borrowed-readonly — the leg's snapshot of `loopLatch.userInterrupted` (gates the interruption marker). */
     userInterruptedLive: boolean;
-    /** borrowed-readonly — the Runner's deployment deps, read LIVE (`onError`, `checkpointStore`, `onNotice`); the one home of why it is
+    /** borrowed-readonly — the Runner's deployment deps, read LIVE (`onError`, `checkpointStore`, `onNotice`, `mediaByteCapBytes`); the one home of why it is
      *  a seat and not a captured object is {@link RunnerDepsSeat}. */
     runner: RunnerDepsSeat;
     /** borrowed-readonly — the session store: the end-of-task pass touches the leg's session through it (`finish`'s teardown legs). */

package/dist/core/runner/run-terminal-adoption.js

@@ -43,7 +43,7 @@ export async function runTerminalAdoption(input) {
             const report = await reconcileInterruptedSession(prepared.session, prepared.toolEffects, undefined, startedToolCallIds);
             orphansClosed = report.recovered.length;
             for (const orphan of report.recovered) {
-                emitSettled(prepared.toolOccurrences, { toolCallId: orphan.toolCallId, spelledName: orphan.toolName, ...(toolLabels.has(orphan.toolName) ? { label: toolLabels.get(orphan.toolName) } : {}), args: orphan.args }, reconciledEnd(orphan), { push: (f) => queue.push({ ...f, ...ident() }), structured: prepared.structuredProjector });
+                emitSettled(prepared.toolOccurrences, { toolCallId: orphan.toolCallId, spelledName: orphan.toolName, ...(toolLabels.has(orphan.toolName) ? { label: toolLabels.get(orphan.toolName) } : {}), args: orphan.args }, reconciledEnd(orphan), { push: (f) => queue.push({ ...f, ...ident() }), structured: prepared.structuredProjector, mediaByteCapBytes: runner.deps.mediaByteCapBytes });
                 emitCommitted(orphan.entryId, "toolResult", orphan.toolCallId);
             }
             reconcileComplete = true;

package/dist/core/runner/run-turn-boundary.js

@@ -10,7 +10,7 @@ import { buildWorkingFileAttachments, centerAdoptionOption, contextInstructionFi
 import { hookSeatExpiredError, runHookSeat } from "../hooks.js";
 import { sanitizeUntrustedText, SHELLED_BODY_ENVELOPE_TAGS } from "../untrusted-text.js";
 import { droppedToolDigest, withAnnounceDigests } from "./announce-once-ledger.js";
-import { formatDiagnosticsBlock } from "../lsp-diagnostics.js";
+import { formatDiagnosticsBlock, withholdListedDiagnostics } from "../lsp-diagnostics.js";
 import { workflowSizeGuidelineChangeNotice } from "../../orchestration/workflow-size-guideline.js";
 import { awaitChargeWithSlowDisclosure, discloseUnevaluableWindow, ENV_DUE_GOVERNANCE_READ_BUDGET_MS, GOVERNANCE_READ_STALLED, LIMIT_APPROACH_DEFAULT_THRESHOLDS, limitApproachFrames, platformLimitTerminal, raceUntilDeadline } from "./clock-and-limits.js";
 import { appendBoundaryFrames, compactionRestateOptions } from "./compaction-restate.js";
@@ -203,7 +203,7 @@ export function createTurnBoundary(input) {
             !prepared.lspDiagnostics.registry.isEmpty() &&
             !prepared.abortController.signal.aborted &&
             prepared.batchHaltRef.current === undefined) {
-            const files = prepared.lspDiagnostics.registry.drain(prepared.lspDiagnostics.runIdent);
+            const files = await withholdListedDiagnostics(prepared.lspDiagnostics.registry.drain(prepared.lspDiagnostics.runIdent), prepared.lspDiagnostics.withheldOf);
             if (files.length > 0) {
                 queue.push({ type: "diagnostics", files, isNew: true, ...ident() });
                 const block = mintSystemReminder(formatDiagnosticsBlock(files), prepared.reminderMark);

package/dist/core/runner/runtask.js

@@ -45,7 +45,7 @@ import { streamLifecycleVerbs } from "./stream-lifecycle-verbs.js";
 import { streamHaltVerbs } from "./stream-halt-verbs.js";
 import { streamModeVerb } from "./stream-mode-verb.js";
 import { runNotificationLane } from "./run-notification-lane.js";
-import { assertRunnerDepsDoors } from "./construction-doors.js";
+import { retainRunnerDeps } from "./construction-doors.js";
 import { runLeg } from "./run-leg.js";
 import { runTerminalAdoption } from "./run-terminal-adoption.js";
 import { runSettleAndTeardown } from "./run-settle-and-teardown.js";
@@ -77,10 +77,10 @@ export class Runner {
     static PARENT_CONSTRAINT_REGISTRY_CAP = 1024;
     depsSeat;
     constructor(deps) {
-        assertRunnerDepsDoors(deps);
+        const retained = retainRunnerDeps(deps);
         const runner = this;
         this.depsSeat = { get deps() { return runner.deps; } };
-        this.deps = withDeploymentAllowedTools(deps);
+        this.deps = withDeploymentAllowedTools(retained);
         if (this.deps.tiers) {
             this.deps = { ...this.deps, models: expandTiers(this.deps.models, this.deps.tiers) };
         }
@@ -121,7 +121,7 @@ export class Runner {
         if (!this.deps.toolResultStore) {
             this.deps = { ...this.deps, toolResultStore: new RunnerSharedToolResultStore({ maxTotalChars: 64_000_000 }) };
         }
-        this.sessions = deps.sessionStore ?? new TtlSessionStore();
+        this.sessions = this.deps.sessionStore ?? new TtlSessionStore();
     }
     emitTaskOutcome(outcome) {
         emitTaskOutcome(this.deps, outcome);
@@ -465,10 +465,10 @@ export class Runner {
                         const { effectiveTimeoutMs, walltimeMonotonicDeadline, timeout, pushContent, ownCommittedTailRef, emitCommitted } = runClockAndContent({ spec, prepared, queue, internals, rs, ident, parentToolCallId, startedToolCallIds });
                         const toolProgress = createToolProgressLane(pushContent, ident, prepared.toolOccurrences);
                         prepared.toolProgressRef.current = toolProgress;
-                        const { subagentName, withBrainSinks, withExtraBodyDroppedSink } = runBrainSinks({ queue, internals, rs, ident, parentToolCallId, observeReasoningWireFacts, notice: { onNotice: this.deps.onNotice, sessionId: prepared.sessionId, runId: prepared.runId } });
+                        const { withBrainSinks, withExtraBodyDroppedSink } = runBrainSinks({ queue, internals, rs, ident, observeReasoningWireFacts, notice: { onNotice: this.deps.onNotice, sessionId: prepared.sessionId, runId: prepared.runId } });
                         const toolLabels = new Map(prepared.tools.flatMap((t) => (t.label !== undefined && t.label !== t.name ? [[t.name, t.label]] : [])));
                         for (const orphan of prepared.wakeRecovered) {
-                            emitSettled(prepared.toolOccurrences, { toolCallId: orphan.toolCallId, spelledName: orphan.toolName, ...(toolLabels.has(orphan.toolName) ? { label: toolLabels.get(orphan.toolName) } : {}), args: orphan.args }, reconciledEnd(orphan), { push: (f) => queue.push({ ...f, ...ident() }), structured: prepared.structuredProjector });
+                            emitSettled(prepared.toolOccurrences, { toolCallId: orphan.toolCallId, spelledName: orphan.toolName, ...(toolLabels.has(orphan.toolName) ? { label: toolLabels.get(orphan.toolName) } : {}), args: orphan.args }, reconciledEnd(orphan), { push: (f) => queue.push({ ...f, ...ident() }), structured: prepared.structuredProjector, mediaByteCapBytes: this.deps.mediaByteCapBytes });
                             emitCommitted(orphan.entryId, "toolResult", orphan.toolCallId);
                         }
                         const postToolBatchHook = (spec.hooks ?? this.deps.hooks)?.postToolBatch;
@@ -477,7 +477,7 @@ export class Runner {
                         const { onMessageUpdate, onMessageEnd, onToolStart, onToolEnd, onTurnEnd, announceWorkspaceMove } = createHarnessHandlers({
                             prepared, stats, rs,
                             deps: {
-                                spec, queue, internals, ident, parentToolCallId, subagentName,
+                                spec, queue, internals, ident, mediaByteCapBytes: this.deps.mediaByteCapBytes,
                                 pushContent, emitCommitted, startedToolCallIds, toolStartAt, toolProgress, writeFamilyOf,
                                 toolLabels, postToolBatchHook, batchArgs, internalsNotifier,
                                 runnerHooks: { onError: (e, info) => this.deps.onError?.(e, info), onNotice: this.deps.onNotice },
@@ -512,7 +512,7 @@ export class Runner {
                                 spec, queue, prepared, rs, stats, ident, emitCommitted, startedToolCallIds, toolLabels, timeout, compactionBrain, compactionBreaker, windowSafetyOptions,
                                 undrainedUserAtEnd, userInputLostAtEnd, final, threw, abortedLive, userInterruptedLive, runner: this.depsSeat, sessions: this.sessions,
                                 next: ({ threw, comp, answerSettled, owedUserInput }) => runSettleAndTeardown({
-                                    spec, queue, prepared, resume, internals, rs, stats, ident, parentToolCallId, subagentName, loopLatch, timeout, ownCommittedTailRef,
+                                    spec, queue, prepared, resume, internals, rs, stats, ident, loopLatch, timeout, ownCommittedTailRef,
                                     emitDelegationLifecycle, taskIdRef, manualCompactRef, drainManualCompact, final, threw, abortedLive, userInterruptedLive, answerSettled, strandedHumanAnswers, reasoningResolution, comp, compactionBreaker, owedUserInput,
                                     setResult, onSuggestions, onSuspend, runner: this.depsSeat, sessions: this.sessions,
                                 }),

package/dist/core/runner/session-file-state-replay.d.ts

@@ -31,15 +31,22 @@
  *     (the model re-reads), which is the pre-existing cost, not a new failure.
  */
 import type { AgentMessage } from "../../internal/harness.js";
-/** The whole text of one file at the moment the transcript recorded it. */
-export interface TranscriptFileRecord {
+import { type UserAttachmentObservation } from "../../internal/llm.js";
+/** What the transcript proves about one file: its whole text at that moment (a tool's card), or the read-state entry an
+ *  attachment frame's delivery committed (its record's observation, verbatim — hash, view and partial-view flag). */
+export type TranscriptFileRecord = {
     /** The path as the tool recorded it — absolute (see {@link wholeFileRecordsFromTranscript}). */
     path: string;
     /** The file's ENTIRE text at that moment, in the decoded coordinate the fs tools hash. */
     content: string;
-    /** The recording tool result's own timestamp — the most honest "last read at" available. */
+    /** The recording message's own timestamp — the most honest "last read at" available. */
     at: number;
-}
+} | {
+    path: string;
+    /** The entry the delivery committed. */
+    observation: UserAttachmentObservation["entry"];
+    at: number;
+};
 /**
  * Per-file, the last whole-file content the transcript proves — in transcript order, last record wins.
  *
@@ -57,6 +64,9 @@ export interface TranscriptFileRecord {
  * the narrowed model-facing union: this reads the branch as the session stores it, and every lane that
  * is not a tool result falls out on the first line of the loop.
  *
+ * A user-attachment frame (`UserMessage.attachment` with an observation) proves the read state its delivery committed,
+ * keyed by the canonical key it carries — the same entry the live commit wrote, so a rebuilt partial view stays one.
+ *
  * Paths are reported only when the tool recorded an ABSOLUTE one. A relative spelling was resolved
  * against the tracked working directory of that moment, which this task cannot reconstruct; re-
  * resolving it here could key the entry to a different file.

package/dist/core/runner/session-file-state-replay.js

@@ -1,3 +1,4 @@
+import { userAttachmentOf } from "../../internal/llm.js";
 import { isAbsoluteForFamily, pathFamilyOf } from "../../tools/fs/safety.js";
 import { applyRecordedEdit } from "../../tools/fs/fs-shared.js";
 import { normalizeFileText } from "../../tools/fs/encoding.js";
@@ -64,6 +65,13 @@ function wholeFileFromReadCard(rest) {
 export function wholeFileRecordsFromTranscript(messages) {
     const byPath = new Map();
     for (const m of messages) {
+        const attachment = userAttachmentOf(m);
+        if (attachment?.observation !== undefined) {
+            const { key, entry } = attachment.observation;
+            if (isAbsoluteForFamily(pathFamilyOf({ root: key }), key))
+                byPath.set(key, { path: key, observation: entry, at: m.timestamp });
+            continue;
+        }
         if (m.role !== "toolResult" || m.isError)
             continue;
         const card = cardOf(m.details);

package/dist/core/runner/stream-steer-verb.js

@@ -13,6 +13,9 @@ export function streamSteerVerb(input) {
     const { spec, internals, queue, acceptedSteerInputs, live, ready, orTimeout, readyTimeoutMs: READY_TIMEOUT_MS, steeringError, runner } = input;
     let steerChain = Promise.resolve();
     const steer = async (text, options) => {
+        if (options?.userAttachments !== undefined) {
+            throw steeringError("a steer carries no attachments — declare them in TaskSpec.userAttachments on the next objective", "steering.invalid_content");
+        }
         const trusted = options?.trusted ? true : false;
         if (trusted && sanitizeUntrustedText(text) !== text) {
             throw steeringError("trusted steering text must not contain a </system-reminder> tag", "steering.invalid_content");

package/dist/core/runner/tool-end-body.d.ts

@@ -32,9 +32,8 @@ export declare function batchResponseDigest(result: unknown): string | undefined
  *  showed an empty body for every durable-approved call. Same projection = same source as the transcript.
  *  Also the one place the gate outcome reaches a frame — see the parameter. */
 export declare function toolEndBodyFrom(result: unknown, isError: boolean, 
-/** The leg's card projector — see the doc above. A parameter, never a module default: a body minted with the engine
- *  set alone would silently drop every declared caller card and never announce. */
-structured: StructuredProjector, 
+/** The leg's card projector (never a module default: the engine set alone drops every declared caller card unannounced) and media budget. */
+leg: Pick<OccurrenceFrames, "structured" | "mediaByteCapBytes">, 
 /** The gate's record of the pass that admitted or refused this call, supplied by the CALLER of this
  *  projection — the end projection ({@link emitSettled}) reads it off the call's occurrence (its latest gate
  *  record). Deliberately a parameter and never derived from `result`: a tool's own `details`
@@ -63,10 +62,12 @@ export type OccurrenceFrame = Omit<Extract<TaskEvent, {
 }>, keyof TaskEventIdentity> | Omit<Extract<TaskEvent, {
     type: "tool_end";
 }>, keyof TaskEventIdentity>;
-/** Where an occurrence's frames go: the leg's push (it stamps the identity and picks the queue) and its card projector. */
+/** Where an occurrence's frames go: the leg's push (it stamps the identity and picks the queue), its card projector and its media budget. */
 export interface OccurrenceFrames {
     push(frame: OccurrenceFrame): void;
     structured: StructuredProjector;
+    /** `RunnerDeps.mediaByteCapBytes` as given — the request strip's budget, read through the same `mediaBudgetBytes`; required, so no site reads a second one. */
+    mediaByteCapBytes: number | undefined;
 }
 /** The START projection: the call's occurrence opens and its start frame goes out. Every leg that announces a call
  *  comes through here (the live loop's `tool_execution_start`, the resumed leg's approved call). */

package/dist/core/runner/tool-end-body.js

@@ -33,9 +33,9 @@ export function batchResponseDigest(result) {
         ? `${text.slice(0, BATCH_RESPONSE_MAX_CHARS)}…[+${text.length - BATCH_RESPONSE_MAX_CHARS} chars truncated]`
         : text;
 }
-export function toolEndBodyFrom(result, isError, structured, gate, gatedCallIdOfRun) {
-    const o = toolOutputFrom(result);
-    const st = structured(result);
+export function toolEndBodyFrom(result, isError, leg, gate, gatedCallIdOfRun) {
+    const o = toolOutputFrom(result, leg.mediaByteCapBytes);
+    const st = leg.structured(result);
     const det = isError ? readMember(result, "details") : undefined;
     const codeRaw = readMember(det, "code");
     const kindRaw = readMember(det, "errorKind");
@@ -71,7 +71,7 @@ export function emitSettled(table, start, end, frames) {
         toolName: occ.spelledName,
         ...(occ.label !== undefined ? { label: occ.label } : {}),
         isError,
-        ...toolEndBodyFrom(end.result, isError, frames.structured, gate, end.gatedCallIdOfRun),
+        ...toolEndBodyFrom(end.result, isError, frames, gate, end.gatedCallIdOfRun),
         ...(gate?.disposition.kind === "denied" && occ.wireName !== undefined ? { wireName: occ.wireName } : {}),
         ...(end.notExecuted === true ? { notExecuted: true } : {}),
     });