@sema-agent/core 7.5.0 → 7.5.2

package/dist/core/runner/contracts.js

@@ -0,0 +1 @@
+export {};

package/dist/core/runner/denial-limit-arms.d.ts

@@ -3,7 +3,7 @@ import { type AutoModeArmingRecipe } from "../auto-mode-arming.js";
 import type { PermissionResult, ResolvedAsk, ToolCallRequest } from "../tool-policy.js";
 import { type EngineNotice } from "../types.js";
 import { type AskOrigin } from "../ask-origin.js";
-import type { Prepared } from "./prepare-task.js";
+import type { Prepared } from "./contracts.js";
 /**
  * #548 — the classifier DENIAL-LIMIT arms of the tool gate's inherited (delegation) lane, extracted
  * from `prepareTask` as a phase module (design/238 D-7: extract, don't accrete). The gate's OWN
@@ -173,3 +173,26 @@ export declare function settleDenialLimitFallback(opts: {
     toolName: string;
     toolCallId: string;
 }): void;
+/**
+ * design/384 slice 1 — the observer `resolveAskBound` hands `resolveAsk` for a DETACHED approver's
+ * settlement (the race arm released the wait; the approver's promise lives on):
+ *  · an approval the released wait never consumed becomes the `task.late_approval` notice a host
+ *    can forward on its own wire (the wire-facing half of "release, not a verdict" — the notice
+ *    asserts non-consumption only, never an arrival order the resolver cannot prove);
+ *  · an unconsumed rejection goes to the deployment's error face (`onError(phase:"hook")`) — a
+ *    callback failure the engine no longer awaits is still a callback failure, never silence.
+ */
+export declare function lateAskSettlementObserver(args: {
+    toolName: string;
+    toolCallId: string;
+    sessionId: string;
+    runId: string;
+    taskId?: string;
+    onNotice: import("../types.js").RunnerDeps["onNotice"];
+    onError: import("../types.js").RunnerDeps["onError"];
+}): (late: {
+    kind: "approve";
+} | {
+    kind: "error";
+    error: unknown;
+}) => void;

package/dist/core/runner/denial-limit-arms.js

@@ -114,3 +114,24 @@ export function settleDenialLimitFallback(opts) {
         opts.stop({ toolName: opts.toolName, toolCallId: opts.toolCallId, fallback });
     }
 }
+export function lateAskSettlementObserver(args) {
+    return (late) => {
+        if (late.kind === "approve") {
+            deliverEngineNotice(args.onNotice, {
+                code: "task.late_approval",
+                message: `an approval for "${args.toolName}" was not consumed: a run or turn interrupt released the ask wait, ` +
+                    `so the tool did NOT run and the approval was not honored (an unconsumed answer is the approver ` +
+                    `releasing its wait, never a verdict).`,
+                detail: {
+                    toolName: args.toolName,
+                    toolCallId: args.toolCallId,
+                    sessionId: args.sessionId,
+                    runId: args.runId,
+                    ...(args.taskId !== undefined ? { taskId: args.taskId } : {}),
+                },
+            });
+            return;
+        }
+        args.onError?.(late.error, { phase: "hook", sessionId: args.sessionId });
+    };
+}

package/dist/core/runner/derived-route-fallback.d.ts

@@ -0,0 +1,34 @@
+/**
+ * The derived-leg route pre-flight shared by prepareTask's two derived seats: the compaction-summary model (the
+ * driver's own seat, resolved before the offload prelude) and the auto-mode classifier model (the caps-and-workflow
+ * phase's arming). Moved whole out of the orchestrator so the phase reaches DOWN for it instead of the two callers
+ * spelling it twice. The judgment law itself lives in the brain's route adjudicator; this is the one guarded seat
+ * around it.
+ */
+import type { Model } from "../../internal/llm.js";
+import type { RunnerDeps, TaskSpec } from "../types.js";
+/**
+ * The derived-leg pairing pre-flight as ONE guarded seat: judge the derived model where its route
+ * differs from the primary's, announce the fallback on a broken pairing, and ABSTAIN (keep the
+ * derived model) on ANY throw. The pre-flight is advisory — the brain's request gate re-runs the
+ * same law — so neither a throwing judge face nor a garbage catalog value (the route-identity
+ * normalization throws a TypeError on a non-string baseUrl) may widen into "task preparation
+ * failed": at the compaction seat the session is already acquired and the throw-cleanup contract
+ * is not yet armed, so a throw here would leak the acquired session view, and the garbage value
+ * still earns its loud refusal at the request gate the moment the derived leg is actually used.
+ * Returns whether the seat should fall back to the primary model.
+ */
+export declare function derivedRouteFallsBack(args: {
+    seat: string;
+    derived: Model;
+    primary: Model;
+    brain: RunnerDeps["brain"];
+    getApiKeyAndHeaders: TaskSpec["getApiKeyAndHeaders"];
+    onNotice: RunnerDeps["onNotice"];
+    /** #433 — the run this seat resolution belongs to; carried onto the notice as its routing key
+     *  (the audience stays operator: correlation, not entitlement). Absent ⇒ nothing is fabricated. */
+    sessionId?: string;
+    /** #499 — the INVOCATION this seat resolution belongs to. The session cannot stand in for it: two
+     *  runs of one session that both fall back on the same seat mint otherwise byte-identical lines. */
+    runId?: string;
+}): Promise<boolean>;

package/dist/core/runner/derived-route-fallback.js

@@ -0,0 +1,16 @@
+import { adjudicateDerivedRoute, fallbackToPrimaryNotice, sameRouteIdentity } from "../../brain/route-adjudicator.js";
+import { deliverEngineNotice } from "../types.js";
+export async function derivedRouteFallsBack(args) {
+    try {
+        if (sameRouteIdentity(args.derived, args.primary))
+            return false;
+        const verdict = await adjudicateDerivedRoute({ brain: args.brain, model: args.derived, getApiKeyAndHeaders: args.getApiKeyAndHeaders });
+        if (verdict === undefined || verdict.ok)
+            return false;
+        deliverEngineNotice(args.onNotice, fallbackToPrimaryNotice({ seat: args.seat, from: args.derived.id, to: args.primary.id, verdict, ...(args.sessionId !== undefined ? { sessionId: args.sessionId } : {}), ...(args.runId !== undefined ? { runId: args.runId } : {}) }));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/core/runner/inherited-ask-grants.d.ts

@@ -0,0 +1,46 @@
+import { type OnAsk, type PermissionResult, type ResolvedAsk, type ToolCallRequest } from "../tool-policy.js";
+/** RB-40 byte-shape key, throw-proofed: JSON.stringify throws on a cyclic value (a deployment
+ *  policy's rewrite object carries no acyclicity guarantee) — `undefined` here means "no comparable
+ *  shape", which every consumer treats as a mismatch (skip the record / skip the reuse ⇒ the child
+ *  gate just re-asks — the safe direction, never a gate failure). */
+export declare function askGrantShapeOf(args: unknown): string | undefined;
+/**
+ * RB-40 — duplicate-frame collapse (single-Runner embedded shape), the CONSUME half: an inherited
+ * layer already resolved THIS call as a clean allow at the SAME approver function, on EXACTLY the
+ * byte-shape this caller-slot ask now presents. The human's consent covers this consultation
+ * verbatim — asking again is the 2-frame UX debt, not a second authority. Guards, all mismatches
+ * re-ask (⇒ `undefined`):
+ *  · SOURCE (review F-2): only a caller-slot POLICY ask may reuse — a safety tighten
+ *    (egress/irreversible/shellGate stamp `decisionReason:"safety"`), a hook-promoted ask
+ *    ("hook"), or a classifier ask carries a DIFFERENT authority/context and keeps its frame.
+ *  · IDENTITY: the approver FUNCTION reference (never a name) — compared through
+ *    `askApproverIdentity`, not by raw reference (ruled 2026-08-04): a delegated child's approver
+ *    is the ancestor's own, wrapped with delegation provenance — a DIFFERENT function object, the
+ *    SAME operator. Bare `===` therefore stopped collapsing the frame the moment the ask seam
+ *    started forwarding approvers, and one tool call presented the same person the same card
+ *    twice. The wrapper adds metadata and delegates every decision, so it grants no authority of
+ *    its own; identity here only answers "same consultation".
+ *  · SHAPE: byte-equality against the [1462] r5 presented SNAPSHOT; reuse re-emits that snapshot
+ *    as the executed shape via `presentedInput` (review F-1) — the same schema-revalidated binding
+ *    as a main-gate approval (shown == executed, by construction).
+ *  · LEDGER (review F-3): the ONE real consultation (timed on the wrapper arm) is recorded here —
+ *    one frame happened, one frame is booked.
+ * The grant lives only within one gate evaluation (consumed on reuse, swept at the call site) — a
+ * REOPENED checkpoint's re-adjudication never sees a stale grant.
+ */
+export declare function consumeInheritedAskGrant(grants: Map<string, {
+    approver: unknown;
+    argsJson: string;
+    presented: unknown;
+    waitMs: number;
+}>, onAsk: OnAsk | undefined, humanReviewRef: {
+    count: number;
+    totalWaitMs: number;
+    gates: Array<{
+        kind: string;
+        waitMs: number;
+        decision?: string;
+        toolName?: string;
+        toolArg?: string;
+    }>;
+}, decision: PermissionResult, req: ToolCallRequest): ResolvedAsk | undefined;

package/dist/core/runner/inherited-ask-grants.js

@@ -0,0 +1,29 @@
+import { primaryActivityArg } from "../arg-summary.js";
+import { askApproverIdentity } from "../tool-policy.js";
+export function askGrantShapeOf(args) {
+    try {
+        return JSON.stringify(args ?? null);
+    }
+    catch {
+        return undefined;
+    }
+}
+export function consumeInheritedAskGrant(grants, onAsk, humanReviewRef, decision, req) {
+    if (decision.decisionReason !== undefined && decision.decisionReason !== "rule")
+        return undefined;
+    const grant = grants.get(req.toolCallId);
+    if (grant === undefined || askApproverIdentity(grant.approver) !== askApproverIdentity(onAsk) || grant.argsJson !== askGrantShapeOf(req.args))
+        return undefined;
+    grants.delete(req.toolCallId);
+    humanReviewRef.count += 1;
+    humanReviewRef.totalWaitMs += grant.waitMs;
+    const toolArg = primaryActivityArg(req.args);
+    humanReviewRef.gates.push({
+        kind: "human",
+        waitMs: grant.waitMs,
+        decision: "allow",
+        toolName: req.toolName,
+        ...(toolArg !== undefined ? { toolArg } : {}),
+    });
+    return { action: "allow", presentedInput: grant.presented };
+}

package/dist/core/runner/park-commit.d.ts

@@ -0,0 +1,108 @@
+/**
+ * The commit-side vocabulary of a durable park: which holder a COMMITTED checkpoint publishes to, the abort-classification
+ * marker the loop stamps on the contaminated siblings, and the deadline arithmetic every mint shares (the retention
+ * defaults and the one TTL sanitizer). Moved whole out of the orchestrator so the boundary-parks phase (resource /
+ * platform / review) and the park-ask phase (the approval park) reach DOWN for the same publication seam and the same
+ * numbers, and the driver keeps reaching down for the marker its harness stamps. Pure: no engine state; the only clock
+ * is the caller's.
+ */
+import type { CheckpointGate, CheckpointToken, PendingAction } from "../checkpoint-store.js";
+import type { WorkspaceHandle } from "../remote-env.js";
+import type { Prepared } from "./contracts.js";
+/** design/74 (HIGH-2): default resource-checkpoint retention (30 days, the spec's
+ *  `RESOURCE_SUSPEND_TTL_SEC`). Stamped onto the checkpoint `deadline` so the durable reaper can GC an
+ *  ORPHANED resource suspend; a legitimate auto-resume fires long before this. Override via
+ *  `TaskSpec.resourceSuspend.ttlMs`. */
+export declare const DEFAULT_RESOURCE_TTL_MS: number;
+/**
+ * design/164 件五 — how long AFTER a governance window frees a `usage_window` checkpoint stays reapable-free.
+ * The retention TTL answers "was this abandoned?"; a usage-window suspend is not abandoned while the window
+ * it waits on is still full, so its deadline is pushed to `retryAfterMs + this`. One hour gives a host's
+ * scheduler a realistic chance to pick the resume up (a cron tick, a queue drain) before the row is
+ * treated as garbage — small next to the 30-day retention it is compared against, and large next to any
+ * polling interval a driver would sanely use.
+ */
+export declare const USAGE_WINDOW_REAP_MARGIN_MS: number;
+/** design/80 D-2 (BLOCKER): abandonment TTL stamped on an UNATTENDED human/irreversible_ask suspend (no
+ *  `durableApproval` = no operator/resolver wired). Without it the checkpoint has `deadline=undefined` and the
+ *  reaper (which filters on a non-null deadline) can NEVER GC it → a pinned session + a stranded paused VM +
+ *  an orphan checkpoint leak forever. A `durableApproval` suspend keeps the operator's `ttlMs` (undefined =
+ *  unbounded by the operator's choice; D-D `terminalAt` is the eventual liveness backstop there). 30 days. */
+export declare const DEFAULT_UNATTENDED_APPROVAL_TTL_MS: number;
+/**
+ * RB-68 (2026-07-25, red probe): a caller-supplied TTL is only a TTL if it is a finite, positive number.
+ * `TaskSpec.durableApproval.ttlMs` / `resourceSuspend.ttlMs` are typed as a bare `number`, and the mint
+ * arithmetic was `Date.now() + ttlMs` with NO validation — so `Number(process.env.APPROVAL_TTL_MS)` on an
+ * unset/malformed env var (a config-center miss, an upstream arithmetic slip) silently produced
+ * `deadline = NaN`. Every reaper comparison is `deadline <= cutoff`, and `NaN <= anything` is FALSE, so a
+ * checkpoint that LOOKS bounded (it carries a ttlMs and a deadline) became permanently IMMORTAL: no reap
+ * cutoff, however far in the future, could ever expire it → a pinned session + a stranded paused VM, and
+ * a misconfigured deployment silently defeating its own abandoned-approval cleanup with no error anywhere.
+ *
+ * Handling follows the codebase's established treatment of malformed numeric config — sanitize to the
+ * documented default rather than throw — `task-registry-shared.ts`'s `TASK_OUTPUT_DEFAULT_CHARS` fallbacks
+ * (non-numeric / non-finite / non-positive all return the documented default) and `media-byte-cap.ts`'s
+ * `!Number.isFinite(limitBytes) || limitBytes <= 0` guard are the two live precedents: garbage in a bound
+ * field must never widen the bound, and
+ * killing an in-flight task over it would cost more than it saves. `undefined` (the deliberate
+ * "unbounded, D-D terminalAt is the backstop" choice) is preserved as-is and is NOT what this rejects.
+ */
+export declare function sanitizedTtlMs(ttlMs: number | undefined): number | undefined;
+/**
+ * WHICH tool call a committed durable park is holding this run — `undefined` when nothing parked, or
+ * when the park that did commit holds no call (a resource slice, a plan review).
+ *
+ * SINGLE derivation on purpose. Two consumers need this answer: the abort-classification seam, which
+ * stamps it into the `details` of the results the loop mints for the contaminated siblings, and the
+ * `tool_end` projection, which puts it on the wire. Reading it from one function keeps the two from
+ * disagreeing about WHICH HOLDER WINS or about what a holder with no call means. They are not otherwise
+ * interchangeable: the frame face applies strictly narrower conditions on top of this answer (see
+ * `tool_end.gatedCallId`), so a frame may omit an id this function returns — never the reverse.
+ *
+ * The frame side must not read the id back out of a tool RESULT even though the marker is there: a
+ * result's `details` is written by the tool (and replaceable by post-tool hooks), so lifting a
+ * cross-call attribution from it would let any failing tool name an arbitrary call and put a phantom
+ * approval wait on someone else's frame. Same rule, same reason, as `settledBy`.
+ *
+ * The two holders are never both set (the commit-side discriminant writes exactly one); they are read
+ * here in assemble-result's slot order so the winner is the same one the terminal status is built from.
+ */
+export declare function gatedCallIdOf(p: Pick<Prepared, "suspendRef" | "reviewRef">): string | undefined;
+/**
+ * The abort-classification marker for the loop's short-circuit "Operation aborted" family: when a gate
+ * committed a durable park this run (`suspendRef` for human/irreversible/content asks, `reviewRef` for
+ * the dry-run/plan-review family), the contaminated sibling frames carry something a consumer can key
+ * on instead of parsing the (contract-stable) result text (ruled 2026-08-04). The commit is published
+ * BEFORE the abort fires, so this read is race-free at mint time.
+ *
+ * `gatedCallId` NAMES the call the gate is holding, so a consumer can attribute a contaminated frame to
+ * its cause instead of inferring the pair from batch adjacency. Absent, never approximated: a park that
+ * holds no tool call (a resource slice, a plan review) publishes no id, and this marker does not invent
+ * one from whatever call happens to be in flight.
+ *
+ * Module-level rather than a closure in `prepareTask` (design/238 D-7: extract, don't accrete) — the
+ * marker's shape and its rules belong beside {@link gatedCallIdOf}, the derivation it reads.
+ */
+export declare function parkContaminationMarker(refs: Pick<Prepared, "suspendRef" | "reviewRef">): Record<string, unknown> | undefined;
+/**
+ * design/76 §2.5 — THE COMMIT-SIDE DISCRIMINANT (v4 MAJOR-A, the load-bearing dry-run fix). Called
+ * AFTER `commitSuspendSaga` returns true (the checkpoint is durably committed) to publish which holder
+ * the run loop reads for the terminal status. Branch on the COMMITTED `gate.kind`: a REVIEW-PAUSE gate
+ * writes `reviewRef` (→ assemble-result slot 8.6 → `status:"needs_review"` / `review.pending`); every
+ * approval/resource gate (human / irreversible_ask / resource_limit / task_done) writes `suspendRef` as
+ * before (→ slot 8.5 → `status:"suspended"`). NEVER both — a review pause that also set `suspendRef`
+ * would assemble as `"suspended"` and make slot 8.6 dead code. The review-pause family is BOTH the
+ * dry-run `{kind:"needs_review"}` gate (design/76 §2.5) AND the design/80 D-B `{kind:"plan_review"}`
+ * gate — both are human-review pauses that share the `needs_review` terminal (a `plan_review` resumes
+ * with a `plan_review` outcome, a `needs_review` with `dry_run_review`; the distinct gate.kind keeps the
+ * resume discriminant unambiguous). (The review checkpoints themselves are minted by a PROFILE, out of
+ * core scope; core only owns this routing seam + the gate/status/resume discriminants.)
+ *
+ * Module-level, taking the holders as a parameter (design/238 D-7: extract, don't accrete) — the
+ * closure form captured nothing else, so hoisting it costs nothing and puts the discriminant beside the
+ * two readers of what it publishes ({@link gatedCallIdOf}, {@link parkContaminationMarker}).
+ */
+export declare function publishCommittedSuspend(refs: Pick<Prepared, "suspendRef" | "reviewRef">, token: CheckpointToken, gate: CheckpointGate, scope: string, remoteHandle: WorkspaceHandle | undefined, checkpointId?: string, 
+/** The COMMITTED row's pendingAction — passed whole, not as a pre-extracted id, so no call site can
+ *  hand this seam an id the committed row does not actually park on. */
+pendingAction?: PendingAction): void;

package/dist/core/runner/park-commit.js

@@ -0,0 +1,32 @@
+export const DEFAULT_RESOURCE_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+export const USAGE_WINDOW_REAP_MARGIN_MS = 60 * 60 * 1000;
+export const DEFAULT_UNATTENDED_APPROVAL_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+export function sanitizedTtlMs(ttlMs) {
+    if (ttlMs === undefined)
+        return undefined;
+    return Number.isFinite(ttlMs) && ttlMs > 0 ? ttlMs : DEFAULT_RESOURCE_TTL_MS;
+}
+export function gatedCallIdOf(p) {
+    if (p.suspendRef.token !== undefined)
+        return p.suspendRef.gatedCallId;
+    if (p.reviewRef.token !== undefined)
+        return p.reviewRef.gatedCallId;
+    return undefined;
+}
+export function parkContaminationMarker(refs) {
+    if (refs.suspendRef.token === undefined && refs.reviewRef.token === undefined)
+        return undefined;
+    const gatedCallId = gatedCallIdOf(refs);
+    return { code: "gate.parked", ...(gatedCallId !== undefined ? { gatedCallId } : {}) };
+}
+export function publishCommittedSuspend(refs, token, gate, scope, remoteHandle, checkpointId, pendingAction) {
+    const ref = gate.kind === "needs_review" || gate.kind === "plan_review" ? refs.reviewRef : refs.suspendRef;
+    ref.token = token;
+    if (checkpointId !== undefined)
+        ref.checkpointId = checkpointId;
+    ref.gate = gate;
+    ref.gatedCallId = pendingAction?.kind === "tool_approval" ? pendingAction.toolCallId : undefined;
+    if (remoteHandle !== undefined)
+        ref.restoreMode = remoteHandle.restoreMode === "park_only" ? "park_only" : "snapshot";
+    ref.scope = scope;
+}

package/dist/core/runner/{prepare-permission-rules.d.ts → permission-rule-lanes.d.ts}

@@ -1,5 +1,6 @@
 /**
- * design/389 — prepare's permission-rule phase: the TWO gate lanes the unified store feeds.
+ * design/389 — the permission-rule LANES the unified store feeds (prepare-path machinery, design/390 L1): the two gate
+ * lanes, and — since the policy-chain phase took the chain assembly — the rule-offer factory every ask-mint site calls.
  *
  * `prepareTask` used to assemble the personal lane inline (a store read + a hand-spliced session
  * overlay + two admission arms) and the org lane from a second seam. Both now read the ONE store query —
@@ -23,8 +24,8 @@
  * silence the ungated-write warning for deployments that wired no policy at all.
  */
 import type { AskRuleEvidence, ToolCallRequest } from "../tool-policy.js";
-import type { OrgGateVerdict, PersistedRuleAnswer, PersistedRuleHit } from "../hooks.js";
-import type { PersistedAllowRule } from "../permission-rule-model.js";
+import { persistedRuleMandateOf, type OrgGateVerdict, type PersistedRuleAnswer, type PersistedRuleHit } from "../hooks.js";
+import type { PersistedAllowRule, RuleOffer, SegmentCoverage } from "../permission-rule-model.js";
 import { type OrgRuleResolution } from "../permission-rule-org.js";
 import type { PermissionRuleStoreProvider } from "../permission-rule-provider.js";
 /** The one SHELL tool the persisted-rule lane speaks for. */
@@ -130,3 +131,108 @@ export declare function createPermissionRuleLanes(cfg: {
      *  lane took the read. */
     onDisclosure: (message: string) => void;
 }): PermissionRuleLanes;
+/** The closed reason set for the rule-offer factory's empty answer (#490 修②) — the same three
+ *  spellings the `AskRequest` and durable-row seats declare, kept at the one factory that fills both.
+ *  Deliberately not exported: this is a wire vocabulary, and its two faces declare it literally (the
+ *  `previewWithheld` precedent) so a consumer reads the closed set on the type it is holding rather
+ *  than through an import. */
+type RuleOffersAbsence = "mandated" | "lane_cannot_speak" | "shadowed";
+/** The surviving-ask facts the rule-offer factory reads (see {@link createRuleOffersOf}): the
+ *  synchronous mint sites spread the surviving decision, which carries them; the park leg threads
+ *  each as its own parameter. */
+interface RuleOffersAskFacts {
+    requiresRealApproval?: boolean;
+    persistedRuleShadowed?: string;
+    decisionReason?: import("../tool-policy.js").DecisionReason;
+    /** #457 ④: an EXPLICIT `ask` permission rule matched this call (design/127 DSL, stamped at
+     *  the rule policy's three matched-ask exits — bare, covering and param). */
+    matchedAskRule?: string;
+    /** #502: the engine-stamped probe mandate (the reversibility probe declared this call's
+     *  demotion structural — for the built-in shell probe, a read outside the session's
+     *  allowed directories). */
+    probeMandated?: boolean;
+    inheritedUnresolved?: boolean;
+    /** The ask is being resolved at an ANCESTOR's frozen approver (the three inherited-lane
+     *  mint sites pass it literally) — this task's rule lane never adjudicates it. */
+    ancestorResolved?: boolean;
+    /** design/375 §5.2②: the surviving ask's engine-stamped per-segment coverage table — the
+     *  batch offer carries exactly the segments this table calls uncovered. Absent ⇒ all
+     *  segments read as uncovered (over-offer, the safe direction). */
+    segmentCoverage?: readonly SegmentCoverage[];
+}
+/**
+ * design/179 §4 — the rule forms that could cover this exact call, for a surface's "stop asking me
+ * this" option (extracted from the prepare body, the spliceSessionOverlayRows precedent; the maker
+ * captures the per-task wiring once and the returned factory serves all five ask-mint sites — the
+ * approval-preview field is a standing example of what happens otherwise: it reached two of the
+ * five, so a delegated child's card was silently poorer than the top-level one).
+ *
+ * Empty unless a rule lane is armed — offering an option that redemption would refuse is worse than
+ * offering none — and empty for any call the lane cannot speak for (a compound, a redirection, a
+ * substitution, or a tool that is not the shell tool).
+ *
+ * Empty, too, on any ask a persisted rule could never CLEAR — "allow rules silence the classifier's
+ * questions, never a mandated one". Two doors, matching the two halves of that boundary:
+ *  · the marks half, judged from the SAME resolved sources the gate input is built from, through the
+ *    gate's own single-source predicate (an operator's shellGate:"always", the tool's own
+ *    egress/irreversibility marks, and — #502 — the PER-CALL member that predicate also takes: a
+ *    demotion this call's reversibility probe declared structural, read off the ask the gate
+ *    stamped rather than off the tool seat, because it is true of one call and not of the seat) —
+ *    a drift here would offer a rule the lane then refuses to honor;
+ *  · the decision half (`ask`, REQUIRED at every mint site so a site added later cannot skip it):
+ *    `requiresRealApproval` (org/governance — only judgment clears it), the shadowed-rule
+ *    disclosure (the standing proof that a matching rule does not clear THIS ask), a hook-raised
+ *    ask (`decisionReason === "hook"` — the lane's own clearing conjuncts refuse hook asks, so a
+ *    rule minted from one would never silence it), an EXPLICIT `ask` rule match (`matchedAskRule`
+ *    — see below), and an inherited-unresolved marked call (the
+ *    ask is an ANCESTOR's authority, which this task's rule lane never adjudicates). Offering
+ *    "stop asking me this" on a card that will keep asking lets a person mint a rule that never
+ *    takes effect where they minted it.
+ *
+ * #457 ④ (CC 2.1.245 toolPolicy 对表, F11: "wildcard `ask` … keeps every matching tool behind a
+ * per-call prompt (no persistent always-allow)") — `matchedAskRule` was the one conjunct of the
+ * lane's own clearing predicate this door did not mirror, and the asymmetry was live: the
+ * persisted-rule lane refuses to clear ANY ask carrying it (`hooks.ts`, the
+ * `decision.matchedAskRule === undefined` conjunct on its allow arm), so a person who wrote a
+ * standing `Bash` `ask` rule and had no allow rule yet was still offered "allow, and stop asking
+ * me this" — and the rule they minted came back on the very next call as a SHADOWED match
+ * (`persistedRuleShadowed`, which this door was already refusing). The offer was only ever
+ * suppressed one call too late, after the useless rule existed. The shadowed conjunct stays: it
+ * covers the person who ALREADY has the allow rule; this one covers the person about to mint it.
+ *
+ * #490 修② — every door above that answers "no offers" now also names WHICH door, on the
+ * `ruleOffersAbsence` seat (`AskRequest`'s and the durable row's, ONE factory so the two faces
+ * cannot disagree). The doctrine it serves is the loud-bad-value one, applied to an absence: a
+ * surface reading an empty card could not tell "there is nothing this lane could offer" from
+ * "offers were deliberately suppressed", and a person reading it could not tell "write the rule
+ * yourself" from "no rule can excuse this approval". The seat is CLOSED
+ * (`mandated | lane_cannot_speak | shadowed`), mutually exclusive with `ruleOffers` by
+ * construction, and structural-door silent (see the first two guards).
+ */
+export declare function createRuleOffersOf(cfg: {
+    /** `permissionRuleLane !== undefined` at wiring time — the armed-lane structural door. */
+    laneArmed: boolean;
+    principal: string | undefined;
+    /** `deps.localOwnerRules === true` — the declared local-owner exception to the anonymous floor. */
+    localOwnerDeclared: boolean;
+    /** The live mark sources the gate input is built from — passed as REFERENCES (read per call, so a
+     *  late-registered tool seat is seen exactly as the gate sees it). */
+    egressTools: {
+        has(name: string): boolean;
+    };
+    irreversibilityTier: {
+        get(name: string): Parameters<typeof persistedRuleMandateOf>[0]["irreversibility"];
+    };
+    shellGatedBash: boolean;
+    taskRoot: string | undefined;
+    /** The live tracked-cwd ref (read per call — the relative-cd resolution base, adversarial-review P1/r3). */
+    cwdRef: {
+        current: string;
+    } | undefined;
+    deniesDirectoryRead: ((directory: string) => boolean) | undefined;
+}): (toolName: string, args: unknown, ask: RuleOffersAskFacts | undefined) => {
+    ruleOffers?: readonly RuleOffer[];
+    ruleOffersAbsence?: RuleOffersAbsence;
+    execCwd?: string;
+};
+export {};

package/dist/core/runner/{prepare-permission-rules.js → permission-rule-lanes.js}

@@ -1,4 +1,5 @@
-import { directoryRuleAdmits, eligiblePersisted, findAdmittingRule, lexicalNormalAbsolutePathOf, segmentCoverageOf } from "../permission-rule-model.js";
+import { persistedRuleMandateOf } from "../hooks.js";
+import { directoryRuleAdmits, eligiblePersisted, findAdmittingRule, lexicalNormalAbsolutePathOf, segmentCoverageOf, suggestRulesForCommand } from "../permission-rule-model.js";
 import { orgRuleVerdictFor } from "../permission-rule-org.js";
 export const PERSISTED_RULE_TOOL = "Bash";
 export const DIRECTORY_RULE_TOOL = "Read";
@@ -138,3 +139,48 @@ export function createPermissionRuleLanes(cfg) {
         : undefined;
     return { personal, org };
 }
+export function createRuleOffersOf(cfg) {
+    return (toolName, args, ask) => {
+        if (!cfg.laneArmed || toolName !== PERSISTED_RULE_TOOL)
+            return {};
+        if ((cfg.principal === undefined || cfg.principal === "") && !cfg.localOwnerDeclared)
+            return {};
+        const closedDoor = (() => {
+            if (ask?.requiresRealApproval === true)
+                return "mandated";
+            if (ask?.persistedRuleShadowed !== undefined)
+                return "shadowed";
+            if (ask?.decisionReason === "hook")
+                return "mandated";
+            if (ask?.matchedAskRule !== undefined)
+                return "shadowed";
+            if (ask?.inheritedUnresolved === true)
+                return "mandated";
+            if (ask?.ancestorResolved === true)
+                return "mandated";
+            return undefined;
+        })();
+        if (closedDoor !== undefined)
+            return { ruleOffersAbsence: closedDoor };
+        if (persistedRuleMandateOf({
+            egress: cfg.egressTools.has(toolName),
+            irreversibility: cfg.irreversibilityTier.get(toolName),
+            shellGated: cfg.shellGatedBash,
+            probeMandated: ask?.probeMandated === true,
+        }) !== undefined) {
+            return { ruleOffersAbsence: "mandated" };
+        }
+        const command = args?.command;
+        if (typeof command !== "string")
+            return { ruleOffersAbsence: "lane_cannot_speak" };
+        const offers = suggestRulesForCommand(command, {
+            ...(ask?.segmentCoverage !== undefined ? { coverage: ask.segmentCoverage } : {}),
+            ...(cfg.taskRoot !== undefined ? { scope: { kind: "project", root: cfg.taskRoot }, cwd: cfg.taskRoot } : {}),
+            ...(cfg.cwdRef?.current !== undefined ? { execCwd: cfg.cwdRef.current } : {}),
+            ...(cfg.deniesDirectoryRead !== undefined ? { deniesDirectoryRead: cfg.deniesDirectoryRead } : {}),
+        });
+        return offers.length > 0
+            ? { ruleOffers: offers, ...(cfg.cwdRef?.current !== undefined ? { execCwd: cfg.cwdRef.current } : {}) }
+            : { ruleOffersAbsence: "lane_cannot_speak" };
+    };
+}

package/dist/core/runner/prepare-acquire-reconcile.d.ts

@@ -22,7 +22,7 @@ import { StoredSession } from "../session.js";
 import type { AcquiredSession, SessionStore } from "../session.js";
 import { type RecoveredOrphan } from "../session-reconcile.js";
 import type { TaskSpec, ToolEffect } from "../types.js";
-import type { PrepareResume } from "./prepare-task.js";
+import type { PrepareResume } from "./contracts.js";
 export interface PrepareAcquireReconcileInput {
     /** borrowed-mutable (service port) — the deployment's session store. This phase's verbs on it are
      *  the acquire/forget half of the session resource protocol: `acquire` per attempt, `forget` to