@sema-agent/core 7.5.2 → 7.6.1

package/dist/core/runner/prepare-wiring-manifest.d.ts

@@ -25,7 +25,8 @@ import type { LockedPreflight } from "../locked-config.js";
 import type { MaterializedMcp } from "../mcp.js";
 import type { SessionStore } from "../session.js";
 import { type ToolResultStore } from "../tool-result-store.js";
-import { type ApprovalSettledBy, type OnAsk, type ToolPolicy } from "../tool-policy.js";
+import { type OnAsk, type ToolPolicy } from "../tool-policy.js";
+import type { GateOutcome } from "../gate-outcome.js";
 import type { RunnerDeps, RuntimeCaps, TaskSpec, ToolEffect, ToolExecuteContext } from "../types.js";
 import { type UsageWindow } from "../usage-window-store.js";
 import { type AutoModeArmReason, type WiringManifest, type WiringManifestMcpEntry } from "../wiring-manifest.js";
@@ -113,9 +114,7 @@ export interface PrepareWiringManifestInput {
     /** borrowed-readonly — the built harness the peer drain binds to. */
     harness: AgentHarness;
     /** borrowed-readonly — the durable-suspend holder; the drain's parked predicate reads `token` at run time. Not written here. */
-    suspendRef: Prepared["suspendRef"];
-    /** borrowed-readonly — the review holder; same read. Not written here. */
-    reviewRef: Prepared["reviewRef"];
+    pausedRef: Prepared["pausedRef"];
     /** borrowed-readonly — the FROZEN approver seat (the notice's liveApprover fact). */
     frozenOnAsk: OnAsk | undefined;
     /** borrowed-readonly — the LIVE half of the inherited chain (the notice reads its content mandates). */
@@ -134,16 +133,9 @@ export interface PrepareWiringManifestResult {
     /** borrowed-mutable — the call ids the gate blocked or suspended (`Prepared.blockedToolCalls`). Writers: the gate; readers
      *  delete one-shot. */
     blockedToolCalls: Set<string>;
-    /** borrowed-mutable — the settlement sideband (`Prepared.approvalSettlement`). Writer: the gate; the frame mint reads and
+    /** borrowed-mutable — the gate-outcome sideband (`Prepared.gateOutcomes`). Writer: the gate station; the frame mint reads and
      *  deletes. Nothing else may write it. */
-    approvalSettlement: Map<string, {
-        settledBy?: ApprovalSettledBy;
-        approver?: string;
-        resolution?: import("../tool-policy.js").AskDenyResolution;
-        autoDenied?: true;
-    }>;
-    /** borrowed-mutable — the bare-human-rejection sideband. Writer: resolveAskBound; the gate handler consumes one-shot. */
-    humanBareRejections: Set<string>;
+    gateOutcomes: Map<string, GateOutcome>;
     /** borrowed-mutable — the turn's halt fact (`Prepared.batchHaltRef`). Writer: the judgment site; cleared at the next request. */
     batchHaltRef: Prepared["batchHaltRef"];
     /** owned — whether any consumer of the blocked set is wired (populate only then). */
@@ -178,8 +170,8 @@ export interface PrepareWiringManifestResult {
  * server the leg's FROZEN entry snapshot declared, in declaration order, joined by name to this leg's
  * materialization statuses. Pure projection — no connection logic, no second look at any transport:
  *  · a status `connected` ⇒ `connected` with the mounted roster size (the intake's post-filter count);
- *  · a status `failed` ⇒ `failed` with the class the materialization stamped ({@link McpFailureCode})
- *    and the remote text SECRET-REDACTED (an HTTP endpoint's error body rides the SDK's message
+ *  · a status `failed` ⇒ `failed` with the failure record the materialization stamped (`errorCode`/`delivered`/
+ *    `httpStatus` = the MCP vocabulary's `McpFailure` spread flat) and the remote text SECRET-REDACTED (an HTTP endpoint's error body rides the SDK's message
  *    verbatim, and a body that echoes the bearer it rejected must not reach a stream consumer),
  *    then neutralized + bounded to the reminder's own 240 (the same bound the once-per-session
  *    ledger applies to that text — one face, one width);

package/dist/core/runner/prepare-wiring-manifest.js

@@ -22,7 +22,7 @@ export function mcpManifestEntries(entries, statuses) {
             name: entry.name,
             ...source,
             status: "failed",
-            ...(status.errorCode !== undefined ? { errorCode: status.errorCode } : {}),
+            ...(status.errorCode !== undefined ? { errorCode: status.errorCode, delivered: status.delivered, ...(status.httpStatus !== undefined ? { httpStatus: status.httpStatus } : {}) } : {}),
             ...(status.error !== undefined ? { error: inlineUntrusted(status.error, 240) } : {}),
             toolCount: 0,
         };
@@ -87,17 +87,17 @@ const ungatedWarnedShapes = new WeakMap();
 function announceDurableGateUnavailable(args) {
     if (!args.forceDurableGate || args.storeWired)
         return;
-    const cause = args.taskStoreNull ? "task_store_null" : "no_deployment_store";
+    const cause = args.taskStoreDisabled ? "task_store_disabled" : "no_deployment_store";
     const inheritedContentMandate = (args.parentConstraints ?? []).some((pc) => pc.contentMandate === true);
     const liveQuestionFace = args.liveQuestionFace && !inheritedContentMandate;
     deliverEngineNotice(args.onNotice, {
         code: "config.durable_gate_unavailable",
         message: `Durable approval gate mandated but unavailable: the runtime entitlement forceDurableGate is in force for this ` +
-            `principal, but ${cause === "task_store_null" ? "this task disabled the checkpoint store (checkpointStore: null)" : "this deployment wired no checkpoint store"}, ` +
+            `principal, but ${cause === "task_store_disabled" ? 'this task disabled the checkpoint store (checkpointStore: "disabled")' : "this deployment wired no checkpoint store"}, ` +
             `so no interactive ask of this task can be parked for a durable answer. Asks resolve on the live chain instead ` +
             `(${args.liveApprover ? "a live approver answers permission asks in-stream" : "permission asks are denied fail-closed — no live approver is wired"}; ` +
             `${liveQuestionFace ? "a live question face answers AskUserQuestion in-stream" : args.liveQuestionFace ? "AskUserQuestion is withheld from the live face by an inherited durable mandate and refused" : "AskUserQuestion has no live face and is refused"}) ` +
-            `and NO durable approval record is written. ${cause === "task_store_null" ? "Run this task with its store, or withdraw the entitlement for principals whose runs are machine-started." : "Wire a checkpoint store on this deployment, or withdraw the entitlement for principals served here."}`,
+            `and NO durable approval record is written. ${cause === "task_store_disabled" ? "Run this task with its store, or withdraw the entitlement for principals whose runs are machine-started." : "Wire a checkpoint store on this deployment, or withdraw the entitlement for principals served here."}`,
         detail: {
             sessionId: args.sessionId,
             runId: args.runId,
@@ -109,7 +109,7 @@ function announceDurableGateUnavailable(args) {
     });
 }
 export function prepareWiringManifest(input) {
-    const { spec, deps, internals, resume, sessionId, runId, hostTaskId, taskScope, hooks, preToolUseObservational, policyLayers, effectivePolicy, handsEnabled, mcp, irreversibleTools, egressTools, toolEffects, ownedEnv, executionEnv, offloadStore, onceLedger, usageWindows, envLifetimeSuspendAt, runtimeCaps, resolvedInteractionPosture, durableQuestionFace, liveQuestionFace, checkpointStore, sessions, modelGateManifest, autoModeArmReason, lockedPreflight, peerLaneRefs, peerLaneActive, harness, suspendRef, reviewRef, frozenOnAsk, liveInheritedGate, delegation } = input;
+    const { spec, deps, internals, resume, sessionId, runId, hostTaskId, taskScope, hooks, preToolUseObservational, policyLayers, effectivePolicy, handsEnabled, mcp, irreversibleTools, egressTools, toolEffects, ownedEnv, executionEnv, offloadStore, onceLedger, usageWindows, envLifetimeSuspendAt, runtimeCaps, resolvedInteractionPosture, durableQuestionFace, liveQuestionFace, checkpointStore, sessions, modelGateManifest, autoModeArmReason, lockedPreflight, peerLaneRefs, peerLaneActive, harness, pausedRef, frozenOnAsk, liveInheritedGate, delegation } = input;
     const onAsk = spec.onAsk ?? deps.onAsk;
     const handWriteTools = handsEnabled && spec.handsReadOnly !== true
         ? Object.keys(HAND_TOOL_EFFECTS).filter((name) => {
@@ -144,8 +144,7 @@ export function prepareWiringManifest(input) {
     }
     const preToolContexts = new Map();
     const blockedToolCalls = new Set();
-    const approvalSettlement = new Map();
-    const humanBareRejections = new Set();
+    const gateOutcomes = new Map();
     const batchHaltRef = {};
     const blockedTracked = Boolean(hooks?.postToolUse || hooks?.preToolUse || hooks?.postToolUseFailure || hooks?.postToolBatch);
     const restoreSurfaceGap = ownedEnv !== undefined && isRemoteExecutionEnv(ownedEnv) && ownedEnv.capabilities.suspendable ? missingRestoreSurface(ownedEnv) : [];
@@ -220,7 +219,7 @@ export function prepareWiringManifest(input) {
             ownTokens: () => internals?.peerSelfRef?.current.ownTokens ?? [],
             refs: peerLaneRefs,
             selfName: () => internals?.explicitAgentName,
-            parked: () => suspendRef.token !== undefined || reviewRef.token !== undefined,
+            parked: () => pausedRef.current !== undefined,
         });
     }
     const parkLaneArmed = wiringManifest.parkLane.effective === true;
@@ -231,7 +230,7 @@ export function prepareWiringManifest(input) {
         resourceSuspendEligible ||
         platformSuspendArmed ||
         spec.enablePlanMode === true;
-    announceDurableGateUnavailable({ onNotice: deps.onNotice, forceDurableGate: runtimeCaps?.forceDurableGate === true, storeWired: checkpointStore !== undefined, taskStoreNull: spec.checkpointStore === null, liveApprover: isLiveApproverSeat(frozenOnAsk), liveQuestionFace: liveQuestionFace !== undefined, parentConstraints: liveInheritedGate?.parentConstraints, sessionId, runId, principal: spec.principal });
+    announceDurableGateUnavailable({ onNotice: deps.onNotice, forceDurableGate: runtimeCaps?.forceDurableGate === true, storeWired: checkpointStore !== undefined, taskStoreDisabled: spec.checkpointStore === "disabled", liveApprover: isLiveApproverSeat(frozenOnAsk), liveQuestionFace: liveQuestionFace !== undefined, parentConstraints: liveInheritedGate?.parentConstraints, sessionId, runId, principal: spec.principal });
     const hookIdentity = mintHookInvocationIdentity({
         sessionId,
         taskId: hostTaskId,
@@ -243,5 +242,5 @@ export function prepareWiringManifest(input) {
     });
     const hookContextConsumerWired = hooks?.preToolUse !== undefined || hooks?.postToolUse !== undefined || hooks?.postToolUseFailure !== undefined;
     const hookEnvFace = hookContextConsumerWired && (ownedEnv ?? deps.executionEnv) != null ? createHookEnvCapabilities(executionEnv) : undefined;
-    return { onAsk, preToolContexts, blockedToolCalls, approvalSettlement, humanBareRejections, batchHaltRef, blockedTracked, incompleteSuspendAdapter, durableSuspendInfraReady, resourceSuspendEligible, usageGovernance, platformSuspendArmed, durableApproval, wiringManifest, parkLaneArmed, gateMachineryActive, hookIdentity, hookEnvFace };
+    return { onAsk, preToolContexts, blockedToolCalls, gateOutcomes, batchHaltRef, blockedTracked, incompleteSuspendAdapter, durableSuspendInfraReady, resourceSuspendEligible, usageGovernance, platformSuspendArmed, durableApproval, wiringManifest, parkLaneArmed, gateMachineryActive, hookIdentity, hookEnvFace };
 }

package/dist/core/runner/runtask.d.ts

@@ -1,124 +1,42 @@
 import { type Model } from "../../internal/llm.js";
-import { type Checkpoint, type CheckpointToken, type PendingSteerEntry, type ReopenReason, type ResumeOutcome } from "../checkpoint-store.js";
-import type { RunInternals } from "./prepare-task.js";
+import { type CheckpointToken, type ResumeOutcome } from "../checkpoint-store.js";
 import { type TaskOutcome } from "../task-outcome.js";
 import { type SideQuerySpec, type SideQueryResult } from "../side-query.js";
 import type { SessionStore } from "../session.js";
 import { type RecoveredOrphan } from "../session-reconcile.js";
-import { type ApprovalSettledBy } from "../tool-policy.js";
+import type { GateOutcome } from "../gate-outcome.js";
+import { type McpDelivered } from "../mcp-failure.js";
 import type { AgentDefinition, ModelRef, RunnerDeps, TaskEvent, TaskResult, TaskSpec, TaskStream } from "../types.js";
-/**
- * Config re-supplied to {@link Runner.resume} (design/45). A suspended task's tools / model / policy /
- * hooks cannot be reconstructed from a checkpoint token (the session stores neither tool implementations
- * nor the hand band), so the caller's trusted control plane re-supplies the same {@link TaskSpec} it ran
- * with — minus the conversation bits: `sessionId` comes from the checkpoint and `objective` is replaced by
- * an internally-generated continuation, so both are omitted.
- */
-export type ResumeTaskConfig = Omit<TaskSpec, "objective" | "sessionId">;
-/** design/45 resume plan threaded from {@link Runner.resume} into the shared run loop. */
-interface ResumeRun {
-    cp: Checkpoint;
-    /**
-     * RB-152 (2026-07-25, 按面收口): did the APPROVED ACTION actually begin executing?
-     *
-     * The reopen compensation used to key on an error-code whitelist (`resume.env_failed` /
-     * `resume.session_not_found` / `resume.tool_unavailable`). That is a proxy for the thing that actually
-     * matters, and every time a NEW way to exit without running the action appeared, the whitelist did not
-     * know about it: a caller's abort landing anywhere between the CAS and `tool.execute` — across
-     * `SessionStore.acquire` (pluggable, cross-network on a durable backend), the MCP reconnect, the env
-     * rebuild, `resumeVM`, tool materialization — produced a `failed` result with NO errorCode, no reopen,
-     * and a human approval consumed for work that never happened. Two rounds of fixes (RB-77, RB-109) each
-     * moved that window rather than closing it, because both extended the whitelist.
-     *
-     * This binds the compensation to the FACT instead: set the instant before `tool.execute` for the gated
-     * call (the same `onExecuteStart` signal the orphan-reconcile split already trusts). Every terminal —
-     * throw OR returned result — asks one question: was the checkpoint consumed while this stayed false?
-     */
-    pendingActionStarted?: boolean;
-    /** Validated against `cp.gate.kind` at the resume entry: human/irreversible_ask→`policy_ask`,
-     *  resource_limit→`resource_limit` (design/74), needs_review→`dry_run_review` (design/76 §2.5),
-     *  plan_review→`plan_review` (design/80 D-B). The gate-match guard in `resumeStream` enforces the
-     *  correlation. design/144 §3: `wake` is the NON-GATE arm — only a checkpoint awaiting NO gate
-     *  decision passes the resume entry with it (gate purity, `wake.gate_pending`); the run loop skips
-     *  `applyResumeDecision` for it (no pending action to resolve) and re-enters via the continuation +
-     *  pendingSteer tail alone. */
-    outcome: Extract<ResumeOutcome, {
-        gate: "policy_ask" | "resource_limit" | "dry_run_review" | "plan_review" | "wake";
-    }>;
-    /** design/144 §3 (X5) — the wake's own operator message, validated (`validatePendingSteer`) at the
-     *  resume entry and carried SEPARATELY from the checkpoint's parked `pendingSteer`: a message-bearing
-     *  wake of a checkpoint that ALSO holds a parked steer must deliver BOTH (park order: parked first,
-     *  wake message second), each under its own trusted framing — the old merge-into-the-slot shape
-     *  silently DISPLACED the parked (undelivered) supervisor steer. Wake outcomes only. */
-    wakeMessage?: Omit<PendingSteerEntry, "seq">;
-    /** design/373 §4.3 (D2) — the userPromptSubmit screen's `additionalContext` for {@link wakeMessage},
-     *  captured at the resume ENTRY (the message is screened once, pre-CAS, on the resuming process's
-     *  hook) and delivered by the drain as the engine's own reminder AHEAD of the wake frame — carrying
-     *  it forward is what keeps the hook single-run (re-screening at the drain would be the double-run
-     *  §4.3-3 reserves for the cross-process parked leg). Present only when a wake message passed a
-     *  screen that supplied context. */
-    wakeMessageHookContext?: string;
-    /** Compensation hook (design/45/49): called iff the resumed run fails with `resume.env_failed` (post-CAS
-     *  workspace `resumeVM` failed) OR `resume.tool_unavailable` (P-7: the approved tool vanished) — in both
-     *  the CAS already consumed the checkpoint but the pending action never ran. `resumeStream` supplies a
-     *  closure that reopens the checkpoint (`resolved → pending`) so a retry re-resumes the SAME suspended work
-     *  instead of losing it to a forced "re-initiate". design/80 D-1 (reopen-by-reason): the `reason` is
-     *  recorded on the reopened row so the next re-resume validates per reason — an `env_failed` reopen must
-     *  replay the persisted winner (a system retry of the approved action), while a `tool_unavailable` reopen
-     *  lets a human re-decide with the tool present (a fresh decision is allowed — preserves P-7). */
-    onEnvRestoreFailed?: (reason: ReopenReason) => Promise<void>;
-    /** RB-471/FR-C1 — set in the run body right after `applyResumeDecision` completes: the negative-
-     *  decision twin of `pendingActionStarted`. A reject/deny consumes its gate BY BEING DELIVERED, and
-     *  this bit is the delivery fact — every throw-arm cause (prepare failure, `session_not_found`, a
-     *  pre-delivery abort) and the walltime-exhausted settle fire BEFORE it is set, so an undelivered
-     *  negative decision still reopens as `env_failed` (the retry replays the persisted decision; it
-     *  never re-asks — design/80 D-1), closing the RB-152/RB-70 loss class the first RB-471 cut reopened. */
-    decisionDelivered?: boolean;
-}
+import type { ResumeRun, ResumeTaskConfig, RunInternals, RunnerSelfSeat } from "./contracts.js";
+export type { ResumeTaskConfig } from "./contracts.js";
 /** The `tool_end` body fields projected from a harness tool result — output/truncated/totalChars via
  *  {@link toolOutputFrom} and the CC card via {@link structuredFrom}. Single construction point for BOTH
  *  the live loop's frames and the resumed batch's frames (`resolvePendingCall` + the deferred-sibling
  *  close): the resumed frames used to carry only `isError`, so a client rendering tool output from frames
  *  showed an empty body for every durable-approved call. Same projection = same source as the transcript.
- *  Also the one place `settledBy` reaches a frame — see the parameter. */
+ *  Also the one place the gate outcome reaches a frame — see the parameter. */
 declare function toolEndBodyFrom(result: unknown, isError: boolean, 
-/** What ended the approval this call was waiting on, supplied by the CALLER of this projection — the
- *  live loop reads it off the gate's per-call sideband, the resumed leg off the decide. Deliberately
- *  a parameter and never derived from `result`: a tool's own `details` (which post-tool hooks may
- *  also replace) is writable by layers that adjudicate nothing, so reading provenance out of it would
- *  let a failing tool claim a person approved it. Omitted ⇒ the caller supplied no source: the call
- *  settled no approval, OR an approval settled whose decider named none (a caller predating the
- *  field) — absence is not a fact about the call (see the `tool_end.settledBy` doc, the one home). */
-settledBy?: ApprovalSettledBy, 
-/** design/252 G-7 — WHOSE settlement, from the same caller and the same channel as `settledBy`, and
- *  for the same reason it is a parameter: an attribution read out of a tool's own result would let a
- *  tool name the person who approved it. Omitted ⇒ this call's settlement named nobody. */
-approver?: string, 
-/** The ask resolver's deny-arm classification — same caller, same engine-owned channel and the same
- *  never-derived-from-`result` posture as the two above. Omitted ⇒ not an ask-resolution deny. */
-resolution?: import("../tool-policy.js").AskDenyResolution, 
+/** The gate's record of the pass that admitted or refused this call, supplied by the CALLER of this
+ *  projection — the live loop reads it off the gate's per-call sideband, the resumed leg off the decide's
+ *  minted record. Deliberately a parameter and never derived from `result`: a tool's own `details`
+ *  (which post-tool hooks may also replace) is writable by layers that adjudicate nothing, so reading
+ *  provenance out of it would let a failing tool claim a person approved it. Omitted ⇒ the call never
+ *  went through the gate (see the `tool_end.gate` doc, the one home). */
+gate?: GateOutcome, 
 /** WHICH call this run's committed durable park is holding ({@link gatedCallIdOf}), for the frames the
- *  abort short-circuits. Same never-derived-from-`result` posture as the three above, and for the
+ *  abort short-circuits. Same never-derived-from-`result` posture as the outcome above, and for the
  *  sharpest version of that reason: this one is an assertion about a DIFFERENT call, so a tool able to
  *  author it could point an approval UI at a call nobody is waiting on. Omitted ⇒ no park is holding a
  *  call (nothing parked, or the park that did holds none), and the frame then carries no id at all. */
-gatedCallIdOfRun?: string, 
-/** #557 — the classifier denial-limit fallback's own auto-deny marker, from the same engine-owned
- *  settlement sideband as `resolution` (same never-derived-from-`result` posture). Omitted ⇒ absent.
- *  The pair `settledBy:"timeout"` + `resolution:"window_expired"` WITHOUT this bit is the approval
- *  factory's own `approvalTimeoutMs` window; a durable park's expiry is neither — the decide lane's
- *  emitter passes no `resolution` at all (see the `tool_end.autoDenied` doc on the event type). */
-autoDenied?: true): {
+gatedCallIdOfRun?: string): {
     output?: unknown;
     truncated?: boolean;
     totalChars?: number;
     structured?: unknown;
     errorCode?: string;
+    delivered?: McpDelivered;
     gatedCallId?: string;
-    settledBy?: ApprovalSettledBy;
-    approver?: string;
-    resolution?: import("../tool-policy.js").AskDenyResolution;
-    autoDenied?: true;
+    gate?: GateOutcome;
 };
 /**
  * scan-1/A1 — the BODY of the synthetic `tool_end` that closes a reconcile-recovered orphan. ONE
@@ -160,7 +78,7 @@ export declare function raceUntilDeadline<T>(p: Promise<T>, deadline: number): P
  * A stateless task runner. Holds shared deps (the external brain, model catalog) and an
  * in-memory session store so that passing a `sessionId` continues a prior conversation.
  */
-export declare class Runner {
+export declare class Runner implements RunnerSelfSeat {
     private deps;
     readonly sessions: SessionStore;
     /** Per-sessionId serialization so two tasks never mutate one session concurrently. */
@@ -440,12 +358,12 @@ export declare class Runner {
      * factory-minted remote/worktree lane captured an already-destroyed env (plain host/static lanes were
      * false-green).
      *
-     * design/49 v1.5 / design/76 §2.5: a SUSPENDED (`suspendRef.token`) or `needs_review` (`reviewRef.token`) pause
+     * design/49 v1.5 / design/76 §2.5: a committed durable pause (`pausedRef.current`, any gate kind)
      * `suspendVM`-paused the env and persisted its `workspaceHandle` into the checkpoint — destroying it would
      * discard the paused VM and make resume fail to restore. Skip teardown; `resume()` rebuilds + `resumeVM`s it. A
      * cancelled pause is reaped via `TaskStream.destroy()` (design/51); an abandoned one is the service container
      * reaper's backstop. The gate here MIRRORS the tail's reap-stash (same durable fact
-     * `suspendRef.token===undefined && reviewRef.token===undefined`), so exactly one path owns the env's fate.
+     * `pausedRef.current === undefined`), so exactly one path owns the env's fate.
      */
     private teardownOwnedEnv;
 }