@sema-agent/core 7.50.2 → 7.51.0

package/dist/core/redaction-passes.js

@@ -0,0 +1,378 @@
+export function summarizeRedactions(findings) {
+    if (findings.length === 0)
+        return "no redactions";
+    const counts = new Map();
+    for (const f of findings) {
+        const label = `${f.kind} (${f.confidence})`;
+        counts.set(label, (counts.get(label) ?? 0) + 1);
+    }
+    const parts = [...counts].map(([label, n]) => `${label} x${n}`);
+    return `${findings.length} redaction${findings.length === 1 ? "" : "s"}: ${parts.join(", ")}`;
+}
+function passZeroMapper(batches) {
+    const cursors = batches.map(() => ({ i: 0, delta: 0 }));
+    return (pos) => {
+        let p = pos;
+        for (let b = batches.length - 1; b >= 0; b--) {
+            const edits = batches[b];
+            const c = cursors[b];
+            let mapped;
+            while (mapped === undefined && c.i < edits.length) {
+                const e = edits[c.i];
+                const outStart = e.at + c.delta;
+                if (p < outStart)
+                    mapped = p - c.delta;
+                else if (p < outStart + e.insertedLen)
+                    mapped = e.at;
+                else {
+                    c.delta += e.insertedLen - e.removedLen;
+                    c.i++;
+                }
+            }
+            p = mapped ?? p - c.delta;
+        }
+        return p;
+    };
+}
+const PREEXISTING_MARKER_RE = /\[redacted(?:-[a-z]+)?\]/g;
+const FORMAT_CHAR_RE = /\p{Cf}/u;
+const MAX_FORMAT_SLOT_SCANS = 64;
+const REDACTED_WHOLE = "[redacted]";
+function finding(pass, span, family) {
+    const f = { kind: pass.kind, confidence: pass.confidence, span, marker: pass.marker, source: pass.source };
+    if (family !== undefined)
+        f.family = family;
+    return f;
+}
+function insertedFor(pass, match, groups) {
+    return typeof pass.replace === "string"
+        ? pass.replace.replace(/\$(\d)/g, (_m, d) => groups[Number(d) - 1] ?? "")
+        : pass.replace(match, ...groups);
+}
+function removedRegion(pass, match, groups, inserted) {
+    if (typeof pass.replace === "string") {
+        const parts = pass.replace.split(/(\$\d)/).filter((p) => p !== "");
+        const isRef = (p) => /^\$\d$/.test(p);
+        const refText = (p) => groups[Number(p[1]) - 1] ?? "";
+        let head = "";
+        for (const p of parts) {
+            if (!isRef(p))
+                break;
+            head += refText(p);
+        }
+        let tail = "";
+        for (let i = parts.length - 1; i >= 0 && isRef(parts[i]); i--)
+            tail = refText(parts[i]) + tail;
+        if (parts.every(isRef))
+            return [0, match.length];
+        if (!match.startsWith(head))
+            head = "";
+        if (!match.endsWith(tail) || head.length + tail.length > match.length)
+            tail = "";
+        return [head.length, match.length - tail.length];
+    }
+    const markerAt = pass.marker === "" ? -1 : inserted.lastIndexOf(pass.marker);
+    const headStop = markerAt < 0 ? inserted.length : markerAt;
+    const tailStop = markerAt < 0 ? inserted.length : inserted.length - markerAt - pass.marker.length;
+    let head = 0;
+    while (head < match.length && head < headStop && match[head] === inserted[head])
+        head++;
+    let tail = 0;
+    while (tail < match.length - head && tail < inserted.length - head && tail < tailStop && match[match.length - 1 - tail] === inserted[inserted.length - 1 - tail])
+        tail++;
+    return [head, match.length - tail];
+}
+const SOLO_SCAN_WORK_PER_CHAR = 8;
+const SOLO_SCAN_WORK_FLOOR = 1 << 17;
+function soloHits(input, passes) {
+    const hits = [];
+    passes.forEach((pass, i) => {
+        const re = new RegExp(pass.re.source, pass.re.flags.includes("g") ? pass.re.flags : `${pass.re.flags}g`);
+        const rescans = pass.family !== undefined;
+        let work = Math.max(SOLO_SCAN_WORK_PER_CHAR * input.length, SOLO_SCAN_WORK_FLOOR);
+        for (let m = re.exec(input); m !== null; m = re.exec(input)) {
+            const at = m.index;
+            const familyAt = () => (typeof pass.family === "function" ? pass.family(input, at) : pass.family);
+            if (rescans) {
+                work -= m[0].length;
+                if (work < 0) {
+                    hits.push({ start: at, end: input.length, marker: pass.marker === "" ? REDACTED_WHOLE : pass.marker, pass: i, family: familyAt(), matchStart: at, matchEnd: input.length });
+                    break;
+                }
+                re.lastIndex = at + 1;
+            }
+            else
+                re.lastIndex = at + Math.max(m[0].length, 1);
+            const inserted = insertedFor(pass, m[0], m.slice(1));
+            if (inserted === m[0])
+                continue;
+            const [a, b] = removedRegion(pass, m[0], m.slice(1), inserted);
+            if (b <= a)
+                continue;
+            const family = familyAt();
+            hits.push({ start: at + a, end: at + b, marker: inserted.slice(a, inserted.length - (m[0].length - b)), pass: i, family, matchStart: at, matchEnd: at + m[0].length });
+        }
+    });
+    return hits;
+}
+function unremovedHits(hits, removals) {
+    const gone = [];
+    for (const r of [...removals].filter((x) => x.end > x.start).sort((x, y) => x.start - y.start || y.end - x.end)) {
+        const last = gone[gone.length - 1];
+        if (last !== undefined && r.start <= last[1])
+            last[1] = Math.max(last[1], r.end);
+        else
+            gone.push([r.start, r.end]);
+    }
+    return hits.filter((h) => {
+        let lo = 0;
+        let hi = gone.length - 1;
+        let at = -1;
+        while (lo <= hi) {
+            const mid = (lo + hi) >> 1;
+            if (gone[mid][0] <= h.start) {
+                at = mid;
+                lo = mid + 1;
+            }
+            else
+                hi = mid - 1;
+        }
+        return at === -1 || gone[at][1] < h.end;
+    });
+}
+function sequentialRemovals(batches) {
+    const removals = [];
+    for (let j = 0; j < batches.length; j++) {
+        const toPassZero = passZeroMapper(batches.slice(0, j));
+        for (const e of batches[j]) {
+            const start = toPassZero(e.at + e.head);
+            const end = toPassZero(e.at + e.removedLen - e.tail);
+            removals.push({ start, end: Math.max(start, end), marker: e.inserted.slice(e.head, e.insertedLen - e.tail), pass: e.pass, family: e.family });
+        }
+    }
+    return removals;
+}
+function renderRemovals(input, removals) {
+    const sorted = removals.filter((r) => r.end > r.start || r.marker !== "").sort((x, y) => x.start - y.start || y.end - x.end);
+    const edits = [];
+    let out = "";
+    let cursor = 0;
+    for (let i = 0; i < sorted.length;) {
+        const start = sorted[i].start;
+        let end = sorted[i].end;
+        let widest;
+        for (; i < sorted.length && (sorted[i].start < end || sorted[i].start === start || (sorted[i].marker === "" && sorted[i].start === end)); i++) {
+            const r = sorted[i];
+            if (r.end > end)
+                end = r.end;
+            if (r.marker !== "" && (widest === undefined || r.end - r.start > widest.end - widest.start))
+                widest = r;
+        }
+        const marker = widest?.marker ?? REDACTED_WHOLE;
+        out += input.slice(cursor, start) + marker;
+        cursor = end;
+        edits.push({ at: start, removedLen: end - start, insertedLen: marker.length, inserted: marker, family: widest?.family, head: 0, tail: 0, pass: widest?.pass ?? sorted[i - 1].pass });
+    }
+    return { out: out + input.slice(cursor), edits };
+}
+function runPasses(input, passes, findings, toOriginal) {
+    const batches = [];
+    let cur = input;
+    passes.forEach((pass, passIndex) => {
+        const edits = [];
+        const passInput = cur;
+        const toPassZero = passZeroMapper(batches.slice());
+        cur = cur.replace(pass.re, (...args) => {
+            const match = args[0];
+            const offset = args[args.length - 2];
+            const groups = args.slice(1, -2);
+            const inserted = insertedFor(pass, match, groups);
+            if (inserted === match)
+                return inserted;
+            const family = typeof pass.family === "function" ? pass.family(passInput, offset) : pass.family;
+            if (findings !== undefined)
+                findings.push({ pass: passIndex, f: finding(pass, [toOriginal(toPassZero(offset)), toOriginal(toPassZero(offset + match.length))], family) });
+            const [a, b] = removedRegion(pass, match, groups, inserted);
+            edits.push({ at: offset, removedLen: match.length, insertedLen: inserted.length, inserted, family, head: a, tail: match.length - b, pass: passIndex });
+            return inserted;
+        });
+        batches.push(edits);
+    });
+    return { out: cur, batches };
+}
+function applyPasses(input, passes, report, toOriginal, disjoint = false) {
+    const found = report === undefined ? undefined : [];
+    const plain = runPasses(input, passes, found, toOriginal);
+    const solo = soloHits(input, passes);
+    const sequential = solo.length === 0 ? [] : sequentialRemovals(plain.batches);
+    const outer = unremovedHits(solo, sequential);
+    const mappable = !disjoint || replacedSpans(plain.batches) !== undefined;
+    const whole = outer.length === 0 && mappable ? undefined : renderRemovals(input, [...sequential, ...outer]);
+    if (whole === undefined || (whole.out === plain.out && mappable)) {
+        if (report !== undefined)
+            report.findings.push(...found.map((x) => x.f));
+        return plain;
+    }
+    if (report !== undefined) {
+        const seen = new Set(found.map((x) => `${x.pass}:${x.f.span[0]}:${x.f.span[1]}`));
+        for (const h of outer) {
+            const span = [toOriginal(h.matchStart), toOriginal(h.matchEnd)];
+            const key = `${h.pass}:${span[0]}:${span[1]}`;
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            found.push({ pass: h.pass, f: finding(passes[h.pass], span, h.family) });
+        }
+        found.sort((x, y) => x.pass - y.pass || x.f.span[0] - y.f.span[0]);
+        report.findings.push(...found.map((x) => x.f));
+    }
+    return { out: whole.out, batches: [whole.edits] };
+}
+function replacedSpans(batches) {
+    const spans = [];
+    for (let j = 0; j < batches.length; j++) {
+        const toPassZero = passZeroMapper(batches.slice(0, j));
+        for (const e of batches[j]) {
+            const s0 = toPassZero(e.at);
+            const e0 = toPassZero(e.at + e.removedLen);
+            if (e0 - s0 !== e.removedLen)
+                return undefined;
+            spans.push({ start: s0, end: e0, inserted: e.inserted, pass: e.pass, family: e.family });
+        }
+    }
+    spans.sort((a, b) => a.start - b.start);
+    for (let i = 1; i < spans.length; i++)
+        if (spans[i].start < spans[i - 1].end)
+            return undefined;
+    return spans;
+}
+export function runRedactionPasses(input, passes, report) {
+    if (report !== undefined && report.preexistingMarkers === undefined) {
+        report.preexistingMarkers = input.match(PREEXISTING_MARKER_RE)?.length ?? 0;
+    }
+    if (!FORMAT_CHAR_RE.test(input))
+        return applyPasses(input, passes, report, (pos) => pos).out;
+    const viewChars = [];
+    const viewToOriginal = [];
+    const formatAtSlot = [];
+    const charStartOffsets = [];
+    {
+        let orig = 0;
+        let viewOff = 0;
+        let slotBuf = "";
+        for (const ch of input) {
+            if (FORMAT_CHAR_RE.test(ch)) {
+                slotBuf += ch;
+            }
+            else {
+                formatAtSlot.push(slotBuf);
+                slotBuf = "";
+                viewToOriginal.push(orig);
+                charStartOffsets.push(viewOff);
+                viewChars.push(ch);
+                viewOff += ch.length;
+            }
+            orig += ch.length;
+        }
+        formatAtSlot.push(slotBuf);
+        viewToOriginal.push(input.length);
+        charStartOffsets.push(viewOff);
+    }
+    const view = viewChars.join("");
+    const offsetToCharIndex = new Map();
+    charStartOffsets.forEach((off, idx) => offsetToCharIndex.set(off, idx));
+    const toOriginal = (pos) => {
+        const idx = offsetToCharIndex.get(pos);
+        return idx === undefined ? input.length : viewToOriginal[idx];
+    };
+    const { batches } = applyPasses(view, passes, report, toOriginal, true);
+    const viewSpans = replacedSpans(batches);
+    if (viewSpans === undefined)
+        return REDACTED_WHOLE;
+    const spans = viewSpans.map((sp) => {
+        const startIdx = offsetToCharIndex.get(sp.start) ?? viewChars.length;
+        const endIdx = offsetToCharIndex.get(sp.end) ?? viewChars.length;
+        const lastIdx = endIdx - 1;
+        const endOrig = lastIdx >= startIdx && lastIdx < viewChars.length ? viewToOriginal[lastIdx] + viewChars[lastIdx].length : viewToOriginal[startIdx];
+        return { start: viewToOriginal[startIdx], end: endOrig, inserted: sp.inserted };
+    });
+    const viewOffsetToOriginal = (viewStart, viewEnd) => {
+        const startIdx = offsetToCharIndex.get(viewStart) ?? viewChars.length;
+        const endIdx = offsetToCharIndex.get(viewEnd) ?? viewChars.length;
+        const lastIdx = endIdx - 1;
+        const endOrig = lastIdx >= startIdx && lastIdx < viewChars.length ? viewToOriginal[lastIdx] + viewChars[lastIdx].length : viewToOriginal[startIdx];
+        return { start: viewToOriginal[startIdx], end: endOrig };
+    };
+    const cutOffsets = [];
+    for (let k = 1; k < viewChars.length; k++)
+        if (formatAtSlot[k] !== "")
+            cutOffsets.push(charStartOffsets[k]);
+    if (cutOffsets.length > MAX_FORMAT_SLOT_SCANS)
+        return REDACTED_WHOLE;
+    const extra = [];
+    const rawSpans = replacedSpans(applyPasses(input, passes, undefined, (pos) => pos, true).batches);
+    if (rawSpans !== undefined)
+        extra.push(...rawSpans);
+    for (const cut of cutOffsets) {
+        const cutSpans = replacedSpans(applyPasses(view.slice(cut), passes, undefined, (pos) => pos, true).batches);
+        if (cutSpans === undefined)
+            continue;
+        for (const c of cutSpans) {
+            const o = viewOffsetToOriginal(c.start + cut, c.end + cut);
+            extra.push({ ...c, start: o.start, end: o.end });
+        }
+    }
+    extra.sort((a, b) => a.start - b.start);
+    const firstEndingAfter = (pos) => {
+        let lo = 0;
+        let hi = spans.length;
+        while (lo < hi) {
+            const mid = (lo + hi) >> 1;
+            if (spans[mid].end > pos)
+                hi = mid;
+            else
+                lo = mid + 1;
+        }
+        return lo;
+    };
+    for (const r of extra) {
+        const at = firstEndingAfter(r.start);
+        const hit = spans[at];
+        if (hit !== undefined && hit.start < r.end) {
+            if (r.start < hit.start)
+                hit.start = r.start;
+            if (r.end > hit.end)
+                hit.end = r.end;
+            let next = at + 1;
+            while (next < spans.length && spans[next].start < hit.end)
+                hit.end = Math.max(hit.end, spans[next++].end);
+            if (next > at + 1)
+                spans.splice(at + 1, next - at - 1);
+            continue;
+        }
+        spans.splice(at, 0, { start: r.start, end: r.end, inserted: r.inserted });
+        if (report !== undefined)
+            report.findings.push(finding(passes[r.pass], [r.start, r.end], r.family));
+    }
+    let result = "";
+    let cursor = 0;
+    for (const sp of spans) {
+        result += input.slice(cursor, sp.start) + sp.inserted;
+        cursor = sp.end;
+    }
+    result += input.slice(cursor);
+    return result;
+}
+const BRACKET_MARKER = { "url-credentials": "[redacted-credentials]" };
+const bracketMarker = (kind) => BRACKET_MARKER[kind] ?? "[redacted]";
+const capturesLabel = (re) => new RegExp(`${re.source}|`).exec("").length > 1;
+export function egressPasses(groups, replacers = {}) {
+    return groups.map((rows) => {
+        const head = rows[0];
+        const marker = bracketMarker(head.kind);
+        const re = rows.length === 1 ? head.match : new RegExp(rows.map((r) => `(?:${r.match.source})`).join("|"), head.match.flags);
+        const sticky = rows.map((r) => ({ id: r.id, re: new RegExp(r.match.source, r.match.flags.replace("g", "") + "y") }));
+        const family = rows.length === 1 ? head.id : (input, at) => sticky.find((s) => ((s.re.lastIndex = at), s.re.test(input)))?.id ?? head.id;
+        return { kind: head.kind, confidence: head.confidence, marker, source: head.source, re, replace: replacers[head.kind] ?? (capturesLabel(head.match) ? `$1${marker}` : marker), family };
+    });
+}

package/dist/core/remote-env.d.ts

@@ -319,9 +319,10 @@ export interface RemoteExecutionEnv extends ExecutionEnv {
         /** True iff this adapter's {@link FileSystem.canonicalPath} is the AUTHORITY on where a path lands —
          *  it answers for the very filesystem the commands run on, and a failure to answer is a failure of
          *  the resolver rather than a namespace it cannot see into. Optional, and absent is not a
-         *  declaration: an adapter that says nothing keeps the reading every adapter has had, in which a
-         *  chain nothing could be established about leaves the lexical verdict standing. Declaring it says
-         *  the opposite — that an unanswerable chain is a question, not an absence — and the read
+         *  declaration: an adapter that says nothing keeps the lexical verdict for a chain its resolver answers
+         *  `not_supported` (no file face); a resolver that FAILS (any other non-answer) is a failure either way —
+         *  the read station records it and the command is unanswered. Declaring it says that even an
+         *  unanswerable chain is a question, not an absence — and the read
          *  boundary's execute-time recheck then refuses rather than passing the written spelling through.
          *  Read STRICTLY through {@link canonicalPathIsAuthoritative}, like every other capability whose
          *  `true` changes what a containment leg does; a wrong-SHAPE value reads absent and is announced. */

package/dist/core/resume-startup-cause.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Why a resume could not run its approved action — ONE reading of the failure's code, shared by every
+ * consumer that has to act on it: the reopen compensation (which {@link ReopenReason} a consumed
+ * checkpoint returns to pending under) and the parked-resume receipt (the `cause` its caller branches on).
+ * The answer is read from the failure's CODE — a thrown value's `cause` chain, or a failed result's
+ * terminal code — never from its sentence; a code this table does not name reads as ABSENT (not known),
+ * which each consumer answers in its own documented way rather than with a guessed cause.
+ *
+ *  · `environment` — the leg's infrastructure failed (the workspace restore, an abort): the decision is
+ *    untouched, and a retry replays it;
+ *  · `session_gone` — the resumed agent's transcript session is missing;
+ *  · `tool_unavailable` — the approved tool is not available to the resumed leg (gone, replaced by a
+ *    different contract, or an inherited tool the drive cannot hand over): this approval cannot run, and a
+ *    fresh decision resolves it;
+ *  · `configuration` — the deployment's configuration refuses the resumed leg (a `config.*` door, the
+ *    pre-claim configuration screen, a re-supplied constraint chain that is missing or does not match its
+ *    installation record): a retry under the same configuration fails the same way;
+ *  · `decision_rejected` — the supplied decision does not fit the checkpoint (another gate's answer, an
+ *    unsafe payload, an input the constraints refuse): correct the decision and resubmit.
+ */
+/**
+ * design/80 D-1: why a consumed checkpoint was {@link import("./checkpoint-store.js").CheckpointStore.reopen | reopened}
+ * (resolved → pending). The reason drives re-resume validation (§3 invariant #1): an `env_failed` reopen is a SYSTEM
+ * RETRY of the ALREADY-APPROVED action — the re-resume MUST replay the persisted
+ * {@link import("./checkpoint-store.js").ResolvedOutcome} winner, never a new vote — while a `tool_unavailable` reopen
+ * (the action could not run, may now be invalid — P-7) lets a human RE-DECIDE with the tool present, so a fresh
+ * operator decision IS allowed.
+ *
+ * `constraint_rejected` (F-012 L3) carries the same FRESH-REDECISION semantics as `tool_unavailable`:
+ * a resolve was retracted because its decided INPUT failed a constraint re-adjudication (a frozen
+ * ancestor projection / resume-edit policy denied the approver's edit) — the ask itself is unconsumed,
+ * so the returned-to-pending row takes a fresh operator decision, never a forced replay of the
+ * rejected one. Core's own edit re-adjudication runs PRE-CAS (nothing to reopen there); this reason
+ * exists for a deployment lane that discovers the same rejection only after its own resolve landed
+ * and must return the row to pending without inventing an out-of-vocabulary reason.
+ *
+ * `config_refused` carries the same FRESH-REDECISION semantics: the deployment's configuration refused
+ * the resumed leg before its approved action started, so a retry under the same configuration fails the
+ * same way — it is not a system retry, and the row takes a fresh decision (or the same one again once the
+ * configuration is corrected). Which reason a failure reopens under is {@link reopenReasonOf}'s answer.
+ */
+export declare const REOPEN_REASONS: readonly ["env_failed", "tool_unavailable", "constraint_rejected", "config_refused"];
+export type ReopenReason = (typeof REOPEN_REASONS)[number];
+export declare const RESUME_STARTUP_CAUSES: readonly ["environment", "session_gone", "tool_unavailable", "configuration", "decision_rejected"];
+export type ResumeStartupCause = (typeof RESUME_STARTUP_CAUSES)[number];
+/** The cause a resume failure's code names; `undefined` when the code is absent or the table does not
+ *  name it. Every `config.*` code is a configuration door's refusal. */
+export declare function resumeStartupCauseOf(code: string | undefined): ResumeStartupCause | undefined;
+/**
+ * The reason a consumed checkpoint whose approved action never started returns to pending under. A failure
+ * whose cause is not known reopens as `env_failed`: the leg went away before the action ran, the human's
+ * decision is untouched, and the retry replays it.
+ */
+export declare function reopenReasonOf(cause: ResumeStartupCause | undefined): ReopenReason;
+/** What the result of a returned resume leg says after its checkpoint was reopened, per reason. */
+export declare function reopenedUnstartedSentence(reason: ReopenReason): string;

package/dist/core/resume-startup-cause.js

@@ -0,0 +1,43 @@
+export const REOPEN_REASONS = Object.freeze(["env_failed", "tool_unavailable", "constraint_rejected", "config_refused"]);
+export const RESUME_STARTUP_CAUSES = Object.freeze(["environment", "session_gone", "tool_unavailable", "configuration", "decision_rejected"]);
+const CAUSE_OF_CODE = new Map([
+    ["resume.env_failed", "environment"],
+    ["checkpoint.resume_aborted", "environment"],
+    ["resume.session_not_found", "session_gone"],
+    ["resume.tool_unavailable", "tool_unavailable"],
+    ["resume.tool_contract_mismatch", "tool_unavailable"],
+    ["checkpoint.config_refused", "configuration"],
+    ["resume.parent_constraint_missing", "configuration"],
+    ["resume.parent_constraint_mismatch", "configuration"],
+    ["checkpoint.gate_mismatch", "decision_rejected"],
+    ["checkpoint.invalid_outcome", "decision_rejected"],
+    ["resume.constraint_rejected", "decision_rejected"],
+    ["resume.constraint_unprojectable", "decision_rejected"],
+]);
+export function resumeStartupCauseOf(code) {
+    if (code === undefined)
+        return undefined;
+    return CAUSE_OF_CODE.get(code) ?? (code.startsWith("config.") ? "configuration" : undefined);
+}
+const REOPEN_REASON_OF_CAUSE = {
+    environment: "env_failed",
+    session_gone: "env_failed",
+    tool_unavailable: "tool_unavailable",
+    configuration: "config_refused",
+    decision_rejected: "constraint_rejected",
+};
+export function reopenReasonOf(cause) {
+    return cause === undefined ? "env_failed" : REOPEN_REASON_OF_CAUSE[cause];
+}
+export function reopenedUnstartedSentence(reason) {
+    switch (reason) {
+        case "env_failed":
+            return "the approved action never started, so the checkpoint was REOPENED (pending): the same approval can be resumed again, do not ask for a fresh one";
+        case "config_refused":
+            return "the approved action never started, so the checkpoint was REOPENED (pending): the deployment's configuration refused the resumed leg, so resuming under the same configuration fails the same way — correct the configuration, then resume, or decide afresh";
+        case "tool_unavailable":
+            return "the approved action never started, so the checkpoint was REOPENED (pending): the approved tool is not available to the resumed leg, so this approval cannot run — decide afresh";
+        case "constraint_rejected":
+            return "the approved action never started, so the checkpoint was REOPENED (pending): the decided input was refused, so decide afresh";
+    }
+}

package/dist/core/rule-denial-sentence.d.ts

@@ -59,8 +59,8 @@ export declare function ruleSourcePhrase(source: RuleDenialSource): string;
  * head rather than spelling a second grammar.
  *
  * - `tool` — named when the sentence stands alone; omitted when a carrier sentence already named the call.
- * - `rule` — the rule's own text, when the source has one to quote (a permission rule does; a session
- *   policy row is structured fields, not a rule DSL, so it does not).
+ * - `rule` — the rule's own text, when the source has one to quote (a permission rule does; a session rule's entry is
+ *   stored data and is not quoted onto a sentence that reaches the model).
  * - `origin` — where in that store's layering the row was written (e.g. a settings layer's key path).
  * - `detail` — WHY this call failed the rule, when the source word alone does not say it (an allowlist
  *   miss, a write the confinement cannot place, the refusing layer's own sentence).

package/dist/core/runner/announce-once-ledger.js

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-import { redactSecrets } from "../untrusted-egress.js";
+import { egressText } from "../untrusted-egress.js";
 import { inlineUntrusted } from "../untrusted-text.js";
 import { thrownText } from "../thrown-value.js";
 export const ANNOUNCE_ONCE_MAX_DIGESTS = 200;
@@ -11,7 +11,7 @@ export function warningDigest(err) {
     const e = err;
     const code = typeof e?.code === "string" ? e.code : "";
     const message = thrownText(err);
-    return announceDigest(code, redactSecrets(message));
+    return announceDigest(code, egressText("same-principal", message));
 }
 export function droppedToolDigest(d) {
     return announceDigest(DROPPED_TOOL_MODEL_LANE, `${d.server}\n${d.tool}\n${d.reason}`);

package/dist/core/runner/classifier-ladder.d.ts

@@ -34,7 +34,8 @@
  */
 import type { AssistantMessage, Model } from "../../internal/llm.js";
 import { type AutoModeClassified } from "../auto-mode.js";
-import type { ClassifierUnavailableInfo, ClassifierUnavailableSeat } from "../classifier-unavailable-arm.js";
+import { type ClassifierUnavailableInfo, type ClassifierUnavailableSeat } from "../classifier-unavailable-arm.js";
+import type { ApprovalRoute } from "../wiring-manifest.js";
 import type { EngineNotice, RunnerDeps } from "../types.js";
 /**
  * The rungs a classification walks, in order: the classifier seat, and — under `classifierFallback: "main"` (the
@@ -112,9 +113,13 @@ export declare function announceClassifierRoleDefaulted(args: {
 /**
  * The `classifier.unavailable` notice — a classification that could not RULE (the classifier leg failed, its per-level
  * budget ran out, or it replied with no verdict — `parse_error`; the code name predates that third cause) and where the
- * call went: `"asked"` = on down the ask chain to this leg's approval seat (a person or a durable park decides; the
- * handed-on ask carries `requiresRealApproval` and `classifierNoRuling`, so no automatic lane answers it), `"denied"` =
- * refused (no approval seat: nobody to ask — a reply with no verdict is then also counted on the denial limit). Audience `user`: the refusal is the session user's own
+ * call went, read off the station's ONE route word (`ApprovalRoute`): `live_approver` = on to the live approver now,
+ * `durable_park` = on to the durable park (the notice is minted at the fork: it states the route, never whether the park
+ * then commits) — both are `disposition: "asked"` (the handed-on ask carries
+ * `requiresRealApproval` and `classifierNoRuling`, so no automatic lane answers it), `none` = `"denied"`, refused — no
+ * approver and no park facility (a reply with no verdict is then also counted on the denial limit). The sentence names the
+ * route; the detail carries its projection (`disposition`), and the route itself is the run's published seat word
+ * (`wiring_manifest.ask.effective`). Audience `user`: the refusal is the session user's own
  * call, and on a lane with no approval face (`-p`) this line is the only place they hear why it did not run. Once
  * per classification that could not answer, from both classifier stations (the leg's gate and an ancestor's frozen
  * classifier in the policy fold) — a call judged by more than one classifier can carry one line per classifier. The line
@@ -131,10 +136,10 @@ export declare function classifierUnavailableNotice(args: ClassifierUnavailableI
     sessionId?: string;
     runId?: string;
 }): EngineNotice;
-/** A classifier station's fork facts, wired once per leg: whether an ask the station hands on reaches a person, and
- *  the `classifier.unavailable` notice through the one throat. Both stations (the gate, the inherited fold) take it. */
+/** A classifier station's fork facts, wired once per leg: the route an ask the station hands on takes, and the
+ *  `classifier.unavailable` notice through the one throat. Both stations (the gate, the inherited fold) take it. */
 export declare function classifierUnavailableSeat(args: ClassifierUnavailableStation & {
-    approvalSeat: boolean;
+    route: ApprovalRoute;
     onNotice: RunnerDeps["onNotice"];
     sessionId?: string;
     runId?: string;
@@ -142,12 +147,11 @@ export declare function classifierUnavailableSeat(args: ClassifierUnavailableSta
 /** Which station forked (`leg` — the leg's gate, on its own approval seat; `ancestor` — an ancestor's frozen classifier in
  *  the policy fold, on that ancestor's frozen approver) and the per-level budget its classifier held, when stated.
  *
- *  ONE question at both stations — does the route a handed-on ask takes from HERE end at a person — asked of two routes:
- *  the leg's gate hands its ask down the leg's own chain (`askReachesPerson(wiring_manifest.ask)`: a live approver, or the
- *  durable park); the inherited station resolves at the ancestor's frozen approver, whose only road to a person is being
- *  a live function (`isLiveApproverSeat`: a blanket or absent seat there ends in a refusal, and the leg's park is reached
- *  only through a live approver's `unavailable`). Reading the leg's route at the inherited station would hand the ask to a
- *  frozen seat that cannot answer it. */
+ *  ONE question at both stations, ONE answer function (`approvalRouteOf`) — where does a handed-on ask go from HERE — asked
+ *  of two seats: the leg's gate hands its ask down the leg's own chain (`approvalRouteOf(wiring_manifest.ask)`: its live
+ *  approver, or the durable park); the inherited station resolves at the ancestor's frozen approver
+ *  (`frozenApproverRoute`: the same table with no park — a blanket or absent seat there ends in a refusal, and the leg's
+ *  park is reached only through a live approver's `unavailable`). */
 export interface ClassifierUnavailableStation {
     station: "leg" | "ancestor";
     budgetMs?: number;

package/dist/core/runner/classifier-ladder.js

@@ -2,6 +2,7 @@ import { sameRouteIdentity } from "../../brain/route-adjudicator.js";
 import { thinkingOffSpelled } from "../../brain/reasoning.js";
 import { AUTO_MODE_CLASSIFIER_CONTRACT_BROKEN_AFTER, AUTO_MODE_CLASSIFIER_LOW_REASONING_BUDGET_TOKENS, AUTO_MODE_CLASSIFIER_MAX_TOKENS, AUTO_MODE_CLASSIFIER_THINK_BUDGET_TOKENS } from "../auto-mode-defaults.js";
 import { autoModeClassifierFallbackOf, parseAutoModeResponse } from "../auto-mode.js";
+import { classifierUnavailableDispositionOf } from "../classifier-unavailable-arm.js";
 import { DEFAULT_TIER_ORDER, expandTiers, resolveTaskModel, roleSpecNamesModel } from "../roles.js";
 import { emitTrace } from "../trace.js";
 import { deliverEngineNotice } from "../types.js";
@@ -101,13 +102,14 @@ export function classifierUnavailableNotice(args) {
         : args.cause === "parse_error"
             ? args.station === "ancestor" ? `${whose} replied without a verdict` : "the classifier's reply carried no verdict"
             : `${whose} could not run (error)`;
-    const next = args.disposition === "asked"
-        ? args.station === "ancestor"
-            ? "so the call was handed on to that layer's approver rather than refused by the classifier."
-            : "so the call was handed on to a person (a live approver or a durable park) rather than refused by the classifier."
-        : (args.station === "ancestor" ? "and that layer has no live approver" : "and this run has no approval seat") +
-            ", so the call was refused and did not run." +
-            (args.cause === "timeout" ? " A deployment on a slow gateway raises the budget." : "");
+    const seatOwner = args.station === "ancestor" ? "that layer's" : "this run's";
+    const next = args.route === "live_approver"
+        ? `so the call was handed on to ${seatOwner} live approver rather than refused by the classifier.`
+        : args.route === "durable_park"
+            ? `so the call was handed on to ${seatOwner} durable approval park, for a person to answer later, rather than refused by the classifier.`
+            : (args.station === "ancestor" ? "and that layer has no live approver" : "and this run has no approver and no park facility") +
+                ", so the call was refused and did not run." +
+                (args.cause === "timeout" ? " A deployment on a slow gateway raises the budget." : "");
     return {
         code: "classifier.unavailable",
         message: `auto mode could not judge "${args.toolName}": ${why}, ${next}`,
@@ -115,15 +117,15 @@ export function classifierUnavailableNotice(args) {
             toolName: args.toolName,
             toolCallId: args.toolCallId,
             cause: args.cause,
-            disposition: args.disposition,
+            disposition: classifierUnavailableDispositionOf(args.route),
             ...(args.sessionId !== undefined ? { sessionId: args.sessionId } : {}),
             ...(args.runId !== undefined ? { runId: args.runId } : {}),
         },
     };
 }
 export function classifierUnavailableSeat(args) {
-    const { approvalSeat, onNotice, sessionId, runId, station, budgetMs } = args;
-    return { approvalSeat, onUnavailable: (info) => deliverEngineNotice(onNotice, classifierUnavailableNotice({ ...info, station, ...(budgetMs !== undefined ? { budgetMs } : {}), ...(sessionId !== undefined ? { sessionId } : {}), ...(runId !== undefined ? { runId } : {}) })) };
+    const { route, onNotice, sessionId, runId, station, budgetMs } = args;
+    return { route, onUnavailable: (info) => deliverEngineNotice(onNotice, classifierUnavailableNotice({ ...info, station, ...(budgetMs !== undefined ? { budgetMs } : {}), ...(sessionId !== undefined ? { sessionId } : {}), ...(runId !== undefined ? { runId } : {}) })) };
 }
 function classifierFallbackAnnouncer(args) {
     const announced = new Set();