@sema-agent/core 7.51.2 → 7.53.0

package/dist/core/runner/session-rule-policy.d.ts

@@ -1,7 +1,7 @@
 import type { ExecutionEnv } from "../../internal/harness-types.js";
 import type { ToolEffect } from "../types.js";
 import type { NamedToolPolicy } from "../tool-policy.js";
-import { type SessionPermissionRules, type SessionPolicyStore, type StoredSessionRules } from "../session-policy-store.js";
+import { type SessionPermissionRules, type SessionPolicyStore, type SessionRuleEntryField, type StoredSessionRules } from "../session-policy-store.js";
 import type { PathRuleBases } from "../permission-rule-model.js";
 /** The FULL path-confinable write-tool set: every catalog tool declaring a write path target — `Write` / `Edit`
  *  (target `file_path`) and `NotebookEdit`, whose write target is `notebook_path` and is extracted by the shared
@@ -91,7 +91,7 @@ export interface SessionRuleSource {
  * the turn-boundary read-visibility query reuses one synthetic id for every path it screens and for every
  * turn of the run. The entry is taken ONCE, and a claimed snapshot is served only while its `rev` still
  * stands at the enforced floor; a claim from a later adjudication, whose floor has moved on, falls through
- * to a fresh read. A real tool call's id is minted per call and never repeats.
+ * to a fresh read. A real call's id is the provider's: unique within one assistant response only (`brain/tool-call-id.ts`).
  */
 export declare function createLiveSessionRules(store: SessionPolicyStore, floor: {
     sessionId: string;
@@ -112,8 +112,8 @@ export declare function createLiveSessionRules(store: SessionPolicyStore, floor:
  *  - `toolAllow` (if set) → deny any call no entry admits (the matcher's allow reading in the `narrowing` posture: every
  *    segment of a command line named by an entry; never the allow layer's auto-mode strip), naming the uncovered segment.
  *  - an entry that reads as nothing → in no row (it guards and grants nothing; the prepare-time audit names it, or
- *    `onEarlierGrammar`, once per distinct set, when its snapshot's own earlier grammar reads it so).
- *  - a snapshot the shape reading refuses → deny every call, saying what it holds (never its text).
+ *    `onEarlierGrammar(entries, bucket, grammar)`, once per distinct set, when its snapshot's own earlier grammar reads it so).
+ *  - a snapshot that cannot be read (its shape; a `toolDeny` entry no grammar reads) → deny every call, never quoting it.
  *  - `allowDirs` (if set) → a WRITE tool must land inside one of the dirs (resolved via `canonicalizeTarget`,
  *    so a symlink can't carry across a write out); a write-capable tool that cannot be path-confined (e.g. `bash`)
  *    is DENIED while `allowDirs` is set (fail-closed).
@@ -132,5 +132,5 @@ export declare function createSessionRulePolicy(rules: SessionPermissionRules |
     rootPath?: string;
     toolEffects?: ReadonlyMap<string, ToolEffect>;
     anchors?: PathRuleBases;
-    onEarlierGrammar?: (entries: readonly string[]) => void;
+    onEarlierGrammar?: (entries: readonly string[], field: SessionRuleEntryField, grammar: number) => void;
 }): NamedToolPolicy;

package/dist/core/runner/session-rule-policy.js

@@ -1,5 +1,5 @@
 import { canonicalizeTarget, isWinFormPath, pathFamilyOf, writeTargetPath } from "../../tools/fs/safety.js";
-import { compileSessionRuleBucket, continuesLineage, earlierGrammarAnnouncer, readSessionRulesShape } from "../session-policy-store.js";
+import { SESSION_RULES_GRAMMAR, compileSessionRuleBucket, continuesLineage, earlierGrammarAnnouncer, earlierGrammarRefusalClause, readSessionRulesShape, unreadableDenyEntries } from "../session-policy-store.js";
 import { compiledEntryName, judgeAllowEntries, uncoveredCommandSegment } from "../allow-entry.js";
 import { inlineUntrusted } from "../untrusted-text.js";
 import { callTargetReadingOf, pathTargetBaseOf, readCallTarget } from "../effective-path-target.js";
@@ -104,27 +104,30 @@ export function createLiveSessionRules(store, floor, hooks) {
         return p;
     };
 }
-function compileSessionRules(rules, announceEarlier) {
+function compileSessionRules(rules) {
     const shaped = readSessionRulesShape(rules);
+    const refuseEvery = (what) => `the session rules cannot be read as rules (they hold ${what}) — every call is refused until they are rewritten`;
     if ("fault" in shaped) {
         const { field, got } = shaped.fault;
         const what = got === "not a rule bucket" ? "a key that is no rule bucket" : field === "" ? `a value that is ${got}, not an object of rule buckets` : `${field} holding ${got}`;
-        return { deny: [], allow: undefined, allowDirs: undefined, pathRows: false, names: { deny: [], allow: [] }, unreadable: `the session rules cannot be read as rules (they hold ${what}) — every call is refused until they are rewritten` };
+        return { deny: [], allow: undefined, earlier: { grammar: SESSION_RULES_GRAMMAR, toolAllow: [], toolDeny: [] }, allowDirs: undefined, pathRows: false, names: { deny: [], allow: [] }, unreadable: refuseEvery(what) };
     }
-    const { toolAllow, allowDirs } = shaped.rules;
+    const { toolAllow, allowDirs, grammar } = shaped.rules;
+    const unreadDeny = unreadableDenyEntries(shaped.rules).length;
     const denyList = compileSessionRuleBucket(shaped.rules, "toolDeny");
     const allowList = toolAllow === undefined ? undefined : compileSessionRuleBucket(shaped.rules, "toolAllow");
     const rowsOf = (behavior, list) => list.rows.map((r) => ({ behavior, entry: r.entry, compiled: r.compiled }));
     const deny = rowsOf("deny", denyList);
     const allow = allowList === undefined ? undefined : rowsOf("allow", allowList);
     const named = (list, earlier) => (list?.inert ?? []).filter((i) => (i.reason === "earlier_grammar") === earlier).map((i) => i.entry);
-    announceEarlier(named(allowList, true));
     return {
         deny,
         allow,
+        earlier: { grammar, toolAllow: named(allowList, true), toolDeny: named(denyList, true) },
         allowDirs: allowDirs !== undefined && allowDirs.length > 0 ? allowDirs : undefined,
         pathRows: [...deny, ...(allow ?? [])].some((r) => r.compiled.kind === "path"),
         names: { deny: [...deny.map((r) => compiledEntryName(r.compiled)), ...named(denyList, false)], allow: [...(allow ?? []).map((r) => compiledEntryName(r.compiled)), ...named(allowList, false)] },
+        ...(unreadDeny > 0 ? { unreadable: refuseEvery(`${unreadDeny === 1 ? "a toolDeny entry" : `${unreadDeny} toolDeny entries`} that rule grammar ${SESSION_RULES_GRAMMAR} reads as no rule`) } : {}),
     };
 }
 export function createSessionRulePolicy(rules, opts) {
@@ -138,7 +141,9 @@ export function createSessionRulePolicy(rules, opts) {
     let compiled;
     const compile = (r) => {
         if (compiled === undefined || compiledFor !== r) {
-            compiled = compileSessionRules(r, announceEarlier);
+            compiled = compileSessionRules(r);
+            for (const field of ["toolAllow", "toolDeny"])
+                announceEarlier(compiled.earlier[field], field, compiled.earlier.grammar);
             compiledFor = r;
         }
         return compiled;
@@ -147,7 +152,7 @@ export function createSessionRulePolicy(rules, opts) {
     return {
         nameSets: [{ ...(seedNames.deny.length > 0 ? { deny: seedNames.deny } : {}), ...(seedNames.allow.length > 0 ? { allow: seedNames.allow } : {}) }],
         async check(req, signal) {
-            const { deny: denyRows, allow: allowRows, allowDirs, unreadable, pathRows } = compile(await readRules(req.toolCallId, signal));
+            const { deny: denyRows, allow: allowRows, earlier, allowDirs, unreadable, pathRows } = compile(await readRules(req.toolCallId, signal));
             if (unreadable !== undefined)
                 return deny(req.toolName, unreadable);
             if (denyRows.length > 0 || allowRows !== undefined) {
@@ -159,7 +164,7 @@ export function createSessionRulePolicy(rules, opts) {
                     return deny(req.toolName);
                 if (allowRows !== undefined && judgeAllowEntries(allowRows, call, "allow", judged, "narrowing") === undefined) {
                     const segment = uncoveredCommandSegment(allowRows, call, judged, "narrowing");
-                    return deny(req.toolName, segment === undefined ? "it is not in the session-rule allowlist" : `it is not in the session-rule allowlist (no entry covers ${JSON.stringify(inlineUntrusted(segment, 200))})`);
+                    return deny(req.toolName, `it is not in the session-rule allowlist${segment === undefined ? "" : ` (no entry covers ${JSON.stringify(inlineUntrusted(segment, 200))})`}${earlierGrammarRefusalClause(earlier.toolAllow, earlier.grammar)}`);
                 }
             }
             if (allowDirs) {

package/dist/core/runner/side-call-account.d.ts

@@ -0,0 +1,68 @@
+/**
+ * The run's usage account for the model calls made BESIDE the main loop — the compaction summarizer, the permission
+ * classifier, a mod's `$.model.complete`: the lanes, what a reply tells the account, the one door a lane books through, and the
+ * ONE function behind it. The lane table says which `Stats` line keeps a lane's cost besides `costMicroUsd` (every lane folds
+ * into the total — it is the budget coordinate and the reported figure); it is total over the lanes by its fence, so a fourth
+ * lane is a row here, not a second accounting function.
+ */
+import type { AssistantMessageDiagnostic, Model, Usage } from "../../internal/llm.js";
+import { type ModelPricing } from "../pricing.js";
+import type { AssertAllKeysHandled } from "../ask-origin.js";
+import type { RunnerDeps, TaskSpec } from "../types.js";
+import type { Stats } from "./assemble-result.js";
+/** Whose model call it is: the compaction summarizer, the permission classifier, a mod's `$.model.complete`. */
+export type SideCallLane = "compaction" | "classifier" | "mod";
+/** The `Stats` line a lane's cost is also kept in: compaction is its own partition line; the classifier and the mods share the side-call line. */
+export declare const SIDE_CALL_LANE_TOTAL: {
+    readonly compaction: "compactionMicroUsd";
+    readonly classifier: "sideCallMicroUsd";
+    readonly mod: "sideCallMicroUsd";
+};
+export type LaneTotalCoversEverySideCallLane = AssertAllKeysHandled<Exclude<SideCallLane, keyof typeof SIDE_CALL_LANE_TOTAL>>;
+/** A side call's reply as the account reads it: the provider's usage (absent ⇒ none reported), the marks of what is unknown,
+ *  and the diagnostics that say a degrading brain served it from its fallback (the model that ANSWERED is the one priced). */
+export interface SideCallReply {
+    readonly usage?: Usage;
+    readonly usageMissing?: true;
+    readonly stopReason?: string;
+    readonly diagnostics?: AssistantMessageDiagnostic[];
+}
+/** The leg's one door onto the run's usage account: every side call's reply is booked through it, once. */
+export type SideCallBook = (lane: SideCallLane, model: Model, reply: SideCallReply | undefined) => void;
+/** The leg's seats a side call is priced and traced on — everything the call needs that `stats` does not carry. */
+export interface SideCallAccount {
+    /** The run's telemetry: a call on an unpriced model taints `unpricedSpend`; the trace row goes to its tracer. */
+    telemetry: {
+        unpricedSpend: boolean;
+        readonly tracer: TaskSpec["tracer"];
+        readonly taskId: string;
+    };
+    /** The deployment's price table, read at the call (a swapped deps seat reaches legs already running). */
+    pricing: () => RunnerDeps["pricing"];
+    /** The telemetry lane's price-table door, consulted for every table a side call adopts. */
+    noteUnevaluablePriceTable: (p: ModelPricing) => void;
+    /** The deployment's model catalog: where the fallback model of a degraded reply is looked up. */
+    catalog: RunnerDeps["models"];
+}
+/** What one side call tells the account beyond its usage: the model it asked, the marks of what is unknown, and — when a
+ *  degrading brain served the reply from another model — that model's id. */
+export interface SideCallCall {
+    model: Model;
+    account: SideCallAccount;
+    usageMissing?: true;
+    stopReason?: string;
+    servedBy?: string;
+}
+/**
+ * THE one place a model call made beside the main loop reaches the run's account: the compaction summarizer, the
+ * permission classifier and a mod's `$.model.complete` all land here, each with its lane. The call is accounted exactly
+ * like a main-loop call (re-priced in core from the deployment's table and the model's cache family, integer
+ * micro-USD, never the brain's own `usage.cost`), so the reported total, the budget gate at the next turn end and the
+ * trace agree about what the run spent. Latency and first-token time are not modeled (there are no per-delta hooks here).
+ *
+ * `usage` absent — the reply reported none — marks the leg's stats `usageMissing` (the totals are then a lower bound:
+ * unknown is not free). A reply the brain itself marked `usageMissing` does the same for its zero-filled usage.
+ */
+export declare function recordSideCallUsage(stats: Stats, usage: Usage | undefined, lane: SideCallLane, call: SideCallCall): void;
+/** The leg's door: `recordSideCallUsage` bound to the leg's `stats` and account, reading what the reply itself says (its marks, and who served it). */
+export declare function sideCallBookOf(stats: Stats, account: SideCallAccount): SideCallBook;

package/dist/core/runner/side-call-account.js

@@ -0,0 +1,61 @@
+import { readDegradation } from "../../brain/degrading.js";
+import { isModelPriced, modelCostToPricing } from "../pricing.js";
+import { emitTrace } from "../trace.js";
+import { cacheFamilyOf, usageCostMicroUsd } from "./usage-accounting.js";
+export const SIDE_CALL_LANE_TOTAL = {
+    compaction: "compactionMicroUsd",
+    classifier: "sideCallMicroUsd",
+    mod: "sideCallMicroUsd",
+};
+function catalogModel(id, catalog) {
+    if (catalog === undefined)
+        return undefined;
+    for (const m of Object.values(catalog))
+        if (m.id === id)
+            return m;
+    return Object.hasOwn(catalog, id) ? catalog[id] : undefined;
+}
+export function recordSideCallUsage(stats, usage, lane, call) {
+    if (usage === undefined || call.usageMissing === true)
+        stats.usageMissing = true;
+    if (usage === undefined)
+        return;
+    const { model: requested, account } = call;
+    const pricing = account.pricing();
+    const served = call.servedBy === undefined ? requested : catalogModel(call.servedBy, account.catalog);
+    const modelId = served?.id ?? call.servedBy ?? requested.id;
+    const price = pricing?.[modelId] ?? modelCostToPricing(served?.cost);
+    const priced = served !== undefined ? isModelPriced(served, pricing) : pricing?.[modelId] !== undefined;
+    if (!priced)
+        account.telemetry.unpricedSpend = true;
+    account.noteUnevaluablePriceTable(price);
+    const family = served !== undefined ? cacheFamilyOf(served) : "input-excludes-cached";
+    const { totalInputTokens, uncachedInputTokens, costMicroUsd } = usageCostMicroUsd(family, usage, price);
+    stats.tokens += usage.totalTokens || 0;
+    stats.promptTokens += uncachedInputTokens;
+    stats.totalInputTokens += totalInputTokens;
+    stats.cachedTokens += usage.cacheRead || 0;
+    stats.cacheWriteTokens += usage.cacheWrite || 0;
+    stats.outputTokens += usage.output || 0;
+    stats.costMicroUsd += costMicroUsd;
+    const total = SIDE_CALL_LANE_TOTAL[lane];
+    stats[total] = (stats[total] ?? 0) + costMicroUsd;
+    emitTrace(account.telemetry.tracer, () => ({
+        kind: "brain.call", version: 1, taskId: account.telemetry.taskId, model: modelId, ...(served !== undefined ? { provider: served.provider } : {}),
+        promptTokens: uncachedInputTokens, totalInputTokens, completionTokens: usage.output || 0,
+        cacheRead: usage.cacheRead || 0, cacheWrite: usage.cacheWrite || 0,
+        latencyMs: 0, ...(priced ? { costMicroUsd } : {}), ...(call.stopReason !== undefined ? { stopReason: call.stopReason } : {}), ts: Date.now(),
+    }));
+}
+export function sideCallBookOf(stats, account) {
+    return (lane, model, reply) => {
+        const degradedTo = readDegradation(reply)?.to;
+        recordSideCallUsage(stats, reply?.usage, lane, {
+            model,
+            account,
+            ...(reply?.usageMissing === true ? { usageMissing: true } : {}),
+            ...(typeof reply?.stopReason === "string" ? { stopReason: reply.stopReason } : {}),
+            ...(degradedTo !== undefined && degradedTo !== model.id ? { servedBy: degradedTo } : {}),
+        });
+    };
+}

package/dist/core/runner/skills-seat.d.ts

@@ -0,0 +1,15 @@
+/**
+ * THE reading of `TaskSpec.skills` — the one place the caller's skill objects are read. The config doors call it before any
+ * resource (a resume before its claim) and hand its copy on as the leg's `skills`; the disclosure block and the `Skill` tool read
+ * that copy through `normalizeSkills` (synthetic-tools.ts), its sorted view.
+ */
+import type { SkillSpec } from "../agent-definition.js";
+/**
+ * Total, and once: a value that is not a list, an entry that is not an object, a `name` / `description` / `content` that is not a
+ * string, or `files` that is not a list of `{ path, content }` strings refuses by name (`config.invalid_argument`, `detail.field` =
+ * the member's path); `baseDir` by its own reader ({@link skillBaseDirOf}, `config.skill_base_dir_invalid`). Every entry is
+ * screened, a later duplicate of a name included. Each field is read ONCE, BY NAME (an inherited or non-enumerable list counts;
+ * a rest copy would drop it). What it returns is plain data in declaration order, first of a name: every member and attachment
+ * copied, the two tables read ({@link readSkillTable}: a non-list is one entry that reads as nothing).
+ */
+export declare function readSkillsSeat(skills: unknown): SkillSpec[];

package/dist/core/runner/skills-seat.js

@@ -0,0 +1,57 @@
+import { readSkillTable } from "../skill-grant.js";
+import { assertNoRetiredKeys, RETIRED_TASK_SPEC_KEYS } from "../retired-keys.js";
+import { skillBaseDirOf } from "./skill-base-dir.js";
+const SKILLS_SEAT = "TaskSpec.skills";
+const kindOf = (v) => (v === null ? "null" : Array.isArray(v) ? "an array" : typeof v);
+function skillsSeatRefusal(field, problem) {
+    const e = new Error(`${field} ${problem} — an entry the engine cannot read is refused rather than dropped.`);
+    e.code = "config.invalid_argument";
+    e.detail = { field };
+    return e;
+}
+function readSkillFiles(files, at) {
+    if (files === undefined)
+        return undefined;
+    if (!Array.isArray(files))
+        throw skillsSeatRefusal(at, `must be a list of { path, content } attachments (got ${kindOf(files)})`);
+    const out = [];
+    for (const [j, f] of files.entries()) {
+        if (typeof f !== "object" || f === null || Array.isArray(f))
+            throw skillsSeatRefusal(`${at}[${j}]`, `must be an attachment object { path, content } (got ${kindOf(f)})`);
+        const { path, content } = f;
+        if (typeof path !== "string")
+            throw skillsSeatRefusal(`${at}[${j}].path`, `must be a string (got ${kindOf(path)})`);
+        if (typeof content !== "string")
+            throw skillsSeatRefusal(`${at}[${j}].content`, `must be a string (got ${kindOf(content)})`);
+        out.push({ path, content });
+    }
+    return out;
+}
+export function readSkillsSeat(skills) {
+    if (skills === undefined)
+        return [];
+    if (!Array.isArray(skills))
+        throw skillsSeatRefusal(SKILLS_SEAT, `must be a list (got ${kindOf(skills)})`);
+    assertNoRetiredKeys({ skills }, RETIRED_TASK_SPEC_KEYS, "TaskSpec");
+    const seen = new Set();
+    const out = [];
+    for (const [i, raw] of skills.entries()) {
+        const at = `${SKILLS_SEAT}[${i}]`;
+        if (typeof raw !== "object" || raw === null || Array.isArray(raw))
+            throw skillsSeatRefusal(at, `must be an object { name, description, content } (got ${kindOf(raw)})`);
+        const { name, description, content, allowedTools, disallowedTools, files: rawFiles, baseDir, ...rest } = raw;
+        void rest;
+        for (const [member, value] of [["name", name], ["description", description], ["content", content]]) {
+            if (typeof value !== "string")
+                throw skillsSeatRefusal(`${at}.${member}`, `must be a string (got ${kindOf(value)})`);
+        }
+        const files = readSkillFiles(rawFiles, `${at}.files`);
+        skillBaseDirOf(baseDir);
+        if (seen.has(name))
+            continue;
+        seen.add(name);
+        const [allowed, denied] = [readSkillTable(allowedTools), readSkillTable(disallowedTools)];
+        out.push({ name, description, content, ...(allowed !== undefined ? { allowedTools: allowed } : {}), ...(denied !== undefined ? { disallowedTools: denied } : {}), ...(files !== undefined ? { files } : {}), ...(baseDir !== undefined ? { baseDir } : {}) });
+    }
+    return out;
+}

package/dist/core/runner/stream-halt-verbs.js

@@ -15,15 +15,16 @@ export function streamHaltVerbs(input) {
             throw haltRefused("the task is not running");
         const apply = () => {
             const abortOwnedBeforeHalt = h.abortController.signal.aborted;
-            const receipt = h.harness.halt();
+            const receipt = h.loop.ended ? { turnCut: false, accepted: false } : h.harness.halt();
+            h.loop.callerStop.stop();
             if (receipt.accepted && !abortOwnedBeforeHalt) {
                 h.loop.userHalted = true;
             }
             else if (!h.loop.userHalted) {
                 deliverEngineNotice(runner.deps.onNotice, {
                     code: "task.halt_unconsumed",
-                    message: "a user halt arrived while the run was already ending for its own reason: nothing was cut or stopped " +
-                        "by it — the run's own ending stands, and the result will not carry haltedByUser for this halt.",
+                    message: "a user halt arrived while the run was already ending for its own reason: it cut no turn and stopped no " +
+                        "boundary — the run's own ending stands, and the result will not carry haltedByUser for this halt.",
                     detail: {
                         sessionId: h.sessionId,
                         runId: h.runId,
@@ -47,33 +48,27 @@ export function streamHaltVerbs(input) {
             }
             return { turnCut: receipt.turnCut };
         };
-        try {
-            if (live.resultValue !== undefined || h.loop.ended)
-                throw haltRefused("the task is no longer running");
-            return apply();
-        }
-        catch (e) {
-            if (!(e instanceof Error && e.code === "invalid_state"))
-                throw e;
-        }
         const birthDeadline = Date.now() + READY_TIMEOUT_MS;
-        while (live.resultValue === undefined && !h.loop.ended && Date.now() < birthDeadline) {
+        while (live.resultValue === undefined) {
             try {
                 return apply();
             }
-            catch (e2) {
-                if (!(e2 instanceof Error && e2.code === "invalid_state"))
-                    throw e2;
+            catch (e) {
+                if (!(e instanceof Error && e.code === "invalid_state"))
+                    throw e;
             }
+            if (Date.now() >= birthDeadline)
+                throw haltRefused("the task is no longer running");
             await new Promise((r) => setTimeout(r, 10));
         }
-        throw haltRefused("the task is no longer running");
+        throw haltRefused("the task has already finished");
     };
     const destroy = () => (destroyOnce ??= (async () => {
         const h = live.handle ?? (await orTimeout(ready));
         if (h) {
             h.abortController.abort();
             void h.harness.abort();
+            h.loop.callerStop.stop();
         }
         await orTimeout(run.catch(() => { }));
         await reapSuspended();

package/dist/core/runner/stream-lifecycle-verbs.js

@@ -145,12 +145,15 @@ export function streamLifecycleVerbs(input) {
         const h = live.handle ?? (await orTimeout(ready));
         if (!h)
             throw interruptRefused("the task is not running");
-        if (live.resultValue !== undefined || h.loop.ended)
-            throw interruptRefused("the task is no longer running");
-        if (!h.abortController.signal.aborted)
+        if (live.resultValue !== undefined)
+            throw interruptRefused("the task has already finished");
+        if (!h.loop.ended && !h.abortController.signal.aborted)
             h.loop.userInterrupted = true;
-        h.abortController.abort();
-        void h.harness.abort();
+        if (!h.loop.ended) {
+            h.abortController.abort();
+            void h.harness.abort();
+        }
+        h.loop.callerStop.stop();
     };
     return { notify, optOutMemoryCapture, reconnectMcpServer, compact, detach, interrupt };
 }

package/dist/core/runner/stream-steer-verb.d.ts

@@ -3,7 +3,7 @@ import { type TaskEvent, type TaskSpec, type TaskStream } from "../types.js";
 import type { LiveHandle, RunInternals, RunnerDepsSeat, TaskStreamLiveSeat } from "./contracts.js";
 import { type SteerReplayRecord, type SteerReplayRefusalDetail } from "../steer-replay.js";
 export interface StreamSteerVerbInput {
-    /** borrowed-readonly — the task spec (the hooks seat, `principal`, `taskId`). */
+    /** borrowed-readonly — the task spec (`principal`, `taskId`). */
     spec: TaskSpec;
     /** borrowed-readonly — the trusted run-internals channel (the spawning tool id the ledger frame carries). */
     internals: RunInternals | undefined;

package/dist/core/runner/stream-steer-verb.js

@@ -1,14 +1,14 @@
 import { uuidv7 } from "../../internal/harness.js";
 import { snapshotActorAssertion } from "../../internal/llm.js";
 import { MAX_STEER_INPUT_ID_CHARS } from "../checkpoint-store.js";
-import { formatHookFeedback, hookSeatExpiredError, runHookSeat } from "../hooks.js";
+import { formatHookFeedback } from "../hooks.js";
+import { classicEventBase, failedHandlerClause, screenUserPrompt } from "../mods/stations.js";
 import { buildHumanInputEvent, frameMidTurnUserInput, projectHumanInput } from "../human-input-projection.js";
 import { injectionLaneOf, isSystemInjectionPriority, steerPriorityOf, SYSTEM_INJECTION_PRIORITIES } from "../task-notification.js";
 import { deliverEngineNotice } from "../types.js";
 import { inlineUntrusted, sanitizeUntrustedText } from "../untrusted-text.js";
 import { announceAcceptance, armAcceptance, nextHumanInputSeq } from "./steer-admission.js";
 import { steerReplayRefusal } from "../steer-replay.js";
-import { asThrownError } from "../thrown-value.js";
 export function streamSteerVerb(input) {
     const { spec, internals, queue, acceptedSteerInputs, live, ready, orTimeout, readyTimeoutMs: READY_TIMEOUT_MS, steeringError, runner } = input;
     let steerChain = Promise.resolve();
@@ -94,42 +94,24 @@ export function streamSteerVerb(input) {
             if (live.resultValue !== undefined || h.loop.ended)
                 throw steeringError("the task is no longer running");
             if (mintsAFrame) {
-                const screen = (spec.hooks ?? runner.deps.hooks)?.userPromptSubmit;
-                if (screen !== undefined) {
-                    let decision;
-                    try {
-                        const seat = await runHookSeat("userPromptSubmit", { timeoutMs: h.hookTimeoutMs, signal: h.abortController.signal, abortEnds: true }, (sig) => screen(text, { identity: h.hookIdentity, permissionMode: h.permissionMode.observed, signal: sig, source: "steer", inputId: effectiveInputId, ...(actor !== undefined ? { actor: snapshotActorAssertion(actor) } : {}) }));
-                        if (seat.expired) {
-                            if (seat.cause === "timeout") {
-                                try {
-                                    runner.deps.onError?.(hookSeatExpiredError("userPromptSubmit", h.hookTimeoutMs, seat.cause, "the steering input was NOT accepted (fail-closed) and the caller was refused typed"), { phase: "hook", sessionId: h.sessionId });
-                                }
-                                catch {
-                                }
-                            }
-                            throw steeringError(seat.cause === "timeout"
-                                ? `the deployment's userPromptSubmit hook did not answer within its ${h.hookTimeoutMs}ms bound while screening this steering input; the input was NOT accepted (fail-closed)`
-                                : `the task was cancelled while the deployment's userPromptSubmit hook was still screening this steering input; the input was NOT accepted (fail-closed)`, "steering.blocked_by_hook");
-                        }
-                        decision = seat.value;
-                    }
-                    catch (hookErr) {
-                        if (hookErr instanceof Error && hookErr.code === "steering.blocked_by_hook")
-                            throw hookErr;
-                        const err = asThrownError(hookErr);
-                        try {
-                            runner.deps.onError?.(err, { phase: "hook", sessionId: h.sessionId });
-                        }
-                        catch {
-                        }
-                        throw steeringError(`the deployment's userPromptSubmit hook crashed while screening this steering input (${inlineUntrusted(err.message)}); the input was NOT accepted (fail-closed)`, "steering.blocked_by_hook");
-                    }
-                    if (decision?.block !== undefined && decision.block !== "") {
-                        throw steeringError(`the deployment's userPromptSubmit hook blocked this steering input: ${inlineUntrusted(decision.block)}`, "steering.blocked_by_hook");
-                    }
-                    if (decision?.additionalContext !== undefined && decision.additionalContext !== "") {
-                        payload = `${formatHookFeedback(decision.additionalContext, h.reminderMark)}\n\n${payload}`;
-                    }
+                const screen = await screenUserPrompt(h.modBus, {
+                    ...classicEventBase(h.hookIdentity, h.permissionMode.observed),
+                    prompt: text,
+                    source: "steer",
+                    inputId: effectiveInputId,
+                    ...(actor !== undefined ? { actor: snapshotActorAssertion(actor) } : {}),
+                }, h.abortController.signal);
+                if (screen?.kind === "aborted") {
+                    throw steeringError(`the task was cancelled while the deployment's userPromptSubmit hook was still screening this steering input; the input was NOT accepted (fail-closed)`, "steering.blocked_by_hook");
+                }
+                if (screen?.kind === "failed") {
+                    throw steeringError(`the deployment's userPromptSubmit hook ${failedHandlerClause(screen)} while screening this steering input; the input was NOT accepted (fail-closed)`, "steering.blocked_by_hook");
+                }
+                if (screen?.block !== undefined && screen.block !== "") {
+                    throw steeringError(`the deployment's userPromptSubmit hook blocked this steering input: ${inlineUntrusted(screen.block)}`, "steering.blocked_by_hook");
+                }
+                if (screen?.additionalContext !== undefined && screen.additionalContext !== "") {
+                    payload = `${formatHookFeedback(screen.additionalContext, h.reminderMark)}\n\n${payload}`;
                 }
             }
             const injectFramed = async () => {