@sema-agent/core 7.52.0 → 7.54.0

package/dist/core/runner/run-leg.js

@@ -8,17 +8,20 @@ import { formatHookFeedback } from "../hooks.js";
 import { classicEventBase, failedHandlerClause, screenUserPrompt } from "../mods/stations.js";
 import { buildAppliedHumanInputEvent, buildHumanInputEvent, projectHumanInput } from "../human-input-projection.js";
 import { humanInputAttachmentsOf, readObjectiveAttachments, userAttachmentDeclarations } from "../user-attachment.js";
-import { uuidv7 } from "../../internal/harness.js";
+import { readToolCallArguments, uuidv7 } from "../../internal/harness.js";
 import { ORG_ADJUDICATION_TIMEOUT_MS, settleOrgVerdictWithin } from "../permission-rule-org.js";
 import { applyPersistedTightening, disclosedRuleSet } from "../persisted-rule-arms.js";
-import { parkedSkillApprovalRefusal, skillRowRefusal } from "../skill-grant.js";
+import { argsReadBy, stampArgsReading } from "../effective-path-target.js";
+import { skillRowRefusal } from "../skill-grant.js";
+import { judgeApprovalObject } from "../approval-object.js";
 import { SKILL_TOOL_NAME } from "./synthetic-tools.js";
 import { computeCostMicroUsd } from "../pricing.js";
 import { mintSystemReminder } from "../reminder-mint.js";
 import { hasDestroy } from "../remote-env.js";
-import { advertisedWritableRootsSeat, attestationOf, exemptRootsSeat, humanRefusalSentence, policyCannotAnswer, policyRefusalMessage, refuseOutOfContractDecision } from "../tool-policy.js";
+import { advertisedWritableRootsSeat, attestationOf, exemptRootsSeat, humanRefusalSentence, licenseCovers, ownedReading, policyCannotAnswer, policyRefusalMessage, refuseOutOfContractDecision } from "../tool-policy.js";
+import { failedJudgmentDeny } from "./policy-throw.js";
 import { pathDenialCardOf } from "../../tools/fs/safety.js";
-import { callFaceSeat, judgeParkedToolIdentity, parkedRowLiveFace, rosterEntryNamed } from "../tool-roster.js";
+import { callFaceSeat, parkedRowLiveFace, rosterEntryNamed } from "../tool-roster.js";
 import { deliverEngineNotice } from "../types.js";
 import { delimitUntrusted, inlineUntrusted, REVIEWER_NOTE_MAX_BODY, sanitizeUntrustedText } from "../untrusted-text.js";
 import { errorCodeOf } from "./terminal-account.js";
@@ -26,6 +29,7 @@ import { DEFAULT_PRECALL_OUTPUT_TOKENS, platformLimitTerminal } from "./clock-an
 import { legContextOverlayOption } from "./compaction-call-options.js";
 import { mintOutputStyleReminder, owedPostureText } from "./compaction-restate.js";
 import { deepJsonEqual, resumeContinuation } from "./decide-continuation.js";
+import { approvalWordsOf, owedApprovalWords, withApprovalWords } from "./approval-feedback.js";
 import { chainCannotJudge } from "./call-hook-stations.js";
 import { settleExecutionRecord } from "./execution-record.js";
 import { holdPrompt } from "./prompt-block.js";
@@ -62,6 +66,10 @@ export async function runLeg(input) {
         }
         if (resume) {
             const walltimeExhaustedResume = effectiveTimeoutMs !== undefined && effectiveTimeoutMs <= 0;
+            const approvalWords = approvalWordsOf(resume.outcome);
+            const approvalFrames = owedApprovalWords(approvalWords, uuidv7());
+            let approvalCommitted = false;
+            prepared.undeliveredContinuationRef.current.parkedSteers.push(...approvalFrames);
             const resumeWindowRetryAfterMs = !walltimeExhaustedResume && prepared.usageGovernance !== undefined ? await prepared.usageGovernance.check(Date.now()) : undefined;
             if (resumeWindowRetryAfterMs !== undefined) {
                 const owesNothing = resume.outcome.gate === "resource_limit" &&
@@ -234,13 +242,15 @@ export async function runLeg(input) {
                         ...ident(),
                     });
                 }
+                if (approvalWords !== undefined)
+                    continuation = withApprovalWords(continuation, engineSegments, approvalWords);
                 const pending = resume.cp.pendingAction;
                 const rejectionHalt = pending.kind === "tool_approval" && resume.outcome.gate === "policy_ask"
                     ? maybeHumanRejectionHalt({ gate: resume.outcome.gateOutcome, isDelegatedChild: prepared.hookIdentity.isDelegatedChild, toolName: pending.toolName, toolCallId: pending.toolCallId })
                     : undefined;
                 if (rejectionHalt !== undefined && pending.kind === "tool_approval")
                     prepared.batchHaltRef.current = { rejectedToolCallId: pending.toolCallId };
-                prepared.undeliveredContinuationRef.current = { parkedSteers: resumeFrames.map(({ entry }) => entry).filter((e) => !withheldSteerIds.has(e.inputId)), orphanTasks };
+                prepared.undeliveredContinuationRef.current = { parkedSteers: [...resumeFrames.map(({ entry }) => entry).filter((e) => !withheldSteerIds.has(e.inputId)), ...approvalFrames], orphanTasks };
                 if (!prepared.abortController.signal.aborted) {
                     if (resume !== undefined)
                         resume.decisionDelivered = true;
@@ -262,11 +272,22 @@ export async function runLeg(input) {
                         const preview = redactThenCut(prepared.outputStyleFrame, 220);
                         prepared.frameReceipts.pending.push({ source: "output_style", text: continuation, commit: () => void (queue.push({ type: "steering_injected", source: "output_style", preview, ...ident() }), (rs.attach.attachmentsInjected += 1)) });
                     }
+                    if (approvalFrames.length > 0) {
+                        prepared.frameReceipts.pending.push({
+                            source: "approval_feedback",
+                            text: continuation,
+                            commit: () => {
+                                approvalCommitted = true;
+                                const seat = prepared.undeliveredContinuationRef.current;
+                                seat.parkedSteers = seat.parkedSteers.filter((f) => !approvalFrames.includes(f));
+                            },
+                        });
+                    }
                     final = await withBrainSinks(() => prepared.harness.prompt(continuation, {
                         engineSegments,
                         settleUnansweredToolCalls: rejectionHalt !== undefined ? { halt: rejectionHalt } : {},
                         onDelivered: () => {
-                            prepared.undeliveredContinuationRef.current = { parkedSteers: [], orphanTasks: [] };
+                            prepared.undeliveredContinuationRef.current = { parkedSteers: approvalCommitted ? [] : [...approvalFrames], orphanTasks: [] };
                             for (const e of appliedEvents)
                                 queue.push(e);
                         },
@@ -529,19 +550,6 @@ async function applyResumeDecision(runner, prepared, resume, emit, emitCommitted
         return;
     if (pendingAction.kind !== "tool_approval")
         return;
-    if (resume.outcome.gate === "policy_ask" &&
-        resume.outcome.decision === "allow" &&
-        !prepared.tools.some((t) => t.name === pendingAction.toolName)) {
-        const e = new Error(`the approved tool "${pendingAction.toolName}" is no longer available on resume — refusing to continue as if it ran; the checkpoint is reopened for a retry with the tool present`);
-        e.code = "resume.tool_unavailable";
-        throw e;
-    }
-    const liveRoster = prepared.toolRosterDeltas.current;
-    if (pendingAction.kind === "tool_approval" && liveRoster !== undefined && judgeParkedToolIdentity(pendingAction, rosterEntryNamed(liveRoster, pendingAction.toolName)) === "mismatch") {
-        const e = new Error(`the approved tool "${pendingAction.toolName}" on this leg is not the tool the approval was minted against (its contract / shape / revision differ) — refusing to execute a replacement wearing the name; the checkpoint is reopened for a retry with the original tool present`);
-        e.code = "resume.tool_contract_mismatch";
-        throw e;
-    }
     await resolvePendingCall(runner, prepared, resume, emit, emitCommitted, onResolvedToolSuccess, onExecuteStart);
 }
 async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted, onResolvedToolSuccess, onExecuteStart) {
@@ -549,13 +557,29 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
     const { outcome } = resume;
     if (pendingAction.kind !== "tool_approval" || outcome.gate !== "policy_ask")
         return;
+    const mounted = () => { const tool = prepared.tools.find((x) => x.name === pendingAction.toolName); const roster = prepared.toolRosterDeltas.current; return tool === undefined || roster === undefined ? {} : { tool, entry: rosterEntryNamed(roster, pendingAction.toolName) }; };
+    const reopen = (miss) => { throw Object.assign(new Error(miss.message), { code: miss.code }); };
+    const liveTool = mounted().tool;
+    const atSession = outcome.decision === "allow" ? judgeApprovalObject(pendingAction, { tool: mounted().entry }, "session") : "match";
+    if (atSession !== "match" && atSession.disposition === "reopen")
+        reopen(atSession);
     const decidedGate = outcome.gateOutcome;
     if (decidedGate === undefined) {
         throw new CheckpointError("checkpoint.invalid_outcome", "pending action reached the resolver with no settlement record on its decision (gateOutcome) — refusing to execute or settle a decision that carries no record");
     }
     const humanRewrite = wireOf("resume.questionArgsShown", pendingAction) === ASK_USER_QUESTION_TOOL_NAME ? undefined : outcome.updatedInput;
-    const resolvedArgs = humanRewrite !== undefined ? humanRewrite : pendingAction.args;
-    const pendingLabel = (() => { const l = prepared.tools.find((t) => t.name === pendingAction.toolName)?.label; return l !== undefined && l !== pendingAction.toolName ? { label: l } : {}; })();
+    const reading = liveTool === undefined ? undefined : ownedReading((a) => readToolCallArguments(liveTool, { type: "toolCall", id: pendingAction.toolCallId, name: pendingAction.toolName, arguments: {} }, a));
+    const beltFace = () => { const f = parkedRowLiveFace(prepared.toolRosterDeltas.current, pendingAction); if (f !== undefined && reading !== undefined)
+        stampArgsReading(f, reading); return f; };
+    const tryRead = (v) => { try {
+        return { args: reading === undefined ? v : argsReadBy(reading, v) };
+    }
+    catch (error) {
+        return { args: v, unread: { error } };
+    } };
+    const decided = outcome.decision === "allow" ? tryRead(humanRewrite !== undefined ? humanRewrite : pendingAction.args) : { args: humanRewrite !== undefined ? humanRewrite : pendingAction.args };
+    const resolvedArgs = decided.args;
+    const pendingLabel = (() => { const l = liveTool?.label; return l !== undefined && l !== pendingAction.toolName ? { label: l } : {}; })();
     const spelledName = pendingAction.names?.[0] ?? pendingAction.toolName;
     const occurrences = prepared.toolOccurrences;
     const callStart = { toolCallId: pendingAction.toolCallId, spelledName, wireName: pendingAction.toolName, ...pendingLabel, args: resolvedArgs };
@@ -563,15 +587,26 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
     occurrences.gateRound(pendingAction.toolCallId, decidedGate, frozenInputSnapshot(resolvedArgs));
     let notExecuted = false;
     const resultRow = (text, isError) => withRowNotExecuted(toolResultMsg(pendingAction.toolCallId, pendingAction.toolName, text, isError), notExecuted);
-    const settleEnd = async (isError, result, refusedBy) => {
+    const settleEnd = async (isError, result, refusedBy, neverRan) => {
         if (refusedBy !== undefined)
             occurrences.refuse(pendingAction.toolCallId, refusedBy);
-        const settled = emitSettled(occurrences, callStart, { result, isError }, { push: emit, structured: prepared.structuredProjector, mediaByteCapBytes: runner.deps.mediaByteCapBytes });
+        const settled = emitSettled(occurrences, callStart, { result, isError, ...(neverRan ? { notExecuted: true } : {}) }, { push: emit, structured: prepared.structuredProjector, mediaByteCapBytes: runner.deps.mediaByteCapBytes });
         notExecuted = settled.notExecuted === true;
         const gate = settled.gate ?? decidedGate;
         const word = await resume.recordExecutionOutcome(gate);
         settleExecutionRecord(runner.deps.onNotice, word, { toolName: pendingAction.toolName, gate, sessionId: prepared.sessionId, runId: prepared.runId, scope: resume.cp.scope, ...(resume.cp.checkpointId !== undefined ? { checkpointId: resume.cp.checkpointId } : {}) });
     };
+    const settleUnreadable = async (error, which) => {
+        const marks = egressValue("same-principal", thrownMarksOf(error));
+        const text = formatHookFeedback(`The approved tool call "${pendingAction.toolName}" was not executed: the tool could not read ${which} — its argument preparation failed (${egressThrownText("same-principal", error)}). This approval is spent — the call has to be re-issued.`, prepared.reminderMark);
+        await settleEnd(true, { content: text, ...(marks !== undefined ? { details: marks } : {}) }, undefined, true);
+        emitCommitted(await prepared.session.appendMessage(resultRow(text, true)), "toolResult", pendingAction.toolCallId);
+    };
+    const vetoApproval = async (miss) => {
+        const text = formatHookFeedback(miss.message, prepared.reminderMark);
+        await settleEnd(true, { content: text, ...(miss.code !== undefined ? { details: { code: miss.code } } : {}) }, "policy");
+        emitCommitted(await prepared.session.appendMessage(resultRow(text, true)), "toolResult", pendingAction.toolCallId);
+    };
     if (outcome.decision === "deny") {
         const settlementKind = outcome.gateOutcome?.settlement?.kind;
         const reason = settlementKind === "policy_refused"
@@ -593,6 +628,10 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
     if (outcome.decision !== "allow") {
         throw new CheckpointError("checkpoint.invalid_outcome", `pending action reached the resolver with decision "${String(outcome.decision)}" — only "allow" executes and only "deny" injects a denial; refusing to execute`);
     }
+    if (atSession !== "match")
+        return vetoApproval(atSession);
+    if (decided.unread !== undefined)
+        return settleUnreadable(decided.unread.error, humanRewrite !== undefined ? "the arguments the decision edited it to" : "its arguments");
     const screened = await prepared.approvedCallScreen?.({ toolCallId: pendingAction.toolCallId, toolName: pendingAction.toolName, args: structuredClone(resolvedArgs), decidedBy: outcome.hostDecision.decidedBy });
     if (screened !== undefined && "refused" in screened) {
         const hookDenial = formatHookFeedback(screened.refused, prepared.reminderMark);
@@ -600,10 +639,13 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
         emitCommitted(await prepared.session.appendMessage(resultRow(hookDenial, true)), "toolResult", pendingAction.toolCallId);
         return;
     }
-    const executedArgs = humanRewrite !== undefined ? resolvedArgs : screened !== undefined ? screened.args : resolvedArgs;
-    const unseen = !deepJsonEqual(executedArgs, pendingAction.args);
+    const rescreened = humanRewrite === undefined && screened !== undefined ? tryRead(screened.args) : undefined;
+    if (rescreened?.unread !== undefined)
+        return settleUnreadable(rescreened.unread.error, "the arguments a PreToolUse hook rewrote it to");
+    const executedArgs = rescreened !== undefined ? rescreened.args : resolvedArgs;
+    const unseen = !licenseCovers(pendingAction.boundInputHash, executedArgs);
     let beltReading;
-    const beltReq = () => ({ toolName: pendingAction.toolName, args: executedArgs, toolCallId: pendingAction.toolCallId, ...callFaceSeat(parkedRowLiveFace(prepared.toolRosterDeltas.current, pendingAction)), budget: beltBudget, ...(prepared.cwdRef !== undefined ? { cwd: prepared.cwdRef.current } : {}), ...(prepared.handsRoot !== undefined ? { root: prepared.handsRoot } : {}), ...advertisedWritableRootsSeat(prepared.advertisedWritableDirs), ...exemptRootsSeat(prepared.exemptRoots), ...(beltReading !== undefined ? { targetReading: beltReading } : {}) });
+    const beltReq = () => ({ toolName: pendingAction.toolName, args: executedArgs, toolCallId: pendingAction.toolCallId, ...callFaceSeat(beltFace()), budget: beltBudget, ...(prepared.cwdRef !== undefined ? { cwd: prepared.cwdRef.current } : {}), ...(prepared.handsRoot !== undefined ? { root: prepared.handsRoot } : {}), ...advertisedWritableRootsSeat(prepared.advertisedWritableDirs), ...exemptRootsSeat(prepared.exemptRoots), ...(beltReading !== undefined ? { targetReading: beltReading } : {}) });
     const unjudgeable = unseen ? chainCannotJudge(resume.cp.state.inheritedGate) : undefined;
     if (unjudgeable !== undefined) {
         const chainDenial = formatHookFeedback(`The approved tool call "${pendingAction.toolName}" was not executed: its input changed after the approval and the inherited ancestor chain cannot judge the changed input (${unjudgeable}). This approval is spent — the call has to be re-issued.`, prepared.reminderMark);
@@ -620,14 +662,20 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
         const card = pathDenialCardOf(attestationOf(d, { toolCallId: pendingAction.toolCallId, toolName: pendingAction.toolName })?.pathDenial);
         return card !== undefined ? { details: card } : {};
     };
+    const beltCheck = async (judge, seat) => { const signal = prepared.abortController.signal; try {
+        return await judge(signal);
+    }
+    catch (err) {
+        return failedJudgmentDeny(err, signal, (e) => runner.deps.onError?.(e, { phase: "hook", sessionId: prepared.sessionId }), seat, pendingAction);
+    } };
     const beltStamped = prepared.stampCallTarget?.(beltReq(), prepared.abortController.signal);
     if (beltStamped !== undefined)
         beltReading = (await beltStamped).targetReading;
     if (unseen && prepared.basePolicyForResumeEdit) {
-        const rechecked = refuseOutOfContractDecision(await prepared.basePolicyForResumeEdit.check(beltReq(), prepared.abortController.signal));
+        const rechecked = refuseOutOfContractDecision(await beltCheck((signal) => prepared.basePolicyForResumeEdit.check(beltReq(), signal), "the deployment's tool policy re-checking a resumed call"));
         const personUnanswered = policyCannotAnswer(rechecked, outcome.hostDecision.decidedBy);
         const beltUnsafe = rechecked.action === "deny" ||
-            (rechecked.updatedInput !== undefined && !deepJsonEqual(rechecked.updatedInput, executedArgs)) ||
+            (rechecked.updatedInput !== undefined && ((read) => read.unread !== undefined || !deepJsonEqual(read.args, executedArgs))(tryRead(rechecked.updatedInput))) ||
             personUnanswered;
         if (beltUnsafe) {
             const why = rechecked.action === "deny"
@@ -653,7 +701,7 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
     }
     if (prepared.permissionRuleOrg !== undefined) {
         const orgVerdict = prepared.permissionRuleOrg
-            .adjudicate({ toolName: pendingAction.toolName, args: executedArgs, toolCallId: pendingAction.toolCallId, ...callFaceSeat(parkedRowLiveFace(prepared.toolRosterDeltas.current, pendingAction)) })
+            .adjudicate({ toolName: pendingAction.toolName, args: executedArgs, toolCallId: pendingAction.toolCallId, ...callFaceSeat(beltFace()) })
             .catch(() => ({ status: "unavailable", disclosures: ["the org adjudication face threw on resume"] }));
         let orgWaitCancelled = false;
         const org = await settleOrgVerdictWithin(orgVerdict, { status: "unavailable", disclosures: [`the org adjudication face did not answer within ${ORG_ADJUDICATION_TIMEOUT_MS}ms (or the task ended first)`] }, {
@@ -687,7 +735,7 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
         }
     }
     if (prepared.denyNarrowingPolicy) {
-        const narrowed = refuseOutOfContractDecision(await prepared.denyNarrowingPolicy.check(beltReq(), prepared.abortController.signal));
+        const narrowed = refuseOutOfContractDecision(await beltCheck((signal) => prepared.denyNarrowingPolicy.check(beltReq(), signal), "the narrowing rules re-checking a resumed call"));
         if (narrowed.action === "deny") {
             const narrowedDenial = formatHookFeedback(`The approved tool call "${pendingAction.toolName}" is now denied by ${ruleSourcePhrase("narrowing")} and was not executed${narrowed.message ? `: ${narrowed.message}` : ""}.`, prepared.reminderMark);
             await settleEnd(true, { content: narrowedDenial, ...denialCard(narrowed) }, "policy");
@@ -729,7 +777,7 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
         }
     }
     if (prepared.shellReadCheck !== undefined) {
-        const readCall = { toolName: pendingAction.toolName, ...callFaceSeat(parkedRowLiveFace(prepared.toolRosterDeltas.current, pendingAction)) };
+        const readCall = { toolName: pendingAction.toolName, ...callFaceSeat(beltFace()) };
         const judged = prepared.shellReadCheck.judge(readCall, executedArgs, prepared.cwdRef?.current, prepared.abortController.signal, {
             toolCallId: pendingAction.toolCallId,
             ...(unseen ? { seat: "rejudge" } : {}),
@@ -753,18 +801,24 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
             reading.verdict.admit?.();
         }
     }
-    const grantRefusal = parkedSkillApprovalRefusal(pendingAction, executedArgs, prepared.skillSpecs, SKILL_TOOL_NAME, "execution");
-    if (grantRefusal !== undefined) {
-        const grantDenial = formatHookFeedback(grantRefusal, prepared.reminderMark);
-        await settleEnd(true, { content: grantDenial }, "policy");
-        emitCommitted(await prepared.session.appendMessage(resultRow(grantDenial, true)), "toolResult", pendingAction.toolCallId);
-        return;
-    }
-    const tool = prepared.tools.find((t) => t.name === pendingAction.toolName);
-    if (!tool) {
-        const e = new Error(`the approved tool "${pendingAction.toolName}" is no longer available on resume`);
-        e.code = "resume.tool_unavailable";
-        throw e;
+    let tool;
+    for (;;) {
+        const { targetReading: _belts, ...unread } = beltReq();
+        const targetReading = (await prepared.stampCallTarget?.(unread, prepared.abortController.signal))?.targetReading;
+        const atExecution = judgeApprovalObject(pendingAction, { tool: mounted().entry, args: executedArgs, skills: prepared.skillSpecs, skillToolName: SKILL_TOOL_NAME, ...(humanRewrite !== undefined ? { decided: resolvedArgs } : {}), targetReading }, "execution");
+        if (atExecution !== "match")
+            return atExecution.disposition === "reopen" ? reopen(atExecution) : vetoApproval(atExecution);
+        tool = mounted().tool;
+        const waited = prepared.crossBoundary?.storeWaits() ?? 0;
+        const crossBoundaryRefusal = await prepared.crossBoundary?.check?.exit({ toolName: pendingAction.toolName, args: executedArgs, toolCallId: pendingAction.toolCallId }, outcome.hostDecision.decidedBy);
+        if (crossBoundaryRefusal !== undefined) {
+            const text = formatHookFeedback(crossBoundaryRefusal.message, prepared.reminderMark);
+            await settleEnd(true, { content: text }, "policy");
+            emitCommitted(await prepared.session.appendMessage(resultRow(text, true)), "toolResult", pendingAction.toolCallId);
+            return;
+        }
+        if ((prepared.crossBoundary?.storeWaits() ?? 0) === waited)
+            break;
     }
     const args = executedArgs;
     screened?.admit();

package/dist/core/runner/run-recovery-lanes.js

@@ -2,7 +2,7 @@ import { compactionKindOf } from "../task-notification.js";
 import { planRejectionClears } from "../context-edit.js";
 import { rosterToolName } from "../tool-roster.js";
 import { landStaleResultClears } from "./prepare-context-lane.js";
-import { DEFAULT_COMPACTION_INSTRUCTIONS, isCompactionManualCancel, maybeCompact, mintCompactedEvent } from "../auto-compaction.js";
+import { compactionPassReport, DEFAULT_COMPACTION_INSTRUCTIONS, isCompactionManualCancel, maybeCompact, mintCompactedEvent } from "../auto-compaction.js";
 import { emitTrace } from "../trace.js";
 import { isDegenerateCutMessage } from "../../brain/terminal-cause.js";
 import { rebaseCadenceWindows } from "./turn-attachments.js";
@@ -22,6 +22,7 @@ export function runRecoveryLanes(input) {
         if (callerStop.signal.aborted)
             return false;
         const passSignal = AbortSignal.any([prepared.abortController.signal, callerStop.signal, ...(turnSignal !== undefined ? [turnSignal] : [])]);
+        const passReport = compactionPassReport(queue, ident);
         try {
             const comp = await maybeCompact({
                 session: prepared.session,
@@ -50,6 +51,7 @@ export function runRecoveryLanes(input) {
                 ...compactionRestateOptions(prepared),
                 ...windowSafetyOptions(prepared.harness.getModel()),
                 ...compactionHookOptions(runner, prepared, "forced", passSignal),
+                onStarted: passReport.onStarted,
             });
             if (comp.compacted) {
                 compactionBreaker.failures = 0;
@@ -95,13 +97,13 @@ export function runRecoveryLanes(input) {
         catch (err) {
             if (isCompactionManualCancel(err) || (turnSignal?.aborted === true && !prepared.abortController.signal.aborted)) {
                 emitTrace(rs.telemetry.tracer, () => ({ kind: "compaction.mooted", version: 1, taskId: rs.telemetry.taskId, reason: "cancelled", ts: Date.now() }));
-                queue.push({ type: "compaction_outcome", outcome: "mooted", trigger: "forced", reason: "cancelled", ...ident() });
+                queue.push({ type: "compaction_outcome", outcome: "mooted", trigger: "forced", reason: "cancelled", ...passReport.end, ...ident() });
                 return false;
             }
             compactionBreaker.failures += 1;
             runner.deps.onError?.(asThrownError(err), { phase: "compaction", sessionId: prepared.sessionId });
             const msg = thrownText(err);
-            queue.push({ type: "compaction_outcome", outcome: "failed", trigger: "forced", reason: msg.length > 512 ? `${msg.slice(0, 512)}…` : msg, ...ident() });
+            queue.push({ type: "compaction_outcome", outcome: "failed", trigger: "forced", reason: msg.length > 512 ? `${msg.slice(0, 512)}…` : msg, ...passReport.end, ...ident() });
             return false;
         }
     };

package/dist/core/runner/run-settle-and-teardown.js

@@ -282,6 +282,8 @@ export async function runSettleAndTeardown(input) {
         const writeDateAnchor = owedDateAnchor(prepared.session, prepared.dateChange, rs.attach.dateState);
         if (writeDateAnchor !== undefined)
             await settleTeardownLeg(writeDateAnchor, "date anchor (settle leg)", (e) => runner.deps.onError?.(e, { phase: "degraded", sessionId: prepared.sessionId }));
+        if (prepared.crossBoundary !== undefined)
+            await prepared.crossBoundary.settle();
         const ownedEnvDying = prepared.ownedEnv !== undefined &&
             hasDestroy(prepared.ownedEnv) &&
             isIsolated(prepared.ownedEnv) &&

package/dist/core/runner/run-terminal-adoption.js

@@ -1,4 +1,4 @@
-import { DEFAULT_COMPACTION_INSTRUCTIONS, isCompactionManualCancel, maybeCompact } from "../auto-compaction.js";
+import { compactionPassReport, DEFAULT_COMPACTION_INSTRUCTIONS, isCompactionManualCancel, maybeCompact } from "../auto-compaction.js";
 import { eventDefaultOn } from "../../prompt-assembly/event-registry.js";
 import { appendInterruptionMarker, reconcileInterruptedSession } from "../session-reconcile.js";
 import { emitTrace } from "../trace.js";
@@ -10,6 +10,7 @@ import { compactionHookOptions, recordCompactionReuse, seamCCompactionOptions }
 import { compactionRestateOptions } from "./compaction-restate.js";
 import { MAX_CONSECUTIVE_COMPACTION_FAILURES } from "./compaction-knobs.js";
 import { emitSettled, reconciledEnd } from "./tool-end-body.js";
+import { isApprovalWordsFrame } from "./approval-feedback.js";
 import { asThrownError, thrownText } from "../thrown-value.js";
 export async function runTerminalAdoption(input) {
     const { spec, queue, prepared, rs, stats, ident, emitCommitted, startedToolCallIds, toolLabels, timeout, compactionBrain, compactionBreaker, windowSafetyOptions, undrainedUserAtEnd, userInputLostAtEnd, final, abortedLive, userInterruptedLive, callerStop, runner, sessions, next } = input;
@@ -78,21 +79,28 @@ export async function runTerminalAdoption(input) {
     }
     let migratedParked = { steer: 0, followUp: 0 };
     let carriedContinuation = 0;
+    let carriedApproval = 0;
+    let approvalRefusal;
     if (committedPause !== undefined && runner.deps.checkpointStore !== undefined) {
         const parkToken = committedPause.cause.token;
         const parkScope = committedPause.scope;
         const store = runner.deps.checkpointStore;
         const carried = [];
         const owed = [
-            ...prepared.undeliveredContinuationRef.current.parkedSteers.map(({ seq: _seq, ...input }) => ({ input })),
+            ...prepared.undeliveredContinuationRef.current.parkedSteers.map((frame) => {
+                const { seq: _seq, ...input } = frame;
+                return { input, ...(isApprovalWordsFrame(frame) ? { approval: true } : {}) };
+            }),
             ...prepared.harness.readParkableUserInputs().map((record) => ({ input: record, live: record })),
         ];
-        for (const { input, live } of owed) {
+        for (const { input, live, approval } of owed) {
             try {
                 if (!(await store.setPendingSteer(parkToken, parkScope, input)))
                     break;
                 if (live !== undefined)
                     carried.push(live);
+                else if (approval)
+                    carriedApproval += 1;
                 else
                     carriedContinuation += 1;
             }
@@ -102,14 +110,17 @@ export async function runTerminalAdoption(input) {
                     sessionId: prepared.sessionId,
                 });
                 const parkCode = errorCodeOf(parkErr);
-                if (parkCode === "steering.invalid_content" || parkCode === "steering.queue_full")
+                if (parkCode === "steering.invalid_content" || parkCode === "steering.queue_full") {
+                    if (approval)
+                        approvalRefusal = parkCode;
                     continue;
+                }
                 break;
             }
         }
         migratedParked = prepared.harness.dropParkedUserInputs(carried);
     }
-    const owedUserInput = { held: undrainedUserAtEnd.current, migrated: migratedParked, continuation: { frames: prepared.undeliveredContinuationRef.current.parkedSteers, carried: carriedContinuation } };
+    const owedUserInput = { held: undrainedUserAtEnd.current, migrated: migratedParked, continuation: { frames: prepared.undeliveredContinuationRef.current.parkedSteers.filter((f) => !isApprovalWordsFrame(f)), carried: carriedContinuation, approval: { owed: prepared.undeliveredContinuationRef.current.parkedSteers.filter(isApprovalWordsFrame).length, carried: carriedApproval, ...(approvalRefusal !== undefined ? { refusal: approvalRefusal } : {}) } } };
     if (rs.attach.attachState?.postCompactPending === true && (rs.attach.attachmentsCfg?.backgroundTasks ?? eventDefaultOn("background_tasks")) === true) {
         emitTrace(rs.telemetry.tracer, () => ({ kind: "compaction.announce_dropped", version: 1, taskId: rs.telemetry.taskId, ts: Date.now() }));
     }
@@ -120,7 +131,8 @@ export async function runTerminalAdoption(input) {
         minTokens: rs.counters.compactionFloor,
         brain: compactionBrain,
         windowSafety: windowSafetyOptions(prepared.harness.getModel()),
-        onCompactionOutcome: (outcome, reason) => queue.push({ type: "compaction_outcome", outcome, trigger: "auto", reason, ...ident() }),
+        passReport: compactionPassReport(queue, ident),
+        onCompactionOutcome: (outcome, reason, end) => queue.push({ type: "compaction_outcome", outcome, trigger: "auto", reason, ...end, ...ident() }),
     }, runner, sessions);
     return await next({ threw, comp, answerSettled: settled, owedUserInput });
 }
@@ -153,7 +165,7 @@ async function finish(spec, prepared, opts, runner, sessions) {
                 ...(prepared.onCompactionApplied ? { onApplied: prepared.onCompactionApplied } : {}),
                 ...seamCCompactionOptions(runner, prepared),
                 ...compactionRestateOptions(prepared),
-                ...compactionHookOptions(runner, prepared, "auto", opts.callerStop.signal),
+                ...compactionHookOptions(runner, prepared, "auto", opts.callerStop.signal), onStarted: opts.passReport.onStarted,
             });
             recordCompactionReuse(runner, prepared, finishComp);
             if (finishComp.unevaluableWindow) {
@@ -170,7 +182,7 @@ async function finish(spec, prepared, opts, runner, sessions) {
                     reason: "cancelled",
                     ts: Date.now(),
                 }));
-                opts?.onCompactionOutcome?.("mooted", "cancelled");
+                opts?.onCompactionOutcome?.("mooted", "cancelled", opts.passReport.end);
             }
             else {
                 const failMsg = thrownText(err);
@@ -183,7 +195,7 @@ async function finish(spec, prepared, opts, runner, sessions) {
                     reason: failReason,
                     ts: Date.now(),
                 }));
-                opts?.onCompactionOutcome?.("failed", failReason);
+                opts?.onCompactionOutcome?.("failed", failReason, opts.passReport.end);
                 runner.deps.onError?.(err, { phase: "compaction", sessionId: prepared.sessionId });
             }
         }

package/dist/core/runner/run-turn-boundary.js

@@ -1,7 +1,7 @@
 import { compactionKindOf } from "../task-notification.js";
 import { mintSystemReminder } from "../reminder-mint.js";
 import { eventDefaultOn } from "../../prompt-assembly/event-registry.js";
-import { DEFAULT_COMPACTION_INSTRUCTIONS, isCompactionManualCancel, maybeCompact, mintCompactedEvent, nextTrimForceBackoff, recordCompactionAndCheckRapidRefill } from "../auto-compaction.js";
+import { compactionPassReport, DEFAULT_COMPACTION_INSTRUCTIONS, isCompactionManualCancel, maybeCompact, mintCompactedEvent, nextTrimForceBackoff, recordCompactionAndCheckRapidRefill } from "../auto-compaction.js";
 import { emitTrace } from "../trace.js";
 import { redactThenCut } from "../../agents/subagent-steps.js";
 import { ATTACHMENT_BYTE_CAP, CHANGED_FILES_MAX, TOTAL_TOKENS_REMINDER_DEFAULT_MODE, attachmentEnvelopeTags, clipToBytes, collectDateChange, collectDueAttachments, collectInstructionsChange, commitAgentListing, commitInstructionsChange, commitSkillsListing, isIntactSource, rebaseCadenceWindows, renderAgentListingFrame, renderMcpDroppedTools, renderMcpInstructionsDelta, selectMcpDroppedBatch, renderSkillsListingFrame, renderToolsDelta } from "./turn-attachments.js";
@@ -558,6 +558,7 @@ export function createTurnBoundary(input) {
         const passTrigger = trimPressure ? "forced" : forceManual ? "manual" : "auto";
         let manualOutcome = "failed";
         const manualInstructions = claimedManual?.instructions;
+        const passReport = compactionPassReport(queue, ident);
         try {
             const comp = await maybeCompact({
                 session: prepared.session,
@@ -587,6 +588,7 @@ export function createTurnBoundary(input) {
                 ...compactionRestateOptions(prepared),
                 ...windowSafetyOptions(event.model),
                 ...compactionHookOptions(runner, prepared, passTrigger, compactionPassSignal),
+                onStarted: passReport.onStarted,
             });
             if (comp.blocked) {
                 emitTrace(rs.telemetry.tracer, () => ({
@@ -670,7 +672,7 @@ export function createTurnBoundary(input) {
         catch (err) {
             if (isCompactionManualCancel(err)) {
                 emitTrace(rs.telemetry.tracer, () => ({ kind: "compaction.mooted", version: 1, taskId: rs.telemetry.taskId, reason: "cancelled", ts: Date.now() }));
-                queue.push({ type: "compaction_outcome", outcome: "mooted", trigger: passTrigger, reason: "cancelled", ...ident() });
+                queue.push({ type: "compaction_outcome", outcome: "mooted", trigger: passTrigger, reason: "cancelled", ...passReport.end, ...ident() });
                 manualOutcome = "mooted";
             }
             else if (!prepared.abortController.signal.aborted) {
@@ -686,11 +688,15 @@ export function createTurnBoundary(input) {
                     reason: failReason,
                     ts: Date.now(),
                 }));
-                queue.push({ type: "compaction_outcome", outcome: "failed", trigger: passTrigger, reason: failReason, ...ident() });
+                queue.push({ type: "compaction_outcome", outcome: "failed", trigger: passTrigger, reason: failReason, ...passReport.end, ...ident() });
                 manualOutcome = "failed";
             }
             else {
                 manualOutcome = "mooted";
+                if (passReport.pass !== undefined) {
+                    emitTrace(rs.telemetry.tracer, () => ({ kind: "compaction.mooted", version: 1, taskId: rs.telemetry.taskId, reason: "task_ending", ts: Date.now() }));
+                    queue.push({ type: "compaction_outcome", outcome: "mooted", trigger: passTrigger, reason: "task_ending", ...passReport.end, ...ident() });
+                }
             }
         }
         if (forceManual)

package/dist/core/runner/runtask.js

@@ -481,7 +481,7 @@ export class Runner {
             outcome,
             taskConfig,
             internals,
-            runner: this.depsSeat,
+            runner: this.depsSeat, sessions: this.sessions,
             parentConstraintRegistry: this.parentConstraintRegistry,
             next: (admitted) => this.resumeLadder(token, outcome, admitted),
         });

package/dist/core/runner/session-file-state-replay.d.ts

@@ -41,10 +41,13 @@ export type TranscriptFileRecord = {
     content: string;
     /** The recording message's own timestamp — the most honest "last read at" available. */
     at: number;
+    /** A Read result's call id — the transmission that carried the text (a Write's or an Edit's post-condition: none). */ transmittedByToolCallId?: string;
 } | {
     path: string;
-    /** The entry the delivery committed. */
-    observation: UserAttachmentObservation["entry"];
+    /** The entry the delivery committed, stamped with the frame that carried it (a trim that drops the frame retires it). */
+    observation: UserAttachmentObservation["entry"] & {
+        transmittedByToolCallId: string;
+    };
     at: number;
 };
 /**

package/dist/core/runner/session-file-state-replay.js

@@ -3,6 +3,7 @@ import { isAbsoluteForFamily, pathFamilyOf } from "../../tools/fs/safety.js";
 import { applyRecordedEdit } from "../../tools/fs/fs-shared.js";
 import { normalizeFileText } from "../../tools/fs/encoding.js";
 import { isOffloadedDetailReplacement } from "../tool-result-store.js";
+import { attachmentTransmissionId } from "../user-attachment.js";
 const READ_TOOL = "Read";
 const WRITE_TOOL = "Write";
 const EDIT_TOOL = "Edit";
@@ -69,7 +70,7 @@ export function wholeFileRecordsFromTranscript(messages) {
         if (attachment?.observation !== undefined) {
             const { key, entry } = attachment.observation;
             if (isAbsoluteForFamily(pathFamilyOf({ root: key }), key))
-                byPath.set(key, { path: key, observation: entry, at: m.timestamp });
+                byPath.set(key, { path: key, observation: { ...entry, transmittedByToolCallId: attachmentTransmissionId(attachment) }, at: m.timestamp });
             continue;
         }
         if (m.role !== "toolResult" || m.isError)
@@ -112,7 +113,7 @@ export function wholeFileRecordsFromTranscript(messages) {
             continue;
         if (isOffloadedDetailReplacement(content))
             continue;
-        byPath.set(filePath, { path: filePath, content, at: m.timestamp });
+        byPath.set(filePath, { path: filePath, content, at: m.timestamp, ...(isRead ? { transmittedByToolCallId: m.toolCallId } : {}) });
     }
     return [...byPath.values()];
 }

package/dist/core/runner/skills-seat.d.ts

@@ -0,0 +1,15 @@
+/**
+ * THE reading of `TaskSpec.skills` — the one place the caller's skill objects are read. The config doors call it before any
+ * resource (a resume before its claim) and hand its copy on as the leg's `skills`; the disclosure block and the `Skill` tool read
+ * that copy through `normalizeSkills` (synthetic-tools.ts), its sorted view.
+ */
+import type { SkillSpec } from "../agent-definition.js";
+/**
+ * Total, and once: a value that is not a list, an entry that is not an object, a `name` / `description` / `content` that is not a
+ * string, or `files` that is not a list of `{ path, content }` strings refuses by name (`config.invalid_argument`, `detail.field` =
+ * the member's path); `baseDir` by its own reader ({@link skillBaseDirOf}, `config.skill_base_dir_invalid`). Every entry is
+ * screened, a later duplicate of a name included. Each field is read ONCE, BY NAME (an inherited or non-enumerable list counts;
+ * a rest copy would drop it). What it returns is plain data in declaration order, first of a name: every member and attachment
+ * copied, the two tables read ({@link readSkillTable}: a non-list is one entry that reads as nothing).
+ */
+export declare function readSkillsSeat(skills: unknown): SkillSpec[];

package/dist/core/runner/skills-seat.js

@@ -0,0 +1,57 @@
+import { readSkillTable } from "../skill-grant.js";
+import { assertNoRetiredKeys, RETIRED_TASK_SPEC_KEYS } from "../retired-keys.js";
+import { skillBaseDirOf } from "./skill-base-dir.js";
+const SKILLS_SEAT = "TaskSpec.skills";
+const kindOf = (v) => (v === null ? "null" : Array.isArray(v) ? "an array" : typeof v);
+function skillsSeatRefusal(field, problem) {
+    const e = new Error(`${field} ${problem} — an entry the engine cannot read is refused rather than dropped.`);
+    e.code = "config.invalid_argument";
+    e.detail = { field };
+    return e;
+}
+function readSkillFiles(files, at) {
+    if (files === undefined)
+        return undefined;
+    if (!Array.isArray(files))
+        throw skillsSeatRefusal(at, `must be a list of { path, content } attachments (got ${kindOf(files)})`);
+    const out = [];
+    for (const [j, f] of files.entries()) {
+        if (typeof f !== "object" || f === null || Array.isArray(f))
+            throw skillsSeatRefusal(`${at}[${j}]`, `must be an attachment object { path, content } (got ${kindOf(f)})`);
+        const { path, content } = f;
+        if (typeof path !== "string")
+            throw skillsSeatRefusal(`${at}[${j}].path`, `must be a string (got ${kindOf(path)})`);
+        if (typeof content !== "string")
+            throw skillsSeatRefusal(`${at}[${j}].content`, `must be a string (got ${kindOf(content)})`);
+        out.push({ path, content });
+    }
+    return out;
+}
+export function readSkillsSeat(skills) {
+    if (skills === undefined)
+        return [];
+    if (!Array.isArray(skills))
+        throw skillsSeatRefusal(SKILLS_SEAT, `must be a list (got ${kindOf(skills)})`);
+    assertNoRetiredKeys({ skills }, RETIRED_TASK_SPEC_KEYS, "TaskSpec");
+    const seen = new Set();
+    const out = [];
+    for (const [i, raw] of skills.entries()) {
+        const at = `${SKILLS_SEAT}[${i}]`;
+        if (typeof raw !== "object" || raw === null || Array.isArray(raw))
+            throw skillsSeatRefusal(at, `must be an object { name, description, content } (got ${kindOf(raw)})`);
+        const { name, description, content, allowedTools, disallowedTools, files: rawFiles, baseDir, ...rest } = raw;
+        void rest;
+        for (const [member, value] of [["name", name], ["description", description], ["content", content]]) {
+            if (typeof value !== "string")
+                throw skillsSeatRefusal(`${at}.${member}`, `must be a string (got ${kindOf(value)})`);
+        }
+        const files = readSkillFiles(rawFiles, `${at}.files`);
+        skillBaseDirOf(baseDir);
+        if (seen.has(name))
+            continue;
+        seen.add(name);
+        const [allowed, denied] = [readSkillTable(allowedTools), readSkillTable(disallowedTools)];
+        out.push({ name, description, content, ...(allowed !== undefined ? { allowedTools: allowed } : {}), ...(denied !== undefined ? { disallowedTools: denied } : {}), ...(files !== undefined ? { files } : {}), ...(baseDir !== undefined ? { baseDir } : {}) });
+    }
+    return out;
+}