@sema-agent/core 7.54.1 → 7.55.0

package/dist/core/session-store.js

@@ -1,4 +1,4 @@
-import { InMemorySessionRepo, SessionError, uuidv7, } from "../internal/harness.js";
+import { InMemorySessionRepo, ParentChainGuard, SessionError, findUnansweredToolBatch, compareOccupants, uuidv7, } from "../internal/harness.js";
 import { isSessionConflict } from "./session.js";
 import { readMember } from "./thrown-value.js";
 const DAY_MS = 24 * 60 * 60 * 1000;
@@ -23,12 +23,13 @@ export class TtlSessionStore {
     durability;
     placements;
     listPlaced;
+    headOf;
+    repoHead;
     repo;
     entries = new Map();
-    owners = new Map();
     pending = new Map();
     pendingPlacedDeletes = new Set();
-    deletingPlaced = new Map();
+    releasing = new Map();
     pinned = new Set();
     defaultTtlMs;
     evictPolicy;
@@ -46,6 +47,11 @@ export class TtlSessionStore {
         if (typeof repoListPlaced === "function") {
             this.listPlaced = (kind, o) => repoListPlaced.call(this.repo, kind, o);
         }
+        const repoHeadOf = this.repo.headOf;
+        if (typeof repoHeadOf === "function") {
+            this.repoHead = (sessionId) => repoHeadOf.call(this.repo, sessionId);
+            this.headOf = this.repoHead;
+        }
         if (opts.sweepIntervalMs !== undefined && opts.sweepIntervalMs > 0) {
             this.sweepTimer = setInterval(() => this.sweep(), opts.sweepIntervalMs);
             this.sweepTimer.unref?.();
@@ -54,14 +60,18 @@ export class TtlSessionStore {
     async acquire(sessionId, opts) {
         this.sweep();
         if (sessionId) {
-            const inflightPlacedDelete = this.deletingPlaced.get(sessionId);
-            if (inflightPlacedDelete !== undefined)
-                await inflightPlacedDelete;
+            const inflightRelease = this.releasing.get(sessionId);
+            if (inflightRelease !== undefined)
+                await inflightRelease;
             const existing = this.entries.get(sessionId);
             if (existing) {
-                this.assertPlacementAdmission(sessionId, existing.placement, opts);
-                existing.lastActiveAt = Date.now();
-                return { session: existing.session, sessionId };
+                if (await this.cachedViewStands(sessionId, existing)) {
+                    this.assertPlacementAdmission(sessionId, existing.placement, opts);
+                    existing.lastActiveAt = Date.now();
+                    return { session: existing.session, sessionId };
+                }
+                if (this.entries.get(sessionId) === existing)
+                    this.entries.delete(sessionId);
             }
             if (opts?.requireExisting) {
                 return { session: await this.openOrCreate(sessionId, true), sessionId };
@@ -87,6 +97,12 @@ export class TtlSessionStore {
         const meta = await session.getMetadata();
         return { session, sessionId: meta.id };
     }
+    async cachedViewStands(sessionId, cached) {
+        if (this.repoHead === undefined)
+            return true;
+        const [shown, row] = await Promise.all([cached.session.getMetadata(), this.repoHead(sessionId)]);
+        return compareOccupants(shown, row) === "same";
+    }
     assertPlacementAdmission(sessionId, placement, opts) {
         const store = this;
         admitSessionPlacement(sessionId, placement, opts ?? {}, {
@@ -99,8 +115,6 @@ export class TtlSessionStore {
         try {
             const session = await this.repo.open({ id, createdAt: "" });
             const meta = await session.getMetadata();
-            if (meta.placement === undefined)
-                this.pendingPlacedDeletes.delete(id);
             this.entries.set(id, { session, lastActiveAt: Date.now(), createdAt: meta.createdAt, ...(meta.forkedFrom !== undefined ? { forkedFrom: meta.forkedFrom } : {}), ...(meta.placement !== undefined ? { placement: meta.placement } : {}) });
             return session;
         }
@@ -115,10 +129,16 @@ export class TtlSessionStore {
         }
     }
     async createAndStore(id, placement) {
-        const session = await this.repo.create({ ...(id !== undefined ? { id } : {}), ...(placement !== undefined ? { placement } : {}) });
+        let session;
+        try {
+            session = await this.repo.create({ ...(id !== undefined ? { id } : {}), ...(placement !== undefined ? { placement } : {}) });
+        }
+        catch (err) {
+            if (id === undefined || !isSessionConflict(err))
+                throw err;
+            session = await this.repo.open({ id, createdAt: "" });
+        }
         const meta = await session.getMetadata();
-        if (meta.placement === undefined)
-            this.pendingPlacedDeletes.delete(meta.id);
         this.entries.set(meta.id, { session, lastActiveAt: Date.now(), createdAt: meta.createdAt, ...(meta.forkedFrom !== undefined ? { forkedFrom: meta.forkedFrom } : {}), ...(meta.placement !== undefined ? { placement: meta.placement } : {}) });
         return session;
     }
@@ -164,17 +184,8 @@ export class TtlSessionStore {
             throw err;
         }
         const forkOptions = await settledForkOptions(source);
-        const forkParams = { ...forkOptions, id: uuidv7() };
-        if (owner != null) {
-            forkParams.owner = owner;
-        }
-        const forked = await this.repo.fork(await source.getMetadata(), forkParams);
+        const forked = await this.repo.fork(await source.getMetadata(), { ...forkOptions, id: uuidv7(), ...(owner !== undefined ? { owner } : {}) });
         const meta = await forked.getMetadata();
-        const inherited = this.owners.has(sourceId) ? this.owners.get(sourceId) : undefined;
-        const forkOwner = owner ?? inherited;
-        if (forkOwner !== undefined && !this.owners.has(meta.id)) {
-            this.owners.set(meta.id, forkOwner);
-        }
         this.entries.set(meta.id, {
             session: forked,
             lastActiveAt: Date.now(),
@@ -187,46 +198,66 @@ export class TtlSessionStore {
         if (this.pinned.has(sessionId)) {
             return;
         }
-        const e = this.entries.get(sessionId);
-        if (e !== undefined && e.placement === undefined)
-            this.pendingPlacedDeletes.delete(sessionId);
-        let placed = e !== undefined ? e.placement !== undefined : this.pendingPlacedDeletes.has(sessionId);
-        if (!placed && e === undefined && this.placements !== undefined) {
-            const probe = this.repo.placementOf;
-            if (typeof probe === "function") {
-                try {
-                    placed = (await probe.call(this.repo, sessionId)) !== undefined;
-                }
-                catch {
-                    placed = false;
-                }
-            }
-        }
-        if (!e && !placed) {
+        const cached = this.entries.get(sessionId);
+        if (cached !== undefined)
+            this.entries.delete(sessionId);
+        if (cached !== undefined && cached.placement === undefined && this.evictPolicy !== "delete")
+            return;
+        if (cached === undefined && !this.releasing.has(sessionId) && !this.rowReadMatters(sessionId))
             return;
+        return this.holdingId(sessionId, () => this.releaseRow(sessionId, cached));
+    }
+    async holdingId(sessionId, work) {
+        const prior = this.releasing.get(sessionId);
+        let settle;
+        const gate = new Promise((r) => (settle = r));
+        this.releasing.set(sessionId, gate);
+        try {
+            if (prior !== undefined)
+                await prior;
+            await work();
+        }
+        finally {
+            if (this.releasing.get(sessionId) === gate)
+                this.releasing.delete(sessionId);
+            settle();
         }
-        if (placed) {
+    }
+    async releaseRow(sessionId, cached) {
+        if (cached?.placement !== undefined)
             this.pendingPlacedDeletes.add(sessionId);
-            this.entries.delete(sessionId);
-            let settleGate;
-            this.deletingPlaced.set(sessionId, new Promise((r) => (settleGate = r)));
-            try {
-                const meta = e !== undefined ? await e.session.getMetadata() : { id: sessionId, createdAt: "" };
-                await this.repo.delete(meta);
-            }
-            finally {
-                this.deletingPlaced.delete(sessionId);
-                settleGate();
-            }
-            this.pendingPlacedDeletes.delete(sessionId);
-            this.owners.delete(sessionId);
+        const view = cached !== undefined && (await this.cachedViewStands(sessionId, cached)) ? cached : undefined;
+        const placed = view !== undefined ? view.placement !== undefined : await this.rowIsPlaced(sessionId);
+        if (view === undefined && !placed)
             return;
+        const meta = view !== undefined ? await view.session.getMetadata() : { id: sessionId, createdAt: "" };
+        if (!placed)
+            return this.repo.delete(meta);
+        this.pendingPlacedDeletes.add(sessionId);
+        await this.repo.delete(meta);
+        this.pendingPlacedDeletes.delete(sessionId);
+    }
+    placementProbe() {
+        const probe = this.repo.placementOf;
+        return typeof probe === "function" ? probe.bind(this.repo) : undefined;
+    }
+    rowReadMatters(sessionId) {
+        return this.pendingPlacedDeletes.has(sessionId) || (this.placements !== undefined && this.placementProbe() !== undefined);
+    }
+    async rowIsPlaced(sessionId) {
+        if (!this.rowReadMatters(sessionId))
+            return false;
+        const probe = this.placementProbe();
+        let placement;
+        try {
+            placement = probe !== undefined ? await probe(sessionId) : (await (await this.repo.open({ id: sessionId, createdAt: "" })).getMetadata()).placement;
         }
-        this.entries.delete(sessionId);
-        if (this.evictPolicy === "delete") {
-            await this.repo.delete(e !== undefined ? await e.session.getMetadata() : { id: sessionId, createdAt: "" });
-            this.owners.delete(sessionId);
+        catch (err) {
+            if (!isNotFound(err))
+                throw err;
         }
+        this.pendingPlacedDeletes.delete(sessionId);
+        return placement !== undefined;
     }
     forget(sessionId) {
         this.entries.delete(sessionId);
@@ -237,29 +268,36 @@ export class TtlSessionStore {
     unpin(sessionId) {
         this.pinned.delete(sessionId);
     }
-    async ownerOf(sessionId) {
-        return this.owners.has(sessionId) ? this.owners.get(sessionId) : undefined;
-    }
     async register(sessionId, owner) {
-        if (this.owners.has(sessionId)) {
+        const inflightRelease = this.releasing.get(sessionId);
+        if (inflightRelease !== undefined)
+            await inflightRelease;
+        if (await this.hasRow(sessionId))
             return;
-        }
         if (owner !== null && typeof owner !== "string") {
             throw new TypeError(`SessionStore.register: owner must be a string (owned) or null (anonymous), got ${owner === undefined ? "undefined" : typeof owner}`);
         }
-        this.owners.set(sessionId, owner);
+        try {
+            await this.repo.create({ id: sessionId, owner });
+        }
+        catch (err) {
+            if (isSessionConflict(err))
+                return;
+            throw err;
+        }
     }
-    async incarnationOf(sessionId) {
-        let session;
+    async hasRow(sessionId) {
+        if (this.repoHead !== undefined)
+            return (await this.repoHead(sessionId)) !== undefined;
         try {
-            session = await this.repo.open({ id: sessionId, createdAt: "" });
+            await this.repo.open({ id: sessionId, createdAt: "" });
+            return true;
         }
         catch (err) {
             if (isNotFound(err))
-                return undefined;
+                return false;
             throw err;
         }
-        return (await session.getMetadata()).incarnation;
     }
     sweep(now = Date.now()) {
         for (const [id, e] of this.entries) {
@@ -269,9 +307,10 @@ export class TtlSessionStore {
             if (now - e.lastActiveAt > this.defaultTtlMs) {
                 this.entries.delete(id);
                 if (this.evictPolicy === "delete" && e.placement === undefined) {
-                    void this.repo.delete({ id, createdAt: "" }).then(() => {
-                        this.owners.delete(id);
-                    }, () => { });
+                    void this.holdingId(id, async () => {
+                        if (await this.cachedViewStands(id, e))
+                            await this.repo.delete({ id, createdAt: "" });
+                    }).catch(() => { });
                 }
             }
         }
@@ -285,22 +324,25 @@ export class TtlSessionStore {
         }
     }
 }
-async function settledForkOptions(source) {
+export async function settledForkOptions(source) {
     const storage = source.getStorage();
     let id = await storage.getLeafId();
+    const chain = new ParentChainGuard();
+    const answers = [];
     while (id) {
+        chain.stepOnto(id);
         const entry = await storage.getEntry(id);
         if (!entry || entry.type !== "message") {
             return {};
         }
         if (entry.message.role === "assistant") {
-            const hasToolCall = Array.isArray(entry.message.content) &&
-                entry.message.content.some((c) => c.type === "toolCall");
-            return hasToolCall && entry.parentId ? { entryId: entry.parentId, position: "at" } : {};
+            const open = findUnansweredToolBatch([entry.message, ...answers]) !== undefined;
+            return open && entry.parentId ? { entryId: entry.parentId, position: "at" } : {};
         }
         if (entry.message.role !== "toolResult") {
             return {};
         }
+        answers.push(entry.message);
         id = entry.parentId;
     }
     return {};

package/dist/core/session.d.ts

@@ -6,8 +6,9 @@ export type { SessionStorage, SessionRepo, SessionMetadata, SessionTreeEntry, }
 export { SessionError } from "../internal/harness.js";
 export type { SessionWriteOptions } from "../internal/harness.js";
 import type { Session } from "../internal/harness.js";
-import type { SessionTreeEntry } from "../internal/harness.js";
+import type { SessionHead, SessionTreeEntry } from "../internal/harness.js";
 export type { SessionPlacementRecord } from "../internal/harness.js";
+export type { SessionHead } from "../internal/harness.js";
 /** True when `err` is a session optimistic-lock conflict (a concurrent writer won the branch leaf). Both
  *  halves read what a HOST `SessionStorage` threw, so both are guarded — unreadable is not a conflict,
  *  never a raise inside the classify-and-rethrow guard. The class test is KEPT: widening the verdict to
@@ -243,59 +244,36 @@ export interface SessionStore {
      * an in-memory repo forks IN-PROCESS yet loses the copy on restart, while a durable repo (file/pg) makes the
      * fork survive restart/replica. **Capability presence ≠ durability** — a cross-replica consumer (design/114
      * warm-resume) MUST wire a durable repo; core cannot verify durability, only fail-loud on a missing source at
-     * fork time (returns `null`). `owner` (if given) scopes the new session for multi-tenant stores, and a store that
-     * also implements {@link register} MUST make the fork's ownership row agree with it — a fork COPIES the source's
-     * history, so the copy must never be weaker than the original: with no `owner` argument the fork inherits the
-     * SOURCE's row (a source with no row mints none, keeping the authorizer's claim branch intact). An EXPLICIT
-     * `owner: null` follows the same inheritance, deliberately: "anonymous" on a copy of an OWNED source would
-     * make that history claimable by anyone — a downgrade this face exists to prevent — so `null` only takes
-     * effect when the source itself is unowned/anonymous. MUST copy the COMMITTED leaf (an in-flight
-     * uncommitted turn of an active source is not included — a fork is a snapshot at the fork point).
+     * fork time (returns `null`). The fork is a new row whose owner cell is recorded in the write that creates it — a fork
+     * COPIES the source's history, so the copy is never weaker than the original: with no `owner` argument, or an
+     * EXPLICIT `null`, the fork records the SOURCE row's owner ("anonymous" on a copy of an OWNED source would admit
+     * every principal to that history — a downgrade this face exists to prevent); an owner string records that owner.
+     * MUST copy the COMMITTED leaf (an in-flight uncommitted turn of an active source is not included — a fork is a
+     * snapshot at the fork point).
      */
     fork?(sourceId: string, owner?: string | null): Promise<string | null>;
     /**
-     * Session-ownership capability face (multi-tenant admission — the deployment's authorizer probes for
-     * BOTH methods and runs its owner gate only when they exist; a store without them forces the
-     * deployment into its fail-closed arm, refusing caller-supplied session ids under multi-tenancy).
+     * The row's {@link SessionHead} for `sessionId` — owner, occupant and active leaf — in ONE read of the row, never assembled from
+     * separate reads (a delete and re-create of the id between two reads would pair one generation's owner with the next one's
+     * occupant). `undefined` = no row for this id. A rejection is a read fault, not an answer.
      *
-     * `ownerOf` is THREE-state and the states must never collapse:
-     *  - `undefined` — the session has NO ownership row (unknown id): the authorizer claims it for the
-     *    calling principal (or 404s under require-existing).
-     *  - `null` — the session EXISTS and is anonymous (unowned): admitted (single-tenant/dev sharing).
-     *  - `string` — owned: a different principal is refused.
-     *  Collapsing `undefined` into `null` breaks the gate in both directions at once (an unknown id
-     *  reads as an admissible anonymous session; an anonymous session reads as claimable).
+     * The BY-ID read, for a reader that did not acquire the session (hosts, a deployment's authorizer). A store that has it hands out,
+     * from `acquire`, only a session of the occupant it names — a cached view of an occupant the row no longer holds (the row deleted,
+     * or deleted and created again, through another writer — on the File lane a writer in another process too) is not served — so its `incarnation` and the acquired session's metadata agree (the kit pins both); a run's own memory seat reads the session it ACQUIRED instead, never this lookup. The owner is a cell of the row: `null` = anonymous (admitted to every principal) — a row created
+     * with no owner, a placed row, or a row written before the cell existed; a string = owned. **Optional**: absent ⇒ no by-id read,
+     * and a deployment's authorizer, which needs this and {@link register} together, takes its fail-closed arm.
      */
-    ownerOf?(sessionId: string): Promise<string | null | undefined>;
+    headOf?(sessionId: string): Promise<SessionHead | undefined>;
     /**
-     * Idempotent ownership upsert, FIRST-WRITE-WINS and atomic: the first registered owner is kept,
-     * later calls neither overwrite nor throw. Deliberately makes NO authorization decision — the
-     * caller re-reads {@link ownerOf} after registering and judges there (which is exactly why the
-     * first-write-wins read-back must be atomic: a concurrent loser has to SEE the winner's owner on
-     * re-read, or it silently attaches to the winner's session). In-memory synchronous writes satisfy
-     * this trivially; durable implementations need a real uniqueness guarantee, not read-then-write.
-     * The ownership row must never expire BEFORE its session (a live session reading as `undefined`
-     * would be re-claimable by anyone); same-lifetime or longer both satisfy the contract — so a store that
-     * deletes the row when it deletes the history must gate that on the history delete having SUCCEEDED.
-     * An implementation must never store a value that {@link ownerOf} reads back as `undefined` (a row that
-     * EXISTS yet reads as "no row" is permanently claimable and never ownable): a FIRST write whose `owner` is
-     * neither a string nor `null` is refused loudly instead — the no-overwrite-no-throw rule above governs
-     * LATER calls, which stay silent no-ops whatever they carry.
+     * The owner write of the ownership pair ({@link headOf} + this). On an id with NO row it creates the row — an ordinary row, no
+     * placement — recording `owner` in the creating write, first-write-wins and atomic: of two concurrent first registers, both
+     * callers' re-reads see the same winner (durable implementations need a real uniqueness guarantee, not read-then-write). On an id
+     * whose row EXISTS it does nothing, whatever it carries — an owned row, an anonymous row, or a row `acquire` created (which
+     * records `null`) stays as it is; there is no claiming of an existing row. A FIRST write whose `owner` is neither a string nor
+     * `null` is refused loudly and leaves no row; a later call stays a silent no-op whatever it carries. Deliberately makes NO
+     * authorization decision — the caller re-reads {@link headOf} and judges there. The owner lives and dies with its row.
      */
     register?(sessionId: string, owner: string | null): Promise<void>;
-    /**
-     * WHICH occupant holds `sessionId` now: the session row's {@link SessionMetadata.incarnation} cell,
-     * minted by the repo when the row came into existence and stable for the row's whole life (restarts,
-     * cache eviction, replicas). `undefined` = UNKNOWN — no row for this id, or a row written before the
-     * cell existed; a reader treats unknown as "cannot tell occupants apart", never as a different one.
-     * A rejection is a read fault, not an answer.
-     *
-     * The BY-ID read, for a reader that did not acquire the session (hosts; this read and the metadata of
-     * a session `acquire` hands back must agree — the incarnation kit pins both). A run's own memory seat
-     * reads the session it ACQUIRED instead, never a second lookup: the cached view `acquire` returns and
-     * a by-id read can answer two different rows. **Optional**: absent ⇒ no by-id read.
-     */
-    incarnationOf?(sessionId: string): Promise<string | undefined>;
     /** Number of live/cached sessions (best-effort). */
     readonly size: number;
     /** Release resources (timers, connections). Best-effort; must not throw. */

package/dist/core/shared-memory/tools.js

@@ -2,7 +2,7 @@ import { Type } from "typebox";
 import { errorResult } from "../tools.js";
 import { CONNECTING_MESSAGE, GENERIC_FAILURE_MESSAGE, NO_STORES_MESSAGE, SHARED_STORE_FRAME, UNAVAILABLE_MESSAGE, datePrefixOf, echoUntrusted, foldReaderError, listPrefixArgument, normalizeEntries, normalizeMemoryPath, normalizeReadValue, normalizeSnapshot, pageDocuments, relativePathRefusal, sanitizeSharedContent, validateDocumentPath, validatePathPrefix, } from "./normalize.js";
 import { SHARED_MEMORY_LIST_PAGE_SIZE, SHARED_MEMORY_LIST_TOOL_NAME, SHARED_MEMORY_READ_CAP_BYTES, SHARED_MEMORY_READ_TOOL_NAME, } from "./types.js";
-import { toolFace } from "../tool-catalog-entries.js";
+import { mountRuleFace, toolFace } from "../tool-catalog-entries.js";
 const LIST_HINT = "List shared memory stores and their documents — check here before telling the user you do not have something.";
 const LIST_DESCRIPTION = [
     LIST_HINT,
@@ -127,6 +127,7 @@ export function createSharedMemoryTools(opts) {
     const listTool = {
         name: SHARED_MEMORY_LIST_TOOL_NAME,
         ...toolFace("memory-list"),
+        ruleFace: mountRuleFace("memory-list"),
         description: LIST_DESCRIPTION,
         defer: true,
         parameters: Type.Object({
@@ -258,6 +259,7 @@ export function createSharedMemoryTools(opts) {
     const readTool = {
         name: SHARED_MEMORY_READ_TOOL_NAME,
         ...toolFace("memory-read"),
+        ruleFace: mountRuleFace("memory-read"),
         description: READ_DESCRIPTION,
         defer: true,
         parameters: Type.Object({

package/dist/core/shared-memory/types.d.ts

@@ -2,7 +2,7 @@
  * design/177 — the SHARED memory-store seam (connected team/deployment memory libraries the model may
  * BROWSE and READ through two tools) and its model-facing constants.
  *
- * Upstream anchor: CC 2.1.223's `memory_list` / `memory_read` pair, whose defining property was READ/WRITE
+ * Upstream anchor: the reference's `memory_list` / `memory_read` pair, whose defining property was READ/WRITE
  * ASYMMETRY (no model-side write channel); CC no longer has that shape — 2.1.296 also mounts `yd` (cli296.js:242348) "memory_write" — and sema keeps the 223 one (KL-878): write governance is an
  * environment concern, and the tool face's entire participation in it is truthfully reporting each
  * store's `writable` bit. sema keeps that structure and pushes the whole credential/consent half onto

package/dist/core/side-query.d.ts

@@ -1,6 +1,7 @@
 import type { AssistantMessage, StopReason, Tool, ToolResultMessage, Usage, UserMessage } from "../internal/llm.js";
 import type { Brain, Model, ModelRef, ModelRole, ModelRoles, TaskSpec, ThinkingLevel } from "./types.js";
 import { type DegradationInfo } from "../brain/degrading.js";
+import { type BrainErrorCode } from "../brain/errors.js";
 /** A tool DEFINITION exposed to the model in a side query (never executed by the engine). */
 export interface SideQueryToolDef {
     name: string;
@@ -117,6 +118,15 @@ export interface SideQueryResult {
      *  RETURNS the honest failure instead of throwing: utility callers uniformly need "no answer +
      *  why", and a throw would lose usage/model attribution for the failed attempt. */
     errorMessage?: string;
+    /** The brain code of a failed query (`stopReason:"error"`), lifted from {@link errorMessage}'s `[code]` prefix by the one
+     *  shared parser; absent when the message names none (an engine-minted shell, a custom brain). */
+    errorCode?: BrainErrorCode;
+    /** The STRUCTURAL failure kind the reply carried (`AssistantMessage.errorKind`), forwarded as is: `input_too_long` (the
+     *  provider refused the request as over its window), `length_empty`, `degenerate`. Absent when the reply carried none. */
+    errorKind?: AssistantMessage["errorKind"];
+    /** `true` when the failure was a provider refusal its minter RULED OUT as input-too-long (`AssistantMessage.inputTooLongRuledOut`),
+     *  forwarded as is. Absent otherwise. */
+    inputTooLongRuledOut?: true;
 }
 /** Dependencies the Runner passes through (a strict subset of RunnerDeps — no session/tool machinery). */
 export interface SideQueryDeps {

package/dist/core/side-query.js

@@ -1,6 +1,7 @@
 import { ensureToolTurnInvariants } from "../internal/llm.js";
 import { resolveTaskModel } from "./roles.js";
 import { readDegradation } from "../brain/degrading.js";
+import { extractErrorCode } from "../brain/errors.js";
 import { cacheFamilyOf, uncachedInputTokensOf } from "./runner/usage-accounting.js";
 import { providerReportedModel } from "./message-utils.js";
 import { providerToolCallId } from "../brain/tool-call-id.js";
@@ -71,6 +72,7 @@ export async function runSideQuery(spec, deps) {
     const degraded = readDegradation(msg);
     const servedModel = typeof msg.model === "string" && msg.model.length > 0 ? msg.model : resolved.model.id;
     const reportedModel = providerReportedModel(msg);
+    const errorCode = extractErrorCode(msg.errorMessage);
     return {
         text,
         toolCalls,
@@ -82,5 +84,8 @@ export async function runSideQuery(spec, deps) {
         ...(msg.usageMissing === true ? { usageMissing: true } : {}),
         stopReason: msg.stopReason,
         ...(msg.errorMessage !== undefined ? { errorMessage: msg.errorMessage } : {}),
+        ...(msg.stopReason === "error" && errorCode !== undefined ? { errorCode } : {}),
+        ...(msg.errorKind !== undefined ? { errorKind: msg.errorKind } : {}),
+        ...(msg.inputTooLongRuledOut === true ? { inputTooLongRuledOut: true } : {}),
     };
 }

package/dist/core/store-contracts/checkpoint-store-contract.js

@@ -1,6 +1,6 @@
 import { strict as assert } from "node:assert";
 import { executionVerdict } from "../checkpoint-execution-record.js";
-import { MAX_PENDING_STEER_ENTRIES, mintCheckpointToken, readPendingSteerQueue, } from "../checkpoint-store.js";
+import { MAX_PENDING_STEER_ENTRIES, checkpointIndexFacts, mintCheckpointToken, readPendingSteerQueue, } from "../checkpoint-store.js";
 import { checkpointFrom } from "../pause-registry.js";
 import { beginContract } from "./contract-harness.js";
 export function createCheckpointFixture(over = {}) {
@@ -308,7 +308,7 @@ export async function checkpointStoreContract(make, runAssertion) {
         const stored = (await store.get(bitless.token)).pendingAction;
         assert.equal("hasBidiControls" in stored, false, "projection backfill must not write back to the row");
     });
-    run("the approval object's members: a row's identity + face group and its targets (capabilityId/contractId/shapeDigest/implementationRevision + family/pathTarget/names + targets) survive the round-trip verbatim; an absent group stays absent", async () => {
+    run("the approval object's members: a row's identity + face group and its targets (capabilityId/contractId/shapeDigest/implementationRevision + family/pathTarget/hostTarget/names + targets) survive the round-trip verbatim; an absent group stays absent", async () => {
         const store = make();
         const carried = createCheckpointFixture({ token: mintCheckpointToken(), sessionId: "id-carried" });
         const group = {
@@ -331,6 +331,14 @@ export async function checkpointStoreContract(make, runAssertion) {
         const bareBack = (await store.get(bare.token)).pendingAction;
         for (const k of Object.keys(group))
             assert.equal(k in bareBack, false, `an absent ${k} must stay OMITTED (a pre-388 row reads name-only, never a partial face)`);
+        const fetchRow = createCheckpointFixture({ token: mintCheckpointToken(), sessionId: "id-host" });
+        Object.assign(fetchRow.pendingAction, { ...group, family: "web", pathTarget: undefined, targets: undefined, hostTarget: { param: "url" } });
+        delete fetchRow.pendingAction.pathTarget;
+        delete fetchRow.pendingAction.targets;
+        await store.put(fetchRow.token, fetchRow);
+        const fetchBack = (await store.get(fetchRow.token)).pendingAction;
+        assert.deepEqual(fetchBack.hostTarget, { param: "url" }, "the row's hostTarget must survive the round-trip verbatim (dropped, a resume of the parked fetch reads a face that moved and is vetoed, and its pre-claim recheck judges the catalog's slot for the NAME)");
+        assert.equal("hostTarget" in bareBack, false, "an absent hostTarget must stay OMITTED");
     });
     run("#457 previewWithheld three-form matrix: a row's spelling survives + projects; absent stays absent; an out-of-contract spelling reads as absent", async () => {
         const store = make();
@@ -436,6 +444,25 @@ export async function checkpointStoreContract(make, runAssertion) {
         await assert.rejects(store.recordExecutionOutcome(cp.token, cp.scope, EXECUTED_ALLOW), (e) => e.code === "checkpoint.execution_outcome_conflict", "a person's record for a row the policy decided is a different record");
         assert.deepEqual((await store.get(cp.token)).executionOutcome, POLICY_ALLOWED);
     });
+    run("index facts: every row's checkpointIndexFacts survive the round trip — an approval gate with a card, a word outside the card set, no card, a descriptor, a deadline, the directional-control bit; a tool-less park", async () => {
+        const store = make();
+        const descriptor = { severity: 4, axes: { egress: true }, toolName: "Write" };
+        const laterWord = createCheckpointFixture({ gate: { kind: "human", reason: "approve", toolName: "Write" } });
+        Object.assign(laterWord.gate, { approvalCard: "card-of-a-later-engine" });
+        const rows = [
+            createCheckpointFixture({ gate: { kind: "human", reason: "approve", toolName: "Write", approvalCard: "file-write", riskDescriptor: descriptor }, deadline: 1_900_000_000_000 }),
+            createCheckpointFixture({ gate: { kind: "irreversible_ask", reason: "send", toolName: "Write", approvalCard: "question" } }),
+            laterWord,
+            createCheckpointFixture({ pendingAction: { kind: "tool_approval", origin: "policy", toolCallId: "call-b", toolName: "Write", args: {}, boundInputHash: "hb", hasBidiControls: true, batchToolCallIds: ["call-b"], completedCallIds: [] } }),
+            createCheckpointFixture({ gate: { kind: "resource_limit", reason: "turns" }, pendingAction: { kind: "resource_limit", reason: "turns" }, deadline: 1_900_000_000_001 }),
+        ];
+        for (const cp of rows) {
+            await store.put(cp.token, cp);
+            const back = await store.get(cp.token);
+            assert.ok(back !== null, "a row put is a row read");
+            assert.deepEqual(checkpointIndexFacts(back), checkpointIndexFacts(cp), `the index facts of the row ${cp.gate.kind} came back different`);
+        }
+    });
     await settle();
 }
 const sortByToken = (a, b) => a.token.localeCompare(b.token);