@sema-agent/core 7.54.1 → 7.56.0

package/dist/core/runner/resume-apply.js

@@ -1,5 +1,4 @@
 import { snapshotActorAssertion } from "../../internal/llm.js";
-import { ASK_USER_QUESTION_TOOL_NAME } from "../ask-question.js";
 import { CheckpointError, remainingBudgetMicroUsd } from "../checkpoint-store.js";
 import { chainPolicyOnLeg, chainTopAnchors } from "./child-tree.js";
 import { mintHookInvocationIdentity } from "../hooks.js";
@@ -8,14 +7,15 @@ import { checkToolPolicyProjection, policyCannotAnswer, refuseOutOfContractDecis
 import { callFaceSeat, parkedCallFaceOf } from "../tool-roster.js";
 import { readCallTarget } from "../effective-path-target.js";
 import { inlineUntrusted } from "../untrusted-text.js";
-import { deepJsonEqual, describeSuppliedValue, mintDecideRecord } from "./decide-continuation.js";
+import { describeSuppliedValue, mintDecideRecord } from "./decide-continuation.js";
+import { editRewrittenSentence, readRejudge } from "../rewrite-rejudge.js";
 import { orgVerdictBeforeClaim } from "./permission-rule-lanes.js";
 import { chainCannotJudge } from "./call-hook-stations.js";
 import { thrownText } from "../thrown-value.js";
-import { wireOf } from "../tool-name-readings.js";
 import { judgeApprovalObject } from "../approval-object.js";
-import { SKILL_CONTENT_MAX_CHARS, SKILL_TOOL_NAME, normalizeSkills } from "./synthetic-tools.js";
-import { skillLoadReading } from "./skill-base-dir.js";
+import { SKILL_TOOL_NAME, normalizeSkills, skillsThatLoad } from "./synthetic-tools.js";
+import { readSkillsSeat } from "./skills-seat.js";
+import { frozenSkillScopesOf } from "../mods/spec-seats.js";
 export async function resumeApply(input) {
     const { cp, config, internals, outcomeGate, wakeMessage, resumeSignal, recheckGovernanceWindow, plainReviewOutcome, plainParkOutcome, runner, effectiveDelegationFacts } = input;
     let plainPolicyOutcome = input.plainPolicyOutcome;
@@ -23,7 +23,7 @@ export async function resumeApply(input) {
     let legMods;
     if (outcomeGate === "wake" && wakeMessage !== undefined) {
         if (resumeSignal?.aborted !== true) {
-            legMods = await admitLegMods({ spec: config, deps: runner.deps, sessionId: cp.sessionId });
+            legMods = await admitLegMods({ spec: config, deps: runner.deps, sessionId: cp.sessionId, skills: skillsThatLoad(readSkillsSeat(config.skills)), reopenedSkills: frozenSkillScopesOf(cp.state) });
         }
         if (legMods !== undefined && legMods.bus.hasHandlers("classic.UserPromptSubmit")) {
             const screenedMessage = wakeMessage;
@@ -75,7 +75,7 @@ export async function resumeApply(input) {
         });
     };
     if (plainPolicyOutcome?.decision === "allow" && cp.pendingAction.kind === "tool_approval") {
-        const servedSkills = normalizeSkills(config.skills).filter((s) => skillLoadReading(s, SKILL_CONTENT_MAX_CHARS).loads);
+        const servedSkills = skillsThatLoad(normalizeSkills(config.skills));
         const claimed = judgeApprovalObject(cp.pendingAction, { args: plainPolicyOutcome.updatedInput ?? cp.pendingAction.args, skills: servedSkills, skillToolName: SKILL_TOOL_NAME }, "claim");
         if (claimed !== "match")
             throw new CheckpointError("checkpoint.invalid_outcome", claimed.message, { field: "boundGrantDigest" });
@@ -83,8 +83,7 @@ export async function resumeApply(input) {
     if (plainPolicyOutcome !== undefined &&
         plainPolicyOutcome.decision === "allow" &&
         plainPolicyOutcome.updatedInput !== undefined &&
-        cp.pendingAction.kind === "tool_approval" &&
-        wireOf("resume.editRecheckQuestionSkip", cp.pendingAction) !== ASK_USER_QUESTION_TOOL_NAME) {
+        cp.pendingAction.kind === "tool_approval") {
         const editedArgs = plainPolicyOutcome.updatedInput;
         const editBudget = {
             resourceRemainingMicroUsd: remainingBudgetMicroUsd(cp.resourceLedger),
@@ -148,9 +147,9 @@ export async function resumeApply(input) {
             }
             if (policyCannotAnswer(rechecked, plainPolicyOutcome.hostDecision.decidedBy))
                 throw new CheckpointError("checkpoint.invalid_outcome", `the approver EDITED this call's input, the edited args raise a question that requires real approval, and the decision is the deployment's policy — a policy's answer is not a person's (decide the edit as "person", or approve the shown input); refusing pre-CAS, the checkpoint stays pending`, { field: "hostDecision" });
-            if (rechecked.updatedInput !== undefined && !deepJsonEqual(rechecked.updatedInput, editedArgs)) {
-                throw new CheckpointError("resume.constraint_rejected", `the deployment's resume-edit policy REWROTE the approver's edited args to a different value than was approved — the durable resume cannot execute either the un-adjudicated edit or an unapproved rewrite; ` +
-                    `refused pre-CAS (the checkpoint stays pending); re-submit the edited action so the rewrite is adjudicated and approved synchronously`);
+            const reread = readRejudge(editedReq, editedArgs, rechecked);
+            if (reread.kind === "rewritten") {
+                throw new CheckpointError("resume.constraint_rejected", `${editRewrittenSentence(cp.pendingAction.toolName)} (detail.editRewritten) — refused pre-CAS, the checkpoint stays pending and decidable`, { editRewritten: { acceptableForm: reread.form } });
             }
         }
     }

package/dist/core/runner/resume-checkpoint-screen.js

@@ -5,6 +5,7 @@ import { CHECKPOINT_FEATURES, CheckpointError, checkpointVersionOf, MAX_SUPPORTE
 import { judgeCheckpointRequirements } from "../checkpoint-requirements.js";
 import { constraintChainDigest, constraintChainEntryOfSuppliedLayer } from "../tool-policy.js";
 import { readFrozenSkillGrants } from "../skill-grant.js";
+import { readFrozenSkillScopes } from "../mods/spec-seats.js";
 import { chainInstallationGaps, chainInstallationRefusal } from "./child-tree.js";
 import { screeningInstallationsOf, unraisableGuardsOf } from "../mods/stations.js";
 import { refusePersistedToolNames, refuseRenamedDelegationMounts } from "./sub-agent-deny-lists.js";
@@ -61,6 +62,8 @@ export function resumeCheckpointScreen(input) {
         }
         if (readFrozenSkillGrants(cp.state.skillGrants) === undefined)
             throw new CheckpointError("checkpoint.invalid_outcome", "this checkpoint carries a skill-grant section (state.skillGrants) that does not read as grant rows under this engine — a damaged section, or a row an earlier release wrote whose entry this release reads as nothing (an entry with a surrounding space, say) — refusing to resume without the grant rows and refusals it carries; the checkpoint stays pending: finish it on a worker of the release that parked it, or expire it", { reason: "skill_grants_damaged" });
+        if (readFrozenSkillScopes(cp.state.skillScopes) === undefined)
+            throw new CheckpointError("checkpoint.invalid_outcome", "this checkpoint carries a skill-scope section (state.skillScopes) that does not read as a list of SkillSpec names — a damaged section — refusing to resume without the active skills' hooks it records; the checkpoint stays pending: finish it on a worker of the release that parked it, or expire it", { reason: "skill_scopes_damaged" });
         for (const field of ["handsRoot", "handsHome", "handsCwd"]) {
             const coordinate = cp.state[field];
             if (coordinate !== undefined && validatePath(coordinate, { intent: "validate-coordinate" }) === undefined)

package/dist/core/runner/resume-claim.d.ts

@@ -2,8 +2,8 @@
  * The resume ladder's CLAIM rung (E10), verbatim from `Runner.resumeStream`: the atomic
  * CAS (`claimTerminal` when the store provides it — one round trip carrying the loser's truth — else the
  * two-step `resolve` + diagnostic read), the same-Runner claim mark around it, and the loss classification
- * (`reopened_concurrently` for a live row whose rev moved, `already_resolved` for a consumed one, with the
- * dead parked-constraint entry evicted). Winning is the SOLE trigger to execute the pending action.
+ * (`reopened_concurrently` for a live row whose rev moved, `resume.holder_superseded` for the validated row a carried claim holder
+ * lost, `already_resolved` for a consumed one, with the dead parked-constraint entry evicted). Winning is the SOLE trigger to execute.
  *
  * Async (the CAS). It ends by handing off to the driver's post-claim rung (`next`) in its LAST continuation
  * — the post-consume hook fires on the tick the win was read — and returns what that rung returns.
@@ -19,6 +19,8 @@ export interface ResumeClaimInput<R> {
     store: CheckpointStore;
     /** borrowed-readonly — the twin the store persists as the resolved outcome. */
     outcomeForStore: ResumeRun["outcome"];
+    /** borrowed-readonly — the deployment's claim holder the resume acts under (`RunInternals.holder`), carried into the CAS. */
+    holder?: string | undefined;
     /** borrowed-mutable — the Runner's same-Runner claim marks: opened with the resolve attempt, released on a loss. */
     locallyClaimedTokens: Set<CheckpointToken>;
     /** borrowed-mutable — the Runner's parked-constraint registry: a terminally consumed token's entry is evicted. */

package/dist/core/runner/resume-claim.js

@@ -1,23 +1,30 @@
 import { CheckpointError } from "../checkpoint-store.js";
+import { checkpointRevOf } from "../checkpoint-generation.js";
 export async function resumeClaim(input) {
-    const { token, cp, store, outcomeForStore, locallyClaimedTokens, parentConstraintRegistry } = input;
+    const { token, cp, store, outcomeForStore, holder, locallyClaimedTokens, parentConstraintRegistry } = input;
+    const expect = { rev: checkpointRevOf(cp), ...(holder !== undefined ? { holder } : {}) };
     locallyClaimedTokens.add(token);
-    let won;
-    let claimLossStatus;
+    let won, loss;
     if (store.claimTerminal !== undefined) {
-        const claim = await store.claimTerminal(token, cp.scope, { kind: "resolve", outcome: outcomeForStore, expect: { rev: cp.rev ?? 0 } });
+        const claim = await store.claimTerminal(token, cp.scope, { kind: "resolve", outcome: outcomeForStore, expect });
         won = claim.claimed;
         if (!claim.claimed)
-            claimLossStatus = claim.current.status;
+            loss = { status: claim.current.status, rev: claim.current.status === "absent" ? undefined : claim.current.rev, sameRow: true };
     }
     else {
-        won = await store.resolve(token, cp.scope, outcomeForStore, { rev: cp.rev ?? 0 });
+        won = await store.resolve(token, cp.scope, outcomeForStore, expect);
     }
     if (!won)
         locallyClaimedTokens.delete(token);
     if (!won) {
-        const stillPending = claimLossStatus !== undefined ? claimLossStatus === "pending" : (await store.get(token))?.status === "pending";
-        if (stillPending) {
+        if (loss === undefined) {
+            const row = await store.get(token);
+            loss = row ? { status: row.status, rev: checkpointRevOf(row), sameRow: row.scope === cp.scope } : { status: "absent", rev: undefined, sameRow: false };
+        }
+        if (loss.status === "pending") {
+            if (holder !== undefined && loss.sameRow && loss.rev === expect.rev) {
+                throw new CheckpointError("resume.holder_superseded", "the claim this resume acts under is no longer the deployment's current grant — nothing was applied and the checkpoint is unchanged by this resume; the run is superseded: do not retry it (the current holder delivers)");
+            }
             throw new CheckpointError("checkpoint.reopened_concurrently", "checkpoint changed concurrently (its revision advanced via a resolve/reopen cycle since this resume validated) — not executed; re-resume against the current state");
         }
         parentConstraintRegistry.delete(token);

package/dist/core/runner/resume-policy-outcome.js

@@ -45,7 +45,7 @@ export function resumePolicyOutcome(input) {
         const reason = decide.reason;
         assertOutcomeText(reason, "reason");
         const feedback = decide.feedback;
-        assertOutcomeText(feedback, "feedback");
+        assertOutcomeText(feedback, "feedback", { field: "feedback" });
         plainPolicyOutcome = {
             gate: "policy_ask",
             boundCallId: decide.boundCallId,

package/dist/core/runner/retired-runner-deps.js

@@ -7,7 +7,8 @@ const RETIRED_RUNNER_DEPS_KEYS = {
     graderEnvFactory: "the grader env reaches the repair loop as `RepairLoopConfig.graderEnv`, minted by the trusted control plane (`assertOracleIsolation` / `GraderEnv` unchanged)",
     "hands.readCyberReminder": "a Read result carries only the reminders about that read (an empty file, an offset past the end, a file already in context) — no standing content-safety tail, so there is nothing to switch; a deployment that wants that sentence states it in its own `appendSystemPrompt`",
     promptProvider: "a deployment changes prompt text through overlays: register a `prompt.compose` handler on `RunnerDeps.mods` answering `{ overlays }` (role base `replace`, a brand line `add` to the role band, a behavior or scenario `add`, a core-behavior `replace` / `append` / `drop`), choose the role base per task with `TaskSpec.promptRole`, and dispose of an MCP server's instructions with a `prompt.section` registration answering `{ text }` / `{ text: null }`",
-    memorySessionIncarnation: "the occupant behind a session id is a cell of the session row now — `SessionMetadata.incarnation` on the metadata `Session.getMetadata()` returns (forks also `forkedFromIncarnation`), with `SessionStore.incarnationOf` for by-id readers; put the token the old seat answered on your sessions instead. A deployment that drops the seat without surfacing the cell loses the axis: records bind by session id alone",
+    allowImageUrl: "a remote image URL is judged by the one egress guard (https, the private-network floor) and the deployment's host floor — declare a CDN list as `RunnerDeps.hostFloor.only` (it bounds every structured egress: the fetch tool, task images, MCP http, A2A, WebSearch's SearXNG backend), or send the image inline",
+    memorySessionIncarnation: "the occupant behind a session id is a cell of the session row now — `SessionMetadata.incarnation` on the metadata `Session.getMetadata()` returns (forks also `forkedFromIncarnation`), with `SessionStore.headOf` (its `incarnation`) for by-id readers; put the token the old seat answered on your sessions instead. A deployment that drops the seat without surfacing the cell loses the axis: records bind by session id alone",
 };
 export function assertNoRetiredRunnerDeps(deps) {
     assertNoRetiredKeys(deps, RETIRED_RUNNER_DEPS_KEYS, "RunnerDeps");

package/dist/core/runner/rewind-files.d.ts

@@ -0,0 +1,15 @@
+import type { RewindFilesRequest, RewindFilesResult } from "../file-history-store.js";
+import type { SessionStore } from "../session.js";
+import type { RunnerDeps } from "../types.js";
+import type { SessionReadFileStates } from "./session-read-file-states.js";
+/** What the Runner lends the rewind: its current deps, its session store, its read-state seats, and its lock. */
+export interface RewindFilesSeats {
+    deps: RunnerDeps;
+    sessions: SessionStore;
+    readStates: SessionReadFileStates;
+    /** Whether a leg of this Runner holds or awaits `sessionId`'s lock. */
+    sessionBusy(sessionId: string): boolean;
+    /** Take `sessionId`'s lock; called synchronously after `sessionBusy` answered false, so nothing slips in between. */
+    takeSessionLock(sessionId: string): Promise<() => void>;
+}
+export declare function rewindSessionFiles(seats: RewindFilesSeats, request: RewindFilesRequest): Promise<RewindFilesResult>;

package/dist/core/runner/rewind-files.js

@@ -0,0 +1,132 @@
+import { types } from "node:util";
+import { isPlainRecord } from "../mods/kernel/receive.js";
+import { hasDestroy } from "../remote-env.js";
+import { readMember } from "../thrown-value.js";
+import { resolveDeploymentFileHistory, storeUnconfiguredRefusal } from "./file-history-request.js";
+import { prepareExecutionEnv } from "./prepare-execution-env.js";
+import { noBoundaryRefusal, settleFileHistoryRestore } from "./file-history-restore.js";
+import { adoptForkedFileHistory, resolveFileHistoryCoordinates } from "./prepare-file-history.js";
+import { createRollbackStack } from "./rollback-stack.js";
+import { settleTeardownLeg } from "./teardown-bounded.js";
+const REQUEST_KEYS = new Set(["sessionId", "to", "dryRun", "signal"]);
+export async function rewindSessionFiles(seats, request) {
+    const req = screenRewindFilesRequest(request);
+    const { deps } = seats;
+    const { wiredSeat, fileHistoryStore, captureStore } = resolveDeploymentFileHistory(deps);
+    if (fileHistoryStore === undefined)
+        throw storeUnconfiguredRefusal(wiredSeat, req.to);
+    if (seats.sessionBusy(req.sessionId))
+        throw sessionBusyRefusal(req.sessionId, req.to);
+    const lock = seats.takeSessionLock(req.sessionId);
+    const release = await lock;
+    try {
+        const session = await acquireExistingSession(seats.sessions, req.sessionId);
+        const report = (err) => {
+            try {
+                deps.onError?.(err, { phase: "config", sessionId: req.sessionId });
+            }
+            catch {
+            }
+        };
+        const rollback = createRollbackStack(report);
+        let envPhase;
+        try {
+            envPhase = await prepareExecutionEnv({ deps, spec: {}, internals: undefined, resume: undefined, placementRootResolved: req.sessionId, sessionId: req.sessionId, forgetOnThrow: async () => { }, rollback });
+        }
+        catch (err) {
+            await rollback.unwindAll();
+            throw err;
+        }
+        rollback.commit();
+        try {
+            return await rewindOnEnv(req, envPhase.executionEnv, envPhase.handsEnabled, envPhase.taskRootInitial, { store: fileHistoryStore, captureStore, session: session.session, seats });
+        }
+        finally {
+            const owned = envPhase.ownedEnvSeat.current;
+            if (owned !== undefined && hasDestroy(owned))
+                await settleTeardownLeg(() => owned.destroy(), "ownedEnv.destroy (rewindFiles)", report);
+        }
+    }
+    finally {
+        release();
+    }
+}
+async function rewindOnEnv(req, env, handsEnabled, taskRoot, ctx) {
+    if (!handsEnabled)
+        throw filesEnvUnsupportedRefusal(req.sessionId, req.to);
+    const { historyRoot, historyScope } = await resolveFileHistoryCoordinates(true, env, taskRoot, undefined, req.sessionId);
+    if (ctx.captureStore !== undefined)
+        await adoptForkedFileHistory(ctx.captureStore, ctx.session, req.sessionId, ctx.seats.deps.onError);
+    if (req.dryRun) {
+        if (!(await ctx.store.canRestore(historyScope, req.to)))
+            throw noBoundaryRefusal(req.to, req.sessionId, true);
+        const preview = ctx.store.diffStats === undefined ? null : await ctx.store.diffStats(historyScope, req.to, env, historyRoot);
+        return { dryRun: true, preview: preview ?? null };
+    }
+    const restore = await settleFileHistoryRestore({ store: ctx.store, sessionId: req.sessionId, target: req.to, before: false, env, root: historyRoot, signal: req.signal, readStates: ctx.seats.readStates });
+    return { dryRun: false, restore };
+}
+function screenRewindFilesRequest(request) {
+    const bad = (what) => {
+        const e = new Error(`Runner.rewindFiles: ${what} — nothing was rewound. The request is { sessionId, to, dryRun?, signal? }.`);
+        e.code = "rewind.invalid_spec";
+        throw e;
+    };
+    if (typeof request !== "object" || request === null)
+        return bad(`the request must be a plain object, got ${request === null ? "null" : typeof request}`);
+    if (types.isProxy(request) || !isPlainRecord(request))
+        return bad("the request must be a plain data object (not a Proxy, and with no prototype that could supply a member)");
+    let descriptors;
+    try {
+        descriptors = Object.getOwnPropertyDescriptors(request);
+    }
+    catch {
+        return bad("the request could not be read");
+    }
+    const keys = Reflect.ownKeys(descriptors);
+    const unknown = keys.filter((k) => typeof k !== "string" || !REQUEST_KEYS.has(k));
+    if (unknown.length > 0)
+        return bad(`unknown key ${unknown.map((k) => JSON.stringify(String(k))).join(", ")}`);
+    const read = {};
+    for (const k of keys) {
+        const d = descriptors[k];
+        if (!("value" in d))
+            return bad(`member ${JSON.stringify(k)} is an accessor, not a value`);
+        read[k] = d.value;
+    }
+    const { sessionId, to, dryRun, signal } = read;
+    if (typeof sessionId !== "string" || sessionId === "")
+        return bad(`sessionId must be a non-empty string, got ${shown(sessionId)}`);
+    if (typeof to !== "string" || to === "")
+        return bad(`to must be a non-empty entry id, got ${shown(to)}`);
+    if (dryRun !== undefined && typeof dryRun !== "boolean")
+        return bad(`dryRun must be a boolean when given, got ${shown(dryRun)}`);
+    if (signal !== undefined && !(signal instanceof AbortSignal))
+        return bad(`signal must be an AbortSignal when given, got ${shown(signal)}`);
+    return { sessionId, to, dryRun: dryRun === true, signal };
+}
+function shown(v) {
+    return typeof v === "string" ? JSON.stringify(v.slice(0, 40)) : v === null || typeof v === "boolean" || typeof v === "number" ? String(v) : `a ${typeof v}`;
+}
+async function acquireExistingSession(sessions, sessionId) {
+    try {
+        return await sessions.acquire(sessionId, { requireExisting: true });
+    }
+    catch (err) {
+        if (readMember(err, "code") !== "not_found")
+            throw err;
+        const e = new Error(`Runner.rewindFiles: session "${sessionId}" does not exist — nothing was rewound`);
+        e.code = "resume.session_not_found";
+        throw e;
+    }
+}
+function sessionBusyRefusal(sessionId, target) {
+    const e = new Error(`Runner.rewindFiles: a task is running or queued on session "${sessionId}" in this Runner — rewinding its files to entry "${target}" now would move them under that task, so nothing was rewound; retry once it has ended`);
+    e.code = "rewind.session_busy";
+    return e;
+}
+function filesEnvUnsupportedRefusal(sessionId, target) {
+    const e = new Error(`Runner.rewindFiles: this deployment mounts no filesystem-capable ExecutionEnv, so session "${sessionId}" has no working tree to rewind to entry "${target}" — nothing was rewound`);
+    e.code = "rewind.files_env_unsupported";
+    return e;
+}

package/dist/core/runner/run-attachment-seats.js

@@ -4,6 +4,7 @@ import { SKILLS_LISTING_PROBE_HEADER } from "./synthetic-tools.js";
 import { AGENT_LISTING_REMOVED_HEADER, SKILLS_LISTING_DELTA_HEADER, SKILLS_LISTING_REMOVED_HEADER, agentListingDeltaHeader, agentListingInitialHeader, createAttachmentState, replayAnnouncedListing, replayAnnouncedModels } from "./turn-attachments.js";
 import { wireOf } from "../tool-name-readings.js";
 import { rosterToolName } from "../tool-roster.js";
+import { rowNotExecuted } from "./tool-not-executed.js";
 export async function runAttachmentSeats(input) {
     const { spec, prepared, resume, rs, runner, next } = input;
     rs.counters.wroteThisRun = false;
@@ -27,7 +28,6 @@ export async function runAttachmentSeats(input) {
             ? { announcedGuideline: prepared.workflowSizeGuideline.legGuideline, current: prepared.workflowSizeGuideline.current }
             : undefined;
     rs.counters.cadenceTurns = 0;
-    rs.turn.lastTurnHadToolCalls = false;
     if (rs.attach.attachState !== undefined && (rs.attach.attachmentsCfg?.backgroundTasks ?? eventDefaultOn("background_tasks")) === true) {
         try {
             const branch = await prepared.session.getBranch();
@@ -176,7 +176,7 @@ export async function runAttachmentSeats(input) {
                     if ((fvMarked || text.includes("<system-reminder>[final verification]")) && rs.counters.finalVerifyInjections < 2)
                         rs.counters.finalVerifyInjections += 1;
                 }
-                else if (m.role === "toolResult" && !rs.counters.wroteThisRun && (prepared.toolEffects.get(wireOf("verify.wroteThisRunSeed", { toolName: rosterToolName(prepared.toolRosterDeltas.current, m.toolName) })) ?? "write") !== "read") {
+                else if (m.role === "toolResult" && !rs.counters.wroteThisRun && !rowNotExecuted(m.details) && (prepared.toolEffects.get(wireOf("verify.wroteThisRunSeed", { toolName: rosterToolName(prepared.toolRosterDeltas.current, m.toolName) })) ?? "write") !== "read") {
                     rs.counters.wroteThisRun = true;
                 }
             }

package/dist/core/runner/run-brain-sinks.d.ts

@@ -3,6 +3,7 @@ import { type ExtraBodyDroppedSeatInput } from "./extra-body-dropped-seat.js";
 import type { PushQueue } from "../push-queue.js";
 import type { TaskEvent } from "../types.js";
 import type { RunInternals, RunState } from "./contracts.js";
+import { type CapabilityWithheldRecord } from "./capability-withheld-seat.js";
 export interface RunBrainSinksInput {
     /** borrowed-mutable — the run's event queue: the `status` frames. */
     queue: PushQueue<TaskEvent>;
@@ -20,11 +21,13 @@ export interface RunBrainSinksInput {
     observeReasoningWireFacts: (facts: ReasoningWireFacts) => void;
     /** borrowed-readonly — the notice sink and the leg's ids; the fourth and fifth sinks' announcers are minted from them. */
     notice: ExtraBodyDroppedSeatInput;
+    /** borrowed-mutable — the session's announced record: the sixth sink's announcer says a withheld capability once per session. */
+    announced: CapabilityWithheldRecord;
 }
 export interface RunBrainSinksResult {
     /** Compose the three brain ALS sinks around a brain-driving call. */
     withBrainSinks: <T>(fn: () => Promise<T>) => Promise<T>;
-    /** Compose the two leg-wide request sinks (the extraBody strip, the credential-origin refusal) around the whole leg. */
+    /** Compose the three leg-wide request sinks (the extraBody strip, the credential-origin refusal, the withheld capability) around the whole leg. */
     withLegRequestSinks: <T>(fn: () => Promise<T>) => Promise<T>;
 }
 export declare function runBrainSinks(input: RunBrainSinksInput): RunBrainSinksResult;

package/dist/core/runner/run-brain-sinks.js

@@ -3,8 +3,9 @@ import { createExtraBodyDroppedScope } from "./extra-body-dropped-seat.js";
 import { createCredentialOriginRefusalScope } from "./credential-origin-seat.js";
 import { createSafeNotifier, observeThenableRejection } from "../safe-notify.js";
 import { emitTrace } from "../trace.js";
+import { createCapabilityWithheldScope } from "./capability-withheld-seat.js";
 export function runBrainSinks(input) {
-    const { queue, internals, rs, ident, observeReasoningWireFacts, notice } = input;
+    const { queue, internals, rs, ident, observeReasoningWireFacts, notice, announced } = input;
     const statusSinkNotifier = createSafeNotifier({
         onError: (f) => console.warn(`[sema-core] ${f.site}: run-internals status sink threw (contained; further failures counted, not re-disclosed): ${f.error.message}`),
     });
@@ -63,6 +64,7 @@ export function runBrainSinks(input) {
     const withBrainSinks = (fn) => runWithStatusSink(statusEmit, () => runWithBrainTelemetry(telemetryEmit, () => runWithReasoningWireFacts(observeReasoningWireFacts, fn)));
     const withExtraBodyDropped = createExtraBodyDroppedScope(notice);
     const withCredentialOriginRefusals = createCredentialOriginRefusalScope(notice);
-    const withLegRequestSinks = (fn) => withExtraBodyDropped(() => withCredentialOriginRefusals(fn));
+    const withCapabilityWithheld = createCapabilityWithheldScope(notice, announced);
+    const withLegRequestSinks = (fn) => withExtraBodyDropped(() => withCredentialOriginRefusals(() => withCapabilityWithheld(fn)));
     return { withBrainSinks, withLegRequestSinks };
 }

package/dist/core/runner/run-compaction-machinery.d.ts

@@ -24,7 +24,7 @@ export interface RunCompactionMachineryInput {
     runner: RunnerDepsSeat;
 }
 export interface RunCompactionMachineryResult {
-    /** The accounted compaction brain — `complete` always provided, usage recorded inline. */
+    /** The accounted compaction brain ({@link derivedLegBrain} on the `compaction` lane). */
     compactionBrain: Brain;
     /** Whether ROUTINE turn-boundary compaction runs for this task, asked AT THE BOUNDARY. The request's own
      *  `compaction` is fixed for the leg, but the deployment's per-model overlay is a live seat — an operator

package/dist/core/runner/run-compaction-machinery.js

@@ -4,22 +4,12 @@ import { compactionEnabled, contextOverlayFor } from "../context-settings.js";
 import { sanitizeCompactionSettings } from "../auto-compaction.js";
 import { modelCostToPricing } from "../pricing.js";
 import { emitTrace } from "../trace.js";
-import { runWithReasoningWireFacts, runWithStatusSink } from "../../brain/status-sink.js";
-import { sideCallBookOf } from "./side-call-account.js";
+import { derivedLegBrain, sideCallBookOf } from "./side-call-account.js";
 export function runCompactionMachinery(input) {
     const { spec, prepared, rs, stats, noteUnevaluablePriceTable, modelCatalog, runner } = input;
     const bookSideCall = sideCallBookOf(stats, { telemetry: rs.telemetry, pricing: () => runner.deps.pricing, noteUnevaluablePriceTable, catalog: modelCatalog });
     prepared.sideCallBookRef.book = bookSideCall;
-    const compactionBrain = {
-        stream: runner.deps.brain.stream,
-        complete: async (m, c, o) => {
-            const msg = await runWithStatusSink(() => { }, async () => await runWithReasoningWireFacts(() => { }, async () => runner.deps.brain.complete
-                ? await runner.deps.brain.complete(m, c, o)
-                : await (await Promise.resolve(runner.deps.brain.stream(m, c, o))).result()));
-            bookSideCall("compaction", m, msg);
-            return msg;
-        },
-    };
+    const compactionBrain = derivedLegBrain(() => runner.deps.brain, "compaction", bookSideCall);
     const legOverlay = () => contextOverlayFor(runner.deps.contextSettings, prepared.harness.getModelRef(), runner.deps);
     const withinTaskCompaction = () => compactionEnabled(spec.compaction?.enabled, legOverlay()) && (spec.compaction?.withinTask ?? true);
     const compactionBreaker = { failures: 0 };

package/dist/core/runner/run-git-lane.d.ts

@@ -47,6 +47,7 @@ export interface RunGitLaneInput {
      *  so a pending announcement is re-asserted into the session ahead of the boundary's own context work. */
     onTurnBoundary: (event: {
         model: Model;
+        continues: boolean;
     }) => Promise<undefined>;
     /** borrowed-readonly — the Runner's deployment deps, read LIVE inside the closures (`onError`). */
     runner: RunnerDepsSeat;

package/dist/core/runner/run-harness-handlers.js

@@ -5,17 +5,19 @@ import { emitTrace } from "../trace.js";
 import { primaryActivityArg } from "../arg-summary.js";
 import { egressText } from "../untrusted-egress.js";
 import { readDegradation } from "../../brain/degrading.js";
-import { OUTPUT_TOOL_NAME } from "./synthetic-tools.js";
+import { OUTPUT_TOOL_NAME } from "../tool-catalog-entries.js";
 import { usageCostMicroUsd } from "./usage-accounting.js";
 import { advanceCadenceClock, reduceToolEnd } from "./turn-attachments.js";
 import { gatedCallIdOf } from "./park-commit.js";
 import { hasVerifiableStructureSignal } from "./grounding-signal.js";
 import { announceToolCall, batchResponseDigest, emitSettled } from "./tool-end-body.js";
-import { stampRowNotExecuted } from "./tool-not-executed.js";
+import { neverExecuted, stampRowNotExecuted } from "./tool-not-executed.js";
+import { extensionCallOf, noteExtensionCallDenied, requesterOf } from "../mods/extension-call.js";
 import { createResponseModelSeat } from "./response-model-seat.js";
 import { createToolCallIdFoldSeat } from "./tool-call-id-fold-seat.js";
 import { createFinishReasonSeat } from "./finish-reason-seat.js";
-import { createToolTurnIncompleteSeat, turnCarriesToolCall } from "./tool-turn-repair-seat.js";
+import { createToolTurnIncompleteSeat } from "./tool-turn-repair-seat.js";
+import { createWithheldShellEnvSeat } from "./shell-env-withheld.js";
 import { wireOf } from "../tool-name-readings.js";
 import { rosterToolName } from "../tool-roster.js";
 export function createHarnessHandlers(input) {
@@ -24,11 +26,12 @@ export function createHarnessHandlers(input) {
     const toolCallIdFoldSeat = createToolCallIdFoldSeat(deps.runnerHooks.onNotice, { sessionId: prepared.sessionId, runId: prepared.runId });
     const toolTurnIncompleteSeat = createToolTurnIncompleteSeat(deps.runnerHooks.onNotice, { sessionId: prepared.sessionId, runId: prepared.runId });
     const finishReasonSeat = createFinishReasonSeat(deps.runnerHooks.onNotice, { sessionId: prepared.sessionId, runId: prepared.runId });
+    const withheldShellEnvSeat = createWithheldShellEnvSeat(prepared, deps.runnerHooks.onNotice);
     const { spec, queue, internals, ident, pushContent, emitCommitted, startedToolCallIds, toolStartAt, toolProgress, writeFamilyOf, toolLabels, postToolBatchArmed, batchArgs, internalsNotifier, mediaByteCapBytes } = deps;
     const frames = { push: (f) => pushContent({ ...f, ...ident() }), structured: prepared.structuredProjector, mediaByteCapBytes };
     const startOf = (e) => {
         const label = toolLabels.get(e.toolName);
-        return { toolCallId: e.toolCallId, spelledName: e.toolName, wireName: rosterToolName(prepared.toolRosterDeltas.current, e.toolName), ...(label !== undefined ? { label } : {}), args: e.args };
+        return { toolCallId: e.toolCallId, spelledName: e.toolName, wireName: rosterToolName(prepared.toolRosterDeltas.current, e.toolName), ...(label !== undefined ? { label } : {}), args: e.args, ...requesterOf(prepared.modBus, e.toolCallId) };
     };
     let lastWorkspaceCwd = prepared.cwdRef?.current;
     const announceWorkspaceMove = () => {
@@ -201,7 +204,6 @@ export function createHarnessHandlers(input) {
             const content = m.content;
             if (rs.attach.attachState !== undefined)
                 rs.counters.cadenceTurns = advanceCadenceClock(rs.attach.attachState, rs.counters.cadenceTurns, content, writeFamilyOf);
-            rs.turn.lastTurnHadToolCalls = turnCarriesToolCall(content);
         }
         rs.turn.callStartAt = undefined;
         rs.turn.firstTokenAt = undefined;
@@ -223,12 +225,15 @@ export function createHarnessHandlers(input) {
         const activityArg = primaryActivityArg(event.args);
         internalsNotifier.notify(() => observeThenableRejection(internals?.onActivity?.({ phase: "start", toolCallId: event.toolCallId, toolName: event.toolName, at: startAt, ...(activityArg !== undefined ? { arg: activityArg } : {}) }), internalsNotifier, "runtask.onActivity.start"), "runtask.onActivity.start");
         announceToolCall(prepared.toolOccurrences, startOf(event), frames);
+        withheldShellEnvSeat.onToolStart(event.toolName);
     };
     const onToolEnd = (event) => {
         const toolStarted = toolStartAt.get(event.toolCallId);
         toolStartAt.delete(event.toolCallId);
         const toolNow = Date.now();
-        if (!rs.counters.wroteThisRun && (prepared.toolEffects.get(wireOf("verify.wroteThisRun", { toolName: rosterToolName(prepared.toolRosterDeltas.current, event.toolName) })) ?? "write") !== "read") {
+        const occ = prepared.toolOccurrences.get(event.toolCallId);
+        const ran = event.notExecuted !== true && !(occ !== undefined && neverExecuted(occ));
+        if (ran && !rs.counters.wroteThisRun && (prepared.toolEffects.get(wireOf("verify.wroteThisRun", { toolName: rosterToolName(prepared.toolRosterDeltas.current, event.toolName) })) ?? "write") !== "read") {
             rs.counters.wroteThisRun = true;
         }
         if (rs.attach.attachState !== undefined && !event.isError) {
@@ -237,7 +242,7 @@ export function createHarnessHandlers(input) {
                 reduceToolEnd(rs.attach.attachState, det);
         }
         if (postToolBatchArmed) {
-            if (prepared.blockedToolCalls.delete(event.toolCallId) || event.notExecuted === true) {
+            if (prepared.blockedToolCalls.delete(event.toolCallId) || !ran || extensionCallOf(prepared.modBus, event.toolCallId) !== undefined) {
                 batchArgs?.delete(event.toolCallId);
             }
             else {
@@ -267,6 +272,8 @@ export function createHarnessHandlers(input) {
             ...(event.notExecuted === true ? { notExecuted: true } : {}),
             ...(() => { const id = prepared.abortController.signal.aborted ? gatedCallIdOf(prepared) : undefined; return id !== undefined ? { gatedCallIdOfRun: id } : {}; })(),
         }, frames);
+        if (settled.gate?.disposition.kind === "denied")
+            noteExtensionCallDenied(prepared.modBus, event.toolCallId);
         stampRowNotExecuted(event.result, settled.notExecuted === true);
         emitTrace(rs.telemetry.tracer, () => ({
             kind: "tool.call",

package/dist/core/runner/run-leg.d.ts

@@ -82,7 +82,7 @@ export interface RunLegInput<R> {
     unsubBoundary: () => void;
     /** borrowed-readonly — the git lane's harness-event release, called third. */
     unsub: () => void;
-    /** borrowed-readonly — the Runner's deployment deps, read LIVE (`onError`, `hooks`, `onNotice`, `allowImageUrl`, `mediaByteCapBytes`; the resumed
+    /** borrowed-readonly — the Runner's deployment deps, read LIVE (`onError`, `hooks`, `onNotice`, `mediaByteCapBytes`; the resumed
      *  decision's resolver files its execution record's word through `onNotice` too); the one home of why it is a seat and not a
      *  captured object is {@link RunnerDepsSeat}. */
     runner: RunnerDepsSeat;