@sema-agent/core 7.55.0 → 7.56.0

package/dist/core/runner/resume-apply.js

@@ -1,5 +1,4 @@
 import { snapshotActorAssertion } from "../../internal/llm.js";
-import { ASK_USER_QUESTION_TOOL_NAME } from "../ask-question.js";
 import { CheckpointError, remainingBudgetMicroUsd } from "../checkpoint-store.js";
 import { chainPolicyOnLeg, chainTopAnchors } from "./child-tree.js";
 import { mintHookInvocationIdentity } from "../hooks.js";
@@ -8,14 +7,15 @@ import { checkToolPolicyProjection, policyCannotAnswer, refuseOutOfContractDecis
 import { callFaceSeat, parkedCallFaceOf } from "../tool-roster.js";
 import { readCallTarget } from "../effective-path-target.js";
 import { inlineUntrusted } from "../untrusted-text.js";
-import { deepJsonEqual, describeSuppliedValue, mintDecideRecord } from "./decide-continuation.js";
+import { describeSuppliedValue, mintDecideRecord } from "./decide-continuation.js";
+import { editRewrittenSentence, readRejudge } from "../rewrite-rejudge.js";
 import { orgVerdictBeforeClaim } from "./permission-rule-lanes.js";
 import { chainCannotJudge } from "./call-hook-stations.js";
 import { thrownText } from "../thrown-value.js";
-import { wireOf } from "../tool-name-readings.js";
 import { judgeApprovalObject } from "../approval-object.js";
-import { SKILL_CONTENT_MAX_CHARS, SKILL_TOOL_NAME, normalizeSkills } from "./synthetic-tools.js";
-import { skillLoadReading } from "./skill-base-dir.js";
+import { SKILL_TOOL_NAME, normalizeSkills, skillsThatLoad } from "./synthetic-tools.js";
+import { readSkillsSeat } from "./skills-seat.js";
+import { frozenSkillScopesOf } from "../mods/spec-seats.js";
 export async function resumeApply(input) {
     const { cp, config, internals, outcomeGate, wakeMessage, resumeSignal, recheckGovernanceWindow, plainReviewOutcome, plainParkOutcome, runner, effectiveDelegationFacts } = input;
     let plainPolicyOutcome = input.plainPolicyOutcome;
@@ -23,7 +23,7 @@ export async function resumeApply(input) {
     let legMods;
     if (outcomeGate === "wake" && wakeMessage !== undefined) {
         if (resumeSignal?.aborted !== true) {
-            legMods = await admitLegMods({ spec: config, deps: runner.deps, sessionId: cp.sessionId });
+            legMods = await admitLegMods({ spec: config, deps: runner.deps, sessionId: cp.sessionId, skills: skillsThatLoad(readSkillsSeat(config.skills)), reopenedSkills: frozenSkillScopesOf(cp.state) });
         }
         if (legMods !== undefined && legMods.bus.hasHandlers("classic.UserPromptSubmit")) {
             const screenedMessage = wakeMessage;
@@ -75,7 +75,7 @@ export async function resumeApply(input) {
         });
     };
     if (plainPolicyOutcome?.decision === "allow" && cp.pendingAction.kind === "tool_approval") {
-        const servedSkills = normalizeSkills(config.skills).filter((s) => skillLoadReading(s, SKILL_CONTENT_MAX_CHARS).loads);
+        const servedSkills = skillsThatLoad(normalizeSkills(config.skills));
         const claimed = judgeApprovalObject(cp.pendingAction, { args: plainPolicyOutcome.updatedInput ?? cp.pendingAction.args, skills: servedSkills, skillToolName: SKILL_TOOL_NAME }, "claim");
         if (claimed !== "match")
             throw new CheckpointError("checkpoint.invalid_outcome", claimed.message, { field: "boundGrantDigest" });
@@ -83,8 +83,7 @@ export async function resumeApply(input) {
     if (plainPolicyOutcome !== undefined &&
         plainPolicyOutcome.decision === "allow" &&
         plainPolicyOutcome.updatedInput !== undefined &&
-        cp.pendingAction.kind === "tool_approval" &&
-        wireOf("resume.editRecheckQuestionSkip", cp.pendingAction) !== ASK_USER_QUESTION_TOOL_NAME) {
+        cp.pendingAction.kind === "tool_approval") {
         const editedArgs = plainPolicyOutcome.updatedInput;
         const editBudget = {
             resourceRemainingMicroUsd: remainingBudgetMicroUsd(cp.resourceLedger),
@@ -148,9 +147,9 @@ export async function resumeApply(input) {
             }
             if (policyCannotAnswer(rechecked, plainPolicyOutcome.hostDecision.decidedBy))
                 throw new CheckpointError("checkpoint.invalid_outcome", `the approver EDITED this call's input, the edited args raise a question that requires real approval, and the decision is the deployment's policy — a policy's answer is not a person's (decide the edit as "person", or approve the shown input); refusing pre-CAS, the checkpoint stays pending`, { field: "hostDecision" });
-            if (rechecked.updatedInput !== undefined && !deepJsonEqual(rechecked.updatedInput, editedArgs)) {
-                throw new CheckpointError("resume.constraint_rejected", `the deployment's resume-edit policy REWROTE the approver's edited args to a different value than was approved — the durable resume cannot execute either the un-adjudicated edit or an unapproved rewrite; ` +
-                    `refused pre-CAS (the checkpoint stays pending); re-submit the edited action so the rewrite is adjudicated and approved synchronously`);
+            const reread = readRejudge(editedReq, editedArgs, rechecked);
+            if (reread.kind === "rewritten") {
+                throw new CheckpointError("resume.constraint_rejected", `${editRewrittenSentence(cp.pendingAction.toolName)} (detail.editRewritten) — refused pre-CAS, the checkpoint stays pending and decidable`, { editRewritten: { acceptableForm: reread.form } });
             }
         }
     }

package/dist/core/runner/resume-checkpoint-screen.js

@@ -5,6 +5,7 @@ import { CHECKPOINT_FEATURES, CheckpointError, checkpointVersionOf, MAX_SUPPORTE
 import { judgeCheckpointRequirements } from "../checkpoint-requirements.js";
 import { constraintChainDigest, constraintChainEntryOfSuppliedLayer } from "../tool-policy.js";
 import { readFrozenSkillGrants } from "../skill-grant.js";
+import { readFrozenSkillScopes } from "../mods/spec-seats.js";
 import { chainInstallationGaps, chainInstallationRefusal } from "./child-tree.js";
 import { screeningInstallationsOf, unraisableGuardsOf } from "../mods/stations.js";
 import { refusePersistedToolNames, refuseRenamedDelegationMounts } from "./sub-agent-deny-lists.js";
@@ -61,6 +62,8 @@ export function resumeCheckpointScreen(input) {
         }
         if (readFrozenSkillGrants(cp.state.skillGrants) === undefined)
             throw new CheckpointError("checkpoint.invalid_outcome", "this checkpoint carries a skill-grant section (state.skillGrants) that does not read as grant rows under this engine — a damaged section, or a row an earlier release wrote whose entry this release reads as nothing (an entry with a surrounding space, say) — refusing to resume without the grant rows and refusals it carries; the checkpoint stays pending: finish it on a worker of the release that parked it, or expire it", { reason: "skill_grants_damaged" });
+        if (readFrozenSkillScopes(cp.state.skillScopes) === undefined)
+            throw new CheckpointError("checkpoint.invalid_outcome", "this checkpoint carries a skill-scope section (state.skillScopes) that does not read as a list of SkillSpec names — a damaged section — refusing to resume without the active skills' hooks it records; the checkpoint stays pending: finish it on a worker of the release that parked it, or expire it", { reason: "skill_scopes_damaged" });
         for (const field of ["handsRoot", "handsHome", "handsCwd"]) {
             const coordinate = cp.state[field];
             if (coordinate !== undefined && validatePath(coordinate, { intent: "validate-coordinate" }) === undefined)

package/dist/core/runner/resume-claim.d.ts

@@ -2,8 +2,8 @@
  * The resume ladder's CLAIM rung (E10), verbatim from `Runner.resumeStream`: the atomic
  * CAS (`claimTerminal` when the store provides it — one round trip carrying the loser's truth — else the
  * two-step `resolve` + diagnostic read), the same-Runner claim mark around it, and the loss classification
- * (`reopened_concurrently` for a live row whose rev moved, `already_resolved` for a consumed one, with the
- * dead parked-constraint entry evicted). Winning is the SOLE trigger to execute the pending action.
+ * (`reopened_concurrently` for a live row whose rev moved, `resume.holder_superseded` for the validated row a carried claim holder
+ * lost, `already_resolved` for a consumed one, with the dead parked-constraint entry evicted). Winning is the SOLE trigger to execute.
  *
  * Async (the CAS). It ends by handing off to the driver's post-claim rung (`next`) in its LAST continuation
  * — the post-consume hook fires on the tick the win was read — and returns what that rung returns.
@@ -19,6 +19,8 @@ export interface ResumeClaimInput<R> {
     store: CheckpointStore;
     /** borrowed-readonly — the twin the store persists as the resolved outcome. */
     outcomeForStore: ResumeRun["outcome"];
+    /** borrowed-readonly — the deployment's claim holder the resume acts under (`RunInternals.holder`), carried into the CAS. */
+    holder?: string | undefined;
     /** borrowed-mutable — the Runner's same-Runner claim marks: opened with the resolve attempt, released on a loss. */
     locallyClaimedTokens: Set<CheckpointToken>;
     /** borrowed-mutable — the Runner's parked-constraint registry: a terminally consumed token's entry is evicted. */

package/dist/core/runner/resume-claim.js

@@ -1,23 +1,30 @@
 import { CheckpointError } from "../checkpoint-store.js";
+import { checkpointRevOf } from "../checkpoint-generation.js";
 export async function resumeClaim(input) {
-    const { token, cp, store, outcomeForStore, locallyClaimedTokens, parentConstraintRegistry } = input;
+    const { token, cp, store, outcomeForStore, holder, locallyClaimedTokens, parentConstraintRegistry } = input;
+    const expect = { rev: checkpointRevOf(cp), ...(holder !== undefined ? { holder } : {}) };
     locallyClaimedTokens.add(token);
-    let won;
-    let claimLossStatus;
+    let won, loss;
     if (store.claimTerminal !== undefined) {
-        const claim = await store.claimTerminal(token, cp.scope, { kind: "resolve", outcome: outcomeForStore, expect: { rev: cp.rev ?? 0 } });
+        const claim = await store.claimTerminal(token, cp.scope, { kind: "resolve", outcome: outcomeForStore, expect });
         won = claim.claimed;
         if (!claim.claimed)
-            claimLossStatus = claim.current.status;
+            loss = { status: claim.current.status, rev: claim.current.status === "absent" ? undefined : claim.current.rev, sameRow: true };
     }
     else {
-        won = await store.resolve(token, cp.scope, outcomeForStore, { rev: cp.rev ?? 0 });
+        won = await store.resolve(token, cp.scope, outcomeForStore, expect);
     }
     if (!won)
         locallyClaimedTokens.delete(token);
     if (!won) {
-        const stillPending = claimLossStatus !== undefined ? claimLossStatus === "pending" : (await store.get(token))?.status === "pending";
-        if (stillPending) {
+        if (loss === undefined) {
+            const row = await store.get(token);
+            loss = row ? { status: row.status, rev: checkpointRevOf(row), sameRow: row.scope === cp.scope } : { status: "absent", rev: undefined, sameRow: false };
+        }
+        if (loss.status === "pending") {
+            if (holder !== undefined && loss.sameRow && loss.rev === expect.rev) {
+                throw new CheckpointError("resume.holder_superseded", "the claim this resume acts under is no longer the deployment's current grant — nothing was applied and the checkpoint is unchanged by this resume; the run is superseded: do not retry it (the current holder delivers)");
+            }
             throw new CheckpointError("checkpoint.reopened_concurrently", "checkpoint changed concurrently (its revision advanced via a resolve/reopen cycle since this resume validated) — not executed; re-resume against the current state");
         }
         parentConstraintRegistry.delete(token);

package/dist/core/runner/retired-runner-deps.js

@@ -7,6 +7,7 @@ const RETIRED_RUNNER_DEPS_KEYS = {
     graderEnvFactory: "the grader env reaches the repair loop as `RepairLoopConfig.graderEnv`, minted by the trusted control plane (`assertOracleIsolation` / `GraderEnv` unchanged)",
     "hands.readCyberReminder": "a Read result carries only the reminders about that read (an empty file, an offset past the end, a file already in context) — no standing content-safety tail, so there is nothing to switch; a deployment that wants that sentence states it in its own `appendSystemPrompt`",
     promptProvider: "a deployment changes prompt text through overlays: register a `prompt.compose` handler on `RunnerDeps.mods` answering `{ overlays }` (role base `replace`, a brand line `add` to the role band, a behavior or scenario `add`, a core-behavior `replace` / `append` / `drop`), choose the role base per task with `TaskSpec.promptRole`, and dispose of an MCP server's instructions with a `prompt.section` registration answering `{ text }` / `{ text: null }`",
+    allowImageUrl: "a remote image URL is judged by the one egress guard (https, the private-network floor) and the deployment's host floor — declare a CDN list as `RunnerDeps.hostFloor.only` (it bounds every structured egress: the fetch tool, task images, MCP http, A2A, WebSearch's SearXNG backend), or send the image inline",
     memorySessionIncarnation: "the occupant behind a session id is a cell of the session row now — `SessionMetadata.incarnation` on the metadata `Session.getMetadata()` returns (forks also `forkedFromIncarnation`), with `SessionStore.headOf` (its `incarnation`) for by-id readers; put the token the old seat answered on your sessions instead. A deployment that drops the seat without surfacing the cell loses the axis: records bind by session id alone",
 };
 export function assertNoRetiredRunnerDeps(deps) {

package/dist/core/runner/rewind-files.d.ts

@@ -0,0 +1,15 @@
+import type { RewindFilesRequest, RewindFilesResult } from "../file-history-store.js";
+import type { SessionStore } from "../session.js";
+import type { RunnerDeps } from "../types.js";
+import type { SessionReadFileStates } from "./session-read-file-states.js";
+/** What the Runner lends the rewind: its current deps, its session store, its read-state seats, and its lock. */
+export interface RewindFilesSeats {
+    deps: RunnerDeps;
+    sessions: SessionStore;
+    readStates: SessionReadFileStates;
+    /** Whether a leg of this Runner holds or awaits `sessionId`'s lock. */
+    sessionBusy(sessionId: string): boolean;
+    /** Take `sessionId`'s lock; called synchronously after `sessionBusy` answered false, so nothing slips in between. */
+    takeSessionLock(sessionId: string): Promise<() => void>;
+}
+export declare function rewindSessionFiles(seats: RewindFilesSeats, request: RewindFilesRequest): Promise<RewindFilesResult>;

package/dist/core/runner/rewind-files.js

@@ -0,0 +1,132 @@
+import { types } from "node:util";
+import { isPlainRecord } from "../mods/kernel/receive.js";
+import { hasDestroy } from "../remote-env.js";
+import { readMember } from "../thrown-value.js";
+import { resolveDeploymentFileHistory, storeUnconfiguredRefusal } from "./file-history-request.js";
+import { prepareExecutionEnv } from "./prepare-execution-env.js";
+import { noBoundaryRefusal, settleFileHistoryRestore } from "./file-history-restore.js";
+import { adoptForkedFileHistory, resolveFileHistoryCoordinates } from "./prepare-file-history.js";
+import { createRollbackStack } from "./rollback-stack.js";
+import { settleTeardownLeg } from "./teardown-bounded.js";
+const REQUEST_KEYS = new Set(["sessionId", "to", "dryRun", "signal"]);
+export async function rewindSessionFiles(seats, request) {
+    const req = screenRewindFilesRequest(request);
+    const { deps } = seats;
+    const { wiredSeat, fileHistoryStore, captureStore } = resolveDeploymentFileHistory(deps);
+    if (fileHistoryStore === undefined)
+        throw storeUnconfiguredRefusal(wiredSeat, req.to);
+    if (seats.sessionBusy(req.sessionId))
+        throw sessionBusyRefusal(req.sessionId, req.to);
+    const lock = seats.takeSessionLock(req.sessionId);
+    const release = await lock;
+    try {
+        const session = await acquireExistingSession(seats.sessions, req.sessionId);
+        const report = (err) => {
+            try {
+                deps.onError?.(err, { phase: "config", sessionId: req.sessionId });
+            }
+            catch {
+            }
+        };
+        const rollback = createRollbackStack(report);
+        let envPhase;
+        try {
+            envPhase = await prepareExecutionEnv({ deps, spec: {}, internals: undefined, resume: undefined, placementRootResolved: req.sessionId, sessionId: req.sessionId, forgetOnThrow: async () => { }, rollback });
+        }
+        catch (err) {
+            await rollback.unwindAll();
+            throw err;
+        }
+        rollback.commit();
+        try {
+            return await rewindOnEnv(req, envPhase.executionEnv, envPhase.handsEnabled, envPhase.taskRootInitial, { store: fileHistoryStore, captureStore, session: session.session, seats });
+        }
+        finally {
+            const owned = envPhase.ownedEnvSeat.current;
+            if (owned !== undefined && hasDestroy(owned))
+                await settleTeardownLeg(() => owned.destroy(), "ownedEnv.destroy (rewindFiles)", report);
+        }
+    }
+    finally {
+        release();
+    }
+}
+async function rewindOnEnv(req, env, handsEnabled, taskRoot, ctx) {
+    if (!handsEnabled)
+        throw filesEnvUnsupportedRefusal(req.sessionId, req.to);
+    const { historyRoot, historyScope } = await resolveFileHistoryCoordinates(true, env, taskRoot, undefined, req.sessionId);
+    if (ctx.captureStore !== undefined)
+        await adoptForkedFileHistory(ctx.captureStore, ctx.session, req.sessionId, ctx.seats.deps.onError);
+    if (req.dryRun) {
+        if (!(await ctx.store.canRestore(historyScope, req.to)))
+            throw noBoundaryRefusal(req.to, req.sessionId, true);
+        const preview = ctx.store.diffStats === undefined ? null : await ctx.store.diffStats(historyScope, req.to, env, historyRoot);
+        return { dryRun: true, preview: preview ?? null };
+    }
+    const restore = await settleFileHistoryRestore({ store: ctx.store, sessionId: req.sessionId, target: req.to, before: false, env, root: historyRoot, signal: req.signal, readStates: ctx.seats.readStates });
+    return { dryRun: false, restore };
+}
+function screenRewindFilesRequest(request) {
+    const bad = (what) => {
+        const e = new Error(`Runner.rewindFiles: ${what} — nothing was rewound. The request is { sessionId, to, dryRun?, signal? }.`);
+        e.code = "rewind.invalid_spec";
+        throw e;
+    };
+    if (typeof request !== "object" || request === null)
+        return bad(`the request must be a plain object, got ${request === null ? "null" : typeof request}`);
+    if (types.isProxy(request) || !isPlainRecord(request))
+        return bad("the request must be a plain data object (not a Proxy, and with no prototype that could supply a member)");
+    let descriptors;
+    try {
+        descriptors = Object.getOwnPropertyDescriptors(request);
+    }
+    catch {
+        return bad("the request could not be read");
+    }
+    const keys = Reflect.ownKeys(descriptors);
+    const unknown = keys.filter((k) => typeof k !== "string" || !REQUEST_KEYS.has(k));
+    if (unknown.length > 0)
+        return bad(`unknown key ${unknown.map((k) => JSON.stringify(String(k))).join(", ")}`);
+    const read = {};
+    for (const k of keys) {
+        const d = descriptors[k];
+        if (!("value" in d))
+            return bad(`member ${JSON.stringify(k)} is an accessor, not a value`);
+        read[k] = d.value;
+    }
+    const { sessionId, to, dryRun, signal } = read;
+    if (typeof sessionId !== "string" || sessionId === "")
+        return bad(`sessionId must be a non-empty string, got ${shown(sessionId)}`);
+    if (typeof to !== "string" || to === "")
+        return bad(`to must be a non-empty entry id, got ${shown(to)}`);
+    if (dryRun !== undefined && typeof dryRun !== "boolean")
+        return bad(`dryRun must be a boolean when given, got ${shown(dryRun)}`);
+    if (signal !== undefined && !(signal instanceof AbortSignal))
+        return bad(`signal must be an AbortSignal when given, got ${shown(signal)}`);
+    return { sessionId, to, dryRun: dryRun === true, signal };
+}
+function shown(v) {
+    return typeof v === "string" ? JSON.stringify(v.slice(0, 40)) : v === null || typeof v === "boolean" || typeof v === "number" ? String(v) : `a ${typeof v}`;
+}
+async function acquireExistingSession(sessions, sessionId) {
+    try {
+        return await sessions.acquire(sessionId, { requireExisting: true });
+    }
+    catch (err) {
+        if (readMember(err, "code") !== "not_found")
+            throw err;
+        const e = new Error(`Runner.rewindFiles: session "${sessionId}" does not exist — nothing was rewound`);
+        e.code = "resume.session_not_found";
+        throw e;
+    }
+}
+function sessionBusyRefusal(sessionId, target) {
+    const e = new Error(`Runner.rewindFiles: a task is running or queued on session "${sessionId}" in this Runner — rewinding its files to entry "${target}" now would move them under that task, so nothing was rewound; retry once it has ended`);
+    e.code = "rewind.session_busy";
+    return e;
+}
+function filesEnvUnsupportedRefusal(sessionId, target) {
+    const e = new Error(`Runner.rewindFiles: this deployment mounts no filesystem-capable ExecutionEnv, so session "${sessionId}" has no working tree to rewind to entry "${target}" — nothing was rewound`);
+    e.code = "rewind.files_env_unsupported";
+    return e;
+}

package/dist/core/runner/run-attachment-seats.js

@@ -4,6 +4,7 @@ import { SKILLS_LISTING_PROBE_HEADER } from "./synthetic-tools.js";
 import { AGENT_LISTING_REMOVED_HEADER, SKILLS_LISTING_DELTA_HEADER, SKILLS_LISTING_REMOVED_HEADER, agentListingDeltaHeader, agentListingInitialHeader, createAttachmentState, replayAnnouncedListing, replayAnnouncedModels } from "./turn-attachments.js";
 import { wireOf } from "../tool-name-readings.js";
 import { rosterToolName } from "../tool-roster.js";
+import { rowNotExecuted } from "./tool-not-executed.js";
 export async function runAttachmentSeats(input) {
     const { spec, prepared, resume, rs, runner, next } = input;
     rs.counters.wroteThisRun = false;
@@ -175,7 +176,7 @@ export async function runAttachmentSeats(input) {
                     if ((fvMarked || text.includes("<system-reminder>[final verification]")) && rs.counters.finalVerifyInjections < 2)
                         rs.counters.finalVerifyInjections += 1;
                 }
-                else if (m.role === "toolResult" && !rs.counters.wroteThisRun && (prepared.toolEffects.get(wireOf("verify.wroteThisRunSeed", { toolName: rosterToolName(prepared.toolRosterDeltas.current, m.toolName) })) ?? "write") !== "read") {
+                else if (m.role === "toolResult" && !rs.counters.wroteThisRun && !rowNotExecuted(m.details) && (prepared.toolEffects.get(wireOf("verify.wroteThisRunSeed", { toolName: rosterToolName(prepared.toolRosterDeltas.current, m.toolName) })) ?? "write") !== "read") {
                     rs.counters.wroteThisRun = true;
                 }
             }

package/dist/core/runner/run-brain-sinks.d.ts

@@ -3,6 +3,7 @@ import { type ExtraBodyDroppedSeatInput } from "./extra-body-dropped-seat.js";
 import type { PushQueue } from "../push-queue.js";
 import type { TaskEvent } from "../types.js";
 import type { RunInternals, RunState } from "./contracts.js";
+import { type CapabilityWithheldRecord } from "./capability-withheld-seat.js";
 export interface RunBrainSinksInput {
     /** borrowed-mutable — the run's event queue: the `status` frames. */
     queue: PushQueue<TaskEvent>;
@@ -20,11 +21,13 @@ export interface RunBrainSinksInput {
     observeReasoningWireFacts: (facts: ReasoningWireFacts) => void;
     /** borrowed-readonly — the notice sink and the leg's ids; the fourth and fifth sinks' announcers are minted from them. */
     notice: ExtraBodyDroppedSeatInput;
+    /** borrowed-mutable — the session's announced record: the sixth sink's announcer says a withheld capability once per session. */
+    announced: CapabilityWithheldRecord;
 }
 export interface RunBrainSinksResult {
     /** Compose the three brain ALS sinks around a brain-driving call. */
     withBrainSinks: <T>(fn: () => Promise<T>) => Promise<T>;
-    /** Compose the two leg-wide request sinks (the extraBody strip, the credential-origin refusal) around the whole leg. */
+    /** Compose the three leg-wide request sinks (the extraBody strip, the credential-origin refusal, the withheld capability) around the whole leg. */
     withLegRequestSinks: <T>(fn: () => Promise<T>) => Promise<T>;
 }
 export declare function runBrainSinks(input: RunBrainSinksInput): RunBrainSinksResult;

package/dist/core/runner/run-brain-sinks.js

@@ -3,8 +3,9 @@ import { createExtraBodyDroppedScope } from "./extra-body-dropped-seat.js";
 import { createCredentialOriginRefusalScope } from "./credential-origin-seat.js";
 import { createSafeNotifier, observeThenableRejection } from "../safe-notify.js";
 import { emitTrace } from "../trace.js";
+import { createCapabilityWithheldScope } from "./capability-withheld-seat.js";
 export function runBrainSinks(input) {
-    const { queue, internals, rs, ident, observeReasoningWireFacts, notice } = input;
+    const { queue, internals, rs, ident, observeReasoningWireFacts, notice, announced } = input;
     const statusSinkNotifier = createSafeNotifier({
         onError: (f) => console.warn(`[sema-core] ${f.site}: run-internals status sink threw (contained; further failures counted, not re-disclosed): ${f.error.message}`),
     });
@@ -63,6 +64,7 @@ export function runBrainSinks(input) {
     const withBrainSinks = (fn) => runWithStatusSink(statusEmit, () => runWithBrainTelemetry(telemetryEmit, () => runWithReasoningWireFacts(observeReasoningWireFacts, fn)));
     const withExtraBodyDropped = createExtraBodyDroppedScope(notice);
     const withCredentialOriginRefusals = createCredentialOriginRefusalScope(notice);
-    const withLegRequestSinks = (fn) => withExtraBodyDropped(() => withCredentialOriginRefusals(fn));
+    const withCapabilityWithheld = createCapabilityWithheldScope(notice, announced);
+    const withLegRequestSinks = (fn) => withExtraBodyDropped(() => withCredentialOriginRefusals(() => withCapabilityWithheld(fn)));
     return { withBrainSinks, withLegRequestSinks };
 }

package/dist/core/runner/run-harness-handlers.js

@@ -11,11 +11,13 @@ import { advanceCadenceClock, reduceToolEnd } from "./turn-attachments.js";
 import { gatedCallIdOf } from "./park-commit.js";
 import { hasVerifiableStructureSignal } from "./grounding-signal.js";
 import { announceToolCall, batchResponseDigest, emitSettled } from "./tool-end-body.js";
-import { stampRowNotExecuted } from "./tool-not-executed.js";
+import { neverExecuted, stampRowNotExecuted } from "./tool-not-executed.js";
+import { extensionCallOf, noteExtensionCallDenied, requesterOf } from "../mods/extension-call.js";
 import { createResponseModelSeat } from "./response-model-seat.js";
 import { createToolCallIdFoldSeat } from "./tool-call-id-fold-seat.js";
 import { createFinishReasonSeat } from "./finish-reason-seat.js";
 import { createToolTurnIncompleteSeat } from "./tool-turn-repair-seat.js";
+import { createWithheldShellEnvSeat } from "./shell-env-withheld.js";
 import { wireOf } from "../tool-name-readings.js";
 import { rosterToolName } from "../tool-roster.js";
 export function createHarnessHandlers(input) {
@@ -24,11 +26,12 @@ export function createHarnessHandlers(input) {
     const toolCallIdFoldSeat = createToolCallIdFoldSeat(deps.runnerHooks.onNotice, { sessionId: prepared.sessionId, runId: prepared.runId });
     const toolTurnIncompleteSeat = createToolTurnIncompleteSeat(deps.runnerHooks.onNotice, { sessionId: prepared.sessionId, runId: prepared.runId });
     const finishReasonSeat = createFinishReasonSeat(deps.runnerHooks.onNotice, { sessionId: prepared.sessionId, runId: prepared.runId });
+    const withheldShellEnvSeat = createWithheldShellEnvSeat(prepared, deps.runnerHooks.onNotice);
     const { spec, queue, internals, ident, pushContent, emitCommitted, startedToolCallIds, toolStartAt, toolProgress, writeFamilyOf, toolLabels, postToolBatchArmed, batchArgs, internalsNotifier, mediaByteCapBytes } = deps;
     const frames = { push: (f) => pushContent({ ...f, ...ident() }), structured: prepared.structuredProjector, mediaByteCapBytes };
     const startOf = (e) => {
         const label = toolLabels.get(e.toolName);
-        return { toolCallId: e.toolCallId, spelledName: e.toolName, wireName: rosterToolName(prepared.toolRosterDeltas.current, e.toolName), ...(label !== undefined ? { label } : {}), args: e.args };
+        return { toolCallId: e.toolCallId, spelledName: e.toolName, wireName: rosterToolName(prepared.toolRosterDeltas.current, e.toolName), ...(label !== undefined ? { label } : {}), args: e.args, ...requesterOf(prepared.modBus, e.toolCallId) };
     };
     let lastWorkspaceCwd = prepared.cwdRef?.current;
     const announceWorkspaceMove = () => {
@@ -222,12 +225,15 @@ export function createHarnessHandlers(input) {
         const activityArg = primaryActivityArg(event.args);
         internalsNotifier.notify(() => observeThenableRejection(internals?.onActivity?.({ phase: "start", toolCallId: event.toolCallId, toolName: event.toolName, at: startAt, ...(activityArg !== undefined ? { arg: activityArg } : {}) }), internalsNotifier, "runtask.onActivity.start"), "runtask.onActivity.start");
         announceToolCall(prepared.toolOccurrences, startOf(event), frames);
+        withheldShellEnvSeat.onToolStart(event.toolName);
     };
     const onToolEnd = (event) => {
         const toolStarted = toolStartAt.get(event.toolCallId);
         toolStartAt.delete(event.toolCallId);
         const toolNow = Date.now();
-        if (!rs.counters.wroteThisRun && (prepared.toolEffects.get(wireOf("verify.wroteThisRun", { toolName: rosterToolName(prepared.toolRosterDeltas.current, event.toolName) })) ?? "write") !== "read") {
+        const occ = prepared.toolOccurrences.get(event.toolCallId);
+        const ran = event.notExecuted !== true && !(occ !== undefined && neverExecuted(occ));
+        if (ran && !rs.counters.wroteThisRun && (prepared.toolEffects.get(wireOf("verify.wroteThisRun", { toolName: rosterToolName(prepared.toolRosterDeltas.current, event.toolName) })) ?? "write") !== "read") {
             rs.counters.wroteThisRun = true;
         }
         if (rs.attach.attachState !== undefined && !event.isError) {
@@ -236,7 +242,7 @@ export function createHarnessHandlers(input) {
                 reduceToolEnd(rs.attach.attachState, det);
         }
         if (postToolBatchArmed) {
-            if (prepared.blockedToolCalls.delete(event.toolCallId) || event.notExecuted === true) {
+            if (prepared.blockedToolCalls.delete(event.toolCallId) || !ran || extensionCallOf(prepared.modBus, event.toolCallId) !== undefined) {
                 batchArgs?.delete(event.toolCallId);
             }
             else {
@@ -266,6 +272,8 @@ export function createHarnessHandlers(input) {
             ...(event.notExecuted === true ? { notExecuted: true } : {}),
             ...(() => { const id = prepared.abortController.signal.aborted ? gatedCallIdOf(prepared) : undefined; return id !== undefined ? { gatedCallIdOfRun: id } : {}; })(),
         }, frames);
+        if (settled.gate?.disposition.kind === "denied")
+            noteExtensionCallDenied(prepared.modBus, event.toolCallId);
         stampRowNotExecuted(event.result, settled.notExecuted === true);
         emitTrace(rs.telemetry.tracer, () => ({
             kind: "tool.call",

package/dist/core/runner/run-leg.d.ts

@@ -82,7 +82,7 @@ export interface RunLegInput<R> {
     unsubBoundary: () => void;
     /** borrowed-readonly — the git lane's harness-event release, called third. */
     unsub: () => void;
-    /** borrowed-readonly — the Runner's deployment deps, read LIVE (`onError`, `hooks`, `onNotice`, `allowImageUrl`, `mediaByteCapBytes`; the resumed
+    /** borrowed-readonly — the Runner's deployment deps, read LIVE (`onError`, `hooks`, `onNotice`, `mediaByteCapBytes`; the resumed
      *  decision's resolver files its execution record's word through `onNotice` too); the one home of why it is a seat and not a
      *  captured object is {@link RunnerDepsSeat}. */
     runner: RunnerDepsSeat;

package/dist/core/runner/run-leg.js

@@ -1,6 +1,6 @@
 import { snapshotActorAssertion } from "../../internal/llm.js";
 import { redactThenCut } from "../../agents/subagent-steps.js";
-import { ASK_USER_QUESTION_TOOL_NAME } from "../ask-question.js";
+import { isEngineQuestionFace } from "../ask-question.js";
 import { CheckpointError, readPendingSteerQueue, realApprovalOrgFact, remainingBudgetMicroUsd } from "../checkpoint-store.js";
 import { normalizePersistedRuleHit } from "../rule-lane-reads.js";
 import { decidersNote, SETTLEMENT_NOBODY_JUDGED } from "../gate-outcome.js";
@@ -21,7 +21,7 @@ import { hasDestroy } from "../remote-env.js";
 import { advertisedWritableRootsSeat, attestationOf, exemptRootsSeat, humanRefusalSentence, licenseCovers, ownedReading, policyCannotAnswer, policyRefusalMessage, refuseOutOfContractDecision } from "../tool-policy.js";
 import { failedJudgmentDeny } from "./policy-throw.js";
 import { pathDenialCardOf } from "../../tools/fs/safety.js";
-import { callFaceSeat, parkedRowLiveFace, rosterEntryNamed } from "../tool-roster.js";
+import { callFaceSeat, parkedRowLiveFace, rosterEntryNamed, rowMember } from "../tool-roster.js";
 import { deliverEngineNotice } from "../types.js";
 import { delimitUntrusted, inlineUntrusted, REVIEWER_NOTE_MAX_BODY, sanitizeUntrustedText } from "../untrusted-text.js";
 import { errorCodeOf } from "./terminal-account.js";
@@ -29,7 +29,8 @@ import { DEFAULT_PRECALL_OUTPUT_TOKENS, platformLimitTerminal } from "./clock-an
 import { legContextOverlayOption } from "./compaction-call-options.js";
 import { mintOutputStyleReminder, owedPostureText } from "./compaction-restate.js";
 import { advisorFrameText, registerAdvisorReceipt } from "./advisor-instructions.js";
-import { deepJsonEqual, resumeContinuation } from "./decide-continuation.js";
+import { resumeContinuation } from "./decide-continuation.js";
+import { editRewrittenSentence, sameBytes } from "../rewrite-rejudge.js";
 import { approvalWordsOf, owedApprovalWords, withApprovalWords } from "./approval-feedback.js";
 import { chainCannotJudge } from "./call-hook-stations.js";
 import { settleExecutionRecord } from "./execution-record.js";
@@ -46,12 +47,11 @@ import { settleTeardownLeg } from "./teardown-bounded.js";
 import { announceToolCall, emitSettled, toolResultMsg } from "./tool-end-body.js";
 import { rowDetailsOf, withRowNotExecuted } from "./tool-not-executed.js";
 import { announceListingTruncation } from "../skill-listing-budget.js";
-import { attachmentEnvelopeTags, collectDateChange, commitAgentListing, commitSkillsListing, reduceToolEnd, renderAgentListingFrame, renderOrphanedBackgroundTasks, renderSkillsListingFrame, stampWriteAnchor } from "./turn-attachments.js";
-import { flushOwedAnnouncedSnapshot } from "./announce-once-ledger.js";
+import { attachmentEnvelopeTags, collectDateChange, commitAgentListing, commitSkillsListing, owedMcpUnavailable, reduceToolEnd, renderAgentListingFrame, renderOrphanedBackgroundTasks, renderSkillsListingFrame, stampWriteAnchor } from "./turn-attachments.js";
+import { flushOwedAnnouncedSnapshot, settleMcpUnavailable } from "./announce-once-ledger.js";
 import { thrownMarksOf } from "../thrown-value.js";
 import { egressThrownText, egressValue } from "../untrusted-egress.js";
 import { ruleSourcePhrase } from "../rule-denial-sentence.js";
-import { wireOf } from "../tool-name-readings.js";
 export async function runLeg(input) {
     const { spec, queue, prepared, resume, rs, entryActor, effectiveTimeoutMs, timeout, pushContent, ident, emitCommitted, writeFamilyOf, startedToolCallIds, announceWorkspaceMove, withBrainSinks, flushGitMirror, loopLatch, notificationLane, unsubscribeTaskNotifications, unsubGitRetry, unsubBoundary, unsub, runner, next } = input;
     let final;
@@ -164,6 +164,9 @@ export async function runLeg(input) {
                 const outputStyleWrapped = mintOutputStyleReminder(prepared);
                 if (outputStyleWrapped !== undefined)
                     continuation += "\n\n" + outputStyleWrapped;
+                const unavailableResume = owedMcpUnavailable(prepared, rs.attach.attachmentsCfg);
+                if (unavailableResume !== undefined)
+                    continuation += "\n\n" + mintSystemReminder(sanitizeUntrustedText(unavailableResume.body, attachmentEnvelopeTags("mcp_unavailable")), prepared.reminderMark);
                 const advisorResumeFrame = advisorFrameText(prepared);
                 if (advisorResumeFrame !== undefined)
                     continuation += "\n\n" + advisorResumeFrame;
@@ -279,6 +282,8 @@ export async function runLeg(input) {
                     }
                     if (postureText !== undefined)
                         prepared.frameReceipts.pending.push({ source: "posture", text: continuation, commit: () => undefined });
+                    if (unavailableResume !== undefined)
+                        prepared.frameReceipts.pending.push({ source: "mcp_unavailable", text: continuation, commit: () => void (settleMcpUnavailable(prepared, unavailableResume.entries), queue.push({ type: "steering_injected", source: "mcp_unavailable", preview: redactThenCut(unavailableResume.body, 220), ...ident() }), (rs.attach.attachmentsInjected += 1)) });
                     if (approvalFrames.length > 0) {
                         prepared.frameReceipts.pending.push({
                             source: "approval_feedback",
@@ -361,6 +366,9 @@ export async function runLeg(input) {
             const dateFrame = legToday !== undefined ? collectDateChange(rs.attach.dateState, legToday) : undefined;
             if (dateFrame !== undefined)
                 firstFrames.push({ source: "date_change", body: dateFrame.body, commit: () => void (rs.attach.dateState.announcedDate = legToday), disclose: () => undefined });
+            const unavailable = owedMcpUnavailable(prepared, rs.attach.attachmentsCfg);
+            if (unavailable !== undefined)
+                firstFrames.push({ source: "mcp_unavailable", body: unavailable.body, commit: () => settleMcpUnavailable(prepared, unavailable.entries), disclose: () => undefined });
             if (rs.attach.attachState !== undefined) {
                 const attach = rs.attach.attachState;
                 if (rs.attach.agentListingOn && prepared.agentListing !== undefined) {
@@ -450,7 +458,7 @@ export async function runLeg(input) {
             }
             else {
                 const images = spec.images
-                    ? await Promise.all(spec.images.map((img) => toImageContent(img, runner.deps.allowImageUrl)))
+                    ? await Promise.all(spec.images.map((img) => toImageContent(img, prepared.hostFloor)))
                     : undefined;
                 if (gitLegDelivered !== undefined) {
                     const delivered = gitLegDelivered;
@@ -570,7 +578,7 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
     const { outcome } = resume;
     if (pendingAction.kind !== "tool_approval" || outcome.gate !== "policy_ask")
         return;
-    const mounted = () => { const tool = prepared.tools.find((x) => x.name === pendingAction.toolName); const roster = prepared.toolRosterDeltas.current; return tool === undefined || roster === undefined ? {} : { tool, entry: rosterEntryNamed(roster, pendingAction.toolName) }; };
+    const mounted = () => { const roster = prepared.toolRosterDeltas.current; const entry = roster === undefined ? undefined : rosterEntryNamed(roster, pendingAction.toolName); const tool = entry?.name === pendingAction.toolName ? rowMember(entry) : undefined; return tool === undefined ? {} : { tool, entry }; };
     const reopen = (miss) => { throw Object.assign(new Error(miss.message), { code: miss.code }); };
     const liveTool = mounted().tool;
     const atSession = outcome.decision === "allow" ? judgeApprovalObject(pendingAction, { tool: mounted().entry }, "session") : "match";
@@ -580,7 +588,7 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
     if (decidedGate === undefined) {
         throw new CheckpointError("checkpoint.invalid_outcome", "pending action reached the resolver with no settlement record on its decision (gateOutcome) — refusing to execute or settle a decision that carries no record");
     }
-    const humanRewrite = wireOf("resume.questionArgsShown", pendingAction) === ASK_USER_QUESTION_TOOL_NAME ? undefined : outcome.updatedInput;
+    const humanRewrite = isEngineQuestionFace(parkedRowLiveFace(prepared.toolRosterDeltas.current, pendingAction)) ? undefined : outcome.updatedInput;
     const reading = liveTool === undefined ? undefined : ownedReading((a) => readToolCallArguments(liveTool, { type: "toolCall", id: pendingAction.toolCallId, name: pendingAction.toolName, arguments: {} }, a));
     const beltFace = () => { const f = parkedRowLiveFace(prepared.toolRosterDeltas.current, pendingAction); if (f !== undefined && reading !== undefined)
         stampArgsReading(f, reading); return f; };
@@ -652,9 +660,14 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
         emitCommitted(await prepared.session.appendMessage(resultRow(hookDenial, true)), "toolResult", pendingAction.toolCallId);
         return;
     }
-    const rescreened = humanRewrite === undefined && screened !== undefined ? tryRead(screened.args) : undefined;
+    const rescreened = screened !== undefined ? tryRead(screened.args) : undefined;
     if (rescreened?.unread !== undefined)
         return settleUnreadable(rescreened.unread.error, "the arguments a PreToolUse hook rewrote it to");
+    if (humanRewrite !== undefined && rescreened !== undefined && !sameBytes({}, resolvedArgs, rescreened.args)) {
+        const text = formatHookFeedback(`${editRewrittenSentence(pendingAction.toolName)}, which a PreToolUse hook wrote — this approval is spent; the call has to be re-issued.`, prepared.reminderMark);
+        await settleEnd(true, { content: text, details: { editRewritten: { acceptableForm: rescreened.args } } }, "hook");
+        return emitCommitted(await prepared.session.appendMessage(resultRow(text, true)), "toolResult", pendingAction.toolCallId);
+    }
     const executedArgs = rescreened !== undefined ? rescreened.args : resolvedArgs;
     const unseen = !licenseCovers(pendingAction.boundInputHash, executedArgs);
     let beltReading;
@@ -687,19 +700,18 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
     if (unseen && prepared.basePolicyForResumeEdit) {
         const rechecked = refuseOutOfContractDecision(await beltCheck((signal) => prepared.basePolicyForResumeEdit.check(beltReq(), signal), "the deployment's tool policy re-checking a resumed call"));
         const personUnanswered = policyCannotAnswer(rechecked, outcome.hostDecision.decidedBy);
-        const beltUnsafe = rechecked.action === "deny" ||
-            (rechecked.updatedInput !== undefined && ((read) => read.unread !== undefined || !deepJsonEqual(read.args, executedArgs))(tryRead(rechecked.updatedInput))) ||
-            personUnanswered;
-        if (beltUnsafe) {
+        const rewrite = rechecked.updatedInput !== undefined ? tryRead(rechecked.updatedInput) : undefined;
+        const rewrote = rewrite !== undefined && (rewrite.unread !== undefined || !sameBytes({}, rewrite.args, executedArgs));
+        if (rechecked.action === "deny" || rewrote || personUnanswered) {
             const why = rechecked.action === "deny"
                 ? (rechecked.message ? `: ${rechecked.message}` : "")
                 : personUnanswered
                     ? " (the call as it would run requires a person's approval, and this decision was the deployment's policy)"
                     : " (the policy rewrote these bytes to a value that was not approved)";
             const editedDenial = formatHookFeedback(`${outcome.updatedInput !== undefined ? "The approver EDITED this call's input; the edited call" : "A PreToolUse hook REWROTE this approved call's input; the rewritten call"} is refused by the deployment's tool policy and was not executed${why}.`, prepared.reminderMark);
-            await settleEnd(true, { content: editedDenial, ...denialCard(rechecked) }, "policy");
-            const eid = await prepared.session.appendMessage(resultRow(editedDenial, true));
-            emitCommitted(eid, "toolResult", pendingAction.toolCallId);
+            const outlet = rechecked.action !== "deny" && !personUnanswered && humanRewrite !== undefined && rewrite?.unread === undefined && rewrite !== undefined ? { details: { editRewritten: { acceptableForm: rewrite.args } } } : denialCard(rechecked);
+            await settleEnd(true, { content: editedDenial, ...outlet }, "policy");
+            emitCommitted(await prepared.session.appendMessage(resultRow(editedDenial, true)), "toolResult", pendingAction.toolCallId);
             return;
         }
     }
@@ -841,7 +853,7 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
     const finalize = (executed) => prepared.harness.finalizeToolCall({ type: "toolCall", id: pendingAction.toolCallId, name: spelledName, arguments: executedArgs }, executedArgs, executed);
     let res;
     try {
-        res = await tool.execute(pendingAction.toolCallId, args, prepared.abortController.signal);
+        res = await (prepared.toolCallStation ?? ((_c, run) => run()))({ toolCallId: pendingAction.toolCallId, toolName: tool.name, args }, () => tool.execute(pendingAction.toolCallId, args, prepared.abortController.signal), prepared.abortController.signal);
     }
     catch (err) {
         const execError = `Error: ${egressThrownText("same-principal", err)}`;

package/dist/core/runner/run-settle-and-teardown.js

@@ -96,6 +96,7 @@ export async function runSettleAndTeardown(input) {
             editedFiles: prepared.editedFilesSnapshot(),
             haltedOnUserRejection: prepared.batchHaltRef.current !== undefined,
             haltConsumption: prepared.harness.haltConsumption(),
+            answerEntryIds: prepared.harness.answerEntryIdsOf(final),
             strandedHumanAnswers,
             remoteEnvFailures: prepared.remoteEnvFailures,
             effectiveReadFace: prepared.effectiveReadFace,
@@ -283,7 +284,7 @@ export async function runSettleAndTeardown(input) {
         if (writeDateAnchor !== undefined)
             await settleTeardownLeg(writeDateAnchor, "date anchor (settle leg)", (e) => runner.deps.onError?.(e, { phase: "degraded", sessionId: prepared.sessionId }));
         if (prepared.crossBoundary !== undefined)
-            await prepared.crossBoundary.settle();
+            await prepared.crossBoundary.settle(() => defaultTaskRegistry.owedDeliveries({ ...prepared.registryAccess, sessionId: prepared.sessionId }));
         const ownedEnvDying = prepared.ownedEnv !== undefined &&
             hasDestroy(prepared.ownedEnv) &&
             isIsolated(prepared.ownedEnv) &&