@sema-agent/core 7.55.0 → 7.57.0

package/dist/core/runner/prepare-wiring-manifest.js

@@ -117,10 +117,10 @@ function announceDurableGateUnavailable(args) {
     });
 }
 export function prepareWiringManifest(input) {
-    const { spec, deps, internals, resume, sessionId, runId, hostTaskId, taskScope, modBus, checkpointScope, policyLayers, effectivePolicy, handsEnabled, taskRootFinal, legWriteGuard, mcp, irreversibleTools, egressTools, toolEffects, ownedEnv, executionEnv, offloadStore, onceLedger, usageWindows, envLifetimeSuspendAt, runtimeCaps, resolvedInteractionPosture, durableQuestionFace, liveQuestionFace, checkpointStore, sessions, modelGateManifest, autoModeArmReason, permissionMode, lockedPreflight, peerLaneRefs, frameSettlement, sessionBox, harness, pausedRef, askSeat, liveInheritedGate, delegation, toolRoster, readDenyBuiltinTiersActive, lspManagerWired, shellReadStationArmed, crossBoundaryStationEngaged, lspDiagnosticsLive, fileHistoryFact, projectMemoryFact, sessionRulesChildrenReadLive, memoryPollution, advisorFact } = input;
+    const { spec, deps, internals, resume, sessionId, runId, hostTaskId, taskScope, modBus, standingModBus, checkpointScope, policyLayers, effectivePolicy, handsEnabled, taskRootFinal, legWriteGuard, mcp, irreversibleTools, egressTools, toolEffects, ownedEnv, executionEnv, offloadStore, onceLedger, usageWindows, envLifetimeSuspendAt, runtimeCaps, resolvedInteractionPosture, durableQuestionFace, liveQuestionFace, checkpointStore, sessions, modelGateManifest, autoModeArmReason, permissionMode, lockedPreflight, peerLaneRefs, frameSettlement, sessionBox, harness, pausedRef, askSeat, liveInheritedGate, delegation, toolRoster, readDenyBuiltinTiersActive, lspManagerWired, shellReadStationArmed, crossBoundaryStationEngaged, lspDiagnosticsLive, fileHistoryFact, projectMemoryFact, sessionRulesChildrenReadLive, memoryPollution, advisorFact, hostFloorPosture } = input;
     const onAsk = askSeat.value;
     const handWriteTools = toolRoster.entries.filter((e) => e.mountedBy === "hands" && (e.effect === "write" || e.effect === "idempotent")).map((e) => e.name);
-    const hasEffectAwareGate = policyLayers.length > 0 || chainJudges(modBus);
+    const hasEffectAwareGate = policyLayers.length > 0 || chainJudges(standingModBus);
     const rosterHolds = new Set(toolRoster.entries.map((e) => e.name));
     const peerWriteUngated = modePolicyOf(permissionMode.current).unstated === "ask"
         ? []
@@ -223,7 +223,7 @@ export function prepareWiringManifest(input) {
         mods: modBus.records,
         ...(lspManagerWired ? { lsp: deriveLspSeam(toolRoster.entries.some((e) => e.contract.contractId === LSP_CONTRACT_ID), lspDiagnosticsLive) } : {}),
         hands: deriveHandsSeam(handsEnabled),
-        fileHistory: fileHistoryFact, projectMemory: projectMemoryFact, sessionRulesChildrenReadLive, ...(advisorFact !== undefined ? { advisor: advisorFact } : {}),
+        fileHistory: fileHistoryFact, projectMemory: projectMemoryFact, sessionRulesChildrenReadLive, ...(advisorFact !== undefined ? { advisor: advisorFact } : {}), ...(hostFloorPosture !== undefined ? { hostFloor: hostFloorPosture } : {}),
     });
     peerLaneRefs.askEffective = askSeatEffective(wiringManifest);
     peerLaneRefs.permissionMode = () => permissionMode.current;

package/dist/core/runner/resume-admission.js

@@ -49,7 +49,7 @@ export async function resumeAdmission(input) {
     const resumeSignal = config.signal;
     let suppliedMessage;
     refuseRetiredModeSeed(cp.state);
-    config = refuseResumeDoors(config, cp.state.inheritedGate, runner.deps, sessions);
+    config = refuseResumeDoors(config, cp.state.inheritedGate, runner.deps, sessions, internals?.holder);
     const parkedSteers = readPendingSteerQueue(cp.state);
     if (outcomeGate === "wake") {
         suppliedMessage = outcome.message;

package/dist/core/runner/resume-apply.js

@@ -1,5 +1,4 @@
 import { snapshotActorAssertion } from "../../internal/llm.js";
-import { ASK_USER_QUESTION_TOOL_NAME } from "../ask-question.js";
 import { CheckpointError, remainingBudgetMicroUsd } from "../checkpoint-store.js";
 import { chainPolicyOnLeg, chainTopAnchors } from "./child-tree.js";
 import { mintHookInvocationIdentity } from "../hooks.js";
@@ -8,14 +7,15 @@ import { checkToolPolicyProjection, policyCannotAnswer, refuseOutOfContractDecis
 import { callFaceSeat, parkedCallFaceOf } from "../tool-roster.js";
 import { readCallTarget } from "../effective-path-target.js";
 import { inlineUntrusted } from "../untrusted-text.js";
-import { deepJsonEqual, describeSuppliedValue, mintDecideRecord } from "./decide-continuation.js";
+import { describeSuppliedValue, mintDecideRecord } from "./decide-continuation.js";
+import { editRewrittenSentence, readRejudge } from "../rewrite-rejudge.js";
 import { orgVerdictBeforeClaim } from "./permission-rule-lanes.js";
 import { chainCannotJudge } from "./call-hook-stations.js";
 import { thrownText } from "../thrown-value.js";
-import { wireOf } from "../tool-name-readings.js";
 import { judgeApprovalObject } from "../approval-object.js";
-import { SKILL_CONTENT_MAX_CHARS, SKILL_TOOL_NAME, normalizeSkills } from "./synthetic-tools.js";
-import { skillLoadReading } from "./skill-base-dir.js";
+import { SKILL_TOOL_NAME, normalizeSkills, skillsThatLoad } from "./synthetic-tools.js";
+import { readSkillsSeat } from "./skills-seat.js";
+import { frozenSkillScopesOf } from "../mods/spec-seats.js";
 export async function resumeApply(input) {
     const { cp, config, internals, outcomeGate, wakeMessage, resumeSignal, recheckGovernanceWindow, plainReviewOutcome, plainParkOutcome, runner, effectiveDelegationFacts } = input;
     let plainPolicyOutcome = input.plainPolicyOutcome;
@@ -23,7 +23,7 @@ export async function resumeApply(input) {
     let legMods;
     if (outcomeGate === "wake" && wakeMessage !== undefined) {
         if (resumeSignal?.aborted !== true) {
-            legMods = await admitLegMods({ spec: config, deps: runner.deps, sessionId: cp.sessionId });
+            legMods = await admitLegMods({ spec: config, deps: runner.deps, sessionId: cp.sessionId, skills: skillsThatLoad(readSkillsSeat(config.skills)), reopenedSkills: frozenSkillScopesOf(cp.state) });
         }
         if (legMods !== undefined && legMods.bus.hasHandlers("classic.UserPromptSubmit")) {
             const screenedMessage = wakeMessage;
@@ -75,7 +75,7 @@ export async function resumeApply(input) {
         });
     };
     if (plainPolicyOutcome?.decision === "allow" && cp.pendingAction.kind === "tool_approval") {
-        const servedSkills = normalizeSkills(config.skills).filter((s) => skillLoadReading(s, SKILL_CONTENT_MAX_CHARS).loads);
+        const servedSkills = skillsThatLoad(normalizeSkills(config.skills));
         const claimed = judgeApprovalObject(cp.pendingAction, { args: plainPolicyOutcome.updatedInput ?? cp.pendingAction.args, skills: servedSkills, skillToolName: SKILL_TOOL_NAME }, "claim");
         if (claimed !== "match")
             throw new CheckpointError("checkpoint.invalid_outcome", claimed.message, { field: "boundGrantDigest" });
@@ -83,8 +83,7 @@ export async function resumeApply(input) {
     if (plainPolicyOutcome !== undefined &&
         plainPolicyOutcome.decision === "allow" &&
         plainPolicyOutcome.updatedInput !== undefined &&
-        cp.pendingAction.kind === "tool_approval" &&
-        wireOf("resume.editRecheckQuestionSkip", cp.pendingAction) !== ASK_USER_QUESTION_TOOL_NAME) {
+        cp.pendingAction.kind === "tool_approval") {
         const editedArgs = plainPolicyOutcome.updatedInput;
         const editBudget = {
             resourceRemainingMicroUsd: remainingBudgetMicroUsd(cp.resourceLedger),
@@ -148,9 +147,9 @@ export async function resumeApply(input) {
             }
             if (policyCannotAnswer(rechecked, plainPolicyOutcome.hostDecision.decidedBy))
                 throw new CheckpointError("checkpoint.invalid_outcome", `the approver EDITED this call's input, the edited args raise a question that requires real approval, and the decision is the deployment's policy — a policy's answer is not a person's (decide the edit as "person", or approve the shown input); refusing pre-CAS, the checkpoint stays pending`, { field: "hostDecision" });
-            if (rechecked.updatedInput !== undefined && !deepJsonEqual(rechecked.updatedInput, editedArgs)) {
-                throw new CheckpointError("resume.constraint_rejected", `the deployment's resume-edit policy REWROTE the approver's edited args to a different value than was approved — the durable resume cannot execute either the un-adjudicated edit or an unapproved rewrite; ` +
-                    `refused pre-CAS (the checkpoint stays pending); re-submit the edited action so the rewrite is adjudicated and approved synchronously`);
+            const reread = readRejudge(editedReq, editedArgs, rechecked);
+            if (reread.kind === "rewritten") {
+                throw new CheckpointError("resume.constraint_rejected", `${editRewrittenSentence(cp.pendingAction.toolName)} (detail.editRewritten) — refused pre-CAS, the checkpoint stays pending and decidable`, { editRewritten: { acceptableForm: reread.form } });
             }
         }
     }

package/dist/core/runner/resume-checkpoint-screen.js

@@ -5,6 +5,7 @@ import { CHECKPOINT_FEATURES, CheckpointError, checkpointVersionOf, MAX_SUPPORTE
 import { judgeCheckpointRequirements } from "../checkpoint-requirements.js";
 import { constraintChainDigest, constraintChainEntryOfSuppliedLayer } from "../tool-policy.js";
 import { readFrozenSkillGrants } from "../skill-grant.js";
+import { readFrozenSkillScopes } from "../mods/spec-seats.js";
 import { chainInstallationGaps, chainInstallationRefusal } from "./child-tree.js";
 import { screeningInstallationsOf, unraisableGuardsOf } from "../mods/stations.js";
 import { refusePersistedToolNames, refuseRenamedDelegationMounts } from "./sub-agent-deny-lists.js";
@@ -61,6 +62,8 @@ export function resumeCheckpointScreen(input) {
         }
         if (readFrozenSkillGrants(cp.state.skillGrants) === undefined)
             throw new CheckpointError("checkpoint.invalid_outcome", "this checkpoint carries a skill-grant section (state.skillGrants) that does not read as grant rows under this engine — a damaged section, or a row an earlier release wrote whose entry this release reads as nothing (an entry with a surrounding space, say) — refusing to resume without the grant rows and refusals it carries; the checkpoint stays pending: finish it on a worker of the release that parked it, or expire it", { reason: "skill_grants_damaged" });
+        if (readFrozenSkillScopes(cp.state.skillScopes) === undefined)
+            throw new CheckpointError("checkpoint.invalid_outcome", "this checkpoint carries a skill-scope section (state.skillScopes) that does not read as a list of SkillSpec names — a damaged section — refusing to resume without the active skills' hooks it records; the checkpoint stays pending: finish it on a worker of the release that parked it, or expire it", { reason: "skill_scopes_damaged" });
         for (const field of ["handsRoot", "handsHome", "handsCwd"]) {
             const coordinate = cp.state[field];
             if (coordinate !== undefined && validatePath(coordinate, { intent: "validate-coordinate" }) === undefined)

package/dist/core/runner/resume-claim.d.ts

@@ -2,8 +2,8 @@
  * The resume ladder's CLAIM rung (E10), verbatim from `Runner.resumeStream`: the atomic
  * CAS (`claimTerminal` when the store provides it — one round trip carrying the loser's truth — else the
  * two-step `resolve` + diagnostic read), the same-Runner claim mark around it, and the loss classification
- * (`reopened_concurrently` for a live row whose rev moved, `already_resolved` for a consumed one, with the
- * dead parked-constraint entry evicted). Winning is the SOLE trigger to execute the pending action.
+ * (`reopened_concurrently` for a live row whose rev moved, `resume.holder_superseded` for the validated row a carried claim holder
+ * lost, `already_resolved` for a consumed one, with the dead parked-constraint entry evicted). Winning is the SOLE trigger to execute.
  *
  * Async (the CAS). It ends by handing off to the driver's post-claim rung (`next`) in its LAST continuation
  * — the post-consume hook fires on the tick the win was read — and returns what that rung returns.
@@ -19,6 +19,8 @@ export interface ResumeClaimInput<R> {
     store: CheckpointStore;
     /** borrowed-readonly — the twin the store persists as the resolved outcome. */
     outcomeForStore: ResumeRun["outcome"];
+    /** borrowed-readonly — the deployment's claim holder the resume acts under (`RunInternals.holder`), carried into the CAS. */
+    holder?: string | undefined;
     /** borrowed-mutable — the Runner's same-Runner claim marks: opened with the resolve attempt, released on a loss. */
     locallyClaimedTokens: Set<CheckpointToken>;
     /** borrowed-mutable — the Runner's parked-constraint registry: a terminally consumed token's entry is evicted. */

package/dist/core/runner/resume-claim.js

@@ -1,23 +1,30 @@
 import { CheckpointError } from "../checkpoint-store.js";
+import { checkpointRevOf } from "../checkpoint-generation.js";
 export async function resumeClaim(input) {
-    const { token, cp, store, outcomeForStore, locallyClaimedTokens, parentConstraintRegistry } = input;
+    const { token, cp, store, outcomeForStore, holder, locallyClaimedTokens, parentConstraintRegistry } = input;
+    const expect = { rev: checkpointRevOf(cp), ...(holder !== undefined ? { holder } : {}) };
     locallyClaimedTokens.add(token);
-    let won;
-    let claimLossStatus;
+    let won, loss;
     if (store.claimTerminal !== undefined) {
-        const claim = await store.claimTerminal(token, cp.scope, { kind: "resolve", outcome: outcomeForStore, expect: { rev: cp.rev ?? 0 } });
+        const claim = await store.claimTerminal(token, cp.scope, { kind: "resolve", outcome: outcomeForStore, expect });
         won = claim.claimed;
         if (!claim.claimed)
-            claimLossStatus = claim.current.status;
+            loss = { status: claim.current.status, rev: claim.current.status === "absent" ? undefined : claim.current.rev, sameRow: true };
     }
     else {
-        won = await store.resolve(token, cp.scope, outcomeForStore, { rev: cp.rev ?? 0 });
+        won = await store.resolve(token, cp.scope, outcomeForStore, expect);
     }
     if (!won)
         locallyClaimedTokens.delete(token);
     if (!won) {
-        const stillPending = claimLossStatus !== undefined ? claimLossStatus === "pending" : (await store.get(token))?.status === "pending";
-        if (stillPending) {
+        if (loss === undefined) {
+            const row = await store.get(token);
+            loss = row ? { status: row.status, rev: checkpointRevOf(row), sameRow: row.scope === cp.scope } : { status: "absent", rev: undefined, sameRow: false };
+        }
+        if (loss.status === "pending") {
+            if (holder !== undefined && loss.sameRow && loss.rev === expect.rev) {
+                throw new CheckpointError("resume.holder_superseded", "the claim this resume acts under is no longer the deployment's current grant — nothing was applied and the checkpoint is unchanged by this resume; the run is superseded: do not retry it (the current holder delivers)");
+            }
             throw new CheckpointError("checkpoint.reopened_concurrently", "checkpoint changed concurrently (its revision advanced via a resolve/reopen cycle since this resume validated) — not executed; re-resume against the current state");
         }
         parentConstraintRegistry.delete(token);

package/dist/core/runner/retired-runner-deps.js

@@ -7,6 +7,7 @@ const RETIRED_RUNNER_DEPS_KEYS = {
     graderEnvFactory: "the grader env reaches the repair loop as `RepairLoopConfig.graderEnv`, minted by the trusted control plane (`assertOracleIsolation` / `GraderEnv` unchanged)",
     "hands.readCyberReminder": "a Read result carries only the reminders about that read (an empty file, an offset past the end, a file already in context) — no standing content-safety tail, so there is nothing to switch; a deployment that wants that sentence states it in its own `appendSystemPrompt`",
     promptProvider: "a deployment changes prompt text through overlays: register a `prompt.compose` handler on `RunnerDeps.mods` answering `{ overlays }` (role base `replace`, a brand line `add` to the role band, a behavior or scenario `add`, a core-behavior `replace` / `append` / `drop`), choose the role base per task with `TaskSpec.promptRole`, and dispose of an MCP server's instructions with a `prompt.section` registration answering `{ text }` / `{ text: null }`",
+    allowImageUrl: "a remote image URL is judged by the one egress guard (https, the private-network floor) and the deployment's host floor — declare a CDN list as `RunnerDeps.hostFloor.only` (it bounds every structured egress: the fetch tool, task images, MCP http, A2A, WebSearch's SearXNG backend), or send the image inline",
     memorySessionIncarnation: "the occupant behind a session id is a cell of the session row now — `SessionMetadata.incarnation` on the metadata `Session.getMetadata()` returns (forks also `forkedFromIncarnation`), with `SessionStore.headOf` (its `incarnation`) for by-id readers; put the token the old seat answered on your sessions instead. A deployment that drops the seat without surfacing the cell loses the axis: records bind by session id alone",
 };
 export function assertNoRetiredRunnerDeps(deps) {

package/dist/core/runner/rewind-files.d.ts

@@ -0,0 +1,12 @@
+import type { RewindFilesRequest, RewindFilesResult } from "../file-history-store.js";
+import type { SessionStore } from "../session.js";
+import type { RunnerDeps } from "../types.js";
+import type { SessionReadFileStates } from "./session-read-file-states.js";
+import { type SessionLockSeats } from "./session-verb-doors.js";
+/** What the Runner lends the rewind: its current deps, its session store, its read-state seats, and its lock. */
+export interface RewindFilesSeats extends SessionLockSeats {
+    deps: RunnerDeps;
+    sessions: SessionStore;
+    readStates: SessionReadFileStates;
+}
+export declare function rewindSessionFiles(seats: RewindFilesSeats, request: RewindFilesRequest): Promise<RewindFilesResult>;

package/dist/core/runner/rewind-files.js

@@ -0,0 +1,90 @@
+import { hasDestroy } from "../remote-env.js";
+import { resolveDeploymentFileHistory, storeUnconfiguredRefusal } from "./file-history-request.js";
+import { prepareExecutionEnv } from "./prepare-execution-env.js";
+import { noBoundaryRefusal, settleFileHistoryRestore } from "./file-history-restore.js";
+import { adoptForkedFileHistory, resolveFileHistoryCoordinates } from "./prepare-file-history.js";
+import { createRollbackStack } from "./rollback-stack.js";
+import { acquireExistingSession, claimIdleSession, readPlainRequest, shownValue } from "./session-verb-doors.js";
+import { settleTeardownLeg } from "./teardown-bounded.js";
+const REQUEST_KEYS = new Set(["sessionId", "to", "dryRun", "signal"]);
+export async function rewindSessionFiles(seats, request) {
+    const req = screenRewindFilesRequest(request);
+    const { deps } = seats;
+    const { wiredSeat, fileHistoryStore, captureStore } = resolveDeploymentFileHistory(deps);
+    if (fileHistoryStore === undefined)
+        throw storeUnconfiguredRefusal(wiredSeat, req.to);
+    const release = await claimIdleSession(seats, req.sessionId, () => sessionBusyRefusal(req.sessionId, req.to));
+    try {
+        const session = await acquireExistingSession(seats.sessions, req.sessionId, "Runner.rewindFiles", "nothing was rewound");
+        const report = (err) => {
+            try {
+                deps.onError?.(err, { phase: "config", sessionId: req.sessionId });
+            }
+            catch {
+            }
+        };
+        const rollback = createRollbackStack(report);
+        let envPhase;
+        try {
+            envPhase = await prepareExecutionEnv({ deps, spec: {}, internals: undefined, resume: undefined, placementRootResolved: req.sessionId, sessionId: req.sessionId, forgetOnThrow: async () => { }, rollback });
+        }
+        catch (err) {
+            await rollback.unwindAll();
+            throw err;
+        }
+        rollback.commit();
+        try {
+            return await rewindOnEnv(req, envPhase.executionEnv, envPhase.handsEnabled, envPhase.taskRootInitial, { store: fileHistoryStore, captureStore, session: session.session, seats });
+        }
+        finally {
+            const owned = envPhase.ownedEnvSeat.current;
+            if (owned !== undefined && hasDestroy(owned))
+                await settleTeardownLeg(() => owned.destroy(), "ownedEnv.destroy (rewindFiles)", report);
+        }
+    }
+    finally {
+        release();
+    }
+}
+async function rewindOnEnv(req, env, handsEnabled, taskRoot, ctx) {
+    if (!handsEnabled)
+        throw filesEnvUnsupportedRefusal(req.sessionId, req.to);
+    const { historyRoot, historyScope } = await resolveFileHistoryCoordinates(true, env, taskRoot, undefined, req.sessionId);
+    if (ctx.captureStore !== undefined)
+        await adoptForkedFileHistory(ctx.captureStore, ctx.session, req.sessionId, ctx.seats.deps.onError);
+    if (req.dryRun) {
+        if (!(await ctx.store.canRestore(historyScope, req.to)))
+            throw noBoundaryRefusal(req.to, req.sessionId, true);
+        const preview = ctx.store.diffStats === undefined ? null : await ctx.store.diffStats(historyScope, req.to, env, historyRoot);
+        return { dryRun: true, preview: preview ?? null };
+    }
+    const restore = await settleFileHistoryRestore({ store: ctx.store, sessionId: req.sessionId, target: req.to, before: false, env, root: historyRoot, signal: req.signal, readStates: ctx.seats.readStates });
+    return { dryRun: false, restore };
+}
+function screenRewindFilesRequest(request) {
+    const bad = (what) => {
+        const e = new Error(`Runner.rewindFiles: ${what} — nothing was rewound. The request is { sessionId, to, dryRun?, signal? }.`);
+        e.code = "rewind.invalid_spec";
+        throw e;
+    };
+    const { sessionId, to, dryRun, signal } = readPlainRequest(request, REQUEST_KEYS, bad);
+    if (typeof sessionId !== "string" || sessionId === "")
+        return bad(`sessionId must be a non-empty string, got ${shownValue(sessionId)}`);
+    if (typeof to !== "string" || to === "")
+        return bad(`to must be a non-empty entry id, got ${shownValue(to)}`);
+    if (dryRun !== undefined && typeof dryRun !== "boolean")
+        return bad(`dryRun must be a boolean when given, got ${shownValue(dryRun)}`);
+    if (signal !== undefined && !(signal instanceof AbortSignal))
+        return bad(`signal must be an AbortSignal when given, got ${shownValue(signal)}`);
+    return { sessionId, to, dryRun: dryRun === true, signal };
+}
+function sessionBusyRefusal(sessionId, target) {
+    const e = new Error(`Runner.rewindFiles: a task is running or queued on session "${sessionId}" in this Runner, or a write one of its tasks issued has not settled — rewinding its files to entry "${target}" now would move them under that work, so nothing was rewound; retry once it has ended and its writes have settled`);
+    e.code = "rewind.session_busy";
+    return e;
+}
+function filesEnvUnsupportedRefusal(sessionId, target) {
+    const e = new Error(`Runner.rewindFiles: this deployment mounts no filesystem-capable ExecutionEnv, so session "${sessionId}" has no working tree to rewind to entry "${target}" — nothing was rewound`);
+    e.code = "rewind.files_env_unsupported";
+    return e;
+}

package/dist/core/runner/run-attachment-seats.js

@@ -4,6 +4,7 @@ import { SKILLS_LISTING_PROBE_HEADER } from "./synthetic-tools.js";
 import { AGENT_LISTING_REMOVED_HEADER, SKILLS_LISTING_DELTA_HEADER, SKILLS_LISTING_REMOVED_HEADER, agentListingDeltaHeader, agentListingInitialHeader, createAttachmentState, replayAnnouncedListing, replayAnnouncedModels } from "./turn-attachments.js";
 import { wireOf } from "../tool-name-readings.js";
 import { rosterToolName } from "../tool-roster.js";
+import { rowNotExecuted } from "./tool-not-executed.js";
 export async function runAttachmentSeats(input) {
     const { spec, prepared, resume, rs, runner, next } = input;
     rs.counters.wroteThisRun = false;
@@ -175,7 +176,7 @@ export async function runAttachmentSeats(input) {
                     if ((fvMarked || text.includes("<system-reminder>[final verification]")) && rs.counters.finalVerifyInjections < 2)
                         rs.counters.finalVerifyInjections += 1;
                 }
-                else if (m.role === "toolResult" && !rs.counters.wroteThisRun && (prepared.toolEffects.get(wireOf("verify.wroteThisRunSeed", { toolName: rosterToolName(prepared.toolRosterDeltas.current, m.toolName) })) ?? "write") !== "read") {
+                else if (m.role === "toolResult" && !rs.counters.wroteThisRun && !rowNotExecuted(m.details) && (prepared.toolEffects.get(wireOf("verify.wroteThisRunSeed", { toolName: rosterToolName(prepared.toolRosterDeltas.current, m.toolName) })) ?? "write") !== "read") {
                     rs.counters.wroteThisRun = true;
                 }
             }

package/dist/core/runner/run-brain-sinks.d.ts

@@ -3,6 +3,7 @@ import { type ExtraBodyDroppedSeatInput } from "./extra-body-dropped-seat.js";
 import type { PushQueue } from "../push-queue.js";
 import type { TaskEvent } from "../types.js";
 import type { RunInternals, RunState } from "./contracts.js";
+import { type CapabilityWithheldRecord } from "./capability-withheld-seat.js";
 export interface RunBrainSinksInput {
     /** borrowed-mutable — the run's event queue: the `status` frames. */
     queue: PushQueue<TaskEvent>;
@@ -20,11 +21,13 @@ export interface RunBrainSinksInput {
     observeReasoningWireFacts: (facts: ReasoningWireFacts) => void;
     /** borrowed-readonly — the notice sink and the leg's ids; the fourth and fifth sinks' announcers are minted from them. */
     notice: ExtraBodyDroppedSeatInput;
+    /** borrowed-mutable — the session's announced record: the sixth sink's announcer says a withheld capability once per session. */
+    announced: CapabilityWithheldRecord;
 }
 export interface RunBrainSinksResult {
     /** Compose the three brain ALS sinks around a brain-driving call. */
     withBrainSinks: <T>(fn: () => Promise<T>) => Promise<T>;
-    /** Compose the two leg-wide request sinks (the extraBody strip, the credential-origin refusal) around the whole leg. */
+    /** Compose the three leg-wide request sinks (the extraBody strip, the credential-origin refusal, the withheld capability) around the whole leg. */
     withLegRequestSinks: <T>(fn: () => Promise<T>) => Promise<T>;
 }
 export declare function runBrainSinks(input: RunBrainSinksInput): RunBrainSinksResult;

package/dist/core/runner/run-brain-sinks.js

@@ -3,8 +3,9 @@ import { createExtraBodyDroppedScope } from "./extra-body-dropped-seat.js";
 import { createCredentialOriginRefusalScope } from "./credential-origin-seat.js";
 import { createSafeNotifier, observeThenableRejection } from "../safe-notify.js";
 import { emitTrace } from "../trace.js";
+import { createCapabilityWithheldScope } from "./capability-withheld-seat.js";
 export function runBrainSinks(input) {
-    const { queue, internals, rs, ident, observeReasoningWireFacts, notice } = input;
+    const { queue, internals, rs, ident, observeReasoningWireFacts, notice, announced } = input;
     const statusSinkNotifier = createSafeNotifier({
         onError: (f) => console.warn(`[sema-core] ${f.site}: run-internals status sink threw (contained; further failures counted, not re-disclosed): ${f.error.message}`),
     });
@@ -63,6 +64,7 @@ export function runBrainSinks(input) {
     const withBrainSinks = (fn) => runWithStatusSink(statusEmit, () => runWithBrainTelemetry(telemetryEmit, () => runWithReasoningWireFacts(observeReasoningWireFacts, fn)));
     const withExtraBodyDropped = createExtraBodyDroppedScope(notice);
     const withCredentialOriginRefusals = createCredentialOriginRefusalScope(notice);
-    const withLegRequestSinks = (fn) => withExtraBodyDropped(() => withCredentialOriginRefusals(fn));
+    const withCapabilityWithheld = createCapabilityWithheldScope(notice, announced);
+    const withLegRequestSinks = (fn) => withExtraBodyDropped(() => withCredentialOriginRefusals(() => withCapabilityWithheld(fn)));
     return { withBrainSinks, withLegRequestSinks };
 }

package/dist/core/runner/run-harness-handlers.js

@@ -11,11 +11,13 @@ import { advanceCadenceClock, reduceToolEnd } from "./turn-attachments.js";
 import { gatedCallIdOf } from "./park-commit.js";
 import { hasVerifiableStructureSignal } from "./grounding-signal.js";
 import { announceToolCall, batchResponseDigest, emitSettled } from "./tool-end-body.js";
-import { stampRowNotExecuted } from "./tool-not-executed.js";
+import { neverExecuted, stampRowNotExecuted } from "./tool-not-executed.js";
+import { extensionCallOf, noteExtensionCallDenied, requesterOf } from "../mods/extension-call.js";
 import { createResponseModelSeat } from "./response-model-seat.js";
 import { createToolCallIdFoldSeat } from "./tool-call-id-fold-seat.js";
 import { createFinishReasonSeat } from "./finish-reason-seat.js";
 import { createToolTurnIncompleteSeat } from "./tool-turn-repair-seat.js";
+import { createWithheldShellEnvSeat } from "./shell-env-withheld.js";
 import { wireOf } from "../tool-name-readings.js";
 import { rosterToolName } from "../tool-roster.js";
 export function createHarnessHandlers(input) {
@@ -24,11 +26,12 @@ export function createHarnessHandlers(input) {
     const toolCallIdFoldSeat = createToolCallIdFoldSeat(deps.runnerHooks.onNotice, { sessionId: prepared.sessionId, runId: prepared.runId });
     const toolTurnIncompleteSeat = createToolTurnIncompleteSeat(deps.runnerHooks.onNotice, { sessionId: prepared.sessionId, runId: prepared.runId });
     const finishReasonSeat = createFinishReasonSeat(deps.runnerHooks.onNotice, { sessionId: prepared.sessionId, runId: prepared.runId });
+    const withheldShellEnvSeat = createWithheldShellEnvSeat(prepared, deps.runnerHooks.onNotice);
     const { spec, queue, internals, ident, pushContent, emitCommitted, startedToolCallIds, toolStartAt, toolProgress, writeFamilyOf, toolLabels, postToolBatchArmed, batchArgs, internalsNotifier, mediaByteCapBytes } = deps;
     const frames = { push: (f) => pushContent({ ...f, ...ident() }), structured: prepared.structuredProjector, mediaByteCapBytes };
     const startOf = (e) => {
         const label = toolLabels.get(e.toolName);
-        return { toolCallId: e.toolCallId, spelledName: e.toolName, wireName: rosterToolName(prepared.toolRosterDeltas.current, e.toolName), ...(label !== undefined ? { label } : {}), args: e.args };
+        return { toolCallId: e.toolCallId, spelledName: e.toolName, wireName: rosterToolName(prepared.toolRosterDeltas.current, e.toolName), ...(label !== undefined ? { label } : {}), args: e.args, ...requesterOf(prepared.modBus, e.toolCallId) };
     };
     let lastWorkspaceCwd = prepared.cwdRef?.current;
     const announceWorkspaceMove = () => {
@@ -222,12 +225,15 @@ export function createHarnessHandlers(input) {
         const activityArg = primaryActivityArg(event.args);
         internalsNotifier.notify(() => observeThenableRejection(internals?.onActivity?.({ phase: "start", toolCallId: event.toolCallId, toolName: event.toolName, at: startAt, ...(activityArg !== undefined ? { arg: activityArg } : {}) }), internalsNotifier, "runtask.onActivity.start"), "runtask.onActivity.start");
         announceToolCall(prepared.toolOccurrences, startOf(event), frames);
+        withheldShellEnvSeat.onToolStart(event.toolName);
     };
     const onToolEnd = (event) => {
         const toolStarted = toolStartAt.get(event.toolCallId);
         toolStartAt.delete(event.toolCallId);
         const toolNow = Date.now();
-        if (!rs.counters.wroteThisRun && (prepared.toolEffects.get(wireOf("verify.wroteThisRun", { toolName: rosterToolName(prepared.toolRosterDeltas.current, event.toolName) })) ?? "write") !== "read") {
+        const occ = prepared.toolOccurrences.get(event.toolCallId);
+        const ran = event.notExecuted !== true && !(occ !== undefined && neverExecuted(occ));
+        if (ran && !rs.counters.wroteThisRun && (prepared.toolEffects.get(wireOf("verify.wroteThisRun", { toolName: rosterToolName(prepared.toolRosterDeltas.current, event.toolName) })) ?? "write") !== "read") {
             rs.counters.wroteThisRun = true;
         }
         if (rs.attach.attachState !== undefined && !event.isError) {
@@ -236,7 +242,7 @@ export function createHarnessHandlers(input) {
                 reduceToolEnd(rs.attach.attachState, det);
         }
         if (postToolBatchArmed) {
-            if (prepared.blockedToolCalls.delete(event.toolCallId) || event.notExecuted === true) {
+            if (prepared.blockedToolCalls.delete(event.toolCallId) || !ran || extensionCallOf(prepared.modBus, event.toolCallId) !== undefined) {
                 batchArgs?.delete(event.toolCallId);
             }
             else {
@@ -266,6 +272,8 @@ export function createHarnessHandlers(input) {
             ...(event.notExecuted === true ? { notExecuted: true } : {}),
             ...(() => { const id = prepared.abortController.signal.aborted ? gatedCallIdOf(prepared) : undefined; return id !== undefined ? { gatedCallIdOfRun: id } : {}; })(),
         }, frames);
+        if (settled.gate?.disposition.kind === "denied")
+            noteExtensionCallDenied(prepared.modBus, event.toolCallId);
         stampRowNotExecuted(event.result, settled.notExecuted === true);
         emitTrace(rs.telemetry.tracer, () => ({
             kind: "tool.call",

package/dist/core/runner/run-leg.d.ts

@@ -82,7 +82,7 @@ export interface RunLegInput<R> {
     unsubBoundary: () => void;
     /** borrowed-readonly — the git lane's harness-event release, called third. */
     unsub: () => void;
-    /** borrowed-readonly — the Runner's deployment deps, read LIVE (`onError`, `hooks`, `onNotice`, `allowImageUrl`, `mediaByteCapBytes`; the resumed
+    /** borrowed-readonly — the Runner's deployment deps, read LIVE (`onError`, `hooks`, `onNotice`, `mediaByteCapBytes`; the resumed
      *  decision's resolver files its execution record's word through `onNotice` too); the one home of why it is a seat and not a
      *  captured object is {@link RunnerDepsSeat}. */
     runner: RunnerDepsSeat;