@sema-agent/core 7.6.2 → 7.7.0

package/dist/core/runner/decide-continuation.d.ts

@@ -0,0 +1,98 @@
+/**
+ * The resumed leg's DECIDE vocabulary — everything the resume engine needs to read a decide outcome and
+ * carry it into the continuation, none of which is a step the driver calls with an Input:
+ *  · was the decision NEGATIVE (a delivered refusal consumes its gate; no reopen compensation may fire);
+ *  · is a replayed winner the SAME decision as the persisted one (design/80 D-1 reopen-by-reason guard,
+ *    with the structural JSON equality it needs);
+ *  · which call a CONTENT-ASK checkpoint parks on, and the one-shot answering face a decide's answer is
+ *    bound to for the redeemed call;
+ *  · the capture-time domain checks on a decide's TEXT payloads, and the label a rejected value gets;
+ *  · the model-facing text for a deferred batch sibling, and the continuation prompt itself.
+ *
+ * Pure over its arguments (the answering face is the one closure, and it closes over its own arguments
+ * only). Run-loop machinery (layer 1), named without the `resume-` family prefix: that prefix marks a
+ * driven rung of the resume decision ladder, which this is not.
+ */
+import { type OnQuestion, type QuestionAnswer } from "../ask-question.js";
+import { type Checkpoint, type ResolvedOutcome } from "../checkpoint-store.js";
+import type { ResumeRun } from "./contracts.js";
+/**
+ * RB-471 ([2315]) — was this resume driven by a NEGATIVE human decision (plan_review/dry_run_review
+ * `reject`, policy_ask `deny`)? Such a decision consumes its gate by being DELIVERED: there is no owed
+ * action whose non-start could waste it, so the reopen compensation (both the throw-path and the
+ * settle-path arm) must never fire for it — reopening re-asks a gate the human already refused, and on
+ * the plan_review reject leg it minted a zombie gate beside the re-plan's NEW park (the session then
+ * reported the same decidePath locked no matter how many times the human decided).
+ */
+export declare function resumeDecisionWasNegative(resume: ResumeRun): boolean;
+/** Model-facing result for a batch sibling of a suspended call that v1 does not blind-run (§4.ter). */
+export declare const DEFERRED_REISSUE: string;
+/**
+ * Structural deep equality of two JSON-serializable values (order-independent over object keys). Used ONLY
+ * by the Runner's `resumeStream` design/80 D-1 reopen-by-reason guard to confirm an `env_failed` re-resume
+ * replays the EXACT persisted winner (its `updatedInput` payload included). This is a same-runtime
+ * value-vs-value comparison of two payloads that already round-trip JSON in the durable store — it is NOT
+ * the cross-runtime `boundInputHash` canonicalization (design/80 D-1 §2, out of scope for slice 1b), which
+ * the spec deliberately keeps server-minted-opaque to avoid false mismatches.
+ */
+export declare function deepJsonEqual(a: unknown, b: unknown): boolean;
+/** design/80 D-1 (reopen-by-reason): two resume winners are the SAME decision iff they bind the same call,
+ *  the same allow/deny verdict, the same (deep-equal) `updatedInput` rewrite AND the same (deep-equal)
+ *  content-ask `answer`. An `env_failed` re-resume must replay an identical winner; any divergence is a
+ *  re-vote (rejected).
+ *
+ *  ORDER MATTERS — `incoming` is the decide being replayed, `persisted` is the row's recorded winner. The
+ *  `reason` dimension is compared ASYMMETRICALLY (see below), so the two arguments are not interchangeable. */
+export declare function sameWinner(incoming: ResolvedOutcome, persisted: ResolvedOutcome): boolean;
+/** The tool call a CONTENT-ASK checkpoint parks on — the pending `tool_approval` call of the reserved
+ *  question tool — or `undefined` when this checkpoint parks on anything else (a side-effecting tool's
+ *  approval, a resource slice, a review pause). The single predicate both the answer-binding guard and the
+ *  answering-face injection key on, so "is this decide answering a question?" is asked exactly one way. */
+export declare function pendingContentAskCallId(cp: Checkpoint): string | undefined;
+/**
+ * Bind a decide's content-ask answer as the resumed leg's answering face (ruled 2026-08-04) — the same
+ * shape the documented live arm builds by hand (`{ ...taskConfig, onQuestion: async () => answer }`), so
+ * the redeemed call executes against the SAME tool and the SAME untrusted-answer fence rather than a
+ * second, parallel answer path.
+ *
+ * ONE-SHOT, bound to the redeemed call id: a decide answers the question the operator was shown, and
+ * nothing else. Should the resumed leg ask a NEW question, this face must not replay the previous answer
+ * to it (the questions differ; the fence's `selected ⊆ options` would strip the selections and the
+ * operator's note would be re-delivered out of context). It falls through to whatever answering face the
+ * resume already had, and — with none — refuses, which the tool reports to the model as "no answer was
+ * obtained", its honest headless outcome. In the durable topology this fallthrough is normally
+ * unreachable: a second question is adjudicated `ask` and parks for its own decide before executing.
+ */
+export declare function answerFaceForRedeemedCall(answer: QuestionAnswer, redeemedCallId: string, base: OnQuestion | undefined, 
+/** Digest of the question batch the operator was shown, so redemption cannot be claimed by a
+ *  DIFFERENT question that happens to arrive under the same call id. */
+redeemedQuestionsHash: string): OnQuestion;
+/**
+ * A label for a REJECTED deployment-supplied value, safe to put in an error message. Never coerces:
+ * `String(x)` on an object with no `toPrimitive` path (a null-prototype record, a throwing
+ * `Symbol.toPrimitive`) throws, which would replace this module's typed refusal with a raw TypeError —
+ * the malformed input escaping the very classification the refusal exists to give.
+ */
+export declare function describeSuppliedValue(value: unknown): string;
+/**
+ * Capture-time domain check for a decide outcome's TEXT payloads — the review lanes' `editedPlan` /
+ * `reason` and the approval lane's deny `reason`. All are persisted (the recorded winner's payload,
+ * compared when an `env_failed` reopen replays it) and all are fenced into the model-facing
+ * continuation reminder. The declared wire type is a string; a value outside it reads one way in this
+ * process and another after a JSON round-trip, and reaches the reminder as whatever its stringification
+ * happens to be. Worse, the pre-CAS tag-hygiene check and the fence BOTH reach the value through
+ * `String.prototype.replace`: an object carrying its own `replace` is therefore read twice and may
+ * answer differently each time — the check passing on text it never inspected. Refused pre-CAS so the
+ * row stays `pending` for a well-formed decide, exactly like the other capture-time domain refusals,
+ * and BEFORE the hygiene check so no guard ever consults a value outside the domain. The rejected field
+ * is named in the message only — `CheckpointError`'s structured `detail.field` is a closed set covering
+ * the approval lane's payload names, and widening it is a wire-surface change of its own.
+ */
+export declare function assertOutcomeText(value: string | undefined, field: "editedPlan" | "reason"): void;
+/**
+ * The continuation prompt for a resumed run (design/45 §B6). The vendored harness only exposes
+ * `prompt(text)` (it always appends a user message — there is no "continue from tool results" entry), so
+ * resume re-enters via a `<system-reminder>`-wrapped user message that tells the model the gated decision
+ * was applied. The "user message wart" is accepted (API-valid, and clearer than a silent continuation).
+ */
+export declare function resumeContinuation(resume: ResumeRun, mark: string | undefined): string;

package/dist/core/runner/decide-continuation.js

@@ -0,0 +1,133 @@
+import { ASK_USER_QUESTION_TOOL_NAME, isLiveQuestionFace, markBoundOnlyQuestionFace } from "../ask-question.js";
+import { boundInputHashOf } from "../canonical-json.js";
+import { CheckpointError } from "../checkpoint-store.js";
+import { formatHookFeedback } from "../hooks.js";
+import { delimitUntrusted, REVIEWER_NOTE_MAX_BODY } from "../untrusted-text.js";
+export function resumeDecisionWasNegative(resume) {
+    const o = resume.outcome;
+    return o.decision === "reject" || o.decision === "deny";
+}
+export const DEFERRED_REISSUE = "[DEFERRED] This tool call shared a batch with a call that suspended for durable approval, so it was " +
+    "NOT executed on resume. If you still need it, issue it again now.";
+export function deepJsonEqual(a, b) {
+    if (a === b)
+        return true;
+    if (typeof a !== typeof b || a === null || b === null || typeof a !== "object") {
+        return false;
+    }
+    const aArr = Array.isArray(a);
+    const bArr = Array.isArray(b);
+    if (aArr !== bArr)
+        return false;
+    if (aArr && bArr) {
+        if (a.length !== b.length)
+            return false;
+        for (let i = 0; i < a.length; i++) {
+            if (!deepJsonEqual(a[i], b[i]))
+                return false;
+        }
+        const aExtra = Object.keys(a).filter((k) => !isCanonicalIndexKey(k, a.length));
+        const bExtra = Object.keys(b).filter((k) => !isCanonicalIndexKey(k, b.length));
+        if (aExtra.length !== bExtra.length)
+            return false;
+        return aExtra.every((k) => Object.prototype.hasOwnProperty.call(b, k) && deepJsonEqual(Reflect.get(a, k), Reflect.get(b, k)));
+    }
+    const ao = a;
+    const bo = b;
+    const aKeys = Object.keys(ao);
+    const bKeys = Object.keys(bo);
+    if (aKeys.length !== bKeys.length)
+        return false;
+    return aKeys.every((k) => Object.prototype.hasOwnProperty.call(bo, k) && deepJsonEqual(ao[k], bo[k]));
+}
+function isCanonicalIndexKey(key, length) {
+    return /^(0|[1-9]\d*)$/.test(key) && Number(key) < length;
+}
+export function sameWinner(incoming, persisted) {
+    return (incoming.boundCallId === persisted.boundCallId &&
+        incoming.decision === persisted.decision &&
+        deepJsonEqual(incoming.updatedInput, persisted.updatedInput) &&
+        deepJsonEqual(incoming.answer, persisted.answer) &&
+        (persisted.reason === undefined || incoming.reason === persisted.reason));
+}
+export function pendingContentAskCallId(cp) {
+    return cp.pendingAction.kind === "tool_approval" && cp.pendingAction.toolName === ASK_USER_QUESTION_TOOL_NAME
+        ? cp.pendingAction.toolCallId
+        : undefined;
+}
+export function answerFaceForRedeemedCall(answer, redeemedCallId, base, redeemedQuestionsHash) {
+    let consumed = false;
+    const face = async (req, signal) => {
+        if (!consumed && req.toolCallId === redeemedCallId && boundInputHashOf(req.questions) === redeemedQuestionsHash) {
+            consumed = true;
+            return answer;
+        }
+        if (base !== undefined)
+            return base(req, signal);
+        throw new Error("this resumed leg's answer was bound to the decided question only — a new question has no answer on this leg");
+    };
+    return isLiveQuestionFace(base) ? face : markBoundOnlyQuestionFace(face);
+}
+export function describeSuppliedValue(value) {
+    return typeof value === "string" ? value : value === null ? "null" : typeof value;
+}
+export function assertOutcomeText(value, field) {
+    if (value !== undefined && typeof value !== "string") {
+        throw new CheckpointError("checkpoint.invalid_outcome", `resume \`${field}\` is not a plain string (got ${typeof value}) — a decide's text payload is an operator's plain data, not a live object; refusing pre-CAS, the checkpoint stays pending`);
+    }
+}
+export function resumeContinuation(resume, mark) {
+    if (resume.outcome.gate === "wake") {
+        return formatHookFeedback("You were WOKEN from a parked pause by an operator. Before continuing, re-orient from the workspace: " +
+            "run `git status` and review your recent changes / last commits to confirm what is already done, then " +
+            "continue the remaining work. Do NOT restart the task or re-run work that is already committed.", mark);
+    }
+    if (resume.outcome.gate === "resource_limit") {
+        return formatHookFeedback("You were resumed after a pause. Before continuing, re-orient from the workspace: run `git status` and " +
+            "review your recent changes / last commits to confirm what is already done, then continue the " +
+            "remaining work. Do NOT restart the task or re-run work that is already committed.", mark);
+    }
+    if (resume.outcome.gate === "dry_run_review") {
+        const verdict = resume.outcome.decision === "approve"
+            ? "Your predicted change was REVIEWED and APPROVED; it has been applied"
+            : `Your predicted change was REVIEWED and REJECTED${resume.outcome.reason ? `: ${delimitUntrusted("reviewer note", resume.outcome.reason, REVIEWER_NOTE_MAX_BODY)}` : ""}; it was NOT applied`;
+        return formatHookFeedback(`You were resumed after a dry-run review. ${verdict}. Before continuing, re-orient from the workspace ` +
+            "(run `git status` and review your recent changes) to confirm the current state, then continue the " +
+            "remaining work. Do NOT restart the task or re-run work that is already done.", mark);
+    }
+    if (resume.outcome.gate === "plan_review") {
+        if (resume.outcome.decision === "approve") {
+            return formatHookFeedback("Your proposed PLAN was REVIEWED and APPROVED. Proceed with that plan now — begin executing it. " +
+                "This is a RESUMED task; do NOT re-plan or restart from scratch, just carry out the approved plan.", mark);
+        }
+        if (resume.outcome.decision === "edit") {
+            if (!resume.outcome.editedPlan) {
+                return formatHookFeedback("Your proposed PLAN was REVIEWED and EDITED, but no revised plan text was supplied — proceed with your " +
+                    "ORIGINAL plan as-is, begin executing it now. This is a RESUMED task; do NOT re-plan or restart from scratch.", mark);
+            }
+            return formatHookFeedback("Your proposed PLAN was REVIEWED and EDITED by a human reviewer. Proceed with the REVISED plan below " +
+                "(it supersedes your earlier plan); begin executing it now. This is a RESUMED task; do NOT re-plan " +
+                "or restart from scratch, just carry out the revised plan.\n\nThe REVISED plan to follow is:\n" +
+                delimitUntrusted("revised plan", resume.outcome.editedPlan), mark);
+        }
+        const why = resume.outcome.reason ? ` Reviewer note: ${delimitUntrusted("reviewer note", resume.outcome.reason, REVIEWER_NOTE_MAX_BODY)}` : "";
+        return formatHookFeedback(`Your proposed PLAN was REVIEWED and REJECTED; it was NOT executed.${why} Produce a NEW plan that ` +
+            "addresses the concern, then continue. This is a RESUMED task — re-plan from the current state; do " +
+            "NOT execute the rejected plan.", mark);
+    }
+    const { pendingAction } = resume.cp;
+    if (pendingAction.kind !== "tool_approval") {
+        return formatHookFeedback("This is a RESUMED task — continue from where you left off without restarting or re-running prior work.", mark);
+    }
+    const decided = resume.outcome.decision === "allow"
+        ? "was APPROVED and has now been executed — its result is in the tool results above"
+        : `was DENIED${resume.outcome.reason ? `: ${delimitUntrusted("reviewer note", resume.outcome.reason, REVIEWER_NOTE_MAX_BODY)}` : ""}`;
+    const remaining = pendingAction.batchToolCallIds.filter((id) => id !== pendingAction.toolCallId && !pendingAction.completedCallIds.includes(id)).length;
+    const batchNote = remaining > 0
+        ? ` ${remaining} other tool call(s) from that batch were returned as deferred and not run — re-issue any you still need.`
+        : "";
+    return formatHookFeedback(`The pending tool call "${pendingAction.toolName}" ${decided}.${batchNote} ` +
+        `This is a RESUMED task — every step before this point is already done and its results are in the ` +
+        `conversation above. Do NOT restart the task or re-run any tool you already ran; continue from this ` +
+        `exact point, building on the existing results, and finish the remaining work.`, mark);
+}

package/dist/core/runner/execution-record.d.ts

@@ -0,0 +1,26 @@
+/**
+ * The execution-record settle half of the pending-call resolver's belt (run-loop machinery, layer 1):
+ * what the resolver does with the word the row's `recordExecutionOutcome` verb answered. The verb itself
+ * is bound by `resumeStream` (ResumeRun.recordExecutionOutcome); the resolver calls it once per
+ * resolution, right after the resolved call's `tool_end` frame, and hands the answer here. The rule is a
+ * table lookup, not a condition list: the words that leave the row unrecorded
+ * (`EXECUTION_RECORD_LEAVES_ROW_UNRECORDED`) announce `checkpoint.execution_outcome_unrecorded`; the
+ * others say nothing. The execution result is never changed by the answer — the record is an account of
+ * what ran, not a gate on it — so this module has no return value and no throw of its own (a conflict is
+ * the verb's own throw and propagates past the resolver untouched).
+ */
+import { type ExecutionOutcomeRecordWord } from "../checkpoint-execution-record.js";
+import type { GateOutcome } from "../gate-outcome.js";
+import { type RunnerDeps } from "../types.js";
+/** The facts the unrecorded notice carries — all from the resumed leg; the secret token never rides. */
+export interface ExecutionRecordFacts {
+    toolName: string;
+    gate: GateOutcome;
+    sessionId: string;
+    runId: string;
+    scope: string;
+    checkpointId?: string;
+}
+/** Settle the record verb's answer: announce the unrecorded words through the deployment's notice sink;
+ *  the recorded words are silent. */
+export declare function settleExecutionRecord(onNotice: RunnerDeps["onNotice"], word: ExecutionOutcomeRecordWord, facts: ExecutionRecordFacts): void;

package/dist/core/runner/execution-record.js

@@ -0,0 +1,19 @@
+import { EXECUTION_RECORD_LEAVES_ROW_UNRECORDED } from "../checkpoint-execution-record.js";
+import { deliverEngineNotice } from "../types.js";
+export function settleExecutionRecord(onNotice, word, facts) {
+    if (!EXECUTION_RECORD_LEAVES_ROW_UNRECORDED[word])
+        return;
+    deliverEngineNotice(onNotice, {
+        code: "checkpoint.execution_outcome_unrecorded",
+        message: `The resolved tool call "${facts.toolName}" was disposed (${facts.gate.disposition.kind}) but its execution record could not be filed on the checkpoint: ` +
+            `the store answered "${word}" — the row is no longer a resolved row of this scope (reopened, expired or removed under this leg). ` +
+            `The execution result stands as delivered; the row reads unknown on its execution axis.`,
+        detail: {
+            sessionId: facts.sessionId,
+            runId: facts.runId,
+            scope: facts.scope,
+            ...(facts.checkpointId !== undefined ? { checkpointId: facts.checkpointId } : {}),
+            word,
+        },
+    });
+}

package/dist/core/runner/git-leg-delivery.d.ts

@@ -0,0 +1,28 @@
+import type { MaybeCompactOptions } from "../auto-compaction.js";
+import type { Prepared } from "./contracts.js";
+/** env-tail migration — the git frame's authority shell: the single-point F3 wrap the first-frame
+ *  listings use (one `<system-reminder>` per body, body neutralized — idempotent over the already-
+ *  sanitized snapshot; the S2 breakout posture). */
+export declare function wrapGitFrame(body: string, mark: string | undefined): string;
+/**
+ * env-tail migration — the git lane's leg-boundary decision: read ladder (BRANCH AUTHORITY) then
+ * the `(kind, hash)` compare. Ladder rungs:
+ *   ① nearest mirror on the active session branch — a PENDING carrier (or an announced carrier
+ *      whose frame entry is off the branch) is a MANDATORY re-announce gate, overriding everything;
+ *   ② the checkpoint mirror, only when the branch carries no mirror at all — its own `entryId`
+ *      must sit on the active branch to count as announced (a rewound frame under a descendant
+ *      checkpoint reads as pending);
+ *   ③ full absence ⇒ conservative re-announce (duplicate-tolerant by design).
+ * Seeds `ref.announced` with the resolved prior (pendingness preserved — a suspend before the
+ * receipt then mirrors the honest state) and returns the frame BODY to deliver, or undefined when
+ * the announced view already matches (or the lane has nothing to say this leg). Tombstone kinds
+ * fire on the availability FLIP EDGE only: with no prior view at all there is nothing to disown —
+ * no frame (the probe's own onError already told the deployment).
+ */
+export declare function resolveGitLegDelivery(prepared: Prepared, cpMirror: unknown, report: (err: Error) => void): Promise<string | undefined>;
+/** env-tail migration — the compaction interaction option for one `maybeCompact` invocation (ALL
+ *  THREE routes — turn-boundary auto, prompt-too-long recovery, end-of-task finish — thread this
+ *  same builder, the single-source requirement): the current tuple restated as PENDING on the
+ *  compaction entry (same CAS as the new baseline) + the run's re-assert closure as the landing
+ *  hook. Empty when the lane never announced anything (nothing to preserve across the summary). */
+export declare function gitRestateOption(prepared: Prepared): Pick<MaybeCompactOptions, "gitRestate">;

package/dist/core/runner/git-leg-delivery.js

@@ -0,0 +1,94 @@
+import { gitFrameContextVisible, normalizeGitAnnouncement } from "../../internal/harness.js";
+import { mintSystemReminder } from "../reminder-mint.js";
+import { sanitizeUntrustedText, SHELLED_BODY_ENVELOPE_TAGS } from "../untrusted-text.js";
+import { branchCarriesVisiblePositiveGitFrame, newestEngineGitFrame } from "./git-status-frame.js";
+export function wrapGitFrame(body, mark) {
+    return mintSystemReminder(sanitizeUntrustedText(body, SHELLED_BODY_ENVELOPE_TAGS), mark);
+}
+export async function resolveGitLegDelivery(prepared, cpMirror, report) {
+    const ref = prepared.gitStatusRef;
+    const frame = ref.frame;
+    if (frame === undefined)
+        return undefined;
+    let prior;
+    let pending = false;
+    try {
+        const branchReadout = await prepared.session.getGitAnnouncement?.();
+        if (branchReadout !== undefined) {
+            if (branchReadout.status === "pending") {
+                pending = true;
+                prior = { kind: branchReadout.kind, hash: branchReadout.hash };
+            }
+            else {
+                prior = { kind: branchReadout.kind, hash: branchReadout.hash, ...(branchReadout.entryId !== undefined ? { entryId: branchReadout.entryId } : {}) };
+            }
+        }
+        else {
+            const shaped = normalizeGitAnnouncement(cpMirror);
+            if (shaped !== undefined) {
+                if (shaped.pending === true || shaped.entryId === undefined) {
+                    pending = true;
+                    prior = { kind: shaped.kind, hash: shaped.hash };
+                }
+                else if (gitFrameContextVisible(await prepared.session.getBranch(), shaped.entryId)) {
+                    prior = { kind: shaped.kind, hash: shaped.hash, entryId: shaped.entryId };
+                }
+                else {
+                    pending = true;
+                    prior = { kind: shaped.kind, hash: shaped.hash };
+                }
+            }
+        }
+    }
+    catch (err) {
+        pending = true;
+        report(err instanceof Error ? err : new Error(String(err)));
+    }
+    if (prior !== undefined && !pending && prior.entryId !== undefined) {
+        try {
+            const newest = newestEngineGitFrame(await prepared.session.getBranch(), prepared.reminderMark);
+            if (newest === undefined || newest.entryId !== prior.entryId)
+                pending = true;
+        }
+        catch (err) {
+            pending = true;
+            report(err instanceof Error ? err : new Error(String(err)));
+        }
+    }
+    if (prior !== undefined)
+        ref.announced = pending ? { ...prior, pending: true } : { ...prior };
+    const negative = frame.kind === "unavailable" || frame.kind === "non-repo";
+    if (negative) {
+        if (prior === undefined && !pending) {
+            let mustDisown;
+            try {
+                mustDisown = branchCarriesVisiblePositiveGitFrame(await prepared.session.getBranch(), prepared.reminderMark);
+            }
+            catch (err) {
+                mustDisown = true;
+                report(err instanceof Error ? err : new Error(String(err)));
+            }
+            return mustDisown ? frame.body : undefined;
+        }
+        if (prior !== undefined && !pending && prior.kind === frame.kind && prior.hash === frame.hash)
+            return undefined;
+        return frame.body;
+    }
+    if (!pending && prior !== undefined && prior.kind === frame.kind && prior.hash === frame.hash) {
+        ref.protectedText = wrapGitFrame(frame.body, prepared.reminderMark);
+        if (frame.kind === "full" && frame.shrunk !== undefined) {
+            ref.wrappedShrink = { find: ref.protectedText, replace: wrapGitFrame(frame.shrunk.body, prepared.reminderMark) };
+        }
+        return undefined;
+    }
+    return frame.body;
+}
+export function gitRestateOption(prepared) {
+    const ref = prepared.gitStatusRef;
+    if (ref.frame === undefined || ref.announced === undefined || ref.reassert === undefined)
+        return {};
+    const use = ref.overBudgetShrunk && ref.frame.shrunk !== undefined
+        ? { kind: "degraded", hash: ref.frame.shrunk.hash }
+        : { kind: ref.frame.kind, hash: ref.frame.hash };
+    return { gitRestate: { pending: use, land: ref.reassert } };
+}

package/dist/core/runner/initial-run-state.d.ts

@@ -0,0 +1,14 @@
+/**
+ * The zero-value constructor of {@link RunState}, the run loop's ONE shared mutable record (seven groups,
+ * sixty fields; its writers are the run loop's three top-level machines, see the interface's own doc in
+ * contracts.ts). The driver mints one per run leg and hands it to every machine as a `borrowed-mutable`
+ * seat; nothing here reads or writes host state, so the skeleton is machinery, not a phase.
+ *
+ * Named without the `run-` family prefix on purpose: that prefix marks a DRIVEN run lane (one the driver
+ * calls with an Input and reads a Result from — the phase-api gate judges every such file), and the
+ * layering registry's run-lanes stratum is a glob over the same prefix. A machinery module the lanes stand
+ * on sits one layer below them under a name of its own, exactly as the prepare-path machinery does.
+ */
+import type { RunState } from "./contracts.js";
+/** Zero-value skeleton — every REAL value is assigned at the field's original declaration site. */
+export declare function createRunState(): RunState;

package/dist/core/runner/initial-run-state.js

@@ -0,0 +1,11 @@
+export function createRunState() {
+    return {
+        telemetry: { cacheFamily: "input-excludes-cached", pricing: { inputPer1M: 0, outputPer1M: 0 }, pricingConfigured: true, unpricedSpend: false, tracer: undefined, taskId: "", runId: "", taskStart: 0, taskStartMonotonic: 0, cacheBreakReported: false },
+        degrade: { degradeToModel: undefined, degraded: undefined, outputErrorStreak: 0, outputInvalid: false, recordDegraded: () => { } },
+        limits: { turnsExceeded: false, budgetHit: undefined, budgetAxis: undefined, platformTerminal: undefined, outputRetryCap: 0, effectiveMaxTurns: undefined },
+        budget: { remainingMicroUsd: undefined, maxCostMicroUsd: undefined, remainingTokens: undefined, maxTokensWindow: undefined, overBudget: () => undefined, streamCancel: false, callOutputChars: 0, lastStreamBudgetCheck: 0, projectedOverBudget: () => undefined },
+        turn: { callStartAt: undefined, firstTokenAt: undefined, turnUsage: undefined, turnUsageMissing: false, turnStopReason: undefined, lastTurnHadToolCalls: false, toolBatch: [] },
+        counters: { approachNoticesSent: 0, walltimeSyncBackstopFired: false, compactionFloor: 0, trimForceBackoff: false, repetitionCuts: 0, repetitionSpared: 0, repetitionEvents: [], REPETITION_EVENTS_CAP: 0, preemptIgnoredReported: false, wroteThisRun: false, finalVerifyInjections: 0, groundingSignalPreR9: false, groundingSignalPostR9: false, cadenceTurns: 0 },
+        attach: { attachmentsCfg: undefined, agentListingOn: false, skillsListingOn: false, attachState: undefined, dateState: undefined, instrProbe: undefined, instrState: undefined, sizeGuidelineState: undefined, attachmentsInjected: 0 },
+    };
+}

package/dist/core/runner/prepare-caps-and-workflow.js

@@ -5,7 +5,9 @@ import { CROSS_SESSION_CLASSIFIER_RULE } from "../../agents/cross-session-envelo
 import { createRunWorkflowTool, RUN_WORKFLOW_TOOL_NAME } from "../../orchestration/run-workflow-tool.js";
 import { isSelfOrchestrationActive } from "../../orchestration/workflow-script-runner.js";
 import { resolveWorkflowSizeGuideline } from "../../orchestration/workflow-size-guideline.js";
+import { thinkingOffExpressible } from "../../brain/reasoning.js";
 import { autoModeArmingRecipeOf } from "../auto-mode-arming.js";
+import { AUTO_MODE_CLASSIFIER_MAX_TOKENS } from "../auto-mode-defaults.js";
 import { buildAutoModePrompt, renderAutoModeAction, renderAutoModeWindow } from "../auto-mode-prompt.js";
 import { createAutoModeDecider, createAutoModeDenialTracker } from "../auto-mode.js";
 import { resolveCheckpointStore } from "../checkpoint-store.js";
@@ -14,6 +16,7 @@ import { createPresentPlanTool, createEnterPlanModeTool } from "../present-plan-
 import { resolveTaskModel } from "../roles.js";
 import { brainToRuntime } from "../runtime.js";
 import { defaultTaskRegistry } from "../task-registry.js";
+import { emitTrace } from "../trace.js";
 import { defineTool, isDefineToolProduct } from "../tools.js";
 import { derivedRouteFallsBack } from "./derived-route-fallback.js";
 import { REPORT_FINDINGS_TOOL_NAME, createReportBlockedTool, createReportFindingsTool } from "./synthetic-tools.js";
@@ -156,11 +159,23 @@ export async function prepareCapsAndWorkflow(input) {
         const classifierLaneRule = peerLaneActive && peerSendMessageBuiltIn;
         const classifierSystemPrompt = buildAutoModePrompt(classifierLaneRule ? { ...am, crossSessionMessagesRule: CROSS_SESSION_CLASSIFIER_RULE } : am);
         const classifierRuntime = brainToRuntime(deps.brain);
+        const classifierCap = thinkingOffExpressible(classifierModel) ? { maxTokens: AUTO_MODE_CLASSIFIER_MAX_TOKENS } : {};
         autoModeDenialTracking = createAutoModeDenialTracker(am.denialLimit);
         autoModeDecider = createAutoModeDecider({
             ...(am.timeoutMs !== undefined ? { timeoutMs: am.timeoutMs } : {}),
             ...(am.failureThreshold !== undefined ? { failureThreshold: am.failureThreshold } : {}),
             ...(am.onBreakerOpen !== undefined ? { onBreakerOpen: am.onBreakerOpen } : {}),
+            onClassified: (info) => emitTrace(deps.tracer, () => ({
+                kind: "auto_mode.classified",
+                version: 1,
+                taskId: hostTaskId,
+                toolCallId: info.toolCallId,
+                model: classifierModel.id,
+                ms: info.ms,
+                verdict: info.verdict,
+                ...(info.cause !== undefined ? { cause: info.cause } : {}),
+                ts: Date.now(),
+            })),
             classify: async (input, signal) => {
                 const ctx = await session.buildContext();
                 const known = ctx.messages.filter((m) => !isSyntheticApiErrorMessage(m) &&
@@ -169,6 +184,8 @@ export async function prepareCapsAndWorkflow(input) {
                 const classifierAuth = await spec.getApiKeyAndHeaders?.(classifierModel);
                 const response = await classifierRuntime.completeSimple(classifierModel, { systemPrompt: classifierSystemPrompt, messages: [{ role: "user", content: userPrompt, timestamp: Date.now() }] }, {
                     signal,
+                    reasoning: "off",
+                    ...classifierCap,
                     ...(classifierAuth?.apiKey !== undefined ? { apiKey: classifierAuth.apiKey } : {}),
                     ...(classifierAuth?.headers !== undefined ? { headers: classifierAuth.headers } : {}),
                 });

package/dist/core/runner/prepare-run-refs.d.ts

@@ -86,16 +86,4 @@ export interface PrepareRunRefsResult {
     worktreeIsolation: SubagentWorktreeIsolation | undefined;
 }
 /** The M3a phase body — prepareTask's run-refs stretch, verbatim (see the module header). */
-/**
- * A run that opted into `forwardSubagentEvents` may have BACKGROUND children whose frames are forwarded to the
- * deployment's sink from the child's own run. Those forwards are scheduled on later microtasks than the parent's
- * turn, so "the parent stream ended" and "the child's already-emitted frames reached the sink" are two different
- * moments — the gap is one microtask ladder deep and moves whenever the gate's station structure changes (design/393
- * / #594: the three-layer gate added three async frames to a child's gated call, and a consumer that read the parent
- * to `done` then inspected the sink lost the child's `tool_end`). The rule is not a tick count: **before the parent
- * says `done`, every frame a child had already handed to the forward channel is delivered.** One macrotask turn is
- * the smallest boundary that strictly orders after all pending microtasks; it is taken only on the opted-in run,
- * only once, right before `done`.
- */
-export declare function drainForwardedFramesBeforeDone(spec: Pick<TaskSpec, "forwardSubagentEvents">): Promise<void>;
 export declare function prepareRunRefs(input: PrepareRunRefsInput): PrepareRunRefsResult;

package/dist/core/runner/prepare-run-refs.js

@@ -2,11 +2,6 @@ import { createSubagentWorktreeHelper } from "../../agents/subagent.js";
 import { SubagentRetainLedger } from "../../agents/retain-ledger.js";
 import { ActiveSkillScope } from "./active-skill-scope.js";
 import { createEditedFilesLedger } from "./edited-files-ledger.js";
-export async function drainForwardedFramesBeforeDone(spec) {
-    if (spec.forwardSubagentEvents !== true)
-        return;
-    await new Promise((resolve) => setImmediate(resolve));
-}
 export function prepareRunRefs(input) {
     const { spec, internals, executionEnv, taskRootFinal } = input;
     const { note: noteFileEdited, snapshot: editedFilesSnapshot } = createEditedFilesLedger();

package/dist/core/runner/runtask.d.ts

@@ -3,77 +3,9 @@ import { type CheckpointToken, type ResumeOutcome } from "../checkpoint-store.js
 import { type TaskOutcome } from "../task-outcome.js";
 import { type SideQuerySpec, type SideQueryResult } from "../side-query.js";
 import type { SessionStore } from "../session.js";
-import { type RecoveredOrphan } from "../session-reconcile.js";
-import type { GateOutcome } from "../gate-outcome.js";
-import { type McpDelivered } from "../mcp-failure.js";
 import type { AgentDefinition, ModelRef, RunnerDeps, TaskEvent, TaskResult, TaskSpec, TaskStream } from "../types.js";
 import type { ResumeRun, ResumeTaskConfig, RunInternals, RunnerSelfSeat } from "./contracts.js";
 export type { ResumeTaskConfig } from "./contracts.js";
-/** The `tool_end` body fields projected from a harness tool result — output/truncated/totalChars via
- *  {@link toolOutputFrom} and the CC card via {@link structuredFrom}. Single construction point for BOTH
- *  the live loop's frames and the resumed batch's frames (`resolvePendingCall` + the deferred-sibling
- *  close): the resumed frames used to carry only `isError`, so a client rendering tool output from frames
- *  showed an empty body for every durable-approved call. Same projection = same source as the transcript.
- *  Also the one place the gate outcome reaches a frame — see the parameter. */
-declare function toolEndBodyFrom(result: unknown, isError: boolean, 
-/** The gate's record of the pass that admitted or refused this call, supplied by the CALLER of this
- *  projection — the live loop reads it off the gate's per-call sideband, the resumed leg off the decide's
- *  minted record. Deliberately a parameter and never derived from `result`: a tool's own `details`
- *  (which post-tool hooks may also replace) is writable by layers that adjudicate nothing, so reading
- *  provenance out of it would let a failing tool claim a person approved it. Omitted ⇒ the call never
- *  went through the gate (see the `tool_end.gate` doc, the one home). */
-gate?: GateOutcome, 
-/** WHICH call this run's committed durable park is holding ({@link gatedCallIdOf}), for the frames the
- *  abort short-circuits. Same never-derived-from-`result` posture as the outcome above, and for the
- *  sharpest version of that reason: this one is an assertion about a DIFFERENT call, so a tool able to
- *  author it could point an approval UI at a call nobody is waiting on. Omitted ⇒ no park is holding a
- *  call (nothing parked, or the park that did holds none), and the frame then carries no id at all. */
-gatedCallIdOfRun?: string): {
-    output?: unknown;
-    truncated?: boolean;
-    totalChars?: number;
-    structured?: unknown;
-    errorCode?: string;
-    delivered?: McpDelivered;
-    gatedCallId?: string;
-    gate?: GateOutcome;
-};
-/**
- * scan-1/A1 — the BODY of the synthetic `tool_end` that closes a reconcile-recovered orphan. ONE
- * construction point for BOTH minting legs (the live-abort loop at the end of a run, and the wake/crash
- * leg's replay at run open), so the two can never disagree about the shape of the same event.
- *
- * Both frames used to carry `isError:true` and NOTHING else: a consumer rendering tool output from the
- * event stream showed an EMPTY body for every interrupted call, even though the persisted transcript
- * (which the model reads) carried the full `[INTERRUPTED]` explanation — the two faces of one call
- * disagreed. The projection goes through the same {@link toolEndBodyFrom} every live tool result uses, so
- * `output` = the persisted model-facing text and `errorCode` = the persisted `details.errorKind`
- * (`interrupted_never_started` / `interrupted_outcome_unknown`) — a consumer discriminates on the code
- * instead of prose-matching. No `structured`: the reconcile mints no CC card (no `details.type`), which
- * `structuredFrom`'s allowlist already enforces.
- */
-export declare function reconciledToolEndBody(orphan: Pick<RecoveredOrphan, "text" | "errorKind">): ReturnType<typeof toolEndBodyFrom>;
-export declare const GOVERNANCE_READ_STALLED: unique symbol;
-/** Await a ledger charge, firing `onSlow` ONCE if it has not settled after
- *  {@link CHARGE_SETTLE_DISCLOSE_MS}. The charge itself is always awaited to completion. */
-export declare function awaitChargeWithSlowDisclosure<T>(charge: Promise<T>, onSlow: () => void, discloseAfterMs?: number): Promise<T>;
-/**
- * Await `p` until the absolute epoch `deadline`, then give up with {@link GOVERNANCE_READ_STALLED}.
- *
- * Chunked, and deliberately so: the deadline is derived from a caller-declared environment lifetime, so
- * the distance to it can exceed {@link MAX_TIMER_DELAY_MS} — a single timer armed for that distance
- * would fire at once and abandon a perfectly healthy read. Each chunk re-reads the wall clock, so the
- * decision is always made against the deadline itself rather than against an allowance computed once.
- *
- * Exported for its own unit pin (the same posture as the brain-call guardrail primitive): the
- * behaviors below are clock behaviors, and only a virtual clock can assert them without spending the
- * wall-clock time they describe. Not re-exported from the package index.
- *
- * An already-overdue deadline still gets ONE zero-delay pass: a promise that is settled (or settles in a
- * microtask, which is every in-process store) must be allowed to win, because giving up on an answer we
- * already hold would be a fabricated stall. The second pass is what makes the loop terminate.
- */
-export declare function raceUntilDeadline<T>(p: Promise<T>, deadline: number): Promise<T | typeof GOVERNANCE_READ_STALLED>;
 /**
  * A stateless task runner. Holds shared deps (the external brain, model catalog) and an
  * in-memory session store so that passing a `sessionId` continues a prior conversation.