@sema-agent/core 7.9.2 → 7.11.0

package/dist/engine/execution-env/node-execution-env.js

@@ -2,7 +2,7 @@ import { spawn } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import { closeSync, constants, createReadStream, mkdtempSync, openSync, readSync, statSync, truncateSync, unlinkSync } from "node:fs";
 import { access, appendFile, lstat, mkdir, mkdtemp, open, readdir, readFile, readlink, realpath, rename, rm, unlink, writeFile, } from "node:fs/promises";
-import { tmpdir } from "node:os";
+import { homedir, tmpdir } from "node:os";
 import { isAbsolute, join, resolve } from "node:path";
 import { createInterface } from "node:readline";
 import { ExecutionError, err, FileError, ok, toError, } from "../harness/types.js";
@@ -284,6 +284,7 @@ export function openSpoolPair(base) {
 }
 export class NodeExecutionEnv {
     cwd;
+    homeDir = homedir();
     shellPath;
     shellEnv;
     inheritEnv;

package/dist/engine/harness/agent-harness.d.ts

@@ -131,6 +131,7 @@ export declare class AgentHarness<TSkill extends Skill = Skill, TPromptTemplate
     private runPromise?;
     private pendingSessionWrites;
     private model;
+    /** The run's thinking level; `undefined` = undeclared (provider default, no wire key) — distinct from "off". */
     private thinkingLevel;
     /** RB-30 terminal fix — runner-set sink for engine-note payloads left undrained at agent_end. */
     onUndrainedEngineNotes?: (payloads: unknown[]) => void;
@@ -410,7 +411,8 @@ export declare class AgentHarness<TSkill extends Skill = Skill, TPromptTemplate
     } & UserMessageProvenance): Promise<void>;
     appendMessage(message: AgentMessage): Promise<void>;
     getModel(): Model;
-    getThinkingLevel(): ThinkingLevel;
+    /** The current level, or `undefined` when none was declared (provider default — no wire key). */
+    getThinkingLevel(): ThinkingLevel | undefined;
     setModel(model: Model): Promise<void>;
     setThinkingLevel(level: ThinkingLevel): Promise<void>;
     setActiveTools(toolNames: string[]): Promise<void>;

package/dist/engine/harness/agent-harness.js

@@ -277,7 +277,7 @@ export class AgentHarness {
             this.tools.set(tool.name, tool);
         }
         this.model = options.model;
-        this.thinkingLevel = options.thinkingLevel ?? "off";
+        this.thinkingLevel = options.thinkingLevel;
         this.activeToolNames =
             options.activeToolNames ?? (options.tools ?? []).map((tool) => tool.name);
         this.steeringQueueMode = options.steeringMode ?? "one-at-a-time";

package/dist/engine/harness/types.d.ts

@@ -498,6 +498,17 @@ export interface ExecutionEnv extends FileSystem, Shell {
      * SSH env to an organization-managed build host can be non-isolated yet omit this flag.
      */
     readonly externalContentTarget?: boolean;
+    /**
+     * #644 — declared by the ADAPTER: the HOME DIRECTORY of the user this environment runs as, as an absolute
+     * path in the environment's own namespace. The base a `~/`-relative permission rule (`Edit(~/.ssh/**)`)
+     * resolves against for calls executing in this env. Omitted ⇒ the environment declares no home, and every
+     * `~/` deny/ask rule reads UNREADABLE for its calls (a fail-closed ask a person clears), because the only
+     * other candidate — the ENGINE PROCESS's home — is the wrong directory on any leg whose environment is not
+     * the engine host (a remote executor, a sandbox), and guarding the wrong directory silently was the
+     * defect. A local Node environment declares `os.homedir()` (it IS the host). A declared value that is not
+     * an absolute path is refused at prepare (`config.execution_env_home_dir_invalid`), never read as absent.
+     */
+    readonly homeDir?: string;
 }
 /** Base fields shared by append-only session tree entries. */
 export interface SessionTreeEntryBase {
@@ -1167,7 +1178,8 @@ export interface ModelSelectEvent {
 export interface ThinkingLevelSelectEvent {
     type: "thinking_level_select";
     level: ThinkingLevel;
-    previousLevel: ThinkingLevel;
+    /** `undefined` when the run had no declared level before this selection (provider default). */
+    previousLevel: ThinkingLevel | undefined;
 }
 export interface ResourcesUpdateEvent<TSkill extends Skill = Skill, TPromptTemplate extends PromptTemplate = PromptTemplate> {
     type: "resources_update";
@@ -1335,7 +1347,8 @@ export interface AgentHarnessOptions<TSkill extends Skill = Skill, TPromptTempla
         env: ExecutionEnv;
         session: Session;
         model: Model;
-        thinkingLevel: ThinkingLevel;
+        /** `undefined` = no level declared (provider default). */
+        thinkingLevel: ThinkingLevel | undefined;
         activeTools: TTool[];
         resources: AgentHarnessResources<TSkill, TPromptTemplate>;
     }) => string | Promise<string>);

package/dist/index.d.ts

@@ -54,6 +54,7 @@ export { pgQuery, mysqlQuery, sqliteQuery } from "./tools/sql-adapters.js";
 export { materializeMcpTools, MCP_PREFIX, type MaterializedMcp, type McpServerStatus, type McpRefreshResult } from "./core/mcp.js";
 export { MCP_FAILURE_KINDS, MCP_DELIVERY_VERDICTS, classifyMcpFailure, type McpFailure, type McpFailureKind, type McpDelivered } from "./core/mcp-failure.js";
 export { MCP_INJECTION_DROP_REASONS, MCP_INJECTION_DROP_TEXT, mcpInjectionDroppedNotice, type McpInjectionDropReason, type McpInjectionDropFacts } from "./core/mcp-injection-drop.js";
+export { askUnresolvableNotice, type AskUnresolvableFacts } from "./core/ask-unresolvable-notice.js";
 export { materializeA2aTools, A2aRpcError, type MaterializedA2a, type A2aPeerStatus, type A2aRefreshResult, type A2aToolAxis } from "./core/a2a.js";
 export { PROTOCOL_TABLE, MCP_NAMESPACE, A2A_NAMESPACE, protocolOf, type ProtocolNamespace, type ProtocolId } from "./core/protocol-table.js";
 export { InMemorySessionPolicyStore, SessionPolicyError, loosenReasons, normalizeRules, stripRev, type SessionPolicyStore, type SessionPermissionRules, type StoredSessionRules, type SessionRulesRecord, type PutRulesOptions, } from "./core/session-policy-store.js";
@@ -166,7 +167,8 @@ export { createAllowDenyPolicy, createApprovalPolicy, COARSE_SHELL_TOOLS, create
 export { type AskOrigin, ASK_ORIGINS, isAskOrigin, classifierMayAnswer, ORIGIN_IMPLIES_REAL_APPROVAL } from "./core/ask-origin.js";
 export { SETTLEMENT_KINDS, type SettlementKind, isSettlementKind, type Settlement, SETTLEMENT_IS_REFUSAL, DENIED_BY_VALUES, type DeniedBy, isDeniedBy, DENIED_BY_MAY_VETO, type GateDisposition, type GateOutcome, screenGateOutcome } from "./core/gate-outcome.js";
 export { type AskCarry } from "./core/hooks.js";
-export { parseAutoModeResponse, createAutoModeDecider, type AutoModeVerdict, type AutoModeDecider, type AutoModeDeciderOptions, type AutoModeClassified, type AutoModeClassifyFn, type AutoModeClassifyInput, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow, type AutoModeDenialTracker, type AutoModeDenialLimitOptions, type DenialLimitCounts, type DenialLimitFallbackFace, type UnarmedDenialLimitFallback, type DenialLimitFallback, type DenialLimitVerdict, } from "./core/auto-mode.js";
+export { SWAPPABLE_DEP_SEATS, SWAP_SEAT_NOTICE, isSwappableDepSeat, screenSwappableDeps, type SwappableDepSeat, type SwappableDeps } from "./core/swappable-deps.js";
+export { parseAutoModeResponse, createAutoModeDecider, AUTO_MODE_UNAVAILABLE_CAUSES, isAutoModeUnavailableCause, AUTO_MODE_BREAKER_CAUSES, isAutoModeBreakerCause, AutoModeBreakerLedger, type AutoModeUnavailableCause, type AutoModeBreakerCause, type AutoModeBreakerTrip, type AutoModeVerdict, type AutoModeDecider, type AutoModeDeciderOptions, type AutoModeClassified, type AutoModeClassifyFn, type AutoModeClassifyInput, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow, type AutoModeDenialTracker, type AutoModeDenialLimitOptions, type DenialLimitCounts, type DenialLimitFallbackFace, type UnarmedDenialLimitFallback, type DenialLimitFallback, type DenialLimitVerdict, } from "./core/auto-mode.js";
 export { AUTO_MODE_DENIAL_LIMIT_DEFAULTS, AUTO_MODE_DENIAL_AUTO_DENY_DEFAULT_MS, AUTO_MODE_CLASSIFIER_MAX_TOKENS } from "./core/auto-mode-defaults.js";
 export { buildAutoModePrompt, renderAutoModeWindow, renderAutoModeAction, AUTO_MODE_DEFAULTS_SENTINEL, type AutoModeRules, type BuildAutoModePromptOptions, type AutoModeWindowOptions, } from "./core/auto-mode-prompt.js";
 export { AUTO_MODE_BASE_PROMPT, AUTO_MODE_PERMISSIONS_EXTERNAL } from "./core/auto-mode-prompt-assets.js";
@@ -188,12 +190,14 @@ export { createPermissionRulePolicy, validatePermissionRules, parsePermissionRul
  * and nothing more. Removal is exported without ceremony, because narrowing on a user's behalf is
  * allowed and widening is not.
  */
-export { RULE_BEHAVIORS, RULE_BEHAVIOR_PRECEDENCE, RULE_BEHAVIORS_BY_PRECEDENCE, isRuleBehavior, readRowBehavior, adjudicatePersistedRules, adjudicatePersistedPathRules, ruleReachesProgramRun, programRunReachOf, PROGRAM_RUN_REACHES, type ProgramRunReach, type ProgramRunReachOutcome, pathRuleReaches, ruleToolGrammarOf, COMMAND_RULE_TOOL, READ_RULE_TOOL, type PathRuleBases, type RuleBehavior, type PersistedRuleVerdict, parseRuleText, formatRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, stripFormatCharacters, UNCOVERED_SEGMENT_REASON_BASELINE, RULE_OFFERS_ABSENCE_BASELINE, type UncoveredSegmentDetail, type EditedRuleBreadthWarning, directoryRuleAdmits, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, type PersistedRule, type RuleTombstone, type RuleScope, type RuleDot, type RuleAdd, type RuleAddOrigin, type RuleOffer, type RuleOfferBatchMember, type SegmentRuleSuggestion, type SegmentCoverage, type RuleReject, type RuleRejectCode, type ParsedRule, type PersistedRuleTool, type PersistedRuleMatch, } from "./core/permission-rule-model.js";
+export { RULE_BEHAVIORS, RULE_BEHAVIOR_PRECEDENCE, RULE_BEHAVIORS_BY_PRECEDENCE, isRuleBehavior, readRowBehavior, adjudicatePersistedRules, adjudicatePersistedPathRules, ruleReachesProgramRun, programRunReachOf, PROGRAM_RUN_REACHES, type ProgramRunReach, type ProgramRunReachOutcome, pathRuleReachOf, ruleBasesNeeded, PATH_RULE_BASES, PATH_RULE_BASE_LABEL, ruleToolGrammarOf, COMMAND_RULE_TOOL, READ_RULE_TOOL, type PathRuleBase, type PathRuleBases, type RuleBehavior, type PersistedRuleVerdict, parseRuleText, formatRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, stripFormatCharacters, UNCOVERED_SEGMENT_REASON_BASELINE, RULE_OFFERS_ABSENCE_BASELINE, type UncoveredSegmentDetail, type EditedRuleBreadthWarning, directoryRuleAdmits, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, type PersistedRule, type RuleTombstone, type RuleScope, type RuleDot, type RuleAdd, type RuleAddOrigin, type RuleOffer, type RuleOfferBatchMember, type SegmentRuleSuggestion, type SegmentCoverage, type RuleReject, type RuleRejectCode, type ParsedRule, type PersistedRuleTool, type PersistedRuleMatch, } from "./core/permission-rule-model.js";
 export { removePersistedRule, applyTombstones, sameScope, sameRuleIdentity, isValidConsentScope, isValidDurableScope, InMemoryDurableRulePartition, EMPTY_DURABLE_RULE_PARTITION, type DurableRulePartition, type DurableRulePartitionProvider, type RuleWriteOutcome, type StoredRules, type RemoveResult, type PutResult, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, type RuleSyncState, type RuleSyncFrontier, type RuleSyncDrop, type RuleSyncLandingReport, type RuleOwner, type QuarantinedRuleAdd, PERMISSION_RULE_WRITER, writerOf, foldDelta, addDotsOf, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, type PermissionRuleWriter, type WritableDurableRulePartition, type RuleWriteDelta, type RuleAddDelta, type RuleDeleteDelta, type RuleSyncJoinDelta, type RawRuleSyncState, type RedemptionAuthorization, } from "./core/permission-rule-store.js";
 export { syncPermissionRules, parseRuleSyncResponse, PERMISSION_RULE_SYNC_PATH, LOCAL_OWNER_UNSYNCABLE_CODE, type PermissionRuleSyncTransport, type PermissionRuleSyncResult, type RuleSyncRequestBody, type RuleSyncResponseBody, } from "./core/permission-rule-sync.js";
 export { createPermissionRuleStoreProvider, effectivePermissionRules, effectiveOrThrow, ruleSourceOf, type PermissionRuleStore, type PermissionRuleStoreProvider, type PermissionRuleStoreConfig, type EffectivePermissionRules, type EffectivePermissionRule, type RemovedPermissionRule, type RuleSource, } from "./core/permission-rule-provider.js";
 export { InMemorySessionRulePartition, type SessionRulePartition, type SessionRuleAdd, type SessionRuleApplyResult, } from "./core/permission-rule-session.js";
-export { readShellCommand, isFullyReadable, MAX_SHELL_READ_CHARS, SHELL_WRAPPER_TABLE, type ShellCommandShape, type ShellSegment, type ShellWord, type ShellWrapperName, } from "./core/shell-lexer.js";
+export { readShellCommand, isFullyReadable, MAX_SHELL_READ_CHARS, SHELL_WRAPPER_TABLE, type ShellCommandShape, type ShellSegment, type ShellWord, type ShellRedirection, type ShellWrapperName, } from "./core/shell-lexer.js";
+export { readOnlyShellVerdict, type ReadOnlyShellVerdict } from "./core/read-only-shell.js";
+export { READ_ONLY_FLAG_ARITIES, FLAG_VALUE_ACCEPTS, READ_ONLY_COMMAND_TABLE, READ_ONLY_BARE_PROGRAMS, READ_ONLY_GLOB_PROGRAMS, READ_ONLY_EXACT_FORMS, READ_ONLY_BARE_ONLY, FIND_ACTION_PRIMARIES, FIND_VALUE_PRIMARIES, FIND_NEWER_PRIMARY, READ_ONLY_ENV_NAMES, XARGS_READ_ONLY_TARGETS, type ReadOnlyFlagArity, type ReadOnlyCommandRow, } from "./core/read-only-shell-table.js";
 export { orgRuleVerdictFor, type OrgRuleVerdict, orgRuleShadows, unenforceableOrgRules, ORG_UNAVAILABLE_DECISION_REASON, ORG_RULE_DECISION_REASON, ORG_ADJUDICATION_TIMEOUT_MS, type OrgPermissionRule, type OrgRuleSnapshot, type OrgRuleSnapshotProvider, type OrgRuleStatePersistence, type PersistedOrgRuleState, type OrgRulePartitionConfig, type OrgRuleResolution, type OrgRuleStatus, } from "./core/permission-rule-org.js";
 export { RULE_SYNC_DROP_CODES, type RuleSyncDropReason, type RuleQuarantineReason } from "./core/governance-codes.js";
 export { prepareCardApproval, confirmRuleApproval, type ConfirmResult, type ConfirmRefusalReason, precheckEditedRuleText, type EditedRuleTextPrecheck, redeemRuleTicket, redeemRuleBatch, prepareCcImport, prepareStarterBatch, mintRuleTicket, STARTER_RULES, InMemoryRuleApprovalRecordStore, ruleOffersOfRecord, type RuleTicket, type RuleCandidate, type RuleApprovalKind, type RuleApprovalRecord, type RuleApprovalRecordStore, type RuleOffer2, type StaleRuleApprovalRecord, type RuleConsentDeps, type RedeemResult, type RedeemedBatchMember, type CcImportLayer, type ImportedSettingsLayer, type ImportPreview, } from "./core/permission-rule-consent.js";
@@ -228,7 +232,7 @@ export { type ReasoningIntensity, type ReasoningResolution, type ResolvedReasoni
 export { DESIGN_REVIEW_PROMPTS, CODE_REVIEW_PROMPT, SCENARIO_REGISTRY, runScenario, type ScenarioId, type CodeReviewMode, type ScenarioProfile, type RunScenarioOptions, type RunScenarioResult, } from "./scenarios/scenario-registry.js";
 export { teacherMode, TEACHER_PROFILE, type TeacherModePair, type TeacherProfile, } from "./scenarios/teacher-quickstart.js";
 export { loadOrchestrationEnv, DEFAULT_REASONING_INTENSITY, type OrchestrationMode, type OrchestrationEnv, } from "./scenarios/env.js";
-export { runWorkflow, startWorkflow, workflowAgentCallKey, WorkflowBudgetExceededError, WorkflowNestingError, WorkflowAgentSchemaError, WorkflowAgentStalledError, WorkflowAgentBlockedError, WORKFLOW_SPAWN_BLOCKED_ERROR_CODE, type WorkflowFanOutSlotError, type WorkflowFanOutOptions, WORKFLOW_SUBAGENT_PROMPT, WORKFLOW_SUBAGENT_PROMPT_SCHEMA, WORKFLOW_SUBAGENT_APPEND, WORKFLOW_SUBAGENT_APPEND_SCHEMA, type WorkflowHandle, MAX_WORKFLOW_ITEMS, type WorkflowRun, type WorkflowRunStatus, type WorkflowItemStatus, type WorkflowPhase, type WorkflowGroup, type WorkflowAgentRun, type WorkflowAgentHandle, type WorkflowRunStats, type WorkflowEvent, type WorkflowBudget, type WorkflowAgentOptions, type WorkflowRunContext, type WorkflowInternals, type RunWorkflowOptions, type RunWorkflowResult, type WorkflowTimers, } from "./orchestration/workflow.js";
+export { runWorkflow, startWorkflow, workflowAgentCallKey, WorkflowBudgetExceededError, WorkflowNestingError, WorkflowAgentSchemaError, WorkflowAgentStalledError, WorkflowAgentBlockedError, WORKFLOW_SPAWN_BLOCKED_ERROR_CODE, WorkflowAgentParkedError, WORKFLOW_AGENT_PARKED_ERROR_CODE, type WorkflowParkedResume, type WorkflowFanOutSlotError, type WorkflowFanOutOptions, WORKFLOW_SUBAGENT_PROMPT, WORKFLOW_SUBAGENT_PROMPT_SCHEMA, WORKFLOW_SUBAGENT_APPEND, WORKFLOW_SUBAGENT_APPEND_SCHEMA, type WorkflowHandle, MAX_WORKFLOW_ITEMS, type WorkflowRun, type WorkflowRunStatus, type WorkflowItemStatus, type WorkflowPhase, type WorkflowGroup, type WorkflowAgentRun, type WorkflowAgentHandle, type WorkflowRunStats, type WorkflowEvent, type WorkflowBudget, type WorkflowAgentOptions, type WorkflowRunContext, type WorkflowInternals, type RunWorkflowOptions, type RunWorkflowResult, type WorkflowTimers, } from "./orchestration/workflow.js";
 export { listWorkflowRuns, getWorkflowRun, subscribeWorkflow, deriveAgentDisplayStatus, type AgentDisplayStatus } from "./orchestration/workflow-observe.js";
 export { runGoal, DECLARE_DONE_TOOL_NAME, type GoalSpec, type GoalResult, type GoalStatus, type GoalBudgetCause, type GoalVerdict, type GoalTurnState, type GoalVerificationKind, } from "./orchestration/goal.js";
 export { emitTaskOutcome, type TaskOutcome } from "./core/task-outcome.js";

package/dist/index.js

@@ -41,6 +41,7 @@ export { pgQuery, mysqlQuery, sqliteQuery } from "./tools/sql-adapters.js";
 export { materializeMcpTools, MCP_PREFIX } from "./core/mcp.js";
 export { MCP_FAILURE_KINDS, MCP_DELIVERY_VERDICTS, classifyMcpFailure } from "./core/mcp-failure.js";
 export { MCP_INJECTION_DROP_REASONS, MCP_INJECTION_DROP_TEXT, mcpInjectionDroppedNotice } from "./core/mcp-injection-drop.js";
+export { askUnresolvableNotice } from "./core/ask-unresolvable-notice.js";
 export { materializeA2aTools, A2aRpcError } from "./core/a2a.js";
 export { PROTOCOL_TABLE, MCP_NAMESPACE, A2A_NAMESPACE, protocolOf } from "./core/protocol-table.js";
 export { InMemorySessionPolicyStore, SessionPolicyError, loosenReasons, normalizeRules, stripRev, } from "./core/session-policy-store.js";
@@ -140,19 +141,22 @@ export { createAllowDenyPolicy, createApprovalPolicy, COARSE_SHELL_TOOLS, create
 export { ASK_ORIGINS, isAskOrigin, classifierMayAnswer, ORIGIN_IMPLIES_REAL_APPROVAL } from "./core/ask-origin.js";
 export { SETTLEMENT_KINDS, isSettlementKind, SETTLEMENT_IS_REFUSAL, DENIED_BY_VALUES, isDeniedBy, DENIED_BY_MAY_VETO, screenGateOutcome } from "./core/gate-outcome.js";
 export {} from "./core/hooks.js";
-export { parseAutoModeResponse, createAutoModeDecider, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow, } from "./core/auto-mode.js";
+export { SWAPPABLE_DEP_SEATS, SWAP_SEAT_NOTICE, isSwappableDepSeat, screenSwappableDeps } from "./core/swappable-deps.js";
+export { parseAutoModeResponse, createAutoModeDecider, AUTO_MODE_UNAVAILABLE_CAUSES, isAutoModeUnavailableCause, AUTO_MODE_BREAKER_CAUSES, isAutoModeBreakerCause, AutoModeBreakerLedger, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow, } from "./core/auto-mode.js";
 export { AUTO_MODE_DENIAL_LIMIT_DEFAULTS, AUTO_MODE_DENIAL_AUTO_DENY_DEFAULT_MS, AUTO_MODE_CLASSIFIER_MAX_TOKENS } from "./core/auto-mode-defaults.js";
 export { buildAutoModePrompt, renderAutoModeWindow, renderAutoModeAction, AUTO_MODE_DEFAULTS_SENTINEL, } from "./core/auto-mode-prompt.js";
 export { AUTO_MODE_BASE_PROMPT, AUTO_MODE_PERMISSIONS_EXTERNAL } from "./core/auto-mode-prompt-assets.js";
 export { AUTO_MODE_ARMING_RECIPE_VERSION, autoModeArmingRecipeOf, sanitizeAutoModeArmingRecipe, foldAutoModeArming, } from "./core/auto-mode-arming.js";
 export { rebuildAutoModeDecider, } from "./core/auto-mode-rebuild.js";
 export { createPermissionRulePolicy, validatePermissionRules, parsePermissionRule, wildcardMatch, isNamespacedCoveringRuleName, namespacedRuleNameCovers, } from "./core/permission-rules.js";
-export { RULE_BEHAVIORS, RULE_BEHAVIOR_PRECEDENCE, RULE_BEHAVIORS_BY_PRECEDENCE, isRuleBehavior, readRowBehavior, adjudicatePersistedRules, adjudicatePersistedPathRules, ruleReachesProgramRun, programRunReachOf, PROGRAM_RUN_REACHES, pathRuleReaches, ruleToolGrammarOf, COMMAND_RULE_TOOL, READ_RULE_TOOL, parseRuleText, formatRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, stripFormatCharacters, UNCOVERED_SEGMENT_REASON_BASELINE, RULE_OFFERS_ABSENCE_BASELINE, directoryRuleAdmits, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, } from "./core/permission-rule-model.js";
+export { RULE_BEHAVIORS, RULE_BEHAVIOR_PRECEDENCE, RULE_BEHAVIORS_BY_PRECEDENCE, isRuleBehavior, readRowBehavior, adjudicatePersistedRules, adjudicatePersistedPathRules, ruleReachesProgramRun, programRunReachOf, PROGRAM_RUN_REACHES, pathRuleReachOf, ruleBasesNeeded, PATH_RULE_BASES, PATH_RULE_BASE_LABEL, ruleToolGrammarOf, COMMAND_RULE_TOOL, READ_RULE_TOOL, parseRuleText, formatRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, stripFormatCharacters, UNCOVERED_SEGMENT_REASON_BASELINE, RULE_OFFERS_ABSENCE_BASELINE, directoryRuleAdmits, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, } from "./core/permission-rule-model.js";
 export { removePersistedRule, applyTombstones, sameScope, sameRuleIdentity, isValidConsentScope, isValidDurableScope, InMemoryDurableRulePartition, EMPTY_DURABLE_RULE_PARTITION, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, PERMISSION_RULE_WRITER, writerOf, foldDelta, addDotsOf, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, } from "./core/permission-rule-store.js";
 export { syncPermissionRules, parseRuleSyncResponse, PERMISSION_RULE_SYNC_PATH, LOCAL_OWNER_UNSYNCABLE_CODE, } from "./core/permission-rule-sync.js";
 export { createPermissionRuleStoreProvider, effectivePermissionRules, effectiveOrThrow, ruleSourceOf, } from "./core/permission-rule-provider.js";
 export { InMemorySessionRulePartition, } from "./core/permission-rule-session.js";
 export { readShellCommand, isFullyReadable, MAX_SHELL_READ_CHARS, SHELL_WRAPPER_TABLE, } from "./core/shell-lexer.js";
+export { readOnlyShellVerdict } from "./core/read-only-shell.js";
+export { READ_ONLY_FLAG_ARITIES, FLAG_VALUE_ACCEPTS, READ_ONLY_COMMAND_TABLE, READ_ONLY_BARE_PROGRAMS, READ_ONLY_GLOB_PROGRAMS, READ_ONLY_EXACT_FORMS, READ_ONLY_BARE_ONLY, FIND_ACTION_PRIMARIES, FIND_VALUE_PRIMARIES, FIND_NEWER_PRIMARY, READ_ONLY_ENV_NAMES, XARGS_READ_ONLY_TARGETS, } from "./core/read-only-shell-table.js";
 export { orgRuleVerdictFor, orgRuleShadows, unenforceableOrgRules, ORG_UNAVAILABLE_DECISION_REASON, ORG_RULE_DECISION_REASON, ORG_ADJUDICATION_TIMEOUT_MS, } from "./core/permission-rule-org.js";
 export { RULE_SYNC_DROP_CODES } from "./core/governance-codes.js";
 export { prepareCardApproval, confirmRuleApproval, precheckEditedRuleText, redeemRuleTicket, redeemRuleBatch, prepareCcImport, prepareStarterBatch, mintRuleTicket, STARTER_RULES, InMemoryRuleApprovalRecordStore, ruleOffersOfRecord, } from "./core/permission-rule-consent.js";
@@ -186,7 +190,7 @@ export { DEFAULT_EFFORT_LEVELS, REASONING_BUDGET_SHARE, isThinkingLevel, rankOf,
 export { DESIGN_REVIEW_PROMPTS, CODE_REVIEW_PROMPT, SCENARIO_REGISTRY, runScenario, } from "./scenarios/scenario-registry.js";
 export { teacherMode, TEACHER_PROFILE, } from "./scenarios/teacher-quickstart.js";
 export { loadOrchestrationEnv, DEFAULT_REASONING_INTENSITY, } from "./scenarios/env.js";
-export { runWorkflow, startWorkflow, workflowAgentCallKey, WorkflowBudgetExceededError, WorkflowNestingError, WorkflowAgentSchemaError, WorkflowAgentStalledError, WorkflowAgentBlockedError, WORKFLOW_SPAWN_BLOCKED_ERROR_CODE, WORKFLOW_SUBAGENT_PROMPT, WORKFLOW_SUBAGENT_PROMPT_SCHEMA, WORKFLOW_SUBAGENT_APPEND, WORKFLOW_SUBAGENT_APPEND_SCHEMA, MAX_WORKFLOW_ITEMS, } from "./orchestration/workflow.js";
+export { runWorkflow, startWorkflow, workflowAgentCallKey, WorkflowBudgetExceededError, WorkflowNestingError, WorkflowAgentSchemaError, WorkflowAgentStalledError, WorkflowAgentBlockedError, WORKFLOW_SPAWN_BLOCKED_ERROR_CODE, WorkflowAgentParkedError, WORKFLOW_AGENT_PARKED_ERROR_CODE, WORKFLOW_SUBAGENT_PROMPT, WORKFLOW_SUBAGENT_PROMPT_SCHEMA, WORKFLOW_SUBAGENT_APPEND, WORKFLOW_SUBAGENT_APPEND_SCHEMA, MAX_WORKFLOW_ITEMS, } from "./orchestration/workflow.js";
 export { listWorkflowRuns, getWorkflowRun, subscribeWorkflow, deriveAgentDisplayStatus } from "./orchestration/workflow-observe.js";
 export { runGoal, DECLARE_DONE_TOOL_NAME, } from "./orchestration/goal.js";
 export { emitTaskOutcome } from "./core/task-outcome.js";

package/dist/orchestration/run-workflow-tool.d.ts

@@ -260,8 +260,11 @@ export interface RunWorkflowToolDeps {
     /** The HOST task's effective working root — threaded into every spawned agent's trusted internals so a
      *  TOC env factory can root the child at the parent's cwd (CC parity, 2026-07-03). */
     parentCwd?: string;
-    /** Call-time getter for the HOST task's current thinking level — a spawned agent with no explicit
-     *  script/baseline `thinking` inherits it (the parentCwd/model-snapshot companion). */
+    /** Call-time getter for the level a spawned agent runs at when neither the script, the agentType
+     *  definition nor the governance baseline set `thinking` (the mount folds the deployment's STATED
+     *  `roles.subagent.thinking` over the HOST task's current level — the child thinking seat's lower rungs).
+     *  Threaded to the workflow as `defaultThinking` and applied at the launch site AFTER the agentType fold,
+     *  the `parentModel` → `defaultModel` companion. */
     parentThinking?: () => import("../core/types.js").TaskSpec["thinking"];
     /** 5.30 merge-rescan (design/199 parity gap) — call-time getter for the HOST task's RESOLVED
      *  read-face containment; folds stricter-wins into every spawned workflow child (see
@@ -307,6 +310,23 @@ export interface RunWorkflowToolDeps {
      *  Absent on both seats ⇒ byte-identical baseline: a child's asks keep the pre-#342 resolution
      *  (`RunnerDeps.onAsk`, else the fail-closed headless auto-deny). */
     parentOnAsk?: import("../core/tool-policy.js").OnAsk;
+    /** #642 — the HOST run's `durableApproval` opt-in (value copy; the Runner mints it from `spec.durableApproval`
+     *  beside `parentOnAsk`, the same seat the delegation tool reads as `ctx.durableApprovalForChildren`). Folded
+     *  into `RunWorkflowOptions.defaultDurableApproval` at execute — ONLY when a `store` is wired (the wa* row's
+     *  durable home; without it the child keeps the pre-#642 lifecycle: its unavailable ask denies fail-closed
+     *  and the `delegation.ask_unresolvable` notice says so). `ctx.durableApprovalForChildren` wins when a
+     *  wrapping path provides it; this dep covers the auto-mounted tool's minimal execute ctx, like `parentOnAsk`.
+     *  Absent on both seats ⇒ byte-identical: a workflow child's ask keeps the host-seat resolution alone. */
+    parentDurableApproval?: {
+        scope: string;
+        ttlMs?: number;
+    };
+    /** #642 — the decisions a host holds for PARKED wa* rows of a prior run, read at execute when the model
+     *  re-invokes with `resumeFromRunId` (a call-time getter over the run id: the decisions arrive on the host's
+     *  trusted run channel, `RunInternals.workflowParkedResume`, and only the ones naming THIS resume's source run
+     *  apply). Threaded into `RunWorkflowOptions.parkedResume`: the resume drives the parked child on with the
+     *  decision instead of re-parking. Never a tool argument — a model cannot decide an approval. */
+    parkedResume?: (resumeFromRunId: string) => ReadonlyArray<import("./workflow.js").WorkflowParkedResume> | undefined;
     /** The HOST run's display sink (its `RunInternals.onForwardEvent` behind the runner's ctx wrapper:
      *  `task_progress` always, plus the children's content events — `text_delta`/`text_end`/
      *  `reasoning_delta`/`tool_start`/`tool_end`, UNTRUSTED-RAW: the consumer must redact — when the HOST spec set

package/dist/orchestration/run-workflow-tool.js

@@ -5,6 +5,7 @@ import { redactSecrets, redactHostLeaks, boundedRedactedSummary } from "../core/
 import { withDelegationProvenance } from "../core/tool-policy.js";
 import { LAUNCH_RECEIPT_OWN_WORDS_CLAUSE, launchReceiptNoQuoteClause } from "../agents/launch-receipt-contract.js";
 import { startWorkflow } from "./workflow.js";
+import { WORKFLOW_AGENT_PARKED_ERROR_CODE } from "./workflow-types.js";
 import { buildWorkflowPrimitives } from "./workflow-primitives.js";
 import { parseWorkflowMeta, splitWorkflowMeta, workflowScriptReadsClockOrRandom } from "./workflow-meta.js";
 import { mergeWorkflowArgs, normalizeStringArg } from "./workflow-script-store.js";
@@ -51,6 +52,7 @@ function workflowUsageBlock(run) {
         agent_count: agents.length,
         agents_done: agents.filter((a) => a.status === "completed").length,
         agents_error: agents.filter((a) => a.status === "failed").length,
+        ...(agents.some((a) => a.status === "parked") ? { agents_parked: agents.filter((a) => a.status === "parked").length } : {}),
         agents_empty_result: agents.filter((a) => a.status === "completed" && (a.output === undefined || a.output === "")).length,
         agents_replayed: agents.filter((a) => a.replayed === true).length,
         ...(run.journalSkips !== undefined && run.journalSkips > 0 ? { journal_skipped: run.journalSkips } : {}),
@@ -76,6 +78,7 @@ function workflowDiagnostics(runId, journalRef, resumeMiss) {
 }
 const SCRIPT_ERROR_CODES = new Set([
     "workflow.script_error",
+    "workflow.parked_call_changed",
     "workflow.nesting",
     "workflow.model_not_allowed",
     "workflow.agent_schema",
@@ -86,6 +89,12 @@ const SCRIPT_ERROR_CODES = new Set([
 function failureSummary(err, runId) {
     const e = err;
     const code = typeof e?.code === "string" ? e.code : undefined;
+    if (code === WORKFLOW_AGENT_PARKED_ERROR_CODE) {
+        const msg = typeof e?.message === "string" ? redactSecrets(e.message) : "";
+        return (`workflow parked (${code}): ${msg.length > 200 ? `${msg.slice(0, 200)}…` : msg} — it did not fail and is not finished` +
+            (runId ? `; per-agent rows via TaskOutput("${runId}") (the parked row reads status "parked")` : "") +
+            `; do not re-issue the same call — once the approval is decided, the deployment resumes this run${runId ? ` (resumeFromRunId: "${runId}")` : ""} and the script continues from the parked call`);
+    }
     const guide = runId
         ? `; per-agent rows via TaskOutput("${runId}"); after fixing, re-invoke with resumeFromRunId: "${runId}" (completed agents replay from the journal)`
         : "";
@@ -465,6 +474,7 @@ export async function createRunWorkflowTool(d) {
                 return structuredError(`workflow script failed to compile: ${err instanceof Error ? err.message : String(err)}`);
             }
             const hostOnAsk = ctx.onAsk ?? d.parentOnAsk;
+            const hostDurableApproval = ctx.durableApprovalForChildren ?? d.parentDurableApproval;
             const runGovernance = hostOnAsk !== undefined && governance.baseline.base.onAsk === undefined
                 ? {
                     ...governance,
@@ -478,7 +488,7 @@ export async function createRunWorkflowTool(d) {
                 }
                 : governance;
             const scriptFn = (wfCtx) => {
-                const primitives = buildWorkflowPrimitives(wfCtx, runGovernance, d.onAgentSpawn, d.parentThinking, principal, ctx.checkpointStoreDisabledForChildren === true || d.parentCheckpointStoreDisabled === true, d.parentReadFace, d.parentReadDenyPatterns, ctx.handsReadOnly === true || d.parentHandsReadOnly === true, ctx.interactiveTools === false || d.parentInteractiveTools === false);
+                const primitives = buildWorkflowPrimitives(wfCtx, runGovernance, d.onAgentSpawn, principal, ctx.checkpointStoreDisabledForChildren === true || d.parentCheckpointStoreDisabled === true, d.parentReadFace, d.parentReadDenyPatterns, ctx.handsReadOnly === true || d.parentHandsReadOnly === true, ctx.interactiveTools === false || d.parentInteractiveTools === false);
                 return d.scriptRunner.run({ scriptSource: script, primitives, scriptArgs: effectiveArgs, signal: wfCtx.signal }).then((r) => r.result);
             };
             if (ctx.signal?.aborted) {
@@ -536,7 +546,10 @@ export async function createRunWorkflowTool(d) {
                         return d.parentMemoryCaptureState !== undefined ? { parentMemoryCaptureState: d.parentMemoryCaptureState } : {};
                     })(),
                     ...(d.parentModel !== undefined ? { defaultModel: d.parentModel } : {}),
+                    ...(d.parentThinking !== undefined ? { defaultThinking: d.parentThinking } : {}),
                     ...(d.parentGetApiKeyAndHeaders !== undefined ? { defaultGetApiKeyAndHeaders: d.parentGetApiKeyAndHeaders } : {}),
+                    ...(hostDurableApproval !== undefined && d.store !== undefined ? { defaultDurableApproval: { ...hostDurableApproval } } : {}),
+                    ...(resumeFromRunId !== undefined && d.parkedResume !== undefined && d.parkedResume(resumeFromRunId) !== undefined ? { parkedResume: d.parkedResume(resumeFromRunId) } : {}),
                     ...(parentCenterArtifactDigest !== undefined ? { parentCenterArtifactDigest } : {}),
                     ...(parentCenterSourceRevision !== undefined ? { parentCenterSourceRevision } : {}),
                     ...((ctx.forwardEvent ?? d.forwardEvent) !== undefined ? { onForwardEvent: (ctx.forwardEvent ?? d.forwardEvent) } : {}),

package/dist/orchestration/workflow-governance.d.ts

@@ -8,8 +8,9 @@
  * (toolPolicy / onAsk / hooks / principal / tools / mcp / skills / lspManager / checkpointStore /
  * getApiKeyAndHeaders / promptProvider / sessionId / signal / …) is structurally never copied. "Never
  * copied" is a statement about the SCRIPT's spec — the child's control plane still arrives from the
- * TRUSTED side, and some of it inherits from the HOST run on trusted lanes of its own: `principal` /
- * `thinking` / the durable off-switch via `buildWorkflowPrimitives`' engine injections, and the host's
+ * TRUSTED side, and some of it inherits from the HOST run on trusted lanes of its own: `principal` / the
+ * durable off-switch via `buildWorkflowPrimitives`' engine injections, `model` / `thinking` / the stated
+ * subagent persona via the launch site's child seats (`withWorkflowChildSeats`), and the host's
  * effective approver via the run-workflow mount's base-slot fold (`RunWorkflowToolDeps.parentOnAsk` →
  * `baseline.base.onAsk`, backlog #342 — filled only when the deployment did not pin the seat). Those are
  * host-ctx bindings the engine writes onto the baseline/child, never a read of anything the script wrote:

package/dist/orchestration/workflow-observe.d.ts

@@ -56,7 +56,7 @@ export declare function listWorkflowRuns(store: WorkflowRunStore, scope: string,
  */
 export declare function getWorkflowRun(store: WorkflowRunStore, id: string, scope: string): Promise<WorkflowRun | null>;
 /** design/99 MF-W display status. */
-export type AgentDisplayStatus = "queued" | "running" | "done" | "failed" | "interrupted";
+export type AgentDisplayStatus = "queued" | "running" | "done" | "failed" | "interrupted" | "parked";
 /**
  * design/99 MF-W (design-review DoR ⑤+⑥): the SHARED, anti-drift projection of a workflow agent's record-level
  * status → a CC-style display status, derived PURELY from the persisted record (the agent's `status` + `startedAt`

package/dist/orchestration/workflow-observe.js

@@ -66,6 +66,8 @@ export function deriveAgentDisplayStatus(agent, runStatus) {
         return "done";
     if (agent.status === "failed")
         return "failed";
+    if (agent.status === "parked")
+        return "parked";
     if (runStatus !== "running")
         return "interrupted";
     return agent.startedAt === undefined ? "queued" : "running";

package/dist/orchestration/workflow-primitives.d.ts

@@ -31,8 +31,11 @@ export interface WorkflowGovernance {
 /**
  * Build the flat {@link WorkflowPrimitives} a {@link WorkflowScriptRunner} runs the script against. The
  * `agent` primitive is GOVERNED when `governance` is set (LLM-authored), else a trusted pass-through.
+ * The host's model and thinking are NOT injected here: both are seats the launch site (`workflow.ts`,
+ * `withWorkflowChildSeats`) fills AFTER the agentType fold, so a definition's own value is the explicit rung
+ * — filling them here ran ahead of the fold and made the fold's "when unset" guard permanently false.
  */
-export declare function buildWorkflowPrimitives(ctx: WorkflowRunContext, governance?: WorkflowGovernance, onAgentSpawn?: (handle: WorkflowAgentHandle) => void, parentThinking?: () => TaskSpec["thinking"], parentPrincipal?: string, 
+export declare function buildWorkflowPrimitives(ctx: WorkflowRunContext, governance?: WorkflowGovernance, onAgentSpawn?: (handle: WorkflowAgentHandle) => void, parentPrincipal?: string, 
 /** ruled 2026-08-04 — the host run set `TaskSpec.checkpointStore: "disabled"` (the per-run durable off
  *  switch). Every agent this workflow spawns inherits it; see the injection below. */
 parentCheckpointStoreDisabled?: boolean, 

package/dist/orchestration/workflow-primitives.js

@@ -65,7 +65,7 @@ function formatResourceClampNote(notes) {
     const parts = notes.map((n) => `${n.field}: requested ${n.requested === undefined ? "unset" : n.requested} → applied ${n.applied}`);
     return `workflow governance tightened this agent's resource limits (${parts.join("; ")})`;
 }
-export function buildWorkflowPrimitives(ctx, governance, onAgentSpawn, parentThinking, parentPrincipal, parentCheckpointStoreDisabled, parentReadFace, parentReadDenyPatterns, parentHandsReadOnly, parentInteractiveToolsOff) {
+export function buildWorkflowPrimitives(ctx, governance, onAgentSpawn, parentPrincipal, parentCheckpointStoreDisabled, parentReadFace, parentReadDenyPatterns, parentHandsReadOnly, parentInteractiveToolsOff) {
     const agent = (spec, opts) => {
         if (typeof spec === "string")
             spec = { objective: spec };
@@ -74,11 +74,6 @@ export function buildWorkflowPrimitives(ctx, governance, onAgentSpawn, parentThi
         const childSpec = governance
             ? buildGovernedChildSpec(spec, effectiveBaseline(governance.baseline), governance.models, governance.caps, (notes) => ctx.log(formatResourceClampNote(notes)), governance.onNotice)
             : { ...spec };
-        if (childSpec.thinking === undefined && parentThinking) {
-            const inherited = parentThinking();
-            if (inherited !== undefined)
-                childSpec.thinking = inherited;
-        }
         if (childSpec.principal === undefined && parentPrincipal !== undefined) {
             childSpec.principal = parentPrincipal;
         }

package/dist/orchestration/workflow-types.d.ts

@@ -1,7 +1,9 @@
 import type { TaskResult, TaskStatus, ToolActivity } from "../core/types.js";
 export type WorkflowRunStatus = "running" | "completed" | "failed";
-/** Status of one phase / agent-run within a workflow. */
-export type WorkflowItemStatus = "running" | "completed" | "failed";
+/** Status of one phase / agent-run within a workflow. `"parked"` (#642) is an AGENT row's word only — the
+ *  agent durably paused at an approval gate and the run suspended on it (the row carries the token, see
+ *  {@link WorkflowAgentRun.parkedCheckpointToken}); a phase or group never parks (a parked agent ends the run). */
+export type WorkflowItemStatus = "running" | "completed" | "failed" | "parked";
 export interface WorkflowPhase {
     title: string;
     /** F7/B7 (CC pretty.js:446478): a phase PRE-REGISTERED from `meta.phases` starts as `"pending"` — the plan
@@ -119,6 +121,16 @@ export interface WorkflowAgentRun {
      *  (`fork(sessionId)→runTask`, or `runTask({sessionId})`) instead of a fresh re-run. An opaque id (not
      *  content) → scope-gated via `getWorkflowRun`, no redaction needed. Absent for a stub run that minted none. */
     sessionId?: string;
+    /**
+     * #642 — the durable-approval checkpoint token this agent is PARKED on (`status: "parked"` only): the child
+     * durably paused at an approval gate under the host's forwarded `durableApproval`, the run recorded the
+     * park here and suspended. The mirror of the background agent row's `parkedCheckpointToken`, and the
+     * workflow-origin JOIN a host routes a parked approval by: a checkpoint whose `sourceTaskId` equals this
+     * row's {@link sessionId} is a workflow child's park, and this token is the same row's redemption key —
+     * the checkpoint row itself carries no workflow key. It is the resume CAPABILITY (never log it or put it
+     * in a URL); a durable row is its home exactly as on the background lane. Absent on every other status.
+     */
+    parkedCheckpointToken?: string;
     /**
      * #499 — the ENGINE-minted identity of the task run behind this record (= its `TaskResult.runId`).
      *
@@ -515,6 +527,29 @@ export declare class WorkflowAgentBlockedError extends Error {
     /** Human-readable cause, already bounded + redacted by the engine (classifier text is model output). */
     reason: string);
 }
+/** #642 — the machine code of a run that SUSPENDED on a parked agent (the thrown error's `code`, the run's
+ *  failed terminal). Not a script fault and not a host fault: an approval a person still has to decide. */
+export declare const WORKFLOW_AGENT_PARKED_ERROR_CODE = "workflow.agent_parked";
+/**
+ * #642 — thrown by `ctx.agent` / `ctx.agentStream().result()` when the child durably PAUSED at an approval gate
+ * under the host's forwarded `durableApproval` (the workflow lane's park family, the background delegation's
+ * twin): the wa* row records `status:"parked"` + `parkedCheckpointToken`, the journal records the parked leg at
+ * its ordinal, and the RUN SUSPENDS — every later spawn is refused with this same error and the run's terminal
+ * is this park whatever the script body returns (the team-discussion `teamPause` shape). Nothing after the
+ * parked call runs; the script must not retry it (an identical call parks again). A resume of the run
+ * (`resumeFromRunId`) with the host's decision for the token drives the parked child on and the script
+ * continues from here; without a decision the ordinal re-parks.
+ *
+ * Carries the non-secret `checkpointId` (display/correlation) and the gate kind — never the token (the resume
+ * capability lives on the wa* row, a durable row, exactly as on the background lane).
+ */
+export declare class WorkflowAgentParkedError extends Error {
+    readonly label: string;
+    readonly gateKind: string;
+    readonly checkpointId?: string | undefined;
+    readonly code = "workflow.agent_parked";
+    constructor(label: string, gateKind: string, checkpointId?: string | undefined);
+}
 /** design/98 §D.6 hard cap: thrown by `ctx.agent` once the workflow has spawned `max` agents (a runaway
  *  LLM-authored script is bounded, not trusted — this counts cumulative spawns, so it binds even when the
  *  token budget has room left, or when no budget was set at all). */

package/dist/orchestration/workflow-types.js

@@ -55,6 +55,22 @@ export class WorkflowAgentBlockedError extends Error {
         this.name = "WorkflowAgentBlockedError";
     }
 }
+export const WORKFLOW_AGENT_PARKED_ERROR_CODE = "workflow.agent_parked";
+export class WorkflowAgentParkedError extends Error {
+    label;
+    gateKind;
+    checkpointId;
+    code = WORKFLOW_AGENT_PARKED_ERROR_CODE;
+    constructor(label, gateKind, checkpointId) {
+        super(`workflow agent "${label}" is parked at an approval gate (${gateKind}${checkpointId !== undefined ? `, checkpoint ${checkpointId}` : ""}) — ` +
+            "the workflow is suspended until the approval is decided; nothing after this call runs. Do not re-issue the call: " +
+            "a resume of this run carrying the decision continues from here.");
+        this.label = label;
+        this.gateKind = gateKind;
+        this.checkpointId = checkpointId;
+        this.name = "WorkflowAgentParkedError";
+    }
+}
 export class WorkflowMaxAgentsError extends Error {
     max;
     budgetTotal;

package/dist/orchestration/workflow.d.ts

@@ -1,6 +1,7 @@
 import type { TSchema } from "typebox";
-import type { RunnerSelfSeat } from "../core/runner/contracts.js";
-import type { AgentDefinition, TaskEvent, TaskResult, TaskSpec } from "../core/types.js";
+import type { InheritedGate, RunnerSelfSeat } from "../core/runner/contracts.js";
+import type { CheckpointToken, ResumeOutcome } from "../core/checkpoint-store.js";
+import type { AgentDefinition, TaskEvent, TaskResult, TaskSpec, ThinkingLevel } from "../core/types.js";
 import type { WorkflowRunStore } from "../core/workflow-run-store.js";
 import type { WorkflowJournalStore, ResumeClaimArgs } from "../core/workflow-journal-store.js";
 import type { WorkflowRun, WorkflowEvent } from "./workflow-types.js";
@@ -21,9 +22,11 @@ export declare const WORKFLOW_SUBAGENT_APPEND_SCHEMA = "---\n\nNOTE: You are run
  * Apply the G5 default persona to a `ctx.agent`/`ctx.agentStream` child spec. Two-state on the EFFECTIVE
  * schema (`agentOpts.schema` wins over a spec-carried `outputSchema`, same as the runSpec injection):
  *   • no `spec.systemPrompt` → the dedicated workflow-subagent persona REPLACES the role base (198
- *     default `workflow-subagent` agent-type semantics);
- *   • a script-supplied `spec.systemPrompt` (custom persona) → the matching NOTE is APPENDED via
- *     `appendSystemPrompt` (198 composite semantics — append, never replace), after any existing append.
+ *     default `workflow-subagent` agent-type semantics) — reached only when neither the script, the
+ *     agentType definition nor the deployment's stated subagent preset supplied one ({@link withWorkflowChildSeats}
+ *     writes the preset first);
+ *   • a `spec.systemPrompt` (custom persona: script, definition or stated preset) → the matching NOTE is
+ *     APPENDED via `appendSystemPrompt` (198 composite semantics — append, never replace), after any existing append.
  * Called AFTER the call-key is computed (the journal identity keys the AUTHORED spec, so a resume across
  * core versions replays cleanly; the persona is an execution detail, not call identity).
  */
@@ -120,7 +123,9 @@ export declare class WorkflowJournalIncompatibleError extends Error {
     readonly fromRunId: string;
     readonly ordinal: number;
     readonly code = "workflow.journal_incompatible";
-    constructor(fromRunId: string, ordinal: number);
+    constructor(fromRunId: string, ordinal: number, 
+    /** #642: an alternative reason clause (the parked-row cross-check); absent ⇒ the no-terminal-cause wording. */
+    reason?: string);
 }
 /**
  * A TRUSTED, run-scoped internal channel carrying the workflow **nesting depth** across a process boundary
@@ -282,6 +287,18 @@ export interface WorkflowRunContext {
     /** Emit a narrator log line (observability only — not stored on the run). */
     log(message: string): void;
 }
+/**
+ * #642 — one decision a resume carries for a PARKED ordinal of the prior run ({@link RunWorkflowOptions.parkedResume}):
+ * the checkpoint token the wa* row is parked on (the row's `parkedCheckpointToken`, the redemption key), the
+ * caller's decision for it (the same {@link ResumeOutcome} a top-level `runner.resume` takes), and the optional
+ * cross-process re-supply of the checkpoint's opaque parent constraints. The token is matched by string equality
+ * against the journaled parked entry — an entry whose token no decision names re-parks.
+ */
+export interface WorkflowParkedResume {
+    token: CheckpointToken;
+    outcome: ResumeOutcome;
+    inheritedGate?: InheritedGate;
+}
 export interface RunWorkflowOptions {
     /** Trusted caller-supplied run id. Used by the unified task registry so tool-launched workflows expose
      *  `task_id === runId` (`w*`) without making the model choose an id. Omit for the legacy UUID mint path. */
@@ -431,10 +448,40 @@ export interface RunWorkflowOptions {
      *  re-resolution that loses per-model routing (the 4/4-agents-404 incident: session model id
      *  re-resolved against the base gateway). Mirrors the subagent lane's `ctx.model` semantics. */
     defaultModel?: () => import("../internal/llm.js").Model | undefined;
+    /** Call-time getter for the thinking level a spawned agent runs at when neither the script, the
+     *  agentType definition nor the governance baseline set `thinking` — the child thinking seat's lower rungs
+     *  (the deployment's STATED `roles.subagent.thinking`, else the host's current level), as the run-workflow
+     *  mount folds them. Snapshotted ONCE at call entry and folded into the call identity like `defaultModel`;
+     *  applied at the launch site AFTER the agentType fold ({@link withWorkflowChildSeats}). */
+    defaultThinking?: () => ThinkingLevel | undefined;
     /** The HOST's per-model auth hook, inherited into every spawned agent's spec (the
      *  credential half of model inheritance; scripts can never set it — governance strips it — so
      *  this is always the host's). NOT call identity (auth, not behavior; a function, not data). */
     defaultGetApiKeyAndHeaders?: TaskSpec["getApiKeyAndHeaders"];
+    /**
+     * #642 — the HOST run's `durableApproval` opt-in (value copy), inherited into every spawned agent whose
+     * fold left the seat unpinned (a deployment baseline that pins `durableApproval` wins; scripts can never set
+     * it — governance strips it). With it a workflow child's plain policy `ask` — an ask the host's approver
+     * answers `unavailable` for, or a durable mandate — PARKS durably instead of denying fail-closed, exactly as
+     * a background delegation child's does under the §7.3 park family: the wa* row records `status:"parked"` +
+     * the token, the run SUSPENDS (the script cannot continue past a parked call), and a resume drives the
+     * parked child on with the caller's decision ({@link parkedResume}). Tighten-only: a park capability,
+     * never a widening — the decision stays with a person. REQUIRES {@link store} (the wa* row's durable home;
+     * refused loudly at entry without it). Threaded by the Workflow tool from the host's trusted seat; a
+     * directly-started workflow passes its own. NOT call identity.
+     */
+    defaultDurableApproval?: TaskSpec["durableApproval"];
+    /**
+     * #642 — the decisions a resume ({@link resumeFromRunId}) carries for PARKED ordinals of the prior run: at
+     * an ordinal whose journal entry is `parked` (a matching call key), the run drives the parked child's own
+     * resume — `runner.resumeStream(token, outcome, …)` on the pinned session, the child's spec rebuilt from
+     * the script call exactly as at spawn — and settles its result at that ordinal, so the script continues past
+     * the call it parked on. A parked ordinal with NO decision here re-parks (the row and the journal say the
+     * same thing again, the run suspends again); it is never run live. `inheritedGate` is the cross-process
+     * re-supply of the checkpoint's opaque parent constraints (the same seat the background lane's drive
+     * takes). TRUSTED: a host-supplied decision, never a script/model argument; requires `resumeFromRunId`.
+     */
+    parkedResume?: ReadonlyArray<WorkflowParkedResume>;
     /** design/148 S1 — the HOST run's adopted center artifact (trusted, threaded by the Workflow tool
      *  from ctx): every spawned agent composes the same closure. */
     parentCenterArtifactDigest?: string;