@sema-agent/server 7.131.0 → 7.133.0

package/dist/http/routes/sessions.js

@@ -1,6 +1,6 @@
 import { SessionError, materializeA2aTools, materializeMcpTools, sanitizePathComponent } from "@sema-agent/core";
 import { a2aForScenario, mcpForScenario } from "../../web-admin-client/facade.js";
-import { HttpError, isUuidShape, legacyUnownedSessionOk } from "../../security.js";
+import { HttpError, isUuidShape, legacyUnownedSessionOk, sessionOwnerCellOf } from "../../security.js";
 import { windowMessages, truncateMessageBlobs, redactSessionViewForRead } from "../../audit.js";
 import { redactSecrets } from "../../trace/redact.js";
 import { recordFailOpen } from "../../observability/fail-open.js";
@@ -9,18 +9,19 @@ import { sentMemoryComplianceFailure } from "../memory-compliance-failure-reply.
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS } from "../../task-settings.js";
 import { readWritableSessionPermissionRules } from "../../session-policy-wire.js";
 import { sendJson, sendError, sendSessionError, sendSessionPolicyError, sseHeaders, httpErrorBody } from "../send.js";
-import { gatedPrincipal, explicitOperatorOk, sessionOwnerReadable, sendPrincipalRefusal, sendUnauthorized } from "../principal-gate.js";
+import { gatedPrincipal, explicitOperatorOk, sessionCallerOf, sessionOwnerReadable, sendPrincipalRefusal, sendUnauthorized } from "../principal-gate.js";
+import { runRowReadableOnSessionFace } from "../owner-access.js";
 import { assertNever, SESSION_NOT_FOUND_MESSAGE } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
 import { rosterAgentId } from "./agents-roster.js";
 import { projectSessionListRow } from "./sessions-list.js";
 import { readSessionRowPatch } from "../../session-row.js";
+import { buildBoundedToolNames } from "../../panel-tool-names.js";
 const MCP_STATUS_TTL_MS = 5_000;
 const A2A_STATUS_TTL_MS = 5_000;
 const A2A_MATERIALIZE_TIMEOUT_MS = 10_000;
 const MEMORY_STATUS_TTL_MS = 5_000;
 const LAST_LEG_LEDGER_TIMEOUT_MS = 2_000;
-const A2A_PANEL_MAX_TOOL_NAMES = 200;
 export function createSessionsLocal() {
     return {
         sseConnections: 0,
@@ -30,11 +31,11 @@ export function createSessionsLocal() {
         memoryStatusCache: new Map(),
     };
 }
-async function lastLegMcpFor(deps, sessionId, principal) {
+async function lastLegMcpFor(deps, sessionId, caller) {
     let timer;
     try {
         return await Promise.race([
-            readLastLegMcp(deps, sessionId, principal),
+            readLastLegMcp(deps, sessionId, caller),
             new Promise((r) => { timer = setTimeout(() => { recordFailOpen("server.mcp-panel.last-leg-unreadable", `ledger read exceeded ${LAST_LEG_LEDGER_TIMEOUT_MS}ms`); r(undefined); }, LAST_LEG_LEDGER_TIMEOUT_MS); }),
         ]);
     }
@@ -47,14 +48,14 @@ async function lastLegMcpFor(deps, sessionId, principal) {
             clearTimeout(timer);
     }
 }
-async function readLastLegMcp(deps, sessionId, principal) {
+async function readLastLegMcp(deps, sessionId, caller) {
     const runStore = deps.runStore;
     if (!runStore || sessionId === null)
         return undefined;
     const latest = await runStore.latestRunForSession(sessionId);
     if (latest === undefined)
         return undefined;
-    if (!sessionOwnerReadable(principal, latest.owner, deps.config) && !explicitOperatorOk(principal, deps.config.operatorPrincipals))
+    if (!runRowReadableOnSessionFace(deps, caller, latest.owner, "owner_or_operator"))
         return undefined;
     const events = await runStore.getEvents(latest.taskId, 0);
     for (let i = events.length - 1; i >= 0; i--) {
@@ -79,7 +80,7 @@ export async function handleSessions(req, res, match, ctx) {
                 sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
                 return undefined;
             }
-            if (!sessionOwnerOk(req, res, owner))
+            if (!sessionOwnerOk(req, res, await sessionOwnerCellOf(deps.sessionStorage, sessionId, owner)))
                 return undefined;
         }
         let audit;
@@ -95,7 +96,7 @@ export async function handleSessions(req, res, match, ctx) {
             sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
             return undefined;
         }
-        if (!sessionOwnerOk(req, res, audit.owner))
+        if (!sessionOwnerOk(req, res, await sessionOwnerCellOf(deps.sessionStorage, sessionId, audit.owner)))
             return undefined;
         return audit;
     };
@@ -138,12 +139,13 @@ export async function handleSessions(req, res, match, ctx) {
     }
     {
         if (match.decl.id === "session-mcp") {
-            const principal = gatedPrincipal(req, deps.config);
+            const caller = sessionCallerOf(req, deps);
+            const principal = caller.principal;
             if (deps.config.requirePrincipal && !principal) {
                 sendPrincipalRefusal(res, req, deps.config);
                 return;
             }
-            const lastLegMcp = await lastLegMcpFor(deps, safeDecode(match.params.sessionId), principal);
+            const lastLegMcp = await lastLegMcpFor(deps, safeDecode(match.params.sessionId), caller);
             const ledgerHalf = lastLegMcp === undefined ? {} : { lastLegMcp };
             let scenarioName;
             try {
@@ -233,13 +235,7 @@ export async function handleSessions(req, res, match, ctx) {
                                 ...(s.agentName ? { agentName: s.agentName } : {}),
                                 ...(s.agentDescription ? { agentDescription: s.agentDescription } : {}),
                                 ...(s.endpoint ? { endpoint: redactSecrets(String(s.endpoint)).slice(0, 2048) } : {}),
-                                ...(s.toolNames
-                                    ? {
-                                        toolCount: s.toolNames.length,
-                                        toolNames: s.toolNames.slice(0, A2A_PANEL_MAX_TOOL_NAMES),
-                                        ...(s.toolNames.length > A2A_PANEL_MAX_TOOL_NAMES ? { toolNamesTruncated: true } : {}),
-                                    }
-                                    : {}),
+                                ...(s.toolNames ? { toolCount: s.toolNames.length, ...buildBoundedToolNames(s.toolNames) } : {}),
                                 ...(s.error ? { error: redactSecrets(String(s.error)).slice(0, 200) } : {}),
                             })),
                         };
@@ -277,7 +273,7 @@ export async function handleSessions(req, res, match, ctx) {
                     return;
                 }
                 owner = head.owner;
-                if (!sessionOwnerOk(req, res, owner ?? null))
+                if (!sessionOwnerOk(req, res, await sessionOwnerCellOf(deps.sessionStorage, headSession, owner ?? null)))
                     return;
                 leafId = head.leafId;
             }
@@ -287,7 +283,7 @@ export async function handleSessions(req, res, match, ctx) {
                     sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
                     return;
                 }
-                if (!sessionOwnerOk(req, res, owner ?? null))
+                if (!sessionOwnerOk(req, res, await sessionOwnerCellOf(deps.sessionStorage, headSession, owner ?? null)))
                     return;
                 leafId = await getLeafId(headSession);
             }
@@ -344,13 +340,13 @@ export async function handleSessions(req, res, match, ctx) {
                     return;
                 }
                 sse.sseOwnerLookups++;
-                const ownerP = ownerOf(evSession);
-                void ownerP.catch(() => undefined).then(() => { sse.sseOwnerLookups--; });
+                const cellP = ownerOf(evSession).then((o) => (o === undefined ? undefined : sessionOwnerCellOf(evFact.sessionStorage, evSession, o)));
+                void cellP.catch(() => undefined).then(() => { sse.sseOwnerLookups--; });
                 let stallTimer;
-                let owner;
+                let cell;
                 try {
-                    owner = await Promise.race([
-                        ownerP,
+                    cell = await Promise.race([
+                        cellP,
                         new Promise((r) => { stallTimer = setTimeout(() => r("__stall__"), stallBound); stallTimer.unref?.(); }),
                     ]);
                 }
@@ -360,21 +356,22 @@ export async function handleSessions(req, res, match, ctx) {
                 }
                 if (closed)
                     return;
-                if (owner === "__stall__") {
+                if (cell === "__stall__") {
                     cleanup();
                     res.setHeader("retry-after", "5");
                     sendError(res, 503, "state.sse_owner_lookup_stalled", "session-events owner lookup stalled — retry");
                     return;
                 }
-                if (owner === undefined) {
+                if (cell === undefined) {
                     cleanup();
                     sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
                     return;
                 }
-                if (!sessionOwnerOk(req, res, owner ?? null)) {
+                if (!sessionOwnerOk(req, res, cell)) {
                     cleanup();
                     return;
                 }
+                const owner = cell.owner;
                 const q = new URLSearchParams(match.search);
                 const lastLeafId = q.get("lastLeafId");
                 let first = true;
@@ -678,7 +675,7 @@ export async function handleSessions(req, res, match, ctx) {
             sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
             return;
         }
-        if (!sessionOwnerOk(req, res, face.owner))
+        if (!sessionOwnerOk(req, res, await sessionOwnerCellOf(store, sessionId, face.owner)))
             return;
         const read = readSessionRowPatch(await readJson(req));
         if ("problem" in read) {
@@ -717,7 +714,7 @@ export async function handleSessions(req, res, match, ctx) {
                 sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
                 return;
             }
-            if (!scope.fleetWide && owner !== scope.gateOwner && !legacyUnownedSessionOk(deps.config.requirePrincipal, scope.gateOwner, owner)) {
+            if (!scope.fleetWide && owner !== scope.gateOwner && !legacyUnownedSessionOk(deps.config.requirePrincipal, sessionCallerOf(req, deps), await sessionOwnerCellOf(forkFact.sessionStorage, sourceId, owner))) {
                 sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
                 return;
             }
@@ -755,7 +752,7 @@ export async function handleSessions(req, res, match, ctx) {
                 sendJson(res, 200, { deleted: false });
                 return;
             }
-            if (!scope.fleetWide && owner !== scope.gateOwner && !legacyUnownedSessionOk(deps.config.requirePrincipal, scope.gateOwner, owner)) {
+            if (!scope.fleetWide && owner !== scope.gateOwner && !legacyUnownedSessionOk(deps.config.requirePrincipal, sessionCallerOf(req, deps), await sessionOwnerCellOf(deleteFact.sessionStorage, sessionId, owner))) {
                 sendJson(res, 200, { deleted: false });
                 return;
             }
@@ -805,7 +802,7 @@ export async function handleSessions(req, res, match, ctx) {
                 sendError(res, 409, "conflict.session_ownerless", "this session has no recorded owner, so its rules can be neither read nor changed through this route; rules already stored for it keep applying to the runs of the principal they were stored under. Ways out: on the local backend, during the upgrade window, the first task submitted with a principal on a session written by an earlier version claims it for that principal (this route then serves its owner); or delete the session (DELETE /v1/sessions/:id), which removes its rules with it");
                 return;
             }
-            const operator = explicitOperatorOk(principal, deps.config.operatorPrincipals);
+            const operator = explicitOperatorOk(principal, deps.config);
             if (!operator && owner !== (principal ?? null)) {
                 sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
                 return;
@@ -822,14 +819,7 @@ export async function handleSessions(req, res, match, ctx) {
                 }
                 return;
             }
-            let body;
-            try {
-                body = (await readJson(req));
-            }
-            catch {
-                sendError(res, 400, "request.invalid_json", "invalid JSON body");
-                return;
-            }
+            const body = (await readJson(req));
             const read = readWritableSessionPermissionRules(body.rules);
             if (read.refusal !== undefined) {
                 sendSessionPolicyError(res, read.refusal);

package/dist/http/routes/shared-memory.js

@@ -1,21 +1,10 @@
-import { SHARED_MEMORY_READ_CAP_BYTES, SharedMemoryStoreError } from "@sema-agent/core";
+import { isSharedMemoryDocumentPath, SHARED_MEMORY_READ_CAP_BYTES, SharedMemoryStoreError } from "@sema-agent/core";
 import { sendJson, sendError } from "../send.js";
 import { gatedPrincipal, sendUnauthorized } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
 const RETRY_AFTER_SEC = 10;
 const HTTP_LIST_LIMIT = 100;
-const FORBIDDEN_PATH_CHARS = /[\p{Cc}\p{Cf}\p{Co}\p{Cn}\p{Default_Ignorable_Code_Point}\u2028\u2029\\]/u;
-const DOCUMENT_SUFFIXES = [".md", ".txt", ".json", ".jsonl"];
-function isDocumentPath(path) {
-    if (!path.startsWith("/") || FORBIDDEN_PATH_CHARS.test(path))
-        return false;
-    const segments = path.slice(1).split("/");
-    const last = segments.at(-1);
-    if (last === undefined || !segments.every((s) => s !== "" && !s.startsWith(".")))
-        return false;
-    return DOCUMENT_SUFFIXES.some((s) => last.endsWith(s));
-}
 function refuseStore(res) {
     sendError(res, 404, "not_found.shared_memory_store", "not found");
 }
@@ -120,7 +109,7 @@ export async function handleSharedMemory(req, res, match, ctx) {
                 return;
             }
             const path = query.get("path");
-            if (path === null || path === "" || !isDocumentPath(path)) {
+            if (path === null || path === "" || !isSharedMemoryDocumentPath(path)) {
                 sendError(res, 400, "request.query_invalid", "missing or malformed ?path= (absolute, .md/.txt/.json/.jsonl)");
                 return;
             }

package/dist/http/routes/side-query.js

@@ -1,10 +1,11 @@
 import { MODEL_ROLES, expandTiers, isThinkingLevel } from "@sema-agent/core";
 import { HttpError } from "../../security.js";
+import { echoCallerText } from "../../caller-text-echo.js";
 import { isAtMentionable, matchCatalogModel, refusedCatalogEntry, selectableCatalog } from "../../model-select.js";
-import { modelUnavailableMessage } from "../../model-entry-refusal.js";
+import { echoModelRef, modelUnavailableMessage } from "../../model-entry-refusal.js";
 import { redactSecrets } from "../../trace/redact.js";
 import { admitProviderEcho, redactErrorMessage } from "../../observability/run-terminal.js";
-import { sendJson, sendError, httpErrorCode, msg } from "../send.js";
+import { sendJson, sendError, sendHttpError, msg } from "../send.js";
 import { gatedPrincipal, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
 const CORE_PREFLIGHT_VALIDATION_PREFIXES = ["Unknown model ref ", "No model for role "];
@@ -12,6 +13,7 @@ export function isCorePreflightValidationError(message) {
     return CORE_PREFLIGHT_VALIDATION_PREFIXES.some((prefix) => message.startsWith(prefix));
 }
 export const CORE_PREFLIGHT_VALIDATION_ANCHORS = CORE_PREFLIGHT_VALIDATION_PREFIXES;
+const MODEL_ROLE_ECHO_CHARS = 80;
 function isModelRole(value) {
     return typeof value === "string" && MODEL_ROLES.includes(value);
 }
@@ -50,8 +52,7 @@ export async function handleSideQuery(req, res, match, ctx) {
                     body = raw;
                 }
                 catch (e) {
-                    const he = e instanceof HttpError ? e : new HttpError(400, msg(e));
-                    sendError(res, he.status, httpErrorCode(he.status, he.code), he.message);
+                    sendHttpError(res, e instanceof HttpError ? e : new HttpError(400, msg(e)));
                     return;
                 }
                 if (!Array.isArray(body.messages) || body.messages.length === 0) {
@@ -63,7 +64,7 @@ export async function handleSideQuery(req, res, match, ctx) {
                     return;
                 }
                 if (body.modelRole !== undefined && !isModelRole(body.modelRole)) {
-                    const shown = (typeof body.modelRole === "string" ? JSON.stringify(body.modelRole.slice(0, 80)) : `of type ${body.modelRole === null ? "null" : Array.isArray(body.modelRole) ? "array" : typeof body.modelRole}`);
+                    const shown = (typeof body.modelRole === "string" ? JSON.stringify(echoCallerText(body.modelRole, { maxChars: MODEL_ROLE_ECHO_CHARS })) : `of type ${body.modelRole === null ? "null" : Array.isArray(body.modelRole) ? "array" : typeof body.modelRole}`);
                     sendError(res, 400, "request.field_invalid", `invalid modelRole ${shown} — must be a string, one of ${MODEL_ROLES.join(" / ")} (the engine's role vocabulary); a value outside it is refused before any model call`);
                     return;
                 }
@@ -71,12 +72,12 @@ export async function handleSideQuery(req, res, match, ctx) {
                     const catalog = selectableCatalog(deps.config.models ?? {}, deps.config.tiers, deps.config.modelRefusals);
                     const unavailable = matchCatalogModel(body.model, catalog, deps.config.modelRefusals) === undefined ? refusedCatalogEntry(body.model, deps.config.modelRefusals) : undefined;
                     if (unavailable !== undefined) {
-                        const message = modelUnavailableMessage("model", body.model.slice(0, 120), unavailable.name, unavailable.refusal);
+                        const message = modelUnavailableMessage("model", body.model, unavailable.name, unavailable.refusal);
                         sendError(res, 400, "request.model_unavailable", message);
                         return;
                     }
                     if (!isAtMentionable(body.model, catalog, deps.config.atMention, deps.config.modelRefusals)) {
-                        sendError(res, 400, "request.model_not_allowed", `model is not @-mentionable on this deployment: "${body.model.slice(0, 120)}" — which models can be @-mentioned is configured by the operator (models.atMention)`);
+                        sendError(res, 400, "request.model_not_allowed", `model is not @-mentionable on this deployment: "${echoModelRef(body.model)}" — which models can be @-mentioned is configured by the operator (models.atMention)`);
                         return;
                     }
                 }

package/dist/http/routes/tasks.js

@@ -1,6 +1,6 @@
 import { redactErrorMessage, redactHead, redactTerminalResult } from "../../observability/run-terminal.js";
 import { runWithVerification, runCascade, taskNotificationDedupKey, uuidv7 } from "@sema-agent/core";
-import { graftParkToolCallId, markChildrenStoppedByUserOnAbort, syncRefusalHttpStatus, releaseKeyIfZeroWorkRefusal, createPromptCommitReader, HEARTBEAT_MS } from "../../runs.js";
+import { graftParkToolCallId, markChildrenStoppedByUserOnAbort, syncRefusalHttpStatus, zeroWorkRefusalFacts, releaseKeyIfZeroWorkRefusal, createPromptCommitReader, HEARTBEAT_MS } from "../../runs.js";
 import { sealResultForExit, outwardPlane } from "../../terminal.js";
 import { withPrincipal } from "../../observability/principal-context.js";
 import { fleetRunPublisher, fleetRunLabels, fleetRunResiduals, isFleetAgentTerminalNotification } from "../../fleet/fleet-bus.js";
@@ -14,11 +14,11 @@ import { buildCancelledLedgerRow, createRunAbort, mintCancelledResult } from "..
 import { recordResourceWindow } from "../../resource-window.js";
 import { redactSecrets } from "../../trace/redact.js";
 import { liveToolEndForBacklog } from "../../trace/tool-output-media.js";
-import { contextUsageEventData, turnEndEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskStartedEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, workspaceChangedEventData, wiringManifestFaceEventData, toolRosterDeltaEventData, toolProgressEventData, toolDisclosureEventData, humanInputEventData, appendModelUsageDelta, attachModelUsage, textEndEventData, liveIdentityFields } from "../../trace/project.js";
+import { contextUsageEventData, turnEndEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskStartedEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, compactionStartedEventData, workspaceChangedEventData, wiringManifestFaceEventData, toolRosterDeltaEventData, toolProgressEventData, toolDisclosureEventData, humanInputEventData, appendModelUsageDelta, attachModelUsage, textEndEventData, liveIdentityFields } from "../../trace/project.js";
 import { cascadeConfig, runMeta } from "../run-meta.js";
 import { idemCallerOf, inflightKeyOf, submissionIdemOf } from "../idempotency.js";
 import { replayOfExistingRun } from "../submit-replay.js";
-import { sendJson, sendError, sseHeaders } from "../send.js";
+import { httpErrorCode, sendJson, sendError, sseHeaders } from "../send.js";
 import { collectSsePreamble } from "../sse-log.js";
 import { buildApprovalPreamble, buildApprovalPreambleSseFrames } from "../../approval-card.js";
 import { createApprovalCardEmitter, resolveApprovalLeg, resolveStreamApprovalGate } from "../../tool-approval.js";
@@ -30,10 +30,13 @@ import { failOpenTagForDroppedFrame, recordFailOpen } from "../../observability/
 import { buildSyncSubmitBody } from "../sync-submit-body.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
-import { buildCheckpointCtx } from "../checkpoint-ctx.js";
+import { persistSubmitCtx } from "../submit-ctx.js";
 import { serviceVersion } from "../../service-version.js";
 import { withModelReachScope } from "../../model-reach-scope.js";
 import { createInstructionSelectionLeg } from "../../instruction-selection.js";
+import { fieldConflictFacts } from "../../field-conflict.js";
+import { refusalBody } from "../refusal-body.js";
+import { heldWorkflowParkDecisions } from "../../parked-decide.js";
 const DISCONNECT_PARK_GRACE_MS = 10_000;
 function sseData(res, payload) {
     const anchor = payload.eventId;
@@ -60,8 +63,8 @@ function sendSubmitResult(res, resp) {
         : raw;
     sendJson(res, 200, body);
 }
-function writeMetaFrame(res, taskId, sessionId) {
-    res.write(`event: meta\ndata: ${JSON.stringify({ type: "meta", taskId, ...(sessionId ? { sessionId } : {}) })}\n\n`);
+function writeMetaFrame(res, taskId, sessionId, warnings) {
+    res.write(`event: meta\ndata: ${JSON.stringify({ type: "meta", taskId, ...(sessionId ? { sessionId } : {}), ...(warnings !== undefined ? { warnings } : {}) })}\n\n`);
 }
 function refusalDoneResult(body) {
     if (isActiveRunConflictBody(body))
@@ -148,13 +151,13 @@ export async function handleTasks(req, res, match, ctx) {
         if (!prepared)
             return;
         const principal = prepared.auth?.principal;
-        const wiringOperatorFace = explicitOperatorOk(gatedPrincipal(req, deps.config), deps.config.operatorPrincipals);
+        const wiringOperatorFace = explicitOperatorOk(gatedPrincipal(req, deps.config), deps.config);
         let wiringReceipt;
         const instructionLeg = createInstructionSelectionLeg();
         const withRunReceipt = (out) => wiringReceipt !== undefined ? { ...out, wiringManifest: wiringReceipt } : out;
         if (liveStream) {
             if (prepared.verify || prepared.cascade) {
-                sendError(res, 400, "request.field_conflict", "verify / cascade are not supported on /v1/tasks/stream (both are multi-attempt, not a single stream) — use /v1/tasks or /v1/runs");
+                sendError(res, 400, "request.field_conflict", "verify / cascade are not supported on /v1/tasks/stream (both are multi-attempt, not a single stream) — use /v1/tasks or /v1/runs", fieldConflictFacts("cascade_verify", prepared.verify ? (prepared.cascade ? ["verify", "cascade"] : ["verify"]) : ["cascade"]));
                 return;
             }
             const earlyDurableTid = facts.durableRuns(deps).available && prepared.spec.sessionId ? uuidv7() : undefined;
@@ -169,7 +172,7 @@ export async function handleTasks(req, res, match, ctx) {
             reqState.streamDetached = detachOnDisconnect;
             sseHeaders(res, earlyDurableTid ? { "x-task-id": earlyDurableTid } : undefined);
             if (earlyDurableTid)
-                writeMetaFrame(res, earlyDurableTid, prepared.spec.sessionId);
+                writeMetaFrame(res, earlyDurableTid, prepared.spec.sessionId, prepared.warnings);
             const ac = createRunAbort();
             let closed = false;
             let detachLogged = false;
@@ -215,14 +218,26 @@ export async function handleTasks(req, res, match, ctx) {
                 parkFacility: deps.checkpointStore !== undefined,
             });
             const replaySessionId = replayGate.active ? prepared.spec.sessionId : undefined;
+            const presentedOnConnection = new Set();
+            const presentedCompleted = new Set();
+            const admitPresentedComplete = (askId) => {
+                if (!presentedOnConnection.has(askId))
+                    return true;
+                if (presentedCompleted.has(askId))
+                    return false;
+                presentedCompleted.add(askId);
+                return true;
+            };
             if (replaySessionId) {
                 const replayOwner = gatedPrincipal(req, deps.config) ?? null;
                 const askStore = replayGate.active ? replayGate.askStore : undefined;
+                let presentedAskIds = [];
                 const preambleFrames = await collectSsePreamble(async (signal) => {
                     if (!askStore)
                         return [];
                     const rows = await askStore.listPendingBySession(replaySessionId, replayOwner, signal);
                     const { frames, skipped, dropped } = buildApprovalPreamble(rows, Date.now(), deps.config.streamApproval.replayMax);
+                    presentedAskIds = frames.map((f) => f.askId);
                     if (skipped > 0)
                         deps.logger?.warn?.("approval_preamble_row_skipped", { sessionId: replaySessionId, skipped, face: "tasks.stream" });
                     if (dropped > 0)
@@ -232,6 +247,16 @@ export async function handleTasks(req, res, match, ctx) {
                 if (!res.writableEnded && !res.destroyed) {
                     for (const f of preambleFrames)
                         res.write(`event: ${f.event}\ndata: ${JSON.stringify(f.data)}\n\n`);
+                    if (deps.toolApproval && preambleFrames.length > 0) {
+                        for (const askId of presentedAskIds)
+                            presentedOnConnection.add(askId);
+                        const unwatch = deps.toolApproval.watchPresentedCards(presentedAskIds, (frame) => {
+                            if (res.writableEnded || res.destroyed || !admitPresentedComplete(frame.askId))
+                                return;
+                            res.write(`event: ${frame.type}\ndata: ${JSON.stringify(frame)}\n\n`);
+                        });
+                        res.once("close", unwatch);
+                    }
                 }
             }
             const hb = setInterval(() => {
@@ -286,14 +311,18 @@ export async function handleTasks(req, res, match, ctx) {
                     }
                     durableTaskId = tid;
                 }
+                if (deps.checkpointStore && prepared.spec.sessionId) {
+                    const ctxRefusal = await persistSubmitCtx(deps.checkpointStore, deps, durableTaskId !== undefined && deps.runStore ? { runStore: deps.runStore, taskId: durableTaskId } : undefined, prepared.spec.sessionId, { body: prepared.body, memoryScope: prepared.auth?.memoryScope, writerVersion: serviceVersion() });
+                    if (ctxRefusal) {
+                        sseData(res, { type: "done", result: doneResultOfOutcome(ctxRefusal) });
+                        return ctxRefusal;
+                    }
+                }
                 commitSessionInheritEnv(deps, prepared.spec.sessionId, prepared.body);
                 if (prepared.spec.sessionId)
                     markChildrenStoppedByUserOnAbort(ac.signal, durableTaskId ?? prepared.spec.sessionId, prepared.auth?.principal);
                 let ledgerSink;
                 let ledgerTerminal = false;
-                if (deps.checkpointStore && prepared.spec.sessionId) {
-                    await deps.checkpointStore.putCtx(prepared.spec.sessionId, buildCheckpointCtx({ body: prepared.body, memoryScope: prepared.auth?.memoryScope, writerVersion: serviceVersion() }));
-                }
                 if (durableTaskId && deps.runStore) {
                     const rs = deps.runStore;
                     const tid = durableTaskId;
@@ -374,7 +403,9 @@ export async function handleTasks(req, res, match, ctx) {
                             const tailContentMode = prepared.spec.forwardSubagentEvents === true ? "on" : "progress_only";
                             const childReasoning = createReasoningSegments();
                             const topReasoning = createReasoningSegments();
+                            const heldDecisions = prepared.spec.sessionId !== undefined ? await heldWorkflowParkDecisions(deps, prepared.spec.sessionId) : {};
                             const fwdInternals = {
+                                ...heldDecisions,
                                 onForwardEvent: (e) => {
                                     fleetPub?.onForwardEvent(e);
                                     ledgerSink?.onForwardEvent(e);
@@ -453,6 +484,7 @@ export async function handleTasks(req, res, match, ctx) {
                             liveStreamRef = liveStream;
                             if (durableTaskId)
                                 steerableRuns.set(durableTaskId, liveStream);
+                            prepared.acceptance.attachStream({ reachable: () => !closed && !res.writableEnded && !res.destroyed, write: (frame) => sseData(res, { ...frame }) });
                             for await (const ev of liveStream) {
                                 if (closed)
                                     break;
@@ -541,6 +573,9 @@ export async function handleTasks(req, res, match, ctx) {
                                 else if (ev.type === "compaction_outcome") {
                                     sseData(res, { type: "compaction_outcome", ...compactionOutcomeEventData(ev) });
                                 }
+                                else if (ev.type === "compaction_started") {
+                                    sseData(res, { type: "compaction_started", ...compactionStartedEventData(ev) });
+                                }
                                 else if (ev.type === "wiring_manifest") {
                                     const wiringFace = wiringManifestFaceEventData(ev, wiringOperatorFace, instructionLeg.segment());
                                     wiringReceipt ??= wiringFace;
@@ -652,6 +687,8 @@ export async function handleTasks(req, res, match, ctx) {
                         writeLive: (frame) => {
                             if (res.writableEnded || res.destroyed)
                                 throw new Error("live stream ended");
+                            if (frame.type === "approval_complete" && !admitPresentedComplete(frame.askId))
+                                return;
                             emitAsk(frame);
                         },
                     });
@@ -663,7 +700,6 @@ export async function handleTasks(req, res, match, ctx) {
                         ? {
                             taskId: askTaskId,
                             owner: askOwner,
-                            emit: emitApproval,
                             abortSignal: ac.signal,
                             ...(prepared.spec.sessionId ? { sessionId: prepared.spec.sessionId } : {}),
                             ...(streamApprovalOn
@@ -673,7 +709,7 @@ export async function handleTasks(req, res, match, ctx) {
                                     legKey: "",
                                     ...(legDeadlineMonotonic !== undefined ? { legDeadlineMonotonic } : {}),
                                 }
-                                : {}),
+                                : { emit: emitApproval }),
                         }
                         : undefined;
                     if (deps.toolApproval) {
@@ -836,7 +872,13 @@ export async function handleTasks(req, res, match, ctx) {
             res.end();
         }
         else {
-            const withSyncSubmitKeys = (body) => prepared.verify || prepared.cascade ? { ...body, notice: MULTI_ATTEMPT_NO_EVENT_CHANNEL_NOTICE } : body;
+            const withSyncSubmitKeys = (body) => {
+                const extra = {
+                    ...(prepared.verify || prepared.cascade ? { notice: MULTI_ATTEMPT_NO_EVENT_CHANNEL_NOTICE } : {}),
+                    ...(prepared.warnings !== undefined ? { warnings: prepared.warnings } : {}),
+                };
+                return Object.keys(extra).length > 0 ? { ...body, ...extra } : body;
+            };
             const runSyncSubmitLeg = async () => {
                 const syncLegStartedAt = Date.now();
                 let durableTaskId;
@@ -857,10 +899,12 @@ export async function handleTasks(req, res, match, ctx) {
                         return { status: placementReject.status, body: devicePlacementErrorBody(placementReject) };
                     durableTaskId = tid;
                 }
-                commitSessionInheritEnv(deps, prepared.spec.sessionId, prepared.body);
                 if (deps.checkpointStore && prepared.spec.sessionId) {
-                    await deps.checkpointStore.putCtx(prepared.spec.sessionId, buildCheckpointCtx({ body: prepared.body, memoryScope: prepared.auth?.memoryScope, writerVersion: serviceVersion() }));
+                    const ctxRefusal = await persistSubmitCtx(deps.checkpointStore, deps, durableTaskId !== undefined && deps.runStore ? { runStore: deps.runStore, taskId: durableTaskId } : undefined, prepared.spec.sessionId, { body: prepared.body, memoryScope: prepared.auth?.memoryScope, writerVersion: serviceVersion() });
+                    if (ctxRefusal)
+                        return ctxRefusal;
                 }
+                commitSessionInheritEnv(deps, prepared.spec.sessionId, prepared.body);
                 const syncCancelCtrl = createRunAbort();
                 if (prepared.spec.sessionId)
                     markChildrenStoppedByUserOnAbort(syncCancelCtrl.signal, durableTaskId ?? prepared.spec.sessionId, prepared.auth?.principal);
@@ -893,10 +937,11 @@ export async function handleTasks(req, res, match, ctx) {
                 let result;
                 counters.uncountedBillableInflight++;
                 try {
-                    const verifyLeg = (v) => runWithVerification(prepared.runner, specWithSignal, v);
-                    const cascadeLeg = () => runCascade(prepared.runner, specWithSignal, cascadeConfig(deps.config.cascadeLadder, prepared.spec.limits?.maxCostUsd));
+                    const heldDecisions = prepared.spec.sessionId !== undefined ? await heldWorkflowParkDecisions(deps, prepared.spec.sessionId) : {};
+                    const verifyLeg = (v) => runWithVerification(prepared.runner, specWithSignal, v, heldDecisions);
+                    const cascadeLeg = () => runCascade(prepared.runner, specWithSignal, cascadeConfig(deps.config.cascadeLadder, prepared.spec.limits?.maxCostUsd), heldDecisions);
                     const plainLeg = async () => {
-                        const stream = prepared.runner.runTaskStream(specWithSignal);
+                        const stream = prepared.runner.runTaskStream(specWithSignal, undefined, heldDecisions);
                         for await (const ev of stream) {
                             observeSyncLegEvent(ev);
                             prepared.acceptance.observe(ev);
@@ -933,7 +978,8 @@ export async function handleTasks(req, res, match, ctx) {
                     const retryAfterSec = resumeAtPlane.errorCode === "memory.admission_required" && result.retryAfterMs !== undefined
                         ? Math.max(1, Math.ceil(result.retryAfterMs / 1000))
                         : undefined;
-                    return { status: resumeAtStatus, body: { errorCode: resumeAtPlane.errorCode, error: redactErrorMessage(resumeAtPlane.errorMessage) ?? "resume-at failed", ...(retryAfterSec !== undefined ? { retryAfterSec } : {}) } };
+                    const refusalFacts = zeroWorkRefusalFacts(redactTerminalResult(sealResultForExit(result)).terminal, prepared.warnings);
+                    return { status: resumeAtStatus, body: refusalBody({ errorCode: httpErrorCode(resumeAtStatus, resumeAtPlane.errorCode), message: redactErrorMessage(resumeAtPlane.errorMessage) ?? "resume-at failed", facts: { ...(retryAfterSec !== undefined ? { retryAfterSec } : {}), ...refusalFacts } }) };
                 }
                 const exitResult = await mintSubmitExitResult(result, deps.checkpointStore);
                 const syncPlane = outwardPlane(result.terminal);