maka-agent 0.2.0-dev.77.20261009 → 0.2.0-dev.78.20261010

package/node_modules/@maka/core/dist/bot-events.js

@@ -130,14 +130,7 @@ export function plaintextHelpReply() {
     ].join('\n');
 }
 export function formatBotMessageForSession(message) {
-    return `[${botDisplayLabel(message.platform)}:${sanitizeBotUserName(message.userName)}] ${message.text.trim()}`;
-}
-function sanitizeBotUserName(value) {
-    return (value
-        .replace(/[\u0000-\u001F\u007F-\u009F]+/g, ' ')
-        .replace(/[\p{Cf}]+/gu, ' ')
-        .replace(/\s+/g, ' ')
-        .trim() || 'unknown');
+    return `[${botDisplayLabel(message.platform)}] ${message.text.trim()}`;
 }
 /**
  * Non-error `BotStatus.reason` values. These states have their own UI surface,

package/node_modules/@maka/core/dist/local-memory.js

@@ -318,8 +318,11 @@ export function findLocalMemoryEntryDraftRange(input, entryId) {
             end: lineStarts[endLineIndex] ?? input.length,
         };
     };
+    const isCodeFenceLine = createMemoryCodeFenceTracker();
     for (let index = 0; index < lines.length; index += 1) {
         const line = lines[index] ?? '';
+        if (isCodeFenceLine(line))
+            continue;
         const heading = /^##\s+(.+?)\s*$/.exec(line);
         if (heading) {
             const matched = matchCurrent(index);
@@ -421,7 +424,12 @@ function parseLocalMemoryMarkdownRaw(input) {
         }
         current = null;
     };
+    const isCodeFenceLine = createMemoryCodeFenceTracker();
     for (const line of lines) {
+        if (isCodeFenceLine(line)) {
+            current?.body.push(line);
+            continue;
+        }
         const heading = /^##\s+(.+?)\s*$/.exec(line);
         if (heading) {
             flush();
@@ -455,8 +463,29 @@ function stripPromptContent(entry) {
     const { promptContent: _promptContent, ...preview } = entry;
     return preview;
 }
+// All entry readers and editors share fence state so code examples cannot split entries.
+function createMemoryCodeFenceTracker() {
+    let fence;
+    return (line) => {
+        const match = /^ {0,3}(`{3,}|~{3,})(.*)$/.exec(line);
+        if (fence) {
+            if (match &&
+                match[1][0] === fence.marker &&
+                match[1].length >= fence.length &&
+                match[2].trim() === '') {
+                fence = undefined;
+            }
+            return true;
+        }
+        if (!match || (match[1][0] === '`' && match[2].includes('`')))
+            return false;
+        fence = { marker: match[1][0], length: match[1].length };
+        return true;
+    };
+}
 function parseMetaComment(line) {
-    const match = /^<!--\s*maka-memory:\s*(.*?)\s*-->$/.exec(line.trim());
+    // Four-space or tab indentation denotes a code example, not entry identity or state.
+    const match = /^ {0,3}<!--\s*maka-memory:\s*(.*?)\s*-->[ \t]*$/.exec(line);
     if (!match)
         return null;
     const meta = {};
@@ -482,8 +511,11 @@ function findLocalMemoryEntrySection(input, entryId) {
         const proposalId = current.meta?.proposalId;
         return id === entryId || proposalId === entryId ? { id, ...current } : null;
     };
+    const isCodeFenceLine = createMemoryCodeFenceTracker();
     for (let index = 0; index < lines.length; index += 1) {
         const line = lines[index] ?? '';
+        if (isCodeFenceLine(line))
+            continue;
         const heading = /^##\s+(.+?)\s*$/.exec(line);
         if (heading) {
             const matched = matchCurrent();
@@ -534,8 +566,13 @@ function findLocalMemoryEntryFullSection(input, entryId) {
             },
         };
     };
+    const isCodeFenceLine = createMemoryCodeFenceTracker();
     for (let index = 0; index < lines.length; index += 1) {
         const line = lines[index] ?? '';
+        if (isCodeFenceLine(line)) {
+            current?.body.push(line);
+            continue;
+        }
         const heading = /^##\s+(.+?)\s*$/.exec(line);
         if (heading) {
             const matched = matchCurrent(index);

package/node_modules/@maka/core/dist/scheduled-task.js

@@ -493,23 +493,22 @@ function asFiniteNumber(value) {
         return value;
     return null;
 }
+/**
+ * Calendar recurrence uses Date's local-time rules: shift gaps forward and take
+ * the first repeated time. Rebuild from the anchor so gap shifts do not carry
+ * into later cycles; cron instead skips nonexistent local times.
+ */
 function nextCalendarFireAt(schedule, after) {
     const anchor = new Date(schedule.anchorAt);
-    if (schedule.recurrence === 'daily') {
-        const next = new Date(after);
-        next.setHours(anchor.getHours(), anchor.getMinutes(), anchor.getSeconds(), anchor.getMilliseconds());
-        if (next.getTime() <= after)
-            next.setDate(next.getDate() + 1);
-        return next.getTime();
-    }
-    if (schedule.recurrence === 'weekly') {
-        const next = new Date(after);
-        next.setHours(anchor.getHours(), anchor.getMinutes(), anchor.getSeconds(), anchor.getMilliseconds());
-        const dayDelta = (anchor.getDay() - next.getDay() + 7) % 7;
-        next.setDate(next.getDate() + dayDelta);
-        if (next.getTime() <= after)
-            next.setDate(next.getDate() + 7);
-        return next.getTime();
+    if (schedule.recurrence === 'daily' || schedule.recurrence === 'weekly') {
+        const base = new Date(after);
+        const dayOffset = schedule.recurrence === 'daily' ? 0 : (anchor.getDay() - base.getDay() + 7) % 7;
+        const periodDays = schedule.recurrence === 'daily' ? 1 : 7;
+        // Build each occurrence from the anchor: a DST gap may normalize today's
+        // wall time, but that adjusted hour must not carry into another date.
+        const occurrence = (offset) => new Date(base.getFullYear(), base.getMonth(), base.getDate() + offset, anchor.getHours(), anchor.getMinutes(), anchor.getSeconds(), anchor.getMilliseconds()).getTime();
+        const next = occurrence(dayOffset);
+        return next > after ? next : occurrence(dayOffset + periodDays);
     }
     const afterDate = new Date(after);
     for (let offset = 0; offset <= 480; offset += 1) {

package/node_modules/@maka/core/dist/session.js

@@ -467,6 +467,7 @@ const WORKHUB_DELEGATION_ASSIGNED_MESSAGE_SHAPE = defineObjectShape()([
     'attachments',
     'targetAttachments',
     'returnResults',
+    'executionPermissionMode',
     'create',
     'steered',
     'replacesActionId',
@@ -797,6 +798,8 @@ function isWorkHubCoordinationMessage(message) {
         typeof message.targetSessionName === 'string' &&
         message.targetSessionName.trim().length > 0 &&
         (message.returnResults === undefined || message.returnResults === true) &&
+        (message.executionPermissionMode === undefined ||
+            isPermissionMode(message.executionPermissionMode)) &&
         (message.steered === undefined || message.steered === true) &&
         ((message.schemaVersion === WORKHUB_COORDINATION_RECORD_SCHEMA_VERSION &&
             message.replacesActionId === undefined &&

package/node_modules/@maka/core/dist/text-sanitize.js

@@ -84,6 +84,11 @@ const ZERO_WIDTH_REGEX = /[\u200B-\u200D\u2060-\u2064\uFEFF]/g;
  */
 export function sanitizeUnicodeText(text, opts) {
     const suffix = opts.truncatedSuffix ?? '…';
+    // A negative cap is clamped to zero: without it the loop never breaks (the
+    // whole input is expanded) and the slice's negative end keeps nearly the
+    // whole string — the opposite of the "hard cap" this option promises. Same
+    // boundary contract as truncateUtf16Safe's `maxUnits <= 0` guard.
+    const maxCodePoints = Math.max(0, opts.maxCodePoints);
     const cleaned = text
         .normalize('NFC')
         .replace(CONTROL_CHARS_REGEX, ' ')
@@ -95,12 +100,12 @@ export function sanitizeUnicodeText(text, opts) {
     for (const point of cleaned) {
         points.push(point);
         // One extra point detects truncation without expanding the entire input.
-        if (opts.maxCodePoints >= 0 && points.length > opts.maxCodePoints)
+        if (points.length > maxCodePoints)
             break;
     }
-    if (points.length <= opts.maxCodePoints)
+    if (points.length <= maxCodePoints)
         return cleaned;
-    return points.slice(0, opts.maxCodePoints).join('') + suffix;
+    return points.slice(0, maxCodePoints).join('') + suffix;
 }
 /**
  * Truncate to at most `maxUnits` UTF-16 code units without ending on an

package/node_modules/@maka/runtime/dist/ai-sdk-backend.js

@@ -90,6 +90,16 @@ export class AiSdkBackend {
      * read back as absent.
      */
     activeTurns = new Set();
+    /**
+     * Deferred-tool activations for this Session backend. `tool_search` only
+     * adds names; Turn end and compaction do not clear them. Clearing at Turn
+     * end would change the provider tool list and miss the prompt cache on the
+     * next Turn. Compaction already invalidates that cache, so clearing there
+     * would change the prefix a second time. Concurrent Runs on this backend
+     * share the map, so a search in one Run is visible on a sibling Run's next
+     * step. A rebuilt backend starts empty.
+     */
+    sessionActiveTools = new Map();
     compaction;
     turnSessionState = {};
     constructor(input) {
@@ -254,6 +264,7 @@ export class AiSdkBackend {
             providerTelemetry: this.providerTelemetry,
             compaction: this.compaction,
             snapshotToolAvailability: () => this.snapshotToolAvailability(),
+            sessionActiveTools: this.sessionActiveTools,
             codeCellAdmission: this.codeCellAdmission,
             resolvedProviderOptions: this.resolvedProviderOptions,
             session: this.turnSessionState,

package/node_modules/@maka/runtime/dist/ai-sdk-turn.js

@@ -37,7 +37,7 @@ import { contextDiagnosticsCompactionOf, } from './context-diagnostics.js';
 import { hasBlockingReplayDiagnostics } from './ai-sdk-compaction.js';
 import { portableApplyPatchTool } from './apply-patch-profile.js';
 import { RunTrace } from './run-trace.js';
-import { REQUEST_SANDBOX_BOUNDARY_TOOL_NAME, SANDBOX_BOUNDARY_DENIED_FOR_TURN, SANDBOX_BOUNDARY_FINALIZATION_PROMPT, } from './sandbox-boundary-tool.js';
+import { REQUEST_SANDBOX_BOUNDARY_TOOL_NAME, SANDBOX_BOUNDARY_DENIED_FOR_TURN, SANDBOX_BOUNDARY_FINALIZATION_PROMPT, requiredSandboxBoundaryToolNames, } from './sandbox-boundary-tool.js';
 import { buildRuntimeEventModelReplayPlan, appendPriorUnknownToolResponses, buildSteeringEnvelope, collectToolActivityTurnIds, compatibleProviderReasoningReplayEventIds, formatTextWithInlineRefs, inspectPriorUnknownToolOutcomes, steeringMessagesMissingFromBase, steeringModelMessage, } from './model-history.js';
 import { toolSchemaCharsForDiagnostics, requestCompositionToolSchemas, stableHash, toolCatalogHash, } from './request-shape.js';
 import { toolAvailabilityHash } from './tool-availability.js';
@@ -374,13 +374,15 @@ function providerRetryDelayMs(failedAttempt, retryAfterMs) {
  *
  * Each turn owns its ToolRuntime for the same reason: gating, the loop gate,
  * the subagent and child-run limiters, durable attempts, and step admission are
- * all per-turn facts.
+ * all per-turn facts. Deferred-tool activation is the exception: it lives on
+ * the Session backend so later Turns — and concurrent Runs on the same
+ * backend — keep the same provider tool list.
  */
 export class AiSdkTurn {
     deps;
     request;
     abortController = new AbortController();
-    activeTools = new Map();
+    activeTools;
     aborted = false;
     loopStopRequested = false;
     loopStopReason;
@@ -412,6 +414,7 @@ export class AiSdkTurn {
             request.orchestration ??
                 resolveEffectiveOrchestration(deps.backend.header.orchestrationMode, undefined);
         this.toolRuntime = deps.createToolRuntime(this);
+        this.activeTools = deps.sessionActiveTools;
     }
     async *run() {
         yield* this.runWithinScope(this.request);
@@ -805,7 +808,7 @@ export class AiSdkTurn {
         }
         // --- Build the provider-visible schema set. Tool execution stays in Runtime. ---
         // Each logical step freezes its own scoped catalog and search projection.
-        // Mutable activation belongs to this turn and follows contribution identity.
+        // Mutable activation is the Session backend map and follows contribution identity.
         const requiredOrchestrationTools = this.orchestration.mode === 'swarm'
             ? new Set([
                 'agent_list',
@@ -834,7 +837,11 @@ export class AiSdkTurn {
             if (toolMode === 'code_mode' && snapshot.hostTools.some((tool) => tool.name === 'exec')) {
                 throw new Error('Tool name "exec" is reserved for Code Mode.');
             }
-            const basePlan = snapshot.runtime.prepare(this.activeTools, requiredOrchestrationTools);
+            const requiredTools = new Set([
+                ...requiredOrchestrationTools,
+                ...requiredSandboxBoundaryToolNames(snapshot.hostTools),
+            ]);
+            const basePlan = snapshot.runtime.prepare(this.activeTools, requiredTools);
             const nestedTools = nestableToolSnapshot(basePlan.providerTools, basePlan.activeTools);
             const plan = projectToolModePlan(basePlan, toolMode, codeModeExecTool);
             const modelTools = {};
@@ -1231,6 +1238,7 @@ export class AiSdkTurn {
                         result = await this.deps.modelAdapter.startStream({
                             model,
                             messages: dispatchMessages,
+                            historyMessageCount: attemptMessages.length,
                             tools: modelTools,
                             activeTools: activeToolsForRequest,
                             onStreamActivity: () => requestWatchdog?.markActivity(),

package/node_modules/@maka/runtime/dist/bots/proxied-fetch.js

@@ -22,6 +22,11 @@ import { buildProxyDispatcher } from '../network/proxy-dispatcher.js';
 import { resolveActiveProxy } from '../network/active-proxy-state.js';
 import { FETCH_PROXY_SNAPSHOT } from '../network/scoped-fetch-transport.js';
 const DEFAULT_TIMEOUT_MS = 15_000;
+// Bounded wait for dispatcher teardown in the error path: a graceful close
+// that never settles must not delay the rejection the caller is owed. The
+// success path keeps its fire-and-forget close, which owns the streaming
+// body lifecycle and is not bounded here.
+const DISPATCHER_CLOSE_GRACE_MS = 1_000;
 export async function proxiedFetch(input, init = {}) {
     const url = typeof input === 'string' ? input : input instanceof URL ? input.toString() : input.url;
     const proxy = resolveActiveProxy();
@@ -70,8 +75,31 @@ export async function proxiedFetch(input, init = {}) {
     catch (error) {
         if (timer)
             clearTimeout(timer);
+        // Mirror the shared transport teardown ordering: begin dispatcher
+        // teardown before aborting so the graceful close can retire live
+        // CONNECT tunnels, with abort still cancelling pending connects. Keep
+        // the wait bounded so a stalled close cannot hold the rejection.
+        const teardown = disposeDispatcher(timedOut);
         controller.abort(error);
-        await disposeDispatcher(timedOut);
+        let graceTimer;
+        const graceExpired = await Promise.race([
+            teardown.then(() => false),
+            new Promise((resolve) => {
+                graceTimer = setTimeout(() => resolve(true), DISPATCHER_CLOSE_GRACE_MS);
+            }),
+        ]);
+        if (graceTimer)
+            clearTimeout(graceTimer);
+        if (graceExpired) {
+            // The graceful close never settled within the grace, so destroy the
+            // dispatcher instead of leaking it. Fire-and-forget with the error
+            // swallowed: teardown must never replace the rejection the caller is
+            // owed.
+            const disposable = dispatcher;
+            if (typeof disposable.destroy === 'function') {
+                void Promise.resolve(disposable.destroy.call(dispatcher, new Error('Dispatcher close grace expired'))).catch(() => { });
+            }
+        }
         throw error;
     }
     // Headers are in: return the original Fetch Response now. close() is

package/node_modules/@maka/runtime/dist/file-stable-write.js

@@ -134,13 +134,25 @@ async function openExistingNoTruncate(path) {
  * only after the identity was validated on the fd. Write-step failures
  * (ENOSPC/EIO/EDQUOT/EFBIG) can leave the file truncated or half-written, so
  * they surface as `outcome_unknown` — the file's state is genuinely unknown.
+ * Short writes complete the remaining bytes; zero progress also reports outcome_unknown.
  */
 export async function writeThroughHandle(handle, content) {
+    const bytes = Buffer.from(content, 'utf8');
     try {
         await handle.truncate(0);
-        // Position 0 explicitly: a prior readFile leaves the fd position at EOF,
-        // and a positionless write would create a NUL-prefixed sparse file.
-        await handle.write(content, 0, 'utf8');
+        // Use an explicit offset from zero: a previous readFile may leave the fd at
+        // EOF, where an implicit write would create a sparse prefix.
+        // A successful write may consume only part of the buffer. Keep byte
+        // offsets (not string indices) so a short write inside UTF-8 is lossless.
+        let offset = 0;
+        while (offset < bytes.length) {
+            const { bytesWritten } = await handle.write(bytes, offset, bytes.length - offset, offset);
+            if (bytesWritten <= 0) {
+                throw new StableWriteFailure('outcome_unknown', 'The write stopped making progress; the file may be truncated. ' +
+                    'Re-read the file before writing to it again.');
+            }
+            offset += bytesWritten;
+        }
     }
     catch (error) {
         const code = error.code;

package/node_modules/@maka/runtime/dist/model-adapter.js

@@ -181,7 +181,8 @@ export class ModelAdapter {
             sdkTools[TOOL_SEARCH_PROVIDER_NAME] = sdkTools[TOOL_SEARCH_NAME];
             delete sdkTools[TOOL_SEARCH_NAME];
         }
-        const fullMessages = this.runtime.wire === 'openai-chat' ? lowerChatToolImages(input.messages) : input.messages;
+        const messages = withAnthropicHistoryCacheBreakpoint(input.messages, input.historyMessageCount, this.input.providerOptions);
+        const fullMessages = this.runtime.wire === 'openai-chat' ? lowerChatToolImages(messages) : messages;
         const responsesLane = input.continuationKey && usesNativeOpenAiResponses(this.input.connection, this.runtime)
             ? input.continuationKey
             : undefined;
@@ -895,6 +896,24 @@ function translateChunk(chunk, openAiChatReasoningTransportState, runtime, runti
             return [];
     }
 }
+function withAnthropicHistoryCacheBreakpoint(messages, historyMessageCount, providerOptions) {
+    const cacheControl = providerOptions?.anthropic
+        ?.cacheControl;
+    if (cacheControl === undefined ||
+        historyMessageCount === undefined ||
+        historyMessageCount >= messages.length) {
+        return messages;
+    }
+    return messages.map((message, index) => index === historyMessageCount - 1
+        ? {
+            ...message,
+            providerOptions: {
+                ...message.providerOptions,
+                anthropic: { ...message.providerOptions?.anthropic, cacheControl },
+            },
+        }
+        : message);
+}
 function lowerChatToolImages(messages) {
     const result = [];
     let images = [];

package/node_modules/@maka/runtime/dist/network/proxy-test.js

@@ -21,6 +21,10 @@ import { buildProxyDispatcher } from './proxy-dispatcher.js';
 import { fetch } from 'undici';
 const DEFAULT_PROBE_URL = 'https://icanhazip.com';
 const DEFAULT_TIMEOUT_MS = 8_000;
+// Bounded wait for dispatcher teardown: a graceful close that never settles
+// (observed behind real proxies after an abort) must not keep this call —
+// and the serialized settings lane it runs on — pending forever.
+const DISPATCHER_CLOSE_GRACE_MS = 1_000;
 export async function testProxyConnection(input = {}, storedProxy) {
     const proxy = parseProxyConfig(input.proxy ?? storedProxy);
     const probeUrl = input.url ?? DEFAULT_PROBE_URL;
@@ -81,8 +85,31 @@ export async function testProxyConnection(input = {}, storedProxy) {
         };
     }
     finally {
+        // Mirror the shared transport teardown ordering: begin dispatcher
+        // teardown before aborting, so the graceful close can retire live
+        // CONNECT tunnels before the signal kills their sockets; abort still
+        // cancels any pending connect or handshake. Keep the wait bounded so a
+        // stalled close cannot hold this call past its result.
+        const teardown = disposeDispatcher(timedOut);
         controller.abort();
-        await disposeDispatcher(timedOut);
+        let graceTimer;
+        const graceExpired = await Promise.race([
+            teardown.then(() => false),
+            new Promise((resolve) => {
+                graceTimer = setTimeout(() => resolve(true), DISPATCHER_CLOSE_GRACE_MS);
+            }),
+        ]);
+        if (graceTimer)
+            clearTimeout(graceTimer);
+        if (graceExpired) {
+            // The graceful close never settled within the grace, so destroy the
+            // dispatcher instead of leaking it. Fire-and-forget with the error
+            // swallowed: teardown must never replace the result this call owes.
+            const disposable = dispatcher;
+            if (typeof disposable.destroy === 'function') {
+                void Promise.resolve(disposable.destroy.call(dispatcher, new Error('Dispatcher close grace expired'))).catch(() => { });
+            }
+        }
     }
 }
 async function lookupCountry(ip, dispatcher, signal) {

package/node_modules/@maka/runtime/dist/network/scoped-fetch-transport.js

@@ -21,6 +21,7 @@ import { matchesBypassList } from './bypass-matcher.js';
 import { buildProxyDispatcher } from './proxy-dispatcher.js';
 import { buildAbortableConnector } from './abortable-connector.js';
 export const FETCH_PROXY_SNAPSHOT = Symbol.for('maka.fetch.proxy-snapshot');
+const TRANSPORT_CLOSE_GRACE_MS = 1_000;
 export function inheritFetchProxySnapshot(fetch, source) {
     const descriptor = Object.getOwnPropertyDescriptor(source, FETCH_PROXY_SNAPSHOT);
     if (descriptor)
@@ -62,8 +63,7 @@ export function createProxiedFetchTransport(proxy) {
         if (closePromise)
             return closePromise;
         closed = true;
-        connections.abort(new Error('Connection effect fetch transport closed'));
-        closePromise = Promise.all([
+        const destroyed = Promise.all([
             directDispatcher
                 .destroy(new Error('Connection effect fetch transport closed'))
                 .catch(() => { }),
@@ -71,6 +71,17 @@ export function createProxiedFetchTransport(proxy) {
                 ?.destroy(new Error('Connection effect fetch transport closed'))
                 .catch(() => { }),
         ]).then(() => undefined);
+        // Let dispatchers begin teardown before aborting CONNECT tunnels, so Undici
+        // can retire HTTP/2 sessions before their sockets disappear. Abort still
+        // cancels pending connects and handshakes; retain a bound for stalled teardown.
+        connections.abort(new Error('Connection effect fetch transport closed'));
+        let deadline;
+        closePromise = Promise.race([
+            destroyed,
+            new Promise((resolve) => {
+                deadline = setTimeout(resolve, TRANSPORT_CLOSE_GRACE_MS);
+            }),
+        ]).finally(() => clearTimeout(deadline));
         return closePromise;
     };
     return { fetch, close };

package/node_modules/@maka/runtime/dist/runtime-kernel.js

@@ -21,6 +21,7 @@ import { randomUUID } from 'node:crypto';
 import { decodeRuntimeBoundaryCursor, } from '@maka/core/runtime-boundary';
 import { isTerminalRuntimeEvent, } from '@maka/core/runtime-event';
 import { isDeepStrictEqual } from 'node:util';
+import { createGenesisExecutionBoundary } from '@maka/core/sandbox-boundary';
 import { resolveEffectiveOrchestration, } from '@maka/core/orchestration';
 import { AgentRun, ContinuationStartCommitError, } from './agent-run.js';
 import { createSessionEventMapMemory, isLiveBackendSessionEvent, mapSessionEventToRuntimeEvent, } from './session-event-runtime-mapper.js';
@@ -320,7 +321,17 @@ export class RuntimeKernel {
         const execution = this.takeExecutionClaim(sessionId, options.execution);
         try {
             await this.enterExecutionClaim(execution);
-            const header = await this.readBackendHeader(execution);
+            execution.executionPolicy = options.executionPolicy;
+            const existing = this.active.get(sessionId);
+            if (existing && !isDeepStrictEqual(existing.executionPolicy, options.executionPolicy)) {
+                if (existing.activeRuns.size > 0)
+                    throw new Error('Cannot change execution policy while a Turn is running');
+                await this.disposeBackend(sessionId);
+            }
+            const storedHeader = await this.readBackendHeader(execution);
+            const header = options.executionPolicy
+                ? { ...storedHeader, permissionMode: options.executionPolicy.permissionMode }
+                : storedHeader;
             let workspaceIdentity;
             if (this.deps.inspectContinuationSafety) {
                 try {
@@ -355,7 +366,12 @@ export class RuntimeKernel {
                         return active;
                     },
                     unregisterRun: (active, activeRun) => this.unregisterParentRun(active, activeRun),
-                    updateHeader: (targetSessionId, patch) => this.updateHeader(targetSessionId, patch),
+                    updateHeader: async (targetSessionId, patch) => {
+                        const updated = await this.updateHeader(targetSessionId, patch);
+                        return options.executionPolicy
+                            ? { ...updated, permissionMode: options.executionPolicy.permissionMode }
+                            : updated;
+                    },
                     updateStatus: (targetSessionId, status, blockedReason, ts) => this.updateStatus(targetSessionId, status, blockedReason, ts),
                     ...this.messageProjectionHook(),
                 },
@@ -410,7 +426,14 @@ export class RuntimeKernel {
             (this.executionClaims.get(continuation.sessionId)?.size ?? 0) > 1) {
             throw new Error('Cannot continue while another run is active');
         }
-        const header = await this.readBackendHeader(execution);
+        execution.executionPolicy = options.executionPolicy;
+        const existing = this.active.get(continuation.sessionId);
+        if (existing && !isDeepStrictEqual(existing.executionPolicy, options.executionPolicy))
+            await this.disposeBackend(continuation.sessionId);
+        const storedHeader = await this.readBackendHeader(execution);
+        const header = options.executionPolicy
+            ? { ...storedHeader, permissionMode: options.executionPolicy.permissionMode }
+            : storedHeader;
         const sessionRuns = await this.deps.runtimeEventStore.listSessionInvocations(continuation.sessionId);
         const sourceRun = sessionRuns.find((run) => run.runId === continuation.sourceRunId);
         if (!sourceRun) {
@@ -564,7 +587,12 @@ export class RuntimeKernel {
                     return active;
                 },
                 unregisterRun: (active, activeRun) => this.unregisterParentRun(active, activeRun),
-                updateHeader: (targetSessionId, patch) => this.updateHeader(targetSessionId, patch),
+                updateHeader: async (targetSessionId, patch) => {
+                    const updated = await this.updateHeader(targetSessionId, patch);
+                    return options.executionPolicy
+                        ? { ...updated, permissionMode: options.executionPolicy.permissionMode }
+                        : updated;
+                },
                 updateStatus: (targetSessionId, status, blockedReason, ts) => this.updateStatus(targetSessionId, status, blockedReason, ts),
                 ...this.messageProjectionHook(),
             },
@@ -1689,6 +1717,32 @@ export class RuntimeKernel {
     hasActiveRun(sessionId, runId, turnId) {
         return this.activeRunsFor(sessionId).some((run) => run.runId === runId && (turnId === undefined || run.turnId === turnId));
     }
+    readExecutionPolicy(sessionId, runId) {
+        for (const generation of this.backendGenerationsFor(sessionId)) {
+            if (generation.activeRuns.has(runId))
+                return generation.executionPolicy;
+        }
+        return [...(this.executionClaims.get(sessionId) ?? [])].find((execution) => execution.run?.runId === runId)?.executionPolicy;
+    }
+    returnExecutionQuestions(sessionId, runId) {
+        for (const generation of this.backendGenerationsFor(sessionId)) {
+            const run = generation.activeRuns.get(runId);
+            if (!run)
+                continue;
+            const policy = {
+                permissionMode: run.headerSnapshot().permissionMode,
+                questions: 'return',
+            };
+            generation.executionPolicy = policy;
+            for (const execution of this.executionClaims.get(sessionId) ?? []) {
+                if (execution.run?.runId === runId)
+                    execution.executionPolicy = policy;
+            }
+            return;
+        }
+        // A terminal backend can precede the Host's terminal admission. Its queued
+        // steering is recovered into a successor with the durable delegated policy.
+    }
     requestRunHandoff(sessionId, runId, pause, signal) {
         if (!this.deps.inspectContinuationSafety)
             return undefined;
@@ -1987,11 +2041,17 @@ export class RuntimeKernel {
                 }));
             execution.run?.bindProviderStateIdentity(prepared.providerStateIdentity);
             const subagent = await this.resolveSubagentActivation(header);
+            const kernel = this;
             const backend = await prepared.build({
                 sessionId,
                 workspaceRoot: header.workspaceRoot,
                 header,
-                store: this.deps.store,
+                store: execution.executionPolicy
+                    ? this.executionPolicyStore(sessionId, execution.executionPolicy)
+                    : this.deps.store,
+                get executionPolicy() {
+                    return kernel.active.get(sessionId)?.executionPolicy ?? execution.executionPolicy;
+                },
                 abortSignal: execution.abortController.signal,
                 ...(subagent
                     ? {
@@ -2007,12 +2067,39 @@ export class RuntimeKernel {
             });
             await this.rejectCancelledBackendActivation(backend, header, execution);
             const generation = this.createBackendGeneration(sessionId, backend, header, prepared.providerStateIdentity);
+            generation.executionPolicy = execution.executionPolicy;
             this.active.set(sessionId, generation);
             return generation;
         });
         entry.cachedHeader = header;
         return entry;
     }
+    executionPolicyStore(targetSessionId, policy) {
+        const store = this.deps.store;
+        // Host stores are frozen. Proxy invariants forbid replacing their own
+        // non-configurable methods, so intercept on an independent facade instead.
+        return new Proxy(Object.create(store), {
+            get(_facade, property) {
+                if (property === 'readHeader')
+                    return async (sessionId) => {
+                        const header = await store.readHeader(sessionId);
+                        return sessionId === targetSessionId
+                            ? { ...header, permissionMode: policy.permissionMode }
+                            : header;
+                    };
+                if (property === 'readExecutionBoundary')
+                    return async (sessionId) => {
+                        const boundary = await store.readExecutionBoundary(sessionId);
+                        if (sessionId === targetSessionId &&
+                            (policy.permissionMode === 'bypass' || boundary.kind === 'bypass'))
+                            return createGenesisExecutionBoundary(policy.permissionMode);
+                        return boundary;
+                    };
+                const value = Reflect.get(store, property);
+                return typeof value === 'function' ? value.bind(store) : value;
+            },
+        });
+    }
     async shareBackendActivation(activationKey, activate) {
         let activation = this.backendActivationBuilds.get(activationKey);
         if (!activation) {

package/node_modules/@maka/runtime/dist/sandbox-boundary-tool.js

@@ -31,6 +31,18 @@ export const SANDBOX_BOUNDARY_UNAVAILABLE = 'request_sandbox_boundary is not ava
     'Retrying will fail the same way — redo the work inside the paths already allowed, or tell the ' +
     'user which path needs access.';
 export const REQUEST_SANDBOX_BOUNDARY_TOOL_NAME = 'request_sandbox_boundary';
+/**
+ * Session-stable required names for the widening tool. Host only binds it when
+ * the Session is not Full access. Passing the name through `requiredToolNames`
+ * keeps the schema visible without a `tool_search` hop, and without depending
+ * on a live boundary prompt that would change the provider prefix per Turn
+ * (#5879). Returns empty when the tool is not bound.
+ */
+export function requiredSandboxBoundaryToolNames(hostTools) {
+    return hostTools.some((tool) => tool.name === REQUEST_SANDBOX_BOUNDARY_TOOL_NAME)
+        ? new Set([REQUEST_SANDBOX_BOUNDARY_TOOL_NAME])
+        : new Set();
+}
 export const SANDBOX_BOUNDARY_DENIED_FOR_TURN = 'The user denied a sandbox boundary expansion for this Turn. Do not request another expansion. ' +
     'Continue only with the authority already available, or explain the remaining blocker.';
 export const SANDBOX_BOUNDARY_FINALIZATION_PROMPT = [