@dev.sail.money/sailor 1.3.0-226 → 1.3.0-227

package/examples/custom-mandate/.sail/contracts/interfaces/IPermission.sol

@@ -10,6 +10,10 @@ struct Context {
     uint256 value;
     uint256 blockTimestamp;
     uint256 blockNumber;
+    /// @dev Kernel registrationEpoch(account, permission) at dispatch. Configurable
+    ///      permissions fail closed on a mismatch with the epoch stamped at configure()
+    ///      time; permissions without post-deploy configuration can ignore it.
+    uint256 configEpoch;
 }
 
 interface IPermission {

package/examples/custom-mandate/README.md

@@ -36,11 +36,14 @@ struct Context {
     uint256 value;          // msg.value (native asset) sent with the call
     uint256 blockTimestamp; // block.timestamp at evaluation
     uint256 blockNumber;    // block.number at evaluation
+    uint256 configEpoch;    // kernel registrationEpoch(account, permission) at dispatch;
+                            // ignore it unless your permission takes post-deploy configuration
 }
 ```
 
 - `evaluate` — your policy. Return `true` to permit the call, `false` to block it. Runs under a
-  100k-gas `staticcall`; a revert or gas overage is treated as `false`.
+  150,000-gas `staticcall` (`SailKernel.PERMISSION_GAS_CAP`); a revert or gas overage is treated
+  as `false`.
 - `discriminator` — a stable `bytes32` name for your permission (e.g. `keccak256("MyMandate")`).
 
 Keep all policy parameters constructor-configured so each deployment is a complete, reviewable

package/examples/permissions/interfaces/IBatchPermission.sol

@@ -26,6 +26,8 @@ struct BatchContext {
     bytes32 batchHash;      // keccak256(abi.encode(calls)) — stable id for the exact sequence
     uint256 blockTimestamp; // block.timestamp at dispatch
     uint256 blockNumber;    // block.number at dispatch
+    uint256 configEpoch;    // kernel registrationEpoch(account, permission) at dispatch —
+                            // same fail-closed freshness check as Context.configEpoch
 }
 
 interface IBatchPermission {

package/examples/permissions/interfaces/IPermission.sol

@@ -10,6 +10,10 @@ struct Context {
     uint256 value;
     uint256 blockTimestamp;
     uint256 blockNumber;
+    /// @dev Kernel registrationEpoch(account, permission) at dispatch. Configurable
+    ///      permissions fail closed on a mismatch with the epoch stamped at configure()
+    ///      time; permissions without post-deploy configuration can ignore it.
+    uint256 configEpoch;
 }
 
 interface IPermission {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dev.sail.money/sailor",
-  "version": "1.3.0-226",
+  "version": "1.3.0-227",
   "description": "Operator toolkit for Sail Protocol",
   "bin": {
     "sailor": "packages/cli/dist/index.cjs"

package/packages/cli/dist/index.cjs

@@ -40545,15 +40545,36 @@ var IPERMISSION_ABI = [
           { name: "selector", type: "bytes4" },
           { name: "value", type: "uint256" },
           { name: "blockTimestamp", type: "uint256" },
-          { name: "blockNumber", type: "uint256" }
+          { name: "blockNumber", type: "uint256" },
+          { name: "configEpoch", type: "uint256" }
         ]
       }
     ],
     outputs: [{ type: "bool" }]
   }
 ];
+var REGISTRATION_EPOCH_ABI2 = [
+  {
+    type: "function",
+    name: "registrationEpoch",
+    stateMutability: "view",
+    inputs: [
+      { name: "account", type: "address" },
+      { name: "permission", type: "address" }
+    ],
+    outputs: [{ type: "uint256" }]
+  }
+];
+async function readRegistrationEpoch(publicClient, kernel, account2, permission) {
+  return await publicClient.readContract({
+    address: kernel,
+    abi: REGISTRATION_EPOCH_ABI2,
+    functionName: "registrationEpoch",
+    args: [account2, permission]
+  });
+}
 function buildPermissionContext(params) {
-  const { account: account2, manager, call: call2, blockInfo } = params;
+  const { account: account2, manager, call: call2, blockInfo, configEpoch } = params;
   const selector = call2.data.length >= 10 ? call2.data.slice(0, 10) : "0x00000000";
   return {
     account: account2,
@@ -40564,12 +40585,23 @@ function buildPermissionContext(params) {
     selector,
     value: call2.value,
     blockTimestamp: blockInfo.timestamp,
-    blockNumber: blockInfo.number
+    blockNumber: blockInfo.number,
+    configEpoch
   };
 }
 async function probePermissionForCall(params) {
-  const { publicClient, permission, account: account2, manager, call: call2, blockInfo } = params;
-  const ctx = buildPermissionContext({ account: account2, manager, call: call2, blockInfo });
+  const { publicClient, kernel, permission, account: account2, manager, call: call2, blockInfo } = params;
+  let configEpoch;
+  try {
+    configEpoch = await readRegistrationEpoch(publicClient, kernel, account2, permission);
+  } catch (err) {
+    return {
+      accepted: false,
+      reverted: true,
+      error: `could not read registrationEpoch from kernel ${kernel} (${err.message.split("\n")[0]})`
+    };
+  }
+  const ctx = buildPermissionContext({ account: account2, manager, call: call2, blockInfo, configEpoch });
   try {
     const accepted = await publicClient.readContract({
       address: permission,
@@ -40583,10 +40615,11 @@ async function probePermissionForCall(params) {
   }
 }
 async function resolvePermissionForCall(params) {
-  const { publicClient, account: account2, manager, call: call2, registeredPermissions, blockInfo } = params;
-  const ctx = buildPermissionContext({ account: account2, manager, call: call2, blockInfo });
+  const { publicClient, kernel, account: account2, manager, call: call2, registeredPermissions, blockInfo } = params;
   for (const permission of registeredPermissions) {
     try {
+      const configEpoch = await readRegistrationEpoch(publicClient, kernel, account2, permission);
+      const ctx = buildPermissionContext({ account: account2, manager, call: call2, blockInfo, configEpoch });
       const accepted = await publicClient.readContract({
         address: permission,
         abi: IPERMISSION_ABI,
@@ -40656,7 +40689,10 @@ async function probePassThrough(pc, permission, account2) {
           selector: PROBE_SELECTOR,
           value: 0n,
           blockTimestamp: 0n,
-          blockNumber: 0n
+          blockNumber: 0n,
+          // Pass-through probes only run on conjunctive kernels, which predate
+          // registrationEpoch — there is no live epoch to read, so probe with 0.
+          configEpoch: 0n
         }
       ]
     });
@@ -40952,6 +40988,10 @@ struct Context {
     uint256 value;          // native ETH forwarded (wei)
     uint256 blockTimestamp; // block.timestamp at dispatch
     uint256 blockNumber;    // block.number at dispatch
+    uint256 configEpoch;    // kernel registrationEpoch(account, permission) at dispatch;
+                            // configurable permissions fail closed on a mismatch with the
+                            // epoch stamped at configure() time. Custom permissions that
+                            // take no post-deploy configuration can ignore it.
 }
 
 /// @title  IPermission
@@ -40987,6 +41027,8 @@ struct BatchContext {
     bytes32 batchHash;      // keccak256(abi.encode(calls)) \u2014 stable id for the exact sequence
     uint256 blockTimestamp; // block.timestamp at dispatch
     uint256 blockNumber;    // block.number at dispatch
+    uint256 configEpoch;    // kernel registrationEpoch(account, permission) at dispatch \u2014
+                            // same fail-closed freshness check as Context.configEpoch
 }
 
 /// @title  IBatchPermission
@@ -44364,6 +44406,7 @@ async function mandateSimulate(options) {
       const [probe, codeCheck] = await Promise.all([
         probePermissionForCall({
           publicClient: pc,
+          kernel: project.contracts.kernel,
           permission,
           account: account2,
           manager,
@@ -45323,6 +45366,8 @@ Configure the chain in the SDK chain registry or set KERNEL_ADDRESS in .sail/.en
         } else {
           permission = await resolvePermissionForCall({
             publicClient,
+            kernel,
+            // narrowed: runCommand validates kernel before runTick runs
             account: accountAddr,
             manager: agentManager.address,
             call: firstCall,

package/packages/sdk/dist/intelligence.d.ts

@@ -5,7 +5,7 @@
  * Do not edit manually — run `pnpm build` to regenerate.
  *
  * Spec version : 1.2.1
- * Generated at : 2026-07-02T15:07:10.282Z
+ * Generated at : 2026-07-02T16:26:37.498Z
  */
 export declare const SAIL_INTELLIGENCE_BASE_URL = "https://api.sail.money";
 export declare const SAIL_INTELLIGENCE_DOCS_URL = "https://api.sail.money/docs";

package/packages/sdk/dist/intelligence.js

@@ -5,7 +5,7 @@
  * Do not edit manually — run `pnpm build` to regenerate.
  *
  * Spec version : 1.2.1
- * Generated at : 2026-07-02T15:07:10.282Z
+ * Generated at : 2026-07-02T16:26:37.498Z
  */
 export const SAIL_INTELLIGENCE_BASE_URL = "https://api.sail.money";
 export const SAIL_INTELLIGENCE_DOCS_URL = "https://api.sail.money/docs";

package/templates/default/.agents/skills/sail-mandates/references/examples-index.md

@@ -29,6 +29,6 @@ Permissions only bound on-chain actions: venues with off-chain order matching (P
 
 ## Interfaces (vendored in `examples/permissions/interfaces/`)
 
-- `IPermission.evaluate(bytes txData, Context ctx) → bool`; Context: `account, manager, submitter, target, selector, value, blockTimestamp, blockNumber`.
-- `IBatchPermission.evaluateBatch(Call[] calls, BatchContext ctx) → bool` + `isBatchPermission() → true`; Call: `(target, value, data)`; BatchContext: `account, manager, submitter, permission, batchHash, blockTimestamp, blockNumber`.
+- `IPermission.evaluate(bytes txData, Context ctx) → bool`; Context: `account, manager, submitter, target, selector, value, blockTimestamp, blockNumber, configEpoch`.
+- `IBatchPermission.evaluateBatch(Call[] calls, BatchContext ctx) → bool` + `isBatchPermission() → true`; Call: `(target, value, data)`; BatchContext: `account, manager, submitter, permission, batchHash, blockTimestamp, blockNumber, configEpoch`.
 - `SailCalldata.sol`: bounded slot-indexed calldata readers (`hasParams`, `asAddress`, `asUint256`, …) — use these instead of `abi.decode` to avoid wrong-offset reads.

package/templates/default/test/BoundedCallPermission.t.sol

@@ -39,7 +39,8 @@ contract BoundedCallPermissionTest {
             selector: selector,
             value: value,
             blockTimestamp: block.timestamp,
-            blockNumber: block.number
+            blockNumber: block.number,
+            configEpoch: 0 // BoundedCallPermission takes no post-deploy config; value unused
         });
     }