@namzu/sdk 61.4.0 → 62.0.0

package/dist/runtime/query/review-policy.d.ts

@@ -145,7 +145,7 @@ export declare function batchNeedsReview(toolCalls: readonly ToolCallSummary[],
  * answers for the batch as a unit, and approving its other calls while the
  * one that needed a person is dropped would run a plan with a hole in it.
  */
-export declare const SANDBOX_ESCAPE_UNATTENDED_REFUSAL = "Refused: a call in this batch asks to run outside the sandbox, which needs a person to confirm it each time, and nobody can be asked in this session. Nothing in this batch ran. Run the command inside the sandbox, or resend the other calls without the escape.";
+export declare const SANDBOX_ESCAPE_UNATTENDED_REFUSAL = "Refused: this call asks to run outside the sandbox, which needs a person to confirm it each time, and nobody can be asked in this session. This call did not run; the other calls in the batch are not affected. Run the command inside the sandbox instead.";
 /**
  * What the model is told when a batch reaches a path outside the turn's roots
  * and nobody can be asked.
@@ -155,7 +155,7 @@ export declare const SANDBOX_ESCAPE_UNATTENDED_REFUSAL = "Refused: a call in thi
  * nobody to ask widens the roots up front instead (`additionalDirectories`,
  * the CLI's `--add-dir`), where an operator wrote the directory down.
  */
-export declare const OUTSIDE_ROOTS_UNATTENDED_REFUSAL = "Refused: a call in this batch reaches a path outside the working directory and the added directories, which needs a person to approve it each time, and nobody can be asked in this session. Nothing in this batch ran. Stay inside the working directory, or tell the user which directory you need so they can add it to the session (the CLI's --add-dir).";
+export declare const OUTSIDE_ROOTS_UNATTENDED_REFUSAL = "Refused: this call reaches a path outside the working directory and the directories added to this session, which needs a person to approve it each time, and nobody can be asked in this session. This call did not run; the other calls in the batch are not affected. Use a path inside the working directory, or tell the user which directory you need so they can start the session with it added (the CLI's --add-dir).";
 /**
  * What the model is told when a batch carries a call the tool itself
  * declared always needs a person's approval and nobody can be asked.
@@ -164,7 +164,7 @@ export declare const OUTSIDE_ROOTS_UNATTENDED_REFUSAL = "Refused: a call in this
  * declaration is the tool author's, not the operator's, so no rule, mode or
  * remembered grant can stand in for the person it names.
  */
-export declare const REQUIRES_APPROVAL_UNATTENDED_REFUSAL = "Refused: a call in this batch is one the tool itself declared always needs a person's approval, and nobody can be asked in this session. Nothing in this batch ran. This cannot be granted by a rule, an automation mode, a remembered approval or a skill; run it in a session where a person can be asked.";
+export declare const REQUIRES_APPROVAL_UNATTENDED_REFUSAL = "Refused: this call is one the tool itself declared always needs a person's approval, and nobody can be asked in this session. This call did not run; the other calls in the batch are not affected. This cannot be granted by a rule, an automation mode, a remembered approval or a skill; run it in a session where a person can be asked.";
 /**
  * What the model is told when a batch runs a command whose own program name
  * is decided at runtime and nobody can be asked.
@@ -174,7 +174,7 @@ export declare const REQUIRES_APPROVAL_UNATTENDED_REFUSAL = "Refused: a call in
  * before it runs — unlike a sandbox escape, there is no equivalent
  * "unattended allow" for this.
  */
-export declare const UNKNOWN_PROGRAM_UNATTENDED_REFUSAL = "Refused: a call in this batch runs a command whose own program name is decided at runtime (a substitution or a variable stands for it), which needs a person to approve it each time, and nobody can be asked in this session. Nothing in this batch ran. Write the program name literally; compute what needs computing in the arguments instead.";
+export declare const UNKNOWN_PROGRAM_UNATTENDED_REFUSAL = "Refused: this call runs a command whose own program name is decided at runtime (a substitution or a variable stands for it), which needs a person to approve it each time, and nobody can be asked in this session. This call did not run; the other calls in the batch are not affected. Write the program name literally; compute what needs computing in the arguments instead.";
 /**
  * What the model is told when a batch writes a protected path (a git hook, a
  * shell rc file, editor or tool configuration, the project's `.namzu`
@@ -184,23 +184,23 @@ export declare const UNKNOWN_PROGRAM_UNATTENDED_REFUSAL = "Refused: a call in th
  * the turn, with the operator's rights, so an answer given before the call
  * existed (a mode, a rule, "approve all") is not an answer about it.
  */
-export declare const PROTECTED_PATH_UNATTENDED_REFUSAL = "Refused: a call in this batch writes a protected path (a git hook or config, a shell startup file, editor or tool configuration, or the project's .namzu directory), which needs a person to approve it each time, and nobody can be asked in this session. Nothing in this batch ran. Leave those files alone, or tell the user what change you need so they can make it.";
+export declare const PROTECTED_PATH_UNATTENDED_REFUSAL = "Refused: this call writes a protected path (a git hook or config, a shell startup file, editor or tool configuration, or the project's .namzu directory), which needs a person to approve it each time, and nobody can be asked in this session. This call did not run; the other calls in the batch are not affected. Leave those files alone, or tell the user what change you need so they can make it.";
 /**
  * What the model is told when a batch removes something catastrophic (the
  * root, the home directory, the working directory or a parent of it, a glob
  * across directories, a target a variable may empty) and nobody can be asked.
  */
-export declare const DANGEROUS_REMOVAL_UNATTENDED_REFUSAL = "Refused: a call in this batch removes something this check treats as catastrophic (the file system root, a top-level or home directory, the working directory or a parent of it, a glob across directories, or a target a variable or substitution may leave empty), which needs a person to approve it each time, and nobody can be asked in this session. Nothing in this batch ran. Name the exact directory to remove with a literal path.";
+export declare const DANGEROUS_REMOVAL_UNATTENDED_REFUSAL = "Refused: this call removes something this check treats as catastrophic (the file system root, a top-level or home directory, the working directory or a parent of it, a glob across directories, or a target a variable or substitution may leave empty), which needs a person to approve it each time, and nobody can be asked in this session. This call did not run; the other calls in the batch are not affected. Name the exact directory to remove with a literal path.";
 /**
  * What the model is told when a batch carries a call a rule or a hook asked a
  * person to approve and nobody can be asked.
  */
-export declare const ASK_RULE_UNATTENDED_REFUSAL = "Refused: a call in this batch is one a rule or a hook says a person must approve, and nobody can be asked in this session. Nothing in this batch ran. Run it in a session where a person can be asked, or have the operator change the rule.";
+export declare const ASK_RULE_UNATTENDED_REFUSAL = "Refused: this call is one a rule or a hook says a person must approve, and nobody can be asked in this session. This call did not run; the other calls in the batch are not affected. Run it in a session where a person can be asked, or have the operator change the rule.";
 /**
  * What the model is told when the checks that decide whether a call reaches
  * past its boundary did not finish and nobody can be asked.
  */
-export declare const UNFINISHED_CHECK_UNATTENDED_REFUSAL = "Refused: the safety checks on a call in this batch did not finish, so it cannot be shown to be safe, and a person has to approve it and nobody can be asked in this session. Nothing in this batch ran. Try a simpler form of the call.";
+export declare const UNFINISHED_CHECK_UNATTENDED_REFUSAL = "Refused: the safety checks on this call did not finish, so it cannot be shown to be safe, and a person has to approve it and nobody can be asked in this session. This call did not run; the other calls in the batch are not affected. Try a simpler form of the call.";
 /** What the model is told when the conversation is too long for the classifier to read. */
 export declare const CLASSIFIER_TRANSCRIPT_TOO_LONG_FEEDBACK = "Blocked by auto mode: the conversation has become too long for the safety check to read, so this action was not run. The conversation is being shortened; try the action again.";
 /**
@@ -227,6 +227,10 @@ export declare const SCREEN_CONSENT_DECLINED_FEEDBACK = "The user declined to sh
 export interface ScreenConsentRecord {
     readonly sessions: Set<string>;
 }
+/** The outside-the-roots refusal, naming the directory and the way to allow it. */
+export declare function outsideRootsRefusal(toolCalls: readonly ToolCallSummary[]): string;
+/** The catastrophic-removal refusal with the one-line reason the check found. */
+export declare function dangerousRemovalRefusal(toolCalls: readonly ToolCallSummary[]): string;
 /**
  * Whether a mode needs a batch a rule already allowed to come to the policy.
  *
@@ -235,6 +239,34 @@ export interface ScreenConsentRecord {
  * answers its `reviewAllowedCalls` with this for the mode it is in.
  */
 export declare function modeReviewsAllowedCalls(mode: ReviewMode): boolean;
+/** The slice of a reviewed call {@link mustAskPerson} reads; a `ToolCallSummary` fits it. */
+export interface MustAskCall {
+    readonly escalation?: unknown;
+    readonly requiresApproval?: boolean;
+    readonly authorization?: {
+        readonly explicitReview?: boolean;
+        readonly askRule?: boolean;
+    };
+    readonly hookPermission?: {
+        readonly decision?: string;
+    };
+}
+/**
+ * Whether a standing "yes" (a remembered `approve-all`, or a host's own
+ * "allow for this conversation") must not cover this call: it exists to put a
+ * question to a person.
+ *
+ * It crosses the turn's boundary in any way (a sandbox escape, a path outside
+ * the roots, a protected path, a catastrophic removal, a program nobody can
+ * name, a check that did not finish), its tool needs a yes on every call, or a
+ * rule or a hook asked for a person. `escalation` is tested as a whole rather
+ * than field by field, so a kind of escalation added later is asked about
+ * before anyone remembers to list it. A call that reaches the first look at
+ * the screen is asked about too; that is a property of the request
+ * (`ToolReviewRequest.screenConsent`), so a host adds it where it builds the
+ * ask.
+ */
+export declare function mustAskPerson(call: MustAskCall): boolean;
 /** The batch a person is asked about. */
 export interface ToolReviewRequest {
     /** Originating session, preserved by createReviewHandler for host attribution. */

package/dist/runtime/query/review-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"review-policy.d.ts","sourceRoot":"","sources":["../../../src/runtime/query/review-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAYH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAA;AAC5D,OAAO,KAAK,EAGX,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,MAAM,2BAA2B,CAAA;AAClC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAA;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAA;AACnE,OAAO,EAAE,KAAK,oBAAoB,EAA6B,MAAM,6BAA6B,CAAA;AAIlG,MAAM,MAAM,UAAU;AACrB,6DAA6D;AAC3D,QAAQ;AACV,gGAAgG;GAC9F,MAAM;AACR;;;;;;;;;;GAUG;GACD,cAAc;AAChB;;;;;;;;;GASG;GACD,MAAM;AACR;;;;GAIG;GACD,QAAQ;AACV;;;;;;;;;;;;;GAaG;GACD,QAAQ;AACV;;;;;;;;;;GAUG;GACD,UAAU,CAAA;AAEb,eAAO,MAAM,YAAY,EAAE,SAAS,UAAU,EAQ7C,CAAA;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,UAAU,CAEhE;AAED,OAAO,EAAE,iBAAiB,EAAE,CAAA;AAE5B,oEAAoE;AACpE,eAAO,MAAM,mBAAmB,6MACsK,CAAA;AAEtM,iFAAiF;AACjF,eAAO,MAAM,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAA8B,CAAA;AAYjF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,oBAAoB,EAAE,WAAW,CAAC,MAAM,CAInD,CAAA;AAEF;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAC7B,QAAQ,EAAE,IAAI,CAAC,WAAW,EAAE,KAAK,GAAG,UAAU,CAAC,EAC/C,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,OAAO,GACZ,OAAO,CAOT;AAED,MAAM,MAAM,eAAe,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,OAAO,CAAA;AAEvE;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAC/B,SAAS,EAAE,SAAS,eAAe,EAAE,EACrC,MAAM,EAAE,eAAe,GACrB,OAAO,CAST;AAoBD;;;;;;;GAOG;AACH,eAAO,MAAM,iCAAiC,uQACuN,CAAA;AAErQ;;;;;;;;GAQG;AACH,eAAO,MAAM,gCAAgC,kWACmT,CAAA;AAEhW;;;;;;;GAOG;AACH,eAAO,MAAM,oCAAoC,iTAC8P,CAAA;AAE/S;;;;;;;;GAQG;AACH,eAAO,MAAM,kCAAkC,uVACsS,CAAA;AAErV;;;;;;;;GAQG;AACH,eAAO,MAAM,iCAAiC,+WAC+T,CAAA;AAE7W;;;;GAIG;AACH,eAAO,MAAM,oCAAoC,mbACgY,CAAA;AAEjb;;;GAGG;AACH,eAAO,MAAM,2BAA2B,iPACuM,CAAA;AAE/O;;;GAGG;AACH,eAAO,MAAM,mCAAmC,4OAC0L,CAAA;AAE1O,2FAA2F;AAC3F,eAAO,MAAM,uCAAuC,oLAC8H,CAAA;AAElL;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,WAAW,CAAC,MAAM,CAgBpD,CAAA;AAoKF,sGAAsG;AACtG,eAAO,MAAM,2BAA2B,EAAE,WAAW,CAAC,MAAM,CAQ1D,CAAA;AAEF;;;GAGG;AACH,eAAO,MAAM,iCAAiC,+QAC+N,CAAA;AAE7Q,6EAA6E;AAC7E,eAAO,MAAM,gCAAgC,8KAC+H,CAAA;AAE5K;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAC9B;AAwBD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAEjE;AAqGD,yCAAyC;AACzC,MAAM,WAAW,iBAAiB;IACjC,kFAAkF;IAClF,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAA;IAC9B,+EAA+E;IAC/E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,eAAe,EAAE,CAAA;IAC9C;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,IAAI,CAAA;IAC7B;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,CAAA;IACvB;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAC7B;AAED,MAAM,MAAM,gBAAgB,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE;AAC9B,yDAAyD;GACvD;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAA;CAAE,GAChC;IACA,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;IACvB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,gBAAgB,CAAA;IACpC;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,CAAA;CACtB,CAAA;AAEJ,wEAAwE;AACxE,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAA;AAExF,MAAM,WAAW,mBAAmB;IACnC,sEAAsE;IACtE,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,CAAA;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAA;IAClC,iGAAiG;IACjG,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAA;IACjC,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,KAAK,GAAG,UAAU,CAAC,CAAA;IACzD;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE;QAAE,GAAG,EAAE,OAAO,CAAA;KAAE,CAAA;IACtC;;;;;;;;;OASG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAA;IACrD;;;;;;;;;OASG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAA;IAC1C;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,mBAAmB,CAAA;IAC5C;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,OAAO,CAAA;IACnE;;;;;;;;OAQG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,eAAe,KAAK,OAAO,CAAA;IAC3D;;;OAGG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,oBAAoB,CAAA;IAC1C,sGAAsG;IACtG,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACtC;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,CAAC,MAAM,SAAS,MAAM,EAAE,CAAC,CAAA;IAC9D;;;;;;OAMG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE;QACpC,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAA;QACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KACvB,KAAK,IAAI,CAAA;IACV;;;;OAIG;IACH,QAAQ,CAAC,6BAA6B,CAAC,EAAE,MAAM,IAAI,CAAA;CACnD;AAoCD,wFAAwF;AACxF,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,mBAAwB,GAAG,aAAa,CA4fpF;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,mBAAwB,GAAG,cAAc,CAGpF"}
+{"version":3,"file":"review-policy.d.ts","sourceRoot":"","sources":["../../../src/runtime/query/review-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAeH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAA;AAC5D,OAAO,KAAK,EAGX,aAAa,EACb,gBAAgB,EAChB,eAAe,EAEf,MAAM,2BAA2B,CAAA;AAClC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAA;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAA;AACnE,OAAO,EAAE,KAAK,oBAAoB,EAA6B,MAAM,6BAA6B,CAAA;AAIlG,MAAM,MAAM,UAAU;AACrB,6DAA6D;AAC3D,QAAQ;AACV,gGAAgG;GAC9F,MAAM;AACR;;;;;;;;;;GAUG;GACD,cAAc;AAChB;;;;;;;;;GASG;GACD,MAAM;AACR;;;;GAIG;GACD,QAAQ;AACV;;;;;;;;;;;;;GAaG;GACD,QAAQ;AACV;;;;;;;;;;GAUG;GACD,UAAU,CAAA;AAEb,eAAO,MAAM,YAAY,EAAE,SAAS,UAAU,EAQ7C,CAAA;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,UAAU,CAEhE;AAED,OAAO,EAAE,iBAAiB,EAAE,CAAA;AAE5B,oEAAoE;AACpE,eAAO,MAAM,mBAAmB,6MACsK,CAAA;AAEtM,iFAAiF;AACjF,eAAO,MAAM,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAA8B,CAAA;AAYjF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,oBAAoB,EAAE,WAAW,CAAC,MAAM,CAInD,CAAA;AAEF;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAC7B,QAAQ,EAAE,IAAI,CAAC,WAAW,EAAE,KAAK,GAAG,UAAU,CAAC,EAC/C,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,OAAO,GACZ,OAAO,CAOT;AAED,MAAM,MAAM,eAAe,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,OAAO,CAAA;AAEvE;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAC/B,SAAS,EAAE,SAAS,eAAe,EAAE,EACrC,MAAM,EAAE,eAAe,GACrB,OAAO,CAST;AAoBD;;;;;;;GAOG;AACH,eAAO,MAAM,iCAAiC,iQACiN,CAAA;AAE/P;;;;;;;;GAQG;AACH,eAAO,MAAM,gCAAgC,kaACmX,CAAA;AAEha;;;;;;;GAOG;AACH,eAAO,MAAM,oCAAoC,iVAC8R,CAAA;AAE/U;;;;;;;;GAQG;AACH,eAAO,MAAM,kCAAkC,uXACsU,CAAA;AAErX;;;;;;;;GAQG;AACH,eAAO,MAAM,iCAAiC,+YAC+V,CAAA;AAE7Y;;;;GAIG;AACH,eAAO,MAAM,oCAAoC,mdACga,CAAA;AAEjd;;;GAGG;AACH,eAAO,MAAM,2BAA2B,iRACuO,CAAA;AAE/Q;;;GAGG;AACH,eAAO,MAAM,mCAAmC,4QAC0N,CAAA;AAE1Q,2FAA2F;AAC3F,eAAO,MAAM,uCAAuC,oLAC8H,CAAA;AAElL;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,WAAW,CAAC,MAAM,CAgBpD,CAAA;AAoKF,sGAAsG;AACtG,eAAO,MAAM,2BAA2B,EAAE,WAAW,CAAC,MAAM,CAQ1D,CAAA;AAEF;;;GAGG;AACH,eAAO,MAAM,iCAAiC,+QAC+N,CAAA;AAE7Q,6EAA6E;AAC7E,eAAO,MAAM,gCAAgC,8KAC+H,CAAA;AAE5K;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAC9B;AAQD,mFAAmF;AACnF,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,SAAS,eAAe,EAAE,GAAG,MAAM,CAajF;AAED,iFAAiF;AACjF,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,SAAS,eAAe,EAAE,GAAG,MAAM,CAMrF;AAwBD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAEjE;AAwBD,6FAA6F;AAC7F,MAAM,WAAW,WAAW;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAA;IAC7B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAA;IACnC,QAAQ,CAAC,aAAa,CAAC,EAAE;QAAE,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;IAC1F,QAAQ,CAAC,cAAc,CAAC,EAAE;QAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CACxD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAQxD;AA+ED,yCAAyC;AACzC,MAAM,WAAW,iBAAiB;IACjC,kFAAkF;IAClF,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAA;IAC9B,+EAA+E;IAC/E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,eAAe,EAAE,CAAA;IAC9C;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,IAAI,CAAA;IAC7B;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,CAAA;IACvB;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAC7B;AAED,MAAM,MAAM,gBAAgB,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE;AAC9B,yDAAyD;GACvD;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAA;CAAE,GAChC;IACA,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;IACvB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,gBAAgB,CAAA;IACpC;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,CAAA;CACtB,CAAA;AAEJ,wEAAwE;AACxE,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAA;AAExF,MAAM,WAAW,mBAAmB;IACnC,sEAAsE;IACtE,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,CAAA;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAA;IAClC,iGAAiG;IACjG,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAA;IACjC,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,KAAK,GAAG,UAAU,CAAC,CAAA;IACzD;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE;QAAE,GAAG,EAAE,OAAO,CAAA;KAAE,CAAA;IACtC;;;;;;;;;OASG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAA;IACrD;;;;;;;;;OASG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAA;IAC1C;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,mBAAmB,CAAA;IAC5C;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,OAAO,CAAA;IACnE;;;;;;;;OAQG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,eAAe,KAAK,OAAO,CAAA;IAC3D;;;OAGG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,oBAAoB,CAAA;IAC1C,sGAAsG;IACtG,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACtC;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,CAAC,MAAM,SAAS,MAAM,EAAE,CAAC,CAAA;IAC9D;;;;;;OAMG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE;QACpC,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAA;QACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KACvB,KAAK,IAAI,CAAA;IACV;;;;OAIG;IACH,QAAQ,CAAC,6BAA6B,CAAC,EAAE,MAAM,IAAI,CAAA;CACnD;AAoCD,wFAAwF;AACxF,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,mBAAwB,GAAG,aAAa,CA6jBpF;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,mBAAwB,GAAG,cAAc,CAGpF"}

package/dist/runtime/query/review-policy.js

@@ -20,6 +20,8 @@
  * What a host supplies is the one thing the kernel cannot: how to ask a
  * person (`prompt`).
  */
+import { homedir } from 'node:os';
+import { dirname, parse } from 'node:path';
 import { unknownProgramInLine } from '../../authorization/program.js';
 import { readShellLine, shellPathAccess, } from '../../authorization/shell-paths.js';
 import { effectiveBashWorkingDirectory } from '../../tools/builtins/bash-cwd.js';
@@ -135,7 +137,7 @@ function onlyReadsOutsideRoots(toolCalls, exempt) {
  * answers for the batch as a unit, and approving its other calls while the
  * one that needed a person is dropped would run a plan with a hole in it.
  */
-export const SANDBOX_ESCAPE_UNATTENDED_REFUSAL = 'Refused: a call in this batch asks to run outside the sandbox, which needs a person to confirm it each time, and nobody can be asked in this session. Nothing in this batch ran. Run the command inside the sandbox, or resend the other calls without the escape.';
+export const SANDBOX_ESCAPE_UNATTENDED_REFUSAL = 'Refused: this call asks to run outside the sandbox, which needs a person to confirm it each time, and nobody can be asked in this session. This call did not run; the other calls in the batch are not affected. Run the command inside the sandbox instead.';
 /**
  * What the model is told when a batch reaches a path outside the turn's roots
  * and nobody can be asked.
@@ -145,7 +147,7 @@ export const SANDBOX_ESCAPE_UNATTENDED_REFUSAL = 'Refused: a call in this batch
  * nobody to ask widens the roots up front instead (`additionalDirectories`,
  * the CLI's `--add-dir`), where an operator wrote the directory down.
  */
-export const OUTSIDE_ROOTS_UNATTENDED_REFUSAL = "Refused: a call in this batch reaches a path outside the working directory and the added directories, which needs a person to approve it each time, and nobody can be asked in this session. Nothing in this batch ran. Stay inside the working directory, or tell the user which directory you need so they can add it to the session (the CLI's --add-dir).";
+export const OUTSIDE_ROOTS_UNATTENDED_REFUSAL = "Refused: this call reaches a path outside the working directory and the directories added to this session, which needs a person to approve it each time, and nobody can be asked in this session. This call did not run; the other calls in the batch are not affected. Use a path inside the working directory, or tell the user which directory you need so they can start the session with it added (the CLI's --add-dir).";
 /**
  * What the model is told when a batch carries a call the tool itself
  * declared always needs a person's approval and nobody can be asked.
@@ -154,7 +156,7 @@ export const OUTSIDE_ROOTS_UNATTENDED_REFUSAL = "Refused: a call in this batch r
  * declaration is the tool author's, not the operator's, so no rule, mode or
  * remembered grant can stand in for the person it names.
  */
-export const REQUIRES_APPROVAL_UNATTENDED_REFUSAL = "Refused: a call in this batch is one the tool itself declared always needs a person's approval, and nobody can be asked in this session. Nothing in this batch ran. This cannot be granted by a rule, an automation mode, a remembered approval or a skill; run it in a session where a person can be asked.";
+export const REQUIRES_APPROVAL_UNATTENDED_REFUSAL = "Refused: this call is one the tool itself declared always needs a person's approval, and nobody can be asked in this session. This call did not run; the other calls in the batch are not affected. This cannot be granted by a rule, an automation mode, a remembered approval or a skill; run it in a session where a person can be asked.";
 /**
  * What the model is told when a batch runs a command whose own program name
  * is decided at runtime and nobody can be asked.
@@ -164,7 +166,7 @@ export const REQUIRES_APPROVAL_UNATTENDED_REFUSAL = "Refused: a call in this bat
  * before it runs — unlike a sandbox escape, there is no equivalent
  * "unattended allow" for this.
  */
-export const UNKNOWN_PROGRAM_UNATTENDED_REFUSAL = 'Refused: a call in this batch runs a command whose own program name is decided at runtime (a substitution or a variable stands for it), which needs a person to approve it each time, and nobody can be asked in this session. Nothing in this batch ran. Write the program name literally; compute what needs computing in the arguments instead.';
+export const UNKNOWN_PROGRAM_UNATTENDED_REFUSAL = 'Refused: this call runs a command whose own program name is decided at runtime (a substitution or a variable stands for it), which needs a person to approve it each time, and nobody can be asked in this session. This call did not run; the other calls in the batch are not affected. Write the program name literally; compute what needs computing in the arguments instead.';
 /**
  * What the model is told when a batch writes a protected path (a git hook, a
  * shell rc file, editor or tool configuration, the project's `.namzu`
@@ -174,23 +176,23 @@ export const UNKNOWN_PROGRAM_UNATTENDED_REFUSAL = 'Refused: a call in this batch
  * the turn, with the operator's rights, so an answer given before the call
  * existed (a mode, a rule, "approve all") is not an answer about it.
  */
-export const PROTECTED_PATH_UNATTENDED_REFUSAL = "Refused: a call in this batch writes a protected path (a git hook or config, a shell startup file, editor or tool configuration, or the project's .namzu directory), which needs a person to approve it each time, and nobody can be asked in this session. Nothing in this batch ran. Leave those files alone, or tell the user what change you need so they can make it.";
+export const PROTECTED_PATH_UNATTENDED_REFUSAL = "Refused: this call writes a protected path (a git hook or config, a shell startup file, editor or tool configuration, or the project's .namzu directory), which needs a person to approve it each time, and nobody can be asked in this session. This call did not run; the other calls in the batch are not affected. Leave those files alone, or tell the user what change you need so they can make it.";
 /**
  * What the model is told when a batch removes something catastrophic (the
  * root, the home directory, the working directory or a parent of it, a glob
  * across directories, a target a variable may empty) and nobody can be asked.
  */
-export const DANGEROUS_REMOVAL_UNATTENDED_REFUSAL = 'Refused: a call in this batch removes something this check treats as catastrophic (the file system root, a top-level or home directory, the working directory or a parent of it, a glob across directories, or a target a variable or substitution may leave empty), which needs a person to approve it each time, and nobody can be asked in this session. Nothing in this batch ran. Name the exact directory to remove with a literal path.';
+export const DANGEROUS_REMOVAL_UNATTENDED_REFUSAL = 'Refused: this call removes something this check treats as catastrophic (the file system root, a top-level or home directory, the working directory or a parent of it, a glob across directories, or a target a variable or substitution may leave empty), which needs a person to approve it each time, and nobody can be asked in this session. This call did not run; the other calls in the batch are not affected. Name the exact directory to remove with a literal path.';
 /**
  * What the model is told when a batch carries a call a rule or a hook asked a
  * person to approve and nobody can be asked.
  */
-export const ASK_RULE_UNATTENDED_REFUSAL = 'Refused: a call in this batch is one a rule or a hook says a person must approve, and nobody can be asked in this session. Nothing in this batch ran. Run it in a session where a person can be asked, or have the operator change the rule.';
+export const ASK_RULE_UNATTENDED_REFUSAL = 'Refused: this call is one a rule or a hook says a person must approve, and nobody can be asked in this session. This call did not run; the other calls in the batch are not affected. Run it in a session where a person can be asked, or have the operator change the rule.';
 /**
  * What the model is told when the checks that decide whether a call reaches
  * past its boundary did not finish and nobody can be asked.
  */
-export const UNFINISHED_CHECK_UNATTENDED_REFUSAL = 'Refused: the safety checks on a call in this batch did not finish, so it cannot be shown to be safe, and a person has to approve it and nobody can be asked in this session. Nothing in this batch ran. Try a simpler form of the call.';
+export const UNFINISHED_CHECK_UNATTENDED_REFUSAL = 'Refused: the safety checks on this call did not finish, so it cannot be shown to be safe, and a person has to approve it and nobody can be asked in this session. This call did not run; the other calls in the batch are not affected. Try a simpler form of the call.';
 /** What the model is told when the conversation is too long for the classifier to read. */
 export const CLASSIFIER_TRANSCRIPT_TOO_LONG_FEEDBACK = 'Blocked by auto mode: the conversation has become too long for the safety check to read, so this action was not run. The conversation is being shortened; try the action again.';
 /**
@@ -391,6 +393,35 @@ export const ACCEPT_EDITS_SHELL_COMMANDS = new Set([
 export const SCREEN_CONSENT_UNATTENDED_REFUSAL = "Refused: this call would send what is on the user's screen to the model provider, which a person agrees to once per session, and nobody can be asked in this session. Nothing in this batch ran. Tell the user computer use needs their consent in an interactive session.";
 /** What the model is told when the operator declines to share the screen. */
 export const SCREEN_CONSENT_DECLINED_FEEDBACK = 'The user declined to share their screen in this session. Nothing in this batch ran. Do not take screenshots or read windows again; ask the user how they want to proceed.';
+/** The directory to name for a path the guard stopped: the path itself unless it looks like a file. */
+function directoryToAllow(path) {
+    const last = path.split(/[\\/]/).pop() ?? '';
+    return last.includes('.') ? dirname(path) : path;
+}
+/** The outside-the-roots refusal, naming the directory and the way to allow it. */
+export function outsideRootsRefusal(toolCalls) {
+    const paths = [...new Set(toolCalls.flatMap((tc) => tc.escalation?.outsidePaths ?? []))];
+    if (paths.length === 0)
+        return OUTSIDE_ROOTS_UNATTENDED_REFUSAL;
+    const blocked = `${OUTSIDE_ROOTS_UNATTENDED_REFUSAL} Blocked: ${paths.slice(0, 3).join(', ')}.`;
+    const directories = [...new Set(paths.map(directoryToAllow))];
+    // A directory that is the file system root or the home directory is too wide to
+    // suggest adding; a path directly under the root is more often a mistyped name.
+    const wide = new Set([parse(directories[0] ?? '/').root, homedir()]);
+    const addable = directories.filter((d) => !wide.has(d)).slice(0, 3);
+    if (addable.length === 0) {
+        return `${blocked} It sits directly under a directory too wide to add; if the name is a typo, use a path inside the working directory or the system temp directory.`;
+    }
+    return `${blocked} To allow it, the user starts the session with ${addable.map((d) => `--add-dir ${d}`).join(' ')}.`;
+}
+/** The catastrophic-removal refusal with the one-line reason the check found. */
+export function dangerousRemovalRefusal(toolCalls) {
+    const why = toolCalls.find((tc) => tc.escalation?.dangerousRemoval !== undefined)?.escalation
+        ?.dangerousRemoval;
+    return why === undefined
+        ? DANGEROUS_REMOVAL_UNATTENDED_REFUSAL
+        : `${DANGEROUS_REMOVAL_UNATTENDED_REFUSAL} Why: ${why}.`;
+}
 /**
  * Whether the call writes a protected path, removes something catastrophic, or
  * could not be checked.
@@ -406,7 +437,7 @@ function floorRefusal(toolCalls) {
         return PROTECTED_PATH_UNATTENDED_REFUSAL;
     }
     return toolCalls.some((tc) => tc.escalation?.dangerousRemoval !== undefined)
-        ? DANGEROUS_REMOVAL_UNATTENDED_REFUSAL
+        ? dangerousRemovalRefusal(toolCalls)
         : UNFINISHED_CHECK_UNATTENDED_REFUSAL;
 }
 /**
@@ -437,6 +468,28 @@ function isBypassImmune(tc) {
         tc.escalation?.unfinishedCheck !== undefined ||
         tc.requiresApproval === true);
 }
+/**
+ * Whether a standing "yes" (a remembered `approve-all`, or a host's own
+ * "allow for this conversation") must not cover this call: it exists to put a
+ * question to a person.
+ *
+ * It crosses the turn's boundary in any way (a sandbox escape, a path outside
+ * the roots, a protected path, a catastrophic removal, a program nobody can
+ * name, a check that did not finish), its tool needs a yes on every call, or a
+ * rule or a hook asked for a person. `escalation` is tested as a whole rather
+ * than field by field, so a kind of escalation added later is asked about
+ * before anyone remembers to list it. A call that reaches the first look at
+ * the screen is asked about too; that is a property of the request
+ * (`ToolReviewRequest.screenConsent`), so a host adds it where it builds the
+ * ask.
+ */
+export function mustAskPerson(call) {
+    return (call.escalation !== undefined ||
+        call.requiresApproval === true ||
+        call.authorization?.explicitReview === true ||
+        call.authorization?.askRule === true ||
+        call.hookPermission?.decision === 'ask');
+}
 /** The refusal for the first immune thing in a batch nobody can be asked about, or undefined. */
 function immuneRefusal(toolCalls, escapeConfirmed) {
     if (!escapeConfirmed && toolCalls.some((tc) => tc.escalation?.sandboxEscape === true)) {
@@ -446,7 +499,7 @@ function immuneRefusal(toolCalls, escapeConfirmed) {
         return PROTECTED_PATH_UNATTENDED_REFUSAL;
     }
     if (toolCalls.some((tc) => tc.escalation?.dangerousRemoval !== undefined)) {
-        return DANGEROUS_REMOVAL_UNATTENDED_REFUSAL;
+        return dangerousRemovalRefusal(toolCalls);
     }
     if (toolCalls.some((tc) => tc.escalation?.unfinishedCheck !== undefined)) {
         return UNFINISHED_CHECK_UNATTENDED_REFUSAL;
@@ -665,7 +718,15 @@ export function createReviewHandler(options = {}) {
         }
         return acceptEditsAllows(tc, sessionId);
     };
-    return async (request, context) => {
+    // Decisions that refuse one call and say so. The wrapper below splits a batch on
+    // this mark, never on the wording of the refusal.
+    const perCallRefusals = new WeakSet();
+    const callRefusal = (feedback) => {
+        const decision = { action: 'reject_tools', feedback };
+        perCallRefusals.add(decision);
+        return decision;
+    };
+    const decide = async (request, context, classified = false) => {
         if (request.type !== 'tool_review') {
             return request.type === 'plan_approval' ? { action: 'approve_plan' } : { action: 'continue' };
         }
@@ -779,7 +840,7 @@ export function createReviewHandler(options = {}) {
             };
             const live = request.toolCalls.filter((tc) => tc.authorization?.decision !== 'deny');
             const escapes = live.filter((tc) => tc.escalation?.sandboxEscape === true).map((tc) => tc.id);
-            if (mode === 'classify') {
+            if (mode === 'classify' && !classified) {
                 const classifier = options.classifier;
                 const transcript = context?.transcript() ?? [];
                 for (const tc of live) {
@@ -834,7 +895,7 @@ export function createReviewHandler(options = {}) {
             if (!prompt) {
                 const refusal = immuneRefusal(live, options.unattendedSandboxEscape === 'allow');
                 if (refusal !== undefined)
-                    return { action: 'reject_tools', feedback: refusal };
+                    return callRefusal(refusal);
                 return {
                     action: 'approve_tools',
                     ...(escapes.length > 0 ? { confirmedEscalations: escapes } : {}),
@@ -854,22 +915,22 @@ export function createReviewHandler(options = {}) {
         if (escapes.length > 0) {
             if (!prompt) {
                 if (options.unattendedSandboxEscape !== 'allow') {
-                    return { action: 'reject_tools', feedback: SANDBOX_ESCAPE_UNATTENDED_REFUSAL };
+                    return callRefusal(SANDBOX_ESCAPE_UNATTENDED_REFUSAL);
                 }
                 // This opt-in confirms only the sandbox escape. A different call in
                 // the batch, or another boundary on this same call, still needs a
                 // person; the early return must not approve that boundary too.
                 if (request.toolCalls.some(reachesAFloor)) {
-                    return { action: 'reject_tools', feedback: floorRefusal(request.toolCalls) };
+                    return callRefusal(floorRefusal(request.toolCalls));
                 }
                 if (request.toolCalls.some((tc) => (tc.escalation?.outsidePaths?.length ?? 0) > 0)) {
-                    return { action: 'reject_tools', feedback: OUTSIDE_ROOTS_UNATTENDED_REFUSAL };
+                    return callRefusal(outsideRootsRefusal(request.toolCalls));
                 }
                 if (request.toolCalls.some((tc) => tc.requiresApproval === true)) {
-                    return { action: 'reject_tools', feedback: REQUIRES_APPROVAL_UNATTENDED_REFUSAL };
+                    return callRefusal(REQUIRES_APPROVAL_UNATTENDED_REFUSAL);
                 }
                 if (request.toolCalls.some((tc) => tc.escalation?.unknownProgram !== undefined)) {
-                    return { action: 'reject_tools', feedback: UNKNOWN_PROGRAM_UNATTENDED_REFUSAL };
+                    return callRefusal(UNKNOWN_PROGRAM_UNATTENDED_REFUSAL);
                 }
                 return { action: 'approve_tools', confirmedEscalations: escapes };
             }
@@ -894,7 +955,7 @@ export function createReviewHandler(options = {}) {
         // the call existed. With nobody to ask it is refused, not approved.
         if (request.toolCalls.some(reachesAFloor)) {
             if (!prompt)
-                return { action: 'reject_tools', feedback: floorRefusal(request.toolCalls) };
+                return callRefusal(floorRefusal(request.toolCalls));
             const answer = await ask();
             if (answer.kind === 'reject') {
                 return {
@@ -915,7 +976,7 @@ export function createReviewHandler(options = {}) {
         // With nobody to ask it is refused, not approved.
         if (request.toolCalls.some((tc) => (tc.escalation?.outsidePaths?.length ?? 0) > 0)) {
             if (!prompt)
-                return { action: 'reject_tools', feedback: OUTSIDE_ROOTS_UNATTENDED_REFUSAL };
+                return callRefusal(outsideRootsRefusal(request.toolCalls));
             const answer = await ask();
             if (answer.kind === 'reject') {
                 return {
@@ -938,7 +999,7 @@ export function createReviewHandler(options = {}) {
         // grant was ever an answer to IT specifically.
         if (request.toolCalls.some((tc) => tc.requiresApproval === true)) {
             if (!prompt)
-                return { action: 'reject_tools', feedback: REQUIRES_APPROVAL_UNATTENDED_REFUSAL };
+                return callRefusal(REQUIRES_APPROVAL_UNATTENDED_REFUSAL);
             const answer = await ask();
             if (answer.kind === 'reject') {
                 return {
@@ -961,7 +1022,7 @@ export function createReviewHandler(options = {}) {
         // name literally.
         if (request.toolCalls.some((tc) => tc.escalation?.unknownProgram !== undefined)) {
             if (!prompt)
-                return { action: 'reject_tools', feedback: UNKNOWN_PROGRAM_UNATTENDED_REFUSAL };
+                return callRefusal(UNKNOWN_PROGRAM_UNATTENDED_REFUSAL);
             const answer = await ask();
             if (answer.kind === 'reject') {
                 return {
@@ -975,7 +1036,10 @@ export function createReviewHandler(options = {}) {
                 remembered.all = true;
             return { action: 'approve_tools' };
         }
-        if (mode === 'auto' || !prompt || remembered.all) {
+        // A remembered "approve all" answers ordinary calls. A call a rule or a
+        // hook asked a person about exists to put its own question, which the
+        // latch was never an answer to (`mustAskPerson`): it goes on to ask.
+        if (mode === 'auto' || !prompt || (remembered.all && !request.toolCalls.some(mustAskPerson))) {
             return { action: 'approve_tools' };
         }
         // Every call a person would be asked about is one a skill loaded in
@@ -1006,7 +1070,11 @@ export function createReviewHandler(options = {}) {
             case 'approve':
                 return { action: 'approve_tools' };
             case 'approve-all':
-                remembered.all = true;
+                // A rule's or a hook's question was put to this person once; an
+                // "approve all" to it approves it and leaves the latch as it was,
+                // as the ACP bridge does.
+                if (!request.toolCalls.some(mustAskPerson))
+                    remembered.all = true;
                 return { action: 'approve_tools' };
             case 'reject':
                 return {
@@ -1017,6 +1085,53 @@ export function createReviewHandler(options = {}) {
                 };
         }
     };
+    // With nobody to ask, a refusal that belongs to one call is that call's
+    // alone. The batch is not refused for it: each call is decided on its own,
+    // the ones that pass run, and the one that does not gets its own reason.
+    // Without this a single stray path in a parallel batch costs the turn every
+    // other call in it.
+    return async (request, context) => {
+        const whole = await decide(request, context);
+        if (whole.action !== 'reject_tools' ||
+            prompt ||
+            request.type !== 'tool_review' ||
+            request.toolCalls.length < 2 ||
+            !perCallRefusals.has(whole)) {
+            return whole;
+        }
+        // The whole-batch pass has already put every call to the classifier (it
+        // refuses only after all of them were allowed), so the per-call passes do
+        // not ask it again. One at a time: no pass races another on shared state.
+        const alone = [];
+        for (const tc of request.toolCalls) {
+            alone.push(await decide({ ...request, toolCalls: [tc] }, context, true));
+        }
+        const modifications = [];
+        const policyRefusals = {};
+        const confirmed = [];
+        for (const [i, decision] of alone.entries()) {
+            const id = request.toolCalls[i].id;
+            if (decision.action === 'approve_tools') {
+                modifications.push({ toolCallId: id, action: 'approve' });
+                confirmed.push(...(decision.confirmedEscalations ?? []));
+            }
+            else if (decision.action === 'reject_tools' && !decision.endTurn && !decision.declined) {
+                modifications.push({ toolCallId: id, action: 'deny' });
+                policyRefusals[id] = decision.feedback;
+            }
+            else {
+                return whole;
+            }
+        }
+        if (Object.keys(policyRefusals).length === 0)
+            return whole;
+        return {
+            action: 'modify_tools',
+            modifications,
+            policyRefusals,
+            ...(confirmed.length > 0 ? { confirmedEscalations: confirmed } : {}),
+        };
+    };
 }
 /**
  * The mode as an `ApprovalPolicy`, named after itself so a durable log can