@orkestrel/agent 0.0.42 → 0.0.44

package/dist/src/core/index.d.cts

@@ -40,6 +40,7 @@ import type { ToolManagerInterface } from '@orkestrel/tool';
 import type { ToolOptions } from '@orkestrel/tool';
 import type { ToolResult } from '@orkestrel/tool';
 import { UnionShape } from '@orkestrel/contract';
+import type { WorkspaceInterface } from '@orkestrel/workspace';
 import type { WorkspaceManagerInterface } from '@orkestrel/workspace';
 
 /**
@@ -155,6 +156,25 @@ approved: BooleanShape;
  */
 export declare type AgentBuiltin = 'load' | 'unload' | 'memo' | 'remember' | 'switch';
 
+/**
+ * Carries what an agent run hands each tool call as `ToolContext.caller`: the workspace the run acts
+ * on and the paths it reaches there.
+ *
+ * @remarks
+ * The agent builds one for each call as the call starts, from the view of the request the model
+ * answered and the ceiling at that moment, the context scope intersected with the run scope. Both
+ * keys are always present, so a run that shows no workspace or states no `files` list says so with
+ * `undefined` rather than an omitted member. `ToolContext.caller` is unverified by contract and can
+ * reach a handler from a wire, so read it through {@link isAgentCaller} and accept its `workspace`
+ * only as the very instance your own registry holds under that id.
+ */
+export declare interface AgentCaller {
+    /** Holds the workspace the run acts on: the one the turn's request rendered, while the ceiling admits it at the call. */
+    readonly workspace: WorkspaceInterface | undefined;
+    /** Lists the paths the run reaches in that workspace: the live ceiling's `files` list at the call (`undefined` ⇒ every path, `[]` ⇒ none). */
+    readonly files: readonly string[] | undefined;
+}
+
 /**
  * Represents a streamed step of an agent turn — the union the loop yields as it runs, discriminated
  * by the `category` of step it carries, and the pull surface beside the push {@link AgentEventMap}.
@@ -988,7 +1008,7 @@ category: LiteralShape<readonly ["error"]>;
  *   judge, a tool handler, and a selection handler are awaited until they settle, because each can
  *   carry usage or finished work, so one that ignores its signal holds the run past a cancel or a
  *   timeout, and on a ledger its held scan, until it returns.
- *   The agent supplies no caller identity.
+ *   Each call's `ToolContext.caller` is an {@link AgentCaller}.
  * - **Paced + capped.** The `scheduler` (when given) yields between turns; tool
  *   iteration is capped at `limit` so the loop always terminates.
  * - **Two observation surfaces.** Pull: the {@link AgentChunk} stream (`stream().events`)
@@ -7259,6 +7279,29 @@ export declare const INVALID_RELAY_STATUS = 400;
  */
 export declare function isAgentBuiltin(value: unknown): value is AgentBuiltin;
 
+/**
+ * Checks whether a value is an agent caller: a plain record whose own keys are exactly `workspace`
+ * and `files`, whose `workspace` is `undefined` or an object, and whose `files` is `undefined` or an
+ * array of strings.
+ *
+ * @remarks
+ * Total: each member is read once, and an omitted, inherited, or undeclared member, a throwing
+ * accessor, and a revoked `Proxy` return false rather than throw. It checks the shape a caller
+ * carries, never that `workspace` is a live workspace: a value that crossed a wire passes when it
+ * holds that shape, so accept its `workspace` only as the very instance your own registry holds
+ * under that id.
+ *
+ * @param value - The unknown caller candidate, such as `ToolContext.caller`
+ * @returns True if the value satisfies the caller contract; false otherwise
+ *
+ * @example
+ * ```ts
+ * isAgentCaller({ workspace: undefined, files: undefined }) // true
+ * isAgentCaller({ workspace: 'returns' }) // false
+ * ```
+ */
+export declare function isAgentCaller(value: unknown): value is AgentCaller;
+
 /**
  * Narrows an unknown caught value to an {@link AgentError} through its identity brand and declared members, so a `catch`
  * can branch on its `code`.
@@ -13105,6 +13148,30 @@ export declare function resolveDisclosure(context: AgentContextInterface, conver
  */
 export declare function resolvePredict(predict: number | undefined, capacity: number): number;
 
+/**
+ * Resolves the workspace a run renders and acts on: the one `selected` names, else the registry's
+ * active one, kept only while `allowed` admits its id.
+ *
+ * @remarks
+ * A selection the registry does not hold resolves to `undefined` and never falls back to the active
+ * workspace. `allowed` is three-way, as {@link import('../helpers.js').filterAllowList} reads it.
+ * `AgentContext.build`, the caller an agent run hands each tool call, and a ledger's calibration
+ * resolve through it, so what a request renders and what a call receives come from one rule.
+ *
+ * @param workspaces - The workspace registry to read
+ * @param selected - The id a `switch` call or the `workspace` option selected, or `undefined`
+ * @param allowed - The ceiling's `workspaces` list (`undefined` ⇒ every id, `[]` ⇒ none)
+ * @returns The workspace, or `undefined` when none resolves
+ *
+ * @example
+ * ```ts
+ * import { resolveWorkspace } from '@orkestrel/agent'
+ *
+ * resolveWorkspace(agent.context.workspaces, 'returns', ['returns']) // the registered returns workspace
+ * ```
+ */
+export declare function resolveWorkspace(workspaces: WorkspaceManagerInterface, selected: string | undefined, allowed: readonly string[] | undefined): WorkspaceInterface | undefined;
+
 /** Lists the members `AgentRunnerOptions` declares, frozen — the keys `createAgentRunner` admits. */
 export declare const RUNNER_OPTION_KEYS: readonly ["registry", "partial", "concurrency", "retries", "timeout"];
 
@@ -13320,7 +13387,9 @@ export declare const SCOPE_NOTE = "it is not one of the listed tools. Use a list
  * message and the image files attached to the last user message — and `workspaces` decides
  * whether that workspace renders at all. Two lists bound a write as well as a read: the
  * `remember` built-in writes only a name a defined `memos` list holds, and the `switch` built-in
- * selects only an id a defined `workspaces` list holds.
+ * selects only an id a defined `workspaces` list holds. The `files` list also bounds the workspace
+ * tool of `@orkestrel/toolbox`, which receives it as `caller.files`, an
+ * {@link import('../agents/types.js').AgentCaller} member.
  */
 export declare interface ScopeFilter {
     /** Lists the allowed instruction names matched against the `name` property (`undefined` ⇒ all, `[]` ⇒ none, else only-listed). */
@@ -13343,7 +13412,8 @@ export declare interface ScopeFilter {
      * Lists the allowed active-workspace file paths matched against the `path` property (`undefined` ⇒ all, `[]` ⇒ none, else only-listed) —
      * the filter {@link AgentContextInterface.build} applies to the rendered workspace's
      * {@link import('@orkestrel/workspace').WorkspaceInterface.files} before rendering them (text → the context message, image →
-     * the last user message).
+     * the last user message). Each tool call receives the list as `caller.files`, and the workspace
+     * tool of `@orkestrel/toolbox` reaches the listed paths alone.
      */
     readonly files?: readonly string[];
     /**

package/dist/src/core/index.d.ts

@@ -40,6 +40,7 @@ import type { ToolManagerInterface } from '@orkestrel/tool';
 import type { ToolOptions } from '@orkestrel/tool';
 import type { ToolResult } from '@orkestrel/tool';
 import { UnionShape } from '@orkestrel/contract';
+import type { WorkspaceInterface } from '@orkestrel/workspace';
 import type { WorkspaceManagerInterface } from '@orkestrel/workspace';
 
 /**
@@ -155,6 +156,25 @@ approved: BooleanShape;
  */
 export declare type AgentBuiltin = 'load' | 'unload' | 'memo' | 'remember' | 'switch';
 
+/**
+ * Carries what an agent run hands each tool call as `ToolContext.caller`: the workspace the run acts
+ * on and the paths it reaches there.
+ *
+ * @remarks
+ * The agent builds one for each call as the call starts, from the view of the request the model
+ * answered and the ceiling at that moment, the context scope intersected with the run scope. Both
+ * keys are always present, so a run that shows no workspace or states no `files` list says so with
+ * `undefined` rather than an omitted member. `ToolContext.caller` is unverified by contract and can
+ * reach a handler from a wire, so read it through {@link isAgentCaller} and accept its `workspace`
+ * only as the very instance your own registry holds under that id.
+ */
+export declare interface AgentCaller {
+    /** Holds the workspace the run acts on: the one the turn's request rendered, while the ceiling admits it at the call. */
+    readonly workspace: WorkspaceInterface | undefined;
+    /** Lists the paths the run reaches in that workspace: the live ceiling's `files` list at the call (`undefined` ⇒ every path, `[]` ⇒ none). */
+    readonly files: readonly string[] | undefined;
+}
+
 /**
  * Represents a streamed step of an agent turn — the union the loop yields as it runs, discriminated
  * by the `category` of step it carries, and the pull surface beside the push {@link AgentEventMap}.
@@ -988,7 +1008,7 @@ category: LiteralShape<readonly ["error"]>;
  *   judge, a tool handler, and a selection handler are awaited until they settle, because each can
  *   carry usage or finished work, so one that ignores its signal holds the run past a cancel or a
  *   timeout, and on a ledger its held scan, until it returns.
- *   The agent supplies no caller identity.
+ *   Each call's `ToolContext.caller` is an {@link AgentCaller}.
  * - **Paced + capped.** The `scheduler` (when given) yields between turns; tool
  *   iteration is capped at `limit` so the loop always terminates.
  * - **Two observation surfaces.** Pull: the {@link AgentChunk} stream (`stream().events`)
@@ -7259,6 +7279,29 @@ export declare const INVALID_RELAY_STATUS = 400;
  */
 export declare function isAgentBuiltin(value: unknown): value is AgentBuiltin;
 
+/**
+ * Checks whether a value is an agent caller: a plain record whose own keys are exactly `workspace`
+ * and `files`, whose `workspace` is `undefined` or an object, and whose `files` is `undefined` or an
+ * array of strings.
+ *
+ * @remarks
+ * Total: each member is read once, and an omitted, inherited, or undeclared member, a throwing
+ * accessor, and a revoked `Proxy` return false rather than throw. It checks the shape a caller
+ * carries, never that `workspace` is a live workspace: a value that crossed a wire passes when it
+ * holds that shape, so accept its `workspace` only as the very instance your own registry holds
+ * under that id.
+ *
+ * @param value - The unknown caller candidate, such as `ToolContext.caller`
+ * @returns True if the value satisfies the caller contract; false otherwise
+ *
+ * @example
+ * ```ts
+ * isAgentCaller({ workspace: undefined, files: undefined }) // true
+ * isAgentCaller({ workspace: 'returns' }) // false
+ * ```
+ */
+export declare function isAgentCaller(value: unknown): value is AgentCaller;
+
 /**
  * Narrows an unknown caught value to an {@link AgentError} through its identity brand and declared members, so a `catch`
  * can branch on its `code`.
@@ -13105,6 +13148,30 @@ export declare function resolveDisclosure(context: AgentContextInterface, conver
  */
 export declare function resolvePredict(predict: number | undefined, capacity: number): number;
 
+/**
+ * Resolves the workspace a run renders and acts on: the one `selected` names, else the registry's
+ * active one, kept only while `allowed` admits its id.
+ *
+ * @remarks
+ * A selection the registry does not hold resolves to `undefined` and never falls back to the active
+ * workspace. `allowed` is three-way, as {@link import('../helpers.js').filterAllowList} reads it.
+ * `AgentContext.build`, the caller an agent run hands each tool call, and a ledger's calibration
+ * resolve through it, so what a request renders and what a call receives come from one rule.
+ *
+ * @param workspaces - The workspace registry to read
+ * @param selected - The id a `switch` call or the `workspace` option selected, or `undefined`
+ * @param allowed - The ceiling's `workspaces` list (`undefined` ⇒ every id, `[]` ⇒ none)
+ * @returns The workspace, or `undefined` when none resolves
+ *
+ * @example
+ * ```ts
+ * import { resolveWorkspace } from '@orkestrel/agent'
+ *
+ * resolveWorkspace(agent.context.workspaces, 'returns', ['returns']) // the registered returns workspace
+ * ```
+ */
+export declare function resolveWorkspace(workspaces: WorkspaceManagerInterface, selected: string | undefined, allowed: readonly string[] | undefined): WorkspaceInterface | undefined;
+
 /** Lists the members `AgentRunnerOptions` declares, frozen — the keys `createAgentRunner` admits. */
 export declare const RUNNER_OPTION_KEYS: readonly ["registry", "partial", "concurrency", "retries", "timeout"];
 
@@ -13320,7 +13387,9 @@ export declare const SCOPE_NOTE = "it is not one of the listed tools. Use a list
  * message and the image files attached to the last user message — and `workspaces` decides
  * whether that workspace renders at all. Two lists bound a write as well as a read: the
  * `remember` built-in writes only a name a defined `memos` list holds, and the `switch` built-in
- * selects only an id a defined `workspaces` list holds.
+ * selects only an id a defined `workspaces` list holds. The `files` list also bounds the workspace
+ * tool of `@orkestrel/toolbox`, which receives it as `caller.files`, an
+ * {@link import('../agents/types.js').AgentCaller} member.
  */
 export declare interface ScopeFilter {
     /** Lists the allowed instruction names matched against the `name` property (`undefined` ⇒ all, `[]` ⇒ none, else only-listed). */
@@ -13343,7 +13412,8 @@ export declare interface ScopeFilter {
      * Lists the allowed active-workspace file paths matched against the `path` property (`undefined` ⇒ all, `[]` ⇒ none, else only-listed) —
      * the filter {@link AgentContextInterface.build} applies to the rendered workspace's
      * {@link import('@orkestrel/workspace').WorkspaceInterface.files} before rendering them (text → the context message, image →
-     * the last user message).
+     * the last user message). Each tool call receives the list as `caller.files`, and the workspace
+     * tool of `@orkestrel/toolbox` reaches the listed paths alone.
      */
     readonly files?: readonly string[];
     /**

package/dist/src/core/index.js

@@ -1,4 +1,4 @@
-import { ContractError, INTRINSICS, admitValue, arrayOf, arrayShape, attempt, booleanShape, boundsOf, canonicalStringify, cloneJSONValue, createContract, describeFaults, errorToMessage, failure, holds, integerShape, isArray, isBoolean, isError, isFiniteNumber, isFunction, isJSONValue, isNumber, isObject, isPromiseLike, isRecord, isString, jsonShape, literalOf, literalShape, nullableOf, nullableShape, numberShape, objectOf, objectShape, optionalOf, optionalShape, parseJSON, parseJSONAs, parseJSONValue, preview, rawShape, recordOf, recordShape, refuseOptionKeys, schemaToParameters, schemaToShape, stringShape, success, unionOf, unionShape } from "@orkestrel/contract";
+import { ContractError, INTRINSICS, admitValue, arrayOf, arrayShape, attempt, booleanShape, boundsOf, canonicalStringify, cloneJSONValue, createContract, describeFaults, errorToMessage, failure, holds, integerShape, isArray, isBoolean, isError, isFiniteNumber, isFunction, isJSONValue, isNumber, isObject, isPromiseLike, isRecord, isString, jsonShape, literalOf, literalShape, matchesExactKeys, nullableOf, nullableShape, numberShape, objectOf, objectShape, optionalOf, optionalShape, parseJSON, parseJSONAs, parseJSONValue, preview, rawShape, recordOf, recordShape, refuseOptionKeys, schemaToParameters, schemaToShape, stringShape, success, unionOf, unionShape } from "@orkestrel/contract";
 import { createTokenBudget, createTokenMeter, isBudget, isBudgetAmount, isBudgetError, isTokenUsage } from "@orkestrel/budget";
 import { ToolError, ToolManager, createTool, createToolManager, isToolCall, isToolError } from "@orkestrel/tool";
 import { createNDJSONParser } from "@orkestrel/ndjson";
@@ -5227,6 +5227,32 @@ function intersectFilters(parent, child) {
 	};
 }
 /**
+* Resolves the workspace a run renders and acts on: the one `selected` names, else the registry's
+* active one, kept only while `allowed` admits its id.
+*
+* @remarks
+* A selection the registry does not hold resolves to `undefined` and never falls back to the active
+* workspace. `allowed` is three-way, as {@link import('../helpers.js').filterAllowList} reads it.
+* `AgentContext.build`, the caller an agent run hands each tool call, and a ledger's calibration
+* resolve through it, so what a request renders and what a call receives come from one rule.
+*
+* @param workspaces - The workspace registry to read
+* @param selected - The id a `switch` call or the `workspace` option selected, or `undefined`
+* @param allowed - The ceiling's `workspaces` list (`undefined` ⇒ every id, `[]` ⇒ none)
+* @returns The workspace, or `undefined` when none resolves
+*
+* @example
+* ```ts
+* import { resolveWorkspace } from '@orkestrel/agent'
+*
+* resolveWorkspace(agent.context.workspaces, 'returns', ['returns']) // the registered returns workspace
+* ```
+*/
+function resolveWorkspace(workspaces, selected, allowed) {
+	const workspace = selected === void 0 ? workspaces.active : workspaces.workspace(selected);
+	return workspace !== void 0 && filterAllowList(allowed, [workspace.id], (id) => id).length > 0 ? workspace : void 0;
+}
+/**
 * Renders one index line for a memo or a skill — `- name: description`, the built-in `render` of
 * the memo and skill managers.
 *
@@ -6282,10 +6308,8 @@ var AgentContext = class {
 			return skill === void 0 || skill.content.trim() === "" ? [] : [skill];
 		}), renderSkillBody, void 0);
 		if (bodies !== void 0) parts.push(bodies);
-		const selected = options?.disclosure?.workspace;
-		const workspace = selected === void 0 ? this.#workspaces.active : this.#workspaces.workspace(selected);
-		const shown = filterAllowList(scope.workspaces, workspace === void 0 ? [] : [workspace], (one) => one.id);
-		const files = filterAllowList(scope.files, shown.flatMap((one) => one.files()), (one) => one.path);
+		const workspace = resolveWorkspace(this.#workspaces, options?.disclosure?.workspace, scope.workspaces);
+		const files = filterAllowList(scope.files, workspace?.files() ?? [], (one) => one.path);
 		const documented = renderSection(WORKSPACE_SECTION_HEADER, files.flatMap((file) => isTextContent(file.content) ? [{
 			path: file.path,
 			language: file.content.language,
@@ -7252,6 +7276,35 @@ function isAuthorityDecision(value) {
 		reason: isString
 	}, ["reason"])(value);
 }
+/**
+* Checks whether a value is an agent caller: a plain record whose own keys are exactly `workspace`
+* and `files`, whose `workspace` is `undefined` or an object, and whose `files` is `undefined` or an
+* array of strings.
+*
+* @remarks
+* Total: each member is read once, and an omitted, inherited, or undeclared member, a throwing
+* accessor, and a revoked `Proxy` return false rather than throw. It checks the shape a caller
+* carries, never that `workspace` is a live workspace: a value that crossed a wire passes when it
+* holds that shape, so accept its `workspace` only as the very instance your own registry holds
+* under that id.
+*
+* @param value - The unknown caller candidate, such as `ToolContext.caller`
+* @returns True if the value satisfies the caller contract; false otherwise
+*
+* @example
+* ```ts
+* isAgentCaller({ workspace: undefined, files: undefined }) // true
+* isAgentCaller({ workspace: 'returns' }) // false
+* ```
+*/
+function isAgentCaller(value) {
+	return holds(() => {
+		if (!isRecord(value) || !matchesExactKeys(value, ["workspace", "files"])) return false;
+		const workspace = value.workspace;
+		const files = value.files;
+		return (workspace === void 0 || isObject(workspace)) && (files === void 0 || arrayOf(isString)(files));
+	});
+}
 // src/core/agents/helpers.ts
 /**
 * Projects an unknown value onto a fresh, exact `JSONValue` representation of an
@@ -8616,6 +8669,7 @@ function collectDisclosure(conversation, builtins) {
 * registers under a built-in's name is never read: `tool` and `execute` answer a built-in's name
 * from the run's manager and every other name from the host's. Each handler reads the ceiling when
 * it runs, the context scope intersected with the run scope at that moment, never a turn's copy.
+* The `caller` each call receives reads the ceiling the same way, as the call starts.
 */
 var AgentRun = class {
 	#context;
@@ -8628,6 +8682,7 @@ var AgentRun = class {
 	#ceiling = {};
 	#shown = { skills: [] };
 	#ids = [];
+	#files = [];
 	#advertised = [];
 	#snapshot;
 	#selection;
@@ -8711,6 +8766,31 @@ var AgentRun = class {
 		return this.#advertised.some((definition) => definition.name === "switch");
 	}
 	/**
+	* Returns what a tool call receives as `ToolContext.caller`: the workspace instance the working
+	* head rendered, kept only while the ceiling at this moment admits its id, and that ceiling's
+	* `files` list.
+	*
+	* @remarks
+	* The instance is the one the head's build resolved, never the registry's `active` pointer at the
+	* call, so a host's `switch` made while the provider answers reaches the next turn's head and not
+	* this call. Each read of this getter reads the `workspaces` and `files` lists of the context
+	* scope and the run scope one time each, and no other list, so a call reads them as it starts, a
+	* narrowing made after the turn's decision reaches that call, and a turn still reads its `tools`
+	* list once.
+	*
+	* @returns A fresh caller
+	*/
+	get caller() {
+		const outer = this.#context.scope;
+		const inner = this.#scope;
+		const rendered = this.#head?.rendered;
+		const [workspace] = filterAllowList(intersectKeys(outer?.workspaces, inner?.workspaces), rendered === void 0 ? [] : [rendered], (one) => one.id);
+		return {
+			workspace,
+			files: intersectKeys(outer?.files, inner?.files)
+		};
+	}
+	/**
 	* Returns the selection the working head rendered.
 	*
 	* @returns The selection, or undefined before the first build
@@ -8734,8 +8814,10 @@ var AgentRun = class {
 	* `load`, `unload`, or `switch` is enabled, and only the records of an enabled built-in count.
 	* Registered skills hold their tools back only while `load` is enabled. The view compared with
 	* the working head's is the ceiling's `instructions`, `skills`, `memos`, `files`, and
-	* `workspaces` lists, the shown skills by id, the shown workspace, and whether `switch` is
-	* advertised.
+	* `workspaces` lists, the shown skills by id, the shown workspace, the files that workspace
+	* renders under the ceiling's `files` list, compared by identity, and whether `switch` is
+	* advertised. An edit to a rendered file, by a tool or by the host, therefore makes the head
+	* stale, and an edit to a file no build renders does not.
 	*
 	* @returns True if the working head was built with another view and must be rebuilt; false otherwise
 	*/
@@ -8750,13 +8832,19 @@ var AgentRun = class {
 		this.#ceiling = ceiling;
 		this.#shown = shown;
 		this.#ids = shown.skills.flatMap((name) => this.#context.skills.skill(name)?.id ?? []);
+		this.#files = filterAllowList(ceiling.files, resolveWorkspace(this.#context.workspaces, shown.workspace, ceiling.workspaces)?.files() ?? [], (file) => file.path);
 		this.#advertised = filterAdvertisedTools(this.#candidates(ceiling), ceiling.tools, this.#builtins.has("load") ? this.#context.skills.skills() : [], shown.skills);
 		const head = this.#head;
-		return head === void 0 || !matchesHeadLists(head.ceiling, ceiling) || head.ids.length !== this.#ids.length || head.ids.some((id, index) => id !== this.#ids[index]) || head.workspace !== shown.workspace || head.switchable !== this.switchable;
+		return head === void 0 || !matchesHeadLists(head.ceiling, ceiling) || head.ids.length !== this.#ids.length || head.ids.some((id, index) => id !== this.#ids[index]) || head.workspace !== shown.workspace || head.switchable !== this.switchable || head.files.length !== this.#files.length || head.files.some((file, index) => file !== this.#files[index]);
 	}
 	/**
-	* Records what the working head was built with: the selection, the built array's length, and
-	* the view the last `observe` resolved.
+	* Records what the working head was built with: the selection, the built array's length, the
+	* view the last `observe` resolved, and the workspace instance the build rendered.
+	*
+	* @remarks
+	* Call it right after the build: it resolves the rendered workspace from the inputs the build
+	* read, the shown workspace and the context scope's `workspaces` list intersected with the
+	* snapshot's.
 	*
 	* @param selection - The selection the build rendered
 	* @param length - The length of the built array
@@ -8768,7 +8856,9 @@ var AgentRun = class {
 			ceiling: this.#ceiling,
 			ids: this.#ids,
 			workspace: this.#shown.workspace,
-			switchable: this.switchable
+			switchable: this.switchable,
+			files: this.#files,
+			rendered: resolveWorkspace(this.#context.workspaces, this.#shown.workspace, intersectKeys(this.#context.scope?.workspaces, this.#snapshot?.workspaces))
 		};
 	}
 	/**
@@ -9673,7 +9763,10 @@ var Agent = class {
 		const { allowed, denials } = authorization;
 		const entries = [...allowed].sort(([left], [right]) => left - right);
 		const started = entries.map(([, { call, tool }]) => {
-			if (!this.#changed(run, call, tool, advertised)) return run.execute(call, { signal });
+			if (!this.#changed(run, call, tool, advertised)) return run.execute(call, {
+				signal,
+				caller: run.caller
+			});
 			this.#emitter.emit("deny", call, `${call.name} changed after its decision`, void 0);
 			return denyCall(call, AUTHORITY_NOTES.denied);
 		});
@@ -13674,8 +13767,7 @@ var Ledger = class {
 	async #measureScale(head, bare, signal) {
 		const rate = bare / estimateMessages(head);
 		const workspace = this.#show(intersectFilters(this.#agent.context.scope, void 0)).workspace;
-		const workspaces = this.#agent.context.workspaces;
-		const files = ((workspace === void 0 ? workspaces.active : workspaces.workspace(workspace))?.files() ?? []).flatMap((file) => isTextContent(file.content) ? [file.path] : []);
+		const files = (resolveWorkspace(this.#agent.context.workspaces, workspace, void 0)?.files() ?? []).flatMap((file) => isTextContent(file.content) ? [file.path] : []);
 		const shown = this.#agent.context.build({
 			selection: {
 				messages: [],
@@ -14721,6 +14813,6 @@ var Ledger = class {
 function createLedger(provider, options) {
 	return new Ledger(provider, options);
 }
-export { AGENT_OPTION_KEYS, AGENT_RUN_KEYS, ARGUMENT_BLANK_PATTERN, ARGUMENT_CONTROL_PATTERN, AUTHORITY_NOTES, AUTHORITY_OPTION_KEYS, Agent, AgentContext, AgentError, AgentFanout, AgentJobError, AgentJudge, AgentProvider, AgentRegistry, Approver, Authority, BUILD_OPTION_KEYS, BUILTIN_LIMITS, BUILTIN_NOTES, BUILTIN_TOOLS, CLASSIFIER_OPTION_KEYS, COMPACT_OPTION_KEYS, CONTEXT_OPTION_KEYS, CONVERSATION_INPUT_KEYS, CONVERSATION_MANAGER_KEYS, CONVERSATION_OPTION_KEYS, CONVERSATION_RECAP_PREFIX, CONVERSATION_ROLES, Channel, Classifier, ContextError, Conversation, ConversationError, ConversationManager, DECISIVE_CATEGORIES, DEFAULT_AGENT_LIMIT, DEFAULT_CONVERSATION_KEEP, DEFAULT_LEDGER_LIMIT, DEFAULT_LEDGER_SHARE, DEFAULT_PROVIDER_TIMEOUT, DEFAULT_RECALL_LIMIT, DEFAULT_RELAY_LIMIT, DETERMINISTIC_JUDGE_ERROR, DatabaseConversationStore, DatabaseMemoStore, GAUGE_OPTION_KEYS, Gauge, IMAGE_TOKEN_ESTIMATE, INSTRUCTION_MANAGER_KEYS, INVALID_RELAY_STATUS, Instruction, InstructionManager, JOB_REFUSAL_PREFIX, JUDGE_INPUT_KEYS, JudgeAbortError, JudgeError, JudgmentManager, LEDGER_AGENT_KEYS, LEDGER_CATEGORIES, LEDGER_NOTES, LEDGER_OPTION_KEYS, LEDGER_OWNER_PREFIX, LEDGER_QUESTIONS, LEDGER_RECALL_LABELS, LEDGER_RULES_KEY, LEDGER_SAMPLE_BYTES, LEDGER_SCALE_DRIFT, LEDGER_SLICE, LEDGER_WORD, LOADED_SECTION_HEADER, Ledger, LedgerError, LedgerRequest, MAX_ERROR_BODY_LENGTH, MEMO_MANAGER_KEYS, MEMO_SECTION_HEADER, MESSAGE_ROLES, MESSAGE_TOKEN_OVERHEAD, MemoManager, MemoryConversationStore, MemoryMemoStore, OVERSIZED_RELAY_STATUS, PLACED_CATEGORIES, PROVIDER_INPUT_KEYS, ProviderAbortError, ProviderError, QUEUE_OPTION_KEYS, QUIET_CATEGORIES, REFERENCE_OPTION_KEYS, REFUSED_RELAY_CONTENT_TYPE, REFUSED_RELAY_STATUS, REGISTRY_OPTION_KEYS, RELAY_CONTENT_TYPE, RELAY_OPTION_KEYS, RELAY_PROVIDER_KEYS, RELAY_PROVIDER_MESSAGE, RELAY_STREAM_KEYS, RUNNER_OPTION_KEYS, RelayProvider, RelayStream, SCOPE_FILTER_KEYS, SCOPE_KEYS, SCOPE_MANAGER_KEYS, SCOPE_NOTE, SKILL_MANAGER_KEYS, SKILL_SECTION_HEADER, STREAM_OPTION_KEYS, SYSTEM_ONE_OPTION_KEYS, SYSTEM_ONE_PATH, Scope, ScopeManager, SkillManager, SystemOneJudge, THINK_CLOSE, THINK_OPEN, ThinkSplitter, UNAUTHORIZED_RELAY_STATUS, UPSTREAM_RELAY_STATUS, WORKSPACE_INDEX_HEADER, WORKSPACE_SECTION_HEADER, agentAnswerContract, agentAnswerShape, agentChunkToFrame, agentFrameContract, agentFrameShape, agentJobContract, agentJobShape, agentPromptContract, agentPromptShape, agentResultToFrame, agentResultToJSON, agentStreamToFrames, armReaderAbort, assembleResult, attachImages, attachUserImages, buildJudgeResult, buildJudgments, buildLedgerCut, buildLedgerIndex, buildLedgerLineKey, buildLedgerRenderContext, buildLines, buildProviderHeaders, buildProviderResult, buildRecallMessage, buildRecapMessage, buildRecords, buildRelayRequest, buildRequestMessage, buildSummaryMessage, builtinToolContracts, chargeUsage, collectAmendments, collectBuiltinDefinitions, collectDisclosure, collectExchanges, collectImageData, collectJobRefusals, collectLedgerEvidence, collectLedgerLines, collectLedgerReplies, collectLive, collectNames, collectProjectionIds, collectRecallMessages, collectRegistry, collectRetiredFindings, collectToolGroups, collectWriteSupersessions, computeLedgerChecksum, computeSkillPrice, computeThinking, computeToolDensity, computeToolPrice, conversationSnapshotContract, conversationSnapshotShape, copyJSON, createAgent, createAgentContext, createAgentQueue, createAgentRegistry, createAgentRunner, createApprover, createAuthority, createBuiltinTool, createChannel, createConversation, createConversationManager, createDatabaseConversationStore, createDatabaseMemoStore, createInstruction, createInstructionManager, createLedger, createMemoManager, createMemoryConversationStore, createMemoryMemoStore, createRelay, createRelayProvider, createScope, createScopeManager, createSkillManager, createSystemOneJudge, createThinkSplitter, cutListing, cutWorkspaceSample, denyCall, describeCandidates, describeQuestionRefusal, describeRelayRefusal, describeSnapshotRefusal, digestLedgerTools, digestLedgerWindow, estimateMessages, estimateRequest, estimateTokens, extractLiterals, extractQueueOptions, extractSystemOneAnswer, extractSystemOneUsage, extractWords, filterAdvertisedTools, filterAllowList, filterBuiltinCandidates, findLedgerCut, findToolCall, fitSlope, freezeJSON, handleAgentQueueJob, hasCalls, hasHiddenRecall, identifyLookup, inferStop, instructionInputContract, instructionInputShape, intersectFilters, intersectKeys, isAgentBuiltin, isAgentError, isAgentJobError, isAuthorityDecision, isAuthorityVerdict, isContextError, isConversation, isConversationError, isConversationSnapshot, isFraction, isJudgeAbortError, isJudgeAnswer, isJudgeEntry, isJudgeError, isJudgeQuestion, isJudgment, isLedgerError, isLedgerQuestion, isLedgerSnapshot, isLedgerWindowSnapshot, isMemo, isMemoOrigin, isMemoSnapshot, isMessage, isMessageInput, isNonNegativeSafeInteger, isPositiveSafeInteger, isProviderAbortError, isProviderError, isProviderResult, isScope, isSection, isSystemOneAnswer, isSystemOneResponse, joinThinking, judgeAnswerContract, judgeAnswerShape, judgeEntryShape, judgeQuestionContract, judgeQuestionShape, judgmentContract, judgmentShape, ledgerSnapshotContract, ledgerSnapshotShape, ledgerWindowContract, ledgerWindowShape, linkOwners, loadToolContract, loadToolShape, matchEntities, matchesCutLine, matchesHeadLists, matchesJSON, matchesJudgment, matchesLookup, matchesPlainLine, measureAnswer, measureMessage, measureRequest, memoContract, memoInputContract, memoInputShape, memoShape, memoSnapshotContract, memoSnapshotShape, memoToolContract, memoToolShape, mergeSupersessions, messageContract, messageInputContract, messageInputShape, messageShape, normalizeArgument, normalizeWord, placeMember, providerRequestContract, providerRequestShape, providerResultContract, providerResultShape, questionToSystemOne, raceSignal, rankLedgerCut, readBodyText, readChunks, readFailure, readJudgeOutcome, readProviderDelta, relayFrameContract, relayFrameShape, releaseReader, rememberToolContract, rememberToolShape, removeEntries, renderArguments, renderCauseChain, renderFencedFile, renderIndexEntry, renderIndexLine, renderJSON, renderLedgerAnnotation, renderLedgerPinned, renderLedgerRecord, renderLookupCall, renderSection, renderSkillBody, renderStub, renderToolValue, renderTopicNames, requestToRelay, requireAnswer, requireBudget, requireBuiltins, requireConversation, requireConversationSnapshot, requireCumulative, requireEntry, requireFallback, requireJudgeResult, requireJudgment, requireKeep, requireLimit, requireMessageInput, requireProviderResult, requireRecordInput, requireRole, requireRules, requireScope, requireSectionsCap, requireSummary, requireWorkspace, resolveDecision, resolveDisclosure, resolvePredict, sanitizeToken, sanitizeUsage, scanAmendments, scanJobTree, scanJudgmentTies, scanProbability, sectionContract, sectionShape, selectRecords, settleAgentJob, settleToolResult, skillInputContract, skillInputShape, splitResultLines, splitSentences, splitTopic, splitWords, stripThinking, sumUsage, switchToolContract, switchToolShape, tokenUsageShape, tokenUsageToJSON, toolCallShape };
+export { AGENT_OPTION_KEYS, AGENT_RUN_KEYS, ARGUMENT_BLANK_PATTERN, ARGUMENT_CONTROL_PATTERN, AUTHORITY_NOTES, AUTHORITY_OPTION_KEYS, Agent, AgentContext, AgentError, AgentFanout, AgentJobError, AgentJudge, AgentProvider, AgentRegistry, Approver, Authority, BUILD_OPTION_KEYS, BUILTIN_LIMITS, BUILTIN_NOTES, BUILTIN_TOOLS, CLASSIFIER_OPTION_KEYS, COMPACT_OPTION_KEYS, CONTEXT_OPTION_KEYS, CONVERSATION_INPUT_KEYS, CONVERSATION_MANAGER_KEYS, CONVERSATION_OPTION_KEYS, CONVERSATION_RECAP_PREFIX, CONVERSATION_ROLES, Channel, Classifier, ContextError, Conversation, ConversationError, ConversationManager, DECISIVE_CATEGORIES, DEFAULT_AGENT_LIMIT, DEFAULT_CONVERSATION_KEEP, DEFAULT_LEDGER_LIMIT, DEFAULT_LEDGER_SHARE, DEFAULT_PROVIDER_TIMEOUT, DEFAULT_RECALL_LIMIT, DEFAULT_RELAY_LIMIT, DETERMINISTIC_JUDGE_ERROR, DatabaseConversationStore, DatabaseMemoStore, GAUGE_OPTION_KEYS, Gauge, IMAGE_TOKEN_ESTIMATE, INSTRUCTION_MANAGER_KEYS, INVALID_RELAY_STATUS, Instruction, InstructionManager, JOB_REFUSAL_PREFIX, JUDGE_INPUT_KEYS, JudgeAbortError, JudgeError, JudgmentManager, LEDGER_AGENT_KEYS, LEDGER_CATEGORIES, LEDGER_NOTES, LEDGER_OPTION_KEYS, LEDGER_OWNER_PREFIX, LEDGER_QUESTIONS, LEDGER_RECALL_LABELS, LEDGER_RULES_KEY, LEDGER_SAMPLE_BYTES, LEDGER_SCALE_DRIFT, LEDGER_SLICE, LEDGER_WORD, LOADED_SECTION_HEADER, Ledger, LedgerError, LedgerRequest, MAX_ERROR_BODY_LENGTH, MEMO_MANAGER_KEYS, MEMO_SECTION_HEADER, MESSAGE_ROLES, MESSAGE_TOKEN_OVERHEAD, MemoManager, MemoryConversationStore, MemoryMemoStore, OVERSIZED_RELAY_STATUS, PLACED_CATEGORIES, PROVIDER_INPUT_KEYS, ProviderAbortError, ProviderError, QUEUE_OPTION_KEYS, QUIET_CATEGORIES, REFERENCE_OPTION_KEYS, REFUSED_RELAY_CONTENT_TYPE, REFUSED_RELAY_STATUS, REGISTRY_OPTION_KEYS, RELAY_CONTENT_TYPE, RELAY_OPTION_KEYS, RELAY_PROVIDER_KEYS, RELAY_PROVIDER_MESSAGE, RELAY_STREAM_KEYS, RUNNER_OPTION_KEYS, RelayProvider, RelayStream, SCOPE_FILTER_KEYS, SCOPE_KEYS, SCOPE_MANAGER_KEYS, SCOPE_NOTE, SKILL_MANAGER_KEYS, SKILL_SECTION_HEADER, STREAM_OPTION_KEYS, SYSTEM_ONE_OPTION_KEYS, SYSTEM_ONE_PATH, Scope, ScopeManager, SkillManager, SystemOneJudge, THINK_CLOSE, THINK_OPEN, ThinkSplitter, UNAUTHORIZED_RELAY_STATUS, UPSTREAM_RELAY_STATUS, WORKSPACE_INDEX_HEADER, WORKSPACE_SECTION_HEADER, agentAnswerContract, agentAnswerShape, agentChunkToFrame, agentFrameContract, agentFrameShape, agentJobContract, agentJobShape, agentPromptContract, agentPromptShape, agentResultToFrame, agentResultToJSON, agentStreamToFrames, armReaderAbort, assembleResult, attachImages, attachUserImages, buildJudgeResult, buildJudgments, buildLedgerCut, buildLedgerIndex, buildLedgerLineKey, buildLedgerRenderContext, buildLines, buildProviderHeaders, buildProviderResult, buildRecallMessage, buildRecapMessage, buildRecords, buildRelayRequest, buildRequestMessage, buildSummaryMessage, builtinToolContracts, chargeUsage, collectAmendments, collectBuiltinDefinitions, collectDisclosure, collectExchanges, collectImageData, collectJobRefusals, collectLedgerEvidence, collectLedgerLines, collectLedgerReplies, collectLive, collectNames, collectProjectionIds, collectRecallMessages, collectRegistry, collectRetiredFindings, collectToolGroups, collectWriteSupersessions, computeLedgerChecksum, computeSkillPrice, computeThinking, computeToolDensity, computeToolPrice, conversationSnapshotContract, conversationSnapshotShape, copyJSON, createAgent, createAgentContext, createAgentQueue, createAgentRegistry, createAgentRunner, createApprover, createAuthority, createBuiltinTool, createChannel, createConversation, createConversationManager, createDatabaseConversationStore, createDatabaseMemoStore, createInstruction, createInstructionManager, createLedger, createMemoManager, createMemoryConversationStore, createMemoryMemoStore, createRelay, createRelayProvider, createScope, createScopeManager, createSkillManager, createSystemOneJudge, createThinkSplitter, cutListing, cutWorkspaceSample, denyCall, describeCandidates, describeQuestionRefusal, describeRelayRefusal, describeSnapshotRefusal, digestLedgerTools, digestLedgerWindow, estimateMessages, estimateRequest, estimateTokens, extractLiterals, extractQueueOptions, extractSystemOneAnswer, extractSystemOneUsage, extractWords, filterAdvertisedTools, filterAllowList, filterBuiltinCandidates, findLedgerCut, findToolCall, fitSlope, freezeJSON, handleAgentQueueJob, hasCalls, hasHiddenRecall, identifyLookup, inferStop, instructionInputContract, instructionInputShape, intersectFilters, intersectKeys, isAgentBuiltin, isAgentCaller, isAgentError, isAgentJobError, isAuthorityDecision, isAuthorityVerdict, isContextError, isConversation, isConversationError, isConversationSnapshot, isFraction, isJudgeAbortError, isJudgeAnswer, isJudgeEntry, isJudgeError, isJudgeQuestion, isJudgment, isLedgerError, isLedgerQuestion, isLedgerSnapshot, isLedgerWindowSnapshot, isMemo, isMemoOrigin, isMemoSnapshot, isMessage, isMessageInput, isNonNegativeSafeInteger, isPositiveSafeInteger, isProviderAbortError, isProviderError, isProviderResult, isScope, isSection, isSystemOneAnswer, isSystemOneResponse, joinThinking, judgeAnswerContract, judgeAnswerShape, judgeEntryShape, judgeQuestionContract, judgeQuestionShape, judgmentContract, judgmentShape, ledgerSnapshotContract, ledgerSnapshotShape, ledgerWindowContract, ledgerWindowShape, linkOwners, loadToolContract, loadToolShape, matchEntities, matchesCutLine, matchesHeadLists, matchesJSON, matchesJudgment, matchesLookup, matchesPlainLine, measureAnswer, measureMessage, measureRequest, memoContract, memoInputContract, memoInputShape, memoShape, memoSnapshotContract, memoSnapshotShape, memoToolContract, memoToolShape, mergeSupersessions, messageContract, messageInputContract, messageInputShape, messageShape, normalizeArgument, normalizeWord, placeMember, providerRequestContract, providerRequestShape, providerResultContract, providerResultShape, questionToSystemOne, raceSignal, rankLedgerCut, readBodyText, readChunks, readFailure, readJudgeOutcome, readProviderDelta, relayFrameContract, relayFrameShape, releaseReader, rememberToolContract, rememberToolShape, removeEntries, renderArguments, renderCauseChain, renderFencedFile, renderIndexEntry, renderIndexLine, renderJSON, renderLedgerAnnotation, renderLedgerPinned, renderLedgerRecord, renderLookupCall, renderSection, renderSkillBody, renderStub, renderToolValue, renderTopicNames, requestToRelay, requireAnswer, requireBudget, requireBuiltins, requireConversation, requireConversationSnapshot, requireCumulative, requireEntry, requireFallback, requireJudgeResult, requireJudgment, requireKeep, requireLimit, requireMessageInput, requireProviderResult, requireRecordInput, requireRole, requireRules, requireScope, requireSectionsCap, requireSummary, requireWorkspace, resolveDecision, resolveDisclosure, resolvePredict, resolveWorkspace, sanitizeToken, sanitizeUsage, scanAmendments, scanJobTree, scanJudgmentTies, scanProbability, sectionContract, sectionShape, selectRecords, settleAgentJob, settleToolResult, skillInputContract, skillInputShape, splitResultLines, splitSentences, splitTopic, splitWords, stripThinking, sumUsage, switchToolContract, switchToolShape, tokenUsageShape, tokenUsageToJSON, toolCallShape };
 
 //# sourceMappingURL=index.js.map