@r1z4x/tezgah 1.13.0 → 1.14.0

package/hooks/tezgah_lessons.py

@@ -78,7 +78,8 @@ def _test_names(path):
 def _enforced(value, root):
     """Whether the enforcer a retired lesson names is armed now: a test only
     while `<root>/tests/test_x.py` still defines it at top level, a gate rule
-    only while neither its own switch nor `pretooluse-off` is set."""
+    only while none of its own switches (one, or a tuple) nor `pretooluse-off`
+    is set."""
     test = re.match(r"tests\.(test_\w+)\.(\w+)$", value)
     if test:
         return test.group(2) in _test_names(
@@ -86,7 +87,9 @@ def _enforced(value, root):
     from tezgah_gate import DENY_RULES  # lazy: only a retired line pays for it
     if value not in DENY_RULES or off("pretooluse-off"):
         return False
-    return not (DENY_RULES[value] and off(DENY_RULES[value]))
+    switches = DENY_RULES[value]
+    return not any(off(s) for s in (
+        (switches,) if isinstance(switches, str) else switches or ()))
 
 
 def parse(line):

package/hooks/tezgah_paths.py

@@ -1020,12 +1020,21 @@ def say(code=None):
 # `authorized` row, the stand-down text) - the control rule refuses the routes
 # the gate sees, and an interpreter writing them is SECURITY.md's residual.
 STAND_DOWN = "tezgah-setup --uninstall --full\n"
-_LATCH = {"ledger": None, "since": None}
+# A subagent session also binds its parent's ledger (B-036, OQ-11): it latches
+# on the earlier of the two first rows, so a switch the parent made mid-session
+# is not honoured by a subagent it spawns afterwards, and the user's prompt to
+# the parent authorizes a switch for the subagent too.
+_LATCH = {"ledger": None, "parent": None, "since": None}
 
 
-def latch(ledger):
-    """Bind this process's `off()` to one session's ledger path (None unbinds)."""
-    _LATCH.update(ledger=ledger, since=None)
+def latch(ledger, parent=None):
+    """Bind this process's `off()` to one session's ledger path (None unbinds),
+    and to the ledger of the session that spawned it. Rebinding the same
+    ledger with no parent keeps the one an earlier bind named: the gate's own
+    bind runs after the host adapter's, which read the payload."""
+    if parent is None and ledger and ledger == _LATCH["ledger"]:
+        parent = _LATCH["parent"]
+    _LATCH.update(ledger=ledger, parent=parent, since=None)
 
 
 def _first_ts(ledger):
@@ -1066,8 +1075,10 @@ def _honored(path, name):
     ledger = _LATCH["ledger"]
     if not ledger:
         return True
+    parent = _LATCH["parent"]
     if _LATCH["since"] is None:
-        _LATCH["since"] = _first_ts(ledger)
+        firsts = (_first_ts(ledger), _first_ts(parent) if parent else None)
+        _LATCH["since"] = min((t for t in firsts if t is not None), default=None)
     since = _LATCH["since"]
     if since is None or max(t for st in stats for t in (st.st_mtime, st.st_ctime)) \
             < since + 1:
@@ -1079,7 +1090,7 @@ def _honored(path, name):
                     return True
         except (OSError, UnicodeDecodeError):
             pass
-    return name in _authorized(ledger)
+    return name in _authorized(ledger) or bool(parent) and name in _authorized(parent)
 
 
 def off(name):

package/hooks/tezgah_policy.py

@@ -25,7 +25,7 @@ import sys
 
 sys.path.insert(0, os.path.dirname(os.path.realpath(__file__)))
 import tezgah_research as tr  # noqa: E402  (the layer's own line resolver)
-from tezgah_paths import say  # noqa: E402  (the language packs' contract words)
+from tezgah_paths import CONFIG_DIR, HOME, say  # noqa: E402  (the language packs' contract words)
 
 # The tezgah CLIs the injected text names, by placeholder. `render` fills each
 # with `tezgah_paths.tool(<name>)`; the hookless copies (REPLY_LANG_HOOKLESS)
@@ -60,7 +60,7 @@ summary is not the whole contract.
 Level: `{PONY_BIN} lite|full|ultra` (bare call shows it; stored in
 ~/.config/tezgah/ponytail.level, machine-wide until changed). The default `full`
 adds nothing to this reminder; a non-default level is named in it every turn.
-Off: user says "stop ponytail".
+Off: user says "stop ponytail", or `ponytail-auto.off` / the repo's `.no-ponytail`.
 """
 
 ADHD = """
@@ -843,7 +843,7 @@ first; write what was cut only when you consciously cut something the user asked
 for, in at most three lines. In force from the first turn; levels
 lite|full|ultra are set with `{PONY_BIN}` and ride the per-turn reminder when
 not `full`; read the full `ponytail` skill from the router for the level table
-and examples. Off: "stop ponytail".
+and examples. Off: "stop ponytail", `ponytail-auto.off` or `.no-ponytail`.
 
 **Output shape: ADHD-friendly.** The answer or the next action is on the first
 line - a command, path, snippet or the decision itself, never context or the
@@ -1140,7 +1140,7 @@ item) goes to the user in the approval batch, never answered by the
 orchestrator or escalated to a stronger model. Off: `orchestrate-off`.
 
 **Kill switches:** each one removes its own rule from this text, not just the
-status mark. `~/.config/tezgah/`: `exec-mode.off`, `orchestrate-off`,
+status mark. `{SWITCH_DIR}`: `exec-mode.off`, `orchestrate-off`,
 `consult-off`, `research-off`, `ponytail-auto.off`, `adhd-off`, `spec-off`, `design-off`,
 `reminder-off`, `verify-off` (the integrity rule: its prompt text, the shortcut
 denials and the Stop gate), `task-off` (the task rule), `judge-off` (the
@@ -1212,10 +1212,18 @@ tezgah refusal and another session's work wait for the owner's answer;
 leftover work is done now, not listed - only a {DECISION}/{ACCESS}/{IRREVERSIBLE}/{ENV}
 blocker with its evidence goes under "{BLOCKERS_HEADING}"; no
 AI/model attribution in any persisted or published artifact. Full
-detail: the tezgah-contract skill.{PONY_LEVEL} Kill switches under ~/.config/tezgah/.
+detail: the tezgah-contract skill.{PONY_LEVEL} Kill switches under {SWITCH_DIR}.
 </harness-reminder>
 """
 
+# The kill-switch dir CORE and PROMPT_REMINDER name: CONFIG_DIR, which follows
+# XDG_CONFIG_HOME, spelled from `~` when it sits under HOME, so the default
+# reads `~/.config/tezgah/` on every install and the static copies match it.
+SWITCH_DIR = ("~" + CONFIG_DIR[len(HOME):] if CONFIG_DIR.startswith(HOME + os.sep)
+              else CONFIG_DIR).replace(os.sep, "/") + "/"
+CORE = CORE.replace("{SWITCH_DIR}", SWITCH_DIR)
+PROMPT_REMINDER = PROMPT_REMINDER.replace("{SWITCH_DIR}", SWITCH_DIR)
+
 # The blocks above are the on-demand full contract, shipped hand-kept as
 # skills/tezgah-contract/SKILL.md; CORE stays the always-on summary. There is no
 # joined constant: the cost report measures the shipped skill itself, and

package/hooks/tezgah_skill_pick.py

@@ -44,7 +44,7 @@ prompt the judgement did not answer, over an index cached in SQLite and rebuilt
 only when a SKILL.md's stat moves, and appends one line naming the top section
 when it carries enough of the prompt's words - each section once per session.
 No credential and no arming file, so `judge-off` does not reach it (it is not a
-judgement); `reminder-off` drops it with the rest of the per-turn text."""
+judgement), and neither does `reminder-off`, which drops only the reminder line."""
 
 
 import hashlib

package/hooks/tezgah_snapshot.py

@@ -131,17 +131,20 @@ def _append(session_id, row):
     """Append one ledger row, including the keys tezgah_integrity.note() drops.
 
     `note()` keeps only the LEDGER_FIELDS keys and truncates `detail` to 200
-    chars, so a row carrying a sha256 - and a path longer than the truncation -
+    chars, so a path longer than the truncation - and a rollback's `forced` -
     cannot go through it. This writes the same file that writer names, from the
     same derivation (`tezgah_integrity._path`), so there is one ledger and one
     rule for where it is; every reader treats an unknown key as nothing, so the
-    extra `hash` costs no existing reader anything. Best effort, like `note()`:
-    a write failure is not the caller's failure."""
+    extra `forced` costs no existing reader anything. It stamps `v`
+    (`ROW_VERSION`) as `note_path` does, so the row's shape is named across a
+    version change. Best effort, like `note()`: a write failure is not the
+    caller's failure."""
     if not session_id:
         return
     try:
         # through the ledger's own writer: its flock, its torn-tail repair and
         # its owner-only modes (audit SEC-05 / L-6), not a second open()
+        row = dict(row, v=ti.ROW_VERSION)
         ti._append(ti._path(session_id),
                    json.dumps({k: v for k, v in row.items() if v is not None})
                    + "\n")

package/hooks/tezgah_stopspec.py

@@ -205,7 +205,8 @@ class Trace:
                     or (bool(ti.UI_TOOL_CMD.search(self.masked(i)))
                         and row.get("exit") in (None, 0) and not row.get("fail_class")))
         if name == "Dc":
-            return self.col("U")[i] and bool(ti.DESIGN_COMPONENT.search(self.masked(i)))
+            return self.col("U")[i] and any(
+                ti.DESIGN_COMPONENT.search(p) for p in ti._ui_writes(row))
         if name == "Dk":
             # a `slop` verdict only counts for the repository it scanned (review
             # of plan 133, finding 5): a scan of some other tree proves nothing

package/hosts/amp/hook.py

@@ -151,7 +151,7 @@ def handle(payload):
     event = payload.get("event") or ""
     cwd = payload.get("cwd") or os.getcwd()
     session_id = payload.get("session_id")
-    safe(session_id, bind_session, session_id)  # the switch latch (tezgah_paths.off)
+    safe(session_id, bind_session, session_id, payload.get("parent"))  # the switch latch
     if event == "status":
         return status_line(cwd, session_id)
     if event == "pre_tool_use":

package/hosts/amp/tezgah-plugin.ts.in

@@ -211,9 +211,13 @@ export default function tezgahAmp(amp: any): void {
     if (res?.idx) st.idx = res.idx;
     if (typeof res?.status === "string" && res.status) paint(thread, res.status);
   };
+  // A subagent thread names its parent on every payload: the switch latch
+  // counts from the earlier of the two threads' first rows (B-036). `status`
+  // reads the parent session.start or an earlier event already asked for.
   const refresh = async (thread: string): Promise<void> => {
     if (!active(thread)) return;
-    show(thread, await ask(thread, { event: "status", cwd: cwd(), session_id: thread }));
+    show(thread, await ask(thread, { event: "status", cwd: cwd(), session_id: thread,
+                                     parent: state(thread).parent ?? undefined }));
   };
 
   // A failed hook is told once per thread: a notification now, a hidden line
@@ -271,6 +275,7 @@ export default function tezgahAmp(amp: any): void {
       const thread = threadOf(event, ctx);
       // session.start cannot inject: the brief rides this thread's next turn
       state(thread).briefed = false;
+      await parentOf(thread, ctx);
       await refresh(thread);
       tell(thread, ctx);
     } catch { /* a handler never throws */ }
@@ -296,7 +301,8 @@ export default function tezgahAmp(amp: any): void {
       // tezgah's own continue is not a user prompt: no turn row, no grant
       if (prompt.trim() && !prompt.startsWith(MARK)) {
         const res = await ask(thread, { event: "user_prompt", cwd: cwd(), session_id: thread,
-                                        prompt, subagent: parent !== null });
+                                        prompt, subagent: parent !== null,
+                                        parent: parent ?? undefined });
         if (res.context) parts.push(String(res.context));
       }
       tell(thread, ctx);
@@ -315,8 +321,10 @@ export default function tezgahAmp(amp: any): void {
         return { action: "allow" };
       }
       const thread = threadOf(event, ctx);
+      const parent = await parentOf(thread, ctx);
       const res = await ask(thread, { event: "pre_tool_use", cwd: cwd(), session_id: thread,
-                                      tool, input: gateInput(event) });
+                                      tool, input: gateInput(event),
+                                      parent: parent ?? undefined });
       tell(thread, ctx);
       if (typeof res.deny === "string" && res.deny) {
         return { action: "reject-and-continue", message: res.deny };
@@ -339,8 +347,10 @@ export default function tezgahAmp(amp: any): void {
       // carries an integer one; the hook never counts a bare `done` as a pass.
       const exit = output && typeof output === "object" && !Array.isArray(output)
         && Number.isInteger(output.exitCode) ? output.exitCode : undefined;
+      const parent = await parentOf(thread, ctx);
       const res = await ask(thread, {
         event: "post_tool_use", cwd: cwd(), session_id: thread, tool,
+        parent: parent ?? undefined,
         input: gateInput(event), status: event?.status, exit_code: exit,
         result_len: text === undefined ? undefined : text.length,
         empty_run: text !== undefined && EMPTY_RUN.test(text.slice(-EMPTY_RUN_TAIL)) || undefined,

package/hosts/antigravity/hook.py

@@ -210,7 +210,7 @@ def main():
     first = paths[0] if isinstance(paths, list) and paths else None
     cwd = first if isinstance(first, str) and first else os.getcwd()
     session_id = payload.get("conversationId")
-    safe(session_id, bind_session, session_id)  # the switch latch (tezgah_paths.off)
+    safe(session_id, bind_session, session_id, payload.get("parent"))  # the switch latch
     # the core's own field names; transcriptPath is left out: its format is not
     # the one the disarmed-gate counter reads (`tezgah_context.gate_inactive`)
     norm = {"session_id": session_id, "cwd": cwd}

package/hosts/codex/hook.py

@@ -168,7 +168,7 @@ def main():
     # not tell this is a codex session without it.
     if session_id:
         os.environ.setdefault("CODEX_THREAD_ID", str(session_id))
-    safe(session_id, bind_session, session_id)  # the switch latch (tezgah_paths.off)
+    safe(session_id, bind_session, session_id, payload.get("parent"))  # the switch latch
     if event == "SessionStart":
         safe(session_id, attest_session, "codex", session_id, cwd)
 

package/hosts/commandcode/hook.py

@@ -195,7 +195,7 @@ def main():
     event = payload.get("hook_event_name") or ""
     cwd = payload.get("cwd") or os.getcwd()
     session_id = payload.get("session_id")
-    safe(session_id, bind_session, session_id)  # the switch latch (tezgah_paths.off)
+    safe(session_id, bind_session, session_id, payload.get("parent"))  # the switch latch
     out = {}
     if event == "PreToolUse":
         name = payload.get("tool_name", "") or ""

package/hosts/copilot/hook.py

@@ -228,7 +228,7 @@ def main():
     event = payload.get("hook_event_name") or (sys.argv[1] if len(sys.argv) > 1 else "")
     cwd = payload.get("cwd") or os.getcwd()
     session_id = payload.get("session_id") or payload.get("sessionId")
-    safe(session_id, bind_session, session_id)  # the switch latch (tezgah_paths.off)
+    safe(session_id, bind_session, session_id, payload.get("parent"))  # the switch latch
     out = {}
     if event == "PreToolUse":
         name = payload.get("tool_name", "") or ""

package/hosts/cursor/hook.py

@@ -302,7 +302,8 @@ def dispatch(payload):
     cwd = cwd_of(payload)
     session_id = (payload.get("conversation_id") or payload.get("session_id")
                   or payload.get("parent_conversation_id"))
-    bind_session(session_id)  # the switch latch (tezgah_paths.off); dispatch runs in safe()
+    # the switch latch (tezgah_paths.off); dispatch runs in safe()
+    bind_session(session_id, payload.get("parent_conversation_id"))
     kind = classify(payload, event)
     quiet = off("reminder-off")
 

package/hosts/droid/hook.py

@@ -207,7 +207,7 @@ def main():
     event = payload.get("hook_event_name") or ""
     cwd = payload.get("cwd") or os.getcwd()
     session_id = payload.get("session_id")
-    safe(session_id, bind_session, session_id)  # the switch latch (tezgah_paths.off)
+    safe(session_id, bind_session, session_id, payload.get("parent"))  # the switch latch
     out = {}
     if event == "PreToolUse":
         name = payload.get("tool_name", "") or ""

package/hosts/gemini/hook.py

@@ -176,7 +176,7 @@ def main():
     event = payload.get("hook_event_name") or ""
     cwd = payload.get("cwd") or os.getcwd()
     session_id = payload.get("session_id")
-    safe(session_id, bind_session, session_id)  # the switch latch (tezgah_paths.off)
+    safe(session_id, bind_session, session_id, payload.get("parent"))  # the switch latch
     out = {}
     if event == "BeforeTool":
         reason = safe(session_id, decision, gate_name(payload.get("tool_name", "") or ""),

package/hosts/goose/hook.py

@@ -107,7 +107,7 @@ def main():
     event = payload.get("event") or ""
     cwd = payload.get("working_dir") or os.getcwd()
     session_id = payload.get("session_id")
-    safe(session_id, bind_session, session_id)  # the switch latch (tezgah_paths.off)
+    safe(session_id, bind_session, session_id, payload.get("parent"))  # the switch latch
     out = {}
     if event == "PreToolUse":
         name = payload.get("tool_name", "") or ""

package/hosts/omp/hook.py

@@ -141,7 +141,7 @@ def handle(payload):
     event = payload.get("event") or ""
     cwd = payload.get("cwd") or os.getcwd()
     session_id = payload.get("session_id")
-    safe(session_id, bind_session, session_id)  # the switch latch (tezgah_paths.off)
+    safe(session_id, bind_session, session_id, payload.get("parent"))  # the switch latch
     if event == "status":
         # turn end and the session switch: the probe runs, so the idx mark is
         # answered at every turn boundary

package/hosts/omp/tezgah-hook.ts.in

@@ -301,6 +301,68 @@ function labelled(content: any, label: string): any {
   return undefined;
 }
 
+// The calls one omp tool call carries, as the core names them (B-010). omp
+// routes an MCP call through its device tool - `write` to `xd://mcp__<name>`
+// with the call's arguments as JSON in `content` - and the core's MCP rules,
+// the MCP_EFFECT spawn filter and the Stop rule's `external` row are keyed on
+// the real name, so the device form is read as `mcp__<name>` with the parsed
+// arguments (an unparsable body stays readable as `content`). The URL is
+// matched the way omp resolves it: trimmed, the scheme in any case. `ast_edit`
+// (direct or as `xd://ast_edit`) only stages its rewrite and omp applies it
+// later through `write xd://resolve`, so the gate reads its targets here: one
+// `edit` per `paths` item, the ops' replacement text as the new content, marked
+// `via: "ast_edit"` - only such an item is read as a glob or a directory.
+// `outer` keeps the device `write` itself in front, for the gate only: its
+// content rules (a credential, a skip) read the whole body whatever class the
+// carried call is, as they did before the route (review 153 F1). The gate
+// writes no `began` for it (tezgah_gate.ROUTED_DEVICE): its result is recorded
+// as the call it carries.
+const DEVICE = /^xd:\/\/(mcp__[^/?#]+|ast_edit)$/i;
+function deviceOf(tool: string, args: any): RegExpExecArray | null {
+  return tool.toLowerCase() === "write" ? DEVICE.exec(String(args?.path ?? "").trim()) : null;
+}
+function routed(tool: string, args: any, outer = false): Array<[string, any]> {
+  let name = tool;
+  let input = args ?? {};
+  const device = deviceOf(name, input);
+  const calls: Array<[string, any]> = device && outer ? [[name, input]] : [];
+  if (device) {
+    name = device[1].toLowerCase() === "ast_edit" ? "ast_edit"
+      : "mcp__" + device[1].slice("mcp__".length);
+    const raw = String(input?.content ?? "");
+    try {
+      const parsed = JSON.parse(raw);
+      input = parsed && typeof parsed === "object" ? parsed : { content: raw };
+    } catch {
+      input = { content: raw };
+    }
+  }
+  if (name.toLowerCase() !== "ast_edit") return [...calls, [name, input]];
+  const ops = Array.isArray(input?.ops) ? input.ops : [];
+  const out = ops.map((op: any) => String(op?.out ?? "")).join("\n");
+  const paths = Array.isArray(input?.paths) ? input.paths : [];
+  return [...calls, ...paths.map((p: any): [string, any] =>
+    ["edit", { path: String(p), new_string: out, via: "ast_edit" }])];
+}
+
+// omp emits a device call and then, under the same id, the native event of the
+// call it carries: the device event leaves one key per carried call it passed
+// and that native event consumes it, so a row, a label and a retry count are
+// written once (review 153 F4). Nothing else is skipped: a direct call leaves
+// no key, and a reused id, an empty one or a refused call reaches the gate and
+// the ledger again (review 153 round 2 #1). ponytail: the newest 512 keys.
+const CARRIED = { call: new Set<string>(), result: new Set<string>() };
+function carriedKey(id: any, tool: string, input: any): string | null {
+  if (id == null || id === "") return null;
+  return `${id}:${tool.toLowerCase()}:${String(input?.path ?? "")}`;
+}
+function carry(seen: Set<string>, keys: string[]): void {
+  for (const key of keys) {
+    seen.add(key);
+    if (seen.size > 512) seen.delete(seen.values().next().value as string);
+  }
+}
+
 // A check's own output saying it ran nothing: the same literal as
 // hooks/tezgah_integrity.py `EMPTY_RUN` (tests/test_omp_extension.py pins the
 // two equal), read here because the bridge sends the hook a size and never the
@@ -473,6 +535,13 @@ function isSubagent(ctx: any): boolean {
   }
 }
 
+// A subagent's events name the main session as `parent`, as its session_start
+// does: the switch latch counts from the earlier of the two sessions' first
+// rows, so a switch the parent made mid-session holds no sway here (B-036).
+function parentOf(ctx: any): string | undefined {
+  return isSubagent(ctx) ? process.env.TEZGAH_SESSION || undefined : undefined;
+}
+
 // The session an omp fork was forked from: a main session whose header still
 // names a `parentSession` (an id, or a `<stamp>_<id>.jsonl` path). The hook
 // writes it as a `forked` row, so the race rule names a fork as one instead of
@@ -588,7 +657,8 @@ export default function tezgahOmp(pi: any): void {
   // A failed hook answers nothing, so the last good line would keep claiming a
   // gate that is not running: the widget is repainted with the failure instead.
   const refresh = (ctx: any): void => {
-    const res = ask({ event: "status", cwd: cwdOf(ctx), session_id: sessionOf(ctx) });
+    const res = ask({ event: "status", cwd: cwdOf(ctx), session_id: sessionOf(ctx),
+                      parent: parentOf(ctx) });
     if (hookError) return markBroken(ctx);
     show(ctx, res);
   };
@@ -719,7 +789,7 @@ export default function tezgahOmp(pi: any): void {
     // `subagent`: a task prompt is the parent's brief, never the user's grant
     const res = ask({ event: "user_prompt", cwd: cwdOf(ctx), prompt,
                       session_id: session, transcript_path: sessionFileOf(ctx),
-                      subagent: isSubagent(ctx) });
+                      subagent: isSubagent(ctx), parent: parentOf(ctx) });
     if (hookError) return noticeMessage(ctx, session);
     if (!res.context) return undefined;
     // A hidden message, not a system-prompt rewrite: omp keeps per-request
@@ -730,38 +800,44 @@ export default function tezgahOmp(pi: any): void {
   });
 
   pi.on("tool_call", async (event: any, ctx: any) => {
-    const tool = String(event?.toolName ?? event?.name ?? "");
     // An MCP tool is named per server (`mcp__<server>_<tool>`), so no exact
     // list can hold it: an effect verb in the name reaches the gate, whose
-    // content rules read its payload (tezgah_integrity.mcp_class).
-    if (!GATED.includes(tool.toLowerCase()) && !MCP_EFFECT.test(tool)) {
-      return undefined;
-    }
-    const res = ask({ event: "pre_tool_use", cwd: cwdOf(ctx), tool,
-                      input: event?.input ?? event?.args ?? {},
-                      session_id: sessionOf(ctx) });
-    if (hookError) {
-      markBroken(ctx);
-      return undefined;  // a hook that cannot answer cannot refuse either
-    }
-    if (res.deny) return { block: true, reason: res.deny };
-    if (res.advice && event?.toolCallId != null) {
-      ADVICE.set(String(event.toolCallId), String(res.advice));
+    // content rules read its payload (tezgah_integrity.mcp_class). A device
+    // call is judged as itself and as the call it carries (`routed`), and the
+    // native event of a carried call it passed is not asked twice (`CARRIED`).
+    const callId = event?.toolCallId;
+    const name = String(event?.toolName ?? event?.name ?? "");
+    const args = event?.input ?? event?.args ?? {};
+    const device = deviceOf(name, args) != null;
+    const carried: string[] = [];
+    for (const [n, [tool, input]] of routed(name, args, true).entries()) {
+      if (!GATED.includes(tool.toLowerCase()) && !MCP_EFFECT.test(tool)) continue;
+      const key = carriedKey(callId, tool, input);
+      if (device) {
+        if (n > 0 && key) carried.push(key);  // the device `write` itself is first
+      } else if (key && CARRIED.call.delete(key)) {
+        continue;
+      }
+      const res = ask({ event: "pre_tool_use", cwd: cwdOf(ctx), tool, input,
+                        session_id: sessionOf(ctx), parent: parentOf(ctx) });
+      if (hookError) {
+        markBroken(ctx);
+        return undefined;  // a hook that cannot answer cannot refuse either
+      }
+      if (res.deny) return { block: true, reason: res.deny };
+      if (res.advice && event?.toolCallId != null) {
+        ADVICE.set(String(event.toolCallId), String(res.advice));
+      }
     }
+    carry(CARRIED.call, carried);
     return undefined;
   });
 
   pi.on("tool_result", async (event: any, ctx: any) => {
-    const tool = String(event?.toolName ?? "");
-    const args = event?.input ?? {};
     const id = event?.toolCallId != null ? String(event.toolCallId) : "";
     const advice = ADVICE.get(id);
     ADVICE.delete(id);
     const graph = advice ? { additionalContext: advice } : undefined;
-    if (!WATCHED.includes(tool.toLowerCase()) && !tool.startsWith("mcp__")
-        && !skillRead(tool, args)) {
-      return graph;
-    }
     // Tri-state: an unread outcome must never be written as a passed check,
     // because the Stop rule below reads this ledger as evidence.
     const failed = typeof event?.isError === "boolean" ? event.isError : null;
@@ -775,18 +851,34 @@ export default function tezgahOmp(pi: any): void {
     const content = event?.content;
     const resultLen = typeof content === "string" ? content.length
       : Array.isArray(content) ? content.length : undefined;
-    // omp's todo call holds one op and its result's `details.phases` the whole
-    // list, so that list crosses for this one tool: the queue the Stop rule and
-    // the idle-wait warning read (tezgah_integrity.note_todo).
-    const phases = tool.toLowerCase() === "todo" ? event?.details?.phases : undefined;
-    const todo = Array.isArray(phases)
-      ? phases.flatMap((p: any) => (Array.isArray(p?.tasks) ? p.tasks : []))
-      : undefined;
-    const res = ask({ event: "post_tool_use", cwd: cwdOf(ctx), tool,
-                      input: event?.input ?? {}, failed, idx: idxGlyph,
-                      session_id: sessionOf(ctx), result_len: resultLen,
-                      empty_run: emptyRun(content) || undefined, todo });
-    if (hookError) return markBroken(ctx);
+    let res: any;
+    // a device call is recorded as the call it carries (`routed`): an MCP
+    // query's answer is an `external` row, never an edit of `xd://...`
+    const name = String(event?.toolName ?? "");
+    const input = event?.input ?? {};
+    const device = deviceOf(name, input) != null;
+    for (const [tool, args] of routed(name, input)) {
+      if (!WATCHED.includes(tool.toLowerCase()) && !tool.startsWith("mcp__")
+          && !skillRead(tool, args)) {
+        continue;
+      }
+      const key = carriedKey(event?.toolCallId, tool, args);
+      if (!device && key && CARRIED.result.delete(key)) continue;
+      // omp's todo call holds one op and its result's `details.phases` the whole
+      // list, so that list crosses for this one tool: the queue the Stop rule and
+      // the idle-wait warning read (tezgah_integrity.note_todo).
+      const phases = tool.toLowerCase() === "todo" ? event?.details?.phases : undefined;
+      const todo = Array.isArray(phases)
+        ? phases.flatMap((p: any) => (Array.isArray(p?.tasks) ? p.tasks : []))
+        : undefined;
+      res = ask({ event: "post_tool_use", cwd: cwdOf(ctx), tool,
+                  input: args, failed, idx: idxGlyph,
+                  session_id: sessionOf(ctx), parent: parentOf(ctx), result_len: resultLen,
+                  empty_run: emptyRun(content) || undefined, todo });
+      if (hookError) return markBroken(ctx);
+      if (device && key) carry(CARRIED.result, [key]);
+    }
+    if (!res) return graph;
     show(ctx, res);
     // A result that came from outside the user and the workspace is labelled in
     // place; every other result is left exactly as the host produced it.