@sema-agent/client-core 0.100.0 → 0.101.0

package/dist/executionLaneCapability.js

@@ -1,5 +1,5 @@
 import { capForDisplay } from './fleetTaskDesc.js';
-import { engineWireTarget } from './engineWireTarget.js';
+import { engineWireTargetBaseUrl } from './engineWireTarget.js';
 import { createEngineCapReader, unreadableReadingDetail } from './engineCapReader.js';
 import { ownDataField } from './ownKey.js';
 export function projectExecutionLaneCapability(caps) {
@@ -49,7 +49,7 @@ const reader = createEngineCapReader({
     name: 'executionLane',
     project: projectExecutionLaneCapability,
 });
-export function observedExecutionLane(baseUrl = engineWireTarget()?.baseUrl) {
+export function observedExecutionLane(baseUrl = engineWireTargetBaseUrl()) {
     return reader.observed(baseUrl);
 }
 export function toolsRunHereFromExecutionLane(reading) {

package/dist/fileHistoryCaptureCapability.js

@@ -1,6 +1,6 @@
 import { msg, renderMessage } from './i18n/translate.js';
 import { capForDisplay } from './fleetTaskDesc.js';
-import { engineWireTarget } from './engineWireTarget.js';
+import { engineWireTargetBaseUrl } from './engineWireTarget.js';
 import { createEngineCapReader, unreadableReadingDetail } from './engineCapReader.js';
 import { refreshEngineCapsOnce } from './engineCapsCache.js';
 import { ownDataField } from './ownKey.js';
@@ -23,7 +23,7 @@ const reader = createEngineCapReader({
     name: 'fileHistoryCapture',
     project: projectFileHistoryCaptureCapability,
 });
-export function observedFileHistoryCapture(baseUrl = engineWireTarget()?.baseUrl) {
+export function observedFileHistoryCapture(baseUrl = engineWireTargetBaseUrl()) {
     return reader.observed(baseUrl);
 }
 export function fileHistoryCaptureMode(reading) {
@@ -118,7 +118,7 @@ export async function judgeFileHistoryTighten(captureOffByUser, opts) {
                 withinMs = 0;
             }
         }
-        const baseUrl = explicitBase ?? engineWireTarget()?.baseUrl;
+        const baseUrl = explicitBase ?? engineWireTargetBaseUrl();
         const first = observedFileHistoryCapture(baseUrl);
         const v1 = fileHistoryTightenVerdict(first, captureOffByUser);
         if (v1 !== 'unjudged')

package/dist/finalVerifyWire.d.ts

@@ -2,11 +2,14 @@ import type { SemaSettings } from '@sema-agent/sdk';
 import { type EnvLike } from './hostEnv.js';
 export type WireHooksConfig = NonNullable<SemaSettings['hooks']>;
 export declare const HEADLESS_FINAL_VERIFY_ENV = "SEMA_HEADLESS_FINAL_VERIFY";
-export declare function parseNoFinalVerifyArgv(argv: string[]): boolean;
+export interface HeadlessFinalVerifyFlags {
+    readonly noFinalVerify?: boolean;
+    readonly finalVerify?: boolean;
+}
 export declare function headlessFinalVerifyDisabledByEnv(env?: EnvLike): boolean;
 export declare function hasUserStopHook(wireHooks: WireHooksConfig | undefined): boolean;
-export declare function resolveHeadlessFinalVerify(argv: string[], env?: EnvLike, wireHooks?: WireHooksConfig): boolean;
-export declare function resolveHeadlessFinalVerifyDetail(argv: string[], env?: EnvLike, wireHooks?: WireHooksConfig): {
+export declare function resolveHeadlessFinalVerify(flags: HeadlessFinalVerifyFlags | undefined, env?: EnvLike, wireHooks?: WireHooksConfig): boolean;
+export declare function resolveHeadlessFinalVerifyDetail(flags: HeadlessFinalVerifyFlags | undefined, env?: EnvLike, wireHooks?: WireHooksConfig): {
     on: boolean;
     offReason?: 'flag' | 'env' | 'stop-hook';
 };

package/dist/finalVerifyWire.js

@@ -1,24 +1,7 @@
 import { hostEnv } from './hostEnv.js';
 import { envFlagOff, envFlagOn } from './envFlag.js';
+import { flagTrue } from './flagInput.js';
 export const HEADLESS_FINAL_VERIFY_ENV = 'SEMA_HEADLESS_FINAL_VERIFY';
-export function parseNoFinalVerifyArgv(argv) {
-    for (const a of argv) {
-        if (a === '--')
-            break;
-        if (a === '--no-final-verify')
-            return true;
-    }
-    return false;
-}
-function parseFinalVerifyArgv(argv) {
-    for (const a of argv) {
-        if (a === '--')
-            break;
-        if (a === '--final-verify')
-            return true;
-    }
-    return false;
-}
 export function headlessFinalVerifyDisabledByEnv(env = hostEnv()) {
     return envFlagOff(env[HEADLESS_FINAL_VERIFY_ENV]);
 }
@@ -26,15 +9,15 @@ export function hasUserStopHook(wireHooks) {
     const groups = wireHooks?.['Stop'];
     return Array.isArray(groups) && groups.length > 0;
 }
-export function resolveHeadlessFinalVerify(argv, env = hostEnv(), wireHooks) {
-    return resolveHeadlessFinalVerifyDetail(argv, env, wireHooks).on;
+export function resolveHeadlessFinalVerify(flags, env = hostEnv(), wireHooks) {
+    return resolveHeadlessFinalVerifyDetail(flags, env, wireHooks).on;
 }
-export function resolveHeadlessFinalVerifyDetail(argv, env = hostEnv(), wireHooks) {
-    if (parseNoFinalVerifyArgv(argv))
+export function resolveHeadlessFinalVerifyDetail(flags, env = hostEnv(), wireHooks) {
+    if (flagTrue(flags, 'noFinalVerify'))
         return { on: false, offReason: 'flag' };
     if (headlessFinalVerifyDisabledByEnv(env))
         return { on: false, offReason: 'env' };
-    const explicitOn = parseFinalVerifyArgv(argv) || envFlagOn(env[HEADLESS_FINAL_VERIFY_ENV]);
+    const explicitOn = flagTrue(flags, 'finalVerify') || envFlagOn(env[HEADLESS_FINAL_VERIFY_ENV]);
     if (explicitOn) {
         if (hasUserStopHook(wireHooks))
             return { on: false, offReason: 'stop-hook' };

package/dist/flagInput.d.ts

@@ -0,0 +1,4 @@
+export declare function flagObject(flags: object | null | undefined, key: string): object | undefined;
+export declare function flagIsWronglyTyped(flags: object | null | undefined, key: string): boolean;
+export declare function flagString(flags: object | null | undefined, key: string): string | undefined;
+export declare function flagTrue(flags: object | null | undefined, key: string): boolean;

package/dist/flagInput.js

@@ -0,0 +1,24 @@
+import { guardedRead, readOwnDataValue } from './ownKey.js';
+function flagSlot(flags, key) {
+    return guardedRead(() => readOwnDataValue(flags, key));
+}
+export function flagObject(flags, key) {
+    const v = flagSlot(flags, key);
+    try {
+        return typeof v === 'object' && v !== null && !Array.isArray(v) ? v : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function flagIsWronglyTyped(flags, key) {
+    const v = flagSlot(flags, key);
+    return v !== undefined && typeof v !== 'string';
+}
+export function flagString(flags, key) {
+    const v = flagSlot(flags, key);
+    return typeof v === 'string' ? v : undefined;
+}
+export function flagTrue(flags, key) {
+    return flagSlot(flags, key) === true;
+}

package/dist/fleet/fleetLedger.js

@@ -12,6 +12,7 @@ import { isSdkFleetTaskTerminal, isSdkFleetTaskTerminalNotSuccess } from '../ter
 import { projectTasks, projectWorkflows, wireCycleSeq, wireParentId, } from './fleetProjection.js';
 import { isInStreamDrainingEnd } from '../wireErrorTriage.js';
 import { cycleSeqOrder, cycleSeqValue } from '../cycleOrder.js';
+import { guardedRead, ownSnapshotRecord, readOwnDataValue } from '../ownKey.js';
 export const TERMINAL_RETAIN_MS = 60_000;
 function hasRowId(row) {
     const id = row?.id;
@@ -382,7 +383,7 @@ export function createFleetLedger(hooks = {}, opts = {}) {
                 hooks.onHookNotice?.(frame, sessionScopedMeta === true);
                 break;
             case 'bg_notification':
-                applyBgNotification(frame.notification, ing);
+                applyBgNotification(guardedRead(() => readOwnDataValue(frame, 'notification')), ing);
                 break;
             default:
                 if (isInStreamDrainingEnd(frame)) {
@@ -394,7 +395,8 @@ export function createFleetLedger(hooks = {}, opts = {}) {
                 break;
         }
     }
-    function applyBgNotification(n, ing) {
+    function applyBgNotification(raw, ing) {
+        const n = ownSnapshotRecord(raw);
         if (typeof n?.taskId !== 'string' || typeof n?.status !== 'string') {
             droppedMalformed++;
             debug('[fleet-frame] MALFORMED bg_notification dropped(taskId 或 status 缺席/非串)');
@@ -554,6 +556,7 @@ export function createFleetLedger(hooks = {}, opts = {}) {
             status: n.status,
             ...(typeof n.seq === 'number' ? { seq: n.seq } : {}),
             ...(typeof n.summary === 'string' ? { summary: n.summary } : {}),
+            ...(typeof n.completionId === 'string' && n.completionId.length > 0 ? { completionId: n.completionId } : {}),
         });
     }
     function project(nowMs, opts) {

package/dist/fleet/fleetProjection.d.ts

@@ -54,6 +54,7 @@ export interface FleetWorkflowView {
 }
 export declare function coerceTaskStatus(s: string): FleetTaskStatus;
 export declare function coerceWorkflowStatus(s: string | undefined): FleetTaskStatus;
+export declare function workflowRunDisplayStatusOf(run: object | null | undefined): FleetTaskStatus;
 export declare const CONTROL_TOOL_VERBS: ReadonlySet<string>;
 export declare function projectDescription(description: string | undefined): string;
 export declare function wireParentId(r: Pick<FleetTaskRow, 'parentId'>): string | undefined;

package/dist/fleet/fleetProjection.js

@@ -2,6 +2,7 @@ import { collapseLabel, escapeDisplayControlChars, taskDescFromName } from '../f
 import { rowIdTail } from '../workflow.js';
 import { cycleSeqValue } from '../cycleOrder.js';
 import { frozenSet } from '../frozenSet.js';
+import { guardedRead, readOwnDataValue } from '../ownKey.js';
 import { CORE_RESERVED_AGENT_NAMES } from '../generated/engineFactTables.js';
 export function coerceTaskStatus(s) {
     if (s === 'parked')
@@ -26,7 +27,15 @@ export function coerceTaskStatus(s) {
     }
 }
 export function coerceWorkflowStatus(s) {
-    switch (s) {
+    return workflowRunDisplayStatusOf({ status: s });
+}
+export function workflowRunDisplayStatusOf(run) {
+    const status = runField(run, 'status');
+    if (runField(run, 'parked') === true)
+        return 'awaiting approval';
+    if (status === 'failed' && runField(run, 'errorCode') === WORKFLOW_AGENT_PARKED_ERROR_CODE)
+        return 'awaiting approval';
+    switch (status) {
         case 'completed':
             return 'completed';
         case 'failed':
@@ -43,6 +52,10 @@ export function coerceWorkflowStatus(s) {
             return 'idle';
     }
 }
+const WORKFLOW_AGENT_PARKED_ERROR_CODE = 'workflow.agent_parked';
+function runField(run, key) {
+    return guardedRead(() => typeof run === 'object' && run !== null && !Array.isArray(run) ? readOwnDataValue(run, key) : undefined);
+}
 function deriveAgentLabel(agentType, agentName, name, id) {
     const identity = collapseLabel(agentName ?? '') || collapseLabel(agentType ?? '');
     if (identity)
@@ -218,7 +231,7 @@ export function projectWorkflows(rows) {
             id: r.id,
             name: collapseLabel(r.name ?? '') || 'Dynamic workflow',
             description: projectDescription(r.description),
-            status: coerceWorkflowStatus(r.status),
+            status: workflowRunDisplayStatusOf(r),
             ...wireNumberKey('doneCount', wireCount(r.doneCount)),
             ...wireNumberKey('totalCount', wireCount(r.totalCount)),
             ...wireNumberKey('elapsedMs', wireDuration(r.elapsedMs)),

package/dist/gateVocabulary.js

@@ -105,6 +105,8 @@ const RULE_OFFERS_ABSENCE_KEYS = Object.freeze({
     },
     lane_cannot_speak: { line: 'approval.ruleOffer.absence.laneCannotSpeak' },
 });
+const _absenceWordsPin = true;
+void _absenceWordsPin;
 export function ruleOffersAbsenceDetail(reason, opts, lang) {
     if (typeof reason !== 'string' || reason === '')
         return undefined;
@@ -144,6 +146,7 @@ const APPROVAL_MANDATE_KEYS = Object.freeze({
     probe_unanswered: 'approval.mandate.word.probeUnanswered',
     write_protection: 'approval.mandate.word.writeProtection',
     target_unresolved: 'approval.mandate.word.targetUnresolved',
+    cross_boundary_taint: 'approval.mandate.word.crossBoundaryTaint',
 });
 const APPROVAL_MANDATE_SET = new Set(APPROVAL_MANDATE_WORDS);
 export function approvalMandateDetail(word, lang) {

package/dist/generated/engineFactTables.d.ts

@@ -14,7 +14,7 @@ export declare const CORE_ASK_EVIDENCE_ABSENCE_VALUES: readonly ["not_wired", "n
 export declare const CORE_SYSTEM_INJECTION_PRIORITIES: readonly ["now", "next", "later"];
 export declare const CORE_READ_DENY_BUILTIN_TIERS: readonly ["credentials", "shell-history", "browser", "wallet", "agent-config"];
 export declare const CORE_READ_DENY_DEFAULT_TIERS: readonly ["credentials", "agent-config"];
-export declare const CORE_ASK_CLASSES: readonly ["content_question", "hook", "ancestor", "dangerous_delete", "unverifiable_delete", "unverifiable_shell_text", "transcript_write", "org_rule", "rule_unreadable", "ask_rule", "denial_limit_fallback", "classifier_no_ruling", "requires_user_interaction", "operator_forced", "shell_floor", "target_unresolved", "probe", "write_protection", "tool_marks_mcp", "tool_marks_a2a", "policy_rra", "artifact_shared_read", "mode", "unstated", "ordinary"];
+export declare const CORE_ASK_CLASSES: readonly ["content_question", "hook", "ancestor", "dangerous_delete", "unverifiable_delete", "unverifiable_shell_text", "transcript_write", "org_rule", "rule_unreadable", "ask_rule", "denial_limit_fallback", "classifier_no_ruling", "requires_user_interaction", "cross_boundary", "operator_forced", "shell_floor", "target_unresolved", "probe", "write_protection", "tool_marks_mcp", "tool_marks_a2a", "policy_rra", "artifact_shared_read", "mode", "unstated", "ordinary"];
 export interface CoreModeArbitrationRow {
     readonly bypassImmune: boolean;
     readonly classifierEligible: boolean;
@@ -22,7 +22,7 @@ export interface CoreModeArbitrationRow {
     readonly ruleMayClear: boolean;
     readonly hookAskFloor: boolean;
 }
-export declare const CORE_MODE_ARBITRATION: Readonly<Record<"content_question" | "hook" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "org_rule" | "rule_unreadable" | "ask_rule" | "denial_limit_fallback" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "target_unresolved" | "probe" | "write_protection" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "mode" | "unstated" | "ordinary", CoreModeArbitrationRow>>;
+export declare const CORE_MODE_ARBITRATION: Readonly<Record<"content_question" | "hook" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "org_rule" | "rule_unreadable" | "ask_rule" | "denial_limit_fallback" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "target_unresolved" | "probe" | "write_protection" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "mode" | "unstated" | "ordinary", CoreModeArbitrationRow>>;
 export declare const CORE_SKILL_GRANT_ORIGINS: readonly ["model", "user", "inherited"];
 export declare const CORE_ALLOW_ENTRY_INERT_REASONS: readonly ["wildcard_all", "namespace_wildcard", "content_unsupported", "grammar", "tool_name", "near_miss", "earlier_grammar"];
 export declare const CORE_ALLOW_RULE_MEMBERS: readonly ["hook", "deployment", "persisted", "skill", "request"];
@@ -42,10 +42,14 @@ export declare const CORE_MAX_PENDING_STEER_CHARS: number;
 export declare const CORE_PROMPT_BLOCK_CAUSES: readonly ["block", "crashed", "timeout", "cancelled"];
 export declare const CORE_PERMISSION_MODES: readonly ["default", "acceptEdits", "plan", "auto", "bypassPermissions", "dontAsk"];
 export declare const CORE_APPROVAL_REACH: readonly ["none"];
-export declare const CORE_PERSISTED_RULE_MANDATES: readonly ["operator_always", "tool_marks", "probe_mandate", "probe_unanswered", "write_protection", "target_unresolved"];
+export declare const CORE_PERSISTED_RULE_MANDATES: readonly ["operator_always", "tool_marks", "probe_mandate", "probe_unanswered", "write_protection", "target_unresolved", "cross_boundary_taint"];
 export declare const CORE_TASK_NOTIFICATION_TERMINAL_STATUSES: readonly ["completed", "failed", "killed", "cancelled"];
 export declare const CORE_RESUME_STARTUP_CAUSES: readonly ["environment", "session_gone", "transcript_corrupt", "tool_unavailable", "configuration", "decision_rejected"];
 export declare const CORE_BUILTIN_SUBAGENT_TYPES: readonly ["Explore", "Plan", "fork", "general-purpose"];
+export declare const CORE_RULE_OFFERS_ABSENCES: readonly ["mandated", "allow_outranked", "ask_rule_matched", "lane_cannot_speak"];
+export declare const CORE_TOOL_APPROVAL_CARDS: readonly ["file-edit", "file-write", "notebook-edit", "shell", "fetch", "skill", "workflow", "plan", "question", "generic"];
+export declare const CORE_ASK_CLASSES_WITHOUT_REASON_ROW: readonly ["probe"];
+export declare const CORE_ASK_CLASS_REASONS: Readonly<Record<Exclude<(typeof CORE_ASK_CLASSES)[number], (typeof CORE_ASK_CLASSES_WITHOUT_REASON_ROW)[number]>, string>>;
 export declare const CORE_USER_ATTACHMENT_KINDS: readonly ["text", "notebook", "image", "pdf", "directory", "client_text", "client_image"];
 export declare const CORE_USER_ATTACHMENT_SUPPLIES: readonly ["path", "content_text", "content_image"];
 export declare const CORE_USER_ATTACHMENT_OUTCOMES: readonly ["attached", "partial", "unchanged", "not_attached"];

package/dist/generated/engineFactTables.js

@@ -85,6 +85,7 @@ export const CORE_ENGINE_CARD_TYPES = Object.freeze([
     "workflow-run",
     "report-findings",
     "tool-search",
+    "advisor",
     "ask-question",
     "exit-plan-mode",
     "enter-plan-mode",
@@ -154,6 +155,7 @@ export const CORE_ASK_CLASSES = Object.freeze([
     "denial_limit_fallback",
     "classifier_no_ruling",
     "requires_user_interaction",
+    "cross_boundary",
     "operator_forced",
     "shell_floor",
     "target_unresolved",
@@ -181,6 +183,7 @@ export const CORE_MODE_ARBITRATION = Object.freeze({
     "denial_limit_fallback": Object.freeze({ bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false }),
     "classifier_no_ruling": Object.freeze({ bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false }),
     "requires_user_interaction": Object.freeze({ bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: true }),
+    "cross_boundary": Object.freeze({ bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false }),
     "operator_forced": Object.freeze({ bypassImmune: true, classifierEligible: true, sandboxAdmission: true, ruleMayClear: false, hookAskFloor: false }),
     "shell_floor": Object.freeze({ bypassImmune: true, classifierEligible: true, sandboxAdmission: true, ruleMayClear: false, hookAskFloor: false }),
     "target_unresolved": Object.freeze({ bypassImmune: true, classifierEligible: false, sandboxAdmission: true, ruleMayClear: false, hookAskFloor: true }),
@@ -306,6 +309,7 @@ export const CORE_PERSISTED_RULE_MANDATES = Object.freeze([
     "probe_unanswered",
     "write_protection",
     "target_unresolved",
+    "cross_boundary_taint",
 ]);
 export const CORE_TASK_NOTIFICATION_TERMINAL_STATUSES = Object.freeze([
     "completed",
@@ -327,6 +331,54 @@ export const CORE_BUILTIN_SUBAGENT_TYPES = Object.freeze([
     "fork",
     "general-purpose",
 ]);
+export const CORE_RULE_OFFERS_ABSENCES = Object.freeze([
+    "mandated",
+    "allow_outranked",
+    "ask_rule_matched",
+    "lane_cannot_speak",
+]);
+export const CORE_TOOL_APPROVAL_CARDS = Object.freeze([
+    "file-edit",
+    "file-write",
+    "notebook-edit",
+    "shell",
+    "fetch",
+    "skill",
+    "workflow",
+    "plan",
+    "question",
+    "generic",
+]);
+export const CORE_ASK_CLASSES_WITHOUT_REASON_ROW = Object.freeze([
+    "probe",
+]);
+export const CORE_ASK_CLASS_REASONS = Object.freeze({
+    "content_question": "the call is the engine's own question to a person",
+    "hook": "a PreToolUse hook asks about this call — the deployment's own screening is answered by a person",
+    "ancestor": "the task that delegated this one owns this question",
+    "dangerous_delete": "this removal targets a protected location (the filesystem root, a top-level directory, a home directory, or a workspace directory or one of its ancestors) — it is cleared by confirming this call, never by an allow rule",
+    "unverifiable_delete": "this removal could not be verified safe — it is cleared by confirming this call, never by an allow rule",
+    "unverifiable_shell_text": "the text this shell will run cannot be read by the engine — it is cleared by confirming this call, never by an allow rule",
+    "transcript_write": "this write targets the session transcript — it is cleared by confirming this call, never by an allow rule",
+    "org_rule": "an organization policy rule requires approval for this call",
+    "rule_unreadable": "a rule that may govern this call cannot currently be read (this deployment's organization policy, a partition of the person's standing rules, or this call against a deny or ask rule), so whether one forbids it is unknown",
+    "ask_rule": "an explicit ask rule matched this call (a person's or the deployment's ask-me-each-time outranks a standing allow rule)",
+    "denial_limit_fallback": "the auto-mode classifier refused too many calls in a row, so a person decides",
+    "classifier_no_ruling": "the auto-mode classifier could not judge this call, so a person decides",
+    "requires_user_interaction": "this tool's server declares that a call must be put to a person",
+    "cross_boundary": "this run executes on a device outside the deployment's trust boundary and the deployment is multi-tenant, so an org-side write — or, after an off-target read, a call bound for the device — is confirmed by the deployment's approver for this call: no standing allow rule and no automatic lane answers for it, and an allow the configuration gives (a blanket seat or a policy's answer) is refused",
+    "operator_forced": "this call arrived already marked as requiring confirmation (an earlier layer of this run, or the task that delegated it, judged it so) — it is cleared by confirming this call, never by a standing allow rule",
+    "shell_floor": "this deployment mandates per-call confirmation for shell commands (shellGate: always)",
+    "target_unresolved": "where this write leads on disk could not be determined (a link on the way could not be examined, or the environment could not resolve the target), so whether it lands on a guarded path is unknown — it is cleared by confirming this call: no standing rule and no automatic decider answers for it, though a wired approver seat can",
+    "write_protection": "this write's target is on the deployment's write-protection table (the agent's own configuration is guarded one look per write) — it is cleared by confirming this call, never by a standing allow rule",
+    "tool_marks_mcp": "this tool carries egress/irreversibility/interaction marks (a mandated confirmation a rule cannot clear)",
+    "tool_marks_a2a": "this tool carries egress/irreversibility/interaction marks (a mandated confirmation a rule cannot clear)",
+    "policy_rra": "the deployment's policy requires a real approval for this call",
+    "artifact_shared_read": "this read targets another task's shared artifact — it is cleared by confirming this call",
+    "mode": "the permission mode puts this question to a person",
+    "unstated": "this call arrived already marked as requiring confirmation (an earlier layer of this run, or the task that delegated it, judged it so) — it is cleared by confirming this call, never by a standing allow rule",
+    "ordinary": "this call arrived already marked as requiring confirmation (an earlier layer of this run, or the task that delegated it, judged it so) — it is cleared by confirming this call, never by a standing allow rule",
+});
 export const CORE_USER_ATTACHMENT_KINDS = Object.freeze([
     "text",
     "notebook",

package/dist/generated/engineNoticeTables.js

@@ -26,6 +26,8 @@ export const CORE_ENGINE_NOTICE_CODES = Object.freeze([
     "config.peer_lane_unmounted",
     "config.secret_env_scrubbed",
     "config.credential_not_withheld",
+    "config.cross_boundary_posture_undeclared",
+    "config.cross_boundary_record_unwritten",
     "config.permission_mode_unavailable",
     "permission.ask_released_by_mode",
     "permission.read_deny_unapplied",
@@ -67,6 +69,8 @@ export const CORE_ENGINE_NOTICE_CODES = Object.freeze([
     "memory.project_scope_absent",
     "route.fallback_to_primary",
     "route.classifier_unroutable",
+    "route.seat_detached",
+    "advisor.not_attached",
     "route.credential_origin_mismatch",
     "route.response_model_mismatch",
     "route.tool_call_id_folded",
@@ -124,6 +128,8 @@ export const CORE_NOTICE_AUDIENCE = Object.freeze({
     "config.peer_lane_unmounted": "operator",
     "config.secret_env_scrubbed": "operator",
     "config.credential_not_withheld": "operator",
+    "config.cross_boundary_posture_undeclared": "operator",
+    "config.cross_boundary_record_unwritten": "operator",
     "config.permission_mode_unavailable": "user",
     "permission.ask_released_by_mode": "user",
     "permission.read_deny_unapplied": "user",
@@ -165,6 +171,8 @@ export const CORE_NOTICE_AUDIENCE = Object.freeze({
     "memory.project_scope_absent": "operator",
     "route.fallback_to_primary": "operator",
     "route.classifier_unroutable": "operator",
+    "route.seat_detached": "operator",
+    "advisor.not_attached": "user",
     "route.credential_origin_mismatch": "user",
     "route.response_model_mismatch": "operator",
     "route.tool_call_id_folded": "operator",
@@ -228,6 +236,8 @@ export const CORE_NOTICE_MINTER = Object.freeze({
     "config.peer_lane_unmounted": "engine",
     "config.secret_env_scrubbed": "engine",
     "config.credential_not_withheld": "engine",
+    "config.cross_boundary_posture_undeclared": "engine",
+    "config.cross_boundary_record_unwritten": "engine",
     "config.permission_mode_unavailable": "engine",
     "permission.ask_released_by_mode": "engine",
     "permission.read_deny_unapplied": "engine",
@@ -269,6 +279,8 @@ export const CORE_NOTICE_MINTER = Object.freeze({
     "memory.project_scope_absent": "engine",
     "route.fallback_to_primary": "engine",
     "route.classifier_unroutable": "engine",
+    "route.seat_detached": "engine",
+    "advisor.not_attached": "engine",
     "route.credential_origin_mismatch": "engine",
     "route.response_model_mismatch": "engine",
     "route.tool_call_id_folded": "engine",

package/dist/generated/settingsSchemaActiveTiers.d.ts

@@ -0,0 +1 @@
+export declare const SETTINGS_ACTIVE_TIERS_CLOSURE: () => any;

package/dist/generated/settingsSchemaActiveTiers.js

@@ -0,0 +1,14 @@
+export const SETTINGS_ACTIVE_TIERS_CLOSURE = () => {
+    function resolveActiveTiers(models) {
+        if (!models.activeTierGroup)
+            return undefined;
+        const group = (models.tierGroups ?? []).find((g) => g.name === models.activeTierGroup);
+        if (!group)
+            return undefined;
+        const bound = Object.entries(group.tiers).filter((e) => typeof e[1] === "string" && e[1].length > 0);
+        if (bound.length === 0)
+            return undefined;
+        return Object.fromEntries(bound);
+    }
+    return { resolveActiveTiers };
+};

package/dist/generated/settingsSchemaCallerTextEcho.d.ts

@@ -0,0 +1 @@
+export declare const SETTINGS_CALLER_TEXT_ECHO_CLOSURE: (stripControlAndBidi: (text: string) => string) => any;

package/dist/generated/settingsSchemaCallerTextEcho.js

@@ -0,0 +1,8 @@
+export const SETTINGS_CALLER_TEXT_ECHO_CLOSURE = (stripControlAndBidi) => {
+    const CALLER_TEXT_ECHO_MAX_CHARS = 64;
+    function echoCallerText(text) {
+        const clean = stripControlAndBidi(text);
+        return clean.length > CALLER_TEXT_ECHO_MAX_CHARS ? `${clean.slice(0, CALLER_TEXT_ECHO_MAX_CHARS)}…` : clean;
+    }
+    return { echoCallerText };
+};

package/dist/generated/settingsSchemaControlAndBidi.d.ts

@@ -0,0 +1 @@
+export declare const SETTINGS_CONTROL_AND_BIDI_CLOSURE: () => any;

package/dist/generated/settingsSchemaControlAndBidi.js

@@ -0,0 +1,8 @@
+export const SETTINGS_CONTROL_AND_BIDI_CLOSURE = () => {
+    const CONTROL_AND_BIDI_CHARS = "\\u0000-\\u001f\\u007f\\u061c\\u200e\\u200f\\u202a-\\u202e\\u2066-\\u2069";
+    const STRIP_RE = new RegExp(`[${CONTROL_AND_BIDI_CHARS}]`, "g");
+    function stripControlAndBidi(text) {
+        return text.replace(STRIP_RE, "");
+    }
+    return { stripControlAndBidi, CONTROL_AND_BIDI_CHARS };
+};

package/dist/generated/settingsSchemaDefaultModel.d.ts

@@ -0,0 +1,11 @@
+export declare const SETTINGS_DEFAULT_MODEL_CLOSURE: (resolveActiveTiers: (models: {
+    readonly tierGroups?: readonly {
+        readonly name: string;
+        readonly tiers?: {
+            readonly [tier: string]: string | undefined;
+        } | undefined;
+    }[] | undefined;
+    readonly activeTierGroup?: string | undefined;
+}) => {
+    [tier: string]: string;
+} | undefined) => any;

package/dist/generated/settingsSchemaDefaultModel.js

@@ -0,0 +1,25 @@
+export const SETTINGS_DEFAULT_MODEL_CLOSURE = (resolveActiveTiers) => {
+    const DEFAULT_ROLE_TIER_LADDER = ["pro", "flash", "lite"];
+    function resolveCatalogDefaultModel(models, has, fallback) {
+        const target = models.roles?.default;
+        const named = target !== undefined && "model" in target ? target.model : undefined;
+        const select = target !== undefined && "select" in target ? target.select : undefined;
+        if (!named && select)
+            return { kind: "select", select };
+        const tiers = resolveActiveTiers(models) ?? {};
+        const candidates = [
+            { source: "roles.default", name: named },
+            ...DEFAULT_ROLE_TIER_LADDER.map((t) => ({ source: `tierGroup.${t}`, name: tiers[t] })),
+        ];
+        const dangling = [];
+        for (const c of candidates) {
+            if (c.name === undefined || c.name === "")
+                continue;
+            if (has(c.name))
+                return { kind: "named", name: c.name, source: c.source, dangling };
+            dangling.push({ source: c.source, name: c.name });
+        }
+        return { kind: "named", name: fallback, source: "fallback", dangling };
+    }
+    return { resolveCatalogDefaultModel, DEFAULT_ROLE_TIER_LADDER };
+};

package/dist/generated/settingsSchemaFns.d.ts

@@ -19,6 +19,9 @@ export declare const SETTINGS_HOOKS_CLASSIFICATION_OUTCOMES: readonly ["loaded",
 export declare const SETTINGS_HOOKS_DROPPED_PIECE_CODES: readonly ["hooks-not-object", "unknown-event", "event-not-array", "matcher-invalid", "entry-invalid"];
 export declare const SETTINGS_HOOKS_REJECTION_CODES: readonly ["guard-outside-hooks", "hooks-is-matcher", "guard-under-unknown-event", "guard-event-not-array", "guard-matcher-invalid", "guard-entry-invalid"];
 export declare const SETTINGS_CLASSIFY_HOOKS_CONFIG: (settingsDoc: unknown) => HooksClassification;
+export declare const SETTINGS_STRIP_CONTROL_AND_BIDI: (text: string) => string;
+export declare const SETTINGS_CONTROL_AND_BIDI_CHARS: string;
+export declare const SETTINGS_ECHO_CALLER_TEXT: (text: string) => string;
 export declare const SETTINGS_READ_REQUEST_MCP_TRANSPORT: (t: unknown) => RequestMcpTransportRead;
 export declare const SETTINGS_READ_MCP_IDENTITY_HEADERS: (transport: Record<string, unknown>) => {
     principalHeader?: string;
@@ -29,3 +32,54 @@ export declare const SETTINGS_DESCRIBE_BAD_WIRE_NAME: (v: unknown) => string;
 export declare const SETTINGS_IS_CONTENT_ORIGIN_WORD: (v: unknown) => v is McpContentOrigin;
 export declare const SETTINGS_DESCRIBE_BAD_CONTENT_ORIGIN: (v: unknown) => string;
 export declare const SETTINGS_TOOL_WIRE_NAME_MAX_CHARS: 128;
+export declare const SETTINGS_URL_ALLOW_PATTERN_MATCHES: (url: string, pattern: string) => boolean;
+export declare const SETTINGS_IS_AT_LEAST: (layer: string, minTrust: string) => boolean;
+export declare const SETTINGS_MEMBER_ADMISSION: (category: string, member: string) => object;
+export declare const SETTINGS_SAFETY_MERGE_SPEC: object;
+export declare const SETTINGS_LAYER_ADMISSION: (source: string, workspace: string, category: string, member?: string) => string;
+export declare const SETTINGS_RESOLVE_ACTIVE_TIERS: (models: {
+    readonly tierGroups?: readonly {
+        readonly name: string;
+        readonly tiers?: {
+            readonly [tier: string]: string | undefined;
+        } | undefined;
+    }[] | undefined;
+    readonly activeTierGroup?: string | undefined;
+}) => {
+    [tier: string]: string;
+} | undefined;
+export declare const SETTINGS_RESOLVE_CATALOG_DEFAULT_MODEL: (models: {
+    readonly roles?: {
+        readonly default?: {
+            readonly model?: string | undefined;
+            readonly select?: {
+                readonly tier?: string | undefined;
+                readonly needs?: readonly string[] | undefined;
+                readonly prefer?: string | undefined;
+            } | undefined;
+        } | undefined;
+    } | undefined;
+    readonly tierGroups?: readonly {
+        readonly name: string;
+        readonly tiers?: {
+            readonly [tier: string]: string | undefined;
+        } | undefined;
+    }[] | undefined;
+    readonly activeTierGroup?: string | undefined;
+}, has: (name: string) => boolean, fallback: string) => {
+    readonly kind: "named";
+    readonly name: string;
+    readonly source: string;
+    readonly dangling: readonly {
+        readonly source: string;
+        readonly name: string;
+    }[];
+} | {
+    readonly kind: "select";
+    readonly select: {
+        readonly tier?: string | undefined;
+        readonly needs?: readonly string[] | undefined;
+        readonly prefer?: string | undefined;
+    };
+};
+export declare const SETTINGS_DEFAULT_ROLE_TIER_LADDER: readonly ["pro", "flash", "lite"];

package/dist/generated/settingsSchemaFns.js

@@ -1,6 +1,14 @@
 import { SETTINGS_CLASSIFY_HOOKS_CONFIG_CLOSURE } from './settingsSchemaHooksClassifier.js';
+import { SETTINGS_CONTROL_AND_BIDI_CLOSURE } from './settingsSchemaControlAndBidi.js';
+import { SETTINGS_CALLER_TEXT_ECHO_CLOSURE } from './settingsSchemaCallerTextEcho.js';
 import { SETTINGS_MCP_REQUEST_ENTRY_CLOSURE } from './settingsSchemaMcpRequestEntry.js';
 import { SETTINGS_MCP_CONTENT_ORIGINS } from './settingsSchemaTables.js';
+import { SETTINGS_URL_ALLOW_PATTERN_MATCHES_CLOSURE } from './settingsSchemaUrlPattern.js';
+import { SETTINGS_SAFETY_MERGE_CLOSURE } from './settingsSchemaSafetyMergeSpec.js';
+import { SETTINGS_MIN_TRUST_WORDS } from './settingsSchemaTables.js';
+import { SETTINGS_LAYER_SOURCES_CLOSURE } from './settingsSchemaSettingsSources.js';
+import { SETTINGS_ACTIVE_TIERS_CLOSURE } from './settingsSchemaActiveTiers.js';
+import { SETTINGS_DEFAULT_MODEL_CLOSURE } from './settingsSchemaDefaultModel.js';
 export const SETTINGS_AT_MENTION_MODES = Object.freeze([
     "all",
     "none",
@@ -135,7 +143,12 @@ export const SETTINGS_HOOKS_REJECTION_CODES = Object.freeze([
     "guard-entry-invalid",
 ]);
 export const SETTINGS_CLASSIFY_HOOKS_CONFIG = SETTINGS_CLASSIFY_HOOKS_CONFIG_CLOSURE(SETTINGS_HOOK_EVENTS);
-const SETTINGS_MCP_REQUEST_ENTRY = SETTINGS_MCP_REQUEST_ENTRY_CLOSURE(SETTINGS_MCP_CONTENT_ORIGINS, SETTINGS_STARTS_WITH_HTTP_SCHEME);
+const SETTINGS_CONTROL_AND_BIDI = SETTINGS_CONTROL_AND_BIDI_CLOSURE();
+export const SETTINGS_STRIP_CONTROL_AND_BIDI = SETTINGS_CONTROL_AND_BIDI.stripControlAndBidi;
+export const SETTINGS_CONTROL_AND_BIDI_CHARS = SETTINGS_CONTROL_AND_BIDI.CONTROL_AND_BIDI_CHARS;
+const SETTINGS_CALLER_TEXT_ECHO = SETTINGS_CALLER_TEXT_ECHO_CLOSURE(SETTINGS_STRIP_CONTROL_AND_BIDI);
+export const SETTINGS_ECHO_CALLER_TEXT = SETTINGS_CALLER_TEXT_ECHO.echoCallerText;
+const SETTINGS_MCP_REQUEST_ENTRY = SETTINGS_MCP_REQUEST_ENTRY_CLOSURE(SETTINGS_MCP_CONTENT_ORIGINS, SETTINGS_STARTS_WITH_HTTP_SCHEME, SETTINGS_ECHO_CALLER_TEXT);
 export const SETTINGS_READ_REQUEST_MCP_TRANSPORT = SETTINGS_MCP_REQUEST_ENTRY.readRequestMcpTransport;
 export const SETTINGS_READ_MCP_IDENTITY_HEADERS = SETTINGS_MCP_REQUEST_ENTRY.readMcpIdentityHeaders;
 export const SETTINGS_IS_USABLE_WIRE_NAME = SETTINGS_MCP_REQUEST_ENTRY.isUsableWireName;
@@ -143,3 +156,15 @@ export const SETTINGS_DESCRIBE_BAD_WIRE_NAME = SETTINGS_MCP_REQUEST_ENTRY.descri
 export const SETTINGS_IS_CONTENT_ORIGIN_WORD = SETTINGS_MCP_REQUEST_ENTRY.isContentOriginWord;
 export const SETTINGS_DESCRIBE_BAD_CONTENT_ORIGIN = SETTINGS_MCP_REQUEST_ENTRY.describeBadContentOrigin;
 export const SETTINGS_TOOL_WIRE_NAME_MAX_CHARS = SETTINGS_MCP_REQUEST_ENTRY.TOOL_WIRE_NAME_MAX_CHARS;
+export const SETTINGS_URL_ALLOW_PATTERN_MATCHES = SETTINGS_URL_ALLOW_PATTERN_MATCHES_CLOSURE();
+const SETTINGS_SAFETY_MERGE = SETTINGS_SAFETY_MERGE_CLOSURE(SETTINGS_MIN_TRUST_WORDS);
+export const SETTINGS_IS_AT_LEAST = SETTINGS_SAFETY_MERGE.isAtLeast;
+export const SETTINGS_MEMBER_ADMISSION = SETTINGS_SAFETY_MERGE.memberAdmission;
+export const SETTINGS_SAFETY_MERGE_SPEC = SETTINGS_SAFETY_MERGE.SAFETY_MERGE_SPEC;
+const SETTINGS_LAYER_SOURCES = SETTINGS_LAYER_SOURCES_CLOSURE(SETTINGS_SAFETY_MERGE_SPEC, SETTINGS_IS_AT_LEAST, SETTINGS_MEMBER_ADMISSION);
+export const SETTINGS_LAYER_ADMISSION = SETTINGS_LAYER_SOURCES.layerAdmission;
+const SETTINGS_ACTIVE_TIERS = SETTINGS_ACTIVE_TIERS_CLOSURE();
+export const SETTINGS_RESOLVE_ACTIVE_TIERS = SETTINGS_ACTIVE_TIERS.resolveActiveTiers;
+const SETTINGS_DEFAULT_MODEL = SETTINGS_DEFAULT_MODEL_CLOSURE(SETTINGS_RESOLVE_ACTIVE_TIERS);
+export const SETTINGS_RESOLVE_CATALOG_DEFAULT_MODEL = SETTINGS_DEFAULT_MODEL.resolveCatalogDefaultModel;
+export const SETTINGS_DEFAULT_ROLE_TIER_LADDER = SETTINGS_DEFAULT_MODEL.DEFAULT_ROLE_TIER_LADDER;

package/dist/generated/settingsSchemaMcpRequestEntry.d.ts

@@ -1 +1 @@
-export declare const SETTINGS_MCP_REQUEST_ENTRY_CLOSURE: (MCP_CONTENT_ORIGINS: readonly ["local", "execution", "external"], startsWithHttpScheme: (raw: string) => boolean) => any;
+export declare const SETTINGS_MCP_REQUEST_ENTRY_CLOSURE: (MCP_CONTENT_ORIGINS: readonly ["local", "execution", "external"], startsWithHttpScheme: (raw: string) => boolean, echoCallerText: (text: string) => string) => any;