@sema-agent/client-core 0.102.0 → 0.104.0

package/dist/generated/settingsSchemaTypes.d.ts

@@ -118,7 +118,7 @@ export interface McpEntryKeyIssue {
     readonly path: string;
     readonly reason: string;
     readonly member?: string;
-    readonly fault?: "not_plain_record" | "member_not_string" | "member_name_reserved";
+    readonly fault?: PlainStringRecordFault;
 }
 export type RequestMcpTransportRead = {
     ok: true;
@@ -128,6 +128,8 @@ export type RequestMcpTransportRead = {
     ok: false;
     issue: McpEntryKeyIssue;
 };
+declare const PLAIN_STRING_RECORD_FAULTS: readonly ["not_plain_record", "member_not_string", "member_name_reserved"];
+export type PlainStringRecordFault = (typeof PLAIN_STRING_RECORD_FAULTS)[number];
 declare const MCP_CONTENT_ORIGINS: readonly ["local", "execution", "external"];
 export type McpContentOrigin = (typeof MCP_CONTENT_ORIGINS)[number];
 export {};

package/dist/hitl/automaticAnswerVerdict.d.ts

@@ -20,7 +20,7 @@ export type AutomaticAnswerVerdict = {
     readonly kind: 'unknown';
     readonly why: AutomaticAnswerUnknownWhy;
 };
-export declare const MODE_ARBITRATION: Readonly<Record<"hook" | "write_protection" | "mode" | "target_unresolved" | "content_question" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "org_rule" | "rule_unreadable" | "ask_rule" | "denial_limit_fallback" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", CoreModeArbitrationRow>>;
+export declare const MODE_ARBITRATION: Readonly<Record<"hook" | "write_protection" | "mode" | "target_unresolved" | "content_question" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "org_rule" | "rule_unreadable" | "ask_rule" | "denial_limit_fallback" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", CoreModeArbitrationRow>>;
 export declare function foldModeArbitrationRow(classes: Iterable<string>, askFace?: AutomaticAnswerAskFace): CoreModeArbitrationRow;
 export declare function automaticAnswerVerdict(card: object | null | undefined, lane: AutomaticAnswerLane, facts?: AutomaticAnswerFacts | null): AutomaticAnswerVerdict;
 export declare function mandatedApprovalDetailOf(card: object | null | undefined, lang?: UiLanguage): string;

package/dist/hitl/automaticAnswerVerdict.js

@@ -1,4 +1,4 @@
-import { CORE_MODE_ARBITRATION, CORE_MODE_RELEASE_REASONS } from '../generated/engineFactTables.js';
+import { CORE_MODE_ARBITRATION, CORE_MODE_RELEASE_REASONS, CORE_REAL_APPROVAL_ASK_CLASSES } from '../generated/engineFactTables.js';
 import { CORE_RELEASABLE_ASK_CLASSES_BY_FACE, CORE_SHELL_FACE_TOOL_NAMES } from '../generated/engineAskFaceTables.js';
 import { mandatedApprovalDetail } from '../gateVocabulary.js';
 import { msg, renderMessage } from '../i18n/translate.js';
@@ -60,12 +60,13 @@ export function foldModeArbitrationRow(classes, askFace) {
         return ORDINARY_ROW;
     return Object.freeze({ bypassImmune, classifierEligible, sandboxAdmission, ruleMayClear, hookAskFloor });
 }
-function rowBlocks(lane, row) {
-    return lane === 'mode_posture' ? row.bypassImmune : !row.ruleMayClear;
-}
+const REAL_APPROVAL_CLASSES = new Set(CORE_REAL_APPROVAL_ASK_CLASSES);
 function classBlocks(lane, c, face) {
-    const row = TABLE[c];
-    return lane === 'mode_posture' ? bypassImmuneOn(c, face) : !row.ruleMayClear;
+    if (lane === 'mode_posture')
+        return bypassImmuneOn(c, face);
+    if (lane === 'standing_rule')
+        return !TABLE[c].ruleMayClear;
+    return REAL_APPROVAL_CLASSES.has(c);
 }
 function mustAsk(road, extra) {
     return Object.freeze({ kind: 'must_ask', road, ...(extra?.askClass !== undefined ? { askClass: extra.askClass } : {}), ...(extra?.origin !== undefined ? { origin: extra.origin } : {}) });
@@ -88,6 +89,42 @@ function evidenceView(card, ...keys) {
     }
     return out;
 }
+const SLOT_ABSENT = Object.freeze({ kind: 'absent' });
+const SLOT_UNREADABLE = Object.freeze({ kind: 'unreadable' });
+const EVIDENCE_CHAIN_MAX = 32;
+function evidenceSlotOf(o, key) {
+    let at = o;
+    for (let depth = 0; at !== null; depth++) {
+        if (depth >= EVIDENCE_CHAIN_MAX)
+            return SLOT_UNREADABLE;
+        const d = Object.getOwnPropertyDescriptor(at, key);
+        if (d !== undefined)
+            return Object.hasOwn(d, 'value') ? Object.freeze({ kind: 'data', value: d.value }) : SLOT_UNREADABLE;
+        at = Object.getPrototypeOf(at);
+    }
+    return SLOT_ABSENT;
+}
+const EVIDENCE_BOOLEAN_KEYS = Object.freeze(['requiresRealApproval', 'governanceForced', 'mandated']);
+const EVIDENCE_STRING_KEYS = Object.freeze(['origin', 'ruleOffersAbsence', 'mandate']);
+function evidenceUnreadable(card) {
+    for (const k of EVIDENCE_BOOLEAN_KEYS) {
+        const slot = evidenceSlotOf(card, k);
+        if (slot.kind === 'unreadable' || (slot.kind === 'data' && slot.value !== undefined && typeof slot.value !== 'boolean'))
+            return true;
+    }
+    for (const k of EVIDENCE_STRING_KEYS) {
+        const slot = evidenceSlotOf(card, k);
+        if (slot.kind === 'unreadable' || (slot.kind === 'data' && slot.value !== undefined && (typeof slot.value !== 'string' || slot.value === '')))
+            return true;
+    }
+    const risk = evidenceSlotOf(card, 'risk');
+    if (risk.kind === 'absent' || (risk.kind === 'data' && risk.value === undefined))
+        return false;
+    if (risk.kind === 'unreadable' || typeof risk.value !== 'object' || risk.value === null)
+        return true;
+    const nested = evidenceSlotOf(risk.value, 'requiresRealApproval');
+    return nested.kind !== 'data' || typeof nested.value !== 'boolean';
+}
 function readHostAskRuleMatched(facts) {
     if (typeof facts !== 'object' || facts === null)
         return undefined;
@@ -138,14 +175,14 @@ export function automaticAnswerVerdict(card, lane, facts) {
                     return mustAsk('allow_rule_shadow');
             }
         }
+        if (evidenceUnreadable(card))
+            return UNKNOWN.card_unreadable;
         const pair = readAskClassPairState(card);
         if (pair.state === 'malformed')
             return UNKNOWN.classes_malformed;
         if (pair.state === 'absent')
             return UNKNOWN.classes_absent;
         const classes = pair.classes;
-        const folded = foldModeArbitrationRow(classes, face);
-        let anyKnown = false;
         let firstBlocking;
         let anyUnknown = false;
         for (const c of classes) {
@@ -153,12 +190,11 @@ export function automaticAnswerVerdict(card, lane, facts) {
                 anyUnknown = true;
                 continue;
             }
-            anyKnown = true;
             if (firstBlocking === undefined && classBlocks(lane, c, face))
                 firstBlocking = c;
         }
-        if (anyKnown && rowBlocks(lane, folded))
-            return mustAsk('ask_class', firstBlocking !== undefined ? { askClass: firstBlocking } : undefined);
+        if (firstBlocking !== undefined)
+            return mustAsk('ask_class', { askClass: firstBlocking });
         if (anyUnknown)
             return UNKNOWN.class_not_in_table;
         if (lane !== 'mode_posture')

package/dist/hitl/decisionConflict.js

@@ -1,9 +1,10 @@
 import { APPROVAL_BINDING_MISMATCH, CHECKPOINT_UNSUPPORTED_VERSION, RESUME_OUTCOME_INVALID } from '../engineErrorCodes.js';
 import { msg, renderMessage } from '../i18n/translate.js';
 import { ownDataField } from '../ownKey.js';
-import { isSlotCarrier, PROTOCOL_ERROR_NAME, protocolErrorNameOf, readRefusalField } from '../wireFailureShape.js';
+import { isSlotCarrier, PROTOCOL_ERROR_NAME, protocolErrorNameReading, readRefusalSlots, readThrownExtraSnapshot } from '../wireFailureShape.js';
 const BINDING_SEAT_FIELDS = new Set(['boundCallId', 'boundInputHash']);
 const ANSWER_FIELD = 'answer';
+const REFUSAL_WORD_KEYS = Object.freeze(['field', 'reason']);
 const GRANT_DIGEST_FIELD = 'boundGrantDigest';
 function namedProtocolOf(r) {
     return r.state === 'named' ? r.name : undefined;
@@ -11,6 +12,7 @@ function namedProtocolOf(r) {
 export function decisionConflictOf(err, captured, protocolNameRead) {
     if (!isSlotCarrier(err))
         return undefined;
+    const extra = readThrownExtraSnapshot(err);
     let code;
     if (captured !== undefined) {
         if (captured.state !== 'read')
@@ -25,23 +27,21 @@ export function decisionConflictOf(err, captured, protocolNameRead) {
             return undefined;
         }
     }
-    const protocolName = protocolNameRead !== undefined ? namedProtocolOf(protocolNameRead) : protocolErrorNameOf(err);
+    const protocolName = namedProtocolOf(protocolNameRead ?? protocolErrorNameReading(err, extra));
     if (code === CHECKPOINT_UNSUPPORTED_VERSION)
         return 'format_version';
     const bindingFamily = code === APPROVAL_BINDING_MISMATCH || (code === undefined && protocolName === PROTOCOL_ERROR_NAME.ApprovalBindingMismatchError);
     if (!bindingFamily && code !== RESUME_OUTCOME_INVALID)
         return undefined;
-    let field;
-    try {
-        field = readRefusalField(err);
-    }
-    catch {
-        field = undefined;
-    }
+    const slots = readRefusalSlots(err, REFUSAL_WORD_KEYS, extra.bag);
+    const field = slots.field.word;
     if (code === RESUME_OUTCOME_INVALID)
         return field === ANSWER_FIELD ? 'answer_invalid' : field === GRANT_DIGEST_FIELD ? 'grant_changed' : undefined;
-    if (field === undefined)
-        return 'row_integrity';
+    if (field === undefined) {
+        if (slots.field.present)
+            return undefined;
+        return slots.reason.word !== undefined ? 'row_integrity' : undefined;
+    }
     return BINDING_SEAT_FIELDS.has(field) ? 'binding_mismatch' : undefined;
 }
 export const DECISION_ANSWER_INVALID_CONTENT = 'The engine rejected the answer itself because it does not fit the question that was asked · Nothing was decided and the question is still waiting · Correct the answer and send it again';

package/dist/hitl/decisionRefusal.d.ts

@@ -54,6 +54,7 @@ export interface DecisionRefusalReading {
     readonly transient?: true;
     readonly conflict?: DecisionRefusalConflict;
     readonly unrecoverable?: true;
+    readonly acceptableForm?: {} | null;
 }
 export declare function mintDecisionRefusalReading(err: {} | null | undefined, context?: RefusalRouteContext, attributionCarried?: boolean, delivered?: DeliveredReading, carried?: RefusalCarrier): DecisionRefusalReading;
 export declare function readDecisionRefusalReading(err: {} | null | undefined, context?: RefusalRouteContext): DecisionRefusalReading;

package/dist/hitl/decisionRefusal.js

@@ -1,4 +1,4 @@
-import { ASK_GONE, ASK_GONE_PARKED, RESUME_PREFLIGHT_REJECTED, isDecideAlreadyResolvedCode, isDecideParkMovedCode, isDecideRowUnrevivableCode, refusalRetriableReading, refusalSaysStillPending } from '../engineErrorCodes.js';
+import { ASK_GONE, ASK_GONE_PARKED, RESUME_CONSTRAINT_REJECTED, RESUME_PREFLIGHT_REJECTED, isDecideAlreadyResolvedCode, isDecideParkMovedCode, isDecideRowUnrevivableCode, refusalRetriableReading, refusalSaysStillPending } from '../engineErrorCodes.js';
 import { isUiLanguage } from '../env/uiLanguage.js';
 import { msg, renderMessage } from '../i18n/translate.js';
 import { notPendingCauseReading, refusalCauseWordOf } from './approvalEndingCause.js';
@@ -7,7 +7,7 @@ import { isAlreadyResolvedGateReason, isCodeClassifiedGateFailure } from './park
 import { decisionConflictOf } from './decisionConflict.js';
 import { readLivePendingRows } from './livePendingAsk.js';
 import { guardedRead, ownDataField, readOwnDataValue } from '../ownKey.js';
-import { PROTOCOL_ERROR_NAME, THROWN_SLOT_UNREADABLE, isDisplayableWireCode, isSlotCarrier, ownFoldedCodeBitsOf, protocolErrorNameReading, readErrorRecord, readRefusalField, readThrownSlot } from '../wireFailureShape.js';
+import { PROTOCOL_ERROR_NAME, THROWN_SLOT_UNREADABLE, isDisplayableWireCode, isSlotCarrier, ownFoldedCodeBitsOf, protocolErrorNameReading, readErrorPresent, readErrorRecord, readRefusalField, readThrownSlot } from '../wireFailureShape.js';
 import { attributionRefusalOf, carrierReadOf } from './attributionLadder.js';
 import { CODE_UNREADABLE, ownReadingSlot } from '../engineWireFor.js';
 export const ASK_DECIDED_CODE = 'conflict.ask_decided';
@@ -223,6 +223,7 @@ export function mintDecisionRefusalReading(err, context, attributionCarried, del
     const inRange = standing !== undefined && status !== undefined;
     const conflict = inRange && status === 409 && obj !== undefined ? isolated(() => decisionConflictOf(obj, captured, pn)) : undefined;
     const unrecoverable = inRange && status !== undefined && Number.isInteger(status) && status >= 400 && status <= 599 && isDecideRowUnrevivableCode(errorCode);
+    const acceptableForm = errorCode === RESUME_CONSTRAINT_REJECTED && obj !== undefined ? isolated(() => readErrorPresent(obj, 'acceptableForm')) : undefined;
     const transient = inRange &&
         conflict !== 'grant_changed' &&
         !unrecoverable &&
@@ -244,6 +245,7 @@ export function mintDecisionRefusalReading(err, context, attributionCarried, del
         ...(transient ? { transient: true } : {}),
         ...(conflict !== undefined ? { conflict } : {}),
         ...(unrecoverable ? { unrecoverable: true } : {}),
+        ...(acceptableForm !== undefined ? { acceptableForm } : {}),
     });
 }
 export function readDecisionRefusalReading(err, context) {

package/dist/hitl/editedRuleTextPrecheck.d.ts

@@ -12,6 +12,7 @@ export type EditedRuleTextPrecheck = {
     message: string;
 };
 export type EditedRuleTextPrechecker = (text: string, command: string) => EditedRuleTextPrecheck;
+export declare function trimEditedRuleText(text: string): string;
 export declare function installEditedRuleTextPrechecker(fn: EditedRuleTextPrechecker | null): () => void;
 export declare function hasEditedRuleTextPrechecker(): boolean;
 export declare function precheckEditedRuleText(text: string, command: string): EditedRuleTextPrecheck | undefined;

package/dist/hitl/editedRuleTextPrecheck.js

@@ -1,4 +1,29 @@
 let installed = null;
+function escapedAt(s, i) {
+    let n = 0;
+    for (let j = i - 1; j >= 0 && s[j] === '\\'; j -= 1)
+        n += 1;
+    return n % 2 === 1;
+}
+export function trimEditedRuleText(text) {
+    if (typeof text !== 'string')
+        return text;
+    const outer = text.trim();
+    let open = -1;
+    for (let i = 0; i < outer.length; i += 1) {
+        if (outer[i] === '(' && !escapedAt(outer, i)) {
+            open = i;
+            break;
+        }
+    }
+    if (open <= 0)
+        return outer;
+    const head = outer.slice(0, open);
+    const name = head.trimEnd();
+    if (name === head || name.length === 0 || name.endsWith('\\'))
+        return outer;
+    return name + outer.slice(open);
+}
 export function installEditedRuleTextPrechecker(fn) {
     const prev = installed;
     installed = fn;
@@ -13,7 +38,7 @@ export function precheckEditedRuleText(text, command) {
     const fn = installed;
     if (fn === null)
         return undefined;
-    return fn(text, command);
+    return fn(trimEditedRuleText(text), command);
 }
 export function _resetEditedRuleTextPrecheckerForTest() {
     installed = null;

package/dist/hitl/persistedRulesWire.js

@@ -208,6 +208,7 @@ const PERSISTED_RULE_MATCH_KEYS = Object.freeze({
     host: 'rules.match.host',
     subdomain: 'rules.match.subdomain',
     pattern: 'rules.match.pattern',
+    tool: 'rules.match.tool',
 });
 export function persistedRuleMatchLabel(ruleOrMatch, lang) {
     const word = typeof ruleOrMatch === 'string' ? ruleOrMatch : ownSlot(ruleOrMatch, 'match');

package/dist/hitl/planReviewWire.d.ts

@@ -1,4 +1,5 @@
 import { type QuestionAnswer } from '../liveQuestionStore.js';
+import type { EngineWireInjection } from '../engineWireSdk.js';
 import { type PlanReviewModeAfter } from './hitlBridge.js';
 import type { AgentClient } from '@sema-agent/sdk';
 import type { ReopenCardVerdict } from '../adapter/activeRunSelfHeal.js';
@@ -66,7 +67,7 @@ export type PlanReviewWireClient = {
     assistant: Pick<AgentClient['assistant'], 'planReview'>;
     runs: Pick<AgentClient['runs'], 'get'>;
 };
-export interface PlanReviewWire {
+export interface PlanReviewWire extends EngineWireInjection<PlanReviewWireClient> {
     client: PlanReviewWireClient;
 }
 export interface PlanReviewDecisionOutcome extends PlanReviewOutcomeMeta {

package/dist/hitl/planReviewWire.js

@@ -2,6 +2,7 @@ import { publishQuestionFrame, publishQuestionFrameFor, registerLocalQuestionRes
 import { hostLog } from '../host.js';
 import { abortableSleep, settleWithinDeadline } from '../abortableSleep.js';
 import { clientHasVerbs, engineWireFor, noAnswerKindOf, sendOnce } from '../engineWireFor.js';
+import { engineCapTrue } from '../engineCapsCache.js';
 import { engineWireTarget } from '../engineWireTarget.js';
 import { enqueuePlanReviewOutcome } from '../notifications.js';
 import { corruptStoredRowContent, corruptStoredRowWhere } from '../wireErrorTriage.js';
@@ -370,7 +371,7 @@ export function armPlanReviewApproval(result, sessionKey, opts) {
         }
         const wire = opts?.wire;
         if (wire !== undefined) {
-            if (!usablePlanReviewWireClient(wire.client)) {
+            if (engineWireFor(wire, DEFAULT_SESSION_KEY, usablePlanReviewWireClient).kind !== 'injected') {
                 hostLog('error', 'planReviewWire: plan_review card NOT armed — the engine client supplied by the host is not usable (needs assistant.planReview and runs.get)');
                 return false;
             }
@@ -454,15 +455,6 @@ export function planReviewOutcomeTail(taskId, decision, effect, cause) {
             return `Do not state the result as fact: tell the user the ${decision} was submitted but its effect could not be confirmed; TaskOutput("${taskId}") shows where the task stands.`;
     }
 }
-function clientOnlyView(wire) {
-    if (wire === undefined || wire === null || typeof wire !== 'object')
-        return wire;
-    return {
-        get client() {
-            return wire.client;
-        },
-    };
-}
 function planReviewDecisionTimedOutOutcome(decision) {
     return (`The plan_review ${decision} was sent, but no answer came back from the engine within the time limit this host allows for it — ` +
         `it may have taken effect (${decision === 'approve' ? 'an approval keeps the engine busy until the resumed work finishes' : 'the engine may still be applying it'}).`);
@@ -654,7 +646,7 @@ async function decidePlanReviewInner(taskId, decision, permissionModeAfter, disp
     let stillParkedCause;
     let statusSeen;
     const wire = opts?.wire;
-    const resolved = engineWireFor(clientOnlyView(wire), DEFAULT_SESSION_KEY, usablePlanReviewWireClient);
+    const resolved = engineWireFor(wire, DEFAULT_SESSION_KEY, usablePlanReviewWireClient);
     const badMode = permissionModeAfter !== undefined && !isPlanReviewModeAfter(permissionModeAfter);
     if (badMode) {
         hostLog('error', `planReviewWire: ${decision} NOT sent — permissionModeAfter must be "default" or "acceptEdits"`);
@@ -683,11 +675,15 @@ async function decidePlanReviewInner(taskId, decision, permissionModeAfter, disp
             try {
                 const mode = isPlanReviewModeAfter(permissionModeAfter) ? permissionModeAfter : undefined;
                 const reason = denyReasonForWire(opts?.reason, `plan-review ${taskId}`);
+                const capsBase = resolved.kind === 'target' ? resolved.target.baseUrl : resolved.capsBaseUrl;
+                const checkpointId = gateBefore !== undefined && engineCapTrue(capsBase, 'planReviewCheckpointId') ? gateBefore : undefined;
                 const reqBody = { decision };
                 if (reason !== undefined)
                     reqBody.reason = reason;
                 if (mode !== undefined)
                     reqBody.permissionModeAfter = mode;
+                if (checkpointId !== undefined)
+                    reqBody.checkpointId = checkpointId;
                 let body;
                 try {
                     body = await sendOnce(undefined, () => client.assistant.planReview(taskId, reqBody));
@@ -697,7 +693,7 @@ async function decidePlanReviewInner(taskId, decision, permissionModeAfter, disp
                     const defaultConflict = mode === 'default' && conflict?.status === 400 && conflict?.errorCode === REQUEST_FIELD_CONFLICT;
                     if (defaultConflict && !directFailureVerdictOf(e1, directSafetyStopOf(e1)).yields) {
                         hostLog('debug', 'planReviewWire: permissionModeAfter "default" refused as not applicable — re-sending the approval without the key (same meaning)');
-                        body = await sendOnce(undefined, () => client.assistant.planReview(taskId, reason !== undefined ? { decision, reason } : { decision }));
+                        body = await sendOnce(undefined, () => client.assistant.planReview(taskId, { decision, ...(reason !== undefined ? { reason } : {}), ...(checkpointId !== undefined ? { checkpointId } : {}) }));
                     }
                     else {
                         throw e1;

package/dist/hitl/sessionPolicyDeliverable.d.ts

@@ -22,4 +22,3 @@ export interface SessionPolicyDeliverableOptions {
 }
 export declare function sessionPolicyDeliverable(behavior: 'deny' | 'ask', rules: readonly string[], opts?: SessionPolicyDeliverableOptions): SessionPolicyDeliverability;
 export declare function sessionPolicyWithheldNotice(why: SessionPolicyWithheldWhy, lang?: UiLanguage): string;
-export declare function legacyToolNameFailureNoteOf(code: string | undefined): string | undefined;

package/dist/hitl/sessionPolicyDeliverable.js

@@ -1,11 +1,10 @@
-import { CONFIG_LEGACY_TOOL_NAME } from '../engineErrorCodes.js';
 import { rosterMountedNames } from '../rosterMountedNames.js';
 import { msg, renderMessage } from '../i18n/translate.js';
 import { readOwnDataValue } from '../ownKey.js';
 import { denyEntryReading, ruleCompileVerdict } from '../ruleCompileVerdict.js';
+import { hasCoreValuePort, ruleNameCovers } from '../coreValuePorts.js';
 import { ruleToolNameVerdictOf } from '../protocolSegment.js';
 import { PREFIXES_IN_PROSE, REFUSED_NAME_FIX } from './refusedToolNameProse.js';
-import { prepareRefusalNoteOf } from '../prepareRefusal.js';
 import { CORE_PROTOCOL_PREFIXES } from '../generated/toolNameTables.js';
 const COVERING_NAMESPACE_PREFIXES = CORE_PROTOCOL_PREFIXES;
 const WITHHELD_NOTICE = {
@@ -15,7 +14,7 @@ const WITHHELD_NOTICE = {
     wildcard: 'Not written to this session’s rule record: this rule uses a wildcard (*), and an engine that matches that record by exact tool name would block none of the tools it covers.',
     not_a_tool_name: 'Not written to this session’s rule record: this entry is not exactly one tool name — it is empty, not text, has spaces around the name, is not a single tool name in rule syntax (for example it contains a backslash or a parenthesis, or is longer than a rule can be), or spells its server or agent peer part in a way the engine never uses when naming tools (for example with a dot or a space), so no tool would ever match it.',
     legacy_tool_name: `Not written to this session’s rule record: unless a tool by exactly this name is available, the engine refuses it — it is a retired tool name, or it contains "__" but does not start with ${PREFIXES_IN_PROSE} — and with it in that record every later run of this session would fail at startup until that entry is removed from the record. ${REFUSED_NAME_FIX}`,
-    not_in_roster: 'Not written to this session’s rule record: the tool roster supplied for this check has no tool by exactly this name, as a name or an alias, with letter case counted — it may be misspelled, or name a tool this deployment does not provide — so recorded as it is it would block nothing here.',
+    not_in_roster: 'Not written to this session’s rule record: the tool roster supplied for this check has no tool this rule would block — no tool by exactly this name, as a name or an alias, with letter case counted, and, where the engine also reads the name as naming every tool of a server (a server whose own name contains "__"), no tool of that server either — it may be misspelled, or name a tool this deployment does not provide — so recorded as it is it would block nothing here.',
     namespace_covering_unconfirmed: msg('session.policy.withheld.namespaceCoveringUnconfirmed'),
 };
 export const SESSION_POLICY_WITHHELD_WHY = Object.freeze(Object.keys(WITHHELD_NOTICE));
@@ -153,11 +152,14 @@ export function sessionPolicyDeliverable(behavior, rules, opts) {
                 why = 'not_a_tool_name';
         }
         let inertReason;
+        let coveringRow = false;
         if (engineAsked) {
             const reading = entryReadingOf(r);
             if (reading === 'unknown')
                 return unreadable();
-            if (reading !== 'row') {
+            if (reading === 'covering')
+                coveringRow = true;
+            else if (reading !== 'row') {
                 inertReason = reading.reason;
                 if (why === undefined)
                     why = reading.why;
@@ -170,8 +172,13 @@ export function sessionPolicyDeliverable(behavior, rules, opts) {
             if (grammar === 'refused')
                 why = 'not_a_tool_name';
         }
-        if (why === undefined && mounted !== undefined && !mounted.has(r) && covering === undefined)
-            why = 'not_in_roster';
+        if (why === undefined && mounted !== undefined && !mounted.has(r) && covering === undefined) {
+            const reach = coveringRow ? coveredRosterName(r, mounted) : 'none';
+            if (reach === 'unknown')
+                return unreadable();
+            if (reach === 'none')
+                why = 'not_in_roster';
+        }
         if (why === undefined)
             exact.push(r);
         else {
@@ -191,12 +198,29 @@ export function sessionPolicyDeliverable(behavior, rules, opts) {
 function entryReadingOf(rule) {
     const reading = denyEntryReading(rule);
     if (reading.kind === 'row')
-        return 'row';
+        return reading.covering === true ? 'covering' : 'row';
     if (reading.kind === 'unknown')
         return 'unknown';
     const reason = reading.reason;
     return reason === 'grammar' || reason === 'content_unsupported' ? { why: 'not_a_tool_name', reason } : { why: 'wildcard', reason };
 }
+function coveredRosterName(rule, mounted) {
+    if (!hasCoreValuePort('ruleNameCovers'))
+        return 'unknown';
+    try {
+        for (const name of mounted) {
+            const v = ruleNameCovers(rule, name);
+            if (v === true)
+                return 'covers';
+            if (v !== false)
+                return 'unknown';
+        }
+        return 'none';
+    }
+    catch {
+        return 'unknown';
+    }
+}
 export function sessionPolicyWithheldNotice(why, lang) {
     if (typeof why === 'string' && Object.hasOwn(WITHHELD_NOTICE, why)) {
         const sentence = WITHHELD_NOTICE[why];
@@ -204,6 +228,3 @@ export function sessionPolicyWithheldNotice(why, lang) {
     }
     return 'Not written to this session’s rule record.';
 }
-export function legacyToolNameFailureNoteOf(code) {
-    return code === CONFIG_LEGACY_TOOL_NAME ? prepareRefusalNoteOf(code) : undefined;
-}

package/dist/hitl/sessionPolicyWire.js

@@ -21,7 +21,7 @@ const RULE_FIELD_PRESENCE = {
     toolDeny: true,
     allowDirs: true,
 };
-const RECORD_META_KEYS = Object.freeze(['rev', 'gen', 'grammar']);
+const RECORD_META_KEYS = Object.freeze(['rev', 'gen', 'grammar', 'operatorRules']);
 const _metaKeysPin = true;
 void _metaKeysPin;
 export const SESSION_POLICY_RULE_FIELDS = Object.freeze(Object.keys(RULE_FIELD_PRESENCE));

package/dist/hitl/toolApprovalWire.d.ts

@@ -1,6 +1,7 @@
 import { type HitlClientLike, type DecideOperationObserver } from './hitlBridge.js';
 import { readApprovalCardWord, type ApprovalCardWord } from './approvalCardReading.js';
 import { type ApprovalAllowRuleShadow } from './allowRuleShadow.js';
+import { CORE_PERSISTED_RULE_MATCHES } from '../generated/engineFactTables.js';
 import type { UiLanguage } from '../env/uiLanguage.js';
 import type { SessionRuleInertReason } from './sessionPolicyWire.js';
 import { type ApprovalCardClaim } from './approvalHolds.js';
@@ -30,22 +31,33 @@ export type { RuleOfferBatchMember };
 export type { RuleOfferUncoveredDetail };
 export type { RuleOfferUncoveredReason };
 export { RULE_OFFER_MATCHES, RULE_OFFER_BATCH_MEMBER_KINDS, RULE_OFFER_UNCOVERED_REASONS };
+type RuleOfferMatchWord = (typeof CORE_PERSISTED_RULE_MATCHES)[number];
+type RuleOfferBatchMemberReading = Exclude<RuleOfferBatchMember, {
+    kind: 'command';
+}> | (Omit<Extract<RuleOfferBatchMember, {
+    kind: 'command';
+}>, 'match'> & {
+    match: RuleOfferMatchWord;
+});
 export type { AskOrigin };
 export type { RuleOffersAbsence };
 export type { DenialLimitKind };
 export type { DenialLimitFallback };
 export { RULE_OFFERS_ABSENCE_REASONS };
 export declare const ASK_ORIGIN_WORDS: readonly string[];
-export type RuleOfferReading = (Extract<SdkRuleOffer, {
+export type RuleOfferReading = (Omit<Extract<SdkRuleOffer, {
     kind: 'single';
-}> & {
+}>, 'match'> & {
+    match: RuleOfferMatchWord;
     offerIndex: number;
 }) | (Omit<Extract<SdkRuleOffer, {
     kind: 'batch';
-}>, 'uncoveredDetail'> & {
+}>, 'uncoveredDetail' | 'rules'> & RuleOfferBatchReadingSeats);
+interface RuleOfferBatchReadingSeats {
+    rules: RuleOfferBatchMemberReading[];
     offerIndex: number;
     uncoveredDetail?: readonly RuleOfferUncoveredDetail[];
-});
+}
 export interface ApprovalCardAllowDecision {
     kind: 'allow';
     allowSession: boolean;
@@ -85,6 +97,7 @@ export interface ApprovalCardRequest {
     };
     wireNote?: string;
     argsUnavailable?: true;
+    argsRewritten?: true;
     governanceForced?: true;
     delegation?: ToolApprovalDelegation;
     ruleOffers?: RuleOfferReading[];
@@ -166,7 +179,7 @@ export interface ReadRootCandidateView {
     covers?: 'exact';
 }
 export type ToolApprovalDelegation = ApprovalCardDelegation;
-export declare const TOOL_APPROVAL_FRAME_KEYS_MIRROR: readonly ["type", "approvalId", "toolCallId", "toolName", "sourceTaskId", "fromSubagent", "sourceAgentName", "message", "args", "argsOmitted", "governanceForced", "ruleOffers", "ruleOffersAbsence", "denialLimitFallback", "readRootCandidate", "mandated", "mandate", "origin", "approvalCard", "askClass", "classes", "inputHasBidi", "parked", "persistedRuleShadowed", "allowRuleShadowed", "probeCause", "probeReason", "rememberRefused", "boundGrantDigest", "boundGrantAbsence", "boundGrants", "classifierNoRuling", "ruleEvidence", "requiresRealApproval", "expiresInMs", "expiresAtMs", "serverNowMs", "delegation", "outcome", "cause"];
+export declare const TOOL_APPROVAL_FRAME_KEYS_MIRROR: readonly ["type", "approvalId", "toolCallId", "toolName", "sourceTaskId", "fromSubagent", "sourceAgentName", "message", "args", "argsOmitted", "governanceForced", "ruleOffers", "ruleOffersAbsence", "denialLimitFallback", "readRootCandidate", "mandated", "mandate", "origin", "approvalCard", "askClass", "classes", "inputHasBidi", "parked", "persistedRuleShadowed", "allowRuleShadowed", "probeCause", "probeReason", "rememberRefused", "boundGrantDigest", "boundGrantAbsence", "boundGrants", "classifierNoRuling", "ruleEvidence", "requiresRealApproval", "expiresInMs", "expiresAtMs", "serverNowMs", "delegation", "outcome", "cause", "requestedBy"];
 export interface ApprovalMandatedFacts {
     readonly mandated?: true;
     readonly ruleOffersAbsence?: string;
@@ -263,8 +276,8 @@ export declare function approvalSupersedesDetail(card: Pick<ApprovalCardRequest,
 export declare function readDenialLimitFallback(v: unknown): DenialLimitFallback | undefined;
 export declare function readRuleOffers(v: unknown): RuleOfferReading[] | undefined;
 export declare function readRuleOfferSupply(offers: unknown): RuleOfferReading[] | undefined;
-export type ApprovalCardV1Facts = Pick<ApprovalCardRequest, 'toolName' | 'args'> & Pick<ApprovalCardRequest, 'toolCallId' | 'workerBadge' | 'wireNote' | 'argsUnavailable' | 'governanceForced' | 'delegation' | 'ruleOffersReadOnly' | 'inputHasBidi' | 'allowRuleShadow' | 'probeCause' | 'rememberRefused' | 'ruleEvidence' | 'requiresRealApproval' | 'ruleOffersAbsence' | 'denialLimitFallback' | 'askClass' | 'classes' | 'grantBinding' | 'unreadableEvidence' | 'message'>;
-export type ApprovalCardFacts = ApprovalCardV1Facts & Pick<ApprovalCardRequest, 'ruleOffers' | 'probeReason' | 'mandated' | 'mandate' | 'readRootCandidate' | 'origin' | 'approvalCard' | 'boundGrants' | 'classifierNoRuling' | 'allowSessionCarried' | 'cardPayloadUnreadable'>;
+export type ApprovalCardV1Facts = Pick<ApprovalCardRequest, 'toolName' | 'args'> & Pick<ApprovalCardRequest, 'toolCallId' | 'workerBadge' | 'wireNote' | 'argsUnavailable' | 'governanceForced' | 'delegation' | 'ruleOffersReadOnly' | 'inputHasBidi' | 'allowRuleShadow' | 'probeCause' | 'rememberRefused' | 'ruleEvidence' | 'requiresRealApproval' | 'ruleOffersAbsence' | 'denialLimitFallback' | 'askClass' | 'classes' | 'grantBinding' | 'unreadableEvidence' | 'message' | 'approvalCard'>;
+export type ApprovalCardFacts = ApprovalCardV1Facts & Pick<ApprovalCardRequest, 'argsRewritten' | 'ruleOffers' | 'probeReason' | 'mandated' | 'mandate' | 'readRootCandidate' | 'origin' | 'boundGrants' | 'classifierNoRuling' | 'allowSessionCarried' | 'cardPayloadUnreadable'>;
 export interface ApprovalCardFrameFactsOptions {
     readonly streamArgs?: object;
     readonly argsUnavailable?: true;