@sema-agent/client-core 0.103.0 → 0.104.1

package/dist/hitl/sessionPolicyDeliverable.js

@@ -2,6 +2,7 @@ import { rosterMountedNames } from '../rosterMountedNames.js';
 import { msg, renderMessage } from '../i18n/translate.js';
 import { readOwnDataValue } from '../ownKey.js';
 import { denyEntryReading, ruleCompileVerdict } from '../ruleCompileVerdict.js';
+import { hasCoreValuePort, ruleNameCovers } from '../coreValuePorts.js';
 import { ruleToolNameVerdictOf } from '../protocolSegment.js';
 import { PREFIXES_IN_PROSE, REFUSED_NAME_FIX } from './refusedToolNameProse.js';
 import { CORE_PROTOCOL_PREFIXES } from '../generated/toolNameTables.js';
@@ -13,7 +14,7 @@ const WITHHELD_NOTICE = {
     wildcard: 'Not written to this session’s rule record: this rule uses a wildcard (*), and an engine that matches that record by exact tool name would block none of the tools it covers.',
     not_a_tool_name: 'Not written to this session’s rule record: this entry is not exactly one tool name — it is empty, not text, has spaces around the name, is not a single tool name in rule syntax (for example it contains a backslash or a parenthesis, or is longer than a rule can be), or spells its server or agent peer part in a way the engine never uses when naming tools (for example with a dot or a space), so no tool would ever match it.',
     legacy_tool_name: `Not written to this session’s rule record: unless a tool by exactly this name is available, the engine refuses it — it is a retired tool name, or it contains "__" but does not start with ${PREFIXES_IN_PROSE} — and with it in that record every later run of this session would fail at startup until that entry is removed from the record. ${REFUSED_NAME_FIX}`,
-    not_in_roster: 'Not written to this session’s rule record: the tool roster supplied for this check has no tool by exactly this name, as a name or an alias, with letter case counted — it may be misspelled, or name a tool this deployment does not provide — so recorded as it is it would block nothing here.',
+    not_in_roster: 'Not written to this session’s rule record: the tool roster supplied for this check has no tool this rule would block — no tool by exactly this name, as a name or an alias, with letter case counted, and, where the engine also reads the name as naming every tool of a server (a server whose own name contains "__"), no tool of that server either — it may be misspelled, or name a tool this deployment does not provide — so recorded as it is it would block nothing here.',
     namespace_covering_unconfirmed: msg('session.policy.withheld.namespaceCoveringUnconfirmed'),
 };
 export const SESSION_POLICY_WITHHELD_WHY = Object.freeze(Object.keys(WITHHELD_NOTICE));
@@ -151,11 +152,14 @@ export function sessionPolicyDeliverable(behavior, rules, opts) {
                 why = 'not_a_tool_name';
         }
         let inertReason;
+        let coveringRow = false;
         if (engineAsked) {
             const reading = entryReadingOf(r);
             if (reading === 'unknown')
                 return unreadable();
-            if (reading !== 'row') {
+            if (reading === 'covering')
+                coveringRow = true;
+            else if (reading !== 'row') {
                 inertReason = reading.reason;
                 if (why === undefined)
                     why = reading.why;
@@ -168,8 +172,13 @@ export function sessionPolicyDeliverable(behavior, rules, opts) {
             if (grammar === 'refused')
                 why = 'not_a_tool_name';
         }
-        if (why === undefined && mounted !== undefined && !mounted.has(r) && covering === undefined)
-            why = 'not_in_roster';
+        if (why === undefined && mounted !== undefined && !mounted.has(r) && covering === undefined) {
+            const reach = coveringRow ? coveredRosterName(r, mounted) : 'none';
+            if (reach === 'unknown')
+                return unreadable();
+            if (reach === 'none')
+                why = 'not_in_roster';
+        }
         if (why === undefined)
             exact.push(r);
         else {
@@ -189,12 +198,29 @@ export function sessionPolicyDeliverable(behavior, rules, opts) {
 function entryReadingOf(rule) {
     const reading = denyEntryReading(rule);
     if (reading.kind === 'row')
-        return 'row';
+        return reading.covering === true ? 'covering' : 'row';
     if (reading.kind === 'unknown')
         return 'unknown';
     const reason = reading.reason;
     return reason === 'grammar' || reason === 'content_unsupported' ? { why: 'not_a_tool_name', reason } : { why: 'wildcard', reason };
 }
+function coveredRosterName(rule, mounted) {
+    if (!hasCoreValuePort('ruleNameCovers'))
+        return 'unknown';
+    try {
+        for (const name of mounted) {
+            const v = ruleNameCovers(rule, name);
+            if (v === true)
+                return 'covers';
+            if (v !== false)
+                return 'unknown';
+        }
+        return 'none';
+    }
+    catch {
+        return 'unknown';
+    }
+}
 export function sessionPolicyWithheldNotice(why, lang) {
     if (typeof why === 'string' && Object.hasOwn(WITHHELD_NOTICE, why)) {
         const sentence = WITHHELD_NOTICE[why];

package/dist/hitl/toolApprovalWire.d.ts

@@ -10,7 +10,7 @@ import { type ApprovalMandateWord } from '../gateVocabulary.js';
 import type { ToolPermissionRequest } from '../seatContract.js';
 import { type ApprovalDecidedByReading } from '../approvalDecidedByCapability.js';
 import { RULE_OFFER_MATCHES, RULE_OFFER_BATCH_MEMBER_KINDS, RULE_OFFER_UNCOVERED_REASONS, RULE_OFFERS_ABSENCE_REASONS } from '@sema-agent/sdk';
-import type { ApprovalDecidedBy, ApprovalCardDelegation, ToolApprovalDecision as SdkToolApprovalDecision, ToolApprovalRespondAck, ToolApprovalRespondReplayed, PersistedRuleAnchor, RuleOfferMatch, RuleOfferBatchMember, RuleOfferUncoveredDetail, RuleOfferUncoveredReason, AskOrigin, RuleOffersAbsence, DenialLimitKind, DenialLimitFallback, ToolApprovalFrame, RuleOffer as SdkRuleOffer } from '@sema-agent/sdk';
+import type { ApprovalDecidedBy, ApprovalCardDelegation, ToolApprovalDecision as SdkToolApprovalDecision, ToolApprovalRespondAck, ToolApprovalRespondReplayed, PersistedRuleAnchor, RuleOfferMatch, RuleOfferBatchMember, RuleOfferUncoveredDetail, RuleOfferUncoveredReason, AskOrigin, RuleOffersAbsence, DenialLimitKind, DenialLimitFallback, ToolApprovalFrame, ApprovalRequestFrame, RuleOffer as SdkRuleOffer } from '@sema-agent/sdk';
 export declare function toolNameIsFsWrite(name: string): boolean;
 export declare function toolNameIsShellExec(name: string): boolean;
 export interface ToolApprovalGateLike {
@@ -97,6 +97,7 @@ export interface ApprovalCardRequest {
     };
     wireNote?: string;
     argsUnavailable?: true;
+    argsRewritten?: true;
     governanceForced?: true;
     delegation?: ToolApprovalDelegation;
     ruleOffers?: RuleOfferReading[];
@@ -178,7 +179,7 @@ export interface ReadRootCandidateView {
     covers?: 'exact';
 }
 export type ToolApprovalDelegation = ApprovalCardDelegation;
-export declare const TOOL_APPROVAL_FRAME_KEYS_MIRROR: readonly ["type", "approvalId", "toolCallId", "toolName", "sourceTaskId", "fromSubagent", "sourceAgentName", "message", "args", "argsOmitted", "governanceForced", "ruleOffers", "ruleOffersAbsence", "denialLimitFallback", "readRootCandidate", "mandated", "mandate", "origin", "approvalCard", "askClass", "classes", "inputHasBidi", "parked", "persistedRuleShadowed", "allowRuleShadowed", "probeCause", "probeReason", "rememberRefused", "boundGrantDigest", "boundGrantAbsence", "boundGrants", "classifierNoRuling", "ruleEvidence", "requiresRealApproval", "expiresInMs", "expiresAtMs", "serverNowMs", "delegation", "outcome", "cause"];
+export declare const TOOL_APPROVAL_FRAME_KEYS_MIRROR: readonly ["type", "approvalId", "toolCallId", "toolName", "sourceTaskId", "fromSubagent", "sourceAgentName", "message", "args", "argsOmitted", "governanceForced", "ruleOffers", "ruleOffersAbsence", "denialLimitFallback", "readRootCandidate", "mandated", "mandate", "origin", "approvalCard", "askClass", "classes", "inputHasBidi", "parked", "persistedRuleShadowed", "allowRuleShadowed", "probeCause", "probeReason", "rememberRefused", "boundGrantDigest", "boundGrantAbsence", "boundGrants", "classifierNoRuling", "ruleEvidence", "requiresRealApproval", "expiresInMs", "expiresAtMs", "serverNowMs", "delegation", "outcome", "cause", "requestedBy"];
 export interface ApprovalMandatedFacts {
     readonly mandated?: true;
     readonly ruleOffersAbsence?: string;
@@ -276,7 +277,7 @@ export declare function readDenialLimitFallback(v: unknown): DenialLimitFallback
 export declare function readRuleOffers(v: unknown): RuleOfferReading[] | undefined;
 export declare function readRuleOfferSupply(offers: unknown): RuleOfferReading[] | undefined;
 export type ApprovalCardV1Facts = Pick<ApprovalCardRequest, 'toolName' | 'args'> & Pick<ApprovalCardRequest, 'toolCallId' | 'workerBadge' | 'wireNote' | 'argsUnavailable' | 'governanceForced' | 'delegation' | 'ruleOffersReadOnly' | 'inputHasBidi' | 'allowRuleShadow' | 'probeCause' | 'rememberRefused' | 'ruleEvidence' | 'requiresRealApproval' | 'ruleOffersAbsence' | 'denialLimitFallback' | 'askClass' | 'classes' | 'grantBinding' | 'unreadableEvidence' | 'message' | 'approvalCard'>;
-export type ApprovalCardFacts = ApprovalCardV1Facts & Pick<ApprovalCardRequest, 'ruleOffers' | 'probeReason' | 'mandated' | 'mandate' | 'readRootCandidate' | 'origin' | 'boundGrants' | 'classifierNoRuling' | 'allowSessionCarried' | 'cardPayloadUnreadable'>;
+export type ApprovalCardFacts = ApprovalCardV1Facts & Pick<ApprovalCardRequest, 'argsRewritten' | 'ruleOffers' | 'probeReason' | 'mandated' | 'mandate' | 'readRootCandidate' | 'origin' | 'boundGrants' | 'classifierNoRuling' | 'allowSessionCarried' | 'cardPayloadUnreadable'>;
 export interface ApprovalCardFrameFactsOptions {
     readonly streamArgs?: object;
     readonly argsUnavailable?: true;
@@ -292,7 +293,7 @@ export interface ToolApprovalFrameLaneOpts {
     windowIsCurrent?: boolean;
     argsUnavailable?: true;
 }
-export declare function surfaceToolApprovalFrameAndRespond(frame: ToolApprovalFrame, respond: RespondToolApprovalFn, streamArgs: unknown | undefined, signal?: AbortSignal, lane?: ToolApprovalFrameLaneOpts, run?: {
+export declare function surfaceToolApprovalFrameAndRespond(frame: ToolApprovalFrame | ApprovalRequestFrame, respond: RespondToolApprovalFn, streamArgs: unknown | undefined, signal?: AbortSignal, lane?: ToolApprovalFrameLaneOpts, run?: {
     readonly taskId?: string;
     readonly sessionId?: string;
 }): Promise<ApprovalResolution>;

package/dist/hitl/toolApprovalWire.js

@@ -28,9 +28,10 @@ import { isApprovalMandateWord } from '../gateVocabulary.js';
 import { approvalDecidedByAdmitted } from '../approvalDecidedByCapability.js';
 import { decideFailureNote } from '../decideFailureNote.js';
 import { slotPresenceOf, wireFailureTextsOf } from '../wireFailureShape.js';
+import { isPlainRecord } from '../jsonFaithful.js';
 import { DECIDE_WORKFLOW_REMEMBER_UNSUPPORTED } from '../engineErrorCodes.js';
 import { readDecideReceipt } from '../decideReceipt.js';
-import { RULE_OFFER_MATCHES, RULE_OFFER_BATCH_MEMBER_KINDS, RULE_OFFER_UNCOVERED_REASONS, RULE_OFFERS_ABSENCE_REASONS, ASK_ORIGINS, } from '@sema-agent/sdk';
+import { RULE_OFFER_MATCHES, RULE_OFFER_BATCH_MEMBER_KINDS, RULE_OFFER_UNCOVERED_REASONS, RULE_OFFERS_ABSENCE_REASONS, ASK_ORIGINS, isApprovalRequestFrameV1, } from '@sema-agent/sdk';
 export function toolNameIsFsWrite(name) {
     const n = name.replace(/[\s_-]+/g, '').toLowerCase();
     return (n === 'write' || n === 'filewrite' || n === 'edit' || n === 'fileedit' || n === 'multiedit' || n === 'notebookedit');
@@ -193,6 +194,11 @@ const PARK_ROW_ARGS_ABSENT_NOTE = "this request's tool arguments are not availab
 const PARK_ROW_ARGS_TRUNCATED_NOTE = "this request's tool arguments were too large to keep on the pending approval record and were replaced by a size marker, " +
     'so you are deciding without seeing them; deny it if you are not sure what it will do. ' +
     'Edits are not accepted on this card: there is no original input to edit';
+const ARGS_REWRITTEN_NOTE = "this request's tool arguments were changed after the model made the call (for example by a hook) — " +
+    'the arguments shown here are the changed ones recorded for this approval, and they differ from the call shown in the conversation';
+const ARGS_FROM_MODEL_CALL_NOTE = 'this approval request did not carry usable tool arguments (for example because they were too large to include), ' +
+    "so the arguments shown are the model's original call from the conversation — " +
+    'if they were changed after that call (for example by a hook), what runs differs from what is shown';
 const PARK_EDIT_REFUSED_REASON = "the card returned an edited approval, but this request's tool arguments are not available on this surface " +
     '(missing, or replaced by a size marker on the pending approval record), so the edit cannot be applied — nothing was sent; ' +
     'approve or deny it as it is';
@@ -205,6 +211,139 @@ function isParkRowInputSizeMarker(v) {
     const o = v;
     return o.truncated === true && typeof o.bytes === 'number' && Number.isFinite(o.bytes) && o.bytes >= 0;
 }
+function recordedInputShapeOf(v) {
+    if (v === undefined || v === null)
+        return 'absent';
+    try {
+        if (typeof v !== 'object' || !isPlainRecord(v))
+            return 'other';
+        return isParkRowInputSizeMarker(v) ? 'size_marker' : 'input';
+    }
+    catch {
+        return 'other';
+    }
+}
+function argsProvablyDiffer(recorded, streamArgs) {
+    try {
+        if (typeof streamArgs !== 'object' || streamArgs === null || Array.isArray(streamArgs))
+            return false;
+        return jsonValuesDiffer(recorded, streamArgs, 0, { nodes: 0 }) === true;
+    }
+    catch {
+        return false;
+    }
+}
+function cardInputOf(recorded, stream) {
+    const shape = recordedInputShapeOf(recorded);
+    const streamPresent = stream !== undefined && stream !== null;
+    if (shape === 'input')
+        return { from: 'recorded', args: recorded, rewritten: streamPresent && argsProvablyDiffer(recorded, stream) };
+    if (streamPresent)
+        return { from: 'stream', args: stream, shape };
+    return { from: 'none', shape, recorded };
+}
+const CARD_ARGS_COMPARE_MAX_NODES = 20_000;
+const CARD_ARGS_COMPARE_MAX_DEPTH = 256;
+const NOT_COMPARABLE = Symbol('not comparable');
+function ownDataForCompare(o, k) {
+    const d = Object.getOwnPropertyDescriptor(o, k);
+    return d !== undefined && Object.hasOwn(d, 'value') ? d.value : NOT_COMPARABLE;
+}
+const TO_JSON_CHAIN_MAX = 32;
+function hasToJsonHook(o) {
+    let at = o;
+    for (let depth = 0; at !== null; depth++) {
+        if (depth >= TO_JSON_CHAIN_MAX)
+            return true;
+        const d = Object.getOwnPropertyDescriptor(at, 'toJSON');
+        if (d !== undefined)
+            return !Object.hasOwn(d, 'value') || typeof d.value === 'function';
+        at = Object.getPrototypeOf(at);
+    }
+    return false;
+}
+function jsonValueKindOf(v) {
+    if (v === null)
+        return 'null';
+    switch (typeof v) {
+        case 'boolean':
+            return 'boolean';
+        case 'string':
+            return 'string';
+        case 'number':
+            return Number.isFinite(v) ? 'number' : undefined;
+        case 'object':
+            if (Array.isArray(v))
+                return hasToJsonHook(v) ? undefined : 'array';
+            return isPlainRecord(v) && !hasToJsonHook(v) ? 'object' : undefined;
+        default:
+            return undefined;
+    }
+}
+function jsonValuesDiffer(a, b, depth, budget) {
+    if (++budget.nodes > CARD_ARGS_COMPARE_MAX_NODES || depth > CARD_ARGS_COMPARE_MAX_DEPTH)
+        return undefined;
+    const ka = jsonValueKindOf(a);
+    const kb = jsonValueKindOf(b);
+    if (ka === undefined || kb === undefined)
+        return undefined;
+    if (ka !== kb)
+        return true;
+    if (ka === 'array') {
+        const xa = a;
+        const xb = b;
+        const la = ownDataForCompare(xa, 'length');
+        const lb = ownDataForCompare(xb, 'length');
+        if (typeof la !== 'number' || typeof lb !== 'number')
+            return undefined;
+        if (la !== lb)
+            return true;
+        for (let i = 0; i < la; i++) {
+            const va = ownDataForCompare(xa, String(i));
+            const vb = ownDataForCompare(xb, String(i));
+            if (va === NOT_COMPARABLE || vb === NOT_COMPARABLE)
+                return undefined;
+            const d = jsonValuesDiffer(va, vb, depth + 1, budget);
+            if (d !== false)
+                return d;
+        }
+        return false;
+    }
+    if (ka === 'object') {
+        const ra = a;
+        const rb = b;
+        const keysA = Object.keys(ra);
+        const keysB = Object.keys(rb);
+        budget.nodes += keysA.length + keysB.length;
+        if (budget.nodes > CARD_ARGS_COMPARE_MAX_NODES)
+            return undefined;
+        const inA = new Set(keysA);
+        const inB = new Set(keysB);
+        for (const k of keysA) {
+            const va = ownDataForCompare(ra, k);
+            if (va === NOT_COMPARABLE)
+                return undefined;
+            if (!inB.has(k))
+                return jsonValueKindOf(va) === undefined ? undefined : true;
+            const vb = ownDataForCompare(rb, k);
+            if (vb === NOT_COMPARABLE)
+                return undefined;
+            const d = jsonValuesDiffer(va, vb, depth + 1, budget);
+            if (d !== false)
+                return d;
+        }
+        for (const k of keysB) {
+            if (inA.has(k))
+                continue;
+            const vb = ownDataForCompare(rb, k);
+            if (vb === NOT_COMPARABLE)
+                return undefined;
+            return jsonValueKindOf(vb) === undefined ? undefined : true;
+        }
+        return false;
+    }
+    return a === b ? false : true;
+}
 function durableHoldKey(row, callKey) {
     const createdAt = typeof row.createdAt === 'number' && Number.isFinite(row.createdAt) ? row.createdAt : null;
     return JSON.stringify([typeof row.sessionId === 'string' ? row.sessionId : null, typeof row.taskId === 'string' ? row.taskId : null, callKey, createdAt]);
@@ -331,7 +470,7 @@ export async function surfaceFsApprovalAndDecide(deps, taskId, argsByCall, signa
     });
 }
 function parkRowHolderIdentity(row, gatedCallId) {
-    const askSig = carrierAskSig(row);
+    const askSig = carrierAskSig(row, row);
     return {
         ...(typeof row.taskId === 'string' && row.taskId !== '' ? { taskId: row.taskId } : {}),
         ...(gatedCallId !== undefined && gatedCallId !== '' ? { toolCallId: gatedCallId } : {}),
@@ -344,15 +483,10 @@ async function presentFsApprovalAndDecide(deps, taskId, argsByCall, signal, foun
     const at = { lane: 'decide', ...(gatedCallId !== undefined ? { gatedCallId } : {}) };
     const toolName = typeof pending.toolName === 'string' ? pending.toolName : '';
     const streamArgs = gatedCallId !== undefined ? argsByCall.get(gatedCallId) : undefined;
-    const rowInput = pending.input;
-    const rowArgsGap = streamArgs !== undefined && streamArgs !== null
-        ? undefined
-        : rowInput === undefined || rowInput === null
-            ? 'absent'
-            : isParkRowInputSizeMarker(rowInput)
-                ? 'truncated'
-                : undefined;
-    const args = streamArgs !== undefined && streamArgs !== null ? streamArgs : rowArgsGap !== undefined ? {} : rowInput;
+    const reading = cardInputOf(pending.input, streamArgs);
+    const rowArgsGap = reading.from !== 'none' ? undefined : reading.shape === 'absent' ? 'absent' : reading.shape === 'size_marker' ? 'truncated' : undefined;
+    const args = reading.from !== 'none' ? reading.args : rowArgsGap !== undefined ? {} : reading.recorded;
+    const argsRewritten = reading.from === 'recorded' && reading.rewritten;
     if (typeof args !== 'object' || args === null) {
         return { kind: 'not_sent', ...at, cause: 'no_input', detail: 'gate has no tool input payload' };
     }
@@ -375,6 +509,7 @@ async function presentFsApprovalAndDecide(deps, taskId, argsByCall, signal, foun
                 wireNote: rowArgsGap === 'truncated' ? PARK_ROW_ARGS_TRUNCATED_NOTE : PARK_ROW_ARGS_ABSENT_NOTE,
             }
             : {}),
+        ...(argsRewritten ? { argsRewritten: true, wireNote: ARGS_REWRITTEN_NOTE } : {}),
         ...(pending.governanceForced === true ? { governanceForced: true } : {}),
         ...(readRequiresRealApproval(pending) ? { requiresRealApproval: true } : {}),
         ...(hasOwnStrictTrue(pending, 'mandated') ? { mandated: true } : {}),
@@ -583,6 +718,7 @@ export const TOOL_APPROVAL_FRAME_KEYS_MIRROR = [
     'delegation',
     'outcome',
     'cause',
+    'requestedBy',
 ];
 const _mirrorPin = [true];
 void _mirrorPin;
@@ -1074,21 +1210,23 @@ function serverMayReadCallLaw(carrier) {
 const UNREADABLE_EVIDENCE_KEYS = Object.freeze({
     frame: Object.freeze([
         ['rememberRefused', 'rememberRefused'], ['governanceForced', 'governanceForced'], ['requiresRealApproval', 'requiresRealApproval'],
-        ['mandated', 'mandated'], ['mandate', 'mandate'], ['origin', 'origin'], ['ruleOffersAbsence', 'ruleOffersAbsence'], ['ruleOffers', 'ruleOffers'],
+        ['ruleOffersAbsence', 'ruleOffersAbsence'], ['ruleOffers', 'ruleOffers'],
         ['allowRuleShadowed', 'allowRuleShadow'], ['askClass', 'askClass'], ['classes', 'classes'],
     ]),
+    live: Object.freeze([['mandated', 'mandated'], ['mandate', 'mandate'], ['origin', 'origin']]),
     row: Object.freeze([
         ['rememberRefused', 'rememberRefused'], ['governanceForced', 'governanceForced'], ['requiresRealApproval', 'requiresRealApproval'],
         ['mandated', 'mandated'], ['mandate', 'mandate'], ['origin', 'origin'], ['ruleOffersAbsence', 'ruleOffersAbsence'], ['ruleOffers', 'ruleOffersReadOnly'],
         ['askClass', 'askClass'], ['classes', 'classes'],
     ]),
     v1: Object.freeze([
-        ['rememberRefused', 'rememberRefused'], ['governanceForced', 'governanceForced'], ['ruleOffersAbsence', 'ruleOffersAbsence'], ['ruleOffers', 'ruleOffersReadOnly'],
+        ['rememberRefused', 'rememberRefused'], ['governanceForced', 'governanceForced'], ['requiresRealApproval', 'requiresRealApproval'],
+        ['ruleOffersAbsence', 'ruleOffersAbsence'], ['ruleOffers', 'ruleOffersReadOnly'],
         ['allowRuleShadowed', 'allowRuleShadow'], ['askClass', 'askClass'], ['classes', 'classes'],
     ]),
     generic: Object.freeze([['ruleOffersAbsence', 'ruleOffersAbsence'], ['askClass', 'askClass'], ['classes', 'classes']]),
 });
-function v1RiskUnreadable(card) {
+function riskSubtreeUnreadable(card) {
     if (slotPresenceOf(card, 'risk') === 'absent')
         return false;
     try {
@@ -1099,12 +1237,18 @@ function v1RiskUnreadable(card) {
         return true;
     }
 }
-function withUnreadableEvidence(carrier, leg, req, reported = []) {
+function withUnreadableEvidence(carrier, leg, req, reported = [], live) {
     const keys = new Set(reported);
     for (const [from, to] of UNREADABLE_EVIDENCE_KEYS[leg]) {
         if (slotPresenceOf(carrier, from) !== 'absent' && !Object.hasOwn(req, to))
             keys.add(from);
     }
+    if (live !== undefined) {
+        for (const [from, to] of UNREADABLE_EVIDENCE_KEYS.live) {
+            if (slotPresenceOf(live, from) !== 'absent' && !Object.hasOwn(req, to))
+                keys.add(from);
+        }
+    }
     if (leg === 'row') {
         const rd = ownDataValue(carrier, 'riskDescriptor');
         if (typeof rd === 'object' && rd !== null && slotPresenceOf(rd, 'allowRuleShadowed') !== 'absent' && !Object.hasOwn(req, 'allowRuleShadow'))
@@ -1115,7 +1259,7 @@ function withUnreadableEvidence(carrier, leg, req, reported = []) {
         if (retiredAllowRuleShadowKeyPresent(carrier, shadowLeg))
             keys.add(RETIRED_SHADOW_EVIDENCE_LABEL[shadowLeg]);
     }
-    if (leg === 'v1' && v1RiskUnreadable(carrier))
+    if ((leg === 'v1' || leg === 'frame') && riskSubtreeUnreadable(carrier))
         keys.add('risk');
     return keys.size === 0 ? req : { ...req, unreadableEvidence: Object.freeze([...keys].sort()) };
 }
@@ -1174,9 +1318,9 @@ function askSignatureOf(req) {
 function askSigOf(classes, origin, mandate) {
     return JSON.stringify([classes !== undefined ? [...classes] : null, origin ?? null, mandate ?? null]);
 }
-function carrierAskSig(v) {
+function carrierAskSig(v, live) {
     try {
-        return askSigOf(readAskClassPair(v)?.classes, readAskOrigin(v), readApprovalMandate(v));
+        return askSigOf(readAskClassPair(v)?.classes, live === undefined ? undefined : readAskOrigin(live), live === undefined ? undefined : readApprovalMandate(live));
     }
     catch {
         return undefined;
@@ -1487,9 +1631,10 @@ function v1Bit(stamp) {
 const SUSPENDED_ASK_ARGS_NOTE = "this request's tool arguments are not available on this surface — it was raised while no client was connected, " +
     'so you are deciding without seeing them; deny it if you are not sure what it will do. ' +
     'Edits are not accepted on this card: there is no original input to edit';
-function cardFactsOf(carrier, leg, opts) {
+function cardFactsOf(carrier, leg, opts, liveFacts) {
     const c = carrier;
     const full = leg !== 'generic';
+    const live = leg === 'frame' ? carrier : leg === 'v1' ? liveFacts : undefined;
     const asFrame = carrier;
     const fromSubagent = full
         ? (() => {
@@ -1505,14 +1650,23 @@ function cardFactsOf(carrier, leg, opts) {
         try {
             let stream;
             let blind = false;
-            if (leg === 'frame' && typeof opts === 'object' && opts !== null) {
+            if (typeof opts === 'object' && opts !== null) {
                 stream = opts.streamArgs;
                 blind = opts.argsUnavailable === true;
             }
-            const raw = stream !== undefined && stream !== null ? stream : c.args !== undefined && c.args !== null ? c.args : undefined;
-            if (typeof raw === 'object' && raw !== null)
-                return blind ? { args: raw, argsUnavailable: true } : { args: raw };
-            const fallback = argsFallbackOf(c.message, c.argsOmitted);
+            const reading = cardInputOf(c.args, stream);
+            if (reading.from === 'recorded') {
+                if (blind)
+                    return { args: reading.args, argsUnavailable: true };
+                return reading.rewritten ? { args: reading.args, argsRewritten: true, wireNote: ARGS_REWRITTEN_NOTE } : { args: reading.args };
+            }
+            if (reading.from === 'stream' && typeof reading.args === 'object' && reading.args !== null) {
+                if (blind)
+                    return { args: reading.args, argsUnavailable: true };
+                return { args: reading.args, wireNote: ARGS_FROM_MODEL_CALL_NOTE };
+            }
+            const omitted = c.argsOmitted === true || reading.shape === 'size_marker';
+            const fallback = argsFallbackOf(c.message, omitted);
             const note = blind ? SUSPENDED_ASK_ARGS_NOTE : fallback.omittedNote;
             return { args: fallback.args, argsUnavailable: true, ...(note !== undefined ? { wireNote: note } : {}) };
         }
@@ -1538,6 +1692,8 @@ function cardFactsOf(carrier, leg, opts) {
         out.wireNote = argsPart.wireNote;
     if (argsPart.argsUnavailable === true)
         out.argsUnavailable = true;
+    if (argsPart.argsRewritten === true)
+        out.argsRewritten = true;
     if (full) {
         v1Bit(() => {
             if (c.governanceForced === true)
@@ -1567,9 +1723,9 @@ function cardFactsOf(carrier, leg, opts) {
             if (isWireRecordCarrier(pc))
                 out.probeCause = pc;
         });
-        if (leg === 'frame') {
+        if (live !== undefined) {
             v1Bit(() => {
-                const r = readProbeReason(carrier);
+                const r = readProbeReason(live);
                 if (r !== undefined)
                     out.probeReason = r;
             });
@@ -1590,18 +1746,18 @@ function cardFactsOf(carrier, leg, opts) {
         catch {
             realApprovalUnreadable = true;
         }
-        if (leg === 'frame') {
+        if (live !== undefined) {
             v1Bit(() => {
-                if (hasOwnStrictTrue(carrier, 'mandated'))
+                if (hasOwnStrictTrue(live, 'mandated'))
                     out.mandated = true;
             });
             v1Bit(() => {
-                const w = readApprovalMandate(carrier);
+                const w = readApprovalMandate(live);
                 if (w !== undefined)
                     out.mandate = w;
             });
             v1Bit(() => {
-                const rc = readReadRootCandidate(c.readRootCandidate);
+                const rc = readReadRootCandidate(live.readRootCandidate);
                 if (rc !== undefined)
                     out.readRootCandidate = rc;
             });
@@ -1621,9 +1777,9 @@ function cardFactsOf(carrier, leg, opts) {
         if (dlf !== undefined)
             out.denialLimitFallback = dlf;
     });
-    if (leg === 'frame') {
+    if (live !== undefined) {
         v1Bit(() => {
-            const o = readAskOrigin(carrier);
+            const o = readAskOrigin(live);
             if (o !== undefined)
                 out.origin = o;
         });
@@ -1642,14 +1798,14 @@ function cardFactsOf(carrier, leg, opts) {
             out.classes = pair.classes;
         }
     });
-    if (leg === 'frame') {
+    if (live !== undefined) {
         v1Bit(() => {
-            const g = readApprovalBoundGrants(carrier);
+            const g = readApprovalBoundGrants(live);
             if (g !== undefined)
                 out.boundGrants = g;
         });
         v1Bit(() => {
-            const w = readApprovalClassifierNoRuling(carrier);
+            const w = readApprovalClassifierNoRuling(live);
             if (w !== undefined)
                 out.classifierNoRuling = w;
         });
@@ -1664,7 +1820,7 @@ function cardFactsOf(carrier, leg, opts) {
     if (leg === 'frame')
         out.allowSessionCarried = true;
     out.grantBinding = readApprovalGrantBinding(carrier);
-    return withUnreadableEvidence(carrier, leg, out, realApprovalUnreadable ? ['requiresRealApproval'] : []);
+    return withUnreadableEvidence(carrier, leg, out, realApprovalUnreadable ? ['requiresRealApproval'] : [], live);
 }
 export function approvalCardFactsOfV1(card) {
     if (typeof card !== 'object' || card === null)
@@ -1685,9 +1841,19 @@ const MAX_RESPOND_NOTE_CHARS = 2048;
 export async function surfaceToolApprovalFrameAndRespond(frame, respond, streamArgs, signal, lane, run) {
     const receivedAtMs = Date.now();
     const approvalId = frame.approvalId;
-    const entry = { frame, approvalId, identity: liveCardIdentityOf(approvalId, frame, run), respond, streamArgs, signal, lane, receivedAtMs };
+    const carriers = openingFrameCarriersOf(frame);
+    const entry = { frame, carriers, approvalId, identity: liveCardIdentityOf(approvalId, frame, carriers, run), respond, streamArgs, signal, lane, receivedAtMs };
     return enterLiveCard(entry);
 }
+function openingFrameCarriersOf(frame) {
+    if (frame.type !== 'approval_request')
+        return { body: frame, live: frame, leg: 'frame' };
+    const card = frame.card;
+    const pinned = Object.create(frame, { card: { value: card, enumerable: true } });
+    if (isApprovalRequestFrameV1(pinned))
+        return { body: pinned.card, live: frame, leg: 'v1' };
+    return { body: typeof card === 'object' && card !== null ? card : {}, live: undefined, leg: 'generic' };
+}
 function enterLiveCard(e) {
     const { approvalId, signal } = e;
     const held = liveCardHoldOf(liveFrameCallKey(approvalId));
@@ -1701,7 +1867,7 @@ function enterLiveCard(e) {
         return joinOtherLaneHolder(e, other);
     return holdLiveCard(e.identity, signal, async (hold) => {
         const slot = {};
-        const out = await presentToolApprovalFrameAndRespond(e.frame, approvalId, e.respond, e.streamArgs, signal, e.lane, hold, slot, e.receivedAtMs);
+        const out = await presentToolApprovalFrameAndRespond(e.frame, e.carriers, approvalId, e.respond, e.streamArgs, signal, e.lane, hold, slot, e.receivedAtMs);
         noteCallOutcome(slot, out);
         return out;
     });
@@ -1716,15 +1882,16 @@ async function joinOtherLaneHolder(e, other) {
         return { kind: 'not_sent', lane: 'respond', cause: 'retracted', joinedInFlight: true };
     return enterLiveCard(e);
 }
-function liveCardIdentityOf(approvalId, frame, run) {
-    const toolCallId = typeof frame.toolCallId === 'string' && frame.toolCallId !== '' ? frame.toolCallId : undefined;
-    const fromSubagent = isFromSubagent(frame);
+function liveCardIdentityOf(approvalId, frame, carriers, run) {
+    const body = carriers.body;
+    const toolCallId = typeof body.toolCallId === 'string' && body.toolCallId !== '' ? body.toolCallId : undefined;
+    const fromSubagent = isFromSubagent(carriers.body);
     const bound = fromSubagent ? undefined : frameBindingOf(frame);
     const source = bound ?? run;
-    const ownRun = fromSubagent ? frame.sourceTaskId : source?.taskId;
+    const ownRun = fromSubagent ? body.sourceTaskId : source?.taskId;
     const taskId = typeof ownRun === 'string' && ownRun !== '' ? ownRun : undefined;
     const sessionId = !fromSubagent && typeof source?.sessionId === 'string' && source.sessionId !== '' ? source.sessionId : undefined;
-    const askSig = carrierAskSig(frame);
+    const askSig = carrierAskSig(carriers.body, carriers.live);
     return {
         approvalId,
         ...(toolCallId !== undefined ? { toolCallId } : {}),
@@ -1779,10 +1946,11 @@ function readApprovalCardClaimSignal(v) {
 export function claimApprovalCard(identity, options) {
     return claimApprovalCardFor(readApprovalHolderIdentity(identity), readApprovalCardClaimSignal(options));
 }
-async function presentToolApprovalFrameAndRespond(frame, approvalId, respond, streamArgs, signal, lane, hold, ledgerSlot, receivedAtMs) {
-    const frameToolCallId = typeof frame.toolCallId === 'string' && frame.toolCallId !== '' ? frame.toolCallId : undefined;
+async function presentToolApprovalFrameAndRespond(frame, carriers, approvalId, respond, streamArgs, signal, lane, hold, ledgerSlot, receivedAtMs) {
+    const bodyToolCallId = carriers.body.toolCallId;
+    const frameToolCallId = typeof bodyToolCallId === 'string' && bodyToolCallId !== '' ? bodyToolCallId : undefined;
     const decidedByReading = decidedByReadingSnapshotOf(lane);
-    const facts = cardFactsOf(frame, 'frame', { streamArgs, ...(lane?.argsUnavailable === true ? { argsUnavailable: true } : {}) });
+    const facts = cardFactsOf(carriers.body, carriers.leg, { streamArgs, ...(lane?.argsUnavailable === true ? { argsUnavailable: true } : {}) }, carriers.live);
     const argsNotRealInput = facts.argsUnavailable === true;
     const ruleOffers = facts.ruleOffers;
     if (argsNotRealInput && lane?.argsUnavailable !== true && facts.wireNote !== undefined) {
@@ -1792,7 +1960,7 @@ async function presentToolApprovalFrameAndRespond(frame, approvalId, respond, st
         ...facts,
         callKey: liveFrameCallKey(approvalId),
         signal: hold.cardSignal,
-        ...approvalWindowKeysOf(frame, { windowIsCurrent: lane?.windowIsCurrent === true, receivedAtMs }),
+        ...approvalWindowKeysOf(frame, { windowIsCurrent: lane?.windowIsCurrent === true, receivedAtMs, ...(carriers.leg === 'generic' ? { unknownShape: true } : {}) }),
     });
     if (hold.superseded !== undefined) {
         hostLog('debug', `liveToolApprovalWire: ${approvalId} was settled by the engine while its card was up${hold.superseded.parked ? ' (parked)' : ''} — card withdrawn; ` +

package/dist/host.d.ts

@@ -3,9 +3,6 @@ import type { WireHooksConfig } from './finalVerifyWire.js';
 import { type NotificationQueuePort } from './notifications.js';
 export type SettingsDocument = Record<string, unknown>;
 export type ManagedPolicyState = 'absent' | 'in-effect' | 'in-effect-pieces' | 'unreadable-covered' | 'unreadable-uncovered' | 'remote-unknown';
-export interface ManagedPolicyReading {
-    readonly state: ManagedPolicyState;
-}
 export type HooksStartupMode = 'safe' | 'bare';
 export type PluginHookOptionValue = string | number | boolean;
 export interface PluginHookSensitiveOption {

package/dist/hostTurnSettings.js

@@ -454,8 +454,10 @@ function permissionsArm(src, side, adoption) {
             appendOwnElement(buckets[bucket], rule);
             origins[bucket].set(rule, origin);
         }
-        else if (rank(origin) < rank(prev))
+        else if (rank(origin) < rank(prev)) {
+            origins[bucket].delete(rule);
             origins[bucket].set(rule, origin);
+        }
     };
     let projectionError;
     const portsProjection = newRulePortsProjection();

package/dist/humanTurn.js

@@ -1,4 +1,4 @@
-import { CORE_MAX_PENDING_STEER_CHARS, CORE_MCP_IMAGE_MAX_BASE64, CORE_USER_ATTACHMENT_LABEL_MAX } from './generated/engineFactTables.js';
+import { CORE_IMAGE_ADMISSION_HARD_IMAGE_BASE64_CHARS, CORE_MAX_PENDING_STEER_CHARS, CORE_USER_ATTACHMENT_LABEL_MAX } from './generated/engineFactTables.js';
 import { mintEnvelopeOf, mintReferenceOf, seatTextOf } from './userAttachmentEnvelope.js';
 import { readEncodingShares, readHumanTurnInput } from './humanTurnRead.js';
 import { putOwnKey } from './ownKey.js';
@@ -224,7 +224,7 @@ function encodeObjective(v) {
     let count = 0;
     let total = 0;
     const seat = (len) => {
-        if (len > CORE_MCP_IMAGE_MAX_BASE64)
+        if (len > CORE_IMAGE_ADMISSION_HARD_IMAGE_BASE64_CHARS)
             return 'image_too_large';
         if (count + 1 > IMAGE_SEAT_MAX_COUNT)
             return 'seat_count';