@sema-agent/client-core 0.104.0 → 0.105.0

package/dist/hitl/toolApprovalWire.d.ts

@@ -10,7 +10,7 @@ import { type ApprovalMandateWord } from '../gateVocabulary.js';
 import type { ToolPermissionRequest } from '../seatContract.js';
 import { type ApprovalDecidedByReading } from '../approvalDecidedByCapability.js';
 import { RULE_OFFER_MATCHES, RULE_OFFER_BATCH_MEMBER_KINDS, RULE_OFFER_UNCOVERED_REASONS, RULE_OFFERS_ABSENCE_REASONS } from '@sema-agent/sdk';
-import type { ApprovalDecidedBy, ApprovalCardDelegation, ToolApprovalDecision as SdkToolApprovalDecision, ToolApprovalRespondAck, ToolApprovalRespondReplayed, PersistedRuleAnchor, RuleOfferMatch, RuleOfferBatchMember, RuleOfferUncoveredDetail, RuleOfferUncoveredReason, AskOrigin, RuleOffersAbsence, DenialLimitKind, DenialLimitFallback, ToolApprovalFrame, RuleOffer as SdkRuleOffer } from '@sema-agent/sdk';
+import type { ApprovalDecidedBy, ApprovalCardDelegation, ToolApprovalDecision as SdkToolApprovalDecision, ToolApprovalRespondAck, ToolApprovalRespondReplayed, PersistedRuleAnchor, RuleOfferMatch, RuleOfferBatchMember, RuleOfferUncoveredDetail, RuleOfferUncoveredReason, AskOrigin, RuleOffersAbsence, DenialLimitKind, DenialLimitFallback, ToolApprovalFrame, ApprovalRequestFrame, RuleOffer as SdkRuleOffer } from '@sema-agent/sdk';
 export declare function toolNameIsFsWrite(name: string): boolean;
 export declare function toolNameIsShellExec(name: string): boolean;
 export interface ToolApprovalGateLike {
@@ -293,7 +293,7 @@ export interface ToolApprovalFrameLaneOpts {
     windowIsCurrent?: boolean;
     argsUnavailable?: true;
 }
-export declare function surfaceToolApprovalFrameAndRespond(frame: ToolApprovalFrame, respond: RespondToolApprovalFn, streamArgs: unknown | undefined, signal?: AbortSignal, lane?: ToolApprovalFrameLaneOpts, run?: {
+export declare function surfaceToolApprovalFrameAndRespond(frame: ToolApprovalFrame | ApprovalRequestFrame, respond: RespondToolApprovalFn, streamArgs: unknown | undefined, signal?: AbortSignal, lane?: ToolApprovalFrameLaneOpts, run?: {
     readonly taskId?: string;
     readonly sessionId?: string;
 }): Promise<ApprovalResolution>;

package/dist/hitl/toolApprovalWire.js

@@ -31,7 +31,7 @@ import { slotPresenceOf, wireFailureTextsOf } from '../wireFailureShape.js';
 import { isPlainRecord } from '../jsonFaithful.js';
 import { DECIDE_WORKFLOW_REMEMBER_UNSUPPORTED } from '../engineErrorCodes.js';
 import { readDecideReceipt } from '../decideReceipt.js';
-import { RULE_OFFER_MATCHES, RULE_OFFER_BATCH_MEMBER_KINDS, RULE_OFFER_UNCOVERED_REASONS, RULE_OFFERS_ABSENCE_REASONS, ASK_ORIGINS, } from '@sema-agent/sdk';
+import { RULE_OFFER_MATCHES, RULE_OFFER_BATCH_MEMBER_KINDS, RULE_OFFER_UNCOVERED_REASONS, RULE_OFFERS_ABSENCE_REASONS, ASK_ORIGINS, isApprovalRequestFrameV1, } from '@sema-agent/sdk';
 export function toolNameIsFsWrite(name) {
     const n = name.replace(/[\s_-]+/g, '').toLowerCase();
     return (n === 'write' || n === 'filewrite' || n === 'edit' || n === 'fileedit' || n === 'multiedit' || n === 'notebookedit');
@@ -470,7 +470,7 @@ export async function surfaceFsApprovalAndDecide(deps, taskId, argsByCall, signa
     });
 }
 function parkRowHolderIdentity(row, gatedCallId) {
-    const askSig = carrierAskSig(row);
+    const askSig = carrierAskSig(row, row);
     return {
         ...(typeof row.taskId === 'string' && row.taskId !== '' ? { taskId: row.taskId } : {}),
         ...(gatedCallId !== undefined && gatedCallId !== '' ? { toolCallId: gatedCallId } : {}),
@@ -1210,16 +1210,18 @@ function serverMayReadCallLaw(carrier) {
 const UNREADABLE_EVIDENCE_KEYS = Object.freeze({
     frame: Object.freeze([
         ['rememberRefused', 'rememberRefused'], ['governanceForced', 'governanceForced'], ['requiresRealApproval', 'requiresRealApproval'],
-        ['mandated', 'mandated'], ['mandate', 'mandate'], ['origin', 'origin'], ['ruleOffersAbsence', 'ruleOffersAbsence'], ['ruleOffers', 'ruleOffers'],
+        ['ruleOffersAbsence', 'ruleOffersAbsence'], ['ruleOffers', 'ruleOffers'],
         ['allowRuleShadowed', 'allowRuleShadow'], ['askClass', 'askClass'], ['classes', 'classes'],
     ]),
+    live: Object.freeze([['mandated', 'mandated'], ['mandate', 'mandate'], ['origin', 'origin']]),
     row: Object.freeze([
         ['rememberRefused', 'rememberRefused'], ['governanceForced', 'governanceForced'], ['requiresRealApproval', 'requiresRealApproval'],
         ['mandated', 'mandated'], ['mandate', 'mandate'], ['origin', 'origin'], ['ruleOffersAbsence', 'ruleOffersAbsence'], ['ruleOffers', 'ruleOffersReadOnly'],
         ['askClass', 'askClass'], ['classes', 'classes'],
     ]),
     v1: Object.freeze([
-        ['rememberRefused', 'rememberRefused'], ['governanceForced', 'governanceForced'], ['ruleOffersAbsence', 'ruleOffersAbsence'], ['ruleOffers', 'ruleOffersReadOnly'],
+        ['rememberRefused', 'rememberRefused'], ['governanceForced', 'governanceForced'], ['requiresRealApproval', 'requiresRealApproval'],
+        ['ruleOffersAbsence', 'ruleOffersAbsence'], ['ruleOffers', 'ruleOffersReadOnly'],
         ['allowRuleShadowed', 'allowRuleShadow'], ['askClass', 'askClass'], ['classes', 'classes'],
     ]),
     generic: Object.freeze([['ruleOffersAbsence', 'ruleOffersAbsence'], ['askClass', 'askClass'], ['classes', 'classes']]),
@@ -1235,12 +1237,18 @@ function riskSubtreeUnreadable(card) {
         return true;
     }
 }
-function withUnreadableEvidence(carrier, leg, req, reported = []) {
+function withUnreadableEvidence(carrier, leg, req, reported = [], live) {
     const keys = new Set(reported);
     for (const [from, to] of UNREADABLE_EVIDENCE_KEYS[leg]) {
         if (slotPresenceOf(carrier, from) !== 'absent' && !Object.hasOwn(req, to))
             keys.add(from);
     }
+    if (live !== undefined) {
+        for (const [from, to] of UNREADABLE_EVIDENCE_KEYS.live) {
+            if (slotPresenceOf(live, from) !== 'absent' && !Object.hasOwn(req, to))
+                keys.add(from);
+        }
+    }
     if (leg === 'row') {
         const rd = ownDataValue(carrier, 'riskDescriptor');
         if (typeof rd === 'object' && rd !== null && slotPresenceOf(rd, 'allowRuleShadowed') !== 'absent' && !Object.hasOwn(req, 'allowRuleShadow'))
@@ -1310,9 +1318,9 @@ function askSignatureOf(req) {
 function askSigOf(classes, origin, mandate) {
     return JSON.stringify([classes !== undefined ? [...classes] : null, origin ?? null, mandate ?? null]);
 }
-function carrierAskSig(v) {
+function carrierAskSig(v, live) {
     try {
-        return askSigOf(readAskClassPair(v)?.classes, readAskOrigin(v), readApprovalMandate(v));
+        return askSigOf(readAskClassPair(v)?.classes, live === undefined ? undefined : readAskOrigin(live), live === undefined ? undefined : readApprovalMandate(live));
     }
     catch {
         return undefined;
@@ -1623,9 +1631,10 @@ function v1Bit(stamp) {
 const SUSPENDED_ASK_ARGS_NOTE = "this request's tool arguments are not available on this surface — it was raised while no client was connected, " +
     'so you are deciding without seeing them; deny it if you are not sure what it will do. ' +
     'Edits are not accepted on this card: there is no original input to edit';
-function cardFactsOf(carrier, leg, opts) {
+function cardFactsOf(carrier, leg, opts, liveFacts) {
     const c = carrier;
     const full = leg !== 'generic';
+    const live = leg === 'frame' ? carrier : leg === 'v1' ? liveFacts : undefined;
     const asFrame = carrier;
     const fromSubagent = full
         ? (() => {
@@ -1641,7 +1650,7 @@ function cardFactsOf(carrier, leg, opts) {
         try {
             let stream;
             let blind = false;
-            if (leg === 'frame' && typeof opts === 'object' && opts !== null) {
+            if (typeof opts === 'object' && opts !== null) {
                 stream = opts.streamArgs;
                 blind = opts.argsUnavailable === true;
             }
@@ -1714,9 +1723,9 @@ function cardFactsOf(carrier, leg, opts) {
             if (isWireRecordCarrier(pc))
                 out.probeCause = pc;
         });
-        if (leg === 'frame') {
+        if (live !== undefined) {
             v1Bit(() => {
-                const r = readProbeReason(carrier);
+                const r = readProbeReason(live);
                 if (r !== undefined)
                     out.probeReason = r;
             });
@@ -1737,18 +1746,18 @@ function cardFactsOf(carrier, leg, opts) {
         catch {
             realApprovalUnreadable = true;
         }
-        if (leg === 'frame') {
+        if (live !== undefined) {
             v1Bit(() => {
-                if (hasOwnStrictTrue(carrier, 'mandated'))
+                if (hasOwnStrictTrue(live, 'mandated'))
                     out.mandated = true;
             });
             v1Bit(() => {
-                const w = readApprovalMandate(carrier);
+                const w = readApprovalMandate(live);
                 if (w !== undefined)
                     out.mandate = w;
             });
             v1Bit(() => {
-                const rc = readReadRootCandidate(c.readRootCandidate);
+                const rc = readReadRootCandidate(live.readRootCandidate);
                 if (rc !== undefined)
                     out.readRootCandidate = rc;
             });
@@ -1768,9 +1777,9 @@ function cardFactsOf(carrier, leg, opts) {
         if (dlf !== undefined)
             out.denialLimitFallback = dlf;
     });
-    if (leg === 'frame') {
+    if (live !== undefined) {
         v1Bit(() => {
-            const o = readAskOrigin(carrier);
+            const o = readAskOrigin(live);
             if (o !== undefined)
                 out.origin = o;
         });
@@ -1789,14 +1798,14 @@ function cardFactsOf(carrier, leg, opts) {
             out.classes = pair.classes;
         }
     });
-    if (leg === 'frame') {
+    if (live !== undefined) {
         v1Bit(() => {
-            const g = readApprovalBoundGrants(carrier);
+            const g = readApprovalBoundGrants(live);
             if (g !== undefined)
                 out.boundGrants = g;
         });
         v1Bit(() => {
-            const w = readApprovalClassifierNoRuling(carrier);
+            const w = readApprovalClassifierNoRuling(live);
             if (w !== undefined)
                 out.classifierNoRuling = w;
         });
@@ -1811,7 +1820,7 @@ function cardFactsOf(carrier, leg, opts) {
     if (leg === 'frame')
         out.allowSessionCarried = true;
     out.grantBinding = readApprovalGrantBinding(carrier);
-    return withUnreadableEvidence(carrier, leg, out, realApprovalUnreadable ? ['requiresRealApproval'] : []);
+    return withUnreadableEvidence(carrier, leg, out, realApprovalUnreadable ? ['requiresRealApproval'] : [], live);
 }
 export function approvalCardFactsOfV1(card) {
     if (typeof card !== 'object' || card === null)
@@ -1832,9 +1841,19 @@ const MAX_RESPOND_NOTE_CHARS = 2048;
 export async function surfaceToolApprovalFrameAndRespond(frame, respond, streamArgs, signal, lane, run) {
     const receivedAtMs = Date.now();
     const approvalId = frame.approvalId;
-    const entry = { frame, approvalId, identity: liveCardIdentityOf(approvalId, frame, run), respond, streamArgs, signal, lane, receivedAtMs };
+    const carriers = openingFrameCarriersOf(frame);
+    const entry = { frame, carriers, approvalId, identity: liveCardIdentityOf(approvalId, frame, carriers, run), respond, streamArgs, signal, lane, receivedAtMs };
     return enterLiveCard(entry);
 }
+function openingFrameCarriersOf(frame) {
+    if (frame.type !== 'approval_request')
+        return { body: frame, live: frame, leg: 'frame' };
+    const card = frame.card;
+    const pinned = Object.create(frame, { card: { value: card, enumerable: true } });
+    if (isApprovalRequestFrameV1(pinned))
+        return { body: pinned.card, live: frame, leg: 'v1' };
+    return { body: typeof card === 'object' && card !== null ? card : {}, live: undefined, leg: 'generic' };
+}
 function enterLiveCard(e) {
     const { approvalId, signal } = e;
     const held = liveCardHoldOf(liveFrameCallKey(approvalId));
@@ -1848,7 +1867,7 @@ function enterLiveCard(e) {
         return joinOtherLaneHolder(e, other);
     return holdLiveCard(e.identity, signal, async (hold) => {
         const slot = {};
-        const out = await presentToolApprovalFrameAndRespond(e.frame, approvalId, e.respond, e.streamArgs, signal, e.lane, hold, slot, e.receivedAtMs);
+        const out = await presentToolApprovalFrameAndRespond(e.frame, e.carriers, approvalId, e.respond, e.streamArgs, signal, e.lane, hold, slot, e.receivedAtMs);
         noteCallOutcome(slot, out);
         return out;
     });
@@ -1863,15 +1882,16 @@ async function joinOtherLaneHolder(e, other) {
         return { kind: 'not_sent', lane: 'respond', cause: 'retracted', joinedInFlight: true };
     return enterLiveCard(e);
 }
-function liveCardIdentityOf(approvalId, frame, run) {
-    const toolCallId = typeof frame.toolCallId === 'string' && frame.toolCallId !== '' ? frame.toolCallId : undefined;
-    const fromSubagent = isFromSubagent(frame);
+function liveCardIdentityOf(approvalId, frame, carriers, run) {
+    const body = carriers.body;
+    const toolCallId = typeof body.toolCallId === 'string' && body.toolCallId !== '' ? body.toolCallId : undefined;
+    const fromSubagent = isFromSubagent(carriers.body);
     const bound = fromSubagent ? undefined : frameBindingOf(frame);
     const source = bound ?? run;
-    const ownRun = fromSubagent ? frame.sourceTaskId : source?.taskId;
+    const ownRun = fromSubagent ? body.sourceTaskId : source?.taskId;
     const taskId = typeof ownRun === 'string' && ownRun !== '' ? ownRun : undefined;
     const sessionId = !fromSubagent && typeof source?.sessionId === 'string' && source.sessionId !== '' ? source.sessionId : undefined;
-    const askSig = carrierAskSig(frame);
+    const askSig = carrierAskSig(carriers.body, carriers.live);
     return {
         approvalId,
         ...(toolCallId !== undefined ? { toolCallId } : {}),
@@ -1926,10 +1946,11 @@ function readApprovalCardClaimSignal(v) {
 export function claimApprovalCard(identity, options) {
     return claimApprovalCardFor(readApprovalHolderIdentity(identity), readApprovalCardClaimSignal(options));
 }
-async function presentToolApprovalFrameAndRespond(frame, approvalId, respond, streamArgs, signal, lane, hold, ledgerSlot, receivedAtMs) {
-    const frameToolCallId = typeof frame.toolCallId === 'string' && frame.toolCallId !== '' ? frame.toolCallId : undefined;
+async function presentToolApprovalFrameAndRespond(frame, carriers, approvalId, respond, streamArgs, signal, lane, hold, ledgerSlot, receivedAtMs) {
+    const bodyToolCallId = carriers.body.toolCallId;
+    const frameToolCallId = typeof bodyToolCallId === 'string' && bodyToolCallId !== '' ? bodyToolCallId : undefined;
     const decidedByReading = decidedByReadingSnapshotOf(lane);
-    const facts = cardFactsOf(frame, 'frame', { streamArgs, ...(lane?.argsUnavailable === true ? { argsUnavailable: true } : {}) });
+    const facts = cardFactsOf(carriers.body, carriers.leg, { streamArgs, ...(lane?.argsUnavailable === true ? { argsUnavailable: true } : {}) }, carriers.live);
     const argsNotRealInput = facts.argsUnavailable === true;
     const ruleOffers = facts.ruleOffers;
     if (argsNotRealInput && lane?.argsUnavailable !== true && facts.wireNote !== undefined) {
@@ -1939,7 +1960,7 @@ async function presentToolApprovalFrameAndRespond(frame, approvalId, respond, st
         ...facts,
         callKey: liveFrameCallKey(approvalId),
         signal: hold.cardSignal,
-        ...approvalWindowKeysOf(frame, { windowIsCurrent: lane?.windowIsCurrent === true, receivedAtMs }),
+        ...approvalWindowKeysOf(frame, { windowIsCurrent: lane?.windowIsCurrent === true, receivedAtMs, ...(carriers.leg === 'generic' ? { unknownShape: true } : {}) }),
     });
     if (hold.superseded !== undefined) {
         hostLog('debug', `liveToolApprovalWire: ${approvalId} was settled by the engine while its card was up${hold.superseded.parked ? ' (parked)' : ''} — card withdrawn; ` +

package/dist/hostSettingsSource.d.ts

@@ -121,7 +121,7 @@ export interface HostSettingsAdoption {
     };
     readonly overflow?: true;
 }
-export declare function adoptHostSettingsRead(read: HostSettingsRead, session: HostSettingsSession, allowAdmitted?: (layer: AdoptedLayer) => boolean): HostSettingsAdoption;
+export declare function adoptHostSettingsRead(read: HostSettingsRead, session: HostSettingsSession, allowAdmitted?: (layer: AdoptedLayer) => boolean, layeredRules?: boolean): HostSettingsAdoption;
 export type ManagedCommitVerdict = 'proceed' | 'refuse';
 export type ManagedRuleScopeVerdict = 'all-sources' | 'by-switch' | 'degrade';
 export type ManagedHooksRestrictionVerdict = 'use-read' | 'held-restrictions' | 'withhold';

package/dist/hostSettingsSource.js

@@ -524,7 +524,7 @@ function overflowOf(read, session) {
     return Object.freeze({ read, session: remintSameContent(session), trusted: false, clean: false, extraTighten: NO_EXTRA, allowByLayer: emptyByLayer(), overflow: true });
 }
 const carrierKeysOf = (read, layer) => read.layers[layer].carriers.map((c) => c.id);
-export function adoptHostSettingsRead(read, session, allowAdmitted = () => true) {
+export function adoptHostSettingsRead(read, session, allowAdmitted = () => true, layeredRules = false) {
     const B = session.baseline;
     const stackIssues = ADOPTED_LAYERS.flatMap((l) => read.layers[l].issues.map((x) => `${l}|${x}`));
     const loadedNow = ADOPTED_LAYERS.flatMap((l) => read.layers[l].malformed ? [] : read.layers[l].carriers.filter((c) => LOADED.has(c.status) || (c.status === 'empty' && c.emptyKind === 'empty-object')).map((c) => `${l}|${c.id}`));
@@ -627,9 +627,13 @@ export function adoptHostSettingsRead(read, session, allowAdmitted = () => true)
         effectiveLayers[l] = l === 'policySettings' ? snap : Object.freeze({ ...snap, doc: base.docs[l] });
     }
     const effective = Object.freeze({ ...read, layers: Object.freeze(effectiveLayers), current: read, debug: Object.freeze([]) });
-    const sentNow = (bucket) => new Set([...ADOPTED_LAYERS.flatMap((l) => permissionRulesOf(base.docs[l], bucket)), ...extraTighten[bucket].map((r) => r.rule)]);
-    const readNow = (bucket) => new Set(ADOPTED_LAYERS.flatMap((l) => permissionRulesOf(read.layers[l].doc, bucket)));
-    const drop = (bucket) => Object.freeze([...sentNow(bucket)].filter((r) => !readNow(bucket).has(r)).sort());
+    const idOf = (layer, rule) => (layeredRules ? JSON.stringify([layer, rule]) : rule);
+    const sentNow = (bucket) => [...ADOPTED_LAYERS.flatMap((l) => permissionRulesOf(base.docs[l], bucket).map((rule) => ({ layer: l, rule }))), ...extraTighten[bucket]];
+    const readNow = (bucket) => new Set(ADOPTED_LAYERS.flatMap((l) => permissionRulesOf(read.layers[l].doc, bucket).map((rule) => idOf(l, rule))));
+    const drop = (bucket) => {
+        const now = readNow(bucket);
+        return Object.freeze([...new Set(sentNow(bucket).filter((r) => !now.has(idOf(r.layer, r.rule))).map((r) => r.rule))].sort());
+    };
     const wouldDrop = Object.freeze({ deny: drop('deny'), ask: drop('ask') });
     const acceptable = !stackIssues.some((x) => !base.issues.includes(x)) && !anyMalformed && !ADOPTED_LAYERS.some((l) => read.layers[l].carriers.some((c) => c.status === 'unreadable' || c.status === 'not-loaded'));
     const s = mintHostSettingsSession(parentVersionOf(session), session.consented, baseline);

package/dist/hostTurnSettings.d.ts

@@ -8,7 +8,7 @@ import { type HostSettingsSession, type HostSettingsSource } from './hostSetting
 import { type SubmissionIdentity } from './request/submissionIdentity.js';
 import { type WebSearchApiKeyFor } from './webSearchWireCaps.js';
 import { type FileHistoryCaptureReading } from './fileHistoryCaptureCapability.js';
-import type { PermissionsAllowGrantReading } from './permissionsAllowGrantCapability.js';
+import { type PermissionsAllowGrantReading } from './permissionsAllowGrantCapability.js';
 export declare const HOST_SUPPLIED_KEYS: readonly ["settings.hooks", "settings.resolved", "settings.webSearch", "settings.outputStyle", "memory", "fileHistory"];
 export type HostSuppliedKey = (typeof HOST_SUPPLIED_KEYS)[number];
 export declare const HOST_SETTING_CAUSES: readonly ["carried", "entries_dropped", "source_rejected", "projection_failed", "source_unreadable", "empty", "no_source", "host_port_missing", "value_malformed", "held_previous", "policy_withheld"];

package/dist/hostTurnSettings.js

@@ -10,6 +10,7 @@ import { fileHistoryTightenVerdict, fileHistoryUnjudgedRefusal } from './fileHis
 import { msg, renderMessage } from './i18n/translate.js';
 import { newRulePortsProjection, projectPermissionsDeclaration, rulePortsMissingOf, WIRE_RULE_TRUST_ORDER } from './permissionsDeclaration.js';
 import { assemblyRefusalOf } from './wireFailureShape.js';
+import { permissionRuleLayersOn } from './permissionsAllowGrantCapability.js';
 import { layerAdmitted } from './settingsLayerAdmission.js';
 import { appendOwnElement, ownDataField } from './ownKey.js';
 export const HOST_SUPPLIED_KEYS = Object.freeze(['settings.hooks', 'settings.resolved', 'settings.webSearch', 'settings.outputStyle', 'memory', 'fileHistory']);
@@ -388,15 +389,15 @@ function allowAdmittedFor(read) {
 function badPermissionsSource() {
     return new HostSourceShapeError(`hostTurnSettings: sources.resolved must be 'none' or { allowGrantReading, cliArg?, session?, clientOwnedServers?, serverVersion? } — since 0.101.0 the permission rules of the settings files come from the settings the entry reads; do not pass snapshot — got something else (the value is not echoed).`);
 }
-function permissionsArm(src, side, adoption) {
+function readPermissionSource(src) {
     const key = 'settings.resolved';
     if (src.kind === 'missing')
-        return missingArm(key);
+        return { kind: 'arm', arm: missingArm(key) };
     if (src.kind === 'threw')
-        return unreadableArm(key);
+        return { kind: 'arm', arm: unreadableArm(key) };
     const v = src.value;
     if (v === 'none')
-        return noSourceArm(key);
+        return { kind: 'arm', arm: noSourceArm(key) };
     let allowGrantReading;
     let cliAllow;
     let cliDeny;
@@ -415,7 +416,7 @@ function permissionsArm(src, side, adoption) {
         const se = ownDataOf(v, 'session');
         const o = ownDataOf(v, 'clientOwnedServers');
         if (!g.ok || !c.ok || !se.ok || !o.ok)
-            return unreadableArm(key);
+            return { kind: 'arm', arm: unreadableArm(key) };
         allowGrantReading = g.value;
         const cv = c.value;
         const sv = se.value;
@@ -428,7 +429,7 @@ function permissionsArm(src, side, adoption) {
         const sd = sv === undefined ? { ok: true, value: undefined } : ownDataOf(sv, 'deny');
         const sa = sv === undefined ? { ok: true, value: undefined } : ownDataOf(sv, 'ask');
         if (!ca.ok || !cd.ok || !sd.ok || !sa.ok)
-            return unreadableArm(key);
+            return { kind: 'arm', arm: unreadableArm(key) };
         cliAllow = stringListOf(ca.value);
         cliDeny = stringListOf(cd.value);
         sesDeny = stringListOf(sd.value);
@@ -439,16 +440,32 @@ function permissionsArm(src, side, adoption) {
     catch (e) {
         if (e instanceof HostSourceShapeError)
             throw e;
-        return unreadableArm(key);
+        return { kind: 'arm', arm: unreadableArm(key) };
     }
     if (cliAllow === undefined || cliDeny === undefined || sesDeny === undefined || sesAsk === undefined || (owned === undefined && ownedRaw !== undefined))
         throw badPermissionsSource();
+    return { kind: 'facts', allowGrantReading, cliAllow, cliDeny, sesDeny, sesAsk, owned, serverVersion };
+}
+function permissionsArm(facts, side, adoption, layered) {
+    const key = 'settings.resolved';
+    if (facts.kind === 'arm')
+        return facts.arm;
+    const { allowGrantReading, cliAllow, cliDeny, sesDeny, sesAsk, owned, serverVersion } = facts;
     if (side.kind === 'missing')
         return missingArm(key);
     const buckets = { deny: [], ask: [], allow: [] };
     const origins = { deny: new Map(), ask: new Map(), allow: new Map() };
     const rank = (o) => WIRE_RULE_TRUST_ORDER.indexOf(o);
+    const contributions = { deny: [], ask: [] };
+    const contributed = { deny: new Set(), ask: new Set() };
     const add = (bucket, rule, origin) => {
+        if (bucket !== 'allow') {
+            const k = JSON.stringify([origin, rule]);
+            if (!contributed[bucket].has(k)) {
+                contributed[bucket].add(k);
+                appendOwnElement(contributions[bucket], freeze({ rule, origin }));
+            }
+        }
         const prev = origins[bucket].get(rule);
         if (prev === undefined) {
             appendOwnElement(buckets[bucket], rule);
@@ -504,7 +521,7 @@ function permissionsArm(src, side, adoption) {
     let declared;
     if (projectionError === undefined) {
         try {
-            const d = projectPermissionsDeclaration({ deny: buckets.deny, ask: buckets.ask, allow: buckets.allow, origins, cliDeny, settingsRead: 'clean', ...(owned !== undefined && owned.length > 0 ? { clientOwnedServers: owned } : {}), ...(serverVersion !== undefined ? { serverVersion } : {}) }, allowGrantReading, portsProjection);
+            const d = projectPermissionsDeclaration({ deny: buckets.deny, ask: buckets.ask, allow: buckets.allow, origins, cliDeny, settingsRead: 'clean', ...(owned !== undefined && owned.length > 0 ? { clientOwnedServers: owned } : {}), ...(serverVersion !== undefined ? { serverVersion } : {}) }, allowGrantReading, portsProjection, layered ? freeze({ deny: freeze([...contributions.deny]), ask: freeze([...contributions.ask]) }) : undefined);
             declared = d.permissions !== undefined ? { permissions: d.permissions } : undefined;
         }
         catch (error) {
@@ -615,10 +632,12 @@ export function buildHostTurnSettings(input, judges) {
     if (rawSide.kind === 'read')
         for (const line of rawSide.read.debug)
             hostLog('debug', line);
-    const adoption = rawSide.kind === 'read' ? adoptHostSettingsRead(rawSide.read, session, allowAdmittedFor(rawSide.read)) : undefined;
+    const permissionSource = readPermissionSource(read('resolved'));
+    const layeredRules = permissionSource.kind === 'facts' && permissionRuleLayersOn(permissionSource.allowGrantReading);
+    const adoption = rawSide.kind === 'read' ? adoptHostSettingsRead(rawSide.read, session, allowAdmittedFor(rawSide.read), layeredRules) : undefined;
     const side = adoption !== undefined ? { kind: 'read', read: adoption.read } : rawSide;
     const nextSession = adoption?.session ?? remintSameContent(session);
-    const resolvedArm = permissionsArm(read('resolved'), side, adoption);
+    const resolvedArm = permissionsArm(permissionSource, side, adoption, layeredRules);
     let resolvedCarried = resolvedArm.carried;
     let resolvedError;
     if (resolvedCarried !== undefined) {

package/dist/i18n/messages.en.d.ts

@@ -187,6 +187,8 @@ declare const EN: {
     'config.mcp.nameReserved': string;
     'config.mcp.identityHeadersBothSet': string;
     'config.mcp.transportUnreadable': string;
+    'config.mcp.transportNotAdvertised': string;
+    'config.mcp.transportsNone': string;
     'config.mcp.transportInvalid': string;
     'config.mcp.transportDegraded': string;
     'config.mcp.toolAxesInvalid': string;
@@ -547,6 +549,13 @@ declare const EN: {
     'session.fileHistoryRefusal.notSaid': string;
     'session.fileHistoryRefusal.unrecognized': string;
     'session.fileHistoryRefusal.unreadable': string;
+    'session.memoryErase.personalStoreUnjudged': string;
+    'session.memorySync.parked.one': string;
+    'session.memorySync.parked.other': string;
+    'session.memorySync.parkedUnnamed.one': string;
+    'session.memorySync.parkedUnnamed.other': string;
+    'session.memorySync.wayOut.deleteCursor': string;
+    'session.memorySync.wayOut.unrecognized': string;
     'session.hostSettings.memorySwitchMalformed': string;
     'session.hostSettings.fileHistoryRestoreConflict': string;
     'session.hostSettings.projectionUnchecked': string;
@@ -670,6 +679,18 @@ declare const EN: {
     'session.steerRefusal.advice': string;
     'session.steerRefusal.hostQueue.queued': string;
     'session.steerRefusal.hostQueue.dropped': string;
+    'session.permissionModeSwitch.applied': string;
+    'session.permissionModeSwitch.folded': string;
+    'session.permissionModeSwitch.reason.entryFloor': string;
+    'session.permissionModeSwitch.reason.disableAutoMode': string;
+    'session.permissionModeSwitch.reason.engine': string;
+    'session.permissionModeSwitch.notPersisted': string;
+    'session.permissionModeSwitch.notRunning': string;
+    'session.permissionModeSwitch.notFound': string;
+    'session.permissionModeSwitch.refused': string;
+    'session.permissionModeSwitch.refusedWithCode': string;
+    'session.permissionModeSwitch.unconfirmed': string;
+    'session.permissionModeSwitch.unavailable': string;
     'notice.capability.subject.userInvokedSkills': string;
     'notice.capability.subject.skillToolLists': string;
     'notice.capability.subject.permissionRulesWrite': string;
@@ -1053,6 +1074,35 @@ declare const EN: {
     'config.mods.refusal.by': string;
     'config.mods.rewrite.resultInPlace': string;
     'config.mods.rewrite.inputBy': string;
+    'follow.notFollowed.headRun': string;
+    'follow.notFollowed.headTurn': string;
+    'follow.notFollowed.reason.exhaustedDraining': string;
+    'follow.notFollowed.reason.exhaustedConnectionLost': string;
+    'follow.notFollowed.reason.exhaustedStreamCap': string;
+    'follow.notFollowed.reason.exhausted': string;
+    'follow.notFollowed.reason.badInput': string;
+    'follow.notFollowed.reason.noRunId': string;
+    'follow.notFollowed.reason.runUnknown': string;
+    'follow.notFollowed.reason.unspecified': string;
+    'follow.notFollowed.endingUnknown': string;
+    'follow.notFollowed.exit.reattach': string;
+    'follow.notFollowed.exit.checkRuns': string;
+    'follow.notFollowed.exit.runUnknown': string;
+    'follow.notFollowed.idleTear': string;
+    'follow.notFollowed.idleGrace': string;
+    'approval.planReview.note.empty': string;
+    'approval.planReview.note.marked': string;
+    'approval.planReview.note.tooLarge': string;
+    'approval.planReview.note.notCarried': string;
+    'approval.planReview.note.unknown': string;
+    'approval.planReview.askAgain.shown': string;
+    'approval.planReview.askAgain.marked': string;
+    'approval.planReview.askAgain.tooLarge': string;
+    'approval.planReview.askAgain.notCarried': string;
+    'approval.planReview.askAgain.unknown': string;
+    'approval.planReview.askAgain.withNote': string;
+    'approval.planReview.option.askAgain.label': string;
+    'approval.planReview.option.askAgain.description': string;
 };
 export declare const EN_MESSAGES: Readonly<typeof EN>;
 export type MessageKey = keyof typeof EN;

package/dist/i18n/messages.en.js

@@ -187,6 +187,8 @@ const EN = {
     'config.mcp.nameReserved': 'MCP server name {name}{where} cannot be used, so the server was not started: names starting with "remote-" are kept for the MCP servers a connected device offers. Rename the server.',
     'config.mcp.identityHeadersBothSet': 'MCP server {name}{where} was not started: it sets both principalHeader and assertionHeader, which name the same identity header — keep only one of the two. The other MCP servers are unaffected.',
     'config.mcp.transportUnreadable': 'could not be read (a getter or proxy trap on the declaration threw)',
+    'config.mcp.transportNotAdvertised': 'MCP server {name}{where} was not started: it uses the {kind} transport, which the engine in use says it does not support (it supports: {supported}). The other MCP servers are unaffected.',
+    'config.mcp.transportsNone': 'none',
     'config.mcp.transportInvalid': 'MCP server {name}{where} was not started: its transport setting cannot be used — {path} {problem}. Fix that setting for this server (or remove the server); the other MCP servers are unaffected.',
     'config.mcp.transportDegraded': 'MCP server {name}{where} was started without part of its transport settings, which cannot be used as written: {lost}. The rest of its settings are applied; fix the settings named above to get them applied too.',
     'config.mcp.toolAxesInvalid': 'MCP server {name}{where} was not started: its toolAxes setting is not valid — {problem}. Fix the toolAxes entry for this server (or remove it); the other MCP servers are unaffected.',
@@ -547,6 +549,13 @@ const EN = {
     'session.fileHistoryRefusal.notSaid': 'Nothing was sent: file checkpointing is turned off in your settings, but this engine did not report whether it can stop recording file history for a session, so sending now could record it anyway. Trying again will not change that while this engine reports the same; to send and let file history be recorded this time, turn file checkpointing back on in your settings.',
     'session.fileHistoryRefusal.unrecognized': 'Nothing was sent: file checkpointing is turned off in your settings, but this engine reported a file-history capture mode this client does not recognize, so whether it can stop recording file history for a session is unknown and sending now could record it anyway. Trying again will not change that while this engine reports the same; to send and let file history be recorded this time, turn file checkpointing back on in your settings.',
     'session.fileHistoryRefusal.unreadable': "Nothing was sent: file checkpointing is turned off in your settings, but this engine's report on whether it can stop recording file history for a session could not be read by this client, so sending now could record it anyway. Trying again will not change that while this engine reports the same; to send and let file history be recorded this time, turn file checkpointing back on in your settings.",
+    'session.memoryErase.personalStoreUnjudged': "Nothing was erased: part of this session's memory is kept in a personal memory store that this deployment cannot erase yet, so the erase was declined before anything changed.",
+    'session.memorySync.parked.one': 'Memory sync is paused on this deployment for the "{scope}" layer: its sync cursor could not be used. {wayOut}',
+    'session.memorySync.parked.other': 'Memory sync is paused on this deployment for {count} layers ({scopes}): their sync cursors could not be used. {wayOut}',
+    'session.memorySync.parkedUnnamed.one': 'Memory sync is paused on this deployment for 1 layer: its sync cursor could not be used. {wayOut}',
+    'session.memorySync.parkedUnnamed.other': 'Memory sync is paused on this deployment for {count} layers: their sync cursors could not be used. {wayOut}',
+    'session.memorySync.wayOut.deleteCursor': 'Syncing resumes once an operator deletes the sync cursor of each paused layer on the server; entries deleted on only one side since the last sync will come back and need to be deleted again.',
+    'session.memorySync.wayOut.unrecognized': 'The deployment named a way out that this client does not recognize, so none is suggested here.',
     'session.hostSettings.memorySwitchMalformed': 'The memory setting in your settings file could not be read, so turning memory off was not applied: this request was sent with memory available. Fix the memory section (memory.enabled must be true or false) to turn it off.',
     'session.hostSettings.fileHistoryRestoreConflict': 'Nothing was sent: file checkpointing was turned off in your settings after this request was prepared, but this request also restores files from a checkpoint, and a request cannot do both. To restore the files, turn file checkpointing back on in your settings; otherwise send the request without the file restore.',
     'session.hostSettings.projectionUnchecked': 'The settings for this request could not be checked before sending, so the request is not sent. Reload your settings and try again.',
@@ -670,6 +679,18 @@ const EN = {
     'session.steerRefusal.advice': '{happened} — {nextStep}',
     'session.steerRefusal.hostQueue.queued': 'it stays queued and will be submitted as-is when this turn ends',
     'session.steerRefusal.hostQueue.dropped': 'it was not kept; {nextStep}',
+    'session.permissionModeSwitch.applied': 'The running turn now uses the {mode} permission mode.',
+    'session.permissionModeSwitch.folded': 'The running turn now uses the {mode} permission mode instead of the one you chose — {reason}.',
+    'session.permissionModeSwitch.reason.entryFloor': 'this deployment does not allow a looser mode than its floor',
+    'session.permissionModeSwitch.reason.disableAutoMode': "this task's settings turn auto mode off",
+    'session.permissionModeSwitch.reason.engine': 'the engine does not allow the chosen mode for this run',
+    'session.permissionModeSwitch.notPersisted': '{line} The switch was not saved with the run: if the run pauses and later resumes, it resumes in the mode it had before, so switch again after it resumes.',
+    'session.permissionModeSwitch.notRunning': 'This run is not running a turn right now (it is paused waiting on a decision, has finished, or is running elsewhere), so its mode was not switched.',
+    'session.permissionModeSwitch.notFound': 'No such run is visible to you, so no mode was switched.',
+    'session.permissionModeSwitch.refused': 'The engine refused to switch the mode of this run ({status}), so it keeps the mode it had.',
+    'session.permissionModeSwitch.refusedWithCode': 'The engine refused to switch the mode of this run ({status} {code}), so it keeps the mode it had.',
+    'session.permissionModeSwitch.unconfirmed': 'The switch was sent but no readable answer came back, so whether the mode changed is not known — switch again to be sure.',
+    'session.permissionModeSwitch.unavailable': 'Switching the mode of a running turn is not available here, so the mode was not changed.',
     'notice.capability.subject.userInvokedSkills': 'user-invoked skills',
     'notice.capability.subject.skillToolLists': 'skill tool lists',
     'notice.capability.subject.permissionRulesWrite': 'permission-rule write entry',
@@ -1053,5 +1074,34 @@ const EN = {
     'config.mods.refusal.by': 'Refused by {by}',
     'config.mods.rewrite.resultInPlace': 'Answered by {by} in place of the tool',
     'config.mods.rewrite.inputBy': 'Arguments changed by {by} before the call was let through',
+    'follow.notFollowed.headRun': 'This screen is no longer following run {taskId}{reason}{ending}{exit}',
+    'follow.notFollowed.headTurn': "This screen is no longer following this turn's run{reason}{ending}{exit}",
+    'follow.notFollowed.reason.exhaustedDraining': ": the engine instance serving it was going down when its last event stream closed, and this client's re-attach allowance has run out.",
+    'follow.notFollowed.reason.exhaustedConnectionLost': ": the connection dropped on the last attempt, and this client's re-attach allowance has run out.",
+    'follow.notFollowed.reason.exhaustedStreamCap': ": its event stream hit the engine's time limit on the last attempt, and this client's re-attach allowance has run out.",
+    'follow.notFollowed.reason.exhausted': ": this client's re-attach allowance has run out.",
+    'follow.notFollowed.reason.badInput': ': this client hit an internal error while re-attaching.',
+    'follow.notFollowed.reason.noRunId': ': this client never learned which run it was, so there is nothing to re-attach to.',
+    'follow.notFollowed.reason.runUnknown': ': the engine answered that it does not know that run — it may have been cleaned up, or this client asked with the wrong identity.',
+    'follow.notFollowed.reason.unspecified': '.',
+    'follow.notFollowed.endingUnknown': ' The engine has not said how that run ended — it may still be going.',
+    'follow.notFollowed.exit.reattach': ' What it does next shows up here only after this client re-attaches to it.',
+    'follow.notFollowed.exit.checkRuns': " Check this session's runs before sending the work again.",
+    'follow.notFollowed.exit.runUnknown': " Re-attaching will not bring it back here; check this session's runs before sending the work again.",
+    'follow.notFollowed.idleTear': "This turn's event stream went silent for {secs}s. {notice} {grace}",
+    'follow.notFollowed.idleGrace': 'If the run legitimately goes quiet this long (e.g. a long build), raising the idle grace may help next time: set {env} (settings env, integer ms, {min}-{max}; default {default}).',
+    'approval.planReview.note.empty': 'The plan is empty.',
+    'approval.planReview.note.marked': 'This plan contains characters that cannot be shown as written, so it cannot be approved from this card. Reject it, or ask for the plan to be presented again.',
+    'approval.planReview.note.tooLarge': 'This plan is too large to be shown in full ({length} characters), so it cannot be approved from this card. Reject it, or ask for a shorter plan.',
+    'approval.planReview.note.notCarried': "The engine did not bring this plan's text up to this card (it may be too long), so it cannot be approved from this card. Reject it, or ask for the plan to be presented again.",
+    'approval.planReview.note.unknown': 'This card cannot show the plan it would approve, so it cannot be approved from this card. Reject it, or ask for the plan to be presented again.',
+    'approval.planReview.askAgain.shown': 'The user asked for the plan to be presented again.',
+    'approval.planReview.askAgain.marked': 'The user could not approve this plan: it contains characters that cannot be shown as written. Present the plan again without those characters.',
+    'approval.planReview.askAgain.tooLarge': 'The user could not approve this plan: it is too large to be shown in full. Present a shorter plan.',
+    'approval.planReview.askAgain.notCarried': 'The user could not approve this plan: its text did not reach the approval card (it may be too long). Present a shorter plan.',
+    'approval.planReview.askAgain.unknown': 'The user could not approve this plan: the approval card could not show it. Present the plan again.',
+    'approval.planReview.askAgain.withNote': '{sentence} The user added: {note}',
+    'approval.planReview.option.askAgain.label': 'No, ask for the plan to be presented again',
+    'approval.planReview.option.askAgain.description': 'Do not approve; ask the model to present the plan again',
 };
 export const EN_MESSAGES = Object.freeze(EN);