@sema-agent/client-core 0.104.1 → 0.106.0

package/dist/hitl/sessionAllowRoute.d.ts

@@ -0,0 +1,2 @@
+export type SessionAllowLeg = 'frame' | 'v1' | 'generic';
+export declare function sessionAllowCarried(leg: SessionAllowLeg, approvalId: unknown): boolean;

package/dist/hitl/sessionAllowRoute.js

@@ -0,0 +1,7 @@
+export function sessionAllowCarried(leg, approvalId) {
+    if (leg === 'frame')
+        return true;
+    if (leg === 'v1')
+        return typeof approvalId === 'string' && approvalId !== '';
+    return false;
+}

package/dist/hitl/sessionPolicyWire.d.ts

@@ -128,17 +128,11 @@ export interface SessionPolicyInertEntryRefusal {
 export declare function tightenSessionPolicy(facade: SessionPolicyFacade, req: SessionPolicyTightenRequest, opts?: {
     signal?: AbortSignal;
 }): Promise<SessionPolicyTightenOutcome>;
-export interface SessionPolicyTightenFacts {
-    readonly agentsStartedBeforeFirstRule?: number | undefined;
-    readonly workflowsRunning?: number | undefined;
-    readonly untrackedBackgroundItems?: number | undefined;
-    readonly inFlightUnreadable?: true | undefined;
-}
 export interface SessionPolicyDeploymentFacts {
     readonly operator?: 'present' | 'absent';
     readonly identityAttach?: 'available' | 'unavailable';
 }
-export declare function sessionPolicyTightenNotice(outcome: SessionPolicyTightenOutcome, lang?: UiLanguage, facts?: SessionPolicyTightenFacts, deployment?: SessionPolicyDeploymentFacts): string;
+export declare function sessionPolicyTightenNotice(outcome: SessionPolicyTightenOutcome, lang?: UiLanguage, deployment?: SessionPolicyDeploymentFacts): string;
 export declare function sessionPolicyReadNotice(outcome: Exclude<SessionPolicyReadOutcome, {
     kind: 'present';
 }> | {

package/dist/hitl/sessionPolicyWire.js

@@ -414,29 +414,6 @@ export async function tightenSessionPolicy(facade, req, opts) {
     return { kind: 'conflict', rev: second.retryAtRev };
 }
 const earlierGrammarNote = (lang) => renderMessage(msg('rules.sessionPolicy.tighten.earlierGrammar'), lang);
-function factSlot(facts, key) {
-    try {
-        return ownRead(facts, key);
-    }
-    catch {
-        return undefined;
-    }
-}
-function factCount(facts, key) {
-    const n = factSlot(facts, key);
-    return typeof n === 'number' && Number.isSafeInteger(n) && n >= 1 ? n : undefined;
-}
-function firstRuleWorkFactsOf(facts) {
-    const none = { agents: undefined, workflows: undefined, untracked: undefined, unreadable: false };
-    if (typeof facts !== 'object' || facts === null)
-        return none;
-    return {
-        agents: factCount(facts, 'agentsStartedBeforeFirstRule'),
-        workflows: factCount(facts, 'workflowsRunning'),
-        untracked: factCount(facts, 'untrackedBackgroundItems'),
-        unreadable: factSlot(facts, 'inFlightUnreadable') === true,
-    };
-}
 function deploymentHasNoOperator(d) {
     try {
         return typeof d === 'object' && d !== null && ownRead(d, 'operator') === 'absent';
@@ -453,28 +430,11 @@ function deploymentHasNoIdentity(d) {
         return false;
     }
 }
-export function sessionPolicyTightenNotice(outcome, lang, facts, deployment) {
+export function sessionPolicyTightenNotice(outcome, lang, deployment) {
     const say = (key, params) => renderMessage(msg(key, params), lang);
     switch (outcome.kind) {
-        case 'written': {
-            const head = say('rules.sessionPolicy.tighten.written', { rev: outcome.rev });
-            const w = firstRuleWorkFactsOf(facts);
-            const unseen = msg('rules.sessionPolicy.tighten.writtenBeforeFirstRule.unseen');
-            if (w.unreadable)
-                return `${head} ${renderMessage(msg('rules.sessionPolicy.tighten.writtenBeforeFirstRule.unreadable'), lang)} ${renderMessage(unseen, lang)}`;
-            const parts = [];
-            if (w.agents !== undefined)
-                appendOwnElement(parts, msg(w.agents === 1 ? 'rules.sessionPolicy.tighten.writtenBeforeFirstRule.agents.one' : 'rules.sessionPolicy.tighten.writtenBeforeFirstRule.agents.many', { n: w.agents }));
-            if (w.workflows !== undefined)
-                appendOwnElement(parts, msg(w.workflows === 1 ? 'rules.sessionPolicy.tighten.writtenBeforeFirstRule.workflows.one' : 'rules.sessionPolicy.tighten.writtenBeforeFirstRule.workflows.many', { n: w.workflows }));
-            if (w.untracked !== undefined)
-                appendOwnElement(parts, msg(w.untracked === 1 ? 'rules.sessionPolicy.tighten.writtenBeforeFirstRule.untracked.one' : 'rules.sessionPolicy.tighten.writtenBeforeFirstRule.untracked.many', { n: w.untracked }));
-            const [p0, p1, p2] = parts;
-            if (p0 === undefined)
-                return head;
-            const list = p1 === undefined ? p0 : p2 === undefined ? msg('rules.sessionPolicy.tighten.writtenBeforeFirstRule.list.two', { a: p0, b: p1 }) : msg('rules.sessionPolicy.tighten.writtenBeforeFirstRule.list.three', { a: p0, b: p1, c: p2 });
-            return `${head} ${renderMessage(msg('rules.sessionPolicy.tighten.writtenBeforeFirstRule.counts', { list }), lang)} ${renderMessage(unseen, lang)}`;
-        }
+        case 'written':
+            return say('rules.sessionPolicy.tighten.written', { rev: outcome.rev });
         case 'conflict':
             return say('rules.sessionPolicy.tighten.conflict');
         case 'loosen_forbidden':

package/dist/hitl/subagentSource.d.ts

@@ -0,0 +1 @@
+export declare function subagentSourceSessionOf(carrier: object | null | undefined): string | undefined;

package/dist/hitl/subagentSource.js

@@ -0,0 +1,13 @@
+import { slotReadOf } from '../wireFailureShape.js';
+const nonEmpty = (v) => (typeof v === 'string' && v !== '' ? v : undefined);
+export function subagentSourceSessionOf(carrier) {
+    if (typeof carrier !== 'object' || carrier === null)
+        return undefined;
+    const current = slotReadOf(carrier, 'sourceSessionId');
+    if (current.presence === 'present')
+        return nonEmpty(current.value);
+    if (current.presence !== 'absent')
+        return undefined;
+    const retired = slotReadOf(carrier, 'sourceTaskId');
+    return retired.presence === 'present' ? nonEmpty(retired.value) : undefined;
+}

package/dist/hitl/toolApprovalWire.d.ts

@@ -163,7 +163,7 @@ export declare function approvalCardPortFor(sessionKey: string): ApprovalCardPor
 export declare function __resetSettledApprovalsForTests(): void;
 export declare function _resetApprovalCardPortForTest(): void;
 export declare function surfaceApprovalCard(req: ApprovalCardRequest): Promise<ApprovalCardDecision>;
-declare const REMEMBER_REFUSAL_CODES: readonly ["remember_not_in_proof", "remember_requires_binding", "capability.store_required", "decide.workflow_remember_unsupported", "decide.parked_remember_unsupported"];
+declare const REMEMBER_REFUSAL_CODES: readonly ["remember_not_in_proof", "capability.store_required", "decide.workflow_remember_unsupported", "decide.parked_remember_unsupported"];
 export type RememberRefusalCode = (typeof REMEMBER_REFUSAL_CODES)[number];
 export declare function rememberRefusalOf(error: unknown): RememberRefusalCode | undefined;
 export declare function surfaceFsApprovalAndDecide(deps: FsApprovalWireDeps, taskId: string, argsByCall: Map<string, unknown>, signal?: AbortSignal, parkGatedCallId?: string, parkToolName?: string): Promise<ApprovalResolution>;
@@ -179,7 +179,7 @@ export interface ReadRootCandidateView {
     covers?: 'exact';
 }
 export type ToolApprovalDelegation = ApprovalCardDelegation;
-export declare const TOOL_APPROVAL_FRAME_KEYS_MIRROR: readonly ["type", "approvalId", "toolCallId", "toolName", "sourceTaskId", "fromSubagent", "sourceAgentName", "message", "args", "argsOmitted", "governanceForced", "ruleOffers", "ruleOffersAbsence", "denialLimitFallback", "readRootCandidate", "mandated", "mandate", "origin", "approvalCard", "askClass", "classes", "inputHasBidi", "parked", "persistedRuleShadowed", "allowRuleShadowed", "probeCause", "probeReason", "rememberRefused", "boundGrantDigest", "boundGrantAbsence", "boundGrants", "classifierNoRuling", "ruleEvidence", "requiresRealApproval", "expiresInMs", "expiresAtMs", "serverNowMs", "delegation", "outcome", "cause", "requestedBy"];
+export declare const TOOL_APPROVAL_FRAME_KEYS_MIRROR: readonly ["type", "approvalId", "toolCallId", "toolName", "sourceTaskId", "sourceSessionId", "agentId", "askReasons", "fromSubagent", "sourceAgentName", "message", "args", "argsOmitted", "governanceForced", "ruleOffers", "ruleOffersAbsence", "denialLimitFallback", "readRootCandidate", "mandated", "mandate", "origin", "approvalCard", "askClass", "classes", "inputHasBidi", "parked", "persistedRuleShadowed", "allowRuleShadowed", "probeCause", "probeReason", "rememberRefused", "boundGrantDigest", "boundGrantAbsence", "boundGrants", "classifierNoRuling", "ruleEvidence", "requiresRealApproval", "expiresInMs", "expiresAtMs", "serverNowMs", "delegation", "outcome", "cause", "requestedBy"];
 export interface ApprovalMandatedFacts {
     readonly mandated?: true;
     readonly ruleOffersAbsence?: string;
@@ -283,6 +283,7 @@ export interface ApprovalCardFrameFactsOptions {
     readonly argsUnavailable?: true;
 }
 export declare function approvalCardFactsOfV1(card: object | null | undefined): Readonly<ApprovalCardV1Facts> | undefined;
+export declare function approvalCardFactsOfV1Frame(frame: object | null | undefined): Readonly<ApprovalCardFacts> | undefined;
 export declare function approvalCardFactsOfFrame(frame: object | null | undefined, opts?: ApprovalCardFrameFactsOptions | null): Readonly<ApprovalCardFacts> | undefined;
 export declare function approvalCardFactsOfGeneric(card: object | null | undefined): Readonly<ApprovalCardFacts> | undefined;
 export interface ToolApprovalFrameLaneOpts {

package/dist/hitl/toolApprovalWire.js

@@ -15,9 +15,10 @@ import { readEngineActiveBgTasks } from '../fleet/fleetLedger.js';
 import { CORE_SKILL_TOOL_NAME } from '../generated/toolNameTables.js';
 import { CORE_ALLOW_ENTRY_INERT_REASONS, CORE_PERSISTED_RULE_MATCHES } from '../generated/engineFactTables.js';
 import { msg, renderMessage } from '../i18n/translate.js';
+import { sessionAllowCarried } from './sessionAllowRoute.js';
 import { INTERRUPT_DENY_REASON, observeCancelByDeny, surfaceApprovalParking, surfaceRememberNotApplied, surfaceEditNotForwarded, surfaceEditRefusedOnBlindAsk, surfaceRuleArmNotSent, surfaceRuleArmRejected } from './hitlHostSurface.js';
 import { approvalCallKey, liveFrameCallKey } from './gateIdentity.js';
-import { displayUntrusted } from '../displayUntrusted.js';
+import { displayUntrusted, quoteUntrustedForSentence } from '../displayUntrusted.js';
 import { frameBindingOf } from '../frameBinding.js';
 import { carriesAttributionKey, deliverWithAttributionLadder } from './attributionLadder.js';
 import { deliverApprovalDecision, newSendTally } from './approvalDelivery.js';
@@ -28,6 +29,8 @@ import { isApprovalMandateWord } from '../gateVocabulary.js';
 import { approvalDecidedByAdmitted } from '../approvalDecidedByCapability.js';
 import { decideFailureNote } from '../decideFailureNote.js';
 import { slotPresenceOf, wireFailureTextsOf } from '../wireFailureShape.js';
+import { APPROVAL_LIVE_FACE_KEYS, approvalLiveFaceOf, hasOwnStrictTrue } from './approvalLiveFace.js';
+import { subagentSourceSessionOf } from './subagentSource.js';
 import { isPlainRecord } from '../jsonFaithful.js';
 import { DECIDE_WORKFLOW_REMEMBER_UNSUPPORTED } from '../engineErrorCodes.js';
 import { readDecideReceipt } from '../decideReceipt.js';
@@ -156,7 +159,6 @@ function cardPortMissReason() {
 }
 const REMEMBER_REFUSAL_CODES = Object.freeze([
     'remember_not_in_proof',
-    'remember_requires_binding',
     'capability.store_required',
     DECIDE_WORKFLOW_REMEMBER_UNSUPPORTED,
     'decide.parked_remember_unsupported',
@@ -512,9 +514,7 @@ async function presentFsApprovalAndDecide(deps, taskId, argsByCall, signal, foun
         ...(argsRewritten ? { argsRewritten: true, wireNote: ARGS_REWRITTEN_NOTE } : {}),
         ...(pending.governanceForced === true ? { governanceForced: true } : {}),
         ...(readRequiresRealApproval(pending) ? { requiresRealApproval: true } : {}),
-        ...(hasOwnStrictTrue(pending, 'mandated') ? { mandated: true } : {}),
-        ...((w) => (w !== undefined ? { mandate: w } : {}))(readApprovalMandate(pending)),
-        ...((o) => (o !== undefined ? { origin: o } : {}))(readAskOrigin(pending)),
+        ...approvalLiveFaceOf(pending).facts,
         ...((w) => (w !== undefined ? { approvalCard: w } : {}))(readApprovalCardWord(pending)),
         ...(readAskClassPair(pending) ?? {}),
         ...(pending.gateKind === 'irreversible_ask' ? { irreversibleParkGate: true } : {}),
@@ -683,6 +683,9 @@ export const TOOL_APPROVAL_FRAME_KEYS_MIRROR = [
     'toolCallId',
     'toolName',
     'sourceTaskId',
+    'sourceSessionId',
+    'agentId',
+    'askReasons',
     'fromSubagent',
     'sourceAgentName',
     'message',
@@ -758,9 +761,6 @@ export function toolPermissionRequestAskBits(card, requestId) {
         ...(seatSessionRowOf(card, requestId) ? { sessionRow: true } : {}),
     };
 }
-function hasOwnStrictTrue(v, key) {
-    return Object.hasOwn(v, key) && v[key] === true;
-}
 function isToolApprovalDelegation(v) {
     if (v === null || typeof v !== 'object')
         return false;
@@ -1283,6 +1283,30 @@ export function classifierNoRulingDetail(word, lang) {
         return renderMessage(msg('approval.classifier.noRulingOther', { reason: displayUntrusted(word) }), lang);
     return renderMessage(msg('approval.classifier.noRulingBare'), lang);
 }
+const BOUND_GRANT_NAMES_SHOWN = 6;
+const BOUND_GRANT_NAME_MAX = 512;
+const BOUND_GRANT_NAME_INPUT_MAX = 8192;
+const BOUND_GRANT_NAMES_LOOKAHEAD = 32;
+function boundGrantNameList(rules, lang) {
+    const shown = [];
+    let looked = 0;
+    for (const entry of rules) {
+        if (shown.length >= BOUND_GRANT_NAMES_SHOWN || looked >= BOUND_GRANT_NAMES_LOOKAHEAD)
+            break;
+        looked += 1;
+        if (entry.length > BOUND_GRANT_NAME_INPUT_MAX)
+            continue;
+        const quoted = quoteUntrustedForSentence(entry, BOUND_GRANT_NAME_MAX);
+        if (quoted !== undefined)
+            shown.push(quoted);
+    }
+    if (shown.length === 0)
+        return undefined;
+    const rest = rules.length - shown.length;
+    if (rest > 0)
+        shown.push(renderMessage(msg('approval.boundGrants.more', { count: rest }), lang));
+    return shown.join(' · ');
+}
 export function approvalBoundGrantsDetail(grants, lang) {
     const g = readApprovalBoundGrants({ boundGrants: grants });
     if (g === undefined)
@@ -1290,8 +1314,10 @@ export function approvalBoundGrantsDetail(grants, lang) {
     if (g.skill === null)
         return renderMessage(msg('approval.boundGrants.noSkill'), lang);
     const isRule = (e) => readBoundGrantEntry(e)?.kind === 'rule';
-    const a = g.allowedTools.filter(isRule).length;
-    const d = g.disallowedTools.filter(isRule).length;
+    const allowRules = g.allowedTools.filter(isRule);
+    const denyRules = g.disallowedTools.filter(isRule);
+    const a = allowRules.length;
+    const d = denyRules.length;
     const allowNothing = g.allowedTools.length - a;
     const denyNothing = g.disallowedTools.length - d;
     if (denyNothing > 0) {
@@ -1302,8 +1328,14 @@ export function approvalBoundGrantsDetail(grants, lang) {
             return renderMessage(allowNothing === 1 ? msg('approval.boundGrants.listsNoToolsWithNothing.one') : msg('approval.boundGrants.listsNoToolsWithNothing.other', { count: String(allowNothing) }), lang);
         return renderMessage(msg('approval.boundGrants.listsNoTools'), lang);
     }
-    const allow = a === 1 ? msg('approval.boundGrants.allowPart.one') : msg('approval.boundGrants.allowPart.other', { count: a });
-    const deny = d === 1 ? msg('approval.boundGrants.denyPart.one') : msg('approval.boundGrants.denyPart.other', { count: d });
+    const allowNames = boundGrantNameList(allowRules, lang);
+    const denyNames = boundGrantNameList(denyRules, lang);
+    const allow = allowNames !== undefined
+        ? (a === 1 ? msg('approval.boundGrants.allowPart.named.one', { names: allowNames }) : msg('approval.boundGrants.allowPart.named.other', { count: a, names: allowNames }))
+        : (a === 1 ? msg('approval.boundGrants.allowPart.one') : msg('approval.boundGrants.allowPart.other', { count: a }));
+    const deny = denyNames !== undefined
+        ? (d === 1 ? msg('approval.boundGrants.denyPart.named.one', { names: denyNames }) : msg('approval.boundGrants.denyPart.named.other', { count: d, names: denyNames }))
+        : (d === 1 ? msg('approval.boundGrants.denyPart.one') : msg('approval.boundGrants.denyPart.other', { count: d }));
     if (allowNothing > 0) {
         return renderMessage(allowNothing === 1 ? msg('approval.boundGrants.activatesWithNothing.one', { allow, deny }) : msg('approval.boundGrants.activatesWithNothing.other', { allow, deny, count: String(allowNothing) }), lang);
     }
@@ -1320,7 +1352,8 @@ function askSigOf(classes, origin, mandate) {
 }
 function carrierAskSig(v, live) {
     try {
-        return askSigOf(readAskClassPair(v)?.classes, live === undefined ? undefined : readAskOrigin(live), live === undefined ? undefined : readApprovalMandate(live));
+        const face = live === undefined ? undefined : approvalLiveFaceOf(live);
+        return askSigOf(readAskClassPair(v)?.classes, face?.facts.origin, face?.facts.mandate);
     }
     catch {
         return undefined;
@@ -1605,10 +1638,11 @@ export function readRuleOfferSupply(offers) {
 }
 function subagentBadgeFor(frame) {
     let name = typeof frame.sourceAgentName === 'string' && frame.sourceAgentName.length > 0 ? frame.sourceAgentName : '';
-    if (!name && typeof frame.sourceTaskId === 'string' && frame.sourceTaskId.length > 0) {
-        name = frame.sourceTaskId;
+    const source = subagentSourceSessionOf(frame);
+    if (!name && source !== undefined) {
+        name = source;
         try {
-            const row = readEngineActiveBgTasks().tasks.find(t => t.id === frame.sourceTaskId);
+            const row = readEngineActiveBgTasks().tasks.find(t => t.id === source);
             if (typeof row?.name === 'string' && row.name.length > 0)
                 name = row.name;
         }
@@ -1631,10 +1665,11 @@ function v1Bit(stamp) {
 const SUSPENDED_ASK_ARGS_NOTE = "this request's tool arguments are not available on this surface — it was raised while no client was connected, " +
     'so you are deciding without seeing them; deny it if you are not sure what it will do. ' +
     'Edits are not accepted on this card: there is no original input to edit';
-function cardFactsOf(carrier, leg, opts, liveFacts) {
+function cardFactsOf(carrier, leg, opts, liveFacts, approvalId) {
     const c = carrier;
     const full = leg !== 'generic';
     const live = leg === 'frame' ? carrier : leg === 'v1' ? liveFacts : undefined;
+    let face;
     const asFrame = carrier;
     const fromSubagent = full
         ? (() => {
@@ -1747,15 +1782,11 @@ function cardFactsOf(carrier, leg, opts, liveFacts) {
             realApprovalUnreadable = true;
         }
         if (live !== undefined) {
-            v1Bit(() => {
-                if (hasOwnStrictTrue(live, 'mandated'))
-                    out.mandated = true;
-            });
-            v1Bit(() => {
-                const w = readApprovalMandate(live);
-                if (w !== undefined)
-                    out.mandate = w;
-            });
+            face = approvalLiveFaceOf(live);
+            if (face.facts.mandated === true)
+                out.mandated = true;
+            if (face.facts.mandate !== undefined)
+                out.mandate = face.facts.mandate;
             v1Bit(() => {
                 const rc = readReadRootCandidate(live.readRootCandidate);
                 if (rc !== undefined)
@@ -1777,13 +1808,8 @@ function cardFactsOf(carrier, leg, opts, liveFacts) {
         if (dlf !== undefined)
             out.denialLimitFallback = dlf;
     });
-    if (live !== undefined) {
-        v1Bit(() => {
-            const o = readAskOrigin(live);
-            if (o !== undefined)
-                out.origin = o;
-        });
-    }
+    if (face !== undefined && face.facts.origin !== undefined)
+        out.origin = face.facts.origin;
     if (leg !== 'generic') {
         v1Bit(() => {
             const w = readApprovalCardWord(carrier);
@@ -1817,16 +1843,32 @@ function cardFactsOf(carrier, leg, opts, liveFacts) {
     });
     if (leg === 'generic')
         out.cardPayloadUnreadable = true;
-    if (leg === 'frame')
+    if (sessionAllowCarried(leg, approvalId))
         out.allowSessionCarried = true;
     out.grantBinding = readApprovalGrantBinding(carrier);
-    return withUnreadableEvidence(carrier, leg, out, realApprovalUnreadable ? ['requiresRealApproval'] : [], live);
+    const reported = realApprovalUnreadable ? ['requiresRealApproval'] : [];
+    if (face?.layerUnknown === 'marked' || (leg === 'v1' && face?.layerUnknown === 'absent'))
+        reported.push(...APPROVAL_LIVE_FACE_KEYS);
+    return withUnreadableEvidence(carrier, leg, out, reported, live);
 }
 export function approvalCardFactsOfV1(card) {
     if (typeof card !== 'object' || card === null)
         return undefined;
     return Object.freeze(cardFactsOf(card, 'v1'));
 }
+export function approvalCardFactsOfV1Frame(frame) {
+    if (typeof frame !== 'object' || frame === null)
+        return undefined;
+    try {
+        const carriers = openingFrameCarriersOf(frame);
+        if (carriers.leg !== 'v1')
+            return undefined;
+        return Object.freeze(cardFactsOf(carriers.body, 'v1', null, carriers.live, ownDataValue(frame, 'approvalId')));
+    }
+    catch {
+        return undefined;
+    }
+}
 export function approvalCardFactsOfFrame(frame, opts) {
     if (typeof frame !== 'object' || frame === null)
         return undefined;
@@ -1888,7 +1930,7 @@ function liveCardIdentityOf(approvalId, frame, carriers, run) {
     const fromSubagent = isFromSubagent(carriers.body);
     const bound = fromSubagent ? undefined : frameBindingOf(frame);
     const source = bound ?? run;
-    const ownRun = fromSubagent ? body.sourceTaskId : source?.taskId;
+    const ownRun = fromSubagent ? subagentSourceSessionOf(carriers.body) : source?.taskId;
     const taskId = typeof ownRun === 'string' && ownRun !== '' ? ownRun : undefined;
     const sessionId = !fromSubagent && typeof source?.sessionId === 'string' && source.sessionId !== '' ? source.sessionId : undefined;
     const askSig = carrierAskSig(carriers.body, carriers.live);
@@ -1950,7 +1992,7 @@ async function presentToolApprovalFrameAndRespond(frame, carriers, approvalId, r
     const bodyToolCallId = carriers.body.toolCallId;
     const frameToolCallId = typeof bodyToolCallId === 'string' && bodyToolCallId !== '' ? bodyToolCallId : undefined;
     const decidedByReading = decidedByReadingSnapshotOf(lane);
-    const facts = cardFactsOf(carriers.body, carriers.leg, { streamArgs, ...(lane?.argsUnavailable === true ? { argsUnavailable: true } : {}) }, carriers.live);
+    const facts = cardFactsOf(carriers.body, carriers.leg, { streamArgs, ...(lane?.argsUnavailable === true ? { argsUnavailable: true } : {}) }, carriers.live, approvalId);
     const argsNotRealInput = facts.argsUnavailable === true;
     const ruleOffers = facts.ruleOffers;
     if (argsNotRealInput && lane?.argsUnavailable !== true && facts.wireNote !== undefined) {

package/dist/hostSettingsSource.d.ts

@@ -2,7 +2,7 @@ import { SETTINGS_WORKSPACE_TRUST_STATES } from './generated/settingsSchemaTable
 import type { ManagedPolicyState, PluginHooksReading, SessionHooksReading, SettingsDocument } from './host.js';
 import type { PluginHookReaderState } from './pluginHooksWire.js';
 export type WorkspaceTrustState = (typeof SETTINGS_WORKSPACE_TRUST_STATES)[number];
-export declare const HOST_SETTINGS_LAYERS: readonly ["policySettings", "userSettings", "projectSettings", "localSettings", "flagSettings"];
+export declare const HOST_SETTINGS_LAYERS: readonly ["policySettings", "userSettings", "projectSettings", "localSettings", "flagSettings", "foreignProjectSettings"];
 export type HostSettingsLayer = (typeof HOST_SETTINGS_LAYERS)[number];
 export declare const MANAGED_POLICY_STATES: readonly ["absent", "in-effect", "in-effect-pieces", "unreadable-covered", "unreadable-uncovered", "remote-unknown"];
 export declare const HOST_STARTUP_MODES: readonly ["safe", "bare", "none"];
@@ -71,6 +71,8 @@ export declare function sourceOfRead(read: HostSettingsRead): HostSettingsSource
 export declare function settingsValueOf(read: HostSettingsRead, key: string): {} | null | undefined;
 export declare function mergedBooleanOf(read: HostSettingsRead, key: string): boolean | undefined;
 export declare const CC_MERGE_ORDER: readonly ["userSettings", "projectSettings", "localSettings", "flagSettings", "policySettings"];
+export type TightenOnlyHostSettingsLayer = Exclude<HostSettingsLayer, (typeof CC_MERGE_ORDER)[number]>;
+export declare const TIGHTEN_ONLY_HOST_SETTINGS_LAYERS: readonly TightenOnlyHostSettingsLayer[];
 export declare function nonManagedLayerDown(read: HostSettingsRead): boolean;
 export declare const ADOPTED_LAYERS: readonly ["userSettings", "projectSettings", "localSettings", "flagSettings"];
 export type AdoptedLayer = (typeof ADOPTED_LAYERS)[number];
@@ -102,6 +104,7 @@ export declare function hostSettingsSessionFollows(stored: HostSettingsSession |
 export declare const FIRST_SESSION: HostSettingsSession;
 export declare function sessionSnapshotOf(previous: {} | null | undefined): HostSettingsSession | undefined;
 export declare function permissionRulesOf(doc: SettingsDocument | null, bucket: 'allow' | 'deny' | 'ask'): readonly string[];
+export declare function permissionBucketOf(doc: SettingsDocument | null, bucket: 'allow' | 'deny' | 'ask'): readonly string[] | undefined;
 export interface HostSettingsAdoption {
     readonly read: HostSettingsRead;
     readonly session: HostSettingsSession;
@@ -121,7 +124,7 @@ export interface HostSettingsAdoption {
     };
     readonly overflow?: true;
 }
-export declare function adoptHostSettingsRead(read: HostSettingsRead, session: HostSettingsSession, allowAdmitted?: (layer: AdoptedLayer) => boolean): HostSettingsAdoption;
+export declare function adoptHostSettingsRead(read: HostSettingsRead, session: HostSettingsSession, allowAdmitted?: (layer: AdoptedLayer) => boolean, layeredRules?: boolean): HostSettingsAdoption;
 export type ManagedCommitVerdict = 'proceed' | 'refuse';
 export type ManagedRuleScopeVerdict = 'all-sources' | 'by-switch' | 'degrade';
 export type ManagedHooksRestrictionVerdict = 'use-read' | 'held-restrictions' | 'withhold';

package/dist/hostSettingsSource.js

@@ -2,7 +2,7 @@ import { appendOwnElement } from './ownKey.js';
 import { SETTINGS_WORKSPACE_TRUST_STATES } from './generated/settingsSchemaTables.js';
 import { jsonFaithfulCost, materializeJsonFaithful } from './jsonFaithful.js';
 import { faultText } from './hostCallbackGuard.js';
-export const HOST_SETTINGS_LAYERS = Object.freeze(['policySettings', 'userSettings', 'projectSettings', 'localSettings', 'flagSettings']);
+export const HOST_SETTINGS_LAYERS = Object.freeze(['policySettings', 'userSettings', 'projectSettings', 'localSettings', 'flagSettings', 'foreignProjectSettings']);
 export const MANAGED_POLICY_STATES = Object.freeze(['absent', 'in-effect', 'in-effect-pieces', 'unreadable-covered', 'unreadable-uncovered', 'remote-unknown']);
 export const HOST_STARTUP_MODES = Object.freeze(['safe', 'bare', 'none']);
 export const HOST_SETTINGS_CARRIER_STATUSES = Object.freeze(['loaded', 'loaded-partial', 'empty', 'absent', 'unreadable', 'not-loaded']);
@@ -394,8 +394,9 @@ export function mergedBooleanOf(read, key) {
     return out;
 }
 export const CC_MERGE_ORDER = Object.freeze(['userSettings', 'projectSettings', 'localSettings', 'flagSettings', 'policySettings']);
+export const TIGHTEN_ONLY_HOST_SETTINGS_LAYERS = Object.freeze(HOST_SETTINGS_LAYERS.filter((l) => !CC_MERGE_ORDER.includes(l)));
 export function nonManagedLayerDown(read) {
-    return HOST_SETTINGS_LAYERS.some((l) => {
+    return CC_MERGE_ORDER.some((l) => {
         if (l === 'policySettings')
             return false;
         const snap = read.layers[l];
@@ -403,6 +404,7 @@ export function nonManagedLayerDown(read) {
     });
 }
 export const ADOPTED_LAYERS = Object.freeze(['userSettings', 'projectSettings', 'localSettings', 'flagSettings']);
+const isAdoptedLayer = (l) => ADOPTED_LAYERS.includes(l);
 const GENESIS_VERSION = '0';
 export const parentVersionOf = (session) => (session.version === GENESIS_VERSION ? null : session.version);
 function canonicalOf(v) {
@@ -512,19 +514,22 @@ export function sessionSnapshotOf(previous) {
 }
 const LOADED = new Set(['loaded', 'loaded-partial']);
 export function permissionRulesOf(doc, bucket) {
+    return permissionBucketOf(doc, bucket) ?? [];
+}
+export function permissionBucketOf(doc, bucket) {
     if (doc === null)
-        return [];
+        return undefined;
     const p = ownData(doc, 'permissions');
     if (!p.ok || !isRecord(p.value))
-        return [];
+        return undefined;
     const b = ownData(p.value, bucket);
-    return b.ok && Array.isArray(b.value) ? b.value.filter((x) => typeof x === 'string') : [];
+    return b.ok && Array.isArray(b.value) ? b.value.filter((x) => typeof x === 'string') : undefined;
 }
 function overflowOf(read, session) {
     return Object.freeze({ read, session: remintSameContent(session), trusted: false, clean: false, extraTighten: NO_EXTRA, allowByLayer: emptyByLayer(), overflow: true });
 }
 const carrierKeysOf = (read, layer) => read.layers[layer].carriers.map((c) => c.id);
-export function adoptHostSettingsRead(read, session, allowAdmitted = () => true) {
+export function adoptHostSettingsRead(read, session, allowAdmitted = () => true, layeredRules = false) {
     const B = session.baseline;
     const stackIssues = ADOPTED_LAYERS.flatMap((l) => read.layers[l].issues.map((x) => `${l}|${x}`));
     const loadedNow = ADOPTED_LAYERS.flatMap((l) => read.layers[l].malformed ? [] : read.layers[l].carriers.filter((c) => LOADED.has(c.status) || (c.status === 'empty' && c.emptyKind === 'empty-object')).map((c) => `${l}|${c.id}`));
@@ -624,12 +629,16 @@ export function adoptHostSettingsRead(read, session, allowAdmitted = () => true)
     const effectiveLayers = {};
     for (const l of HOST_SETTINGS_LAYERS) {
         const snap = read.layers[l];
-        effectiveLayers[l] = l === 'policySettings' ? snap : Object.freeze({ ...snap, doc: base.docs[l] });
+        effectiveLayers[l] = isAdoptedLayer(l) ? Object.freeze({ ...snap, doc: base.docs[l] }) : snap;
     }
     const effective = Object.freeze({ ...read, layers: Object.freeze(effectiveLayers), current: read, debug: Object.freeze([]) });
-    const sentNow = (bucket) => new Set([...ADOPTED_LAYERS.flatMap((l) => permissionRulesOf(base.docs[l], bucket)), ...extraTighten[bucket].map((r) => r.rule)]);
-    const readNow = (bucket) => new Set(ADOPTED_LAYERS.flatMap((l) => permissionRulesOf(read.layers[l].doc, bucket)));
-    const drop = (bucket) => Object.freeze([...sentNow(bucket)].filter((r) => !readNow(bucket).has(r)).sort());
+    const idOf = (layer, rule) => (layeredRules ? JSON.stringify([layer, rule]) : rule);
+    const sentNow = (bucket) => [...ADOPTED_LAYERS.flatMap((l) => permissionRulesOf(base.docs[l], bucket).map((rule) => ({ layer: l, rule }))), ...extraTighten[bucket]];
+    const readNow = (bucket) => new Set(ADOPTED_LAYERS.flatMap((l) => permissionRulesOf(read.layers[l].doc, bucket).map((rule) => idOf(l, rule))));
+    const drop = (bucket) => {
+        const now = readNow(bucket);
+        return Object.freeze([...new Set(sentNow(bucket).filter((r) => !now.has(idOf(r.layer, r.rule))).map((r) => r.rule))].sort());
+    };
     const wouldDrop = Object.freeze({ deny: drop('deny'), ask: drop('ask') });
     const acceptable = !stackIssues.some((x) => !base.issues.includes(x)) && !anyMalformed && !ADOPTED_LAYERS.some((l) => read.layers[l].carriers.some((c) => c.status === 'unreadable' || c.status === 'not-loaded'));
     const s = mintHostSettingsSession(parentVersionOf(session), session.consented, baseline);

package/dist/hostTurnSettings.d.ts

@@ -3,12 +3,12 @@ import type { WireHooksConfig } from './finalVerifyWire.js';
 import type { memoryOffDeclared as MemoryOffDeclared } from './request/taskRequest.js';
 import type { EnvLike } from './hostEnv.js';
 import { type SettingsDocument } from './host.js';
-import type { HookSettingsSource, HooksWirePlan, HooksWirePlanOptions } from './pluginHooksWire.js';
-import { type HostSettingsSession, type HostSettingsSource } from './hostSettingsSource.js';
+import type { HooksWirePlan, HooksWirePlanOptions } from './pluginHooksWire.js';
+import { type HostSettingsLayer, type HostSettingsSession, type HostSettingsSource } from './hostSettingsSource.js';
 import { type SubmissionIdentity } from './request/submissionIdentity.js';
 import { type WebSearchApiKeyFor } from './webSearchWireCaps.js';
 import { type FileHistoryCaptureReading } from './fileHistoryCaptureCapability.js';
-import type { PermissionsAllowGrantReading } from './permissionsAllowGrantCapability.js';
+import { type PermissionsAllowGrantReading } from './permissionsAllowGrantCapability.js';
 export declare const HOST_SUPPLIED_KEYS: readonly ["settings.hooks", "settings.resolved", "settings.webSearch", "settings.outputStyle", "memory", "fileHistory"];
 export type HostSuppliedKey = (typeof HOST_SUPPLIED_KEYS)[number];
 export declare const HOST_SETTING_CAUSES: readonly ["carried", "entries_dropped", "source_rejected", "projection_failed", "source_unreadable", "empty", "no_source", "host_port_missing", "value_malformed", "held_previous", "policy_withheld"];
@@ -16,12 +16,12 @@ export type HostSettingCause = (typeof HOST_SETTING_CAUSES)[number];
 export declare const HOST_SETTING_DISPOSITIONS: readonly ["carry", "carry_partial", "withhold_notice", "withhold_by_policy", "hold_for_consent", "refuse_turn", "unwired", "nothing_to_carry"];
 export type HostSettingDisposition = (typeof HOST_SETTING_DISPOSITIONS)[number];
 export type HostSettingPlane = 'turn' | 'session' | 'diagnostic';
-export type HostSettingNoticeId = 'HS-UNWIRED' | 'HS-MANAGED-REJECTED' | 'HS-PROJECTION' | 'HS-SOURCE-UNREADABLE' | 'HS-WEBSEARCH-MALFORMED' | 'HS-SWITCH-MALFORMED' | 'HS-FILEHISTORY-UNJUDGED' | 'HS-FILEHISTORY-RESTORE' | 'HS-MANAGED-UNREADABLE' | 'HS-LAYER-NOT-LOADED' | 'HS-HELD-PREVIOUS' | 'HS-STYLE-MISSING' | 'HS-STYLE-SAFE';
+export type HostSettingNoticeId = 'HS-UNWIRED' | 'HS-MANAGED-REJECTED' | 'HS-PROJECTION' | 'HS-SOURCE-UNREADABLE' | 'HS-WEBSEARCH-MALFORMED' | 'HS-SWITCH-MALFORMED' | 'HS-FILEHISTORY-UNJUDGED' | 'HS-FILEHISTORY-RESTORE' | 'HS-MANAGED-UNREADABLE' | 'HS-LAYER-NOT-LOADED' | 'HS-HELD-PREVIOUS' | 'HS-STYLE-MISSING' | 'HS-STYLE-SAFE' | 'HS-LAYER-PARTS-UNREAD';
 export interface HostSettingRow {
     readonly key: HostSuppliedKey;
     readonly cause: HostSettingCause;
     readonly disposition: HostSettingDisposition;
-    readonly layers?: readonly HookSettingsSource[];
+    readonly layers?: readonly HostSettingsLayer[];
 }
 export interface HostSettingNotice {
     readonly id: HostSettingNoticeId;
@@ -123,7 +123,6 @@ export interface HostPermissionFacts {
         readonly ask?: readonly string[];
     };
     readonly clientOwnedServers?: readonly string[];
-    readonly serverVersion?: string;
 }
 export declare function rethrowHostResolvedDeferred(product: HostTurnSettings): void;
 export type HostResolvedMaterializer = (snapshot: SettingsDocument) => SettingsDocument;