@sema-agent/client-core 0.105.0 → 0.106.0

package/dist/hitl/toolApprovalWire.js

@@ -15,9 +15,10 @@ import { readEngineActiveBgTasks } from '../fleet/fleetLedger.js';
 import { CORE_SKILL_TOOL_NAME } from '../generated/toolNameTables.js';
 import { CORE_ALLOW_ENTRY_INERT_REASONS, CORE_PERSISTED_RULE_MATCHES } from '../generated/engineFactTables.js';
 import { msg, renderMessage } from '../i18n/translate.js';
+import { sessionAllowCarried } from './sessionAllowRoute.js';
 import { INTERRUPT_DENY_REASON, observeCancelByDeny, surfaceApprovalParking, surfaceRememberNotApplied, surfaceEditNotForwarded, surfaceEditRefusedOnBlindAsk, surfaceRuleArmNotSent, surfaceRuleArmRejected } from './hitlHostSurface.js';
 import { approvalCallKey, liveFrameCallKey } from './gateIdentity.js';
-import { displayUntrusted } from '../displayUntrusted.js';
+import { displayUntrusted, quoteUntrustedForSentence } from '../displayUntrusted.js';
 import { frameBindingOf } from '../frameBinding.js';
 import { carriesAttributionKey, deliverWithAttributionLadder } from './attributionLadder.js';
 import { deliverApprovalDecision, newSendTally } from './approvalDelivery.js';
@@ -28,6 +29,8 @@ import { isApprovalMandateWord } from '../gateVocabulary.js';
 import { approvalDecidedByAdmitted } from '../approvalDecidedByCapability.js';
 import { decideFailureNote } from '../decideFailureNote.js';
 import { slotPresenceOf, wireFailureTextsOf } from '../wireFailureShape.js';
+import { APPROVAL_LIVE_FACE_KEYS, approvalLiveFaceOf, hasOwnStrictTrue } from './approvalLiveFace.js';
+import { subagentSourceSessionOf } from './subagentSource.js';
 import { isPlainRecord } from '../jsonFaithful.js';
 import { DECIDE_WORKFLOW_REMEMBER_UNSUPPORTED } from '../engineErrorCodes.js';
 import { readDecideReceipt } from '../decideReceipt.js';
@@ -156,7 +159,6 @@ function cardPortMissReason() {
 }
 const REMEMBER_REFUSAL_CODES = Object.freeze([
     'remember_not_in_proof',
-    'remember_requires_binding',
     'capability.store_required',
     DECIDE_WORKFLOW_REMEMBER_UNSUPPORTED,
     'decide.parked_remember_unsupported',
@@ -512,9 +514,7 @@ async function presentFsApprovalAndDecide(deps, taskId, argsByCall, signal, foun
         ...(argsRewritten ? { argsRewritten: true, wireNote: ARGS_REWRITTEN_NOTE } : {}),
         ...(pending.governanceForced === true ? { governanceForced: true } : {}),
         ...(readRequiresRealApproval(pending) ? { requiresRealApproval: true } : {}),
-        ...(hasOwnStrictTrue(pending, 'mandated') ? { mandated: true } : {}),
-        ...((w) => (w !== undefined ? { mandate: w } : {}))(readApprovalMandate(pending)),
-        ...((o) => (o !== undefined ? { origin: o } : {}))(readAskOrigin(pending)),
+        ...approvalLiveFaceOf(pending).facts,
         ...((w) => (w !== undefined ? { approvalCard: w } : {}))(readApprovalCardWord(pending)),
         ...(readAskClassPair(pending) ?? {}),
         ...(pending.gateKind === 'irreversible_ask' ? { irreversibleParkGate: true } : {}),
@@ -683,6 +683,9 @@ export const TOOL_APPROVAL_FRAME_KEYS_MIRROR = [
     'toolCallId',
     'toolName',
     'sourceTaskId',
+    'sourceSessionId',
+    'agentId',
+    'askReasons',
     'fromSubagent',
     'sourceAgentName',
     'message',
@@ -758,9 +761,6 @@ export function toolPermissionRequestAskBits(card, requestId) {
         ...(seatSessionRowOf(card, requestId) ? { sessionRow: true } : {}),
     };
 }
-function hasOwnStrictTrue(v, key) {
-    return Object.hasOwn(v, key) && v[key] === true;
-}
 function isToolApprovalDelegation(v) {
     if (v === null || typeof v !== 'object')
         return false;
@@ -1283,6 +1283,30 @@ export function classifierNoRulingDetail(word, lang) {
         return renderMessage(msg('approval.classifier.noRulingOther', { reason: displayUntrusted(word) }), lang);
     return renderMessage(msg('approval.classifier.noRulingBare'), lang);
 }
+const BOUND_GRANT_NAMES_SHOWN = 6;
+const BOUND_GRANT_NAME_MAX = 512;
+const BOUND_GRANT_NAME_INPUT_MAX = 8192;
+const BOUND_GRANT_NAMES_LOOKAHEAD = 32;
+function boundGrantNameList(rules, lang) {
+    const shown = [];
+    let looked = 0;
+    for (const entry of rules) {
+        if (shown.length >= BOUND_GRANT_NAMES_SHOWN || looked >= BOUND_GRANT_NAMES_LOOKAHEAD)
+            break;
+        looked += 1;
+        if (entry.length > BOUND_GRANT_NAME_INPUT_MAX)
+            continue;
+        const quoted = quoteUntrustedForSentence(entry, BOUND_GRANT_NAME_MAX);
+        if (quoted !== undefined)
+            shown.push(quoted);
+    }
+    if (shown.length === 0)
+        return undefined;
+    const rest = rules.length - shown.length;
+    if (rest > 0)
+        shown.push(renderMessage(msg('approval.boundGrants.more', { count: rest }), lang));
+    return shown.join(' · ');
+}
 export function approvalBoundGrantsDetail(grants, lang) {
     const g = readApprovalBoundGrants({ boundGrants: grants });
     if (g === undefined)
@@ -1290,8 +1314,10 @@ export function approvalBoundGrantsDetail(grants, lang) {
     if (g.skill === null)
         return renderMessage(msg('approval.boundGrants.noSkill'), lang);
     const isRule = (e) => readBoundGrantEntry(e)?.kind === 'rule';
-    const a = g.allowedTools.filter(isRule).length;
-    const d = g.disallowedTools.filter(isRule).length;
+    const allowRules = g.allowedTools.filter(isRule);
+    const denyRules = g.disallowedTools.filter(isRule);
+    const a = allowRules.length;
+    const d = denyRules.length;
     const allowNothing = g.allowedTools.length - a;
     const denyNothing = g.disallowedTools.length - d;
     if (denyNothing > 0) {
@@ -1302,8 +1328,14 @@ export function approvalBoundGrantsDetail(grants, lang) {
             return renderMessage(allowNothing === 1 ? msg('approval.boundGrants.listsNoToolsWithNothing.one') : msg('approval.boundGrants.listsNoToolsWithNothing.other', { count: String(allowNothing) }), lang);
         return renderMessage(msg('approval.boundGrants.listsNoTools'), lang);
     }
-    const allow = a === 1 ? msg('approval.boundGrants.allowPart.one') : msg('approval.boundGrants.allowPart.other', { count: a });
-    const deny = d === 1 ? msg('approval.boundGrants.denyPart.one') : msg('approval.boundGrants.denyPart.other', { count: d });
+    const allowNames = boundGrantNameList(allowRules, lang);
+    const denyNames = boundGrantNameList(denyRules, lang);
+    const allow = allowNames !== undefined
+        ? (a === 1 ? msg('approval.boundGrants.allowPart.named.one', { names: allowNames }) : msg('approval.boundGrants.allowPart.named.other', { count: a, names: allowNames }))
+        : (a === 1 ? msg('approval.boundGrants.allowPart.one') : msg('approval.boundGrants.allowPart.other', { count: a }));
+    const deny = denyNames !== undefined
+        ? (d === 1 ? msg('approval.boundGrants.denyPart.named.one', { names: denyNames }) : msg('approval.boundGrants.denyPart.named.other', { count: d, names: denyNames }))
+        : (d === 1 ? msg('approval.boundGrants.denyPart.one') : msg('approval.boundGrants.denyPart.other', { count: d }));
     if (allowNothing > 0) {
         return renderMessage(allowNothing === 1 ? msg('approval.boundGrants.activatesWithNothing.one', { allow, deny }) : msg('approval.boundGrants.activatesWithNothing.other', { allow, deny, count: String(allowNothing) }), lang);
     }
@@ -1320,7 +1352,8 @@ function askSigOf(classes, origin, mandate) {
 }
 function carrierAskSig(v, live) {
     try {
-        return askSigOf(readAskClassPair(v)?.classes, live === undefined ? undefined : readAskOrigin(live), live === undefined ? undefined : readApprovalMandate(live));
+        const face = live === undefined ? undefined : approvalLiveFaceOf(live);
+        return askSigOf(readAskClassPair(v)?.classes, face?.facts.origin, face?.facts.mandate);
     }
     catch {
         return undefined;
@@ -1605,10 +1638,11 @@ export function readRuleOfferSupply(offers) {
 }
 function subagentBadgeFor(frame) {
     let name = typeof frame.sourceAgentName === 'string' && frame.sourceAgentName.length > 0 ? frame.sourceAgentName : '';
-    if (!name && typeof frame.sourceTaskId === 'string' && frame.sourceTaskId.length > 0) {
-        name = frame.sourceTaskId;
+    const source = subagentSourceSessionOf(frame);
+    if (!name && source !== undefined) {
+        name = source;
         try {
-            const row = readEngineActiveBgTasks().tasks.find(t => t.id === frame.sourceTaskId);
+            const row = readEngineActiveBgTasks().tasks.find(t => t.id === source);
             if (typeof row?.name === 'string' && row.name.length > 0)
                 name = row.name;
         }
@@ -1631,10 +1665,11 @@ function v1Bit(stamp) {
 const SUSPENDED_ASK_ARGS_NOTE = "this request's tool arguments are not available on this surface — it was raised while no client was connected, " +
     'so you are deciding without seeing them; deny it if you are not sure what it will do. ' +
     'Edits are not accepted on this card: there is no original input to edit';
-function cardFactsOf(carrier, leg, opts, liveFacts) {
+function cardFactsOf(carrier, leg, opts, liveFacts, approvalId) {
     const c = carrier;
     const full = leg !== 'generic';
     const live = leg === 'frame' ? carrier : leg === 'v1' ? liveFacts : undefined;
+    let face;
     const asFrame = carrier;
     const fromSubagent = full
         ? (() => {
@@ -1747,15 +1782,11 @@ function cardFactsOf(carrier, leg, opts, liveFacts) {
             realApprovalUnreadable = true;
         }
         if (live !== undefined) {
-            v1Bit(() => {
-                if (hasOwnStrictTrue(live, 'mandated'))
-                    out.mandated = true;
-            });
-            v1Bit(() => {
-                const w = readApprovalMandate(live);
-                if (w !== undefined)
-                    out.mandate = w;
-            });
+            face = approvalLiveFaceOf(live);
+            if (face.facts.mandated === true)
+                out.mandated = true;
+            if (face.facts.mandate !== undefined)
+                out.mandate = face.facts.mandate;
             v1Bit(() => {
                 const rc = readReadRootCandidate(live.readRootCandidate);
                 if (rc !== undefined)
@@ -1777,13 +1808,8 @@ function cardFactsOf(carrier, leg, opts, liveFacts) {
         if (dlf !== undefined)
             out.denialLimitFallback = dlf;
     });
-    if (live !== undefined) {
-        v1Bit(() => {
-            const o = readAskOrigin(live);
-            if (o !== undefined)
-                out.origin = o;
-        });
-    }
+    if (face !== undefined && face.facts.origin !== undefined)
+        out.origin = face.facts.origin;
     if (leg !== 'generic') {
         v1Bit(() => {
             const w = readApprovalCardWord(carrier);
@@ -1817,16 +1843,32 @@ function cardFactsOf(carrier, leg, opts, liveFacts) {
     });
     if (leg === 'generic')
         out.cardPayloadUnreadable = true;
-    if (leg === 'frame')
+    if (sessionAllowCarried(leg, approvalId))
         out.allowSessionCarried = true;
     out.grantBinding = readApprovalGrantBinding(carrier);
-    return withUnreadableEvidence(carrier, leg, out, realApprovalUnreadable ? ['requiresRealApproval'] : [], live);
+    const reported = realApprovalUnreadable ? ['requiresRealApproval'] : [];
+    if (face?.layerUnknown === 'marked' || (leg === 'v1' && face?.layerUnknown === 'absent'))
+        reported.push(...APPROVAL_LIVE_FACE_KEYS);
+    return withUnreadableEvidence(carrier, leg, out, reported, live);
 }
 export function approvalCardFactsOfV1(card) {
     if (typeof card !== 'object' || card === null)
         return undefined;
     return Object.freeze(cardFactsOf(card, 'v1'));
 }
+export function approvalCardFactsOfV1Frame(frame) {
+    if (typeof frame !== 'object' || frame === null)
+        return undefined;
+    try {
+        const carriers = openingFrameCarriersOf(frame);
+        if (carriers.leg !== 'v1')
+            return undefined;
+        return Object.freeze(cardFactsOf(carriers.body, 'v1', null, carriers.live, ownDataValue(frame, 'approvalId')));
+    }
+    catch {
+        return undefined;
+    }
+}
 export function approvalCardFactsOfFrame(frame, opts) {
     if (typeof frame !== 'object' || frame === null)
         return undefined;
@@ -1888,7 +1930,7 @@ function liveCardIdentityOf(approvalId, frame, carriers, run) {
     const fromSubagent = isFromSubagent(carriers.body);
     const bound = fromSubagent ? undefined : frameBindingOf(frame);
     const source = bound ?? run;
-    const ownRun = fromSubagent ? body.sourceTaskId : source?.taskId;
+    const ownRun = fromSubagent ? subagentSourceSessionOf(carriers.body) : source?.taskId;
     const taskId = typeof ownRun === 'string' && ownRun !== '' ? ownRun : undefined;
     const sessionId = !fromSubagent && typeof source?.sessionId === 'string' && source.sessionId !== '' ? source.sessionId : undefined;
     const askSig = carrierAskSig(carriers.body, carriers.live);
@@ -1950,7 +1992,7 @@ async function presentToolApprovalFrameAndRespond(frame, carriers, approvalId, r
     const bodyToolCallId = carriers.body.toolCallId;
     const frameToolCallId = typeof bodyToolCallId === 'string' && bodyToolCallId !== '' ? bodyToolCallId : undefined;
     const decidedByReading = decidedByReadingSnapshotOf(lane);
-    const facts = cardFactsOf(carriers.body, carriers.leg, { streamArgs, ...(lane?.argsUnavailable === true ? { argsUnavailable: true } : {}) }, carriers.live);
+    const facts = cardFactsOf(carriers.body, carriers.leg, { streamArgs, ...(lane?.argsUnavailable === true ? { argsUnavailable: true } : {}) }, carriers.live, approvalId);
     const argsNotRealInput = facts.argsUnavailable === true;
     const ruleOffers = facts.ruleOffers;
     if (argsNotRealInput && lane?.argsUnavailable !== true && facts.wireNote !== undefined) {

package/dist/hostSettingsSource.d.ts

@@ -2,7 +2,7 @@ import { SETTINGS_WORKSPACE_TRUST_STATES } from './generated/settingsSchemaTable
 import type { ManagedPolicyState, PluginHooksReading, SessionHooksReading, SettingsDocument } from './host.js';
 import type { PluginHookReaderState } from './pluginHooksWire.js';
 export type WorkspaceTrustState = (typeof SETTINGS_WORKSPACE_TRUST_STATES)[number];
-export declare const HOST_SETTINGS_LAYERS: readonly ["policySettings", "userSettings", "projectSettings", "localSettings", "flagSettings"];
+export declare const HOST_SETTINGS_LAYERS: readonly ["policySettings", "userSettings", "projectSettings", "localSettings", "flagSettings", "foreignProjectSettings"];
 export type HostSettingsLayer = (typeof HOST_SETTINGS_LAYERS)[number];
 export declare const MANAGED_POLICY_STATES: readonly ["absent", "in-effect", "in-effect-pieces", "unreadable-covered", "unreadable-uncovered", "remote-unknown"];
 export declare const HOST_STARTUP_MODES: readonly ["safe", "bare", "none"];
@@ -71,6 +71,8 @@ export declare function sourceOfRead(read: HostSettingsRead): HostSettingsSource
 export declare function settingsValueOf(read: HostSettingsRead, key: string): {} | null | undefined;
 export declare function mergedBooleanOf(read: HostSettingsRead, key: string): boolean | undefined;
 export declare const CC_MERGE_ORDER: readonly ["userSettings", "projectSettings", "localSettings", "flagSettings", "policySettings"];
+export type TightenOnlyHostSettingsLayer = Exclude<HostSettingsLayer, (typeof CC_MERGE_ORDER)[number]>;
+export declare const TIGHTEN_ONLY_HOST_SETTINGS_LAYERS: readonly TightenOnlyHostSettingsLayer[];
 export declare function nonManagedLayerDown(read: HostSettingsRead): boolean;
 export declare const ADOPTED_LAYERS: readonly ["userSettings", "projectSettings", "localSettings", "flagSettings"];
 export type AdoptedLayer = (typeof ADOPTED_LAYERS)[number];
@@ -102,6 +104,7 @@ export declare function hostSettingsSessionFollows(stored: HostSettingsSession |
 export declare const FIRST_SESSION: HostSettingsSession;
 export declare function sessionSnapshotOf(previous: {} | null | undefined): HostSettingsSession | undefined;
 export declare function permissionRulesOf(doc: SettingsDocument | null, bucket: 'allow' | 'deny' | 'ask'): readonly string[];
+export declare function permissionBucketOf(doc: SettingsDocument | null, bucket: 'allow' | 'deny' | 'ask'): readonly string[] | undefined;
 export interface HostSettingsAdoption {
     readonly read: HostSettingsRead;
     readonly session: HostSettingsSession;

package/dist/hostSettingsSource.js

@@ -2,7 +2,7 @@ import { appendOwnElement } from './ownKey.js';
 import { SETTINGS_WORKSPACE_TRUST_STATES } from './generated/settingsSchemaTables.js';
 import { jsonFaithfulCost, materializeJsonFaithful } from './jsonFaithful.js';
 import { faultText } from './hostCallbackGuard.js';
-export const HOST_SETTINGS_LAYERS = Object.freeze(['policySettings', 'userSettings', 'projectSettings', 'localSettings', 'flagSettings']);
+export const HOST_SETTINGS_LAYERS = Object.freeze(['policySettings', 'userSettings', 'projectSettings', 'localSettings', 'flagSettings', 'foreignProjectSettings']);
 export const MANAGED_POLICY_STATES = Object.freeze(['absent', 'in-effect', 'in-effect-pieces', 'unreadable-covered', 'unreadable-uncovered', 'remote-unknown']);
 export const HOST_STARTUP_MODES = Object.freeze(['safe', 'bare', 'none']);
 export const HOST_SETTINGS_CARRIER_STATUSES = Object.freeze(['loaded', 'loaded-partial', 'empty', 'absent', 'unreadable', 'not-loaded']);
@@ -394,8 +394,9 @@ export function mergedBooleanOf(read, key) {
     return out;
 }
 export const CC_MERGE_ORDER = Object.freeze(['userSettings', 'projectSettings', 'localSettings', 'flagSettings', 'policySettings']);
+export const TIGHTEN_ONLY_HOST_SETTINGS_LAYERS = Object.freeze(HOST_SETTINGS_LAYERS.filter((l) => !CC_MERGE_ORDER.includes(l)));
 export function nonManagedLayerDown(read) {
-    return HOST_SETTINGS_LAYERS.some((l) => {
+    return CC_MERGE_ORDER.some((l) => {
         if (l === 'policySettings')
             return false;
         const snap = read.layers[l];
@@ -403,6 +404,7 @@ export function nonManagedLayerDown(read) {
     });
 }
 export const ADOPTED_LAYERS = Object.freeze(['userSettings', 'projectSettings', 'localSettings', 'flagSettings']);
+const isAdoptedLayer = (l) => ADOPTED_LAYERS.includes(l);
 const GENESIS_VERSION = '0';
 export const parentVersionOf = (session) => (session.version === GENESIS_VERSION ? null : session.version);
 function canonicalOf(v) {
@@ -512,13 +514,16 @@ export function sessionSnapshotOf(previous) {
 }
 const LOADED = new Set(['loaded', 'loaded-partial']);
 export function permissionRulesOf(doc, bucket) {
+    return permissionBucketOf(doc, bucket) ?? [];
+}
+export function permissionBucketOf(doc, bucket) {
     if (doc === null)
-        return [];
+        return undefined;
     const p = ownData(doc, 'permissions');
     if (!p.ok || !isRecord(p.value))
-        return [];
+        return undefined;
     const b = ownData(p.value, bucket);
-    return b.ok && Array.isArray(b.value) ? b.value.filter((x) => typeof x === 'string') : [];
+    return b.ok && Array.isArray(b.value) ? b.value.filter((x) => typeof x === 'string') : undefined;
 }
 function overflowOf(read, session) {
     return Object.freeze({ read, session: remintSameContent(session), trusted: false, clean: false, extraTighten: NO_EXTRA, allowByLayer: emptyByLayer(), overflow: true });
@@ -624,7 +629,7 @@ export function adoptHostSettingsRead(read, session, allowAdmitted = () => true,
     const effectiveLayers = {};
     for (const l of HOST_SETTINGS_LAYERS) {
         const snap = read.layers[l];
-        effectiveLayers[l] = l === 'policySettings' ? snap : Object.freeze({ ...snap, doc: base.docs[l] });
+        effectiveLayers[l] = isAdoptedLayer(l) ? Object.freeze({ ...snap, doc: base.docs[l] }) : snap;
     }
     const effective = Object.freeze({ ...read, layers: Object.freeze(effectiveLayers), current: read, debug: Object.freeze([]) });
     const idOf = (layer, rule) => (layeredRules ? JSON.stringify([layer, rule]) : rule);

package/dist/hostTurnSettings.d.ts

@@ -3,8 +3,8 @@ import type { WireHooksConfig } from './finalVerifyWire.js';
 import type { memoryOffDeclared as MemoryOffDeclared } from './request/taskRequest.js';
 import type { EnvLike } from './hostEnv.js';
 import { type SettingsDocument } from './host.js';
-import type { HookSettingsSource, HooksWirePlan, HooksWirePlanOptions } from './pluginHooksWire.js';
-import { type HostSettingsSession, type HostSettingsSource } from './hostSettingsSource.js';
+import type { HooksWirePlan, HooksWirePlanOptions } from './pluginHooksWire.js';
+import { type HostSettingsLayer, type HostSettingsSession, type HostSettingsSource } from './hostSettingsSource.js';
 import { type SubmissionIdentity } from './request/submissionIdentity.js';
 import { type WebSearchApiKeyFor } from './webSearchWireCaps.js';
 import { type FileHistoryCaptureReading } from './fileHistoryCaptureCapability.js';
@@ -16,12 +16,12 @@ export type HostSettingCause = (typeof HOST_SETTING_CAUSES)[number];
 export declare const HOST_SETTING_DISPOSITIONS: readonly ["carry", "carry_partial", "withhold_notice", "withhold_by_policy", "hold_for_consent", "refuse_turn", "unwired", "nothing_to_carry"];
 export type HostSettingDisposition = (typeof HOST_SETTING_DISPOSITIONS)[number];
 export type HostSettingPlane = 'turn' | 'session' | 'diagnostic';
-export type HostSettingNoticeId = 'HS-UNWIRED' | 'HS-MANAGED-REJECTED' | 'HS-PROJECTION' | 'HS-SOURCE-UNREADABLE' | 'HS-WEBSEARCH-MALFORMED' | 'HS-SWITCH-MALFORMED' | 'HS-FILEHISTORY-UNJUDGED' | 'HS-FILEHISTORY-RESTORE' | 'HS-MANAGED-UNREADABLE' | 'HS-LAYER-NOT-LOADED' | 'HS-HELD-PREVIOUS' | 'HS-STYLE-MISSING' | 'HS-STYLE-SAFE';
+export type HostSettingNoticeId = 'HS-UNWIRED' | 'HS-MANAGED-REJECTED' | 'HS-PROJECTION' | 'HS-SOURCE-UNREADABLE' | 'HS-WEBSEARCH-MALFORMED' | 'HS-SWITCH-MALFORMED' | 'HS-FILEHISTORY-UNJUDGED' | 'HS-FILEHISTORY-RESTORE' | 'HS-MANAGED-UNREADABLE' | 'HS-LAYER-NOT-LOADED' | 'HS-HELD-PREVIOUS' | 'HS-STYLE-MISSING' | 'HS-STYLE-SAFE' | 'HS-LAYER-PARTS-UNREAD';
 export interface HostSettingRow {
     readonly key: HostSuppliedKey;
     readonly cause: HostSettingCause;
     readonly disposition: HostSettingDisposition;
-    readonly layers?: readonly HookSettingsSource[];
+    readonly layers?: readonly HostSettingsLayer[];
 }
 export interface HostSettingNotice {
     readonly id: HostSettingNoticeId;
@@ -123,7 +123,6 @@ export interface HostPermissionFacts {
         readonly ask?: readonly string[];
     };
     readonly clientOwnedServers?: readonly string[];
-    readonly serverVersion?: string;
 }
 export declare function rethrowHostResolvedDeferred(product: HostTurnSettings): void;
 export type HostResolvedMaterializer = (snapshot: SettingsDocument) => SettingsDocument;

package/dist/hostTurnSettings.js

@@ -1,7 +1,7 @@
 import { SETTINGS_CLASSIFY_HOOKS_CONFIG } from './generated/settingsSchemaFns.js';
 import { hostLog } from './host.js';
 import { layerNotAppliedRefusesTurn, salvageSettingsHooksEntries } from './settingsHooksSalvage.js';
-import { ADOPTED_LAYERS, HOST_SETTINGS_LAYERS, HostSettingsSourceShapeError, permissionRulesOf, MANAGED_READING_DISPOSITIONS, adoptHostSettingsRead, mintHostSettingsSession, readHostSettingsOnce, remintSameContent, sessionSnapshotOf, settingsValueOf, sourceOfRead, } from './hostSettingsSource.js';
+import { ADOPTED_LAYERS, HOST_SETTINGS_LAYERS, HostSettingsSourceShapeError, TIGHTEN_ONLY_HOST_SETTINGS_LAYERS, permissionBucketOf, permissionRulesOf, MANAGED_READING_DISPOSITIONS, adoptHostSettingsRead, mintHostSettingsSession, readHostSettingsOnce, remintSameContent, sessionSnapshotOf, settingsValueOf, sourceOfRead, } from './hostSettingsSource.js';
 import { hooksWirePlan } from './hooksWireCaps.js';
 import { submissionSurfaceOf } from './request/submissionIdentity.js';
 import { displayUntrusted } from './displayUntrusted.js';
@@ -11,7 +11,8 @@ import { msg, renderMessage } from './i18n/translate.js';
 import { newRulePortsProjection, projectPermissionsDeclaration, rulePortsMissingOf, WIRE_RULE_TRUST_ORDER } from './permissionsDeclaration.js';
 import { assemblyRefusalOf } from './wireFailureShape.js';
 import { permissionRuleLayersOn } from './permissionsAllowGrantCapability.js';
-import { layerAdmitted } from './settingsLayerAdmission.js';
+import { layerAdmissionReading, layerAdmitted } from './settingsLayerAdmission.js';
+import { SETTINGS_BUILD_LAYER_PARTS_UNREAD_NOTICE } from './generated/settingsSchemaFns.js';
 import { appendOwnElement, ownDataField } from './ownKey.js';
 export const HOST_SUPPLIED_KEYS = Object.freeze(['settings.hooks', 'settings.resolved', 'settings.webSearch', 'settings.outputStyle', 'memory', 'fileHistory']);
 export const HOST_SETTING_CAUSES = Object.freeze([
@@ -42,6 +43,7 @@ const HOST_SETTING_NOTICE_TEXT = {
     'HS-HELD-PREVIOUS': () => renderMessage(msg('session.hostSettings.heldPrevious')),
     'HS-STYLE-MISSING': (what) => renderMessage(msg('session.hostSettings.styleMissing', { name: what })),
     'HS-STYLE-SAFE': () => renderMessage(msg('session.hostSettings.styleSafeMode')),
+    'HS-LAYER-PARTS-UNREAD': (line) => line,
 };
 const KEY_NOUN = {
     'settings.hooks': 'the hooks',
@@ -367,10 +369,60 @@ function stringListOf(v) {
 function permissionMemberAdmitted(layer, read, bucket) {
     return layerAdmitted(layer, read.trust, 'permissions', bucket);
 }
+function managedRulesOnly(read) {
+    const policyDoc = read.layers.policySettings.doc;
+    return MANAGED_READING_DISPOSITIONS[read.managed].ruleScope === 'by-switch' && policyDoc !== null && managedOnlySwitchOn(policyDoc);
+}
+const TIGHTEN_ONLY_LAYER_BUCKETS = Object.freeze(['deny', 'ask']);
+function tightenOnlyBucketsRead(read, layer) {
+    if (managedRulesOnly(read))
+        return [];
+    const doc = read.layers[layer].doc;
+    return TIGHTEN_ONLY_LAYER_BUCKETS.filter((bucket) => permissionMemberAdmitted(layer, read, bucket) && permissionBucketOf(doc, bucket) !== undefined);
+}
+function tightenOnlyLayerPartsUnread(read, layer, permissionsRead) {
+    const doc = read.layers[layer].doc;
+    if (doc === null)
+        return [];
+    const readBuckets = permissionsRead ? tightenOnlyBucketsRead(read, layer) : [];
+    const parts = [];
+    const rec = doc;
+    for (const key of Object.keys(rec)) {
+        const v = rec[key];
+        if (key !== 'permissions')
+            appendOwnElement(parts, key);
+        else if (typeof v !== 'object' || v === null || Array.isArray(v))
+            appendOwnElement(parts, key);
+        else
+            for (const member of Object.keys(v))
+                if (!readBuckets.includes(member))
+                    appendOwnElement(parts, `${key}.${member}`);
+    }
+    for (const c of read.layers[layer].carriers)
+        if (c.status === 'loaded-partial')
+            for (const k of c.issues ?? [])
+                if (!parts.includes(k))
+                    appendOwnElement(parts, k);
+    return parts;
+}
+function tightenOnlyLayerNotices(read, permissionsRead) {
+    const out = [];
+    for (const layer of TIGHTEN_ONLY_HOST_SETTINGS_LAYERS) {
+        const snap = read.layers[layer];
+        if (!snap.enabled || snap.doc === null)
+            continue;
+        const parts = tightenOnlyLayerPartsUnread(read, layer, permissionsRead);
+        const loaded = snap.carriers.filter((c) => c.status === 'loaded' || c.status === 'loaded-partial').map((c) => c.id);
+        const file = (loaded.length > 0 ? loaded : snap.carriers.map((c) => c.id)).join(', ');
+        const n = SETTINGS_BUILD_LAYER_PARTS_UNREAD_NOTICE({ source: layer, workspace: layerAdmissionReading(read.trust), file, parts });
+        if (n !== undefined)
+            appendOwnElement(out, notice('HS-LAYER-PARTS-UNREAD', 'session', displayUntrusted(n.line)));
+    }
+    return out;
+}
 function allowAdmittedFor(read) {
     const disp = MANAGED_READING_DISPOSITIONS[read.managed];
-    const policyDoc = read.layers.policySettings.doc;
-    const managedOnlySwitch = disp.ruleScope === 'by-switch' && policyDoc !== null && managedOnlySwitchOn(policyDoc);
+    const managedOnlySwitch = managedRulesOnly(read);
     const degrade = disp.ruleScope === 'degrade';
     return (layer) => {
         if (degrade || managedOnlySwitch)
@@ -387,7 +439,7 @@ function allowAdmittedFor(read) {
     };
 }
 function badPermissionsSource() {
-    return new HostSourceShapeError(`hostTurnSettings: sources.resolved must be 'none' or { allowGrantReading, cliArg?, session?, clientOwnedServers?, serverVersion? } — since 0.101.0 the permission rules of the settings files come from the settings the entry reads; do not pass snapshot — got something else (the value is not echoed).`);
+    return new HostSourceShapeError(`hostTurnSettings: sources.resolved must be 'none' or { allowGrantReading, cliArg?, session?, clientOwnedServers? } — since 0.101.0 the permission rules of the settings files come from the settings the entry reads; do not pass snapshot — got something else (the value is not echoed).`);
 }
 function readPermissionSource(src) {
     const key = 'settings.resolved';
@@ -405,12 +457,9 @@ function readPermissionSource(src) {
     let sesAsk;
     let owned;
     let ownedRaw;
-    let serverVersion;
     try {
         if (!isRecordShape(v) || Object.hasOwn(v, 'snapshot') || !Object.hasOwn(v, 'allowGrantReading'))
             throw badPermissionsSource();
-        const sver = ownDataOf(v, 'serverVersion');
-        serverVersion = sver.ok && typeof sver.value === 'string' ? sver.value : undefined;
         const g = ownDataOf(v, 'allowGrantReading');
         const c = ownDataOf(v, 'cliArg');
         const se = ownDataOf(v, 'session');
@@ -444,13 +493,13 @@ function readPermissionSource(src) {
     }
     if (cliAllow === undefined || cliDeny === undefined || sesDeny === undefined || sesAsk === undefined || (owned === undefined && ownedRaw !== undefined))
         throw badPermissionsSource();
-    return { kind: 'facts', allowGrantReading, cliAllow, cliDeny, sesDeny, sesAsk, owned, serverVersion };
+    return { kind: 'facts', allowGrantReading, cliAllow, cliDeny, sesDeny, sesAsk, owned };
 }
 function permissionsArm(facts, side, adoption, layered) {
     const key = 'settings.resolved';
     if (facts.kind === 'arm')
         return facts.arm;
-    const { allowGrantReading, cliAllow, cliDeny, sesDeny, sesAsk, owned, serverVersion } = facts;
+    const { allowGrantReading, cliAllow, cliDeny, sesDeny, sesAsk, owned } = facts;
     if (side.kind === 'missing')
         return missingArm(key);
     const buckets = { deny: [], ask: [], allow: [] };
@@ -482,7 +531,7 @@ function permissionsArm(facts, side, adoption, layered) {
         const read = side.read;
         const disp = MANAGED_READING_DISPOSITIONS[read.managed];
         const policyDoc = read.layers.policySettings.doc;
-        const managedOnlySwitch = disp.ruleScope === 'by-switch' && policyDoc !== null && managedOnlySwitchOn(policyDoc);
+        const managedOnlySwitch = managedRulesOnly(read);
         const degrade = disp.ruleScope === 'degrade';
         try {
             for (const bucket of Object.keys(buckets)) {
@@ -506,6 +555,10 @@ function permissionsArm(facts, side, adoption, layered) {
                     for (const r of adoption?.extraTighten[bucket] ?? [])
                         if (permissionMemberAdmitted(r.layer, read, bucket))
                             add(bucket, r.rule, r.layer);
+                for (const l of TIGHTEN_ONLY_HOST_SETTINGS_LAYERS)
+                    for (const bucket of tightenOnlyBucketsRead(read, l))
+                        for (const r of permissionRulesOf(read.layers[l].doc, bucket))
+                            add(bucket, r, l);
             }
         }
         catch (error) {
@@ -521,7 +574,7 @@ function permissionsArm(facts, side, adoption, layered) {
     let declared;
     if (projectionError === undefined) {
         try {
-            const d = projectPermissionsDeclaration({ deny: buckets.deny, ask: buckets.ask, allow: buckets.allow, origins, cliDeny, settingsRead: 'clean', ...(owned !== undefined && owned.length > 0 ? { clientOwnedServers: owned } : {}), ...(serverVersion !== undefined ? { serverVersion } : {}) }, allowGrantReading, portsProjection, layered ? freeze({ deny: freeze([...contributions.deny]), ask: freeze([...contributions.ask]) }) : undefined);
+            const d = projectPermissionsDeclaration({ deny: buckets.deny, ask: buckets.ask, allow: buckets.allow, origins, cliDeny, settingsRead: 'clean', ...(owned !== undefined && owned.length > 0 ? { clientOwnedServers: owned } : {}) }, allowGrantReading, portsProjection, layered ? freeze({ deny: freeze([...contributions.deny]), ask: freeze([...contributions.ask]) }) : undefined);
             declared = d.permissions !== undefined ? { permissions: d.permissions } : undefined;
         }
         catch (error) {
@@ -584,8 +637,11 @@ function notLoadedLayers(read, plan) {
     }
     return out;
 }
+const isTightenOnlyLayer = (l) => TIGHTEN_ONLY_HOST_SETTINGS_LAYERS.includes(l);
 function notLoadedSentence(n, form) {
     const layer = msg(`session.hostSettings.layer.${n.layer}`);
+    if (isTightenOnlyLayer(n.layer))
+        return renderMessage(msg(form === 'hold' ? 'session.hostSettings.layerNotLoaded.restrictions.hold' : 'session.hostSettings.layerNotLoaded.restrictions.sent', { layer }));
     return renderMessage(msg(form === 'hold' ? `session.hostSettings.layerNotLoaded.hold.${n.how}` : 'session.hostSettings.layerNotLoaded.sent.unreadable', { layer }));
 }
 function settingsSideOf(input) {
@@ -679,17 +735,19 @@ export function buildHostTurnSettings(input, judges) {
     if (notLoaded.length > 0) {
         const key = `hs1-${fnv1a(JSON.stringify(notLoaded.map((n) => n.key)))}`;
         const ask = surface === 'interactive' && !session.consented.includes(key);
-        const layers = freeze(notLoaded.map((n) => n.layer));
-        const cause = notLoaded.some((n) => n.how === 'unreadable') ? 'source_unreadable' : 'source_rejected';
-        const reshape = (a) => {
+        const reshape = (a, feeds) => {
             const d = a.row.disposition;
             if (d === 'refuse_turn' || d === 'unwired' || a.row.cause === 'no_source')
                 return a;
+            const mine = notLoaded.filter((n) => feeds(n.layer));
+            if (mine.length === 0)
+                return a;
+            const cause = mine.some((n) => n.how === 'unreadable') ? 'source_unreadable' : 'source_rejected';
             const disposition = ask ? 'hold_for_consent' : a.carried !== undefined ? 'carry_partial' : 'withhold_notice';
-            return { ...a, row: freeze({ key: a.row.key, cause, disposition, layers }) };
+            return { ...a, row: freeze({ key: a.row.key, cause, disposition, layers: freeze(mine.map((n) => n.layer)) }) };
         };
         const before = armsByKey;
-        armsByKey = [{ ...reshape(before[0]), ...(hooks.plan !== undefined ? { plan: hooks.plan } : {}) }, reshape(before[1]), before[2], before[3], before[4], before[5]];
+        armsByKey = [{ ...reshape(before[0], (l) => !isTightenOnlyLayer(l)), ...(hooks.plan !== undefined ? { plan: hooks.plan } : {}) }, reshape(before[1], () => true), before[2], before[3], before[4], before[5]];
         if (ask && armsByKey.slice(0, 2).some((a) => a.row.disposition === 'hold_for_consent'))
             consentKey = key;
         for (const n of notLoaded) {
@@ -709,7 +767,11 @@ export function buildHostTurnSettings(input, judges) {
     }
     const arms = armsByKey;
     const rows = freeze(arms.map((a) => a.row));
-    const notices = freeze([...arms.flatMap((a) => a.notices), ...notLoadedNotices, ...heldNotices]);
+    const resolvedOut = arms[1]?.row.disposition === 'carry' || arms[1]?.row.disposition === 'carry_partial' || arms[1]?.row.disposition === 'hold_for_consent' ? resolvedCarried : undefined;
+    const permissionsRow = arms[1]?.row;
+    const permissionsRead = permissionsRow !== undefined && permissionsRow.disposition !== 'refuse_turn' && permissionsRow.disposition !== 'unwired' && permissionsRow.cause !== 'no_source';
+    const partsNotices = side.kind === 'read' ? tightenOnlyLayerNotices(side.read, permissionsRead) : [];
+    const notices = freeze([...arms.flatMap((a) => a.notices), ...notLoadedNotices, ...heldNotices, ...partsNotices]);
     const refusal = arms.find((a) => a.row.disposition === 'refuse_turn');
     const verdict = refusal !== undefined
         ? freeze({ kind: 'refuse', notice: refusal.notices[0] ?? notices.find((n) => n.plane === 'turn') ?? notice('HS-PROJECTION', 'turn') })
@@ -721,7 +783,6 @@ export function buildHostTurnSettings(input, judges) {
         return a.row.disposition === 'carry' || a.row.disposition === 'carry_partial' || a.row.disposition === 'hold_for_consent' ? a.carried : undefined;
     };
     const hooksCarried = carriedOf(0);
-    const resolvedOut = arms[1]?.row.disposition === 'carry' || arms[1]?.row.disposition === 'carry_partial' || arms[1]?.row.disposition === 'hold_for_consent' ? resolvedCarried : undefined;
     const carried = freeze({
         ...(hooksCarried !== undefined ? { hooks: hooksCarried } : {}),
         ...(resolvedOut !== undefined ? { resolved: resolvedOut } : {}),