@sema-agent/client-core 0.105.0 → 0.107.0

package/dist/hitl/standingRows.js

@@ -4,6 +4,7 @@ import { readApprovalCardWord, readRuleOffers } from './toolApprovalWire.js';
 import { CORE_SKILL_TOOL_NAME } from '../generated/toolNameTables.js';
 import { toolPermissionRequestIdDomain } from '../seatContract.js';
 import { permissionsDeclarationReport } from '../permissionsDeclaration.js';
+import { readCardUnreadableEvidence, sessionAllowCardReadable, sessionAllowEligible } from './sessionAllowRoute.js';
 const UNREADABLE = Symbol('unreadable');
 function ownData(v, key) {
     try {
@@ -90,18 +91,17 @@ function enginePremiseOf(card) {
         return 'card_unreadable';
     if (refused.inCard)
         return refused.value === true ? 'remember_refused' : 'remember_unreadable';
-    const evidence = present(card, 'unreadableEvidence');
-    if (evidence === UNREADABLE)
+    const list = readCardUnreadableEvidence(card);
+    if (list === 'unreadable')
         return 'card_unreadable';
-    if (!evidence.inCard)
+    if (list === 'absent')
         return { evidenceUnreadable: false };
-    const list = ownData(card, 'unreadableEvidence');
-    if (!Array.isArray(list) || !list.every((k) => typeof k === 'string'))
-        return 'card_unreadable';
     if (list.includes('rememberRefused'))
         return 'remember_unreadable';
     return { evidenceUnreadable: list.length > 0 };
 }
+const _sessionWhyPin = true;
+void _sessionWhyPin;
 export function standingRowsOf(card, host) {
     if (typeof card !== 'object' || card === null)
         return allClosed('card_unreadable');
@@ -110,11 +110,11 @@ export function standingRowsOf(card, host) {
         if (typeof premise === 'string')
             return allClosed(premise);
         const evidenceUnreadable = premise.evidenceUnreadable;
-        const sessionRow = ownData(card, 'allowSessionCarried') === true;
-        const sessionWhy = sessionRow ? 'given' : 'route_cannot_carry';
+        const sessionWhy = sessionAllowEligible(card);
+        const sessionRow = sessionWhy === 'given';
         let deploymentList;
         if (!sessionRow) {
-            deploymentList = 'route_cannot_carry';
+            deploymentList = sessionWhy;
         }
         else {
             const pair = readAskClassPairState(card);
@@ -143,7 +143,7 @@ export function seatSessionRowOf(card, requestId) {
         const domain = toolPermissionRequestIdDomain(requestId);
         if (domain !== 'live:' && domain !== 'durable:')
             return false;
-        return typeof enginePremiseOf(card) !== 'string';
+        return typeof enginePremiseOf(card) !== 'string' && sessionAllowCardReadable(card) === 'given';
     }
     catch {
         return false;

package/dist/hitl/subagentSource.d.ts

@@ -0,0 +1 @@
+export declare function subagentSourceSessionOf(carrier: object | null | undefined): string | undefined;

package/dist/hitl/subagentSource.js

@@ -0,0 +1,13 @@
+import { slotReadOf } from '../wireFailureShape.js';
+const nonEmpty = (v) => (typeof v === 'string' && v !== '' ? v : undefined);
+export function subagentSourceSessionOf(carrier) {
+    if (typeof carrier !== 'object' || carrier === null)
+        return undefined;
+    const current = slotReadOf(carrier, 'sourceSessionId');
+    if (current.presence === 'present')
+        return nonEmpty(current.value);
+    if (current.presence !== 'absent')
+        return undefined;
+    const retired = slotReadOf(carrier, 'sourceTaskId');
+    return retired.presence === 'present' ? nonEmpty(retired.value) : undefined;
+}

package/dist/hitl/toolApprovalWire.d.ts

@@ -163,7 +163,7 @@ export declare function approvalCardPortFor(sessionKey: string): ApprovalCardPor
 export declare function __resetSettledApprovalsForTests(): void;
 export declare function _resetApprovalCardPortForTest(): void;
 export declare function surfaceApprovalCard(req: ApprovalCardRequest): Promise<ApprovalCardDecision>;
-declare const REMEMBER_REFUSAL_CODES: readonly ["remember_not_in_proof", "remember_requires_binding", "capability.store_required", "decide.workflow_remember_unsupported", "decide.parked_remember_unsupported"];
+declare const REMEMBER_REFUSAL_CODES: readonly ["remember_not_in_proof", "capability.store_required", "decide.workflow_remember_unsupported", "decide.parked_remember_unsupported"];
 export type RememberRefusalCode = (typeof REMEMBER_REFUSAL_CODES)[number];
 export declare function rememberRefusalOf(error: unknown): RememberRefusalCode | undefined;
 export declare function surfaceFsApprovalAndDecide(deps: FsApprovalWireDeps, taskId: string, argsByCall: Map<string, unknown>, signal?: AbortSignal, parkGatedCallId?: string, parkToolName?: string): Promise<ApprovalResolution>;
@@ -179,7 +179,7 @@ export interface ReadRootCandidateView {
     covers?: 'exact';
 }
 export type ToolApprovalDelegation = ApprovalCardDelegation;
-export declare const TOOL_APPROVAL_FRAME_KEYS_MIRROR: readonly ["type", "approvalId", "toolCallId", "toolName", "sourceTaskId", "fromSubagent", "sourceAgentName", "message", "args", "argsOmitted", "governanceForced", "ruleOffers", "ruleOffersAbsence", "denialLimitFallback", "readRootCandidate", "mandated", "mandate", "origin", "approvalCard", "askClass", "classes", "inputHasBidi", "parked", "persistedRuleShadowed", "allowRuleShadowed", "probeCause", "probeReason", "rememberRefused", "boundGrantDigest", "boundGrantAbsence", "boundGrants", "classifierNoRuling", "ruleEvidence", "requiresRealApproval", "expiresInMs", "expiresAtMs", "serverNowMs", "delegation", "outcome", "cause", "requestedBy"];
+export declare const TOOL_APPROVAL_FRAME_KEYS_MIRROR: readonly ["type", "approvalId", "toolCallId", "toolName", "sourceTaskId", "sourceSessionId", "agentId", "askReasons", "fromSubagent", "sourceAgentName", "message", "args", "argsOmitted", "governanceForced", "ruleOffers", "ruleOffersAbsence", "denialLimitFallback", "readRootCandidate", "mandated", "mandate", "origin", "approvalCard", "askClass", "classes", "inputHasBidi", "parked", "persistedRuleShadowed", "allowRuleShadowed", "probeCause", "probeReason", "rememberRefused", "boundGrantDigest", "boundGrantAbsence", "boundGrants", "classifierNoRuling", "ruleEvidence", "requiresRealApproval", "expiresInMs", "expiresAtMs", "serverNowMs", "delegation", "outcome", "cause", "requestedBy"];
 export interface ApprovalMandatedFacts {
     readonly mandated?: true;
     readonly ruleOffersAbsence?: string;
@@ -283,6 +283,7 @@ export interface ApprovalCardFrameFactsOptions {
     readonly argsUnavailable?: true;
 }
 export declare function approvalCardFactsOfV1(card: object | null | undefined): Readonly<ApprovalCardV1Facts> | undefined;
+export declare function approvalCardFactsOfV1Frame(frame: object | null | undefined): Readonly<ApprovalCardFacts> | undefined;
 export declare function approvalCardFactsOfFrame(frame: object | null | undefined, opts?: ApprovalCardFrameFactsOptions | null): Readonly<ApprovalCardFacts> | undefined;
 export declare function approvalCardFactsOfGeneric(card: object | null | undefined): Readonly<ApprovalCardFacts> | undefined;
 export interface ToolApprovalFrameLaneOpts {

package/dist/hitl/toolApprovalWire.js

@@ -15,9 +15,10 @@ import { readEngineActiveBgTasks } from '../fleet/fleetLedger.js';
 import { CORE_SKILL_TOOL_NAME } from '../generated/toolNameTables.js';
 import { CORE_ALLOW_ENTRY_INERT_REASONS, CORE_PERSISTED_RULE_MATCHES } from '../generated/engineFactTables.js';
 import { msg, renderMessage } from '../i18n/translate.js';
+import { sessionAllowCarried, sessionAllowEligible } from './sessionAllowRoute.js';
 import { INTERRUPT_DENY_REASON, observeCancelByDeny, surfaceApprovalParking, surfaceRememberNotApplied, surfaceEditNotForwarded, surfaceEditRefusedOnBlindAsk, surfaceRuleArmNotSent, surfaceRuleArmRejected } from './hitlHostSurface.js';
 import { approvalCallKey, liveFrameCallKey } from './gateIdentity.js';
-import { displayUntrusted } from '../displayUntrusted.js';
+import { displayUntrusted, quoteUntrustedForSentence } from '../displayUntrusted.js';
 import { frameBindingOf } from '../frameBinding.js';
 import { carriesAttributionKey, deliverWithAttributionLadder } from './attributionLadder.js';
 import { deliverApprovalDecision, newSendTally } from './approvalDelivery.js';
@@ -28,6 +29,8 @@ import { isApprovalMandateWord } from '../gateVocabulary.js';
 import { approvalDecidedByAdmitted } from '../approvalDecidedByCapability.js';
 import { decideFailureNote } from '../decideFailureNote.js';
 import { slotPresenceOf, wireFailureTextsOf } from '../wireFailureShape.js';
+import { APPROVAL_LIVE_FACE_KEYS, approvalLiveFaceOf, hasOwnStrictTrue } from './approvalLiveFace.js';
+import { subagentSourceSessionOf } from './subagentSource.js';
 import { isPlainRecord } from '../jsonFaithful.js';
 import { DECIDE_WORKFLOW_REMEMBER_UNSUPPORTED } from '../engineErrorCodes.js';
 import { readDecideReceipt } from '../decideReceipt.js';
@@ -156,7 +159,6 @@ function cardPortMissReason() {
 }
 const REMEMBER_REFUSAL_CODES = Object.freeze([
     'remember_not_in_proof',
-    'remember_requires_binding',
     'capability.store_required',
     DECIDE_WORKFLOW_REMEMBER_UNSUPPORTED,
     'decide.parked_remember_unsupported',
@@ -447,7 +449,7 @@ export async function surfaceFsApprovalAndDecide(deps, taskId, argsByCall, signa
         closeDurableRead(readMark);
     }
     if (!found.ok)
-        return { kind: 'not_sent', lane: 'decide', cause: found.code ?? 'fetch_failed', ...(found.reason !== '' ? { detail: found.reason } : {}) };
+        return { kind: 'not_sent', lane: 'decide', cause: found.code ?? 'fetch_failed', ...(found.reason !== '' ? { detail: found.reason } : {}), ...(found.rowVerdict !== undefined ? { rowVerdict: found.rowVerdict } : {}) };
     if (held !== undefined)
         return joinDurableDecision(held, deps, signal);
     const rowIdentity = parkRowHolderIdentity(found.pending, found.gatedCallId);
@@ -498,7 +500,7 @@ async function presentFsApprovalAndDecide(deps, taskId, argsByCall, signal, foun
     const durableRuleOffersAbsence = pending.ruleOffersAbsence;
     hold.presented = true;
     deps.onPresented?.();
-    const card = await surfaceCallTrackedCard(gatedCallId, undefined, ledgerSlot, withUnreadableEvidence(pending, 'row', {
+    const cardRequest = withUnreadableEvidence(pending, 'row', {
         toolName,
         args,
         callKey,
@@ -512,9 +514,7 @@ async function presentFsApprovalAndDecide(deps, taskId, argsByCall, signal, foun
         ...(argsRewritten ? { argsRewritten: true, wireNote: ARGS_REWRITTEN_NOTE } : {}),
         ...(pending.governanceForced === true ? { governanceForced: true } : {}),
         ...(readRequiresRealApproval(pending) ? { requiresRealApproval: true } : {}),
-        ...(hasOwnStrictTrue(pending, 'mandated') ? { mandated: true } : {}),
-        ...((w) => (w !== undefined ? { mandate: w } : {}))(readApprovalMandate(pending)),
-        ...((o) => (o !== undefined ? { origin: o } : {}))(readAskOrigin(pending)),
+        ...approvalLiveFaceOf(pending).facts,
         ...((w) => (w !== undefined ? { approvalCard: w } : {}))(readApprovalCardWord(pending)),
         ...(readAskClassPair(pending) ?? {}),
         ...(pending.gateKind === 'irreversible_ask' ? { irreversibleParkGate: true } : {}),
@@ -533,7 +533,8 @@ async function presentFsApprovalAndDecide(deps, taskId, argsByCall, signal, foun
         allowSessionCarried: true,
         grantBinding: readApprovalGrantBinding(pending),
         parkRow: parkRowOf(taskId, pending, gatedCallId),
-    }));
+    });
+    const card = await surfaceCallTrackedCard(gatedCallId, undefined, ledgerSlot, cardRequest);
     hold.phase = 'respond';
     if (rowArgsGap !== undefined && card.kind === 'allow' && card.updatedInput !== undefined) {
         hostLog('error', `liveToolApprovalWire: approval card for ${gatedCallId ?? `task ${taskId}`} returned an edited approval, but the tool input is ${rowArgsGap === 'truncated' ? 'a size marker on the pending row' : 'missing from both the stream and the pending row'} — nothing sent (the park stays pending)`);
@@ -560,10 +561,15 @@ async function presentFsApprovalAndDecide(deps, taskId, argsByCall, signal, foun
                 let rememberStop;
                 try {
                     let rememberRefused = false;
-                    const approveBody = answerPayloadFor(card, 'decide');
+                    const sessionAllowWhy = sessionAllowEligible(cardRequest);
+                    const sessionDowngraded = card.allowSession === true && sessionAllowWhy !== 'given';
+                    if (sessionDowngraded)
+                        hostLog('debug', `liveToolApprovalWire: ${gatedCallId ?? `task ${taskId}`} session-wide allow taken as allow-once — the card is not eligible (${sessionAllowWhy})`);
+                    const answered = sessionDowngraded ? { ...card, allowSession: false } : card;
+                    const approveBody = answerPayloadFor(answered, 'decide');
                     const { remember: _remember, ...plainApproveBody } = approveBody;
                     void _remember;
-                    emitAnswerCommitted(callKey, 'decide', card, approveBody);
+                    emitAnswerCommitted(callKey, 'decide', answered, approveBody);
                     if (approveBody.remember === 'session') {
                         let sessionReceipt;
                         let sessionDecided = false;
@@ -591,7 +597,7 @@ async function presentFsApprovalAndDecide(deps, taskId, argsByCall, signal, foun
                     }
                     const raw = await bridge.decideTool(plainApproveBody, gatedCallId, decideOpts, pending);
                     const receipt = readDecideReceipt(raw);
-                    if (rememberRefused)
+                    if (rememberRefused || sessionDowngraded)
                         surfaceRememberNotApplied();
                     return { kind: 'decided', ...at, decision: 'allow', ...(receipt !== undefined ? { receipt } : {}) };
                 }
@@ -683,6 +689,9 @@ export const TOOL_APPROVAL_FRAME_KEYS_MIRROR = [
     'toolCallId',
     'toolName',
     'sourceTaskId',
+    'sourceSessionId',
+    'agentId',
+    'askReasons',
     'fromSubagent',
     'sourceAgentName',
     'message',
@@ -758,9 +767,6 @@ export function toolPermissionRequestAskBits(card, requestId) {
         ...(seatSessionRowOf(card, requestId) ? { sessionRow: true } : {}),
     };
 }
-function hasOwnStrictTrue(v, key) {
-    return Object.hasOwn(v, key) && v[key] === true;
-}
 function isToolApprovalDelegation(v) {
     if (v === null || typeof v !== 'object')
         return false;
@@ -1283,6 +1289,30 @@ export function classifierNoRulingDetail(word, lang) {
         return renderMessage(msg('approval.classifier.noRulingOther', { reason: displayUntrusted(word) }), lang);
     return renderMessage(msg('approval.classifier.noRulingBare'), lang);
 }
+const BOUND_GRANT_NAMES_SHOWN = 6;
+const BOUND_GRANT_NAME_MAX = 512;
+const BOUND_GRANT_NAME_INPUT_MAX = 8192;
+const BOUND_GRANT_NAMES_LOOKAHEAD = 32;
+function boundGrantNameList(rules, lang) {
+    const shown = [];
+    let looked = 0;
+    for (const entry of rules) {
+        if (shown.length >= BOUND_GRANT_NAMES_SHOWN || looked >= BOUND_GRANT_NAMES_LOOKAHEAD)
+            break;
+        looked += 1;
+        if (entry.length > BOUND_GRANT_NAME_INPUT_MAX)
+            continue;
+        const quoted = quoteUntrustedForSentence(entry, BOUND_GRANT_NAME_MAX);
+        if (quoted !== undefined)
+            shown.push(quoted);
+    }
+    if (shown.length === 0)
+        return undefined;
+    const rest = rules.length - shown.length;
+    if (rest > 0)
+        shown.push(renderMessage(msg('approval.boundGrants.more', { count: rest }), lang));
+    return shown.join(' · ');
+}
 export function approvalBoundGrantsDetail(grants, lang) {
     const g = readApprovalBoundGrants({ boundGrants: grants });
     if (g === undefined)
@@ -1290,8 +1320,10 @@ export function approvalBoundGrantsDetail(grants, lang) {
     if (g.skill === null)
         return renderMessage(msg('approval.boundGrants.noSkill'), lang);
     const isRule = (e) => readBoundGrantEntry(e)?.kind === 'rule';
-    const a = g.allowedTools.filter(isRule).length;
-    const d = g.disallowedTools.filter(isRule).length;
+    const allowRules = g.allowedTools.filter(isRule);
+    const denyRules = g.disallowedTools.filter(isRule);
+    const a = allowRules.length;
+    const d = denyRules.length;
     const allowNothing = g.allowedTools.length - a;
     const denyNothing = g.disallowedTools.length - d;
     if (denyNothing > 0) {
@@ -1302,8 +1334,14 @@ export function approvalBoundGrantsDetail(grants, lang) {
             return renderMessage(allowNothing === 1 ? msg('approval.boundGrants.listsNoToolsWithNothing.one') : msg('approval.boundGrants.listsNoToolsWithNothing.other', { count: String(allowNothing) }), lang);
         return renderMessage(msg('approval.boundGrants.listsNoTools'), lang);
     }
-    const allow = a === 1 ? msg('approval.boundGrants.allowPart.one') : msg('approval.boundGrants.allowPart.other', { count: a });
-    const deny = d === 1 ? msg('approval.boundGrants.denyPart.one') : msg('approval.boundGrants.denyPart.other', { count: d });
+    const allowNames = boundGrantNameList(allowRules, lang);
+    const denyNames = boundGrantNameList(denyRules, lang);
+    const allow = allowNames !== undefined
+        ? (a === 1 ? msg('approval.boundGrants.allowPart.named.one', { names: allowNames }) : msg('approval.boundGrants.allowPart.named.other', { count: a, names: allowNames }))
+        : (a === 1 ? msg('approval.boundGrants.allowPart.one') : msg('approval.boundGrants.allowPart.other', { count: a }));
+    const deny = denyNames !== undefined
+        ? (d === 1 ? msg('approval.boundGrants.denyPart.named.one', { names: denyNames }) : msg('approval.boundGrants.denyPart.named.other', { count: d, names: denyNames }))
+        : (d === 1 ? msg('approval.boundGrants.denyPart.one') : msg('approval.boundGrants.denyPart.other', { count: d }));
     if (allowNothing > 0) {
         return renderMessage(allowNothing === 1 ? msg('approval.boundGrants.activatesWithNothing.one', { allow, deny }) : msg('approval.boundGrants.activatesWithNothing.other', { allow, deny, count: String(allowNothing) }), lang);
     }
@@ -1320,7 +1358,8 @@ function askSigOf(classes, origin, mandate) {
 }
 function carrierAskSig(v, live) {
     try {
-        return askSigOf(readAskClassPair(v)?.classes, live === undefined ? undefined : readAskOrigin(live), live === undefined ? undefined : readApprovalMandate(live));
+        const face = live === undefined ? undefined : approvalLiveFaceOf(live);
+        return askSigOf(readAskClassPair(v)?.classes, face?.facts.origin, face?.facts.mandate);
     }
     catch {
         return undefined;
@@ -1605,10 +1644,11 @@ export function readRuleOfferSupply(offers) {
 }
 function subagentBadgeFor(frame) {
     let name = typeof frame.sourceAgentName === 'string' && frame.sourceAgentName.length > 0 ? frame.sourceAgentName : '';
-    if (!name && typeof frame.sourceTaskId === 'string' && frame.sourceTaskId.length > 0) {
-        name = frame.sourceTaskId;
+    const source = subagentSourceSessionOf(frame);
+    if (!name && source !== undefined) {
+        name = source;
         try {
-            const row = readEngineActiveBgTasks().tasks.find(t => t.id === frame.sourceTaskId);
+            const row = readEngineActiveBgTasks().tasks.find(t => t.id === source);
             if (typeof row?.name === 'string' && row.name.length > 0)
                 name = row.name;
         }
@@ -1631,10 +1671,11 @@ function v1Bit(stamp) {
 const SUSPENDED_ASK_ARGS_NOTE = "this request's tool arguments are not available on this surface — it was raised while no client was connected, " +
     'so you are deciding without seeing them; deny it if you are not sure what it will do. ' +
     'Edits are not accepted on this card: there is no original input to edit';
-function cardFactsOf(carrier, leg, opts, liveFacts) {
+function cardFactsOf(carrier, leg, opts, liveFacts, approvalId) {
     const c = carrier;
     const full = leg !== 'generic';
     const live = leg === 'frame' ? carrier : leg === 'v1' ? liveFacts : undefined;
+    let face;
     const asFrame = carrier;
     const fromSubagent = full
         ? (() => {
@@ -1747,15 +1788,11 @@ function cardFactsOf(carrier, leg, opts, liveFacts) {
             realApprovalUnreadable = true;
         }
         if (live !== undefined) {
-            v1Bit(() => {
-                if (hasOwnStrictTrue(live, 'mandated'))
-                    out.mandated = true;
-            });
-            v1Bit(() => {
-                const w = readApprovalMandate(live);
-                if (w !== undefined)
-                    out.mandate = w;
-            });
+            face = approvalLiveFaceOf(live);
+            if (face.facts.mandated === true)
+                out.mandated = true;
+            if (face.facts.mandate !== undefined)
+                out.mandate = face.facts.mandate;
             v1Bit(() => {
                 const rc = readReadRootCandidate(live.readRootCandidate);
                 if (rc !== undefined)
@@ -1777,13 +1814,8 @@ function cardFactsOf(carrier, leg, opts, liveFacts) {
         if (dlf !== undefined)
             out.denialLimitFallback = dlf;
     });
-    if (live !== undefined) {
-        v1Bit(() => {
-            const o = readAskOrigin(live);
-            if (o !== undefined)
-                out.origin = o;
-        });
-    }
+    if (face !== undefined && face.facts.origin !== undefined)
+        out.origin = face.facts.origin;
     if (leg !== 'generic') {
         v1Bit(() => {
             const w = readApprovalCardWord(carrier);
@@ -1817,16 +1849,32 @@ function cardFactsOf(carrier, leg, opts, liveFacts) {
     });
     if (leg === 'generic')
         out.cardPayloadUnreadable = true;
-    if (leg === 'frame')
+    if (sessionAllowCarried(leg, approvalId))
         out.allowSessionCarried = true;
     out.grantBinding = readApprovalGrantBinding(carrier);
-    return withUnreadableEvidence(carrier, leg, out, realApprovalUnreadable ? ['requiresRealApproval'] : [], live);
+    const reported = realApprovalUnreadable ? ['requiresRealApproval'] : [];
+    if (face?.layerUnknown === 'marked' || (leg === 'v1' && face?.layerUnknown === 'absent'))
+        reported.push(...APPROVAL_LIVE_FACE_KEYS);
+    return withUnreadableEvidence(carrier, leg, out, reported, live);
 }
 export function approvalCardFactsOfV1(card) {
     if (typeof card !== 'object' || card === null)
         return undefined;
     return Object.freeze(cardFactsOf(card, 'v1'));
 }
+export function approvalCardFactsOfV1Frame(frame) {
+    if (typeof frame !== 'object' || frame === null)
+        return undefined;
+    try {
+        const carriers = openingFrameCarriersOf(frame);
+        if (carriers.leg !== 'v1')
+            return undefined;
+        return Object.freeze(cardFactsOf(carriers.body, 'v1', null, carriers.live, ownDataValue(frame, 'approvalId')));
+    }
+    catch {
+        return undefined;
+    }
+}
 export function approvalCardFactsOfFrame(frame, opts) {
     if (typeof frame !== 'object' || frame === null)
         return undefined;
@@ -1888,7 +1936,7 @@ function liveCardIdentityOf(approvalId, frame, carriers, run) {
     const fromSubagent = isFromSubagent(carriers.body);
     const bound = fromSubagent ? undefined : frameBindingOf(frame);
     const source = bound ?? run;
-    const ownRun = fromSubagent ? body.sourceTaskId : source?.taskId;
+    const ownRun = fromSubagent ? subagentSourceSessionOf(carriers.body) : source?.taskId;
     const taskId = typeof ownRun === 'string' && ownRun !== '' ? ownRun : undefined;
     const sessionId = !fromSubagent && typeof source?.sessionId === 'string' && source.sessionId !== '' ? source.sessionId : undefined;
     const askSig = carrierAskSig(carriers.body, carriers.live);
@@ -1950,7 +1998,7 @@ async function presentToolApprovalFrameAndRespond(frame, carriers, approvalId, r
     const bodyToolCallId = carriers.body.toolCallId;
     const frameToolCallId = typeof bodyToolCallId === 'string' && bodyToolCallId !== '' ? bodyToolCallId : undefined;
     const decidedByReading = decidedByReadingSnapshotOf(lane);
-    const facts = cardFactsOf(carriers.body, carriers.leg, { streamArgs, ...(lane?.argsUnavailable === true ? { argsUnavailable: true } : {}) }, carriers.live);
+    const facts = cardFactsOf(carriers.body, carriers.leg, { streamArgs, ...(lane?.argsUnavailable === true ? { argsUnavailable: true } : {}) }, carriers.live, approvalId);
     const argsNotRealInput = facts.argsUnavailable === true;
     const ruleOffers = facts.ruleOffers;
     if (argsNotRealInput && lane?.argsUnavailable !== true && facts.wireNote !== undefined) {
@@ -1996,9 +2044,15 @@ async function presentToolApprovalFrameAndRespond(frame, carriers, approvalId, r
     enterLiveRespondPhase(hold);
     const noteCapable = lane?.approvalDecisionNoteCapable === true;
     const denyReasonRead = card.kind === 'deny' ? ((r) => (typeof r === 'string' ? r : undefined))(card.reason) : undefined;
+    const sessionAllowWhy = sessionAllowEligible(facts);
+    const sessionDowngraded = card.kind === 'allow' && card.allowSession === true && sessionAllowWhy !== 'given';
+    if (sessionDowngraded)
+        hostLog('debug', `liveToolApprovalWire: ${approvalId} session-wide allow taken as allow-once — the card is not eligible (${sessionAllowWhy})`);
     const answerSnapshot = card.kind === 'deny'
         ? ((by) => ({ kind: 'deny', ...(denyReasonRead !== undefined ? { reason: denyReasonRead } : {}), ...(by !== undefined ? { settledBy: by } : {}) }))(readApprovalDenySettledBy(card))
-        : card;
+        : sessionDowngraded && card.kind === 'allow'
+            ? { ...card, allowSession: false }
+            : card;
     const basePayload = answerPayloadFor(answerSnapshot, 'respond', { approvalDecisionNoteCapable: noteCapable });
     const decision = basePayload?.decision ?? 'deny';
     if (card.kind === 'allow' && typeof card.note === 'string' && card.note.trim() !== '' && answerCarriage({ callKey: liveFrameCallKey(approvalId) }).allowNote === 'none') {
@@ -2231,6 +2285,8 @@ async function presentToolApprovalFrameAndRespond(frame, carriers, approvalId, r
             logAfterDecided(`liveToolApprovalWire: ${approvalId} allow_session ack rememberApplied=false — grant not stored, surfacing honest notice`);
             surfaceRememberNotApplied();
         }
+        if (replayed === undefined && sessionDowngraded)
+            surfaceRememberNotApplied();
         if (respondOpts.updatedInput !== undefined && applied?.updatedInputForwarded === false) {
             logAfterDecided(`liveToolApprovalWire: ${approvalId} edited args were NOT forwarded (ack.updatedInputForwarded=false) — the tool runs on the ORIGINAL input`);
             surfaceEditNotForwarded();

package/dist/hostSettingsSource.d.ts

@@ -2,7 +2,7 @@ import { SETTINGS_WORKSPACE_TRUST_STATES } from './generated/settingsSchemaTable
 import type { ManagedPolicyState, PluginHooksReading, SessionHooksReading, SettingsDocument } from './host.js';
 import type { PluginHookReaderState } from './pluginHooksWire.js';
 export type WorkspaceTrustState = (typeof SETTINGS_WORKSPACE_TRUST_STATES)[number];
-export declare const HOST_SETTINGS_LAYERS: readonly ["policySettings", "userSettings", "projectSettings", "localSettings", "flagSettings"];
+export declare const HOST_SETTINGS_LAYERS: readonly ["policySettings", "userSettings", "projectSettings", "localSettings", "flagSettings", "foreignProjectSettings"];
 export type HostSettingsLayer = (typeof HOST_SETTINGS_LAYERS)[number];
 export declare const MANAGED_POLICY_STATES: readonly ["absent", "in-effect", "in-effect-pieces", "unreadable-covered", "unreadable-uncovered", "remote-unknown"];
 export declare const HOST_STARTUP_MODES: readonly ["safe", "bare", "none"];
@@ -71,6 +71,8 @@ export declare function sourceOfRead(read: HostSettingsRead): HostSettingsSource
 export declare function settingsValueOf(read: HostSettingsRead, key: string): {} | null | undefined;
 export declare function mergedBooleanOf(read: HostSettingsRead, key: string): boolean | undefined;
 export declare const CC_MERGE_ORDER: readonly ["userSettings", "projectSettings", "localSettings", "flagSettings", "policySettings"];
+export type TightenOnlyHostSettingsLayer = Exclude<HostSettingsLayer, (typeof CC_MERGE_ORDER)[number]>;
+export declare const TIGHTEN_ONLY_HOST_SETTINGS_LAYERS: readonly TightenOnlyHostSettingsLayer[];
 export declare function nonManagedLayerDown(read: HostSettingsRead): boolean;
 export declare const ADOPTED_LAYERS: readonly ["userSettings", "projectSettings", "localSettings", "flagSettings"];
 export type AdoptedLayer = (typeof ADOPTED_LAYERS)[number];
@@ -102,6 +104,7 @@ export declare function hostSettingsSessionFollows(stored: HostSettingsSession |
 export declare const FIRST_SESSION: HostSettingsSession;
 export declare function sessionSnapshotOf(previous: {} | null | undefined): HostSettingsSession | undefined;
 export declare function permissionRulesOf(doc: SettingsDocument | null, bucket: 'allow' | 'deny' | 'ask'): readonly string[];
+export declare function permissionBucketOf(doc: SettingsDocument | null, bucket: 'allow' | 'deny' | 'ask'): readonly string[] | undefined;
 export interface HostSettingsAdoption {
     readonly read: HostSettingsRead;
     readonly session: HostSettingsSession;

package/dist/hostSettingsSource.js

@@ -2,7 +2,7 @@ import { appendOwnElement } from './ownKey.js';
 import { SETTINGS_WORKSPACE_TRUST_STATES } from './generated/settingsSchemaTables.js';
 import { jsonFaithfulCost, materializeJsonFaithful } from './jsonFaithful.js';
 import { faultText } from './hostCallbackGuard.js';
-export const HOST_SETTINGS_LAYERS = Object.freeze(['policySettings', 'userSettings', 'projectSettings', 'localSettings', 'flagSettings']);
+export const HOST_SETTINGS_LAYERS = Object.freeze(['policySettings', 'userSettings', 'projectSettings', 'localSettings', 'flagSettings', 'foreignProjectSettings']);
 export const MANAGED_POLICY_STATES = Object.freeze(['absent', 'in-effect', 'in-effect-pieces', 'unreadable-covered', 'unreadable-uncovered', 'remote-unknown']);
 export const HOST_STARTUP_MODES = Object.freeze(['safe', 'bare', 'none']);
 export const HOST_SETTINGS_CARRIER_STATUSES = Object.freeze(['loaded', 'loaded-partial', 'empty', 'absent', 'unreadable', 'not-loaded']);
@@ -394,8 +394,9 @@ export function mergedBooleanOf(read, key) {
     return out;
 }
 export const CC_MERGE_ORDER = Object.freeze(['userSettings', 'projectSettings', 'localSettings', 'flagSettings', 'policySettings']);
+export const TIGHTEN_ONLY_HOST_SETTINGS_LAYERS = Object.freeze(HOST_SETTINGS_LAYERS.filter((l) => !CC_MERGE_ORDER.includes(l)));
 export function nonManagedLayerDown(read) {
-    return HOST_SETTINGS_LAYERS.some((l) => {
+    return CC_MERGE_ORDER.some((l) => {
         if (l === 'policySettings')
             return false;
         const snap = read.layers[l];
@@ -403,6 +404,7 @@ export function nonManagedLayerDown(read) {
     });
 }
 export const ADOPTED_LAYERS = Object.freeze(['userSettings', 'projectSettings', 'localSettings', 'flagSettings']);
+const isAdoptedLayer = (l) => ADOPTED_LAYERS.includes(l);
 const GENESIS_VERSION = '0';
 export const parentVersionOf = (session) => (session.version === GENESIS_VERSION ? null : session.version);
 function canonicalOf(v) {
@@ -512,13 +514,16 @@ export function sessionSnapshotOf(previous) {
 }
 const LOADED = new Set(['loaded', 'loaded-partial']);
 export function permissionRulesOf(doc, bucket) {
+    return permissionBucketOf(doc, bucket) ?? [];
+}
+export function permissionBucketOf(doc, bucket) {
     if (doc === null)
-        return [];
+        return undefined;
     const p = ownData(doc, 'permissions');
     if (!p.ok || !isRecord(p.value))
-        return [];
+        return undefined;
     const b = ownData(p.value, bucket);
-    return b.ok && Array.isArray(b.value) ? b.value.filter((x) => typeof x === 'string') : [];
+    return b.ok && Array.isArray(b.value) ? b.value.filter((x) => typeof x === 'string') : undefined;
 }
 function overflowOf(read, session) {
     return Object.freeze({ read, session: remintSameContent(session), trusted: false, clean: false, extraTighten: NO_EXTRA, allowByLayer: emptyByLayer(), overflow: true });
@@ -624,7 +629,7 @@ export function adoptHostSettingsRead(read, session, allowAdmitted = () => true,
     const effectiveLayers = {};
     for (const l of HOST_SETTINGS_LAYERS) {
         const snap = read.layers[l];
-        effectiveLayers[l] = l === 'policySettings' ? snap : Object.freeze({ ...snap, doc: base.docs[l] });
+        effectiveLayers[l] = isAdoptedLayer(l) ? Object.freeze({ ...snap, doc: base.docs[l] }) : snap;
     }
     const effective = Object.freeze({ ...read, layers: Object.freeze(effectiveLayers), current: read, debug: Object.freeze([]) });
     const idOf = (layer, rule) => (layeredRules ? JSON.stringify([layer, rule]) : rule);

package/dist/hostTurnSettings.d.ts

@@ -3,8 +3,8 @@ import type { WireHooksConfig } from './finalVerifyWire.js';
 import type { memoryOffDeclared as MemoryOffDeclared } from './request/taskRequest.js';
 import type { EnvLike } from './hostEnv.js';
 import { type SettingsDocument } from './host.js';
-import type { HookSettingsSource, HooksWirePlan, HooksWirePlanOptions } from './pluginHooksWire.js';
-import { type HostSettingsSession, type HostSettingsSource } from './hostSettingsSource.js';
+import type { HooksWirePlan, HooksWirePlanOptions } from './pluginHooksWire.js';
+import { type HostSettingsLayer, type HostSettingsSession, type HostSettingsSource } from './hostSettingsSource.js';
 import { type SubmissionIdentity } from './request/submissionIdentity.js';
 import { type WebSearchApiKeyFor } from './webSearchWireCaps.js';
 import { type FileHistoryCaptureReading } from './fileHistoryCaptureCapability.js';
@@ -16,12 +16,12 @@ export type HostSettingCause = (typeof HOST_SETTING_CAUSES)[number];
 export declare const HOST_SETTING_DISPOSITIONS: readonly ["carry", "carry_partial", "withhold_notice", "withhold_by_policy", "hold_for_consent", "refuse_turn", "unwired", "nothing_to_carry"];
 export type HostSettingDisposition = (typeof HOST_SETTING_DISPOSITIONS)[number];
 export type HostSettingPlane = 'turn' | 'session' | 'diagnostic';
-export type HostSettingNoticeId = 'HS-UNWIRED' | 'HS-MANAGED-REJECTED' | 'HS-PROJECTION' | 'HS-SOURCE-UNREADABLE' | 'HS-WEBSEARCH-MALFORMED' | 'HS-SWITCH-MALFORMED' | 'HS-FILEHISTORY-UNJUDGED' | 'HS-FILEHISTORY-RESTORE' | 'HS-MANAGED-UNREADABLE' | 'HS-LAYER-NOT-LOADED' | 'HS-HELD-PREVIOUS' | 'HS-STYLE-MISSING' | 'HS-STYLE-SAFE';
+export type HostSettingNoticeId = 'HS-UNWIRED' | 'HS-MANAGED-REJECTED' | 'HS-PROJECTION' | 'HS-SOURCE-UNREADABLE' | 'HS-WEBSEARCH-MALFORMED' | 'HS-SWITCH-MALFORMED' | 'HS-FILEHISTORY-UNJUDGED' | 'HS-FILEHISTORY-RESTORE' | 'HS-MANAGED-UNREADABLE' | 'HS-LAYER-NOT-LOADED' | 'HS-HELD-PREVIOUS' | 'HS-STYLE-MISSING' | 'HS-STYLE-SAFE' | 'HS-LAYER-PARTS-UNREAD';
 export interface HostSettingRow {
     readonly key: HostSuppliedKey;
     readonly cause: HostSettingCause;
     readonly disposition: HostSettingDisposition;
-    readonly layers?: readonly HookSettingsSource[];
+    readonly layers?: readonly HostSettingsLayer[];
 }
 export interface HostSettingNotice {
     readonly id: HostSettingNoticeId;
@@ -123,7 +123,6 @@ export interface HostPermissionFacts {
         readonly ask?: readonly string[];
     };
     readonly clientOwnedServers?: readonly string[];
-    readonly serverVersion?: string;
 }
 export declare function rethrowHostResolvedDeferred(product: HostTurnSettings): void;
 export type HostResolvedMaterializer = (snapshot: SettingsDocument) => SettingsDocument;