@sema-agent/client-core 0.108.0 → 0.109.0

package/dist/errorSupplementRoles.js

@@ -5,7 +5,7 @@ import { resumeReopenContent } from './hitl/suspendedReopen.js';
 import { idempotencyPayloadMismatchContent } from './engineErrorCodes.js';
 import { inheritEnvRefusalContent } from './inheritEnvWire.js';
 import { projectSeedRefusalContent } from './projectSeed.js';
-import { usageWindowExhaustedContent, fleetLeaseUnavailableContent, settingsPermissionBucketRefusalContent, fieldLimitRefusalContent, autonomyLaneRefusalContent, sessionArchiveStampedContent, unsupportedRuleRefusalContent, admissionWallRefusalContent, hostPostureRefusalContent, toolDeclarationRefusalContent, } from './wireRefusalCopy.js';
+import { usageWindowExhaustedContent, fleetLeaseUnavailableContent, settingsPermissionBucketRefusalContent, fieldLimitRefusalContent, autonomyLaneRefusalContent, sessionArchiveStampedContent, unsupportedRuleRefusalContent, admissionWallRefusalContent, hostPostureRefusalContent, toolDeclarationRefusalContent, envCredentialRefusalContent, sessionIdRetiredContent, runConcurrencyCapContent, } from './wireRefusalCopy.js';
 import { catalogDefaultRefusalContent } from './model/catalogDefault.js';
 const ROLE_BY_READER = new Map([
     [corruptSessionContent, 'replacement'],
@@ -25,6 +25,9 @@ const ROLE_BY_READER = new Map([
     [unsupportedRuleRefusalContent, 'replacement'],
     [projectSeedRefusalContent, 'replacement'],
     [catalogDefaultRefusalContent, 'replacement'],
+    [envCredentialRefusalContent, 'replacement'],
+    [sessionIdRetiredContent, 'replacement'],
+    [runConcurrencyCapContent, 'replacement'],
     [admissionWallRefusalContent, 'supplement'],
     [hostPostureRefusalContent, 'supplement'],
     [toolDeclarationRefusalContent, 'supplement'],

package/dist/fleetTaskDesc.js

@@ -1,12 +1,12 @@
-import { applyDisplayFace, ESCAPE_FACE, LABEL_FACE, paintAndCap } from './displayUntrusted.js';
+import { applyDisplayFace, displayUntrusted, ESCAPE_FACE } from './displayUntrusted.js';
 export function escapeDisplayControlChars(s) {
     return applyDisplayFace(s, ESCAPE_FACE);
 }
 export function capForDisplay(raw, max) {
-    return paintAndCap(raw, ESCAPE_FACE, typeof max === 'number' && max > 0 ? max : 0);
+    return displayUntrusted(raw, { foldLines: false, escapeBackslashes: 'auto', max: typeof max === 'number' && max > 0 ? max : 0 });
 }
 export function collapseLabel(s) {
-    return applyDisplayFace(s, LABEL_FACE);
+    return displayUntrusted(s, { escapeBackslashes: 'auto' });
 }
 export function taskDescFromName(name, agentType, agentName) {
     if (!name || !agentType)

package/dist/generated/engineFactTables.d.ts

@@ -74,3 +74,4 @@ export declare const CORE_USER_ATTACHMENT_LABEL_MAX: number;
 export declare const CORE_PRESENT_PLAN_TOOL_NAME: "ExitPlanMode";
 export declare const CORE_WORKFLOW_AGENT_PARKED_ERROR_CODE: "workflow.agent_parked";
 export declare const CORE_REFUSAL_ECHO_KINDS: readonly ["path", "command", "pattern"];
+export declare const CORE_DISCARDED_DELIVERY_PATHS: readonly ["live", "box", "drain", "notice"];

package/dist/generated/engineFactTables.js

@@ -471,3 +471,9 @@ export const CORE_REFUSAL_ECHO_KINDS = Object.freeze([
     "command",
     "pattern",
 ]);
+export const CORE_DISCARDED_DELIVERY_PATHS = Object.freeze([
+    "live",
+    "box",
+    "drain",
+    "notice",
+]);

package/dist/generated/engineNoticeTables.js

@@ -37,6 +37,7 @@ export const CORE_ENGINE_NOTICE_CODES = Object.freeze([
     "permission.rule_store_unavailable",
     "permission.rule_row_dropped",
     "config.session_rules_earlier_grammar",
+    "config.legacy_tool_name",
     "permission.allowed_tool_not_granted",
     "mods.registration_refused",
     "peer.inbound_disposition",
@@ -157,6 +158,7 @@ export const CORE_NOTICE_AUDIENCE = Object.freeze({
     "permission.rule_store_unavailable": "user",
     "permission.rule_row_dropped": "user",
     "config.session_rules_earlier_grammar": "user",
+    "config.legacy_tool_name": "user",
     "permission.allowed_tool_not_granted": "user",
     "mods.registration_refused": "user",
     "peer.inbound_disposition": "user",
@@ -283,6 +285,7 @@ export const CORE_NOTICE_MINTER = Object.freeze({
     "permission.rule_store_unavailable": "engine",
     "permission.rule_row_dropped": "engine",
     "config.session_rules_earlier_grammar": "engine",
+    "config.legacy_tool_name": "engine",
     "permission.allowed_tool_not_granted": "engine",
     "mods.registration_refused": "engine",
     "peer.inbound_disposition": "engine",

package/dist/hitl/approvalCardReasons.js

@@ -2,7 +2,9 @@ import { displayUntrusted } from '../displayUntrusted.js';
 import { msg, renderMessage } from '../i18n/translate.js';
 import { approvalMandateDetail, askOriginNoteOf } from '../gateVocabulary.js';
 import { readAskOrigin, readOwnDataValue, guardedRead } from '../ownKey.js';
+import { elideMiddleForDisplay } from '../noticePresentation.js';
 import { allowRuleShadowSentence } from './allowRuleShadow.js';
+import { approvalUnreadableWhyWordOf } from './approvalRequestFrameReading.js';
 import { mandatedApprovalDetailOf } from './automaticAnswerVerdict.js';
 import { approvalBoundGrantsDetail, approvalIsMandated, approvalPriorCardsDetail, askProbeReasonDetail, classifierNoRulingDetail, readApprovalBoundGrants, readApprovalClassifierNoRuling, readApprovalMandate, readDenialLimitFallback, } from './toolApprovalWire.js';
 export const APPROVAL_CARD_REASON_SOURCES = Object.freeze([
@@ -21,8 +23,24 @@ export const APPROVAL_CARD_REASON_SOURCES = Object.freeze([
 ]);
 export const APPROVAL_CARD_REASONS_DEFAULT_MAX_LINES = 4;
 const MESSAGE_DISPLAY_MAX = 300;
-function payloadUnreadableDetail(lang) {
-    return renderMessage(msg('approval.card.payloadUnreadable'), lang);
+function engineMessageLine(engineMessage) {
+    const shown = displayUntrusted(engineMessage);
+    if (shown.length <= MESSAGE_DISPLAY_MAX)
+        return shown;
+    const settled = displayUntrusted(elideMiddleForDisplay(shown, MESSAGE_DISPLAY_MAX));
+    return settled.length <= MESSAGE_DISPLAY_MAX ? settled : displayUntrusted(engineMessage, { max: MESSAGE_DISPLAY_MAX });
+}
+function payloadUnreadableDetail(why, lang) {
+    switch (typeof why === 'string' ? approvalUnreadableWhyWordOf(why) : undefined) {
+        case 'version_unknown':
+            return renderMessage(msg('approval.card.payloadUnreadable.versionUnknown'), lang);
+        case 'kind_unknown':
+            return renderMessage(msg('approval.card.payloadUnreadable.partUnknown'), lang);
+        case 'unreadable_fields':
+            return renderMessage(msg('approval.card.payloadUnreadable.fieldsMalformed'), lang);
+        default:
+            return renderMessage(msg('approval.card.payloadUnreadable'), lang);
+    }
 }
 function moreDetail(n, lang) {
     return renderMessage(n === 1 ? msg('approval.card.more.one') : msg('approval.card.more.other', { count: n }), lang);
@@ -64,7 +82,7 @@ export function approvalCardReasons(card, opts, lang) {
     catch {
         denialLimitReadable = false;
     }
-    add('payload_unreadable', () => (ownData(card, 'cardPayloadUnreadable') === true ? payloadUnreadableDetail(lang) : undefined));
+    add('payload_unreadable', () => (ownData(card, 'cardPayloadUnreadable') === true ? payloadUnreadableDetail(ownData(card, 'cardPayloadUnreadableWhy'), lang) : undefined));
     add('prior_cards', () => approvalPriorCardsDetail(card, lang));
     add('message', () => {
         const engineMessage = ownData(card, 'message');
@@ -73,7 +91,7 @@ export function approvalCardReasons(card, opts, lang) {
         const tool = ownData(card, 'toolName');
         if (typeof tool === 'string' && engineMessage.trim() === `approval required for "${tool}"`)
             return undefined;
-        return displayUntrusted(engineMessage, { max: MESSAGE_DISPLAY_MAX });
+        return engineMessageLine(engineMessage);
     });
     add('mandated', () => (approvalIsMandated(card) ? mandatedApprovalDetailOf(card, lang) : undefined));
     add('mandate', () => {

package/dist/hitl/approvalRequestFrameReading.d.ts

@@ -0,0 +1,14 @@
+export declare const APPROVAL_REQUEST_FRAME_UNREADABLE_WHYS: readonly ["version_unknown", "kind_unknown", "unreadable_fields"];
+export type ApprovalRequestFrameUnreadableWhy = (typeof APPROVAL_REQUEST_FRAME_UNREADABLE_WHYS)[number];
+export type ApprovalRequestFrameReading = {
+    readonly v1: true;
+} | {
+    readonly v1: false;
+    readonly why: ApprovalRequestFrameUnreadableWhy;
+    readonly schemaVersion?: string;
+    readonly kind?: string;
+};
+export declare function approvalRequestFrameReadingThrowing(frame: object | null | undefined): ApprovalRequestFrameReading;
+export declare function approvalRequestFrameReadingOf(frame: object | null | undefined): ApprovalRequestFrameReading;
+export declare function approvalUnreadableWhyWordOf(v: string): ApprovalRequestFrameUnreadableWhy | undefined;
+export declare function approvalFrameUnreadableWhyOf(reading: ApprovalRequestFrameReading | null | undefined): ApprovalRequestFrameUnreadableWhy | undefined;

package/dist/hitl/approvalRequestFrameReading.js

@@ -0,0 +1,79 @@
+import { isApprovalRequestFrameV1 } from '@sema-agent/sdk';
+import { displayUntrusted } from '../displayUntrusted.js';
+export const APPROVAL_REQUEST_FRAME_UNREADABLE_WHYS = Object.freeze(['version_unknown', 'kind_unknown', 'unreadable_fields']);
+const KNOWN_FRAME_TYPE = 'approval_request';
+const KNOWN_SCHEMA_VERSION = 1;
+const KNOWN_KIND = 'permission';
+const FRAME_READING_VALUE_MAX = 24;
+const FRAME_READING_VALUE_PREFIX = 128;
+const V1_READING = Object.freeze({ v1: true });
+const UNREADABLE_READING = Object.freeze({ v1: false, why: 'unreadable_fields' });
+function displayableScalar(v) {
+    let raw;
+    if (typeof v === 'string')
+        raw = v.length > FRAME_READING_VALUE_PREFIX ? v.slice(0, FRAME_READING_VALUE_PREFIX) : v;
+    else if (typeof v === 'number' && Number.isFinite(v))
+        raw = String(v);
+    else
+        return undefined;
+    const shown = displayUntrusted(raw, { max: FRAME_READING_VALUE_MAX });
+    return shown === '' ? undefined : shown;
+}
+export function approvalRequestFrameReadingThrowing(frame) {
+    if (typeof frame !== 'object' || frame === null)
+        return UNREADABLE_READING;
+    const x = frame;
+    const type = x.type;
+    const schemaVersion = x.schemaVersion;
+    const kind = x.kind;
+    const pinned = Object.create(frame, {
+        type: { value: type, enumerable: true },
+        schemaVersion: { value: schemaVersion, enumerable: true },
+        kind: { value: kind, enumerable: true },
+    });
+    if (isApprovalRequestFrameV1(pinned))
+        return V1_READING;
+    const why = type !== KNOWN_FRAME_TYPE
+        ? 'unreadable_fields'
+        : schemaVersion !== KNOWN_SCHEMA_VERSION
+            ? 'version_unknown'
+            : kind !== KNOWN_KIND
+                ? 'kind_unknown'
+                : 'unreadable_fields';
+    const shownVersion = displayableScalar(schemaVersion);
+    const shownKind = displayableScalar(kind);
+    return Object.freeze({
+        v1: false,
+        why,
+        ...(shownVersion !== undefined ? { schemaVersion: shownVersion } : {}),
+        ...(shownKind !== undefined ? { kind: shownKind } : {}),
+    });
+}
+export function approvalRequestFrameReadingOf(frame) {
+    try {
+        return approvalRequestFrameReadingThrowing(frame);
+    }
+    catch {
+        return UNREADABLE_READING;
+    }
+}
+export function approvalUnreadableWhyWordOf(v) {
+    return APPROVAL_REQUEST_FRAME_UNREADABLE_WHYS.find((w) => w === v);
+}
+export function approvalFrameUnreadableWhyOf(reading) {
+    try {
+        if (typeof reading !== 'object' || reading === null)
+            return undefined;
+        const v1 = Object.getOwnPropertyDescriptor(reading, 'v1');
+        const why = Object.getOwnPropertyDescriptor(reading, 'why');
+        if (v1 === undefined || !Object.hasOwn(v1, 'value') || v1.value !== false)
+            return undefined;
+        if (why === undefined || !Object.hasOwn(why, 'value'))
+            return undefined;
+        const word = why.value;
+        return typeof word === 'string' ? approvalUnreadableWhyWordOf(word) : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/hitl/approvalsFeed.js

@@ -51,7 +51,7 @@ function readDurablePendingRows(raw) {
 }
 function durableDigestOf(rows) {
     return rows
-        .map(r => [r.sessionId ?? '', r.taskId ?? '', r.toolCallId ?? '', r.boundCallId ?? '', r.boundInputHash ?? '', r.toolName ?? '', JSON.stringify(checkpointRowVerdictOf(r) ?? null), JSON.stringify(parkRowDelegationLinksOf(r) ?? null)]
+        .map(r => [r.sessionId ?? '', r.taskId ?? '', r.toolCallId ?? '', r.boundCallId ?? '', r.boundInputHash ?? '', r.toolName ?? '', r.gateKind ?? '', JSON.stringify(checkpointRowVerdictOf(r) ?? null), JSON.stringify(parkRowDelegationLinksOf(r) ?? null)]
         .join('
'))
         .sort()
         .join('');

package/dist/hitl/askParkRowRouting.js

@@ -1,7 +1,7 @@
 import { askParkForeignGateKind, durableDecideLegOf } from '../adapter/activeRunSelfHeal.js';
 import { isAskTool, questionCardVerdict } from './frameRouter.js';
 import { approvalCallKey } from './gateIdentity.js';
-import { askQuestionsFromPending, pendingRowIsOwnedByThisSession } from './parkOwnership.js';
+import { askQuestionsFromPending, pendingRowIsOwnedByThisSession, pendingRowOwnershipOf } from './parkOwnership.js';
 import { approvalQueueRowFamilyOf, checkpointQueueRowSortOf, QUEUE_ROW_FAMILY_UNREADABLE_GATE } from './approvalQueueRow.js';
 import { checkpointRowBarOf, checkpointRowBarSentence } from '../checkpointRowVerdict.js';
 import { msg, renderMessage } from '../i18n/translate.js';
@@ -161,8 +161,11 @@ export function countOwnedPendingRows(listed, deps) {
             throw new Error('approvals.list answered with a pending row that is not an object — the owned pending count is unknown');
         }
         const family = approvalQueueRowFamilyOf(row);
-        if (family === 'unreadable')
+        if (family === 'unreadable') {
+            if (pendingRowOwnershipOf(row, deps) === 'foreign')
+                continue;
             throw new Error('approvals.list answered with a pending row whose family (`kind`) cannot be read — the owned pending count is unknown');
+        }
         if (family !== 'checkpoint')
             continue;
         if (pendingRowIsOwnedAndDecidable(row, deps))

package/dist/hitl/automaticAnswerVerdict.d.ts

@@ -1,13 +1,15 @@
 import { type CoreModeArbitrationRow } from '../generated/engineFactTables.js';
 import { CORE_ASK_FACES } from '../generated/engineAskFaceTables.js';
 import type { UiLanguage } from '../env/uiLanguage.js';
+import type { PermissionRuleValue } from '@sema-agent/agent-types';
 export type AutomaticAnswerLane = 'mode_posture' | 'standing_rule' | 'permission_request_hook';
 export type AutomaticAnswerAskFace = (typeof CORE_ASK_FACES)[number];
 export interface AutomaticAnswerFacts {
     readonly settingsAskRuleMatched?: boolean;
+    readonly allowRule?: PermissionRuleValue;
 }
 export type AutomaticAnswerRoad = 'origin' | 'requires_real_approval' | 'governance' | 'mandate_word' | 'mandated' | 'allow_rule_shadow' | 'ask_class' | 'settings_ask_rule';
-export type AutomaticAnswerUnknownWhy = 'card_unreadable' | 'lane_not_recognised' | 'classes_malformed' | 'classes_absent' | 'class_not_in_table' | 'host_not_reported';
+export type AutomaticAnswerUnknownWhy = 'card_unreadable' | 'lane_not_recognised' | 'classes_malformed' | 'classes_absent' | 'class_not_in_table' | 'host_not_reported' | 'answer_may_read_arguments';
 export type AutomaticAnswerVerdict = {
     readonly kind: 'must_ask';
     readonly road: AutomaticAnswerRoad;
@@ -22,6 +24,7 @@ export type AutomaticAnswerVerdict = {
 };
 export declare const MODE_ARBITRATION: Readonly<Record<"hook" | "write_protection" | "mode" | "target_unresolved" | "content_question" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "org_rule" | "rule_unreadable" | "ask_rule" | "denial_limit_fallback" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", CoreModeArbitrationRow>>;
 export declare function foldModeArbitrationRow(classes: Iterable<string>, askFace?: AutomaticAnswerAskFace): CoreModeArbitrationRow;
+export declare function askLevelVerdict(card: object | null | undefined, lane: AutomaticAnswerLane, facts?: AutomaticAnswerFacts | null): AutomaticAnswerVerdict;
 export declare function automaticAnswerVerdict(card: object | null | undefined, lane: AutomaticAnswerLane, facts?: AutomaticAnswerFacts | null): AutomaticAnswerVerdict;
 export declare function mandatedApprovalDetailOf(card: object | null | undefined, lang?: UiLanguage): string;
 export interface CrossBoundaryTaintReading {
@@ -29,5 +32,5 @@ export interface CrossBoundaryTaintReading {
 }
 export declare function crossBoundaryTaintOf(carrier: object | null | undefined): CrossBoundaryTaintReading | undefined;
 export declare function crossBoundaryTaintWayOutOf(carrier: object | null | undefined, lang?: UiLanguage): string | undefined;
-export type PermissionRequestHookScope = 'allow_or_deny' | 'deny_only' | 'skip';
+export type PermissionRequestHookScope = 'deny_only' | 'skip';
 export declare function permissionRequestHookScope(verdict: AutomaticAnswerVerdict | null | undefined): PermissionRequestHookScope;

package/dist/hitl/automaticAnswerVerdict.js

@@ -3,6 +3,7 @@ import { CORE_RELEASABLE_ASK_CLASSES_BY_FACE, CORE_SHELL_FACE_TOOL_NAMES } from
 import { mandatedApprovalDetail } from '../gateVocabulary.js';
 import { msg, renderMessage } from '../i18n/translate.js';
 import { guardedRead, readAskOrigin, readOwnDataValue, readOwnNonEmptyString } from '../ownKey.js';
+import { allowRuleScopeOf } from './permissionRuleScope.js';
 import { readAskClassPairState } from './askClassPair.js';
 import { readRequiresRealApproval } from './approvalCardReading.js';
 import { approvalAllowRuleShadowed, retiredAllowRuleShadowKeyPresent } from './allowRuleShadow.js';
@@ -78,6 +79,7 @@ const UNKNOWN = Object.freeze({
     classes_absent: Object.freeze({ kind: 'unknown', why: 'classes_absent' }),
     class_not_in_table: Object.freeze({ kind: 'unknown', why: 'class_not_in_table' }),
     host_not_reported: Object.freeze({ kind: 'unknown', why: 'host_not_reported' }),
+    answer_may_read_arguments: Object.freeze({ kind: 'unknown', why: 'answer_may_read_arguments' }),
 });
 const MAY_ANSWER = Object.freeze({ kind: 'may_answer' });
 function evidenceView(card, ...keys) {
@@ -142,7 +144,7 @@ function readHostAskRuleMatched(facts) {
     const v = guardedRead(() => readOwnDataValue(facts, 'settingsAskRuleMatched'));
     return typeof v === 'boolean' ? v : undefined;
 }
-export function automaticAnswerVerdict(card, lane, facts) {
+export function askLevelVerdict(card, lane, facts) {
     if (lane !== 'mode_posture' && lane !== 'standing_rule' && lane !== 'permission_request_hook')
         return UNKNOWN.lane_not_recognised;
     try {
@@ -214,6 +216,18 @@ export function automaticAnswerVerdict(card, lane, facts) {
         return UNKNOWN.card_unreadable;
     }
 }
+function reportedWholeToolAllowRule(facts) {
+    if (typeof facts !== 'object' || facts === null)
+        return false;
+    const raw = guardedRead(() => readOwnDataValue(facts, 'allowRule'));
+    return allowRuleScopeOf(typeof raw === 'object' ? raw : undefined) === 'whole_tool';
+}
+export function automaticAnswerVerdict(card, lane, facts) {
+    const asked = askLevelVerdict(card, lane, facts);
+    if (asked.kind !== 'may_answer' || lane === 'mode_posture')
+        return asked;
+    return lane === 'standing_rule' && reportedWholeToolAllowRule(facts) ? asked : UNKNOWN.answer_may_read_arguments;
+}
 export function mandatedApprovalDetailOf(card, lang) {
     try {
         if (typeof card !== 'object' || card === null)
@@ -276,7 +290,7 @@ export function crossBoundaryTaintWayOutOf(carrier, lang) {
 export function permissionRequestHookScope(verdict) {
     try {
         const kind = typeof verdict === 'object' && verdict !== null ? verdict.kind : undefined;
-        return kind === 'may_answer' ? 'allow_or_deny' : kind === 'must_ask' ? 'skip' : 'deny_only';
+        return kind === 'must_ask' ? 'skip' : 'deny_only';
     }
     catch {
         return 'deny_only';

package/dist/hitl/decisionConflict.d.ts

@@ -3,5 +3,6 @@ import type { CapturedCode } from '../engineWireFor.js';
 import { type ProtocolErrorNameReading } from '../wireFailureShape.js';
 export type DecisionRefusalConflict = 'binding_mismatch' | 'row_integrity' | 'format_version' | 'answer_invalid' | 'grant_changed';
 export declare function decisionConflictOf(err: unknown, captured?: CapturedCode, protocolNameRead?: ProtocolErrorNameReading): DecisionRefusalConflict | undefined;
-export declare const DECISION_ANSWER_INVALID_CONTENT = "The engine rejected the answer itself because it does not fit the question that was asked \u00B7 Nothing was decided and the question is still waiting \u00B7 Correct the answer and send it again";
+export declare function decisionAnswerInvalidContent(lang?: UiLanguage): string;
+export declare const DECISION_ANSWER_INVALID_CONTENT: string;
 export declare function decisionGrantChangedContent(lang?: UiLanguage): string;

package/dist/hitl/decisionConflict.js

@@ -45,7 +45,10 @@ export function decisionConflictOf(err, captured, protocolNameRead) {
     }
     return BINDING_SEAT_FIELDS.has(field) ? 'binding_mismatch' : undefined;
 }
-export const DECISION_ANSWER_INVALID_CONTENT = 'The engine rejected the answer itself because it does not fit the question that was asked · Nothing was decided and the question is still waiting · Correct the answer and send it again';
+export function decisionAnswerInvalidContent(lang) {
+    return renderMessage(msg('approval.decision.answerInvalid'), lang);
+}
+export const DECISION_ANSWER_INVALID_CONTENT = decisionAnswerInvalidContent();
 export function decisionGrantChangedContent(lang) {
     return renderMessage(msg('approval.decision.grantChanged'), lang);
 }

package/dist/hitl/frameRouter.js

@@ -32,7 +32,11 @@ export function policyDenyReason(facts) {
     const one = typeof facts.toolName === 'string' && SENTENCE_TOOL_NAME.test(facts.toolName) ? `this one "${facts.toolName}" call` : 'this one call';
     const flag = typeof facts.allowRuleFlag === 'string' && SENTENCE_TOOL_NAME.test(facts.allowRuleFlag.replace(/^--?/, '')) ? ` (or ${facts.allowRuleFlag})` : '';
     const budgetKnob = typeof facts.budgetSetting === 'string' && SENTENCE_TOOL_NAME.test(facts.budgetSetting) ? facts.budgetSetting : undefined;
-    const cause = facts.cause === 'no_allow_rule' || facts.cause === 'ask_rule' || facts.cause === 'engine_ask_rule' || facts.cause === 'budget' ? facts.cause : 'other';
+    const cause = facts.cause === 'no_allow_rule' || facts.cause === 'ask_rule' || facts.cause === 'engine_ask_rule' || facts.cause === 'budget' || facts.cause === 'whole_tool_rule_only'
+        ? facts.cause
+        : 'other';
+    const wholeToolOnly = 'this client does not approve calls from the arguments shown to it, so here only an allow rule for the whole tool can approve calls like this ahead of time — ' +
+        'a rule that names paths, commands or other arguments applies only where the engine checks it against the real arguments';
     if (facts.lane === 'dont_ask') {
         const mode = 'denied by the dontAsk permission mode';
         switch (cause) {
@@ -44,6 +48,8 @@ export function policyDenyReason(facts) {
                 return `${mode}: a rule on the engine side, not one of the user's permission rules, asks about ${one}, and this mode refuses anything that would ask — the user's settings cannot approve it; use another permission mode to answer it`;
             case 'budget':
                 return `${mode}: ${one} needed approval, and this session's automatic-approval budget is used up, so saved rules no longer approve calls${budgetKnob !== undefined ? ` — raise ${budgetKnob} before launch to change the cap` : ''}`;
+            case 'whole_tool_rule_only':
+                return `${mode}: ${one} needed approval; ${wholeToolOnly} — and this mode refuses anything that would ask; use another permission mode to answer it`;
             default:
                 return `${mode}: ${one} needed a person's approval that saved permission rules cannot approve here (the engine or your deployment requires a person for it, or it could not be checked against your rules), and this mode refuses anything that would ask — use another permission mode to answer it`;
         }
@@ -59,6 +65,8 @@ export function policyDenyReason(facts) {
             return `${lane}: a rule on the engine side, not one of the user's permission rules, asks about ${one}, so it needed a person's answer, and ${tail}; the user's settings cannot approve it - run the task interactively to answer it`;
         case 'budget':
             return `${lane}: ${one} needed a person's approval, and this session's automatic-approval budget is used up, so saved rules no longer approve calls; ${tail}${budgetKnob !== undefined ? `; raise ${budgetKnob} before launch to change the cap` : ''}`;
+        case 'whole_tool_rule_only':
+            return `${lane}: ${one} needed a person's approval; ${wholeToolOnly}; ${tail}; run the task interactively to answer it`;
         default:
             return `${lane}: ${one} needed a person's approval, and saved permission rules cannot approve it here (the engine or your deployment requires a person for it, or it could not be checked against your rules); ${tail}; run the task interactively to answer it`;
     }

package/dist/hitl/hitlBridge.d.ts

@@ -141,6 +141,10 @@ export type FindPendingOutcome = {
 export declare function findPendingForTask(client: HitlClientLike, taskId: string, matches: (toolName: string | undefined) => boolean, opts?: {
     signal?: AbortSignal;
 }, callId?: string, identityAccepts?: (row: PendingCheckpoint) => boolean): Promise<FindPendingOutcome>;
+export declare function checkpointQueueReadingOf(row: object): {
+    readonly r: PendingCheckpoint;
+    readonly foreign: string | null;
+} | undefined;
 export declare class HitlBridge {
     private readonly client;
     private readonly taskId;

package/dist/hitl/hitlBridge.js

@@ -270,11 +270,8 @@ export async function findPendingForTask(client, taskId, matches, opts, callId,
         return { ok: false, reason: `approvals.list failed: ${t.reason}` };
     }
     const readings = rows.flatMap((r) => {
-        const sort = checkpointQueueRowSortOf(r);
-        if (sort === 'excluded')
-            return [];
-        const cp = r;
-        return [{ r: cp, foreign: sort === 'unreadable' ? QUEUE_ROW_FAMILY_UNREADABLE_GATE : askParkForeignGateKind(cp) }];
+        const x = checkpointQueueReadingOf(r);
+        return x === undefined ? [] : [x];
     });
     const decidable = readings.filter((x) => x.foreign === null).map((x) => x.r);
     const identityRow = callId !== undefined
@@ -313,6 +310,13 @@ export async function findPendingForTask(client, taskId, matches, opts, callId,
         return { ok: false, reason: checkpointRowBarSentence(bar), code: 'row_unresumable', rowVerdict: bar };
     return { ok: true, pending, gatedCallId: pending.toolCallId ?? pending.boundCallId ?? undefined };
 }
+export function checkpointQueueReadingOf(row) {
+    const sort = checkpointQueueRowSortOf(row);
+    if (sort === 'excluded')
+        return undefined;
+    const cp = row;
+    return { r: cp, foreign: sort === 'unreadable' ? QUEUE_ROW_FAMILY_UNREADABLE_GATE : askParkForeignGateKind(cp) };
+}
 export class HitlBridge {
     client;
     taskId;

package/dist/hitl/livePendingAsk.js

@@ -1,10 +1,10 @@
 import { isApprovalRequestFrameV1 } from '@sema-agent/sdk';
-import { appendOwnElement } from '../ownKey.js';
+import { appendOwnElement, readOwnDataNonEmptyString } from '../ownKey.js';
 import { readRequiresRealApproval } from './approvalCardReading.js';
 import { pendingRowIsOfSession } from './parkRowDelegation.js';
 import { approvalLiveFaceOf, liveFaceCarried } from './approvalLiveFace.js';
 import { THROWN_SLOT_UNREADABLE, readThrownSlot } from '../wireFailureShape.js';
-import { isToolApprovalFrame, surfaceToolApprovalFrameAndRespond, } from './toolApprovalWire.js';
+import { isToolApprovalFrame, surfaceApprovalFrameWithId, } from './toolApprovalWire.js';
 function nonEmptyString(v) {
     return typeof v === 'string' && v !== '';
 }
@@ -24,7 +24,9 @@ function snapshotMembers(raw) {
     }
     return raw.length === length ? out : undefined;
 }
-function openingFrameOf(f) {
+function openingFrameOf(f, approvalId) {
+    if (typeof f !== 'object' || f === null || readOwnDataNonEmptyString(f, 'approvalId') !== approvalId)
+        return undefined;
     if (isToolApprovalFrame(f))
         return f.type === 'tool_approval' ? f : undefined;
     return isApprovalRequestFrameV1(f) ? f : undefined;
@@ -54,19 +56,19 @@ export function readLivePendingRows(body) {
             continue;
         }
         const o = item;
-        if (!nonEmptyString(o.approvalId) || !nonEmptyString(o.toolName) || !nonNegativeFinite(o.ts) || !nonNegativeFinite(o.expiresAtMs)) {
+        const approvalId = readOwnDataNonEmptyString(o, 'approvalId');
+        if (approvalId === undefined || !nonEmptyString(o.toolName) || !nonNegativeFinite(o.ts) || !nonNegativeFinite(o.expiresAtMs)) {
             dropped++;
             continue;
         }
-        if (seen.has(o.approvalId)) {
+        if (seen.has(approvalId)) {
             dropped++;
             continue;
         }
-        seen.add(o.approvalId);
-        const opening = openingFrameOf(o.frame);
-        const frame = opening !== undefined && opening.approvalId === o.approvalId ? opening : undefined;
-        rows.push({
-            approvalId: o.approvalId,
+        seen.add(approvalId);
+        const frame = openingFrameOf(o.frame, approvalId);
+        appendOwnElement(rows, {
+            approvalId,
             toolName: o.toolName,
             ts: o.ts,
             expiresAtMs: o.expiresAtMs,
@@ -147,13 +149,12 @@ export function livePendingRowToApprovalFrame(row) {
     };
 }
 export function surfaceSuspendedAskAndRespond(row, respond, signal, lane) {
-    if (row.frame !== undefined) {
-        return surfaceToolApprovalFrameAndRespond(row.frame, respond, undefined, signal, lane);
+    const frame = row.frame;
+    const approvalId = row.approvalId;
+    if (frame !== undefined) {
+        return surfaceApprovalFrameWithId(frame, approvalId, respond, undefined, signal, lane, undefined);
     }
-    return surfaceToolApprovalFrameAndRespond(livePendingRowToApprovalFrame(row), respond, undefined, signal, {
-        ...lane,
-        argsUnavailable: true,
-    });
+    return surfaceApprovalFrameWithId(livePendingRowToApprovalFrame(row), approvalId, respond, undefined, signal, { ...lane, argsUnavailable: true }, undefined);
 }
 const TRACKER_UNSEEN_CLAIMS_MAX = 512;
 export function createSuspendedAskTracker(filter) {

package/dist/hitl/localAllowRule.js

@@ -1,4 +1,5 @@
 import { reasonOfThrownWithSink } from '../hostCallbackGuard.js';
+import { isWholeToolRuleValue } from './permissionRuleScope.js';
 const BASH_TOOL_NAME_FOR_RULES = 'Bash';
 export function parseLocalAllowRule(rule, expectedToolName, deps) {
     if (typeof rule !== 'string' || rule === '') {
@@ -14,7 +15,7 @@ export function parseLocalAllowRule(rule, expectedToolName, deps) {
     if (typeof value.toolName !== 'string' || value.toolName === '') {
         return { ok: false, error: 'rule text carries no tool name' };
     }
-    if (value.ruleContent === undefined || value.ruleContent === '') {
+    if (isWholeToolRuleValue(value)) {
         return {
             ok: false,
             error: 'candidate is a whole-tool allow rule (broader than this ask) — not offered locally',

package/dist/hitl/noAllowCause.d.ts

@@ -1,4 +1,4 @@
-export type NoAllowCause = 'no_allow_rule' | 'ask_rule' | 'engine_ask_rule' | 'budget' | 'other';
+export type NoAllowCause = 'no_allow_rule' | 'ask_rule' | 'engine_ask_rule' | 'budget' | 'whole_tool_rule_only' | 'other';
 export interface RuleLadderNoAllowFacts {
     readonly allowed?: boolean;
     readonly denied?: boolean;

package/dist/hitl/noAllowCause.js

@@ -1,4 +1,4 @@
-import { automaticAnswerVerdict } from './automaticAnswerVerdict.js';
+import { askLevelVerdict } from './automaticAnswerVerdict.js';
 function ladderSays(ladder, key) {
     if (typeof ladder !== 'object' || ladder === null)
         return false;
@@ -17,11 +17,13 @@ export function noAllowCauseOf(card, ladder) {
         return 'ask_rule';
     if (ladderSays(ladder, 'budgetExhausted'))
         return 'budget';
-    const standing = automaticAnswerVerdict(card, 'standing_rule');
+    const standing = askLevelVerdict(card, 'standing_rule');
     if (standing.kind === 'must_ask' && (standing.askClass === 'ask_rule' || standing.origin === 'ask_rule')) {
         return ladderSays(ladder, 'noAskRuleMatched') || ladderSays(ladder, 'noRuleMatched') ? 'engine_ask_rule' : 'ask_rule';
     }
     if (ladderSays(ladder, 'noRuleMatched') && standing.kind === 'may_answer')
         return 'no_allow_rule';
+    if (standing.kind === 'may_answer')
+        return 'whole_tool_rule_only';
     return 'other';
 }

package/dist/hitl/parkExpiryJudgements.js

@@ -1,11 +1,36 @@
+import { isApprovalCompleteFrameV1 } from '@sema-agent/sdk';
 import { APPROVAL_EXPIRED } from '../engineErrorCodes.js';
 import { approvalCompleteParked } from './approvalCompleteParked.js';
 export function classifyApprovalCompleteFrame(frame) {
     if (typeof frame !== 'object' || frame === null)
         return null;
     const f = frame;
-    if (f.type !== 'tool_approval_complete')
+    const type = f.type;
+    if (type === 'tool_approval_complete')
+        return dispositionOf(frame, f);
+    if (type === 'approval_complete')
+        return presentedFamilyDisposition(frame);
+    return null;
+}
+function presentedFamilyDisposition(frame) {
+    try {
+        const snapshot = ownDataSnapshot(frame);
+        return isApprovalCompleteFrameV1(snapshot) ? dispositionOf(snapshot, snapshot) : null;
+    }
+    catch {
         return null;
+    }
+}
+function ownDataSnapshot(frame) {
+    const snapshot = Object.create(null);
+    for (const key of Object.getOwnPropertyNames(frame)) {
+        const d = Object.getOwnPropertyDescriptor(frame, key);
+        if (d !== undefined && Object.hasOwn(d, 'value'))
+            snapshot[key] = d.value;
+    }
+    return snapshot;
+}
+function dispositionOf(frame, f) {
     const outcome = f.outcome;
     if (outcome === 'allowed' || outcome === 'denied')
         return 'settled';

package/dist/hitl/parkOwnership.d.ts

@@ -6,5 +6,7 @@ export interface ParkOwnershipDeps {
     isOwnRun?: (taskIdTail: string) => boolean;
 }
 export declare function pendingRowIsOwnedByThisSession(row: PendingCheckpoint, deps?: ParkOwnershipDeps): boolean;
+export declare function pendingRowOwnershipOf(row: object, deps?: ParkOwnershipDeps): 'owned' | 'foreign' | 'unknown';
+export declare function usableAskQuestions(value: unknown): AskQuestion[] | null;
 export declare function askQuestionsFromPending(pending: PendingCheckpoint): AskQuestion[] | null;
 export declare function isHitlSafetyErrorLike(e: unknown): boolean;