@sema-agent/client-core 0.85.1 → 0.86.0

package/dist/fleet/workflowSizeWarning.js

@@ -1,11 +1,8 @@
+import { CORE_WORKFLOW_SIZE_GUIDELINE_AGENT_CAPS } from '../generated/engineFactTables.js';
 export const WORKFLOW_SIZE_WARNING_AGENT_CAP = 25;
 export const WORKFLOW_SIZE_WARNING_TOKEN_CAP = 1_500_000;
 export const WORKFLOW_SIZE_WARNING_TOKENS_PER_AGENT = 70_000;
-export const WORKFLOW_SIZE_GUIDELINE_AGENT_CAPS = Object.freeze({
-    small: 5,
-    medium: 15,
-    large: 50,
-});
+export const WORKFLOW_SIZE_GUIDELINE_AGENT_CAPS = CORE_WORKFLOW_SIZE_GUIDELINE_AGENT_CAPS;
 export const WORKFLOW_SIZE_WARNING_ENV_NAMES = Object.freeze({
     agents: Object.freeze(['SEMA_CODE_WORKFLOW_SIZE_WARNING_AGENTS', 'CLAUDE_CODE_WORKFLOW_SIZE_WARNING_AGENTS']),
     tokens: Object.freeze(['SEMA_CODE_WORKFLOW_SIZE_WARNING_TOKENS', 'CLAUDE_CODE_WORKFLOW_SIZE_WARNING_TOKENS']),

package/dist/gateOutcome.d.ts

@@ -3,9 +3,13 @@ import { type CcToolDenialKind } from './gateVocabulary.js';
 export type GateDispositionView = {
     kind: 'allowed';
     classifier?: GateClassifierRoundView;
+    released?: GateModeReleaseView;
 } | {
     kind: 'denied';
     classifier?: GateClassifierRoundView;
+    mode?: string;
+    askClass?: string;
+    classes?: readonly string[];
     deniedBy: DeniedBy | (string & {});
     cause?: string;
 };
@@ -19,6 +23,14 @@ export interface GateClassifierFallbackView {
     to: string;
     cause: string;
 }
+export interface GateModeReleaseView {
+    mode: string;
+    askClass: string;
+    classes: readonly string[];
+    origin?: string;
+    mandate?: string;
+    reason?: string;
+}
 export interface SettlementWhoView {
     party: string;
     approver?: string;
@@ -38,6 +50,7 @@ export interface GateOutcomeView {
 }
 export declare function gateOutcomeOf(frame: unknown): GateOutcomeView | undefined;
 export declare function isGateParkedToolEnd(frame: unknown): boolean;
+export declare function gateModeRelease(g: GateOutcomeView | undefined): GateModeReleaseView | undefined;
 export declare function isDeniedGate(g: GateOutcomeView | undefined): boolean;
 export declare function gateDeniedBy(g: GateOutcomeView | undefined): string | undefined;
 export declare function gateApprover(g: GateOutcomeView | undefined): string | undefined;

package/dist/gateOutcome.js

@@ -50,6 +50,39 @@ function readSettlement(v) {
         ...(note !== undefined ? { note } : {}),
     };
 }
+function nonEmptyStringList(v) {
+    if (!Array.isArray(v) || v.length === 0)
+        return undefined;
+    const out = [];
+    for (const x of v) {
+        const t = str(x);
+        if (t === undefined)
+            return undefined;
+        out.push(t);
+    }
+    return Object.freeze(out);
+}
+function readModeRelease(raw) {
+    if (typeof raw !== 'object' || raw === null || Array.isArray(raw))
+        return undefined;
+    const r = raw;
+    const mode = str(r.mode);
+    const askClass = str(r.askClass);
+    const classes = nonEmptyStringList(r.classes);
+    if (mode === undefined || askClass === undefined || classes === undefined)
+        return undefined;
+    const origin = str(r.origin);
+    const mandate = str(r.mandate);
+    const reason = str(r.reason);
+    return {
+        mode,
+        askClass,
+        classes,
+        ...(origin !== undefined ? { origin } : {}),
+        ...(mandate !== undefined ? { mandate } : {}),
+        ...(reason !== undefined ? { reason } : {}),
+    };
+}
 function readClassifierRound(raw) {
     if (typeof raw !== 'object' || raw === null || Array.isArray(raw))
         return undefined;
@@ -85,18 +118,29 @@ export function gateOutcomeOf(frame) {
     let disposition;
     const classifier = readClassifierRound(dr.classifier);
     if (dk === 'allowed') {
-        disposition = { kind: 'allowed', ...(classifier !== undefined ? { classifier } : {}) };
+        const released = readModeRelease(dr.released);
+        disposition = {
+            kind: 'allowed',
+            ...(classifier !== undefined ? { classifier } : {}),
+            ...(released !== undefined ? { released } : {}),
+        };
     }
     else if (dk === 'denied') {
         const deniedBy = str(dr.deniedBy);
         if (deniedBy === undefined)
             return undefined;
         const cause = str(dr.cause);
+        const mode = str(dr.mode);
+        const askClass = str(dr.askClass);
+        const classes = nonEmptyStringList(dr.classes);
         disposition = {
             kind: 'denied',
             deniedBy,
             ...(cause !== undefined ? { cause } : {}),
             ...(classifier !== undefined ? { classifier } : {}),
+            ...(mode !== undefined ? { mode } : {}),
+            ...(askClass !== undefined ? { askClass } : {}),
+            ...(classes !== undefined ? { classes } : {}),
         };
     }
     else {
@@ -115,6 +159,9 @@ export function isGateParkedToolEnd(frame) {
         return false;
     return frame.errorCode === GATE_PARKED_ERROR_CODE;
 }
+export function gateModeRelease(g) {
+    return g?.disposition.kind === 'allowed' ? g.disposition.released : undefined;
+}
 export function isDeniedGate(g) {
     return g?.disposition.kind === 'denied';
 }

package/dist/gateVocabulary.d.ts

@@ -1,12 +1,14 @@
-import type { DeniedBy } from '@sema-agent/sdk';
+import { CORE_DENIED_BY_VALUES } from './generated/engineFactTables.js';
 import type { APPROVAL_MANDATE_WORDS } from './hitl/toolApprovalWire.js';
 export declare const CC_TOOL_DENIAL_KINDS: readonly ["user-rejected", "permission-rule", "automode-blocked", "automode-unavailable", "automode-parsing-error", "interrupted", "cancelled"];
 export type CcToolDenialKind = (typeof CC_TOOL_DENIAL_KINDS)[number];
 export declare function isCcToolDenialKind(v: unknown): v is CcToolDenialKind;
 export declare function isCcToolDenialKindADenial(v: unknown): boolean;
 export declare function ccToolDenialKindForSettledBy(settledBy: unknown): CcToolDenialKind | undefined;
-export declare const GATE_DENIED_BY_WORDS: readonly DeniedBy[];
-export declare function isGateDeniedByWord(v: unknown): v is DeniedBy;
+declare const RETIRED_DENIED_BY_WORDS: readonly ["plan_mode"];
+export type GateDeniedByWord = (typeof CORE_DENIED_BY_VALUES)[number] | (typeof RETIRED_DENIED_BY_WORDS)[number];
+export declare const GATE_DENIED_BY_WORDS: readonly GateDeniedByWord[];
+export declare function isGateDeniedByWord(v: unknown): v is GateDeniedByWord;
 export declare function gateDeniedByDetail(deniedBy: unknown): string;
 export declare function askOriginDetail(origin: unknown, message?: unknown): string;
 export declare const RULE_STORE_UNREADABLE_KINDS: readonly ["store", "call"];
@@ -17,3 +19,4 @@ export declare function mandatedApprovalDetail(): string;
 export type ApprovalMandateWord = (typeof APPROVAL_MANDATE_WORDS)[number];
 export declare function isApprovalMandateWord(v: unknown): v is ApprovalMandateWord;
 export declare function approvalMandateDetail(word: ApprovalMandateWord): string;
+export {};

package/dist/gateVocabulary.js

@@ -1,3 +1,4 @@
+import { CORE_DENIED_BY_VALUES } from './generated/engineFactTables.js';
 export const CC_TOOL_DENIAL_KINDS = Object.freeze([
     'user-rejected',
     'permission-rule',
@@ -20,18 +21,10 @@ export function ccToolDenialKindForSettledBy(settledBy) {
         return 'permission-rule';
     return undefined;
 }
-export const GATE_DENIED_BY_WORDS = Object.freeze([
-    'policy',
-    'hook',
-    'org',
-    'persisted_rule',
-    'classifier',
-    'plan_mode',
-    'compliance',
-    'write_protection',
-    'ask_resolution',
-    'read_boundary',
-]);
+const RETIRED_DENIED_BY_WORDS = Object.freeze(['plan_mode']);
+export const GATE_DENIED_BY_WORDS = Object.freeze([...CORE_DENIED_BY_VALUES, ...RETIRED_DENIED_BY_WORDS]);
+const _deniedByWordsPin = true;
+void _deniedByWordsPin;
 const DENIED_BY_SENTENCES = Object.freeze({
     policy: "denied by this deployment's permission policy",
     hook: 'denied by a PreToolUse hook',
@@ -43,6 +36,7 @@ const DENIED_BY_SENTENCES = Object.freeze({
     write_protection: 'denied because the write landed on a write-protected path',
     ask_resolution: 'denied when the approval was resolved',
     read_boundary: 'denied by the read boundary',
+    mode: "denied by this session's permission mode",
 });
 export function isGateDeniedByWord(v) {
     return typeof v === 'string' && GATE_DENIED_BY_WORDS.includes(v);
@@ -63,7 +57,7 @@ const ASK_ORIGIN_SENTENCES = Object.freeze({
     hook: 'a PreToolUse hook asked about this call',
     ask_rule: 'a persisted ask rule matches this call',
     denial_limit_fallback: 'the auto-mode classifier hit its denial limit and handed this call back to you',
-    shell_gate_tighten: 'this deployment asks about shell commands the coarse shell gate rates above this tier',
+    shell_gate_tighten: 'the coarse shell check rates this command above the tier it lets through, so it asks',
     safety_tighten: 'the gate tightened on this call’s own facts (network egress, irreversibility, or a protected write)',
     policy: 'this deployment’s permission policy asks about this call',
 });
@@ -82,8 +76,6 @@ export function askOriginDetail(origin, message) {
     const word = typeof origin === 'string' && origin.length > 0 ? origin : '(none)';
     return `this call asks; its origin ${word} is a word newer than this client, so answer it as usual`;
 }
-const _deniedByWordsPin = GATE_DENIED_BY_WORDS;
-void _deniedByWordsPin;
 export const RULE_STORE_UNREADABLE_KINDS = Object.freeze(['store', 'call']);
 const RULE_STORE_UNREADABLE_SET = new Set(RULE_STORE_UNREADABLE_KINDS);
 export function isRuleStoreUnreadableKind(v) {

package/dist/generated/engineFactTables.d.ts

@@ -0,0 +1,10 @@
+export declare const CORE_ASK_UNRESOLVABLE_CAUSES: readonly string[];
+export declare const CORE_DURABLE_MANDATE_SOURCES: readonly string[];
+export declare const CORE_TERMINAL_CAUSE_KINDS: readonly ["completed", "failed", "blocked", "paused"];
+export declare const CORE_RESERVED_AGENT_NAMES: readonly string[];
+export declare const CORE_WORKFLOW_SIZE_GUIDELINE_AGENT_CAPS: Readonly<Record<"small" | "medium" | "large", number>>;
+export declare const CORE_ENGINE_AUTHORITY_ENVELOPE_TAGS: readonly string[];
+export declare const CORE_DENIED_BY_VALUES: readonly ["policy", "hook", "org", "persisted_rule", "classifier", "compliance", "write_protection", "ask_resolution", "read_boundary", "mode"];
+export declare const CORE_PERMISSION_MODE_FOLD_REASONS: readonly string[];
+export declare const CORE_ENGINE_CARD_TYPES: readonly string[];
+export declare const CORE_TOOL_DECLARATION_CODES: readonly string[];

package/dist/generated/engineFactTables.js

@@ -0,0 +1,113 @@
+export const CORE_ASK_UNRESOLVABLE_CAUSES = Object.freeze([
+    "approver_unavailable",
+    "no_approver_wired",
+    "mandate_unreconstructible",
+]);
+export const CORE_DURABLE_MANDATE_SOURCES = Object.freeze([
+    "force_durable_gate",
+    "durable_approval",
+]);
+export const CORE_TERMINAL_CAUSE_KINDS = Object.freeze([
+    "completed",
+    "failed",
+    "blocked",
+    "paused",
+]);
+export const CORE_RESERVED_AGENT_NAMES = Object.freeze([
+    "StructuredOutput",
+    "ToolSearch",
+    "ReadToolResult",
+    "ReportBlocked",
+    "Agent",
+]);
+export const CORE_WORKFLOW_SIZE_GUIDELINE_AGENT_CAPS = Object.freeze({
+    "small": 5,
+    "medium": 15,
+    "large": 50,
+});
+export const CORE_ENGINE_AUTHORITY_ENVELOPE_TAGS = Object.freeze([
+    "system-reminder",
+    "task-notification",
+    "new-diagnostics",
+    "user_memory",
+    "scope",
+    "skills",
+    "total_tokens",
+    "instruction-files",
+]);
+export const CORE_DENIED_BY_VALUES = Object.freeze([
+    "policy",
+    "hook",
+    "org",
+    "persisted_rule",
+    "classifier",
+    "compliance",
+    "write_protection",
+    "ask_resolution",
+    "read_boundary",
+    "mode",
+]);
+export const CORE_PERMISSION_MODE_FOLD_REASONS = Object.freeze([
+    "operator_deny",
+    "face_absent",
+    "inherited_ceiling",
+]);
+export const CORE_ENGINE_CARD_TYPES = Object.freeze([
+    "mcp",
+    "a2a",
+    "path_not_in_root",
+    "read_path_denied",
+    "readonly_out_of_root",
+    "read_unestablished",
+    "text",
+    "notebook",
+    "file_unchanged",
+    "image",
+    "document",
+    "edit",
+    "create",
+    "update",
+    "notebook-edit",
+    "bash",
+    "bash_invalid_timeout",
+    "grep",
+    "glob",
+    "repo-map",
+    "artifact",
+    "worktree",
+    "task-output",
+    "task-stop",
+    "monitor-start",
+    "send-message",
+    "agent-transcript",
+    "list-agents",
+    "read-inbox",
+    "workflow-run",
+    "report-findings",
+    "tool-search",
+    "ask-question",
+    "exit-plan-mode",
+    "enter-plan-mode",
+    "cron-create",
+    "cron-delete",
+    "cron-list",
+    "schedule-wakeup",
+    "web-fetch",
+    "web-search",
+    "todo",
+    "task",
+    "task-list",
+    "agent",
+    "fork",
+]);
+export const CORE_TOOL_DECLARATION_CODES = Object.freeze([
+    "config.tool_mount_denied",
+    "config.tool_roster_bound",
+    "config.tool_name_too_long",
+    "config.tool_contract_too_long",
+    "config.tool_schema_bound",
+    "config.tool_face_invalid",
+    "config.tool_name_invalid",
+    "config.egress_requires_write_effect",
+    "config.reserved_tool_name",
+]);

package/dist/generated/engineNoticeTables.js

@@ -24,6 +24,11 @@ export const CORE_ENGINE_NOTICE_CODES = Object.freeze([
     "config.peer_admission_out_of_range",
     "config.peer_lane_unmounted",
     "config.secret_env_scrubbed",
+    "config.permission_mode_unavailable",
+    "permission.ask_released_by_mode",
+    "permission.read_deny_unapplied",
+    "permission.rule_store_unavailable",
+    "resume.legacy_mode_seed_migrated",
     "peer.inbound_disposition",
     "peer.held_settled",
     "peer.idle_subscription",
@@ -31,6 +36,7 @@ export const CORE_ENGINE_NOTICE_CODES = Object.freeze([
     "classifier.fallback",
     "classifier.role_defaulted",
     "classifier.contract_broken",
+    "classifier.unavailable",
     "checkpoint.execution_outcome_unrecorded",
     "delegation.transcript_integrity",
     "delegation.ask_unresolvable",
@@ -58,6 +64,7 @@ export const CORE_ENGINE_NOTICE_CODES = Object.freeze([
     "route.classifier_unroutable",
     "route.base_url_changed_key_unchanged",
     "route.response_model_mismatch",
+    "route.tool_call_id_folded",
     "task.user_steer_undrained",
     "task.user_followup_undrained",
     "steering.parked_input_blocked",
@@ -99,6 +106,11 @@ export const CORE_NOTICE_AUDIENCE = Object.freeze({
     "config.peer_admission_out_of_range": "operator",
     "config.peer_lane_unmounted": "operator",
     "config.secret_env_scrubbed": "operator",
+    "config.permission_mode_unavailable": "user",
+    "permission.ask_released_by_mode": "user",
+    "permission.read_deny_unapplied": "user",
+    "permission.rule_store_unavailable": "user",
+    "resume.legacy_mode_seed_migrated": "operator",
     "peer.inbound_disposition": "user",
     "peer.held_settled": "user",
     "peer.idle_subscription": "user",
@@ -106,6 +118,7 @@ export const CORE_NOTICE_AUDIENCE = Object.freeze({
     "classifier.fallback": "operator",
     "classifier.role_defaulted": "operator",
     "classifier.contract_broken": "operator",
+    "classifier.unavailable": "user",
     "checkpoint.execution_outcome_unrecorded": "operator",
     "delegation.transcript_integrity": "operator",
     "delegation.ask_unresolvable": "user",
@@ -133,6 +146,7 @@ export const CORE_NOTICE_AUDIENCE = Object.freeze({
     "route.classifier_unroutable": "operator",
     "route.base_url_changed_key_unchanged": "operator",
     "route.response_model_mismatch": "operator",
+    "route.tool_call_id_folded": "operator",
     "task.user_steer_undrained": "user",
     "task.user_followup_undrained": "user",
     "steering.parked_input_blocked": "user",

package/dist/hitl/refusedToolNameProse.d.ts

@@ -0,0 +1,4 @@
+export declare const PREFIXES_IN_PROSE: string;
+export declare const REFUSED_NAME_CLASSES: string;
+export declare const REFUSED_NAME_FIX: string;
+export declare const RULES_LEGACY_TOOL_NAME_WRITE_NOTE: string;

package/dist/hitl/refusedToolNameProse.js

@@ -0,0 +1,7 @@
+import { CORE_PROTOCOL_PREFIXES } from '../generated/toolNameTables.js';
+export const PREFIXES_IN_PROSE = CORE_PROTOCOL_PREFIXES.map((prefix) => `"${prefix}"`).join(' or ');
+export const REFUSED_NAME_CLASSES = `a retired tool name, or a name that contains "__" but does not start with ${PREFIXES_IN_PROSE}`;
+export const REFUSED_NAME_FIX = `If the tool still exists, use its current name; a server or agent-peer tool name starts with ${PREFIXES_IN_PROSE}.`;
+export const RULES_LEGACY_TOOL_NAME_WRITE_NOTE = `The engine refused to write these session rules, and the stored record was not changed at all: they name a tool the engine refuses — ${REFUSED_NAME_CLASSES} (the engine's own error text names the entry). ` +
+    `${REFUSED_NAME_FIX} Then write the rules again. ` +
+    'If that entry was already in this session’s rule record, it has to be removed from the record before the record can be written again.';

package/dist/hitl/sessionPolicyDeliverable.js

@@ -1,16 +1,16 @@
-import { CONFIG_LEGACY_TOOL_NAME } from '../engineErrorCodes.js';
+import { CONFIG_LEGACY_TOOL_NAME, RULES_LEGACY_TOOL_NAME } from '../engineErrorCodes.js';
 import { rosterMountedNames } from './rosterMountedNames.js';
+import { PREFIXES_IN_PROSE, REFUSED_NAME_CLASSES, REFUSED_NAME_FIX, RULES_LEGACY_TOOL_NAME_WRITE_NOTE } from './refusedToolNameProse.js';
 import { CORE_PROTOCOL_PREFIXES, CORE_RETIRED_TOOL_CURRENT_NAMES } from '../generated/toolNameTables.js';
 const COVERING_NAMESPACE_PREFIXES = CORE_PROTOCOL_PREFIXES;
 const ENGINE_RETIRED_TOOL_NAMES = CORE_RETIRED_TOOL_CURRENT_NAMES;
-const PREFIXES_IN_PROSE = COVERING_NAMESPACE_PREFIXES.map((prefix) => `"${prefix}"`).join(' or ');
 const WITHHELD_NOTICE = {
     ask_no_bucket: 'Not written to this session’s rule record: that record only holds rules that block outright, and this rule asks before running instead — recording it as a block would change what it means.',
     qualified_deny: 'Not written to this session’s rule record: that record holds whole tool names and command names only, and this rule has a part in parentheses it cannot carry — recording just the name could block more than this rule does.',
     peer_wide: 'Not written to this session’s rule record: this rule names a server or agent peer without naming one of its tools, and an engine that matches that record by exact tool name would block none of that peer’s tools.',
     wildcard: 'Not written to this session’s rule record: this rule uses a wildcard (*), and an engine that matches that record by exact tool name would block none of the tools it covers.',
     not_a_tool_name: 'Not written to this session’s rule record: this entry is not exactly one tool name — it is empty, not text, or has spaces around the name.',
-    legacy_tool_name: `Not written to this session’s rule record: unless a tool by exactly this name is available, the engine refuses it — it is a retired tool name, or it contains "__" but does not start with ${PREFIXES_IN_PROSE} — and with it in that record every later run of this session would fail at startup until that entry is removed from the record. If the tool still exists, use its current name; a server or agent-peer tool name starts with ${PREFIXES_IN_PROSE}.`,
+    legacy_tool_name: `Not written to this session’s rule record: unless a tool by exactly this name is available, the engine refuses it — it is a retired tool name, or it contains "__" but does not start with ${PREFIXES_IN_PROSE} — and with it in that record every later run of this session would fail at startup until that entry is removed from the record. ${REFUSED_NAME_FIX}`,
     not_in_roster: 'Not written to this session’s rule record: the tool roster supplied for this check has no tool by exactly this name, as a name or an alias, with letter case counted — it may be misspelled, or name a tool this deployment does not provide — so recorded as it is it would block nothing here.',
 };
 export const SESSION_POLICY_WITHHELD_WHY = Object.freeze(Object.keys(WITHHELD_NOTICE));
@@ -114,8 +114,12 @@ export function sessionPolicyWithheldNotice(why) {
         ? WITHHELD_NOTICE[why]
         : 'Not written to this session’s rule record.';
 }
-const LEGACY_TOOL_NAME_FAILURE_NOTE = `This run did not start: a tool rule applied to it names a tool the engine refuses — a retired tool name, or a name that contains "__" but does not start with ${PREFIXES_IN_PROSE} (the engine's own error text names the entry). ` +
+const LEGACY_TOOL_NAME_FAILURE_NOTE = `This run did not start: a tool rule applied to it names a tool the engine refuses — ${REFUSED_NAME_CLASSES} (the engine's own error text names the entry). ` +
     'Every later run fails the same way until that entry is removed from wherever it is set: this session’s rule record, the settings sent with the run, a parent session’s rule record, or the deployment’s own tool rules.';
 export function legacyToolNameFailureNoteOf(code) {
-    return code === CONFIG_LEGACY_TOOL_NAME ? LEGACY_TOOL_NAME_FAILURE_NOTE : undefined;
+    if (code === CONFIG_LEGACY_TOOL_NAME)
+        return LEGACY_TOOL_NAME_FAILURE_NOTE;
+    if (code === RULES_LEGACY_TOOL_NAME)
+        return RULES_LEGACY_TOOL_NAME_WRITE_NOTE;
+    return undefined;
 }

package/dist/hitl/sessionPolicyWire.d.ts

@@ -38,6 +38,11 @@ export type SessionPolicyFailure = {
 } | {
     kind: 'request-rejected';
     message: string;
+} | {
+    kind: 'legacy-tool-name';
+    message: string;
+    field?: SessionPolicyRemovedEntry['field'];
+    name?: string;
 } | {
     kind: 'unauthorized';
     message: string;
@@ -85,6 +90,12 @@ export type SessionPolicyTightenOutcome = {
 } | {
     kind: 'capability_absent';
     why: 'not_reported' | 'absent';
+} | {
+    kind: 'legacy_tool_name';
+    message: string;
+    field?: SessionPolicyRemovedEntry['field'];
+    name?: string;
+    alreadyInRecord?: boolean;
 } | {
     kind: 'unknown';
     why: SessionPolicyTightenUnknownWhy;
@@ -127,6 +138,11 @@ export type SessionPolicyRemovalOutcome = {
     kind: 'write_unconfirmed';
     why: Extract<SessionPolicyTightenUnknownWhy, 'write_indeterminate' | 'write_receipt_unreadable' | 'write_receipt_mismatch'>;
     message?: string;
+} | {
+    kind: 'legacy_tool_name';
+    message: string;
+    field?: SessionPolicyRemovedEntry['field'];
+    name?: string;
 };
 export type SessionPolicyRosterRequiredWhy = 'absent' | 'unreadable';
 export declare function removeRefusedSessionRules(facade: SessionPolicyFacade, sessionId: string, roster: ToolRosterView | undefined, opts?: {

package/dist/hitl/sessionPolicyWire.js

@@ -1,6 +1,8 @@
 import { wireFailureShapeOf } from '../wireFailureShape.js';
 import { hostLog } from '../host.js';
 import { isEngineRefusedToolName } from './sessionPolicyDeliverable.js';
+import { RULES_LEGACY_TOOL_NAME_WRITE_NOTE } from './refusedToolNameProse.js';
+import { RULES_LEGACY_TOOL_NAME, isRulesRefusalCode } from '../engineErrorCodes.js';
 import { rosterMountedNames } from './rosterMountedNames.js';
 const RULE_FIELD_PRESENCE = {
     toolAllow: true,
@@ -12,9 +14,19 @@ const RULE_FIELD_PRESENCE = {
 export const SESSION_POLICY_RULE_FIELDS = Object.freeze(Object.keys(RULE_FIELD_PRESENCE));
 const MAX_RULE_ENTRIES = 10_000;
 export function classifySessionPolicyFailure(e) {
-    const { status, errorCode, message } = wireFailureShapeOf(e);
+    const { status, errorCode, message, bodyField, bodyName } = wireFailureShapeOf(e);
     if (errorCode === undefined || errorCode === '')
         return { kind: 'no-verdict', message };
+    if (errorCode === RULES_LEGACY_TOOL_NAME) {
+        return {
+            kind: 'legacy-tool-name',
+            message,
+            ...(bodyField === 'toolDeny' || bodyField === 'toolAllow' ? { field: bodyField } : {}),
+            ...(bodyName !== undefined && bodyName !== '' ? { name: bodyName } : {}),
+        };
+    }
+    if (isRulesRefusalCode(errorCode) && status !== undefined && status >= 400 && status < 500)
+        return { kind: 'error', message };
     if (status === 501 || errorCode === 'capability.session_store_required') {
         return { kind: 'face-unavailable', message };
     }
@@ -209,10 +221,30 @@ function unknownFrom(failure, leg) {
             return { kind: 'unknown', why: leg === 'read' ? 'read_failed' : 'write_indeterminate', message };
         case 'loosen-forbidden':
         case 'cas-conflict':
+        case 'legacy-tool-name':
         case 'error':
             return { kind: 'unknown', why: leg === 'read' ? 'read_failed' : 'write_refused', message };
     }
 }
+function legacyToolNameOutcome(failure, prior, add) {
+    const { field, name } = failure;
+    let alreadyInRecord;
+    if (field !== undefined && name !== undefined) {
+        const inPrior = Object.hasOwn(prior, field) ? prior[field] : undefined;
+        const inAdd = Object.hasOwn(add, field) ? add[field] : undefined;
+        if (inPrior !== undefined && inPrior.includes(name))
+            alreadyInRecord = true;
+        else if (inAdd !== undefined && inAdd.includes(name))
+            alreadyInRecord = false;
+    }
+    return {
+        kind: 'legacy_tool_name',
+        message: failure.message,
+        ...(field !== undefined ? { field } : {}),
+        ...(name !== undefined ? { name } : {}),
+        ...(alreadyInRecord !== undefined ? { alreadyInRecord } : {}),
+    };
+}
 async function attemptTighten(facade, req, opts) {
     const read = await readSessionPolicy(facade, req.sessionId, opts);
     if (read.kind === 'failed')
@@ -231,6 +263,8 @@ async function attemptTighten(facade, req, opts) {
             return { done: { kind: 'loosen_forbidden', message: failure.message } };
         if (failure.kind === 'cas-conflict')
             return { retryAtRev: read.rev };
+        if (failure.kind === 'legacy-tool-name')
+            return { done: legacyToolNameOutcome(failure, read.rules, req.add) };
         return { done: unknownFrom(failure, 'write') };
     }
     let narrowed;
@@ -279,6 +313,8 @@ export function sessionPolicyTightenNotice(outcome) {
             return outcome.why === 'absent'
                 ? 'This deployment does not keep per-session tool rules, so there is nothing to tighten here.'
                 : 'This engine does not say whether it keeps per-session tool rules — it predates that answer — so the tightening entry stays hidden rather than being written blind.';
+        case 'legacy_tool_name':
+            return RULES_LEGACY_TOOL_NAME_WRITE_NOTE;
         case 'unknown':
             switch (outcome.why) {
                 case 'face_unavailable':
@@ -382,6 +418,16 @@ async function attemptRemoval(facade, sessionId, mounted, opts) {
             return { done: { kind: 'loosen_forbidden', message: failure.message, refused: removed } };
         if (failure.kind === 'cas-conflict')
             return { retryAtRev: read.rev };
+        if (failure.kind === 'legacy-tool-name') {
+            return {
+                done: {
+                    kind: 'legacy_tool_name',
+                    message: failure.message,
+                    ...(failure.field !== undefined ? { field: failure.field } : {}),
+                    ...(failure.name !== undefined ? { name: failure.name } : {}),
+                },
+            };
+        }
         return { done: removalFailed(failure, 'write') };
     }
     let narrowed;
@@ -475,6 +521,8 @@ export function sessionPolicyRemovalNotice(outcome) {
             }
         case 'write_unconfirmed':
             return 'The removal was sent but no clear answer came back from the engine — it may already be in effect. Run the removal again: it re-reads the record, and reports nothing left to remove if it did take effect.';
+        case 'legacy_tool_name':
+            return 'Nothing was changed: the engine refused to write this session’s rule record back, because an entry this removal keeps is a name the engine no longer accepts in that record (the engine\'s own error text names the entry). The removal keeps it on purpose — the supplied roster mounts a tool by exactly that name, or this version does not yet recognise the name as one the engine refuses. While the record holds that entry it cannot be written, so the entries this removal meant to take out stay in it as well.';
         default:
             return generic;
     }

package/dist/index.d.ts

@@ -72,7 +72,7 @@ export * from './engineWireSdk.js';
 export * from './classifierVerdictWire.js';
 export { stripSystemReminderBlocks, unwrapSystemReminder } from './systemReminderTag.js';
 export { findSystemReminderOpenTag, type SystemReminderOpenTagSpan } from './systemReminderTag.js';
-export { ACTIVE_RUN_BUSY_ERROR_CODE, asModelFallbackReason, CAPABILITY_SELF_ORCHESTRATION_REQUIRED, CONFIG_DELEGATION_ENTRY_CAPS, CONFIG_LEGACY_TOOL_NAME, CONFIG_LIMIT_INVALID, CONFIG_LIMIT_UNKNOWN_KEY, CONFIG_MEMORY_PROJECT_KEY_SPELLING, CONFIG_MEMORY_WRITE_SCOPE_MISMATCH, CONFIG_REFUSAL_CODES, CONFIG_STRATEGY_FIND_LIMIT_INVALID, CONFIG_STRATEGY_MAX_SIZE_INVALID, CORRUPT_SESSION_ERROR_CODE, DECIDE_CLAIM_LOST, DECIDE_GATE_MOVED, DECIDE_NOT_PARKED, DECIDE_PARK_MOVED_CODES, DECIDE_WORKFLOW_HOST_UNKNOWN, DECIDE_WORKFLOW_LANE_CODES, DECIDE_WORKFLOW_REMEMBER_UNSUPPORTED, DELEGATION_CAP_CODES, DELEGATION_CONCURRENCY_CAP, DELEGATION_SESSION_CAP, delegationCapDispositionOf, DRAINING_ERROR_CODE, ENGINE_STOP_REASONS, engineStopReasonToCc, ENV_LIFETIME_EXPIRED, GATE_PARKED_ERROR_CODE, isConfigRefusalCode, isCorruptSessionCode, isDecideParkMovedCode, isDelegationCapCode, isInterruptedToolEndCode, isLimitsExceededCode, isRewindFamilyCode, isStatusDerivedCoarseCode, isWorkflowParkRefusalCode, LIMITS_MAX_COST_EXCEEDED, LIMITS_MAX_TOKENS_EXCEEDED, LIMITS_MAX_TURNS_EXCEEDED, LIMITS_MAX_WALLTIME_EXCEEDED, MCP_SERVER_REVOKED, MODEL_FALLBACK_INHERIT_NO_TIER_BINDING, OUTPUT_INVALID, PARKED_RESUME_STARTUP_FAILED, RESUME_AT_ERROR_CODE_PREFIX, RESUME_CONTEXT_UNAVAILABLE, RESUME_ENV_FAILED, RESUME_PLACEMENT_MISMATCH, RESUME_POLICY_FOLD_CODE, RESUME_PREFLIGHT_REJECTED, RESUME_REOPEN_CODES, RESUME_RETRY_LATER_CODES, RESUME_TOOL_CONTRACT_MISMATCH, RESUME_TOOL_UNAVAILABLE, RESUME_USAGE_WINDOW_EXHAUSTED, REWIND_ERROR_CODE_PREFIXES, SCENARIO_NOT_ALLOWED_ERROR_CODE, STATUS_DERIVED_COARSE_CODES, STOP_CONFLICT_CODES, STREAM_MAX_DURATION, TOOL_END_INTERRUPTED_NEVER_STARTED, TOOL_END_INTERRUPTED_OUTCOME_UNKNOWN, USAGE_WINDOW_EXHAUSTED, WORKFLOW_PARK_REFUSAL_CODES, } from './engineErrorCodes.js';
+export { ACTIVE_RUN_BUSY_ERROR_CODE, asModelFallbackReason, CAPABILITY_SELF_ORCHESTRATION_REQUIRED, CONFIG_DELEGATION_ENTRY_CAPS, CONFIG_LEGACY_TOOL_NAME, CONFIG_LIMIT_INVALID, CONFIG_LIMIT_UNKNOWN_KEY, CONFIG_MEMORY_PROJECT_KEY_SPELLING, CONFIG_MEMORY_WRITE_SCOPE_MISMATCH, CONFIG_REFUSAL_CODES, CONFIG_STRATEGY_FIND_LIMIT_INVALID, CONFIG_STRATEGY_MAX_SIZE_INVALID, CORRUPT_SESSION_ERROR_CODE, DECIDE_CLAIM_LOST, DECIDE_GATE_MOVED, DECIDE_NOT_PARKED, DECIDE_PARK_MOVED_CODES, DECIDE_WORKFLOW_HOST_UNKNOWN, DECIDE_WORKFLOW_LANE_CODES, DECIDE_WORKFLOW_REMEMBER_UNSUPPORTED, DELEGATION_CAP_CODES, DELEGATION_CONCURRENCY_CAP, DELEGATION_SESSION_CAP, delegationCapDispositionOf, DRAINING_ERROR_CODE, ENGINE_STOP_REASONS, engineStopReasonToCc, ENV_LIFETIME_EXPIRED, FLEET_LEASE_UNAVAILABLE, GATE_PARKED_ERROR_CODE, isConfigRefusalCode, isCorruptSessionCode, isDecideParkMovedCode, isDelegationCapCode, isInterruptedToolEndCode, isLimitsExceededCode, isRewindFamilyCode, isRulesRefusalCode, isStatusDerivedCoarseCode, isWorkflowParkRefusalCode, LIMITS_MAX_COST_EXCEEDED, LIMITS_MAX_TOKENS_EXCEEDED, LIMITS_MAX_TURNS_EXCEEDED, LIMITS_MAX_WALLTIME_EXCEEDED, MCP_SERVER_REVOKED, MODEL_FALLBACK_INHERIT_NO_TIER_BINDING, OUTPUT_INVALID, PARKED_RESUME_STARTUP_FAILED, RESUME_AT_ERROR_CODE_PREFIX, RESUME_CONTEXT_UNAVAILABLE, RESUME_ENV_FAILED, RESUME_PLACEMENT_MISMATCH, RESUME_POLICY_FOLD_CODE, RESUME_PREFLIGHT_REJECTED, RESUME_REOPEN_CODES, RESUME_RETRY_LATER_CODES, RESUME_TOOL_CONTRACT_MISMATCH, RESUME_TOOL_UNAVAILABLE, RESUME_USAGE_WINDOW_EXHAUSTED, REWIND_ERROR_CODE_PREFIXES, RULES_LEGACY_TOOL_NAME, SCENARIO_NOT_ALLOWED_ERROR_CODE, STATUS_DERIVED_COARSE_CODES, STOP_CONFLICT_CODES, STREAM_MAX_DURATION, TOOL_END_INTERRUPTED_NEVER_STARTED, TOOL_END_INTERRUPTED_OUTCOME_UNKNOWN, USAGE_WINDOW_EXHAUSTED, WORKFLOW_PARK_REFUSAL_CODES, } from './engineErrorCodes.js';
 export type { DelegationCapDisposition, ModelFallbackReason, } from './engineErrorCodes.js';
 export * from './agentsWireCaps.js';
 export * from './attachmentsWireCaps.js';
@@ -90,6 +90,8 @@ export * from './rewindWireCaps.js';
 export * from './rewindArchiveCapability.js';
 export * from './fileHistoryCaptureCapability.js';
 export * from './sealedKeyCapability.js';
+export * from './storePostureCapability.js';
+export * from './centerWiringCapability.js';
 export * from './registryQuotaUsage.js';
 export * from './selfOrchestrationWireCaps.js';
 export * from './skillsWireCaps.js';
@@ -145,6 +147,7 @@ export * from './corruptSession.js';
 export * from './corruptSessionCopy.js';
 export * from './resumeRefusalCopy.js';
 export * from './wireRefusalCopy.js';
+export * from './inheritEnvWire.js';
 export * from './decideReceipt.js';
 export * from './sessionMap.js';
 export * from './detachWire.js';
@@ -189,6 +192,7 @@ export * from './request/printNotification.js';
 export * from './seatContract.js';
 export * from './agentSession/contract.js';
 export * from './agentSession/backgroundView.js';
+export { READ_CREDENTIAL_NOT_ACCEPTED_NOTICE } from './readCredentialRefusal.js';
 export { readEngineAgentRegistry, isEngineAgentRegistryListingSuperseded } from './agentSession/engineAgentRegistryRead.js';
 export type { EngineAgentRegistryClient } from './agentSession/engineAgentRegistryRead.js';
 export { stopEngineSessionBackground, engineSessionBackgroundReceiptReadingOf, ENGINE_SESSION_BACKGROUND_RECEIPT_STATES, } from './agentSession/engineSessionBackgroundStop.js';