@sema-agent/client-core 0.91.0 → 0.93.0

package/dist/hitl/toolApprovalWire.d.ts

@@ -1,11 +1,12 @@
 import { type GateCurrentPending, type HitlFailureStage, type HitlSafetyCode, type HitlClientLike, type DecideOperationObserver } from './hitlBridge.js';
-import { type RuleStoreUnreadableKind } from '../gateVocabulary.js';
+import { type AllowRuleShadowedWireMember, type ApprovalAllowRuleShadow } from './allowRuleShadow.js';
 import { type ApprovalMandateWord } from '../gateVocabulary.js';
 import type { ToolPermissionRequest } from '../seatContract.js';
 import { type DenyAttributionRefusalDetail } from '../wireRefusalCopy.js';
+import { type ApprovalDecidedByReading } from '../approvalDecidedByCapability.js';
 import { type DecideReceiptView } from '../decideReceipt.js';
 import { RULE_OFFER_MATCHES, RULE_OFFER_BATCH_MEMBER_KINDS, RULE_OFFER_UNCOVERED_REASONS, RULE_OFFERS_ABSENCE_REASONS } from '@sema-agent/sdk';
-import type { RuleSuggestion, ToolApprovalRespondAck, PersistedRuleAnchor as SdkPersistedRuleAnchor, RuleOfferMatch as SdkRuleOfferMatch, RuleOfferBatchMember as SdkRuleOfferBatchMember, RuleOfferUncoveredDetail as SdkRuleOfferUncoveredDetail, RuleOfferUncoveredReason as SdkRuleOfferUncoveredReason, AskOrigin as SdkAskOrigin, RuleOffersAbsence as SdkRuleOffersAbsence, DenialLimitKind as SdkDenialLimitKind, DenialLimitFallback as SdkDenialLimitFallback } from '@sema-agent/sdk';
+import type { ToolApprovalRespondAck, PersistedRuleAnchor as SdkPersistedRuleAnchor, RuleOfferMatch as SdkRuleOfferMatch, RuleOfferBatchMember as SdkRuleOfferBatchMember, RuleOfferUncoveredDetail as SdkRuleOfferUncoveredDetail, RuleOfferUncoveredReason as SdkRuleOfferUncoveredReason, AskOrigin as SdkAskOrigin, RuleOffersAbsence as SdkRuleOffersAbsence, DenialLimitKind as SdkDenialLimitKind, DenialLimitFallback as SdkDenialLimitFallback } from '@sema-agent/sdk';
 export declare function isFsApprovalGate(gate: {
     kind?: unknown;
     toolName?: unknown;
@@ -23,6 +24,7 @@ export type FsApprovalOutcome = {
     denySettledBy?: ApprovalDenySettledBy | undefined;
     denyReason?: string | undefined;
     denyAttributionDropped?: true;
+    denyAttributionRenamed?: true;
     receipt?: DecideReceiptView | undefined;
 } | {
     kind: 'aborted';
@@ -48,6 +50,7 @@ export interface FsApprovalWireDeps {
     client: HitlClientLike;
     onPresented?: () => void;
     onDecideOperation?: DecideOperationObserver;
+    approvalDecidedBy?: ApprovalDecidedByReading | undefined;
 }
 export declare function structurallyEqual(a: unknown, b: unknown): boolean;
 export type RuleOfferMatch = SdkRuleOfferMatch;
@@ -131,8 +134,10 @@ export interface ApprovalCardRequest {
     inputHasBidi?: true;
     hasBidiControls?: true;
     persistedRuleShadowed?: string;
+    allowRuleShadow?: ApprovalAllowRuleShadow;
     probeCause?: unknown;
     probeReason?: string;
+    rememberRefused?: true;
     ruleEvidence?: unknown;
     requiresRealApproval?: true;
     irreversibleParkGate?: true;
@@ -148,7 +153,6 @@ export interface ApprovalCardRequest {
     origin?: string;
     askClass?: string;
     classes?: readonly string[];
-    ruleStoreUnreadable?: RuleStoreUnreadableKind;
 }
 export type ApprovalCardPort = (req: ApprovalCardRequest) => Promise<ApprovalCardDecision>;
 export declare function installApprovalCardPort(port: ApprovalCardPort | null): () => void;
@@ -161,6 +165,11 @@ export declare function approvalCardPortFor(sessionKey: string): ApprovalCardPor
 export declare function _resetApprovalCardPortForTest(): void;
 export declare function surfaceApprovalCard(req: ApprovalCardRequest): Promise<ApprovalCardDecision>;
 export declare function surfaceFsApprovalAndDecide(deps: FsApprovalWireDeps, taskId: string, argsByCall: Map<string, unknown>, signal?: AbortSignal, parkGatedCallId?: string): Promise<FsApprovalOutcome>;
+export interface BoundSkillGrantsWire {
+    readonly skill: string | null;
+    readonly allowedTools: readonly string[];
+    readonly disallowedTools: readonly string[];
+}
 export interface ToolApprovalFrame {
     type: 'tool_approval' | 'tool_approval_complete';
     approvalId: string;
@@ -175,14 +184,17 @@ export interface ToolApprovalFrame {
     sourceAgentName?: string;
     governanceForced?: true;
     delegation?: ToolApprovalDelegation;
-    ruleSuggestions?: RuleSuggestion[];
     ruleOffers?: readonly WireRuleOffer[];
     ruleOffersAbsence?: string;
     denialLimitFallback?: DenialLimitFallback;
-    ruleStoreUnreadable?: string;
     persistedRuleShadowed?: string;
+    allowRuleShadowed?: readonly AllowRuleShadowedWireMember[];
+    boundGrantDigest?: string;
+    boundGrants?: BoundSkillGrantsWire;
+    classifierNoRuling?: string;
     probeCause?: unknown;
     probeReason?: string;
+    rememberRefused?: true;
     ruleEvidence?: unknown;
     requiresRealApproval?: true;
     mandated?: true;
@@ -207,7 +219,7 @@ export interface ToolApprovalDelegation {
     depth: number;
     agentName?: string;
 }
-export declare const TOOL_APPROVAL_FRAME_KEYS_MIRROR: readonly ["type", "approvalId", "toolCallId", "toolName", "sourceTaskId", "fromSubagent", "sourceAgentName", "message", "args", "argsOmitted", "governanceForced", "ruleSuggestions", "ruleOffers", "ruleOffersAbsence", "denialLimitFallback", "ruleStoreUnreadable", "readRootCandidate", "mandated", "mandate", "origin", "askClass", "classes", "inputHasBidi", "parked", "persistedRuleShadowed", "probeCause", "probeReason", "ruleEvidence", "requiresRealApproval", "expiresInMs", "expiresAtMs", "serverNowMs", "delegation", "outcome"];
+export declare const TOOL_APPROVAL_FRAME_KEYS_MIRROR: readonly ["type", "approvalId", "toolCallId", "toolName", "sourceTaskId", "fromSubagent", "sourceAgentName", "message", "args", "argsOmitted", "governanceForced", "ruleOffers", "ruleOffersAbsence", "denialLimitFallback", "readRootCandidate", "mandated", "mandate", "origin", "askClass", "classes", "inputHasBidi", "parked", "persistedRuleShadowed", "allowRuleShadowed", "probeCause", "probeReason", "rememberRefused", "boundGrantDigest", "boundGrants", "classifierNoRuling", "ruleEvidence", "requiresRealApproval", "expiresInMs", "expiresAtMs", "serverNowMs", "delegation", "outcome"];
 export interface ApprovalMandatedFacts {
     readonly mandated?: true;
     readonly ruleOffersAbsence?: string;
@@ -228,11 +240,17 @@ export interface RespondToolApprovalOpts {
     persistRuleBatchOfferIndex?: number;
     note?: string;
     settledBy?: 'policy';
+    decidedBy?: 'policy';
 }
 export type RespondToolApprovalFn = (approvalId: string, decision: ToolApprovalRespondDecision, opts?: RespondToolApprovalOpts) => Promise<ToolApprovalRespondAck | void>;
 export type ToolApprovalRespondAckView = ToolApprovalRespondAck;
 export type PersistedRuleAnchor = SdkPersistedRuleAnchor;
 export declare function readToolApprovalRespondAck(v: unknown): ToolApprovalRespondAckView | undefined;
+export declare function decisionAttributionKeyOf(reading: ApprovalDecidedByReading | undefined, denySettledBy: ApprovalDenySettledBy | undefined): {
+    decidedBy: 'policy';
+} | {
+    settledBy: 'policy';
+} | Record<never, never>;
 export interface ToolApprovalFrameOutcome {
     decision: ToolApprovalRespondDecision | 'unresolved';
     ack?: ToolApprovalRespondAckView;
@@ -243,6 +261,7 @@ export interface ToolApprovalFrameOutcome {
     denyReason?: string;
     denyAttributionRefusal?: DenyAttributionRefusalDetail;
     denyAttributionDropped?: true;
+    denyAttributionRenamed?: true;
 }
 interface ToolApprovalRespondRefusalFields {
     status?: number;
@@ -260,11 +279,12 @@ export declare function readToolApprovalRespondRefusal(err: unknown): ToolApprov
 export declare function isToolApprovalFrame(ev: unknown): ev is ToolApprovalFrame;
 export declare function readDenialLimitFallback(v: unknown): DenialLimitFallback | undefined;
 export declare function readRuleOffers(v: unknown): RuleOffer[] | undefined;
-export declare function readRuleOfferSupply(offers: unknown, legacy: unknown): RuleOffer[] | undefined;
+export declare function readRuleOfferSupply(offers: unknown): RuleOffer[] | undefined;
 export interface ToolApprovalFrameLaneOpts {
     approvalDecisionNoteCapable?: boolean;
     respondFreeFormRulesCapable?: boolean;
     respondBatchRuleOffersCapable?: boolean;
+    approvalDecidedBy?: ApprovalDecidedByReading | undefined;
     windowIsCurrent?: boolean;
     argsUnavailable?: true;
 }

package/dist/hitl/toolApprovalWire.js

@@ -1,14 +1,16 @@
 import { APPROVAL_CARD_PORT_KEY_MISMATCH_REASON, DEFAULT_DENY_REASON, DecideTransportRetryExhaustedError, HitlBridge, NO_APPROVAL_CARD_PORT_REASON, HitlSafetyError, denyReasonForWire, findPendingForTask, readDecideCurrentPending, readWireErrorCode, } from './hitlBridge.js';
 import { askParkRowArm } from './askParkRowRouting.js';
 import { hostLog } from '../host.js';
-import { readOwnNonEmptyString } from '../ownKey.js';
+import { readOwnDataValue, readOwnNonEmptyString } from '../ownKey.js';
+import { readAskClassPair } from './askClassPair.js';
+import { legacyShadowedRuleTextOf, readAllowRuleShadowFromWire } from './allowRuleShadow.js';
 import { createSessionSlot, DEFAULT_SESSION_KEY } from '../sessionSlot.js';
 import { readEngineActiveBgTasks } from '../fleet/fleetLedger.js';
 import { observeCancelByDeny, surfaceRememberNotApplied, surfaceEditNotForwarded, surfaceEditRefusedOnBlindAsk, surfaceRuleArmNotSent, surfaceRuleArmRejected } from './hitlHostSurface.js';
 import { approvalCallKey, liveFrameCallKey } from './gateIdentity.js';
-import { isRuleStoreUnreadableKind } from '../gateVocabulary.js';
 import { isApprovalMandateWord } from '../gateVocabulary.js';
 import { denyAttributionRefusalFromError } from '../wireRefusalCopy.js';
+import { approvalDecidedByAdmitted } from '../approvalDecidedByCapability.js';
 import { decideFailureNote } from '../decideFailureNote.js';
 import { refusalSaysStillPending } from '../engineErrorCodes.js';
 import { readDecideReceipt } from '../decideReceipt.js';
@@ -169,6 +171,7 @@ function isParkRowInputSizeMarker(v) {
     return o.truncated === true && typeof o.bytes === 'number' && Number.isFinite(o.bytes) && o.bytes >= 0;
 }
 export async function surfaceFsApprovalAndDecide(deps, taskId, argsByCall, signal, parkGatedCallId) {
+    const decidedByReading = decidedByReadingSnapshotOf(deps);
     const found = await findPendingForTask(deps.client, taskId, (toolName) => toolName !== undefined && (toolNameIsFsWrite(toolName) || toolNameIsShellExec(toolName)), signal ? { signal } : undefined, parkGatedCallId, (row) => askParkRowArm(row) === 'tool-gate');
     if (!found.ok)
         return { kind: 'failed', stage: 'fetch', reason: found.reason, ...(found.code !== undefined ? { code: found.code } : {}) };
@@ -189,12 +192,11 @@ export async function surfaceFsApprovalAndDecide(deps, taskId, argsByCall, signa
     }
     const bridge = new HitlBridge(deps.client, taskId, deps.onDecideOperation ? { onDecideOperation: deps.onDecideOperation } : undefined);
     const callKey = approvalCallKey(gatedCallId, taskId);
-    const ruleOffersReadOnly = readRuleOfferSupply(pending.ruleOffers, pending.ruleSuggestions);
+    const ruleOffersReadOnly = readRuleOffers(pending.ruleOffers);
     const durableProbeCause = pending.riskDescriptor?.probeCause;
     const durableProbeReason = readProbeReason(pending.riskDescriptor);
-    const durableShadowedRule = pending.riskDescriptor?.shadowedRule;
+    const durableShadow = readAllowRuleShadowFromWire(pending, 'row');
     const durableRuleOffersAbsence = pending.ruleOffersAbsence;
-    const durableRuleStoreUnreadable = readRuleStoreUnreadable(pending.ruleStoreUnreadable);
     deps.onPresented?.();
     const card = await surfaceApprovalCard({
         toolName,
@@ -218,12 +220,9 @@ export async function surfaceFsApprovalAndDecide(deps, taskId, argsByCall, signa
         ...(ruleOffersReadOnly !== undefined ? { ruleOffersReadOnly } : {}),
         ...(isWireRecordCarrier(durableProbeCause) ? { probeCause: durableProbeCause } : {}),
         ...(durableProbeReason !== undefined ? { probeReason: durableProbeReason } : {}),
-        ...(durableRuleStoreUnreadable !== undefined
-            ? { ruleStoreUnreadable: durableRuleStoreUnreadable }
-            : {}),
-        ...(typeof durableShadowedRule === 'string' && durableShadowedRule.trim() !== ''
-            ? { persistedRuleShadowed: durableShadowedRule }
-            : {}),
+        ...(readRememberRefused(pending) ? { rememberRefused: true } : {}),
+        ...(durableShadow !== undefined ? { allowRuleShadow: durableShadow } : {}),
+        ...((t) => (t !== undefined ? { persistedRuleShadowed: t } : {}))(legacyShadowedRuleTextOf(durableShadow)),
         ...(typeof durableRuleOffersAbsence === 'string' && durableRuleOffersAbsence !== ''
             ? { ruleOffersAbsence: durableRuleOffersAbsence }
             : {}),
@@ -298,31 +297,56 @@ export async function surfaceFsApprovalAndDecide(deps, taskId, argsByCall, signa
                 }
             case 'deny': {
                 const denySettledByForWire = readApprovalDenySettledBy(card);
+                const attributionKeys = decisionAttributionKeyOf(decidedByReading, denySettledByForWire);
                 const denyReasonSnapshot = typeof card.reason === 'string' ? card.reason : undefined;
                 let lastSendCarriedAttribution = false;
                 try {
                     const denyBody = {
                         decision: 'deny',
                         reason: denyReasonForWire(denyReasonSnapshot, `task ${taskId}`) ?? DEFAULT_DENY_REASON,
-                        ...(denySettledByForWire === 'policy' ? { settledBy: 'policy' } : {}),
+                        ...attributionKeys,
                     };
                     let attributionDropped = false;
+                    let attributionRenamed = false;
                     let raw;
-                    lastSendCarriedAttribution = denySettledByForWire === 'policy';
+                    lastSendCarriedAttribution = carriesAttributionKey(attributionKeys);
                     try {
                         raw = await bridge.decideTool(denyBody, gatedCallId, decideOpts, pending);
                     }
                     catch (first) {
-                        if (!shouldResendWithoutAttribution(first, lastSendCarriedAttribution, signal))
+                        if (shouldResendWithoutAttribution(first, lastSendCarriedAttribution, signal)) {
+                            const withoutAttribution = withoutAttributionKey(denyBody);
+                            lastSendCarriedAttribution = false;
+                            hostLog('debug', `liveToolApprovalWire: decide(deny) for task ${taskId} was refused because the settlement note is not part of ` +
+                                'what this deployment signs — re-sending the SAME decision exactly once with that one key removed ' +
+                                '(the refusal happened before the approval was judged, so nothing was consumed and this is a re-delivery, not a second act)');
+                            raw = await bridge.decideTool(withoutAttribution, gatedCallId, decideOpts, pending);
+                            attributionDropped = true;
+                        }
+                        else if (shouldResendUnderSuccessorKey(first, Object.hasOwn(denyBody, 'settledBy'), signal)) {
+                            const renamed = withAttributionKeyRenamed(denyBody);
+                            hostLog('debug', `liveToolApprovalWire: decide(deny) for task ${taskId} was refused because the settlement note was sent under a name ` +
+                                'this engine has retired — re-sending the SAME decision exactly once with that one key renamed to the name the refusal points to ' +
+                                '(the refusal happened before the approval was judged, so nothing was consumed and this is a re-delivery, not a second act)');
+                            try {
+                                raw = await bridge.decideTool(renamed, gatedCallId, decideOpts, pending);
+                                attributionRenamed = true;
+                            }
+                            catch (second) {
+                                if (!shouldResendWithoutAttribution(second, true, signal))
+                                    throw second;
+                                const renamedWithoutAttribution = withoutAttributionKey(renamed);
+                                lastSendCarriedAttribution = false;
+                                hostLog('debug', `liveToolApprovalWire: decide(deny) for task ${taskId} was refused again because the settlement note is not part of ` +
+                                    'what this deployment signs — re-sending the SAME decision exactly once more with that key removed ' +
+                                    '(still before the approval was judged)');
+                                raw = await bridge.decideTool(renamedWithoutAttribution, gatedCallId, decideOpts, pending);
+                                attributionDropped = true;
+                            }
+                        }
+                        else {
                             throw first;
-                        const { settledBy: _droppedKey, ...withoutAttribution } = denyBody;
-                        void _droppedKey;
-                        lastSendCarriedAttribution = false;
-                        hostLog('debug', `liveToolApprovalWire: decide(deny) for task ${taskId} was refused because the settlement note is not part of ` +
-                            'what this deployment signs — re-sending the SAME decision exactly once with that one key removed ' +
-                            '(the refusal happened before the approval was judged, so nothing was consumed and this is a re-delivery, not a second act)');
-                        raw = await bridge.decideTool(withoutAttribution, gatedCallId, decideOpts, pending);
-                        attributionDropped = true;
+                        }
                     }
                     const receipt = readDecideReceipt(raw);
                     const denySettledBy = denySettledByForWire;
@@ -334,6 +358,7 @@ export async function surfaceFsApprovalAndDecide(deps, taskId, argsByCall, signa
                         ...(denySettledBy !== undefined ? { denySettledBy } : {}),
                         ...(denyReason !== undefined ? { denyReason } : {}),
                         ...(attributionDropped ? { denyAttributionDropped: true } : {}),
+                        ...(attributionRenamed ? { denyAttributionRenamed: true } : {}),
                         ...(receipt !== undefined ? { receipt } : {}),
                     };
                 }
@@ -363,6 +388,8 @@ export async function surfaceFsApprovalAndDecide(deps, taskId, argsByCall, signa
         decideSpan.close();
     }
 }
+const _boundGrantsPin = [true, true, true];
+void _boundGrantsPin;
 function readReadRootCandidate(v) {
     if (typeof v !== 'object' || v === null)
         return undefined;
@@ -385,11 +412,9 @@ export const TOOL_APPROVAL_FRAME_KEYS_MIRROR = [
     'args',
     'argsOmitted',
     'governanceForced',
-    'ruleSuggestions',
     'ruleOffers',
     'ruleOffersAbsence',
     'denialLimitFallback',
-    'ruleStoreUnreadable',
     'readRootCandidate',
     'mandated',
     'mandate',
@@ -399,8 +424,13 @@ export const TOOL_APPROVAL_FRAME_KEYS_MIRROR = [
     'inputHasBidi',
     'parked',
     'persistedRuleShadowed',
+    'allowRuleShadowed',
     'probeCause',
     'probeReason',
+    'rememberRefused',
+    'boundGrantDigest',
+    'boundGrants',
+    'classifierNoRuling',
     'ruleEvidence',
     'requiresRealApproval',
     'expiresInMs',
@@ -445,30 +475,6 @@ export function toolPermissionRequestAskBits(card) {
         ...(askClassPair ?? {}),
     };
 }
-function readAskClassPair(v) {
-    if (typeof v !== 'object' || v === null)
-        return undefined;
-    const askClass = readOwnNonEmptyString(v, 'askClass');
-    if (askClass === undefined || !Object.hasOwn(v, 'classes'))
-        return undefined;
-    const raw = v.classes;
-    if (!Array.isArray(raw) || raw.length === 0)
-        return undefined;
-    const classes = [];
-    const seen = new Set();
-    for (let i = 0; i < raw.length; i++) {
-        if (!Object.hasOwn(raw, i))
-            return undefined;
-        const c = raw[i];
-        if (typeof c !== 'string' || c === '' || seen.has(c))
-            return undefined;
-        seen.add(c);
-        classes.push(c);
-    }
-    if (classes[0] !== askClass)
-        return undefined;
-    return { askClass, classes: Object.freeze(classes) };
-}
 function hasOwnStrictTrue(v, key) {
     return Object.hasOwn(v, key) && v[key] === true;
 }
@@ -575,13 +581,50 @@ function readPersistedRuleAnchors(v) {
 function isNonNegativeSafeInt(v) {
     return typeof v === 'number' && Number.isSafeInteger(v) && v >= 0;
 }
-function shouldResendWithoutAttribution(e, sentSettledBy, signal) {
-    if (!sentSettledBy)
+function shouldResendWithoutAttribution(e, sentAttributionKey, signal) {
+    if (!sentAttributionKey)
         return false;
     if (signal?.aborted === true)
         return false;
     return denyAttributionRefusalFromError(e, true)?.kind === 'not_in_proof';
 }
+function shouldResendUnderSuccessorKey(e, lastSendCarriedRetiredKey, signal) {
+    if (!lastSendCarriedRetiredKey)
+        return false;
+    if (signal?.aborted === true)
+        return false;
+    return denyAttributionRefusalFromError(e, true)?.kind === 'retired_key';
+}
+export function decisionAttributionKeyOf(reading, denySettledBy) {
+    if (denySettledBy !== 'policy')
+        return {};
+    return approvalDecidedByAdmitted(reading) ? { decidedBy: 'policy' } : { settledBy: 'policy' };
+}
+function carriesAttributionKey(body) {
+    return Object.hasOwn(body, 'settledBy') || Object.hasOwn(body, 'decidedBy');
+}
+function withoutAttributionKey(body) {
+    const { settledBy: _droppedSettledBy, decidedBy: _droppedDecidedBy, ...rest } = body;
+    void _droppedSettledBy;
+    void _droppedDecidedBy;
+    return rest;
+}
+function withAttributionKeyRenamed(body) {
+    const { settledBy, decidedBy: _replaced, ...rest } = body;
+    void _replaced;
+    return settledBy === undefined ? rest : { ...rest, decidedBy: settledBy };
+}
+function readDecidedByReadingOf(holder) {
+    try {
+        return readOwnDataValue(holder, 'approvalDecidedBy');
+    }
+    catch {
+        return undefined;
+    }
+}
+function decidedByReadingSnapshotOf(holder) {
+    return approvalDecidedByAdmitted(readDecidedByReadingOf(holder)) ? Object.freeze({ kind: 'present', value: true }) : undefined;
+}
 export function readToolApprovalRespondRefusal(err) {
     const pick = (key) => {
         try {
@@ -663,6 +706,14 @@ function readProbeReason(v) {
         return undefined;
     }
 }
+function readRememberRefused(v) {
+    try {
+        return typeof v === 'object' && v !== null && Object.hasOwn(v, 'rememberRefused') && v.rememberRefused === true;
+    }
+    catch {
+        return false;
+    }
+}
 function isNonNegativeFinite(v) {
     return typeof v === 'number' && Number.isFinite(v) && v >= 0;
 }
@@ -688,9 +739,6 @@ export function readDenialLimitFallback(v) {
         autoDenyAfterMs: d.autoDenyAfterMs,
     };
 }
-function readRuleStoreUnreadable(v) {
-    return isRuleStoreUnreadableKind(v) ? v : undefined;
-}
 function isRuleOfferMatch(v) {
     return typeof v === 'string' && RULE_OFFER_MATCHES.includes(v);
 }
@@ -809,24 +857,8 @@ export function readRuleOffers(v) {
     }
     return out.length > 0 ? out : undefined;
 }
-function readLegacyRuleSuggestions(v) {
-    if (!Array.isArray(v))
-        return undefined;
-    if (v.length === 0 || v.length > MAX_RULE_OFFERS_TOLERATED)
-        return undefined;
-    const out = [];
-    for (let i = 0; i < v.length; i++) {
-        const triple = readRuleTriple(v[i]);
-        if (triple === undefined)
-            continue;
-        out.push({ kind: 'single', offerIndex: i, ...triple });
-    }
-    return out.length > 0 ? out : undefined;
-}
-export function readRuleOfferSupply(offers, legacy) {
-    if (offers !== undefined && offers !== null)
-        return readRuleOffers(offers);
-    return readLegacyRuleSuggestions(legacy);
+export function readRuleOfferSupply(offers) {
+    return readRuleOffers(offers);
 }
 function subagentBadgeFor(frame) {
     let name = typeof frame.sourceAgentName === 'string' && frame.sourceAgentName.length > 0 ? frame.sourceAgentName : '';
@@ -850,6 +882,7 @@ const MAX_RESPOND_NOTE_CHARS = 2048;
 export async function surfaceToolApprovalFrameAndRespond(frame, respond, streamArgs, signal, lane) {
     const approvalId = frame.approvalId;
     const frameToolCallId = typeof frame.toolCallId === 'string' && frame.toolCallId !== '' ? frame.toolCallId : undefined;
+    const decidedByReading = decidedByReadingSnapshotOf(lane);
     const toolName = typeof frame.toolName === 'string' ? frame.toolName : 'Write';
     let args = streamArgs !== undefined && streamArgs !== null
         ? streamArgs
@@ -874,8 +907,9 @@ export async function surfaceToolApprovalFrameAndRespond(frame, respond, streamA
         }
     }
     const argsNotRealInput = argsFallback || lane?.argsUnavailable === true;
-    const ruleOffers = readRuleOfferSupply(frame.ruleOffers, frame.ruleSuggestions);
+    const ruleOffers = readRuleOffers(frame.ruleOffers);
     const denialLimitFallback = readDenialLimitFallback(frame.denialLimitFallback);
+    const frameShadow = readAllowRuleShadowFromWire(frame, 'frame');
     const card = await surfaceApprovalCard({
         toolName,
         args: args,
@@ -902,11 +936,11 @@ export async function surfaceToolApprovalFrameAndRespond(frame, respond, streamA
             ? { delegation: frame.delegation }
             : {}),
         ...(ruleOffers !== undefined ? { ruleOffers } : {}),
-        ...(typeof frame.persistedRuleShadowed === 'string' && frame.persistedRuleShadowed.trim() !== ''
-            ? { persistedRuleShadowed: frame.persistedRuleShadowed }
-            : {}),
+        ...((sh) => (sh !== undefined ? { allowRuleShadow: sh } : {}))(frameShadow),
+        ...((t) => (t !== undefined ? { persistedRuleShadowed: t } : {}))(legacyShadowedRuleTextOf(frameShadow)),
         ...(isWireRecordCarrier(frame.probeCause) ? { probeCause: frame.probeCause } : {}),
         ...((r) => (r !== undefined ? { probeReason: r } : {}))(readProbeReason(frame)),
+        ...(readRememberRefused(frame) ? { rememberRefused: true } : {}),
         ...(isWireRecordCarrier(frame.ruleEvidence) ? { ruleEvidence: frame.ruleEvidence } : {}),
         ...(frame.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
         ...(hasOwnStrictTrue(frame, 'mandated') ? { mandated: true } : {}),
@@ -917,7 +951,6 @@ export async function surfaceToolApprovalFrameAndRespond(frame, respond, streamA
             ? { ruleOffersAbsence: frame.ruleOffersAbsence }
             : {}),
         ...(denialLimitFallback !== undefined ? { denialLimitFallback } : {}),
-        ...((k) => (k !== undefined ? { ruleStoreUnreadable: k } : {}))(readRuleStoreUnreadable(frame.ruleStoreUnreadable)),
         ...((o) => (o !== undefined ? { origin: o } : {}))(readOwnNonEmptyString(frame, 'origin')),
         ...(readAskClassPair(frame) ?? {}),
     });
@@ -932,8 +965,9 @@ export async function surfaceToolApprovalFrameAndRespond(frame, respond, streamA
     }
     const decision = card.kind === 'allow' ? (card.allowSession ? 'allow_session' : 'allow') : 'deny';
     const denySettledByForWire = card.kind === 'deny' ? readApprovalDenySettledBy(card) : undefined;
-    const sentSettledBy = decision === 'deny' && denySettledByForWire === 'policy';
-    let lastSendCarriedAttribution = sentSettledBy;
+    const attributionKeys = decision === 'deny' ? decisionAttributionKeyOf(decidedByReading, denySettledByForWire) : {};
+    const sentAttributionKey = carriesAttributionKey(attributionKeys);
+    let lastSendCarriedAttribution = sentAttributionKey;
     const denyReasonSnapshot = card.kind === 'deny' && typeof card.reason === 'string' ? card.reason : undefined;
     if (card.kind === 'failed') {
         hostLog('debug', `liveToolApprovalWire: approval card unavailable (${card.reason}) — fail-closed deny for ${approvalId}`);
@@ -960,14 +994,14 @@ export async function surfaceToolApprovalFrameAndRespond(frame, respond, streamA
         let persistRuleBatchOfferIndex;
         let batchArmTarget;
         let ruleArmDroppedForCaps = false;
-        let ruleArmDroppedForCheck = false;
+        let ruleArmDroppedForCheck;
         const wantsTextArm = card.kind === 'allow' && typeof card.persistRule === 'string' && card.persistRule !== '';
         const wantsBatchArm = card.kind === 'allow' && card.persistRuleBatchOfferIndex !== undefined;
         if (wantsTextArm && wantsBatchArm) {
             hostLog('error', `liveToolApprovalWire: DROPPING the whole persistRule arm for ${approvalId} — the card returned BOTH a rule ` +
                 'text and a batchOfferIndex; the server rejects that combination with a 400 that would take the decision down ' +
                 'with it, and picking one arm here would be deciding on the user\'s behalf (the decision itself still goes through)');
-            ruleArmDroppedForCheck = true;
+            ruleArmDroppedForCheck = 'both_arms';
         }
         else if (card.kind === 'allow' &&
             card.persistRuleBatchOfferIndex !== undefined &&
@@ -992,7 +1026,7 @@ export async function surfaceToolApprovalFrameAndRespond(frame, respond, streamA
                 hostLog('error', `liveToolApprovalWire: DROPPING persistRuleBatchOfferIndex(${String(idx)}) for ${approvalId} — that wire ` +
                     'index is not a batch offer on this frame (out of range, a single offer, or not a non-negative integer); ' +
                     'never redeeming an index the engine did not offer as a batch');
-                ruleArmDroppedForCheck = true;
+                ruleArmDroppedForCheck = 'index_not_a_batch_offer';
             }
         }
         else if (wantsTextArm && card.kind === 'allow' && typeof card.persistRule === 'string' && decision !== 'deny') {
@@ -1014,7 +1048,7 @@ export async function surfaceToolApprovalFrameAndRespond(frame, respond, streamA
             }
             else {
                 hostLog('error', `liveToolApprovalWire: DROPPING persistRule for ${approvalId} — the card returned a rule that is not among the frame's SINGLE offers (a batch member's text is not a selectable candidate either: a conjunction batch is redeemed by index, all-or-nothing) — never sending un-offered text to the rule store`);
-                ruleArmDroppedForCheck = true;
+                ruleArmDroppedForCheck = 'text_not_offered';
             }
         }
         const respondOpts = {
@@ -1024,24 +1058,48 @@ export async function surfaceToolApprovalFrameAndRespond(frame, respond, streamA
             ...(persistRuleEdited !== undefined ? { persistRuleEdited } : {}),
             ...(persistRuleBatchOfferIndex !== undefined ? { persistRuleBatchOfferIndex } : {}),
             ...(note !== undefined ? { note } : {}),
-            ...(sentSettledBy ? { settledBy: 'policy' } : {}),
+            ...attributionKeys,
         };
         let attributionDropped = false;
+        let attributionRenamed = false;
         let raw;
         try {
             raw = await respond(approvalId, decision, respondOpts);
         }
         catch (first) {
-            if (!shouldResendWithoutAttribution(first, lastSendCarriedAttribution, signal))
+            if (shouldResendWithoutAttribution(first, lastSendCarriedAttribution, signal)) {
+                const withoutAttribution = withoutAttributionKey(respondOpts);
+                lastSendCarriedAttribution = false;
+                hostLog('debug', `liveToolApprovalWire: respond(deny) for ${approvalId} was refused because the settlement note is not part of ` +
+                    'what this deployment signs — re-sending the SAME decision exactly once with that one key removed ' +
+                    '(the refusal happened before the approval was judged, so nothing was consumed and this is a re-delivery, not a second act)');
+                raw = await respond(approvalId, decision, withoutAttribution);
+                attributionDropped = true;
+            }
+            else if (shouldResendUnderSuccessorKey(first, Object.hasOwn(respondOpts, 'settledBy'), signal)) {
+                const renamed = withAttributionKeyRenamed(respondOpts);
+                hostLog('debug', `liveToolApprovalWire: respond(deny) for ${approvalId} was refused because the settlement note was sent under a name ` +
+                    'this engine has retired — re-sending the SAME decision exactly once with that one key renamed to the name the refusal points to ' +
+                    '(the refusal happened before the approval was judged, so nothing was consumed and this is a re-delivery, not a second act)');
+                try {
+                    raw = await respond(approvalId, decision, renamed);
+                    attributionRenamed = true;
+                }
+                catch (second) {
+                    if (!shouldResendWithoutAttribution(second, true, signal))
+                        throw second;
+                    const renamedWithoutAttribution = withoutAttributionKey(renamed);
+                    lastSendCarriedAttribution = false;
+                    hostLog('debug', `liveToolApprovalWire: respond(deny) for ${approvalId} was refused again because the settlement note is not part of ` +
+                        'what this deployment signs — re-sending the SAME decision exactly once more with that key removed ' +
+                        '(still before the approval was judged)');
+                    raw = await respond(approvalId, decision, renamedWithoutAttribution);
+                    attributionDropped = true;
+                }
+            }
+            else {
                 throw first;
-            const { settledBy: _droppedKey, ...withoutAttribution } = respondOpts;
-            void _droppedKey;
-            lastSendCarriedAttribution = false;
-            hostLog('debug', `liveToolApprovalWire: respond(deny) for ${approvalId} was refused because the settlement note is not part of ` +
-                'what this deployment signs — re-sending the SAME decision exactly once with that one key removed ' +
-                '(the refusal happened before the approval was judged, so nothing was consumed and this is a re-delivery, not a second act)');
-            raw = await respond(approvalId, decision, withoutAttribution);
-            attributionDropped = true;
+            }
         }
         const parsed = readToolApprovalRespondAck(raw);
         let ack = parsed;
@@ -1097,8 +1155,8 @@ export async function surfaceToolApprovalFrameAndRespond(frame, respond, streamA
         }
         if (ruleArmDroppedForCaps)
             surfaceRuleArmNotSent();
-        if (ruleArmDroppedForCheck)
-            surfaceRuleArmRejected();
+        if (ruleArmDroppedForCheck !== undefined)
+            surfaceRuleArmRejected(ruleArmDroppedForCheck);
         if (decision === 'allow_session' && ack?.rememberApplied === false) {
             logAfterDecided(`liveToolApprovalWire: ${approvalId} allow_session ack rememberApplied=false — grant not stored, surfacing honest notice`);
             surfaceRememberNotApplied();
@@ -1114,6 +1172,7 @@ export async function surfaceToolApprovalFrameAndRespond(frame, respond, streamA
         const denyAttribution = decision === 'deny'
             ? {
                 ...(attributionDropped ? { denyAttributionDropped: true } : {}),
+                ...(attributionRenamed ? { denyAttributionRenamed: true } : {}),
                 ...(denySettledByForWire !== undefined ? { denySettledBy: denySettledByForWire } : {}),
                 ...(denyReasonSnapshot !== undefined && denyReasonSnapshot.trim() !== ''
                     ? { denyReason: denyReasonSnapshot }

package/dist/hookMatcherVerdict.js

@@ -1,5 +1,6 @@
 import { HOOK_TOOL_ALIASES } from './hookToolAliases.js';
-const TOOL_NAME_MATCHER_EVENTS = new Set(['PreToolUse', 'PostToolUse', 'PostToolUseFailure']);
+import { SETTINGS_TOOL_NAME_MATCHER_EVENTS } from './generated/settingsSchemaTables.js';
+const TOOL_NAME_MATCHER_EVENTS = new Set(SETTINGS_TOOL_NAME_MATCHER_EVENTS);
 const MATCHER_MAX_CHARS = 8192;
 const PATTERN_WORK_BUDGET = 10_000_000;
 const PATTERN_MAX_DEPTH = 32;

package/dist/hooksWireCaps.d.ts

@@ -1,7 +1,7 @@
 import { type HooksWirePlan, type HooksWirePlanOptions } from './pluginHooksWire.js';
 import { type HookFailureNotice } from './notifications.js';
 import type { WireHooksConfig } from './finalVerifyWire.js';
-export { GOAL_STOP_HOOK_WIRE_ENV, CC_STOP_SEMANTICS_MIN_SERVER, ccStopSemanticsFromVersion, engineCcStopSemantics, isGoalStopHookWireArmed, setWireSessionStopHook, getWireSessionStopHook, getWireSessionStopHookCcSemantics, buildGoalStopHookPrompt, } from './goalStopHook.js';
+export { GOAL_STOP_HOOK_WIRE_ENV, isGoalStopHookWireArmed, setWireSessionStopHook, getWireSessionStopHook, } from './goalStopHook.js';
 export type { WireHooksConfig };
 export interface HooksForWireOptions {
     readonly plan?: HooksWirePlan;

package/dist/hooksWireCaps.js

@@ -5,7 +5,7 @@ import { hostLog, hostSettings } from './host.js';
 import { createSettingsHookJudge, decidePluginHooks, dedupeSettingsHookGroups, filterSettingsHookGroups, occupancyOf, settingsHookDropText, } from './pluginHooksWire.js';
 import { MAX_HOOK_NOTICE_TEXT_CHARS } from './notifications.js';
 import { goalStopHookMatcher, __resetGoalStopHookForTests } from './goalStopHook.js';
-export { GOAL_STOP_HOOK_WIRE_ENV, CC_STOP_SEMANTICS_MIN_SERVER, ccStopSemanticsFromVersion, engineCcStopSemantics, isGoalStopHookWireArmed, setWireSessionStopHook, getWireSessionStopHook, getWireSessionStopHookCcSemantics, buildGoalStopHookPrompt, } from './goalStopHook.js';
+export { GOAL_STOP_HOOK_WIRE_ENV, isGoalStopHookWireArmed, setWireSessionStopHook, getWireSessionStopHook, } from './goalStopHook.js';
 const EDITABLE_HOOK_SOURCES = ['userSettings', 'projectSettings', 'localSettings'];
 const ALL_HOOK_SOURCES = ['policySettings', ...EDITABLE_HOOK_SOURCES, 'flagSettings'];
 const _hookSourceListsPin = [true, true];