@sema-agent/client-core 0.95.0 → 0.97.0

package/dist/cloudConfigWireCaps.js

@@ -3,6 +3,7 @@ import { toCappedSpec } from './skillsWireCaps.js';
 import { TIER_ORDER } from './model/tierVocabulary.js';
 import { SETTINGS_NARROW_AT_MENTION } from './generated/settingsSchemaFns.js';
 import { modelsPolicyOf } from './model/modelsPolicy.js';
+import { guardedRead, readOwnDataNonEmptyString, readOwnDataValue } from './ownKey.js';
 import { SETTINGS_BUDGET_NUMBER_KEYS, SETTINGS_BUDGET_PER_MODEL_NUMBER_KEYS, SETTINGS_BUDGET_STRING_KEYS, SETTINGS_TIER_GROUP_NAME_RE, } from './generated/settingsSchemaTables.js';
 const asRec = (v) => (typeof v === 'object' && v !== null && !Array.isArray(v) ? v : undefined);
 const asArr = (v) => (Array.isArray(v) ? v : []);
@@ -62,6 +63,10 @@ export function cloudMcpToSpecs(servers, env) {
                 drop(name, 'missing-field');
                 continue;
             }
+            if (asStr(t.principalHeader) && asStr(t.assertionHeader)) {
+                drop(name, 'principal-and-assertion-header');
+                continue;
+            }
             const headers = {};
             for (const [headerName, ref] of Object.entries(asRec(t.headerRefs) ?? {})) {
                 const refName = asStr(ref);
@@ -92,6 +97,7 @@ export function cloudMcpToSpecs(servers, env) {
             ...(allowTools.length > 0 ? { allowTools } : {}),
             ...(s.elicitation === true ? { elicitation: true } : {}),
             ...(s.toolFaces !== undefined ? { toolFaces: s.toolFaces } : {}),
+            ...(s.toolAxes !== undefined ? { toolAxes: s.toolAxes } : {}),
         });
     }
     return { specs, missingEnv: [...new Set(missingEnv)], droppedServers };
@@ -136,6 +142,9 @@ const TIER_GROUP_NAME = SETTINGS_TIER_GROUP_NAME_RE;
 const setOwn = (o, k, v) => {
     Object.defineProperty(o, k, { value: v, enumerable: true, writable: true, configurable: true });
 };
+function modelsDocPositionOf(m, key) {
+    return guardedRead(() => (Object.hasOwn(m, key) ? { value: m[key] } : 'absent')) ?? 'unreadable';
+}
 function modelsDocOf(models, opts) {
     const m = asRec(models);
     if (!m || !Array.isArray(m.models))
@@ -165,9 +174,12 @@ function modelsDocOf(models, opts) {
     };
     const refOf = (v) => (typeof v === 'string' && v !== '' ? { target: v } : {});
     const reasonOf = (v) => typeof v === 'string' && v !== '' ? (rawNames.has(v) ? 'rejected' : 'dangling') : 'unreadable';
+    const modelRefVerdict = (v) => names.has(v) ? (accept === undefined ? 'unvouched' : 'accepted') : reasonOf(v);
     let written = stripped;
+    let catalogKept = false;
     if (acceptedFlags && stripped.length > 0) {
         const anyAccepted = acceptedFlags.some((f) => f);
+        catalogKept = !anyAccepted;
         stripped.forEach((e, i) => {
             if (!acceptedFlags[i])
                 issues.push({ key: 'models', target: e.name, reason: 'rejected', outcome: anyAccepted ? 'dropped' : 'kept' });
@@ -178,108 +190,156 @@ function modelsDocOf(models, opts) {
     const doc = { models: written };
     const policy = modelsPolicyOf(m);
     if (policy.unreadable) {
-        drop({ key: 'default', reason: 'unreadable' });
-        drop({ key: 'atModelAllowlist', at: 'models', reason: 'unreadable' });
+        drop({ key: 'roles', at: 'default', reason: 'unreadable' });
+        drop({ key: 'atMention', at: 'models', reason: 'unreadable' });
     }
     if (policy.defaultUnreadable)
-        drop({ key: 'default', reason: 'unreadable' });
+        drop({ key: 'roles', at: 'default', reason: 'unreadable' });
     const dm = policy.defaultModel;
-    if (accept && dm !== undefined) {
-        if (names.has(dm.name))
-            doc.default = dm.name;
+    let defaultRole;
+    let defaultWinner;
+    if (dm !== undefined && dm.from === 'default') {
+        const verdict = modelRefVerdict(dm.name);
+        if (verdict === 'accepted')
+            defaultRole = { model: dm.name };
         else
-            drop({ key: 'default', target: dm.name, reason: reasonOf(dm.name) });
+            drop({ key: 'roles', at: 'default', target: dm.name, reason: verdict });
+        if (verdict === 'accepted' || verdict === 'unvouched')
+            defaultWinner = dm.name;
     }
     const roles = asRec(m.roles);
-    if (roles) {
-        const kept = {};
-        for (const [role, t] of Object.entries(roles)) {
-            if (role === 'default' && accept && dm?.from === 'roles.default')
-                continue;
+    const keptRoles = {};
+    let sameModelDefaultRole;
+    for (const [role, t] of Object.entries(roles ?? {})) {
+        if (role === 'default' && defaultWinner !== undefined) {
             const tr = asRec(t);
-            const model = tr && Object.hasOwn(tr, 'model') ? tr.model : undefined;
-            if (typeof model === 'string' && !names.has(model)) {
-                drop({ key: 'roles', at: role, ...refOf(model), reason: reasonOf(model) });
+            let model;
+            let snapshot;
+            try {
+                model = tr && Object.hasOwn(tr, 'model') ? tr.model : undefined;
+                if (tr !== undefined && typeof model === 'string' && model === defaultWinner) {
+                    snapshot = {};
+                    for (const [k, v] of Object.entries(tr))
+                        setOwn(snapshot, k, v);
+                    setOwn(snapshot, 'model', model);
+                }
+            }
+            catch {
+                model = undefined;
+                snapshot = undefined;
+            }
+            if (snapshot !== undefined)
+                sameModelDefaultRole = snapshot;
+            else
+                drop({ key: 'roles', at: 'default', ...refOf(model), reason: 'shadowed' });
+            continue;
+        }
+        const tr = asRec(t);
+        const model = tr && Object.hasOwn(tr, 'model') ? tr.model : undefined;
+        if (typeof model === 'string') {
+            const verdict = modelRefVerdict(model);
+            if (verdict !== 'accepted') {
+                drop({ key: 'roles', at: role, ...refOf(model), reason: verdict });
                 continue;
             }
-            setOwn(kept, role, t);
         }
-        doc.roles = kept;
+        setOwn(keptRoles, role, t);
     }
+    const rolesOut = {};
+    if (defaultRole !== undefined)
+        setOwn(rolesOut, 'default', sameModelDefaultRole ?? defaultRole);
+    else if (Object.hasOwn(keptRoles, 'default'))
+        setOwn(rolesOut, 'default', keptRoles.default);
+    for (const [k, v] of Object.entries(keptRoles))
+        if (k !== 'default')
+            setOwn(rolesOut, k, v);
+    if (Object.keys(rolesOut).length > 0)
+        doc.roles = rolesOut;
     const am = policy.atMention;
     if (am?.kind === 'unreadable') {
-        drop({ key: 'atModelAllowlist', at: am.from, reason: 'unreadable' });
+        drop({ key: 'atMention', at: am.from, reason: 'unreadable' });
     }
     else if (am !== undefined) {
         for (let i = 0; i < am.unreadableEntries; i += 1)
-            drop({ key: 'atModelAllowlist', reason: 'unreadable' });
+            drop({ key: 'atMention', reason: 'unreadable' });
         const v = am.value;
-        if (v.mode === 'none') {
-            drop({ key: 'atModelAllowlist', at: 'atMention', reason: 'unsupported' });
-        }
-        else if (v.mode === 'only') {
+        if (v.mode === 'only') {
+            for (const n of v.models)
+                if (!names.has(n))
+                    drop({ key: 'atMention', target: n, reason: reasonOf(n) });
             const narrowed = SETTINGS_NARROW_AT_MENTION(v, names);
             if (narrowed.mode === 'only') {
-                for (const n of v.models)
-                    if (!names.has(n))
-                        drop({ key: 'atModelAllowlist', target: n, reason: reasonOf(n) });
-                doc.atModelAllowlist = [...narrowed.models];
+                doc.atMention = { mode: 'only', models: [...narrowed.models] };
             }
             else {
-                doc.atModelAllowlist = [...v.models];
-                for (const n of v.models)
-                    issues.push({ key: 'atModelAllowlist', target: n, reason: reasonOf(n), outcome: 'kept' });
+                doc.atMention = { mode: narrowed.mode };
+                if (narrowed.mode === 'none' && !catalogKept)
+                    drop({ key: 'atMention', at: 'atMention', reason: 'dangling' });
             }
         }
+        else if (v.mode === 'none') {
+            doc.atMention = { mode: 'none' };
+        }
     }
     let groupNames;
-    const rawGroupNames = new Set((Array.isArray(m.tierGroups) ? m.tierGroups : []).map((g) => asStr(asRec(g)?.name)).filter((n) => !!n));
-    if (accept && Object.hasOwn(m, 'tierGroups')) {
-        if (!Array.isArray(m.tierGroups)) {
-            drop({ key: 'tierGroups', reason: 'unreadable' });
+    if (accept) {
+        const tg = modelsDocPositionOf(m, 'tierGroups');
+        const atg = modelsDocPositionOf(m, 'activeTierGroup');
+        const tgValue = typeof tg === 'object' ? tg.value : undefined;
+        const rawGroupNames = new Set((Array.isArray(tgValue) ? tgValue : []).map((g) => asStr(asRec(g)?.name)).filter((n) => !!n));
+        if (tg === 'unreadable') {
+            drop({ key: 'tierGroups', at: 'models', reason: 'unreadable' });
         }
-        else {
-            const groups = [];
-            groupNames = new Set();
-            for (const raw of m.tierGroups) {
-                const g = asRec(raw);
-                const name = g ? asStr(g.name) : undefined;
-                if (!g || !name || !TIER_GROUP_NAME.test(name)) {
-                    drop({ key: 'tierGroups', ...(name ? { at: name } : {}), reason: 'unreadable' });
-                    continue;
-                }
-                if (groupNames.has(name)) {
-                    drop({ key: 'tierGroups', at: name, reason: 'duplicate' });
-                    continue;
-                }
-                groupNames.add(name);
-                const tiers = {};
-                if (Object.hasOwn(g, 'tiers')) {
-                    const t = asRec(g.tiers);
-                    if (!t)
-                        drop({ key: 'tierGroups', at: `${name}.tiers`, reason: 'unreadable' });
-                    else {
-                        for (const [tier, model] of Object.entries(t)) {
-                            if (!TIER_WORDS.includes(tier))
-                                drop({ key: 'tierGroups', at: `${name}.${tier}`, ...refOf(model), reason: 'unsupported' });
-                            else if (typeof model === 'string' && names.has(model))
-                                setOwn(tiers, tier, model);
-                            else
-                                drop({ key: 'tierGroups', at: `${name}.${tier}`, ...refOf(model), reason: reasonOf(model) });
+        else if (tg !== 'absent') {
+            if (!Array.isArray(tgValue)) {
+                drop({ key: 'tierGroups', reason: 'unreadable' });
+            }
+            else {
+                const groups = [];
+                groupNames = new Set();
+                for (const raw of tgValue) {
+                    const g = asRec(raw);
+                    const name = g ? asStr(g.name) : undefined;
+                    if (!g || !name || !TIER_GROUP_NAME.test(name)) {
+                        drop({ key: 'tierGroups', ...(name ? { at: name } : {}), reason: 'unreadable' });
+                        continue;
+                    }
+                    if (groupNames.has(name)) {
+                        drop({ key: 'tierGroups', at: name, reason: 'duplicate' });
+                        continue;
+                    }
+                    groupNames.add(name);
+                    const tiers = {};
+                    if (Object.hasOwn(g, 'tiers')) {
+                        const t = asRec(g.tiers);
+                        if (!t)
+                            drop({ key: 'tierGroups', at: `${name}.tiers`, reason: 'unreadable' });
+                        else {
+                            for (const [tier, model] of Object.entries(t)) {
+                                if (!TIER_WORDS.includes(tier))
+                                    drop({ key: 'tierGroups', at: `${name}.${tier}`, ...refOf(model), reason: 'unsupported' });
+                                else if (typeof model === 'string' && names.has(model))
+                                    setOwn(tiers, tier, model);
+                                else
+                                    drop({ key: 'tierGroups', at: `${name}.${tier}`, ...refOf(model), reason: reasonOf(model) });
+                            }
                         }
                     }
+                    groups.push({ name, tiers, ...(typeof g.notes === 'string' ? { notes: g.notes } : {}) });
                 }
-                groups.push({ name, tiers, ...(typeof g.notes === 'string' ? { notes: g.notes } : {}) });
+                doc.tierGroups = groups;
             }
-            doc.tierGroups = groups;
         }
-    }
-    if (accept && Object.hasOwn(m, 'activeTierGroup')) {
-        const a = m.activeTierGroup;
-        if (typeof a === 'string' && groupNames?.has(a))
-            doc.activeTierGroup = a;
-        else
-            drop({ key: 'activeTierGroup', ...refOf(a), reason: typeof a === 'string' && a !== '' ? (rawGroupNames.has(a) ? 'rejected' : 'dangling') : 'unreadable' });
+        if (atg === 'unreadable') {
+            drop({ key: 'activeTierGroup', at: 'models', reason: 'unreadable' });
+        }
+        else if (atg !== 'absent') {
+            const a = atg.value;
+            if (typeof a === 'string' && groupNames?.has(a))
+                doc.activeTierGroup = a;
+            else
+                drop({ key: 'activeTierGroup', ...refOf(a), reason: typeof a === 'string' && a !== '' ? (rawGroupNames.has(a) ? 'rejected' : 'dangling') : 'unreadable' });
+        }
     }
     return { doc, issues };
 }
@@ -536,13 +596,17 @@ function droppedRefNotice(d) {
     switch (d.key) {
         case 'models':
             return { level: 'warn', text: `cloud config: ${t === undefined ? 'a model entry' : `model "${t}"`} ${ENTRY_REJECTED} — it was left out of the local catalog` };
-        case 'default':
-            return { level: 'warn', text: `cloud config: ${t === undefined ? 'the default model setting could not be read' : `the default model "${t}" ${notServed}`}, so it was left out — the local engine picks its default from roles and tiers instead` };
         case 'roles':
+            if (d.at === 'default' && d.reason === 'unreadable')
+                return { level: 'warn', text: 'cloud config: the default model setting could not be read, so it was left out — the local engine picks its default from roles and tiers instead' };
+            if (d.reason === 'unvouched')
+                return { level: 'warn', text: `cloud config: role "${d.at ?? ''}" points at model "${t ?? ''}", but this client was given no way to check that the local engine can use that model — the role was left out and falls back along the engine's role chain` };
+            if (d.reason === 'shadowed')
+                return { level: 'warn', text: `cloud config: the "${d.at ?? ''}" role${t === undefined ? '' : ` ("${t}")`} is overridden by the default model setting served to you — only one default model can be set, so that role entry was left out` };
             return { level: 'warn', text: `cloud config: role "${d.at ?? ''}" ${t === undefined ? 'names no readable model' : `points at model "${t}", which ${notServed}`} — the role was left out and falls back along the engine's role chain` };
-        case 'atModelAllowlist':
-            if (d.reason === 'unsupported')
-                return { level: 'warn', text: 'cloud config: the @-mention setting served to you allows no model to be @-mentioned, which the local engine\'s settings format cannot express — it was left out, so @-mentions are not restricted on the local engine' };
+        case 'atMention':
+            if (d.at === 'atMention' && d.reason === 'dangling')
+                return { level: 'warn', text: 'cloud config: none of the models in the @-mention allowlist served to you can be used on the local engine, so @-mentions are turned off there' };
             if (d.at !== undefined)
                 return { level: 'warn', text: 'cloud config: the @-mention setting served to you could not be read by this client — it was left out, so @-mentions are not restricted on the local engine' };
             return { level: 'warn', text: `cloud config: ${t === undefined ? 'an unreadable @-mention allowlist entry' : `@-mention allowlist entry "${t}" ${notServed} and`} was left out` };
@@ -553,11 +617,111 @@ function droppedRefNotice(d) {
                 return { level: 'warn', text: `cloud config: tier "${d.at ?? ''}" is bound to model "${t ?? ''}", which ${notServed} — that tier was left unbound` };
             if (d.reason === 'unsupported')
                 return { level: 'warn', text: `cloud config: tier "${d.at ?? ''}" is not a tier the local engine reads (${TIER_WORDS.join(', ')}) — that binding was left out` };
+            if (d.at === 'models')
+                return { level: 'warn', text: 'cloud config: the tier group settings served to you could not be read by this client — they were left out, so no tier groups are set on the local engine' };
             return { level: 'warn', text: `cloud config: a tier group setting${d.at === undefined ? '' : ` ("${d.at}")`} could not be read and was left out` };
         case 'activeTierGroup':
             return { level: 'warn', text: `cloud config: ${t === undefined ? 'the active tier group setting could not be read' : `the active tier group "${t}" is not among the readable tier groups`} — no tier table is active on the local engine` };
     }
 }
+const MCP_DROP_SENTENCES = {
+    'missing-field': {
+        level: 'warn',
+        text: (who) => `cloud config: MCP server entries left out because a required setting is missing or unreadable (a name, a transport, or its command or address): ${who}`,
+    },
+    'unknown-transport': {
+        level: 'warn',
+        text: (who) => `cloud config: MCP server entries left out because their transport is not one this client supports: ${who}`,
+    },
+    'principal-and-assertion-header': {
+        level: 'warn',
+        text: (who) => `cloud config: MCP server entries left out because they set both principalHeader and assertionHeader, which name the same identity header — keep only one of the two: ${who}`,
+    },
+    capped: {
+        level: 'warn',
+        text: (who) => `cloud config: MCP server entries left out because more than ${MCP_CAPS.items} were served to you and this client passes at most ${MCP_CAPS.items} to the engine: ${who}`,
+    },
+    disabled: {
+        level: 'info',
+        text: (who) => `cloud config: MCP server entries switched off in the served settings, so they are not started here: ${who}`,
+    },
+};
+const MCP_DROP_UNRECOGNISED = (who) => `cloud config: MCP server entries left out for a reason this client does not recognise: ${who}`;
+const MCP_DROP_LIST_UNREADABLE = 'cloud config: the list of MCP server entries left out could not be read by this client — servers missing from the local tool list may have been left out without notice';
+const MCP_DROP_NAMES_SHOWN = 5;
+function mcpDropWho(names, unnamed) {
+    const distinct = [...new Set(names)];
+    const parts = distinct.slice(0, MCP_DROP_NAMES_SHOWN).map((n) => `"${n}"`);
+    if (distinct.length > MCP_DROP_NAMES_SHOWN)
+        parts.push(`+${distinct.length - MCP_DROP_NAMES_SHOWN} more`);
+    if (unnamed > 0)
+        parts.push(`${unnamed} without a readable name`);
+    return parts.join(', ');
+}
+function guarded(read) {
+    try {
+        return read();
+    }
+    catch {
+        return undefined;
+    }
+}
+function droppedMcpNotices(carrier) {
+    const listUnreadable = [{ level: 'warn', text: MCP_DROP_LIST_UNREADABLE }];
+    let desc;
+    try {
+        desc = Object.getOwnPropertyDescriptor(carrier, 'droppedMcpServers');
+    }
+    catch {
+        return listUnreadable;
+    }
+    if (desc === undefined)
+        return [];
+    if (!Object.hasOwn(desc, 'value'))
+        return listUnreadable;
+    const rows = desc.value;
+    let count = 0;
+    try {
+        if (!Array.isArray(rows))
+            return listUnreadable;
+        count = rows.length;
+    }
+    catch {
+        return listUnreadable;
+    }
+    const known = new Map();
+    const unrecognised = { names: [], unnamed: 0 };
+    for (let i = 0; i < count; i++) {
+        const row = guarded(() => readOwnDataValue(rows, String(i)));
+        const rowObj = typeof row === 'object' && row !== null ? row : undefined;
+        const reason = guarded(() => {
+            const raw = readOwnDataValue(rowObj, 'reason');
+            return typeof raw === 'string' && Object.hasOwn(MCP_DROP_SENTENCES, raw) ? raw : undefined;
+        });
+        const name = guarded(() => readOwnDataNonEmptyString(rowObj, 'name'));
+        let bucket = unrecognised;
+        if (reason !== undefined) {
+            let b = known.get(reason);
+            if (b === undefined)
+                known.set(reason, (b = { names: [], unnamed: 0 }));
+            bucket = b;
+        }
+        if (name === undefined)
+            bucket.unnamed++;
+        else
+            bucket.names.push(name);
+    }
+    const out = [];
+    for (const reason of Object.keys(MCP_DROP_SENTENCES)) {
+        const b = known.get(reason);
+        if (b !== undefined)
+            out.push({ level: MCP_DROP_SENTENCES[reason].level, text: MCP_DROP_SENTENCES[reason].text(mcpDropWho(b.names, b.unnamed)) });
+    }
+    if (unrecognised.names.length + unrecognised.unnamed > 0) {
+        out.push({ level: 'warn', text: MCP_DROP_UNRECOGNISED(mcpDropWho(unrecognised.names, unrecognised.unnamed)) });
+    }
+    return out;
+}
 function budgetNotice(r) {
     switch (r.kind) {
         case 'configured': {
@@ -625,15 +789,7 @@ export function cloudEffectiveNotices(p) {
                 'the catalog is kept as sent, and a locally started engine rejects the cloud model settings: at startup it uses its own environment catalog instead, and on a later refresh it keeps the previous configuration',
         });
     }
-    const keptAllowlist = p.modelRefIssues.filter((d) => d.outcome === 'kept' && d.key === 'atModelAllowlist');
-    if (keptAllowlist.length > 0) {
-        const names = keptAllowlist.flatMap((d) => (d.target === undefined ? [] : [`"${d.target}"`]));
-        out.push({
-            level: 'warn',
-            text: `cloud config: no @-mention allowlist entry${names.length > 0 ? ` (${names.join(', ')})` : ''} names a usable model in the catalog served to you — ` +
-                'the list is kept as sent, because an empty list would let every model be mentioned; with it, a locally started engine rejects the cloud model settings — at startup it uses its own environment catalog instead, and on a later refresh it keeps the previous configuration',
-        });
-    }
+    out.push(...droppedMcpNotices(p));
     out.push(budgetNotice(p.budget));
     out.push(runtimeCapsNotice(p.runtimeCaps));
     return out;

package/dist/coreValuePorts.d.ts

@@ -91,17 +91,21 @@ export interface PerModelAuthView {
     apiKey?: string;
     headers?: Record<string, string>;
 }
+export type RuleGrammarView = 'command' | 'domain' | 'name' | 'path';
+export interface RuleToolNameVerdictView {
+    readonly kind: 'current' | 'retired' | 'unprefixed_namespace' | 'unmintable_segment' | (string & {});
+    readonly guidance?: string;
+    readonly currentName?: string;
+}
 export interface CoreValuePorts {
     resolveAutonomousLoopPrompt: (prompt: string, opts?: AutonomousLoopPromptOptionsView) => string | null;
     loosenReasons: (prior: SessionPermissionRules, next: SessionPermissionRules) => string[];
     combinePolicies: (...policies: CoreToolPolicyHandle[]) => CoreToolPolicyHandle;
     createAllowDenyPolicy: (opts: AllowDenyPolicyOptionsView) => CoreToolPolicyHandle;
     MCP_NAMESPACE: CoreProtocolNamespaceView;
-    RETIRED_TOOL_NAMES: ReadonlyMap<string, string>;
     protocolOf: (name: string) => CoreProtocolNamespaceView | undefined;
-    ruleToolGrammarOf: (toolName: string) => 'command' | 'path' | undefined;
+    ruleToolGrammarOf: (toolName: string) => RuleGrammarView | undefined;
     validatePermissionRules: (rules: PermissionRuleView[], opts?: ValidatePermissionRulesOptionsView) => PermissionRuleIssueView[];
-    DISCUSSION_WORKFLOW_NAME: string;
     mintNamespacePrefix(ns: CoreProtocolNamespaceView, peer: string): string;
     compileAllowList(entries: readonly string[], behavior: 'allow' | 'deny', roster?: ReadonlySet<string>): AllowListReadingView;
     routeKeyOf(url: string | undefined): string;
@@ -113,8 +117,9 @@ export interface CoreValuePorts {
     routePairingStatus(brain: {
         adjudicateRoute?(model: RouteModelView, perModelAuth?: PerModelAuthView): RouteAdjudicationView | undefined;
     }, model: RouteModelView, perModelAuth?: PerModelAuthView): RoutePairingStatusView;
+    judgeRuleToolName(name: string, roster: ReadonlySet<string>): RuleToolNameVerdictView;
 }
-export declare const CORE_VALUE_PORT_NAMES: readonly ["resolveAutonomousLoopPrompt", "loosenReasons", "combinePolicies", "createAllowDenyPolicy", "MCP_NAMESPACE", "RETIRED_TOOL_NAMES", "protocolOf", "ruleToolGrammarOf", "validatePermissionRules", "DISCUSSION_WORKFLOW_NAME", "mintNamespacePrefix", "compileAllowList", "routeKeyOf", "joinRequestUrl", "resolveRouteCredential", "adjudicateModelRoute", "routePairingStatus"];
+export declare const CORE_VALUE_PORT_NAMES: readonly ["resolveAutonomousLoopPrompt", "loosenReasons", "combinePolicies", "createAllowDenyPolicy", "MCP_NAMESPACE", "protocolOf", "ruleToolGrammarOf", "validatePermissionRules", "mintNamespacePrefix", "compileAllowList", "routeKeyOf", "joinRequestUrl", "resolveRouteCredential", "adjudicateModelRoute", "routePairingStatus", "judgeRuleToolName"];
 export type CoreValuePortName = (typeof CORE_VALUE_PORT_NAMES)[number];
 export declare function installCoreValuePorts(ports: Partial<CoreValuePorts> | null): () => void;
 export declare function hasCoreValuePorts(): boolean;
@@ -125,13 +130,12 @@ export declare function loosenReasons(prior: SessionPermissionRules, next: Sessi
 export declare function combinePolicies(...policies: CoreToolPolicyHandle[]): CoreToolPolicyHandle | undefined;
 export declare function createAllowDenyPolicy(opts: AllowDenyPolicyOptionsView): CoreToolPolicyHandle | undefined;
 export declare function mcpNamespace(): CoreProtocolNamespaceView | undefined;
-export declare function retiredToolNames(): ReadonlyMap<string, string> | undefined;
 export declare function protocolOf(name: string): CoreProtocolNamespaceView | undefined;
-export declare function ruleToolGrammarOf(toolName: string): 'command' | 'path' | undefined;
+export declare function ruleToolGrammarOf(toolName: string): RuleGrammarView | undefined;
 export declare function validatePermissionRules(rules: PermissionRuleView[], opts?: ValidatePermissionRulesOptionsView): PermissionRuleIssueView[] | undefined;
-export declare function discussionWorkflowName(): string | undefined;
 export declare function mintNamespacePrefix(ns: CoreProtocolNamespaceView, peer: string): string | undefined;
 export declare function compileAllowList(entries: readonly string[], behavior: 'allow' | 'deny', roster?: ReadonlySet<string>): AllowListReadingView | undefined;
+export declare function ruleToolNameJudgement(name: string, roster: ReadonlySet<string>): RuleToolNameVerdictView | undefined;
 export declare function routeKeyOf(url: string | undefined): string | undefined;
 export declare function joinRequestUrl(root: string | undefined, suffix: string): string | undefined;
 export declare function resolveRouteCredential(input: RouteCredentialInputView): RouteCredentialView | undefined;

package/dist/coreValuePorts.js

@@ -4,11 +4,9 @@ export const CORE_VALUE_PORT_NAMES = Object.freeze([
     'combinePolicies',
     'createAllowDenyPolicy',
     'MCP_NAMESPACE',
-    'RETIRED_TOOL_NAMES',
     'protocolOf',
     'ruleToolGrammarOf',
     'validatePermissionRules',
-    'DISCUSSION_WORKFLOW_NAME',
     'mintNamespacePrefix',
     'compileAllowList',
     'routeKeyOf',
@@ -16,6 +14,7 @@ export const CORE_VALUE_PORT_NAMES = Object.freeze([
     'resolveRouteCredential',
     'adjudicateModelRoute',
     'routePairingStatus',
+    'judgeRuleToolName',
 ]);
 let installed = null;
 export function installCoreValuePorts(ports) {
@@ -56,9 +55,6 @@ export function createAllowDenyPolicy(opts) {
 export function mcpNamespace() {
     return port('MCP_NAMESPACE');
 }
-export function retiredToolNames() {
-    return port('RETIRED_TOOL_NAMES');
-}
 export function protocolOf(name) {
     const fn = port('protocolOf');
     return fn === undefined ? undefined : fn(name);
@@ -71,9 +67,6 @@ export function validatePermissionRules(rules, opts) {
     const fn = port('validatePermissionRules');
     return fn === undefined ? undefined : fn(rules, opts);
 }
-export function discussionWorkflowName() {
-    return port('DISCUSSION_WORKFLOW_NAME');
-}
 export function mintNamespacePrefix(ns, peer) {
     const fn = port('mintNamespacePrefix');
     return fn === undefined ? undefined : fn(ns, peer);
@@ -82,6 +75,10 @@ export function compileAllowList(entries, behavior, roster) {
     const fn = port('compileAllowList');
     return fn === undefined ? undefined : fn(entries, behavior, roster);
 }
+export function ruleToolNameJudgement(name, roster) {
+    const fn = port('judgeRuleToolName');
+    return fn === undefined ? undefined : fn(name, roster);
+}
 export function routeKeyOf(url) {
     const fn = port('routeKeyOf');
     return fn === undefined ? undefined : fn(url);

package/dist/credentialProvenance.d.ts

@@ -0,0 +1,28 @@
+export declare const CREDENTIAL_ATTACH_WORDS: readonly ["local-sidecar", "service-token", "registry", "none"];
+export type CredentialAttachWord = (typeof CREDENTIAL_ATTACH_WORDS)[number];
+declare const TARGET_KIND_WORDS: readonly ["local-managed", "loopback-pin", "remote", "unresolved"];
+declare const TARGET_PROVENANCE_WORDS: readonly ["managed", "connect-pin", "manual", "none"];
+declare const CONSENT_WORDS: readonly ["granted", "absent", "n/a"];
+declare const SIDECAR_OWNERSHIP_WORDS: readonly ["verified", "mismatch"];
+export type CredentialTargetKind = (typeof TARGET_KIND_WORDS)[number];
+export type CredentialTargetProvenance = (typeof TARGET_PROVENANCE_WORDS)[number];
+export type CredentialConsent = (typeof CONSENT_WORDS)[number];
+export type CredentialSidecarOwnership = (typeof SIDECAR_OWNERSHIP_WORDS)[number];
+export interface CredentialFacts {
+    readonly kind: CredentialTargetKind;
+    readonly provenance?: CredentialTargetProvenance;
+    readonly sidecarOwnership?: CredentialSidecarOwnership;
+    readonly serviceTokenAtFirstWrite?: boolean;
+    readonly loggedIn?: boolean;
+    readonly consent?: CredentialConsent;
+}
+export type CredentialFactName = 'facts' | 'kind' | 'sidecarOwnership' | 'serviceTokenAtFirstWrite' | 'loggedIn' | 'provenance' | 'consent';
+export type CredentialProvenance = {
+    readonly kind: 'word';
+    readonly word: CredentialAttachWord;
+} | {
+    readonly kind: 'unreadable';
+    readonly reason: CredentialFactName;
+};
+export declare function credentialProvenance(facts: CredentialFacts): CredentialProvenance;
+export {};

package/dist/credentialProvenance.js

@@ -0,0 +1,76 @@
+export const CREDENTIAL_ATTACH_WORDS = Object.freeze(['local-sidecar', 'service-token', 'registry', 'none']);
+const TARGET_KIND_WORDS = ['local-managed', 'loopback-pin', 'remote', 'unresolved'];
+const TARGET_PROVENANCE_WORDS = ['managed', 'connect-pin', 'manual', 'none'];
+const CONSENT_WORDS = ['granted', 'absent', 'n/a'];
+const SIDECAR_OWNERSHIP_WORDS = ['verified', 'mismatch'];
+function said(word) {
+    const r = { kind: 'word', word };
+    return Object.freeze(r);
+}
+function unreadable(reason) {
+    const r = { kind: 'unreadable', reason };
+    return Object.freeze(r);
+}
+function ownData(holder, key) {
+    try {
+        if (typeof holder !== 'object' || holder === null)
+            return undefined;
+        const d = Object.getOwnPropertyDescriptor(holder, key);
+        return d !== undefined && Object.hasOwn(d, 'value') ? d.value : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function ownBool(holder, key) {
+    const v = ownData(holder, key);
+    return typeof v === 'boolean' ? v : undefined;
+}
+function ownWord(holder, key, closed) {
+    const v = ownData(holder, key);
+    return typeof v === 'string' ? closed.find((w) => w === v) : undefined;
+}
+function decide(facts) {
+    if (typeof facts !== 'object' || facts === null || Array.isArray(facts))
+        return unreadable('facts');
+    const kind = ownWord(facts, 'kind', TARGET_KIND_WORDS);
+    if (kind === undefined)
+        return unreadable('kind');
+    if (kind === 'unresolved')
+        return said('none');
+    if (kind === 'local-managed') {
+        const owned = ownWord(facts, 'sidecarOwnership', SIDECAR_OWNERSHIP_WORDS);
+        if (owned === undefined)
+            return unreadable('sidecarOwnership');
+        return said(owned === 'verified' ? 'local-sidecar' : 'none');
+    }
+    const tokenAtFirstWrite = ownBool(facts, 'serviceTokenAtFirstWrite');
+    if (tokenAtFirstWrite === undefined)
+        return unreadable('serviceTokenAtFirstWrite');
+    if (tokenAtFirstWrite)
+        return said('service-token');
+    const loggedIn = ownBool(facts, 'loggedIn');
+    if (loggedIn === undefined)
+        return unreadable('loggedIn');
+    if (!loggedIn)
+        return said('none');
+    const provenance = ownWord(facts, 'provenance', TARGET_PROVENANCE_WORDS);
+    if (provenance === undefined)
+        return unreadable('provenance');
+    if (provenance !== 'connect-pin')
+        return said('none');
+    if (kind === 'remote')
+        return said('registry');
+    const consent = ownWord(facts, 'consent', CONSENT_WORDS);
+    if (consent === undefined || consent === 'n/a')
+        return unreadable('consent');
+    return said(consent === 'granted' ? 'registry' : 'none');
+}
+export function credentialProvenance(facts) {
+    try {
+        return decide(facts);
+    }
+    catch {
+        return unreadable('facts');
+    }
+}