@sema-agent/core 5.0.0 → 5.1.0

package/dist/core/permission-rules.d.ts

@@ -1,4 +1,4 @@
-import type { ToolPolicy } from "./tool-policy.js";
+import type { NamedToolPolicy } from "./tool-policy.js";
 export declare const BASH_GENERIC_PARAMS: ReadonlySet<string>;
 export interface PermissionRule {
     rule: string;
@@ -32,4 +32,4 @@ export declare function parsePermissionRule(rule: string): ParsedPermissionRule;
 export declare function wildcardMatch(pattern: string, value: string): boolean;
 export declare const fileToolParamVocabulary: (canonicalTool: string) => ReadonlySet<string> | undefined;
 export declare function validatePermissionRules(rules: PermissionRule[], opts?: Pick<PermissionRulePolicyOptions, "primaryFieldGeneric" | "caps">): PermissionRuleIssue[];
-export declare function createPermissionRulePolicy(rules: PermissionRule[], opts?: PermissionRulePolicyOptions): ToolPolicy;
+export declare function createPermissionRulePolicy(rules: PermissionRule[], opts?: PermissionRulePolicyOptions): NamedToolPolicy;

package/dist/core/permission-rules.js

@@ -1,3 +1,4 @@
+import { MCP_NAMESPACE } from "./protocol-table.js";
 export const BASH_GENERIC_PARAMS = new Set(["command", "timeout", "description", "run_in_background"]);
 const DEFAULT_CAPS = {
     maxRules: 256,
@@ -95,7 +96,7 @@ const FILE_TOOL_PARAMS = {
     Write: new Set(["file_path", "path", "content"]),
     NotebookEdit: new Set(["notebook_path", "path", "cell_id", "cell_type", "edit_mode", "new_source"]),
     Grep: new Set([
-        "pattern", "path", "glob", "type", "output_mode", "head_limit", "max_results", "offset",
+        "pattern", "path", "glob", "type", "output_mode", "head_limit", "offset",
         "multiline", "context", "ignore_case", "-i", "-n", "-o", "-A", "-B", "-C",
     ]),
     Glob: new Set(["pattern", "path", "max_results"]),
@@ -142,7 +143,7 @@ function compile(rules, caps, primaryFieldGeneric) {
             }
         }
         const toolName = parsed.toolName;
-        if (toolName.startsWith("mcp__") && (parsed.ruleContent !== undefined || indexOfUnescaped(text, "(") !== -1)) {
+        if (toolName.startsWith(MCP_NAMESPACE.prefix) && (parsed.ruleContent !== undefined || indexOfUnescaped(text, "(") !== -1)) {
             bad(text, "unsupported.mcp_paren", "MCP rules do not support patterns in parentheses (CC parity); use the toolAxes system");
             continue;
         }
@@ -259,23 +260,33 @@ export function createPermissionRulePolicy(rules, opts) {
         }
     }
     const defaultAction = opts?.defaultAction ?? "allow";
+    const nameSets = { deny: [], ask: [], allow: [] };
+    for (const [toolName, entry] of byTool) {
+        if (entry.bare.deny !== undefined || entry.param.deny.length > 0)
+            nameSets.deny.push(toolName);
+        if (entry.bare.ask !== undefined || entry.param.ask.length > 0)
+            nameSets.ask.push(toolName);
+        if (entry.bare.allow !== undefined)
+            nameSets.allow.push(toolName);
+    }
     return {
+        nameSets: [nameSets],
         check(req) {
             const entry = byTool.get(req.toolName);
             if (entry) {
                 if (entry.bare.deny) {
-                    return { action: "deny", reason: ruleMessage("denied", entry.bare.deny.ruleText, entry.bare.deny.source) };
+                    return { action: "deny", message: ruleMessage("denied", entry.bare.deny.ruleText, entry.bare.deny.source) };
                 }
                 const paramDeny = matchParamRules(entry.param.deny, req.args, caps.maxScalarValueChars);
                 if (paramDeny) {
-                    return { action: "deny", reason: ruleMessage("denied", paramDeny.ruleText, paramDeny.source) };
+                    return { action: "deny", message: ruleMessage("denied", paramDeny.ruleText, paramDeny.source) };
                 }
                 if (entry.bare.ask) {
-                    return { action: "ask", reason: ruleMessage("flagged", entry.bare.ask.ruleText, entry.bare.ask.source) };
+                    return { action: "ask", message: ruleMessage("flagged", entry.bare.ask.ruleText, entry.bare.ask.source) };
                 }
                 const paramAsk = matchParamRules(entry.param.ask, req.args, caps.maxScalarValueChars);
                 if (paramAsk) {
-                    return { action: "ask", reason: ruleMessage("flagged", paramAsk.ruleText, paramAsk.source) };
+                    return { action: "ask", message: ruleMessage("flagged", paramAsk.ruleText, paramAsk.source) };
                 }
                 if (entry.bare.allow) {
                     return { action: "allow" };
@@ -283,7 +294,7 @@ export function createPermissionRulePolicy(rules, opts) {
             }
             if (defaultAction === "allow")
                 return { action: "allow" };
-            return { action: defaultAction, reason: `no permission rule matched "${req.toolName}" (default-${defaultAction} rule set)` };
+            return { action: defaultAction, message: `no permission rule matched "${req.toolName}" (default-${defaultAction} rule set)` };
         },
     };
 }

package/dist/core/protocol-table.d.ts

@@ -0,0 +1,14 @@
+export type ProtocolId = "mcp";
+export interface ProtocolNamespace {
+    readonly id: ProtocolId;
+    readonly prefix: string;
+    makeName(peer: string, tool: string): string;
+    parse(name: string): {
+        peer: string;
+        tool: string;
+    } | undefined;
+    displayGroupKey(name: string): string;
+}
+export declare const MCP_NAMESPACE: ProtocolNamespace;
+export declare const PROTOCOL_TABLE: readonly ProtocolNamespace[];
+export declare function protocolOf(name: string): ProtocolNamespace | undefined;

package/dist/core/protocol-table.js

@@ -0,0 +1,23 @@
+const NAME_SEP = "__";
+export const MCP_NAMESPACE = {
+    id: "mcp",
+    prefix: `mcp${NAME_SEP}`,
+    makeName: (peer, tool) => `mcp${NAME_SEP}${peer}${NAME_SEP}${tool}`,
+    parse(name) {
+        if (!name.startsWith(this.prefix))
+            return undefined;
+        const rest = name.slice(this.prefix.length);
+        const sep = rest.indexOf(NAME_SEP);
+        if (sep <= 0)
+            return undefined;
+        return { peer: rest.slice(0, sep), tool: rest.slice(sep + NAME_SEP.length) };
+    },
+    displayGroupKey(name) {
+        const p = this.parse(name);
+        return p === undefined ? name : `${this.prefix}${p.peer}${NAME_SEP}*`;
+    },
+};
+export const PROTOCOL_TABLE = [MCP_NAMESPACE];
+export function protocolOf(name) {
+    return PROTOCOL_TABLE.find((ns) => name.startsWith(ns.prefix));
+}

package/dist/core/runner/active-skill-scope.js

@@ -28,7 +28,7 @@ export function createActiveSkillScopePolicy(opts) {
             if (unresolved && unresolved.kind === "unresolved") {
                 return {
                     action: "deny",
-                    reason: `tool "${req.toolName}" denied: active skill artifact "${unresolved.lineageId}" manifest could not be resolved (${unresolved.reason}) — fail-closed deny-all`,
+                    message: `tool "${req.toolName}" denied: active skill artifact "${unresolved.lineageId}" manifest could not be resolved (${unresolved.reason}) — fail-closed deny-all`,
                     decisionReason: "safety",
                 };
             }
@@ -49,7 +49,7 @@ export function createActiveSkillScopePolicy(opts) {
                 const ids = manifests.map((m) => m.lineageId).join(", ");
                 return {
                     action: "deny",
-                    reason: `tool "${req.toolName}" is not in the active skill manifest allowlist (artifact(s): ${ids})`,
+                    message: `tool "${req.toolName}" is not in the active skill manifest allowlist (artifact(s): ${ids})`,
                     decisionReason: "safety",
                 };
             }
@@ -68,7 +68,7 @@ export function createActiveSkillScopePolicy(opts) {
                 if (!admitted) {
                     return {
                         action: "deny",
-                        reason: `tool "${req.toolName}" is narrowed by skill manifest "${frame.manifest.lineageId}": ${rejections.join("; ")}`,
+                        message: `tool "${req.toolName}" is narrowed by skill manifest "${frame.manifest.lineageId}": ${rejections.join("; ")}`,
                         decisionReason: "safety",
                     };
                 }
@@ -80,7 +80,7 @@ export function createActiveSkillScopePolicy(opts) {
                     const ids = manifests.filter((m) => m.allowPaths?.length).map((m) => m.lineageId).join(", ");
                     return {
                         action: "deny",
-                        reason: `write-capable tool "${req.toolName}" denied: active skill manifest constrains writes to allowPaths but this tool's target cannot be path-confined (only ${[...PATH_WRITE_TOOLS].join("/")} are) — fail-closed (artifact(s): ${ids})`,
+                        message: `write-capable tool "${req.toolName}" denied: active skill manifest constrains writes to allowPaths but this tool's target cannot be path-confined (only ${[...PATH_WRITE_TOOLS].join("/")} are) — fail-closed (artifact(s): ${ids})`,
                         decisionReason: "safety",
                     };
                 }
@@ -92,7 +92,7 @@ export function createActiveSkillScopePolicy(opts) {
                     if (typeof path !== "string" || path.length === 0) {
                         return {
                             action: "deny",
-                            reason: `write tool "${req.toolName}" denied: active skill manifest constrains writes to allowPaths but the call has no resolvable path`,
+                            message: `write tool "${req.toolName}" denied: active skill manifest constrains writes to allowPaths but the call has no resolvable path`,
                             decisionReason: "safety",
                         };
                     }
@@ -100,7 +100,7 @@ export function createActiveSkillScopePolicy(opts) {
                     if (!canon.ok) {
                         return {
                             action: "deny",
-                            reason: `write to "${path}" denied: its real target could not be resolved against the active skill manifest allowPaths`,
+                            message: `write to "${path}" denied: its real target could not be resolved against the active skill manifest allowPaths`,
                             decisionReason: "safety",
                         };
                     }
@@ -115,7 +115,7 @@ export function createActiveSkillScopePolicy(opts) {
                         if (!inside) {
                             return {
                                 action: "deny",
-                                reason: `write to "${path}" is outside the paths allowed by skill manifest "${m.lineageId}" (allowPaths: ${(m.allowPaths ?? []).join(", ")})`,
+                                message: `write to "${path}" is outside the paths allowed by skill manifest "${m.lineageId}" (allowPaths: ${(m.allowPaths ?? []).join(", ")})`,
                                 decisionReason: "safety",
                             };
                         }

package/dist/core/runner/prepare-memory.js

@@ -1,4 +1,4 @@
-import { deriveControlPlaneDir, deriveProjectControlDir, deriveProjectMemoryDir, deriveRepoMemoryDir, drainMemoryAnnouncements, enqueueMemoryAnnouncement, lookupProjectIdHint, recordProjectIdHint, resolveMemoryEngineRoot } from "../memory-engine/layout.js";
+import { adoptLegacyRepoDirs, deriveControlPlaneDir, deriveProjectControlDir, deriveProjectMemoryDir, deriveRepoMemoryDir, drainMemoryAnnouncements, enqueueMemoryAnnouncement, lookupProjectIdHint, recordProjectIdHint, resolveMemoryEngineRoot } from "../memory-engine/layout.js";
 import { classifyScopePlanes, derivePersonalControlDir, derivePersonalMemoryDir, mergeHarvestReports, mergeInjections, needsDualRoots, parsedProjectPlane } from "../memory-engine/dual-root.js";
 import { normalizeMemorySpec } from "../memory.js";
 import { MemoryEngine } from "../memory-engine/engine.js";
@@ -15,6 +15,9 @@ export async function prepareMemory(input) {
             const pinned = backend.directoryRoot;
             const engineRoot = resolveMemoryEngineRoot(deps.memoryEngineDir);
             const repoRoot = deps.rootPath ?? taskRootPath;
+            if (repoRoot) {
+                adoptLegacyRepoDirs(engineRoot, repoRoot, (err) => deps.onError?.(err, { phase: "memory", sessionId }));
+            }
             let identityKey;
             if (memorySpec.scopeContract === "v2" && repoRoot) {
                 const consumesProjectIdentity = [...memorySpec.scopes, ...(memorySpec.writeScope !== null ? [memorySpec.writeScope] : [])]

package/dist/core/runner/prepare-task.js

@@ -30,6 +30,7 @@ import { CacheBreakDetector, toolsToFingerprintInputs } from "../cache-break-det
 import { reservedCollisions, reservedFor } from "../../brain/request-params.js";
 import { defineTool, isDefineToolProduct } from "../tools.js";
 import { RETIRED_TOOL_NAMES } from "../tool-name-aliases.js";
+import { protocolOf } from "../protocol-table.js";
 import { pathToUri } from "../lsp-protocol.js";
 import { DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, createOffloadPersist, firstPartyOffloadPolicy, InMemoryToolResultStore, RunnerSharedToolResultStore, ScopedToolResultStore, isVolatileOffloadStore, OFFLOAD_TOOL_NAME, createReadToolResultTool, withToolResultOffload, } from "../tool-result-store.js";
 import { OUTPUT_TOOL_NAME, REPORT_FINDINGS_TOOL_NAME, SKILL_CONTENT_MAX_CHARS, SKILL_TOOL_NAME, createOutputTool, createReportBlockedTool, createReportFindingsTool, createSkillTool, normalizeSkills } from "./synthetic-tools.js";
@@ -1378,6 +1379,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     ...(deps.backgroundAgentStore !== undefined ? { agentStore: deps.backgroundAgentStore } : {}),
                     ...(deps.mailboxStore !== undefined ? { mailbox: deps.mailboxStore } : {}),
                     ...(reviveSpawn !== undefined ? { reviveSpawn } : {}),
+                    onNotifyError: (f) => emitTrace(deps.tracer, () => ({ kind: "observer.notify_failed", version: 1, taskId: hostTaskId, site: f.site, message: f.error.message, ts: Date.now() })),
                 })));
                 if (!(spec.tools ?? []).some((t) => t.name === AGENT_TRANSCRIPT_TOOL_NAME)) {
                     tools.push(firstPartyOffload(createAgentTranscriptTool({
@@ -1834,7 +1836,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             ...(assembled.sections
                 ? { sections: assembled.sections.map((s) => ({ id: s.id, slot: s.slot, carrier: s.carrier, cadence: s.cadence, cacheClass: s.cacheClass, chars: s.text.length, hash: saltedHash(s.text), ...(s.declaredContentHash !== undefined ? { contentHash: s.declaredContentHash } : {}) })) }
                 : {}),
-            tools: projectToolManifest(tools, (t) => (t.name.startsWith("mcp__") ? "mcp" : "caller")),
+            tools: projectToolManifest(tools, (t) => protocolOf(t.name)?.id ?? "caller"),
         };
         const epochDeclaredSections = (assembled.sections ?? [])
             .filter((s) => s.origin === "provider")
@@ -2190,8 +2192,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             }
         }
         const policy = spec.toolPolicy ?? deps.toolPolicy;
-        {
-            const nameGroups = toolPolicyNameSets(policy);
+        const auditPolicyNames = (auditee) => {
+            const nameGroups = toolPolicyNameSets(auditee);
             if (nameGroups.length > 0) {
                 const known = new Set(tools.flatMap((t) => [t.name, ...(t.aliases ?? [])]));
                 for (const t of harnessTools)
@@ -2208,6 +2210,11 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                                 err.code = "config.legacy_tool_name";
                                 throw err;
                             }
+                            if (n.includes("__") && protocolOf(n) === undefined) {
+                                const err = new Error(`tool policy ${kind}-list entry "${n}" is a pre-prefix MCP tool name and matches nothing in this run's roster — MCP tools are named "mcp__<server>__<tool>" and legacy-name normalization was removed (RB-476-A), so this entry would silently guard nothing. Prefix the entry with "mcp__".`);
+                                err.code = "config.legacy_tool_name";
+                                throw err;
+                            }
                             unmatched.add(`"${n}" (${kind})`);
                         }
                     }
@@ -2231,7 +2238,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     }
                 }
             }
-        }
+        };
+        auditPolicyNames(policy);
         let sessionRulePolicy;
         if (deps.sessionPolicyStore && spec.sessionId) {
             const rules = await deps.sessionPolicyStore.getRules(spec.sessionId, spec.principal);
@@ -2268,6 +2276,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             })
             : undefined;
         const narrowingLayers = [sessionRulePolicy, ...ancestorRulePolicies, skillScopePolicy].filter((p) => p !== undefined);
+        for (const layer of narrowingLayers)
+            auditPolicyNames(layer);
         const denyNarrowingPolicy = narrowingLayers.length === 0 ? undefined : narrowingLayers.length === 1 ? narrowingLayers[0] : combinePolicies(...narrowingLayers);
         const basePolicyForResumeEdit = spec.toolPolicy ?? deps.toolPolicy;
         const sameInstanceAncestorCount = policy === undefined ? 0 : (inheritedParentConstraints ?? []).reduce((n, pc) => (pc.policy === policy ? n + 1 : n), 0);
@@ -2330,7 +2340,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 if (round >= 3) {
                     return {
                         action: "deny",
-                        reason: `the approval-edit chain for "${creq.toolName}" exceeded the re-approval cap (inherited parent policy) — denied fail-closed; re-submit the edited action directly`,
+                        message: `the approval-edit chain for "${creq.toolName}" exceeded the re-approval cap (inherited parent policy) — denied fail-closed; re-submit the edited action directly`,
                     };
                 }
                 let re;
@@ -2340,7 +2350,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 catch (err) {
                     return {
                         action: "deny",
-                        reason: `inherited parent policy re-check of the approved edit errored for "${creq.toolName}": ${err instanceof Error ? err.message : String(err)}`,
+                        message: `inherited parent policy re-check of the approved edit errored for "${creq.toolName}": ${err instanceof Error ? err.message : String(err)}`,
                     };
                 }
                 if (re.action === "deny")
@@ -2354,7 +2364,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     toolName: creq.toolName,
                     toolCallId: creq.toolCallId,
                     args: editArgs,
-                    message: re.message ?? re.reason ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
+                    message: re.message ?? re.message ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
                     ...askSourceIdentity(),
                     ...(re.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
                 }, onAskOf, csignal ?? abortController.signal);
@@ -2372,7 +2382,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     if (first === undefined) {
                         return {
                             action: "deny",
-                            reason: `inherited parent policy could not be arbitrated for "${creq.toolName}" ` +
+                            message: `inherited parent policy could not be arbitrated for "${creq.toolName}" ` +
                                 `(shared-instance first decision unavailable); denied fail-closed`,
                         };
                     }
@@ -2390,7 +2400,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         }
                         return {
                             action: "deny",
-                            reason: `inherited parent policy requires durable approval for "${creq.toolName}" — the parent's durable ` +
+                            message: `inherited parent policy requires durable approval for "${creq.toolName}" — the parent's durable ` +
                                 `ask cannot be reconstructed in a delegated child; denied fail-closed (tighten-only)`,
                         };
                     }
@@ -2400,7 +2410,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         toolName: creq.toolName,
                         toolCallId: creq.toolCallId,
                         args: presentedArgs,
-                        message: first.message ?? first.reason ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
+                        message: first.message ?? first.message ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
                         ...askSourceIdentity(),
                         ...(first.action === "ask" && first.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
                     }, pc.onAsk, csignal ?? abortController.signal);
@@ -2410,7 +2420,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             return first;
                         return {
                             action: "deny",
-                            reason: `no approver is reachable for the inherited approval of "${creq.toolName}" and the marker channel is at capacity — denied fail-closed`,
+                            message: `no approver is reachable for the inherited approval of "${creq.toolName}" and the marker channel is at capacity — denied fail-closed`,
                         };
                     }
                     if (resolved.action !== "allow")
@@ -2431,7 +2441,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     catch (err) {
                         return {
                             action: "deny",
-                            reason: `inherited parent policy errored for "${creq.toolName}": ${err instanceof Error ? err.message : String(err)}`,
+                            message: `inherited parent policy errored for "${creq.toolName}": ${err instanceof Error ? err.message : String(err)}`,
                         };
                     }
                     if (decision.action !== "ask")
@@ -2446,7 +2456,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         }
                         return {
                             action: "deny",
-                            reason: `inherited parent policy requires durable approval for "${creq.toolName}" — the parent's durable ` +
+                            message: `inherited parent policy requires durable approval for "${creq.toolName}" — the parent's durable ` +
                                 `ask cannot be reconstructed in a delegated child; denied fail-closed (tighten-only)`,
                         };
                     }
@@ -2456,7 +2466,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         toolName: creq.toolName,
                         toolCallId: creq.toolCallId,
                         args: presentedArgs,
-                        message: decision.message ?? decision.reason ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
+                        message: decision.message ?? decision.message ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
                         ...askSourceIdentity(),
                         ...(decision.action === "ask" && decision.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
                     }, pc.onAsk, csignal ?? abortController.signal);
@@ -2466,7 +2476,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             return decision;
                         return {
                             action: "deny",
-                            reason: `no approver is reachable for the inherited approval of "${creq.toolName}" and the marker channel is at capacity — denied fail-closed`,
+                            message: `no approver is reachable for the inherited approval of "${creq.toolName}" and the marker channel is at capacity — denied fail-closed`,
                         };
                     }
                     if (resolved.action !== "allow")
@@ -2621,7 +2631,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             const adjudicate = effectivePolicy
                 ? (req) => raceAbort(Promise.resolve(effectivePolicy.check({ ...req, budget: budgetSnapshot }, abortController.signal)), abortController.signal, () => ({
                     action: "deny",
-                    reason: "policy check aborted (task timed out or cancelled)",
+                    message: "policy check aborted (task timed out or cancelled)",
                 }))
                 : undefined;
             const sanitizePreview = (node, depth = 0) => {
@@ -2663,7 +2673,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 if (inheritedUnavailableAsks.delete(req.toolCallId)) {
                     return {
                         action: "deny",
-                        reason: `approval for "${req.toolName}" requires an ancestor task's approval that cannot be resolved here ` +
+                        message: `approval for "${req.toolName}" requires an ancestor task's approval that cannot be resolved here ` +
                             `(no live approver reachable, or a durable-park mandate applies), and no durable approval park is ` +
                             `available — denied fail-closed (the inherited constraint stands).`,
                         decisionReason: "mode",
@@ -2696,7 +2706,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         const preview = approvalPreviewOf(req.toolName, req.args);
                         return preview !== undefined ? { preview } : {};
                     })(),
-                    message: decision.message ?? decision.reason ?? `approval required for "${req.toolName}"`,
+                    message: decision.message ?? decision.message ?? `approval required for "${req.toolName}"`,
                     ...askSourceIdentity(),
                     ...(decision.action === "ask" && decision.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
                 }, onAsk, abortController.signal);
@@ -2878,6 +2888,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     const token = mintCheckpointToken();
                     const gate = { kind: "resource_limit", reason };
                     const resourceLedgerOut = debitLedger(priorLedger, sliceSpend, resourceTotal);
+                    const mintedAt = Date.now();
                     const cp = {
                         token,
                         version: resourceLedgerOut.totalWalltimeSec !== undefined ? WALLTIME_CHECKPOINT_VERSION : RESOURCE_CHECKPOINT_VERSION,
@@ -2888,8 +2899,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         pendingAction: { kind: "resource_limit", reason },
                         state: serializeCheckpointState(remoteHandle),
                         status: "pending",
-                        createdAt: Date.now(),
-                        deadline: Date.now() + (sanitizedTtlMs(rs.ttlMs) ?? DEFAULT_RESOURCE_TTL_MS),
+                        createdAt: mintedAt,
+                        deadline: mintedAt + (sanitizedTtlMs(rs.ttlMs) ?? DEFAULT_RESOURCE_TTL_MS),
                         suspendCount: priorSuspendCount,
                         humanReview: humanReviewRef.count > 0
                             ? { count: humanReviewRef.count, totalWaitMs: humanReviewRef.totalWaitMs, gates: [...humanReviewRef.gates] }
@@ -2958,6 +2969,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     const scope = checkpointScopeOf(spec);
                     const gate = { kind: "plan_review", reason: reason ?? `plan review requested` };
                     const reviewLedger = debitLedger(priorLedger, liveSpendRef.get?.() ?? { costMicroUsd: 0, tokens: 0, turns: 0, walltimeMs: 0 }, resourceTotal, { countSlice: false });
+                    const mintedAt = Date.now();
                     const cp = {
                         token,
                         version: reviewLedger.totalWalltimeSec !== undefined ? WALLTIME_CHECKPOINT_VERSION : BINDING_CHECKPOINT_VERSION,
@@ -2968,9 +2980,9 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         pendingAction: { kind: "plan_review" },
                         state: serializeCheckpointState(remoteHandle),
                         status: "pending",
-                        createdAt: Date.now(),
+                        createdAt: mintedAt,
                         suspendedAt: now(),
-                        deadline: Date.now() + (sanitizedTtlMs(spec.durableApproval?.ttlMs) ?? DEFAULT_RESOURCE_TTL_MS),
+                        deadline: mintedAt + (sanitizedTtlMs(spec.durableApproval?.ttlMs) ?? DEFAULT_RESOURCE_TTL_MS),
                         suspendCount: priorSuspendCount + 1,
                         humanReview: humanReviewRef.count > 0
                             ? { count: humanReviewRef.count, totalWaitMs: humanReviewRef.totalWaitMs, gates: [...humanReviewRef.gates] }
@@ -3082,6 +3094,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         const ttlMs = sanitizedTtlMs(durableApproval?.ttlMs);
                         const checkpointState = serializeCheckpointState(remoteHandle);
                         const approvalLedger = debitLedger(priorLedger, liveSpendRef.get?.() ?? { costMicroUsd: 0, tokens: 0, turns: 0, walltimeMs: 0 }, resourceTotal, { countSlice: false });
+                        const mintedAt = Date.now();
                         cp = {
                             token,
                             version: approvalLedger.totalWalltimeSec !== undefined ? WALLTIME_CHECKPOINT_VERSION : BINDING_CHECKPOINT_VERSION,
@@ -3104,12 +3117,12 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             },
                             state: checkpointState,
                             deadline: ttlMs !== undefined
-                                ? Date.now() + ttlMs
+                                ? mintedAt + ttlMs
                                 : durableApproval !== undefined
                                     ? undefined
-                                    : Date.now() + DEFAULT_UNATTENDED_APPROVAL_TTL_MS,
+                                    : mintedAt + DEFAULT_UNATTENDED_APPROVAL_TTL_MS,
                             status: "pending",
-                            createdAt: Date.now(),
+                            createdAt: mintedAt,
                             suspendedAt: now(),
                             humanReview: humanReviewRef.count > 0
                                 ? { count: humanReviewRef.count, totalWaitMs: humanReviewRef.totalWaitMs, gates: [...humanReviewRef.gates] }

package/dist/core/runner/runtask.js

@@ -1674,7 +1674,13 @@ export class Runner {
         }
         rs.telemetry.taskStart = Date.now();
         rs.telemetry.taskStartMonotonic = performance.now();
-        void Promise.resolve(this.sessions.noteTaskRun?.(prepared.sessionId, rs.telemetry.taskId)).catch(() => { });
+        void Promise.resolve(this.sessions.noteTaskRun?.(prepared.sessionId, rs.telemetry.taskId)).catch((err) => {
+            try {
+                this.deps.onError?.(err instanceof Error ? err : new Error(String(err)), { phase: "config", sessionId: prepared.sessionId });
+            }
+            catch {
+            }
+        });
         rs.degrade.recordDegraded = (info, toModel) => {
             if (rs.degrade.degraded !== undefined)
                 return;
@@ -3344,7 +3350,7 @@ export class Runner {
             const rechecked = await prepared.basePolicyForResumeEdit.check({ toolName: pendingAction.toolName, args: resolvedArgs, toolCallId: pendingAction.toolCallId }, prepared.abortController.signal);
             if (rechecked.action === "deny") {
                 emitEnd(true);
-                const eid = await prepared.session.appendMessage(toolResultMsg(pendingAction.toolCallId, pendingAction.toolName, formatHookFeedback(`The approver EDITED this call's input; the edited call is denied by the deployment's tool policy and was not executed${rechecked.reason ? `: ${rechecked.reason}` : ""}.`), true));
+                const eid = await prepared.session.appendMessage(toolResultMsg(pendingAction.toolCallId, pendingAction.toolName, formatHookFeedback(`The approver EDITED this call's input; the edited call is denied by the deployment's tool policy and was not executed${rechecked.message ? `: ${rechecked.message}` : ""}.`), true));
                 emitCommitted(eid, "toolResult", pendingAction.toolCallId);
                 return;
             }
@@ -3353,7 +3359,7 @@ export class Runner {
             const narrowed = await prepared.denyNarrowingPolicy.check({ toolName: pendingAction.toolName, args: resolvedArgs, toolCallId: pendingAction.toolCallId }, prepared.abortController.signal);
             if (narrowed.action === "deny") {
                 emitEnd(true);
-                const eid = await prepared.session.appendMessage(toolResultMsg(pendingAction.toolCallId, pendingAction.toolName, formatHookFeedback(`The approved tool call "${pendingAction.toolName}" is now denied by a session rule and was not executed${narrowed.reason ? `: ${narrowed.reason}` : ""}.`), true));
+                const eid = await prepared.session.appendMessage(toolResultMsg(pendingAction.toolCallId, pendingAction.toolName, formatHookFeedback(`The approved tool call "${pendingAction.toolName}" is now denied by a session rule and was not executed${narrowed.message ? `: ${narrowed.message}` : ""}.`), true));
                 emitCommitted(eid, "toolResult", pendingAction.toolCallId);
                 return;
             }

package/dist/core/runner/session-rule-policy.d.ts

@@ -1,6 +1,6 @@
 import type { ExecutionEnv } from "../../internal/harness-types.js";
 import type { ToolEffect } from "../types.js";
-import { type ToolPolicy } from "../tool-policy.js";
+import { type NamedToolPolicy } from "../tool-policy.js";
 import type { SessionPermissionRules } from "../session-policy-store.js";
 export declare const PATH_WRITE_TOOLS: ReadonlySet<string>;
 export declare function isWithin(root: string, p: string): boolean;
@@ -8,4 +8,4 @@ export declare function createSessionRulePolicy(rules: SessionPermissionRules, o
     env: ExecutionEnv;
     rootPath?: string;
     toolEffects?: ReadonlyMap<string, ToolEffect>;
-}): ToolPolicy;
+}): NamedToolPolicy;

package/dist/core/runner/session-rule-policy.js

@@ -18,7 +18,7 @@ export function isWithin(root, p) {
     const base = r.endsWith("/") ? r : r + "/";
     return c.startsWith(base);
 }
-const deny = (reason) => ({ action: "deny", reason, decisionReason: "rule" });
+const deny = (message) => ({ action: "deny", message, decisionReason: "rule" });
 export function createSessionRulePolicy(rules, opts) {
     const { env, rootPath, toolEffects } = opts;
     const toolDeny = new Set(rules.toolDeny ?? []);
@@ -32,6 +32,7 @@ export function createSessionRulePolicy(rules, opts) {
         : undefined;
     const allowDirs = rules.allowDirs && rules.allowDirs.length > 0 ? rules.allowDirs : undefined;
     return {
+        nameSets: [{ ...(rules.toolDeny?.length ? { deny: [...rules.toolDeny] } : {}), ...(rules.toolAllow?.length ? { allow: [...rules.toolAllow] } : {}) }],
         async check(req, signal) {
             const toolName = req.toolName;
             if (toolDeny.has(toolName))

package/dist/core/runner/synthetic-tools.js

@@ -187,13 +187,13 @@ export function createSkillTool(skills, scope) {
             `Do not invoke a skill that is already running. ` +
             `If a \`<command-name>\` block is already present this turn, the skill is loaded — follow it directly rather than calling again.`,
         parameters: Type.Object({
-            skill: Type.Optional(Type.String({ description: 'The skill name. E.g., "commit", "review-pr", or "pdf"' })),
+            skill: Type.String({ description: 'The skill name. E.g., "commit", "review-pr", or "pdf"' }),
             args: Type.Optional(Type.String({ description: "Optional arguments for the skill" })),
         }),
         effect: "read",
         execute: (rawArgs) => {
             const a = (rawArgs ?? {});
-            const name = String(a.skill ?? a.name ?? "");
+            const name = String(a.skill ?? "");
             const skill = byName.get(name);
             if (!skill) {
                 throw new Error(`Unknown skill "${name}". Available skills: ${names}.`);

package/dist/core/runner/tool-disclosure.d.ts

@@ -39,7 +39,6 @@ export declare function scoreToolMatch(query: string, info: DeferredToolInfo): n
 export interface ToolSearchArgs {
     query?: string;
     max_results?: number;
-    select?: string[];
 }
 export declare function resolveToolSearchDetailed(args: ToolSearchArgs, registry: ReadonlyMap<string, DeferredToolInfo>): {
     matched: string[];

package/dist/core/runner/tool-disclosure.js

@@ -130,8 +130,6 @@ export function resolveToolSearchDetailed(args, registry) {
             out.push(name);
         }
     };
-    for (const name of args.select ?? [])
-        add(name);
     const q = typeof args.query === "string" ? args.query.trim() : "";
     if (q !== "") {
         const selectMatch = /^select:(.+)$/i.exec(q);

package/dist/core/runner/turn-attachments.js

@@ -1,5 +1,6 @@
 import { PRESENT_PLAN_TOOL_NAME } from "../present-plan-tool.js";
 import { defuseFenceMarkers, delimitUntrusted, sanitizeUntrustedText } from "../untrusted-text.js";
+import { protocolOf } from "../protocol-table.js";
 import { buildSkillsBlock, skillListingLine } from "./synthetic-tools.js";
 import { TOOL_SEARCH_NAME as TOOL_SEARCH_TOOL_NAME } from "./tool-disclosure.js";
 export const TODO_REMINDER_CONFIG = {
@@ -384,7 +385,7 @@ export const TOOLS_DELTA_LIST_MAX = 30;
 function groupByMcpServer(names) {
     const counts = new Map();
     for (const n of names) {
-        const key = n.startsWith("mcp__") ? `${n.split("__", 2).join("__")}__*` : n;
+        const key = protocolOf(n)?.displayGroupKey(n) ?? n;
         counts.set(key, (counts.get(key) ?? 0) + 1);
     }
     return [...counts.entries()]

package/dist/core/sensitive-path-policy.js

@@ -69,7 +69,7 @@ export function createSensitivePathPolicy(opts) {
                 if (canon.unresolvedSymlink) {
                     return {
                         action: "deny",
-                        reason: `write to "${path}" is blocked: it is a symlink whose real target could not be resolved (it could point onto a guarded sensitive path)`,
+                        message: `write to "${path}" is blocked: it is a symlink whose real target could not be resolved (it could point onto a guarded sensitive path)`,
                         decisionReason: "safety",
                     };
                 }
@@ -79,7 +79,7 @@ export function createSensitivePathPolicy(opts) {
             if (hit) {
                 return {
                     action: "deny",
-                    reason: `write to "${path}" is blocked: its real target resolves onto the guarded sensitive path "${hit}"`,
+                    message: `write to "${path}" is blocked: its real target resolves onto the guarded sensitive path "${hit}"`,
                     decisionReason: "safety",
                 };
             }

package/dist/core/tool-policy.d.ts

@@ -13,20 +13,17 @@ export type PermissionResult = {
     action: "allow";
     updatedInput?: unknown;
     message?: string;
-    reason?: string;
     decisionReason?: DecisionReason;
 } | {
     action: "ask";
     updatedInput?: unknown;
     message?: string;
-    reason?: string;
     decisionReason?: DecisionReason;
     requiresRealApproval?: boolean;
 } | {
     action: "deny";
     updatedInput?: unknown;
     message?: string;
-    reason?: string;
     decisionReason?: DecisionReason;
 };
 export declare function decisionText(d: PermissionResult): string | undefined;