@sema-agent/core 5.0.1 → 5.1.0

package/dist/core/protocol-table.js

@@ -0,0 +1,23 @@
+const NAME_SEP = "__";
+export const MCP_NAMESPACE = {
+    id: "mcp",
+    prefix: `mcp${NAME_SEP}`,
+    makeName: (peer, tool) => `mcp${NAME_SEP}${peer}${NAME_SEP}${tool}`,
+    parse(name) {
+        if (!name.startsWith(this.prefix))
+            return undefined;
+        const rest = name.slice(this.prefix.length);
+        const sep = rest.indexOf(NAME_SEP);
+        if (sep <= 0)
+            return undefined;
+        return { peer: rest.slice(0, sep), tool: rest.slice(sep + NAME_SEP.length) };
+    },
+    displayGroupKey(name) {
+        const p = this.parse(name);
+        return p === undefined ? name : `${this.prefix}${p.peer}${NAME_SEP}*`;
+    },
+};
+export const PROTOCOL_TABLE = [MCP_NAMESPACE];
+export function protocolOf(name) {
+    return PROTOCOL_TABLE.find((ns) => name.startsWith(ns.prefix));
+}

package/dist/core/runner/active-skill-scope.js

@@ -28,7 +28,7 @@ export function createActiveSkillScopePolicy(opts) {
             if (unresolved && unresolved.kind === "unresolved") {
                 return {
                     action: "deny",
-                    reason: `tool "${req.toolName}" denied: active skill artifact "${unresolved.lineageId}" manifest could not be resolved (${unresolved.reason}) — fail-closed deny-all`,
+                    message: `tool "${req.toolName}" denied: active skill artifact "${unresolved.lineageId}" manifest could not be resolved (${unresolved.reason}) — fail-closed deny-all`,
                     decisionReason: "safety",
                 };
             }
@@ -49,7 +49,7 @@ export function createActiveSkillScopePolicy(opts) {
                 const ids = manifests.map((m) => m.lineageId).join(", ");
                 return {
                     action: "deny",
-                    reason: `tool "${req.toolName}" is not in the active skill manifest allowlist (artifact(s): ${ids})`,
+                    message: `tool "${req.toolName}" is not in the active skill manifest allowlist (artifact(s): ${ids})`,
                     decisionReason: "safety",
                 };
             }
@@ -68,7 +68,7 @@ export function createActiveSkillScopePolicy(opts) {
                 if (!admitted) {
                     return {
                         action: "deny",
-                        reason: `tool "${req.toolName}" is narrowed by skill manifest "${frame.manifest.lineageId}": ${rejections.join("; ")}`,
+                        message: `tool "${req.toolName}" is narrowed by skill manifest "${frame.manifest.lineageId}": ${rejections.join("; ")}`,
                         decisionReason: "safety",
                     };
                 }
@@ -80,7 +80,7 @@ export function createActiveSkillScopePolicy(opts) {
                     const ids = manifests.filter((m) => m.allowPaths?.length).map((m) => m.lineageId).join(", ");
                     return {
                         action: "deny",
-                        reason: `write-capable tool "${req.toolName}" denied: active skill manifest constrains writes to allowPaths but this tool's target cannot be path-confined (only ${[...PATH_WRITE_TOOLS].join("/")} are) — fail-closed (artifact(s): ${ids})`,
+                        message: `write-capable tool "${req.toolName}" denied: active skill manifest constrains writes to allowPaths but this tool's target cannot be path-confined (only ${[...PATH_WRITE_TOOLS].join("/")} are) — fail-closed (artifact(s): ${ids})`,
                         decisionReason: "safety",
                     };
                 }
@@ -92,7 +92,7 @@ export function createActiveSkillScopePolicy(opts) {
                     if (typeof path !== "string" || path.length === 0) {
                         return {
                             action: "deny",
-                            reason: `write tool "${req.toolName}" denied: active skill manifest constrains writes to allowPaths but the call has no resolvable path`,
+                            message: `write tool "${req.toolName}" denied: active skill manifest constrains writes to allowPaths but the call has no resolvable path`,
                             decisionReason: "safety",
                         };
                     }
@@ -100,7 +100,7 @@ export function createActiveSkillScopePolicy(opts) {
                     if (!canon.ok) {
                         return {
                             action: "deny",
-                            reason: `write to "${path}" denied: its real target could not be resolved against the active skill manifest allowPaths`,
+                            message: `write to "${path}" denied: its real target could not be resolved against the active skill manifest allowPaths`,
                             decisionReason: "safety",
                         };
                     }
@@ -115,7 +115,7 @@ export function createActiveSkillScopePolicy(opts) {
                         if (!inside) {
                             return {
                                 action: "deny",
-                                reason: `write to "${path}" is outside the paths allowed by skill manifest "${m.lineageId}" (allowPaths: ${(m.allowPaths ?? []).join(", ")})`,
+                                message: `write to "${path}" is outside the paths allowed by skill manifest "${m.lineageId}" (allowPaths: ${(m.allowPaths ?? []).join(", ")})`,
                                 decisionReason: "safety",
                             };
                         }

package/dist/core/runner/prepare-memory.js

@@ -1,4 +1,4 @@
-import { deriveControlPlaneDir, deriveProjectControlDir, deriveProjectMemoryDir, deriveRepoMemoryDir, drainMemoryAnnouncements, enqueueMemoryAnnouncement, lookupProjectIdHint, recordProjectIdHint, resolveMemoryEngineRoot } from "../memory-engine/layout.js";
+import { adoptLegacyRepoDirs, deriveControlPlaneDir, deriveProjectControlDir, deriveProjectMemoryDir, deriveRepoMemoryDir, drainMemoryAnnouncements, enqueueMemoryAnnouncement, lookupProjectIdHint, recordProjectIdHint, resolveMemoryEngineRoot } from "../memory-engine/layout.js";
 import { classifyScopePlanes, derivePersonalControlDir, derivePersonalMemoryDir, mergeHarvestReports, mergeInjections, needsDualRoots, parsedProjectPlane } from "../memory-engine/dual-root.js";
 import { normalizeMemorySpec } from "../memory.js";
 import { MemoryEngine } from "../memory-engine/engine.js";
@@ -15,6 +15,9 @@ export async function prepareMemory(input) {
             const pinned = backend.directoryRoot;
             const engineRoot = resolveMemoryEngineRoot(deps.memoryEngineDir);
             const repoRoot = deps.rootPath ?? taskRootPath;
+            if (repoRoot) {
+                adoptLegacyRepoDirs(engineRoot, repoRoot, (err) => deps.onError?.(err, { phase: "memory", sessionId }));
+            }
             let identityKey;
             if (memorySpec.scopeContract === "v2" && repoRoot) {
                 const consumesProjectIdentity = [...memorySpec.scopes, ...(memorySpec.writeScope !== null ? [memorySpec.writeScope] : [])]

package/dist/core/runner/prepare-task.js

@@ -30,6 +30,7 @@ import { CacheBreakDetector, toolsToFingerprintInputs } from "../cache-break-det
 import { reservedCollisions, reservedFor } from "../../brain/request-params.js";
 import { defineTool, isDefineToolProduct } from "../tools.js";
 import { RETIRED_TOOL_NAMES } from "../tool-name-aliases.js";
+import { protocolOf } from "../protocol-table.js";
 import { pathToUri } from "../lsp-protocol.js";
 import { DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, createOffloadPersist, firstPartyOffloadPolicy, InMemoryToolResultStore, RunnerSharedToolResultStore, ScopedToolResultStore, isVolatileOffloadStore, OFFLOAD_TOOL_NAME, createReadToolResultTool, withToolResultOffload, } from "../tool-result-store.js";
 import { OUTPUT_TOOL_NAME, REPORT_FINDINGS_TOOL_NAME, SKILL_CONTENT_MAX_CHARS, SKILL_TOOL_NAME, createOutputTool, createReportBlockedTool, createReportFindingsTool, createSkillTool, normalizeSkills } from "./synthetic-tools.js";
@@ -1835,7 +1836,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             ...(assembled.sections
                 ? { sections: assembled.sections.map((s) => ({ id: s.id, slot: s.slot, carrier: s.carrier, cadence: s.cadence, cacheClass: s.cacheClass, chars: s.text.length, hash: saltedHash(s.text), ...(s.declaredContentHash !== undefined ? { contentHash: s.declaredContentHash } : {}) })) }
                 : {}),
-            tools: projectToolManifest(tools, (t) => (t.name.startsWith("mcp__") ? "mcp" : "caller")),
+            tools: projectToolManifest(tools, (t) => protocolOf(t.name)?.id ?? "caller"),
         };
         const epochDeclaredSections = (assembled.sections ?? [])
             .filter((s) => s.origin === "provider")
@@ -2209,7 +2210,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                                 err.code = "config.legacy_tool_name";
                                 throw err;
                             }
-                            if (n.includes("__") && !n.startsWith("mcp__")) {
+                            if (n.includes("__") && protocolOf(n) === undefined) {
                                 const err = new Error(`tool policy ${kind}-list entry "${n}" is a pre-prefix MCP tool name and matches nothing in this run's roster — MCP tools are named "mcp__<server>__<tool>" and legacy-name normalization was removed (RB-476-A), so this entry would silently guard nothing. Prefix the entry with "mcp__".`);
                                 err.code = "config.legacy_tool_name";
                                 throw err;
@@ -2339,7 +2340,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 if (round >= 3) {
                     return {
                         action: "deny",
-                        reason: `the approval-edit chain for "${creq.toolName}" exceeded the re-approval cap (inherited parent policy) — denied fail-closed; re-submit the edited action directly`,
+                        message: `the approval-edit chain for "${creq.toolName}" exceeded the re-approval cap (inherited parent policy) — denied fail-closed; re-submit the edited action directly`,
                     };
                 }
                 let re;
@@ -2349,7 +2350,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 catch (err) {
                     return {
                         action: "deny",
-                        reason: `inherited parent policy re-check of the approved edit errored for "${creq.toolName}": ${err instanceof Error ? err.message : String(err)}`,
+                        message: `inherited parent policy re-check of the approved edit errored for "${creq.toolName}": ${err instanceof Error ? err.message : String(err)}`,
                     };
                 }
                 if (re.action === "deny")
@@ -2363,7 +2364,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     toolName: creq.toolName,
                     toolCallId: creq.toolCallId,
                     args: editArgs,
-                    message: re.message ?? re.reason ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
+                    message: re.message ?? re.message ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
                     ...askSourceIdentity(),
                     ...(re.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
                 }, onAskOf, csignal ?? abortController.signal);
@@ -2381,7 +2382,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     if (first === undefined) {
                         return {
                             action: "deny",
-                            reason: `inherited parent policy could not be arbitrated for "${creq.toolName}" ` +
+                            message: `inherited parent policy could not be arbitrated for "${creq.toolName}" ` +
                                 `(shared-instance first decision unavailable); denied fail-closed`,
                         };
                     }
@@ -2399,7 +2400,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         }
                         return {
                             action: "deny",
-                            reason: `inherited parent policy requires durable approval for "${creq.toolName}" — the parent's durable ` +
+                            message: `inherited parent policy requires durable approval for "${creq.toolName}" — the parent's durable ` +
                                 `ask cannot be reconstructed in a delegated child; denied fail-closed (tighten-only)`,
                         };
                     }
@@ -2409,7 +2410,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         toolName: creq.toolName,
                         toolCallId: creq.toolCallId,
                         args: presentedArgs,
-                        message: first.message ?? first.reason ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
+                        message: first.message ?? first.message ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
                         ...askSourceIdentity(),
                         ...(first.action === "ask" && first.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
                     }, pc.onAsk, csignal ?? abortController.signal);
@@ -2419,7 +2420,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             return first;
                         return {
                             action: "deny",
-                            reason: `no approver is reachable for the inherited approval of "${creq.toolName}" and the marker channel is at capacity — denied fail-closed`,
+                            message: `no approver is reachable for the inherited approval of "${creq.toolName}" and the marker channel is at capacity — denied fail-closed`,
                         };
                     }
                     if (resolved.action !== "allow")
@@ -2440,7 +2441,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     catch (err) {
                         return {
                             action: "deny",
-                            reason: `inherited parent policy errored for "${creq.toolName}": ${err instanceof Error ? err.message : String(err)}`,
+                            message: `inherited parent policy errored for "${creq.toolName}": ${err instanceof Error ? err.message : String(err)}`,
                         };
                     }
                     if (decision.action !== "ask")
@@ -2455,7 +2456,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         }
                         return {
                             action: "deny",
-                            reason: `inherited parent policy requires durable approval for "${creq.toolName}" — the parent's durable ` +
+                            message: `inherited parent policy requires durable approval for "${creq.toolName}" — the parent's durable ` +
                                 `ask cannot be reconstructed in a delegated child; denied fail-closed (tighten-only)`,
                         };
                     }
@@ -2465,7 +2466,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         toolName: creq.toolName,
                         toolCallId: creq.toolCallId,
                         args: presentedArgs,
-                        message: decision.message ?? decision.reason ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
+                        message: decision.message ?? decision.message ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
                         ...askSourceIdentity(),
                         ...(decision.action === "ask" && decision.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
                     }, pc.onAsk, csignal ?? abortController.signal);
@@ -2475,7 +2476,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             return decision;
                         return {
                             action: "deny",
-                            reason: `no approver is reachable for the inherited approval of "${creq.toolName}" and the marker channel is at capacity — denied fail-closed`,
+                            message: `no approver is reachable for the inherited approval of "${creq.toolName}" and the marker channel is at capacity — denied fail-closed`,
                         };
                     }
                     if (resolved.action !== "allow")
@@ -2630,7 +2631,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             const adjudicate = effectivePolicy
                 ? (req) => raceAbort(Promise.resolve(effectivePolicy.check({ ...req, budget: budgetSnapshot }, abortController.signal)), abortController.signal, () => ({
                     action: "deny",
-                    reason: "policy check aborted (task timed out or cancelled)",
+                    message: "policy check aborted (task timed out or cancelled)",
                 }))
                 : undefined;
             const sanitizePreview = (node, depth = 0) => {
@@ -2672,7 +2673,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 if (inheritedUnavailableAsks.delete(req.toolCallId)) {
                     return {
                         action: "deny",
-                        reason: `approval for "${req.toolName}" requires an ancestor task's approval that cannot be resolved here ` +
+                        message: `approval for "${req.toolName}" requires an ancestor task's approval that cannot be resolved here ` +
                             `(no live approver reachable, or a durable-park mandate applies), and no durable approval park is ` +
                             `available — denied fail-closed (the inherited constraint stands).`,
                         decisionReason: "mode",
@@ -2705,7 +2706,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         const preview = approvalPreviewOf(req.toolName, req.args);
                         return preview !== undefined ? { preview } : {};
                     })(),
-                    message: decision.message ?? decision.reason ?? `approval required for "${req.toolName}"`,
+                    message: decision.message ?? decision.message ?? `approval required for "${req.toolName}"`,
                     ...askSourceIdentity(),
                     ...(decision.action === "ask" && decision.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
                 }, onAsk, abortController.signal);

package/dist/core/runner/runtask.js

@@ -1674,7 +1674,13 @@ export class Runner {
         }
         rs.telemetry.taskStart = Date.now();
         rs.telemetry.taskStartMonotonic = performance.now();
-        void Promise.resolve(this.sessions.noteTaskRun?.(prepared.sessionId, rs.telemetry.taskId)).catch(() => { });
+        void Promise.resolve(this.sessions.noteTaskRun?.(prepared.sessionId, rs.telemetry.taskId)).catch((err) => {
+            try {
+                this.deps.onError?.(err instanceof Error ? err : new Error(String(err)), { phase: "config", sessionId: prepared.sessionId });
+            }
+            catch {
+            }
+        });
         rs.degrade.recordDegraded = (info, toModel) => {
             if (rs.degrade.degraded !== undefined)
                 return;
@@ -3344,7 +3350,7 @@ export class Runner {
             const rechecked = await prepared.basePolicyForResumeEdit.check({ toolName: pendingAction.toolName, args: resolvedArgs, toolCallId: pendingAction.toolCallId }, prepared.abortController.signal);
             if (rechecked.action === "deny") {
                 emitEnd(true);
-                const eid = await prepared.session.appendMessage(toolResultMsg(pendingAction.toolCallId, pendingAction.toolName, formatHookFeedback(`The approver EDITED this call's input; the edited call is denied by the deployment's tool policy and was not executed${rechecked.reason ? `: ${rechecked.reason}` : ""}.`), true));
+                const eid = await prepared.session.appendMessage(toolResultMsg(pendingAction.toolCallId, pendingAction.toolName, formatHookFeedback(`The approver EDITED this call's input; the edited call is denied by the deployment's tool policy and was not executed${rechecked.message ? `: ${rechecked.message}` : ""}.`), true));
                 emitCommitted(eid, "toolResult", pendingAction.toolCallId);
                 return;
             }
@@ -3353,7 +3359,7 @@ export class Runner {
             const narrowed = await prepared.denyNarrowingPolicy.check({ toolName: pendingAction.toolName, args: resolvedArgs, toolCallId: pendingAction.toolCallId }, prepared.abortController.signal);
             if (narrowed.action === "deny") {
                 emitEnd(true);
-                const eid = await prepared.session.appendMessage(toolResultMsg(pendingAction.toolCallId, pendingAction.toolName, formatHookFeedback(`The approved tool call "${pendingAction.toolName}" is now denied by a session rule and was not executed${narrowed.reason ? `: ${narrowed.reason}` : ""}.`), true));
+                const eid = await prepared.session.appendMessage(toolResultMsg(pendingAction.toolCallId, pendingAction.toolName, formatHookFeedback(`The approved tool call "${pendingAction.toolName}" is now denied by a session rule and was not executed${narrowed.message ? `: ${narrowed.message}` : ""}.`), true));
                 emitCommitted(eid, "toolResult", pendingAction.toolCallId);
                 return;
             }

package/dist/core/runner/session-rule-policy.js

@@ -18,7 +18,7 @@ export function isWithin(root, p) {
     const base = r.endsWith("/") ? r : r + "/";
     return c.startsWith(base);
 }
-const deny = (reason) => ({ action: "deny", reason, decisionReason: "rule" });
+const deny = (message) => ({ action: "deny", message, decisionReason: "rule" });
 export function createSessionRulePolicy(rules, opts) {
     const { env, rootPath, toolEffects } = opts;
     const toolDeny = new Set(rules.toolDeny ?? []);

package/dist/core/runner/synthetic-tools.js

@@ -187,13 +187,13 @@ export function createSkillTool(skills, scope) {
             `Do not invoke a skill that is already running. ` +
             `If a \`<command-name>\` block is already present this turn, the skill is loaded — follow it directly rather than calling again.`,
         parameters: Type.Object({
-            skill: Type.Optional(Type.String({ description: 'The skill name. E.g., "commit", "review-pr", or "pdf"' })),
+            skill: Type.String({ description: 'The skill name. E.g., "commit", "review-pr", or "pdf"' }),
             args: Type.Optional(Type.String({ description: "Optional arguments for the skill" })),
         }),
         effect: "read",
         execute: (rawArgs) => {
             const a = (rawArgs ?? {});
-            const name = String(a.skill ?? a.name ?? "");
+            const name = String(a.skill ?? "");
             const skill = byName.get(name);
             if (!skill) {
                 throw new Error(`Unknown skill "${name}". Available skills: ${names}.`);

package/dist/core/runner/tool-disclosure.d.ts

@@ -39,7 +39,6 @@ export declare function scoreToolMatch(query: string, info: DeferredToolInfo): n
 export interface ToolSearchArgs {
     query?: string;
     max_results?: number;
-    select?: string[];
 }
 export declare function resolveToolSearchDetailed(args: ToolSearchArgs, registry: ReadonlyMap<string, DeferredToolInfo>): {
     matched: string[];

package/dist/core/runner/tool-disclosure.js

@@ -130,8 +130,6 @@ export function resolveToolSearchDetailed(args, registry) {
             out.push(name);
         }
     };
-    for (const name of args.select ?? [])
-        add(name);
     const q = typeof args.query === "string" ? args.query.trim() : "";
     if (q !== "") {
         const selectMatch = /^select:(.+)$/i.exec(q);

package/dist/core/runner/turn-attachments.js

@@ -1,5 +1,6 @@
 import { PRESENT_PLAN_TOOL_NAME } from "../present-plan-tool.js";
 import { defuseFenceMarkers, delimitUntrusted, sanitizeUntrustedText } from "../untrusted-text.js";
+import { protocolOf } from "../protocol-table.js";
 import { buildSkillsBlock, skillListingLine } from "./synthetic-tools.js";
 import { TOOL_SEARCH_NAME as TOOL_SEARCH_TOOL_NAME } from "./tool-disclosure.js";
 export const TODO_REMINDER_CONFIG = {
@@ -384,7 +385,7 @@ export const TOOLS_DELTA_LIST_MAX = 30;
 function groupByMcpServer(names) {
     const counts = new Map();
     for (const n of names) {
-        const key = n.startsWith("mcp__") ? `${n.split("__", 2).join("__")}__*` : n;
+        const key = protocolOf(n)?.displayGroupKey(n) ?? n;
         counts.set(key, (counts.get(key) ?? 0) + 1);
     }
     return [...counts.entries()]

package/dist/core/sensitive-path-policy.js

@@ -69,7 +69,7 @@ export function createSensitivePathPolicy(opts) {
                 if (canon.unresolvedSymlink) {
                     return {
                         action: "deny",
-                        reason: `write to "${path}" is blocked: it is a symlink whose real target could not be resolved (it could point onto a guarded sensitive path)`,
+                        message: `write to "${path}" is blocked: it is a symlink whose real target could not be resolved (it could point onto a guarded sensitive path)`,
                         decisionReason: "safety",
                     };
                 }
@@ -79,7 +79,7 @@ export function createSensitivePathPolicy(opts) {
             if (hit) {
                 return {
                     action: "deny",
-                    reason: `write to "${path}" is blocked: its real target resolves onto the guarded sensitive path "${hit}"`,
+                    message: `write to "${path}" is blocked: its real target resolves onto the guarded sensitive path "${hit}"`,
                     decisionReason: "safety",
                 };
             }

package/dist/core/tool-policy.d.ts

@@ -13,20 +13,17 @@ export type PermissionResult = {
     action: "allow";
     updatedInput?: unknown;
     message?: string;
-    reason?: string;
     decisionReason?: DecisionReason;
 } | {
     action: "ask";
     updatedInput?: unknown;
     message?: string;
-    reason?: string;
     decisionReason?: DecisionReason;
     requiresRealApproval?: boolean;
 } | {
     action: "deny";
     updatedInput?: unknown;
     message?: string;
-    reason?: string;
     decisionReason?: DecisionReason;
 };
 export declare function decisionText(d: PermissionResult): string | undefined;

package/dist/core/tool-policy.js

@@ -3,7 +3,7 @@ import { isAbsolute, join, normalize as normalizePath, sep } from "node:path";
 import { BASH_READONLY_DEFAULT_ALLOW, parseLeadingCommandName } from "../tools/fs/index.js";
 import { writeTargetPath } from "../tools/fs/safety.js";
 export function decisionText(d) {
-    return d.message ?? d.reason;
+    return d.message;
 }
 const ALLOW = { action: "allow" };
 function withTimeout(p, ms, onTimeout) {
@@ -39,10 +39,10 @@ export function createAllowDenyPolicy(opts) {
         check(req) {
             const toolName = req.toolName;
             if (deny.has(toolName)) {
-                return { action: "deny", reason: `tool "${req.toolName}" is denied by policy` };
+                return { action: "deny", message: `tool "${req.toolName}" is denied by policy` };
             }
             if (allow && !allow.has(toolName)) {
-                return { action: "deny", reason: `tool "${req.toolName}" is not in the allowlist` };
+                return { action: "deny", message: `tool "${req.toolName}" is not in the allowlist` };
             }
             return ALLOW;
         },
@@ -66,11 +66,11 @@ export function createApprovalPolicy(opts) {
         async check(req, signal) {
             const toolName = req.toolName;
             if (deny.has(toolName)) {
-                return { action: "deny", reason: `tool "${req.toolName}" is denied by policy` };
+                return { action: "deny", message: `tool "${req.toolName}" is denied by policy` };
             }
             if (need.has(toolName)) {
                 if (signal?.aborted) {
-                    return { action: "deny", reason: `approval aborted for "${req.toolName}" (task ended)` };
+                    return { action: "deny", message: `approval aborted for "${req.toolName}" (task ended)` };
                 }
                 let ok;
                 try {
@@ -79,13 +79,19 @@ export function createApprovalPolicy(opts) {
                 catch (err) {
                     return {
                         action: "deny",
-                        reason: `approval errored for "${req.toolName}": ${err instanceof Error ? err.message : String(err)}`,
+                        message: `approval errored for "${req.toolName}": ${err instanceof Error ? err.message : String(err)}`,
                     };
                 }
-                return ok ? ALLOW : { action: "deny", reason: `approval denied for "${req.toolName}"` };
+                const okRaw = ok;
+                if (okRaw === true)
+                    return ALLOW;
+                if (okRaw !== false) {
+                    return { action: "deny", message: `approval callback for "${req.toolName}" returned an out-of-contract value (${typeof ok}) — denied fail-closed (return true, false, or the {allow} object)` };
+                }
+                return { action: "deny", message: `approval denied for "${req.toolName}"` };
             }
             if (opts.denyByDefault && !auto.has(toolName)) {
-                return { action: "deny", reason: `tool "${req.toolName}" requires explicit allow` };
+                return { action: "deny", message: `tool "${req.toolName}" requires explicit allow` };
             }
             return ALLOW;
         },
@@ -130,7 +136,7 @@ export function createCoarseCommandNamePolicy(opts) {
     const shellTools = canonicalToolNameSet(opts.tools);
     const defaultAction = opts.defaultAction ?? "ask";
     const fallback = (reason) => defaultAction === "deny"
-        ? { action: "deny", reason, decisionReason: "rule" }
+        ? { action: "deny", message: reason, decisionReason: "rule" }
         : { action: "ask", message: reason, decisionReason: "rule" };
     return {
         check(req) {
@@ -145,7 +151,7 @@ export function createCoarseCommandNamePolicy(opts) {
                 return fallback(`command is not a single simple command (${parsed.reject})`);
             }
             if (deny.has(parsed.name)) {
-                return { action: "deny", reason: `command "${parsed.name}" is denied by policy`, decisionReason: "rule" };
+                return { action: "deny", message: `command "${parsed.name}" is denied by policy`, decisionReason: "rule" };
             }
             if (allow && !allow.has(parsed.name)) {
                 return fallback(`command "${parsed.name}" is not in the allowlist`);
@@ -394,7 +400,7 @@ export function createUnverifiableDeletePolicy(opts) {
                 action: "ask",
                 decisionReason: "safety",
                 requiresRealApproval: true,
-                reason: `Unverifiable recursive delete (fail-closed unless cleared): ${finding}. ` +
+                message: `Unverifiable recursive delete (fail-closed unless cleared): ${finding}. ` +
                     `Re-run the delete with the resolved literal path written into the command itself ` +
                     `(or assign the variable in the same command, e.g. \`DIR=/exact/path; rm -rf "$DIR"\`) so the target can be verified.`,
             };
@@ -468,7 +474,7 @@ export function createTranscriptIntegrityPolicy(opts) {
         action: "ask",
         decisionReason: "safety",
         requiresRealApproval: true,
-        reason: `Session-transcript write (fail-closed unless cleared): ${what}. Session transcripts (the .jsonl files ` +
+        message: `Session-transcript write (fail-closed unless cleared): ${what}. Session transcripts (the .jsonl files ` +
             `under the agent data dir's sessions/ directory) are harness-written session state, not agent working ` +
             `files — modifying or deleting them tampers with the run's own audit trail. Reading them (ls/cat/grep ` +
             `as a single simple command) is fine.`,
@@ -613,7 +619,15 @@ export async function resolveAsk(req, onAsk, signal) {
         }
         return { action: "allow", updatedInput: edit.value, decisionReason: "mode" };
     }
-    return ok
-        ? { action: "allow", decisionReason: "mode", presentedInput: presented.value }
-        : { action: "deny", message: `approval denied for "${req.toolName}": ${req.message}`, decisionReason: "mode" };
+    const okRaw = ok;
+    if (okRaw === true)
+        return { action: "allow", decisionReason: "mode", presentedInput: presented.value };
+    if (okRaw !== false) {
+        return {
+            action: "deny",
+            message: `the approver for "${req.toolName}" returned an out-of-contract value (${typeof ok}) — denied fail-closed (return true, false, "unavailable", or the {allow} object)`,
+            decisionReason: "mode",
+        };
+    }
+    return { action: "deny", message: `approval denied for "${req.toolName}": ${req.message}`, decisionReason: "mode" };
 }

package/dist/index.d.ts

@@ -40,6 +40,7 @@ export { decideAutoPromote, deriveTripwire, FROZEN_DENYLIST_FLOOR, type AutoProm
 export { runCascade, type CascadeRung, type CascadeConfig, type CascadeAttempt, type CascadeRunResult, type GateVerdict, } from "./agents/cascade.js";
 export { pgQuery, mysqlQuery, sqliteQuery } from "./tools/sql-adapters.js";
 export { materializeMcpTools, MCP_PREFIX, type MaterializedMcp, type McpServerStatus, type McpRefreshResult } from "./core/mcp.js";
+export { PROTOCOL_TABLE, MCP_NAMESPACE, protocolOf, type ProtocolNamespace, type ProtocolId } from "./core/protocol-table.js";
 export { InMemorySessionPolicyStore, SessionPolicyError, loosenReasons, normalizeRules, stripRev, type SessionPolicyStore, type SessionPermissionRules, type StoredSessionRules, type SessionRulesRecord, type PutRulesOptions, } from "./core/session-policy-store.js";
 export { SAFETY_MERGE_CONFORMANCE_CORPUS, type SafetyMergeVector } from "./core/safety-merge-corpus.js";
 export { SAFETY_AXIS_VOCABULARY } from "./core/safety-axis-vocab.js";

package/dist/index.js

@@ -37,6 +37,7 @@ export { decideAutoPromote, deriveTripwire, FROZEN_DENYLIST_FLOOR, } from "./cor
 export { runCascade, } from "./agents/cascade.js";
 export { pgQuery, mysqlQuery, sqliteQuery } from "./tools/sql-adapters.js";
 export { materializeMcpTools, MCP_PREFIX } from "./core/mcp.js";
+export { PROTOCOL_TABLE, MCP_NAMESPACE, protocolOf } from "./core/protocol-table.js";
 export { InMemorySessionPolicyStore, SessionPolicyError, loosenReasons, normalizeRules, stripRev, } from "./core/session-policy-store.js";
 export { SAFETY_MERGE_CONFORMANCE_CORPUS } from "./core/safety-merge-corpus.js";
 export { SAFETY_AXIS_VOCABULARY } from "./core/safety-axis-vocab.js";

package/dist/orchestration/run-spec.js

@@ -28,7 +28,7 @@ function frozenDenyPolicy(rootDir, frozenResolved) {
             const absForm = isAbsolutePathForm(raw);
             const abs = pathKey(absForm ? raw : resolve(rootDir, raw));
             if (frozen.has(abs)) {
-                return { action: "deny", reason: `${raw} is part of the frozen specification surface (read-only).` };
+                return { action: "deny", message: `${raw} is part of the frozen specification surface (read-only).` };
             }
             return { action: "allow" };
         },

package/dist/orchestration/run-workflow-tool.js

@@ -344,8 +344,8 @@ export async function createRunWorkflowTool(d) {
                 }
                 if (resolved === undefined)
                     return structuredError(`unknown workflow name: ${JSON.stringify(rawName)}`);
-                script = typeof resolved === "string" ? resolved : resolved.script;
-                if (typeof resolved !== "string" && "defaultArgs" in resolved)
+                script = resolved.script;
+                if ("defaultArgs" in resolved)
                     registeredDefaultArgs = resolved.defaultArgs;
                 if (typeof resolved !== "string" && typeof resolved.stringArgKey === "string" && resolved.stringArgKey.length > 0) {
                     registeredStringArgKey = resolved.stringArgKey;

package/dist/orchestration/workflow-script-store.d.ts

@@ -12,7 +12,7 @@ export interface WorkflowScriptStore {
     readonly scopePartitioned: true;
     persist(runId: string, script: string, scope: string): Promise<string> | string;
     load(scriptPath: string, scope: string): Promise<string> | string;
-    resolveName?(name: string): Promise<string | NamedWorkflowResolution | undefined> | string | NamedWorkflowResolution | undefined;
+    resolveName?(name: string): Promise<NamedWorkflowResolution | undefined> | NamedWorkflowResolution | undefined;
     list?(): NamedWorkflowListing[] | Promise<NamedWorkflowListing[]>;
 }
 export declare function mergeWorkflowArgs(callArgs: unknown, defaultArgs: unknown): unknown;

package/dist/orchestration/workflow-script-store.js

@@ -95,7 +95,7 @@ export function createFileWorkflowScriptStore(dir) {
             const script = readFileSync(path, "utf-8");
             const argsPath = join(root, `${stem}.args.json`);
             if (!existsSync(argsPath))
-                return script;
+                return { script };
             let defaultArgs;
             try {
                 defaultArgs = JSON.parse(readFileSync(argsPath, "utf-8"));

package/dist/prompt-assembly/assemble.js

@@ -101,7 +101,6 @@ export function assemblePrompt(inputs) {
         userSystemPrompt: inputs.userSystemPrompt,
         userAppendSystemPrompt: inputs.userAppendSystemPrompt,
         tools: inputs.tools,
-        memoryEnabled: false,
         consolidationEnabled: false,
         ...facts,
     };

package/dist/prompt-assembly/tool-catalog.d.ts

@@ -1,6 +1,7 @@
 import type { TSchema } from "typebox";
 import type { AgentTool } from "../internal/harness-types.js";
-export type ToolOrigin = "core" | "caller" | "mcp" | "synthetic";
+import type { ProtocolId } from "../core/protocol-table.js";
+export type ToolOrigin = "core" | "caller" | "synthetic" | ProtocolId;
 export interface ToolContractDescriptor {
     contractId: string;
     implementationRevision: string;

package/dist/prompts/default.d.ts

@@ -64,8 +64,6 @@ export interface StablePromptContext {
     userSystemPrompt?: string;
     userAppendSystemPrompt?: string;
     tools: AgentTool[];
-    memoryEnabled: boolean;
-    consolidationEnabled?: boolean;
     policyEnabled?: boolean;
     hooksEnabled?: boolean;
     isolationEnabled?: boolean;

package/dist/prompts/default.js

@@ -365,10 +365,6 @@ export function constitutionBlocks(ctx) {
         blocks.push({ id: "mode.worktree", text: WORKTREE_NOTICE });
     if (ctx.goalEnabled)
         blocks.push({ id: "mode.goal", text: GOAL_COMPLETION_GUIDANCE });
-    if (ctx.memoryEnabled)
-        blocks.push({ id: "memory.safety", text: MEMORY_SAFETY });
-    if (ctx.memoryEnabled && !ctx.consolidationEnabled)
-        blocks.push({ id: "memory.hygiene", text: MEMORY_HYGIENE });
     return blocks;
 }
 export function composeConstitution(roleBase, ctx) {
@@ -393,7 +389,7 @@ export function analyzePromptCacheFriendliness(provider, opts = {}) {
     const build = (memoryBlock) => {
         if (!provider.stableSystem)
             throw new Error("PromptProvider does not implement stableSystem");
-        return composeSystemPrompt(provider.stableSystem({ userSystemPrompt: opts.userSystemPrompt, tools, memoryEnabled: true }), memoryBlock);
+        return composeSystemPrompt(provider.stableSystem({ userSystemPrompt: opts.userSystemPrompt, tools }), memoryBlock);
     };
     const a = build(PROBE_MEMORY_A);
     const b = build(PROBE_MEMORY_B);