@sema-agent/core 5.0.1 → 5.2.0

package/dist/core/runner/prepare-task.js

@@ -16,7 +16,7 @@ import { createSubagentWorktreeHelper, forkGovernanceDenial } from "../../agents
 import { createAgentTranscriptTool, AGENT_TRANSCRIPT_TOOL_NAME } from "../../agents/agent-transcript-tool.js";
 import { createSendMessageTool, SEND_MESSAGE_TOOL_NAME } from "../../agents/send-message-tool.js";
 import { SubagentRetainLedger } from "../../agents/retain-ledger.js";
-import { combinePolicies, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, resolveAsk, toolPolicyNameSets } from "../tool-policy.js";
+import { combinePolicies, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, refuseOutOfContractDecision, resolveAsk, toolPolicyNameSets } from "../tool-policy.js";
 import { ActiveSkillScope, createActiveSkillScopePolicy } from "./active-skill-scope.js";
 import { computeCallCap, createCallCapRef, softExecDeadlineMs, toolCutDeadlineMs, WALLTIME_STALL_CONNECT_MS, WALLTIME_STALL_FIRST_TOKEN_MS, WALLTIME_STALL_IDLE_MS } from "./call-cap.js";
 import { createCutKillRegistry } from "./cut-kill.js";
@@ -30,6 +30,7 @@ import { CacheBreakDetector, toolsToFingerprintInputs } from "../cache-break-det
 import { reservedCollisions, reservedFor } from "../../brain/request-params.js";
 import { defineTool, isDefineToolProduct } from "../tools.js";
 import { RETIRED_TOOL_NAMES } from "../tool-name-aliases.js";
+import { protocolOf } from "../protocol-table.js";
 import { pathToUri } from "../lsp-protocol.js";
 import { DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, createOffloadPersist, firstPartyOffloadPolicy, InMemoryToolResultStore, RunnerSharedToolResultStore, ScopedToolResultStore, isVolatileOffloadStore, OFFLOAD_TOOL_NAME, createReadToolResultTool, withToolResultOffload, } from "../tool-result-store.js";
 import { OUTPUT_TOOL_NAME, REPORT_FINDINGS_TOOL_NAME, SKILL_CONTENT_MAX_CHARS, SKILL_TOOL_NAME, createOutputTool, createReportBlockedTool, createReportFindingsTool, createSkillTool, normalizeSkills } from "./synthetic-tools.js";
@@ -1835,7 +1836,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             ...(assembled.sections
                 ? { sections: assembled.sections.map((s) => ({ id: s.id, slot: s.slot, carrier: s.carrier, cadence: s.cadence, cacheClass: s.cacheClass, chars: s.text.length, hash: saltedHash(s.text), ...(s.declaredContentHash !== undefined ? { contentHash: s.declaredContentHash } : {}) })) }
                 : {}),
-            tools: projectToolManifest(tools, (t) => (t.name.startsWith("mcp__") ? "mcp" : "caller")),
+            tools: projectToolManifest(tools, (t) => protocolOf(t.name)?.id ?? "caller"),
         };
         const epochDeclaredSections = (assembled.sections ?? [])
             .filter((s) => s.origin === "provider")
@@ -2209,7 +2210,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                                 err.code = "config.legacy_tool_name";
                                 throw err;
                             }
-                            if (n.includes("__") && !n.startsWith("mcp__")) {
+                            if (n.includes("__") && protocolOf(n) === undefined) {
                                 const err = new Error(`tool policy ${kind}-list entry "${n}" is a pre-prefix MCP tool name and matches nothing in this run's roster — MCP tools are named "mcp__<server>__<tool>" and legacy-name normalization was removed (RB-476-A), so this entry would silently guard nothing. Prefix the entry with "mcp__".`);
                                 err.code = "config.legacy_tool_name";
                                 throw err;
@@ -2339,7 +2340,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 if (round >= 3) {
                     return {
                         action: "deny",
-                        reason: `the approval-edit chain for "${creq.toolName}" exceeded the re-approval cap (inherited parent policy) — denied fail-closed; re-submit the edited action directly`,
+                        message: `the approval-edit chain for "${creq.toolName}" exceeded the re-approval cap (inherited parent policy) — denied fail-closed; re-submit the edited action directly`,
                     };
                 }
                 let re;
@@ -2349,7 +2350,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 catch (err) {
                     return {
                         action: "deny",
-                        reason: `inherited parent policy re-check of the approved edit errored for "${creq.toolName}": ${err instanceof Error ? err.message : String(err)}`,
+                        message: `inherited parent policy re-check of the approved edit errored for "${creq.toolName}": ${err instanceof Error ? err.message : String(err)}`,
                     };
                 }
                 if (re.action === "deny")
@@ -2363,7 +2364,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     toolName: creq.toolName,
                     toolCallId: creq.toolCallId,
                     args: editArgs,
-                    message: re.message ?? re.reason ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
+                    message: re.message ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
                     ...askSourceIdentity(),
                     ...(re.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
                 }, onAskOf, csignal ?? abortController.signal);
@@ -2381,7 +2382,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     if (first === undefined) {
                         return {
                             action: "deny",
-                            reason: `inherited parent policy could not be arbitrated for "${creq.toolName}" ` +
+                            message: `inherited parent policy could not be arbitrated for "${creq.toolName}" ` +
                                 `(shared-instance first decision unavailable); denied fail-closed`,
                         };
                     }
@@ -2399,7 +2400,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         }
                         return {
                             action: "deny",
-                            reason: `inherited parent policy requires durable approval for "${creq.toolName}" — the parent's durable ` +
+                            message: `inherited parent policy requires durable approval for "${creq.toolName}" — the parent's durable ` +
                                 `ask cannot be reconstructed in a delegated child; denied fail-closed (tighten-only)`,
                         };
                     }
@@ -2409,7 +2410,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         toolName: creq.toolName,
                         toolCallId: creq.toolCallId,
                         args: presentedArgs,
-                        message: first.message ?? first.reason ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
+                        message: first.message ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
                         ...askSourceIdentity(),
                         ...(first.action === "ask" && first.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
                     }, pc.onAsk, csignal ?? abortController.signal);
@@ -2419,7 +2420,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             return first;
                         return {
                             action: "deny",
-                            reason: `no approver is reachable for the inherited approval of "${creq.toolName}" and the marker channel is at capacity — denied fail-closed`,
+                            message: `no approver is reachable for the inherited approval of "${creq.toolName}" and the marker channel is at capacity — denied fail-closed`,
                         };
                     }
                     if (resolved.action !== "allow")
@@ -2440,7 +2441,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     catch (err) {
                         return {
                             action: "deny",
-                            reason: `inherited parent policy errored for "${creq.toolName}": ${err instanceof Error ? err.message : String(err)}`,
+                            message: `inherited parent policy errored for "${creq.toolName}": ${err instanceof Error ? err.message : String(err)}`,
                         };
                     }
                     if (decision.action !== "ask")
@@ -2455,7 +2456,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         }
                         return {
                             action: "deny",
-                            reason: `inherited parent policy requires durable approval for "${creq.toolName}" — the parent's durable ` +
+                            message: `inherited parent policy requires durable approval for "${creq.toolName}" — the parent's durable ` +
                                 `ask cannot be reconstructed in a delegated child; denied fail-closed (tighten-only)`,
                         };
                     }
@@ -2465,7 +2466,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         toolName: creq.toolName,
                         toolCallId: creq.toolCallId,
                         args: presentedArgs,
-                        message: decision.message ?? decision.reason ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
+                        message: decision.message ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
                         ...askSourceIdentity(),
                         ...(decision.action === "ask" && decision.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
                     }, pc.onAsk, csignal ?? abortController.signal);
@@ -2475,7 +2476,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             return decision;
                         return {
                             action: "deny",
-                            reason: `no approver is reachable for the inherited approval of "${creq.toolName}" and the marker channel is at capacity — denied fail-closed`,
+                            message: `no approver is reachable for the inherited approval of "${creq.toolName}" and the marker channel is at capacity — denied fail-closed`,
                         };
                     }
                     if (resolved.action !== "allow")
@@ -2630,7 +2631,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             const adjudicate = effectivePolicy
                 ? (req) => raceAbort(Promise.resolve(effectivePolicy.check({ ...req, budget: budgetSnapshot }, abortController.signal)), abortController.signal, () => ({
                     action: "deny",
-                    reason: "policy check aborted (task timed out or cancelled)",
+                    message: "policy check aborted (task timed out or cancelled)",
                 }))
                 : undefined;
             const sanitizePreview = (node, depth = 0) => {
@@ -2672,7 +2673,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 if (inheritedUnavailableAsks.delete(req.toolCallId)) {
                     return {
                         action: "deny",
-                        reason: `approval for "${req.toolName}" requires an ancestor task's approval that cannot be resolved here ` +
+                        message: `approval for "${req.toolName}" requires an ancestor task's approval that cannot be resolved here ` +
                             `(no live approver reachable, or a durable-park mandate applies), and no durable approval park is ` +
                             `available — denied fail-closed (the inherited constraint stands).`,
                         decisionReason: "mode",
@@ -2705,7 +2706,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         const preview = approvalPreviewOf(req.toolName, req.args);
                         return preview !== undefined ? { preview } : {};
                     })(),
-                    message: decision.message ?? decision.reason ?? `approval required for "${req.toolName}"`,
+                    message: decision.message ?? `approval required for "${req.toolName}"`,
                     ...askSourceIdentity(),
                     ...(decision.action === "ask" && decision.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
                 }, onAsk, abortController.signal);
@@ -2749,17 +2750,33 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             const checkpointStore = spec.checkpointStore ?? deps.checkpointStore;
             const durableApproval = spec.durableApproval ??
                 (runtimeCaps?.forceDurableGate ? { scope: spec.principal || DEFAULT_IRREVERSIBLE_SCOPE } : undefined);
-            const serializeCheckpointState = (workspaceHandle) => ({
+            const inFlightSpendMicroUsd = () => {
+                const own = liveSpendRef.get?.().costMicroUsd ?? 0;
+                const seededNested = resume?.seed.nestedStats.costMicroUsd;
+                const nestedDelta = nestedStats.costMicroUsd - (typeof seededNested === "number" && Number.isFinite(seededNested) ? seededNested : 0);
+                return (Number.isFinite(own) ? own : 0) + Math.max(0, Number.isFinite(nestedDelta) ? nestedDelta : 0);
+            };
+            const repairBundleForCheckpoint = (parkedSpendMicroUsd) => {
+                const carried = internals?.repairBundle !== undefined
+                    ? structuredClone(internals.repairBundle)
+                    : resume?.seed.repairBundle !== undefined
+                        ? structuredClone(resume.seed.repairBundle)
+                        : undefined;
+                if (carried === undefined)
+                    return undefined;
+                if (parkedSpendMicroUsd === undefined || !Number.isFinite(parkedSpendMicroUsd) || parkedSpendMicroUsd <= 0)
+                    return carried;
+                const prior = typeof carried.spentMicroUsd === "number" && Number.isFinite(carried.spentMicroUsd) ? Math.max(0, carried.spentMicroUsd) : 0;
+                carried.spentMicroUsd = prior + parkedSpendMicroUsd;
+                return carried;
+            };
+            const serializeCheckpointState = (workspaceHandle, parkedSpendMicroUsd) => ({
                 activeTools: [...activeTools],
                 outputRef: { value: outputRef.value, set: outputRef.set },
                 nestedStats: { ...nestedStats },
                 consolidationNotes: undefined,
                 readFileState: readFileStateForCheckpoint ? [...readFileStateForCheckpoint.entries()] : undefined,
-                repairBundle: internals?.repairBundle !== undefined
-                    ? structuredClone(internals.repairBundle)
-                    : resume?.seed.repairBundle !== undefined
-                        ? structuredClone(resume.seed.repairBundle)
-                        : undefined,
+                repairBundle: repairBundleForCheckpoint(parkedSpendMicroUsd),
                 workspaceHandle,
                 handsCwd: handsCwdRef?.current,
                 activeWorktree: worktreeSessionRef?.current ? { ...worktreeSessionRef.current } : undefined,
@@ -2977,7 +2994,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         leafId,
                         gate,
                         pendingAction: { kind: "plan_review" },
-                        state: serializeCheckpointState(remoteHandle),
+                        state: serializeCheckpointState(remoteHandle, inFlightSpendMicroUsd()),
                         status: "pending",
                         createdAt: mintedAt,
                         suspendedAt: now(),
@@ -3091,7 +3108,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                                     };
                         const scope = durableApproval?.scope || checkpointScopeOf({ principal: spec.principal });
                         const ttlMs = sanitizedTtlMs(durableApproval?.ttlMs);
-                        const checkpointState = serializeCheckpointState(remoteHandle);
+                        const checkpointState = serializeCheckpointState(remoteHandle, inFlightSpendMicroUsd());
                         const approvalLedger = debitLedger(priorLedger, liveSpendRef.get?.() ?? { costMicroUsd: 0, tokens: 0, turns: 0, walltimeMs: 0 }, resourceTotal, { countSlice: false });
                         const mintedAt = Date.now();
                         cp = {
@@ -3395,7 +3412,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             ? undefined
             : async (path) => {
                 try {
-                    const d = await denyNarrowingPolicy.check({ toolName: "Read", args: { file_path: path }, toolCallId: "changed-files-visibility-probe" }, abortController.signal);
+                    const d = refuseOutOfContractDecision(await denyNarrowingPolicy.check({ toolName: "Read", args: { file_path: path }, toolCallId: "changed-files-visibility-probe" }, abortController.signal));
                     return d.action === "deny";
                 }
                 catch {

package/dist/core/runner/runtask.js

@@ -36,7 +36,7 @@ import { delimitUntrusted, inlineUntrusted, sanitizeUntrustedText } from "../unt
 import { reconcileInterruptedSession } from "../session-reconcile.js";
 import { RunnerSharedToolResultStore } from "../tool-result-store.js";
 import { formatDiagnosticsBlock } from "../lsp-diagnostics.js";
-import { toolPolicyNameSets } from "../tool-policy.js";
+import { refuseOutOfContractDecision, toolPolicyNameSets } from "../tool-policy.js";
 import { defaultTaskRegistry } from "../task-registry.js";
 import { discloseDroppedPending, PendingSessionNotifications, renderTaskNotificationXml, SystemInjectionQueue, taskNotificationDedupKey } from "../task-notification.js";
 import { ToolDetachHub } from "../tool-detach.js";
@@ -1674,7 +1674,19 @@ export class Runner {
         }
         rs.telemetry.taskStart = Date.now();
         rs.telemetry.taskStartMonotonic = performance.now();
-        void Promise.resolve(this.sessions.noteTaskRun?.(prepared.sessionId, rs.telemetry.taskId)).catch(() => { });
+        const discloseNoteTaskRunFailure = (err) => {
+            try {
+                this.deps.onError?.(err instanceof Error ? err : new Error(String(err)), { phase: "config", sessionId: prepared.sessionId });
+            }
+            catch {
+            }
+        };
+        try {
+            void Promise.resolve(this.sessions.noteTaskRun?.(prepared.sessionId, rs.telemetry.taskId)).catch(discloseNoteTaskRunFailure);
+        }
+        catch (err) {
+            discloseNoteTaskRunFailure(err);
+        }
         rs.degrade.recordDegraded = (info, toModel) => {
             if (rs.degrade.degraded !== undefined)
                 return;
@@ -3341,19 +3353,19 @@ export class Runner {
             return;
         }
         if (outcome.decision === "allow" && outcome.updatedInput !== undefined && prepared.basePolicyForResumeEdit) {
-            const rechecked = await prepared.basePolicyForResumeEdit.check({ toolName: pendingAction.toolName, args: resolvedArgs, toolCallId: pendingAction.toolCallId }, prepared.abortController.signal);
+            const rechecked = refuseOutOfContractDecision(await prepared.basePolicyForResumeEdit.check({ toolName: pendingAction.toolName, args: resolvedArgs, toolCallId: pendingAction.toolCallId }, prepared.abortController.signal));
             if (rechecked.action === "deny") {
                 emitEnd(true);
-                const eid = await prepared.session.appendMessage(toolResultMsg(pendingAction.toolCallId, pendingAction.toolName, formatHookFeedback(`The approver EDITED this call's input; the edited call is denied by the deployment's tool policy and was not executed${rechecked.reason ? `: ${rechecked.reason}` : ""}.`), true));
+                const eid = await prepared.session.appendMessage(toolResultMsg(pendingAction.toolCallId, pendingAction.toolName, formatHookFeedback(`The approver EDITED this call's input; the edited call is denied by the deployment's tool policy and was not executed${rechecked.message ? `: ${rechecked.message}` : ""}.`), true));
                 emitCommitted(eid, "toolResult", pendingAction.toolCallId);
                 return;
             }
         }
         if (prepared.denyNarrowingPolicy) {
-            const narrowed = await prepared.denyNarrowingPolicy.check({ toolName: pendingAction.toolName, args: resolvedArgs, toolCallId: pendingAction.toolCallId }, prepared.abortController.signal);
+            const narrowed = refuseOutOfContractDecision(await prepared.denyNarrowingPolicy.check({ toolName: pendingAction.toolName, args: resolvedArgs, toolCallId: pendingAction.toolCallId }, prepared.abortController.signal));
             if (narrowed.action === "deny") {
                 emitEnd(true);
-                const eid = await prepared.session.appendMessage(toolResultMsg(pendingAction.toolCallId, pendingAction.toolName, formatHookFeedback(`The approved tool call "${pendingAction.toolName}" is now denied by a session rule and was not executed${narrowed.reason ? `: ${narrowed.reason}` : ""}.`), true));
+                const eid = await prepared.session.appendMessage(toolResultMsg(pendingAction.toolCallId, pendingAction.toolName, formatHookFeedback(`The approved tool call "${pendingAction.toolName}" is now denied by a session rule and was not executed${narrowed.message ? `: ${narrowed.message}` : ""}.`), true));
                 emitCommitted(eid, "toolResult", pendingAction.toolCallId);
                 return;
             }

package/dist/core/runner/session-rule-policy.js

@@ -18,7 +18,7 @@ export function isWithin(root, p) {
     const base = r.endsWith("/") ? r : r + "/";
     return c.startsWith(base);
 }
-const deny = (reason) => ({ action: "deny", reason, decisionReason: "rule" });
+const deny = (message) => ({ action: "deny", message, decisionReason: "rule" });
 export function createSessionRulePolicy(rules, opts) {
     const { env, rootPath, toolEffects } = opts;
     const toolDeny = new Set(rules.toolDeny ?? []);

package/dist/core/runner/synthetic-tools.js

@@ -187,13 +187,13 @@ export function createSkillTool(skills, scope) {
             `Do not invoke a skill that is already running. ` +
             `If a \`<command-name>\` block is already present this turn, the skill is loaded — follow it directly rather than calling again.`,
         parameters: Type.Object({
-            skill: Type.Optional(Type.String({ description: 'The skill name. E.g., "commit", "review-pr", or "pdf"' })),
+            skill: Type.String({ description: 'The skill name. E.g., "commit", "review-pr", or "pdf"' }),
             args: Type.Optional(Type.String({ description: "Optional arguments for the skill" })),
         }),
         effect: "read",
         execute: (rawArgs) => {
             const a = (rawArgs ?? {});
-            const name = String(a.skill ?? a.name ?? "");
+            const name = String(a.skill ?? "");
             const skill = byName.get(name);
             if (!skill) {
                 throw new Error(`Unknown skill "${name}". Available skills: ${names}.`);

package/dist/core/runner/tool-disclosure.d.ts

@@ -39,7 +39,6 @@ export declare function scoreToolMatch(query: string, info: DeferredToolInfo): n
 export interface ToolSearchArgs {
     query?: string;
     max_results?: number;
-    select?: string[];
 }
 export declare function resolveToolSearchDetailed(args: ToolSearchArgs, registry: ReadonlyMap<string, DeferredToolInfo>): {
     matched: string[];

package/dist/core/runner/tool-disclosure.js

@@ -1,6 +1,6 @@
 import { Type } from "typebox";
 import { Value } from "typebox/value";
-import { defineTool } from "../tools.js";
+import { defineTool, errorResult } from "../tools.js";
 export const TOOL_SEARCH_NAME = "ToolSearch";
 const DEFER_AUTO_FRACTION = 0.1;
 const CHARS_PER_TOKEN = 4;
@@ -130,8 +130,6 @@ export function resolveToolSearchDetailed(args, registry) {
             out.push(name);
         }
     };
-    for (const name of args.select ?? [])
-        add(name);
     const q = typeof args.query === "string" ? args.query.trim() : "";
     if (q !== "") {
         const selectMatch = /^select:(.+)$/i.exec(q);
@@ -249,6 +247,11 @@ export function createToolSearchTool(opts) {
         }),
         effect: "read",
         execute: async (raw) => {
+            const staleSelect = (raw ?? {});
+            if (staleSelect.select !== undefined) {
+                return errorResult(`Error (${TOOL_SEARCH_NAME}): \`select\` is not a parameter (the array form is retired) — put the ` +
+                    `selection in \`query\` instead: {"query":"select:ToolA,ToolB"}. Nothing was activated.`);
+            }
             const args = (raw ?? {});
             const { matched, missing } = resolveToolSearchDetailed(args, registry);
             const mounted = mountedNames?.() ?? new Set();

package/dist/core/runner/turn-attachments.js

@@ -1,5 +1,6 @@
 import { PRESENT_PLAN_TOOL_NAME } from "../present-plan-tool.js";
 import { defuseFenceMarkers, delimitUntrusted, sanitizeUntrustedText } from "../untrusted-text.js";
+import { protocolOf } from "../protocol-table.js";
 import { buildSkillsBlock, skillListingLine } from "./synthetic-tools.js";
 import { TOOL_SEARCH_NAME as TOOL_SEARCH_TOOL_NAME } from "./tool-disclosure.js";
 export const TODO_REMINDER_CONFIG = {
@@ -384,7 +385,7 @@ export const TOOLS_DELTA_LIST_MAX = 30;
 function groupByMcpServer(names) {
     const counts = new Map();
     for (const n of names) {
-        const key = n.startsWith("mcp__") ? `${n.split("__", 2).join("__")}__*` : n;
+        const key = protocolOf(n)?.displayGroupKey(n) ?? n;
         counts.set(key, (counts.get(key) ?? 0) + 1);
     }
     return [...counts.entries()]

package/dist/core/sensitive-path-policy.js

@@ -69,7 +69,7 @@ export function createSensitivePathPolicy(opts) {
                 if (canon.unresolvedSymlink) {
                     return {
                         action: "deny",
-                        reason: `write to "${path}" is blocked: it is a symlink whose real target could not be resolved (it could point onto a guarded sensitive path)`,
+                        message: `write to "${path}" is blocked: it is a symlink whose real target could not be resolved (it could point onto a guarded sensitive path)`,
                         decisionReason: "safety",
                     };
                 }
@@ -79,7 +79,7 @@ export function createSensitivePathPolicy(opts) {
             if (hit) {
                 return {
                     action: "deny",
-                    reason: `write to "${path}" is blocked: its real target resolves onto the guarded sensitive path "${hit}"`,
+                    message: `write to "${path}" is blocked: its real target resolves onto the guarded sensitive path "${hit}"`,
                     decisionReason: "safety",
                 };
             }

package/dist/core/tool-policy.d.ts

@@ -13,26 +13,24 @@ export type PermissionResult = {
     action: "allow";
     updatedInput?: unknown;
     message?: string;
-    reason?: string;
     decisionReason?: DecisionReason;
 } | {
     action: "ask";
     updatedInput?: unknown;
     message?: string;
-    reason?: string;
     decisionReason?: DecisionReason;
     requiresRealApproval?: boolean;
 } | {
     action: "deny";
     updatedInput?: unknown;
     message?: string;
-    reason?: string;
     decisionReason?: DecisionReason;
 };
 export declare function decisionText(d: PermissionResult): string | undefined;
 export interface ToolPolicy {
     check(req: ToolCallRequest, signal?: AbortSignal): PermissionResult | Promise<PermissionResult>;
 }
+export declare function refuseOutOfContractDecision(d: PermissionResult): PermissionResult;
 export interface ToolPolicyNameSets {
     readonly allow?: readonly string[];
     readonly deny?: readonly string[];

package/dist/core/tool-policy.js

@@ -3,9 +3,19 @@ import { isAbsolute, join, normalize as normalizePath, sep } from "node:path";
 import { BASH_READONLY_DEFAULT_ALLOW, parseLeadingCommandName } from "../tools/fs/index.js";
 import { writeTargetPath } from "../tools/fs/safety.js";
 export function decisionText(d) {
-    return d.message ?? d.reason;
+    return d.message;
 }
 const ALLOW = { action: "allow" };
+const RETIRED_TEXT_FIELD = "reason";
+const RETIRED_TEXT_FIELD_DENY_MESSAGE = `a permission decision carries the retired "${RETIRED_TEXT_FIELD}" field — rename it to "message" (the one text field ` +
+    `a decision carries); denied fail-closed rather than executing a decision whose text this layer cannot read`;
+export function refuseOutOfContractDecision(d) {
+    if (typeof d !== "object" || d === null)
+        return d;
+    if (!Object.prototype.hasOwnProperty.call(d, RETIRED_TEXT_FIELD))
+        return d;
+    return { action: "deny", message: RETIRED_TEXT_FIELD_DENY_MESSAGE, decisionReason: "rule" };
+}
 function withTimeout(p, ms, onTimeout) {
     if (ms === undefined) {
         return p;
@@ -39,10 +49,10 @@ export function createAllowDenyPolicy(opts) {
         check(req) {
             const toolName = req.toolName;
             if (deny.has(toolName)) {
-                return { action: "deny", reason: `tool "${req.toolName}" is denied by policy` };
+                return { action: "deny", message: `tool "${req.toolName}" is denied by policy` };
             }
             if (allow && !allow.has(toolName)) {
-                return { action: "deny", reason: `tool "${req.toolName}" is not in the allowlist` };
+                return { action: "deny", message: `tool "${req.toolName}" is not in the allowlist` };
             }
             return ALLOW;
         },
@@ -66,11 +76,11 @@ export function createApprovalPolicy(opts) {
         async check(req, signal) {
             const toolName = req.toolName;
             if (deny.has(toolName)) {
-                return { action: "deny", reason: `tool "${req.toolName}" is denied by policy` };
+                return { action: "deny", message: `tool "${req.toolName}" is denied by policy` };
             }
             if (need.has(toolName)) {
                 if (signal?.aborted) {
-                    return { action: "deny", reason: `approval aborted for "${req.toolName}" (task ended)` };
+                    return { action: "deny", message: `approval aborted for "${req.toolName}" (task ended)` };
                 }
                 let ok;
                 try {
@@ -79,13 +89,19 @@ export function createApprovalPolicy(opts) {
                 catch (err) {
                     return {
                         action: "deny",
-                        reason: `approval errored for "${req.toolName}": ${err instanceof Error ? err.message : String(err)}`,
+                        message: `approval errored for "${req.toolName}": ${err instanceof Error ? err.message : String(err)}`,
                     };
                 }
-                return ok ? ALLOW : { action: "deny", reason: `approval denied for "${req.toolName}"` };
+                const okRaw = ok;
+                if (okRaw === true)
+                    return ALLOW;
+                if (okRaw !== false) {
+                    return { action: "deny", message: `approval callback for "${req.toolName}" returned an out-of-contract value (${typeof ok}) — denied fail-closed (this policy's \`approve\` returns a boolean: return true or false)` };
+                }
+                return { action: "deny", message: `approval denied for "${req.toolName}"` };
             }
             if (opts.denyByDefault && !auto.has(toolName)) {
-                return { action: "deny", reason: `tool "${req.toolName}" requires explicit allow` };
+                return { action: "deny", message: `tool "${req.toolName}" requires explicit allow` };
             }
             return ALLOW;
         },
@@ -100,7 +116,7 @@ export function combinePolicies(...policies) {
             let current = req;
             let rewrite;
             for (const p of policies) {
-                const d = await p.check(current, signal);
+                const d = refuseOutOfContractDecision(await p.check(current, signal));
                 if (d.action === "deny") {
                     return rewrite?.updatedInput !== undefined ? { ...d, updatedInput: rewrite.updatedInput } : d;
                 }
@@ -130,7 +146,7 @@ export function createCoarseCommandNamePolicy(opts) {
     const shellTools = canonicalToolNameSet(opts.tools);
     const defaultAction = opts.defaultAction ?? "ask";
     const fallback = (reason) => defaultAction === "deny"
-        ? { action: "deny", reason, decisionReason: "rule" }
+        ? { action: "deny", message: reason, decisionReason: "rule" }
         : { action: "ask", message: reason, decisionReason: "rule" };
     return {
         check(req) {
@@ -145,7 +161,7 @@ export function createCoarseCommandNamePolicy(opts) {
                 return fallback(`command is not a single simple command (${parsed.reject})`);
             }
             if (deny.has(parsed.name)) {
-                return { action: "deny", reason: `command "${parsed.name}" is denied by policy`, decisionReason: "rule" };
+                return { action: "deny", message: `command "${parsed.name}" is denied by policy`, decisionReason: "rule" };
             }
             if (allow && !allow.has(parsed.name)) {
                 return fallback(`command "${parsed.name}" is not in the allowlist`);
@@ -394,7 +410,7 @@ export function createUnverifiableDeletePolicy(opts) {
                 action: "ask",
                 decisionReason: "safety",
                 requiresRealApproval: true,
-                reason: `Unverifiable recursive delete (fail-closed unless cleared): ${finding}. ` +
+                message: `Unverifiable recursive delete (fail-closed unless cleared): ${finding}. ` +
                     `Re-run the delete with the resolved literal path written into the command itself ` +
                     `(or assign the variable in the same command, e.g. \`DIR=/exact/path; rm -rf "$DIR"\`) so the target can be verified.`,
             };
@@ -468,7 +484,7 @@ export function createTranscriptIntegrityPolicy(opts) {
         action: "ask",
         decisionReason: "safety",
         requiresRealApproval: true,
-        reason: `Session-transcript write (fail-closed unless cleared): ${what}. Session transcripts (the .jsonl files ` +
+        message: `Session-transcript write (fail-closed unless cleared): ${what}. Session transcripts (the .jsonl files ` +
             `under the agent data dir's sessions/ directory) are harness-written session state, not agent working ` +
             `files — modifying or deleting them tampers with the run's own audit trail. Reading them (ls/cat/grep ` +
             `as a single simple command) is fine.`,
@@ -613,7 +629,15 @@ export async function resolveAsk(req, onAsk, signal) {
         }
         return { action: "allow", updatedInput: edit.value, decisionReason: "mode" };
     }
-    return ok
-        ? { action: "allow", decisionReason: "mode", presentedInput: presented.value }
-        : { action: "deny", message: `approval denied for "${req.toolName}": ${req.message}`, decisionReason: "mode" };
+    const okRaw = ok;
+    if (okRaw === true)
+        return { action: "allow", decisionReason: "mode", presentedInput: presented.value };
+    if (okRaw !== false) {
+        return {
+            action: "deny",
+            message: `the approver for "${req.toolName}" returned an out-of-contract value (${typeof ok}) — denied fail-closed (return true, false, "unavailable", or the {allow} object)`,
+            decisionReason: "mode",
+        };
+    }
+    return { action: "deny", message: `approval denied for "${req.toolName}": ${req.message}`, decisionReason: "mode" };
 }

package/dist/index.d.ts

@@ -40,6 +40,7 @@ export { decideAutoPromote, deriveTripwire, FROZEN_DENYLIST_FLOOR, type AutoProm
 export { runCascade, type CascadeRung, type CascadeConfig, type CascadeAttempt, type CascadeRunResult, type GateVerdict, } from "./agents/cascade.js";
 export { pgQuery, mysqlQuery, sqliteQuery } from "./tools/sql-adapters.js";
 export { materializeMcpTools, MCP_PREFIX, type MaterializedMcp, type McpServerStatus, type McpRefreshResult } from "./core/mcp.js";
+export { PROTOCOL_TABLE, MCP_NAMESPACE, protocolOf, type ProtocolNamespace, type ProtocolId } from "./core/protocol-table.js";
 export { InMemorySessionPolicyStore, SessionPolicyError, loosenReasons, normalizeRules, stripRev, type SessionPolicyStore, type SessionPermissionRules, type StoredSessionRules, type SessionRulesRecord, type PutRulesOptions, } from "./core/session-policy-store.js";
 export { SAFETY_MERGE_CONFORMANCE_CORPUS, type SafetyMergeVector } from "./core/safety-merge-corpus.js";
 export { SAFETY_AXIS_VOCABULARY } from "./core/safety-axis-vocab.js";
@@ -76,7 +77,7 @@ export { InMemoryCheckpointStore, CheckpointError, mintCheckpointToken, checkpoi
 export { InMemoryFileSnapshotStore, DEFAULT_SNAPSHOT_BOUNDS } from "./core/file-snapshot-store.js";
 export { captureManifest, applyManifest } from "./core/file-snapshot-store.js";
 export type { FileSnapshotStore, FileSnapshotResult, FileSnapshotError, FileSnapshotBounds } from "./core/file-snapshot-store.js";
-export { FileStorageBackend, FileSessionRepo, FileCheckpointStore, FileMemoryStore, FileToolResultStore, FileSessionPolicyStore, FileFileSnapshotStore, FileWorkflowJournalStore, MAX_JOURNAL_RESULT_BYTES, oversizeJournalResult, resolveDataRoot, sanitizeScope, sanitizePathComponent, createFileConsolidationLock, atomicWriteFile, writeThenLink, ensureDir, readJsonlRecords, AppendLog, type FileStorageBackendOptions, type FileCheckpointStoreOptions, } from "./stores/file/index.js";
+export { FileStorageBackend, FileSessionRepo, FileCheckpointStore, FileMemoryStore, FileToolResultStore, FileSessionPolicyStore, FileFileSnapshotStore, FileWorkflowJournalStore, MAX_JOURNAL_RESULT_BYTES, oversizeJournalResult, resolveDataRoot, sanitizeScope, sanitizePathComponent, createFileConsolidationLock, atomicWriteFile, writeThenLink, ensureDir, readJsonlRecords, AppendLog, type FileStorageBackendOptions, type FileStorageCorruptReadInfo, type FileSessionRepoOptions, type FileFileSnapshotStoreOptions, type FileCheckpointStoreOptions, } from "./stores/file/index.js";
 export { CacheBreakDetector, type CacheBreakFinding, type ToolFingerprintInput } from "./core/cache-break-detector.js";
 export { maybeCompact, type MaybeCompactOptions, type CompactionWindowSafetyInfo } from "./core/auto-compaction.js";
 export { brainToRuntime } from "./core/runtime.js";
@@ -112,7 +113,7 @@ export { AUTO_MODE_BASE_PROMPT, AUTO_MODE_PERMISSIONS_EXTERNAL } from "./core/au
 export { createPermissionRulePolicy, validatePermissionRules, parsePermissionRule, wildcardMatch, type PermissionRule, type ParsedPermissionRule, type PermissionRuleIssue, type PermissionRuleCaps, type PermissionRulePolicyOptions, } from "./core/permission-rules.js";
 export { formatHookFeedback, runToolGate, type Hooks, type HookToolContext, type HookToolOutput, type PreToolUseResult, type PostToolUseResult, type UserPromptSubmitResult, type HookToolFailure, type PostToolUseFailureResult, type PostToolBatchCall, type PostToolBatchResult, type PreCompactContext, type PreCompactResult, type PostCompactContext, type StopFailureContext, type PermissionDeniedPayload, type PermissionDeniedSource, } from "./core/hooks.js";
 export { InMemoryMemoryStore, composeMemoryBlock, composeLayeredMemoryBlock, normalizeMemorySpec, type NormalizedMemorySpec, type MemorySpecInput, supportsConsolidation, supportsPeriodicConsolidation, firstSentence, expandLexicalTerms, lexicalSearchMatch, type Embedder, classifyPromotable, enforcePromotableWriteGate, guardedMemoryStore, MemoryGateError, detectSecret, enforceSecretWriteGate, enforceStructuredNoteSecretGate, type UtilityGate, type MemoryStore, type MemoryVectorMode, type ScoredMemory, type MemoryNoteHeader, type MemoryNoteRecord, type MemoryNoteType, type StructuredNoteInput, } from "./core/memory.js";
-export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, type MemoryBackendContractHooks, buildMemoryInstruction, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, type MemoryAnnouncement, type ScanFinding, type MemoryEngineOptions, type MemoryInjection, type MemoryBackend, type MemoryEntry, type MemoryEntryFrontmatter, type MemoryEntryHeader, type ScoredMemoryEntry, type NotePatch, type PatchReport, type MaterializedFile, type MemorySessionHandle, type HarvestReport, type HarvestRejection, type HarvestRejectionCode, type ParsedEntryFile, type ScannedEntryFile, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, type ParsedScopeKey, migrateScope, type MigrateScopeReport, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, type RemoteMemoryFile, type RemoteMemoryBaseline, type RemoteMaterialization, type RemoteHarvestResult, type InboundEntryFinding, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, type MemorySyncCursor, type MemorySyncConflict, type MemorySyncPlan, type RecallSource, syncMemoryScope, type MemorySyncTransport, type MemorySyncRequestBody, type MemorySyncResponseBody, type MemorySyncClientConflict, type SyncMemoryScopeOptions, type MemorySyncClientResult, } from "./core/memory-engine/index.js";
+export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, type MemoryBackendContractHooks, buildMemoryInstruction, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, type MemoryAnnouncement, type ScanFinding, type MemoryEngineOptions, type MemoryInjection, type MemoryBackend, type MemoryEntry, type MemoryEntryFrontmatter, type MemoryEntryHeader, type ScoredMemoryEntry, type NotePatch, type PatchReport, type MaterializedFile, type MemorySessionHandle, type HarvestReport, type HarvestRejection, type HarvestRejectionCode, type ParsedEntryFile, type ScannedEntryFile, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, type ParsedScopeKey, migrateScope, type MigrateScopeReport, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, type RemoteMemoryFile, type RemoteMemoryBaseline, type RemoteMaterialization, type RemoteHarvestResult, type InboundEntryFinding, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, type MemorySyncCursor, type MemorySyncConflict, type MemorySyncPlan, type RecallSource, syncMemoryScope, type MemorySyncTransport, type MemorySyncRequestBody, type MemorySyncResponseBody, type MemorySyncClientConflict, type SyncMemoryScopeOptions, type MemorySyncClientResult, } from "./core/memory-engine/index.js";
 export { termSet, jaccardDistance, cosineDistance } from "./core/memory-vector.js";
 export { encodeSurfacedKey, buildManifestText, validateSelectedIds, composeSelectiveBody, formatMemoryAge, resolveLinkedIds, RECALL_CAVEAT, DEFAULT_MAX_SELECTED, DEFAULT_MAX_LINKED, type MemorySelector, type MemorySelectRequest, type SelectiveRecallOptions, type SelectiveRecallResult, type LayeredRecallOptions, type LayeredRecallResult, type ScopedNoteHeader, type ScopedNoteRecord, } from "./core/memory-recall.js";
 export { runMemoryConsolidation, CONSOLIDATION_SYSTEM_PROMPT, DEFAULT_CONSOLIDATION_BAND, DEFAULT_CONSOLIDATION_SEARCH_LIMIT, DEFAULT_CONSOLIDATION_MAX_NOTES, DEFAULT_CONSOLIDATION_TIMEOUT_SEC, normalizeForExactMatch, type ConsolidationParams, type ConsolidationStats, type ConsolidationNote, type ConsolidationLLM, } from "./core/runner/memory-consolidation.js";

package/dist/index.js

@@ -37,6 +37,7 @@ export { decideAutoPromote, deriveTripwire, FROZEN_DENYLIST_FLOOR, } from "./cor
 export { runCascade, } from "./agents/cascade.js";
 export { pgQuery, mysqlQuery, sqliteQuery } from "./tools/sql-adapters.js";
 export { materializeMcpTools, MCP_PREFIX } from "./core/mcp.js";
+export { PROTOCOL_TABLE, MCP_NAMESPACE, protocolOf } from "./core/protocol-table.js";
 export { InMemorySessionPolicyStore, SessionPolicyError, loosenReasons, normalizeRules, stripRev, } from "./core/session-policy-store.js";
 export { SAFETY_MERGE_CONFORMANCE_CORPUS } from "./core/safety-merge-corpus.js";
 export { SAFETY_AXIS_VOCABULARY } from "./core/safety-axis-vocab.js";
@@ -99,7 +100,7 @@ export { AUTO_MODE_BASE_PROMPT, AUTO_MODE_PERMISSIONS_EXTERNAL } from "./core/au
 export { createPermissionRulePolicy, validatePermissionRules, parsePermissionRule, wildcardMatch, } from "./core/permission-rules.js";
 export { formatHookFeedback, runToolGate, } from "./core/hooks.js";
 export { InMemoryMemoryStore, composeMemoryBlock, composeLayeredMemoryBlock, normalizeMemorySpec, supportsConsolidation, supportsPeriodicConsolidation, firstSentence, expandLexicalTerms, lexicalSearchMatch, classifyPromotable, enforcePromotableWriteGate, guardedMemoryStore, MemoryGateError, detectSecret, enforceSecretWriteGate, enforceStructuredNoteSecretGate, } from "./core/memory.js";
-export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, buildMemoryInstruction, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, migrateScope, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, syncMemoryScope, } from "./core/memory-engine/index.js";
+export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, buildMemoryInstruction, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, migrateScope, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, syncMemoryScope, } from "./core/memory-engine/index.js";
 export { termSet, jaccardDistance, cosineDistance } from "./core/memory-vector.js";
 export { encodeSurfacedKey, buildManifestText, validateSelectedIds, composeSelectiveBody, formatMemoryAge, resolveLinkedIds, RECALL_CAVEAT, DEFAULT_MAX_SELECTED, DEFAULT_MAX_LINKED, } from "./core/memory-recall.js";
 export { runMemoryConsolidation, CONSOLIDATION_SYSTEM_PROMPT, DEFAULT_CONSOLIDATION_BAND, DEFAULT_CONSOLIDATION_SEARCH_LIMIT, DEFAULT_CONSOLIDATION_MAX_NOTES, DEFAULT_CONSOLIDATION_TIMEOUT_SEC, normalizeForExactMatch, } from "./core/runner/memory-consolidation.js";

package/dist/orchestration/run-spec.js

@@ -28,7 +28,7 @@ function frozenDenyPolicy(rootDir, frozenResolved) {
             const absForm = isAbsolutePathForm(raw);
             const abs = pathKey(absForm ? raw : resolve(rootDir, raw));
             if (frozen.has(abs)) {
-                return { action: "deny", reason: `${raw} is part of the frozen specification surface (read-only).` };
+                return { action: "deny", message: `${raw} is part of the frozen specification surface (read-only).` };
             }
             return { action: "allow" };
         },