@sema-agent/core 5.17.0 → 5.18.0

package/dist/core/runner/prepare-task.js

@@ -21,6 +21,8 @@ import { createAgentTranscriptTool, AGENT_TRANSCRIPT_TOOL_NAME } from "../../age
 import { createSendMessageTool, SEND_MESSAGE_TOOL_NAME } from "../../agents/send-message-tool.js";
 import { SubagentRetainLedger } from "../../agents/retain-ledger.js";
 import { askApproverIdentity, combinePolicies, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, describeThrown, refuseOutOfContractDecision, resolveAsk, toolPolicyNameSets, tryCloneArgs } from "../tool-policy.js";
+const PERSISTED_RULE_TOOL = "Bash";
+import { findAdmittingRule, suggestRulesForCommand } from "../permission-rule-model.js";
 import { ActiveSkillScope, createActiveSkillScopePolicy } from "./active-skill-scope.js";
 import { CHANGED_FILES_MTIME_EPS_MS, fenceMcpServerInstructions, renderAgentListingDelta } from "./turn-attachments.js";
 import { inlineUntrusted } from "../untrusted-text.js";
@@ -41,6 +43,9 @@ import { compileOutputSchema } from "./strict-output-schema.js";
 import { TOOL_SEARCH_NAME, buildDeferredRegistry, classifyDeferred, extractDiscoveredToolNames, createPlaceholderTool, createToolSearchTool, staticSchemaRenderable, } from "./tool-disclosure.js";
 import { createSharedMemoryTools } from "../shared-memory/tools.js";
 import { SHARED_MEMORY_TOOL_NAMES } from "../shared-memory/types.js";
+import { MEMORY_ENGINE_TOOL_NAMES } from "../memory-engine/tools.js";
+import { MEMORY_RECALL_DISCIPLINE } from "../memory-engine/engine.js";
+import { classifyToolContentOrigin, contentOriginPollutes, delegationCallIsExternal } from "../memory-engine/content-origin.js";
 import { composeMemoryBlock } from "../memory.js";
 import { preflightLockedConfig } from "../locked-config.js";
 import { COMPLIANCE_CAPABILITIES, WEB_FETCH_TOOL_NAME, complianceCallDenial, resolveComplianceDenies } from "../compliance.js";
@@ -1389,6 +1394,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         }
         tools.push(...mcp.tools.map((t) => remoteToolOffload(t)));
         const rebuildHarnessToolsRef = {};
+        const contentOriginWrapRef = {};
         const toolCallGateArmedRef = { armed: false };
         if (lockedPreflight.mcp?.length) {
             tools.push({
@@ -1868,13 +1874,23 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     .catch(() => undefined);
             }
             : undefined;
-        const { memoryEngineSession, memoryBlock: memoryBlockFromEngine, seedFiles: memorySeedFiles, admittedOrgScopes: memoryAdmittedOrgScopes, ownOrgVerdict: memoryOwnOrgVerdict, } = await prepareMemory({
+        const memoryPairNameDomain = new Set();
+        for (const t of tools) {
+            memoryPairNameDomain.add(t.name);
+            for (const alias of t.aliases ?? [])
+                memoryPairNameDomain.add(alias);
+        }
+        const memoryPairExcludedName = MEMORY_ENGINE_TOOL_NAMES.find((n) => (toolFaceSnapshot.exclude ?? []).includes(n));
+        const memoryPairOccupiedName = MEMORY_ENGINE_TOOL_NAMES.find((n) => memoryPairNameDomain.has(n));
+        const memorySearchToolsPlanned = memoryPairExcludedName === undefined && memoryPairOccupiedName === undefined;
+        const { memoryEngineSession, memoryBlock: memoryBlockFromEngine, memoryTools, seedFiles: memorySeedFiles, admittedOrgScopes: memoryAdmittedOrgScopes, ownOrgVerdict: memoryOwnOrgVerdict, } = await prepareMemory({
             spec,
             deps,
             sessionId,
             taskRootPath,
             memoryWriteGateRef,
             writeToolsMounted: tools.some((t) => t.name === "Write") && !(toolFaceSnapshot.exclude?.includes("Write") ?? false),
+            memorySearchToolsPlanned,
             admissionCtx: {
                 orgMemoryDenied: complianceDenies.has("org_memory_mount"),
                 complianceDegraded,
@@ -2012,6 +2028,18 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 sharedMemoryPairMounted = true;
             }
         }
+        let memoryEnginePairMounted = false;
+        if (memoryTools !== undefined && memoryTools.length > 0) {
+            tools.push(...memoryTools.map((s) => defineTool(s)));
+            memoryEnginePairMounted = true;
+        }
+        else if (memoryEngineSession !== undefined && !memorySearchToolsPlanned) {
+            deps.onError?.(new Error(`Memory tools ${MEMORY_ENGINE_TOOL_NAMES.join("/")} were NOT mounted: ` +
+                (memoryPairExcludedName !== undefined
+                    ? `excludeTools removes "${memoryPairExcludedName}"`
+                    : `this task already declares a tool named "${memoryPairOccupiedName}" (the built-in yields to it)`) +
+                " — the pair mounts together or not at all."), { phase: "config", sessionId, classification: "memory-tools-not-mounted" });
+        }
         const skillsListing = skillSpecs.length > 0
             ? {
                 entries: skillSpecs.map((s) => ({
@@ -2216,22 +2244,39 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             }
             return deferredSet;
         };
-        const sharedMemoryPair = SHARED_MEMORY_TOOL_NAMES.filter((n) => tools.some((t) => t.name === n));
+        const sharedMemoryPair = sharedMemoryPairMounted ? SHARED_MEMORY_TOOL_NAMES.filter((n) => tools.some((t) => t.name === n)) : [];
+        const memoryEnginePair = memoryEnginePairMounted ? MEMORY_ENGINE_TOOL_NAMES.filter((n) => tools.some((t) => t.name === n)) : [];
+        const builtinDeferPairNames = [...sharedMemoryPair, ...memoryEnginePair];
         let deferred;
-        if (sharedMemoryPairMounted && sharedMemoryPair.length > 0) {
-            const withoutPair = tools.filter((t) => !sharedMemoryPair.some((n) => n === t.name));
-            const d1 = classifyDeferredOverFace(tools, sharedMemoryPair);
-            const d0 = classifyDeferredOverFace(withoutPair, []);
+        if (builtinDeferPairNames.length > 0) {
+            const withoutPairs = tools.filter((t) => !builtinDeferPairNames.some((n) => n === t.name));
+            const d1 = classifyDeferredOverFace(tools, builtinDeferPairNames);
+            const d0 = classifyDeferredOverFace(withoutPairs, []);
             const soleCause = d0.size === 0 && d1.size > 0;
             const supportNameTaken = tools.some((t) => t.name === TOOL_SEARCH_NAME || (t.aliases ?? []).includes(TOOL_SEARCH_NAME));
             if (soleCause && supportNameTaken) {
                 for (let i = tools.length - 1; i >= 0; i--) {
-                    if (sharedMemoryPair.some((n) => n === tools[i].name))
+                    if (builtinDeferPairNames.some((n) => n === tools[i].name))
                         tools.splice(i, 1);
                 }
-                sharedMemoryPairMounted = false;
-                deps.onError?.(new Error(`Shared memory tools ${SHARED_MEMORY_TOOL_NAMES.join("/")} were NOT mounted: mounting them would inject ` +
-                    `the "${TOOL_SEARCH_NAME}" tool, whose name this task already declares — the pair mounts together or not at all.`), { phase: "config", sessionId, classification: "shared-memory-not-mounted" });
+                if (sharedMemoryPair.length > 0) {
+                    sharedMemoryPairMounted = false;
+                    deps.onError?.(new Error(`Shared memory tools ${SHARED_MEMORY_TOOL_NAMES.join("/")} were NOT mounted: mounting them would inject ` +
+                        `the "${TOOL_SEARCH_NAME}" tool, whose name this task already declares — the pair mounts together or not at all.`), { phase: "config", sessionId, classification: "shared-memory-not-mounted" });
+                }
+                if (memoryEnginePair.length > 0) {
+                    memoryEnginePairMounted = false;
+                    if (memoryBlock !== undefined) {
+                        if (memoryBlock === MEMORY_RECALL_DISCIPLINE)
+                            memoryBlock = undefined;
+                        else if (memoryBlock.includes(`\n\n${MEMORY_RECALL_DISCIPLINE}`))
+                            memoryBlock = memoryBlock.replace(`\n\n${MEMORY_RECALL_DISCIPLINE}`, "");
+                        else if (memoryBlock.startsWith(`${MEMORY_RECALL_DISCIPLINE}\n\n`))
+                            memoryBlock = memoryBlock.slice(MEMORY_RECALL_DISCIPLINE.length + 2);
+                    }
+                    deps.onError?.(new Error(`Memory tools ${MEMORY_ENGINE_TOOL_NAMES.join("/")} were NOT mounted: mounting them would inject ` +
+                        `the "${TOOL_SEARCH_NAME}" tool, whose name this task already declares — the pair mounts together or not at all.`), { phase: "config", sessionId, classification: "memory-tools-not-mounted" });
+                }
                 deferred = d0;
             }
             else {
@@ -2241,6 +2286,78 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         else {
             deferred = classifyDeferredOverFace(tools, []);
         }
+        if (memoryEngineSession !== undefined) {
+            const { pollution, contentSafety } = memoryEngineSession;
+            const callerToolNames = new Set((spec.tools ?? []).map((t) => t.name));
+            const contentOriginWrapped = new WeakSet();
+            const classOf = (t) => classifyToolContentOrigin({
+                declared: t.contentOrigin,
+                isProtocolTool: protocolOf(t.name) !== undefined,
+                isCallerTool: callerToolNames.has(t.name),
+                trusted: contentSafety.trustedTools.has(t.name),
+            });
+            const delegationByName = new Map();
+            for (const t of spec.tools ?? []) {
+                const withFaces = t;
+                if (withFaces.agentToolFaces === undefined && t.agentListing === undefined)
+                    continue;
+                delegationByName.set(t.name, { faces: withFaces.agentToolFaces, pool: withFaces.agentToolPool });
+            }
+            const poolToolPollutes = (t) => contentOriginPollutes(classifyToolContentOrigin({
+                declared: t.contentOrigin,
+                isProtocolTool: protocolOf(t.name) !== undefined,
+                isCallerTool: true,
+                trusted: contentSafety.trustedTools.has(t.name),
+            }), contentSafety.execIsExternalContent);
+            contentOriginWrapRef.current = () => {
+                for (let i = 0; i < tools.length; i++) {
+                    const t = tools[i];
+                    if (contentOriginWrapped.has(t))
+                        continue;
+                    const origin = classOf(t);
+                    const delegation = delegationByName.get(t.name);
+                    const isDelegation = delegation !== undefined;
+                    const pollutes = contentOriginPollutes(origin, contentSafety.execIsExternalContent);
+                    if (!pollutes && !isDelegation) {
+                        contentOriginWrapped.add(t);
+                        continue;
+                    }
+                    const inner = t.execute.bind(t);
+                    const mark = (reason) => {
+                        try {
+                            pollution.markPolluted(reason);
+                        }
+                        catch {
+                        }
+                    };
+                    const wrapped = {
+                        ...t,
+                        execute: async (toolCallId, params, signal, onUpdate) => {
+                            if (pollutes)
+                                mark(`tool "${t.name}" (${origin} content class) was invoked in this session`);
+                            if (!isDelegation)
+                                return inner(toolCallId, params, signal, onUpdate);
+                            const requested = params?.subagent_type;
+                            const external = delegationCallIsExternal({
+                                requestedType: typeof requested === "string" ? requested : undefined,
+                                faces: delegation.faces,
+                                pool: delegation.pool,
+                                isPolluting: poolToolPollutes,
+                            });
+                            const result = await inner(toolCallId, params, signal, onUpdate);
+                            if (external) {
+                                mark(`tool "${t.name}" returned the output of a delegated agent whose tool face can reach external content` +
+                                    (typeof requested === "string" ? ` (subagent_type "${requested}")` : " (no subagent_type named — classified fail-closed)"));
+                            }
+                            return result;
+                        },
+                    };
+                    contentOriginWrapped.add(wrapped);
+                    tools[i] = wrapped;
+                }
+            };
+            contentOriginWrapRef.current();
+        }
         let centerAdoption;
         let centerAdoptionFresh = false;
         {
@@ -2485,6 +2602,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             const withdrawnTools = new Set();
             const deltaRef = toolsDeltaRef;
             const rematerialize = async (active) => {
+                contentOriginWrapRef.current?.();
                 const list = buildToolList(active);
                 await harnessRef.current.setTools(list, list.map((t) => t.name));
                 if (fpRef.current)
@@ -2528,6 +2646,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         }
         else {
             rebuildHarnessToolsRef.current = async () => {
+                contentOriginWrapRef.current?.();
                 const list = [...tools];
                 await harnessRef.current.setTools(list, list.map((t) => t.name));
                 if (fpRef.current)
@@ -2864,6 +2983,47 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 return {};
             return { riskAxes: { ...(irreversible !== undefined ? { irreversible } : {}), ...(egress !== undefined ? { egress } : {}) } };
         };
+        const permissionRuleLane = (() => {
+            const provider = deps.permissionRuleStore;
+            if (provider === undefined)
+                return undefined;
+            const root = taskRootPath;
+            return {
+                admits: async (req) => {
+                    if (spec.principal === undefined || spec.principal === "")
+                        return undefined;
+                    if (req.toolName !== PERSISTED_RULE_TOOL)
+                        return undefined;
+                    const command = req.args?.command;
+                    if (typeof command !== "string")
+                        return undefined;
+                    let listed;
+                    try {
+                        listed = await provider.forPrincipal(spec.principal).list();
+                    }
+                    catch (err) {
+                        emitTrace(deps.tracer, () => ({
+                            kind: "permission.rule_store_unreadable",
+                            version: 1,
+                            taskId: spec.taskId ?? sessionId,
+                            message: err instanceof Error ? err.message : String(err),
+                            ts: Date.now(),
+                        }));
+                        return undefined;
+                    }
+                    return findAdmittingRule(listed.rules, { tool: req.toolName, command, cwd: root })?.rule;
+                },
+            };
+        })();
+        const ruleSuggestionsOf = (toolName, args) => {
+            if (permissionRuleLane === undefined || toolName !== PERSISTED_RULE_TOOL)
+                return {};
+            const command = args?.command;
+            if (typeof command !== "string")
+                return {};
+            const suggestions = suggestRulesForCommand(command);
+            return suggestions.length > 0 ? { ruleSuggestions: suggestions } : {};
+        };
         const recheckApprovedEdit = async (pol, onAskOf, creq, edit, csignal) => {
             let editArgs = edit;
             for (let round = 0;; round++) {
@@ -2894,6 +3054,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     toolName: creq.toolName,
                     toolCallId: creq.toolCallId,
                     args: editArgs,
+                    ...ruleSuggestionsOf(creq.toolName, editArgs),
                     message: re.message ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
                     ...askSourceIdentity(),
                     ...riskAxesOf(creq.toolName),
@@ -2942,6 +3103,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         toolName: creq.toolName,
                         toolCallId: creq.toolCallId,
                         args: presentedArgs,
+                        ...ruleSuggestionsOf(creq.toolName, presentedArgs),
                         message: first.message ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
                         ...askSourceIdentity(),
                         ...riskAxesOf(creq.toolName),
@@ -3000,6 +3162,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         toolName: creq.toolName,
                         toolCallId: creq.toolCallId,
                         args: presentedArgs,
+                        ...ruleSuggestionsOf(creq.toolName, presentedArgs),
                         message: decision.message ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
                         ...askSourceIdentity(),
                         ...riskAxesOf(creq.toolName),
@@ -3215,6 +3378,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             ...(checkpointStore !== undefined ? { checkpointDurability: resolveDeclaredDurability(checkpointStore, "checkpointStore") } : {}),
             sessionDurability: resolveDeclaredDurability(sessions, "sessionStore"),
             backgroundAgentStoreWired: deps.backgroundAgentStore !== undefined,
+            permissionRuleStoreWired: deps.permissionRuleStore !== undefined,
             hostChildEventSinkWired: deps.onBackgroundChildEvent !== undefined,
             lockedConfigWired: deps.lockedConfig !== undefined,
             complianceWired: deps.compliancePostureResolver !== undefined,
@@ -3303,6 +3467,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         const preview = approvalPreviewOf(req.toolName, req.args);
                         return preview !== undefined ? { preview } : {};
                     })(),
+                    ...ruleSuggestionsOf(req.toolName, req.args),
                     message: decision.message ?? `approval required for "${req.toolName}"`,
                     ...askSourceIdentity(),
                     ...riskAxesOf(req.toolName),
@@ -3854,6 +4019,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                                     const preview = approvalPreviewOf(req.toolName, parkedArgs);
                                     return preview !== undefined ? { preview } : {};
                                 })(),
+                                ...ruleSuggestionsOf(req.toolName, parkedArgs),
                                 boundInputHash: boundInputHashOf(parkedArgs),
                                 batchToolCallIds,
                                 completedCallIds,
@@ -3961,6 +4127,22 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             onHookError: notifyHookError,
                             shellGated: (e.toolName === "Bash" && shellGatedBash) || (e.toolName === "Monitor" && shellGatedMonitor),
                             ...(autoModeDecider ? { autoMode: { decider: autoModeDecider } } : {}),
+                            ...(permissionRuleLane
+                                ? {
+                                    persistedRules: {
+                                        admits: permissionRuleLane.admits,
+                                        onResolved: (info) => emitTrace(deps.tracer, () => ({
+                                            kind: "permission.persisted_rule_allowed",
+                                            version: 1,
+                                            taskId: spec.taskId ?? sessionId,
+                                            toolName: info.toolName,
+                                            toolCallId: info.toolCallId,
+                                            rule: info.rule,
+                                            ts: Date.now(),
+                                        })),
+                                    },
+                                }
+                                : {}),
                             isMarkedUnresolvable: (toolCallId) => inheritedUnavailableAsks.has(toolCallId),
                         });
                     }

package/dist/core/runner/runtask.js

@@ -328,6 +328,24 @@ function platformLimitTerminal(reason, retryAfterMs, moment = "turn_boundary") {
         e.retryAfterMs = retryAfterMs;
     return e;
 }
+const disclosedUnevaluableWindow = new WeakSet();
+function discloseUnevaluableWindow(u, prepared, tracer, taskId, onError) {
+    if (disclosedUnevaluableWindow.has(prepared))
+        return;
+    disclosedUnevaluableWindow.add(prepared);
+    emitTrace(tracer, () => ({ kind: "compaction.unevaluable", version: 1, taskId, estTokens: u.estTokens, ts: Date.now() }));
+    const modelClause = u.modelId !== undefined ? ` "${u.modelId}"` : "";
+    const cause = u.windowValue !== undefined
+        ? `its \`${u.windowField}\` is ${u.windowValue}, which is not a positive number of tokens — that field takes precedence over the ` +
+            `others, so fixing or removing it is what restores the threshold`
+        : `it declares no context window at all (\`autoCompactTokens\` / \`contextTokens\` / \`contextWindow\` are all absent) — declare one to restore the threshold`;
+    try {
+        onError?.(new Error(`auto-compaction cannot run for model${modelClause}: ${cause}. Until then there is no threshold to compare against, so the ` +
+            `context will grow until the provider refuses the request. The conversation is already about ${u.estTokens} estimated tokens.`), { phase: "config", sessionId: prepared.sessionId });
+    }
+    catch {
+    }
+}
 function makeTurnBoundary(prepared, stats, rs, deps) {
     const { spec, queue, manualCompactRef, todoToolMounted, taskToolsMounted, walltimeMonotonicDeadline, timeout, ident, postToolBatchHook, batchArgs, compactionBrain, withinTaskCompaction, compactionBreaker, windowSafetyOptions, rapidRefill, drainManualCompact, runnerHooks } = deps;
     let finalVerifySeenAtLastBoundary = 0;
@@ -853,6 +871,9 @@ function makeTurnBoundary(prepared, stats, rs, deps) {
             if (comp.contextUsage) {
                 queue.push({ type: "context_usage", ...comp.contextUsage, ...ident() });
             }
+            if (comp.unevaluableWindow) {
+                discloseUnevaluableWindow(comp.unevaluableWindow, prepared, rs.telemetry.tracer, rs.telemetry.taskId, runnerHooks.onError);
+            }
             if (comp.suppressedByFloor) {
                 const s = comp.suppressedByFloor;
                 emitTrace(rs.telemetry.tracer, () => ({
@@ -3969,6 +3990,9 @@ export class Runner {
                     ...this.compactionHookOptions(spec, prepared.sessionId, "auto"),
                 });
                 this.recordCompactionReuse(prepared, finishComp);
+                if (finishComp.unevaluableWindow) {
+                    discloseUnevaluableWindow(finishComp.unevaluableWindow, prepared, spec.tracer ?? this.deps.tracer, spec.taskId ?? prepared.sessionId, this.deps.onError);
+                }
                 comp = finishComp;
             }
             catch (err) {

package/dist/core/runner/tool-output-projection.js

@@ -62,7 +62,7 @@ const CC_DETAIL_TYPES = new Set([
     "agent", "task", "task-list", "task-output", "workflow-run",
     "web-fetch", "web-search", "todo", "cron-create", "cron-delete", "cron-list", "image",
     "task-stop", "tool-search", "repo-map", "fork", "enter-plan-mode", "exit-plan-mode",
-    "monitor-start", "path_not_in_root", "readonly_out_of_root",
+    "monitor-start", "path_not_in_root", "readonly_out_of_root", "bash_invalid_timeout",
     "report-findings", "schedule-wakeup", "send-message", "agent-transcript", "a2a", "document",
 ]);
 export const structuredFrom = (result) => {

package/dist/core/tool-policy.d.ts

@@ -8,7 +8,7 @@ export interface ToolCallRequest {
         suspendCount: number;
     };
 }
-export type DecisionReason = "rule" | "mode" | "hook" | "safety" | "classifier";
+export type DecisionReason = "rule" | "mode" | "hook" | "safety" | "classifier" | "persisted_rule";
 export type PermissionResult = {
     action: "allow";
     updatedInput?: unknown;
@@ -43,6 +43,12 @@ export declare function toolPolicyNameSets(p: ToolPolicy | undefined): readonly
 export declare function createAllowDenyPolicy(opts: {
     allow?: string[];
     deny?: string[];
+    onInvalidName?: "throw" | "skip";
+    onInvalidNameIssue?: (issue: {
+        entry: string;
+        list: "allow" | "deny";
+        message: string;
+    }) => void;
 }): NamedToolPolicy;
 export declare function createApprovalPolicy(opts: {
     requireApproval: string[];
@@ -81,6 +87,7 @@ export interface AskRequest {
     args: unknown;
     readonly preview?: unknown;
     readonly boundInputHash?: string;
+    readonly ruleSuggestions?: readonly import("./permission-rule-model.js").RuleSuggestion[];
     message: string;
     readonly principal?: string;
     readonly sourceTaskId?: string;

package/dist/core/tool-policy.js

@@ -3,6 +3,7 @@ import { isAbsolute, join, normalize as normalizePath, sep } from "node:path";
 import { BASH_READONLY_DEFAULT_ALLOW, parseLeadingCommandName } from "../tools/fs/index.js";
 import { boundInputHashOf } from "./canonical-json.js";
 import { inlineUntrusted } from "./untrusted-text.js";
+import { parsePermissionRule } from "./permission-rules.js";
 import { writeTargetPath } from "../tools/fs/safety.js";
 export function decisionText(d) {
     return d.message;
@@ -44,6 +45,41 @@ export function toolPolicyNameSets(p) {
     return Array.isArray(sets) ? sets : [];
 }
 export function createAllowDenyPolicy(opts) {
+    const invalid = [];
+    const screen = (entries, list) => {
+        if (entries === undefined)
+            return undefined;
+        const kept = [];
+        for (const entry of entries) {
+            if (parsePermissionRule(entry).ruleContent === undefined) {
+                kept.push(entry);
+                continue;
+            }
+            invalid.push({
+                entry,
+                list,
+                message: `"${entry}" is a rule CONTENT form, not a tool name — a name set matches raw tool names, so this entry ` +
+                    `can never match any mounted tool (in an allow list it removes the tool entirely). Use the tool NAME here, ` +
+                    `and route the narrowing through the lane that speaks this grammar: parameter rules via ` +
+                    `createPermissionRulePolicy, Bash command prefixes via the persisted allow-rule lane.`,
+            });
+        }
+        return kept;
+    };
+    const screenedAllow = screen(opts.allow, "allow");
+    const screenedDeny = screen(opts.deny, "deny");
+    if (invalid.length > 0) {
+        if ((opts.onInvalidName ?? "throw") === "throw") {
+            const e = new Error(`createAllowDenyPolicy: ${invalid.length} entr${invalid.length === 1 ? "y is" : "ies are"} not tool name(s):\n` +
+                invalid.map((i) => `  [${i.list}] ${i.message}`).join("\n"));
+            e.code = "config.invalid_tool_name_set";
+            e.issues = invalid;
+            throw e;
+        }
+        for (const issue of invalid)
+            opts.onInvalidNameIssue?.(issue);
+    }
+    opts = { ...opts, ...(screenedAllow ? { allow: screenedAllow } : {}), ...(screenedDeny ? { deny: screenedDeny } : {}) };
     const allow = opts.allow ? new Set(opts.allow) : undefined;
     const deny = new Set(opts.deny ?? []);
     return {

package/dist/core/tools.js

@@ -45,6 +45,7 @@ export function defineTool(spec, options) {
         executionMode,
         ...(spec.isConcurrencySafe ? { isConcurrencySafe: spec.isConcurrencySafe } : {}),
         ...(spec.effect ? { effect: spec.effect } : {}),
+        ...(spec.contentOrigin ? { contentOrigin: spec.contentOrigin } : {}),
         ...(spec.prepareArguments ? { prepareArguments: spec.prepareArguments } : {}),
         ...(spec.approvalPreview ? { approvalPreview: spec.approvalPreview } : {}),
         execute: async (toolCallId, rawParams, signal) => {

package/dist/core/trace.d.ts

@@ -181,6 +181,20 @@ export type TraceEvent = {
     site: string;
     message: string;
     ts: number;
+} | {
+    kind: "permission.persisted_rule_allowed";
+    version: 1;
+    taskId: string;
+    toolName: string;
+    toolCallId: string;
+    rule: string;
+    ts: number;
+} | {
+    kind: "permission.rule_store_unreadable";
+    version: 1;
+    taskId: string;
+    message: string;
+    ts: number;
 } | {
     kind: "brain.failover";
     version: 1;
@@ -217,6 +231,12 @@ export type TraceEvent = {
     estTokens: number;
     floor: number;
     ts: number;
+} | {
+    kind: "compaction.unevaluable";
+    version: 1;
+    taskId: string;
+    estTokens: number;
+    ts: number;
 } | {
     kind: "compaction.blocked";
     version: 1;

package/dist/core/types.d.ts

@@ -20,6 +20,7 @@ export interface Brain {
     complete?: CompleteSimpleFn;
 }
 export type ToolEffect = "read" | "write" | "idempotent";
+export type ToolContentOrigin = "external" | "execution" | "local";
 export interface ToolSpec<TParams extends TSchema = TSchema> {
     name: string;
     aliases?: string[];
@@ -30,6 +31,17 @@ export interface ToolSpec<TParams extends TSchema = TSchema> {
         name: string;
         description: string;
     }>;
+    agentToolFaces?: ReadonlyArray<{
+        name: string;
+        allowTools?: readonly string[];
+        denyTools?: readonly string[];
+        canRedelegate?: boolean;
+    }>;
+    agentToolPool?: ReadonlyArray<{
+        name: string;
+        aliases?: readonly string[];
+        contentOrigin?: ToolContentOrigin;
+    }>;
     approvalPreview?: (args: unknown) => unknown;
     agentModels?: readonly string[];
     withAgents?: (agents: ReadonlyArray<AgentDefinition>) => ToolSpec;
@@ -42,6 +54,7 @@ export interface ToolSpec<TParams extends TSchema = TSchema> {
     } | Promise<{
         reversible: boolean;
     }>;
+    contentOrigin?: ToolContentOrigin;
     executionMode?: "sequential" | "parallel";
     isConcurrencySafe?: (args: unknown) => boolean;
     parameters: TParams;
@@ -772,6 +785,7 @@ export interface RunnerDeps {
     checkpointStore?: import("./checkpoint-store.js").CheckpointStore;
     fileSnapshotStore?: import("./file-snapshot-store.js").FileSnapshotStore;
     sessionPolicyStore?: import("./session-policy-store.js").SessionPolicyStore;
+    permissionRuleStore?: import("./permission-rule-store.js").PermissionRuleStoreProvider;
     runtimeCapsResolver?: (principal: string | undefined) => RuntimeCaps | undefined | Promise<RuntimeCaps | undefined>;
     lockedConfig?: import("./locked-config.js").LockedConfig;
     compliancePostureResolver?: (principal: string | undefined) => import("./compliance.js").CompliancePosture | undefined | Promise<import("./compliance.js").CompliancePosture | undefined>;

package/dist/core/wiring-manifest.d.ts

@@ -43,6 +43,9 @@ export interface WiringManifest {
         backgroundAgentStore: boolean;
         hostChildEventSink: boolean;
     };
+    permissionRules: {
+        storeWired: boolean;
+    };
     governance: {
         audience: "operator";
         lockedConfig: boolean;
@@ -71,13 +74,14 @@ export interface WiringFacts {
     checkpointDurability?: StoreDurability;
     sessionDurability: StoreDurability;
     backgroundAgentStoreWired: boolean;
+    permissionRuleStoreWired: boolean;
     hostChildEventSinkWired: boolean;
     lockedConfigWired: boolean;
     complianceWired: boolean;
     memoryAdmissionWired: boolean;
     retentionPolicyWired: boolean;
 }
-export type StaticWiringDeps = Pick<RunnerDeps, "onAsk" | "onQuestion" | "interactionPosture" | "onElicit" | "checkpointStore" | "sessionStore" | "backgroundAgentStore" | "onBackgroundChildEvent" | "lockedConfig" | "compliancePostureResolver" | "memoryScopeAdmission" | "retentionPolicy">;
+export type StaticWiringDeps = Pick<RunnerDeps, "onAsk" | "onQuestion" | "interactionPosture" | "onElicit" | "checkpointStore" | "sessionStore" | "backgroundAgentStore" | "onBackgroundChildEvent" | "lockedConfig" | "compliancePostureResolver" | "memoryScopeAdmission" | "retentionPolicy" | "permissionRuleStore">;
 export type StaticWiringSpec = Pick<TaskSpec, "onAsk" | "onQuestion" | "checkpointStore" | "durableApproval" | "mcp" | "interactiveTools" | "interactionPosture">;
 export declare function resolveDeclaredDurability(store: {
     readonly durability?: StoreDurability;

package/dist/core/wiring-manifest.js

@@ -86,6 +86,7 @@ export function deriveWiringManifest(facts) {
         parkLane,
         session: { store: manifestDurabilityOf(facts.sessionDurability) },
         fleet: { backgroundAgentStore: facts.backgroundAgentStoreWired, hostChildEventSink: facts.hostChildEventSinkWired },
+        permissionRules: { storeWired: facts.permissionRuleStoreWired },
         governance: {
             audience: "operator",
             lockedConfig: facts.lockedConfigWired,
@@ -177,6 +178,7 @@ export function describeStaticWiring(deps, spec = {}) {
         ...(capable ? { checkpointDurability: resolveDeclaredDurability(checkpointStore, "checkpointStore") } : {}),
         sessionDurability: resolveDeclaredDurability(deps.sessionStore, "sessionStore"),
         backgroundAgentStoreWired: deps.backgroundAgentStore !== undefined,
+        permissionRuleStoreWired: deps.permissionRuleStore !== undefined,
         hostChildEventSinkWired: deps.onBackgroundChildEvent !== undefined,
         lockedConfigWired: deps.lockedConfig !== undefined,
         complianceWired: deps.compliancePostureResolver !== undefined,

package/dist/index.d.ts

@@ -127,9 +127,13 @@ export { parseAutoModeResponse, createAutoModeDecider, type AutoModeVerdict, typ
 export { buildAutoModePrompt, renderAutoModeWindow, renderAutoModeAction, AUTO_MODE_DEFAULTS_SENTINEL, type AutoModeRules, type BuildAutoModePromptOptions, type AutoModeWindowOptions, } from "./core/auto-mode-prompt.js";
 export { AUTO_MODE_BASE_PROMPT, AUTO_MODE_PERMISSIONS_EXTERNAL } from "./core/auto-mode-prompt-assets.js";
 export { createPermissionRulePolicy, validatePermissionRules, parsePermissionRule, wildcardMatch, type PermissionRule, type ParsedPermissionRule, type PermissionRuleIssue, type PermissionRuleCaps, type PermissionRulePolicyOptions, } from "./core/permission-rules.js";
+export { parseAllowRuleText, formatAllowRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, type PersistedAllowRule, type RuleTombstone, type RuleScope, type RuleDot, type RuleAdd, type RuleAddOrigin, type RuleSuggestion, type RuleReject, type RuleRejectCode, type ParsedAllowRule, type PersistedRuleTool, type PersistedRuleMatch, } from "./core/permission-rule-model.js";
+export { removePersistedRule, applyTombstones, sameScope, InMemoryPermissionRuleStore, EMPTY_RULE_STORE, type PermissionRuleStore, type PermissionRuleStoreProvider, type StoredAllowRules, type RemoveResult, type PutResult, } from "./core/permission-rule-store.js";
+export { prepareCardApproval, confirmRuleApproval, redeemRuleTicket, redeemRuleBatch, prepareCcImport, prepareStarterBatch, mintRuleTicket, STARTER_RULES, InMemoryRuleApprovalRecordStore, type RuleTicket, type RuleCandidate, type RuleApprovalKind, type RuleApprovalRecord, type RuleApprovalRecordStore, type RuleConsentDeps, type RedeemResult, type CcImportLayer, type ImportedSettingsLayer, type ImportPreview, type ImportResult, } from "./core/permission-rule-consent.js";
+export { FilePermissionRuleStoreProvider } from "./stores/file/permission-rule-store.js";
 export { formatHookFeedback, runToolGate, createHookEnvCapabilities, type Hooks, type HookToolContext, type HookEnvCapabilities, type HookToolOutput, type PreToolUseResult, type PostToolUseResult, type UserPromptSubmitResult, type HookToolFailure, type PostToolUseFailureResult, type PostToolBatchCall, type PostToolBatchResult, type PreCompactContext, type PreCompactResult, type PostCompactContext, type StopFailureContext, type PermissionDeniedPayload, type PermissionDeniedSource, } from "./core/hooks.js";
 export { InMemoryMemoryStore, composeMemoryBlock, composeLayeredMemoryBlock, normalizeMemorySpec, type NormalizedMemorySpec, type MemorySpecInput, supportsConsolidation, supportsPeriodicConsolidation, firstSentence, expandLexicalTerms, lexicalSearchMatch, type Embedder, classifyPromotable, enforcePromotableWriteGate, guardedMemoryStore, MemoryGateError, detectSecret, enforceSecretWriteGate, enforceStructuredNoteSecretGate, type UtilityGate, type MemoryStore, type MemoryVectorMode, type ScoredMemory, type MemoryNoteHeader, type MemoryNoteRecord, type MemoryNoteType, type StructuredNoteInput, } from "./core/memory.js";
-export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, type MemoryBackendContractHooks, buildMemoryInstruction, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, type MemoryAnnouncement, type ScanFinding, type MemoryEngineOptions, type MemoryInjection, type MemoryBackend, type MemoryEntry, type MemoryEntryFrontmatter, type MemoryEntryHeader, type ScoredMemoryEntry, type NotePatch, type PatchReport, type MaterializedFile, type MemorySessionHandle, type HarvestReport, type HarvestRejection, type HarvestRejectionCode, type ParsedEntryFile, type ScannedEntryFile, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, type ParsedScopeKey, migrateScope, type MigrateScopeReport, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, type RemoteMemoryFile, type RemoteMemoryBaseline, type RemoteMaterialization, type RemoteHarvestResult, type InboundEntryFinding, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, type MemorySyncCursor, type MemorySyncConflict, type MemorySyncPlan, type RecallSource, syncMemoryScope, type MemorySyncTransport, type MemorySyncRequestBody, type MemorySyncResponseBody, type MemorySyncClientConflict, type SyncMemoryScopeOptions, type MemorySyncClientResult, } from "./core/memory-engine/index.js";
+export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, type MemoryBackendContractHooks, buildMemoryInstruction, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, type MemorySearchDetails, type MemorySearchHit, type MemoryGetDetails, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, type MemoryAnnouncement, type ScanFinding, type MemoryEngineOptions, type MemoryInjection, type MemoryBackend, type MemoryEntry, type MemoryEntryFrontmatter, type MemoryEntryHeader, type ScoredMemoryEntry, type NotePatch, type PatchReport, type MaterializedFile, type MemorySessionHandle, type HarvestReport, type HarvestRejection, type HarvestRejectionCode, type ParsedEntryFile, type ScannedEntryFile, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, type ParsedScopeKey, migrateScope, type MigrateScopeReport, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, type RemoteMemoryFile, type RemoteMemoryBaseline, type RemoteMaterialization, type RemoteHarvestResult, type InboundEntryFinding, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, type MemorySyncCursor, type MemorySyncConflict, type MemorySyncPlan, type RecallSource, syncMemoryScope, type MemorySyncTransport, type MemorySyncRequestBody, type MemorySyncResponseBody, type MemorySyncClientConflict, type SyncMemoryScopeOptions, type MemorySyncClientResult, } from "./core/memory-engine/index.js";
 export { SHARED_MEMORY_READ_CAP_BYTES, SHARED_MEMORY_LIST_PAGE_SIZE, SharedMemoryStoreError, type SharedMemoryStoreProvider, type SharedMemoryStoreReader, type SharedMemoryStoreInfo, type SharedMemoryDocumentEntry, type SharedMemorySnapshot, type SharedMemoryRequestContext, type MemoryListDetails, type MemoryReadDetails, } from "./core/shared-memory/types.js";
 export { sharedMemoryStoreContract, type SharedMemoryFixture, type SharedMemoryStoreContractHooks, } from "./core/shared-memory/contract.js";
 export { termSet, jaccardDistance, cosineDistance } from "./core/memory-vector.js";
@@ -218,7 +222,7 @@ export { retryBackoffMs, parseRetryAfter } from "./brain/retry.js";
 export { type BrainTimeoutConfig } from "./brain/timeout.js";
 export { createAssistantMessageEventStream } from "./internal/llm.js";
 export type { AssistantMessage, AssistantMessageEvent, CompleteSimpleFn, Context, DocumentContent, ImageContent, Message, StopReason, StreamFn, TextContent, ThinkingContent, ToolCall, ToolResultMessage, Usage, UserMessage, } from "./internal/llm.js";
-export type { AgentDefinition, BeforeWriteHook, BeforeWriteRequest, BeforeWriteResult, HandsBandOptions, Brain, BrainStatus, BrainStatusPhase, ImageInput, McpElicitRequest, McpElicitResponse, McpServerSpec, A2aServerSpec, OnElicit, Model, ModelRef, ProjectMemoryLoad, RunnerDeps, RuntimeCaps, BackgroundChildEvent, SkillManifest, SkillSpec, TaskEvent, TaskEventIdentity, ToolActivity, TaskLimits, StaleToolResultOffloadOptions, TaskResult, RemoteEnvFailureNote, TaskSpec, TaskStatus, TaskStream, CompactOutcome, ThinkingLevel, ToolExecuteContext, ToolReturn, ToolSpec, ToolEffect, WorkflowGovernanceBaseline, DelegationTaskType, } from "./core/types.js";
+export type { AgentDefinition, BeforeWriteHook, BeforeWriteRequest, BeforeWriteResult, HandsBandOptions, Brain, BrainStatus, BrainStatusPhase, ImageInput, McpElicitRequest, McpElicitResponse, McpServerSpec, A2aServerSpec, OnElicit, Model, ModelRef, ProjectMemoryLoad, RunnerDeps, RuntimeCaps, BackgroundChildEvent, SkillManifest, SkillSpec, TaskEvent, TaskEventIdentity, ToolActivity, TaskLimits, StaleToolResultOffloadOptions, TaskResult, RemoteEnvFailureNote, TaskSpec, TaskStatus, TaskStream, CompactOutcome, ThinkingLevel, ToolExecuteContext, ToolReturn, ToolSpec, ToolEffect, ToolContentOrigin, WorkflowGovernanceBaseline, DelegationTaskType, } from "./core/types.js";
 export { Type } from "typebox";
 export type { TSchema, Static } from "typebox";
 export { explainPromptAssembly, describeDefaultPack, type DefaultPackDescription, type ExplainInput } from "./prompt-assembly/explain.js";