@sema-agent/core 5.37.0 → 5.39.0

package/dist/core/runner/prepare-config-doors.js

@@ -4,6 +4,7 @@ import { resolveCheckpointStore } from "../checkpoint-store.js";
 import { preflightLockedConfig } from "../locked-config.js";
 import { assertRetentionCapability } from "../retention.js";
 import { resolveModel, resolveTaskModel, roleModelIfSet } from "../roles.js";
+import { applyToolModelGate, assertRestoreGatedToolsValue, modelIdTail } from "../tool-model-gate.js";
 import { resolveUsageWindows } from "../usage-window-store.js";
 import { deriveAskEffective, resolveAskSeamForm, resolveQuestionSeam } from "../wiring-manifest.js";
 const TASK_LIMIT_KEY_DICT = {
@@ -73,7 +74,7 @@ export function resolveTaskLimits(limits) {
     return limits;
 }
 export function isFableFamilyModelId(id) {
-    const tail = id.toLowerCase().split("/").pop() ?? "";
+    const tail = modelIdTail(id);
     return /^claude-fable-\d/.test(tail) || /^claude-mythos-5(?!\d)/.test(tail);
 }
 export function resolveModelPromptTraits(model, spec, internals) {
@@ -85,10 +86,16 @@ export function resolveModelPromptTraits(model, spec, internals) {
 export function prepareConfigDoors(input) {
     const { deps, sessions, resume, internals } = input;
     let spec = input.spec;
+    assertRestoreGatedToolsValue(spec.restoreGatedTools);
     const toolFaceSnapshot = {
         exclude: spec.excludeTools ? Object.freeze([...spec.excludeTools]) : undefined,
         defer: spec.deferTools ? Object.freeze([...spec.deferTools]) : undefined,
         alwaysLoad: spec.alwaysLoadTools ? Object.freeze([...spec.alwaysLoadTools]) : undefined,
+        restoreGated: spec.restoreGatedTools === true
+            ? true
+            : spec.restoreGatedTools !== undefined
+                ? Object.freeze([...spec.restoreGatedTools])
+                : undefined,
     };
     const promptProfile = resolveModelPromptTraits({ id: "" }, spec, internals).promptProfile;
     if (spec.resumeAt !== undefined) {
@@ -223,11 +230,34 @@ export function prepareConfigDoors(input) {
             throw e;
         }
         const perTask = spec.agents;
-        spec = { ...spec, tools: pool.map((t) => (typeof t.withAgents === "function" ? t.withAgents(perTask) : t)) };
+        spec = {
+            ...spec,
+            tools: pool.map((t) => {
+                if (typeof t.withAgents !== "function")
+                    return t;
+                const rebuilt = t.withAgents(perTask);
+                return t.modelGate !== undefined && rebuilt.modelGate === undefined ? { ...rebuilt, modelGate: t.modelGate } : rebuilt;
+            }),
+        };
     }
     const resolvedRole = resolveTaskModel(spec, deps);
     const model = resolvedRole.model;
     const fableMitigations = resolveModelPromptTraits(model, spec, internals).fableMitigations;
+    const gateDecision = applyToolModelGate({
+        tools: spec.tools,
+        modelId: model.id,
+        depsSeat: deps.toolModelGate,
+        restoreGated: toolFaceSnapshot.restoreGated,
+        envRaw: process.env.SEMA_TOOL_MODEL_GATE,
+    });
+    if (gateDecision.survivors !== undefined) {
+        spec = { ...spec, tools: gateDecision.survivors };
+    }
+    const modelGate = Object.freeze({
+        removedByClass: gateDecision.removedByClass,
+        unknownClasses: gateDecision.unknownClasses,
+        discardedEnvRaw: gateDecision.discardedEnvRaw,
+    });
     const thinking = spec.thinking ?? resolvedRole.thinking ?? model.defaultThinking;
     const compModel = spec.compactionModel
         ? resolveModel(spec.compactionModel, deps.models)
@@ -243,6 +273,7 @@ export function prepareConfigDoors(input) {
         thinking,
         compModel,
         fableMitigations,
+        modelGate,
         usageWindows,
         brainCallGuardrailRef,
         brainCallGuardrailMs,

package/dist/core/runner/prepare-task.d.ts

@@ -11,7 +11,7 @@ import { SubagentRetainLedger } from "../../agents/retain-ledger.js";
 import type { OnAsk, ToolCallRequest, ToolPolicy } from "../tool-policy.js";
 import { type ActiveSkillFrame } from "./active-skill-scope.js";
 import type { SessionPermissionRules } from "../session-policy-store.js";
-import { type Hooks, type OrgGateVerdict } from "../hooks.js";
+import { type Hooks, type HookInvocationIdentity, type OrgGateVerdict } from "../hooks.js";
 import type { RecoveredOrphan } from "../session-reconcile.js";
 import { CacheBreakDetector, type ToolFingerprintInput } from "../cache-break-detector.js";
 import { type BrainCallGuardrailRef } from "../../brain/timeout.js";
@@ -29,8 +29,14 @@ import { type WiringManifest } from "../wiring-manifest.js";
 import type { ActiveWorktreeSession, AgentMessage, AgentTool, ExecutionEnv } from "../../internal/harness.js";
 import type { NestedUsageAccum, RunnerDeps, TaskEvent, TaskResult, TaskSpec, ToolActivity, ToolEffect } from "../types.js";
 import type { RepairBundle } from "../../agents/repair-loop.js";
-/** Test seam (mirrors `__resetBashTimeoutAnnouncements`): never called by production code. */
+/** Test seam (mirrors `__resetToolModelGateAnnouncements`): never called by production code.
+ *  Re-arms BOTH arms (a WeakMap has no clear — it is re-minted). */
 export declare function __resetMaterializeEnvAnnouncements(): void;
+/** Test seam (mirrors `__resetMaterializeEnvAnnouncements`): never called by production code.
+ *  Re-arms BOTH arms (a WeakMap has no clear — it is re-minted). Deliberately UNLIKE the read-face
+ *  seam below (console latch only): tests here legitimately reuse ONE sink across prepares to pin
+ *  the per-sink dedup itself, so the seam must be able to re-arm a still-referenced sink. */
+export declare function __resetToolModelGateAnnouncements(): void;
 /** Test seam (mirrors `__resetMalformedNoticeSeatAnnouncement`): never called by production code.
  *  Deliberately asymmetric — it resets only the console latch: the WeakSet arm needs no seam
  *  because a test resets it by minting a fresh sink function (identity IS the ledger key), while
@@ -279,6 +285,15 @@ export interface Prepared {
      * model/tool interaction. Host/operator plane — never enters model context.
      */
     wiringManifest: WiringManifest;
+    /**
+     * #281 件A — this leg's frozen identity envelope, minted ONCE in prepare beside the wiring
+     * manifest (same leg derivation, one mint — {@link mintHookInvocationIdentity}). Every hook
+     * station runtask drives (stop/stopFailure/userPromptSubmit/postToolBatch, the compaction
+     * wrapper) and the 件B delegation-lifecycle observer read THIS object; prepare's own stations
+     * (the tool gate, the post-tool contexts) close over the same const. Always present — a prepared
+     * leg always knows its identity.
+     */
+    hookIdentity: HookInvocationIdentity;
     promptManifest: {
         constitution: "core" | "replaced" | "provider-assembled";
         blocks: Array<{

package/dist/core/runner/prepare-task.js

@@ -28,8 +28,9 @@ import { CHANGED_FILES_MTIME_EPS_MS, fenceMcpServerInstructions, renderAgentList
 import { inlineUntrusted } from "../untrusted-text.js";
 import { policyAskClassOf } from "../ask-class.js";
 import { emitTrace } from "../trace.js";
-import { createSessionRulePolicy } from "./session-rule-policy.js";
-import { cloneObserverInput, createHookEnvCapabilities, createPreToolUseConstraintPolicy, formatHookFeedback, persistedRuleMandateOf, runToolGate } from "../hooks.js";
+import { createSessionRulePolicy, PATH_CONFINABLE_WRITE_TOOLS } from "./session-rule-policy.js";
+import { cloneObserverInput, createHookEnvCapabilities, createPreToolUseConstraintPolicy, formatHookFeedback, mintHookInvocationIdentity, persistedRuleMandateOf, runToolGate } from "../hooks.js";
+import { createWriteProtectionCheck } from "../write-protect.js";
 import { orgRuleVerdictFor } from "../permission-rule-org.js";
 import { CacheBreakDetector, toolsToFingerprintInputs } from "../cache-break-detector.js";
 import { reservedCollisions, reservedFor } from "../../brain/request-params.js";
@@ -92,13 +93,104 @@ import { countElicitOptIns, deriveWiringManifest, resolveAskSeamForm, resolveDec
 import { durableParkGapFor } from "../park-selfcheck.js";
 import { GLOBAL_USAGE_KEY, usageRetryAfterMs } from "../usage-window-store.js";
 import { deliverEngineNotice } from "../types.js";
-const announcedMaterializeEnv = new Set();
+let announcedMaterializeEnvBySink = new WeakMap();
+const announcedMaterializeEnvConsole = new Set();
+function materializeEnvLedger(onNotice) {
+    if (typeof onNotice !== "function")
+        return announcedMaterializeEnvConsole;
+    let lines = announcedMaterializeEnvBySink.get(onNotice);
+    if (lines === undefined) {
+        lines = new Set();
+        announcedMaterializeEnvBySink.set(onNotice, lines);
+    }
+    return lines;
+}
 export function __resetMaterializeEnvAnnouncements() {
-    announcedMaterializeEnv.clear();
+    announcedMaterializeEnvBySink = new WeakMap();
+    announcedMaterializeEnvConsole.clear();
 }
 function emitMaterializeEnvNotice(onNotice, message, detail) {
+    const ledger = materializeEnvLedger(onNotice);
+    if (ledger.has(message))
+        return;
+    ledger.add(message);
     deliverEngineNotice(onNotice, { code: "config.materialize_env_discarded", message, detail });
 }
+function warnCompactionWindowHazard(tracer, spec, model, compModel, hostTaskId) {
+    if (compModel === undefined)
+        return;
+    const compWindow = compModel.contextTokens ?? compModel.contextWindow;
+    const mainWindow = model.autoCompactTokens ?? model.contextTokens ?? model.contextWindow;
+    if (compWindow > 0 && mainWindow > 0 && compWindow < mainWindow) {
+        const merged = { ...DEFAULT_COMPACTION_SETTINGS, ...spec.compaction };
+        const sanitized = sanitizeCompactionSettings(merged, mainWindow);
+        const tolerance = sanitized.clampTolerance ?? DEFAULT_CLAMP_TOLERANCE;
+        const headroom = Math.max(0, compWindow - Math.max(Math.floor(0.8 * summaryOutputBudgetTokens(compModel, sanitized)), 2048) - 512);
+        emitTrace(tracer, () => ({
+            kind: "compaction.window_config_warning",
+            version: 1,
+            taskId: hostTaskId,
+            compactionModelWindow: compWindow,
+            mainModelWindow: mainWindow,
+            ...(tolerance < 1 ? { fallbackAt: Math.floor(headroom / (1 - tolerance)) } : {}),
+            ts: Date.now(),
+        }));
+    }
+}
+let announcedToolModelGateBySink = new WeakMap();
+const announcedToolModelGateConsole = new Set();
+function toolModelGateLedger(onNotice) {
+    if (typeof onNotice !== "function")
+        return announcedToolModelGateConsole;
+    let lines = announcedToolModelGateBySink.get(onNotice);
+    if (lines === undefined) {
+        lines = new Set();
+        announcedToolModelGateBySink.set(onNotice, lines);
+    }
+    return lines;
+}
+export function __resetToolModelGateAnnouncements() {
+    announcedToolModelGateBySink = new WeakMap();
+    announcedToolModelGateConsole.clear();
+}
+function announceToolModelGate(onNotice, modelId, gate) {
+    const ledger = toolModelGateLedger(onNotice);
+    for (const [gateClass, removed] of gate.removedByClass) {
+        const line = `Model gate: default-mounted tool(s) ${removed.map((n) => JSON.stringify(n)).join(", ")} (class ${JSON.stringify(gateClass)}) ` +
+            `were not mounted for model ${JSON.stringify(modelId)} — the gate table marks this model as managing multi-step work without the scaffold. ` +
+            `Explicitly composed tools are exempt; restore via TaskSpec.restoreGatedTools, SEMA_TOOL_MODEL_GATE=off, or RunnerDeps.toolModelGate: false.`;
+        if (!ledger.has(line)) {
+            ledger.add(line);
+            deliverEngineNotice(onNotice, {
+                code: "config.tool_model_gate_removed",
+                message: line,
+                detail: {
+                    modelId,
+                    gateClass,
+                    removed: [...removed],
+                    restore: { spec: "TaskSpec.restoreGatedTools", env: "SEMA_TOOL_MODEL_GATE=off", deps: "RunnerDeps.toolModelGate: false" },
+                },
+            });
+        }
+    }
+    for (const gateClass of gate.unknownClasses) {
+        const line = `ToolSpec.modelGate names gate class ${JSON.stringify(gateClass)}, which no row of the merged gate table defines — the tag is inert ` +
+            `(fail-open: the tool stays mounted). Fix the tag, or define the class via RunnerDeps.toolModelGate.classes.`;
+        if (!ledger.has(line)) {
+            ledger.add(line);
+            deliverEngineNotice(onNotice, { code: "config.tool_model_gate_unknown_class", message: line, detail: { gateClass } });
+        }
+    }
+    if (gate.discardedEnvRaw !== undefined) {
+        const line = `SEMA_TOOL_MODEL_GATE=${JSON.stringify(gate.discardedEnvRaw)} is not in the closed set (on|1|true|off|0|false, case-insensitive) — ` +
+            `not in force on this task (nothing the model gate would remove), but a task where the gate WOULD trim a default-mounted tool ` +
+            `will refuse to prepare under it (config.tool_model_gate_env_invalid). Fix or unset the flag.`;
+        if (!ledger.has(line)) {
+            ledger.add(line);
+            deliverEngineNotice(onNotice, { code: "config.tool_model_gate_env_invalid", message: line, detail: { raw: gate.discardedEnvRaw } });
+        }
+    }
+}
 const readFaceClampAnnouncedSinks = new WeakSet();
 let readFaceClampConsoleAnnounced = false;
 export function __resetReadFaceClampAnnouncement() {
@@ -153,8 +245,9 @@ export { rebaseWorkspacePath, rebaseWorkspacePathAcross } from "./prepare-worksp
 function hasConversationContent(branch) {
     return branch.some((e) => e.type === "message" || e.type === "custom_message" || e.type === "compaction");
 }
-function isDelegatedNonForkChild(internals) {
-    return internals?.isDelegatedChild === true && internals?.insideFork !== true;
+function effectiveDelegationFacts(internals, seedIsDelegatedChild) {
+    const isDelegatedChild = internals?.isDelegatedChild !== undefined ? internals.isDelegatedChild === true : seedIsDelegatedChild === true;
+    return { isDelegatedChild, isNonForkChild: isDelegatedChild && internals?.insideFork !== true };
 }
 export function batchContextAt(messages, currentId) {
     let batch = [];
@@ -238,6 +331,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
     const doors = prepareConfigDoors({ spec, deps, sessions, resume, internals });
     spec = doors.spec;
     const { toolFaceSnapshot, promptProfile, lockedPreflight, resolvedInteractionPosture, resolvedRole, model, thinking, compModel, fableMitigations, usageWindows, brainCallGuardrailRef, brainCallGuardrailMs } = doors;
+    announceToolModelGate(deps.onNotice, model.id, doors.modelGate);
     const { toolEffects, egressTools, irreversibleTools, irreversibilityTier, axisExplicitNegatives, reversibilityProbes, ownToolNames } = prepareSafetyScan({ spec, deps });
     let shellGatedBash = false;
     let shellGatedMonitor = false;
@@ -249,25 +343,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
     const { acquired, session, conflictRef, wakeRecovered, resumeAtBeforeParentId } = await prepareAcquireReconcile({ sessions, spec, resume, toolEffects, ...(() => { const g = durableParkGapFor(deps, spec); return g !== undefined ? { durableParkGap: g } : {}; })() });
     const sessionId = acquired.sessionId;
     const hostTaskId = spec.taskId ?? sessionId;
-    if (compModel !== undefined) {
-        const compWindow = compModel.contextTokens ?? compModel.contextWindow;
-        const mainWindow = model.autoCompactTokens ?? model.contextTokens ?? model.contextWindow;
-        if (compWindow > 0 && mainWindow > 0 && compWindow < mainWindow) {
-            const merged = { ...DEFAULT_COMPACTION_SETTINGS, ...spec.compaction };
-            const sanitized = sanitizeCompactionSettings(merged, mainWindow);
-            const tolerance = sanitized.clampTolerance ?? DEFAULT_CLAMP_TOLERANCE;
-            const headroom = Math.max(0, compWindow - Math.max(Math.floor(0.8 * summaryOutputBudgetTokens(compModel, sanitized)), 2048) - 512);
-            emitTrace(deps.tracer, () => ({
-                kind: "compaction.window_config_warning",
-                version: 1,
-                taskId: hostTaskId,
-                compactionModelWindow: compWindow,
-                mainModelWindow: mainWindow,
-                ...(tolerance < 1 ? { fallbackAt: Math.floor(headroom / (1 - tolerance)) } : {}),
-                ts: Date.now(),
-            }));
-        }
-    }
+    const delegation = effectiveDelegationFacts(internals, resume?.seed.isDelegatedChild);
+    warnCompactionWindowHazard(deps.tracer, spec, model, compModel, hostTaskId);
     const taskScope = internals?.registryScope ?? spec.principal ?? "default";
     internals?.peerSelfRef?.addAxis("s", sessionId);
     internals?.peerSelfRef?.addAxis("t", hostTaskId);
@@ -705,6 +782,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             excludeTools: toolFaceSnapshot.exclude,
             deferTools: toolFaceSnapshot.defer,
             alwaysLoadTools: toolFaceSnapshot.alwaysLoad,
+            ...(toolFaceSnapshot.restoreGated !== undefined ? { restoreGatedTools: toolFaceSnapshot.restoreGated } : {}),
             promptProfile,
             ...(spec.additionalDirectories !== undefined ? { additionalDirectories: Object.freeze([...spec.additionalDirectories]) } : {}),
             ...(spec.additionalReadDirectories !== undefined ? { additionalReadDirectories: Object.freeze([...spec.additionalReadDirectories]) } : {}),
@@ -876,6 +954,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 parentExcludeTools: toolFaceSnapshot.exclude,
                 parentDeferTools: toolFaceSnapshot.defer,
                 parentAlwaysLoadTools: toolFaceSnapshot.alwaysLoad,
+                ...(toolFaceSnapshot.restoreGated !== undefined ? { parentRestoreGatedTools: toolFaceSnapshot.restoreGated } : {}),
                 parentPromptProfile: promptProfile,
                 models: deps.models,
                 agents: deps.agents,
@@ -1335,6 +1414,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             toolEffects.set("TaskStop", "write");
             tools.push(firstPartyOffload(createTaskOutputTool({ registry: defaultTaskRegistry, owner: hostTaskId, scope: taskScope, sessionId, workflowStore: deps.workflowRunStore, agentStore: deps.backgroundAgentStore, notificationWired: internals?.onTaskNotification !== undefined, oneShot: spec.oneShot, toolResultStore: offloadStore })), firstPartyOffload(createTaskStopTool({ registry: defaultTaskRegistry, owner: hostTaskId, scope: taskScope, sessionId, workflowStore: deps.workflowRunStore, agentStore: deps.backgroundAgentStore })));
             if (runnerSelf && !(spec.tools ?? []).some((t) => t.name === SEND_MESSAGE_TOOL_NAME)) {
+                toolEffects.set(SEND_MESSAGE_TOOL_NAME, "write");
+                axisExplicitNegatives.set(SEND_MESSAGE_TOOL_NAME, { ...axisExplicitNegatives.get(SEND_MESSAGE_TOOL_NAME), egress: false });
                 const delegationForRevive = (spec.tools ?? []).find((t) => t.agentListing !== undefined);
                 const reviveSpawn = delegationForRevive !== undefined && deps.backgroundAgentStore !== undefined && deps.mailboxStore !== undefined
                     ? async (req) => {
@@ -1581,7 +1662,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 orgMemoryDenied: complianceDenies.has("org_memory_mount"),
                 complianceDegraded,
                 parentAdmittedOrgScopes: foldAdmissionFreeze({
-                    delegated: internals?.isDelegatedChild === true ||
+                    delegated: delegation.isDelegatedChild ||
                         internals?.inheritedGate !== undefined ||
                         (resume?.seed.inheritedGate !== undefined &&
                             (resume.seed.inheritedGate.ancestorRules !== undefined ||
@@ -1650,7 +1731,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 loaded = await Promise.resolve(deps.loadProjectMemory({
                     cwd: taskRootFinal,
                     handsEnabled,
-                    isSubagent: isDelegatedNonForkChild(internals),
+                    isSubagent: delegation.isNonForkChild,
                     ...(internals?.agentName ? { agentName: internals.agentName } : {}),
                     sessionId,
                     phase: projectMemoryPhase,
@@ -1775,7 +1856,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             awarenessEnabled: thinking !== undefined && ULTRA_REASONING_TIERS.has(thinking),
             worktreeIsolated: internals?.isolation === "worktree" && ownedEnv !== undefined,
             withinTaskCompactionEnabled: (spec.compaction?.enabled ?? true) && (spec.compaction?.withinTask ?? true),
-            isSubagent: isDelegatedNonForkChild(internals),
+            isSubagent: delegation.isNonForkChild,
         };
         const userSystemPrompt = spec.systemPrompt ?? resolvedRole.systemPrompt ?? internals?.defaultSystemPrompt;
         const userAppendSystemPrompt = spec.appendSystemPrompt;
@@ -2209,10 +2290,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             const raw = process.env.SEMA_TOOL_MATERIALIZE_STRATEGY;
             if (raw !== undefined && raw !== "swap" && raw !== "static" && deferred.size === 0) {
                 const line = `SEMA_TOOL_MATERIALIZE_STRATEGY=${JSON.stringify(raw)} is not "swap" or "static" — inert on this task (no deferred tools), but a deferring task WITHOUT an explicit spec strategy will refuse to prepare under it (an explicit legal spec outranks and discards it, loudly). Fix or unset the flag.`;
-                if (!announcedMaterializeEnv.has(line)) {
-                    announcedMaterializeEnv.add(line);
-                    emitMaterializeEnvNotice(deps.onNotice, line, { raw });
-                }
+                emitMaterializeEnvNotice(deps.onNotice, line, { raw });
             }
         }
         if (deferred.size > 0) {
@@ -2231,10 +2309,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             }
             if (envStrategyInvalid) {
                 const line = `SEMA_TOOL_MATERIALIZE_STRATEGY=${JSON.stringify(rawEnvStrategy)} was ignored — not "swap" or "static", and the task spec pins toolMaterializeStrategy=${JSON.stringify(spec.toolMaterializeStrategy)} which outranks it. Fix or unset the env flag.`;
-                if (!announcedMaterializeEnv.has(line)) {
-                    announcedMaterializeEnv.add(line);
-                    emitMaterializeEnvNotice(deps.onNotice, line, { raw: rawEnvStrategy, specStrategy: spec.toolMaterializeStrategy });
-                }
+                emitMaterializeEnvNotice(deps.onNotice, line, { raw: rawEnvStrategy, specStrategy: spec.toolMaterializeStrategy });
             }
             const envStrategy = envStrategyInvalid ? undefined : rawEnvStrategy;
             const requestedStrategy = spec.toolMaterializeStrategy ?? envStrategy ?? "swap";
@@ -2741,7 +2816,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             list.push({ cls, layer });
             foldAskClasses.set(toolCallId, list);
         };
-        const sandboxBoundaryCapable = (toolName) => egressTools.has(toolName) || toolName.includes("__") || ownToolNames.has(toolName);
+        const sandboxBoundaryCapable = (toolName) => egressTools.has(toolName) || toolName.includes("__") || ownToolNames.has(toolName) || toolName === SEND_MESSAGE_TOOL_NAME;
         const emitSandboxAdmitted = (info) => {
             emitTrace(deps.tracer, () => ({
                 kind: "permission.sandbox_admitted",
@@ -2785,7 +2860,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             ...((internals?.explicitAgentName ?? internals?.agentName) !== undefined
                 ? { sourceAgentName: internals?.explicitAgentName ?? internals?.agentName }
                 : {}),
-            ...(internals?.isDelegatedChild === true ? { isDelegatedChild: true } : {}),
+            ...(delegation.isDelegatedChild ? { isDelegatedChild: true } : {}),
         });
         const riskAxesOf = (toolName) => {
             const tier = irreversibilityTier.get(toolName);
@@ -3347,6 +3422,15 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             retentionPolicyWired: deps.retentionPolicy !== undefined,
         });
         const parkLaneArmed = wiringManifest.parkLane.effective === true;
+        const hookIdentity = mintHookInvocationIdentity({
+            sessionId,
+            taskId: spec.taskId ?? sessionId,
+            legKind: wiringManifest.leg.kind,
+            isDelegatedChild: delegation.isDelegatedChild,
+            ...(internals?.insideFork === true ? { insideFork: true } : {}),
+            ...(internals?.agentName !== undefined ? { agentName: internals.agentName } : {}),
+            ...(internals?.parentToolCallId !== undefined ? { parentToolCallId: internals.parentToolCallId } : {}),
+        });
         const hookContextConsumerWired = hooks?.preToolUse !== undefined || hooks?.postToolUse !== undefined || hooks?.postToolUseFailure !== undefined;
         const hookEnvFace = hookContextConsumerWired && (ownedEnv ?? deps.executionEnv) != null ? createHookEnvCapabilities(executionEnv) : undefined;
         if (effectivePolicy || hooks?.preToolUse || egressTools.size > 0 || irreversibleTools.size > 0 || resourceSuspendEligible || platformSuspendArmed || spec.enablePlanMode === true) {
@@ -3556,6 +3640,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     : undefined,
                 gitAnnouncement: gitStatusRef.announced !== undefined ? { ...gitStatusRef.announced } : undefined,
                 delegationProvenance: internals?.delegationProvenance !== undefined ? { ...internals.delegationProvenance.ref.current } : undefined,
+                isDelegatedChild: hookIdentity.isDelegatedChild ? true : undefined,
             });
             const commitSuspendSaga = async (token, cp, remoteEnv, remoteHandle) => {
                 if (!checkpointStore)
@@ -4138,13 +4223,16 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 if (eff !== undefined && !toolEffects.has(t.name))
                     toolEffects.set(t.name, eff);
             }
+            const writeProtectionCheck = createWriteProtectionCheck(deps.writeProtectedPaths);
+            const writeProtectionArmed = writeProtectionCheck !== undefined && tools.some((t) => PATH_CONFINABLE_WRITE_TOOLS.has(t.name));
             toolCallGateArmedRef.armed =
                 effectivePolicy !== undefined ||
                     hooks?.preToolUse !== undefined ||
                     egressTools.size > 0 ||
                     irreversibleTools.size > 0 ||
                     spec.enablePlanMode === true ||
-                    complianceDenies.has("web_fetch");
+                    complianceDenies.has("web_fetch") ||
+                    writeProtectionArmed;
             if (toolCallGateArmedRef.armed) {
                 harness.on("tool_call", async (e) => {
                     blockedToolCalls.delete(e.toolCallId);
@@ -4155,7 +4243,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             if (blockedTracked)
                                 blockedToolCalls.add(e.toolCallId);
                             if (notifyPermissionDenied) {
-                                await notifyPermissionDenied({ toolName: e.toolName, input: cloneObserverInput(e.input), toolCallId: e.toolCallId, reason: complianceDeny, source: "safety" });
+                                await notifyPermissionDenied({ toolName: e.toolName, input: cloneObserverInput(e.input), toolCallId: e.toolCallId, reason: complianceDeny, source: "safety", identity: hookIdentity });
                             }
                             return { block: true, reason: formatHookFeedback(complianceDeny), preToolContext: [] };
                         }
@@ -4166,7 +4254,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         const planDenyReason = `Plan mode is active — "${e.toolName}" is a write/mutating tool and is read-only-blocked. ` +
                             `Research with read-only tools, then call ${PRESENT_PLAN_TOOL_NAME} with your plan to get it approved before acting.`;
                         if (notifyPermissionDenied) {
-                            await notifyPermissionDenied({ toolName: e.toolName, input: cloneObserverInput(e.input), toolCallId: e.toolCallId, reason: planDenyReason, source: "planMode" });
+                            await notifyPermissionDenied({ toolName: e.toolName, input: cloneObserverInput(e.input), toolCallId: e.toolCallId, reason: planDenyReason, source: "planMode", identity: hookIdentity });
                         }
                         return {
                             block: true,
@@ -4179,6 +4267,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         result = await runToolGate({
                             onNotifyError: (f) => emitTrace(deps.tracer, () => ({ kind: "observer.notify_failed", version: 1, taskId: spec.taskId ?? sessionId, site: f.site, message: f.error.message, ts: Date.now() })),
                             event: e,
+                            identity: hookIdentity,
                             preToolUse: ownGatePreToolUse,
                             ...(hookEnvFace !== undefined ? { hookEnv: hookEnvFace } : {}),
                             adjudicate,
@@ -4186,6 +4275,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             suspendAsk,
                             resolveContentAsk,
                             egress: egressTools.has(e.toolName),
+                            peerMessage: e.toolName === SEND_MESSAGE_TOOL_NAME,
+                            ...(writeProtectionCheck !== undefined ? { writeProtectionCheck } : {}),
                             irreversibility: irreversibilityTier.get(e.toolName),
                             reversibilityProbe: reversibilityProbes.get(e.toolName),
                             abortSignal: abortController.signal,
@@ -4291,7 +4382,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             isInterrupt: abortController.signal.aborted || spec.signal?.aborted === true,
                             content: e.content.map((c) => ({ ...c })),
                             details: clonedDetails,
-                        }, { toolCallId: e.toolCallId, toolName: e.toolName, ...(hookEnvFace !== undefined ? { env: hookEnvFace } : {}) });
+                        }, { toolCallId: e.toolCallId, toolName: e.toolName, ...(hookEnvFace !== undefined ? { env: hookEnvFace } : {}), identity: hookIdentity });
                         if (patch?.additionalContext) {
                             content = [...content, { type: "text", text: formatHookFeedback(patch.additionalContext) }];
                             changed = true;
@@ -4299,7 +4390,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     }
                 }
                 else if (hooks?.postToolUse) {
-                    const patch = await hooks.postToolUse(e.toolName, e.input, { content: e.content, details: e.details, isError: e.isError }, { toolCallId: e.toolCallId, toolName: e.toolName, ...(hookEnvFace !== undefined ? { env: hookEnvFace } : {}) });
+                    const patch = await hooks.postToolUse(e.toolName, e.input, { content: e.content, details: e.details, isError: e.isError }, { toolCallId: e.toolCallId, toolName: e.toolName, ...(hookEnvFace !== undefined ? { env: hookEnvFace } : {}), identity: hookIdentity });
                     if (patch?.updatedOutput) {
                         content = patch.updatedOutput;
                         changed = true;
@@ -4586,7 +4677,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         const effectiveReadFaceObserved = carrierReadFace();
         const effectiveReadDenyObserved = readDenyAdditionsNormalized.length > 0 ? readDenyAdditionsNormalized.map((e) => ({ ...e })) : undefined;
         const preparedHolder = {};
-        const buildPrepared = () => ({ harness, session, sessionId, taskRootPath: taskRootFinal, model, thinking, compModel, mcp: mcp, ...(a2a !== undefined && a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, approvalSettlement, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), ...(effectiveReadFaceObserved !== undefined ? { effectiveReadFace: effectiveReadFaceObserved } : {}), ...(effectiveReadDenyObserved !== undefined ? { effectiveReadDenyPatterns: effectiveReadDenyObserved } : {}), effectiveMemoryScopes: memoryEffectiveScopes, cwdRef: handsCwdRef, ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), denyNarrowingPolicy, ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, suspendRef, suspendProgressRef, reviewRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, brainCallGuardrailRef, suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, gitStatusRef, listBackgroundTasks, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}) });
+        const buildPrepared = () => ({ harness, session, sessionId, taskRootPath: taskRootFinal, model, thinking, compModel, mcp: mcp, ...(a2a !== undefined && a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, approvalSettlement, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), ...(effectiveReadFaceObserved !== undefined ? { effectiveReadFace: effectiveReadFaceObserved } : {}), ...(effectiveReadDenyObserved !== undefined ? { effectiveReadDenyPatterns: effectiveReadDenyObserved } : {}), effectiveMemoryScopes: memoryEffectiveScopes, cwdRef: handsCwdRef, ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), denyNarrowingPolicy, ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, suspendRef, suspendProgressRef, reviewRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, brainCallGuardrailRef, suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, gitStatusRef, listBackgroundTasks, hookIdentity, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}) });
         const prepared = buildPrepared();
         preparedHolder.current = prepared;
         return prepared;