@sema-agent/core 5.51.0 → 5.53.0

package/CHANGELOG.md

@@ -1,5 +1,100 @@
 # Changelog
 
+## 5.53.0 — 2026-08-21
+
+### Fixed
+- **An MCP refresh no longer rewrites the cacheable tool prefix** (#375 root fix): `RefreshMcpTools`
+  re-inserted the server's tool domain at the TAIL of the mount array — the wire order — so a
+  byte-identical listing still displaced the whole domain past every later tool, a full provider
+  prefix-cache re-bill the model itself was told to trigger ("refresh when a listing looks stale").
+  The domain now re-enters at its anchor (the lowest index it occupied): an unchanged listing
+  produces a byte-identical array. First-time mounts still append.
+- **Thinking replay survives strict gateways and non-streaming rewrites** (#374 adjacent):
+  the replay judge is shape-based (only a non-empty string counts as a signature — a JSON-roundtrip
+  `null`/number can no longer ride onto the wire), `signature_delta` refuses non-string coercion,
+  and an inlined `content_block_start` thinking block (the compat-gateway SSE-rewrite form) is now
+  fully captured — text and signature — instead of being dropped from every subsequent request.
+- **The cache-break detector tells the truth about reorders** (#376): an order-preserving hash
+  now attributes a pure reorder to `tool-set` with its own wording (previously it fell through to
+  "server-or-ttl … not a client-side prefix bug" — actively misleading, and the exact shape #375
+  just fixed); the low-hit-rate summary discriminates "prefix keeps changing" from "this route
+  reports no caching" using cacheWrite facts instead of guessing.
+- **The MCP refresh region is transactional and collision-gated** (#377): tool effect records are
+  reset before the fold (a refreshed read-only tool no longer silently degrades to write), a
+  rejected listing restores both non-monotone tables, two servers whose names normalize to the
+  same prefix refuse at connect (`config.mcp_server_name_collision`, both original spellings
+  named), and a single listing minting two identical tool names keeps the first with a disclosed
+  drop.
+- Behavior narrowings (named): colliding server configs from "silent shared domain" to a loud
+  connect refusal; same-listing name collisions from "both mounted under one name" to
+  "first kept, drop disclosed".
+
+- **Pre-release scan dispositions (three, fixed in-tree before publish)**: the protocol-name
+  reservation now covers ALIASES (a `__`-shaped caller alias refuses at prepare with the same loud
+  code — it was a dispatchable name sitting inside a server's prefix domain, which the refresh
+  region would classify and clear as remote); the refresh receipt states each drop's OWN reason
+  (a fixed "invalid schema" label lied about the collision lane); the A2A mount gains the same
+  normalized-prefix collision gate as MCP (`config.a2a_peer_name_collision`), making the
+  protocol-naming contract's engine-wide claim true.
+- Behavior narrowing (named): a caller tool alias containing `__` from "accepted" to a loud
+  prepare refusal; colliding A2A peer names from "silent shared domain" to a connect refusal.
+
+### Notes
+- Residuals ticketed: #379 (open-responses presence judge, inline text-block sibling, two-phase
+  refresh observation). #378 resolved by the alias-reservation fix above.
+
+## 5.52.0 — 2026-08-21
+
+### Added
+- **The rejection boundary holds against pre-accepted engine injections** (#370 terminal form):
+  the harness grows ONE provenance gate every engine-authored injection judges against — new
+  engine steers/followUps refuse at entry during a halt, and frames accepted BEFORE the rejection
+  landed are held at drain (delayed, never destroyed: queued user input drains past them, and once
+  the user's turn spends the halt they deliver at the next boundary; a run that ends first parks
+  payload frames per session losslessly). Caller-relayed steers state
+  `UserMessageProvenance.callerAuthored` (additive) at their one mint seam, so the gate's failure
+  direction can never mis-gate user input. `task.user_steer_undrained` no longer counts
+  payload-less engine advisories as lost user steers.
+- **The nine-code resolution vocabulary reaches every deny lane**: `AskDenyResolution` +
+  `isAskDenyResolution` + `ASK_DENY_RESOLUTION_VALUES` exported from the package root (the
+  settledBy precedent); the `createApprovalPolicy` legacy lane and the inherited-ancestor
+  delegation fold now classify on `tool_end.resolution` via a module-private attestation carrier
+  (WeakMap sidecar, call-bound, fold-transferred) — a foreign policy still cannot forge or replay
+  a code, and the public deny wording is byte-unchanged.
+- **The memory session-account close discloses standing deferrals** (#369): a harvest with
+  `deferred` rejection rows that actually closes the account emits one warnings line naming the
+  deferred seats; a refused close reports its outcome UNKNOWN honestly. The two-ledger canon is
+  written at four seats: the projection-debt ledger lives on the HARVEST timeline, orthogonal to
+  the session open/close ledger (writes never cross; reads cross one way).
+- **The bare-mark echo observation seat** (`<outlet>.mark_echo`): failure arms that fence but do
+  not defuse (MCP tool errors, WebFetch non-2xx, WebSearch backend errors) now count a naked mark
+  value riding to the model — count-only, zero model-facing byte changes; the count is an upper
+  bound by contract.
+- **Reasoning reports consume the wire's own request facts** (#367): the anthropic budget arm
+  reports the cap-wins facts of the request the engine SELECTED (minter-reports form, via a
+  brain→runner sink); a leg whose hard output cap deleted the thinking block now reports the drop
+  on both faces instead of a full graded gradient. `reasoning.resolved` may re-emit once per leg
+  when the verdict changes (deduplicated; single-frame runs unchanged).
+
+### Fixed
+- The operator-continuation verb's `access` argument is the WHOLE row-reach identity: unspecified
+  axes no longer backfill from the mount (which WIDENED reach); a mount-only parent pair is
+  unreachable by construction. Disclosed behavior difference: a parent-paired direct continuation
+  without `senderName` now attributes to "main" instead of an internal task id.
+- `createWebFetchTool`'s product-form ctx limitation documented at the factory (defuse/counts
+  need the enrichCtx/spec mount forms).
+- Pre-release scan disposition (fixed in-tree before publish): the continuation verb's identity
+  strip also dropped the mount sessionId as the SESSION RETAIN LEDGER key — an owner-declared
+  access could reach a session-scoped retained child yet get a false `resume.retain_off`. The
+  key now rides a ledger-only options seat (`sessionRetainLedgerKey`, never a predicate axis):
+  reach is still exactly the declared access; the store route is restored.
+
+### Notes
+- Standing residuals ticketed: #372 (withdrawn-seat provenance whitewash, reproduced, design
+  adjudication), #373 (twelve long-lived-map leak risks, store-domain batch), #374 (unsigned
+  thinking replay vs strict gateways), #375 (in-session tool-schema drift vs prompt cache,
+  awaiting break-cadence data).
+
 ## 5.51.0 — 2026-08-21
 
 ### Added

package/dist/agents/send-message-tool.d.ts

@@ -20,6 +20,12 @@ export interface SendMessageToolOptions {
     owner?: string;
     scope?: string;
     sessionId?: string;
+    /** SESSION RETAIN LEDGER key only — never an access axis. `sessionId` above wears two hats
+     *  (row-reach predicate axis AND the process-global retain-ledger map key); a caller that must
+     *  strip the predicate axes (the continuation verb: access IS the identity) still needs the
+     *  ledger route, because the ledger is a STORE seat consulted for an already-gated row by its
+     *  own toolUseId — routing through it cannot widen reach. Consulted after ctx/options sessionId. */
+    sessionRetainLedgerKey?: string;
     /** Completion-notify sink for the resumed run. The Runner mount wires the SENDING run's own
      *  notification injector here (its runtask-wrapped `injectTaskNotification`), so the completion
      *  notice lands in the sender's live injection queue at a turn boundary; a direct mount may wire a
@@ -185,13 +191,18 @@ export interface AgentContinuationReceipt {
  * clear-terminal-payload erases the durable mark; the model-facing tool NEVER softens).
  *
  * Authorization is three-layered and this verb owns only the first: ① the same
- * `canAccessAgentRecord` row predicate the tool runs (an out-of-scope handle reads not_found —
- * non-leaking); ② "this really is an explicit human instruction" is the DEPLOYMENT's obligation —
+ * `canAccessAgentRecord` row predicate the tool runs, against the caller's `access` argument and
+ * NOTHING ELSE (an out-of-scope handle reads not_found — non-leaking); ② "this really is an explicit
+ * human instruction" is the DEPLOYMENT's obligation —
  * the same trust seat that stamps `stopSource:"user"` on the stop side (a server exposes this only
  * through a verified interactive-user principal endpoint, never to unattended machine clients); ③ the model
  * tool face has no such parameter (the bit travels on a module-private symbol — zero forgeable
  * surface from arguments).
  *
+ * ACCESS TOTALITY: the `access` argument is the WHOLE row-reach identity of the call — a partially
+ * specified one leaves the axes it omits UNDECLARED (default-deny), never backfilled from the mount.
+ * See the identity-strip note in the body for why that has to be spelled at the options seat too.
+ *
  * Store-conditional like every continuation face: with no durable stores wired the live-gate waiver
  * still works for same-process handles, and the durable leg refuses honestly.
  */

package/dist/agents/send-message-tool.js

@@ -638,7 +638,7 @@ export function createSendMessageTool(opts) {
                 }
             }
             const runLedger = ctx.subagentRetain ?? opts.retain;
-            const smLedgerSessionId = ctx.sessionId ?? opts.sessionId;
+            const smLedgerSessionId = ctx.sessionId ?? opts.sessionId ?? opts.sessionRetainLedgerKey;
             const sessionLedger = smLedgerSessionId !== undefined ? getSessionRetainLedger(smLedgerSessionId) : undefined;
             const knows = (l) => l !== undefined && row.toolUseId !== undefined && (l.get(row.toolUseId) !== undefined || l.wasEvicted(row.toolUseId));
             const siblingLedger = opts.siblingRetain;
@@ -746,9 +746,15 @@ export function createSendMessageTool(opts) {
     }, opts.enrichCtx !== undefined ? { enrichCtx: opts.enrichCtx } : {});
 }
 export function createAgentContinuationVerb(opts) {
+    const { owner: _mo, scope: _ms, sessionId: _msid, parentTaskId: _mpt, parentSessionId: _mps, ...mountWithoutIdentity } = opts;
+    const mountLedgerKey = opts.sessionId;
     return async (handle, content, access, o) => {
         const tool = createSendMessageTool({
-            ...opts,
+            ...mountWithoutIdentity,
+            ...(mountLedgerKey !== undefined ? { sessionRetainLedgerKey: mountLedgerKey } : {}),
+            ...(access.owner !== undefined ? { owner: access.owner } : {}),
+            ...(access.scope !== undefined ? { scope: access.scope } : {}),
+            ...(access.sessionId !== undefined ? { sessionId: access.sessionId } : {}),
             enrichCtx: (base) => {
                 const enriched = {
                     ...base,

package/dist/brain/anthropic.js

@@ -3,7 +3,7 @@ import { BrainError } from "./errors.js";
 import { DEGENERATE_MESSAGE, trimDegenerateTail } from "./repetition.js";
 import { createRepetitionPoll, parseStreamedToolArgs } from "./stream-shared.js";
 import { mintFallbackToolCallId } from "./tool-call-id.js";
-import { emitBrainTelemetry } from "./status-sink.js";
+import { emitBrainTelemetry, reportReasoningWireFacts } from "./status-sink.js";
 import { errorResultMediaNote, IMAGE_OMITTED_NO_VISION, modelSupportsVision, sendableImages } from "./media-degrade.js";
 import { ANTHROPIC_RESERVED, OUTPUT_CAP_KEYS, applyExtraBody, effectiveOutputCap, lockHeader, mergeHeaders, stripAuthHeaders, takeHeaderCasefold } from "./request-params.js";
 import { MIN_THINKING_TOKENS, budgetCapSkipsThinking, declaredEffortLevels, reasoningBudgetShare, reasoningRequestCarried, resolveEffort } from "./reasoning.js";
@@ -66,7 +66,8 @@ function toAnthropicMessages(ctx, model) {
             for (const c of m.content) {
                 if (c.type === "thinking") {
                     const tc = c;
-                    const sig = tc.thinkingSignature;
+                    const sigRaw = tc.thinkingSignature;
+                    const sig = typeof sigRaw === "string" && sigRaw.length > 0 ? sigRaw : undefined;
                     if (tc.redacted) {
                         if (sig)
                             blocks.push({ type: "redacted_thinking", data: sig });
@@ -260,13 +261,15 @@ export function createAnthropicBrain(config = {}) {
                 if (options?.temperature !== undefined && anthCompat.supportsTemperature !== false) {
                     body.temperature = options.temperature;
                 }
+                let builtReasoningFacts;
                 if (reasoningRequestCarried(model, options?.reasoning)) {
                     if (anthCompat.thinkingMode === "adaptive") {
                         body.thinking = { type: "adaptive" };
                     }
                     else {
                         const hardCap = overrides?.maxOutputTokens !== undefined || options?.maxTokens !== undefined;
-                        if (budgetCapSkipsThinking(body.max_tokens, hardCap)) {
+                        builtReasoningFacts = { outputCapTokens: body.max_tokens, hardOutputCap: hardCap };
+                        if (budgetCapSkipsThinking(builtReasoningFacts.outputCapTokens, builtReasoningFacts.hardOutputCap)) {
                             body.thinking = undefined;
                             delete body.thinking;
                         }
@@ -333,6 +336,8 @@ export function createAnthropicBrain(config = {}) {
                         thinkingRequested = builtThinkingRequested;
                         sentMaxTokens = builtMaxTokens;
                         sentMaxTokensLane = builtMaxTokensLane;
+                        if (builtReasoningFacts !== undefined)
+                            reportReasoningWireFacts(builtReasoningFacts);
                     },
                 };
             },
@@ -373,9 +378,19 @@ export function createAnthropicBrain(config = {}) {
                                     acc.redacted = true;
                                     acc.signature = cb.data ?? "";
                                 }
+                                else {
+                                    if (typeof cb.thinking === "string" && cb.thinking !== "")
+                                        acc.text = cb.thinking;
+                                    if (typeof cb.signature === "string" && cb.signature !== "")
+                                        acc.startSignature = cb.signature;
+                                }
                                 acc.pb = { type: "thinking", thinking: "" };
                                 partial.content = [acc.pb];
                                 out.push({ type: "thinking_start", contentIndex: idx, partial: { ...partial } });
+                                if (acc.text !== "") {
+                                    acc.pb.thinking = acc.text;
+                                    out.push({ type: "thinking_delta", contentIndex: idx, delta: acc.text, partial: { ...partial } });
+                                }
                             }
                             else if (cb.type === "tool_use") {
                                 acc.type = "tool_use";
@@ -414,6 +429,7 @@ export function createAnthropicBrain(config = {}) {
                                 }
                             }
                             else if (d.type === "thinking_delta" && d.thinking) {
+                                acc.startSignature = undefined;
                                 acc.text += d.thinking;
                                 if (acc.pb && acc.pb.type === "thinking")
                                     acc.pb.thinking = acc.text;
@@ -426,7 +442,7 @@ export function createAnthropicBrain(config = {}) {
                                     }
                                 }
                             }
-                            else if (d.type === "signature_delta" && d.signature) {
+                            else if (d.type === "signature_delta" && typeof d.signature === "string" && d.signature.length > 0) {
                                 acc.signature += d.signature;
                             }
                             else if (d.type === "input_json_delta" && d.partial_json) {
@@ -532,8 +548,9 @@ export function createAnthropicBrain(config = {}) {
                                 if (acc.text.length > 0 || acc.redacted === true)
                                     reasoningSeen = true;
                                 const block = { type: "thinking", thinking: acc.text };
-                                if (acc.signature)
-                                    block.thinkingSignature = acc.signature;
+                                const sig = acc.signature || acc.startSignature;
+                                if (sig)
+                                    block.thinkingSignature = sig;
                                 if (acc.redacted)
                                     block.redacted = true;
                                 finalContent.push(block);

package/dist/brain/reasoning.d.ts

@@ -109,8 +109,16 @@ export declare function budgetCapSkipsThinking(outputCapTokens: number, hardCap:
  * request build that a per-leg eager resolution cannot: the resolved output cap and whether it is a
  * HARD bound. Supplied ⇒ the anthropic budget arm mirrors the wire's cap-wins skip
  * ({@link budgetCapSkipsThinking}); absent ⇒ the budget arm reports the cap-blind gradient it always
- * did (the eager per-leg trace/result mint has no request facts — a capped request's per-attempt skip
- * is visible only to a caller that passes them).
+ * did (an eager mint that has not yet seen a request has no facts).
+ *
+ * Who supplies them, and why it is never the reporting caller's own arithmetic: the adapter
+ * that BUILT the request reports the pair it judged, through the runner's reasoning-wire-facts sink
+ * (`status-sink.ts`), from its `onCommitted` hook so a speculatively-built request the overflow
+ * recovery declined can never be reported as sent. A consumer re-deriving the cap would have to
+ * re-implement the adapter's precedence chain (engine override > caller `options.maxTokens` >
+ * `model.maxTokens` > brain-construction default) — a second source of truth for a number only the
+ * minter can state. The runner then re-resolves with them: the skip and its report stay ONE predicate
+ * reading ONE set of facts.
  */
 export interface ReasoningWireFacts {
     /** The request's resolved output cap (the wire `max_tokens` at the moment the thinking arm judges). */

package/dist/brain/request-params.d.ts

@@ -45,10 +45,26 @@ export declare function stripAuthHeaders(headers: Record<string, string>): void;
  * deployment — is byte-identical on the wire).
  *
  * EXEMPT: the auth carriers (`authorization` / `x-api-key`, any case) pass through with the exact
- * legacy spread semantics (same-spelling override only, no case-fold dedup) — their case handling is
- * {@link stripAuthHeaders}' pinned jurisdiction (the per-call-replaces flow and the
- * header-only ANTHROPIC_AUTH_TOKEN shape, which must survive under its own capital-A spelling), and
- * this layer must not become a second, subtly different auth authority.
+ * legacy spread semantics (same-spelling override only, no case-fold dedup), so that
+ * {@link stripAuthHeaders} stays the ONE authority over auth spelling and this layer never becomes a
+ * second, subtly different one.
+ *
+ * RE-RULED, because the exemption used to be justified by a reason that does not hold: the
+ * note claimed it protected "the header-only ANTHROPIC_AUTH_TOKEN shape, which must survive under its
+ * own capital-A spelling". Dedup would not endanger that shape — it keeps the WINNER'S spelling, and a
+ * lone `Authorization` has nothing to be deduped against, so it survives either way; nor does the
+ * per-call-replaces flow depend on the exemption, since {@link stripAuthHeaders} already deletes every
+ * spelling present. Measured, not reasoned: `mergeHeaders({Authorization:A},{authorization:B})` keeps
+ * BOTH, and the platform `Headers` fold sends `authorization: A, B`.
+ *
+ * STATED RESIDUAL (deliberately not fixed here): a deployment that spells the SAME auth carrier two
+ * ways across two layers therefore ships both, comma-folded — the very disease this function fixed
+ * for every other header. It is held, not denied, on severity: no server accepts a comma-joined
+ * credential, so the failure is a LOUD 401 attributable to the misconfiguration, whereas the
+ * non-auth case this function exists for produced a silently WRONG value (`X-Tenant: a, b` — neither
+ * writer's, the later layer's documented override defeated). Tightening it changes which credential
+ * reaches the wire, so it belongs in a window that discloses an auth-face behavior change, not in one
+ * whose subject is the reasoning knob.
  */
 /**
  * #343 (review r4) — assign a STRUCTURAL locked header under its canonical lowercase name, deleting

package/dist/brain/status-sink.d.ts

@@ -1,4 +1,5 @@
 import type { BrainRetryErrClass, BrainStatus } from "../core/types.js";
+import type { ReasoningWireFacts } from "./reasoning.js";
 /** Run `fn` with a per-task brain-status sink in scope. ALS propagates it through the async brain calls
  *  inside `fn` (the harness's prompt → brain.stream → connect/retry loop), so {@link emitBrainStatus}
  *  reaches THIS task's sink and nothing else. */
@@ -60,3 +61,58 @@ export type BrainTelemetry = {
 export declare function runWithBrainTelemetry<T>(emit: (t: BrainTelemetry) => void, fn: () => Promise<T>): Promise<T>;
 /** Report a brain-layer fallback/telemetry event to the active per-task sink, if any. */
 export declare function emitBrainTelemetry(t: BrainTelemetry): void;
+/**
+ * Run `fn` with a per-task REASONING-WIRE-FACTS sink in scope — the THIRD brain→runner ALS channel,
+ * same decoupling contract as its two siblings (no brain-interface field, no per-call option, no-op
+ * outside the scope, an emit must never change a call's outcome).
+ *
+ * What it carries and WHY it is a channel rather than a runner-side computation: the reporting
+ * resolver's cap-wins arm ({@link import("./reasoning.js").budgetCapSkipsThinking}) needs facts that
+ * belong to ONE outgoing request — the output cap that actually reached the wire and whether it was a
+ * HARD bound. The runner's per-leg eager mint cannot know them without re-deriving the adapter's own
+ * cap precedence chain (engine override > caller `options.maxTokens` > `model.maxTokens` >
+ * brain-construction default), i.e. without standing up a SECOND source of truth that a deployment's
+ * own brain, a construction-time default, or a per-attempt engine override would silently desync. So
+ * the MINTER reports the facts it judged — the same law `SSERequest.outputCapTokens` already states
+ * for the overflow recovery ("what the adapter actually put on the wire", never what a consumer
+ * infers) — and the resolver stays the single predicate both faces read.
+ *
+ * REVOKED ON SETTLEMENT, unlike its two siblings, because this sink WRITES to a seat that is later
+ * read into a returned value instead of pushing an advisory frame. `AsyncLocalStorage.run` does not
+ * revoke the store from async resources created inside `fn`: a brain call the engine ABANDONED (the
+ * brain-call guardrail's whole purpose) keeps the scope alive in its own continuation and can call
+ * `observe` long after the task settled — mutating a resolution whose `TaskResult` has already been
+ * assembled and handed back, and emitting a trace correction after the task's terminal. The scope
+ * therefore carries a liveness flag cleared when `fn`'s promise settles, which is also the "freeze
+ * before result assembly" boundary: assembly runs after the brain-driving call resolves, so a report
+ * that could still land is exactly one that arrives before the freeze.
+ *
+ * Passing a NO-OP `observe` is the documented way to SHIELD a nested internal brain call (compaction
+ * summary, side query): it installs a fresh innermost scope for the duration, so the inner call's
+ * reports are swallowed instead of restating the outer leg's posture — the same shape the status sink
+ * uses for the same reason ("background/internal brain calls are not surfaced").
+ */
+export declare function runWithReasoningWireFacts<T>(observe: (f: ReasoningWireFacts) => void, fn: () => Promise<T>): Promise<T>;
+/**
+ * Report the reasoning wire facts of the request the engine has SELECTED to send, to the active
+ * per-task sink, if any.
+ *
+ * Call it from the adapter's `onCommitted` hook, never from `buildRequest`: the context-overflow
+ * recovery builds candidate requests speculatively and may decline them, and a declined candidate's
+ * facts would otherwise be reported against a request that was never sent (the exact hazard
+ * `onCommitted` exists for).
+ *
+ * Precisely what that buys, since the hook's own summary ("becomes the one that is sent") is a shade
+ * stronger than its position: the engine calls it immediately after choosing a request and BEFORE the
+ * attempt loop's abort check and `doFetch`, so a call aborted before its first connect can still have
+ * reported. The distinction that matters here is nonetheless the one the hook does guarantee — a
+ * DECLINED candidate never reports, so the facts always belong to the request the adapter's decision
+ * was made about. The residual (a selected-but-never-connected request on an aborting leg) describes
+ * the posture that leg was about to run under, and is not worth moving a hook three adapters share
+ * their own diagnostics attribution on.
+ *
+ * Fire-and-forget and swallow-guarded like its siblings — an observability fact must never turn a
+ * settled brain call into a failure — and inert once its scope has settled (see
+ * {@link runWithReasoningWireFacts}).
+ */
+export declare function reportReasoningWireFacts(facts: ReasoningWireFacts): void;

package/dist/brain/status-sink.js

@@ -21,3 +21,19 @@ export function emitBrainTelemetry(t) {
     catch {
     }
 }
+const reasoningFactsSinkStore = new AsyncLocalStorage();
+export function runWithReasoningWireFacts(observe, fn) {
+    const scope = { observe, live: true };
+    return reasoningFactsSinkStore.run(scope, fn).finally(() => {
+        scope.live = false;
+    });
+}
+export function reportReasoningWireFacts(facts) {
+    try {
+        const sink = reasoningFactsSinkStore.getStore();
+        if (sink?.live === true)
+            sink.observe(facts);
+    }
+    catch {
+    }
+}

package/dist/core/a2a.js

@@ -2,7 +2,7 @@ import { randomUUID } from "node:crypto";
 import { Type } from "typebox";
 import { A2A_TASK_STATES } from "./a2a-task-state.js";
 import { describeHttpTransportFailure, resolveProtocolHttpHeaders } from "./mcp.js";
-import { mintNamespacePrefix, mintNamespacedToolName } from "./protocol-naming.js";
+import { findNamespacePrefixCollision, mintNamespacePrefix, mintNamespacedToolName } from "./protocol-naming.js";
 import { A2A_NAMESPACE } from "./protocol-table.js";
 import { delimitUntrusted, inlineUntrusted } from "./untrusted-text.js";
 const A2A_REQUEST_TIMEOUT_MS = 30_000;
@@ -575,6 +575,17 @@ function asPeerWarning(spec, err) {
     return warning;
 }
 export async function materializeA2aTools(specs, principal, signal) {
+    if (specs.length > 0) {
+        const collision = findNamespacePrefixCollision(A2A_NAMESPACE, specs.map((s) => s.name));
+        if (collision) {
+            const [a, b] = collision.peers;
+            const e = new Error(a === b
+                ? `A2A peer "${a}" is declared twice — each peer needs its own name (both mount under "${collision.prefix}").`
+                : `A2A peer names "${a}" and "${b}" both mount under "${collision.prefix}" — the namespaced tool name keeps only [a-zA-Z0-9_-], so they are the same domain to this engine. Rename one.`);
+            e.code = "config.a2a_peer_name_collision";
+            throw e;
+        }
+    }
     const lifecycle = { disposed: false };
     const tools = [];
     const toolAxes = [];

package/dist/core/cache-break-detector.js

@@ -27,6 +27,7 @@ export class CacheBreakDetector {
             systemHash: fnv1a(input.systemPrompt),
             perToolHash: new Map(input.tools.map((t) => [t.name, fnv1a(`${t.name}\0${t.description}\0${stableStringify(t.parameters)}`)])),
             toolSetHash: fnv1a([...input.tools.map((t) => t.name)].sort().join(",")),
+            toolOrderHash: fnv1a(input.tools.map((t) => t.name).join(",")),
             modelKey: input.modelKey,
             cacheRead: input.cacheRead,
             at: Date.now(),
@@ -59,7 +60,11 @@ export class CacheBreakDetector {
             }
             else if (snap.toolSetHash !== prev.toolSetHash) {
                 cause = "tool-set";
-                detail = "the tool set changed (a tool was added/removed/reordered)";
+                detail = "the tool set changed (a tool was added or removed)";
+            }
+            else if (snap.toolOrderHash !== prev.toolOrderHash) {
+                cause = "tool-set";
+                detail = "the tool ORDER changed (same tools, different positions) — a reordered tool list is a byte-different prefix from the first moved tool onward, so the provider re-bills the whole tail";
             }
             else if (snap.systemHash !== prev.systemHash) {
                 cause = "system-prefix";
@@ -68,10 +73,11 @@ export class CacheBreakDetector {
             else {
                 const gapMs = snap.at - prev.at;
                 cause = "server-or-ttl";
+                const checked = "nothing this detector fingerprints (system prefix, tool set + order, model)";
                 detail =
                     gapMs < SERVER_GAP_MS
-                        ? `nothing in the prefix changed and the gap was ${Math.round(gapMs / 1000)}s — likely a server-side miss, not a client-side prefix bug`
-                        : `nothing changed but the gap was ${Math.round(gapMs / 60_000)}min — likely a normal TTL expiry (cold cache), not a bug`;
+                        ? `${checked} changed and the gap was ${Math.round(gapMs / 1000)}s — most likely a server-side miss; the message history is not fingerprinted, so volatile content early in the conversation would also land here`
+                        : `${checked} changed and the gap was ${Math.round(gapMs / 60_000)}min — most likely a normal TTL expiry (cold cache)`;
             }
         }
         return { turn: input.turn, cacheReadBefore: before, cacheReadAfter: after, cause, detail };

package/dist/core/hooks.js

@@ -1,4 +1,4 @@
-import { decisionText, describeThrown, isAskDenyResolution, refuseOutOfContractDecision } from "./tool-policy.js";
+import { coreMintedResolutionOf, decisionText, describeThrown, isAskDenyResolution, refuseOutOfContractDecision } from "./tool-policy.js";
 import { brandPolicyAskClass } from "./ask-class.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 import { mintSystemReminder } from "./reminder-mint.js";
@@ -827,7 +827,7 @@ export async function runToolGate(input) {
         if (decision.updatedInput !== undefined) {
             currentInput = decision.updatedInput;
         }
-        const denyResolution = askDenyResolution;
+        const denyResolution = askDenyResolution ?? coreMintedResolutionOf(decision, { toolCallId, toolName });
         if (input.permissionDenied) {
             await notifier.notifyAsync(() => input.permissionDenied?.({ toolName, input: cloneObserverInput(currentInput), toolCallId, reason: denyReason, source: denySource, ...(denyResolution !== undefined ? { resolution: denyResolution } : {}), ...(input.identity !== undefined ? { identity: input.identity } : {}) }), "toolGate.permissionDenied");
         }