@sema-agent/core 5.53.0 → 5.55.0

package/dist/core/runner/prepare-task.d.ts

@@ -483,13 +483,22 @@ export interface Prepared {
     ownedEnv?: ExecutionEnv;
     /** design/45: a mutable holder the durable-suspend gate writes when a policy `ask` was checkpointed
      *  (capture + abort). The run loop reads it to assemble `status:"suspended"`. Empty unless a suspension
-     *  fired this run. */
+     *  fired this run.
+     *
+     *  `gatedCallId` is the id of the tool call the committed gate is holding — read straight off the
+     *  committed checkpoint's `tool_approval` pendingAction, so the id a contaminated sibling frame names
+     *  and the id the checkpoint parks on are the SAME value by construction, not by convention. ABSENT
+     *  (never guessed) for a park that binds no tool call at all — a `resource_limit` slice and a
+     *  `plan_review` pause both have pendingActions with no tool call, so there is no causal id to name.
+     *  Written unconditionally by the commit-side publisher precisely so a later park cannot inherit an
+     *  earlier one's id. */
     suspendRef: {
         token?: CheckpointToken;
         checkpointId?: string;
         gate?: CheckpointGate;
         scope?: string;
         restoreMode?: "snapshot" | "park_only";
+        gatedCallId?: string;
     };
     /** Ruled 2026-08-05 (matrix ruling arm A): set true by the resume engine when this leg EXECUTES the
      *  approved pending call — the restart-loop cap then counts from a fresh base (consecutive
@@ -511,6 +520,7 @@ export interface Prepared {
         gate?: CheckpointGate;
         scope?: string;
         restoreMode?: "snapshot" | "park_only";
+        gatedCallId?: string;
     };
     /** RB-439-a: the remote-workspace lifecycle failures this run hit, appended in call order and echoed
      *  verbatim on `TaskResult.remoteEnvFailures`. A shared array (not a per-call return) because a suspend
@@ -859,6 +869,26 @@ export interface Prepared {
         droppedMessages: boolean;
     };
 }
+/**
+ * WHICH tool call a committed durable park is holding this run — `undefined` when nothing parked, or
+ * when the park that did commit holds no call (a resource slice, a plan review).
+ *
+ * SINGLE derivation on purpose. Two consumers need this answer: the abort-classification seam, which
+ * stamps it into the `details` of the results the loop mints for the contaminated siblings, and the
+ * `tool_end` projection, which puts it on the wire. Reading it from one function keeps the two from
+ * disagreeing about WHICH HOLDER WINS or about what a holder with no call means. They are not otherwise
+ * interchangeable: the frame face applies strictly narrower conditions on top of this answer (see
+ * `tool_end.gatedCallId`), so a frame may omit an id this function returns — never the reverse.
+ *
+ * The frame side must not read the id back out of a tool RESULT even though the marker is there: a
+ * result's `details` is written by the tool (and replaceable by post-tool hooks), so lifting a
+ * cross-call attribution from it would let any failing tool name an arbitrary call and put a phantom
+ * approval wait on someone else's frame. Same rule, same reason, as `settledBy`.
+ *
+ * The two holders are never both set (the commit-side discriminant writes exactly one); they are read
+ * here in assemble-result's slot order so the winner is the same one the terminal status is built from.
+ */
+export declare function gatedCallIdOf(p: Pick<Prepared, "suspendRef" | "reviewRef">): string | undefined;
 /**
  * design/45 resume inputs threaded into {@link prepareTask} to continue a suspended task. The Runner
  * builds it from the persisted {@link Checkpoint}: rewind the branch to the suspension leaf, skip the

package/dist/core/runner/prepare-task.js

@@ -39,6 +39,7 @@ import { STALL_CONNECT_MS, STALL_FIRST_TOKEN_MS, STALL_IDLE_MS, withBrainCallGua
 import { defineTool, isDefineToolProduct } from "../tools.js";
 import { RETIRED_TOOL_NAMES } from "../tool-name-aliases.js";
 import { protocolOf } from "../protocol-table.js";
+import { isMcpCoveringRuleName, mcpRuleNameCovers } from "../permission-rules.js";
 import { pathToUri } from "../lsp-protocol.js";
 import { DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, createOffloadPersist, firstPartyOffloadPolicy, InMemoryToolResultStore, RunnerSharedToolResultStore, ScopedToolResultStore, isVolatileOffloadStore, OFFLOAD_TOOL_NAME, createReadToolResultTool, withToolResultOffload, } from "../tool-result-store.js";
 import { OUTPUT_TOOL_NAME, REPORT_FINDINGS_TOOL_NAME, SKILL_CONTENT_MAX_CHARS, SKILL_TOOL_NAME, createOutputTool, createReportBlockedTool, createReportFindingsTool, createSkillTool, normalizeSkills } from "./synthetic-tools.js";
@@ -240,6 +241,30 @@ class ParkRefusal extends Error {
 export { resolveCheckpointStore } from "../checkpoint-store.js";
 export { isFableFamilyModelId, resolveModelPromptTraits, resolveTaskLimits } from "./prepare-config-doors.js";
 export { rebaseWorkspacePath, rebaseWorkspacePathAcross } from "./prepare-workspace-restore.js";
+export function gatedCallIdOf(p) {
+    if (p.suspendRef.token !== undefined)
+        return p.suspendRef.gatedCallId;
+    if (p.reviewRef.token !== undefined)
+        return p.reviewRef.gatedCallId;
+    return undefined;
+}
+function parkContaminationMarker(refs) {
+    if (refs.suspendRef.token === undefined && refs.reviewRef.token === undefined)
+        return undefined;
+    const gatedCallId = gatedCallIdOf(refs);
+    return { code: "gate.parked", ...(gatedCallId !== undefined ? { gatedCallId } : {}) };
+}
+function publishCommittedSuspend(refs, token, gate, scope, remoteHandle, checkpointId, pendingAction) {
+    const ref = gate.kind === "needs_review" || gate.kind === "plan_review" ? refs.reviewRef : refs.suspendRef;
+    ref.token = token;
+    if (checkpointId !== undefined)
+        ref.checkpointId = checkpointId;
+    ref.gate = gate;
+    ref.gatedCallId = pendingAction?.kind === "tool_approval" ? pendingAction.toolCallId : undefined;
+    if (remoteHandle !== undefined)
+        ref.restoreMode = remoteHandle.restoreMode === "park_only" ? "park_only" : "snapshot";
+    ref.scope = scope;
+}
 function hasConversationContent(branch) {
     return branch.some((e) => e.type === "message" || e.type === "custom_message" || e.type === "compaction");
 }
@@ -2611,7 +2636,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 stream: withBrainCallGuardrail((m, c, o) => deps.brain.stream(m, c, o), brainCallGuardrailMs, brainCallGuardrailRef),
             };
         const harness = new AgentHarness({
-            abortResultDetails: () => suspendRef.token !== undefined || reviewRef.token !== undefined ? { code: "gate.parked" } : undefined,
+            abortResultDetails: () => parkContaminationMarker({ suspendRef, reviewRef }),
             ...(spec.limits?.maxOutputTokens !== undefined && spec.limits.maxOutputTokens > 0
                 ? { maxOutputTokens: spec.limits.maxOutputTokens }
                 : {}),
@@ -2686,6 +2711,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         for (const n of list ?? []) {
                             if (known.has(n))
                                 continue;
+                            if (isMcpCoveringRuleName(n) && [...known].some((k) => mcpRuleNameCovers(n, k)))
+                                continue;
                             const retired = RETIRED_TOOL_NAMES.get(n);
                             if (retired !== undefined) {
                                 const err = new Error(`tool policy ${kind}-list entry "${n}" is a RETIRED tool name (${retired}) and matches nothing in this run's roster — legacy-name normalization was removed (RB-476-A), so this entry would silently guard nothing. Update the deployment's rule to the current name.`);
@@ -3748,16 +3775,6 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     return { ok: false, reason };
                 }
             };
-            const publishCommittedSuspend = (token, gate, scope, remoteHandle, checkpointId) => {
-                const ref = gate.kind === "needs_review" || gate.kind === "plan_review" ? reviewRef : suspendRef;
-                ref.token = token;
-                if (checkpointId !== undefined)
-                    ref.checkpointId = checkpointId;
-                ref.gate = gate;
-                if (remoteHandle !== undefined)
-                    ref.restoreMode = remoteHandle.restoreMode === "park_only" ? "park_only" : "snapshot";
-                ref.scope = scope;
-            };
             const suspendLoopCapHit = (count, cap, detail) => {
                 if (cap === undefined)
                     return false;
@@ -3838,7 +3855,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 };
                 if (!(await commitSuspendSaga(token, cp, suspendableEnv, remoteHandle)).ok)
                     return false;
-                publishCommittedSuspend(token, gate, scope, remoteHandle, cp.checkpointId);
+                publishCommittedSuspend({ suspendRef, reviewRef }, token, gate, scope, remoteHandle, cp.checkpointId, cp.pendingAction);
                 try {
                     await sessions.pin?.(sessionId);
                 }
@@ -3924,7 +3941,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     };
                     if (!(await commitSuspendSaga(token, cp, suspendableEnv, remoteHandle)).ok)
                         return false;
-                    publishCommittedSuspend(token, gate, scope, remoteHandle, cp.checkpointId);
+                    publishCommittedSuspend({ suspendRef, reviewRef }, token, gate, scope, remoteHandle, cp.checkpointId, cp.pendingAction);
                     try {
                         await sessions.pin?.(sessionId);
                     }
@@ -4219,7 +4236,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     if (!committed.ok) {
                         return committed.reason !== undefined ? { parkFailed: committed.reason } : undefined;
                     }
-                    publishCommittedSuspend(token, gate, cp.scope, remoteHandle, cp.checkpointId);
+                    publishCommittedSuspend({ suspendRef, reviewRef }, token, gate, cp.scope, remoteHandle, cp.checkpointId, cp.pendingAction);
                     try {
                         await sessions.pin?.(sessionId);
                     }

package/dist/core/runner/runtask.d.ts

@@ -87,12 +87,19 @@ settledBy?: ApprovalSettledBy,
 approver?: string, 
 /** The ask resolver's deny-arm classification — same caller, same engine-owned channel and the same
  *  never-derived-from-`result` posture as the two above. Omitted ⇒ not an ask-resolution deny. */
-resolution?: import("../tool-policy.js").AskDenyResolution): {
+resolution?: import("../tool-policy.js").AskDenyResolution, 
+/** WHICH call this run's committed durable park is holding ({@link gatedCallIdOf}), for the frames the
+ *  abort short-circuits. Same never-derived-from-`result` posture as the three above, and for the
+ *  sharpest version of that reason: this one is an assertion about a DIFFERENT call, so a tool able to
+ *  author it could point an approval UI at a call nobody is waiting on. Omitted ⇒ no park is holding a
+ *  call (nothing parked, or the park that did holds none), and the frame then carries no id at all. */
+gatedCallIdOfRun?: string): {
     output?: unknown;
     truncated?: boolean;
     totalChars?: number;
     structured?: unknown;
     errorCode?: string;
+    gatedCallId?: string;
     settledBy?: ApprovalSettledBy;
     approver?: string;
     resolution?: import("../tool-policy.js").AskDenyResolution;

package/dist/core/runner/runtask.js

@@ -31,9 +31,9 @@ import { toImageContent } from "./image.js";
 import { OUTPUT_TOOL_NAME, SKILLS_LISTING_PROBE_HEADER, resolveOutputRetries } from "./synthetic-tools.js";
 import { cacheFamilyOf, usageCostMicroUsd } from "./usage-accounting.js";
 import { assembleResult, errorCodeOf } from "./assemble-result.js";
-import { ATTACHMENT_BYTE_CAP, CHANGED_FILES_MAX, AGENT_LISTING_REMOVED_HEADER, SKILLS_LISTING_DELTA_HEADER, SKILLS_LISTING_REMOVED_HEADER, advanceCadenceClock, agentListingDeltaHeader, agentListingInitialHeader, replayAnnouncedListing, replayAnnouncedModels, clipToBytes, collectDateChange, collectDueAttachments, collectInstructionsChange, commitAgentListing, commitInstructionsChange, commitSkillsListing, createAttachmentState, rebaseCadenceWindows, reduceToolEnd, renderAgentListingDelta, renderMcpDroppedTools, renderMcpInstructionsDelta, renderOrphanedBackgroundTasks, selectMcpDroppedBatch, renderSkillsListingDelta, renderToolsDelta, stampWriteAnchor } from "./turn-attachments.js";
+import { ATTACHMENT_BYTE_CAP, CHANGED_FILES_MAX, AGENT_LISTING_REMOVED_HEADER, SKILLS_LISTING_DELTA_HEADER, SKILLS_LISTING_REMOVED_HEADER, advanceCadenceClock, agentListingDeltaHeader, attachmentEnvelopeTags, agentListingInitialHeader, replayAnnouncedListing, replayAnnouncedModels, clipToBytes, collectDateChange, collectDueAttachments, collectInstructionsChange, commitAgentListing, commitInstructionsChange, commitSkillsListing, createAttachmentState, rebaseCadenceWindows, reduceToolEnd, renderAgentListingDelta, renderMcpDroppedTools, renderMcpInstructionsDelta, renderOrphanedBackgroundTasks, selectMcpDroppedBatch, renderSkillsListingDelta, renderToolsDelta, stampWriteAnchor } from "./turn-attachments.js";
 import { buildWorkingFileAttachments, centerAdoptionOption, emitInputTruncated, forkContextOption } from "./compaction-call-options.js";
-import { prepareTask, resolveCheckpointStore } from "./prepare-task.js";
+import { gatedCallIdOf, prepareTask, resolveCheckpointStore } from "./prepare-task.js";
 import { settleTeardownLeg } from "./teardown-bounded.js";
 import { TOOL_SEARCH_NAME } from "./tool-disclosure.js";
 import { hasVerifiableStructureSignal } from "./grounding-signal.js";
@@ -41,7 +41,7 @@ import { hasDestroy, isIsolated } from "../remote-env.js";
 import { hasBackgroundShell, sweepBackgroundShells } from "../background-shell.js";
 import { cloneObserverInput, formatHookFeedback } from "../hooks.js";
 import { buildHumanInputEvent, projectHumanInput } from "../human-input-projection.js";
-import { delimitUntrusted, inlineUntrusted, REVIEWER_NOTE_MAX_BODY, sanitizeUntrustedText } from "../untrusted-text.js";
+import { delimitUntrusted, inlineUntrusted, REVIEWER_NOTE_MAX_BODY, sanitizeUntrustedText, SHELLED_BODY_ENVELOPE_TAGS } from "../untrusted-text.js";
 import { reconcileInterruptedSession } from "../session-reconcile.js";
 import { RunnerSharedToolResultStore } from "../tool-result-store.js";
 import { formatDiagnosticsBlock } from "../lsp-diagnostics.js";
@@ -141,17 +141,19 @@ function resumeDecisionWasNegative(resume) {
 }
 const DEFERRED_REISSUE = "[DEFERRED] This tool call shared a batch with a call that suspended for durable approval, so it was " +
     "NOT executed on resume. If you still need it, issue it again now.";
-function toolEndBodyFrom(result, isError, settledBy, approver, resolution) {
+function toolEndBodyFrom(result, isError, settledBy, approver, resolution, gatedCallIdOfRun) {
     const o = toolOutputFrom(result);
     const st = structuredFrom(result);
     const det = isError ? result?.details : undefined;
     const codeRaw = det?.code;
     const kindRaw = det?.errorKind;
     const code = typeof codeRaw === "string" ? codeRaw : typeof kindRaw === "string" ? kindRaw : undefined;
+    const gatedCallId = code === "gate.parked" ? gatedCallIdOfRun : undefined;
     return {
         ...(o !== undefined ? { output: o.output, ...(o.truncated ? { truncated: true } : {}), ...(o.totalChars !== undefined ? { totalChars: o.totalChars } : {}) } : {}),
         ...(st !== undefined ? { structured: st } : {}),
         ...(typeof code === "string" ? { errorCode: code } : {}),
+        ...(gatedCallId !== undefined ? { gatedCallId } : {}),
         ...(settledBy !== undefined ? { settledBy } : {}),
         ...(approver !== undefined ? { approver } : {}),
         ...(resolution !== undefined ? { resolution } : {}),
@@ -543,7 +545,7 @@ function makeTurnBoundary(prepared, stats, rs, deps) {
             const files = prepared.lspDiagnostics.registry.drain(prepared.lspDiagnostics.runIdent);
             if (files.length > 0) {
                 queue.push({ type: "diagnostics", files, isNew: true, ...ident() });
-                const block = formatDiagnosticsBlock(files);
+                const block = mintSystemReminder(formatDiagnosticsBlock(files), prepared.reminderMark);
                 void prepared.harness.steer(block, { provenance: "engine-note" }).catch(() => undefined);
                 boundarySteered = true;
             }
@@ -746,7 +748,7 @@ function makeTurnBoundary(prepared, stats, rs, deps) {
                 }
             }
             if (due.length > 0) {
-                attachmentsPayload = due.map((a) => mintSystemReminder(sanitizeUntrustedText(a.body), prepared.reminderMark)).join("\n");
+                attachmentsPayload = due.map((a) => mintSystemReminder(sanitizeUntrustedText(a.body, attachmentEnvelopeTags(a.source)), prepared.reminderMark)).join("\n");
                 for (const a of due)
                     boundaryAttachmentBytes += Buffer.byteLength(a.body, "utf8");
                 rs.attach.attachmentsInjected += due.length;
@@ -767,7 +769,7 @@ function makeTurnBoundary(prepared, stats, rs, deps) {
                 try {
                     const r = await postToolBatchHook(batch, injectedThisTurn !== undefined ? { injectedThisTurn } : undefined, { identity: prepared.hookIdentity });
                     if (r?.additionalContext && injectedThisTurn === undefined) {
-                        const body = sanitizeUntrustedText(r.additionalContext);
+                        const body = sanitizeUntrustedText(r.additionalContext, SHELLED_BODY_ENVELOPE_TAGS);
                         const budget = ATTACHMENT_BYTE_CAP - boundaryAttachmentBytes;
                         if (budget >= BATCH_CONTEXT_MIN_KEEP_BYTES) {
                             const clipped = clipToBytes(body, budget) === body
@@ -1008,7 +1010,7 @@ function makeTurnBoundary(prepared, stats, rs, deps) {
     return onTurnBoundary;
 }
 function wrapGitFrame(body, mark) {
-    return mintSystemReminder(sanitizeUntrustedText(body), mark);
+    return mintSystemReminder(sanitizeUntrustedText(body, SHELLED_BODY_ENVELOPE_TAGS), mark);
 }
 async function resolveGitLegDelivery(prepared, cpMirror, report) {
     const ref = prepared.gitStatusRef;
@@ -1344,7 +1346,7 @@ function makeHarnessHandlers(prepared, stats, rs, deps) {
             toolName: event.toolName,
             ...(toolLabels.get(event.toolName) !== undefined ? { label: toolLabels.get(event.toolName) } : {}),
             isError: event.isError,
-            ...toolEndBodyFrom(event.result, event.isError, settlement?.settledBy, settlement?.approver, settlement?.resolution),
+            ...toolEndBodyFrom(event.result, event.isError, settlement?.settledBy, settlement?.approver, settlement?.resolution, prepared.abortController.signal.aborted ? gatedCallIdOf(prepared) : undefined),
             ...ident(),
         });
         announceWorkspaceMove();
@@ -3258,7 +3260,7 @@ export class Runner {
                         }
                     }
                     if (firstFrames.length > 0) {
-                        effectiveObjective = `${firstFrames.map((f) => mintSystemReminder(sanitizeUntrustedText(f.body), prepared.reminderMark)).join("\n")}\n${effectiveObjective}`;
+                        effectiveObjective = `${firstFrames.map((f) => mintSystemReminder(sanitizeUntrustedText(f.body, attachmentEnvelopeTags(f.source)), prepared.reminderMark)).join("\n")}\n${effectiveObjective}`;
                     }
                 }
                 const gitQueuedChars = gitLegDelivered !== undefined && gitLegDelivered.standalone ? gitLegDelivered.wrapped.length : 0;

package/dist/core/runner/session-rule-policy.js

@@ -1,6 +1,6 @@
 import { canonicalizeTarget, writeTargetPath } from "../../tools/fs/safety.js";
 import { isWinFormPath } from "../../tools/fs/safety.js";
-import { createCoarseCommandNamePolicy } from "../tool-policy.js";
+import { createCoarseCommandNamePolicy, mcpCoveringEntries, mcpCoveringHit } from "../tool-policy.js";
 export const PATH_WRITE_TOOLS = new Set(["Write", "Edit", "MultiEdit"]);
 export const PATH_CONFINABLE_WRITE_TOOLS = new Set([...PATH_WRITE_TOOLS, "NotebookEdit"]);
 export function isWithin(root, p) {
@@ -24,6 +24,8 @@ export function createSessionRulePolicy(rules, opts) {
     const { env, rootPath, toolEffects } = opts;
     const toolDeny = new Set(rules.toolDeny ?? []);
     const toolAllow = rules.toolAllow ? new Set(rules.toolAllow) : undefined;
+    const toolDenyCovering = mcpCoveringEntries(rules.toolDeny);
+    const toolAllowCovering = mcpCoveringEntries(rules.toolAllow);
     const cmdPolicy = rules.commandAllow || rules.commandDeny
         ? createCoarseCommandNamePolicy({
             ...(rules.commandAllow ? { allow: rules.commandAllow } : {}),
@@ -36,9 +38,9 @@ export function createSessionRulePolicy(rules, opts) {
         nameSets: [{ ...(rules.toolDeny?.length ? { deny: [...rules.toolDeny] } : {}), ...(rules.toolAllow?.length ? { allow: [...rules.toolAllow] } : {}) }],
         async check(req, signal) {
             const toolName = req.toolName;
-            if (toolDeny.has(toolName))
+            if (toolDeny.has(toolName) || mcpCoveringHit(toolDenyCovering, toolName))
                 return deny(`tool "${req.toolName}" is denied by a session rule`);
-            if (toolAllow && !toolAllow.has(toolName)) {
+            if (toolAllow && !toolAllow.has(toolName) && !mcpCoveringHit(toolAllowCovering, toolName)) {
                 return deny(`tool "${req.toolName}" is not in the session-rule allowlist`);
             }
             if (cmdPolicy) {

package/dist/core/runner/synthetic-tools.js

@@ -1,5 +1,6 @@
 import { Type } from "typebox";
 import { defineTool } from "../tools.js";
+import { sanitizeUntrustedText, SHELLED_BODY_ENVELOPE_TAGS } from "../untrusted-text.js";
 export const OUTPUT_TOOL_NAME = "StructuredOutput";
 export const REPORT_BLOCKED_TOOL_NAME = "ReportBlocked";
 export const REPORT_FINDINGS_TOOL_NAME = "ReportFindings";
@@ -123,7 +124,8 @@ export function skillListingLine(s) {
     const desc = s.description.length > SKILL_DESC_MAX_CHARS
         ? `${s.description.slice(0, SKILL_DESC_MAX_CHARS - 1)}…`
         : s.description;
-    return `- ${s.name}: ${desc}${skillFilesSuffix(s.files)}`;
+    const safe = (t) => sanitizeUntrustedText(t, SHELLED_BODY_ENVELOPE_TAGS);
+    return `- ${safe(s.name)}: ${safe(desc)}${safe(skillFilesSuffix(s.files))}`;
 }
 const SKILLS_BLOCK_CAP_MARKER = "(block size cap reached — lower-priority skills are listed name-only; descriptions via the tool)";
 export function buildSkillsBlock(skills) {
@@ -141,7 +143,7 @@ export function buildSkillsBlock(skills) {
     const lineCost = (l) => bytes(l) + 1;
     const budget = SKILLS_BLOCK_MAX_BYTES - bytes(render([]));
     const fullLines = skills.map((s) => skillListingLine(s));
-    const nameLines = skills.map((s) => `- ${s.name}`);
+    const nameLines = skills.map((s) => `- ${sanitizeUntrustedText(s.name, SHELLED_BODY_ENVELOPE_TAGS)}`);
     const fullTotal = fullLines.reduce((acc, l) => acc + lineCost(l), 0);
     if (fullTotal <= budget)
         return render(fullLines);

package/dist/core/runner/turn-attachments.d.ts

@@ -65,6 +65,7 @@ export interface BackgroundTaskSnapshot {
     description?: string;
     status: string;
 }
+export declare function attachmentEnvelopeTags(source: AttachmentSource): string[];
 /** One due reminder. `body` is the inner text — the steerer adds the `<system-reminder>` wrapper (F3). */
 export interface TurnAttachment {
     source: AttachmentSource;
@@ -638,7 +639,9 @@ export declare function replayAnnouncedListing(texts: readonly string[], headers
 }): Set<string> | undefined;
 /** Removal-frame header for the agent-type roster (single-sourced for renderer + replay parser). */
 export declare const AGENT_LISTING_REMOVED_HEADER = "The following agent types are no longer available:";
-/** CC-verbatim roster-drift header — same single-source rationale as {@link agentListingInitialHeader}. */
+/** CC-verbatim roster-drift header — same single-source rationale as {@link agentListingInitialHeader}.
+ *  The interpolated tool name is neutralized on both headers: a caller renames the delegation tool, so
+ *  the name is deployment text arriving on the marked-reminder lane like every other field here. */
 export declare function agentListingDeltaHeader(toolName: string): string;
 /**
  * G1 续批 — agent-type roster announce (CC 2.1.198 `agent_listing_delta`, bundle pretty.js:599199-599223,
@@ -745,11 +748,18 @@ export declare const MCP_INSTRUCTIONS_MAX_CHARS: number;
  * — fenced on the delta lane, RAW-INTERPOLATED (no fence, no bound) into the stable prompt. A single
  * source makes the divergence unrepresentable.
  *
- * Truncation is DISCLOSED (§25 honesty): `delimitUntrusted` clips silently with an ellipsis, which
- * reads to the model as the server's own text. The trailing note lives OUTSIDE the fence, on a
- * trusted line, so the model can tell "the server said less" from "we cut it". The over-length test
- * mirrors `delimitUntrusted`'s own internal condition exactly (both transforms are idempotent, so
- * re-running them here is a no-op and cannot drift from the clip actually applied).
+ * Truncation is DISCLOSED (§25 honesty): the fence clips silently with an ellipsis, which reads to the
+ * model as the server's own text. The trailing note lives OUTSIDE the fence, on a trusted line, so the
+ * model can tell "the server said less" from "we cut it".
+ *
+ * The clip verdict comes FROM the fence (`delimitUntrustedWithClip`), never from a length test
+ * re-derived here. The earlier shape did re-derive it — a local `sanitizeUntrustedText` pre-pass with
+ * the DEFAULT (reminder-only) tag set, measured against the cap — and that mirror silently stopped
+ * matching once the fence widened its neutralization to the whole authority-envelope family: each
+ * widened-family tag occurrence adds a ZWSP the pre-count never saw, so a server could land its text
+ * in the `(cap − N, cap]` window and get the body clipped with the honesty note withheld, N being its
+ * own choice of tag count. One measurement, taken where the cut happens, is the only shape that cannot
+ * drift.
  */
 export declare function fenceMcpServerInstructions(server: string, text: string): string;
 /**

package/dist/core/runner/turn-attachments.js

@@ -1,5 +1,5 @@
 import { PRESENT_PLAN_TOOL_NAME } from "../present-plan-tool.js";
-import { defuseFenceMarkers, delimitUntrusted, sanitizeUntrustedText } from "../untrusted-text.js";
+import { delimitUntrustedWithClip, sanitizeUntrustedText, SHELLED_BODY_ENVELOPE_TAGS } from "../untrusted-text.js";
 import { protocolOf } from "../protocol-table.js";
 import { buildSkillsBlock, skillListingLine } from "./synthetic-tools.js";
 import { TOOL_SEARCH_NAME as TOOL_SEARCH_TOOL_NAME } from "./tool-disclosure.js";
@@ -20,6 +20,11 @@ export const CHANGED_FILES_MTIME_EPS_MS = 2000;
 export const ATTACHMENT_BYTE_CAP = 8 * 1024;
 const PROJECTION_ITEMS_MAX = 50;
 const PROJECTION_CONTENT_MAX = 80;
+const ATTACHMENT_TAGS_DEFAULT = [...SHELLED_BODY_ENVELOPE_TAGS];
+const ATTACHMENT_TAGS_SKILLS_OWNER = SHELLED_BODY_ENVELOPE_TAGS.filter((t) => t !== "skills");
+export function attachmentEnvelopeTags(source) {
+    return source === "skills_listing" ? ATTACHMENT_TAGS_SKILLS_OWNER : ATTACHMENT_TAGS_DEFAULT;
+}
 export const INSTRUCTIONS_CHANGE_BYTE_CAP = 512;
 export function createAttachmentState() {
     return {
@@ -358,8 +363,9 @@ export function renderBudgetUsd(used, total) {
     return `USD budget: $${used}/$${total}; $${total - used} remaining`;
 }
 export function renderOrphanedBackgroundTasks(tasks) {
+    const safe = (t) => sanitizeUntrustedText(t, SHELLED_BODY_ENVELOPE_TAGS);
     return (`The container was restarted. The following background tasks were running and are now stopped:\n` +
-        tasks.map((t) => `- ${t.description || "(no description)"} (task ${t.id})`).join("\n") +
+        tasks.map((t) => `- ${safe(t.description || "(no description)")} (task ${safe(t.id)})`).join("\n") +
         `\nRe-create them if still needed.`);
 }
 function renderChangedFiles(paths) {
@@ -449,7 +455,7 @@ export const AGENT_TOOLS_NOTE_DEFAULT = "All tools";
 export const AGENT_CONCURRENCY_NOTE = "When you launch multiple agents for independent work, send them in a single message with multiple tool uses so they run concurrently.";
 export const AMBIENT_CONTEXT_NOTE = "This is ambient context — do not narrate it to the user unless they ask or it is directly relevant to their request.";
 export function agentListingInitialHeader(toolName) {
-    return `Available agent types for the ${toolName} tool:`;
+    return `Available agent types for the ${sanitizeUntrustedText(toolName, SHELLED_BODY_ENVELOPE_TAGS)} tool:`;
 }
 export function replayAnnouncedListing(texts, headers) {
     let announced;
@@ -492,13 +498,17 @@ export function replayAnnouncedListing(texts, headers) {
     return announced;
 }
 export const AGENT_LISTING_REMOVED_HEADER = "The following agent types are no longer available:";
+function listingIdentity(name) {
+    return sanitizeUntrustedText(name, SHELLED_BODY_ENVELOPE_TAGS);
+}
 export function agentListingDeltaHeader(toolName) {
-    return `New agent types are now available for the ${toolName} tool:`;
+    return `New agent types are now available for the ${sanitizeUntrustedText(toolName, SHELLED_BODY_ENVELOPE_TAGS)} tool:`;
 }
 export function renderAgentListingDelta(state, entries, toolName, models) {
+    const safe = (t) => sanitizeUntrustedText(t, SHELLED_BODY_ENVELOPE_TAGS);
     const line = (e) => {
-        const base = e.description ? `- ${e.name}: ${e.description}` : `- ${e.name}`;
-        return `${base} (Tools: ${e.tools ?? AGENT_TOOLS_NOTE_DEFAULT})`;
+        const base = e.description ? `- ${safe(e.name)}: ${safe(e.description)}` : `- ${safe(e.name)}`;
+        return `${base} (Tools: ${safe(e.tools ?? AGENT_TOOLS_NOTE_DEFAULT)})`;
     };
     const announced = state.announcedAgentTypes;
     if (announced === undefined) {
@@ -511,18 +521,22 @@ export function renderAgentListingDelta(state, entries, toolName, models) {
             blocks.push(modelsAvailableLine(models));
         return blocks.join("\n\n");
     }
-    const added = entries.filter((e) => !announced.has(e.name)).toSorted((a, b) => a.name.localeCompare(b.name));
-    const removed = [...announced.keys()].filter((n) => !entries.some((e) => e.name === n)).sort();
+    const announcedIds = new Set([...announced.keys()].map(listingIdentity));
+    const added = entries.filter((e) => !announcedIds.has(listingIdentity(e.name))).toSorted((a, b) => a.name.localeCompare(b.name));
+    const removed = [...announced.keys()]
+        .filter((n) => !entries.some((e) => listingIdentity(e.name) === listingIdentity(n)))
+        .sort();
     const modelsDrifted = state.announcedModels !== undefined &&
         models !== undefined &&
-        (state.announcedModels.length !== models.length || state.announcedModels.some((m, i) => m !== models[i]));
+        (state.announcedModels.length !== models.length ||
+            state.announcedModels.some((m, i) => listingIdentity(m) !== listingIdentity(models[i])));
     if (added.length === 0 && removed.length === 0 && !modelsDrifted)
         return undefined;
     const blocks = [];
     if (added.length > 0)
         blocks.push(`${agentListingDeltaHeader(toolName)}\n${added.map(line).join("\n")}`);
     if (removed.length > 0) {
-        blocks.push(`${AGENT_LISTING_REMOVED_HEADER}\n${removed.map((n) => `- ${n}`).join("\n")}`);
+        blocks.push(`${AGENT_LISTING_REMOVED_HEADER}\n${removed.map((n) => `- ${safe(n)}`).join("\n")}`);
         blocks.push(AMBIENT_CONTEXT_NOTE);
     }
     if (modelsDrifted)
@@ -531,7 +545,8 @@ export function renderAgentListingDelta(state, entries, toolName, models) {
 }
 export const MODELS_AVAILABLE_PREFIX = "Models available for the 'model' parameter: ";
 function modelsAvailableLine(models) {
-    return `${MODELS_AVAILABLE_PREFIX}${models.length > 0 ? models.join(", ") : "(none)"}`;
+    const named = models.map((m) => sanitizeUntrustedText(m, SHELLED_BODY_ENVELOPE_TAGS));
+    return `${MODELS_AVAILABLE_PREFIX}${named.length > 0 ? named.join(", ") : "(none)"}`;
 }
 export function replayAnnouncedModels(texts) {
     let last;
@@ -563,15 +578,16 @@ export function renderSkillsListingDelta(state, entries) {
             return undefined;
         return buildSkillsBlock(entries);
     }
-    const added = entries.filter((e) => !announced.has(e.name));
-    const removed = [...announced.keys()].filter((n) => !entries.some((e) => e.name === n));
+    const announcedIds = new Set([...announced.keys()].map(listingIdentity));
+    const added = entries.filter((e) => !announcedIds.has(listingIdentity(e.name)));
+    const removed = [...announced.keys()].filter((n) => !entries.some((e) => listingIdentity(e.name) === listingIdentity(n)));
     if (added.length === 0 && removed.length === 0)
         return undefined;
     const blocks = [];
     if (added.length > 0)
         blocks.push(`${SKILLS_LISTING_DELTA_HEADER}\n${added.map((e) => skillListingLine(e)).join("\n")}`);
     if (removed.length > 0) {
-        blocks.push(`${SKILLS_LISTING_REMOVED_HEADER}\n${removed.map((n) => `- ${n}`).join("\n")}`);
+        blocks.push(`${SKILLS_LISTING_REMOVED_HEADER}\n${removed.map((n) => `- ${sanitizeUntrustedText(n, SHELLED_BODY_ENVELOPE_TAGS)}`).join("\n")}`);
         blocks.push(AMBIENT_CONTEXT_NOTE);
     }
     return blocks.join("\n\n");
@@ -581,12 +597,10 @@ export function commitSkillsListing(state, entries) {
 }
 export const MCP_INSTRUCTIONS_MAX_CHARS = 8 * 1024;
 export function fenceMcpServerInstructions(server, text) {
-    const neutralized = defuseFenceMarkers(sanitizeUntrustedText(text));
-    const clipped = [...neutralized].length > MCP_INSTRUCTIONS_MAX_CHARS;
-    const fenced = delimitUntrusted(`MCP server "${server}" instructions`, neutralized, MCP_INSTRUCTIONS_MAX_CHARS);
-    return clipped
-        ? `${fenced}\n(Truncated by the agent runtime: this server's instructions exceeded ${MCP_INSTRUCTIONS_MAX_CHARS} characters.)`
-        : fenced;
+    const fence = delimitUntrustedWithClip(`MCP server "${server}" instructions`, text, MCP_INSTRUCTIONS_MAX_CHARS);
+    return fence.clipped
+        ? `${fence.text}\n(Truncated by the agent runtime: this server's instructions exceeded ${MCP_INSTRUCTIONS_MAX_CHARS} characters.)`
+        : fence.text;
 }
 export function renderMcpInstructionsDelta(added, removed) {
     const blocks = [];

package/dist/core/tool-policy.d.ts

@@ -383,6 +383,24 @@ export interface ToolPolicyProjection {
      */
     readonly requiresLiveRemainder: boolean;
 }
+/**
+ * The entries of a tool-NAME list whose reach is a set of names rather than one name — the MCP
+ * covering spellings (`mcp__<server>`, `mcp__<server>__<glob>`) that CC's rule matcher resolves and
+ * an exact-membership test silently cannot. Every name-keyed lane in this file consults these
+ * ALONGSIDE its exact set: a covering spelling can never equal a minted tool name (`*` is outside the
+ * minted charset and a minted name always carries a tool segment), so leaving it in the exact set too
+ * costs nothing and keeps the projection/audit faces reporting the operator's own spelling.
+ *
+ * The list is usually empty, which is why every call site tests it before scanning.
+ *
+ * Exported for the OTHER name-keyed lane in this engine — the persisted session/ancestor rules in
+ * `session-rule-policy.ts`. Not part of the public API (`src/index.ts` re-exports by name and does not
+ * list these): all four publishers of {@link ToolPolicyNameSets} must resolve a covering entry the same
+ * way, because the prepare-time audit's exemption for these spellings speaks for all of them at once.
+ */
+export declare function mcpCoveringEntries(entries: readonly string[] | undefined): readonly string[];
+/** Does any covering entry reach `toolName`? See {@link mcpCoveringEntries}. */
+export declare function mcpCoveringHit(covering: readonly string[], toolName: string): boolean;
 /**
  * Execute a persisted {@link ToolPolicyProjection} against a call (F-012 L1): returns the first
  * component's deny, or `undefined` when the projection has no opinion (it is deny-only by

package/dist/core/tool-policy.js

@@ -5,7 +5,7 @@ import { join, normalize as normalizePath, posix as posixPath, sep, win32 as win
 import { BASH_READONLY_DEFAULT_ALLOW, parseLeadingCommandName } from "../tools/fs/index.js";
 import { boundInputHashOf } from "./canonical-json.js";
 import { delimitUntrusted, inlineUntrusted, REVIEWER_NOTE_MAX_BODY } from "./untrusted-text.js";
-import { parsePermissionRule } from "./permission-rules.js";
+import { isMcpCoveringRuleName, mcpRuleNameCovers, parsePermissionRule } from "./permission-rules.js";
 import { isAbsolutePathForm, isWinFormPath, writeTargetPath } from "../tools/fs/safety.js";
 const DECISION_REASONS = ["rule", "mode", "hook", "safety", "classifier", "persisted_rule", "sandbox", "org_rule", "org_unavailable"];
 const DECISION_REASON_SET = new Set(DECISION_REASONS);
@@ -36,16 +36,22 @@ export const ASK_EVIDENCE_ABSENCE_VALUES = ["not_wired", "not_adjudicated", "una
 export function decisionText(d) {
     return d.message;
 }
+export function mcpCoveringEntries(entries) {
+    return (entries ?? []).filter(isMcpCoveringRuleName);
+}
+export function mcpCoveringHit(covering, toolName) {
+    return covering.length > 0 && covering.some((e) => mcpRuleNameCovers(e, toolName));
+}
 export function checkToolPolicyProjection(projection, req) {
     for (const c of projection.components) {
         if (c.kind === "tool_deny") {
-            if (c.names.includes(req.toolName)) {
+            if (c.names.includes(req.toolName) || mcpCoveringHit(mcpCoveringEntries(c.names), req.toolName)) {
                 return { action: "deny", message: `tool "${req.toolName}" is denied by a frozen inherited policy projection` };
             }
             continue;
         }
         if (c.kind === "tool_allowlist") {
-            if (!c.names.includes(req.toolName)) {
+            if (!c.names.includes(req.toolName) && !mcpCoveringHit(mcpCoveringEntries(c.names), req.toolName)) {
                 return { action: "deny", message: `tool "${req.toolName}" is not in a frozen inherited policy projection's allowlist` };
             }
             continue;
@@ -218,6 +224,8 @@ export function createAllowDenyPolicy(opts) {
     opts = { ...opts, ...(screenedAllow ? { allow: screenedAllow } : {}), ...(screenedDeny ? { deny: screenedDeny } : {}) };
     const allow = opts.allow ? new Set(opts.allow) : undefined;
     const deny = new Set(opts.deny ?? []);
+    const denyCovering = mcpCoveringEntries(opts.deny);
+    const allowCovering = mcpCoveringEntries(opts.allow);
     return {
         projection: {
             components: [
@@ -229,10 +237,10 @@ export function createAllowDenyPolicy(opts) {
         nameSets: [{ ...(opts.allow ? { allow: [...opts.allow] } : {}), ...(opts.deny ? { deny: [...opts.deny] } : {}) }],
         check(req) {
             const toolName = req.toolName;
-            if (deny.has(toolName)) {
+            if (deny.has(toolName) || mcpCoveringHit(denyCovering, toolName)) {
                 return { action: "deny", message: `tool "${req.toolName}" is denied by policy` };
             }
-            if (allow && !allow.has(toolName)) {
+            if (allow && !allow.has(toolName) && !mcpCoveringHit(allowCovering, toolName)) {
                 return { action: "deny", message: `tool "${req.toolName}" is not in the allowlist` };
             }
             return ALLOW;
@@ -249,6 +257,9 @@ export function createApprovalPolicy(opts) {
     const need = new Set(opts.requireApproval);
     const deny = new Set(opts.deny ?? []);
     const auto = new Set(opts.autoAllow ?? []);
+    const needCovering = mcpCoveringEntries(opts.requireApproval);
+    const denyCovering = mcpCoveringEntries(opts.deny);
+    const autoCovering = mcpCoveringEntries(opts.autoAllow);
     return {
         projection: {
             components: [
@@ -266,10 +277,10 @@ export function createApprovalPolicy(opts) {
         ],
         async check(req, signal) {
             const toolName = req.toolName;
-            if (deny.has(toolName)) {
+            if (deny.has(toolName) || mcpCoveringHit(denyCovering, toolName)) {
                 return { action: "deny", message: `tool "${req.toolName}" is denied by policy` };
             }
-            if (need.has(toolName)) {
+            if (need.has(toolName) || mcpCoveringHit(needCovering, toolName)) {
                 if (signal?.aborted) {
                     return withCoreMintedResolution({ action: "deny", message: `approval aborted for "${req.toolName}" (task ended)`, settledBy: "aborted" }, "task_aborted", req);
                 }
@@ -303,7 +314,7 @@ export function createApprovalPolicy(opts) {
                 }
                 return withCoreMintedResolution({ action: "deny", message: `approval denied for "${req.toolName}"`, settledBy: "human" }, "human_refused", req);
             }
-            if (opts.denyByDefault && !auto.has(toolName)) {
+            if (opts.denyByDefault && !auto.has(toolName) && !mcpCoveringHit(autoCovering, toolName)) {
                 return { action: "deny", message: `tool "${req.toolName}" requires explicit allow` };
             }
             return ALLOW;