@sema-agent/core 5.55.0 → 5.56.0

package/dist/core/hooks.js

@@ -6,6 +6,92 @@ import { PROBE_REASON_MAX, normalizeProbeCause } from "./checkpoint-store.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "./ask-question.js";
 import { createSafeNotifier } from "./safe-notify.js";
 import { ORG_ADJUDICATION_TIMEOUT_MS, ORG_RULE_DECISION_REASON, ORG_UNAVAILABLE_DECISION_REASON, settleOrgVerdictWithin } from "./permission-rule-org.js";
+export const DEFAULT_HOOK_TIMEOUT_MS = 600_000;
+const MAX_HOOK_TIMEOUT_MS = 2_147_483_647;
+const POST_ABORT_GRACE_MS = 1_000;
+export function postAbortGraceMs(remainingMs) {
+    return Math.max(0, Math.min(POST_ABORT_GRACE_MS, remainingMs));
+}
+const badHookTimeoutReported = new WeakSet();
+export function resolveHookTimeoutMs(supplied, report, owner) {
+    if (supplied === undefined)
+        return DEFAULT_HOOK_TIMEOUT_MS;
+    if (Number.isFinite(supplied) && supplied >= 0 && supplied <= MAX_HOOK_TIMEOUT_MS)
+        return supplied;
+    if (report !== undefined && !(owner !== undefined && badHookTimeoutReported.has(owner))) {
+        if (owner !== undefined)
+            badHookTimeoutReported.add(owner);
+        try {
+            report(new Error(`Hooks.timeoutMs must be a non-negative finite number no greater than ${MAX_HOOK_TIMEOUT_MS} (got ${String(supplied)}) — ` +
+                `every hook seat falls back to the ${DEFAULT_HOOK_TIMEOUT_MS}ms default`));
+        }
+        catch {
+        }
+    }
+    return DEFAULT_HOOK_TIMEOUT_MS;
+}
+export async function runHookSeat(seat, bound, call) {
+    void seat;
+    const timeoutMs = resolveHookTimeoutMs(bound.timeoutMs, bound.onBadTimeout, bound.owner);
+    const taskSignal = bound.signal;
+    const controller = new AbortController();
+    const pending = Promise.resolve(call(controller.signal));
+    const startedAt = performance.now();
+    return await new Promise((resolve, reject) => {
+        let settled = false;
+        let listening = false;
+        let timer;
+        const clearTimer = () => {
+            if (timer !== undefined)
+                clearTimeout(timer);
+            timer = undefined;
+        };
+        const finish = (act) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimer();
+            if (listening)
+                taskSignal?.removeEventListener("abort", onAbort);
+            act();
+        };
+        const expire = (cause) => finish(() => {
+            void pending.then(undefined, () => {
+            });
+            resolve({ expired: true, cause });
+            queueMicrotask(() => {
+                try {
+                    controller.abort();
+                }
+                catch {
+                }
+            });
+        });
+        const collapseToGrace = () => {
+            if (settled)
+                return;
+            clearTimer();
+            timer = setTimeout(() => expire("aborted"), postAbortGraceMs(timeoutMs - (performance.now() - startedAt)));
+        };
+        const onAbort = () => (bound.abortEnds === true ? expire("aborted") : collapseToGrace());
+        timer = setTimeout(() => expire("timeout"), timeoutMs);
+        if (taskSignal !== undefined) {
+            if (taskSignal.aborted) {
+                onAbort();
+            }
+            else {
+                taskSignal.addEventListener("abort", onAbort, { once: true });
+                listening = true;
+            }
+        }
+        pending.then((value) => finish(() => resolve({ expired: false, value })), (err) => finish(() => reject(err instanceof Error ? err : new Error(String(err)))));
+    });
+}
+export function hookSeatExpiredError(seat, timeoutMs, cause, consequence) {
+    return new Error(cause === "timeout"
+        ? `the deployment's ${seat} hook did not answer within its ${timeoutMs}ms bound (Hooks.timeoutMs) — ${consequence}`
+        : `the deployment's ${seat} hook had not answered when the task was cancelled — ${consequence}`);
+}
 export function cloneObserverInput(input) {
     try {
         return structuredClone(input);
@@ -202,17 +288,35 @@ function preToolUseCrashReason(subject, err) {
         `This is a failure of the deployment's hook, NOT of the tool itself — an identical retry reaches the ` +
         `same hook and fails the same way. Hook error: ${cause || "(no message)"}`);
 }
+function preToolUseUnansweredReason(subject, timeoutMs, cause) {
+    return cause === "timeout"
+        ? `a PreToolUse hook did not answer within its ${timeoutMs}ms bound while screening ${subject}; the call was ` +
+            `NOT executed (fail-closed). This is a failure of the deployment's hook, NOT of the tool itself — the ` +
+            `screening face never returned a verdict, so nothing was decided about this call either way.`
+        : `the task was cancelled while a PreToolUse hook was still screening ${subject}; the call was NOT executed ` +
+            `(fail-closed). No verdict was reached — this is the run ending, not the tool failing.`;
+}
 function screenPreToolUseResult(r) {
     if (r === undefined)
         return undefined;
     return refuseOutOfContractDecision(r, { reasonIsNonInput: true });
 }
-export function createPreToolUseConstraintPolicy(preToolUse, env, onCrash) {
+export function createPreToolUseConstraintPolicy(preToolUse, env, onCrash, timeoutMs) {
     return brandPolicyAskClass({
         check: async (req) => {
             let r;
+            const boundMs = resolveHookTimeoutMs(timeoutMs, onCrash);
             try {
-                r = screenPreToolUseResult(await preToolUse(req.toolName, req.args, { toolCallId: req.toolCallId, toolName: req.toolName, ...(env !== undefined ? { env } : {}) }));
+                const seat = await runHookSeat("preToolUse", { timeoutMs: boundMs }, (sig) => preToolUse(req.toolName, req.args, { toolCallId: req.toolCallId, toolName: req.toolName, signal: sig, ...(env !== undefined ? { env } : {}) }));
+                if (seat.expired) {
+                    try {
+                        onCrash?.(hookSeatExpiredError("preToolUse", boundMs, seat.cause, `the inherited screening of "${req.toolName}" was refused fail-closed`));
+                    }
+                    catch {
+                    }
+                    return { action: "deny", message: preToolUseUnansweredReason(`this call to "${req.toolName}"`, boundMs, seat.cause), decisionReason: "hook" };
+                }
+                r = screenPreToolUseResult(seat.value);
             }
             catch (err) {
                 try {
@@ -284,9 +388,14 @@ export function persistedRuleMandateOf(marks) {
 export async function runToolGate(input) {
     const { event, preToolUse, adjudicate, resolveAsk, suspendAsk } = input;
     const { toolCallId, toolName } = event;
-    const hookCtx = () => ({
+    const hookCtx = (seatSignal) => ({
         toolCallId,
         toolName,
+        ...(seatSignal !== undefined ? { signal: seatSignal } : {}),
+        ...(() => {
+            const c = input.trackedCwd?.();
+            return typeof c === "string" ? { cwd: c } : {};
+        })(),
         ...(input.hookEnv !== undefined ? { env: input.hookEnv } : {}),
         ...(input.identity !== undefined ? { identity: input.identity } : {}),
     });
@@ -296,17 +405,47 @@ export async function runToolGate(input) {
     let parkFailed;
     let askDenyResolution;
     const notifier = createSafeNotifier(input.onNotifyError !== undefined ? { onError: input.onNotifyError } : undefined);
+    const hookSeatMs = resolveHookTimeoutMs(input.hookTimeoutMs, (err) => traceHookCrash(input, err, notifier));
+    const seatBound = (abortEnds) => ({
+        timeoutMs: hookSeatMs,
+        ...(input.abortSignal !== undefined ? { signal: input.abortSignal } : {}),
+        ...(abortEnds ? { abortEnds: true } : {}),
+    });
+    const preToolUseUnansweredBlock = async (subject, cause) => {
+        const reason = preToolUseUnansweredReason(subject, hookSeatMs, cause);
+        if (cause === "timeout") {
+            traceHookCrash(input, hookSeatExpiredError("preToolUse", hookSeatMs, cause, `${subject} was NOT executed (fail-closed) and the screening face was signalled to stop`), notifier);
+        }
+        return reason;
+    };
+    const notifyPermissionDeniedSeat = async (payload) => {
+        if (input.permissionDenied === undefined)
+            return;
+        await notifier.notifyAsync(async () => {
+            const seat = await runHookSeat("permissionDenied", seatBound(false), (sig) => input.permissionDenied?.({ ...payload, signal: sig }));
+            if (seat.expired)
+                throw hookSeatExpiredError("permissionDenied", hookSeatMs, seat.cause, "the deny observation was abandoned; the deny itself is unchanged");
+        }, "toolGate.permissionDenied");
+    };
     if (preToolUse) {
         let r;
+        let unanswered;
         try {
-            r = screenPreToolUseResult(await preToolUse(toolName, currentInput, hookCtx()));
+            const seat = await runHookSeat("preToolUse", seatBound(true), (sig) => preToolUse(toolName, currentInput, hookCtx(sig)));
+            if (seat.expired)
+                unanswered = seat.cause;
+            else
+                r = screenPreToolUseResult(seat.value);
         }
         catch (err) {
             const reason = preToolUseCrashReason(`this call to "${toolName}"`, err);
             traceHookCrash(input, err, notifier);
-            if (input.permissionDenied) {
-                await notifier.notifyAsync(() => input.permissionDenied?.({ toolName, input: cloneObserverInput(currentInput), toolCallId, reason, source: "hook", ...(input.identity !== undefined ? { identity: input.identity } : {}) }), "toolGate.permissionDenied");
-            }
+            await notifyPermissionDeniedSeat({ toolName, input: cloneObserverInput(currentInput), toolCallId, reason, source: "hook", ...(input.identity !== undefined ? { identity: input.identity } : {}) });
+            return { block: true, reason: formatHookFeedback(reason, input.reminderMark), preToolContext };
+        }
+        if (unanswered !== undefined) {
+            const reason = await preToolUseUnansweredBlock(`this call to "${toolName}"`, unanswered);
+            await notifyPermissionDeniedSeat({ toolName, input: cloneObserverInput(currentInput), toolCallId, reason, source: "hook", ...(input.identity !== undefined ? { identity: input.identity } : {}) });
             return { block: true, reason: formatHookFeedback(reason, input.reminderMark), preToolContext };
         }
         if (r) {
@@ -714,8 +853,13 @@ export async function runToolGate(input) {
                     }
                     if (preToolUse) {
                         let hr;
+                        let hrUnanswered;
                         try {
-                            hr = screenPreToolUseResult(await preToolUse(toolName, editArgs, hookCtx()));
+                            const seat = await runHookSeat("preToolUse", seatBound(true), (sig) => preToolUse(toolName, editArgs, hookCtx(sig)));
+                            if (seat.expired)
+                                hrUnanswered = seat.cause;
+                            else
+                                hr = screenPreToolUseResult(seat.value);
                         }
                         catch (err) {
                             traceHookCrash(input, err, notifier);
@@ -723,6 +867,11 @@ export async function runToolGate(input) {
                             denySource = "hook";
                             break;
                         }
+                        if (hrUnanswered !== undefined) {
+                            editDenied = { action: "deny", message: await preToolUseUnansweredBlock(`the approved edit for "${toolName}"`, hrUnanswered) };
+                            denySource = "hook";
+                            break;
+                        }
                         if (hr) {
                             if (hr.additionalContext)
                                 preToolContext.push(hr.additionalContext);
@@ -828,9 +977,7 @@ export async function runToolGate(input) {
             currentInput = decision.updatedInput;
         }
         const denyResolution = askDenyResolution ?? coreMintedResolutionOf(decision, { toolCallId, toolName });
-        if (input.permissionDenied) {
-            await notifier.notifyAsync(() => input.permissionDenied?.({ toolName, input: cloneObserverInput(currentInput), toolCallId, reason: denyReason, source: denySource, ...(denyResolution !== undefined ? { resolution: denyResolution } : {}), ...(input.identity !== undefined ? { identity: input.identity } : {}) }), "toolGate.permissionDenied");
-        }
+        await notifyPermissionDeniedSeat({ toolName, input: cloneObserverInput(currentInput), toolCallId, reason: denyReason, source: denySource, ...(denyResolution !== undefined ? { resolution: denyResolution } : {}), ...(input.identity !== undefined ? { identity: input.identity } : {}) });
         const denySettledBy = decision.settledBy;
         const denyApprover = denySettledBy !== undefined ? resolvedApprover : undefined;
         return {

package/dist/core/human-input-projection.d.ts

@@ -4,8 +4,13 @@
  * One renderer covers every human-input carrier: the core-side five (objective / live steer /
  * nextTurn / the resume tail's parked-steer frames / the wake message) and a serving layer's own
  * carriers through the same contract. The division of labor is fixed (ruled 2026-08-05): the INGRESS
- * sanitizes text and mints the {@link ActorAssertion}; this module only PROJECTS — it renders the
- * speaker label ahead of the text, and it never sanitizes, truncates, or rewrites the text itself.
+ * sanitizes text and mints the {@link ActorAssertion}; `projectHumanInput` only PROJECTS — it renders
+ * the speaker label ahead of the text, and it never sanitizes, truncates, or rewrites the text itself.
+ *
+ * The module also owns the DELIVERY frame that tells the model where a human frame arrived
+ * ({@link frameMidTurnUserInput}, backlog #389). That is a separate concern from attribution and runs
+ * AFTER projection (the speaker label belongs to the text; the delivery frame belongs around it) — it is
+ * housed here so every model-facing wrapper for human input has one home.
  *
  * Envelope contract:
  *  - no `actor` ⇒ BYTE-IDENTICAL passthrough. Every pre-171 caller and every single-user host
@@ -35,6 +40,19 @@ export interface HumanInputFrame {
     actor?: ActorAssertion;
     source: HumanInputSource;
 }
+/**
+ * backlog #389 伴生 (V-3 of the steer/interrupt/lifecycle anchor audit) — wrap ONE live caller steer in
+ * the mid-turn delivery frame.
+ *
+ * Scope, deliberately: the UNTRUSTED caller lane only. A `trusted` steer already rides a
+ * `<system-reminder>` (supervisor authority, CC's own non-user-source framing), and a delegated child's
+ * operator steer carries its own explicit operator frame — the bare lane was exactly the most-travelled
+ * one: a person typing while the run works.
+ *
+ * Static strings (no per-call interpolation), and a blank projection is returned VERBATIM so the
+ * harness's empty-injection no-op stays a no-op — a frame must never materialize from nothing.
+ */
+export declare function frameMidTurnUserInput(projected: string): string;
 /**
  * Render the speaker envelope for one human-input frame. Pure; see the module contract above.
  * Call BEFORE any trust framing (`formatHookFeedback` / `delimitUntrusted`) so the label stays

package/dist/core/human-input-projection.js

@@ -2,6 +2,15 @@ import { snapshotActorAssertion } from "../internal/llm.js";
 import { uuidv7 } from "../internal/harness.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 import { attrEscape, EXTERNAL_SOURCE_MAX } from "./task-notification.js";
+const MID_TURN_USER_INPUT_HEAD = "The user sent a new message while you were working:\n";
+const MID_TURN_USER_INPUT_TAIL = "\n\nThis is how a message sent mid-turn is surfaced: within the turn that is still running, often " +
+    "alongside the next tool result, rather than as a separate conversation turn. Address the message " +
+    "above as you continue this turn.";
+export function frameMidTurnUserInput(projected) {
+    if (projected.trim().length === 0)
+        return projected;
+    return `${MID_TURN_USER_INPUT_HEAD}${projected}${MID_TURN_USER_INPUT_TAIL}`;
+}
 export function projectHumanInput(frame) {
     if (frame.actor === undefined || frame.source === "system")
         return frame.text;

package/dist/core/permission-rules.d.ts

@@ -46,6 +46,13 @@ export interface PermissionRuleIssue {
     /** design/179 D7: a Bash prefix rule under `bashPrefixLane:"rules-store"` — reported so a migration
      *  report can tell "route this through the rule store" apart from "this is a mistake". */
      | "unsupported.bash_prefix_rules_store" | "unsupported.file_glob" | "unsupported.mcp_paren"
+    /** A parenthesised rule whose NAME is a covering spelling in a non-MCP protocol namespace
+     *  (`a2a__<peer>__*(x:y)`, `a2a__<peer>(x:y)`). The param DSL is keyed by EXACT tool name, and a
+     *  covering spelling is not one — no mounted tool can ever bear it, so the rule compiled clean and
+     *  matched nothing. Additive member; the MCP spelling keeps its own {@link
+     *  PermissionRuleIssue.code} `unsupported.mcp_paren` (that refusal is wider — it covers exact MCP
+     *  names too, for CC parity — and fires first, so no MCP rule's reported code changes). */
+     | "unsupported.covering_paren"
     /** HRD-PRM-7: a param-level rule naming a parameter the target tool does not carry. Additive member —
      *  the lane that used to compile silently and never match (see {@link FILE_TOOL_PARAMS}). */
      | "unsupported.unknown_param";
@@ -105,27 +112,28 @@ export declare function parsePermissionRule(rule: string): ParsedPermissionRule;
  */
 export declare function wildcardMatch(pattern: string, value: string): boolean;
 /**
- * Does an MCP-namespaced RULE name cover `toolName`? — the tail branch of CC's rule matcher `VRp`
+ * Does a namespaced RULE name cover `toolName`? — the tail branch of CC's rule matcher `VRp`
  * (:595780), which is UNCONDITIONAL there (its `globMatching` option gates only the whole-name glob
  * branch, so CC's allow lane — `mVo` :595803, which passes no options — matches MCP segments too).
- * Three covering forms, matching CC's three disjuncts:
- *   · `mcp__<server>`           — every tool of that server (rule tool segment absent);
- *   · `mcp__<server>__*`        — the same set, spelled with the star CC's own settings validator
- *                                 recommends (`"MCP rules do not support patterns in parentheses …
- *                                 use mcp__srv__*"`);
- *   · `mcp__<server>__get_*`    — a glob over the tool segment.
+ * Three covering forms, matching CC's three disjuncts (`<ns>` = any protocol-table prefix):
+ *   · `<ns>__<peer>`           — every tool of that peer (rule tool segment absent);
+ *   · `<ns>__<peer>__*`        — the same set, spelled with the star CC's own settings validator
+ *                                recommends (`"MCP rules do not support patterns in parentheses …
+ *                                use mcp__srv__*"`);
+ *   · `<ns>__<peer>__get_*`    — a glob over the tool segment.
  * A LITERAL tool segment is deliberately NOT covered here: it is an exact tool name, and the exact
  * table already answers it — the same split CC makes with its leading `ruleName === toolName`.
  *
- * Server segments compare EXACTLY (CC `s.serverName === a.serverName`). A rule must therefore spell
- * the server the way the mint does; that is the same string an operator reads off any mounted tool
- * name, and inventing a fuzzier comparison here would let one rule reach a server it does not name.
+ * Rule and target must be in the SAME namespace, and peer segments compare EXACTLY (CC
+ * `s.serverName === a.serverName`). A rule must therefore spell the peer the way the mint does; that
+ * is the same string an operator reads off any mounted tool name, and inventing a fuzzier comparison
+ * here would let one rule reach a peer — or a protocol — it does not name.
  */
-export declare function mcpRuleNameCovers(ruleName: string, toolName: string): boolean;
-/** True ⇔ this rule name is an MCP name whose reach is a SET of tools rather than one exact tool —
- *  i.e. the shapes {@link mcpRuleNameCovers} answers and an exact name table cannot. Every lane that
- *  keys rules by exact tool name needs this to know which of its entries it must NOT key that way. */
-export declare function isMcpCoveringRuleName(name: string): boolean;
+export declare function namespacedRuleNameCovers(ruleName: string, toolName: string): boolean;
+/** True ⇔ this rule name is a namespaced name whose reach is a SET of tools rather than one exact tool
+ *  — i.e. the shapes {@link namespacedRuleNameCovers} answers and an exact name table cannot. Every
+ *  lane that keys rules by exact tool name needs this to know which entries it must NOT key that way. */
+export declare function isNamespacedCoveringRuleName(name: string): boolean;
 /** Exported for the lockstep guard only (see {@link FILE_TOOL_PARAMS}) — not part of the rule DSL. */
 export declare const fileToolParamVocabulary: (canonicalTool: string) => ReadonlySet<string> | undefined;
 /** Dry-run 校验/迁移报告(codex 127 审 B5):不 throw,返回全部 issues(含 `unsupported.*` 分类,

package/dist/core/permission-rules.js

@@ -1,4 +1,4 @@
-import { MCP_NAMESPACE } from "./protocol-table.js";
+import { MCP_NAMESPACE, protocolOf } from "./protocol-table.js";
 export const BASH_GENERIC_PARAMS = new Set(["command", "timeout", "description", "run_in_background"]);
 const DEFAULT_CAPS = {
     maxRules: 256,
@@ -77,31 +77,34 @@ export function wildcardMatch(pattern, value) {
         p++;
     return p === pattern.length;
 }
-function parseMcpRuleName(name) {
-    if (!name.startsWith(MCP_NAMESPACE.prefix))
+function parseNamespacedRuleName(name) {
+    const ns = protocolOf(name);
+    if (ns === undefined)
         return undefined;
-    const segments = name.slice(MCP_NAMESPACE.prefix.length).split("__");
-    const server = segments[0];
-    if (server === undefined || server === "")
+    const segments = name.slice(ns.prefix.length).split("__");
+    const peer = segments[0];
+    if (peer === undefined || peer === "")
         return undefined;
     const rest = segments.slice(1);
-    return rest.length > 0 ? { server, tool: rest.join("__") } : { server };
+    return rest.length > 0 ? { protocol: ns.id, peer, tool: rest.join("__") } : { protocol: ns.id, peer };
 }
-export function mcpRuleNameCovers(ruleName, toolName) {
-    const rule = parseMcpRuleName(ruleName);
+export function namespacedRuleNameCovers(ruleName, toolName) {
+    const rule = parseNamespacedRuleName(ruleName);
     if (rule === undefined)
         return false;
-    const target = parseMcpRuleName(toolName);
+    const target = parseNamespacedRuleName(toolName);
     if (target === undefined)
         return false;
-    if (rule.server !== target.server)
+    if (rule.protocol !== target.protocol)
+        return false;
+    if (rule.peer !== target.peer)
         return false;
     if (rule.tool === undefined || rule.tool === "*")
         return true;
     return target.tool !== undefined && rule.tool.includes("*") && wildcardMatch(rule.tool, target.tool);
 }
-export function isMcpCoveringRuleName(name) {
-    const parsed = parseMcpRuleName(name);
+export function isNamespacedCoveringRuleName(name) {
+    const parsed = parseNamespacedRuleName(name);
     return parsed !== undefined && (parsed.tool === undefined || parsed.tool.includes("*"));
 }
 const PRIMARY_FIELDS = {
@@ -138,13 +141,13 @@ function countStars(s) {
 }
 function compile(rules, caps, primaryFieldGeneric, bashPrefixLane = "reject") {
     const byTool = new Map();
-    const mcpCovering = { deny: [], ask: [], allow: [] };
+    const namespacedCovering = { deny: [], ask: [], allow: [] };
     const issues = [];
     const bad = (rule, code, message) => {
         issues.push({ rule, code, message });
     };
     if (rules.length > caps.maxRules) {
-        return { byTool, mcpCovering, issues: [{ rule: "", code: "invalid.cap_exceeded", message: `${rules.length} rules > maxRules ${caps.maxRules}` }] };
+        return { byTool, namespacedCovering, issues: [{ rule: "", code: "invalid.cap_exceeded", message: `${rules.length} rules > maxRules ${caps.maxRules}` }] };
     }
     for (const r of rules) {
         const text = r.rule;
@@ -171,14 +174,20 @@ function compile(rules, caps, primaryFieldGeneric, bashPrefixLane = "reject") {
             }
         }
         const toolName = parsed.toolName;
-        if (toolName.startsWith(MCP_NAMESPACE.prefix) && (parsed.ruleContent !== undefined || indexOfUnescaped(text, "(") !== -1)) {
+        const parenthesised = parsed.ruleContent !== undefined || indexOfUnescaped(text, "(") !== -1;
+        if (toolName.startsWith(MCP_NAMESPACE.prefix) && parenthesised) {
             bad(text, "unsupported.mcp_paren", "MCP rules do not support patterns in parentheses (CC parity); use the toolAxes system");
             continue;
         }
+        if (parenthesised && isNamespacedCoveringRuleName(toolName)) {
+            bad(text, "unsupported.covering_paren", `"${toolName}" reaches a SET of tools, and the generic param DSL is keyed by exact tool name — a parenthesised rule on it can never match. ` +
+                `Write the parenthesised rule against one exact tool name, or drop the parentheses to keep the covering rule.`);
+            continue;
+        }
         const entry = byTool.get(toolName) ?? { bare: {}, param: { deny: [], ask: [] } };
         if (parsed.ruleContent === undefined) {
-            if (isMcpCoveringRuleName(toolName)) {
-                mcpCovering[r.behavior].push({ ruleName: toolName, ruleText: text, ...(r.source !== undefined ? { source: r.source } : {}) });
+            if (isNamespacedCoveringRuleName(toolName)) {
+                namespacedCovering[r.behavior].push({ ruleName: toolName, ruleText: text, ...(r.source !== undefined ? { source: r.source } : {}) });
                 continue;
             }
             entry.bare[r.behavior] = { ruleText: text, source: r.source };
@@ -238,7 +247,7 @@ function compile(rules, caps, primaryFieldGeneric, bashPrefixLane = "reject") {
         entry.param[r.behavior].push({ param, pattern, behavior: r.behavior, ruleText: text, source: r.source });
         byTool.set(toolName, entry);
     }
-    return { byTool, mcpCovering, issues };
+    return { byTool, namespacedCovering, issues };
 }
 export function validatePermissionRules(rules, opts) {
     const caps = { ...DEFAULT_CAPS, ...opts?.caps };
@@ -272,7 +281,7 @@ function ruleMessage(kind, ruleText, source) {
 }
 export function createPermissionRulePolicy(rules, opts) {
     const caps = { ...DEFAULT_CAPS, ...opts?.caps };
-    const { byTool, mcpCovering, issues } = compile(rules, caps, opts?.primaryFieldGeneric ?? "reject", opts?.bashPrefixLane ?? "reject");
+    const { byTool, namespacedCovering, issues } = compile(rules, caps, opts?.primaryFieldGeneric ?? "reject", opts?.bashPrefixLane ?? "reject");
     const setLevelCap = issues.some((i) => i.code === "invalid.cap_exceeded" && i.rule === "");
     if (issues.length > 0 && ((opts?.onInvalidRule ?? "throw") === "throw" || setLevelCap)) {
         const e = new Error(`createPermissionRulePolicy: ${issues.length} invalid/unsupported rule(s):\n` +
@@ -307,23 +316,23 @@ export function createPermissionRulePolicy(rules, opts) {
             nameSets.allow.push(toolName);
     }
     for (const behavior of ["deny", "ask", "allow"]) {
-        for (const r of mcpCovering[behavior])
+        for (const r of namespacedCovering[behavior])
             nameSets[behavior].push(r.ruleName);
     }
-    const coveringHit = (lane, toolName) => lane.length === 0 ? undefined : lane.find((r) => mcpRuleNameCovers(r.ruleName, toolName));
-    const hasCovering = mcpCovering.deny.length > 0 || mcpCovering.ask.length > 0 || mcpCovering.allow.length > 0;
+    const coveringHit = (lane, toolName) => lane.length === 0 ? undefined : lane.find((r) => namespacedRuleNameCovers(r.ruleName, toolName));
+    const hasCovering = namespacedCovering.deny.length > 0 || namespacedCovering.ask.length > 0 || namespacedCovering.allow.length > 0;
     return {
         nameSets: [nameSets],
         check(req) {
             const entry = byTool.get(req.toolName);
-            const covering = hasCovering && req.toolName.startsWith(MCP_NAMESPACE.prefix);
+            const covering = hasCovering && protocolOf(req.toolName) !== undefined;
             if (entry?.bare.deny) {
                 return { action: "deny", message: ruleMessage("denied", entry.bare.deny.ruleText, entry.bare.deny.source) };
             }
             if (covering) {
-                const mcpDeny = coveringHit(mcpCovering.deny, req.toolName);
-                if (mcpDeny)
-                    return { action: "deny", message: ruleMessage("denied", mcpDeny.ruleText, mcpDeny.source) };
+                const coveringDeny = coveringHit(namespacedCovering.deny, req.toolName);
+                if (coveringDeny)
+                    return { action: "deny", message: ruleMessage("denied", coveringDeny.ruleText, coveringDeny.source) };
             }
             if (entry) {
                 const paramDeny = matchParamRules(entry.param.deny, req.args, caps.maxScalarValueChars);
@@ -335,9 +344,9 @@ export function createPermissionRulePolicy(rules, opts) {
                 }
             }
             if (covering) {
-                const mcpAsk = coveringHit(mcpCovering.ask, req.toolName);
-                if (mcpAsk)
-                    return { action: "ask", message: ruleMessage("flagged", mcpAsk.ruleText, mcpAsk.source), matchedAskRule: mcpAsk.ruleText };
+                const coveringAsk = coveringHit(namespacedCovering.ask, req.toolName);
+                if (coveringAsk)
+                    return { action: "ask", message: ruleMessage("flagged", coveringAsk.ruleText, coveringAsk.source), matchedAskRule: coveringAsk.ruleText };
             }
             if (entry) {
                 const paramAsk = matchParamRules(entry.param.ask, req.args, caps.maxScalarValueChars);
@@ -348,7 +357,7 @@ export function createPermissionRulePolicy(rules, opts) {
                     return { action: "allow" };
                 }
             }
-            if (covering && coveringHit(mcpCovering.allow, req.toolName)) {
+            if (covering && coveringHit(namespacedCovering.allow, req.toolName)) {
                 return { action: "allow" };
             }
             if (defaultAction === "allow")

package/dist/core/runner/prepare-task.d.ts

@@ -314,6 +314,14 @@ export interface Prepared {
      * leg always knows its identity.
      */
     hookIdentity: HookInvocationIdentity;
+    /**
+     * The per-invocation TIME BOUND every hook seat of this leg runs under (`Hooks.timeoutMs`, already
+     * validated — a garbage value was refused to the default and disclosed ONCE, here, rather than on
+     * every tool call). Published for the same reason `hookIdentity` is: the seats live in two files, and
+     * a number each station re-derived would be two answers to one wiring question — including two
+     * chances to re-refuse the same bad value.
+     */
+    hookTimeoutMs: number;
     promptManifest: {
         constitution: "core" | "replaced" | "provider-assembled";
         blocks: Array<{