@sema-agent/core 5.55.0 → 5.57.0

package/dist/core/permission-rule-model.js

@@ -20,26 +20,12 @@ export const SHELL_RESERVED_WORDS = new Set([
     "function", "if", "in", "select", "then", "time", "until", "while",
 ]);
 export const SUGGESTION_LEXICON = [
-    "git status", "git log", "git diff", "git show", "git branch", "git checkout", "git switch",
-    "git add", "git commit", "git push", "git pull", "git fetch", "git merge", "git rebase",
-    "git tag", "git blame", "git describe", "git cherry-pick", "git restore", "git reset",
-    "git rev-parse", "git ls-files", "git grep",
     "git stash list", "git stash show", "git stash push", "git stash pop", "git stash drop",
     "git remote show", "git worktree list", "git submodule update", "git submodule status",
-    "npm run", "npm test", "npm ci", "npm ls", "npm view", "npm outdated", "npm audit",
-    "npm pack", "npm publish", "npm version", "npm why",
-    "pnpm run", "pnpm test", "pnpm ls", "pnpm outdated", "pnpm audit", "pnpm why",
-    "yarn run", "yarn test", "yarn workspaces list",
-    "cargo build", "cargo test", "cargo run", "cargo check", "cargo clippy", "cargo fmt",
-    "cargo doc", "cargo tree", "cargo bench", "cargo update", "cargo metadata",
-    "go build", "go test", "go vet", "go fmt", "go doc",
+    "yarn workspaces list",
     "go mod tidy", "go mod download", "go mod verify", "go mod graph",
-    "docker ps", "docker images", "docker logs", "docker inspect", "docker build", "docker pull",
-    "docker push", "docker stop", "docker start", "docker restart", "docker rm", "docker rmi",
     "docker compose up", "docker compose down", "docker compose ps", "docker compose logs",
     "docker compose build", "docker compose pull",
-    "kubectl get", "kubectl describe", "kubectl logs", "kubectl apply", "kubectl delete",
-    "kubectl diff", "kubectl explain", "kubectl top",
     "kubectl rollout status", "kubectl rollout restart", "kubectl rollout history",
     "gh pr view", "gh pr list", "gh pr diff", "gh pr checks", "gh pr status", "gh pr create",
     "gh pr merge", "gh issue view", "gh issue list", "gh issue create", "gh repo view",
@@ -48,6 +34,31 @@ export const SUGGESTION_LEXICON = [
     "gh search repos", "gh search issues", "gh search prs", "gh search code",
 ];
 const LEXICON_BODIES = SUGGESTION_LEXICON.map((b) => b.split(" "));
+const GENERIC_SUBCOMMAND_WORD = /^[a-z][a-z0-9]*(-[a-z0-9]+)*$/;
+const SCREENED_HEAD_NAMES = new Set([...BARE_INTERPRETER_NAMES].map((n) => n.toLowerCase()));
+const TRAILING_DOTS = /\.+$/;
+const EXECUTABLE_SUFFIX = /\.(?:exe|com|bat|cmd)$/;
+const PROPOSABLE_HEAD_NAME = /^[A-Za-z0-9._+-]+$/;
+function screenedHeadName(head) {
+    let name = commandBasename(head).toLowerCase();
+    for (;;) {
+        const peeled = name.replace(TRAILING_DOTS, "").replace(EXECUTABLE_SUFFIX, "");
+        if (peeled === name || peeled === "")
+            return name;
+        name = peeled;
+    }
+}
+function genericPrefixBody(tokens) {
+    const head = tokens[0];
+    const second = tokens[1];
+    if (head === undefined || second === undefined)
+        return undefined;
+    if (!PROPOSABLE_HEAD_NAME.test(commandBasename(head)))
+        return undefined;
+    if (SCREENED_HEAD_NAMES.has(screenedHeadName(head)))
+        return undefined;
+    return GENERIC_SUBCOMMAND_WORD.test(second) ? `${head} ${second}` : undefined;
+}
 function longestReviewedBody(tokens) {
     let best;
     for (const words of LEXICON_BODIES) {
@@ -151,6 +162,9 @@ export function escapeForDisclosure(value) {
     });
     return escaped.length <= DISCLOSED_RULE_TEXT_MAX_CHARS ? escaped : `${escaped.slice(0, DISCLOSED_RULE_TEXT_MAX_CHARS)}…`;
 }
+export function hasUnrenderableCharacters(text) {
+    return CONTROL_CHARS_RE.test(text);
+}
 export function parseAllowRuleText(text, opts) {
     if (text.length > MAX_RULE_TEXT_CHARS) {
         return reject("invalid.too_long", `rule text exceeds ${MAX_RULE_TEXT_CHARS} characters`);
@@ -178,12 +192,11 @@ export function parseAllowRuleText(text, opts) {
             ? reject("invalid.empty_command", `rule "${text}" names no command`)
             : reject("invalid.not_simple_command", `rule "${text}" is not a command this lane can name (${shape.reject})`);
     }
-    if (match === "prefix" && shape.segments.length > 1) {
-        return reject("invalid.not_simple_command", `prefix rule "${text}" names more than one command — a prefix admits anything appended to its body, so only the exact form may name a connector chain`);
-    }
-    const head = commandBasename(shape.names[0] ?? "");
+    const head = commandBasename(shape.names[shape.names.length - 1] ?? "");
     if (match === "prefix" && BARE_INTERPRETER_NAMES.has(head) && opts?.direction !== "tighten") {
-        return reject("invalid.bare_interpreter_prefix", `prefix rule "${text}" is headed by the interpreter "${head}" — such a rule authorizes running arbitrary programs, which one approval click cannot be read as having granted (an exact rule naming the whole command line is accepted)`);
+        return reject("invalid.bare_interpreter_prefix", shape.segments.length > 1
+            ? `prefix rule "${text}" leaves its final segment open-ended under the interpreter "${head}" — such a rule authorizes running arbitrary programs, which one approval click cannot be read as having granted (an exact rule naming the whole command line is accepted)`
+            : `prefix rule "${text}" is headed by the interpreter "${head}" — such a rule authorizes running arbitrary programs, which one approval click cannot be read as having granted (an exact rule naming the whole command line is accepted)`);
     }
     const command = foldSpacing(body);
     if (command === undefined) {
@@ -209,7 +222,10 @@ function admitsUnder(rule, command, reading) {
         return false;
     if (rule.match === "exact")
         return folded === rule.command;
-    if (shape.segments.length > 1)
+    const bodyShape = ruleLaneShapeOf(rule.command, reading);
+    if ("reject" in bodyShape)
+        return false;
+    if (shape.segments.length !== bodyShape.segments.length)
         return false;
     return folded === rule.command || folded.startsWith(rule.command + " ");
 }
@@ -259,13 +275,30 @@ export function suggestRulesForCommand(command) {
     if ("rule" in exact && exact.rule.match === "exact" && ruleAdmitsCommand(exact.rule, command)) {
         out.push({ rule: exact.rule.rule, match: "exact", command: exact.rule.command });
     }
-    if (out.length === 1 && shape.segments.length === 1) {
-        const body = longestReviewedBody(folded.split(" "));
-        if (body !== undefined) {
-            const text = formatAllowRuleText(body, "prefix");
-            const parsed = parseAllowRuleText(text);
-            if ("rule" in parsed && parsed.rule.match === "prefix" && ruleAdmitsCommand(parsed.rule, command)) {
-                out.push({ rule: parsed.rule.rule, match: "prefix", command: parsed.rule.command });
+    const offerPrefix = (body) => {
+        if (body === undefined)
+            return;
+        const text = formatAllowRuleText(body, "prefix");
+        const parsed = parseAllowRuleText(text);
+        if ("rule" in parsed && parsed.rule.match === "prefix" && ruleAdmitsCommand(parsed.rule, command)) {
+            out.push({ rule: parsed.rule.rule, match: "prefix", command: parsed.rule.command });
+        }
+    };
+    const tokensOf = (s) => s.split(/\s+/).filter((t) => t !== "");
+    const bodyOf = (tokens) => longestReviewedBody(tokens) ?? genericPrefixBody(tokens);
+    if (out.length === 1) {
+        if (shape.segments.length === 1) {
+            offerPrefix(bodyOf(tokensOf(folded)));
+        }
+        else {
+            const foldedShape = ruleLaneShapeOf(folded, MATCH_READING);
+            if (!("reject" in foldedShape) && foldedShape.segments.length === shape.segments.length) {
+                const rawLast = foldedShape.segments[foldedShape.segments.length - 1] ?? "";
+                const lastBody = bodyOf(tokensOf(rawLast));
+                if (lastBody !== undefined) {
+                    const cut = folded.length - rawLast.length + (rawLast.length - rawLast.trimStart().length);
+                    offerPrefix(folded.slice(0, cut) + lastBody);
+                }
             }
         }
     }

package/dist/core/permission-rules.d.ts

@@ -46,6 +46,13 @@ export interface PermissionRuleIssue {
     /** design/179 D7: a Bash prefix rule under `bashPrefixLane:"rules-store"` — reported so a migration
      *  report can tell "route this through the rule store" apart from "this is a mistake". */
      | "unsupported.bash_prefix_rules_store" | "unsupported.file_glob" | "unsupported.mcp_paren"
+    /** A parenthesised rule whose NAME is a covering spelling in a non-MCP protocol namespace
+     *  (`a2a__<peer>__*(x:y)`, `a2a__<peer>(x:y)`). The param DSL is keyed by EXACT tool name, and a
+     *  covering spelling is not one — no mounted tool can ever bear it, so the rule compiled clean and
+     *  matched nothing. Additive member; the MCP spelling keeps its own {@link
+     *  PermissionRuleIssue.code} `unsupported.mcp_paren` (that refusal is wider — it covers exact MCP
+     *  names too, for CC parity — and fires first, so no MCP rule's reported code changes). */
+     | "unsupported.covering_paren"
     /** HRD-PRM-7: a param-level rule naming a parameter the target tool does not carry. Additive member —
      *  the lane that used to compile silently and never match (see {@link FILE_TOOL_PARAMS}). */
      | "unsupported.unknown_param";
@@ -105,27 +112,28 @@ export declare function parsePermissionRule(rule: string): ParsedPermissionRule;
  */
 export declare function wildcardMatch(pattern: string, value: string): boolean;
 /**
- * Does an MCP-namespaced RULE name cover `toolName`? — the tail branch of CC's rule matcher `VRp`
+ * Does a namespaced RULE name cover `toolName`? — the tail branch of CC's rule matcher `VRp`
  * (:595780), which is UNCONDITIONAL there (its `globMatching` option gates only the whole-name glob
  * branch, so CC's allow lane — `mVo` :595803, which passes no options — matches MCP segments too).
- * Three covering forms, matching CC's three disjuncts:
- *   · `mcp__<server>`           — every tool of that server (rule tool segment absent);
- *   · `mcp__<server>__*`        — the same set, spelled with the star CC's own settings validator
- *                                 recommends (`"MCP rules do not support patterns in parentheses …
- *                                 use mcp__srv__*"`);
- *   · `mcp__<server>__get_*`    — a glob over the tool segment.
+ * Three covering forms, matching CC's three disjuncts (`<ns>` = any protocol-table prefix):
+ *   · `<ns>__<peer>`           — every tool of that peer (rule tool segment absent);
+ *   · `<ns>__<peer>__*`        — the same set, spelled with the star CC's own settings validator
+ *                                recommends (`"MCP rules do not support patterns in parentheses …
+ *                                use mcp__srv__*"`);
+ *   · `<ns>__<peer>__get_*`    — a glob over the tool segment.
  * A LITERAL tool segment is deliberately NOT covered here: it is an exact tool name, and the exact
  * table already answers it — the same split CC makes with its leading `ruleName === toolName`.
  *
- * Server segments compare EXACTLY (CC `s.serverName === a.serverName`). A rule must therefore spell
- * the server the way the mint does; that is the same string an operator reads off any mounted tool
- * name, and inventing a fuzzier comparison here would let one rule reach a server it does not name.
+ * Rule and target must be in the SAME namespace, and peer segments compare EXACTLY (CC
+ * `s.serverName === a.serverName`). A rule must therefore spell the peer the way the mint does; that
+ * is the same string an operator reads off any mounted tool name, and inventing a fuzzier comparison
+ * here would let one rule reach a peer — or a protocol — it does not name.
  */
-export declare function mcpRuleNameCovers(ruleName: string, toolName: string): boolean;
-/** True ⇔ this rule name is an MCP name whose reach is a SET of tools rather than one exact tool —
- *  i.e. the shapes {@link mcpRuleNameCovers} answers and an exact name table cannot. Every lane that
- *  keys rules by exact tool name needs this to know which of its entries it must NOT key that way. */
-export declare function isMcpCoveringRuleName(name: string): boolean;
+export declare function namespacedRuleNameCovers(ruleName: string, toolName: string): boolean;
+/** True ⇔ this rule name is a namespaced name whose reach is a SET of tools rather than one exact tool
+ *  — i.e. the shapes {@link namespacedRuleNameCovers} answers and an exact name table cannot. Every
+ *  lane that keys rules by exact tool name needs this to know which entries it must NOT key that way. */
+export declare function isNamespacedCoveringRuleName(name: string): boolean;
 /** Exported for the lockstep guard only (see {@link FILE_TOOL_PARAMS}) — not part of the rule DSL. */
 export declare const fileToolParamVocabulary: (canonicalTool: string) => ReadonlySet<string> | undefined;
 /** Dry-run 校验/迁移报告(codex 127 审 B5):不 throw,返回全部 issues(含 `unsupported.*` 分类,

package/dist/core/permission-rules.js

@@ -1,4 +1,4 @@
-import { MCP_NAMESPACE } from "./protocol-table.js";
+import { MCP_NAMESPACE, protocolOf } from "./protocol-table.js";
 export const BASH_GENERIC_PARAMS = new Set(["command", "timeout", "description", "run_in_background"]);
 const DEFAULT_CAPS = {
     maxRules: 256,
@@ -77,31 +77,34 @@ export function wildcardMatch(pattern, value) {
         p++;
     return p === pattern.length;
 }
-function parseMcpRuleName(name) {
-    if (!name.startsWith(MCP_NAMESPACE.prefix))
+function parseNamespacedRuleName(name) {
+    const ns = protocolOf(name);
+    if (ns === undefined)
         return undefined;
-    const segments = name.slice(MCP_NAMESPACE.prefix.length).split("__");
-    const server = segments[0];
-    if (server === undefined || server === "")
+    const segments = name.slice(ns.prefix.length).split("__");
+    const peer = segments[0];
+    if (peer === undefined || peer === "")
         return undefined;
     const rest = segments.slice(1);
-    return rest.length > 0 ? { server, tool: rest.join("__") } : { server };
+    return rest.length > 0 ? { protocol: ns.id, peer, tool: rest.join("__") } : { protocol: ns.id, peer };
 }
-export function mcpRuleNameCovers(ruleName, toolName) {
-    const rule = parseMcpRuleName(ruleName);
+export function namespacedRuleNameCovers(ruleName, toolName) {
+    const rule = parseNamespacedRuleName(ruleName);
     if (rule === undefined)
         return false;
-    const target = parseMcpRuleName(toolName);
+    const target = parseNamespacedRuleName(toolName);
     if (target === undefined)
         return false;
-    if (rule.server !== target.server)
+    if (rule.protocol !== target.protocol)
+        return false;
+    if (rule.peer !== target.peer)
         return false;
     if (rule.tool === undefined || rule.tool === "*")
         return true;
     return target.tool !== undefined && rule.tool.includes("*") && wildcardMatch(rule.tool, target.tool);
 }
-export function isMcpCoveringRuleName(name) {
-    const parsed = parseMcpRuleName(name);
+export function isNamespacedCoveringRuleName(name) {
+    const parsed = parseNamespacedRuleName(name);
     return parsed !== undefined && (parsed.tool === undefined || parsed.tool.includes("*"));
 }
 const PRIMARY_FIELDS = {
@@ -138,13 +141,13 @@ function countStars(s) {
 }
 function compile(rules, caps, primaryFieldGeneric, bashPrefixLane = "reject") {
     const byTool = new Map();
-    const mcpCovering = { deny: [], ask: [], allow: [] };
+    const namespacedCovering = { deny: [], ask: [], allow: [] };
     const issues = [];
     const bad = (rule, code, message) => {
         issues.push({ rule, code, message });
     };
     if (rules.length > caps.maxRules) {
-        return { byTool, mcpCovering, issues: [{ rule: "", code: "invalid.cap_exceeded", message: `${rules.length} rules > maxRules ${caps.maxRules}` }] };
+        return { byTool, namespacedCovering, issues: [{ rule: "", code: "invalid.cap_exceeded", message: `${rules.length} rules > maxRules ${caps.maxRules}` }] };
     }
     for (const r of rules) {
         const text = r.rule;
@@ -171,14 +174,20 @@ function compile(rules, caps, primaryFieldGeneric, bashPrefixLane = "reject") {
             }
         }
         const toolName = parsed.toolName;
-        if (toolName.startsWith(MCP_NAMESPACE.prefix) && (parsed.ruleContent !== undefined || indexOfUnescaped(text, "(") !== -1)) {
+        const parenthesised = parsed.ruleContent !== undefined || indexOfUnescaped(text, "(") !== -1;
+        if (toolName.startsWith(MCP_NAMESPACE.prefix) && parenthesised) {
             bad(text, "unsupported.mcp_paren", "MCP rules do not support patterns in parentheses (CC parity); use the toolAxes system");
             continue;
         }
+        if (parenthesised && isNamespacedCoveringRuleName(toolName)) {
+            bad(text, "unsupported.covering_paren", `"${toolName}" reaches a SET of tools, and the generic param DSL is keyed by exact tool name — a parenthesised rule on it can never match. ` +
+                `Write the parenthesised rule against one exact tool name, or drop the parentheses to keep the covering rule.`);
+            continue;
+        }
         const entry = byTool.get(toolName) ?? { bare: {}, param: { deny: [], ask: [] } };
         if (parsed.ruleContent === undefined) {
-            if (isMcpCoveringRuleName(toolName)) {
-                mcpCovering[r.behavior].push({ ruleName: toolName, ruleText: text, ...(r.source !== undefined ? { source: r.source } : {}) });
+            if (isNamespacedCoveringRuleName(toolName)) {
+                namespacedCovering[r.behavior].push({ ruleName: toolName, ruleText: text, ...(r.source !== undefined ? { source: r.source } : {}) });
                 continue;
             }
             entry.bare[r.behavior] = { ruleText: text, source: r.source };
@@ -238,7 +247,7 @@ function compile(rules, caps, primaryFieldGeneric, bashPrefixLane = "reject") {
         entry.param[r.behavior].push({ param, pattern, behavior: r.behavior, ruleText: text, source: r.source });
         byTool.set(toolName, entry);
     }
-    return { byTool, mcpCovering, issues };
+    return { byTool, namespacedCovering, issues };
 }
 export function validatePermissionRules(rules, opts) {
     const caps = { ...DEFAULT_CAPS, ...opts?.caps };
@@ -272,7 +281,7 @@ function ruleMessage(kind, ruleText, source) {
 }
 export function createPermissionRulePolicy(rules, opts) {
     const caps = { ...DEFAULT_CAPS, ...opts?.caps };
-    const { byTool, mcpCovering, issues } = compile(rules, caps, opts?.primaryFieldGeneric ?? "reject", opts?.bashPrefixLane ?? "reject");
+    const { byTool, namespacedCovering, issues } = compile(rules, caps, opts?.primaryFieldGeneric ?? "reject", opts?.bashPrefixLane ?? "reject");
     const setLevelCap = issues.some((i) => i.code === "invalid.cap_exceeded" && i.rule === "");
     if (issues.length > 0 && ((opts?.onInvalidRule ?? "throw") === "throw" || setLevelCap)) {
         const e = new Error(`createPermissionRulePolicy: ${issues.length} invalid/unsupported rule(s):\n` +
@@ -307,23 +316,23 @@ export function createPermissionRulePolicy(rules, opts) {
             nameSets.allow.push(toolName);
     }
     for (const behavior of ["deny", "ask", "allow"]) {
-        for (const r of mcpCovering[behavior])
+        for (const r of namespacedCovering[behavior])
             nameSets[behavior].push(r.ruleName);
     }
-    const coveringHit = (lane, toolName) => lane.length === 0 ? undefined : lane.find((r) => mcpRuleNameCovers(r.ruleName, toolName));
-    const hasCovering = mcpCovering.deny.length > 0 || mcpCovering.ask.length > 0 || mcpCovering.allow.length > 0;
+    const coveringHit = (lane, toolName) => lane.length === 0 ? undefined : lane.find((r) => namespacedRuleNameCovers(r.ruleName, toolName));
+    const hasCovering = namespacedCovering.deny.length > 0 || namespacedCovering.ask.length > 0 || namespacedCovering.allow.length > 0;
     return {
         nameSets: [nameSets],
         check(req) {
             const entry = byTool.get(req.toolName);
-            const covering = hasCovering && req.toolName.startsWith(MCP_NAMESPACE.prefix);
+            const covering = hasCovering && protocolOf(req.toolName) !== undefined;
             if (entry?.bare.deny) {
                 return { action: "deny", message: ruleMessage("denied", entry.bare.deny.ruleText, entry.bare.deny.source) };
             }
             if (covering) {
-                const mcpDeny = coveringHit(mcpCovering.deny, req.toolName);
-                if (mcpDeny)
-                    return { action: "deny", message: ruleMessage("denied", mcpDeny.ruleText, mcpDeny.source) };
+                const coveringDeny = coveringHit(namespacedCovering.deny, req.toolName);
+                if (coveringDeny)
+                    return { action: "deny", message: ruleMessage("denied", coveringDeny.ruleText, coveringDeny.source) };
             }
             if (entry) {
                 const paramDeny = matchParamRules(entry.param.deny, req.args, caps.maxScalarValueChars);
@@ -335,9 +344,9 @@ export function createPermissionRulePolicy(rules, opts) {
                 }
             }
             if (covering) {
-                const mcpAsk = coveringHit(mcpCovering.ask, req.toolName);
-                if (mcpAsk)
-                    return { action: "ask", message: ruleMessage("flagged", mcpAsk.ruleText, mcpAsk.source), matchedAskRule: mcpAsk.ruleText };
+                const coveringAsk = coveringHit(namespacedCovering.ask, req.toolName);
+                if (coveringAsk)
+                    return { action: "ask", message: ruleMessage("flagged", coveringAsk.ruleText, coveringAsk.source), matchedAskRule: coveringAsk.ruleText };
             }
             if (entry) {
                 const paramAsk = matchParamRules(entry.param.ask, req.args, caps.maxScalarValueChars);
@@ -348,7 +357,7 @@ export function createPermissionRulePolicy(rules, opts) {
                     return { action: "allow" };
                 }
             }
-            if (covering && coveringHit(mcpCovering.allow, req.toolName)) {
+            if (covering && coveringHit(namespacedCovering.allow, req.toolName)) {
                 return { action: "allow" };
             }
             if (defaultAction === "allow")

package/dist/core/runner/prepare-task.d.ts

@@ -314,6 +314,14 @@ export interface Prepared {
      * leg always knows its identity.
      */
     hookIdentity: HookInvocationIdentity;
+    /**
+     * The per-invocation TIME BOUND every hook seat of this leg runs under (`Hooks.timeoutMs`, already
+     * validated — a garbage value was refused to the default and disclosed ONCE, here, rather than on
+     * every tool call). Published for the same reason `hookIdentity` is: the seats live in two files, and
+     * a number each station re-derived would be two answers to one wiring question — including two
+     * chances to re-refuse the same bad value.
+     */
+    hookTimeoutMs: number;
     promptManifest: {
         constitution: "core" | "replaced" | "provider-assembled";
         blocks: Array<{

package/dist/core/runner/prepare-task.js

@@ -30,16 +30,17 @@ import { isValidReminderMark, mintReminderMark, reminderMarkDeclaration } from "
 import { policyAskClassOf } from "../ask-class.js";
 import { emitTrace } from "../trace.js";
 import { createSessionRulePolicy, PATH_CONFINABLE_WRITE_TOOLS } from "./session-rule-policy.js";
-import { cloneObserverInput, createHookEnvCapabilities, createPreToolUseConstraintPolicy, formatHookFeedback, mintHookInvocationIdentity, persistedRuleMandateOf, runToolGate } from "../hooks.js";
+import { cloneObserverInput, createHookEnvCapabilities, createPreToolUseConstraintPolicy, formatHookFeedback, mintHookInvocationIdentity, persistedRuleMandateOf, resolveHookTimeoutMs, runHookSeat, hookSeatExpiredError, runToolGate } from "../hooks.js";
 import { createWriteProtectionCheck } from "../write-protect.js";
 import { orgRuleVerdictFor } from "../permission-rule-org.js";
 import { CacheBreakDetector, toolsToFingerprintInputs } from "../cache-break-detector.js";
 import { reservedCollisions, reservedFor } from "../../brain/request-params.js";
+import { adjudicateDerivedRoute, fallbackToPrimaryNotice, sameRouteIdentity } from "../../brain/route-adjudicator.js";
 import { STALL_CONNECT_MS, STALL_FIRST_TOKEN_MS, STALL_IDLE_MS, withBrainCallGuardrail } from "../../brain/timeout.js";
 import { defineTool, isDefineToolProduct } from "../tools.js";
 import { RETIRED_TOOL_NAMES } from "../tool-name-aliases.js";
 import { protocolOf } from "../protocol-table.js";
-import { isMcpCoveringRuleName, mcpRuleNameCovers } from "../permission-rules.js";
+import { isNamespacedCoveringRuleName, namespacedRuleNameCovers } from "../permission-rules.js";
 import { pathToUri } from "../lsp-protocol.js";
 import { DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, createOffloadPersist, firstPartyOffloadPolicy, InMemoryToolResultStore, RunnerSharedToolResultStore, ScopedToolResultStore, isVolatileOffloadStore, OFFLOAD_TOOL_NAME, createReadToolResultTool, withToolResultOffload, } from "../tool-result-store.js";
 import { OUTPUT_TOOL_NAME, REPORT_FINDINGS_TOOL_NAME, SKILL_CONTENT_MAX_CHARS, SKILL_TOOL_NAME, createOutputTool, createReportBlockedTool, createReportFindingsTool, createSkillTool, normalizeSkills } from "./synthetic-tools.js";
@@ -302,6 +303,20 @@ function raceAbort(p, signal, onAbort) {
         p.then(finish, () => finish(onAbort()));
     });
 }
+function createDenyObserverNotifier(hooks, hookTimeoutMs, signal, report) {
+    if (hooks?.permissionDenied === undefined)
+        return undefined;
+    return async (payload) => {
+        try {
+            const seat = await runHookSeat("permissionDenied", { timeoutMs: hookTimeoutMs, signal }, (sig) => hooks.permissionDenied({ ...payload, signal: sig }));
+            if (seat.expired)
+                report(hookSeatExpiredError("permissionDenied", hookTimeoutMs, seat.cause, "the deny observation was abandoned; the deny itself is unchanged"));
+        }
+        catch (err) {
+            report(err);
+        }
+    };
+}
 function mcpRevocationWiring(deps) {
     if (deps.mcpRevocations === undefined)
         return undefined;
@@ -458,6 +473,20 @@ async function adoptReminderMark(session, sessionId, seedMark, spawnMark, onErro
     }
     return { reminderMark, reminderDisclosureCounts: {} };
 }
+async function derivedRouteFallsBack(args) {
+    try {
+        if (sameRouteIdentity(args.derived, args.primary))
+            return false;
+        const verdict = await adjudicateDerivedRoute({ brain: args.brain, model: args.derived, getApiKeyAndHeaders: args.getApiKeyAndHeaders });
+        if (verdict === undefined || verdict.ok)
+            return false;
+        deliverEngineNotice(args.onNotice, fallbackToPrimaryNotice({ seat: args.seat, from: args.derived.id, to: args.primary.id, verdict }));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 export async function prepareTask(spec, deps, sessions, resume, internals, runnerSelf) {
     const doors = prepareConfigDoors({ spec, deps, sessions, resume, internals });
     spec = doors.spec;
@@ -475,7 +504,13 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
     const sessionId = acquired.sessionId;
     const hostTaskId = spec.taskId ?? sessionId;
     const delegation = effectiveDelegationFacts(internals, resume?.seed.isDelegatedChild);
-    warnCompactionWindowHazard(deps.tracer, spec, model, compModel, hostTaskId);
+    let effectiveCompModel = compModel;
+    if (spec.compactionModel === undefined &&
+        compModel !== undefined &&
+        (await derivedRouteFallsBack({ seat: "compaction-summary", derived: compModel, primary: model, brain: deps.brain, getApiKeyAndHeaders: spec.getApiKeyAndHeaders, onNotice: deps.onNotice }))) {
+        effectiveCompModel = undefined;
+    }
+    warnCompactionWindowHazard(deps.tracer, spec, model, effectiveCompModel, hostTaskId);
     const taskScope = internals?.registryScope ?? spec.principal ?? "default";
     internals?.peerSelfRef?.addAxis("s", sessionId);
     internals?.peerSelfRef?.addAxis("t", hostTaskId);
@@ -859,7 +894,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     pc.autoMode?.decider === autoModeDecider)
                 ? [
                     {
-                        policy: createPreToolUseConstraintPolicy(ownPreToolUse, hookEnvFace, notifyOwnHookCrash),
+                        policy: createPreToolUseConstraintPolicy(ownPreToolUse, hookEnvFace, notifyOwnHookCrash, hookTimeoutMs),
                         preToolUse: ownPreToolUse,
                         ...(hookEnvSource !== undefined ? { hookEnv: hookEnvSource } : {}),
                         ...(frozenOnAsk !== undefined ? { onAsk: frozenOnAsk } : {}),
@@ -1059,6 +1094,9 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             catch {
                 classifierModel = model;
             }
+            if (await derivedRouteFallsBack({ seat: "auto-mode-classifier", derived: classifierModel, primary: model, brain: deps.brain, getApiKeyAndHeaders: spec.getApiKeyAndHeaders, onNotice: deps.onNotice })) {
+                classifierModel = model;
+            }
             const classifierSystemPrompt = buildAutoModePrompt(am);
             const classifierRuntime = brainToRuntime(deps.brain);
             autoModeDecider = createAutoModeDecider({
@@ -1069,7 +1107,12 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     const ctx = await session.buildContext();
                     const known = ctx.messages.filter((m) => m.role === "user" || m.role === "assistant" || m.role === "toolResult");
                     const userPrompt = renderAutoModeWindow(known, am.window) + renderAutoModeAction(input);
-                    const response = await classifierRuntime.completeSimple(classifierModel, { systemPrompt: classifierSystemPrompt, messages: [{ role: "user", content: userPrompt, timestamp: Date.now() }] }, { signal });
+                    const classifierAuth = await spec.getApiKeyAndHeaders?.(classifierModel);
+                    const response = await classifierRuntime.completeSimple(classifierModel, { systemPrompt: classifierSystemPrompt, messages: [{ role: "user", content: userPrompt, timestamp: Date.now() }] }, {
+                        signal,
+                        ...(classifierAuth?.apiKey !== undefined ? { apiKey: classifierAuth.apiKey } : {}),
+                        ...(classifierAuth?.headers !== undefined ? { headers: classifierAuth.headers } : {}),
+                    });
                     return response.content
                         .filter((c) => c.type === "text")
                         .map((c) => c.text)
@@ -1398,7 +1441,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     owner: hostTaskId,
                     scope: taskScope,
                     ...(sessionId !== undefined ? { sessionId } : {}),
-                    ...(internals?.onTaskNotification !== undefined ? { notify: internals.onTaskNotification } : {}),
+                    ...(internals?.onTaskNotification !== undefined ? { notify: internals.onTaskNotification } : {}), ...(spec.oneShot !== undefined ? { oneShot: spec.oneShot } : {}),
                     ...(internals?.onSubagentSpawn !== undefined ? { sink: internals.onSubagentSpawn } : {}),
                     ...(internals?.parentNotify !== undefined
                         ? { uplink: internals.parentNotify, ...(internals.parentPeerRef !== undefined ? { uplinkRecipient: internals.parentPeerRef } : {}) }
@@ -2711,7 +2754,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         for (const n of list ?? []) {
                             if (known.has(n))
                                 continue;
-                            if (isMcpCoveringRuleName(n) && [...known].some((k) => mcpRuleNameCovers(n, k)))
+                            if (isNamespacedCoveringRuleName(n) && [...known].some((k) => namespacedRuleNameCovers(n, k)))
                                 continue;
                             const retired = RETIRED_TOOL_NAMES.get(n);
                             if (retired !== undefined) {
@@ -2795,6 +2838,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         const denyNarrowingPolicy = narrowingLayers.length === 0 ? undefined : narrowingLayers.length === 1 ? narrowingLayers[0] : combinePolicies(...narrowingLayers);
         const basePolicyForResumeEdit = lockedPreflight.basePolicyForResumeEdit ?? lockedPreflight.toolPolicy;
         const hooks = spec.hooks ?? deps.hooks;
+        const hookTimeoutMs = resolveHookTimeoutMs(hooks?.timeoutMs, notifyOwnHookCrash, hooks);
         const preToolUseObservational = hooks?.preToolUse !== undefined && hooks.preToolUseObservational === true;
         const ownGatePreToolUse = !preToolUseObservational
             ? hooks?.preToolUse
@@ -3571,21 +3615,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 }
                 return resolved;
             };
-            const hooksWithPermissionDenied = hooks?.permissionDenied ? hooks : undefined;
-            const notifyPermissionDenied = hooksWithPermissionDenied
-                ? async (payload) => {
-                    try {
-                        await hooksWithPermissionDenied.permissionDenied(payload);
-                    }
-                    catch (err) {
-                        try {
-                            deps.onError?.(err instanceof Error ? err : new Error(String(err)), { phase: "hook", sessionId });
-                        }
-                        catch {
-                        }
-                    }
-                }
-                : undefined;
+            const notifyPermissionDenied = createDenyObserverNotifier(hooks, hookTimeoutMs, abortController.signal, notifyOwnHookCrash);
             const notifyHookError = (err) => {
                 try {
                     deps.onError?.(err instanceof Error ? err : new Error(String(err)), { phase: "hook", sessionId });
@@ -4302,6 +4332,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             identity: hookIdentity,
                             reminderMark,
                             preToolUse: ownGatePreToolUse,
+                            hookTimeoutMs,
+                            ...(handsCwdRef !== undefined ? { trackedCwd: () => handsCwdRef.current } : {}),
                             ...(hookEnvFace !== undefined ? { hookEnv: hookEnvFace } : {}),
                             adjudicate,
                             resolveAsk: resolveAskBound,
@@ -4418,7 +4450,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         }
                         catch {
                         }
-                        const patch = await hooks.postToolUseFailure(e.toolName, e.input, {
+                        const failureSeat = await runHookSeat("postToolUseFailure", { timeoutMs: hookTimeoutMs, signal: abortController.signal }, (sig) => hooks.postToolUseFailure(e.toolName, e.input, {
                             error: e.content
                                 .filter((c) => c.type === "text")
                                 .map((c) => c.text)
@@ -4426,7 +4458,11 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             isInterrupt: abortController.signal.aborted || spec.signal?.aborted === true,
                             content: e.content.map((c) => ({ ...c })),
                             details: clonedDetails,
-                        }, { toolCallId: e.toolCallId, toolName: e.toolName, ...(hookEnvFace !== undefined ? { env: hookEnvFace } : {}), identity: hookIdentity });
+                        }, { toolCallId: e.toolCallId, toolName: e.toolName, signal: sig, ...(handsCwdRef?.current !== undefined ? { cwd: handsCwdRef.current } : {}), ...(hookEnvFace !== undefined ? { env: hookEnvFace } : {}), identity: hookIdentity }));
+                        if (failureSeat.expired) {
+                            notifyOwnHookCrash(hookSeatExpiredError("postToolUseFailure", hookTimeoutMs, failureSeat.cause, "the observation was abandoned and its additionalContext dropped; the failure result itself is unchanged"));
+                        }
+                        const patch = failureSeat.expired ? undefined : failureSeat.value;
                         if (patch?.additionalContext) {
                             content = [...content, { type: "text", text: formatHookFeedback(patch.additionalContext, reminderMark) }];
                             changed = true;
@@ -4434,7 +4470,11 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     }
                 }
                 else if (hooks?.postToolUse) {
-                    const patch = await hooks.postToolUse(e.toolName, e.input, { content: e.content, details: e.details, isError: e.isError }, { toolCallId: e.toolCallId, toolName: e.toolName, ...(hookEnvFace !== undefined ? { env: hookEnvFace } : {}), identity: hookIdentity });
+                    const successSeat = await runHookSeat("postToolUse", { timeoutMs: hookTimeoutMs, signal: abortController.signal }, (sig) => hooks.postToolUse(e.toolName, e.input, { content: e.content, details: e.details, isError: e.isError }, { toolCallId: e.toolCallId, toolName: e.toolName, signal: sig, ...(handsCwdRef?.current !== undefined ? { cwd: handsCwdRef.current } : {}), ...(hookEnvFace !== undefined ? { env: hookEnvFace } : {}), identity: hookIdentity }));
+                    if (successSeat.expired) {
+                        notifyOwnHookCrash(hookSeatExpiredError("postToolUse", hookTimeoutMs, successSeat.cause, "the seat was abandoned; the tool result is delivered to the model UNMODIFIED (no updatedOutput, no additionalContext)"));
+                    }
+                    const patch = successSeat.expired ? undefined : successSeat.value;
                     if (patch?.updatedOutput) {
                         content = patch.updatedOutput;
                         changed = true;
@@ -4722,7 +4762,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         const effectiveReadFaceObserved = carrierReadFace();
         const effectiveReadDenyObserved = readDenyAdditionsNormalized.length > 0 ? readDenyAdditionsNormalized.map((e) => ({ ...e })) : undefined;
         const preparedHolder = {};
-        const buildPrepared = () => ({ harness, session, sessionId, reminderMark, reminderDisclosureCounts, taskRootPath: taskRootFinal, model, thinking, compModel, mcp: mcp, ...(a2a !== undefined && a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, approvalSettlement, batchHaltRef, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), ...(effectiveReadFaceObserved !== undefined ? { effectiveReadFace: effectiveReadFaceObserved } : {}), ...(effectiveReadDenyObserved !== undefined ? { effectiveReadDenyPatterns: effectiveReadDenyObserved } : {}), effectiveMemoryScopes: memoryEffectiveScopes, cwdRef: handsCwdRef, ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), denyNarrowingPolicy, ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, suspendRef, suspendProgressRef, reviewRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, brainCallGuardrailRef, suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, gitStatusRef, listBackgroundTasks, hookIdentity, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}) });
+        const buildPrepared = () => ({ harness, session, sessionId, reminderMark, reminderDisclosureCounts, taskRootPath: taskRootFinal, model, thinking, compModel: effectiveCompModel, mcp: mcp, ...(a2a !== undefined && a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, approvalSettlement, batchHaltRef, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), ...(effectiveReadFaceObserved !== undefined ? { effectiveReadFace: effectiveReadFaceObserved } : {}), ...(effectiveReadDenyObserved !== undefined ? { effectiveReadDenyPatterns: effectiveReadDenyObserved } : {}), effectiveMemoryScopes: memoryEffectiveScopes, cwdRef: handsCwdRef, ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), denyNarrowingPolicy, ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, suspendRef, suspendProgressRef, reviewRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, brainCallGuardrailRef, suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, gitStatusRef, listBackgroundTasks, hookIdentity, hookTimeoutMs, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}) });
         const prepared = buildPrepared();
         preparedHolder.current = prepared;
         return prepared;

package/dist/core/runner/runtask.d.ts

@@ -219,7 +219,10 @@ export declare class Runner {
      * - `tiers` omitted ⇒ the current tier bindings are kept (and re-applied over the new models);
      *   explicitly passed (including `undefined`) ⇒ replaced.
      * - Success is announced via `config.models_swapped` (models/tiers counts — key material only,
-     *   never the catalog itself).
+     *   never the catalog itself). A swap may additionally emit the advisory
+     *   `route.base_url_changed_key_unchanged` notice (deliberately conservative — see its entry in
+     *   the notice directory) for same-name entries whose URL moved while the Model-visible
+     *   credential fingerprint did not.
      */
     swapModels(next: {
         models: Record<string, Model>;