@sema-agent/core 7.10.0 → 7.11.1

package/dist/core/read-only-shell.js

@@ -0,0 +1,316 @@
+import { readShellCommand } from "./shell-lexer.js";
+import { FIND_ACTION_PRIMARIES, FIND_NEWER_PRIMARY, FIND_VALUE_PRIMARIES, FLAG_VALUE_ACCEPTS, READ_ONLY_BARE_ONLY, READ_ONLY_BARE_PROGRAMS, READ_ONLY_COMMAND_TABLE, READ_ONLY_ENV_NAMES, READ_ONLY_EXACT_FORMS, READ_ONLY_GLOB_PROGRAMS, XARGS_READ_ONLY_TARGETS, dockerRetargetDanger, } from "./read-only-shell-table.js";
+const NOT = (reason) => ({ readOnly: false, reason });
+const READ_ONLY = { readOnly: true };
+const BARE_PROGRAMS = new Set(READ_ONLY_BARE_PROGRAMS.filter((p) => !p.includes(" ")));
+const BARE_MULTIWORD = READ_ONLY_BARE_PROGRAMS.filter((p) => p.includes(" ")).map((p) => p.split(" "));
+const GLOB_PROGRAMS = new Set(READ_ONLY_GLOB_PROGRAMS);
+const BARE_ONLY = new Set(READ_ONLY_BARE_ONLY);
+const ENV_NAMES = new Set(READ_ONLY_ENV_NAMES);
+const FIND_ACTIONS = new Set(FIND_ACTION_PRIMARIES);
+const FIND_VALUES = new Set(FIND_VALUE_PRIMARIES);
+const XARGS_TARGETS = XARGS_READ_ONLY_TARGETS;
+const TABLE_ROWS = Object.entries(READ_ONLY_COMMAND_TABLE)
+    .map(([key, row]) => ({ words: key.split(" "), row }))
+    .sort((a, b) => b.words.length - a.words.length);
+const READING_REDIRECTS = new Set(["<", "<<", "<<-", "<&", "<<<"]);
+const LITERAL_ASSIGNMENT = /^([A-Za-z_][A-Za-z0-9_]*)\+?=(?:"[^"$`\\]*"|'[^']*'|[A-Za-z0-9_./:+-]*)$/;
+const ASSIGNMENT_NAME = /^([A-Za-z_][A-Za-z0-9_]*)(?:\[[^\]]*\])?\+?=/;
+const FLAG_WORD = /^-[a-zA-Z0-9_-]/;
+const NUMBER_LITERAL = /^[-+]?(0[xX][0-9a-fA-F]+|[0-9]+#[0-9a-zA-Z]+|[0-9]*\.?[0-9]+([eE][-+]?[0-9]+)?)$/;
+const PRINTF_LENGTH = "[lLhqjzZt]*";
+const PRINTF_ESCAPE = new RegExp(`%[^%a-zA-Z]*${PRINTF_LENGTH}\\\\[0-7xX]`);
+const PRINTF_NUMERIC = new RegExp(`%[-+ 0#']*[0-9.*]*${PRINTF_LENGTH}[diouxXeEfFgGaAn]`);
+const JQ_DANGER_FLAG = /^['"]?-[a-zA-Z]*[fL]/;
+const JQ_DANGER_TEXT = /--from-file|--rawfile|--slurpfile|--run-tests|--library-path|\benv\b|\$ENV\b|\binclude\b|\bimport\b/;
+export function readOnlyShellVerdict(command, shape = readShellCommand(command)) {
+    if (shape.grouped)
+        return NOT("a subshell, group or control structure — not a flat list of simple commands");
+    if (shape.segments.length === 0)
+        return NOT("no command");
+    if (shape.backgrounded)
+        return NOT("a background `&` defers execution past the approval-time reading");
+    if (shape.strayRedirection)
+        return NOT("a redirection on a piece that runs no program — the shell still opens its target");
+    for (const seg of shape.segments) {
+        if (seg.unreadable !== undefined)
+            return NOT(seg.unreadable);
+        if (seg.peelUnreadable !== undefined)
+            return NOT(seg.peelUnreadable);
+        for (const w of [...seg.argv, ...seg.redirections.map((r) => r.target)]) {
+            if (expansionKind(w) === "variable")
+                return NOT("a variable, arithmetic or command substitution — its value is not known at approval time");
+            if (w.expands !== false && /[()]/.test(w.raw))
+                return NOT("a pattern with a parenthesised part (an extended pattern or a shell-specific glob qualifier)");
+            if (/^=[A-Za-z_]/.test(w.raw) || w.raw.includes("~["))
+                return NOT("a shell-specific expansion spelling (`=cmd`, `~[…]`)");
+        }
+    }
+    const programs = shape.segments.map((s) => peelBuiltinPrefix(s.argv.slice(leadingAssignmentCount(s.argv)).map((w) => w.text))[0] ?? "");
+    if (shape.segments.length > 1 && programs.includes("cd") && programs.includes("git"))
+        return NOT("a compound that changes directory and runs git");
+    for (const seg of shape.segments) {
+        const verdict = segmentVerdict(seg);
+        if (!verdict.readOnly)
+            return verdict;
+    }
+    return READ_ONLY;
+}
+function expansionKind(w) {
+    if (w.expands === false)
+        return "none";
+    if (/[$`]|[<>]\(/.test(w.raw))
+        return "variable";
+    if (w.expands === "many")
+        return "glob";
+    return "none";
+}
+function leadingAssignmentCount(argv) {
+    let k = 0;
+    while (k < argv.length && ASSIGNMENT_NAME.test(argv[k].raw))
+        k++;
+    return k;
+}
+function peelBuiltinPrefix(words) {
+    let t = words;
+    for (;;) {
+        if (t[0] === "command") {
+            let r = 1;
+            while (t[r] !== undefined && /^-p+$/.test(t[r]))
+                r++;
+            if (t[r] === "--")
+                r++;
+            if (r >= t.length || t[r].startsWith("-"))
+                return t;
+            t = t.slice(r);
+        }
+        else if (t[0] === "builtin") {
+            const r = t[1] === "--" ? 2 : 1;
+            if (r >= t.length)
+                return t;
+            t = t.slice(r);
+        }
+        else if (t[0] === "noglob") {
+            if (t.length <= 1)
+                return t;
+            t = t.slice(1);
+        }
+        else
+            return t;
+    }
+}
+function segmentVerdict(seg) {
+    for (const r of seg.redirections) {
+        const target = r.target.text;
+        if (!READING_REDIRECTS.has(r.op) && target !== "/dev/null" && !(r.op === ">&" && /^\d+$/.test(target)))
+            return NOT(`the redirection \`${r.op} ${target}\` writes`);
+        if (/^\/dev\/(tcp|udp)\//.test(target))
+            return NOT("a redirection to a network pseudo-device");
+    }
+    const k = leadingAssignmentCount(seg.argv);
+    for (const w of seg.argv.slice(0, k)) {
+        const m = LITERAL_ASSIGNMENT.exec(w.raw);
+        if (m === null)
+            return NOT(`the assignment \`${w.raw}\` is not a literal value`);
+        if (!ENV_NAMES.has(m[1]))
+            return NOT(`the environment variable \`${m[1]}\` can alter what a program does`);
+    }
+    const run = seg.argv.slice(k);
+    if (run.length === 0)
+        return NOT("a bare assignment runs no program");
+    const words = peelBuiltinPrefix(run.map((w) => w.text));
+    const program = words[0];
+    if (run.some((w) => expansionKind(w) === "glob"))
+        return GLOB_PROGRAMS.has(program) ? READ_ONLY : NOT(`\`${program}\` with a glob argument — the glob may name anything`);
+    const structural = structuralReading(words);
+    if (structural !== null)
+        return structural ? READ_ONLY : NOT(`\`${program}\` with these arguments is not a read-only form`);
+    return tableReading(words, run);
+}
+function structuralReading(words) {
+    const program = words[0];
+    if (BARE_ONLY.has(program))
+        return words.length === 1;
+    for (const form of READ_ONLY_EXACT_FORMS)
+        if (words.length === form.length && words.every((w, i) => w === form[i]))
+            return true;
+    if (BARE_PROGRAMS.has(program))
+        return true;
+    for (const form of BARE_MULTIWORD)
+        if (words.length >= form.length && form.every((w, i) => words[i] === w))
+            return form[0] !== "docker" || !dockerRetargetDanger(words);
+    if (program === "echo")
+        return true;
+    if (program === "printf")
+        return printfReading(words);
+    if (program === "ls")
+        return true;
+    if (program === "cd")
+        return words.length <= 2;
+    if (program === "find") {
+        for (let i = 1; i < words.length; i++) {
+            const w = words[i];
+            if (FIND_ACTIONS.has(w))
+                return false;
+            if (FIND_VALUES.has(w) || FIND_NEWER_PRIMARY.test(w)) {
+                i++;
+                continue;
+            }
+        }
+        return true;
+    }
+    if (program === "history")
+        return words.length === 1 || (words.length === 2 && /^\d+$/.test(words[1]));
+    if (program === "arch")
+        return words.length === 1 || (words.length === 2 && (words[1] === "-h" || words[1] === "--help"));
+    if (program === "ifconfig")
+        return words.length === 1 || (words.length === 2 && /^[a-zA-Z]/.test(words[1]));
+    return null;
+}
+function printfReading(words) {
+    if (words[1]?.startsWith("-") === true && words[1] !== "--")
+        return false;
+    const at = words[1] === "--" ? 2 : 1;
+    const format = words[at] ?? "";
+    if (format.includes("$"))
+        return false;
+    const stripped = format.replace(/%%/g, "");
+    if (PRINTF_ESCAPE.test(stripped) || /\\[uU]/.test(stripped))
+        return false;
+    if (PRINTF_NUMERIC.test(stripped) || /%[^%a-zA-Z]*\*/.test(stripped)) {
+        for (let i = at + 1; i < words.length; i++) {
+            const operand = words[i];
+            if (operand.includes("[") || operand.includes("`") || operand.includes("$(") || !NUMBER_LITERAL.test(operand))
+                return false;
+        }
+    }
+    return true;
+}
+function tableReading(words, run) {
+    const program = words[0];
+    const hit = TABLE_ROWS.find((r) => words.length >= r.words.length && r.words.every((w, i) => words[i] === w));
+    if (hit !== undefined) {
+        const args = words.slice(hit.words.length);
+        for (const a of args) {
+            if (a.includes("$"))
+                return NOT(`\`${program}\`: an argument spells \`$\``);
+            if (a.includes("{") && (a.includes(",") || a.includes("..")))
+                return NOT(`\`${program}\`: a brace pattern argument`);
+        }
+        if (!flagWalk(args, hit.row, program))
+            return NOT(`\`${program}\`: an option outside its read-only set (or a malformed option value)`);
+        if (hit.row.wordsShape !== undefined ? !hit.row.wordsShape(args) : run.some((w) => w.raw.includes("`")))
+            return NOT(`\`${program}\`: arguments outside its read-only form`);
+        if (hit.row.wordsShape === undefined && (program === "rg" || program === "grep" || program === "egrep" || program === "fgrep") && run.some((w) => /[\n\r]/.test(w.raw)))
+            return NOT(`\`${program}\`: a line break inside an argument`);
+        if (hit.row.dangerous?.(args) === true)
+            return NOT(`\`${program}\`: an argument form upstream marks as writing, executing or resolving`);
+        return READ_ONLY;
+    }
+    if (program === "uniq" && words.slice(1).every((w, i, all) => /^-[a-zA-Z]+$/.test(w) || /^--[a-zA-Z-]+(=\S+)?$/.test(w) || (i > 0 && /^-[fsw]$/.test(all[i - 1]) && /^\d+$/.test(w))))
+        return gitOptionGuard(words);
+    if (program === "jq" && jqReading(run.slice(run.length - words.length + 1)))
+        return gitOptionGuard(words);
+    return NOT(`\`${program}\` is not a read-only program (or not in a read-only form)`);
+}
+function gitOptionGuard(words) {
+    if (words.includes("git") && words.some((w) => /^-c(=|$)|^--exec-path(=|$)|^--config-env(=|$)/.test(w)))
+        return NOT("a git configuration override on the line");
+    return READ_ONLY;
+}
+function jqReading(args) {
+    if (args.some((w) => JQ_DANGER_FLAG.test(w.raw) || JQ_DANGER_TEXT.test(w.raw)))
+        return false;
+    let i = 0;
+    while (i < args.length && (/^-[a-zA-Z]+$/.test(args[i].raw) || /^--[a-zA-Z-]+(=\S+)?$/.test(args[i].raw)))
+        i++;
+    if (i >= args.length)
+        return false;
+    for (; i < args.length; i++) {
+        const w = args[i];
+        const quoted = /^'[^'`]*'$|^"[^"`]*"$/.test(w.raw);
+        if (!quoted && (/^[-'"\s]/.test(w.raw) || /['"]/.test(w.raw)))
+            return false;
+    }
+    return true;
+}
+function flagWalk(args, row, program) {
+    let i = 0;
+    while (i < args.length) {
+        let word = args[i];
+        if (word === "") {
+            i++;
+            continue;
+        }
+        if (program === "xargs" && (!word.startsWith("-") || word === "--")) {
+            if (word === "--" && i + 1 < args.length) {
+                i++;
+                word = args[i];
+            }
+            return XARGS_TARGETS.includes(word);
+        }
+        if (word === "--") {
+            if (row.respectsDoubleDash !== false)
+                break;
+            i++;
+            continue;
+        }
+        if (FLAG_WORD.test(word)) {
+            const eq = word.indexOf("=");
+            const flag = eq === -1 ? word : word.slice(0, eq);
+            const attached = eq === -1 ? undefined : word.slice(eq + 1);
+            const arity = row.safeFlags[flag];
+            if (arity === undefined) {
+                if (program === "git" && /^-\d+$/.test(flag)) {
+                    i++;
+                    continue;
+                }
+                if ((program === "grep" || program === "egrep" || program === "fgrep" || program === "rg") && !flag.startsWith("--") && flag.length > 2) {
+                    const base = flag.slice(0, 2);
+                    const rest = flag.slice(2);
+                    const baseArity = row.safeFlags[base];
+                    if (baseArity !== undefined && /^\d+$/.test(rest) && (baseArity === "number" || baseArity === "string")) {
+                        if (FLAG_VALUE_ACCEPTS[baseArity](rest)) {
+                            i++;
+                            continue;
+                        }
+                        return false;
+                    }
+                }
+                if (!flag.startsWith("--") && flag.length > 2) {
+                    for (let c = 1; c < flag.length; c++)
+                        if (row.safeFlags[`-${flag[c]}`] !== "none")
+                            return false;
+                    i++;
+                    continue;
+                }
+                return false;
+            }
+            if (arity === "none") {
+                if (attached !== undefined)
+                    return false;
+                i++;
+                continue;
+            }
+            let value;
+            if (attached !== undefined) {
+                value = attached;
+                i++;
+            }
+            else {
+                const next = args[i + 1];
+                if (next === undefined || FLAG_WORD.test(next))
+                    return false;
+                value = next;
+                i += 2;
+            }
+            if (arity === "string" && value.startsWith("-") && !(flag === "--sort" && program === "git" && /^-[a-zA-Z]/.test(value)))
+                return false;
+            if (!FLAG_VALUE_ACCEPTS[arity](value))
+                return false;
+            continue;
+        }
+        i++;
+    }
+    return true;
+}

package/dist/core/roles.d.ts

@@ -104,8 +104,9 @@ export interface ResolvedRole {
  * `modelRole` and NO run model: it runs on the deployment's roles alone — the boot default at the end of
  * its chain — and never follows the model a run was switched to. Only a run's CHILDREN follow the parent:
  * the delegation seat (`childModelSeat`) passes the parent's `Model` as `spec.model` with the role kept
- * on `modelRole`, so the role's presets still apply. A side channel that must follow a run passes that
- * run's model explicitly; nothing here infers it.
+ * on `modelRole` — and keeps that role on an EXPLICIT-model seat too, so the explicit branch below reads
+ * the child's presets off the subagent role, not the default one. A side channel that must follow a run
+ * passes that run's model explicitly; nothing here infers it.
  */
 export declare function resolveTaskModel(spec: {
     model?: ModelRef;

package/dist/core/runner/contracts.d.ts

@@ -2424,3 +2424,73 @@ export interface RunnerSelfSeat {
     /** Streaming form of {@link RunnerSelfSeat.resume}: the pre-CAS guards and the CAS run first, then the live stream is returned. */
     resumeStream(token: CheckpointToken, outcome: ResumeOutcome, taskConfig: ResumeTaskConfig, internals?: RunInternals): Promise<TaskStream>;
 }
+/** The live-task handle `runLocked` publishes once the harness exists (design/47): the harness + abort
+ *  controller, the loop-liveness latch (`ended` flips when the single `harness.prompt` settles; `userInterrupted`
+ *  / `userHalted` are the interrupt and halt verbs' attribution seats), the run's reminder mark, its session and
+ *  engine-minted run id, and the hook bound + identity envelope the steer entrance screen runs under. */
+export interface LiveHandle {
+    harness: AgentHarness;
+    abortController: AbortController;
+    loop: {
+        ended: boolean;
+        userInterrupted: boolean;
+        userHalted: boolean;
+    };
+    reminderMark: string;
+    sessionId: string;
+    /** #499 — the run body's engine-minted run id, so the stream-layer verbs can name the run their disclosures are about. */
+    runId: string;
+    hookTimeoutMs: number;
+    hookIdentity: HookInvocationIdentity;
+}
+/** The run body's backstop CARRIER (F-05/W8/件①/#327/#499/#281 r2-D2): the effective ids and the post-prepare
+ *  observations the run body publishes as they are minted, so the stream layer's failure backstop names the
+ *  same run, session and observations the frames the run body already emitted did. */
+export interface TaskIdRef {
+    current?: string;
+    sessionId?: string;
+    runId?: string;
+    effectiveMemoryScopes?: TaskResult["effectiveMemoryScopes"];
+    effectiveReasoning?: TaskResult["effectiveReasoning"];
+    delegationTerminalOwed?: HookInvocationIdentity;
+    editedFiles?: () => TaskResult["editedFiles"];
+}
+/** design/99 MF-18 — the manual `/compact` request seat: the `requested` flag, the parked waiters (each with its
+ *  caller's cancel signal and per-call instructions), the run body's mooted-frame channel and the registration
+ *  gate the run-end backstop closes before its final drain. */
+export interface ManualCompactRef {
+    requested: boolean;
+    waiters: Array<{
+        resolve: (outcome: CompactOutcome) => void;
+        signal?: AbortSignal;
+        instructions?: string;
+    }>;
+    emitMooted?: (reason: string) => void;
+    closed?: boolean;
+}
+/** design/144 §2 — the `notify()` bridge: `runLocked` binds `inject` the moment the task-notification lane exists. */
+export interface NotifyRef {
+    inject?: (n: TaskNotificationPayload, opts?: {
+        priority?: SystemInjectionPriority;
+    }) => void;
+}
+/** design/383 §2.1 — the capture opt-out flip verb's binding; bound only when the run mounted a memory session. */
+export interface CaptureOptOutRef {
+    flip?: (reason?: string) => Promise<{
+        outcome: "created" | "existed";
+    }>;
+}
+/**
+ * The stream's LIVE state as the verb lanes read it — a view over the driver's own locals (getters, and one
+ * setter), never a copy: `resultValue` is written by the run body's `setResult` callback and by the failure
+ * backstop, `handle` by the run body's `onReady`, `reapHandle` by its `onSuspend`; every lane reads each of them
+ * at the instant of its own read, exactly as the one-function façade read the closure variables.
+ */
+export interface TaskStreamLiveSeat {
+    /** The assembled result once the run settled (the run body's `setResult`, or the failure backstop's mint). */
+    resultValue: TaskResult | undefined;
+    /** The live-task handle once `runLocked` published it; `undefined` before, and forever when prepare threw. */
+    readonly handle: LiveHandle | undefined;
+    /** design/51 — what `destroy()` reaps when the run SUSPENDED; unset for every other terminal state. */
+    readonly reapHandle: SuspendReap | undefined;
+}

package/dist/core/runner/gate-exit.d.ts

@@ -218,6 +218,11 @@ export interface GatePass {
      *  touch. Recorded by the gate rather than read off `decisionReason` because that member is a policy's to
      *  compose (a policy stamping `"safety"` on its own ask must read as `policy`). Writer: the fold. */
     tightenedBy: AskOriginFacts["tightened"];
+    /** borrowed-mutable — the reversibility probe was consulted on this pass and DID NOT ANSWER (it threw or
+     *  timed out). The out-of-root mandate has no other source than the probe's answer, so an unanswered probe
+     *  leaves the call's boundary UNKNOWN: the allow layer (a stored allow rule, the read-only reader) must
+     *  not clear the surviving ask — a person confirms it. Writer: the fold. Reader: the lanes' mandate. */
+    probeUnanswered?: true;
     /** borrowed-mutable — the rewrite remembered BEFORE a hook-ask promotion / tighten, re-applied on the
      *  approved path (a redaction is not cancelled because a person confirmed). Writer: the fold. Readers: the
      *  fold's probe and write-protection judges, the lanes, the allow exit. */

package/dist/core/runner/prepare-caps-and-workflow.js

@@ -7,7 +7,7 @@ import { isSelfOrchestrationActive } from "../../orchestration/workflow-script-r
 import { resolveWorkflowSizeGuideline } from "../../orchestration/workflow-size-guideline.js";
 import { thinkingOffExpressible } from "../../brain/reasoning.js";
 import { autoModeArmingRecipeOf } from "../auto-mode-arming.js";
-import { AUTO_MODE_CLASSIFIER_MAX_TOKENS } from "../auto-mode-defaults.js";
+import { AUTO_MODE_CLASSIFIER_LOW_REASONING_BUDGET_TOKENS, AUTO_MODE_CLASSIFIER_MAX_TOKENS } from "../auto-mode-defaults.js";
 import { buildAutoModePrompt, renderAutoModeAction, renderAutoModeWindow } from "../auto-mode-prompt.js";
 import { createAutoModeDecider, createAutoModeDenialTracker } from "../auto-mode.js";
 import { resolveCheckpointStore } from "../checkpoint-store.js";
@@ -17,9 +17,21 @@ import { resolveTaskModel } from "../roles.js";
 import { brainToRuntime } from "../runtime.js";
 import { defaultTaskRegistry } from "../task-registry.js";
 import { emitTrace } from "../trace.js";
-import { defineTool, isDefineToolProduct } from "../tools.js";
+import { defineTool, isDefineToolProduct, rebindDefineToolCtx } from "../tools.js";
+const MOUNT_REMEDY = "author it as a plain-object ToolSpec (own `name` and `execute`), hand the defineTool product itself, or wrap a product through the supported wrapper form (a fresh object re-stamped with `stampDefineToolBrand` whose rebind re-wraps the rebound product)";
 import { derivedRouteFallsBack } from "./derived-route-fallback.js";
 import { REPORT_FINDINGS_TOOL_NAME, createReportBlockedTool, createReportFindingsTool } from "./synthetic-tools.js";
+function classifierReplyText(reply) {
+    return reply.content
+        .filter((c) => c.type === "text")
+        .map((c) => c.text)
+        .join("");
+}
+function classifierReplyEmptyAtCap(reply) {
+    if (classifierReplyText(reply) !== "")
+        return false;
+    return reply.stopReason === "length" || (reply.stopReason === "error" && reply.errorKind === "length_empty");
+}
 import { RosterBuilder, callerMountSource } from "../tool-roster.js";
 function assembleParentCaptureState(o, i, ctl, ancestors) {
     const build = (optedOut, indeterminate) => ({
@@ -71,9 +83,21 @@ export async function prepareCapsAndWorkflow(input) {
         const mounted = mountCallerTool(t);
         roster.mount(mounted, { source: callerMountSource(mounted), mountedBy: "scenario" });
     }
+    function specArmCanConstruct(t) {
+        if (typeof t !== "object" || t === null)
+            return false;
+        const name = Object.getOwnPropertyDescriptor(t, "name");
+        const execute = Object.getOwnPropertyDescriptor(t, "execute");
+        return name !== undefined && "value" in name && typeof name.value === "string" && name.enumerable === true && execute !== undefined && "value" in execute && typeof execute.value === "function" && execute.enumerable === true;
+    }
     function mountCallerTool(t) {
-        if (isDefineToolProduct(t)) {
-            return maybeOffload(t, t);
+        if (isDefineToolProduct(t))
+            return maybeOffload(rebindDefineToolCtx(t, enrichSpecToolCtx), t);
+        if (!specArmCanConstruct(t)) {
+            const shown = Object.getOwnPropertyDescriptor(t, "name")?.value;
+            const e = new Error(`spec.tools entry ${typeof shown === "string" ? JSON.stringify(shown) : "(no own name)"}: the ToolSpec arm rebuilds a caller tool from its OWN enumerable members, and this entry does not carry a string \`name\` and a function \`execute\` as own properties (a class instance, a prototype child of a spec or of a defineTool product, a function, or a Proxy over one) — ${MOUNT_REMEDY}`);
+            e.code = "config.tool_mount_denied";
+            throw e;
         }
         return maybeOffload(defineTool({
             ...t,
@@ -165,7 +189,9 @@ export async function prepareCapsAndWorkflow(input) {
         const classifierLaneRule = peerLaneActive && peerSendMessageBuiltIn;
         const classifierSystemPrompt = buildAutoModePrompt(classifierLaneRule ? { ...am, crossSessionMessagesRule: CROSS_SESSION_CLASSIFIER_RULE } : am);
         const classifierRuntime = brainToRuntime(deps.brain);
-        const classifierCap = thinkingOffExpressible(classifierModel) ? { maxTokens: AUTO_MODE_CLASSIFIER_MAX_TOKENS } : {};
+        const classifierOffSeat = { reasoning: "off", maxTokens: AUTO_MODE_CLASSIFIER_MAX_TOKENS };
+        const classifierLowSeat = { reasoning: "low", maxTokens: AUTO_MODE_CLASSIFIER_MAX_TOKENS + AUTO_MODE_CLASSIFIER_LOW_REASONING_BUDGET_TOKENS };
+        const classifierSeat = thinkingOffExpressible(classifierModel) ? classifierOffSeat : classifierLowSeat;
         autoModeDenialTracking = createAutoModeDenialTracker(am.denialLimit);
         autoModeDecider = createAutoModeDecider({
             ...(am.timeoutMs !== undefined ? { timeoutMs: am.timeoutMs } : {}),
@@ -191,17 +217,17 @@ export async function prepareCapsAndWorkflow(input) {
                     (m.role === "user" || m.role === "assistant" || m.role === "toolResult"));
                 const userPrompt = renderAutoModeWindow(known, am.window) + renderAutoModeAction(input);
                 const classifierAuth = await spec.getApiKeyAndHeaders?.(classifierModel);
-                const response = await classifierRuntime.completeSimple(classifierModel, { systemPrompt: classifierSystemPrompt, messages: [{ role: "user", content: userPrompt, timestamp: Date.now() }] }, {
+                const request = (seat) => classifierRuntime.completeSimple(classifierModel, { systemPrompt: classifierSystemPrompt, messages: [{ role: "user", content: userPrompt, timestamp: Date.now() }] }, {
                     signal,
-                    reasoning: "off",
-                    ...classifierCap,
+                    ...seat,
                     ...(classifierAuth?.apiKey !== undefined ? { apiKey: classifierAuth.apiKey } : {}),
                     ...(classifierAuth?.headers !== undefined ? { headers: classifierAuth.headers } : {}),
                 });
-                return response.content
-                    .filter((c) => c.type === "text")
-                    .map((c) => c.text)
-                    .join("");
+                let response = await request(classifierSeat);
+                if (classifierSeat === classifierOffSeat && classifierReplyEmptyAtCap(response)) {
+                    response = await request(classifierLowSeat);
+                }
+                return classifierReplyText(response);
             },
         });
         if (am.persistArming === true)

package/dist/core/runner/prepare-gate-stations.js

@@ -139,6 +139,15 @@ export function prepareGateStations(input) {
                                 },
                             }
                             : {}),
+                        onReadOnlyAllowed: (info) => emitTrace(deps.tracer, () => ({
+                            kind: "permission.read_only_allowed",
+                            version: 1,
+                            taskId: hostTaskId,
+                            toolName: info.toolName,
+                            toolCallId: info.toolCallId,
+                            command: info.command,
+                            ts: Date.now(),
+                        })),
                         ...(permissionRuleOrgLane
                             ? {
                                 orgRules: {

package/dist/core/runner/prepare-task.js

@@ -634,7 +634,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             session,
             tools: [...harnessTools],
             model,
-            thinkingLevel: thinking ?? "off",
+            thinkingLevel: thinking,
             systemPrompt: systemPromptSeat.current,
             ...(systemBlocks ? { systemBlocks } : {}),
             getApiKeyAndHeaders: spec.getApiKeyAndHeaders,

package/dist/core/runner/prepare-turn-wiring.js

@@ -26,7 +26,7 @@ export function prepareTurnWiring(input) {
         layoutGroups: (systemBlocks ?? [{ groupId: "body", cacheControlBoundary: true }]).map((b) => ({ groupId: b.groupId, cacheControlBoundary: b.cacheControlBoundary })),
         stableSystemText: systemPromptSeat.current,
         toolWire: toolsToFingerprintInputs(harnessTools),
-        thinkingLevel: (thinking ?? "off"),
+        thinkingLevel: thinking ?? null,
         maxTokens: model.maxTokens,
         hasOutputSchema: spec.outputSchema !== undefined,
         sessionId,