@sema-agent/core 7.17.7 → 7.18.0

package/dist/prompts/default.js

@@ -109,10 +109,14 @@ You have no persistent memory store: what is said in this conversation is not au
 export const CYBER_RISK = `IMPORTANT: Assist with authorized security testing, defensive security, CTF challenges, and educational contexts. Refuse requests for destructive techniques, DoS attacks, mass targeting, supply chain compromise, or detection evasion for malicious purposes. Dual-use security tools (C2 frameworks, credential testing, exploit development) require clear authorization context: pentesting engagements, CTF competitions, security research, or defensive use cases.`;
 export const URL_SAFETY = `IMPORTANT: You must NEVER generate or guess URLs for the user unless you are confident that the URLs are for helping the user with programming. You may use URLs provided by the user in their messages or local files.`;
 export const SUMMARIZE_TOOL_RESULTS = `When working with tool results, write down any important information you might need later in your own response, as the original tool result may be cleared or summarized from the context later.`;
-function executionEnvironmentBlock(openReads) {
-    const readWriteLine = openReads
-        ? "- You can read files anywhere this environment exposes (a small sensitive-path deny list applies), and write within the project working directory. Writes outside it, or to system paths, may be denied by the environment or the permission policy."
-        : "- You can read and write within the project working directory. Writes outside it, or to system paths, may be denied by the environment or the permission policy.";
+const READ_WRITE_BULLET = {
+    "roots/roots": "- You can read and write within the project working directory. Writes outside it, or to system paths, may be denied by the environment or the permission policy.",
+    "open/roots": "- You can read files anywhere this environment exposes (a small sensitive-path deny list applies), and write within the project working directory. Writes outside it, or to system paths, may be denied by the environment or the permission policy.",
+    "roots/open": "- You can read within the project working directory, and write files anywhere this environment exposes (a small protected-path list still applies). Writes to system paths may still be denied by the environment or the permission policy.",
+    "open/open": "- You can read and write files anywhere this environment exposes (small sensitive-path and protected-path lists still apply). Writes to system paths may still be denied by the environment or the permission policy.",
+};
+export function executionEnvironmentBlockFor(faces = {}) {
+    const readWriteLine = READ_WRITE_BULLET[`${faces.readOpen === true ? "open" : "roots"}/${faces.writeOpen === true ? "open" : "roots"}`];
     return `# Execution environment
 Commands run inside an isolated execution environment (a managed container or remote host), not on the operator's machine. Within it:
 ${readWriteLine}
@@ -125,8 +129,8 @@ When a command fails, identify the cause before retrying:
 
 If a restriction genuinely blocks a necessary action, do NOT attempt to circumvent it (no privilege escalation, no disabling of guards, no destructive workarounds). Adjust your approach, or surface the limitation to the user with the specific evidence you saw.`;
 }
-export const EXECUTION_ENVIRONMENT = executionEnvironmentBlock(false);
-export const EXECUTION_ENVIRONMENT_OPEN_READS = executionEnvironmentBlock(true);
+export const EXECUTION_ENVIRONMENT = executionEnvironmentBlockFor();
+export const EXECUTION_ENVIRONMENT_OPEN_READS = executionEnvironmentBlockFor({ readOpen: true });
 export const WORKTREE_NOTICE = `# Isolated worktree
 This task runs in its own isolated git worktree — a separate working copy whose root is the working directory shown in # Environment, NOT the repository's main checkout. Any absolute path you were given that points at the main checkout (or another worktree) refers to a DIFFERENT copy; translate it to the same relative path under this worktree's root before reading or writing, and operate only within this worktree. A file's content here may differ from the main checkout, so re-read a file in this worktree before editing it rather than assuming an earlier or external view is current.`;
 export const WORKTREE_STASH_WARNING = "The git stash stack is shared with the main checkout and all other worktrees, and other agent sessions may push or pop it concurrently. " +
@@ -162,8 +166,9 @@ export function harnessHeadLines(ctx) {
 }
 export function harnessContext(ctx) {
     const blocks = [harnessHeadLines(ctx), CYBER_RISK, URL_SAFETY, SUMMARIZE_TOOL_RESULTS];
-    if (ctx.policyEnabled || ctx.isolationEnabled)
-        blocks.push(ctx.readFaceOpen === true ? EXECUTION_ENVIRONMENT_OPEN_READS : EXECUTION_ENVIRONMENT);
+    if (ctx.policyEnabled || ctx.isolationEnabled) {
+        blocks.push(executionEnvironmentBlockFor({ readOpen: ctx.readFaceOpen === true, writeOpen: ctx.writeFaceOpen === true }));
+    }
     if (ctx.promptProfile !== "classic") {
         blocks.push(ctx.fableMitigations === true ? SIMPLE_COMMUNICATING_FABLE : SIMPLE_COMMUNICATING_LEAN);
         blocks.push(SIMPLE_PRONOUNS);
@@ -259,6 +264,9 @@ export function buildEnvironmentContext(facts) {
     if (facts.readFace === "open") {
         lines.push("File reads are not confined to the workspace root. A small sensitive-path deny list applies (see refusals for the exact pattern).");
     }
+    if (facts.writeFace === "open") {
+        lines.push("File writes are not confined to the workspace root. A small protected-path list still applies, and every write still passes the deployment's approval policy (see refusals for the exact reason).");
+    }
     if (facts.isGitRepo !== undefined)
         lines.push(`Is a git repository: ${facts.isGitRepo ? "yes" : "no"}`);
     if (facts.gitWorktreeRoot)

package/dist/tools/artifact/artifact-text.d.ts

@@ -6,6 +6,7 @@
  * neutral phrase. The replacement list is registered in the divergence register beside this package.
  */
 import type { ArtifactAction, ArtifactPlane } from "../../core/artifact-host.js";
+import type { AssertAllKeysHandled } from "../../core/ask-origin.js";
 /** Opening sentence of the hosted face (`U$t`, line 51145; "hosted on claude.ai" replaced). */
 export declare const HOSTED_OPENING = "Render an HTML file to an Artifact \u2014 a default-private web page hosted by this deployment's artifact host. Use this when communicating visually would be clearer than terminal text. Publishing proactively is fine for your own work-product \u2014 artifacts start private. The exception is content that could mislead or cause harm if shared onward: anything imitating a real organization, person, or record, or content the user framed as sensitive. Build those as files, and let the user decide whether they get a URL.";
 /** The title rule (`G$t`, line 51145). */
@@ -54,7 +55,15 @@ export declare const PARAM_TEXT: {
     readonly scope: "list only: 'mine' (default) lists artifacts the user owns — the only ones the update flow can target; 'shared' lists artifacts other people shared with the user (read-only); 'all' lists both. Rows are labeled (mine)/(shared) whenever scope is not 'mine'.";
     readonly path: "read_file only: the published path of the file to return (as listed by 'list_files').";
 };
-/** The tool description for a face: the plane picks the opening, the declared actions pick the paragraphs. */
+/** The opening paragraphs of each declared plane: the hosted opening with its title rule, or the two stub sentences
+ *  (the stub names no gallery, so no title rule). Every paragraph after the opening is keyed on a declared action. */
+export declare const ARTIFACT_PLANE_OPENING: {
+    readonly hosted: readonly ["Render an HTML file to an Artifact — a default-private web page hosted by this deployment's artifact host. Use this when communicating visually would be clearer than terminal text. Publishing proactively is fine for your own work-product — artifacts start private. The exception is content that could mislead or cause harm if shared onward: anything imitating a real organization, person, or record, or content the user framed as sensitive. Build those as files, and let the user decide whether they get a URL.", "**Title**: Set a `<title>` at the top of the HTML — only the first 8KB of the file is scanned for it. It names the artifact in the browser tab and gallery, so make it a name, not a summary: a short noun phrase, typically two to four words, distinctive to this page's subject so the reader can pick it out of a gallery of many — the way an app or a document gets named, never a generic category label, and never a name plus an appended explainer after a dash or colon. When a natural title pairs the name with a generic word, the name is the half that survives the trim — keeping the generic half and dropping the identity makes the title worse, not shorter. And trim only actual explainers: a multi-word title that already reads as one specific name is finished as it is. The explanation belongs in the `description` parameter instead: pass a one-sentence `description` — it becomes the gallery card's subtitle. For HTML publishes, a `title` parameter fills in when the file has no tag (Markdown pages always keep their filename identity). Keep the title stable across redeploys."];
+    readonly "local-stub": readonly ["This eval run stubs artifact publishing locally and has no artifact control plane: only publishing (the default action) is available here — list, delete, comments, replies, watches, database writes, asset uploads, and live docs are not.", "This eval run stubs artifact publishing locally: `url` may only name an artifact this run published (an eval-stub:// link), never an artifact hosted anywhere else. Omit `url` to publish fresh."];
+};
+export type OpeningTableCoversEveryPlane = AssertAllKeysHandled<Exclude<ArtifactPlane, keyof typeof ARTIFACT_PLANE_OPENING>>;
+/** The tool description for a face: the plane's opening, the update rule, one paragraph per declared action, and the
+ *  comments disclosure — no host declares a comments action in this version, so its absence is a fact of every face. */
 export declare function artifactDescription(plane: ArtifactPlane, actions: ReadonlyArray<ArtifactAction>): string;
 /** The `url` parameter's description for a face: the list hint and the read clause ride only with their actions. */
 export declare function urlDescription(actions: ReadonlyArray<ArtifactAction>): string;

package/dist/tools/artifact/artifact-text.js

@@ -33,11 +33,13 @@ export const PARAM_TEXT = {
     scope: "list only: 'mine' (default) lists artifacts the user owns — the only ones the update flow can target; 'shared' lists artifacts other people shared with the user (read-only); 'all' lists both. Rows are labeled (mine)/(shared) whenever scope is not 'mine'.",
     path: "read_file only: the published path of the file to return (as listed by 'list_files').",
 };
+export const ARTIFACT_PLANE_OPENING = {
+    hosted: [HOSTED_OPENING, TITLE_RULE],
+    "local-stub": [STUB_PUBLISH_ONLY, STUB_OWN_MINT_ONLY],
+};
 export function artifactDescription(plane, actions) {
-    if (plane === "local-stub")
-        return [STUB_PUBLISH_ONLY, STUB_OWN_MINT_ONLY, UPDATE_RULE, COMMENTS_NOT_ENABLED].join("\n\n");
     const has = (a) => actions.includes(a);
-    const parts = [HOSTED_OPENING, TITLE_RULE, UPDATE_RULE];
+    const parts = [...ARTIFACT_PLANE_OPENING[plane], UPDATE_RULE];
     if (has("list") && has("read"))
         parts.push(UPDATE_FROM_EARLIER_RULE);
     if (has("read"))
@@ -48,6 +50,7 @@ export function artifactDescription(plane, actions) {
         parts.push(LIST_FILES_RULE);
     if (has("read_file"))
         parts.push(READ_FILE_RULE);
+    parts.push(COMMENTS_NOT_ENABLED);
     return parts.join("\n\n");
 }
 export function urlDescription(actions) {

package/dist/tools/artifact/artifact-tool.d.ts

@@ -1,4 +1,5 @@
 import { type ArtifactHost, type ArtifactHostCapabilities } from "../../core/artifact-host.js";
+import { type OnAsk } from "../../core/tool-policy.js";
 import type { ToolSpec } from "../../core/types.js";
 /** What the engine's local-file reader hands back: the canonical key (the path-binding key) and the bytes, or one of
  *  three refusals — the fence's own (`refused`, with its text and card), a file over the byte budget the caller
@@ -35,11 +36,20 @@ export interface ArtifactToolOptions {
     /** The engine's fs-gated single read of a model-named local file (one read per call; the bytes read are the bytes
      *  published); `maxBytes` is the budget left for this file, judged on metadata before the read. */
     readLocalFile: (path: string, maxBytes: number, signal?: AbortSignal) => Promise<ArtifactLocalRead>;
+    /** The run's effective approver — the same frozen seat the tool gate resolves asks at (`frozenOnAsk` =
+     *  `spec.onAsk ?? deps.onAsk`), riding the MOUNT dep under the same rule as the workflow mount's `parentOnAsk`: a core
+     *  mount's execute ctx is minimal, so the seat never rides `ctx`. The shared-read consent gate resolves at it. Absent
+     *  = the run has no ask face, and a shared read is then REFUSED fail-closed (`artifact.refused`, content withheld) —
+     *  never silently delivered. */
+    onAsk?: OnAsk;
 }
+/** Supporting files per publish (upstream cap); enforced in the schema AND in the body, for callers that bypass the schema. */
+export declare const MAX_FILES_PER_PUBLISH = 255;
 export declare function mediaTypeOf(path: string): string;
 export declare function isTextMedia(mediaType: string | undefined): boolean;
-/** One opaque key per tool-call OCCURRENCE (a gateway may reuse a call id across turns; `occurrence` counts prior
- *  executions of that id in the run), stable for any host retry inside that execution: the host's idempotency key. */
+/** One opaque key per HOST CALL (`occurrence` counts prior host calls made under that tool-call id in this run — so a
+ *  gateway that reuses a call id across turns never replays, and neither do two host calls of ONE execution), stable
+ *  for any retry the host itself makes of that call: the host's idempotency key. */
 export declare function artifactAttemptId(runId: string, toolCallId: string, occurrence?: number): string;
 /** A published path: relative, forward-slash, no dot segments, no NUL, no backslash; returns the NFC form or the refusal. */
 export declare function normalizePublishedPath(raw: string): {

package/dist/tools/artifact/artifact-tool.js

@@ -1,11 +1,13 @@
 import { createHash } from "node:crypto";
 import { Type } from "typebox";
-import { ARTIFACT_FAILURE_RESULT_CODE, ARTIFACT_HOST_ERROR_CODE, ARTIFACT_LIST_SCOPES, ARTIFACT_PLANE_CONTENT_ORIGIN, ARTIFACT_PUBLISH_CONTEXTS, } from "../../core/artifact-host.js";
+import { ARTIFACT_ACTION_CONCURRENCY_SAFE, ARTIFACT_COMMIT_THROW_OUTCOME, ARTIFACT_FAILURE_RESULT_CODE, ARTIFACT_HOST_ERROR_CODE, ARTIFACT_LIST_SCOPES, ARTIFACT_PLANE_CONTENT_ORIGIN, ARTIFACT_PUBLISH_CONTEXTS, } from "../../core/artifact-host.js";
 import { ARTIFACT_TOOL_NAME, toolFace } from "../../core/tool-catalog-entries.js";
+import { resolveAsk } from "../../core/tool-policy.js";
 import { errorResult } from "../../core/tools.js";
 import { inlineUntrusted } from "../../core/untrusted-text.js";
 import { actionDescription, artifactDescription, PARAM_TEXT, urlDescription } from "./artifact-text.js";
-const MAX_FILES_PER_PUBLISH = 255;
+import { ARTIFACT_REJECT_BREAKER_THRESHOLD, artifactRejectBannerFor, artifactRejectKeyOf, createArtifactRejectBreaker } from "./reject-breaker.js";
+export const MAX_FILES_PER_PUBLISH = 255;
 const LIST_LIMIT_DEFAULT = 25;
 const LIST_LIMIT_MAX = 100;
 const BINARY_NOTE_MEDIA = new Set(["application/json", "application/javascript", "text/javascript", "image/svg+xml", "application/xml"]);
@@ -125,36 +127,42 @@ function buildSchema(caps) {
 const invalid = (text) => errorResult(`Error (Artifact): ${text}`, { type: "artifact", invalidArguments: true });
 const typed = (code, text, extra = {}) => errorResult(`Error (Artifact): ${text}`, { type: "artifact", code: ARTIFACT_FAILURE_RESULT_CODE[code], ...extra });
 export function createArtifactTool(opts) {
-    const { host, capabilities: caps, runId, taskId, sessionId, agentName, readLocalFile } = opts;
+    const { host, capabilities: caps, runId, taskId, sessionId, agentName, readLocalFile, onAsk } = opts;
     const versions = new Map();
     const bindings = new Map();
     const occurrences = new Map();
+    const breaker = createArtifactRejectBreaker();
+    const ownUrls = new Set();
+    const sharedUrls = new Set();
+    const sharedReadApproved = new Set();
+    const consentInFlight = new Map();
+    const activeTargets = new Map();
     const hasAction = (a) => caps.actions.includes(a);
     const rememberRef = (ref) => {
         versions.set(ref.url, ref.version);
     };
-    const attemptIdOf = (ctx) => {
+    const rememberOwner = (url, owner) => {
+        (owner === "mine" ? ownUrls : sharedUrls).add(url);
+    };
+    const nextContext = (ctx) => {
         const n = occurrences.get(ctx.toolCallId) ?? 0;
         occurrences.set(ctx.toolCallId, n + 1);
-        return artifactAttemptId(runId, ctx.toolCallId, n);
+        return {
+            taskId,
+            ...(sessionId !== undefined ? { sessionId } : {}),
+            ...(agentName !== undefined ? { agentName } : {}),
+            runId,
+            attemptId: artifactAttemptId(runId, ctx.toolCallId, n),
+        };
     };
-    const contextFor = (attemptId) => ({
-        taskId,
-        ...(sessionId !== undefined ? { sessionId } : {}),
-        ...(agentName !== undefined ? { agentName } : {}),
-        runId,
-        attemptId,
-    });
     const hostError = (verb, fault, url) => {
-        if (caps.plane === "local-stub" && fault.kind === "threw") {
-            return errorResult(`Error (Artifact): the local artifact stub failed before committing (${inlineUntrusted(fault.message, 200)}). Nothing was published; the call can be repeated.`, {
-                type: "artifact", code: ARTIFACT_HOST_ERROR_CODE, outcome: "not_executed", plane: caps.plane,
-            });
+        const outcome = fault.kind === "threw" ? ARTIFACT_COMMIT_THROW_OUTCOME[caps.commit] : "unknown";
+        const details = { type: "artifact", code: ARTIFACT_HOST_ERROR_CODE, outcome, plane: caps.plane, commit: caps.commit };
+        if (outcome === "not_executed") {
+            return errorResult(`Error (Artifact): the artifact host failed before committing (${inlineUntrusted(fault.message, 200)}). Nothing was published; the call can be repeated.`, details);
         }
         const verifiable = hasAction("read") && url !== "";
-        return errorResult(`Error (Artifact): the artifact host did not answer the ${verb.slice(0, 20)} (${inlineUntrusted(fault.message, 200)}). Whether it was applied is not known.${verifiable ? ` Verify with action: "read" on ${url.slice(0, 200)} before repeating the call.` : ""}`, {
-            type: "artifact", code: ARTIFACT_HOST_ERROR_CODE, outcome: "unknown", plane: caps.plane,
-        });
+        return errorResult(`Error (Artifact): the artifact host did not answer the ${verb.slice(0, 20)} (${inlineUntrusted(fault.message, 200)}). Whether it was applied is not known: it may already have been committed, so do not simply repeat the call.${verifiable ? ` Verify with action: "read" on ${url.slice(0, 200)} first.` : ""}`, details);
     };
     const notFoundOrForbidden = (code, url, message) => code === "not_found"
         ? typed(code, `no artifact at ${inlineUntrusted(url, 200)} (${inlineUntrusted(message, 200)}).`, { url })
@@ -173,42 +181,60 @@ export function createArtifactTool(opts) {
             }
         }
     };
+    const manifestOf = (a) => {
+        const mainNorm = normalizePublishedPath(basenameOf(a.file_path));
+        if (!mainNorm.ok)
+            return { ok: false, result: invalid(`the published name of ${inlineUntrusted(a.file_path, 200)} ${mainNorm.reason.slice(0, 80)}.`) };
+        const entries = [];
+        if (a.files === undefined || (Array.isArray(a.files) && a.files.length === 0))
+            return { ok: true, main: mainNorm.path, entries };
+        if (!caps.multiFile)
+            return { ok: false, result: invalid("this artifact host publishes single files only; `files` is not accepted.") };
+        if (!Array.isArray(a.files))
+            return { ok: false, result: invalid("`files` must be an array of { path, file_path } entries.") };
+        if (a.files.length > MAX_FILES_PER_PUBLISH)
+            return { ok: false, result: invalid(`\`files\` carries ${String(a.files.length).slice(0, 20)} entries; at most ${MAX_FILES_PER_PUBLISH} supporting files are accepted per publish.`) };
+        const seen = new Set([mainNorm.path.toLowerCase()]);
+        for (const entry of a.files) {
+            if (!isRecord(entry) || typeof entry["path"] !== "string" || typeof entry["file_path"] !== "string")
+                return { ok: false, result: invalid("every `files` entry must carry a string `path` and a string `file_path`.") };
+            const norm = normalizePublishedPath(entry["path"]);
+            if (!norm.ok)
+                return { ok: false, result: invalid(`files entry ${inlineUntrusted(entry["path"], 120)} ${norm.reason.slice(0, 80)}.`) };
+            const fold = norm.path.toLowerCase();
+            if (seen.has(fold))
+                return { ok: false, result: invalid(`files entry ${inlineUntrusted(norm.path, 120)} collides with another published path.`) };
+            seen.add(fold);
+            entries.push({ path: norm.path, file_path: entry["file_path"] });
+        }
+        return { ok: true, main: mainNorm.path, entries };
+    };
     async function publish(a, ctx) {
-        const attemptId = attemptIdOf(ctx);
-        if (a.file_path === undefined)
+        if (typeof a.file_path !== "string")
             return invalid("`file_path` is required to publish.");
+        const manifest = manifestOf(a);
+        if (!manifest.ok)
+            return manifest.result;
         const files = [];
         const budget = Math.min(caps.maxFileBytes, caps.maxTotalBytes);
         const first = await readLocalFile(a.file_path, budget, ctx.signal);
         if (!first.ok)
             return readRefusal(a.file_path, first);
-        files.push({ path: basenameOf(a.file_path), content: first.bytes, mediaType: mediaTypeOf(a.file_path) });
+        files.push({ path: manifest.main, content: first.bytes, mediaType: mediaTypeOf(manifest.main) });
         let total = first.bytes.byteLength;
         const url = a.url ?? bindings.get(first.key);
         if (url === undefined && (a.force === true || a.baseVersion !== undefined)) {
             return invalid("`force` and `baseVersion` only apply to an update — pass `url`, or republish the same file path this session already published.");
         }
-        if (a.files !== undefined && a.files.length > 0) {
-            if (!caps.multiFile)
-                return invalid("this artifact host publishes single files only; `files` is not accepted.");
-            const seen = new Set([files[0].path.normalize("NFC").toLowerCase()]);
-            for (const entry of a.files) {
-                const norm = normalizePublishedPath(entry.path);
-                if (!norm.ok)
-                    return invalid(`files entry ${inlineUntrusted(entry.path, 120)} ${norm.reason.slice(0, 80)}.`);
-                const fold = norm.path.toLowerCase();
-                if (seen.has(fold))
-                    return invalid(`files entry ${inlineUntrusted(norm.path, 120)} collides with another published path.`);
-                seen.add(fold);
-                const left = caps.maxTotalBytes - total;
-                if (left <= 0)
-                    return typed("payload_too_large", `the files already total ${String(total).slice(0, 20)} bytes; this host accepts at most ${String(caps.maxTotalBytes).slice(0, 20)} bytes per version.`, { limit: caps.maxTotalBytes, measured: total });
-                const r = await readLocalFile(entry.file_path, Math.min(caps.maxFileBytes, left), ctx.signal);
-                if (!r.ok)
-                    return readRefusal(entry.file_path, r);
-                total += r.bytes.byteLength;
-                files.push({ path: norm.path, content: r.bytes, mediaType: mediaTypeOf(norm.path) });
-            }
+        for (const entry of manifest.entries) {
+            const left = caps.maxTotalBytes - total;
+            if (left <= 0)
+                return typed("payload_too_large", `the files already total ${String(total).slice(0, 20)} bytes; this host accepts at most ${String(caps.maxTotalBytes).slice(0, 20)} bytes per version.`, { limit: caps.maxTotalBytes, measured: total });
+            const r = await readLocalFile(entry.file_path, Math.min(caps.maxFileBytes, left), ctx.signal);
+            if (!r.ok)
+                return readRefusal(entry.file_path, r);
+            total += r.bytes.byteLength;
+            files.push({ path: entry.path, content: r.bytes, mediaType: mediaTypeOf(entry.path) });
         }
         const baseVersion = a.baseVersion ?? (url !== undefined ? versions.get(url) : undefined);
         const req = {
@@ -222,12 +248,13 @@ export function createArtifactTool(opts) {
             ...(a.force === true ? { force: true } : {}),
             publishContext: a.publishContext ?? "plain",
         };
-        const call = await callHost("publish", () => host.publish(req, contextFor(attemptId)), ctx.signal);
+        const call = await callHost("publish", () => host.publish(req, nextContext(ctx)), ctx.signal);
         if (!call.ok)
             return hostError("publish", call, inlineUntrusted(url ?? "", 200));
         const out = call.value;
         if (out.ok) {
             rememberRef(out.ref);
+            rememberOwner(out.ref.url, "mine");
             bindings.set(first.key, out.ref.url);
             const title = out.ref.title !== undefined ? ` — ${inlineUntrusted(out.ref.title, 120)}` : "";
             return {
@@ -236,7 +263,12 @@ export function createArtifactTool(opts) {
             };
         }
         if (out.code === "conflict") {
-            const snapshot = out.current;
+            let snapshot = out.current;
+            if (snapshot !== "reread") {
+                const withheld = url === undefined || (await filesOwnership(url, ctx)) !== undefined;
+                if (withheld || (url !== undefined && sharedUrls.has(url) && !sharedReadApproved.has(url)))
+                    snapshot = "reread";
+            }
             if (snapshot !== "reread" && url !== undefined)
                 versions.set(url, out.currentVersion);
             const handedBack = snapshot === "reread"
@@ -266,56 +298,125 @@ export function createArtifactTool(opts) {
         }
     }
     async function list(a, ctx) {
-        const attemptId = attemptIdOf(ctx);
         const scope = a.scope ?? "mine";
         const limit = a.limit ?? LIST_LIMIT_DEFAULT;
-        const call = await callHost("list", () => host.list({ scope, limit }, contextFor(attemptId)), ctx.signal);
+        const call = await callHost("list", () => host.list({ scope, limit }, nextContext(ctx)), ctx.signal);
         if (!call.ok)
             return hostError("list", call, "");
         const out = call.value;
         if (!out.ok)
             return typed("refused", `the host refused the listing (${inlineUntrusted(out.message, 200)}).`);
+        for (const r of out.rows)
+            rememberOwner(r.url, r.owner);
         const lines = out.rows.map((r) => `${inlineUntrusted(r.url, 300)}  v${inlineUntrusted(r.version, 40)}  ${inlineUntrusted(r.updatedAt, 40)}  (${r.owner})${r.title !== undefined ? `  ${inlineUntrusted(r.title, 120)}` : ""}`);
         const body = lines.length === 0 ? "nothing listed" : lines.join("\n");
         return { content: `${body}${out.truncated ? "\n(more artifacts exist; raise `limit` to see them)" : ""}`, details: { type: "artifact", action: "list", plane: caps.plane, scope, rows: out.rows, truncated: out.truncated } };
     }
+    const sharedReadConsent = (url, ref, ctx) => {
+        if (sharedReadApproved.has(url))
+            return Promise.resolve({ ok: true });
+        const pending = consentInFlight.get(url);
+        if (pending !== undefined)
+            return pending;
+        const ask = (async () => {
+            const title = ref?.title !== undefined ? ` (${inlineUntrusted(ref.title, 120)})` : "";
+            const version = ref !== undefined ? `, version ${inlineUntrusted(ref.version, 60)}` : "";
+            const resolved = await resolveAsk({
+                toolName: ARTIFACT_TOOL_NAME,
+                toolCallId: ctx.toolCallId,
+                args: { action: "read", url },
+                message: `Read a shared artifact: ${inlineUntrusted(url, 300)}${title}${version} — an artifact another person shared with this user; approving covers re-reads of it for the rest of this run.`,
+                requiresRealApproval: true,
+            }, onAsk, ctx.signal);
+            if (resolved.action !== "allow")
+                return { ok: false, reason: resolved.message ?? "not approved" };
+            if (resolved.updatedInput !== undefined)
+                return { ok: false, reason: "the approval edited the request; an edited approval does not authorize the original target" };
+            sharedReadApproved.add(url);
+            return { ok: true };
+        })().finally(() => {
+            if (!activeTargets.has(url))
+                consentInFlight.delete(url);
+        });
+        consentInFlight.set(url, ask);
+        return ask;
+    };
+    const filesOwnership = async (url, ctx) => {
+        if (!ownUrls.has(url) && !sharedUrls.has(url)) {
+            if (!hasAction("read"))
+                return typed("refused", `${inlineUntrusted(url, 200)} is not an artifact this run published or listed as its own, and this host declares no read to establish who owns it; its files were not delivered.`, { url, sharedRead: "ownership_unknown" });
+            const probe = await callHost("read", () => host.read({ url }, nextContext(ctx)), ctx.signal);
+            if (!probe.ok)
+                return hostError("read", probe, inlineUntrusted(url, 200));
+            if (!probe.value.ok)
+                return notFoundOrForbidden(probe.value.code, url, probe.value.message);
+            if (probe.value.ref.url !== url)
+                return hostError("read", { kind: "malformed", message: "read.ref.url does not match the requested target" }, inlineUntrusted(url, 200));
+            rememberOwner(url, probe.value.isolatedSummary ? "shared" : "mine");
+        }
+        if (!sharedUrls.has(url))
+            return undefined;
+        const consent = await sharedReadConsent(url, undefined, ctx);
+        return consent.ok ? undefined : typed("refused", `reading the shared artifact ${inlineUntrusted(url, 200)} was not approved (${inlineUntrusted(consent.reason, 200)}); its files were not delivered.`, { url, sharedRead: "not_approved" });
+    };
     async function read(a, ctx) {
-        const attemptId = attemptIdOf(ctx);
         if (a.url === undefined)
             return invalid("`url` is required to read an artifact.");
-        const call = await callHost("read", () => host.read({ url: a.url }, contextFor(attemptId)), ctx.signal);
+        const call = await callHost("read", () => host.read({ url: a.url }, nextContext(ctx)), ctx.signal);
         if (!call.ok)
             return hostError("read", call, inlineUntrusted(a.url, 200));
         const out = call.value;
         if (!out.ok)
             return notFoundOrForbidden(out.code, a.url, out.message);
+        if (out.ref.url !== a.url)
+            return hostError("read", { kind: "malformed", message: "read.ref.url does not match the requested target" }, inlineUntrusted(a.url, 200));
+        rememberOwner(a.url, out.isolatedSummary ? "shared" : "mine");
+        if (sharedUrls.has(a.url)) {
+            const consent = await sharedReadConsent(a.url, out.ref, ctx);
+            if (!consent.ok)
+                return typed("refused", `reading the shared artifact ${inlineUntrusted(a.url, 200)} was not approved (${inlineUntrusted(consent.reason, 200)}); its content was not delivered.`, { url: a.url, sharedRead: "not_approved" });
+        }
         rememberRef(out.ref);
         const head = out.isolatedSummary ? `[isolated summary of a shared artifact — ${inlineUntrusted(out.ref.url, 300)}, version ${inlineUntrusted(out.ref.version, 60)}]\n` : "";
         return { content: `${head}${out.content}`, details: { type: "artifact", action: "read", plane: caps.plane, ref: out.ref, isolatedSummary: out.isolatedSummary } };
     }
     async function listFiles(a, ctx) {
-        const attemptId = attemptIdOf(ctx);
         if (a.url === undefined)
             return invalid("`url` is required to list an artifact's files.");
-        const call = await callHost("list_files", () => host.listFiles({ url: a.url }, contextFor(attemptId)), ctx.signal);
+        const gated = await filesOwnership(a.url, ctx);
+        if (gated !== undefined)
+            return gated;
+        const call = await callHost("list_files", () => host.listFiles({ url: a.url }, nextContext(ctx)), ctx.signal);
         if (!call.ok)
             return hostError("list_files", call, inlineUntrusted(a.url, 200));
         const out = call.value;
         if (!out.ok)
             return notFoundOrForbidden(out.code, a.url, out.message);
+        if (sharedUrls.has(a.url)) {
+            const denied = await filesOwnership(a.url, ctx);
+            if (denied !== undefined)
+                return denied;
+        }
         const lines = out.entries.map((e) => `${inlineUntrusted(e.path, 200)}  ${String(e.bytes).slice(0, 20)} bytes${e.mediaType !== undefined ? `  ${inlineUntrusted(e.mediaType, 80)}` : ""}`);
         return { content: lines.length === 0 ? "no files" : lines.join("\n"), details: { type: "artifact", action: "list_files", plane: caps.plane, url: a.url, entries: out.entries } };
     }
     async function readFile(a, ctx) {
-        const attemptId = attemptIdOf(ctx);
         if (a.url === undefined || a.path === undefined)
             return invalid("`url` and `path` are required to read a published file.");
-        const call = await callHost("read_file", () => host.readFile({ url: a.url, path: a.path }, contextFor(attemptId)), ctx.signal);
+        const gated = await filesOwnership(a.url, ctx);
+        if (gated !== undefined)
+            return gated;
+        const call = await callHost("read_file", () => host.readFile({ url: a.url, path: a.path }, nextContext(ctx)), ctx.signal);
         if (!call.ok)
             return hostError("read_file", call, inlineUntrusted(a.url, 200));
         const out = call.value;
         if (!out.ok)
             return notFoundOrForbidden(out.code, a.url, out.message);
+        if (sharedUrls.has(a.url)) {
+            const denied = await filesOwnership(a.url, ctx);
+            if (denied !== undefined)
+                return denied;
+        }
         return { content: renderFile(out.file), details: { type: "artifact", action: "read_file", plane: caps.plane, url: a.url, path: out.file.path, bytes: out.file.content.byteLength, mediaType: out.file.mediaType } };
     }
     return {
@@ -325,27 +426,59 @@ export function createArtifactTool(opts) {
         description: artifactDescription(caps.plane, caps.actions),
         parameters: buildSchema(caps),
         prepareArguments: (args) => (isRecord(args) && args["action"] === undefined ? { ...args, action: "publish" } : args),
-        execute: (args, ctx) => {
+        isConcurrencySafe: (args) => isRecord(args) && typeof args["action"] === "string" && ARTIFACT_ACTION_CONCURRENCY_SAFE[args["action"]] === true,
+        execute: async (args, ctx) => {
             const a = args;
             const action = a.action ?? "publish";
-            if (!hasAction(action))
-                return invalid(`action ${inlineUntrusted(String(action), 40)} is not available on this artifact host.`);
-            switch (action) {
-                case "publish":
-                    return publish(a, ctx);
-                case "list":
-                    return list(a, ctx);
-                case "read":
-                    return read(a, ctx);
-                case "list_files":
-                    return listFiles(a, ctx);
-                case "read_file":
-                    return readFile(a, ctx);
-                default: {
-                    const _exhaustive = action;
-                    return _exhaustive;
+            const target = typeof a.url === "string" ? a.url : undefined;
+            if (target !== undefined)
+                activeTargets.set(target, (activeTargets.get(target) ?? 0) + 1);
+            let result;
+            try {
+                result = await dispatch(action, a, ctx);
+            }
+            finally {
+                if (target !== undefined) {
+                    const left = activeTargets.get(target) - 1;
+                    if (left > 0)
+                        activeTargets.set(target, left);
+                    else {
+                        activeTargets.delete(target);
+                        consentInFlight.delete(target);
+                    }
                 }
             }
+            if (typeof result === "string" || result.isError !== true) {
+                breaker.clear();
+                return result;
+            }
+            const details = isRecord(result.details) ? result.details : {};
+            const reason = typeof details["code"] === "string" ? details["code"] : details["invalidArguments"] === true ? "invalid_arguments" : "error";
+            const text = typeof result.content === "string" ? result.content : "";
+            const count = breaker.hit(artifactRejectKeyOf(a), reason, text);
+            if (count < ARTIFACT_REJECT_BREAKER_THRESHOLD || typeof result.content !== "string")
+                return result;
+            return { ...result, content: `${artifactRejectBannerFor(reason)}\n\n${result.content}`, details: { ...details, rejectStreak: count } };
         },
     };
+    function dispatch(action, a, ctx) {
+        if (!hasAction(action))
+            return invalid(`action ${inlineUntrusted(String(action), 40)} is not available on this artifact host.`);
+        switch (action) {
+            case "publish":
+                return publish(a, ctx);
+            case "list":
+                return list(a, ctx);
+            case "read":
+                return read(a, ctx);
+            case "list_files":
+                return listFiles(a, ctx);
+            case "read_file":
+                return readFile(a, ctx);
+            default: {
+                const _exhaustive = action;
+                return _exhaustive;
+            }
+        }
+    }
 }

package/dist/tools/artifact/conformance.d.ts

@@ -0,0 +1,56 @@
+import { type ArtifactAction, type ArtifactHost, type ArtifactHostCapabilities, type ArtifactRef } from "../../core/artifact-host.js";
+export interface ArtifactConformanceHooks {
+    /** Make the host's NEXT write fail BEFORE its commit point (`arm`), then restore it (`disarm`). The atomicity vector
+     *  runs only with this hook: the kit cannot reach inside an arbitrary host. */
+    precommitFault?: {
+        arm: () => void | Promise<void>;
+        disarm: () => void | Promise<void>;
+    };
+    /** Save a new version of `ref`'s page from INSIDE the page — the version a plain `force` must not discard
+     *  (`force_refused`). The force-refusal vector runs only with this hook. */
+    pageSavedVersion?: (ref: ArtifactRef) => void | Promise<void>;
+}
+export interface ArtifactConformanceOptions {
+    hooks?: ArtifactConformanceHooks;
+    /** Run the at-limit POSITIVE arms of the byte-limit vector: they allocate and publish payloads of the declared
+     *  sizes. Default `false` — reported `skipped`, named. The over-limit refusal arms always run. */
+    largePayloads?: boolean;
+    /** The run id the kit mounts (`onMount`) and calls under; default a fresh uuid. */
+    runId?: string;
+}
+export type ArtifactConformanceStatus = "pass" | "fail" | "not_applicable" | "skipped";
+export interface ArtifactConformanceVector {
+    /** Stable id: a host's own conformance test keys on it. */
+    id: string;
+    describe: string;
+    /** Every listed action must be declared for the vector to apply. */
+    requiresActions: readonly ArtifactAction[];
+    requiresMultiFile?: true;
+    requiresHook?: keyof ArtifactConformanceHooks;
+    requiresLargePayloads?: true;
+}
+export interface ArtifactConformanceResult {
+    id: string;
+    status: ArtifactConformanceStatus;
+    /** What passed, what failed (the first violated expectation), or why the vector did not run. */
+    detail: string;
+}
+export interface ArtifactConformanceReport {
+    capabilities: ArtifactHostCapabilities;
+    runId: string;
+    results: readonly ArtifactConformanceResult[];
+    passed: number;
+    failed: number;
+    notApplicable: number;
+    skipped: number;
+}
+/** The full vector matrix (data; ids are stable). */
+export declare const ARTIFACT_CONFORMANCE_VECTORS: readonly ArtifactConformanceVector[];
+/** The vectors a host's DECLARATION covers (hook- and payload-gated vectors included: their gating is reported at run time). */
+export declare function artifactConformanceVectors(host: ArtifactHost): ArtifactConformanceVector[];
+/**
+ * Drive `host` through every vector its declaration covers, sequentially, under one fresh run id (the host's
+ * `onMount` is called first). Throws only when the declaration itself is invalid — every vector outcome, a thrown
+ * host method included, is a row of the report.
+ */
+export declare function runArtifactConformance(host: ArtifactHost, opts?: ArtifactConformanceOptions): Promise<ArtifactConformanceReport>;