@sema-agent/core 7.19.0 → 7.20.1

package/dist/core/runner/listing-fold.d.ts

@@ -0,0 +1,57 @@
+/**
+ * The ONE folding engine every listing frame renders through — the `<skills>` block, the skills drift
+ * frame's add arm, the agent-type roster and its drift frame's add arm. A listing is an intact-class
+ * turn attachment (`turn-attachments.ts` `ATTACHMENT_DELIVERY_CLASS`): the delivery lane never clips
+ * it, so this engine is the frame's whole bound, byte-exact over the caller's `frame` (headers, fences,
+ * markers, joiners included).
+ *
+ * Three honesty tiers over ONE set of items, each chosen with the LATER tiers' fixed overhead already
+ * reserved so the final render never blows the budget it was sized against:
+ *   A. everything fits → every item gets its full line;
+ *   B. reserve the cap marker + EVERY item's name-only line first, then spend the remaining slack on
+ *      full lines in PRIORITY order (`rank` ascending; absent ⇒ index), admitting each full line whose
+ *      incremental cost still fits and skipping (not stopping at) the ones that do not — every item stays
+ *      listed, the low-priority ones lose their detail;
+ *   C. even all-name-only overflows → the longest name-only prefix that fits, closed by the caller's
+ *      overflow count line.
+ * Pure: the same items, spec and frame always render the same bytes.
+ */
+export interface ListingFoldSpec<T> {
+    /** The whole frame's byte budget, honoured as given. */
+    blockMaxBytes: number;
+    /** One item's full line (tier A, and tier B's admitted lines). */
+    full: (item: T) => string;
+    /** One item's name-only line (tier B's degraded form, tier C's listed prefix). */
+    nameOnly: (item: T) => string;
+    /** The raw name reported for an item the budget degraded (host-facing data, not prompt text). */
+    nameOf: (item: T) => string;
+    /** Priority for keeping the full line: ascending, 0 = first. Absent ⇒ the item's index. */
+    rank?: (item: T, index: number) => number;
+    /** The marker line that opens a degraded (tier B/C) body. */
+    capMarker: string;
+    /** Tier C's closing line for `n` items that could not be listed at all. */
+    overflowLine: (n: number) => string;
+    /** Renders body lines into the lane's frame; its fixed cost is priced once by rendering it empty. */
+    frame: (lines: readonly string[]) => string;
+}
+/** What one fold produced: the frame, and which items the budget degraded (display order). */
+export interface ListingFoldRender {
+    text: string;
+    /** Items listed WITHOUT their full line. */
+    nameOnly: readonly string[];
+    /** Items the frame could not list at all (tier C's overflow tail). */
+    dropped: readonly string[];
+}
+export declare function foldListingWithin<T>(items: ReadonlyArray<T>, spec: ListingFoldSpec<T>): ListingFoldRender | undefined;
+/** The removal arm's FLOOR — the departure fact with none of the names; constant-size, which is what
+ *  keeps the fact from being starved by a budget the names cannot fit. */
+export declare function removalArmFloor(header: string, count: number): string;
+/**
+ * A listing frame's REMOVAL arm rendered INSIDE a byte budget: every departed name when they fit,
+ * otherwise the longest prefix that does, closed by an honest count line — tier C over a list whose
+ * lines have one form, so there is no name-only tier between them. Names are neutralized on the way
+ * out: the announced map holds raw names from the commit half. Cost of the bound, stated: a name that
+ * does not fit is never announced (the commit half advances past it), so the model can still hold an
+ * entry that is gone — one failed call, against a frame that would otherwise never fit its budget.
+ */
+export declare function foldRemovalArmWithin(removed: readonly string[], header: string, maxBytes: number): string;

package/dist/core/runner/listing-fold.js

@@ -0,0 +1,75 @@
+import { sanitizeUntrustedText, SHELLED_BODY_ENVELOPE_TAGS } from "../untrusted-text.js";
+export function foldListingWithin(items, spec) {
+    if (items.length === 0)
+        return undefined;
+    const bytes = (s) => Buffer.byteLength(s, "utf8");
+    const render = spec.frame;
+    const lineCost = (l) => bytes(l) + 1;
+    const bodyBudget = spec.blockMaxBytes - bytes(render([]));
+    const fullLines = items.map((it) => spec.full(it));
+    const fullTotal = fullLines.reduce((acc, l) => acc + lineCost(l), 0);
+    if (fullTotal <= bodyBudget)
+        return { text: render(fullLines), nameOnly: [], dropped: [] };
+    const nameLines = items.map((it) => spec.nameOnly(it));
+    const namePrefix = new Array(nameLines.length + 1);
+    namePrefix[0] = 0;
+    for (let i = 0; i < nameLines.length; i++)
+        namePrefix[i + 1] = namePrefix[i] + lineCost(nameLines[i]);
+    const markerCost = lineCost(spec.capMarker);
+    const floorCost = markerCost + namePrefix[nameLines.length];
+    if (floorCost <= bodyBudget) {
+        let slack = bodyBudget - floorCost;
+        const byPriority = items
+            .map((it, i) => ({ i, rank: spec.rank?.(it, i) ?? i }))
+            .toSorted((a, b) => a.rank - b.rank || a.i - b.i);
+        const withFull = new Set();
+        for (const { i } of byPriority) {
+            const delta = lineCost(fullLines[i]) - lineCost(nameLines[i]);
+            if (delta <= slack) {
+                withFull.add(i);
+                slack -= delta;
+            }
+        }
+        return {
+            text: render([spec.capMarker, ...items.map((_it, i) => (withFull.has(i) ? fullLines[i] : nameLines[i]))]),
+            nameOnly: items.filter((_it, i) => !withFull.has(i)).map((it) => spec.nameOf(it)),
+            dropped: [],
+        };
+    }
+    for (let m = items.length - 1; m >= 0; m--) {
+        const overflow = spec.overflowLine(items.length - m);
+        if (markerCost + namePrefix[m] + lineCost(overflow) <= bodyBudget) {
+            return {
+                text: render([spec.capMarker, ...nameLines.slice(0, m), overflow]),
+                nameOnly: items.slice(0, m).map((it) => spec.nameOf(it)),
+                dropped: items.slice(m).map((it) => spec.nameOf(it)),
+            };
+        }
+    }
+    return {
+        text: render([spec.capMarker, spec.overflowLine(items.length)]),
+        nameOnly: [],
+        dropped: items.map((it) => spec.nameOf(it)),
+    };
+}
+export function removalArmFloor(header, count) {
+    return [header, `(… +${count} more are no longer available)`].join("\n");
+}
+export function foldRemovalArmWithin(removed, header, maxBytes) {
+    const bytes = (s) => Buffer.byteLength(s, "utf8");
+    const lines = removed.map((n) => `- ${sanitizeUntrustedText(n, SHELLED_BODY_ENVELOPE_TAGS)}`);
+    const head = bytes(header);
+    const lineCost = (l) => bytes(l) + 1;
+    const prefix = new Array(lines.length + 1);
+    prefix[0] = 0;
+    for (let i = 0; i < lines.length; i++)
+        prefix[i + 1] = prefix[i] + lineCost(lines[i]);
+    if (head + prefix[lines.length] <= maxBytes)
+        return [header, ...lines].join("\n");
+    for (let m = lines.length - 1; m >= 0; m--) {
+        const tail = `(… +${lines.length - m} more are no longer available)`;
+        if (head + prefix[m] + lineCost(tail) <= maxBytes)
+            return [header, ...lines.slice(0, m), tail].join("\n");
+    }
+    return removalArmFloor(header, lines.length);
+}

package/dist/core/runner/prepare-execution-env.d.ts

@@ -14,7 +14,7 @@ export interface OwnedEnvSeat {
 export interface PrepareExecutionEnvInput {
     /** borrowed-readonly — the deployment's env seats: the per-task factory (wins), the static env, the
      *  declared root fence, and the incident sink for the bounded teardown legs. */
-    deps: Pick<RunnerDeps, "executionEnvFactory" | "executionEnv" | "rootPath" | "onError">;
+    deps: Pick<RunnerDeps, "executionEnvFactory" | "executionEnv" | "rootPath" | "onError" | "onNotice">;
     /** borrowed-readonly — the REBOUND spec; only the caller's task id rides into the factory ctx. */
     spec: Pick<TaskSpec, "taskId">;
     /** borrowed-readonly — the trusted spawn-side requests: the explicit cwd (a contract), the isolation

package/dist/core/runner/prepare-execution-env.js

@@ -1,5 +1,6 @@
 import { StubExecutionEnv } from "../stub-env.js";
 import { hasDestroy } from "../remote-env.js";
+import { announceMalformedCapabilities } from "./env-capability-census.js";
 import { settleTeardownLeg } from "./teardown-bounded.js";
 export async function prepareExecutionEnv(input) {
     const { deps, spec, internals, resume, placementRootResolved, sessionId, forgetOnThrow, rollback } = input;
@@ -39,6 +40,7 @@ export async function prepareExecutionEnv(input) {
         });
     }
     const executionEnv = ownedEnv ?? deps.executionEnv ?? new StubExecutionEnv();
+    announceMalformedCapabilities(executionEnv, deps.onNotice);
     if (internals?.requestedCwd !== undefined) {
         const canon = async (p) => {
             const r = await executionEnv.canonicalPath(p);

package/dist/core/runner/prepare-gate-stations.d.ts

@@ -30,6 +30,7 @@ import { type HookEnvCapabilities, type HookInvocationIdentity, type Hooks } fro
 import type { ToolPolicy } from "../tool-policy.js";
 import { type GateOutcome } from "../gate-outcome.js";
 import type { RunnerDeps, TaskSpec, ToolEffect } from "../types.js";
+import type { WriteProtectionCheck } from "../write-protect.js";
 import type { CwdRef } from "../../tools/fs/fs-shared.js";
 import type { AskLane, IrreversibilityTier, ParkAsk, Prepared, ReversibilityProbes } from "./contracts.js";
 import type { StopForDenialLimit } from "./denial-limit-arms.js";
@@ -147,6 +148,11 @@ export interface PrepareGateStationsInput {
     handsCwdRef: CwdRef | undefined;
     /** borrowed-readonly — the read-only env capability face every hook context carries, or undefined. */
     hookEnvFace: HookEnvCapabilities | undefined;
+    /** borrowed-readonly — the leg's write-protection gate input, compiled ONCE by the wiring-manifest phase
+     *  (which runs first and has to report the judge's own target view), or undefined when the deployment
+     *  emptied the table: no judge, and no tighten mounted at all. Carried rather than compiled a second time
+     *  here — two compiles are two judges, free to disagree about the seats they were handed. */
+    writeProtectionCheck: WriteProtectionCheck | undefined;
     /** borrowed-readonly — the per-tool irreversibility tier handed to the gate per call. */
     irreversibilityTier: IrreversibilityTier;
     /** borrowed-readonly — the per-tool reversibility probes handed to the gate per call. */

package/dist/core/runner/prepare-gate-stations.js

@@ -7,7 +7,6 @@ import { directDeny } from "./gate-exit.js";
 import { emitTrace } from "../trace.js";
 import { deliverEngineNotice } from "../engine-notice.js";
 import { askUnresolvableNotice } from "../ask-unresolvable-notice.js";
-import { createWriteProtectionCheck } from "../write-protect.js";
 import { PATH_CONFINABLE_WRITE_TOOLS } from "./session-rule-policy.js";
 import { toolCallFaceOf } from "../tool-roster.js";
 function screenGateResult(result) {
@@ -42,7 +41,7 @@ export function maybeHumanRejectionHalt(input) {
     };
 }
 export function prepareGateStations(input) {
-    const { askLane, parkAsk, tools, toolRosterDeltas, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, hooks, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, gateOutcomes, batchHaltRef, blockedTracked, hookIdentity, reminderMark, planModeRef, hostTaskId, sessionId, ownGatePreToolUse, hookTimeoutMs, handsCwdRef, hookEnvFace, irreversibilityTier, reversibilityProbes, abortController, shellGatedTools, autoModeDecider, autoModeDenialTracking, stopForDenialLimit, permissionRuleLane, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, notifyOwnHookCrash } = input;
+    const { askLane, parkAsk, tools, toolRosterDeltas, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, hooks, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, gateOutcomes, batchHaltRef, blockedTracked, hookIdentity, reminderMark, planModeRef, hostTaskId, sessionId, ownGatePreToolUse, hookTimeoutMs, handsCwdRef, hookEnvFace, writeProtectionCheck, irreversibilityTier, reversibilityProbes, abortController, shellGatedTools, autoModeDecider, autoModeDenialTracking, stopForDenialLimit, permissionRuleLane, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, notifyOwnHookCrash } = input;
     if (askLane !== undefined && parkAsk !== undefined) {
         const { adjudicate, resolveAskBound, notifyPermissionDenied, notifyHookError } = askLane;
         const { resolveContentAsk, suspendAsk } = parkAsk;
@@ -51,7 +50,6 @@ export function prepareGateStations(input) {
             if (eff !== undefined && !toolEffects.has(t.name))
                 toolEffects.set(t.name, eff);
         }
-        const writeProtectionCheck = createWriteProtectionCheck(deps.writeProtectedPaths, deps.memoryEngineDir !== undefined ? { dataRoot: deps.memoryEngineDir } : undefined);
         const writeProtectionArmed = writeProtectionCheck !== undefined && tools.some((t) => PATH_CONFINABLE_WRITE_TOOLS.has(t.name));
         toolCallGateArmedRef.armed =
             effectivePolicy !== undefined ||

package/dist/core/runner/prepare-hands-readface.d.ts

@@ -110,6 +110,10 @@ export interface PrepareHandsReadFaceInput {
     /** borrowed-readonly — B-4's settled root (T6 FINAL semantics); the containment root every face
      *  in this phase canonicalizes from. */
     taskRootFinal: string;
+    /** borrowed-readonly — the same root, resolved to the spelling the fence compares with, by the ONE
+     *  resolver at the driver's root receiving point ({@link import("./task-root-canonical.js").resolveTaskRootCanonical}):
+     *  taken as an input, never re-canonicalized here, so the fence and the root notice cannot disagree. */
+    taskRootCanonical: string;
     /** borrowed-readonly — B-4's checkpoint-path rebaser (T7): identity unless a divergent restore
      *  armed it; applied to the readFileState seed keys and the handsCwd seed. */
     rebaseRestoredPath: (p: string) => string;

package/dist/core/runner/prepare-hands-readface.js

@@ -152,7 +152,7 @@ export function resolveHandsLessReadFace(input) {
 }
 export async function prepareHandsMount(input) {
     const envHandToolNames = new Set();
-    const { handsEnabled, executionEnv, taskRootFinal, rebaseRestoredPath, resume, session, sessionId, hostTaskId, taskScope, fullShellReachable, effectiveShellGate, toolFaceSnapshot, model, spec, deps, internals, memoryWriteGate, advertisedWritableDirs, firstPartyOffload, roster, egressTools, irreversibilityTier, irreversibleTools, reversibilityProbes } = input;
+    const { handsEnabled, executionEnv, taskRootCanonical, rebaseRestoredPath, resume, session, sessionId, hostTaskId, taskScope, fullShellReachable, effectiveShellGate, toolFaceSnapshot, model, spec, deps, internals, memoryWriteGate, advertisedWritableDirs, firstPartyOffload, roster, egressTools, irreversibilityTier, irreversibleTools, reversibilityProbes } = input;
     assertStringArraySeat(spec.additionalDirectories, "TaskSpec.additionalDirectories", "strings");
     assertStringArraySeat(spec.additionalReadDirectories, "TaskSpec.additionalReadDirectories", "strings");
     assertStringArraySeat(deps.readDenyPatterns, "RunnerDeps.readDenyPatterns", "compiler-owned");
@@ -176,15 +176,13 @@ export async function prepareHandsMount(input) {
     let attachmentRootCanonical;
     let readDenyMatcher;
     if (handsEnabled) {
-        const rootRaw = taskRootFinal;
-        const canon = await executionEnv.canonicalPath(rootRaw);
-        const rootCanonical = canon.ok ? canon.value : rootRaw;
+        const rootCanonical = taskRootCanonical;
         attachmentRootCanonical = rootCanonical;
         const canonicalizeExtraDirs = async (dirs, field, sink) => {
             for (const dir of dirs ?? []) {
                 if (!dir || !dir.trim())
                     continue;
-                const c = await executionEnv.canonicalPath(dir);
+                const c = await (advertisedWritableDirs?.canonicalizeDeclaredRoot(dir) ?? executionEnv.canonicalPath(dir));
                 if (c.ok) {
                     sink.push(c.value);
                 }

package/dist/core/runner/prepare-listings.d.ts

@@ -17,6 +17,7 @@ import type { AgentTool } from "../../internal/harness.js";
 import type { TaskSpec } from "../types.js";
 import type { AnnounceOnceSink, Prepared, PrepareResume, ToolFaceSnapshot } from "./contracts.js";
 import type { AnnouncedListingSnapshot } from "../../internal/harness.js";
+import type { ResolvedSkillListingBudget } from "../skill-listing-budget.js";
 export interface PrepareListingsInput {
     /** borrowed-readonly — the REBOUND spec (`spec′`). Read: `agents` (the audit's subject), `tools`
      *  (the roster-bearing delegation tool, by its `agentListing` marker), `sessionId` (continuation
@@ -44,6 +45,8 @@ export interface PrepareListingsInput {
     /** borrowed-readonly — the project-context phase's skills-listing projection; read only for the
      *  skills opt-out advisory (entries.length). */
     skillsListing: Prepared["skillsListing"];
+    /** borrowed-readonly — the listing family's resolved budget; the agent roster frames fold into it. */
+    listingBudget: ResolvedSkillListingBudget;
     /** borrowed-mutable — the deferred roster's ToolSearch RIDE seat (declared by the disclosure
      *  mount, read at activation time through `listingRideRef.current?.(newly)`). Written here, once,
      *  on a deferred roster face; no later writer. Identity is the contract (the mount's closures read

package/dist/core/runner/prepare-listings.js

@@ -2,7 +2,7 @@ import { formatLocalDate } from "../../prompts/default.js";
 import { SKILL_TOOL_NAME } from "./synthetic-tools.js";
 import { renderAgentListingDelta } from "./turn-attachments.js";
 export function prepareListings(input) {
-    const { spec, tools, onceLedger, sessionId, toolFaceSnapshot, activeTools, resume, skillsListing, listingRideRef, renderWithDate, envFacts, tzValid, userTz } = input;
+    const { spec, tools, onceLedger, sessionId, toolFaceSnapshot, activeTools, resume, skillsListing, listingBudget, listingRideRef, renderWithDate, envFacts, tzValid, userTz } = input;
     if (spec.agents !== undefined && spec.agents.length > 0) {
         const known = new Set(tools.flatMap((t) => [t.name, ...(t.aliases ?? [])]));
         for (const def of spec.agents) {
@@ -39,6 +39,7 @@ export function prepareListings(input) {
         ? {
             entries: agentListingSpec.agentListing,
             toolName: agentListingSpec.name,
+            budget: listingBudget,
             seedAnnounced: resume !== undefined || spec.sessionId !== undefined,
             ...(agentListingSpec.agentModels !== undefined ? { models: agentListingSpec.agentModels } : {}),
         }
@@ -48,6 +49,7 @@ export function prepareListings(input) {
                     {
                         entries: [],
                         toolName: (spec.tools ?? []).find((t) => t.agentListing !== undefined)?.name ?? "Agent",
+                        budget: listingBudget,
                         seedAnnounced: true,
                     }
                 : undefined;
@@ -66,7 +68,7 @@ export function prepareListings(input) {
                 return undefined;
             if ((announcedListingsRef.agents?.length ?? 0) > 0)
                 return undefined;
-            return renderAgentListingDelta({ announcedAgentTypes: undefined }, rideEntries, rosterBearingSpec.name, rideModels);
+            return renderAgentListingDelta({ announcedAgentTypes: undefined }, rideEntries, rosterBearingSpec.name, rideModels, listingBudget);
         };
     }
     const dateChange = renderWithDate

package/dist/core/runner/prepare-memory.js

@@ -4,7 +4,7 @@ import { admitMemoryScopes } from "../memory-admission.js";
 import { adoptLegacyRepoDirs, canonicalize, deriveRepoControlPlaneDir, deriveProjectControlDir, deriveProjectMemoryDir, deriveRepoMemoryDir, drainMemoryAnnouncements, enqueueMemoryAnnouncement, isContainedIn, lookupProjectIdHint, recordProjectIdHint, resolveMemoryEngineRoot } from "../memory-engine/layout.js";
 import { classifyScopePlanes, derivePersonalControlDir, derivePersonalMemoryDir, mergeHarvestReports, mergeInjections, needsDualRoots, parsedProjectPlane } from "../memory-engine/dual-root.js";
 import { normalizeMemorySpec } from "../memory.js";
-import { MEMORY_ANNOUNCEMENT_CAPTURE_OPTOUT_CODA, MEMORY_ANNOUNCEMENT_READONLY_CODA, MEMORY_CAPTURE_INDETERMINATE_NOTICE, MEMORY_CAPTURE_OPTOUT_NOTICE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, MemoryEngine, entryFileHeadCarriesOrigin, memoryCaptureOptedOutNotice, memoryCaptureOptOutUnpersistedNotice, memoryConsolidationRecommendedNotice, memoryHarvestQuarantinedNotice, memoryHoldNotices, memoryRecallDisciplineSegment, memorySessionPollutedNotice, pollutionContainmentCounts, } from "../memory-engine/engine.js";
+import { MEMORY_ANNOUNCEMENT_CAPTURE_OPTOUT_CODA, MEMORY_ANNOUNCEMENT_READONLY_CODA, MEMORY_CAPTURE_INDETERMINATE_NOTICE, MEMORY_CAPTURE_OPTOUT_NOTICE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, MemoryEngine, entryFileHeadCarriesOrigin, memoryCaptureOptedOutNotice, memoryCaptureOptOutUnpersistedNotice, memoryConsolidationRecommendedNotice, memoryHarvestQuarantinedNotice, memoryHoldNotices, memoryRecallDisciplineSegment, memoryRestoreWithheldNotice, memorySessionPollutedNotice, pollutionContainmentCounts, } from "../memory-engine/engine.js";
 import { adjudicateCaptureOptOut, captureOptOutDeniedError, captureOptOutUnpersistedError } from "./memory-capture-optout.js";
 import { readSessionCaptureOptOut } from "../memory-engine/layout.js";
 import { createMemoryEngineTools } from "../memory-engine/tools.js";
@@ -522,6 +522,9 @@ export async function prepareMemory(input) {
                     }
                     deliverEngineNotice(deps.onNotice, memoryHarvestQuarantinedNotice({ count, moved, escalated, ...(report.reportId !== undefined ? { reportId: report.reportId } : {}), ...(reason !== undefined ? { reason } : {}), sessionId, provenance: input.memoryProvenance, ...(indexOnly ? { indexRolledBack: true } : {}) }));
                 }
+                if (report.restoreWithheld !== undefined && report.restoreWithheld.length > 0) {
+                    deliverEngineNotice(deps.onNotice, memoryRestoreWithheldNotice({ paths: report.restoreWithheld, sessionId }));
+                }
                 for (const notice of memoryHoldNotices(report, sessionId))
                     deliverEngineNotice(deps.onNotice, notice);
                 const consolidationNotice = memoryConsolidationRecommendedNotice(report, sessionId);
@@ -615,6 +618,9 @@ export async function prepareMemory(input) {
                             }
                         }
                         const sweep = await writeEngine.sweepSessionCaptureResidue(writeHandle);
+                        if (sweep.withheld.length > 0) {
+                            deliverEngineNotice(deps.onNotice, memoryRestoreWithheldNotice({ paths: sweep.withheld, sessionId }));
+                        }
                         if (sweep.failures.length > 0) {
                             const named = sweep.failures
                                 .slice(0, 5)

package/dist/core/runner/prepare-policy-chain.js

@@ -303,9 +303,9 @@ export async function preparePolicyChain(input) {
             }
             if (re.updatedInput !== undefined)
                 editArgs = re.updatedInput;
-            const judged = await judgeInheritedClassifier({ autoMode: ancestorDecider !== undefined ? { decider: ancestorDecider, denialTracking: ancestorTracker } : undefined, ask: re, req: { ...creq, args: editArgs }, signal: csignal ?? abortController.signal, subject: "the approved edit" });
+            const judged = await judgeInheritedClassifier({ autoMode: ancestorDecider !== undefined ? { decider: ancestorDecider, denialTracking: ancestorTracker } : undefined, ask: re, req: { ...creq, args: editArgs }, signal: csignal ?? abortController.signal, subject: "the approved edit", allowRewrite: editArgs });
             if (judged.kind === "allow")
-                return { action: "allow", updatedInput: editArgs };
+                return judged.result;
             if (judged.kind === "deny")
                 return judged.result;
             const { ask: editAsk, fallback: editFallback, mintedHere: editMintedHere } = judged;
@@ -371,7 +371,7 @@ export async function preparePolicyChain(input) {
                     }
                     const judged = await judgeInheritedClassifier({ autoMode: pc.autoMode, ask: first, req: creq, signal: csignal ?? abortController.signal, subject: "this call" });
                     if (judged.kind === "allow")
-                        return { action: "allow" };
+                        return judged.result;
                     if (judged.kind === "deny")
                         return judged.result;
                     const { ask: inheritedAsk, fallback, mintedHere } = judged;
@@ -439,9 +439,9 @@ export async function preparePolicyChain(input) {
                         return mandateUnreconstructibleDeny(creq);
                     }
                     const presentedArgs = decision.updatedInput !== undefined ? decision.updatedInput : creq.args;
-                    const judged = await judgeInheritedClassifier({ autoMode: pc.autoMode, ask: decision, req: { ...creq, args: presentedArgs }, signal: csignal ?? abortController.signal, subject: "this call" });
+                    const judged = await judgeInheritedClassifier({ autoMode: pc.autoMode, ask: decision, req: { ...creq, args: presentedArgs }, signal: csignal ?? abortController.signal, subject: "this call", allowRewrite: decision.updatedInput });
                     if (judged.kind === "allow")
-                        return decision.updatedInput !== undefined ? { action: "allow", updatedInput: decision.updatedInput } : { action: "allow" };
+                        return judged.result;
                     if (judged.kind === "deny")
                         return judged.result;
                     const { ask: inheritedAsk, fallback, mintedHere } = judged;

package/dist/core/runner/prepare-prompt-inputs.d.ts

@@ -117,8 +117,8 @@ export interface PreparePromptInputsResult {
     tzValid: boolean;
     /** owned — the client's declared zone as given (paired with `tzValid`; unvalidated on its own). */
     userTz: string | undefined;
-    /** owned — the git-status lane's run-local state (empty on a hands-less leg); the run loop and the
-     *  checkpoint serializer mutate its fields from here on (`announced`, `pendingReceipt`, …). */
+    /** owned — the git-status lane's run-local state (empty on a hands-less leg); the run loop and the checkpoint
+     *  serializer mutate its fields from here on (`announced`, `mirrorOwed`, …; the frame's receipt rides the leg's shared `Prepared.frameReceipts`). */
     gitStatusRef: GitStatusLaneRef;
 }
 /** The M10 phase body — prepareTask's prompt-inputs stretch, verbatim (see the module header). */

package/dist/core/runner/prepare-run-refs.d.ts

@@ -28,8 +28,10 @@ export interface PrepareRunRefsInput {
      *  worktree helper). Never mutated. */
     spec: Pick<TaskSpec, "forwardSubagentEvents" | "retainSubagentSessions" | "handsReadOnly">;
     /** borrowed-readonly — the trusted spawn-side channel; only `onForwardEvent` (the deployment's display
-     *  sink) is read, once, to decide whether a forwarding wrapper exists at all. */
-    internals: Pick<RunInternals, "onForwardEvent"> | undefined;
+     *  sink) is read, to decide whether a forwarding wrapper exists at all, and `forwardScope` (the run's
+     *  forwarding containment, read by the door). The OBJECT is what the wrapper hands the door rather than
+     *  the pulled-out function: the sink keeps its receiver and the run keeps one failure count. */
+    internals: Pick<RunInternals, "onForwardEvent" | "forwardScope"> | undefined;
     /** borrowed-readonly — the run's resolved env; the worktree helper closes over it (lazy: no I/O until a
      *  delegation actually mints a worktree). */
     executionEnv: ExecutionEnv;

package/dist/core/runner/prepare-run-refs.js

@@ -1,6 +1,7 @@
 import { createSubagentWorktreeHelper } from "../../agents/subagent.js";
 import { SubagentRetainLedger } from "../../agents/retain-ledger.js";
 import { ActiveSkillScope } from "./active-skill-scope.js";
+import { forwardSafely } from "./forward-sink.js";
 import { createEditedFilesLedger } from "./edited-files-ledger.js";
 export function forwardsSubagentEvents(spec) {
     return spec.forwardSubagentEvents === true;
@@ -14,14 +15,14 @@ export function prepareRunRefs(input) {
     const harnessRef = {};
     const toolProgressRef = {};
     const skillScope = new ActiveSkillScope();
-    const forwardSink = internals?.onForwardEvent;
-    const forwardEvent = forwardSink
+    const sinkWired = internals?.onForwardEvent !== undefined;
+    const forwardEvent = sinkWired
         ? (e) => {
             if (e.type === "task_progress")
-                forwardSink(e);
+                forwardSafely(internals, e);
             else if (spec.forwardSubagentEvents === true &&
                 (e.type === "text_delta" || e.type === "text_end" || e.type === "reasoning_delta" || e.type === "tool_start" || e.type === "tool_progress" || e.type === "tool_end")) {
-                forwardSink(e);
+                forwardSafely(internals, e);
             }
         }
         : undefined;

package/dist/core/runner/prepare-task.js

@@ -78,6 +78,7 @@ import { ToolRosterDeltaSeat } from "../tool-roster.js";
 import { faceOf } from "../tool-roster.js";
 import { catalogEntriesNamed, pathTargetOf } from "../tool-registry.js";
 import { AdvertisedWritableDirs } from "./advertised-writable-dirs.js";
+import { resolveTaskRootCanonical } from "./task-root-canonical.js";
 import { createStructuredProjector } from "./tool-output-projection.js";
 function warnCompactionWindowHazard(tracer, spec, model, compModel, hostTaskId) {
     if (compModel === undefined)
@@ -365,6 +366,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         }
         const ownedEnv = ownedEnvSeat.current;
         const { taskRootFinal, rebaseRestoredPath } = await prepareWorkspaceRestore({ ownedEnv, deps, spec, internals, resume, taskRootInitial, abortController, sessionId });
+        const { canonical: taskRootCanonical } = await resolveTaskRootCanonical({ env: executionEnv, given: taskRootFinal, onNotice: deps.onNotice, sessionId, runId });
         const { trackFileEdit, fileHistoryBoundary, restoredFilePaths, rewindNotes, fileHistoryEnabled, historyScope, historyRoot, historyFs } = await prepareFileHistory({ deps, spec, internals, executionEnv, taskRootFinal, handsEnabled, sessionId, session, resumeAtBeforeParentId, abortController });
         const { noteFileEdited, editedFilesSnapshot, harnessRef, toolProgressRef, skillScope, forwardEvent, reviewRequestRef, requestReview, stopRequestedRef, requestStopAfterTurn, planModeRef, enterPlanMode, subagentRetain, worktreeIsolation } = prepareRunRefs({ spec, internals, executionEnv, taskRootFinal });
         let resolvedReadFace;
@@ -438,7 +440,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         const callIssuedAtRef = {};
         const workCutRef = { continuation: false, abortedBeforeTurnEnd: false };
         const advertisedWritableDirs = handsEnabled
-            ? new AdvertisedWritableDirs(executionEnv, (dir, reason) => deps.onError?.(new Error(`${dir.advertiser} advertised writable directory skipped (cannot canonicalize): ${dir.path} — ${reason}`), { phase: "config", sessionId }))
+            ? new AdvertisedWritableDirs(executionEnv, (dir, reason) => deps.onError?.(new Error(`${dir.advertiser} advertised writable directory skipped: ${dir.path} — ${reason}`), { phase: "config", sessionId }), taskRootCanonical, [...(spec.additionalDirectories ?? []), ...(spec.additionalReadDirectories ?? [])])
             : undefined;
         const handsWriteHalfPlanned = handsEnabled && handsWriteHalfMounts({ readOnly: spec.handsReadOnly === true });
         const memoryPairNameDomain = new Set();
@@ -508,7 +510,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         if (internals?.ownOrgAdmissionRef !== undefined && ownOrgVerdictRef.current !== undefined) {
             internals.ownOrgAdmissionRef.current = ownOrgVerdictRef.current;
         }
-        const handsReadFaceInput = { handsEnabled, executionEnv, taskRootFinal, rebaseRestoredPath, resume, session, sessionId, hostTaskId, taskScope, fullShellReachable, effectiveShellGate, toolFaceSnapshot, model, spec, deps, internals, memoryWriteGate, ...(advertisedWritableDirs !== undefined ? { advertisedWritableDirs } : {}), firstPartyOffload, roster, egressTools, irreversibilityTier, irreversibleTools, reversibilityProbes, reminderMark, reminderDisclosureCounts, ...(trackFileEdit !== undefined ? { trackFileEdit } : {}), onFileEdited: noteFileEdited, harnessRef, toolProgressRef, ...(restoredFilePaths.length > 0 ? { restoredFilePaths } : {}) };
+        const handsReadFaceInput = { handsEnabled, executionEnv, taskRootFinal, taskRootCanonical, rebaseRestoredPath, resume, session, sessionId, hostTaskId, taskScope, fullShellReachable, effectiveShellGate, toolFaceSnapshot, model, spec, deps, internals, memoryWriteGate, ...(advertisedWritableDirs !== undefined ? { advertisedWritableDirs } : {}), firstPartyOffload, roster, egressTools, irreversibilityTier, irreversibleTools, reversibilityProbes, reminderMark, reminderDisclosureCounts, ...(trackFileEdit !== undefined ? { trackFileEdit } : {}), onFileEdited: noteFileEdited, harnessRef, toolProgressRef, ...(restoredFilePaths.length > 0 ? { restoredFilePaths } : {}) };
         const handsReadFace = handsEnabled ? await prepareHandsMount(handsReadFaceInput) : resolveHandsLessReadFace(handsReadFaceInput);
         const { readFileStateForCheckpoint, seedContextFiles, handsCwdRef, workspaceStateSettle, wsSnapshot, rebaseWsPath, backgroundTaskToolsActive, additionalRootsCanonical, additionalReadRootsCanonical, attachmentRootCanonical, readDenyMatcher, envHandToolNames, sealReadStateSeat } = handsReadFace;
         resolvedReadFace = handsReadFace.resolvedReadFace;
@@ -590,7 +592,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             declaredCards: toolRoster.entries.flatMap((e) => e.renderHints?.resultCards ?? []),
             onUndeclared: (type) => deliverEngineNotice(deps.onNotice, { code: "config.tool_card_undeclared", message: `a tool minted a \`details.type\` card ${JSON.stringify(type)} its definition never declared — dropped from tool_end.structured (declare it on the definition's catalog row or the caller's renderHints.resultCards)`, detail: { type, sessionId, runId } }),
         });
-        const { agentListing, announcedListingsRef, dateChange } = prepareListings({ spec, tools, onceLedger, sessionId, toolFaceSnapshot, activeTools, resume, skillsListing, listingRideRef, renderWithDate, envFacts, tzValid, userTz });
+        const { agentListing, announcedListingsRef, dateChange } = prepareListings({ spec, tools, onceLedger, sessionId, toolFaceSnapshot, activeTools, resume, skillsListing, listingBudget: doors.skillListingBudget, listingRideRef, renderWithDate, envFacts, tzValid, userTz });
         const lastBrainContextRef = {};
         const requestLossyRef = { current: false };
         const staleOffloadWrittenRefs = new Set();
@@ -688,7 +690,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             }
         }
         const { hooks, hookTimeoutMs, preToolUseObservational, ownGatePreToolUse, basePolicyForResumeEdit, denyNarrowingPolicy, policyLayers, effectivePolicy, inheritedUnavailableAsks, inheritedAskGrants, askSourceIdentity, riskAxesOf, ruleOffersOf, permissionRuleLane, permissionRuleOrgLane, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, foldAskClasses, ancestorSandboxAdmissions } = await preparePolicyChain({ spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, lockedPreflight, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, envHandToolNames, handsCwdRef, readDenyMatcher, questionToolMounted, runtimeCaps, inheritedAncestorRules, inheritedParentConstraints, seedInheritedGate, hasSkillManifest, skillScope, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef });
-        const { onAsk, preToolContexts, blockedToolCalls, gateOutcomes, batchHaltRef, blockedTracked, incompleteSuspendAdapter, durableSuspendInfraReady, resourceSuspendEligible, usageGovernance, durableApproval, wiringManifest, parkLaneArmed, gateMachineryActive, hookIdentity, hookEnvFace } = prepareWiringManifest({ spec, deps, internals, resume, sessionId, runId, hostTaskId, taskScope, hooks, preToolUseObservational, policyLayers, effectivePolicy, handsEnabled, mcp, irreversibleTools, egressTools, toolEffects, ownedEnv, executionEnv, offloadStore, onceLedger, usageWindows, envLifetimeSuspendAt, runtimeCaps, resolvedInteractionPosture, durableQuestionFace, liveQuestionFace, checkpointStore, sessions, modelGateManifest, autoModeArmReason, lockedPreflight, peerLaneRefs, peerLaneActive, harness, pausedRef, frozenOnAsk, liveInheritedGate, delegation, toolRoster, lspManagerWired, lspDiagnosticsLive: lspDiagnostics !== undefined });
+        const { onAsk, preToolContexts, blockedToolCalls, gateOutcomes, batchHaltRef, blockedTracked, incompleteSuspendAdapter, durableSuspendInfraReady, resourceSuspendEligible, usageGovernance, durableApproval, wiringManifest, writeProtectionCheck, parkLaneArmed, gateMachineryActive, hookIdentity, hookEnvFace } = prepareWiringManifest({ spec, deps, internals, resume, sessionId, runId, hostTaskId, taskScope, hooks, preToolUseObservational, policyLayers, effectivePolicy, handsEnabled, taskRootFinal, mcp, irreversibleTools, egressTools, toolEffects, ownedEnv, executionEnv, offloadStore, onceLedger, usageWindows, envLifetimeSuspendAt, runtimeCaps, resolvedInteractionPosture, durableQuestionFace, liveQuestionFace, checkpointStore, sessions, modelGateManifest, autoModeArmReason, lockedPreflight, peerLaneRefs, peerLaneActive, harness, pausedRef, frozenOnAsk, liveInheritedGate, delegation, toolRoster, lspManagerWired, lspDiagnosticsLive: lspDiagnostics !== undefined });
         if (fileHistoryBoundary !== undefined) {
             harness.on("tool_call", async () => {
                 await fileHistoryBoundary.settle();
@@ -699,12 +701,12 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         const { saga } = prepareSuspendSaga({ gateMachineryActive, abortController, harness, checkpointStore, deps, sessionId, hostTaskId, taskScope, liveSpendRef, resume, nestedStats, internals, activeTools, outputRef, readFileStateForCheckpoint, faceCheckpointSection, writeFaceCheckpointSection, reminderMark, handsCwdRef, worktreeSessionRef, undeliveredContinuationRef, inheritedParentConstraints, seedInheritedGate, inheritedAncestorRules, inheritedShellGate, autoModeIntent, inheritedAdmittedOrgScopes, ownOrgVerdictRef, orgGovernedProvenance, announcedListingsRef, gitStatusRef, hookIdentity, placementRootResolved, externalContentTargetActive, remoteEnvFailures, memoryEngineSession, suspendLoopRef, ownedEnv, incompleteSuspendAdapter });
         const { suspendForResource, suspendForPlatformLimit, suspendForReview } = prepareBoundaryParks({ saga, spec, checkpointStore, abortController, harness, session, sessions, sessionId, deps, priorLedger, maxSlices, maxSuspends, resourceTotal, priorSuspendCount, suspendChainBase, humanReviewRef, liveSpendRef, now, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, pausedRef, remoteEnvFailures, resourceSuspendEligible, durableSuspendInfraReady, incompleteSuspendAdapter });
         const { parkAsk } = prepareParkAsk({ askLane, saga, spec, deps, sessionId, checkpointStore, toolRosterDeltas: rosterSeat, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, advertisedWritableDirs, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedTools, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, ruleOffersOf, now, humanReviewRef, abortController, harness, pausedRef });
-        prepareGateStations({ askLane, parkAsk, tools, toolRosterDeltas: rosterSeat, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, hooks, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, gateOutcomes, batchHaltRef, blockedTracked, hookIdentity, reminderMark, planModeRef, hostTaskId, sessionId, ownGatePreToolUse, hookTimeoutMs, handsCwdRef, hookEnvFace, irreversibilityTier, reversibilityProbes, abortController, shellGatedTools, autoModeDecider, autoModeDenialTracking, stopForDenialLimit, permissionRuleLane, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, notifyOwnHookCrash });
+        prepareGateStations({ askLane, parkAsk, tools, toolRosterDeltas: rosterSeat, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, hooks, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, gateOutcomes, batchHaltRef, blockedTracked, hookIdentity, reminderMark, planModeRef, hostTaskId, sessionId, ownGatePreToolUse, hookTimeoutMs, handsCwdRef, hookEnvFace, writeProtectionCheck, irreversibilityTier, reversibilityProbes, abortController, shellGatedTools, autoModeDecider, autoModeDenialTracking, stopForDenialLimit, permissionRuleLane, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, notifyOwnHookCrash });
         const { microCompact, charsPerToken } = prepareContextLane({ model, deps, sessionId, runId, hostTaskId, offloadStore, microCompactKnob, harness, batchHaltRef, gitStatusRef, requestLossyRef, trimPressureRef });
         const preparedHolder = {};
         const { cacheBreakDetector, cacheFingerprint, promptOverheadTokens, readTaskFile, normalizeAttachmentPath, isDedupStubResult, recentlyReadFiles, onCompactionApplied, detectExternalChanges, listBackgroundTasks, centerCompactionCandidate, effectiveReadFaceObserved, effectiveWriteFaceObserved, effectiveReadDenyObserved } = prepareTurnWiring({ deps, systemPromptSeat, harnessTools, fpRef, model, epochArtifactDigestForSnapshot, promptProfile, fableMitigations, systemBlocks, thinking, spec, sessionId, turnSnapshotRef, promptManifest, charsPerToken, handsEnabled, executionEnv, attachmentRootCanonical, additionalRootsCanonical, additionalReadRootsCanonical, readDenyMatcher, resolvedReadFace, handsCwdRef, readFileStateForCheckpoint, denyNarrowingPolicy, abortController, hostTaskId, taskScope, buildAssembleInputs, centerAdoptionRef, harnessRef, epochDeclaredSections, carrierReadFace, carrierWriteFace, readDenyAdditionsNormalized, preparedHolder });
         await onceLedger.settle(session, announcedListingsRef);
-        const buildPrepared = () => ({ harness, session, sessionId, runId, reminderMark, reminderDisclosureCounts, editedFilesSnapshot, taskRootPath: taskRootFinal, model, thinking, compModel: effectiveCompModel, mcp, ...(a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, gateOutcomes, batchHaltRef, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), ...(fileHistoryBoundary !== undefined ? { fileHistoryBoundary } : {}), ...(effectiveReadFaceObserved !== undefined ? { effectiveReadFace: effectiveReadFaceObserved, effectiveWriteFace: effectiveWriteFaceObserved } : {}), ...(effectiveReadDenyObserved !== undefined ? { effectiveReadDenyPatterns: effectiveReadDenyObserved } : {}), effectiveMemoryScopes: memoryEffectiveScopes, cwdRef: handsCwdRef, toolProgressRef, ...(advertisedWritableDirs !== undefined ? { advertisedWritableDirs } : {}), ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), ...(sealReadStateSeat !== undefined ? { sealReadStateSeat } : {}), denyNarrowingPolicy, ...(permissionRuleLane !== undefined ? { persistedRuleLane: permissionRuleLane } : {}), ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, pausedRef, undeliveredContinuationRef, suspendProgressRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, workCutRef, brainCallGuardrailRef, gateStopRef, suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolRoster, toolRosterDeltas: rosterSeat, structuredProjector, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, microCompact, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, stopRequestedRef, announcedSnapshotRecovered: onceLedger.recovered, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(projectInstructionContent !== undefined ? { projectInstructionContent } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, gitStatusRef, listBackgroundTasks, hookIdentity, hookTimeoutMs, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}), ...(toolDisclosureSeat !== undefined ? { toolDisclosure: toolDisclosureSeat } : {}) });
+        const buildPrepared = () => ({ harness, session, sessionId, runId, reminderMark, reminderDisclosureCounts, editedFilesSnapshot, taskRootPath: taskRootFinal, model, thinking, compModel: effectiveCompModel, mcp, ...(a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, gateOutcomes, batchHaltRef, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), ...(fileHistoryBoundary !== undefined ? { fileHistoryBoundary } : {}), ...(effectiveReadFaceObserved !== undefined ? { effectiveReadFace: effectiveReadFaceObserved, effectiveWriteFace: effectiveWriteFaceObserved } : {}), ...(effectiveReadDenyObserved !== undefined ? { effectiveReadDenyPatterns: effectiveReadDenyObserved } : {}), effectiveMemoryScopes: memoryEffectiveScopes, cwdRef: handsCwdRef, toolProgressRef, ...(advertisedWritableDirs !== undefined ? { advertisedWritableDirs } : {}), ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), ...(sealReadStateSeat !== undefined ? { sealReadStateSeat } : {}), denyNarrowingPolicy, ...(permissionRuleLane !== undefined ? { persistedRuleLane: permissionRuleLane } : {}), ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, pausedRef, undeliveredContinuationRef, suspendProgressRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, workCutRef, brainCallGuardrailRef, gateStopRef, suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolRoster, toolRosterDeltas: rosterSeat, structuredProjector, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, microCompact, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, stopRequestedRef, announcedSnapshotRecovered: onceLedger.recovered, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(projectInstructionContent !== undefined ? { projectInstructionContent } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, frameReceipts: { pending: [], listingSnapshotOwed: false }, gitStatusRef, listBackgroundTasks, hookIdentity, hookTimeoutMs, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}), ...(toolDisclosureSeat !== undefined ? { toolDisclosure: toolDisclosureSeat } : {}) });
         rollback.commit();
         const prepared = buildPrepared();
         preparedHolder.current = prepared;

package/dist/core/runner/prepare-wiring-manifest.d.ts

@@ -28,6 +28,7 @@ import { type ToolResultStore } from "../tool-result-store.js";
 import { type OnAsk, type ToolPolicy } from "../tool-policy.js";
 import type { GateOutcome } from "../gate-outcome.js";
 import type { RunnerDeps, RuntimeCaps, TaskSpec, ToolEffect, ToolExecuteContext } from "../types.js";
+import type { WriteProtectionCheck } from "../write-protect.js";
 import { type UsageWindow } from "../usage-window-store.js";
 import type { ToolRoster } from "../tool-roster.js";
 import { type AutoModeArmFact, type WiringManifest, type WiringManifestMcpEntry } from "../wiring-manifest.js";
@@ -41,7 +42,8 @@ export interface PrepareWiringManifestInput {
     /** borrowed-readonly — the deployment seats, whole: `onAsk` (the seat's deps half), `onError` (the warning), `executionEnv`
      *  (the hook-env predicate), `checkpointStore` (durable infra), the manifest's dozen wiring facts (`backgroundAgentStore`,
      *  `permissionRuleStore`, `permissionRuleSyncWired`, `onBackgroundChildEvent`, `lockedConfig`, `compliancePostureResolver`,
-     *  `memoryScopeAdmission`, `retentionPolicy`, `onElicit`), `onNotice`, and the usage-governance seats (`usageWindowStore`,
+     *  `memoryScopeAdmission`, `retentionPolicy`, `onElicit`), `onNotice`, the write-protection judge's compile seats
+     *  (`writeProtectedPaths`, `memoryEngineDir`), and the usage-governance seats (`usageWindowStore`,
      *  `now`, `onUsageGovernance`…) the helper reads through the whole record. */
     deps: RunnerDeps;
     /** borrowed-readonly — the trusted spawn-side channel: `questionFaceStripped`, `isDelegatedChild`, `onTaskNotification`,
@@ -67,6 +69,8 @@ export interface PrepareWiringManifestInput {
     effectivePolicy: ToolPolicy | undefined;
     /** borrowed-readonly — whether an execution env is wired (the hand band exists at all). */
     handsEnabled: boolean;
+    /** borrowed-readonly — the resolved task root: the base a `base: "root"` write tool's relative spelling resolves against. */
+    taskRootFinal: string;
     /** borrowed-readonly — the materialized MCP handle: `tools` (the destructive-ungated scan) and `statuses` (the manifest face). */
     mcp: Pick<MaterializedMcp, "tools" | "statuses">;
     /** borrowed-readonly — the assembled safety vocabulary (the ungated scans and the manifest's armed cell). Read only. */
@@ -158,6 +162,9 @@ export interface PrepareWiringManifestResult {
     durableApproval: TaskSpec["durableApproval"];
     /** owned — this leg's EFFECTIVE wiring manifest (`Prepared.wiringManifest`). */
     wiringManifest: WiringManifest;
+    /** owned — the leg's write-protection gate input, or undefined when the table was emptied (no judge, no
+     *  tighten mounted); handed to the gate station rather than compiled a second time there. */
+    writeProtectionCheck: WriteProtectionCheck | undefined;
     /** owned — THE park predicate as one named const (`parkLane.effective === true`). */
     parkLaneArmed: boolean;
     /** owned — THE gate-machinery activation predicate as one named const: a policy, a screening hook, an egress or

package/dist/core/runner/prepare-wiring-manifest.js

@@ -7,6 +7,7 @@ import { isVolatileOffloadStore } from "../tool-result-store.js";
 import { durableMandateSourceOf, isLiveApproverSeat } from "../tool-policy.js";
 import { deliverEngineNotice } from "../types.js";
 import { inlineUntrusted } from "../untrusted-text.js";
+import { mountWriteProtection } from "./write-protection-station.js";
 import { GLOBAL_USAGE_KEY, usageRetryAfterMs, windowsGovernCost } from "../usage-window-store.js";
 import { LSP_CONTRACT_ID, countElicitOptIns, deriveLspSeam, deriveWiringManifest, resolveAskSeamForm, resolveDeclaredDurability, resolveElicitSeam, resolveQuestionSeam, resolveSubagentTranscriptTier } from "../wiring-manifest.js";
 import { DEFAULT_IRREVERSIBLE_SCOPE } from "./checkpoint-scope.js";
@@ -111,7 +112,7 @@ function announceDurableGateUnavailable(args) {
     });
 }
 export function prepareWiringManifest(input) {
-    const { spec, deps, internals, resume, sessionId, runId, hostTaskId, taskScope, hooks, preToolUseObservational, policyLayers, effectivePolicy, mcp, irreversibleTools, egressTools, toolEffects, ownedEnv, executionEnv, offloadStore, onceLedger, usageWindows, envLifetimeSuspendAt, runtimeCaps, resolvedInteractionPosture, durableQuestionFace, liveQuestionFace, checkpointStore, sessions, modelGateManifest, autoModeArmReason, lockedPreflight, peerLaneRefs, peerLaneActive, harness, pausedRef, frozenOnAsk, liveInheritedGate, delegation, toolRoster, lspManagerWired, lspDiagnosticsLive } = input;
+    const { spec, deps, internals, resume, sessionId, runId, hostTaskId, taskScope, hooks, preToolUseObservational, policyLayers, effectivePolicy, handsEnabled, taskRootFinal, mcp, irreversibleTools, egressTools, toolEffects, ownedEnv, executionEnv, offloadStore, onceLedger, usageWindows, envLifetimeSuspendAt, runtimeCaps, resolvedInteractionPosture, durableQuestionFace, liveQuestionFace, checkpointStore, sessions, modelGateManifest, autoModeArmReason, lockedPreflight, peerLaneRefs, peerLaneActive, harness, pausedRef, frozenOnAsk, liveInheritedGate, delegation, toolRoster, lspManagerWired, lspDiagnosticsLive } = input;
     const onAsk = spec.onAsk ?? deps.onAsk;
     const handWriteTools = toolRoster.entries.filter((e) => e.mountedBy === "hands" && (e.effect === "write" || e.effect === "idempotent")).map((e) => e.name);
     const hasEffectAwareGate = Boolean(policyLayers.length > 0 || (hooks?.preToolUse !== undefined && !preToolUseObservational));
@@ -168,6 +169,7 @@ export function prepareWiringManifest(input) {
     const platformSuspendArmed = durableSuspendInfraReady && (envLifetimeSuspendAt !== undefined || usageGovernance !== undefined);
     const durableApproval = spec.durableApproval ??
         (runtimeCaps?.forceDurableGate ? { scope: spec.principal || DEFAULT_IRREVERSIBLE_SCOPE } : undefined);
+    const writeProtection = mountWriteProtection({ deps, env: handsEnabled ? executionEnv : undefined, rootPath: taskRootFinal, roster: toolRoster, sessionId, runId });
     const wiringQuestionSeam = resolveQuestionSeam(spec, deps);
     const wiringQuestionStripped = internals?.questionFaceStripped === true;
     const wiringAskSeam = resolveAskSeamForm(spec, deps);
@@ -204,6 +206,7 @@ export function prepareWiringManifest(input) {
         ...(modelGateManifest !== undefined ? { modelGate: modelGateManifest } : {}),
         autoMode: { ...autoModeArmReason },
         mcp: mcpManifestEntries(lockedPreflight.mcp, mcp.statuses),
+        ...(writeProtection !== undefined ? { writeProtectionTargetView: writeProtection.targetView } : {}),
         tools: toolRoster,
         hooks: wiredHookEntries(hooks, spec.hooks !== undefined ? "spec" : "deps", preToolUseObservational),
         ...(lspManagerWired ? { lsp: deriveLspSeam(toolRoster.entries.some((e) => e.contract.contractId === LSP_CONTRACT_ID), lspDiagnosticsLive) } : {}),
@@ -242,5 +245,5 @@ export function prepareWiringManifest(input) {
     });
     const hookContextConsumerWired = hooks?.preToolUse !== undefined || hooks?.postToolUse !== undefined || hooks?.postToolUseFailure !== undefined;
     const hookEnvFace = hookContextConsumerWired && (ownedEnv ?? deps.executionEnv) != null ? createHookEnvCapabilities(executionEnv) : undefined;
-    return { onAsk, preToolContexts, blockedToolCalls, gateOutcomes, batchHaltRef, blockedTracked, incompleteSuspendAdapter, durableSuspendInfraReady, resourceSuspendEligible, usageGovernance, platformSuspendArmed, durableApproval, wiringManifest, parkLaneArmed, gateMachineryActive, hookIdentity, hookEnvFace };
+    return { onAsk, preToolContexts, blockedToolCalls, gateOutcomes, batchHaltRef, blockedTracked, incompleteSuspendAdapter, durableSuspendInfraReady, resourceSuspendEligible, usageGovernance, platformSuspendArmed, durableApproval, wiringManifest, writeProtectionCheck: writeProtection?.check, parkLaneArmed, gateMachineryActive, hookIdentity, hookEnvFace };
 }