@sema-agent/core 7.19.0 → 7.20.1

package/dist/core/runner/write-protection-station.js

@@ -0,0 +1,32 @@
+import { deliverEngineNotice } from "../engine-notice.js";
+import { protectivePathTargetOf } from "../tool-registry.js";
+import { createWriteProtectionCheck } from "../write-protect.js";
+export function mountWriteProtection(input) {
+    const mount = createWriteProtectionCheck(input.deps.writeProtectedPaths, {
+        ...(input.deps.memoryEngineDir !== undefined ? { dataRoot: input.deps.memoryEngineDir } : {}),
+        ...(input.env !== undefined ? { env: input.env } : {}),
+        rootPath: input.rootPath,
+    });
+    if (mount === undefined || mount.targetView !== "spelling-only")
+        return mount;
+    const covered = input.roster.entries
+        .filter((e) => [e.name, ...e.aliases].some((name) => {
+        const target = protectivePathTargetOf({ toolName: name, args: {}, face: e.pathTarget !== undefined ? { pathTarget: e.pathTarget } : {} });
+        return target !== undefined && target.access !== "read";
+    }))
+        .map((e) => e.name)
+        .sort();
+    if (covered.length === 0)
+        return mount;
+    deliverEngineNotice(input.deps.onNotice, {
+        code: "config.write_protection_target_view_absent",
+        message: `This run mounted path-confinable write tools [${covered.join(", ")}] while its write-protection judge has NO execution environment, ` +
+            `so the judge compares path SPELLINGS against its table and nothing else. A write whose spelling misses the table but whose real target ` +
+            `resolves onto a protected path — through a symlink, a bind mount or a ".." walk — is cleared, and cleared silently: the resolved-target ` +
+            `half of the judgment needs a filesystem to resolve in. Nothing about this run changed. Wire an execution environment (RunnerDeps.executionEnv) ` +
+            `to get the target view back, or accept the spelling-only floor knowingly — the leg's wiring manifest reports which one is in force at ` +
+            `writeProtection.targetView.`,
+        detail: { tools: covered, sessionId: input.sessionId, runId: input.runId },
+    });
+    return mount;
+}

package/dist/core/safe-notify.d.ts

@@ -56,6 +56,11 @@ export interface SafeNotifierOptions {
      */
     readonly onError?: (failure: SafeNotifyFailure) => void;
 }
+/** The sentence of a contained failure, for a consumer that puts it in front of a person. Total by the
+ *  same rule as {@link containedError}: an error object handed in from elsewhere (a `lastErrorAt`
+ *  reading, a rejection an adapter wrapped) may still carry a hostile `message`, and the disclosure a
+ *  site composes from it must not be the thing that faults. */
+export declare function safeErrorMessage(error: unknown): string;
 export interface SafeNotifier {
     /**
      * Run one host-callback invocation, containing any throw. Returns `true` when it completed, `false` when it

package/dist/core/safe-notify.js

@@ -1,9 +1,30 @@
+function containedError(thrown) {
+    try {
+        if (thrown instanceof Error && typeof thrown.message === "string")
+            return thrown;
+        return new Error(String(thrown));
+    }
+    catch {
+        return new Error(`a thrown value of type ${typeof thrown} that cannot be inspected or converted to text`);
+    }
+}
+export function safeErrorMessage(error) {
+    try {
+        const m = error?.message;
+        if (typeof m === "string")
+            return m;
+        return String(error);
+    }
+    catch {
+        return "a failure whose message could not be read";
+    }
+}
 export function createSafeNotifier(opts) {
     const onError = opts?.onError;
     let sites;
     let total = 0;
     const record = (site, thrown) => {
-        const error = thrown instanceof Error ? thrown : new Error(String(thrown));
+        const error = containedError(thrown);
         total += 1;
         if (sites === undefined)
             sites = new Map();
@@ -60,8 +81,9 @@ export function createSafeNotifier(opts) {
 export function observeThenableRejection(r, notifier, site) {
     if (typeof r?.then === "function") {
         r.then(undefined, (err) => {
+            const error = containedError(err);
             notifier.notify(() => {
-                throw err instanceof Error ? err : new Error(String(err));
+                throw error;
             }, site);
         });
     }

package/dist/core/sensitive-path-policy.d.ts

@@ -54,20 +54,13 @@ export declare function agentConfigDenyPatterns(): readonly string[];
  * hard refusal for every deployment that wires this list.
  *
  * SEVERITY LAYERING for the agent-configuration class: the law is {@link agentConfigDenyPatterns} —
- * configuration FILES here, the DIRECTORY one step down on {@link RECOMMENDED_SENSITIVE_ASK_PATTERNS}
- * (same judge, so the severity drops and the reach does not); a directory also holds the person's own
- * material, and the directory-wide entry turned an explicit instruction to edit `.claude/projects/…`
- * into a refusal nobody could lift (a deny outranks an ask under the fold).
+ * configuration FILES here, the DIRECTORY one step down on the always-on write-protection table
+ * (`WRITE_PROTECTED_DEFAULT_TABLE`'s `.claude` / `.sema` rows — the same reach, since that judge sees the
+ * real target too, {@link import("./write-protect.js").WriteProtectionMatcher.judge}); a directory also
+ * holds the person's own material, and a directory-wide DENY entry turned an explicit instruction to edit
+ * `.claude/projects/…` into a refusal nobody could lift (a deny outranks an ask under the fold).
  */
 export declare const RECOMMENDED_SENSITIVE_PATTERNS: readonly string[];
-/**
- * The ASK-severity half of the same guard: the agent-configuration DIRECTORIES, on the SAME judge
- * ({@link createSensitivePathPolicy}'s `askPatterns` seat, whose ABSENCE reads as this list) — only the
- * directories, since the configuration FILES inside them are deny material above. It lives HERE and not
- * only on `WRITE_PROTECTED_DEFAULT_TABLE`, which names the same segments but judges LEXICALLY: a
- * symlink with an innocent name walks past that one, so demoting to it alone trades severity for REACH.
- */
-export declare const RECOMMENDED_SENSITIVE_ASK_PATTERNS: readonly string[];
 /**
  * HRD-PRM-10 — the engine data root, read from the same knob its two consumers read
  * (`$AGENT_DATA_DIR ?? ~/.ai-agent`, off the HOST at wiring time, NFC-normalized) and returned in
@@ -85,16 +78,53 @@ export declare const RECOMMENDED_SENSITIVE_ASK_PATTERNS: readonly string[];
  */
 export declare function dataRootSpellings(explicit: string | undefined): string[];
 /**
- * Build a composable policy that judges writes (via the guarded fs tools) by their CANONICAL target,
- * at TWO severities from ONE judge. `patterns` is the DENY set — deployment-supplied, no default list
- * is shipped; `askPatterns` is the ASK set, judged the same way and consulted only where the deny set
- * misses, so a path on both denies. Both empty = a no-op allow.
+ * The data root's identity in the SAME namespace a judged key lives in: every declared spelling
+ * ({@link dataRootSpellings}) run through the SAME `canonicalizeTarget` that mints the target key. Not a
+ * second canonicalization — the same one, on the other operand, which is what lets
+ * {@link relativeUnderRoot}'s comparison be exact.
+ *
+ * Resolved PER CALL, deliberately not cached. A cached canonical root is a snapshot of the symlink
+ * topology at first use: with a data root reached through a symlink, retargeting it left the policy
+ * still exempting the OLD target for the life of the run. The module header already accepts paying
+ * `canonicalizeTarget` twice for a guarded write as the price of a decoupled gate; this is the same
+ * bargain on the other operand, and a request-scoped cache is the same note's answer if profiling
+ * ever asks for one. A spelling that cannot be resolved contributes NO exemption (the guard's side wins).
+ *
+ * ONE resolver for both write judges (the deny set here, the always-on table's target view) — an
+ * engine-internal seam, like the two neighbours above.
+ */
+export declare function canonicalDataRootKeys(env: ExecutionEnv, spellings: readonly string[], signal?: AbortSignal): Promise<string[]>;
+/**
+ * Is `targetKey` inside the data root `rootKey`, and if so what is its path relative to it? Returns
+ * the relative sub-path (`""` when the target IS the root), or `null` for everything else.
+ *
+ * 🔴 EXACT, and deliberately nothing else. Both operands are minted by the SAME canonicalizer, so
+ * every transformation this comparison could apply — a case fold, an NFC pass, splitting a foreign
+ * separator family, unioning several readings of the root — can only ADD matches. On the DENY side of
+ * this file that is the safe direction and several of those transforms are applied on purpose (a
+ * spelling filter is not a path filter). Here the direction inverts: this test grants an EXEMPTION, so
+ * an added match is not a wider guard, it is a bypass of one — each of case folding, an NFC pass and a
+ * foreign-family read was measured leaking an unrelated sibling into the exemption (their pins name the
+ * shapes). The rule: compare what the canonicalizer produced, byte for byte, every uncertainty falling
+ * to the deny side.
+ *
+ * The separator family comes from the ROOT key (a backslash is an ordinary filename character on
+ * POSIX, so a root `/x/.sema/data` must not swallow the sibling FILE `/x/.sema/data\evil`), and a root
+ * that reduces to nothing exempts nothing rather than exempting the filesystem.
  *
- * @contract sensitive_paths.two_severities_one_judge — ONE canonicalizing judge answers both
- * severities: a deny is a refusal no approver and no persisted allow rule can lift, an ask is one
- * explicit look that either of them may clear. Lowering a path's severity here never lowers its REACH
- * — both tiers see the real target (symlinks resolved, relative spellings resolved against the call's
- * live cwd), which the synchronous write-protection TABLE deliberately does not.
+ * Exported as an ENGINE-INTERNAL seam (not re-exported from `src/index.ts`), like {@link dataRootSpellings}:
+ * the always-on write-protection judge applies the same exemption on its target view, and a second
+ * containment test would be a second place for the two judges to disagree about what "inside" means.
+ */
+export declare function relativeUnderRoot(targetKey: string, rootKey: string): string | null;
+/**
+ * Build a composable policy that DENIES writes (via the guarded fs tools) whose CANONICAL target lands on
+ * a guarded pattern. `patterns` is deployment-supplied — no default list is shipped; empty = a no-op allow.
+ * A deny is a refusal no approver and no persisted allow rule can lift. The ASK severity of the same class
+ * (the agent-configuration DIRECTORIES) is not a tier here: it is the always-on write-protection table's,
+ * which judges the same real target ({@link import("./write-protect.js").WriteProtectionMatcher.judge} —
+ * its contract sentence `write_protection.judges_the_real_target` says the two differ in vocabulary and
+ * severity, never in reach).
  *
  * `env` is the same ExecutionEnv the hands run against (inject the one you pass to the Runner), so
  * canonicalization sees the task's real filesystem (a remote/E2B task resolves in its container).
@@ -104,17 +134,13 @@ export declare function dataRootSpellings(explicit: string | undefined): string[
  *
  * Fail-open by design: a tool with no string `path` returns `allow` here — this guard adds friction on
  * top of the other gates, it is not the only line of defense, and it must not turn an unrelated tool
- * call into a spurious verdict. The verdicts it owns are narrow and certain: "the real target IS a
- * guarded path → deny / ask". (A target it could not RESOLVE is the one fail-CLOSED arm, below.)
+ * call into a spurious verdict. The verdict it owns is narrow and certain: "the real target IS a
+ * guarded path → deny". (A target it could not RESOLVE is the one fail-CLOSED arm, below.)
  */
 export declare function createSensitivePathPolicy(opts: {
     env: ExecutionEnv;
     /** `readonly` accepted so {@link RECOMMENDED_SENSITIVE_PATTERNS} can be passed as-is (widening, non-breaking). */
     patterns: readonly string[];
-    /** The ASK-severity set, same syntax and same judge as `patterns`, consulted only where the deny set
-     *  misses. ABSENT ⇒ {@link RECOMMENDED_SENSITIVE_ASK_PATTERNS}, so a deployment already wiring this
-     *  guard keeps its reach over those directories without a code change; `[]` = no ask tier. */
-    askPatterns?: readonly string[];
     rootPath?: string;
     /**
      * HRD-PRM-10 — the engine data root this deployment runs on. Default

package/dist/core/sensitive-path-policy.js

@@ -50,7 +50,6 @@ export const RECOMMENDED_SENSITIVE_PATTERNS = [
     ".bash_history",
     ".zsh_history",
 ];
-export const RECOMMENDED_SENSITIVE_ASK_PATTERNS = [".claude", ".sema"];
 const CASE_INSENSITIVE_FS = process.platform === "darwin" || process.platform === "win32";
 export function dataRootSpellings(explicit) {
     const raw = explicit ?? process.env.AGENT_DATA_DIR ?? join(homedir(), ".ai-agent");
@@ -65,7 +64,20 @@ export function dataRootSpellings(explicit) {
     }
     return out;
 }
-function relativeUnderRoot(targetKey, rootKey) {
+export async function canonicalDataRootKeys(env, spellings, signal) {
+    const keys = [];
+    for (const spelling of spellings) {
+        try {
+            const r = await canonicalizeTarget(env, spelling, signal, pathFamilyOf({ root: spelling }));
+            if (r.ok && !keys.includes(r.key))
+                keys.push(r.key);
+        }
+        catch {
+        }
+    }
+    return keys;
+}
+export function relativeUnderRoot(targetKey, rootKey) {
     const seps = isWinFormPath(rootKey) ? ["\\", "/"] : ["/"];
     let root = rootKey;
     while (root.length > 0 && seps.includes(root[root.length - 1]))
@@ -96,25 +108,11 @@ function matchSensitive(canonicalKey, compiled, aliasResolved) {
 }
 export function createSensitivePathPolicy(opts) {
     const compiled = compilePatterns(opts.patterns);
-    const compiledAsk = compilePatterns(opts.askPatterns ?? RECOMMENDED_SENSITIVE_ASK_PATTERNS);
     const dataRootPaths = dataRootSpellings(opts.dataRoot);
-    const dataRootKeys = async (signal) => {
-        const keys = [];
-        for (const spelling of dataRootPaths) {
-            try {
-                const r = await canonicalizeTarget(opts.env, spelling, signal, pathFamilyOf({ root: spelling }));
-                if (r.ok && !keys.includes(r.key))
-                    keys.push(r.key);
-            }
-            catch {
-            }
-        }
-        return keys;
-    };
     const guardedByName = opts.tools !== undefined ? new Set(opts.tools) : undefined;
     return {
         async check(req, signal) {
-            if (compiled.length === 0 && compiledAsk.length === 0)
+            if (compiled.length === 0)
                 return { action: "allow" };
             if (guardedByName !== undefined ? !guardedByName.has(req.toolName) : !isProtectedWrite(req))
                 return { action: "allow" };
@@ -133,7 +131,7 @@ export function createSensitivePathPolicy(opts) {
                 };
             }
             let relative = null;
-            for (const rootKey of await dataRootKeys(signal)) {
+            for (const rootKey of await canonicalDataRootKeys(opts.env, dataRootPaths, signal)) {
                 relative = relativeUnderRoot(canon.key, rootKey);
                 if (relative !== null)
                     break;
@@ -149,14 +147,6 @@ export function createSensitivePathPolicy(opts) {
                     decisionReason: "safety",
                 };
             }
-            const askHit = matchSensitive(judged, compiledAsk, canon.aliasResolved === true);
-            if (askHit) {
-                return {
-                    action: "ask",
-                    message: `this write's real target resolves inside the guarded directory "${askHit}" — explicit approval required`,
-                    decisionReason: "safety",
-                };
-            }
             return { action: "allow" };
         },
     };

package/dist/core/skill-listing-budget.d.ts

@@ -5,6 +5,10 @@
  * budget costs a skill its description. The reader is pure; the announcer's only effect is the notice.
  * `runner/synthetic-tools.ts` owns the renderer that consumes the numbers.
  *
+ * The listing frame is an INTACT-class turn attachment (`runner/turn-attachments.ts`
+ * `ATTACHMENT_DELIVERY_CLASS`): the delivery lane never clips it, so the number this reader produces is
+ * the number the frame is rendered to — there is no lane ceiling above it.
+ *
  * Sibling of `tool-search-setting.ts` in shape and in posture: a value outside its domain REFUSES
  * loudly rather than folding back to the default, because a knob that is silently dropped reads to the
  * deployment as a knob that took effect.
@@ -28,50 +32,37 @@ export declare const SKILL_LISTING_DEFAULT_CONTEXT_TOKENS = 200000;
  * default deployment's listing, removed by an estimator's safety margin.
  */
 export declare const SKILL_LISTING_BYTES_PER_TOKEN = 4;
-/**
- * The hard ceiling on the rendered `<skills>` block, in UTF-8 bytes.
- *
- * @contract skills.listing_budget_ceiling — this is a STRUCTURAL property of the delivery lane, not a
- * policy choice and not a superset optimization. The block is not part of the system prompt: it is the
- * body of the `skills_listing` turn attachment, and every attachment bundle is capped at
- * `ATTACHMENT_BYTE_CAP` (8 KiB) by the boundary's `capAttachments`, which CLIPS anything over. A
- * clipped skills frame never satisfies the run loop's intact-survival commit predicate, so the
- * announced set never advances and the frame is re-rendered and re-clipped at every subsequent
- * boundary — permanently. The cap is therefore enforced byte-exact over the WHOLE render (fences,
- * headers, markers, joiners included) and MUST stay ≤ `ATTACHMENT_BYTE_CAP`; the renderer's module
- * pins that relation, since importing the attachment module here would invert the dependency.
- *
- * The consequence is a one-way knob: {@link resolveSkillListingBudget} clamps the declared budget to
- * this number, so a raised fraction (or a model with a very large window) can LOWER the listing budget
- * but can never raise it above this ceiling. When the clamp costs a description, both numbers ride the
- * disclosure ({@link announceSkillListingTruncation}), so the deployment reads what it asked for beside
- * what it got instead of inferring the ceiling from a short listing.
- */
-export declare const SKILLS_BLOCK_MAX_BYTES = 8000;
 /** The typed refusal a budget seat outside its domain raises: a bad value never selects a smaller
  *  listing silently, and never folds back to the default budget. */
 export declare const SKILL_LISTING_BUDGET_INVALID_CODE = "config.skill_listing_budget_invalid";
 /** The notice code minted when the budget cost at least one skill its description or its line. */
 export declare const SKILL_LISTING_TRUNCATED_CODE = "skills.listing_truncated";
-/** The lowered seat: the two numbers the renderer measures against, plus what was asked for. */
+/** The agent-type listing's twin: minted when the budget cost at least one agent type its detail or its line. */
+export declare const AGENT_LISTING_TRUNCATED_CODE = "agents.listing_truncated";
+/** Which listing frame a degradation report describes. */
+export type ListingKind = "skills" | "agents";
+/** The lowered seat: the two numbers the renderer measures against. */
 export interface ResolvedSkillListingBudget {
-    /** The budget the renderer enforces over the whole block, in UTF-8 bytes — already clamped to
-     *  {@link SKILLS_BLOCK_MAX_BYTES}. */
+    /** The budget the renderer enforces over the whole block (fences, headers, markers, joiners
+     *  included), in UTF-8 bytes. */
     blockMaxBytes: number;
-    /** What the declared fraction asked for BEFORE the structural clamp. Equal to `blockMaxBytes`
-     *  whenever the ceiling did not bind; strictly greater when it did. */
-    requestedBytes: number;
     /** Per-skill description cap in code units, ellipsis included. */
     descMaxChars: number;
 }
 /**
  * The ONE reader of the two listing-budget seats.
  *
+ * @contract skills.listing_budget_enforced_as_declared — the resolved `blockMaxBytes` is
+ * `floor(window × 4 × fraction)` with no ceiling above it: the `<skills>` frame is an intact-class
+ * attachment the delivery lane never clips, so what the deployment declares is what the renderer
+ * folds the listing into, on the initial block and on every drift frame alike. The fraction's own
+ * domain `(0, 1]` is the only upper bound (a whole window at most), and a value outside it refuses.
+ *
  * `skillListingBudgetFraction` must be a finite number in `(0, 1]` — zero is excluded deliberately: a
  * zero budget is not "spend nothing", it is a listing every skill loses its description to, which the
  * deployment expresses by declaring fewer skills. `skillListingMaxDescChars` must be a positive safe
  * integer. Both absent ⇒ the documented defaults, which reproduce the pre-seat render byte for byte
- * (`200 000 × 4 × 0.01` = 8 000 = {@link SKILLS_BLOCK_MAX_BYTES}).
+ * (`200 000 × 4 × 0.01` = 8 000 bytes).
  *
  * The window is `contextTokens ?? contextWindow`, the same physical coordinate the deferral gate
  * measures against. A window that is absent OR unusable (non-finite, non-positive) reads as
@@ -87,23 +78,26 @@ export declare function resolveSkillListingBudget(opts: {
         contextWindow?: number;
     } | undefined;
 }): ResolvedSkillListingBudget;
+/** The reader's answer to "no knobs declared, no window declared" — the budget a renderer measures
+ *  against when its caller hands it none. One rule: only the reader turns knobs into numbers. */
+export declare const SKILL_LISTING_DEFAULT_BUDGET: Readonly<ResolvedSkillListingBudget>;
 /**
- * Announce a listing the budget degraded — delivered only when a skill actually lost its description
- * (`nameOnly`) or its line (`dropped`), so a deployment whose roster fits hears nothing.
+ * Announce a listing frame the budget degraded — delivered only when an entry actually lost its detail
+ * (`nameOnly`) or its line (`dropped`), so a deployment whose roster fits hears nothing. One announcer
+ * for both listing frames; the code names the frame (`skills.listing_truncated` / `agents.listing_truncated`).
  *
- * Called from the two lanes that DELIVER a listing frame (the leg's first-frame producer and the turn
- * boundary), never from the config door: the door cannot see the deployment's
- * `attachments.skillsListing` switch (resolved at run start), it runs per prepared task rather than per
- * delivered listing, and a resume leg reaches only the boundary.
+ * Called from the commit of the frame's receipt — the moment the carrying message is in the transcript —
+ * never from the config door: the door cannot see the deployment's listing switches (resolved at run
+ * start), it runs per prepared task rather than per delivered listing, and a resume leg reaches only
+ * the boundary.
  *
- * Audience is `operator`: the person who can raise the fraction, shorten a description or remove a
- * skill runs the deployment, not the session. `requestedBudgetBytes` rides beside `budgetBytes`
- * precisely so the structural ceiling ({@link SKILLS_BLOCK_MAX_BYTES}) is legible at the moment it
- * costs something — the two differ only when the clamp bound.
+ * Audience is `operator`: the person who can raise the fraction, shorten a description or remove an
+ * entry runs the deployment, not the session.
  */
-export declare function announceSkillListingTruncation(onNotice: ((notice: EngineNotice) => void) | undefined, opts: {
-    /** The denominator: how many skills the DELIVERED frame set out to list — the whole roster on an
-     *  initial block, the newly announced set on a drift frame. Read off that frame's own render. */
+export declare function announceListingTruncation(onNotice: ((notice: EngineNotice) => void) | undefined, opts: {
+    listing: ListingKind;
+    /** The denominator: how many entries the DELIVERED frame set out to list — the whole roster on an
+     *  initial frame, the newly announced set on a drift frame. Read off that frame's own render. */
     total: number;
     nameOnly: readonly string[];
     dropped: readonly string[];

package/dist/core/skill-listing-budget.js

@@ -4,9 +4,9 @@ export const SKILL_LISTING_BUDGET_FRACTION_DEFAULT = 0.01;
 export const SKILL_LISTING_DESC_MAX_CHARS_DEFAULT = 1_536;
 export const SKILL_LISTING_DEFAULT_CONTEXT_TOKENS = 200_000;
 export const SKILL_LISTING_BYTES_PER_TOKEN = 4;
-export const SKILLS_BLOCK_MAX_BYTES = 8_000;
 export const SKILL_LISTING_BUDGET_INVALID_CODE = "config.skill_listing_budget_invalid";
 export const SKILL_LISTING_TRUNCATED_CODE = "skills.listing_truncated";
+export const AGENT_LISTING_TRUNCATED_CODE = "agents.listing_truncated";
 function budgetRefusal(problem) {
     const e = new Error(`TaskSpec.${problem}; a bad value refuses loudly, nothing falls back to the default listing budget.`);
     e.code = SKILL_LISTING_BUDGET_INVALID_CODE;
@@ -24,35 +24,34 @@ export function resolveSkillListingBudget(opts) {
     const windowTokens = typeof declaredWindow === "number" && Number.isFinite(declaredWindow) && declaredWindow > 0
         ? declaredWindow
         : SKILL_LISTING_DEFAULT_CONTEXT_TOKENS;
-    const requestedBytes = Math.max(1, Math.floor(windowTokens * SKILL_LISTING_BYTES_PER_TOKEN * (fraction ?? SKILL_LISTING_BUDGET_FRACTION_DEFAULT)));
     return {
-        blockMaxBytes: Math.min(requestedBytes, SKILLS_BLOCK_MAX_BYTES),
-        requestedBytes,
+        blockMaxBytes: Math.max(1, Math.floor(windowTokens * SKILL_LISTING_BYTES_PER_TOKEN * (fraction ?? SKILL_LISTING_BUDGET_FRACTION_DEFAULT))),
         descMaxChars: maxDescChars ?? SKILL_LISTING_DESC_MAX_CHARS_DEFAULT,
     };
 }
-export function announceSkillListingTruncation(onNotice, opts) {
-    const { total, nameOnly, dropped, budget } = opts;
+export const SKILL_LISTING_DEFAULT_BUDGET = Object.freeze(resolveSkillListingBudget({}));
+export function announceListingTruncation(onNotice, opts) {
+    const { listing, total, nameOnly, dropped, budget } = opts;
     if (nameOnly.length === 0 && dropped.length === 0)
         return;
-    const clamped = budget.requestedBytes > budget.blockMaxBytes;
-    deliverEngineNotice(onNotice, {
-        code: SKILL_LISTING_TRUNCATED_CODE,
-        message: `The skills listing does not fit its ${budget.blockMaxBytes}-byte budget` +
-            (clamped ? ` (${budget.requestedBytes} bytes were declared; the listing's delivery lane caps it at ${SKILLS_BLOCK_MAX_BYTES})` : "") +
-            `: ${nameOnly.length} of ${total} are listed name-only` +
-            (dropped.length > 0 ? `, and ${dropped.length} did not fit the listing at all` : "") +
-            `. The \`Skill\` tool still serves every one of them. Raise skillListingBudgetFraction, lower` +
-            ` skillListingMaxDescChars, or declare fewer skills.`,
-        detail: {
-            budgetBytes: budget.blockMaxBytes,
-            requestedBudgetBytes: budget.requestedBytes,
-            descMaxChars: budget.descMaxChars,
-            total,
-            kept: total - nameOnly.length - dropped.length,
-            nameOnly: [...nameOnly],
-            dropped: [...dropped],
-            ...(opts.sessionId !== undefined ? { sessionId: opts.sessionId } : {}),
-        },
-    });
+    const skills = listing === "skills";
+    const message = `The ${skills ? "skills" : "agent-type"} listing does not fit its ${budget.blockMaxBytes}-byte budget` +
+        `: ${nameOnly.length} of ${total} are listed name-only` +
+        (dropped.length > 0 ? `, and ${dropped.length} did not fit the listing at all` : "") +
+        (skills
+            ? `. The \`Skill\` tool still serves every one of them. Raise skillListingBudgetFraction, lower skillListingMaxDescChars, or declare fewer skills.`
+            : `. Raise skillListingBudgetFraction or declare fewer agent types.`);
+    const detail = {
+        budgetBytes: budget.blockMaxBytes,
+        ...(skills ? { descMaxChars: budget.descMaxChars } : {}),
+        total,
+        kept: total - nameOnly.length - dropped.length,
+        nameOnly: [...nameOnly],
+        dropped: [...dropped],
+        ...(opts.sessionId !== undefined ? { sessionId: opts.sessionId } : {}),
+    };
+    if (skills)
+        deliverEngineNotice(onNotice, { code: SKILL_LISTING_TRUNCATED_CODE, message, detail });
+    else
+        deliverEngineNotice(onNotice, { code: AGENT_LISTING_TRUNCATED_CODE, message, detail });
 }

package/dist/core/skills-directory.js

@@ -197,6 +197,19 @@ function listRelativeFiles(base, dir, prefix, out, walk) {
         }
     }
 }
+function skillPhysicalRoot(skillDir, skillName, warn) {
+    try {
+        return physicalPathOf(skillDir);
+    }
+    catch (err) {
+        warn({
+            code: "read_failed",
+            skill: skillName,
+            detail: `the skill directory could not be resolved (${errText(err)}) — attachments skipped and no base directory is stated`,
+        });
+        return undefined;
+    }
+}
 function resolveInsideSkill(abs, rel, walk) {
     let real;
     let stats;
@@ -218,15 +231,7 @@ function resolveInsideSkill(abs, rel, walk) {
     }
     return { real, stats };
 }
-function readAttachments(skillDir, skillName, budgetBytes, warn) {
-    let realRoot;
-    try {
-        realRoot = physicalPathOf(skillDir);
-    }
-    catch (err) {
-        warn({ code: "read_failed", skill: skillName, detail: `the skill directory could not be resolved (${errText(err)}) — attachments skipped` });
-        return [];
-    }
+function readAttachments(skillDir, realRoot, skillName, budgetBytes, warn) {
     const walk = { realRoot, skill: skillName, warn, visited: new Set([realRoot]) };
     const relPaths = [];
     for (const d of RESOURCE_DIRS) {
@@ -442,11 +447,13 @@ export function createSkillsFromDirectory(dir, options = {}) {
                 detail: `disallowed-tools names ${disallowed.map((n) => `"${n}"`).join(", ")}, but this skill produced no allowlist to subtract from (allowed-tools is absent or claims every tool) — the deny declaration is NOT enforced (express it in the task's own tool policy)`,
             });
         }
-        const files = readAttachments(skillDir, name, budget, warn);
+        const baseDir = skillPhysicalRoot(skillDir, name, warn);
+        const files = baseDir === undefined ? [] : readAttachments(skillDir, baseDir, name, budget, warn);
         skills.push({
             name: declaredName,
             description,
             content: parsed.body,
+            ...(baseDir !== undefined ? { baseDir } : {}),
             ...(manifest !== undefined ? { manifest } : {}),
             ...(files.length > 0 ? { files } : {}),
         });

package/dist/core/task-registry.js

@@ -5,6 +5,7 @@ import { shutdownDebug } from "./shutdown-debug.js";
 import { canAccessAgentRecord, } from "./background-agent-store.js";
 import { delimitUntrusted } from "./untrusted-text.js";
 import { createSafeNotifier } from "./safe-notify.js";
+import { stripCwdSentinel } from "../tools/fs/fs-shared.js";
 import { registerMonitorLane, pollMonitorLane, stopMonitorLane } from "./task-registry-monitor.js";
 import { registerWorkflowLane, pollWorkflowLane, stopWorkflowLane } from "./task-registry-workflow.js";
 import { mintCompletionId, canAccessWorkflowRun, formatWorkflowRun, clipTaskOutput, assertOwnership, sleepPollStep, statusFromBackground, rollSpoolText, accountDroppedBytes, renderSpoolBody, spoolDropNote, droppedGapNote, alreadyTerminalStopNote, terminalTaskSummary, TASK_OUTPUT_MAX_CHARS, MONITOR_BATCH_WINDOW_MS, MONITOR_DEFAULT_TIMEOUT_MS, MONITOR_MAX_TIMEOUT_MS, MONITOR_MAX_BATCHES_PER_MINUTE, canAccess, DURABLE_AGENT_HANDLE_RE, } from "./task-registry-shared.js";
@@ -46,7 +47,7 @@ function noTaskForStop(taskId, enrich) {
 }
 function bashTerminalResult(spool) {
     const out = spool.stdout.slice(-2_000);
-    const err = spool.stderr.slice(-2_000);
+    const err = stripCwdSentinel(spool.stderr).stderr.slice(-2_000);
     return err.length > 0 ? `${out}${out.length > 0 ? "\n" : ""}--- stderr (tail) ---\n${err}` : out;
 }
 async function drainBashTailBestEffort(handle) {

package/dist/core/task-spec.d.ts

@@ -944,11 +944,12 @@ export interface TaskSpec {
      * listing degrades inside it: every skill stays listed, the lower-priority ones (declaration order)
      * lose their descriptions first. Raising this is opting in to a higher per-turn context cost.
      *
-     * ⚠️ ONE-WAY IN PRACTICE (`@contract skills.listing_budget_ceiling`): the listing rides the turn-
-     * attachment lane, whose bundle cap is a hard structural limit, so the resolved budget is clamped to
-     * 8 000 bytes. A fraction that asks for MORE lowers nothing and raises nothing; a fraction that asks
-     * for less takes effect exactly. When the clamp costs a skill its description, both numbers ride the
-     * `skills.listing_truncated` notice.
+     * Enforced as declared (`@contract skills.listing_budget_enforced_as_declared`): the listing frames are
+     * intact-class turn attachments the delivery lane never clips, so the resolved budget has no ceiling
+     * above it — a fraction that asks for more gets more (a 1 000 000-token window at the default 0.01 is
+     * 40 000 bytes). The same fraction is EACH listing attachment's budget: the agent-type roster frame
+     * folds into `window × 4 × fraction` too (every type stays listed, the last-declared lose their detail
+     * first; `agents.listing_truncated` reports it).
      *
      * ⚠️ A model declaring a window SMALLER than 200 000 tokens now gets a proportionally smaller listing
      * budget than the flat 8 000 bytes that preceded this seat.
@@ -1251,8 +1252,8 @@ export interface TaskSpec {
      *    back to a transcript probe for older checkpoints — never replayed when already delivered.
      *  - `skillsListing` ([c209-C], DEFAULT-ON, mechanism-family sibling of `agentListing` — no CC
      *    delta anchor, registered in cc-divergences): the FIRST user turn carries the full `<skills>`
-     *    disclosure block (the exact render that used to sit in the stable system prompt — capped
-     *    byte-exact at SKILLS_BLOCK_MAX_BYTES 8000 ≤ the 8192 bundle cap since [c209-C] R2 C4, with
+     *    disclosure block (the exact render that used to sit in the stable system prompt — folded
+     *    byte-exact into the listing budget, `skillListingBudgetFraction` × the window, with
      *    name-only overflow); boundaries announce only skill-set drift. Resume seeding mirrors
      *    `agentListing`.
      *  - `mcpInstructions` (G1 续批 — CC `mcp_instructions_delta` parity): the INITIAL server

package/dist/core/tool-policy.d.ts

@@ -147,7 +147,7 @@ export declare function advertisedWritableRootsSeat(seat: {
 };
 declare const DECISION_REASONS: readonly ["rule", "mode", "hook", "safety", "classifier", "persisted_rule", "sandbox", "org_rule", "org_unavailable", "read_only"];
 export type DecisionReason = (typeof DECISION_REASONS)[number];
-/** Carry every engine attestation (settlement, classifier cause) from a decision onto a reconstruction of it — the
+/** Carry every engine attestation from a decision onto a reconstruction of it — the
  *  seam for the engine's OWN clone sites outside this module (the inherited chain's final-form re-check carries the
  *  post-rewrite args on a spread of an ancestor's deny). Not re-exported from `src/index.ts`. */
 export declare function carryEngineAttestations(from: object, to: object): void;
@@ -168,6 +168,17 @@ export declare function classifierDenyCauseOf(d: unknown, call: {
     toolCallId: string;
     toolName: string;
 }): import("./gate-outcome.js").ClassifierDenyCause | undefined;
+/** Attest that `d` is a decision a classifier station minted for `call` out of the named classification. */
+export declare function attestClassifierRound<T extends object>(d: T, round: import("./auto-mode.js").AutoModeClassifierRound, call: {
+    toolCallId: string;
+    toolName: string;
+}): T;
+/** Read the attested classification off a decision FOR the named call (the gate's fold is the consumer): a
+ *  binding to a different call is a replayed object and answers absence. Internal seam — not re-exported. */
+export declare function classifierRoundOf(d: unknown, call: {
+    toolCallId: string;
+    toolName: string;
+}): import("./auto-mode.js").AutoModeClassifierRound | undefined;
 /** Attest that `d` is an in-fold deny of an ask nobody could resolve, for `call`, for the named cause. */
 export declare function attestAskUnresolvableCause<T extends object>(d: T, cause: import("./ask-unresolvable-notice.js").AskUnresolvableCause, call: {
     toolCallId: string;