@sema-agent/core 7.23.4 → 7.23.5

package/dist/brain/stream-engine.js

@@ -1,12 +1,14 @@
 import { createAssistantMessageEventStream, } from "../internal/llm.js";
 import { STREAM_TORN_WARNING } from "./stream-shared.js";
 import { FLOOR_OUTPUT_TOKENS, parseContextOverflow, planOutputCapAdjustment } from "./context-overflow.js";
-import { BrainError, classifyConnectFailure, classifyHttp, describeNetworkError, namesTheFailure, readProviderRequestId } from "./errors.js";
+import { abortLikeName, BrainError, classifyConnectFailure, classifyFetchThrow, classifyHttp, describeNetworkError, namesTheFailure, readProviderRequestId } from "./errors.js";
+import { stripUrlCredentials } from "./route-adjudicator.js";
 import { classifyInputTooLong } from "./input-too-long.js";
 import { FAST_MAX_BACKOFF_MS, providerWaitHint, retryBackoffMs } from "./retry.js";
 import { bindBrainStatusEmitter, emitBrainStatus, emitBrainTelemetry } from "./status-sink.js";
 import { createConnectController, resolveStallTimeoutMs } from "./timeout.js";
 import { thrownText } from "../core/thrown-value.js";
+import { redactSecrets } from "../core/untrusted-egress.js";
 const DEFAULT_MAX_RETRIES = 10;
 const MAX_RETRIES_ENV_CEILING = 15;
 const MAX_RETRIES_ENV = "SEMA_MAX_RETRIES";
@@ -215,7 +217,7 @@ function emptyAssistant(model) {
     };
 }
 function isAbortError(err) {
-    return err instanceof Error && (err.name === "AbortError" || err.name === "TimeoutError");
+    return abortLikeName(err) !== undefined;
 }
 function sleep(ms, signal) {
     return new Promise((resolve) => {
@@ -338,6 +340,10 @@ export function runStreamingBrain(args) {
                         cc.dispose();
                         throw e;
                     }
+                    else if (classifyFetchThrow(e) === "request_unbuildable") {
+                        cc.dispose();
+                        throw new BrainError("invalid_request", `${httpLabel} request could not be built: ${redactSecrets(stripUrlCredentials(thrownText(e)))}`);
+                    }
                     else {
                         netErr = e;
                     }

package/dist/core/checkpoint-store.d.ts

@@ -248,12 +248,10 @@ export interface ProbeCause {
      *  account of an approval's reach is worse than none. */
     readonly further?: ProbeCauseOperands;
 }
-/** The bloat ceiling on {@link RiskDescriptor.probeReason} — one sentence of cause, sized
- *  like its {@link RiskDescriptor.shadowedRule} sibling. The neutralizer is the injection ceiling; this
- *  is only the length one. Exported (module-level, not part of the package's public surface) so the gate
- *  that sanitizes at the entry boundary and the descriptor builder that re-sanitizes at the persist
- *  boundary cannot cap the same value at two different lengths. */
-export declare const PROBE_REASON_MAX = 200;
+/** The bloat ceiling on {@link RiskDescriptor.probeReason} — re-exported from the leaf neutralizer module
+ *  for the same reason its `PROBE_CAUSE_PATH_MAX` sibling is homed there (a value import from tools/fs
+ *  back into this module closes an ESM cycle), so mint, gate and persist read ONE cap. */
+export { PROBE_REASON_MAX } from "./untrusted-text.js";
 /**
  * The ONE validator for a {@link ProbeCause} arriving from a probe.
  *

package/dist/core/checkpoint-store.js

@@ -1,6 +1,6 @@
 import { randomBytes, randomUUID } from "node:crypto";
 import { uuidv7 } from "../internal/harness.js";
-import { PROBE_CAUSE_PATH_MAX, inlineUntrusted, sanitizeUntrustedText } from "./untrusted-text.js";
+import { PROBE_CAUSE_PATH_MAX, PROBE_REASON_MAX, inlineUntrusted, sanitizeUntrustedText } from "./untrusted-text.js";
 import { carriesBidiControls } from "./tool-policy.js";
 import { readDenialLimitFallback } from "./auto-mode.js";
 import { isAskOrigin, isRuleStoreUnreadable } from "./ask-origin.js";
@@ -14,7 +14,7 @@ export function mintCheckpointToken() {
 export function mintCheckpointId() {
     return `cp_${randomUUID()}`;
 }
-export const PROBE_REASON_MAX = 200;
+export { PROBE_REASON_MAX } from "./untrusted-text.js";
 const PROBE_CAUSE_MAX_SHOWN = 8;
 export function normalizeProbeCause(value) {
     if (!isPlainRecord(value))

package/dist/core/permission-rule-model.js

@@ -144,9 +144,12 @@ function foldSpacing(s) {
 function reject(code, message) {
     return { reject: { code, message } };
 }
-const RULE_LANE_FLOOR = { pathPrefixedNameIsText: true };
-const MATCH_READING = { terminator: "keep", quotedOperatorsAreText: false, redirection: "reject" };
-const OFFER_READING = { terminator: "keep", quotedOperatorsAreText: false, redirection: "tolerate" };
+const RULE_LANE_FLOOR = {
+    pathPrefixedNameIsText: true,
+    quotedOperatorsAreText: true,
+};
+const MATCH_READING = { terminator: "keep", redirection: "reject" };
+const OFFER_READING = { terminator: "keep", redirection: "tolerate" };
 function commandBasename(name) {
     return name.slice(name.lastIndexOf("/") + 1);
 }
@@ -160,7 +163,7 @@ function ruleLaneShapeOf(command, reading) {
             names.push(undefined);
             continue;
         }
-        const floor = parseLeadingCommandName(segment, { ...RULE_LANE_FLOOR, quotedOperatorsAreText: reading.quotedOperatorsAreText });
+        const floor = parseLeadingCommandName(segment, RULE_LANE_FLOOR);
         if ("reject" in floor) {
             return {
                 reject: split.segments.length > 1
@@ -561,7 +564,7 @@ function admitsUnder(rule, command, reading) {
     if (rule.match === "exact")
         return folded === rule.command;
     const bodyShape = ruleLaneShapeOf(rule.command, reading);
-    if ("reject" in bodyShape)
+    if ("reject" in bodyShape || foldSpacing(rule.command) === undefined)
         return false;
     if (shape.segments.length !== bodyShape.segments.length)
         return false;

package/dist/core/runner/prepare-delegation-surface.d.ts

@@ -1,6 +1,7 @@
 import type { AgentTool, ExecutionEnv, WorkspaceState } from "../../internal/harness.js";
 import { type PeerLaneRefs } from "../../agents/peer-session-drain.js";
 import type { SubagentRetainLedger } from "../../agents/retain-ledger.js";
+import type { BashReadonlyRootBoundary } from "../../tools/fs/bash-readonly-classifier.js";
 import { type WorktreeSessionRef } from "../../tools/worktree.js";
 import type { CwdRef } from "../../tools/fs/index.js";
 import { type ToolResultStore } from "../tool-result-store.js";
@@ -36,6 +37,8 @@ export interface PrepareDelegationSurfaceInput {
     runnerSelf: RunnerSelfSeat | undefined;
     /** borrowed-readonly — the background/workflow door's first half: the hands mount decided a real shell with write hands. */
     backgroundTaskToolsActive: boolean;
+    /** borrowed-readonly — this run's shell read boundary (declared at the hands phase), for `Monitor`: the only P11 face that spawns a shell command. */
+    shellReadBoundarySeat: (() => BashReadonlyRootBoundary | undefined) | undefined;
     /** borrowed-readonly — the door's second half: the Workflow tool is on the roster. */
     workflowToolsActive: boolean;
     /** borrowed-readonly — the peer lane's mount verdict for this leg. */

package/dist/core/runner/prepare-delegation-surface.js

@@ -103,6 +103,7 @@ export function prepareDelegationSurface(input) {
         envHandToolNames.add("Monitor");
         roster.mount(firstPartyOffload(createMonitorTool(executionEnv, {
             registry: defaultTaskRegistry,
+            ...(input.shellReadBoundarySeat !== undefined ? { readBoundary: input.shellReadBoundarySeat } : {}),
             owner: hostTaskId,
             scope: taskScope,
             ...(sessionId !== undefined ? { sessionId } : {}),

package/dist/core/runner/prepare-hands-readface.d.ts

@@ -1,4 +1,4 @@
-import { type BeforeWriteHook, type CwdRef, type ReadDenyMatcher, type ContainmentFace } from "../../tools/fs/index.js";
+import { type BashReadonlyRootBoundary, type BeforeWriteHook, type CwdRef, type ReadDenyMatcher, type ContainmentFace } from "../../tools/fs/index.js";
 import { type ReadFileState } from "../../tools/fs/safety.js";
 import type { RunnerDeps, ShellGateDoctrine, TaskSpec } from "../types.js";
 import type { Model } from "../../internal/llm.js";
@@ -266,6 +266,9 @@ export interface PrepareHandsReadFaceResult {
     /** owned — real shell + write hands + background-capable env: gates the driver's TaskOutput/
      *  TaskStop/Monitor/SendMessage mounts (P11) and the Monitor arm of the shellGate fold here. */
     backgroundTaskToolsActive: boolean;
+    /** owned — this run's shell read BOUNDARY, published for a P11 face that spawns a shell command and
+     *  mounts LATER than the band (`Monitor`): the SAME closure the band's shell faces got. ⇔ hands. */
+    shellReadBoundarySeat: (() => BashReadonlyRootBoundary | undefined) | undefined;
     /** write-back (D-3 hold) — the run's RESOLVED read face where hands mount; undefined ⇔ no hands
      *  (the hands-less value lives in `handsLessResolvedFace`). The driver assigns this onto its
      *  outer `let` for the call-time closures (ctx enrichment / checkpoint mint / envFacts). */

package/dist/core/runner/prepare-hands-readface.js

@@ -137,6 +137,7 @@ export function resolveHandsLessReadFace(input) {
         wsSnapshot: undefined,
         rebaseWsPath: (p) => p,
         backgroundTaskToolsActive: false,
+        shellReadBoundarySeat: undefined,
         resolvedReadFace: undefined,
         resolvedWriteFace: undefined,
         readDenyAdditionsNormalized,
@@ -167,6 +168,7 @@ export async function prepareHandsMount(input) {
     let wsSnapshot;
     let rebaseWsPath = (p) => p;
     let backgroundTaskToolsActive = false;
+    let shellReadBoundarySeat;
     let resolvedReadFace;
     let resolvedWriteFace;
     let readDenyAdditionsNormalized = [];
@@ -335,6 +337,7 @@ export async function prepareHandsMount(input) {
             ...denySeat,
             ...(resolvedReadFace !== undefined ? { face: resolvedReadFace } : {}),
         });
+        shellReadBoundarySeat = shellReadBoundary;
         const band = createHandsToolkit(executionEnv, readFileState, rootCanonical, {
             ...(additionalRootsCanonical.length > 0 ? { additionalRoots: additionalRootsCanonical } : {}),
             ...(additionalReadRootsCanonical.length > 0 ? { additionalReadRoots: additionalReadRootsCanonical } : {}),
@@ -422,6 +425,7 @@ export async function prepareHandsMount(input) {
         wsSnapshot,
         rebaseWsPath,
         backgroundTaskToolsActive,
+        shellReadBoundarySeat,
         resolvedReadFace,
         resolvedWriteFace,
         handsLessResolvedWriteFace,

package/dist/core/runner/prepare-task.js

@@ -513,14 +513,14 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         }
         const handsReadFaceInput = { handsEnabled, executionEnv, taskRootFinal, taskRootCanonical, rebaseRestoredPath, resume, session, sessionId, hostTaskId, taskScope, fullShellReachable, effectiveShellGate, toolFaceSnapshot, model, spec, deps, internals, memoryWriteGate, ...(advertisedWritableDirs !== undefined ? { advertisedWritableDirs } : {}), firstPartyOffload, roster, egressTools, irreversibilityTier, irreversibleTools, reversibilityProbes, reminderMark, reminderDisclosureCounts, ...(trackFileEdit !== undefined ? { trackFileEdit } : {}), onFileEdited: noteFileEdited, harnessRef, toolProgressRef, ...(restoredFilePaths.length > 0 ? { restoredFilePaths } : {}) };
         const handsReadFace = handsEnabled ? await prepareHandsMount(handsReadFaceInput) : resolveHandsLessReadFace(handsReadFaceInput);
-        const { readFileStateForCheckpoint, seedContextFiles, handsCwdRef, workspaceStateSettle, wsSnapshot, rebaseWsPath, backgroundTaskToolsActive, additionalRootsCanonical, additionalReadRootsCanonical, attachmentRootCanonical, readDenyMatcher, envHandToolNames, sealReadStateSeat } = handsReadFace;
+        const { readFileStateForCheckpoint, seedContextFiles, handsCwdRef, workspaceStateSettle, wsSnapshot, rebaseWsPath, backgroundTaskToolsActive, shellReadBoundarySeat, additionalRootsCanonical, additionalReadRootsCanonical, attachmentRootCanonical, readDenyMatcher, envHandToolNames, sealReadStateSeat } = handsReadFace;
         resolvedReadFace = handsReadFace.resolvedReadFace;
         resolvedWriteFace = handsReadFace.resolvedWriteFace;
         readDenyAdditionsNormalized = handsReadFace.readDenyAdditionsNormalized;
         handsLessResolvedFace = handsReadFace.handsLessResolvedFace;
         handsLessResolvedWriteFace = handsReadFace.handsLessResolvedWriteFace;
         shellGatedTools = handsReadFace.shellGatedTools;
-        const { worktreeSessionRef } = prepareDelegationSurface({ spec, deps, internals, resume, sessionId, hostTaskId, taskScope, taskRootFinal, executionEnv, runnerSelf, backgroundTaskToolsActive, workflowToolsActive, peerLaneActive, peerSendMessageBuiltIn, peerLaneRefs, roster, toolEffects, axisExplicitNegatives, envHandToolNames, toolFaceSnapshot, firstPartyOffload, offloadStore, subagentRetain, enrichSpecToolCtx, handsCwdRef, wsSnapshot, rebaseWsPath, rebaseRestoredPath, workspaceStateSettle });
+        const { worktreeSessionRef } = prepareDelegationSurface({ spec, deps, internals, resume, sessionId, hostTaskId, taskScope, taskRootFinal, executionEnv, runnerSelf, backgroundTaskToolsActive, shellReadBoundarySeat, workflowToolsActive, peerLaneActive, peerSendMessageBuiltIn, peerLaneRefs, roster, toolEffects, axisExplicitNegatives, envHandToolNames, toolFaceSnapshot, firstPartyOffload, offloadStore, subagentRetain, enrichSpecToolCtx, handsCwdRef, wsSnapshot, rebaseWsPath, rebaseRestoredPath, workspaceStateSettle });
         const { liveQuestionFace, contentAskBindings, contentAskRoutable, lateStrandedAnswers, discloseStrandedAnswers, settleContentAskBindings, durableQuestionFace, questionToolMounted, mountedQuestionTool } = prepareQuestionFace({ frozenOnQuestion, spec, deps, checkpointStore, runtimeCaps, resolvedInteractionPosture, resume, sessionId, roster, inheritedUnavailableAsks: () => inheritedUnavailableAsks });
         if (spec.handsReadOnly !== true) {
             const sessionScope = sessionId ?? spec.principal ?? spec.taskId ?? "default";

package/dist/core/runner/run-leg.js

@@ -29,7 +29,7 @@ import { toolEndBodyFrom, toolResultMsg } from "./tool-end-body.js";
 import { announceListingTruncation } from "../skill-listing-budget.js";
 import { attachmentEnvelopeTags, commitAgentListing, commitSkillsListing, reduceToolEnd, renderAgentListingFrame, renderOrphanedBackgroundTasks, renderSkillsListingFrame, stampWriteAnchor } from "./turn-attachments.js";
 import { flushOwedAnnouncedSnapshot } from "./announce-once-ledger.js";
-import { asThrownError, thrownText } from "../thrown-value.js";
+import { asThrownError, thrownMarksOf, thrownText } from "../thrown-value.js";
 export async function runLeg(input) {
     const { spec, queue, prepared, resume, rs, isDelegatedChild, entryActor, effectiveTimeoutMs, timeout, pushContent, ident, emitCommitted, writeFamilyOf, startedToolCallIds, announceWorkspaceMove, withBrainSinks, flushGitMirror, loopLatch, notificationLane, unsubscribeTaskNotifications, unsubGitRetry, unsubBoundary, unsub, runner, next } = input;
     let final;
@@ -693,18 +693,7 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
     }
     catch (err) {
         const execError = `Error: ${thrownText(err)}`;
-        const marks = (() => {
-            if (err === null || typeof err !== "object")
-                return undefined;
-            const src = err;
-            let d;
-            if (src.details !== null && typeof src.details === "object" && !Array.isArray(src.details)) {
-                d = { ...src.details };
-            }
-            if (typeof src.errorKind === "string")
-                d = { ...(d ?? {}), errorKind: src.errorKind };
-            return d;
-        })();
+        const marks = thrownMarksOf(err);
         await settleEnd(true, { content: execError, ...(marks !== undefined ? { details: marks } : {}) });
         const eid = await prepared.session.appendMessage(toolResultMsg(pendingAction.toolCallId, pendingAction.toolName, execError, true));
         emitCommitted(eid, "toolResult", pendingAction.toolCallId);

package/dist/core/thrown-value.d.ts

@@ -1,3 +1,18 @@
+/**
+ * Is this an Error, including one minted in ANOTHER REALM?
+ *
+ * `instanceof` compares against THIS realm's `Error.prototype`, so a genuine `Error` thrown by a script the
+ * engine ran inside `vm.createContext` — a workflow script is exactly that — fails the test and would be
+ * described as an anonymous object, losing the message that is the entire point of reporting it. The brand
+ * check is the realm-independent one: an object with the `[[ErrorData]]` internal slot answers `[object Error]`
+ * no matter where it was made, and a proxy forwards it. A plain object can forge the tag through
+ * `Symbol.toStringTag`, which costs nothing — the only thing this decides is whether we look for a `message`,
+ * and a forger that supplies a string message has told us what it wanted rendered anyway.
+ *
+ * Guarded, because both operations are attacker-reachable: `instanceof` walks a prototype chain a revoked
+ * proxy traps, and the tag is a getter that can throw.
+ */
+export declare function isErrorLike(value: unknown): boolean;
 /**
  * Turning a value that was THROWN at us into text — the ONE rule, for the whole engine.
  *
@@ -77,3 +92,18 @@ export declare function asThrownError(err: unknown): Error;
  * to describing the value, which {@link thrownText} already does totally.
  */
 export declare function readMember(value: unknown, key: string): unknown;
+/** The PLURAL of {@link readMember}: read a value's own enumerable members, once each, into an inert
+ *  snapshot — for sites that want a COPY of a whole bag an untrusted value handed over (a thrown
+ *  error's `details` mark, on its way onto a tool result). The idiom it replaces is `{ ...value }`,
+ *  a second way of running the value's code: the spread asks for its own keys and evaluates every
+ *  getter behind them, so one hostile member took the copy down with it, and a revoked proxy traps the
+ *  enumeration itself (even `Array.isArray` on one throws). Non-objects, arrays (spreading one yields
+ *  index keys) and anything whose keys cannot be enumerated answer `undefined` — "there is no bag
+ *  here"; a member that refuses to be read comes back `undefined` in a PRESENT key. */
+export declare function readOwnMembers(value: unknown): Record<string, unknown> | undefined;
+/** The MACHINE-READABLE marks a thrown value carries (`details`, with a string `errorKind` folded in) —
+ *  the one extractor for both legs that lift them onto a tool result. The live leg and the resume leg
+ *  each had their own copy, and the resume copy still spread the bag and called `Array.isArray` on it,
+ *  so a hostile `details` failed the whole leg where the live one had stopped losing anything but the
+ *  mark. `undefined` = nothing to carry; a caller that must always present a bag folds that itself. */
+export declare function thrownMarksOf(err: unknown): Record<string, unknown> | undefined;

package/dist/core/thrown-value.js

@@ -1,5 +1,5 @@
 import { describeRejectedValue } from "./tool-search-setting.js";
-function isErrorLike(value) {
+export function isErrorLike(value) {
     try {
         if (value instanceof Error)
             return true;
@@ -54,3 +54,25 @@ export function readMember(value, key) {
         return undefined;
     }
 }
+export function readOwnMembers(value) {
+    let keys;
+    try {
+        if (value === null || typeof value !== "object" || Array.isArray(value))
+            return undefined;
+        keys = Object.keys(value);
+    }
+    catch {
+        return undefined;
+    }
+    const out = {};
+    for (const key of keys)
+        out[key] = readMember(value, key);
+    return out;
+}
+export function thrownMarksOf(err) {
+    const details = readOwnMembers(readMember(err, "details"));
+    const errorKind = readMember(err, "errorKind");
+    if (typeof errorKind !== "string")
+        return details;
+    return { ...(details ?? {}), errorKind };
+}

package/dist/core/tool-catalog-entries.js

@@ -108,7 +108,7 @@ export const TOOL_CATALOG_ENTRIES = [
     { id: "task-stop-hands", name: "TaskStop", source: "builtin", definedIn: "src/tools/fs/fs-bash.ts", mountedBy: ["hands"], cards: [], face: { family: "delegate", effect: "write", contract: TASK_STOP_CONTRACT } },
     { id: "task-output", name: "TaskOutput", source: "builtin", definedIn: "src/core/task-registry.ts", mountedBy: ["delegation"], cards: ["task-output"], face: { family: "delegate", effect: "read", contract: TASK_OUTPUT_CONTRACT } },
     { id: "task-stop", name: "TaskStop", source: "builtin", definedIn: "src/core/task-registry.ts", mountedBy: ["delegation"], cards: ["task-stop"], face: { family: "delegate", effect: "write", contract: TASK_STOP_CONTRACT } },
-    { id: "monitor", name: "Monitor", source: "builtin", definedIn: "src/tools/monitor.ts", mountedBy: ["backgroundTasks"], cards: ["monitor-start"], face: { family: "other", effect: "write", contract: c("core.monitor@1"), offloadThresholdChars: 10_000 } },
+    { id: "monitor", name: "Monitor", source: "builtin", definedIn: "src/tools/monitor.ts", mountedBy: ["backgroundTasks"], cards: ["monitor-start", "readonly_out_of_root"], face: { family: "other", effect: "write", contract: c("core.monitor@1"), offloadThresholdChars: 10_000 } },
     { id: "send-message", name: "SendMessage", source: "builtin", definedIn: "src/agents/send-message-tool.ts", mountedBy: ["delegation", "hostInternals", "peerLane"], cards: ["send-message"], face: { family: "protocol", effect: "write", contract: c("core.send_message@1") } },
     { id: "agent-transcript", name: "AgentTranscript", source: "builtin", definedIn: "src/agents/agent-transcript-tool.ts", mountedBy: ["delegation"], cards: ["agent-transcript"], face: { family: "delegate", effect: "read", contract: c("core.agent_transcript@1") } },
     { id: "list-agents", name: "ListAgents", source: "builtin", definedIn: "src/agents/list-agents-tool.ts", mountedBy: ["peerLane"], cards: ["list-agents"], face: { family: "protocol", effect: "read", aliases: ["ListPeers"], contract: c("core.list_agents@1") } },

package/dist/core/tool-model-gate.js

@@ -1,4 +1,4 @@
-import { thrownText } from "./thrown-value.js";
+import { readMember, thrownText } from "./thrown-value.js";
 export function modelIdTail(id) {
     return id.toLowerCase().split("/").pop() ?? "";
 }
@@ -207,22 +207,10 @@ export function applyToolModelGate(input) {
         merged = input.depsSeat === false ? undefined : mergeToolModelGateClasses(input.depsSeat);
     }
     catch (e) {
-        let code;
-        try {
-            code = e?.code;
-        }
-        catch {
-            code = undefined;
-        }
+        const code = readMember(e, "code");
         if (code !== undefined)
             throw e;
-        let msg;
-        try {
-            msg = thrownText(e);
-        }
-        catch {
-            msg = "[unreportable throw]";
-        }
+        const msg = thrownText(e);
         throw gateConfigError(`RunnerDeps.toolModelGate could not be read (${msg}) — a config seat whose reads throw is a bad value, refused rather than passed.`);
     }
     const raw = input.envRaw;

package/dist/core/tools.js

@@ -1,5 +1,6 @@
 import { Value } from "typebox/value";
 import { formatToolError, formatZodValidationError } from "./tool-errors.js";
+import { readMember } from "./thrown-value.js";
 import { attachToolContract } from "../prompt-assembly/tool-catalog.js";
 function normalizeContent(ret) {
     if (typeof ret === "string") {
@@ -115,13 +116,12 @@ export function defineTool(spec, options) {
             }
             catch (err) {
                 const wrapped = new Error(formatToolError(err));
-                if (err !== null && typeof err === "object") {
-                    const src = err;
-                    if (src.details !== undefined)
-                        wrapped.details = src.details;
-                    if (typeof src.errorKind === "string")
-                        wrapped.errorKind = src.errorKind;
-                }
+                const marks = readMember(err, "details");
+                if (marks !== undefined)
+                    wrapped.details = marks;
+                const errorKind = readMember(err, "errorKind");
+                if (typeof errorKind === "string")
+                    wrapped.errorKind = errorKind;
                 throw wrapped;
             }
             const { content, details, terminate, isError } = normalizeContent(ret);

package/dist/core/untrusted-text.d.ts

@@ -405,6 +405,12 @@ export declare function inlineUntrusted(text: string, maxLen?: number): string;
  *  checkpoint-store closed an ESM evaluation cycle (checkpoint-store → tool-policy → tools/fs →
  *  checkpoint-store, a latent TDZ). Both already import this module; one cap, no cycle. */
 export declare const PROBE_CAUSE_PATH_MAX = 200;
+/** The bloat ceiling on a probe's one-sentence account (`RiskDescriptor.probeReason` /
+ *  `AskRequest.probeReason`); the neutralizer is the INJECTION ceiling, this is only the LENGTH one. Homed
+ *  here for the same reason as the constant above: three readers — the shell probe that MINTS the sentence
+ *  (tools/fs) and must fit every load-bearing part inside this bound, the gate, the persist boundary — and
+ *  a value import from tools/fs into checkpoint-store closes an ESM cycle. */
+export declare const PROBE_REASON_MAX = 200;
 /** The one body bound every "reviewer note" relay passes to {@link delimitUntrusted} — the decider's
  *  free text attached to a deny (sync `AskOutcome.reason` and the durable `ResumeOutcome` `reason`
  *  legs alike). A note is steering, not payload: unbounded it can flood the transcript/context the

package/dist/core/untrusted-text.js

@@ -601,6 +601,7 @@ function sanitizeLabel(label) {
     return inlineUntrusted(label, LABEL_MAX);
 }
 export const PROBE_CAUSE_PATH_MAX = 200;
+export const PROBE_REASON_MAX = 200;
 export const REVIEWER_NOTE_MAX_BODY = 2048;
 export function delimitUntrusted(label, text, maxBody) {
     return delimitUntrustedWithClip(label, text, maxBody).text;

package/dist/core/workflow-run-store-contract.js

@@ -118,6 +118,19 @@ export async function workflowRunStoreContract(make, runAssertion = defaultSeque
         byId.get("d-over").budgetOvershoot.spentTokens = 7;
         assert.equal((await store.get("d-over")).budgetOvershoot.spentTokens, 1_200);
     });
+    run("the failure CODE reaches the LIST row verbatim, and a run without one keeps the key ABSENT", async () => {
+        const store = make();
+        const coded = createWorkflowRun({ id: "f-coded", status: "failed", createdAt: 5_000, error: "the body gave up", errorCode: "workflow.agent_blocked" });
+        const codeless = createWorkflowRun({ id: "f-codeless", status: "failed", createdAt: 6_000, error: "the body gave up" });
+        const ok = createWorkflowRun({ id: "f-ok", status: "completed", createdAt: 7_000 });
+        for (const r of [coded, codeless, ok])
+            await store.put(r.id, r);
+        const byId = new Map((await store.listByScope("tenant-a")).map((s) => [s.id, s]));
+        assert.equal(byId.get("f-coded").errorCode, "workflow.agent_blocked");
+        assert.equal("errorCode" in byId.get("f-codeless"), false, "a failed run with no code ⇒ the key is OMITTED, not an `unknown` stand-in");
+        assert.equal("errorCode" in byId.get("f-ok"), false, "a completed run never carries one ⇒ the key is OMITTED");
+        assert.deepEqual(byId.get("f-coded"), summarizeWorkflowRun(coded));
+    });
     run("the TOTAL-TIMEOUT disclosure reaches the LIST row: timeoutInterruption projects (de-aliased), and a run without it keeps the key ABSENT", async () => {
         const store = make();
         const seat = { timeoutMs: 600_000, agentsCompleted: 3, agentsFailed: 1, agentsInFlight: 2, approvalWaitedMs: 540_000 };

package/dist/core/workflow-run-store.d.ts

@@ -46,6 +46,21 @@ export interface WorkflowRunSummary {
     description?: string;
     /** Lifecycle status ({@link WorkflowRun.status}): running / completed / failed. */
     status: WorkflowRunStatus;
+    /** The MACHINE code of the failure that ended the run ({@link WorkflowRun.errorCode}) — the same word,
+     *  in the same vocabulary, that the full run carries; never re-derived and never a second taxonomy.
+     *  The fourth member of the same family as {@link agentFailures} / {@link budgetOvershoot} /
+     *  {@link timeoutInterruption}: those three qualify a row that LOOKS clean, and this one says WHY a
+     *  `failed` row failed. Nothing else on this projection can answer that — {@link status} is `failed`
+     *  for a refused spawn, a blown budget, a stalled run and a body that simply threw alike, so a list
+     *  face without this seat must `get` the full run per failed row to say anything at all, which is the
+     *  N+1 this projection exists to avoid.
+     *
+     *  PRESENT EXACTLY WHEN THE RUN CARRIES ONE, absent otherwise — an absent key reads "no code on the
+     *  record", never "the run succeeded" and never a `workflow.unknown` stand-in. A `completed` run never
+     *  carries one (per {@link WorkflowRun.errorCode}), and a `failed` run whose body threw a codeless
+     *  error with no failed child on the record carries none either. Free of any own attribution rule: the
+     *  attribution (thrown code → first failed agent → absent) happens once, where the run is written. */
+    errorCode?: string;
     /** Count of agent-runs that ended failed ({@link WorkflowRun.agentFailures}) — present only when > 0.
      *  Lets a list view flag a "completed, with failures" run without an N+1 `get` of the full run. */
     agentFailures?: number;

package/dist/core/workflow-run-store.js

@@ -8,6 +8,7 @@ export function summarizeWorkflowRun(run) {
         ...(run.name !== undefined ? { name: run.name } : {}),
         ...(run.description !== undefined ? { description: run.description } : {}),
         status: run.status,
+        ...(run.errorCode !== undefined ? { errorCode: run.errorCode } : {}),
         ...(run.agentFailures !== undefined ? { agentFailures: run.agentFailures } : {}),
         ...(run.budgetOvershoot !== undefined ? { budgetOvershoot: { ...run.budgetOvershoot } } : {}),
         ...(run.timeoutInterruption !== undefined ? { timeoutInterruption: { ...run.timeoutInterruption } } : {}),

package/dist/engine/loop/agent-loop.js

@@ -2,7 +2,7 @@ import { findToolByName, validateToolArguments } from "../llm/index.js";
 import { truncateError } from "../../core/tool-errors.js";
 import { INTERRUPTED_BY_USER_FOR_TOOL_USE_MARKER, INTERRUPTED_BY_USER_MARKER, } from "../../core/session-reconcile.js";
 import { resolveAgentCoreStreamFn } from "./runtime-deps.js";
-import { thrownText } from "../../core/thrown-value.js";
+import { isErrorLike, readMember, thrownMarksOf, thrownText } from "../../core/thrown-value.js";
 function appendTextDeltaToAssistantMessage(message, contentIndex, delta) {
     const content = [...message.content];
     const currentContent = content[contentIndex];
@@ -1537,33 +1537,19 @@ function safeAbortDetails(fn) {
     }
 }
 function isAbortSemanticsError(error) {
-    try {
-        let cursor = error;
-        for (let depth = 0; depth < 8 && cursor instanceof Error; depth++) {
-            if (cursor.name === "AbortError")
-                return true;
-            const next = cursor.cause;
-            if (next === cursor)
-                break;
-            cursor = next;
-        }
-    }
-    catch {
-        return false;
+    let cursor = error;
+    for (let depth = 0; depth < 8 && isErrorLike(cursor); depth++) {
+        if (readMember(cursor, "name") === "AbortError")
+            return true;
+        const next = readMember(cursor, "cause");
+        if (next === cursor)
+            break;
+        cursor = next;
     }
     return false;
 }
 function createErrorToolResult(message, source) {
-    let details = {};
-    if (source !== null && typeof source === "object") {
-        const marks = source;
-        if (marks.details !== null && typeof marks.details === "object" && !Array.isArray(marks.details)) {
-            details = { ...marks.details };
-        }
-        if (typeof marks.errorKind === "string") {
-            details.errorKind = marks.errorKind;
-        }
-    }
+    const details = thrownMarksOf(source) ?? {};
     return {
         content: [{ type: "text", text: truncateError(message) }],
         details,

package/dist/tools/fs/bash-program-position.d.ts

@@ -9,6 +9,7 @@
  * does (an option skipped, a chain member missed) is how one face used to vouch for a program another refused.
  */
 import type { SegmentTokens } from "./bash-lexer.js";
+import type { AssertAllKeysHandled } from "../../core/ask-origin.js";
 /** The verdict every unresolvable / out-of-root / unbounded finding ends on. The findings differ in what
  *  they found; the consequence is one consequence, and a copy that drifts reads as a second rule. */
 export declare const NOT_AUTO_ALLOWED = "\u2014 not auto-allowed";
@@ -170,6 +171,28 @@ export declare function argvReentryUnjudged(pos: ProgramPosition, acceptedTarget
  */
 export declare const SHELL_SCAN_DECLINES: readonly ["unreadable_program_position", "stream_fed_operands"];
 export type ShellScanDecline = (typeof SHELL_SCAN_DECLINES)[number];
+/** The two SEAT TABLES over that set — ROW PER MEMBER behind a compile-time fence, registered in
+ *  `docs/CLOSED-SETS.md` so `gate:closed-sets` is their runtime twin. The ARGUMENT for the rows is at the
+ *  seats that read them (`fs-bash.ts`), which DERIVE the `Set` shape their readers take. Rows and not two
+ *  sets because a derived set beside an empty literal made a third decline SILENTLY asymmetric, in the
+ *  widening direction; a member with no row now reds `tsc` at both fences with the word spelled out. */
+export declare const BOUNDARY_SEAT_READS_DECLINE: {
+    readonly unreadable_program_position: true;
+    readonly stream_fed_operands: true;
+};
+/** The fence over the read-boundary seat's table: `never` while every decline has a row. */
+export type BoundarySeatTableCoversEveryDecline = AssertAllKeysHandled<Exclude<ShellScanDecline, keyof typeof BOUNDARY_SEAT_READS_DECLINE>>;
+/** The classify doctrine's table — every row `false` BY THE ARGUMENT (stated at the seat), not by omission. */
+export declare const CLASSIFY_SEAT_READS_DECLINE: {
+    readonly unreadable_program_position: false;
+    readonly stream_fed_operands: false;
+};
+/** The fence over the classify seat's table. */
+export type ClassifySeatTableCoversEveryDecline = AssertAllKeysHandled<Exclude<ShellScanDecline, keyof typeof CLASSIFY_SEAT_READS_DECLINE>>;
+/** A seat's table in the shape its readers take — the members it answers YES for. DERIVED, so the ROWS are
+ *  the single source and a set can never say something its table does not. The parameter is TOTAL, not
+ *  `Partial`: that stops a third seat being written `seatDeclineEvidence({})`, one level up from the fences. */
+export declare function seatDeclineEvidence(table: Record<ShellScanDecline, boolean>): ReadonlySet<ShellScanDecline>;
 /** Does a SHELL stand where this segment's program would be — as the program itself (`sh -c`), or as a launcher
  *  ROW handing its operands to one (`watch "…"`)? ONE predicate for the re-entry class, so the two spellings
  *  cannot be answered differently; which names are shells is the caller's declaration. Not a decline. */

package/dist/tools/fs/bash-program-position.js

@@ -159,6 +159,17 @@ export function argvReentryUnjudged(pos, acceptedTargets) {
     return runs === undefined || !acceptedTargets.has(runs);
 }
 export const SHELL_SCAN_DECLINES = ["unreadable_program_position", "stream_fed_operands"];
+export const BOUNDARY_SEAT_READS_DECLINE = {
+    unreadable_program_position: true,
+    stream_fed_operands: true,
+};
+export const CLASSIFY_SEAT_READS_DECLINE = {
+    unreadable_program_position: false,
+    stream_fed_operands: false,
+};
+export function seatDeclineEvidence(table) {
+    return new Set(SHELL_SCAN_DECLINES.filter((decline) => table[decline] === true));
+}
 export function programPositionRunsShell(pos, shellProgram) {
     if (pos.refusal !== undefined)
         return pos.refusal.kind === "control_syntax_at_program_position" && pos.refusal.runsShell === true;

package/dist/tools/fs/bash-readonly-classifier.d.ts

@@ -76,11 +76,13 @@ export interface LeadingCommandNameOptions {
      * Read a shell operator that sits inside a QUOTED region as ordinary argument TEXT rather than as an
      * operator, so `grep -E "a|b" f.log` parses as the single simple command it is.
      *
-     * OPT-IN, and used by ONE caller: the compound classify face ({@link classifyCompoundReadonlyDetailed}),
-     * which has already rejected the whole command for backslashes / `$` / backticks / subshells / line
-     * breaks and so is inside {@link quoteMask}'s exactness envelope. The declaration and rule faces do
-     * NOT set it — their contract is "a single simple command with no operator characters at all", which
-     * is a spelling rule about what a person can read at a glance, not a claim about bash's grammar.
+     * OPT-IN, and the two callers that set it share one premise: the whole command has ALREADY been refused
+     * for backslashes / an expanding `$` / backticks / subshells / line breaks, so they are inside
+     * {@link quoteMask}'s exactness envelope — the compound classify face
+     * ({@link classifyCompoundReadonlyDetailed}) and the persisted permission-RULE lane (`RULE_LANE_FLOOR`),
+     * whose segments come out of that same gate ({@link splitShellCompoundSegments}). The `bash_readonly`
+     * DECLARATION face does NOT set it: its contract is "a single simple command with no operator characters
+     * at all", and it runs on raw tool input with no whole-string gate in front of it.
      *
      * Fail-closed on unbalanced quoting: with a region left open, the mask is not trusted and every
      * operator character counts, exactly as without this option.
@@ -617,8 +619,29 @@ export interface OutOfRootReadGateVerdict {
     readonly paths: readonly string[];
     /** Did the deployment's DENY judge speak about an operand this command names? The other half of the same
      *  question, over the very same readers, in a second pass WITH the deny judge — which is what lets the
-     *  containment answer above stay deny-free and keep its `paths` contract. Absent ⇔ it said nothing. */
-    readonly denied?: true;
+     *  containment answer above stay deny-free and keep its `paths` contract. Absent ⇔ it said nothing.
+     *
+     *  It carries the FINDING, not a boolean: this is the arm a command the grammar gate refused WHOLE
+     *  (`cat .env > out.txt`, a subshell, a substitution) reaches, and there the compound verdict carries no
+     *  deny fields at all — so a caller disclosing the hit has nowhere else to read the path and the pattern
+     *  from, and said nothing. The second pass already computed both; throwing them away was the whole bug. */
+    readonly denied?: {
+        readonly path: string;
+        readonly pattern: string;
+    };
+    /** The reader operands this pass RESOLVED and placed inside the roots, plus the expansions it parsed but
+     *  cannot enumerate — the candidates an execute-time recheck must canonicalize.
+     *
+     *  Published because this pass reads SHAPES the compound walk hands nothing out for: a launcher whose
+     *  program it cannot name (`env -- cat f`, `sudo -u root cat f`), a stream-fed one (`… | xargs cat f`).
+     *  There the compound verdict carries no candidates at all, so the recheck had nothing to resolve and an
+     *  in-root symlink to a deny-listed target RAN after an approval — while the same read spelled without
+     *  the launcher was refused. Same operands, same judge, one more pass allowed to hand them over.
+     *
+     *  NOT the out-of-root ones: those ride {@link paths}, they are what the boundary RAISED, and a leg that
+     *  re-refused them would be a second adjudicator of a decision already made. */
+    readonly checked: readonly string[];
+    readonly undecided: readonly string[];
 }
 /** Test seam for the lockstep pin that the launcher table (the ONE launcher truth, in the program-position
  *  reader's module) stays a SUBSET of the rule lane's curated `BARE_INTERPRETER_NAMES`. Exported for that one