@sema-agent/core 7.33.7 → 7.34.0

package/dist/core/runner/permission-rule-lanes.js

@@ -5,7 +5,10 @@ import { isAbsolutePathForm } from "../../tools/fs/safety.js";
 import { effectivePathTargetOf } from "../effective-path-target.js";
 import { declaredPathTargetOf, protectivePathTargetOf } from "../tool-registry.js";
 import { orgRuleVerdictFor } from "../permission-rule-org.js";
+import { ownerStoreOf } from "../permission-rule-provider.js";
 import { thrownText } from "../thrown-value.js";
+import { gateWaitFailureOf, withGateTimeout } from "../gate-bounded-await.js";
+import { ORG_ADJUDICATION_TIMEOUT_MS } from "../permission-rule-org.js";
 export const PERSISTED_RULE_TOOL = "Bash";
 const HANDOFF_BOUND = 256;
 export function inheritedAskRuleEvidence(provider) {
@@ -59,10 +62,7 @@ export function createPermissionRuleLanes(cfg) {
     if (provider === undefined)
         return { personal: undefined, org: undefined };
     const anonymous = cfg.principal === undefined || cfg.principal === "";
-    const store = anonymous && cfg.localOwnerDeclared
-        ?
-            provider.forLocalOwner()
-        : provider.forPrincipal(anonymous ? undefined : cfg.principal);
+    const store = ownerStoreOf(provider, cfg.principal, cfg.localOwnerDeclared);
     const handed = new Map();
     const read = () => store.effective({ sessionId: cfg.sessionId }).then((view) => {
         for (const line of view.disclosures)
@@ -112,43 +112,47 @@ export function createPermissionRuleLanes(cfg) {
             },
         }
         : undefined;
-    const personal = provider.partitions.durable
-        ? {
-            adjudicate: async (req) => {
-                if (anonymous && !cfg.localOwnerDeclared)
-                    return undefined;
-                const grammar = ruleToolGrammarOf(req.toolName);
-                if (grammar === undefined)
-                    return undefined;
-                let view;
-                try {
-                    view = await claim(req.toolCallId);
-                }
-                catch (err) {
-                    cfg.onDisclosure(thrownText(err));
-                    return { unreadable: true };
-                }
-                if (view.unreadable !== undefined) {
-                    cfg.onDisclosure(view.unreadable);
-                    return { unreadable: true };
-                }
-                const table = view.rules;
-                const liveCwd = cfg.liveCwd();
-                if (grammar === "path") {
-                    return pathRuleLaneAnswer(table, req, { root: cfg.root, sessionId: cfg.sessionId, liveCwd, home: cfg.home });
-                }
-                const command = req.args?.command;
-                if (typeof command !== "string")
-                    return undefined;
-                const execCwd = liveCwd !== undefined ? { execCwd: liveCwd } : {};
-                const verdict = adjudicatePersistedRules(table, { tool: req.toolName, command, cwd: cfg.root, sessionId: cfg.sessionId, ...execCwd });
-                if (verdict !== undefined)
-                    return persistedRuleAnswerOf(verdict);
-                const coverage = segmentCoverageOf(command, { persisted: table }, { tool: req.toolName, cwd: cfg.root, sessionId: cfg.sessionId, ...execCwd });
-                return coverage !== undefined ? { segmentCoverage: coverage } : undefined;
-            },
+    const personalAdjudicate = async (req) => {
+        if (anonymous && !cfg.localOwnerDeclared)
+            return undefined;
+        const grammar = ruleToolGrammarOf(req.toolName);
+        if (grammar === undefined)
+            return undefined;
+        let view;
+        try {
+            view = await withGateTimeout(claim(req.toolCallId), ORG_ADJUDICATION_TIMEOUT_MS, cfg.signal, "persistedRules");
         }
-        : undefined;
+        catch (err) {
+            return gateWaitFailureOf(err) === "aborted" ? { unreadable: true } : skipped(thrownText(err));
+        }
+        if (view.unreadable !== undefined)
+            skipped(view.unreadable, view.unreadableSources);
+        try {
+            const answer = judgeAgainst(view.rules, req, grammar);
+            return view.unreadable !== undefined && (answer === undefined || "segmentCoverage" in answer) ? { unreadable: true } : answer;
+        }
+        catch (err) {
+            const why = `judging this call against the rows threw: ${thrownText(err)}`;
+            cfg.onDisclosure(`the persisted rule lane could not judge a ${req.toolName} call against the rows it read — ${why}`);
+            return { unreadable: true, reason: why };
+        }
+    };
+    const judgeAgainst = (table, req, grammar) => {
+        const liveCwd = cfg.liveCwd();
+        if (grammar === "path")
+            return pathRuleLaneAnswer(table, req, { root: cfg.root, sessionId: cfg.sessionId, liveCwd, home: cfg.home });
+        const command = req.args?.command;
+        if (typeof command !== "string")
+            return undefined;
+        const execCwd = liveCwd !== undefined ? { execCwd: liveCwd } : {};
+        const verdict = adjudicatePersistedRules(table, { tool: req.toolName, command, cwd: cfg.root, sessionId: cfg.sessionId, ...execCwd });
+        if (verdict !== undefined)
+            return persistedRuleAnswerOf(verdict);
+        const coverage = segmentCoverageOf(command, { persisted: table }, { tool: req.toolName, cwd: cfg.root, sessionId: cfg.sessionId, ...execCwd });
+        return coverage !== undefined ? { segmentCoverage: coverage } : undefined;
+    };
+    const skipped = (why, sources) => (cfg.onDisclosure(why), cfg.onStoreUnreadable("call", sources), { unreadable: true });
+    const personal = provider.partitions.durable ? { adjudicate: personalAdjudicate } : undefined;
     return { personal, org };
 }
 export function createRuleOffersOf(cfg) {

package/dist/core/runner/persisted-path-rows.d.ts

@@ -0,0 +1,64 @@
+/**
+ * The person's persisted PATH rows as a leg's read face takes them at prepare (the gate's rule lanes read the same store
+ * per call).
+ */
+import { type EffectivePermissionRules, type PermissionRuleStoreProvider } from "../permission-rule-provider.js";
+import type { PathRuleDenyRow } from "../../tools/fs/read-deny.js";
+import type { RunnerDeps } from "../runner-deps.js";
+/** The person's persisted PATH rows a leg's read face takes at prepare ({@link persistedPathRowsOf}). */
+export interface PersistedPathRows {
+    /** Every live `Read(//dir/**)` allow row's directory (lexical, absolute): a standing yes to reads under it. */
+    readonly readDirectories: readonly string[];
+    /** Every live face-keyed path DENY row (`Read(...)`, `Edit(...)`), as a deny-table row resolved at the task's bases. */
+    readonly denyRows: readonly PathRuleDenyRow[];
+}
+/**
+ * The person's persisted PATH rows, read ONCE at prepare from the same store query the gate's lanes read per call: a
+ * `Read(//dir/**)` allow row is a READ DIRECTORY of the run (the Bash read station, Read / Grep / Glob — one set), and a
+ * `Read(...)` / `Edit(...)` deny row joins the run's read / write deny tables (every read face, the shell's file commands
+ * and traversals). One read, two directions, so a person's allow row never reaches further than their deny rows: a
+ * directory it admits still refuses the paths a deny row names. A row the store gains mid-run applies from the next
+ * prepare; the in-flight grant (`readRootGrant`) is the mid-run door. The store not armed, or the anonymous floor ⇒ no
+ * rows. A read that failed (or did not answer in time) ⇒ no rows, and a partition the read could not read ⇒ none of ITS
+ * rows (the partition that was read contributes its own): what could not be read is skipped for this run's tables — its
+ * directories widen nothing and its deny rows judge nothing here — disclosed on the trace and announced to the person
+ * (`onUnread`); the next prepare reads again, as it would for a row the store gained mid-run. A deny row whose
+ * pattern needs a base the task cannot supply (`~/` with no declared home) is left to the per-call lane and disclosed.
+ */
+export declare function persistedPathRowsOf(cfg: {
+    provider: PermissionRuleStoreProvider | undefined;
+    localOwnerDeclared: boolean;
+    principal: string | undefined;
+    sessionId: string;
+    root: string;
+    home: string | undefined;
+    onDisclosure: (message: string) => void;
+    /** The person is told the store (or the named sources of it) was skipped ({@link ruleStoreUnreadableNotice}). */
+    onUnread: (at: "prepare", sources?: EffectivePermissionRules["unreadableSources"]) => void;
+    /** The run's cut: a read that has not answered by then (or by the gate's await bound) reads as unreadable. */
+    signal?: AbortSignal;
+}): Promise<PersistedPathRows>;
+/**
+ * The run's ONE `permission.rule_store_unavailable` notice (audience user): the person's rules — the whole store, or the
+ * sources of it whose partition could not be read — were skipped; minted by whichever read found it first (the prepare
+ * read of the path rows, or a call's own read on the rule lane), once per run however many reads fail after it (the
+ * prepare sentence says a later call may be judged without them too). The trace keeps every read's line.
+ */
+export declare function ruleStoreUnreadableNotice(onNotice: RunnerDeps["onNotice"], ids: {
+    readonly sessionId: string;
+    readonly runId: string;
+}): (at: "prepare" | "call", sources?: EffectivePermissionRules["unreadableSources"]) => void;
+/** {@link persistedPathRowsOf} for one task's prepare: only where a read face mounts (hands), disclosed on the run's trace,
+ *  cut by the run's own signals. `undefined` = nothing to read, returned synchronously: a run with no person's store (or
+ *  no hands) gains no suspension point on its prepare. */
+export declare function persistedPathRowsOfTask(t: {
+    deps: Pick<RunnerDeps, "permissionRuleStore" | "localOwnerRules" | "tracer">;
+    principal: string | undefined;
+    sessionId: string;
+    root: string;
+    home: string | undefined;
+    taskId: string;
+    handsEnabled: boolean;
+    signals: readonly AbortSignal[];
+    onUnread: (at: "prepare", sources?: EffectivePermissionRules["unreadableSources"]) => void;
+}): Promise<PersistedPathRows> | undefined;

package/dist/core/runner/persisted-path-rows.js

@@ -0,0 +1,89 @@
+import { ownerStoreOf } from "../permission-rule-provider.js";
+import { READ_RULE_TOOL, eligiblePersisted, isUsablePathBase, ruleBasesNeeded } from "../permission-rule-model.js";
+import { isAbsolutePathForm, pathFamilyOf } from "../../tools/fs/safety.js";
+import { PATH_DENY_RULE_FACES, pathRuleDenyRowOf } from "../permission-rules.js";
+import { inlineUntrusted } from "../untrusted-text.js";
+import { DEFAULT_GATE_AWAIT_TIMEOUT_MS, gateWaitFailureOf, withGateTimeout } from "../gate-bounded-await.js";
+import { thrownText } from "../thrown-value.js";
+import { emitTrace } from "../trace.js";
+import { deliverEngineNotice } from "../engine-notice.js";
+export async function persistedPathRowsOf(cfg) {
+    const none = { readDirectories: [], denyRows: [] };
+    const provider = cfg.provider;
+    if (provider === undefined || !readsPersistedPathRows(provider, cfg.principal, cfg.localOwnerDeclared))
+        return none;
+    let view;
+    try {
+        view = await withGateTimeout(ownerStoreOf(provider, cfg.principal, cfg.localOwnerDeclared).effective({ sessionId: cfg.sessionId }), DEFAULT_GATE_AWAIT_TIMEOUT_MS, cfg.signal, "persistedPathRows");
+    }
+    catch (err) {
+        return gateWaitFailureOf(err) === "aborted" ? none : skipped(cfg, thrownText(err));
+    }
+    if (view.unreadable !== undefined)
+        skipped(cfg, view.unreadable, view.unreadableSources);
+    const call = { tool: READ_RULE_TOOL, cwd: cfg.root, sessionId: cfg.sessionId };
+    const bases = { root: cfg.root, ...(cfg.home !== undefined && isAbsolutePathForm(cfg.home) ? { home: cfg.home } : {}) };
+    const family = pathFamilyOf(bases);
+    const readDirectories = [];
+    const denyRows = [];
+    for (const rule of view.rules) {
+        if (rule.status !== "live")
+            continue;
+        if (rule.behavior === "allow" && rule.tool === READ_RULE_TOOL && rule.match === "subpath" && eligiblePersisted(rule, call, "allow")) {
+            if (!readDirectories.includes(rule.command))
+                readDirectories.push(rule.command);
+            continue;
+        }
+        const faces = PATH_DENY_RULE_FACES[rule.tool];
+        if (rule.behavior !== "deny" || faces === undefined || (rule.match !== "path" && rule.match !== "subpath") || !eligiblePersisted(rule, { ...call, tool: rule.tool }, "deny"))
+            continue;
+        const missing = ruleBasesNeeded(rule).filter((b) => !isUsablePathBase(b === "cwd" ? bases.root : bases[b], family));
+        if (missing.length > 0) {
+            cfg.onDisclosure(`the persisted deny rule ${inlineUntrusted(rule.rule, 200)} needs a ${missing.join(" / ")} base this task does not declare — the shell's file commands and the search tools do not judge it on this leg`);
+            continue;
+        }
+        denyRows.push(pathRuleDenyRowOf({ parsed: rule, ruleText: rule.rule, faces }, bases));
+    }
+    return { readDirectories, denyRows };
+}
+function skipped(cfg, why, sources) {
+    cfg.onDisclosure(`the persisted path rules could not be read at prepare, so this run's read directories and read / write deny tables take none of ${sources !== undefined ? `the ${sourcesWord(sources)} rows` : "their rows"} (the next prepare reads again): ${why}`);
+    cfg.onUnread("prepare", sources);
+    return { readDirectories: [], denyRows: [] };
+}
+function sourcesWord(sources) {
+    return sources.length <= 1 ? sources.join("") : `${sources.slice(0, -1).join(", ")} and ${sources[sources.length - 1]}`;
+}
+const SKIPPED_STORE_SENTENCE = {
+    prepare: (which) => `${which} could not be read when this run started, so this run's file and shell checks skip their path rows (Read / Edit deny rows and Read directory rows) — a deny row among them protects nothing on this run. Each call's own rule check reads the rules again (a call whose own read fails too is judged without them), and the next run reads the path rows again.`,
+    call: (which) => `${which} could not be read for a call on this run, so that call's own rule check skipped them: none of their allow, ask or deny rows took part in it, and a deny row among them protected nothing there (path rows the run took when it started still apply to its file and shell checks). Every later call reads them again, and they apply again as soon as a read succeeds.`,
+};
+export function ruleStoreUnreadableNotice(onNotice, ids) {
+    let sent = false;
+    return (at, sources) => {
+        if (sent)
+            return;
+        sent = true;
+        const which = sources !== undefined && sources.length > 0 ? `your persisted permission rules from the ${sourcesWord(sources)} sources` : "your persisted permission rules";
+        deliverEngineNotice(onNotice, { code: "permission.rule_store_unavailable", message: SKIPPED_STORE_SENTENCE[at](which), detail: { at, sessionId: ids.sessionId, runId: ids.runId } });
+    };
+}
+function readsPersistedPathRows(provider, principal, localOwnerDeclared) {
+    return provider.partitions.durable && ((principal !== undefined && principal !== "") || localOwnerDeclared);
+}
+export function persistedPathRowsOfTask(t) {
+    const provider = t.deps.permissionRuleStore;
+    if (!t.handsEnabled || provider === undefined || !readsPersistedPathRows(provider, t.principal, t.deps.localOwnerRules === true))
+        return undefined;
+    return persistedPathRowsOf({
+        provider,
+        localOwnerDeclared: t.deps.localOwnerRules === true,
+        principal: t.principal,
+        sessionId: t.sessionId,
+        root: t.root,
+        home: t.home,
+        onDisclosure: (message) => emitTrace(t.deps.tracer, () => ({ kind: "permission.rule_store_unreadable", version: 1, taskId: t.taskId, message, ts: Date.now() })),
+        onUnread: t.onUnread,
+        signal: AbortSignal.any([...t.signals]),
+    });
+}

package/dist/core/runner/prepare-artifact.d.ts

@@ -12,6 +12,7 @@
  * publishes the declared store into the run's {@link ArtifactStoreRef} for that second point.
  * Synchronous: the stretch has no await (the file read is a closure the tool calls later).
  */
+import type { PermissionModeController } from "../mode-policy.js";
 import type { ExecutionEnv } from "../../internal/harness.js";
 import type { OnAsk } from "../tool-policy.js";
 import { type ArtifactPlane } from "../artifact-host.js";
@@ -22,7 +23,7 @@ import { type ArtifactStoreRef } from "./read-root-grant.js";
 import type { Prepared } from "./contracts.js";
 export interface PrepareArtifactInput {
     /** borrowed-readonly — the deployment's hosting seat and the notice sink the refusal arm announces on. */
-    deps: Pick<RunnerDeps, "artifactHost" | "onNotice">;
+    deps: Pick<RunnerDeps, "artifactHost" | "onNotice" | "tracer">;
     /** borrowed-readonly — the engine-minted run id: the host's `onMount` key and every call context's `runId`. */
     runId: string;
     /** borrowed-readonly — the host task id, the call context's audit attribution. */
@@ -34,6 +35,9 @@ export interface PrepareArtifactInput {
     /** borrowed-readonly — the run's effective approver (`spec.onAsk ?? deps.onAsk`, the seat the tool gate resolves at):
      *  the tool's shared-read consent gate rides it as a mount dep (a core mount's execute ctx is minimal). */
     onAsk: OnAsk | undefined;
+    /** borrowed-readonly — the leg's live permission-mode seat; the tool's shared-read consent gate arbitrates at it before
+     *  the approver is consulted (a released read is delivered, undisclosed to nobody: the gate records it). */
+    permissionMode: PermissionModeController;
     /** borrowed-readonly — the run's resolved env: the byte source of a published local file. */
     executionEnv: ExecutionEnv;
     /** borrowed-readonly — the canonical task root the fs fence contains reads to; undefined ⇒ no local-file publish. */

package/dist/core/runner/prepare-artifact.js

@@ -6,11 +6,12 @@ import { defineTool } from "../tools.js";
 import { inlineUntrusted } from "../untrusted-text.js";
 import { physicalPathOfExisting } from "../physical-path.js";
 import { resolveKey, violationDetails, violationText } from "../../tools/fs/safety.js";
-import { rootAdmittingArtifactStore } from "./read-root-grant.js";
+import { rootAdmittingArtifactStore, withdrawStandingGrantsAdmitting } from "./read-root-grant.js";
+import { emitTrace } from "../trace.js";
 import { createArtifactTool } from "../../tools/artifact/artifact-tool.js";
 import { thrownText } from "../thrown-value.js";
 export function prepareArtifact(input) {
-    const { deps, runId, taskId, sessionId, agentName, onAsk, executionEnv, rootCanonical, additionalRootsCanonical, readDenyMatcher, resolvedReadFace, handsCwdRef, roster, firstPartyOffload, envHandToolNames, artifactStoreRef } = input;
+    const { deps, runId, taskId, sessionId, agentName, onAsk, permissionMode, executionEnv, rootCanonical, additionalRootsCanonical, readDenyMatcher, resolvedReadFace, handsCwdRef, roster, firstPartyOffload, envHandToolNames, artifactStoreRef } = input;
     const host = deps.artifactHost;
     if (host === undefined)
         return { artifactPlane: undefined };
@@ -29,6 +30,11 @@ export function prepareArtifact(input) {
     const storePhysical = storageDir !== undefined && rootCanonical !== undefined ? physicalPathOfExisting(storageDir) : undefined;
     if (artifactStoreRef !== undefined)
         artifactStoreRef.current = storePhysical;
+    if (artifactStoreRef !== undefined && storePhysical !== undefined) {
+        for (const entry of withdrawStandingGrantsAdmitting(storePhysical, artifactStoreRef)) {
+            emitTrace(deps.tracer, () => ({ kind: "config.additional_directory_skipped", version: 1, taskId, entry, field: "persistedReadRule", reason: `admits_artifact_store: the local artifact store ${storageDir} lies inside it or it inside the store — the Artifact tool's ledger and stored files stay outside every root the file tools reach`, ts: Date.now() }));
+        }
+    }
     if (storePhysical !== undefined && rootCanonical !== undefined) {
         const overlapping = rootAdmittingArtifactStore(storePhysical, [rootCanonical, ...additionalRootsCanonical()]);
         if (overlapping !== undefined)
@@ -60,7 +66,7 @@ export function prepareArtifact(input) {
             return { ok: false, reason: "too_large", size: r.value.byteLength, limit: maxBytes, judgedOn: "bytes" };
         return { ok: true, key: rk.key, bytes: r.value };
     };
-    const artifactSpec = createArtifactTool({ host, capabilities: verdict.capabilities, runId, taskId, sessionId, ...(agentName !== undefined ? { agentName } : {}), readLocalFile, ...(onAsk !== undefined ? { onAsk } : {}) });
+    const artifactSpec = createArtifactTool({ host, capabilities: verdict.capabilities, runId, taskId, sessionId, ...(agentName !== undefined ? { agentName } : {}), readLocalFile, ...(onAsk !== undefined ? { onAsk } : {}), permissionMode: () => permissionMode.current, ...(deps.onNotice !== undefined ? { onNotice: deps.onNotice } : {}) });
     roster.mount(firstPartyOffload(defineTool(artifactSpec)), { source: "builtin", mountedBy: "optional" });
     envHandToolNames.add(ARTIFACT_TOOL_NAME);
     return { artifactPlane: verdict.capabilities.plane };

package/dist/core/runner/prepare-ask-lane.d.ts

@@ -83,9 +83,11 @@ export interface PrepareAskLaneInput {
             egress?: boolean;
         };
     };
-    /** borrowed-mutable — the auto-mode denial tracker, or undefined. Writer here: the carry mint arms the auto-deny
-     *  window on it iff the seat about to be called is live (the tracker's one writer). */
-    autoModeDenialTracking: AutoModeDenialTracker | undefined;
+    /** borrowed-mutable — the auto-mode denial tracker's live seat (undefined until an arming). Writer here: the carry mint
+     *  arms the auto-deny window on it iff the seat about to be called is live (the tracker's one writer). */
+    autoModeDenialTracking: {
+        readonly current: AutoModeDenialTracker | undefined;
+    };
     /** borrowed-readonly — the REBOUND spec; only `taskId` is read (the late-settlement observer's tag). */
     spec: Pick<TaskSpec, "taskId">;
     /** borrowed-readonly — the deployment seats this lane reports on, as a Pick over the SAME `deps` object (receiver

package/dist/core/runner/prepare-ask-lane.js

@@ -103,7 +103,7 @@ export function prepareAskLane(input) {
             ...(decision.action === "ask" && decision.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
             ...(decision.action === "ask" ? askMandateMember(decision) : {}),
             ...(decision.action === "ask" && decision.persistedRuleShadowed !== undefined ? { persistedRuleShadowed: decision.persistedRuleShadowed } : {}),
-            ...(decision.action === "ask" ? gateAskCarry(decision, isLiveApproverSeat(onAsk), autoModeDenialTracking) : {}),
+            ...(decision.action === "ask" ? gateAskCarry(decision, isLiveApproverSeat(onAsk), autoModeDenialTracking.current) : {}),
             ...(decision.action === "ask" && decision.probeReason !== undefined ? { probeReason: decision.probeReason } : {}),
             ...(decision.action === "ask" && decision.probeCause !== undefined ? { probeCause: decision.probeCause } : {}),
             ...(decision.action === "ask" && decision.probeReadRootCandidate !== undefined ? { readRootCandidate: decision.probeReadRootCandidate } : {}),

package/dist/core/runner/prepare-caps-and-workflow.d.ts

@@ -24,6 +24,7 @@ import { forkGovernanceDenial } from "../../agents/subagent.js";
 import type { PromptEpochArtifact } from "../../prompt-assembly/artifact.js";
 import { type WorkflowSizeGuideline } from "../../orchestration/workflow-size-guideline.js";
 import { type AutoModeArmingRecipe } from "../auto-mode-arming.js";
+import type { PermissionModeController } from "../mode-policy.js";
 import { type AutoModeDecider, type AutoModeDenialTracker } from "../auto-mode.js";
 import { type CheckpointSeat } from "../checkpoint-seat.js";
 import { type ComplianceCapability } from "../compliance.js";
@@ -109,10 +110,23 @@ export interface PrepareCapsAndWorkflowInput {
     requestReview: (opts?: {
         reason?: string;
     }) => void;
-    /** borrowed-readonly — the plan-mode primitive the EnterPlanMode tool calls. */
-    enterPlanMode: () => void;
-    /** borrowed-readonly — the auto-mode INTENT (own seat ∨ chain ∨ checkpoint), the arming's first arm. */
-    autoModeIntent: boolean;
+    /** borrowed-readonly — the plan-mode primitive the EnterPlanMode tool calls: a steer of the leg's mode seat into `plan`. */
+    enterPlanMode: () => Promise<void>;
+    /** borrowed-readonly — the leg's live permission-mode seat: the arming's first arm is `declared === "auto"`, and the
+     *  arming facts (the deny bits, the face, the re-entrant arm) are bound onto it here. */
+    permissionMode: PermissionModeController;
+    /** borrowed-readonly — LATE-BOUND: the effective read-deny table the hands phase compiles (the rows the classifier's deny
+     *  paragraph renders); read at ARMING, which the driver runs after that phase — never at this phase's own call. */
+    readDenyEntries: () => {
+        readonly entries: ReadonlyArray<{
+            readonly pattern: string;
+            readonly caseSensitive?: boolean;
+        }>;
+        readonly ruleRows: ReadonlyArray<{
+            readonly tool: string;
+            readonly pattern: string;
+        }>;
+    };
     /** borrowed-readonly — the peer lane's mount verdict (the classifier's cross-session rule fills only while mounted). */
     peerLaneActive: boolean;
     /** borrowed-readonly — whether the BUILT-IN SendMessage is on this face (the lane rule's second term). */
@@ -153,15 +167,26 @@ export interface PrepareCapsAndWorkflowResult {
     agentForkDenial: ReturnType<typeof forkGovernanceDenial>;
     /** owned — the observers grant (`allowObservers === true`, explicit opt-in). */
     observersActive: boolean;
-    /** owned — the arming outcome as a closed reason (the manifest's auto-mode face). */
-    /** The leg's auto-mode arming fact (`armed` ⇔ `reason === "armed"`; `deniedSource` only beside a STATED `denied`). */
-    autoModeArmReason: AutoModeArmFact;
-    /** owned — the armed classifier, or undefined when any arming arm failed. */
-    autoModeDecider: AutoModeDecider | undefined;
-    /** owned — the denial tracker built beside the decider (same face, same arming). */
-    autoModeDenialTracking: AutoModeDenialTracker | undefined;
-    /** owned — the serializable arming recipe (persistArming opt-in only). */
-    autoModeArming: AutoModeArmingRecipe | undefined;
+    /** owned — the arming outcome as a closed reason (the manifest's auto-mode face), read LIVE: a leg steered into `auto`
+     *  after prepare arms then, and the fact follows. */
+    autoModeArmReason: () => AutoModeArmFact;
+    /** owned — the armed classifier's live seat (`current` undefined until an arming succeeds — at prepare for an `auto`
+     *  leg, or at a steer into `auto`); every consumer reads `current` at its own call. */
+    autoModeDeciderRef: {
+        readonly current: AutoModeDecider | undefined;
+    };
+    /** owned — the denial tracker built beside the decider (same face, same arming), same live seat. */
+    autoModeDenialTrackingRef: {
+        readonly current: AutoModeDenialTracker | undefined;
+    };
+    /** owned — the serializable arming recipe (persistArming opt-in only), same live seat. */
+    autoModeArmingRef: {
+        readonly current: AutoModeArmingRecipe | undefined;
+    };
+    /** owned — arm the classifier for THIS leg (idempotent; a no-op unless the effective mode is `auto` and the face and the
+     *  deny bit admit it). The driver calls it once after the hands phase (the deny table must exist first); the mode seat
+     *  calls it again on a steer into `auto`. */
+    armAutoMode: () => Promise<void>;
     /** owned — self-orchestration is ACTIVE for this leg (deployment ready ∧ not entitlement-denied); drives the prompt injection. */
     selfOrchestrationActive: boolean;
     /** owned — the Workflow tool is on the roster (the delegation surface's second door). */
@@ -192,6 +217,7 @@ declare const RUNTIME_CAP_KEYS: {
     readonly forceDurableGate: true;
     readonly autoMode: true;
     readonly autoModeDenySource: true;
+    readonly bypassPermissions: true;
     readonly allowMemoryOptOut: true;
 };
 export type RuntimeCapKeysCoverEveryCap = AssertAllKeysHandled<Exclude<keyof RuntimeCaps, keyof typeof RUNTIME_CAP_KEYS>>;

package/dist/core/runner/prepare-caps-and-workflow.js

@@ -7,8 +7,9 @@ import { createRunWorkflowTool } from "../../orchestration/run-workflow-tool.js"
 import { isSelfOrchestrationActive } from "../../orchestration/workflow-script-runner.js";
 import { resolveWorkflowSizeGuideline } from "../../orchestration/workflow-size-guideline.js";
 import { autoModeArmingRecipeOf } from "../auto-mode-arming.js";
-import { buildAutoModePrompt, renderAutoModeAction, renderAutoModeWindow } from "../auto-mode-prompt.js";
-import { autoModeClassifierFallbackOf, createAutoModeDecider, createAutoModeDenialTracker } from "../auto-mode.js";
+import { AUTO_MODE_CLASSIFIER_MAX_RETRIES } from "../auto-mode-defaults.js";
+import { buildAutoModePrompt, readDenyClassifierRules, renderAutoModeAction, renderAutoModeWindow } from "../auto-mode-prompt.js";
+import { autoModeClassifierFallbackOf, createAutoModeDecider, createAutoModeDenialTracker, screenAutoModeKnobs } from "../auto-mode.js";
 import { checkpointStoreOfSeat } from "../checkpoint-seat.js";
 import { COMPLIANCE_CAPABILITIES, WEB_FETCH_TOOL_NAME, resolveComplianceDenies } from "../compliance.js";
 import { createPresentPlanTool, createEnterPlanModeTool } from "../present-plan-tool.js";
@@ -16,7 +17,7 @@ import { brainToRuntime } from "../runtime.js";
 import { defaultTaskRegistry } from "../task-registry.js";
 import { defineTool, isDefineToolProduct, rebindDefineToolCtx } from "../tools.js";
 const MOUNT_REMEDY = "author it as a plain-object ToolSpec (own `name` and `execute`), hand the defineTool product itself, or wrap a product through the supported wrapper form (a fresh object re-stamped with `stampDefineToolBrand` whose rebind re-wraps the rebound product)";
-import { AUTO_MODE_DENY_SOURCES, isAutoModeDenySource } from "../runtime-caps.js";
+import { isAutoModeDenySource } from "../runtime-caps.js";
 import { derivedRouteFallsBack } from "./derived-route-fallback.js";
 import { CLASSIFIER_ATTEMPT_SUFFIX, CLASSIFIER_THINK_SEAT, announceClassifierRoleDefaulted, classifierLadderRungs, classifierReplyAsksAgain, classifierReplyFailure, classifierReplyVerdictText, classifierRoundObserver, classifierRungSeat, classifierSeatModel } from "./classifier-ladder.js";
 import { REPORT_FINDINGS_TOOL_NAME, createReportBlockedTool, createReportFindingsTool } from "./synthetic-tools.js";
@@ -38,6 +39,7 @@ const RUNTIME_CAP_KEYS = {
     forceDurableGate: true,
     autoMode: true,
     autoModeDenySource: true,
+    bypassPermissions: true,
     allowMemoryOptOut: true,
 };
 function snapshotRuntimeCaps(record) {
@@ -54,7 +56,7 @@ function screenAutoModeCap(caps, onError, sessionId) {
         return { caps, faulted: false };
     if (typeof caps !== "object" || caps === null || Array.isArray(caps)) {
         onError?.(new Error(`runtimeCapsResolver returned a non-record value (${JSON.stringify(caps)}) — read as a resolver fault: every per-principal capability is DENIED for this run (auto mode is not armed; asks flow the original chain). Return a RuntimeCaps object or undefined.`), { phase: "config", sessionId });
-        return { caps: { allowWorkflows: false, allowFork: false, autoMode: false }, faulted: true };
+        return { caps: { allowWorkflows: false, allowFork: false, autoMode: false, bypassPermissions: false }, faulted: true };
     }
     let record;
     try {
@@ -62,22 +64,34 @@ function screenAutoModeCap(caps, onError, sessionId) {
     }
     catch (err) {
         onError?.(new Error(`runtimeCapsResolver's record threw while being read (${thrownText(err)}) — read as a resolver fault: every per-principal capability is DENIED for this run (auto mode is not armed; asks flow the original chain).`), { phase: "config", sessionId });
-        return { caps: { allowWorkflows: false, allowFork: false, autoMode: false }, faulted: true };
+        return { caps: { allowWorkflows: false, allowFork: false, autoMode: false, bypassPermissions: false }, faulted: true };
     }
+    let screened = record;
+    let faulted = false;
+    const fault = (message) => {
+        onError?.(new Error(`runtimeCapsResolver returned ${message}`), { phase: "config", sessionId });
+        faulted = true;
+    };
     const { autoMode, autoModeDenySource } = record;
     if (autoModeDenySource !== undefined && (!isAutoModeDenySource(autoModeDenySource) || autoMode !== false)) {
-        onError?.(new Error(`runtimeCapsResolver returned autoModeDenySource=${JSON.stringify(autoModeDenySource)} beside autoMode=${JSON.stringify(autoMode)} — read as a resolver fault: auto mode is DENIED for this run (the classifier is not armed; asks flow the original chain). Name a source only beside autoMode:false, and only one of ${AUTO_MODE_DENY_SOURCES.join("|")}.`), { phase: "config", sessionId });
-        const { autoModeDenySource: _refused, ...rest } = record;
-        return { caps: { ...rest, autoMode: false }, faulted: true };
+        fault(`autoModeDenySource=${JSON.stringify(autoModeDenySource)} beside autoMode=${JSON.stringify(autoMode)} — read as a resolver fault: auto mode is DENIED for this run (the classifier is not armed; asks flow to the approver / park)`);
+        const { autoModeDenySource: _refused, ...rest } = screened;
+        screened = { ...rest, autoMode: false };
     }
-    if (record.autoMode === undefined || typeof record.autoMode === "boolean")
-        return { caps: record, faulted: false };
-    onError?.(new Error(`runtimeCapsResolver returned a non-boolean autoMode (${JSON.stringify(record.autoMode)}) — read as a resolver fault: auto mode is DENIED for this run (the classifier is not armed; asks flow the original chain). Return true, false, or omit the key.`), { phase: "config", sessionId });
-    return { caps: { ...record, autoMode: false }, faulted: true };
+    else if (autoMode !== undefined && typeof autoMode !== "boolean") {
+        fault(`a non-boolean autoMode (${JSON.stringify(autoMode)}) — read as a resolver fault: auto mode is DENIED for this run (the classifier is not armed; asks flow the same way they do with no auto-mode face)`);
+        screened = { ...screened, autoMode: false };
+    }
+    if (record.bypassPermissions !== undefined && typeof record.bypassPermissions !== "boolean") {
+        fault(`a non-boolean bypassPermissions (${JSON.stringify(record.bypassPermissions)}) — read as a resolver fault: bypassPermissions is DENIED for this run (a requested bypass folds back to default)`);
+        screened = { ...screened, bypassPermissions: false };
+    }
+    return { caps: screened, faulted };
 }
-function mintPersistedArming(am, laneRule, classifierSystemPrompt, onError, sessionId) {
+function mintPersistedArming(am, laneRule, classifierSystemPrompt, derivedDenyRules, onError, sessionId) {
     const arming = autoModeArmingRecipeOf(laneRule ? { ...am, crossSessionMessagesRule: true } : am, {
         promptDigest: `apv1:${createHash("sha256").update(classifierSystemPrompt).digest("hex")}`,
+        derivedDenyRules,
     });
     if (arming === undefined) {
         onError?.(new Error("RunnerDeps.autoMode.persistArming is set but the auto-mode face did not canonicalize into an arming recipe " +
@@ -100,7 +114,7 @@ function autoModeArmReasonOf(intent, facePresent, caps, capsFaulted) {
     return { armed: true, reason: "armed" };
 }
 export async function prepareCapsAndWorkflow(input) {
-    const { spec, deps, parentSpecSeat, checkpointSeat, internals, session, sessionId, runId, hostTaskId, taskScope, taskRootFinal, model, thinking, lockedPreflight, toolEffects, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, harnessRef, frozenOnAsk, carrierReadFace, carrierWriteFace, forwardEvent, inheritedGateForChildren, enrichSpecToolCtx, maybeOffload, requestReview, enterPlanMode, autoModeIntent, peerLaneActive, peerSendMessageBuiltIn, runnerSelf } = input;
+    const { spec, deps, parentSpecSeat, checkpointSeat, internals, session, sessionId, runId, hostTaskId, taskScope, taskRootFinal, model, thinking, lockedPreflight, toolEffects, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, harnessRef, frozenOnAsk, carrierReadFace, carrierWriteFace, forwardEvent, inheritedGateForChildren, enrichSpecToolCtx, maybeOffload, requestReview, enterPlanMode, permissionMode, readDenyEntries, peerLaneActive, peerSendMessageBuiltIn, runnerSelf } = input;
     const roster = new RosterBuilder(toolEffects);
     for (const t of spec.tools ?? []) {
         const mounted = mountCallerTool(t);
@@ -151,7 +165,7 @@ export async function prepareCapsAndWorkflow(input) {
         }
         catch (err) {
             deps.onError?.(asThrownError(err), { phase: "config", sessionId });
-            runtimeCaps = { allowWorkflows: false, allowFork: false, autoMode: false };
+            runtimeCaps = { allowWorkflows: false, allowFork: false, autoMode: false, bypassPermissions: false };
             runtimeCapsFaulted = true;
         }
         const screened = screenAutoModeCap(runtimeCaps, deps.onError, sessionId);
@@ -193,11 +207,17 @@ export async function prepareCapsAndWorkflow(input) {
     }
     const agentForkDenial = forkGovernanceDenial(spec.enableFork, runtimeCaps?.allowFork);
     const observersActive = runtimeCaps?.allowObservers === true;
-    let autoModeDecider;
-    let autoModeDenialTracking;
-    let autoModeArming;
-    const autoModeArmReason = autoModeArmReasonOf(autoModeIntent, deps.autoMode !== undefined, runtimeCaps, runtimeCapsFaulted);
-    if (autoModeIntent && deps.autoMode !== undefined && runtimeCaps?.autoMode !== false) {
+    const autoModeDeciderRef = { current: undefined };
+    const autoModeDenialTrackingRef = { current: undefined };
+    const autoModeArmingRef = { current: undefined };
+    const autoModeArmReason = () => autoModeArmReasonOf(permissionMode.declared === "auto", deps.autoMode !== undefined, runtimeCaps, runtimeCapsFaulted);
+    if (deps.autoMode !== undefined)
+        screenAutoModeKnobs(deps.autoMode);
+    const armAutoMode = async () => {
+        if (autoModeDeciderRef.current !== undefined)
+            return;
+        if (permissionMode.declared !== "auto" || deps.autoMode === undefined || runtimeCaps?.autoMode === false)
+            return;
         const am = deps.autoMode;
         const classifierSeat = classifierSeatModel({ deps, main: model });
         let classifierModel = classifierSeat.model;
@@ -206,11 +226,14 @@ export async function prepareCapsAndWorkflow(input) {
         }
         announceClassifierRoleDefaulted({ onNotice: deps.onNotice, seat: { ...classifierSeat, model: classifierModel }, ...(sessionId !== undefined ? { sessionId } : {}), ...(runId !== undefined ? { runId } : {}) });
         const classifierLaneRule = peerLaneActive && peerSendMessageBuiltIn;
-        const classifierSystemPrompt = buildAutoModePrompt(classifierLaneRule ? { ...am, crossSessionMessagesRule: CROSS_SESSION_CLASSIFIER_RULE } : am);
+        const table = readDenyEntries();
+        const derivedDenyRules = readDenyClassifierRules(table.entries, table.ruleRows);
+        let classifierSystemPromptMemo;
+        const classifierSystemPrompt = () => (classifierSystemPromptMemo ??= buildAutoModePrompt({ ...am, derivedDenyRules, ...(classifierLaneRule ? { crossSessionMessagesRule: CROSS_SESSION_CLASSIFIER_RULE } : {}) }));
         const classifierRuntime = brainToRuntime(deps.brain);
         const classifierRungs = classifierLadderRungs(am.classifierFallback, classifierModel, model);
-        autoModeDenialTracking = createAutoModeDenialTracker(am.denialLimit);
-        autoModeDecider = createAutoModeDecider({
+        const denialTracking = createAutoModeDenialTracker(am.denialLimit);
+        const decider = createAutoModeDecider({
             ...(am.timeoutMs !== undefined ? { timeoutMs: am.timeoutMs } : {}),
             candidates: classifierRungs.map((m) => m.id),
             onClassified: classifierRoundObserver({ tracer: deps.tracer, onNotice: deps.onNotice, taskId: hostTaskId, seatModelId: classifierModel.id, ...(sessionId !== undefined ? { sessionId } : {}), ...(runId !== undefined ? { runId } : {}) }),
@@ -229,8 +252,9 @@ export async function prepareCapsAndWorkflow(input) {
                 }
                 const classifierAuth = await spec.getApiKeyAndHeaders?.(rungModel);
                 const request = async (seat, suffix) => {
-                    const response = await classifierRuntime.completeSimple(rungModel, { systemPrompt: classifierSystemPrompt, messages: [{ role: "user", content: userPrompt + suffix, timestamp: Date.now() }] }, {
+                    const response = await classifierRuntime.completeSimple(rungModel, { systemPrompt: classifierSystemPrompt(), messages: [{ role: "user", content: userPrompt + suffix, timestamp: Date.now() }] }, {
                         signal,
+                        maxRetries: AUTO_MODE_CLASSIFIER_MAX_RETRIES,
                         ...seat,
                         ...(classifierAuth?.apiKey !== undefined ? { apiKey: classifierAuth.apiKey } : {}),
                         ...(classifierAuth?.headers !== undefined ? { headers: classifierAuth.headers } : {}),
@@ -246,9 +270,14 @@ export async function prepareCapsAndWorkflow(input) {
                 return classifierReplyVerdictText(response);
             },
         });
-        if (am.persistArming === true)
-            autoModeArming = mintPersistedArming(am, classifierLaneRule, classifierSystemPrompt, deps.onError, sessionId);
-    }
+        const arming = am.persistArming === true ? mintPersistedArming(am, classifierLaneRule, classifierSystemPrompt(), derivedDenyRules, deps.onError, sessionId) : undefined;
+        if (autoModeDeciderRef.current !== undefined)
+            return;
+        autoModeDeciderRef.current = decider;
+        autoModeDenialTrackingRef.current = denialTracking;
+        autoModeArmingRef.current = arming;
+    };
+    permissionMode.bindArming({ caps: runtimeCaps, autoFacePresent: deps.autoMode !== undefined, armAuto: armAutoMode, onArmFault: (e) => deps.onError?.(asThrownError(e), { phase: "config", sessionId }) });
     const deploymentWorkflowReady = runnerSelf !== undefined && isSelfOrchestrationActive(spec, deps);
     const selfOrchestrationActive = deploymentWorkflowReady && runtimeCaps?.allowWorkflows !== false;
     if (deploymentWorkflowReady && runtimeCaps?.allowWorkflows === false) {
@@ -313,7 +342,7 @@ export async function prepareCapsAndWorkflow(input) {
                 const co = memoryEngineSession?.captureOptOut;
                 return assembleParentCaptureState(co?.optedOut() ?? false, co?.indeterminate() ?? false, ctl, [...(internals?.memoryCaptureAncestors ?? []), { sessionId, ...(ctl !== undefined ? { controlDir: ctl } : {}) }]);
             },
-            autoModeReview: () => (autoModeDecider !== undefined ? { decider: autoModeDecider } : undefined),
+            autoModeReview: () => (autoModeDeciderRef.current !== undefined ? { decider: autoModeDeciderRef.current } : undefined),
             workflowDepth: internals?.workflowDepth,
             parentCwd: taskRootFinal,
             parentThinking: () => childThinkingSeat(undefined, deploymentSubagentThinking(runnerSelf.agentCatalog?.roles), harnessRef.current?.getThinkingLevel() ?? thinking).thinking,
@@ -332,5 +361,5 @@ export async function prepareCapsAndWorkflow(input) {
             inheritedGateForChildren,
         }), { source: "builtin", mountedBy: "workflow" });
     }
-    return { roster, blockedRef, runtimeCaps, runtimeCapsFaulted, complianceDenies, complianceDegraded, agentForkDenial, observersActive, autoModeArmReason, autoModeDecider, autoModeDenialTracking, autoModeArming, selfOrchestrationActive, workflowToolsActive, workflowSizeGuideline };
+    return { roster, blockedRef, runtimeCaps, runtimeCapsFaulted, complianceDenies, complianceDegraded, agentForkDenial, observersActive, autoModeArmReason, autoModeDeciderRef, autoModeDenialTrackingRef, autoModeArmingRef, armAutoMode, selfOrchestrationActive, workflowToolsActive, workflowSizeGuideline };
 }