@sema-agent/core 7.33.7 → 7.34.0

package/dist/core/checkpoint-store.js

@@ -3,11 +3,12 @@ import { uuidv7 } from "../internal/harness.js";
 import { PROBE_CAUSE_PATH_MAX, PROBE_REASON_MAX, inlineUntrusted, sanitizeUntrustedText } from "./untrusted-text.js";
 import { carriesBidiControls } from "./tool-policy.js";
 import { readDenialLimitFallback } from "./auto-mode.js";
-import { isAskOrigin, isPersistedRuleMandate, isRuleStoreUnreadable } from "./ask-origin.js";
+import { isAskOrigin, isPersistedRuleMandate } from "./ask-origin.js";
 import { checkpointExecutionRecorded, executionRecordDisposition, ExecutionOutcomeConflictError, } from "./checkpoint-execution-record.js";
 import { renderUntrustedCommandText, stripFormatCharacters } from "./permission-rule-model.js";
 import { redactSecrets } from "./untrusted-egress.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "./ask-question.js";
+import { isPermissionMode } from "./ask-origin.js";
 export function mintCheckpointToken() {
     return randomBytes(16).toString("hex");
 }
@@ -298,15 +299,15 @@ export function summarizeCheckpoint(cp) {
         ...(tool?.previewWithheld === "oversize" || tool?.previewWithheld === "unavailable" ? { previewWithheld: tool.previewWithheld } : {}),
         ...(tool?.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
         ...(tool?.mandated === true ? { mandated: true } : {}),
+        ...(tool?.authoredBy === "deployment" ? { authoredBy: "deployment" } : {}),
         ...(() => {
             const fb = readDenialLimitFallback(tool?.denialLimitFallback);
             return fb !== undefined ? { denialLimitFallback: fb } : {};
         })(),
         ...(() => {
             const origin = tool?.origin;
-            const ruleStoreUnreadable = tool?.ruleStoreUnreadable;
             const mandate = tool?.mandate;
-            return { ...(isAskOrigin(origin) ? { origin } : {}), ...(isRuleStoreUnreadable(ruleStoreUnreadable) ? { ruleStoreUnreadable } : {}), ...(isPersistedRuleMandate(mandate) ? { mandate } : {}) };
+            return { ...(isAskOrigin(origin) ? { origin } : {}), ...(isPersistedRuleMandate(mandate) ? { mandate } : {}) };
         })(),
         ...(hasBidi ? { hasBidiControls: true } : {}),
     };
@@ -732,3 +733,57 @@ export class InMemoryCheckpointStore {
         return this.cps.size;
     }
 }
+export function migrateLegacyModeSeed(gate) {
+    if (gate === undefined)
+        return {};
+    const raw = gate;
+    const refusal = (code, message) => {
+        const e = new Error(message);
+        e.code = code;
+        return e;
+    };
+    const dropped = [];
+    let permissionMode;
+    const declared = raw["permissionMode"];
+    if (declared !== undefined) {
+        if (!isPermissionMode(declared))
+            throw refusal("config.permission_mode_invalid", `the checkpoint row's inheritedGate.permissionMode is ${JSON.stringify(declared)}, not a permission mode — the row cannot be resumed under a mode this engine does not know`);
+        permissionMode = declared;
+        if (raw["autoModeRequested"] !== undefined)
+            dropped.push("autoModeRequested");
+        if (raw["approverPosture"] !== undefined)
+            dropped.push("approverPosture");
+    }
+    else {
+        const intent = raw["autoModeRequested"];
+        if (intent === true) {
+            permissionMode = "auto";
+            dropped.push("autoModeRequested");
+        }
+        else if (intent !== undefined && intent !== false) {
+            throw refusal("resume.legacy_mode_seed", `the checkpoint row's inheritedGate.autoModeRequested is ${JSON.stringify(intent)}, which the one-time mode migration cannot read (only true / false / absent are) — the row is refused rather than resumed under a guessed mode`);
+        }
+        else if (intent === false) {
+            dropped.push("autoModeRequested");
+        }
+        if (raw["approverPosture"] !== undefined)
+            dropped.push("approverPosture");
+    }
+    const prePlan = raw["prePlanMode"];
+    if (prePlan !== undefined && (!isPermissionMode(prePlan) || prePlan === "plan"))
+        throw refusal("config.permission_mode_invalid", `the checkpoint row's inheritedGate.prePlanMode is ${JSON.stringify(prePlan)}, not a permission mode a plan can return to`);
+    const floor = raw["shellGate"];
+    let shellGate;
+    if (floor === "always")
+        shellGate = "always";
+    else if (floor === "off" || floor === "classify")
+        dropped.push("shellGate");
+    else if (floor !== undefined)
+        throw refusal("resume.legacy_mode_seed", `the checkpoint row's inheritedGate.shellGate is ${JSON.stringify(floor)}, which is neither the floor word "always" nor a retired doctrine word — the row is refused rather than resumed under a guessed floor`);
+    return {
+        ...(permissionMode !== undefined ? { permissionMode } : {}),
+        ...(prePlan !== undefined ? { prePlanMode: prePlan } : {}),
+        ...(shellGate !== undefined ? { shellGate } : {}),
+        ...(dropped.length > 0 ? { migrated: { ...(declared === undefined && permissionMode !== undefined ? { permissionMode } : {}), droppedKeys: dropped } } : {}),
+    };
+}

package/dist/core/child-clamp-seats.js

@@ -2,6 +2,7 @@ export const CHILD_CLAMP_SEATS = ["handsReadOnly", "interactiveTools", "readFace
 export const CHILD_CLAMP_SEATS_NOT_CARRIED = Object.freeze({
     toolPolicy: "not a clamp a child spec copies: a parent's denies reach its children through the ancestor-constraint chain the child's own prepare folds, not by putting the parent's policy object on the child seat",
     shellGate: "travels on the inherited-gate lane (`InheritedGate.shellGate`, a trusted internals seat), not on the child spec — a spec-level copy would be a second source for the same clamp",
+    permissionMode: "travels on the inherited-gate lane (`InheritedGate.permissionMode` / `permissionModeCeiling` — the parent's declared word and its LIVE seat): a child with no word of its own inherits that ceiling on every read, and a word it does declare is clamped under it; a spec-level copy would freeze the parent's word at spawn and be a second source for the same clamp",
     onAsk: "per-lane by construction: the delegation lane wraps the parent's approver with spawn provenance before it becomes the child's seat, and a lane with no approver must hand down none",
     hooks: "a deployment seat, not an inherited clamp — `tightenTaskSpec` refuses to merge two hook sets rather than composing them, so there is no tightening value to carry",
     excludeTools: "roster control rather than containment: the lanes that copy a parent's roster do so beside these seats, and the workflow lane authors its child roster from the governance baseline instead of the host's",

package/dist/core/classifier-unavailable-arm.d.ts

@@ -0,0 +1,57 @@
+/**
+ * The ONE exit for an auto-mode classification that could not RULE (`unavailable`: the classifier leg failed, or its
+ * per-level budget ran out) — shared by both classifier stations, the leg's gate and an ancestor's frozen classifier
+ * in the policy fold, so the rule is written once.
+ *
+ * ONE fork, on the APPROVAL SEAT (does an ask this station hands on reach a person — a live approver, or a durable
+ * park): with one, the ask goes on, its text saying why auto mode is asking, and a person decides; without one, the
+ * call is refused with CC's `x1t` sentence and the classification's FORM (`unavailable`) is attested on the deny. The seat is
+ * the only input to the fork — not the cause, not the mode. The handed-on ask carries `requiresRealApproval`: no
+ * automatic lane may answer it in the classifier's stead — not a blanket `onAsk:"allow"`, not the sandbox admission, not a
+ * budget resolver over its park (the park mints the non-budgetable kind). CC refuses either way; asking where a person can be
+ * asked is a declared departure (a classifier that is slow or down must not turn an attended session into a string
+ * of refusals). Neither arm is a block: the denial limit counts classifier RULINGS, and a person's refusal of the
+ * handed-on ask is a person's, not the classifier's.
+ *
+ * The observer hears every such classification with where the call went, except while the call is being aborted — a halt,
+ * or the run's end (the classifier did not fail; the call ended). It is observe-only: a throw never changes the arm.
+ */
+import { type AutoModeClassifierRound, type AutoModeUnavailableCause } from "./auto-mode.js";
+import { type PermissionResult, type ToolCallRequest } from "./tool-policy.js";
+/** Where an `unavailable` classification sent the call: `asked` = on to the approval seat, `denied` = refused. */
+export type ClassifierUnavailableDisposition = "asked" | "denied";
+/** What the stations' observer receives — the facts the `classifier.unavailable` notice is composed from. */
+export interface ClassifierUnavailableInfo {
+    toolName: string;
+    toolCallId: string;
+    cause: AutoModeUnavailableCause;
+    disposition: ClassifierUnavailableDisposition;
+}
+export type ClassifierUnavailableObserver = (info: ClassifierUnavailableInfo) => void;
+/** The station's two facts for the fork: whether an ask it hands on reaches a person (`true` only — anything else is
+ *  no seat), and who hears it. */
+export interface ClassifierUnavailableSeat {
+    approvalSeat?: boolean;
+    onUnavailable?: ClassifierUnavailableObserver;
+}
+/** The arm the fork chose: the ask to hand on, or the refusal. */
+export type ClassifierUnavailableArm<A> = {
+    kind: "asked";
+    ask: A;
+} | {
+    kind: "denied";
+    deny: PermissionResult;
+};
+export declare function classifierUnavailableArm<A extends Extract<PermissionResult, {
+    action: "ask";
+}>>(args: {
+    ask: A;
+    req: ToolCallRequest;
+    cause: AutoModeUnavailableCause;
+    /** The ladder's attribution, for the refusal's sentence (it names both rungs when the ladder moved). */
+    attribution?: AutoModeClassifierRound;
+    seat: ClassifierUnavailableSeat | undefined;
+    /** The call is being aborted (its per-call signal — a halt, or the run's end): the observer is not told (the arm is chosen
+     *  as ever). */
+    aborted: boolean;
+}): ClassifierUnavailableArm<A>;

package/dist/core/classifier-unavailable-arm.js

@@ -0,0 +1,17 @@
+import { classifierUnavailableAskMessage, classifierUnavailableDenyMessage } from "./auto-mode.js";
+import { attestClassifierDenyCause } from "./tool-policy.js";
+export function classifierUnavailableArm(args) {
+    const { ask, req, cause } = args;
+    const seated = args.seat?.approvalSeat === true;
+    if (!args.aborted) {
+        try {
+            args.seat?.onUnavailable?.({ toolName: req.toolName, toolCallId: req.toolCallId, cause, disposition: seated ? "asked" : "denied" });
+        }
+        catch {
+        }
+    }
+    if (seated)
+        return { kind: "asked", ask: { ...ask, message: classifierUnavailableAskMessage(ask.message ?? `approval required for "${req.toolName}"`, cause), requiresRealApproval: true } };
+    const deny = { action: "deny", message: classifierUnavailableDenyMessage(req.toolName, cause, args.attribution), decisionReason: "classifier" };
+    return { kind: "denied", deny: attestClassifierDenyCause(deny, "unavailable", req) };
+}

package/dist/core/effective-path-target.d.ts

@@ -101,3 +101,15 @@ export type PathTargetReading = {
  * against names no file, and claiming it names `/<spelling>` was a fabrication no fence should judge.
  */
 export declare function effectivePathTargetOf(call: ToolCallLike, pt: ToolCallPathTarget | undefined, bases: ToolPathBases): PathTargetReading;
+/**
+ * The SELECTION half of {@link effectivePathTargetOf}, before any identity is applied: the spelling the tool opens and
+ * the base it resolves that spelling against — the slot's own value, or an absolute pattern's base directory — or,
+ * with `spelled` absent, the base itself (the tool searches all of it). A caller that resolves canonically (the tool,
+ * the read face's own station) reads this; the rule lanes read the lexical identity above. Same order as above.
+ */
+export declare function effectivePathSpellingOf(call: ToolCallLike, pt: ToolCallPathTarget | undefined, bases: ToolPathBases): {
+    readonly spelled?: string;
+    readonly base: string | undefined;
+} | {
+    readonly refused: Win32NamespaceRefusal;
+} | undefined;

package/dist/core/effective-path-target.js

@@ -23,26 +23,37 @@ export function splitAbsoluteGlobPattern(pattern, family) {
     return { baseDir, relativePattern: spelled.slice(cut + 1) };
 }
 export function effectivePathTargetOf(call, pt, bases) {
+    const spelling = effectivePathSpellingOf(call, pt, bases);
+    if (spelling === undefined)
+        return undefined;
+    if ("refused" in spelling)
+        return { kind: "refused", reason: spelling.refused };
+    if (spelling.spelled !== undefined)
+        return resolveSpelling(spelling.spelled, spelling.base, bases);
+    const declaredBase = spelling.base;
+    if (declaredBase === undefined)
+        return undefined;
+    const family = pathFamilyOf(bases);
+    return isAbsoluteForFamily(family, declaredBase) ? readingOf(pathIdentityOf(declaredBase, family, bases.root ?? bases.cwd)) : unreadableBase(declaredBase);
+}
+export function effectivePathSpellingOf(call, pt, bases) {
     if (pt === undefined)
         return undefined;
     const declaredBase = pathTargetBaseOf(pt, bases);
     const spelled = pathTargetValue(call.args, pt);
     if (spelled !== undefined)
-        return resolveSpelling(spelled, declaredBase, bases);
+        return { spelled, base: declaredBase };
     if ((pt.absent ?? "none") === "none")
         return undefined;
     if (pt.patternParam !== undefined) {
         const pattern = pathTargetValue(call.args, { param: pt.patternParam });
         const split = pattern === undefined ? undefined : splitAbsoluteGlobPattern(pattern, pathFamilyOf(bases));
         if (split !== undefined && "refused" in split)
-            return { kind: "refused", reason: split.refused };
+            return { refused: split.refused };
         if (split !== undefined)
-            return resolveSpelling(split.baseDir, declaredBase, bases);
+            return { spelled: split.baseDir, base: declaredBase };
     }
-    if (declaredBase === undefined)
-        return undefined;
-    const family = pathFamilyOf(bases);
-    return isAbsoluteForFamily(family, declaredBase) ? readingOf(pathIdentityOf(declaredBase, family, bases.root ?? bases.cwd)) : unreadableBase(declaredBase);
+    return { base: declaredBase };
 }
 function resolveSpelling(spelled, declaredBase, bases) {
     const family = pathFamilyOf(bases);

package/dist/core/engine-notice.d.ts

@@ -222,6 +222,18 @@ export interface EngineNotice {
      *    ladder position (0 the seat, 1 the model behind it), since two rungs may share an id. A ruling from
      *    that rung resets its count; an `unavailable` round neither counts nor resets. Once per run per rung,
      *    and by construction before the denial limit's third block hands the user its card.
+     *  - `"classifier.unavailable"` (`src/core/runner/classifier-ladder.ts`, `classifierUnavailableNotice`; minted by
+     *    both classifier stations — the leg's gate and an ancestor's frozen classifier in the policy fold) — a
+     *    classification could NOT RULE (the classifier leg failed, or its per-level budget
+     *    `RunnerDeps.autoMode.timeoutMs` ran out) and says where the call went: `disposition: "asked"` = on down the
+     *    ask chain to the leg's approval seat (a live approver or a durable park decides; the handed-on ask carries
+     *    `requiresRealApproval`, so no automatic lane answers it; a declared departure from CC, which refuses either
+     *    way), `"denied"` = refused with the classifier's own sentence (no approval seat).
+     *    `detail: { toolName, toolCallId, cause, disposition, sessionId?, runId? }` — `cause` is the
+     *    `AutoModeUnavailableCause` word. Once per classification that could not answer (a call judged by an ancestor's
+     *    classifier and the leg's own can carry two); not minted while the call is being aborted (a halt, or the run's end). Audience
+     *    `user`: on a lane with no approval face this line is the only place the user hears why the call did not
+     *    run. It is not a block — the denial limit does not count it.
      *  - `"route.base_url_changed_key_unchanged"` (key↔URL pairing) — `Runner.swapDeps` moved a
      *    same-name entry's `baseUrl` while its Model-visible credential half (auth-bearing headers)
      *    did not change: legal (a provider changing domains), but worth one loud line — if the
@@ -281,6 +293,44 @@ export interface EngineNotice {
      *    secret-shaped keys from a spawned child's environment (a tool's shell, or a language server).
      *    Once per PROCESS, shared by every scrub site ({@link import("./secret-env.js").announceSecretEnvScrub});
      *    `detail: { names }` — every withheld key's name, never a value.
+     *  - `"config.permission_mode_unavailable"` — the permission mode a task requested is not the mode the leg runs
+     *    under: the deployment denies it (`by: "operator_deny"` — `RuntimeCaps.bypassPermissions` / `autoMode` is
+     *    `false`), a requested `auto` has no classifier face (`by: "face_absent"`), or a child's declaration was folded
+     *    under its parent's ceiling (`by: "inherited_ceiling"`, minted on the PARENT's stream with the child's
+     *    `sessionId` beside the parent's — a child's own manifest is not shown to the person). The leg runs in
+     *    `effective` (always `default` for the first two arms), announced once per leg and once per steer that folds;
+     *    `detail: { requested, effective, by, sessionId, runId }`. Audience `user`.
+     *  - `"config.permission_mode_invalid"`, `"config.spec_retired_key"`, `"config.shell_gate_value_retired"` and
+     *    `"resume.legacy_mode_seed"` are ERROR codes, not notices (named here only to keep the mode family's spellings
+     *    in one place): a `permissionMode` word outside the closed set (on the spec or on a checkpoint row), a spec
+     *    carrying a retired mode key (`autoModeRequested`, `approverPosture`), a `shellGate` value other than
+     *    `"always"`, and a checkpoint row whose pre-mode seed the migration cannot read. Each is a door refusal: the
+     *    code rides the thrown error (the run fails, or the resume is refused) and never crosses
+     *    {@link deliverEngineNotice}, so all four are deliberately absent from {@link ENGINE_NOTICE_CODES} /
+     *    {@link NOTICE_AUDIENCE}, like `config.deps_retired_key`. A consumer diffing its own table against the
+     *    catalog must not add a row for them; it reads them on the error's `code`.
+     *  - `"permission.ask_released_by_mode"` — the `bypassPermissions` mode released a surviving ask instead of
+     *    putting it to anyone; once per (mode, askClass) per run, `detail: { mode, askClass, origin?, mandate?, count,
+     *    firstToolCallId, sessionId, runId }` — `count` is how many releases of that pair the run had made when the
+     *    notice was minted (the first). The per-call record is `tool_end.gate.disposition.released`. Audience `user`.
+     *  - `"permission.read_deny_unapplied"` — the mode released a call whose reads the shell read station could not
+     *    establish (`unestablishable` / `declined`) while a read-deny table is in force: no row of the table was applied
+     *    to what it reads (C-R124, "released and disclosed"). Every such call, `detail: { mode, toolCallId, tiers, rows,
+     *    rowCount, sessionId, runId }` (`rows` = the first eight non-built-in rows). Audience `user`.
+     *  - `"permission.rule_store_unavailable"` — the person's persisted permission rules could not be read (a read
+     *    failure, a corrupt or unreadable store, a read that did not answer in time), so that read's rows were SKIPPED:
+     *    none of their allow, ask or deny rows took part in the decisions it served — a deny row among them protected
+     *    nothing meanwhile — and no card is raised for it. `detail.at` names the read that found it first: `"prepare"`
+     *    (the path rows the run's file and shell checks take at run start — the next run reads them again) or `"call"`
+     *    (one call's own rule check — every later call reads again, so the rows apply as soon as a read succeeds). Once
+     *    per run, whichever read fails first; the trace keeps every read's line (`permission.rule_store_unreadable`).
+     *    `detail: { at, sessionId, runId }`. Audience `user`.
+     *  - `"resume.legacy_mode_seed_migrated"` — a checkpoint row written before the one-key mode (7.34.0) carried
+     *    `autoModeRequested` / `approverPosture` / a doctrine `shellGate`; the resume leg read them once into
+     *    `permissionMode` (`autoModeRequested: true` ⇒ `auto`; a posture is dropped — it never authorized anything;
+     *    `shellGate` `"off"` / `"classify"` are dropped, `"always"` kept) and the next suspend writes the new member.
+     *    `detail: { migrated: { permissionMode?, droppedKeys }, sessionId, runId }`. Audience `operator`. A row the
+     *    migration cannot read refuses the resume instead (`resume.legacy_mode_seed`, the error-code row above).
      *  - `"config.durable_gate_unavailable"` — a durable-approval MANDATE is in force on a leg with NO
      *    checkpoint store: the per-principal `forceDurableGate` entitlement, or the task's own
      *    `durableApproval` opt-in with no live approver seat (`durableMandateSourceOf`, the predicate the
@@ -686,8 +736,9 @@ export interface EngineNotice {
      *    facility (an in-fold deny, no settlement on the frame). The deny itself is unchanged (the
      *    fail-closed sentence as the tool result); this is its person-facing half, minted at the gate's ONE
      *    deny exit, once per tool call, by `ask-unresolvable-notice.ts`. `detail: { sessionId, toolName,
-     *    toolCallId, cause, parkLaneExisted }` — `parkLaneExisted` says whether a park lane was armed and
-     *    declined/failed (`true`) or none existed (`false`, the usual shape). Audience `"user"`: the refused
+     *    toolCallId, cause, parkLaneExisted, remedy? }` — `parkLaneExisted` says whether a park lane was armed and
+     *    declined/failed (`true`) or none existed (`false`, the usual shape); `remedy` (the headless auto-deny only)
+     *    is the one sentence naming the caller-side change that would have let the call run, as the tool text carries it. Audience `"user"`: the refused
      *    work is the session user's own; the operator hears it through the sink like every code.
      *
      *  - `"memory.consolidation_recommended"` (design/339 §2.2/§6.2) — the engine-minted per-scope

package/dist/core/fs-write-gate-policy.d.ts

@@ -1,5 +1,5 @@
 import type { ExecutionEnv } from "../internal/harness-types.js";
-import type { ToolPolicy } from "./tool-policy.js";
+import type { PermissionResult, ToolPolicy } from "./tool-policy.js";
 /** design/388 B22 — the identity triple the exemption probe hands the store beside the name. */
 export interface ToolCallIdentity {
     capabilityId: string;
@@ -31,6 +31,10 @@ export interface FsWriteGatePolicyOptions {
      *  to the ask-resolution chain (live onAsk / durable park / headless deny); `"allow"` is the
      *  acceptEdits-mode shape (domain checks still run so a sensitive-path deny composes unchanged). */
     defaultWrite: "ask" | "allow";
+    /** The ask the default verdict mints in place of the gate's ordinary write question — a permission mode's own
+     *  sentence over the resolved `path`, with the gate's domain note (a configured domain that was not honored) to
+     *  append when there is one. Read only where `defaultWrite` is `"ask"`. */
+    defaultAsk?: (path: string, note: string | undefined) => PermissionResult;
     /**
      * Session-exemption lookup ("allow all for this session" grants recorded by the deployment's approval
      * surface). Consulted ONCE per covered write, after the domain checks and immediately BEFORE the gate

package/dist/core/fs-write-gate-policy.js

@@ -109,7 +109,10 @@ export function createFsWriteGatePolicy(opts) {
             }
             if (defaultWrite === "allow")
                 return { action: "allow" };
-            return ask(`approve write to "${path}"?${advisory}${refusedDomain === undefined ? "" : ` — note: the configured write domain ${refusedDomain} was not honored; a domain that holds the root would exempt every write under it`}`);
+            const note = refusedDomain === undefined ? undefined : ` — note: the configured write domain ${refusedDomain} was not honored; a domain that holds the root would exempt every write under it`;
+            if (opts.defaultAsk !== undefined)
+                return opts.defaultAsk(path, note);
+            return ask(`approve write to "${path}"?${advisory}${note ?? ""}`);
         },
     };
 }

package/dist/core/gate-fold.js

@@ -175,6 +175,14 @@ function shellReadAskMessage(toolName, finding) {
 }
 function applyShellReadVerdict(pass, verdict, toolName, shellGated) {
     const account = verdict.sentence !== undefined && verdict.sentence.trim().length > 0 ? inlineUntrusted(verdict.sentence, PROBE_REASON_MAX) : undefined;
+    if (verdict.writesPlaced === true)
+        pass.shellWritesPlaced = true;
+    if (verdict.writeProtected === true)
+        pass.writeProtected = true;
+    if (verdict.unplacedOptions !== undefined)
+        pass.shellUnplacedOptions = verdict.unplacedOptions;
+    if (verdict.finding === "unestablishable" || verdict.finding === "declined" || verdict.unestablished === true)
+        pass.shellReadUnestablished = true;
     switch (verdict.disposition) {
         case "vouch":
             return;
@@ -207,16 +215,24 @@ function applyShellReadVerdict(pass, verdict, toolName, shellGated) {
             return;
         }
         case "ordinary": {
+            verdict.admit?.();
+            if (verdict.details !== undefined)
+                pass.shellReadDetails = verdict.details;
             if (pass.decision.action === "allow") {
+                const candidate = normalizeReadRootCandidate(verdict.readRootCandidate);
                 pass.decision = {
                     action: "ask",
                     message: shellReadAskMessage(toolName, verdict.finding),
                     decisionReason: "safety",
                     ...(account !== undefined ? { probeReason: account } : {}),
+                    ...(candidate !== undefined ? { probeReadRootCandidate: candidate } : {}),
                 };
+                if (candidate !== undefined)
+                    pass.shellReadOffer = true;
                 pass.tightenedBy = shellGated ? "shell_gate" : "safety";
             }
-            pass.probeBoundaryDeclined = true;
+            if (verdict.finding === "declined")
+                pass.probeBoundaryDeclined = true;
             return;
         }
         default: {