@sema-agent/core 7.33.8 → 7.35.0

package/dist/core/runner/run-leg.js

@@ -513,6 +513,7 @@ export async function runLeg(input) {
         }
         prepared.abortController.abort();
         prepared.releaseSignal();
+        prepared.endModeCeiling();
         strandedHumanAnswers = prepared.settleContentAskBindings();
         try {
             prepared.harness.recoverUndrainedEngineNotes();
@@ -633,7 +634,7 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
     }
     if (prepared.permissionRuleOrg !== undefined) {
         const orgVerdict = prepared.permissionRuleOrg
-            .adjudicate({ toolName: pendingAction.toolName, args: resolvedArgs, toolCallId: pendingAction.toolCallId })
+            .adjudicate({ toolName: pendingAction.toolName, args: resolvedArgs, toolCallId: pendingAction.toolCallId, ...callFaceSeat(toolCallFaceOf(prepared.toolRosterDeltas.current, pendingAction.toolName)) })
             .catch(() => ({ status: "unavailable", disclosures: ["the org adjudication face threw on resume"] }));
         let orgWaitCancelled = false;
         const org = await settleOrgVerdictWithin(orgVerdict, { status: "unavailable", disclosures: [`the org adjudication face did not answer within ${ORG_ADJUDICATION_TIMEOUT_MS}ms (or the task ended first)`] }, {
@@ -683,22 +684,30 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
     }
     if (prepared.persistedRuleLane !== undefined) {
         const unreadable = { unreadable: true };
-        const read = await settleOrgVerdictWithin(Promise.resolve()
-            .then(() => prepared.persistedRuleLane.adjudicate({
-            toolName: pendingAction.toolName,
-            args: resolvedArgs,
-            toolCallId: pendingAction.toolCallId,
-            ...callFaceSeat(toolCallFaceOf(prepared.toolRosterDeltas.current, pendingAction.toolName)),
-            budget: beltBudget,
-            ...(prepared.cwdRef !== undefined ? { cwd: prepared.cwdRef.current } : {}),
-            ...advertisedWritableRootsSeat(prepared.advertisedWritableDirs),
-        }))
-            .then((answer) => normalizePersistedRuleHit(answer)), unreadable, { signal: prepared.abortController.signal, timeoutMs: ORG_ADJUDICATION_TIMEOUT_MS });
+        let laneWaitCancelled = false;
+        let laneRead;
+        try {
+            laneRead = Promise.resolve(prepared.persistedRuleLane.adjudicate({
+                toolName: pendingAction.toolName,
+                args: resolvedArgs,
+                toolCallId: pendingAction.toolCallId,
+                ...callFaceSeat(toolCallFaceOf(prepared.toolRosterDeltas.current, pendingAction.toolName)),
+                budget: beltBudget,
+                ...(prepared.cwdRef !== undefined ? { cwd: prepared.cwdRef.current } : {}),
+                ...advertisedWritableRootsSeat(prepared.advertisedWritableDirs),
+            })).then((answer) => normalizePersistedRuleHit(answer));
+        }
+        catch {
+            laneRead = Promise.resolve(unreadable);
+        }
+        const read = await settleOrgVerdictWithin(laneRead, unreadable, { signal: prepared.abortController.signal, timeoutMs: ORG_ADJUDICATION_TIMEOUT_MS, onFallback: (cause) => void (laneWaitCancelled = cause === "aborted") });
         const tightened = applyPersistedTightening({ action: "allow" }, read);
-        if (tightened.tightened === "deny" || tightened.tightened === "unreadable") {
-            const why = tightened.tightened === "deny"
-                ? `a standing deny rule of yours (${disclosedRuleSet(read.hit?.rules ?? [])}) now refuses it`
-                : "your persisted permission rules could not be read on this leg";
+        if (laneWaitCancelled || tightened.tightened === "deny" || tightened.tightened === "unreadable") {
+            const why = laneWaitCancelled
+                ? "the task was cancelled before your persisted permission rules could be read"
+                : tightened.tightened === "deny"
+                    ? `a standing deny rule of yours (${disclosedRuleSet(read.hit?.rules ?? [])}) now refuses it`
+                    : `it could not be read against your standing deny/ask rules (${read.reason})`;
             const ruleDenial = formatHookFeedback(`The approved tool call "${pendingAction.toolName}" was not executed: ${why}. This approval is spent — the call has to be re-issued and approved again.`, prepared.reminderMark);
             await settleEnd(true, { content: ruleDenial }, vetoed("persisted_rule"));
             const eid = await prepared.session.appendMessage(toolResultMsg(pendingAction.toolCallId, pendingAction.toolName, ruleDenial, true));
@@ -708,7 +717,8 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
     }
     if (prepared.shellReadCheck !== undefined) {
         const edited = outcome.updatedInput !== undefined && !deepJsonEqual(outcome.updatedInput, pendingAction.args);
-        const judged = prepared.shellReadCheck.judge(pendingAction.toolName, resolvedArgs, prepared.cwdRef?.current, prepared.abortController.signal, {
+        const readCall = { toolName: pendingAction.toolName, ...callFaceSeat(toolCallFaceOf(prepared.toolRosterDeltas.current, pendingAction.toolName)) };
+        const judged = prepared.shellReadCheck.judge(readCall, resolvedArgs, prepared.cwdRef?.current, prepared.abortController.signal, {
             toolCallId: pendingAction.toolCallId,
             ...(edited ? { seat: "rejudge" } : {}),
         });
@@ -720,7 +730,7 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
             }
             catch {
                 answered = false;
-                verdict = prepared.shellReadCheck.unanswered(pendingAction.toolName, "the read station could not answer on the resumed leg");
+                verdict = prepared.shellReadCheck.unanswered(readCall, "the read station could not answer on the resumed leg");
             }
             if (!answered || verdict.disposition === "refuse" || (edited && verdict.disposition !== "vouch")) {
                 const readDenial = formatHookFeedback(`The approved tool call "${pendingAction.toolName}" was not executed: ${verdict.sentence ?? "the read boundary does not vouch for what it reads on this leg"} This approval is spent — the call has to be re-issued and approved again.`, prepared.reminderMark);
@@ -729,6 +739,7 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
                 emitCommitted(eid, "toolResult", pendingAction.toolCallId);
                 return;
             }
+            verdict.admit?.();
         }
     }
     const tool = prepared.tools.find((t) => t.name === pendingAction.toolName);

package/dist/core/runner/run-notification-lane.d.ts

@@ -4,6 +4,7 @@ import type { SessionStore } from "../session.js";
 import { type NotificationInjectionOutcome, type PendingSessionNotifications, type SystemInjectionPriority, type TaskNotificationPayload } from "../task-notification.js";
 import type { RunnerDeps, TaskEvent, TaskSpec } from "../types.js";
 import type { SessionReadFileStates } from "./session-read-file-states.js";
+import type { SessionModeSeats } from "./session-mode-seats.js";
 import type { NotificationLaneBindings, Prepared, PrepareTaskFn, ResumeRun, RunInternals, RunnerDepsSeat, RunnerSelfSeat, TaskIdRef } from "./contracts.js";
 export interface RunNotificationLaneInput<R> {
     /** borrowed-readonly — the task spec: prepare's input, and the principal the peer scope is minted from. */
@@ -26,6 +27,8 @@ export interface RunNotificationLaneInput<R> {
     sessions: SessionStore;
     /** borrowed-mutable — the Runner's own per-session read-state seat, ALWAYS this Runner's (a caller-supplied one is overridden). */
     sessionReadStates: SessionReadFileStates;
+    /** borrowed-mutable — the Runner's per-session permission-mode seats, ALWAYS this Runner's (a caller-supplied one is overridden). */
+    sessionModeSeats: SessionModeSeats;
     /** borrowed-mutable — the Runner's per-session parked-notification store: the torn-down lane and the escalation pend here. */
     pendingSessionNotifications: PendingSessionNotifications;
     /** borrowed-readonly — the orchestrator's entry (a lane may not name the orchestrator; the driver hands it in), as the ONE

package/dist/core/runner/run-notification-lane.js

@@ -8,12 +8,13 @@ export function runNotificationLane(input) {
     return obligations.run(() => runNotificationLaneAs(input, obligations));
 }
 async function runNotificationLaneAs(input, obligations) {
-    const { spec, queue, resume, internals, taskIdRef, runner, self, sessions, sessionReadStates, pendingSessionNotifications, prepareTask, next } = input;
+    const { spec, queue, resume, internals, taskIdRef, runner, self, sessions, sessionReadStates, sessionModeSeats, pendingSessionNotifications, prepareTask, next } = input;
     const prepareResume = resume
         ? {
             leafId: resume.cp.leafId,
             suspendedBatch: new Set(resume.cp.pendingAction.kind === "tool_approval" ? resume.cp.pendingAction.batchToolCallIds : []),
             seed: resume.cp.state,
+            outcome: resume.outcome,
             priorSuspendCount: resume.cp.suspendCount,
             priorLedger: resume.cp.resourceLedger,
             priorHumanReview: resume.cp.humanReview,
@@ -117,6 +118,7 @@ async function runNotificationLaneAs(input, obligations) {
         peerInboundChainRef,
         detachHub,
         sessionReadStates,
+        sessionModeSeats,
         onTaskNotification: (notification, opts) => {
             try {
                 upstreamTaskNotification?.(notification, opts);

package/dist/core/runner/run-telemetry-and-budget-seats.d.ts

@@ -6,8 +6,8 @@ import type { Prepared, ResumeRun, RunnerDepsSeat, RunState, TaskIdRef } from ".
 export interface RunTelemetryAndBudgetSeatsInput {
     /** borrowed-readonly — the task spec: limits, degrade, tracer, output retries, the resource-suspend totals. */
     spec: TaskSpec;
-    /** borrowed-mutable — the leg's prepared seat: `liveSpendRef.get` is installed, `humanReviewRef` and `planModeRef`
-     *  are written on a resume; the model, the ledger, the session id and the usage governance are read. */
+    /** borrowed-mutable — the leg's prepared seat: `liveSpendRef.get` is installed, `humanReviewRef` is written and the
+     *  mode seat steered on a resume; the model, the ledger, the session id and the usage governance are read. */
     prepared: Prepared;
     /** borrowed-readonly — the resume plan when this leg resumes a checkpoint (the human-review latency, the plan re-arm). */
     resume: ResumeRun | undefined;

package/dist/core/runner/run-telemetry-and-budget-seats.js

@@ -33,7 +33,7 @@ export function runTelemetryAndBudgetSeats(input) {
         });
     }
     if (resume !== undefined && resume.outcome.gate === "plan_review" && resume.outcome.decision === "reject") {
-        prepared.planModeRef.active = true;
+        void prepared.permissionMode.steer("plan");
     }
     rs.telemetry.cacheFamily = cacheFamilyOf(prepared.model);
     rs.telemetry.pricing = runner.deps.pricing?.[prepared.model.id] ?? modelCostToPricing(prepared.model.cost);

package/dist/core/runner/run-turn-boundary.js

@@ -283,7 +283,7 @@ export function createTurnBoundary(input) {
                     cadenceTurn: rs.counters.cadenceTurns,
                     todoMounted: todoToolMounted,
                     taskListMounted: taskToolsMounted,
-                    planActive: prepared.planModeRef.active,
+                    planActive: prepared.permissionMode.current === "plan",
                     config: {
                         todoReminder: rs.attach.attachmentsCfg?.todoReminder === true,
                         ...(rs.attach.attachmentsCfg?.todoReminderMode !== undefined ? { todoReminderMode: rs.attach.attachmentsCfg.todoReminderMode } : {}),

package/dist/core/runner/runtask.d.ts

@@ -22,6 +22,7 @@ export declare class Runner implements RunnerSelfSeat {
      *  authority: a durable resume's checkpoint seed wins on its leg, and a miss (cross-process,
      *  evicted) falls back to the transcript-replay rung. See {@link SessionReadFileStates}. */
     private readonly sessionReadStates;
+    private readonly sessionModeSeats;
     /** task notifications born BETWEEN turns (run torn down / harness already idle), parked
      *  per session and drained into the session's next run at its first boundary. Runner-lived (outlives any
      *  single run, like the registry handles that produce into it); bounded + drop-disclosing, see

package/dist/core/runner/runtask.js

@@ -16,9 +16,10 @@ import { TtlSessionStore } from "../session-store.js";
 import { errorCodeOf } from "./assemble-result.js";
 import { effectiveDelegationFacts, prepareTask } from "./prepare-task.js";
 import { SessionReadFileStates } from "./session-read-file-states.js";
+import { SessionModeSeats } from "./session-mode-seats.js";
 import { RunnerSharedToolResultStore } from "../tool-result-store.js";
 import { PAUSE_REGISTRY } from "../pause-registry.js";
-import { toolPolicyNameSets } from "../tool-policy.js";
+import { wrapToolPolicy } from "../tool-policy.js";
 import { PendingSessionNotifications } from "../task-notification.js";
 import { ToolDetachHub } from "../tool-detach.js";
 import { assertContextSettingsValue, assertContextSettingsWords, contextOverlayFor } from "../context-settings.js";
@@ -40,6 +41,7 @@ import { streamReap } from "./stream-reap.js";
 import { streamSteerVerb } from "./stream-steer-verb.js";
 import { streamLifecycleVerbs } from "./stream-lifecycle-verbs.js";
 import { streamHaltVerbs } from "./stream-halt-verbs.js";
+import { streamModeVerb } from "./stream-mode-verb.js";
 import { runNotificationLane } from "./run-notification-lane.js";
 import { assertNoRetiredRunnerDeps } from "./retired-runner-deps.js";
 import { runLeg } from "./run-leg.js";
@@ -64,6 +66,7 @@ export class Runner {
     sessions;
     sessionLocks = new Map();
     sessionReadStates = new SessionReadFileStates();
+    sessionModeSeats = new SessionModeSeats();
     pendingSessionNotifications = new PendingSessionNotifications();
     parentConstraintRegistry = new Map();
     suspendedEnvReaps = new Map();
@@ -173,15 +176,7 @@ export class Runner {
         return {
             ...(deps.toolPolicy !== undefined
                 ? {
-                    toolPolicy: (() => {
-                        const sets = toolPolicyNameSets(deps.toolPolicy);
-                        const wrapped = {
-                            check: (req, signal) => deps.toolPolicy.check(req, signal),
-                        };
-                        if (sets.length > 0)
-                            wrapped.nameSets = sets;
-                        return wrapped;
-                    })(),
+                    toolPolicy: wrapToolPolicy(deps.toolPolicy, (req, signal) => deps.toolPolicy.check(req, signal)),
                 }
                 : {}),
             ...(hooks !== undefined ? { hooks } : {}),
@@ -417,6 +412,7 @@ export class Runner {
         const { steer } = streamSteerVerb({ spec, internals, queue, acceptedSteerInputs, live, ready, orTimeout, readyTimeoutMs: READY_TIMEOUT_MS, steeringError, runner: this.depsSeat });
         const { notify, optOutMemoryCapture, reconnectMcpServer, compact, detach, interrupt } = streamLifecycleVerbs({ live, ready, orTimeout, steeringError, notifyRef, captureOptOutRef, mcpRedialRef, manualCompactRef, detachHub });
         const { halt, destroy } = streamHaltVerbs({ spec, live, ready, orTimeout, readyTimeoutMs: READY_TIMEOUT_MS, run, reapSuspended, runner: this.depsSeat });
+        const { setPermissionMode } = streamModeVerb({ live, ready, orTimeout, steeringError });
         return {
             [Symbol.asyncIterator]: () => queue[Symbol.asyncIterator](),
             result: async () => {
@@ -430,6 +426,7 @@ export class Runner {
             steer,
             notify,
             optOutMemoryCapture,
+            setPermissionMode,
             reconnectMcpServer,
             compact,
             detach,
@@ -442,7 +439,7 @@ export class Runner {
         const { spec, queue, setResult, onSuggestions, onReady, onSuspend, manualCompactRef, taskIdRef, resume, internals, notifyRef, captureOptOutRef, mcpRedialRef, entryActor, entryTracer } = input;
         return runNotificationLane({
             spec, queue, resume, internals, taskIdRef,
-            runner: this.depsSeat, self: this, sessions: this.sessions, sessionReadStates: this.sessionReadStates, pendingSessionNotifications: this.pendingSessionNotifications,
+            runner: this.depsSeat, self: this, sessions: this.sessions, sessionReadStates: this.sessionReadStates, sessionModeSeats: this.sessionModeSeats, pendingSessionNotifications: this.pendingSessionNotifications,
             prepareTask,
             next: ({ prepared, injectTaskNotification, deliveredAtTurnOpen, peerInboundChainRef, modelCatalog, notificationLane, unsubscribeTaskNotifications }) => {
                 const { runSourceTaskId, parentToolCallId, ident, emitDelegationLifecycle, loopLatch, stats, internalsNotifier, undrainedUserAtEnd, userInputLostAtEnd } = runIdentityWiring({

package/dist/core/runner/session-mode-seats.d.ts

@@ -0,0 +1,48 @@
+/**
+ * The Runner's per-session PERMISSION-MODE seats: the mode a session's CURRENT leg runs under, as the object a
+ * child's ceiling falls back to once the leg that spawned it has ended. A child's ceiling used to be the controller
+ * of the leg that spawned it for the child's whole life, so a session-scoped background child kept that leg's mode
+ * after the leg ended — the next leg of the same session, started in `plan`, did not reach it. The chain now carries
+ * a LEG ceiling: the spawning leg's live mode while that leg runs, and the session's seat after it. Each leg binds
+ * itself to its session's seat when its prepare commits, so the seat answers the most recently committed leg; a leg
+ * that is still running keeps answering its own children, whatever another leg of the session commits meanwhile.
+ */
+import type { PermissionMode } from "../ask-origin.js";
+import type { PermissionModeReceipt } from "../mode-policy.js";
+/** A child leg whose ceiling is a leg ceiling: its receipt is read before a ceiling move and re-judged after it. */
+export interface ModeCeilingHolder {
+    receipt(): PermissionModeReceipt;
+    /** The ceiling's source moved; `before` is this holder's receipt under the previous source. */
+    ceilingRebound(before: PermissionModeReceipt): void;
+}
+/** One leg's ceiling, as the chain carries it (`InheritedGate.permissionModeCeiling`). */
+export interface LegModeCeiling {
+    /** The spawning leg's live mode while it runs; the session's current leg's after it (`default` before any leg of
+     *  the session committed — no child can read it then). */
+    readonly current: PermissionMode;
+    readonly sessionId: string;
+    /** A child leg holds the ceiling until `signal` aborts (its own leg's end): each move of the ceiling re-judges it. */
+    hold(holder: ModeCeilingHolder, signal: AbortSignal): void;
+}
+/**
+ * The seats of one Runner, keyed by session id and held WEAKLY: a seat lives while a leg ceiling holds it, and the
+ * next leg of the session finds the same object as long as any child still reads it. In-process only — a session
+ * continued on another Runner instance or in another process binds that Runner's seat.
+ */
+export declare class SessionModeSeats {
+    private readonly seats;
+    private readonly reaper;
+    private seatOf;
+    /**
+     * A leg's ceiling over its session's seat, the leg's commit (once its prepare succeeded: the leg becomes the
+     * session's current leg) and its end (once the leg has STOPPED — its loop settled, not merely cancelled: a cancelled
+     * leg whose tool is still pending keeps answering its own children).
+     */
+    legCeiling(sessionId: string, leg: {
+        readonly current: PermissionMode;
+    }): {
+        ceiling: LegModeCeiling;
+        commit: () => void;
+        end: () => void;
+    };
+}

package/dist/core/runner/session-mode-seats.js

@@ -0,0 +1,73 @@
+class Seat {
+    sessionId;
+    leg;
+    holders = new Set();
+    constructor(sessionId) {
+        this.sessionId = sessionId;
+    }
+    get current() {
+        return this.leg?.current ?? "default";
+    }
+    addHolder(holder, via, signal) {
+        if (signal.aborted)
+            return;
+        const entry = { holder, via };
+        this.holders.add(entry);
+        signal.addEventListener("abort", () => this.holders.delete(entry), { once: true });
+    }
+    moveCeiling(affected, move) {
+        const before = [...this.holders].filter((e) => affected(e.via)).map((e) => [e.holder, e.holder.receipt()]);
+        move();
+        for (const [holder, receipt] of before)
+            holder.ceilingRebound(receipt);
+    }
+}
+class LegCeiling {
+    leg;
+    seat;
+    live = true;
+    constructor(leg, seat) {
+        this.leg = leg;
+        this.seat = seat;
+    }
+    get sessionId() {
+        return this.seat.sessionId;
+    }
+    get current() {
+        return this.live ? this.leg.current : this.seat.current;
+    }
+    hold(holder, signal) {
+        this.seat.addHolder(holder, this, signal);
+    }
+    commit() {
+        if (this.seat.leg === this.leg)
+            return;
+        this.seat.moveCeiling((via) => !via.live, () => (this.seat.leg = this.leg));
+    }
+    end() {
+        if (!this.live)
+            return;
+        this.seat.moveCeiling((via) => via === this, () => (this.live = false));
+    }
+}
+export class SessionModeSeats {
+    seats = new Map();
+    reaper = new FinalizationRegistry(({ sessionId, ref }) => {
+        if (this.seats.get(sessionId) === ref)
+            this.seats.delete(sessionId);
+    });
+    seatOf(sessionId) {
+        const live = this.seats.get(sessionId)?.deref();
+        if (live !== undefined)
+            return live;
+        const seat = new Seat(sessionId);
+        const ref = new WeakRef(seat);
+        this.seats.set(sessionId, ref);
+        this.reaper.register(seat, { sessionId, ref });
+        return seat;
+    }
+    legCeiling(sessionId, leg) {
+        const ceiling = new LegCeiling(leg, this.seatOf(sessionId));
+        return { ceiling, commit: () => ceiling.commit(), end: () => ceiling.end() };
+    }
+}

package/dist/core/runner/session-rule-policy.js

@@ -2,6 +2,7 @@ import { canonicalizeTarget, isWinFormPath, pathFamilyOf, writeTargetPath } from
 import { createCoarseCommandNamePolicy, namespacedCoveringEntries, namespacedCoveringHit } from "../tool-policy.js";
 import { continuesLineage } from "../session-policy-store.js";
 import { thrownText } from "../thrown-value.js";
+import { toolNameSetHas } from "../tool-roster.js";
 import { ruleDenialSentence } from "../rule-denial-sentence.js";
 import { DEFAULT_GATE_AWAIT_TIMEOUT_MS, gateWaitFailureOf, withGateTimeout } from "../gate-bounded-await.js";
 import { declaredPathTargetOf, isProtectedWrite, pathConfinableWriteToolNames, skillScopeWriteToolNames } from "../tool-registry.js";
@@ -136,9 +137,9 @@ export function createSessionRulePolicy(rules, opts) {
         async check(req, signal) {
             const { toolDeny, toolAllow, toolDenyCovering, toolAllowCovering, cmdPolicy, allowDirs } = compile(await readRules(req.toolCallId, signal));
             const toolName = req.toolName;
-            if (toolDeny.has(toolName) || namespacedCoveringHit(toolDenyCovering, toolName))
+            if (toolNameSetHas(toolDeny, req) || namespacedCoveringHit(toolDenyCovering, toolName))
                 return deny(req.toolName);
-            if (toolAllow && !toolAllow.has(toolName) && !namespacedCoveringHit(toolAllowCovering, toolName)) {
+            if (toolAllow && !toolNameSetHas(toolAllow, req) && !namespacedCoveringHit(toolAllowCovering, toolName)) {
                 return deny(req.toolName, "it is not in the session-rule allowlist");
             }
             if (cmdPolicy) {

package/dist/core/runner/stream-mode-verb.d.ts

@@ -0,0 +1,27 @@
+/**
+ * The TaskStream façade's PERMISSION-MODE verb: `setPermissionMode` — the one entrance a running leg's mode changes
+ * through (a shell's mode toggle, a serving layer's `permission_mode` control frame). ONE read of the argument at the
+ * wire boundary, the steer lane's liveness gate, then the leg's live mode seat: the requested word is rewritten, the
+ * fold against the deployment's deny bits and the classifier face is re-judged (a fold is announced by the seat), a
+ * leg that became `auto` arms its classifier, and the same three-member receipt the wiring manifest carries comes
+ * back — EVERY call answers one, whether or not the effective mode moved, so a caller never has to render
+ * optimistically. The next tool call reads the new mode at the gate's arbitration point; a child leg derives its own
+ * effective mode from this seat on its next read (no forwarding frame).
+ */
+import type { TaskStream } from "../types.js";
+import type { LiveHandle, TaskStreamLiveSeat } from "./contracts.js";
+export interface StreamModeVerbInput {
+    /** borrowed-readonly — the stream's live state: `resultValue` (the finished-task refusal) and `handle` (the mode seat rides it). */
+    live: TaskStreamLiveSeat;
+    /** borrowed-readonly — the readiness promise the verb awaits before it touches the handle. */
+    ready: Promise<LiveHandle | undefined>;
+    /** borrowed-readonly — the driver's timeout race: a wedged prepare cannot hang the verb on `ready`. */
+    orTimeout: <T>(p: Promise<T>) => Promise<T | undefined>;
+    /** borrowed-readonly — the driver's refusal factory, the steer verb's own `steeringError` seat. */
+    steeringError: (msg: string, code?: string) => Error;
+}
+export interface StreamModeVerbResult {
+    /** The stream's `setPermissionMode` verb. */
+    setPermissionMode: TaskStream["setPermissionMode"];
+}
+export declare function streamModeVerb(input: StreamModeVerbInput): StreamModeVerbResult;

package/dist/core/runner/stream-mode-verb.js

@@ -0,0 +1,19 @@
+import { isPermissionMode, PERMISSION_MODES } from "../ask-origin.js";
+export function streamModeVerb(input) {
+    const { live, ready, orTimeout, steeringError } = input;
+    const setPermissionMode = async (mode) => {
+        const modeIn = mode;
+        if (!isPermissionMode(modeIn)) {
+            const e = new Error(`cannot set the permission mode: it must be one of ${PERMISSION_MODES.join("/")} (got ${JSON.stringify(modeIn)})`);
+            e.code = "steering.invalid_content";
+            throw e;
+        }
+        if (live.resultValue)
+            throw steeringError("the task has already finished");
+        const h = live.handle ?? (await orTimeout(ready));
+        if (!h)
+            throw steeringError("the task is not running");
+        return h.permissionMode.steer(modeIn);
+    };
+    return { setPermissionMode };
+}

package/dist/core/runner/turn-attachments.d.ts

@@ -419,9 +419,9 @@ export interface AttachmentInputs {
     todoMounted: boolean;
     /** Whether the task-family tools are mounted. Both mounted ⇒ task_reminder wins (CC isTodoV2 branch). */
     taskListMounted: boolean;
-    /** Live plan-mode flag (planModeRef.active). One-way in sema: exit re-prepares the run, so a false
-     *  here simply stops the producer — no re-entry cycle reset is needed (documented deviation from CC's
-     *  countPlanModeAttachmentsSinceLastExit, which sema's lifecycle makes unreachable). */
+    /** Whether the leg's effective permission mode is `plan` right now (the one mode seat, whichever entrance set it:
+     *  the spec's word, a steer, the model's EnterPlanMode). A false here simply stops the producer — no re-entry cycle
+     *  reset (documented deviation from CC's countPlanModeAttachmentsSinceLastExit). */
     planActive: boolean;
     /** SR-3 budget_usd lane (CC 198 `QFm` producer :480424-480428 + renderer :600225; 220 `_Fy` @609096
      *  with the mount at @607474): the run's cost progress against its $ ceiling, in USD. Only passed

package/dist/core/runner/turn-attachments.js

@@ -761,7 +761,7 @@ function mcpDroppedToolsBound(inp) {
     const single = first === undefined ? 0 : MCP_DROPPED_FIXED_MAX_BYTES + bytes(first.tool) + bytes(first.server) + bytes(first.reason) + 32;
     return Math.max(MCP_DROPPED_BATCH_MAX_BYTES, single);
 }
-const PLAN_MODE_FULL_BODY = `Plan mode is active. The user indicated that they do not want you to execute yet -- you MUST NOT make any edits, run any non-readonly tools (including changing configs or making commits), or otherwise make any changes to the system. This supercedes any other instructions you have received. Instead, you should: research and analyze with read-only tools, and when you have formed a concrete plan, present it with the ${PRESENT_PLAN_TOOL_NAME} tool for approval. That tool inherently requests plan approval — never ask for approval via plain text.`;
+const PLAN_MODE_FULL_BODY = `Plan mode is active. The user indicated that they do not want you to execute yet -- you MUST NOT make any edits, run any non-readonly tools (including changing configs or making commits), or otherwise make any changes to the system — every such call asks the user first, and is refused where nobody can answer. This supercedes any other instructions you have received. Instead, you should: research and analyze with read-only tools, and when you have formed a concrete plan, present it with the ${PRESENT_PLAN_TOOL_NAME} tool for approval. That tool inherently requests plan approval — never ask for approval via plain text.`;
 const PLAN_MODE_SPARSE_BODY = `Plan mode still active (see full instructions earlier in conversation). Read-only: no edits, commits, or config changes. When your plan is ready, present it with the ${PRESENT_PLAN_TOOL_NAME} tool for approval. Never ask about plan approval via plain text.`;
 const TRUNCATION_MARKER = "\n…[truncated]";
 const MIN_KEEP_BYTES = 160;

package/dist/core/runner/write-protection-station.d.ts

@@ -24,6 +24,12 @@ import type { ExecutionEnv } from "../../internal/harness.js";
 import type { RunnerDeps } from "../runner-deps.js";
 import type { ToolRoster } from "../tool-roster.js";
 import { type WriteProtectionMount } from "../write-protect.js";
+import type { ShellReadBoundary } from "../../tools/fs/shell-read-judge.js";
+/** The leg's mount plus the same judge over a bare ABSOLUTE target — what the shell station asks about each write target
+ *  a command names (`ShellReadBoundary.writeProtectionJudge`): `true` ⇔ a row covers it. */
+export interface LegWriteProtection extends WriteProtectionMount {
+    readonly judgeTarget: NonNullable<ShellReadBoundary["writeProtectionJudge"]>;
+}
 export declare function mountWriteProtection(input: {
     /** borrowed-readonly — the deployment seats: the table (`writeProtectedPaths`; absent ⇒ the default
      *  table, `[]` ⇒ opted out), the data root the memory library is materialized under
@@ -38,4 +44,4 @@ export declare function mountWriteProtection(input: {
     roster: ToolRoster;
     sessionId: string;
     runId: string;
-}): WriteProtectionMount | undefined;
+}): LegWriteProtection | undefined;

package/dist/core/runner/write-protection-station.js

@@ -1,10 +1,10 @@
 import { deliverEngineNotice } from "../engine-notice.js";
 import { protectivePathTargetOf } from "../tool-registry.js";
-import { createWriteProtectionCheck } from "../write-protect.js";
+import { compileWriteProtection, writeProtectionMountOver } from "../write-protect.js";
 const ABSENCE_REASON = { symlink: "unresolved-symlink", target: "unresolvable-target" };
 export function mountWriteProtection(input) {
     const announced = new Set();
-    const mount = createWriteProtectionCheck(input.deps.writeProtectedPaths, {
+    const matcher = compileWriteProtection(input.deps.writeProtectedPaths, {
         ...(input.deps.memoryEngineDir !== undefined ? { dataRoot: input.deps.memoryEngineDir } : {}),
         ...(input.env !== undefined ? { env: input.env } : {}),
         rootPath: input.rootPath,
@@ -25,7 +25,10 @@ export function mountWriteProtection(input) {
             });
         },
     });
-    if (mount === undefined || mount.targetView !== "spelling-only")
+    if (matcher === undefined)
+        return undefined;
+    const mount = { ...writeProtectionMountOver(matcher, input.rootPath), judgeTarget: async (target, opts) => (await matcher.judge(target, { ...(opts?.signal !== undefined ? { signal: opts.signal } : {}), ...(opts?.canonical === true ? { canonical: true } : {}) })).kind === "hit" };
+    if (mount.targetView !== "spelling-only")
         return mount;
     const covered = input.roster.entries
         .filter((e) => [e.name, ...e.aliases].some((name) => {