@sema-agent/core 7.34.0 → 7.35.0

package/dist/core/runner/file-history-request.js

@@ -0,0 +1,90 @@
+export function resolveFileHistoryRequest(spec, deps) {
+    const onTrackFailure = deps.onTrackFailure === undefined ? "refuse" : deps.onTrackFailure;
+    if (onTrackFailure !== "refuse" && onTrackFailure !== "proceed-unprotected") {
+        const e = new Error(`RunnerDeps.onTrackFailure must be "refuse" or "proceed-unprotected"; got ${JSON.stringify(deps.onTrackFailure)} — refusing prepare rather than silently defaulting a first-touch-failure policy.`);
+        e.code = "config.invalid_on_track_failure";
+        throw e;
+    }
+    const wiredSeat = resolveWiredFileHistoryStore(deps.fileHistoryStore);
+    const runDeclaredOff = resolveRunFileHistoryWord(spec.fileHistory);
+    const captureOff = resolveFileHistoryCaptureWord(deps.fileHistoryCapture, wiredSeat);
+    const declaredOff = wiredSeat === "disabled" || runDeclaredOff;
+    const fileHistoryStore = declaredOff ? undefined : wiredSeat;
+    const captureStore = captureOff ? undefined : fileHistoryStore;
+    const legacyRewindFiles = spec.rewindFiles;
+    if (legacyRewindFiles === true) {
+        if (spec.resumeAt !== undefined) {
+            const e = new Error(`rewind-files: TaskSpec.rewindFiles is retired (design/381 — rewind now converges the per-edited-file history, not a whole-tree snapshot). This request pairs it with resumeAt, i.e. the RESTORE sense: set restoreFiles: true instead. (The capture sense needs no request anymore — first-touch tracking is on whenever a RunnerDeps.fileHistoryStore is wired and neither RunnerDeps.fileHistoryCapture nor TaskSpec.fileHistory turns it off.)`);
+            e.code = "rewind.rewind_files_retired";
+            throw e;
+        }
+    }
+    if (spec.restoreFiles === true && spec.resumeAt === undefined) {
+        const e = new Error(`rewind-files: restoreFiles: true needs a resumeAt anchor — restoring files means converging them to a specific prior entry's boundary, and this spec names none. Use resumeAt + restoreFiles to move conversation and files together, or rewindFilesTo alone for a code-only restore.`);
+        e.code = "rewind.invalid_spec";
+        throw e;
+    }
+    if (spec.resumeAt !== undefined && spec.rewindFilesTo !== undefined) {
+        const e = new Error(`rewind-files: resumeAt ("${spec.resumeAt}") and rewindFilesTo ("${spec.rewindFilesTo}") were both set — resumeAt already anchors the file restore when restoreFiles is true, so a separate rewindFilesTo target is a conflicting request. Drop one of the two.`);
+        e.code = "rewind.conflicting_targets";
+        throw e;
+    }
+    const rewindTarget = spec.resumeAt !== undefined ? (spec.restoreFiles === true ? spec.resumeAt : undefined) : spec.rewindFilesTo;
+    const rewindBefore = rewindTarget !== undefined && spec.resumeAt !== undefined && spec.resumeAtMode === "before";
+    if (rewindTarget !== undefined && fileHistoryStore === undefined) {
+        if (runDeclaredOff)
+            throw captureDisabledRefusal(rewindTarget);
+        const e = new Error(wiredSeat === "disabled"
+            ? `rewind-files: restoring files to entry "${rewindTarget}" requires a history backend, but this deployment declared file history disabled (RunnerDeps.fileHistoryStore: "disabled"), so there is no history to restore — the files were NOT rewound`
+            : `rewind-files: restoring files to entry "${rewindTarget}" requires a history backend, but this deployment wired no RunnerDeps.fileHistoryStore — no file history was ever recorded, so the files were NOT rewound`);
+        e.code = "rewind.store_unconfigured";
+        throw e;
+    }
+    return { onTrackFailure, wiredSeat, runDeclaredOff, captureOff, declaredOff, fileHistoryStore, captureStore, rewindTarget, rewindBefore };
+}
+function resolveWiredFileHistoryStore(candidate) {
+    if (candidate === undefined || candidate === "disabled")
+        return candidate;
+    const verbs = ["trackEdit", "annulTrack", "snapshot", "restore", "canRestore", "reap", "adoptScope"];
+    const verbOf = (v) => {
+        try {
+            return candidate[v];
+        }
+        catch {
+            return undefined;
+        }
+    };
+    const probeable = (typeof candidate === "object" && candidate !== null) || typeof candidate === "function";
+    const missing = probeable ? verbs.filter((v) => typeof verbOf(v) !== "function") : [...verbs];
+    if (missing.length > 0) {
+        const shape = candidate === null ? "null" : probeable ? "a value that is not a FileHistoryStore" : `a ${typeof candidate}`;
+        const e = new Error(`RunnerDeps.fileHistoryStore was wired with ${shape} — missing contract verbs: ${missing.join(", ")}. Refusing prepare rather than half-wiring the rewind seat (a present-but-unusable store makes every Edit/Write/NotebookEdit fail its first-touch backup while restore requests report "no store wired"). Write "disabled" (or omit the key) to run without file history.`);
+        e.code = "config.invalid_file_history_store";
+        throw e;
+    }
+    return candidate;
+}
+function resolveRunFileHistoryWord(word) {
+    if (word === undefined || word === "disabled")
+        return word === "disabled";
+    const e = new Error(`rewind-files: TaskSpec.fileHistory holds ${shownWord(word)} — the only value is "disabled"; omit the key to leave the deployment's setting in force`);
+    e.code = "rewind.invalid_spec";
+    throw e;
+}
+function resolveFileHistoryCaptureWord(word, wiredSeat) {
+    if (word === undefined || (word === "off" && wiredSeat !== undefined && wiredSeat !== "disabled"))
+        return word === "off";
+    const e = new Error(word === "off"
+        ? `RunnerDeps.fileHistoryCapture: "off" requires a wired RunnerDeps.fileHistoryStore — nothing to switch off; to drop history entirely write fileHistoryStore: "disabled"`
+        : `RunnerDeps.fileHistoryCapture holds ${shownWord(word)} — the only value is "off"; omit the key to record whenever a fileHistoryStore is wired`);
+    e.code = "config.invalid_file_history_capture";
+    throw e;
+}
+function shownWord(word) {
+    return typeof word === "string" ? JSON.stringify(word.slice(0, 40)) : word === null || typeof word === "boolean" || typeof word === "number" ? String(word) : `a ${typeof word}`;
+}
+function captureDisabledRefusal(target) {
+    const e = new Error(`rewind-files: this run set TaskSpec.fileHistory: "disabled", so it neither records nor restores file history — restoring files to entry "${target}" was refused and the files were NOT rewound`);
+    e.code = "rewind.capture_disabled";
+    return e;
+}

package/dist/core/runner/permission-rule-lanes.d.ts

@@ -29,6 +29,7 @@ import type { AskRuleEvidence, ToolCallRequest } from "../tool-policy.js";
 import { persistedRuleMandateOf, type RuleClearanceFacts } from "../ask-origin.js";
 import { type OrgGateVerdict, type PersistedRuleAnswer, type PersistedRuleHit, type PersistedRuleUnreadable } from "../hooks.js";
 import type { PersistedRule, PersistedRuleVerdict, RuleOffer, SegmentCoverage } from "../permission-rule-model.js";
+import { type ToolCallLike } from "../tool-registry.js";
 import { type OrgRuleResolution } from "../permission-rule-org.js";
 import { type EffectivePermissionRules, type PermissionRuleStoreProvider } from "../permission-rule-provider.js";
 /** The one SHELL tool the persisted-rule lane's COMMAND grammar speaks for (the rule-offer face mints for
@@ -246,7 +247,7 @@ export declare function createRuleOffersOf(cfg: {
         current: string;
     } | undefined;
     deniesDirectoryRead: ((directory: string) => boolean) | undefined;
-}): (toolName: string, args: unknown, ask: RuleOffersAskFacts | undefined) => {
+}): (call: Pick<ToolCallLike, "toolName" | "face">, args: unknown, ask: RuleOffersAskFacts | undefined) => {
     ruleOffers?: readonly RuleOffer[];
     ruleOffersAbsence?: RuleOffersAbsence;
     execCwd?: string;

package/dist/core/runner/permission-rule-lanes.js

@@ -1,12 +1,13 @@
 import { persistedRuleMandateOf, ruleClearanceOf } from "../ask-origin.js";
 import {} from "../hooks.js";
-import { adjudicatePersistedPathRules, adjudicatePersistedRules, ruleToolGrammarOf, segmentCoverageOf, suggestRulesForCommand } from "../permission-rule-model.js";
+import { adjudicatePersistedPathRules, adjudicatePersistedRules, laneToolNamesOf, ruleToolGrammarOf, segmentCoverageOf, suggestRulesForCommand } from "../permission-rule-model.js";
 import { isAbsolutePathForm } from "../../tools/fs/safety.js";
 import { effectivePathTargetOf } from "../effective-path-target.js";
-import { declaredPathTargetOf, protectivePathTargetOf } from "../tool-registry.js";
+import { anyNamed, declaredPathTargetOf, firstNamed, protectivePathTargetOf, ruleNamesOf } from "../tool-registry.js";
 import { orgRuleVerdictFor } from "../permission-rule-org.js";
 import { ownerStoreOf } from "../permission-rule-provider.js";
 import { thrownText } from "../thrown-value.js";
+import { strongestAnswer } from "../persisted-rule-arms.js";
 import { gateWaitFailureOf, withGateTimeout } from "../gate-bounded-await.js";
 import { ORG_ADJUDICATION_TIMEOUT_MS } from "../permission-rule-org.js";
 export const PERSISTED_RULE_TOOL = "Bash";
@@ -105,9 +106,9 @@ export function createPermissionRuleLanes(cfg) {
                 }
                 const revisionCell = orgRevisionEvidenceOf(resolution, cfg.onRevisionDefect);
                 const command = req.args?.command;
-                if (req.toolName !== PERSISTED_RULE_TOOL || typeof command !== "string")
+                if (!laneToolNamesOf(req).includes(PERSISTED_RULE_TOOL) || typeof command !== "string")
                     return { status: "available", ...revisionCell };
-                const verdict = orgRuleVerdictFor(resolution.rules, { tool: req.toolName, command });
+                const verdict = orgRuleVerdictFor(resolution.rules, { tool: PERSISTED_RULE_TOOL, command });
                 return verdict === undefined ? { status: "available", ...revisionCell } : { status: "available", verdict, ...revisionCell };
             },
         }
@@ -115,8 +116,8 @@ export function createPermissionRuleLanes(cfg) {
     const personalAdjudicate = async (req) => {
         if (anonymous && !cfg.localOwnerDeclared)
             return undefined;
-        const grammar = ruleToolGrammarOf(req.toolName);
-        if (grammar === undefined)
+        const laneNames = laneToolNamesOf(req);
+        if (laneNames.length === 0)
             return undefined;
         let view;
         try {
@@ -128,7 +129,7 @@ export function createPermissionRuleLanes(cfg) {
         if (view.unreadable !== undefined)
             skipped(view.unreadable, view.unreadableSources);
         try {
-            const answer = judgeAgainst(view.rules, req, grammar);
+            const answer = strongestAnswer(laneNames.map((n) => judgeAgainst(view.rules, { ...req, toolName: n }, ruleToolGrammarOf(n))));
             return view.unreadable !== undefined && (answer === undefined || "segmentCoverage" in answer) ? { unreadable: true } : answer;
         }
         catch (err) {
@@ -156,15 +157,17 @@ export function createPermissionRuleLanes(cfg) {
     return { personal, org };
 }
 export function createRuleOffersOf(cfg) {
-    return (toolName, args, ask) => {
+    return (call, args, ask) => {
+        const toolName = call.toolName;
         if (!cfg.laneArmed || toolName !== PERSISTED_RULE_TOOL)
             return {};
         if ((cfg.principal === undefined || cfg.principal === "") && !cfg.localOwnerDeclared)
             return {};
+        const tierSeat = firstNamed(cfg.irreversibilityTier, ruleNamesOf(call));
         const closedDoor = ruleClearanceOf(ask, {
-            egress: cfg.egressTools.has(toolName),
-            irreversibility: cfg.irreversibilityTier.get(toolName),
-            shellGated: cfg.shellGatedTools.has(toolName),
+            egress: anyNamed(cfg.egressTools, ruleNamesOf(call)),
+            irreversibility: tierSeat?.value,
+            shellGated: tierSeat !== undefined && cfg.shellGatedTools.has(tierSeat.name),
         }).word;
         if (closedDoor !== undefined)
             return { ruleOffersAbsence: closedDoor };

package/dist/core/runner/prepare-ask-lane.d.ts

@@ -77,7 +77,7 @@ export interface PrepareAskLaneInput {
         isDelegatedChild?: true;
     };
     /** borrowed-readonly — the policy-chain phase's per-tool risk-axes projection (`riskAxes` on the ask). */
-    riskAxesOf: (toolName: string) => {
+    riskAxesOf: (call: Pick<ToolCallRequest, "toolName" | "face">) => {
         riskAxes?: {
             irreversible?: boolean;
             egress?: boolean;

package/dist/core/runner/prepare-ask-lane.js

@@ -96,10 +96,10 @@ export function prepareAskLane(input) {
                 const p = approvalPreviewOf(req.toolName, req.args);
                 return { ...(p.preview !== undefined ? { preview: p.preview } : {}), ...(p.withheld !== undefined ? { previewWithheld: p.withheld } : {}) };
             })(),
-            ...ruleOffersOf(req.toolName, req.args, decision.action === "ask" ? decision : undefined),
+            ...ruleOffersOf(req, req.args, decision.action === "ask" ? decision : undefined),
             message: decision.message ?? `approval required for "${req.toolName}"`,
             ...askSourceIdentity(),
-            ...riskAxesOf(req.toolName),
+            ...riskAxesOf(req),
             ...(decision.action === "ask" && decision.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
             ...(decision.action === "ask" ? askMandateMember(decision) : {}),
             ...(decision.action === "ask" && decision.persistedRuleShadowed !== undefined ? { persistedRuleShadowed: decision.persistedRuleShadowed } : {}),

package/dist/core/runner/prepare-file-history.d.ts

@@ -12,7 +12,9 @@
  * before the move (a minted ownedEnv is destroyed there, the session view forgotten). The phase acquires
  * no resource of its own — the two seats it returns are closures over the store the deployment owns.
  *
- * The module-level helpers below the phase (`restoredAbsPathsOf`, `resolveWiredFileHistoryStore`,
+ * The request door (the bad-value doors and every refusal the request decides alone) lives in
+ * `./file-history-request.ts` and runs BEFORE the session is acquired; this phase receives its resolution.
+ * The module-level helpers below the phase (`restoredAbsPathsOf`,
  * the refusal's epoch-tail wording helper, `adoptForkedFileHistory` with its per-store carry memo,
  * `createFileHistoryBoundarySeat`, `resolveFileHistoryCoordinates` / `resolveFileHistoryScope` /
  * `fileHistoryFilesystemIdentity`, `childScopeRewindRefusal`) moved with it unchanged; the two the test
@@ -22,13 +24,17 @@ import type { ExecutionEnv } from "../../internal/harness.js";
 import type { StoredSession } from "../../engine/session/session.js";
 import type { RunnerDeps, TaskResult, TaskSpec, TrackFileEditHook } from "../types.js";
 import type { FileHistoryBoundarySeat, RunInternals } from "./contracts.js";
+import type { FileHistoryRequest } from "./file-history-request.js";
 export interface PrepareFileHistoryInput {
     /** borrowed-readonly — the deployment seats this phase reads: the first-touch failure policy, the history
      *  store and its capture switch (all validated HERE, once), the incident sink, and the retired-epoch diagnostic probe. */
-    deps: Pick<RunnerDeps, "onTrackFailure" | "fileHistoryStore" | "fileHistoryCapture" | "onError">;
+    deps: Pick<RunnerDeps, "onError">;
     /** borrowed-readonly — the REBOUND spec's rewind request fields and off-switch word (the retired `rewindFiles`
      *  spelling is read off the same object as an unknown key) and the caller's cancel signal for the restore. */
-    spec: Pick<TaskSpec, "resumeAt" | "resumeAtMode" | "restoreFiles" | "rewindFilesTo" | "acceptPartialRestore" | "signal" | "fileHistory">;
+    spec: Pick<TaskSpec, "resumeAt" | "restoreFiles" | "acceptPartialRestore" | "signal">;
+    /** borrowed-readonly — the request door's resolution ({@link resolveFileHistoryRequest}), judged before the session was
+     *  acquired: every refusal the request and the deployment's seats decide on their own has already thrown. */
+    request: FileHistoryRequest;
     /** borrowed-readonly — the trusted lineage a delegating parent handed this run (absent for a root run
      *  and for a host's own fork), read for the recording-scope decision only. */
     internals: Pick<RunInternals, "fileHistoryLineage"> | undefined;

package/dist/core/runner/prepare-file-history.js

@@ -2,45 +2,16 @@ import { NodeExecutionEnv } from "../../engine/execution-env/node-execution-env.
 import { isRemoteExecutionEnv } from "../remote-env.js";
 import { resolveTrackKey } from "../file-history-store.js";
 export async function prepareFileHistory(input) {
-    const { deps, spec, internals, executionEnv, taskRootFinal, handsEnabled, sessionId, session, abortController } = input;
+    const { deps, spec, request, internals, executionEnv, taskRootFinal, handsEnabled, sessionId, session, abortController } = input;
     const rewindNotes = [];
-    const onTrackFailure = deps.onTrackFailure === undefined ? "refuse" : deps.onTrackFailure;
-    if (onTrackFailure !== "refuse" && onTrackFailure !== "proceed-unprotected") {
-        const e = new Error(`RunnerDeps.onTrackFailure must be "refuse" or "proceed-unprotected"; got ${JSON.stringify(deps.onTrackFailure)} — refusing prepare rather than silently defaulting a first-touch-failure policy.`);
-        e.code = "config.invalid_on_track_failure";
-        throw e;
-    }
-    const wiredSeat = resolveWiredFileHistoryStore(deps.fileHistoryStore);
-    const runDeclaredOff = resolveRunFileHistoryWord(spec.fileHistory);
-    const captureOff = resolveFileHistoryCaptureWord(deps.fileHistoryCapture, wiredSeat);
-    const declaredOff = wiredSeat === "disabled" || runDeclaredOff;
-    const fileHistoryStore = declaredOff ? undefined : wiredSeat;
-    const captureStore = captureOff ? undefined : fileHistoryStore;
-    const legacyRewindFiles = spec.rewindFiles;
-    if (legacyRewindFiles === true) {
-        if (spec.resumeAt !== undefined) {
-            const e = new Error(`rewind-files: TaskSpec.rewindFiles is retired (design/381 — rewind now converges the per-edited-file history, not a whole-tree snapshot). This request pairs it with resumeAt, i.e. the RESTORE sense: set restoreFiles: true instead. (The capture sense needs no request anymore — first-touch tracking is on whenever a RunnerDeps.fileHistoryStore is wired and neither RunnerDeps.fileHistoryCapture nor TaskSpec.fileHistory turns it off.)`);
-            e.code = "rewind.rewind_files_retired";
-            throw e;
-        }
+    const { onTrackFailure, captureOff, declaredOff, fileHistoryStore, captureStore, rewindTarget, rewindBefore } = request;
+    if (spec.rewindFiles === true) {
         try {
             deps.onError?.(new Error(`TaskSpec.rewindFiles (capture sense) is retired and was ignored: per-edited-file first-touch tracking is on whenever RunnerDeps.fileHistoryStore is wired and neither RunnerDeps.fileHistoryCapture nor TaskSpec.fileHistory turns it off, so a per-turn capture request has nothing left to ask for. Drop the field; the restore sense moved to TaskSpec.restoreFiles.`), { phase: "config", sessionId });
         }
         catch {
         }
     }
-    if (spec.restoreFiles === true && spec.resumeAt === undefined) {
-        const e = new Error(`rewind-files: restoreFiles: true needs a resumeAt anchor — restoring files means converging them to a specific prior entry's boundary, and this spec names none. Use resumeAt + restoreFiles to move conversation and files together, or rewindFilesTo alone for a code-only restore.`);
-        e.code = "rewind.invalid_spec";
-        throw e;
-    }
-    if (spec.resumeAt !== undefined && spec.rewindFilesTo !== undefined) {
-        const e = new Error(`rewind-files: resumeAt ("${spec.resumeAt}") and rewindFilesTo ("${spec.rewindFilesTo}") were both set — resumeAt already anchors the file restore when restoreFiles is true, so a separate rewindFilesTo target is a conflicting request. Drop one of the two.`);
-        e.code = "rewind.conflicting_targets";
-        throw e;
-    }
-    const rewindTarget = spec.resumeAt !== undefined ? (spec.restoreFiles === true ? spec.resumeAt : undefined) : spec.rewindFilesTo;
-    const rewindBefore = rewindTarget !== undefined && spec.resumeAt !== undefined && spec.resumeAtMode === "before";
     if (spec.resumeAt !== undefined && spec.restoreFiles !== true) {
         rewindNotes.push({
             code: "conversation_only",
@@ -64,18 +35,7 @@ export async function prepareFileHistory(input) {
         await adoptForkedFileHistory(captureStore, session, sessionId, deps.onError);
     if (rewindTarget !== undefined && historyScope !== sessionId)
         throw childScopeRewindRefusal(historyScope, rewindTarget);
-    if (fileHistoryStore === undefined) {
-        if (rewindTarget !== undefined && runDeclaredOff)
-            throw captureDisabledRefusal(rewindTarget);
-        if (rewindTarget !== undefined) {
-            const e = new Error(wiredSeat === "disabled"
-                ? `rewind-files: restoring files to entry "${rewindTarget}" requires a history backend, but this deployment declared file history disabled (RunnerDeps.fileHistoryStore: "disabled"), so there is no history to restore — the files were NOT rewound`
-                : `rewind-files: restoring files to entry "${rewindTarget}" requires a history backend, but this deployment wired no RunnerDeps.fileHistoryStore — no file history was ever recorded, so the files were NOT rewound`);
-            e.code = "rewind.store_unconfigured";
-            throw e;
-        }
-    }
-    else if (!handsEnabled) {
+    if (fileHistoryStore !== undefined && !handsEnabled) {
         if (rewindTarget !== undefined) {
             rewindNotes.push({
                 code: "files_env_unsupported",
@@ -168,52 +128,6 @@ function restoredAbsPathsOf(restored, root) {
     }
     return out;
 }
-function resolveWiredFileHistoryStore(candidate) {
-    if (candidate === undefined || candidate === "disabled")
-        return candidate;
-    const verbs = ["trackEdit", "annulTrack", "snapshot", "restore", "canRestore", "reap", "adoptScope"];
-    const verbOf = (v) => {
-        try {
-            return candidate[v];
-        }
-        catch {
-            return undefined;
-        }
-    };
-    const probeable = (typeof candidate === "object" && candidate !== null) || typeof candidate === "function";
-    const missing = probeable ? verbs.filter((v) => typeof verbOf(v) !== "function") : [...verbs];
-    if (missing.length > 0) {
-        const shape = candidate === null ? "null" : probeable ? "a value that is not a FileHistoryStore" : `a ${typeof candidate}`;
-        const e = new Error(`RunnerDeps.fileHistoryStore was wired with ${shape} — missing contract verbs: ${missing.join(", ")}. Refusing prepare rather than half-wiring the rewind seat (a present-but-unusable store makes every Edit/Write/NotebookEdit fail its first-touch backup while restore requests report "no store wired"). Write "disabled" (or omit the key) to run without file history.`);
-        e.code = "config.invalid_file_history_store";
-        throw e;
-    }
-    return candidate;
-}
-function resolveRunFileHistoryWord(word) {
-    if (word === undefined || word === "disabled")
-        return word === "disabled";
-    const e = new Error(`rewind-files: TaskSpec.fileHistory holds ${shownWord(word)} — the only value is "disabled"; omit the key to leave the deployment's setting in force`);
-    e.code = "rewind.invalid_spec";
-    throw e;
-}
-function resolveFileHistoryCaptureWord(word, wiredSeat) {
-    if (word === undefined || (word === "off" && wiredSeat !== undefined && wiredSeat !== "disabled"))
-        return word === "off";
-    const e = new Error(word === "off"
-        ? `RunnerDeps.fileHistoryCapture: "off" requires a wired RunnerDeps.fileHistoryStore — nothing to switch off; to drop history entirely write fileHistoryStore: "disabled"`
-        : `RunnerDeps.fileHistoryCapture holds ${shownWord(word)} — the only value is "off"; omit the key to record whenever a fileHistoryStore is wired`);
-    e.code = "config.invalid_file_history_capture";
-    throw e;
-}
-function shownWord(word) {
-    return typeof word === "string" ? JSON.stringify(word.slice(0, 40)) : word === null || typeof word === "boolean" || typeof word === "number" ? String(word) : `a ${typeof word}`;
-}
-function captureDisabledRefusal(target) {
-    const e = new Error(`rewind-files: this run set TaskSpec.fileHistory: "disabled", so it neither records nor restores file history — restoring files to entry "${target}" was refused and the files were NOT rewound`);
-    e.code = "rewind.capture_disabled";
-    return e;
-}
 function rewindRefusalTail() {
     return `Boundaries are keyed by a turn's INITIAL entry and exist only for turns that recorded history (a RunnerDeps.fileHistoryStore wired, capture on, and the run's file history not disabled); a boundary from the retired whole-tree snapshot era is not restorable by this seat, and reaped boundaries have none.`;
 }

package/dist/core/runner/prepare-gate-stations.d.ts

@@ -39,6 +39,7 @@ import type { CwdRef } from "../../tools/fs/fs-shared.js";
 import type { AskLane, IrreversibilityTier, ParkAsk, Prepared, ReversibilityProbes, StopForDenialLimit } from "./contracts.js";
 import type { PermissionRuleLanes } from "./permission-rule-lanes.js";
 import { type ToolRosterDeltaSeat } from "../tool-roster.js";
+import type { ToolCallLike } from "../tool-registry.js";
 import { type FrameSettlement } from "../frame-settlement.js";
 /**
  * The parent-thread human-rejection boundary — judged ONCE here, from the pass's own record (CC parity:
@@ -174,7 +175,7 @@ export interface PrepareGateStationsInput {
         readonly signal: AbortSignal;
     };
     /** borrowed-readonly — the shell-seat provenance set: the shell-running tools whose tier is the engine's shell seat's, not a
-     *  deployment mark (the gate's `shellGated` attribution is the gated tool's membership). */
+     *  deployment mark (the gate's `shellGated` attribution is the membership of the name the call's tier was read under). */
     shellGatedTools: ReadonlySet<string>;
     /** borrowed-readonly — the armed classifier's live seat (read per call: a leg steered into `auto` arms after prepare). */
     autoModeDecider: {
@@ -211,8 +212,8 @@ export interface PrepareGateStationsInput {
     questionToolMounted: boolean;
     /** borrowed-readonly — whether sandbox admission is armed (isolated env + park prerequisites). */
     sandboxAdmissionArmed: boolean;
-    /** borrowed-readonly — the per-tool boundary-capability fact the sandbox admission reads. */
-    sandboxBoundaryCapable: (toolName: string) => boolean;
+    /** borrowed-readonly — the per-call boundary-capability fact the sandbox admission reads (the call's wire name and names). */
+    sandboxBoundaryCapable: (call: Pick<ToolCallLike, "toolName" | "face">) => boolean;
     /** borrowed-readonly — the sandbox-admission trace sink (the deferred ancestor disclosure and the gate's own). */
     emitSandboxAdmitted: (info: {
         toolCallId: string;

package/dist/core/runner/prepare-gate-stations.js

@@ -9,7 +9,7 @@ import { askUnresolvableNotice } from "../ask-unresolvable-notice.js";
 import { askReachesPerson } from "../wiring-manifest.js";
 import { classifierUnavailableSeat } from "./classifier-ladder.js";
 import { PATH_CONFINABLE_WRITE_TOOLS } from "./session-rule-policy.js";
-import { toolCallFaceOf } from "../tool-roster.js";
+import { anyNamed, callAnswersTo, callFaceSeat, firstNamed, rosterToolName, ruleNamesOf, toolCallFaceOf } from "../tool-roster.js";
 import { noteHostRewrite } from "../frame-settlement.js";
 function screenGateResult(result) {
     if (result.suspend !== undefined)
@@ -85,11 +85,15 @@ export function prepareGateStations(input) {
                 writeProtectionArmed ||
                 shellReadCheck !== undefined;
         if (toolCallGateArmedRef.armed) {
-            harness.on("tool_call", async (e) => {
+            harness.on("tool_call", async (called) => {
+                const e = { ...called, toolName: rosterToolName(toolRosterDeltas.current, called.toolName) };
+                const call = { toolName: e.toolName, ...callFaceSeat(toolCallFaceOf(toolRosterDeltas.current, called.toolName)) };
+                const names = ruleNamesOf(call);
+                const tierSeat = firstNamed(irreversibilityTier, names);
                 blockedToolCalls.delete(e.toolCallId);
                 inheritedAskGrants.delete(e.toolCallId);
                 {
-                    const complianceDeny = complianceCallDenial(complianceDenies, e.toolName);
+                    const complianceDeny = names.map((n) => complianceCallDenial(complianceDenies, n)).find((d) => d !== undefined);
                     if (complianceDeny !== undefined) {
                         if (blockedTracked)
                             blockedToolCalls.add(e.toolCallId);
@@ -113,24 +117,24 @@ export function prepareGateStations(input) {
                         hookTimeoutMs,
                         ...(handsCwdRef !== undefined ? { trackedCwd: () => handsCwdRef.current } : {}),
                         ...(hookEnvFace !== undefined ? { hookEnv: hookEnvFace } : {}),
-                        toolFaceOf: (name) => toolCallFaceOf(toolRosterDeltas.current, name),
+                        toolFaceOf: (name) => toolCallFaceOf(toolRosterDeltas.current, name === e.toolName ? called.toolName : name),
                         adjudicate,
                         resolveAsk: resolveAskBound,
                         suspendAsk,
                         resolveContentAsk,
-                        egress: egressTools.has(e.toolName),
-                        peerMessage: e.toolName === SEND_MESSAGE_TOOL_NAME,
+                        egress: anyNamed(egressTools, names),
+                        peerMessage: callAnswersTo(call, SEND_MESSAGE_TOOL_NAME),
                         ...(writeProtectionCheck !== undefined ? { writeProtectionCheck } : {}),
                         ...(shellReadCheck !== undefined ? { shellReadCheck } : {}),
-                        irreversibility: irreversibilityTier.get(e.toolName),
-                        reversibilityProbe: reversibilityProbes.get(e.toolName),
+                        irreversibility: tierSeat?.value,
+                        reversibilityProbe: tierSeat !== undefined ? reversibilityProbes.get(tierSeat.name) : undefined,
                         abortSignal: abortController.signal,
                         ...(notifyPermissionDenied ? { permissionDenied: notifyPermissionDenied } : {}),
                         onHookError: notifyHookError,
-                        shellGated: shellGatedTools.has(e.toolName),
+                        shellGated: tierSeat !== undefined && shellGatedTools.has(tierSeat.name),
                         ...(autoModeDecider.current !== undefined ? { autoMode: { decider: autoModeDecider.current, ...(autoModeDenialTracking.current !== undefined ? { denialTracking: autoModeDenialTracking.current } : {}), unavailable: classifierUnavailableSeat({ station: "leg", ...(autoModeDecider.current.timeoutMs !== undefined ? { budgetMs: autoModeDecider.current.timeoutMs } : {}), approvalSeat: askReachesPerson(askRoute), onNotice: deps.onNotice, sessionId, runId }) } } : {}),
                         permissionMode: () => permissionMode.current,
-                        ...(() => { const s = toolMarkSources.get(e.toolName); return s !== undefined ? { toolMarkSources: s } : {}; })(),
+                        ...(() => { const s = firstNamed(toolMarkSources, names)?.value; return s !== undefined ? { toolMarkSources: s } : {}; })(),
                         ...(a2aIsolatePeers === true ? { a2aIsolatePeers: true } : {}),
                         onModeReleased,
                         ancestorArbitrationOf: (toolCallId) => ancestorArbitrations.get(toolCallId),
@@ -183,7 +187,7 @@ export function prepareGateStations(input) {
                             ? {
                                 sandboxAdmission: {
                                     askClassesOf: (toolCallId) => foldAskClasses.get(toolCallId),
-                                    boundaryCapable: sandboxBoundaryCapable(e.toolName),
+                                    boundaryCapable: sandboxBoundaryCapable(call),
                                     onAdmitted: emitSandboxAdmitted,
                                 },
                             }

package/dist/core/runner/prepare-inherited-gate.d.ts

@@ -66,7 +66,7 @@ export interface PrepareInheritedGateInput {
     /** borrowed-readonly — the trusted spawn-side channel: `inheritedGate` (the LIVE half of the chain fold), `ownOrgAdmissionRef`
      *  (the same-session continuation's freeze), `delegationProvenance` (the F-012 stamp), and the identity / peer / notification
      *  seats the ctx enrichment forwards. Never mutated. */
-    internals: Pick<RunInternals, "inheritedGate" | "ownOrgAdmissionRef" | "delegationProvenance" | "memoryCaptureAncestors" | "parentTaskId" | "parentSessionId" | "rootSessionId" | "placementRoot" | "explicitAgentName" | "peerSelfRef" | "peerInboundChainRef" | "onTaskNotification" | "onSubagentSpawn" | "insideFork" | "questionFaceStripped"> | undefined;
+    internals: Pick<RunInternals, "inheritedGate" | "sessionModeSeats" | "ownOrgAdmissionRef" | "delegationProvenance" | "memoryCaptureAncestors" | "parentTaskId" | "parentSessionId" | "rootSessionId" | "placementRoot" | "explicitAgentName" | "peerSelfRef" | "peerInboundChainRef" | "onTaskNotification" | "onSubagentSpawn" | "insideFork" | "questionFaceStripped"> | undefined;
     /** borrowed-readonly — the resume leg, or undefined on a fresh one: `seed.inheritedGate` is the CHECKPOINT half of the chain
      *  fold (the trust floor the live half may only tighten), `seed.readFace` the hands-less re-park's carried section. */
     resume: Pick<PrepareResume, "seed" | "outcome"> | undefined;
@@ -197,6 +197,13 @@ export interface PrepareInheritedGateResult {
      *  seat, or the checkpoint's recorded word), folded against the arming facts the caps phase binds later. Every mode
      *  consumer reads `current` at its own call; the steer verb writes it. */
     permissionMode: PermissionModeController;
+    /** owned — the leg's commit of its mode seats, called by the driver once prepare succeeded (never on a failed one):
+     *  makes this leg its SESSION's current leg and holds the leg's own engine ceiling until `legSignal` aborts, so each
+     *  move of that ceiling re-judges this leg. */
+    commitModeSeats: (legSignal: AbortSignal) => void;
+    /** owned — the leg has STOPPED (the run leg's teardown, after its loop settled): from here its children read the
+     *  session's current leg. Idempotent; a leg that never reaches it keeps answering its children itself. */
+    endModeCeiling: () => void;
     /** owned — the seed ∩ live admitted org scopes (one side absent ⇒ the other; both absent ⇒ undefined). */
     inheritedAdmittedOrgScopes: readonly string[] | undefined;
     /** owned — the prior own org verdict: checkpoint ∩ same-session ref (either alone stands; neither ⇒ undefined). */

package/dist/core/runner/prepare-inherited-gate.js

@@ -7,6 +7,7 @@ import { StubExecutionEnv } from "../stub-env.js";
 import { askApproverIdentity, durableMandateSourceOf } from "../tool-policy.js";
 import { deliverEngineNotice } from "../types.js";
 import { PermissionModeController, modeRequestAfterResume } from "../mode-policy.js";
+import { SessionModeSeats } from "./session-mode-seats.js";
 import { migrateLegacyModeSeed } from "../checkpoint-store.js";
 import { attachRebuiltDenialTrackers, createDenialLimitStop } from "./denial-limit-arms.js";
 import { asThrownError } from "../thrown-value.js";
@@ -56,6 +57,11 @@ export function prepareInheritedGate(input) {
     };
     const permissionMode = new PermissionModeController(modeRequestAfterResume(permissionModeSeat, modeSeed, resume?.outcome), ceiling, { onFold: announceModeFold, ...(modeSeed.prePlanMode !== undefined ? { prePlanMode: modeSeed.prePlanMode } : {}) });
     announceModeFold(permissionMode.receipt());
+    const { ceiling: legModeCeiling, commit: commitLegModeCeiling, end: endModeCeiling } = (internals?.sessionModeSeats ?? new SessionModeSeats()).legCeiling(sessionId, permissionMode);
+    const commitModeSeats = (legSignal) => {
+        commitLegModeCeiling();
+        parentSeat?.hold?.(permissionMode, legSignal);
+    };
     const liveAdmittedOrg = liveInheritedGate?.admittedOrgScopes;
     const seedAdmittedOrg = seedInheritedGate?.admittedOrgScopes;
     const inheritedAdmittedOrgScopes = liveAdmittedOrg === undefined ? seedAdmittedOrg : seedAdmittedOrg === undefined ? liveAdmittedOrg : liveAdmittedOrg.filter((s) => seedAdmittedOrg.includes(s));
@@ -156,7 +162,7 @@ export function prepareInheritedGate(input) {
                     ...(durableMandate ? { durableMandate: true } : {}),
                     ...(contentMandate ? { contentMandate: true } : {}),
                     ...(autoModeDecider !== undefined
-                        ? { autoMode: { decider: autoModeDecider, ...(autoModeDenialTracking !== undefined ? { denialTracking: autoModeDenialTracking } : {}), ...(autoModeArming !== undefined ? { arming: autoModeArming } : {}) } }
+                        ? { autoMode: { decider: autoModeDecider, ...(autoModeDenialTracking !== undefined ? { denialTracking: autoModeDenialTracking } : {}), ...(autoModeArming !== undefined ? { arming: autoModeArming } : {}), liveMode: legModeCeiling } }
                         : {}),
                 },
             ]
@@ -172,7 +178,7 @@ export function prepareInheritedGate(input) {
                         ...(durableMandate ? { durableMandate: true } : {}),
                         ...(contentMandate ? { contentMandate: true } : {}),
                         ...(autoModeDecider !== undefined
-                            ? { autoMode: { decider: autoModeDecider, ...(autoModeDenialTracking !== undefined ? { denialTracking: autoModeDenialTracking } : {}), ...(autoModeArming !== undefined ? { arming: autoModeArming } : {}) } }
+                            ? { autoMode: { decider: autoModeDecider, ...(autoModeDenialTracking !== undefined ? { denialTracking: autoModeDenialTracking } : {}), ...(autoModeArming !== undefined ? { arming: autoModeArming } : {}), liveMode: legModeCeiling } }
                             : {}),
                     },
                 ]
@@ -182,7 +188,7 @@ export function prepareInheritedGate(input) {
             ...(ancestorRules.length > 0 ? { ancestorRules } : {}),
             ...(effectiveShellGate !== undefined ? { shellGate: effectiveShellGate } : {}),
             permissionMode: permissionMode.current,
-            permissionModeCeiling: { get current() { return permissionMode.current; }, sessionId },
+            permissionModeCeiling: legModeCeiling,
             ...(parentConstraints.length > 0 ? { parentConstraints } : {}),
             admittedOrgScopes: memoryAdmittedOrgScopesRef.current,
             ...(orgGovernedProvenance ? { orgAdmissionGoverned: true } : {}),
@@ -295,5 +301,5 @@ export function prepareInheritedGate(input) {
             ...(spec.enablePlanMode === true ? { enterPlanMode } : {}),
         };
     };
-    return { liveInheritedGate, seedInheritedGate, inheritedAncestorRules, inheritedShellGate, inheritedParentConstraints, permissionMode, inheritedAdmittedOrgScopes, priorOwnOrgVerdict, orgGovernedProvenance, effectiveShellGate, ownSessionRulesRef, ancestorSessionRulesRef, ancestorRulesNow, memoryAdmittedOrgScopesRef, ownOrgVerdictRef, orgAdmissionCheckpointState, faceCheckpointSection, faceCheckpointState, writeFaceCheckpointSection, f012CheckpointState, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, frozenOnQuestion, parentSpecSeat, provenanceForChildrenRef, delegationSettlementRef, inheritedGateForChildren, carrierReadFace, carrierWriteFace, fullShellReachable, gateStopRef, stopForDenialLimit, enrichSpecToolCtx };
+    return { liveInheritedGate, seedInheritedGate, inheritedAncestorRules, inheritedShellGate, inheritedParentConstraints, permissionMode, commitModeSeats, endModeCeiling, inheritedAdmittedOrgScopes, priorOwnOrgVerdict, orgGovernedProvenance, effectiveShellGate, ownSessionRulesRef, ancestorSessionRulesRef, ancestorRulesNow, memoryAdmittedOrgScopesRef, ownOrgVerdictRef, orgAdmissionCheckpointState, faceCheckpointSection, faceCheckpointState, writeFaceCheckpointSection, f012CheckpointState, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, frozenOnQuestion, parentSpecSeat, provenanceForChildrenRef, delegationSettlementRef, inheritedGateForChildren, carrierReadFace, carrierWriteFace, fullShellReachable, gateStopRef, stopForDenialLimit, enrichSpecToolCtx };
 }

package/dist/core/runner/prepare-park-ask.d.ts

@@ -29,7 +29,7 @@ import type { RunnerDeps, RuntimeCaps, ShellGateDoctrine, TaskSpec } from "../ty
 import type { CwdRef } from "../../tools/fs/fs-shared.js";
 import type { AdvertisedWritableDirs } from "./advertised-writable-dirs.js";
 import { type ContentAskBinding } from "./content-ask-bindings.js";
-import type { AskLane, ParkAsk, Prepared, SuspendSaga } from "./contracts.js";
+import type { AskLane, IrreversibilityTier, ParkAsk, Prepared, SuspendSaga } from "./contracts.js";
 import type { createRuleOffersOf } from "./permission-rule-lanes.js";
 import { type ToolRosterDeltaSeat } from "../tool-roster.js";
 export interface PrepareParkAskInput {
@@ -112,8 +112,10 @@ export interface PrepareParkAskInput {
     /** borrowed-mutable — the run-scoped remote-lifecycle failure log. Writer here: a refused `suspendVM` (`push`). */
     remoteEnvFailures: Prepared["remoteEnvFailures"];
     /** borrowed-readonly — the shell-seat provenance set: the shell-running tools whose tier is the engine's shell seat's, not a
-     *  deployment mark (the risk descriptor's `shellGated` is the gated tool's membership). */
+     *  deployment mark (the risk descriptor's `shellGated` is the membership of the name the call's tier is read under). */
     shellGatedTools: ReadonlySet<string>;
+    /** borrowed-readonly — the per-tool tier, read only for the name the call's tier seat is read under (as at the gate). */
+    irreversibilityTier: IrreversibilityTier;
     /** borrowed-readonly — the operator's shell floor (`"always"`), persisted on a shell-gated descriptor; undefined = no floor. */
     effectiveShellGate: ShellGateDoctrine | undefined;
     /** borrowed-readonly — the EFFECTIVE durable-approval opt-in (the caller's, or the synthesized mandate scope): picks the

package/dist/core/runner/prepare-park-ask.js

@@ -15,7 +15,7 @@ import { checkpointScopeOf } from "./checkpoint-scope.js";
 import { CONTENT_ASK_BINDING_CAP } from "./content-ask-bindings.js";
 import { DEFAULT_UNATTENDED_APPROVAL_TTL_MS, publishCommittedSuspend, sanitizedTtlMs } from "./park-commit.js";
 import { remoteEnvFailureNote } from "./remote-env-retry.js";
-import { callFaceSeat, parkedToolIdentity, parkedToolFace } from "../tool-roster.js";
+import { callFaceSeat, firstNamed, parkedToolIdentity, parkedToolFace, ruleNamesOf } from "../tool-roster.js";
 class ParkRefusal extends Error {
     constructor(message, options) {
         super(message, options);
@@ -26,7 +26,7 @@ const wordlessDemand = (toolName) => {
     throw new Error(`a real-approval demand for "${toolName}" reached the park with no origin word — the origin stamp precedes every park`);
 };
 export function prepareParkAsk(input) {
-    const { askLane, saga, spec, deps, sessionId, checkpointStore, toolRosterDeltas, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, advertisedWritableDirs, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedTools, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, ruleOffersOf, now, humanReviewRef, abortController, harness, pausedRef } = input;
+    const { askLane, saga, spec, deps, sessionId, checkpointStore, toolRosterDeltas, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, advertisedWritableDirs, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedTools, irreversibilityTier, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, ruleOffersOf, now, humanReviewRef, abortController, harness, pausedRef } = input;
     if (askLane === undefined || saga === undefined)
         return { parkAsk: undefined };
     const { composedCallSignal, approvalPreviewOf } = askLane;
@@ -234,6 +234,7 @@ export function prepareParkAsk(input) {
                     remoteHandle = parkOnlyHandle(parkOnlyRemoteEnv);
                 }
                 token = mintCheckpointToken();
+                const tierSeat = firstNamed(irreversibilityTier, ruleNamesOf(req));
                 const riskDescriptor = buildRiskDescriptor({
                     toolName: req.toolName,
                     args: parkedArgs,
@@ -241,7 +242,7 @@ export function prepareParkAsk(input) {
                     ...(shadowedRule !== undefined ? { shadowedRule } : {}),
                     ...(probeReason !== undefined ? { probeReason } : {}),
                     ...(probeCause !== undefined ? { probeCause } : {}),
-                    shellGated: shellGatedTools.has(req.toolName),
+                    shellGated: tierSeat !== undefined && shellGatedTools.has(tierSeat.name),
                     ...(effectiveShellGate !== undefined ? { shellGateDoctrine: effectiveShellGate } : {}),
                 });
                 gate =
@@ -316,7 +317,7 @@ export function prepareParkAsk(input) {
                         ...(rowRealApproval !== undefined ? { requiresRealApproval: true } : {}),
                         ...askMandateMember(clearanceFacts),
                         ...askCarryRowMembers(carry),
-                        ...ruleOffersOf(req.toolName, parkedArgs, clearanceFacts),
+                        ...ruleOffersOf(req, parkedArgs, clearanceFacts),
                         boundInputHash: boundInputHashOf(parkedArgs),
                         batchToolCallIds,
                         completedCallIds,