@sema-agent/core 7.34.0 → 7.35.1

package/dist/core/runner/assemble-result.js

@@ -1,5 +1,5 @@
 import { isDegenerateCutMessage } from "../../brain/terminal-cause.js";
-import { extractErrorCode, stripErrorCodePrefix } from "../../brain/errors.js";
+import { extractErrorCode, isProviderEchoShape, stripErrorCodePrefix } from "../../brain/errors.js";
 import { terminalProjection } from "./terminal-projection.js";
 import { haltConsumed } from "./halt-attribution.js";
 import { providerReportedModel } from "../message-utils.js";
@@ -127,7 +127,7 @@ export function terminalCauseOf(final, stats, flags) {
         if (final.isApiErrorMessage === true) {
             apiFailure = {
                 ...(final.apiErrorStatus !== undefined ? { status: final.apiErrorStatus } : {}),
-                ...(final.requestId !== undefined ? { requestId: final.requestId } : {}),
+                ...(typeof final.requestId === "string" && isProviderEchoShape(final.requestId) ? { requestId: final.requestId } : {}),
             };
         }
         const lifted = extractErrorCode(message);

package/dist/core/runner/contracts.d.ts

@@ -59,6 +59,7 @@ import type { ActiveSkillFrame } from "./active-skill-scope.js";
 import type { BudgetAxis } from "./assemble-result.js";
 import type { GitStatusLaneRef } from "./git-status-frame.js";
 import type { SessionReadFileStates } from "./session-read-file-states.js";
+import type { LegModeCeiling, SessionModeSeats } from "./session-mode-seats.js";
 import type { BlockedRef, OutputRef, SkillListingEntry } from "./synthetic-tools.js";
 import type { createAttachmentState, WriteFamily } from "./turn-attachments.js";
 import type { cacheFamilyOf } from "./usage-accounting.js";
@@ -443,6 +444,8 @@ export interface Prepared {
     };
     /** Removes the `spec.signal` abort listener on task end (else a long-lived signal leaks listeners). */
     releaseSignal: () => void;
+    /** The leg has stopped: its children's mode ceiling moves to the session's current leg (called once its loop settled). */
+    endModeCeiling: () => void;
     /**
      * End-of-leg sweep for questions this leg's gate routed to a person. Called once by the
      * run loop at task end, on every exit path. A binding that is still present means a person ANSWERED and
@@ -1362,13 +1365,17 @@ export interface InheritedGate {
      */
     permissionMode?: PermissionMode;
     /**
-     * The parent's LIVE mode seat (opaque half; never serialized): the child's effective mode is DERIVED from it on
-     * every read, so a parent's steer reaches a running child on the child's next arbitration without a forwarding
-     * frame. `sessionId` is the parent's, the address of the user notice a folded child declaration is announced on.
+     * The parent's live mode ceiling (opaque half; never serialized): the parent leg's mode while that leg runs, its
+     * SESSION's current leg after it — the child's effective mode is DERIVED from it on every read, so a parent's steer
+     * reaches a running child on the child's next arbitration without a forwarding frame, and the session's next leg
+     * reaches a child that outlived the leg that spawned it (a session-scoped background child). `sessionId` is the
+     * parent's, the address of the user notice a folded child declaration is announced on. `hold` (the engine's own
+     * ceiling): the child is re-judged at each move of the ceiling, and a fold that produces is announced as at prepare.
      */
     permissionModeCeiling?: {
         readonly current: PermissionMode;
         readonly sessionId: string;
+        readonly hold?: LegModeCeiling["hold"];
     };
     /**
      * Org-memory admission freeze (ruled 2026-08-05): the spawning chain's FROZEN admitted org-scope
@@ -1459,6 +1466,14 @@ export interface InheritedGate {
              * the one every gate consults, here and on every descendant.
              */
             arming?: AutoModeArmingRecipe;
+            /**
+             * The ancestor's live mode ceiling (opaque, never serialized; the chain's `permissionModeCeiling`): the classifier
+             * answers the ancestor's asks only while this reads `auto` — else they go to the frozen approver. Absent (a
+             * re-supplied entry) ⇒ the classifier answers as recorded.
+             */
+            liveMode?: {
+                readonly current: PermissionMode;
+            };
         };
         /**
          * Set ONLY on an entry whose `policy` is the folded form of an ancestor's PreToolUse screening face
@@ -1993,6 +2008,13 @@ export interface RunInternals {
      * channel, same posture as every other field here.
      */
     sessionReadStates?: SessionReadFileStates;
+    /**
+     * The Runner's per-session permission-mode seats ({@link SessionModeSeats}): the chain a leg hands its children
+     * carries its SESSION's seat as the children's ceiling, and each leg binds itself to that seat once its prepare
+     * commits — so a session-scoped background child follows the session's current leg. Always set by the Runner's own
+     * prepare call (overriding any caller value); absent on a standalone prepareTask, which mints a seat of its own.
+     */
+    sessionModeSeats?: SessionModeSeats;
     /** Trusted system-injection sink (`Runner.runLocked` wires it to the live TaskStream queue plus the
      *  current harness lanes; never a public TaskSpec field), ADDRESSED TO THE SESSION rather than to this
      *  run: a producer wired here (a background shell, a watch, a delegation settle) keeps the closure long
@@ -2749,7 +2771,7 @@ export interface RunnerSelfSeat {
  */
 export type PrepareTaskFn = (spec: TaskSpec, deps: RunnerDeps, sessions: SessionStore, resume?: PrepareResume, internals?: RunInternals, runnerSelf?: RunnerSelfSeat, runIdSink?: {
     runId?: string;
-}) => Promise<Prepared>;
+}, holdSessionLock?: (sessionId: string) => Promise<void>) => Promise<Prepared>;
 /**
  * The Result of an INSTALLING phase: a lane whose every product is installed on a seat it borrowed
  * (the harness's stop gate and recovery chain, the run state's counter groups, the stream's result setter, the claimed

package/dist/core/runner/denial-limit-arms.d.ts

@@ -27,6 +27,10 @@ export interface InheritedAutoMode {
     decider: AutoModeDecider;
     denialTracking?: AutoModeDenialTracker;
     arming?: AutoModeArmingRecipe;
+    /** The ancestor's live mode seat: the decider answers only while it reads `auto` (absent ⇒ as recorded). */
+    liveMode?: {
+        readonly current: import("../ask-origin.js").PermissionMode;
+    };
 }
 /**
  * A re-supplied chain entry (a cross-process redemption rebuilt its ancestor's classifier from the
@@ -179,7 +183,8 @@ export type InheritedClassifierJudgment<A extends InheritedAsk> =
 export declare function judgeInheritedClassifier<A extends InheritedAsk>(opts: {
     autoMode: InheritedAutoMode | undefined;
     /** The leg's live permission mode (the gate's seat): under `dontAsk` / `bypassPermissions` / `plan` the decider is not
-     *  dispatched (the mode's arbitration decides first). Absent ⇒ a decider on the chain is dispatched. */
+     *  dispatched (the mode's arbitration decides first). Absent ⇒ a decider on the chain is dispatched (subject to the
+     *  entry's own `autoMode.liveMode`). */
     liveMode?: () => import("../ask-origin.js").PermissionMode;
     ask: A;
     req: ToolCallRequest;

package/dist/core/runner/denial-limit-arms.js

@@ -80,17 +80,17 @@ export function inheritedAskCarry(judged, liveApprover, tracker) {
 export async function judgeInheritedClassifier(opts) {
     const { autoMode, ask, req } = opts;
     const origin = askOriginOf(ask, INHERITED_STATION_FACTS);
-    const modeDecidesFirst = () => {
+    const classifierStandsDown = () => {
         const live = opts.liveMode?.();
-        return live === "dontAsk" || live === "bypassPermissions" || live === "plan";
+        return live === "dontAsk" || live === "bypassPermissions" || live === "plan" || (autoMode?.liveMode !== undefined && autoMode.liveMode.current !== "auto");
     };
-    if (autoMode === undefined || modeDecidesFirst() || !classifyAsk(ask, INHERITED_STATION_FACTS).row.classifierEligible) {
+    if (autoMode === undefined || classifierStandsDown() || !classifyAsk(ask, INHERITED_STATION_FACTS).row.classifierEligible) {
         return { kind: "resolve", ask, fallback: ask.denialLimitFallback, mintedHere: false, origin };
     }
     const verdict = await autoMode.decider
         .decide({ req, ...(ask.message !== undefined ? { askMessage: ask.message } : {}) }, opts.signal)
         .catch(() => ({ kind: "unavailable", cause: "error" }));
-    if (verdict.kind === "allow" && modeDecidesFirst())
+    if (verdict.kind === "allow" && classifierStandsDown())
         return { kind: "resolve", ask, fallback: ask.denialLimitFallback, mintedHere: false, origin };
     const attributed = (d) => (verdict.classifier !== undefined ? attestClassifierRound(d, verdict.classifier, req) : d);
     if (verdict.kind === "allow") {

package/dist/core/runner/file-history-request.d.ts

@@ -0,0 +1,26 @@
+/** The file-history REQUEST door and its bad-value doors — the pre-acquire half of the file-history phase (`prepare-file-history.ts`). */
+import type { FileHistoryStore } from "../file-history-store.js";
+import type { RunnerDeps, TaskSpec } from "../types.js";
+/**
+ * The file-history REQUEST door: every refusal the request (`TaskSpec`) and the deployment's own seats decide
+ * without the session, the env or the store's contents — the three bad-value doors (`RunnerDeps.onTrackFailure`,
+ * `RunnerDeps.fileHistoryStore` / `fileHistoryCapture`, `TaskSpec.fileHistory`), the retired `rewindFiles` restore
+ * sense, the restoreFiles / resumeAt / rewindFilesTo contradictions, and a restore asked of a run that holds no
+ * history (`rewind.capture_disabled` / `rewind.store_unconfigured`). SYNCHRONOUS and side-effect free; the driver
+ * calls it BEFORE the session is acquired, so a request refused here leaves the session — its leaf included —
+ * exactly as it was. What it resolves rides into the file-history phase (`prepareFileHistory`) unchanged.
+ */
+export declare function resolveFileHistoryRequest(spec: Pick<TaskSpec, "resumeAt" | "resumeAtMode" | "restoreFiles" | "rewindFilesTo" | "fileHistory">, deps: Pick<RunnerDeps, "onTrackFailure" | "fileHistoryStore" | "fileHistoryCapture">): FileHistoryRequest;
+/** What {@link resolveFileHistoryRequest} resolved: the validated seats and words, the run's store (after every off
+ *  switch) and its capture store, and the restore target (`undefined` = no restore asked). */
+export interface FileHistoryRequest {
+    onTrackFailure: "refuse" | "proceed-unprotected";
+    wiredSeat: FileHistoryStore | "disabled" | undefined;
+    runDeclaredOff: boolean;
+    captureOff: boolean;
+    declaredOff: boolean;
+    fileHistoryStore: FileHistoryStore | undefined;
+    captureStore: FileHistoryStore | undefined;
+    rewindTarget: string | undefined;
+    rewindBefore: boolean;
+}

package/dist/core/runner/file-history-request.js

@@ -0,0 +1,90 @@
+export function resolveFileHistoryRequest(spec, deps) {
+    const onTrackFailure = deps.onTrackFailure === undefined ? "refuse" : deps.onTrackFailure;
+    if (onTrackFailure !== "refuse" && onTrackFailure !== "proceed-unprotected") {
+        const e = new Error(`RunnerDeps.onTrackFailure must be "refuse" or "proceed-unprotected"; got ${JSON.stringify(deps.onTrackFailure)} — refusing prepare rather than silently defaulting a first-touch-failure policy.`);
+        e.code = "config.invalid_on_track_failure";
+        throw e;
+    }
+    const wiredSeat = resolveWiredFileHistoryStore(deps.fileHistoryStore);
+    const runDeclaredOff = resolveRunFileHistoryWord(spec.fileHistory);
+    const captureOff = resolveFileHistoryCaptureWord(deps.fileHistoryCapture, wiredSeat);
+    const declaredOff = wiredSeat === "disabled" || runDeclaredOff;
+    const fileHistoryStore = declaredOff ? undefined : wiredSeat;
+    const captureStore = captureOff ? undefined : fileHistoryStore;
+    const legacyRewindFiles = spec.rewindFiles;
+    if (legacyRewindFiles === true) {
+        if (spec.resumeAt !== undefined) {
+            const e = new Error(`rewind-files: TaskSpec.rewindFiles is retired (design/381 — rewind now converges the per-edited-file history, not a whole-tree snapshot). This request pairs it with resumeAt, i.e. the RESTORE sense: set restoreFiles: true instead. (The capture sense needs no request anymore — first-touch tracking is on whenever a RunnerDeps.fileHistoryStore is wired and neither RunnerDeps.fileHistoryCapture nor TaskSpec.fileHistory turns it off.)`);
+            e.code = "rewind.rewind_files_retired";
+            throw e;
+        }
+    }
+    if (spec.restoreFiles === true && spec.resumeAt === undefined) {
+        const e = new Error(`rewind-files: restoreFiles: true needs a resumeAt anchor — restoring files means converging them to a specific prior entry's boundary, and this spec names none. Use resumeAt + restoreFiles to move conversation and files together, or rewindFilesTo alone for a code-only restore.`);
+        e.code = "rewind.invalid_spec";
+        throw e;
+    }
+    if (spec.resumeAt !== undefined && spec.rewindFilesTo !== undefined) {
+        const e = new Error(`rewind-files: resumeAt ("${spec.resumeAt}") and rewindFilesTo ("${spec.rewindFilesTo}") were both set — resumeAt already anchors the file restore when restoreFiles is true, so a separate rewindFilesTo target is a conflicting request. Drop one of the two.`);
+        e.code = "rewind.conflicting_targets";
+        throw e;
+    }
+    const rewindTarget = spec.resumeAt !== undefined ? (spec.restoreFiles === true ? spec.resumeAt : undefined) : spec.rewindFilesTo;
+    const rewindBefore = rewindTarget !== undefined && spec.resumeAt !== undefined && spec.resumeAtMode === "before";
+    if (rewindTarget !== undefined && fileHistoryStore === undefined) {
+        if (runDeclaredOff)
+            throw captureDisabledRefusal(rewindTarget);
+        const e = new Error(wiredSeat === "disabled"
+            ? `rewind-files: restoring files to entry "${rewindTarget}" requires a history backend, but this deployment declared file history disabled (RunnerDeps.fileHistoryStore: "disabled"), so there is no history to restore — the files were NOT rewound`
+            : `rewind-files: restoring files to entry "${rewindTarget}" requires a history backend, but this deployment wired no RunnerDeps.fileHistoryStore — no file history was ever recorded, so the files were NOT rewound`);
+        e.code = "rewind.store_unconfigured";
+        throw e;
+    }
+    return { onTrackFailure, wiredSeat, runDeclaredOff, captureOff, declaredOff, fileHistoryStore, captureStore, rewindTarget, rewindBefore };
+}
+function resolveWiredFileHistoryStore(candidate) {
+    if (candidate === undefined || candidate === "disabled")
+        return candidate;
+    const verbs = ["trackEdit", "annulTrack", "snapshot", "restore", "canRestore", "reap", "adoptScope"];
+    const verbOf = (v) => {
+        try {
+            return candidate[v];
+        }
+        catch {
+            return undefined;
+        }
+    };
+    const probeable = (typeof candidate === "object" && candidate !== null) || typeof candidate === "function";
+    const missing = probeable ? verbs.filter((v) => typeof verbOf(v) !== "function") : [...verbs];
+    if (missing.length > 0) {
+        const shape = candidate === null ? "null" : probeable ? "a value that is not a FileHistoryStore" : `a ${typeof candidate}`;
+        const e = new Error(`RunnerDeps.fileHistoryStore was wired with ${shape} — missing contract verbs: ${missing.join(", ")}. Refusing prepare rather than half-wiring the rewind seat (a present-but-unusable store makes every Edit/Write/NotebookEdit fail its first-touch backup while restore requests report "no store wired"). Write "disabled" (or omit the key) to run without file history.`);
+        e.code = "config.invalid_file_history_store";
+        throw e;
+    }
+    return candidate;
+}
+function resolveRunFileHistoryWord(word) {
+    if (word === undefined || word === "disabled")
+        return word === "disabled";
+    const e = new Error(`rewind-files: TaskSpec.fileHistory holds ${shownWord(word)} — the only value is "disabled"; omit the key to leave the deployment's setting in force`);
+    e.code = "rewind.invalid_spec";
+    throw e;
+}
+function resolveFileHistoryCaptureWord(word, wiredSeat) {
+    if (word === undefined || (word === "off" && wiredSeat !== undefined && wiredSeat !== "disabled"))
+        return word === "off";
+    const e = new Error(word === "off"
+        ? `RunnerDeps.fileHistoryCapture: "off" requires a wired RunnerDeps.fileHistoryStore — nothing to switch off; to drop history entirely write fileHistoryStore: "disabled"`
+        : `RunnerDeps.fileHistoryCapture holds ${shownWord(word)} — the only value is "off"; omit the key to record whenever a fileHistoryStore is wired`);
+    e.code = "config.invalid_file_history_capture";
+    throw e;
+}
+function shownWord(word) {
+    return typeof word === "string" ? JSON.stringify(word.slice(0, 40)) : word === null || typeof word === "boolean" || typeof word === "number" ? String(word) : `a ${typeof word}`;
+}
+function captureDisabledRefusal(target) {
+    const e = new Error(`rewind-files: this run set TaskSpec.fileHistory: "disabled", so it neither records nor restores file history — restoring files to entry "${target}" was refused and the files were NOT rewound`);
+    e.code = "rewind.capture_disabled";
+    return e;
+}

package/dist/core/runner/permission-rule-lanes.d.ts

@@ -29,6 +29,7 @@ import type { AskRuleEvidence, ToolCallRequest } from "../tool-policy.js";
 import { persistedRuleMandateOf, type RuleClearanceFacts } from "../ask-origin.js";
 import { type OrgGateVerdict, type PersistedRuleAnswer, type PersistedRuleHit, type PersistedRuleUnreadable } from "../hooks.js";
 import type { PersistedRule, PersistedRuleVerdict, RuleOffer, SegmentCoverage } from "../permission-rule-model.js";
+import { type ToolCallLike } from "../tool-registry.js";
 import { type OrgRuleResolution } from "../permission-rule-org.js";
 import { type EffectivePermissionRules, type PermissionRuleStoreProvider } from "../permission-rule-provider.js";
 /** The one SHELL tool the persisted-rule lane's COMMAND grammar speaks for (the rule-offer face mints for
@@ -246,7 +247,7 @@ export declare function createRuleOffersOf(cfg: {
         current: string;
     } | undefined;
     deniesDirectoryRead: ((directory: string) => boolean) | undefined;
-}): (toolName: string, args: unknown, ask: RuleOffersAskFacts | undefined) => {
+}): (call: Pick<ToolCallLike, "toolName" | "face">, args: unknown, ask: RuleOffersAskFacts | undefined) => {
     ruleOffers?: readonly RuleOffer[];
     ruleOffersAbsence?: RuleOffersAbsence;
     execCwd?: string;

package/dist/core/runner/permission-rule-lanes.js

@@ -1,12 +1,13 @@
 import { persistedRuleMandateOf, ruleClearanceOf } from "../ask-origin.js";
 import {} from "../hooks.js";
-import { adjudicatePersistedPathRules, adjudicatePersistedRules, ruleToolGrammarOf, segmentCoverageOf, suggestRulesForCommand } from "../permission-rule-model.js";
+import { adjudicatePersistedPathRules, adjudicatePersistedRules, laneToolNamesOf, ruleToolGrammarOf, segmentCoverageOf, suggestRulesForCommand } from "../permission-rule-model.js";
 import { isAbsolutePathForm } from "../../tools/fs/safety.js";
 import { effectivePathTargetOf } from "../effective-path-target.js";
-import { declaredPathTargetOf, protectivePathTargetOf } from "../tool-registry.js";
+import { anyNamed, declaredPathTargetOf, firstNamed, protectivePathTargetOf, ruleNamesOf } from "../tool-registry.js";
 import { orgRuleVerdictFor } from "../permission-rule-org.js";
 import { ownerStoreOf } from "../permission-rule-provider.js";
 import { thrownText } from "../thrown-value.js";
+import { strongestAnswer } from "../persisted-rule-arms.js";
 import { gateWaitFailureOf, withGateTimeout } from "../gate-bounded-await.js";
 import { ORG_ADJUDICATION_TIMEOUT_MS } from "../permission-rule-org.js";
 export const PERSISTED_RULE_TOOL = "Bash";
@@ -105,9 +106,9 @@ export function createPermissionRuleLanes(cfg) {
                 }
                 const revisionCell = orgRevisionEvidenceOf(resolution, cfg.onRevisionDefect);
                 const command = req.args?.command;
-                if (req.toolName !== PERSISTED_RULE_TOOL || typeof command !== "string")
+                if (!laneToolNamesOf(req).includes(PERSISTED_RULE_TOOL) || typeof command !== "string")
                     return { status: "available", ...revisionCell };
-                const verdict = orgRuleVerdictFor(resolution.rules, { tool: req.toolName, command });
+                const verdict = orgRuleVerdictFor(resolution.rules, { tool: PERSISTED_RULE_TOOL, command });
                 return verdict === undefined ? { status: "available", ...revisionCell } : { status: "available", verdict, ...revisionCell };
             },
         }
@@ -115,8 +116,8 @@ export function createPermissionRuleLanes(cfg) {
     const personalAdjudicate = async (req) => {
         if (anonymous && !cfg.localOwnerDeclared)
             return undefined;
-        const grammar = ruleToolGrammarOf(req.toolName);
-        if (grammar === undefined)
+        const laneNames = laneToolNamesOf(req);
+        if (laneNames.length === 0)
             return undefined;
         let view;
         try {
@@ -128,7 +129,7 @@ export function createPermissionRuleLanes(cfg) {
         if (view.unreadable !== undefined)
             skipped(view.unreadable, view.unreadableSources);
         try {
-            const answer = judgeAgainst(view.rules, req, grammar);
+            const answer = strongestAnswer(laneNames.map((n) => judgeAgainst(view.rules, { ...req, toolName: n }, ruleToolGrammarOf(n))));
             return view.unreadable !== undefined && (answer === undefined || "segmentCoverage" in answer) ? { unreadable: true } : answer;
         }
         catch (err) {
@@ -156,15 +157,17 @@ export function createPermissionRuleLanes(cfg) {
     return { personal, org };
 }
 export function createRuleOffersOf(cfg) {
-    return (toolName, args, ask) => {
+    return (call, args, ask) => {
+        const toolName = call.toolName;
         if (!cfg.laneArmed || toolName !== PERSISTED_RULE_TOOL)
             return {};
         if ((cfg.principal === undefined || cfg.principal === "") && !cfg.localOwnerDeclared)
             return {};
+        const tierSeat = firstNamed(cfg.irreversibilityTier, ruleNamesOf(call));
         const closedDoor = ruleClearanceOf(ask, {
-            egress: cfg.egressTools.has(toolName),
-            irreversibility: cfg.irreversibilityTier.get(toolName),
-            shellGated: cfg.shellGatedTools.has(toolName),
+            egress: anyNamed(cfg.egressTools, ruleNamesOf(call)),
+            irreversibility: tierSeat?.value,
+            shellGated: tierSeat !== undefined && cfg.shellGatedTools.has(tierSeat.name),
         }).word;
         if (closedDoor !== undefined)
             return { ruleOffersAbsence: closedDoor };

package/dist/core/runner/prepare-ask-lane.d.ts

@@ -77,7 +77,7 @@ export interface PrepareAskLaneInput {
         isDelegatedChild?: true;
     };
     /** borrowed-readonly — the policy-chain phase's per-tool risk-axes projection (`riskAxes` on the ask). */
-    riskAxesOf: (toolName: string) => {
+    riskAxesOf: (call: Pick<ToolCallRequest, "toolName" | "face">) => {
         riskAxes?: {
             irreversible?: boolean;
             egress?: boolean;

package/dist/core/runner/prepare-ask-lane.js

@@ -96,10 +96,10 @@ export function prepareAskLane(input) {
                 const p = approvalPreviewOf(req.toolName, req.args);
                 return { ...(p.preview !== undefined ? { preview: p.preview } : {}), ...(p.withheld !== undefined ? { previewWithheld: p.withheld } : {}) };
             })(),
-            ...ruleOffersOf(req.toolName, req.args, decision.action === "ask" ? decision : undefined),
+            ...ruleOffersOf(req, req.args, decision.action === "ask" ? decision : undefined),
             message: decision.message ?? `approval required for "${req.toolName}"`,
             ...askSourceIdentity(),
-            ...riskAxesOf(req.toolName),
+            ...riskAxesOf(req),
             ...(decision.action === "ask" && decision.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
             ...(decision.action === "ask" ? askMandateMember(decision) : {}),
             ...(decision.action === "ask" && decision.persistedRuleShadowed !== undefined ? { persistedRuleShadowed: decision.persistedRuleShadowed } : {}),

package/dist/core/runner/prepare-file-history.d.ts

@@ -12,7 +12,9 @@
  * before the move (a minted ownedEnv is destroyed there, the session view forgotten). The phase acquires
  * no resource of its own — the two seats it returns are closures over the store the deployment owns.
  *
- * The module-level helpers below the phase (`restoredAbsPathsOf`, `resolveWiredFileHistoryStore`,
+ * The request door (the bad-value doors and every refusal the request decides alone) lives in
+ * `./file-history-request.ts` and runs BEFORE the session is acquired; this phase receives its resolution.
+ * The module-level helpers below the phase (`restoredAbsPathsOf`,
  * the refusal's epoch-tail wording helper, `adoptForkedFileHistory` with its per-store carry memo,
  * `createFileHistoryBoundarySeat`, `resolveFileHistoryCoordinates` / `resolveFileHistoryScope` /
  * `fileHistoryFilesystemIdentity`, `childScopeRewindRefusal`) moved with it unchanged; the two the test
@@ -22,13 +24,17 @@ import type { ExecutionEnv } from "../../internal/harness.js";
 import type { StoredSession } from "../../engine/session/session.js";
 import type { RunnerDeps, TaskResult, TaskSpec, TrackFileEditHook } from "../types.js";
 import type { FileHistoryBoundarySeat, RunInternals } from "./contracts.js";
+import type { FileHistoryRequest } from "./file-history-request.js";
 export interface PrepareFileHistoryInput {
     /** borrowed-readonly — the deployment seats this phase reads: the first-touch failure policy, the history
      *  store and its capture switch (all validated HERE, once), the incident sink, and the retired-epoch diagnostic probe. */
-    deps: Pick<RunnerDeps, "onTrackFailure" | "fileHistoryStore" | "fileHistoryCapture" | "onError">;
+    deps: Pick<RunnerDeps, "onError">;
     /** borrowed-readonly — the REBOUND spec's rewind request fields and off-switch word (the retired `rewindFiles`
      *  spelling is read off the same object as an unknown key) and the caller's cancel signal for the restore. */
-    spec: Pick<TaskSpec, "resumeAt" | "resumeAtMode" | "restoreFiles" | "rewindFilesTo" | "acceptPartialRestore" | "signal" | "fileHistory">;
+    spec: Pick<TaskSpec, "resumeAt" | "restoreFiles" | "acceptPartialRestore" | "signal">;
+    /** borrowed-readonly — the request door's resolution ({@link resolveFileHistoryRequest}), judged before the session was
+     *  acquired: every refusal the request and the deployment's seats decide on their own has already thrown. */
+    request: FileHistoryRequest;
     /** borrowed-readonly — the trusted lineage a delegating parent handed this run (absent for a root run
      *  and for a host's own fork), read for the recording-scope decision only. */
     internals: Pick<RunInternals, "fileHistoryLineage"> | undefined;

package/dist/core/runner/prepare-file-history.js

@@ -2,45 +2,16 @@ import { NodeExecutionEnv } from "../../engine/execution-env/node-execution-env.
 import { isRemoteExecutionEnv } from "../remote-env.js";
 import { resolveTrackKey } from "../file-history-store.js";
 export async function prepareFileHistory(input) {
-    const { deps, spec, internals, executionEnv, taskRootFinal, handsEnabled, sessionId, session, abortController } = input;
+    const { deps, spec, request, internals, executionEnv, taskRootFinal, handsEnabled, sessionId, session, abortController } = input;
     const rewindNotes = [];
-    const onTrackFailure = deps.onTrackFailure === undefined ? "refuse" : deps.onTrackFailure;
-    if (onTrackFailure !== "refuse" && onTrackFailure !== "proceed-unprotected") {
-        const e = new Error(`RunnerDeps.onTrackFailure must be "refuse" or "proceed-unprotected"; got ${JSON.stringify(deps.onTrackFailure)} — refusing prepare rather than silently defaulting a first-touch-failure policy.`);
-        e.code = "config.invalid_on_track_failure";
-        throw e;
-    }
-    const wiredSeat = resolveWiredFileHistoryStore(deps.fileHistoryStore);
-    const runDeclaredOff = resolveRunFileHistoryWord(spec.fileHistory);
-    const captureOff = resolveFileHistoryCaptureWord(deps.fileHistoryCapture, wiredSeat);
-    const declaredOff = wiredSeat === "disabled" || runDeclaredOff;
-    const fileHistoryStore = declaredOff ? undefined : wiredSeat;
-    const captureStore = captureOff ? undefined : fileHistoryStore;
-    const legacyRewindFiles = spec.rewindFiles;
-    if (legacyRewindFiles === true) {
-        if (spec.resumeAt !== undefined) {
-            const e = new Error(`rewind-files: TaskSpec.rewindFiles is retired (design/381 — rewind now converges the per-edited-file history, not a whole-tree snapshot). This request pairs it with resumeAt, i.e. the RESTORE sense: set restoreFiles: true instead. (The capture sense needs no request anymore — first-touch tracking is on whenever a RunnerDeps.fileHistoryStore is wired and neither RunnerDeps.fileHistoryCapture nor TaskSpec.fileHistory turns it off.)`);
-            e.code = "rewind.rewind_files_retired";
-            throw e;
-        }
+    const { onTrackFailure, captureOff, declaredOff, fileHistoryStore, captureStore, rewindTarget, rewindBefore } = request;
+    if (spec.rewindFiles === true) {
         try {
             deps.onError?.(new Error(`TaskSpec.rewindFiles (capture sense) is retired and was ignored: per-edited-file first-touch tracking is on whenever RunnerDeps.fileHistoryStore is wired and neither RunnerDeps.fileHistoryCapture nor TaskSpec.fileHistory turns it off, so a per-turn capture request has nothing left to ask for. Drop the field; the restore sense moved to TaskSpec.restoreFiles.`), { phase: "config", sessionId });
         }
         catch {
         }
     }
-    if (spec.restoreFiles === true && spec.resumeAt === undefined) {
-        const e = new Error(`rewind-files: restoreFiles: true needs a resumeAt anchor — restoring files means converging them to a specific prior entry's boundary, and this spec names none. Use resumeAt + restoreFiles to move conversation and files together, or rewindFilesTo alone for a code-only restore.`);
-        e.code = "rewind.invalid_spec";
-        throw e;
-    }
-    if (spec.resumeAt !== undefined && spec.rewindFilesTo !== undefined) {
-        const e = new Error(`rewind-files: resumeAt ("${spec.resumeAt}") and rewindFilesTo ("${spec.rewindFilesTo}") were both set — resumeAt already anchors the file restore when restoreFiles is true, so a separate rewindFilesTo target is a conflicting request. Drop one of the two.`);
-        e.code = "rewind.conflicting_targets";
-        throw e;
-    }
-    const rewindTarget = spec.resumeAt !== undefined ? (spec.restoreFiles === true ? spec.resumeAt : undefined) : spec.rewindFilesTo;
-    const rewindBefore = rewindTarget !== undefined && spec.resumeAt !== undefined && spec.resumeAtMode === "before";
     if (spec.resumeAt !== undefined && spec.restoreFiles !== true) {
         rewindNotes.push({
             code: "conversation_only",
@@ -64,18 +35,7 @@ export async function prepareFileHistory(input) {
         await adoptForkedFileHistory(captureStore, session, sessionId, deps.onError);
     if (rewindTarget !== undefined && historyScope !== sessionId)
         throw childScopeRewindRefusal(historyScope, rewindTarget);
-    if (fileHistoryStore === undefined) {
-        if (rewindTarget !== undefined && runDeclaredOff)
-            throw captureDisabledRefusal(rewindTarget);
-        if (rewindTarget !== undefined) {
-            const e = new Error(wiredSeat === "disabled"
-                ? `rewind-files: restoring files to entry "${rewindTarget}" requires a history backend, but this deployment declared file history disabled (RunnerDeps.fileHistoryStore: "disabled"), so there is no history to restore — the files were NOT rewound`
-                : `rewind-files: restoring files to entry "${rewindTarget}" requires a history backend, but this deployment wired no RunnerDeps.fileHistoryStore — no file history was ever recorded, so the files were NOT rewound`);
-            e.code = "rewind.store_unconfigured";
-            throw e;
-        }
-    }
-    else if (!handsEnabled) {
+    if (fileHistoryStore !== undefined && !handsEnabled) {
         if (rewindTarget !== undefined) {
             rewindNotes.push({
                 code: "files_env_unsupported",
@@ -168,52 +128,6 @@ function restoredAbsPathsOf(restored, root) {
     }
     return out;
 }
-function resolveWiredFileHistoryStore(candidate) {
-    if (candidate === undefined || candidate === "disabled")
-        return candidate;
-    const verbs = ["trackEdit", "annulTrack", "snapshot", "restore", "canRestore", "reap", "adoptScope"];
-    const verbOf = (v) => {
-        try {
-            return candidate[v];
-        }
-        catch {
-            return undefined;
-        }
-    };
-    const probeable = (typeof candidate === "object" && candidate !== null) || typeof candidate === "function";
-    const missing = probeable ? verbs.filter((v) => typeof verbOf(v) !== "function") : [...verbs];
-    if (missing.length > 0) {
-        const shape = candidate === null ? "null" : probeable ? "a value that is not a FileHistoryStore" : `a ${typeof candidate}`;
-        const e = new Error(`RunnerDeps.fileHistoryStore was wired with ${shape} — missing contract verbs: ${missing.join(", ")}. Refusing prepare rather than half-wiring the rewind seat (a present-but-unusable store makes every Edit/Write/NotebookEdit fail its first-touch backup while restore requests report "no store wired"). Write "disabled" (or omit the key) to run without file history.`);
-        e.code = "config.invalid_file_history_store";
-        throw e;
-    }
-    return candidate;
-}
-function resolveRunFileHistoryWord(word) {
-    if (word === undefined || word === "disabled")
-        return word === "disabled";
-    const e = new Error(`rewind-files: TaskSpec.fileHistory holds ${shownWord(word)} — the only value is "disabled"; omit the key to leave the deployment's setting in force`);
-    e.code = "rewind.invalid_spec";
-    throw e;
-}
-function resolveFileHistoryCaptureWord(word, wiredSeat) {
-    if (word === undefined || (word === "off" && wiredSeat !== undefined && wiredSeat !== "disabled"))
-        return word === "off";
-    const e = new Error(word === "off"
-        ? `RunnerDeps.fileHistoryCapture: "off" requires a wired RunnerDeps.fileHistoryStore — nothing to switch off; to drop history entirely write fileHistoryStore: "disabled"`
-        : `RunnerDeps.fileHistoryCapture holds ${shownWord(word)} — the only value is "off"; omit the key to record whenever a fileHistoryStore is wired`);
-    e.code = "config.invalid_file_history_capture";
-    throw e;
-}
-function shownWord(word) {
-    return typeof word === "string" ? JSON.stringify(word.slice(0, 40)) : word === null || typeof word === "boolean" || typeof word === "number" ? String(word) : `a ${typeof word}`;
-}
-function captureDisabledRefusal(target) {
-    const e = new Error(`rewind-files: this run set TaskSpec.fileHistory: "disabled", so it neither records nor restores file history — restoring files to entry "${target}" was refused and the files were NOT rewound`);
-    e.code = "rewind.capture_disabled";
-    return e;
-}
 function rewindRefusalTail() {
     return `Boundaries are keyed by a turn's INITIAL entry and exist only for turns that recorded history (a RunnerDeps.fileHistoryStore wired, capture on, and the run's file history not disabled); a boundary from the retired whole-tree snapshot era is not restorable by this seat, and reaped boundaries have none.`;
 }

package/dist/core/runner/prepare-gate-stations.d.ts

@@ -39,6 +39,7 @@ import type { CwdRef } from "../../tools/fs/fs-shared.js";
 import type { AskLane, IrreversibilityTier, ParkAsk, Prepared, ReversibilityProbes, StopForDenialLimit } from "./contracts.js";
 import type { PermissionRuleLanes } from "./permission-rule-lanes.js";
 import { type ToolRosterDeltaSeat } from "../tool-roster.js";
+import type { ToolCallLike } from "../tool-registry.js";
 import { type FrameSettlement } from "../frame-settlement.js";
 /**
  * The parent-thread human-rejection boundary — judged ONCE here, from the pass's own record (CC parity:
@@ -174,7 +175,7 @@ export interface PrepareGateStationsInput {
         readonly signal: AbortSignal;
     };
     /** borrowed-readonly — the shell-seat provenance set: the shell-running tools whose tier is the engine's shell seat's, not a
-     *  deployment mark (the gate's `shellGated` attribution is the gated tool's membership). */
+     *  deployment mark (the gate's `shellGated` attribution is the membership of the name the call's tier was read under). */
     shellGatedTools: ReadonlySet<string>;
     /** borrowed-readonly — the armed classifier's live seat (read per call: a leg steered into `auto` arms after prepare). */
     autoModeDecider: {
@@ -211,8 +212,8 @@ export interface PrepareGateStationsInput {
     questionToolMounted: boolean;
     /** borrowed-readonly — whether sandbox admission is armed (isolated env + park prerequisites). */
     sandboxAdmissionArmed: boolean;
-    /** borrowed-readonly — the per-tool boundary-capability fact the sandbox admission reads. */
-    sandboxBoundaryCapable: (toolName: string) => boolean;
+    /** borrowed-readonly — the per-call boundary-capability fact the sandbox admission reads (the call's wire name and names). */
+    sandboxBoundaryCapable: (call: Pick<ToolCallLike, "toolName" | "face">) => boolean;
     /** borrowed-readonly — the sandbox-admission trace sink (the deferred ancestor disclosure and the gate's own). */
     emitSandboxAdmitted: (info: {
         toolCallId: string;

package/dist/core/runner/prepare-gate-stations.js

@@ -9,7 +9,7 @@ import { askUnresolvableNotice } from "../ask-unresolvable-notice.js";
 import { askReachesPerson } from "../wiring-manifest.js";
 import { classifierUnavailableSeat } from "./classifier-ladder.js";
 import { PATH_CONFINABLE_WRITE_TOOLS } from "./session-rule-policy.js";
-import { toolCallFaceOf } from "../tool-roster.js";
+import { anyNamed, callAnswersTo, callFaceSeat, firstNamed, rosterToolName, ruleNamesOf, toolCallFaceOf } from "../tool-roster.js";
 import { noteHostRewrite } from "../frame-settlement.js";
 function screenGateResult(result) {
     if (result.suspend !== undefined)
@@ -85,11 +85,15 @@ export function prepareGateStations(input) {
                 writeProtectionArmed ||
                 shellReadCheck !== undefined;
         if (toolCallGateArmedRef.armed) {
-            harness.on("tool_call", async (e) => {
+            harness.on("tool_call", async (called) => {
+                const e = { ...called, toolName: rosterToolName(toolRosterDeltas.current, called.toolName) };
+                const call = { toolName: e.toolName, ...callFaceSeat(toolCallFaceOf(toolRosterDeltas.current, called.toolName)) };
+                const names = ruleNamesOf(call);
+                const tierSeat = firstNamed(irreversibilityTier, names);
                 blockedToolCalls.delete(e.toolCallId);
                 inheritedAskGrants.delete(e.toolCallId);
                 {
-                    const complianceDeny = complianceCallDenial(complianceDenies, e.toolName);
+                    const complianceDeny = names.map((n) => complianceCallDenial(complianceDenies, n)).find((d) => d !== undefined);
                     if (complianceDeny !== undefined) {
                         if (blockedTracked)
                             blockedToolCalls.add(e.toolCallId);
@@ -113,24 +117,24 @@ export function prepareGateStations(input) {
                         hookTimeoutMs,
                         ...(handsCwdRef !== undefined ? { trackedCwd: () => handsCwdRef.current } : {}),
                         ...(hookEnvFace !== undefined ? { hookEnv: hookEnvFace } : {}),
-                        toolFaceOf: (name) => toolCallFaceOf(toolRosterDeltas.current, name),
+                        toolFaceOf: (name) => toolCallFaceOf(toolRosterDeltas.current, name === e.toolName ? called.toolName : name),
                         adjudicate,
                         resolveAsk: resolveAskBound,
                         suspendAsk,
                         resolveContentAsk,
-                        egress: egressTools.has(e.toolName),
-                        peerMessage: e.toolName === SEND_MESSAGE_TOOL_NAME,
+                        egress: anyNamed(egressTools, names),
+                        peerMessage: callAnswersTo(call, SEND_MESSAGE_TOOL_NAME),
                         ...(writeProtectionCheck !== undefined ? { writeProtectionCheck } : {}),
                         ...(shellReadCheck !== undefined ? { shellReadCheck } : {}),
-                        irreversibility: irreversibilityTier.get(e.toolName),
-                        reversibilityProbe: reversibilityProbes.get(e.toolName),
+                        irreversibility: tierSeat?.value,
+                        reversibilityProbe: tierSeat !== undefined ? reversibilityProbes.get(tierSeat.name) : undefined,
                         abortSignal: abortController.signal,
                         ...(notifyPermissionDenied ? { permissionDenied: notifyPermissionDenied } : {}),
                         onHookError: notifyHookError,
-                        shellGated: shellGatedTools.has(e.toolName),
+                        shellGated: tierSeat !== undefined && shellGatedTools.has(tierSeat.name),
                         ...(autoModeDecider.current !== undefined ? { autoMode: { decider: autoModeDecider.current, ...(autoModeDenialTracking.current !== undefined ? { denialTracking: autoModeDenialTracking.current } : {}), unavailable: classifierUnavailableSeat({ station: "leg", ...(autoModeDecider.current.timeoutMs !== undefined ? { budgetMs: autoModeDecider.current.timeoutMs } : {}), approvalSeat: askReachesPerson(askRoute), onNotice: deps.onNotice, sessionId, runId }) } } : {}),
                         permissionMode: () => permissionMode.current,
-                        ...(() => { const s = toolMarkSources.get(e.toolName); return s !== undefined ? { toolMarkSources: s } : {}; })(),
+                        ...(() => { const s = firstNamed(toolMarkSources, names)?.value; return s !== undefined ? { toolMarkSources: s } : {}; })(),
                         ...(a2aIsolatePeers === true ? { a2aIsolatePeers: true } : {}),
                         onModeReleased,
                         ancestorArbitrationOf: (toolCallId) => ancestorArbitrations.get(toolCallId),
@@ -183,7 +187,7 @@ export function prepareGateStations(input) {
                             ? {
                                 sandboxAdmission: {
                                     askClassesOf: (toolCallId) => foldAskClasses.get(toolCallId),
-                                    boundaryCapable: sandboxBoundaryCapable(e.toolName),
+                                    boundaryCapable: sandboxBoundaryCapable(call),
                                     onAdmitted: emitSandboxAdmitted,
                                 },
                             }