@sema-agent/core 7.34.0 → 7.35.1

package/dist/core/runner/prepare-inherited-gate.d.ts

@@ -66,7 +66,7 @@ export interface PrepareInheritedGateInput {
     /** borrowed-readonly — the trusted spawn-side channel: `inheritedGate` (the LIVE half of the chain fold), `ownOrgAdmissionRef`
      *  (the same-session continuation's freeze), `delegationProvenance` (the F-012 stamp), and the identity / peer / notification
      *  seats the ctx enrichment forwards. Never mutated. */
-    internals: Pick<RunInternals, "inheritedGate" | "ownOrgAdmissionRef" | "delegationProvenance" | "memoryCaptureAncestors" | "parentTaskId" | "parentSessionId" | "rootSessionId" | "placementRoot" | "explicitAgentName" | "peerSelfRef" | "peerInboundChainRef" | "onTaskNotification" | "onSubagentSpawn" | "insideFork" | "questionFaceStripped"> | undefined;
+    internals: Pick<RunInternals, "inheritedGate" | "sessionModeSeats" | "ownOrgAdmissionRef" | "delegationProvenance" | "memoryCaptureAncestors" | "parentTaskId" | "parentSessionId" | "rootSessionId" | "placementRoot" | "explicitAgentName" | "peerSelfRef" | "peerInboundChainRef" | "onTaskNotification" | "onSubagentSpawn" | "insideFork" | "questionFaceStripped"> | undefined;
     /** borrowed-readonly — the resume leg, or undefined on a fresh one: `seed.inheritedGate` is the CHECKPOINT half of the chain
      *  fold (the trust floor the live half may only tighten), `seed.readFace` the hands-less re-park's carried section. */
     resume: Pick<PrepareResume, "seed" | "outcome"> | undefined;
@@ -197,6 +197,13 @@ export interface PrepareInheritedGateResult {
      *  seat, or the checkpoint's recorded word), folded against the arming facts the caps phase binds later. Every mode
      *  consumer reads `current` at its own call; the steer verb writes it. */
     permissionMode: PermissionModeController;
+    /** owned — the leg's commit of its mode seats, called by the driver once prepare succeeded (never on a failed one):
+     *  makes this leg its SESSION's current leg and holds the leg's own engine ceiling until `legSignal` aborts, so each
+     *  move of that ceiling re-judges this leg. */
+    commitModeSeats: (legSignal: AbortSignal) => void;
+    /** owned — the leg has STOPPED (the run leg's teardown, after its loop settled): from here its children read the
+     *  session's current leg. Idempotent; a leg that never reaches it keeps answering its children itself. */
+    endModeCeiling: () => void;
     /** owned — the seed ∩ live admitted org scopes (one side absent ⇒ the other; both absent ⇒ undefined). */
     inheritedAdmittedOrgScopes: readonly string[] | undefined;
     /** owned — the prior own org verdict: checkpoint ∩ same-session ref (either alone stands; neither ⇒ undefined). */

package/dist/core/runner/prepare-inherited-gate.js

@@ -7,6 +7,7 @@ import { StubExecutionEnv } from "../stub-env.js";
 import { askApproverIdentity, durableMandateSourceOf } from "../tool-policy.js";
 import { deliverEngineNotice } from "../types.js";
 import { PermissionModeController, modeRequestAfterResume } from "../mode-policy.js";
+import { SessionModeSeats } from "./session-mode-seats.js";
 import { migrateLegacyModeSeed } from "../checkpoint-store.js";
 import { attachRebuiltDenialTrackers, createDenialLimitStop } from "./denial-limit-arms.js";
 import { asThrownError } from "../thrown-value.js";
@@ -56,6 +57,11 @@ export function prepareInheritedGate(input) {
     };
     const permissionMode = new PermissionModeController(modeRequestAfterResume(permissionModeSeat, modeSeed, resume?.outcome), ceiling, { onFold: announceModeFold, ...(modeSeed.prePlanMode !== undefined ? { prePlanMode: modeSeed.prePlanMode } : {}) });
     announceModeFold(permissionMode.receipt());
+    const { ceiling: legModeCeiling, commit: commitLegModeCeiling, end: endModeCeiling } = (internals?.sessionModeSeats ?? new SessionModeSeats()).legCeiling(sessionId, permissionMode);
+    const commitModeSeats = (legSignal) => {
+        commitLegModeCeiling();
+        parentSeat?.hold?.(permissionMode, legSignal);
+    };
     const liveAdmittedOrg = liveInheritedGate?.admittedOrgScopes;
     const seedAdmittedOrg = seedInheritedGate?.admittedOrgScopes;
     const inheritedAdmittedOrgScopes = liveAdmittedOrg === undefined ? seedAdmittedOrg : seedAdmittedOrg === undefined ? liveAdmittedOrg : liveAdmittedOrg.filter((s) => seedAdmittedOrg.includes(s));
@@ -156,7 +162,7 @@ export function prepareInheritedGate(input) {
                     ...(durableMandate ? { durableMandate: true } : {}),
                     ...(contentMandate ? { contentMandate: true } : {}),
                     ...(autoModeDecider !== undefined
-                        ? { autoMode: { decider: autoModeDecider, ...(autoModeDenialTracking !== undefined ? { denialTracking: autoModeDenialTracking } : {}), ...(autoModeArming !== undefined ? { arming: autoModeArming } : {}) } }
+                        ? { autoMode: { decider: autoModeDecider, ...(autoModeDenialTracking !== undefined ? { denialTracking: autoModeDenialTracking } : {}), ...(autoModeArming !== undefined ? { arming: autoModeArming } : {}), liveMode: legModeCeiling } }
                         : {}),
                 },
             ]
@@ -172,7 +178,7 @@ export function prepareInheritedGate(input) {
                         ...(durableMandate ? { durableMandate: true } : {}),
                         ...(contentMandate ? { contentMandate: true } : {}),
                         ...(autoModeDecider !== undefined
-                            ? { autoMode: { decider: autoModeDecider, ...(autoModeDenialTracking !== undefined ? { denialTracking: autoModeDenialTracking } : {}), ...(autoModeArming !== undefined ? { arming: autoModeArming } : {}) } }
+                            ? { autoMode: { decider: autoModeDecider, ...(autoModeDenialTracking !== undefined ? { denialTracking: autoModeDenialTracking } : {}), ...(autoModeArming !== undefined ? { arming: autoModeArming } : {}), liveMode: legModeCeiling } }
                             : {}),
                     },
                 ]
@@ -182,7 +188,7 @@ export function prepareInheritedGate(input) {
             ...(ancestorRules.length > 0 ? { ancestorRules } : {}),
             ...(effectiveShellGate !== undefined ? { shellGate: effectiveShellGate } : {}),
             permissionMode: permissionMode.current,
-            permissionModeCeiling: { get current() { return permissionMode.current; }, sessionId },
+            permissionModeCeiling: legModeCeiling,
             ...(parentConstraints.length > 0 ? { parentConstraints } : {}),
             admittedOrgScopes: memoryAdmittedOrgScopesRef.current,
             ...(orgGovernedProvenance ? { orgAdmissionGoverned: true } : {}),
@@ -295,5 +301,5 @@ export function prepareInheritedGate(input) {
             ...(spec.enablePlanMode === true ? { enterPlanMode } : {}),
         };
     };
-    return { liveInheritedGate, seedInheritedGate, inheritedAncestorRules, inheritedShellGate, inheritedParentConstraints, permissionMode, inheritedAdmittedOrgScopes, priorOwnOrgVerdict, orgGovernedProvenance, effectiveShellGate, ownSessionRulesRef, ancestorSessionRulesRef, ancestorRulesNow, memoryAdmittedOrgScopesRef, ownOrgVerdictRef, orgAdmissionCheckpointState, faceCheckpointSection, faceCheckpointState, writeFaceCheckpointSection, f012CheckpointState, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, frozenOnQuestion, parentSpecSeat, provenanceForChildrenRef, delegationSettlementRef, inheritedGateForChildren, carrierReadFace, carrierWriteFace, fullShellReachable, gateStopRef, stopForDenialLimit, enrichSpecToolCtx };
+    return { liveInheritedGate, seedInheritedGate, inheritedAncestorRules, inheritedShellGate, inheritedParentConstraints, permissionMode, commitModeSeats, endModeCeiling, inheritedAdmittedOrgScopes, priorOwnOrgVerdict, orgGovernedProvenance, effectiveShellGate, ownSessionRulesRef, ancestorSessionRulesRef, ancestorRulesNow, memoryAdmittedOrgScopesRef, ownOrgVerdictRef, orgAdmissionCheckpointState, faceCheckpointSection, faceCheckpointState, writeFaceCheckpointSection, f012CheckpointState, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, frozenOnQuestion, parentSpecSeat, provenanceForChildrenRef, delegationSettlementRef, inheritedGateForChildren, carrierReadFace, carrierWriteFace, fullShellReachable, gateStopRef, stopForDenialLimit, enrichSpecToolCtx };
 }

package/dist/core/runner/prepare-park-ask.d.ts

@@ -29,7 +29,7 @@ import type { RunnerDeps, RuntimeCaps, ShellGateDoctrine, TaskSpec } from "../ty
 import type { CwdRef } from "../../tools/fs/fs-shared.js";
 import type { AdvertisedWritableDirs } from "./advertised-writable-dirs.js";
 import { type ContentAskBinding } from "./content-ask-bindings.js";
-import type { AskLane, ParkAsk, Prepared, SuspendSaga } from "./contracts.js";
+import type { AskLane, IrreversibilityTier, ParkAsk, Prepared, SuspendSaga } from "./contracts.js";
 import type { createRuleOffersOf } from "./permission-rule-lanes.js";
 import { type ToolRosterDeltaSeat } from "../tool-roster.js";
 export interface PrepareParkAskInput {
@@ -112,8 +112,10 @@ export interface PrepareParkAskInput {
     /** borrowed-mutable — the run-scoped remote-lifecycle failure log. Writer here: a refused `suspendVM` (`push`). */
     remoteEnvFailures: Prepared["remoteEnvFailures"];
     /** borrowed-readonly — the shell-seat provenance set: the shell-running tools whose tier is the engine's shell seat's, not a
-     *  deployment mark (the risk descriptor's `shellGated` is the gated tool's membership). */
+     *  deployment mark (the risk descriptor's `shellGated` is the membership of the name the call's tier is read under). */
     shellGatedTools: ReadonlySet<string>;
+    /** borrowed-readonly — the per-tool tier, read only for the name the call's tier seat is read under (as at the gate). */
+    irreversibilityTier: IrreversibilityTier;
     /** borrowed-readonly — the operator's shell floor (`"always"`), persisted on a shell-gated descriptor; undefined = no floor. */
     effectiveShellGate: ShellGateDoctrine | undefined;
     /** borrowed-readonly — the EFFECTIVE durable-approval opt-in (the caller's, or the synthesized mandate scope): picks the

package/dist/core/runner/prepare-park-ask.js

@@ -15,7 +15,7 @@ import { checkpointScopeOf } from "./checkpoint-scope.js";
 import { CONTENT_ASK_BINDING_CAP } from "./content-ask-bindings.js";
 import { DEFAULT_UNATTENDED_APPROVAL_TTL_MS, publishCommittedSuspend, sanitizedTtlMs } from "./park-commit.js";
 import { remoteEnvFailureNote } from "./remote-env-retry.js";
-import { callFaceSeat, parkedToolIdentity, parkedToolFace } from "../tool-roster.js";
+import { callFaceSeat, firstNamed, parkedToolIdentity, parkedToolFace, ruleNamesOf } from "../tool-roster.js";
 class ParkRefusal extends Error {
     constructor(message, options) {
         super(message, options);
@@ -26,7 +26,7 @@ const wordlessDemand = (toolName) => {
     throw new Error(`a real-approval demand for "${toolName}" reached the park with no origin word — the origin stamp precedes every park`);
 };
 export function prepareParkAsk(input) {
-    const { askLane, saga, spec, deps, sessionId, checkpointStore, toolRosterDeltas, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, advertisedWritableDirs, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedTools, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, ruleOffersOf, now, humanReviewRef, abortController, harness, pausedRef } = input;
+    const { askLane, saga, spec, deps, sessionId, checkpointStore, toolRosterDeltas, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, advertisedWritableDirs, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedTools, irreversibilityTier, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, ruleOffersOf, now, humanReviewRef, abortController, harness, pausedRef } = input;
     if (askLane === undefined || saga === undefined)
         return { parkAsk: undefined };
     const { composedCallSignal, approvalPreviewOf } = askLane;
@@ -234,6 +234,7 @@ export function prepareParkAsk(input) {
                     remoteHandle = parkOnlyHandle(parkOnlyRemoteEnv);
                 }
                 token = mintCheckpointToken();
+                const tierSeat = firstNamed(irreversibilityTier, ruleNamesOf(req));
                 const riskDescriptor = buildRiskDescriptor({
                     toolName: req.toolName,
                     args: parkedArgs,
@@ -241,7 +242,7 @@ export function prepareParkAsk(input) {
                     ...(shadowedRule !== undefined ? { shadowedRule } : {}),
                     ...(probeReason !== undefined ? { probeReason } : {}),
                     ...(probeCause !== undefined ? { probeCause } : {}),
-                    shellGated: shellGatedTools.has(req.toolName),
+                    shellGated: tierSeat !== undefined && shellGatedTools.has(tierSeat.name),
                     ...(effectiveShellGate !== undefined ? { shellGateDoctrine: effectiveShellGate } : {}),
                 });
                 gate =
@@ -316,7 +317,7 @@ export function prepareParkAsk(input) {
                         ...(rowRealApproval !== undefined ? { requiresRealApproval: true } : {}),
                         ...askMandateMember(clearanceFacts),
                         ...askCarryRowMembers(carry),
-                        ...ruleOffersOf(req.toolName, parkedArgs, clearanceFacts),
+                        ...ruleOffersOf(req, parkedArgs, clearanceFacts),
                         boundInputHash: boundInputHashOf(parkedArgs),
                         batchToolCallIds,
                         completedCallIds,

package/dist/core/runner/prepare-policy-chain.d.ts

@@ -35,6 +35,7 @@ import type { InheritedGate, IrreversibilityTier, PrepareResume, RunInternals, S
 import { type Arbitration } from "../ask-origin.js";
 import { type ModeGateSeats, type PermissionModeController } from "../mode-policy.js";
 import { createRuleOffersOf, type PermissionRuleLanes } from "./permission-rule-lanes.js";
+import type { ToolCallLike } from "../tool-registry.js";
 export interface PreparePolicyChainInput {
     /** borrowed-readonly — the REBOUND spec. Read: `sessionId` / `principal` (the session-rule read and the lanes' identity),
      *  `hooks` (spec over deps), `durableApproval` / `checkpointStore` (the mandate-park facility test and the sandbox arming's park prerequisites), `taskId` (the late-ask observer's detail).
@@ -199,7 +200,7 @@ export interface PreparePolicyChainResult {
         isDelegatedChild?: true;
     };
     /** owned — the engine-judged risk axes for an ask, from the same resolved sources the safety tightens use. */
-    riskAxesOf: (toolName: string) => {
+    riskAxesOf: (call: Pick<ToolCallLike, "toolName" | "face">) => {
         riskAxes?: {
             irreversible?: boolean;
             egress?: boolean;
@@ -214,7 +215,7 @@ export interface PreparePolicyChainResult {
     /** owned — whether the sandbox-admission mode armed (declared isolation with its park prerequisites). */
     sandboxAdmissionArmed: boolean;
     /** owned — the NOT-CONTAINED classification: a call the declared sandbox does not contain. */
-    sandboxBoundaryCapable: (toolName: string) => boolean;
+    sandboxBoundaryCapable: (call: Pick<ToolCallLike, "toolName" | "face">) => boolean;
     /** owned — the admission disclosure's trace emitter (the gate station emits it once the fold settles). */
     emitSandboxAdmitted: (info: {
         toolCallId: string;