@sema-agent/core 7.35.1 → 7.36.0

package/dist/core/ask-question.js

@@ -5,7 +5,7 @@ import { defineTool, errorResult } from "./tools.js";
 import { delimitUntrusted, inlineUntrusted } from "./untrusted-text.js";
 import { toolFace } from "./tool-catalog-entries.js";
 import { thrownText } from "./thrown-value.js";
-import { callAnswersTo } from "./tool-roster.js";
+import { heldBy } from "./tool-name-readings.js";
 export const ASK_USER_QUESTION_TOOL_NAME = "AskUserQuestion";
 export function classifyQuestionOutcome(outcome) {
     let unavailable;
@@ -132,10 +132,11 @@ export function validateAskQuestions(questions) {
     }
     return undefined;
 }
+const QUESTION_TOOL_NAMES = new Set([ASK_USER_QUESTION_TOOL_NAME]);
 export function createDurableQuestionPolicy() {
     return {
         check(req) {
-            if (!callAnswersTo(req, ASK_USER_QUESTION_TOOL_NAME)) {
+            if (!heldBy("policy.durableQuestion", QUESTION_TOOL_NAMES, req)) {
                 return { action: "allow" };
             }
             return { action: "ask", message: "AskUserQuestion: awaiting a human answer (durable)" };

package/dist/core/checkpoint-store.d.ts

@@ -868,9 +868,11 @@ export type PendingAction = {
      */
     family?: import("./tool-face.js").ToolFamily;
     pathTarget?: import("./tool-face.js").ToolRosterPathTarget;
-    /** The names a rule may spell the parked tool by (`ToolCallFace.names`: the wire name, then the aliases that resolve
-     *  to it) off the same roster row at the same mint — the pre-CAS recheck judges an edit against rules written on
-     *  either name, as the live gate judged the original. Absent on a row minted before it ⇒ the row's `toolName` alone. */
+    /** The names the parked call answered to, copied from the face the gate judged it under (`ToolCallFace.names`: the
+     *  model's spelling first, then the wire name and the other aliases that resolve to it; a row minted before the
+     *  spelling led carries the wire name first) — the pre-CAS recheck judges an edit against rules written on any of
+     *  them, as the live gate judged the original, and the resume re-mints its face under the spelling while it still
+     *  resolves to the row's tool. Absent on a row minted before it ⇒ the row's `toolName` alone. */
     names?: readonly string[];
     /**
      * #438 (additive; no checkpoint-version bump — the `reminderMark` precedent: an optional field an

package/dist/core/checkpoint-store.js

@@ -9,6 +9,7 @@ import { renderUntrustedCommandText, stripFormatCharacters } from "./permission-
 import { redactSecrets } from "./untrusted-egress.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "./ask-question.js";
 import { isPermissionMode } from "./ask-origin.js";
+import { wireOf } from "./tool-name-readings.js";
 export function mintCheckpointToken() {
     return randomBytes(16).toString("hex");
 }
@@ -290,7 +291,7 @@ export function summarizeCheckpoint(cp) {
         ...(cp.sourceTaskId !== undefined ? { sourceTaskId: cp.sourceTaskId } : {}),
         ...(cp.principal !== undefined ? { principal: cp.principal } : {}),
         ...(tool !== undefined ? { toolCallId: tool.toolCallId, toolName: tool.toolName } : {}),
-        ...(tool?.toolName === ASK_USER_QUESTION_TOOL_NAME ? { contentKind: "content_ask" } : {}),
+        ...(tool !== undefined && wireOf("park.contentKindProjection", tool) === ASK_USER_QUESTION_TOOL_NAME ? { contentKind: "content_ask" } : {}),
         ...(toolInput !== undefined ? { toolInput } : {}),
         ...(cp.state.workspaceHandle !== undefined
             ? { restoreMode: cp.state.workspaceHandle.restoreMode === "park_only" ? "park_only" : "snapshot" }

package/dist/core/context-edit.d.ts

@@ -171,6 +171,9 @@ export interface ContextEditOptions {
      * registry state are compaction's job, not a blanking marker's.
      */
     compactableTools?: ReadonlySet<string>;
+    /** The wire name a result's recorded tool name resolves to on the leg's roster (a result is clearable by the tool the
+     *  call ran, not the spelling the model used). Absent ⇒ the recorded name. */
+    toolNameOf?: (recorded: string) => string;
     /**
      * design/374 (RB-212 durable half): the PRE-CAP counterpart array of `messages`, position-aligned
      * (the pipeline's aggregate caps replace in place, never drop). When present, the machine
@@ -316,6 +319,7 @@ export declare function planRejectionClears(messages: AgentMessage[], opts: {
     keyOf: OccurrenceIndex["keyOf"];
     offload?: ContextEditOptions["offload"];
     compactableTools?: ReadonlySet<string>;
+    toolNameOf?: (recorded: string) => string;
     keepRecentToolResults?: number;
 }): RejectionClearPlan;
 /**

package/dist/core/context-edit.js

@@ -5,6 +5,7 @@ import { physicalWindowOf } from "./context-settings.js";
 import { PERSISTED_OUTPUT_PREFIX, offloadPagebackHint } from "./tool-result-store.js";
 import { assertNoRetiredKeys } from "./retired-keys.js";
 import { compactableToolNames } from "./tool-registry.js";
+import { wireOf } from "./tool-name-readings.js";
 const CC_CLEARED_MARKER = "[Old tool result content cleared]";
 const CC_CLEARED_EXTENDED_PREFIX = "[Old tool result content cleared —";
 const refNote = (ref) => offloadPagebackHint(ref, "cleared");
@@ -47,6 +48,7 @@ function resolveKeepRecentToolResults(value, defaultValue) {
     return Math.max(MIN_KEEP_RECENT_TOOL_RESULTS, value);
 }
 const COMPACTABLE_TOOLS = compactableToolNames();
+const compactableResult = (compactable, recorded, toolNameOf) => compactable.has(wireOf("compaction.compactableResult", { toolName: toolNameOf !== undefined ? toolNameOf(recorded) : recorded }));
 function soleMarkerText(m) {
     const content = m.content;
     if (!Array.isArray(content) || content.length !== 1)
@@ -127,6 +129,7 @@ const CONTEXT_EDIT_OPTION_KEYS = new Set([
     "anchoredTotalTokens",
     "charsPerToken",
     "compactableTools",
+    "toolNameOf",
     "clearSource",
 ]);
 const RETIRED_CONTEXT_EDIT_OPTION_KEYS = {
@@ -159,7 +162,7 @@ export function clearStaleToolResults(messages, opts) {
     }
     const keep = resolveKeepRecentToolResults(opts.keepRecentToolResults, CC_DEFAULT_KEEP_RECENT_TOOL_RESULTS);
     const compactable = opts.compactableTools ?? COMPACTABLE_TOOLS;
-    const candidates = messages.flatMap((m, i) => isToolResult(m) && compactable.has(m.toolName) ? [{ idx: i, target: m }] : []);
+    const candidates = messages.flatMap((m, i) => isToolResult(m) && compactableResult(compactable, m.toolName, opts.toolNameOf) ? [{ idx: i, target: m }] : []);
     const beyondKeep = candidates.slice(0, Math.max(0, candidates.length - keep));
     const clearable = beyondKeep.filter(({ target }) => !isCleared(target));
     if (clearable.length === 0) {
@@ -223,7 +226,7 @@ function occurrenceGroupId(m) {
 export function planRejectionClears(messages, opts) {
     const keep = resolveKeepRecentToolResults(opts.keepRecentToolResults, CC_DEFAULT_KEEP_RECENT_TOOL_RESULTS);
     const compactable = opts.compactableTools ?? COMPACTABLE_TOOLS;
-    const candidates = messages.flatMap((m) => (isToolResult(m) && compactable.has(m.toolName) ? [m] : []));
+    const candidates = messages.flatMap((m) => (isToolResult(m) && compactableResult(compactable, m.toolName, opts.toolNameOf) ? [m] : []));
     const beyondKeep = candidates.slice(0, Math.max(0, candidates.length - keep));
     const clearable = beyondKeep.flatMap((m) => {
         if (isCleared(m))

package/dist/core/engine-notice.d.ts

@@ -251,6 +251,13 @@ export interface EngineNotice {
      *    (requested, reported) PAIR — a catalog fact, not a turn fact. Audience `operator`;
      *    `detail: { requested, reported, sessionId, runId }`. Absent ⇒ the provider echoed the requested id
      *    or named nothing — one reading, not two.
+     *  - `"route.tool_call_id_folded"` (#1207) — the provider named a tool call with an id outside the shape the
+     *    engine keys calls under (visible ASCII, 1–128, no `~`), so the brain keyed it under a deterministic fold
+     *    (`ToolCall.id`) and keeps the provider's spelling beside it (`ToolCall.wireId`), handed back only to the
+     *    provider. Advisory: the run is unchanged. ONCE PER RUN, on the first folded call — a gateway fact, not a
+     *    call fact. Audience `operator`; `detail: { toolCallId, rawLength, reason, sessionId, runId }` —
+     *    `toolCallId` the engine id, `reason` `"charset"` (a control byte, a space, a non-ASCII unit or `~`) or
+     *    `"length"` (admitted characters, over 128); never the raw bytes. Absent ⇒ no call of the run was folded.
      *  - `"config.read_face_deployment_clamped"` (#237) — a deployment-wide `readFace: "open"` is not
      *    in force beside a read-only (verifier) mount: it clamps to "roots" without throwing
      *    (stricter-wins; the clamp verdict stands, only its occurrence was undisclosed). Announced

package/dist/core/gate-lanes.js

@@ -11,13 +11,15 @@ import { CD_GIT_COMPOUND_SENTENCE, changesDirectoryBeforeGit, readOnlyShellVerdi
 import { readShellCommand } from "./shell-lexer.js";
 import { COMMAND_RULE_TOOL } from "./permission-rule-model.js";
 import { catalogRuleFaceOf } from "./tool-registry.js";
-import { callAnswersTo, callFaceSeat } from "./tool-roster.js";
+import { callFaceSeat } from "./tool-roster.js";
+import { heldBy, wireOf } from "./tool-name-readings.js";
 import { modeAcceptsFileCommand } from "./mode-policy.js";
 import { ORG_ADJUDICATION_TIMEOUT_MS, ORG_RULE_DECISION_REASON, ORG_UNAVAILABLE_DECISION_REASON, settleOrgVerdictWithin } from "./permission-rule-org.js";
 import { exitGate } from "./runner/gate-exit.js";
 import { traceHookCrash } from "./gate-crash-trace.js";
 import { createGateDeadline, awaitWriteProtectionJudgment, withGateTimeout } from "./gate-bounded-await.js";
 import { thrownText } from "./thrown-value.js";
+const QUESTION_TOOL_NAMES = new Set([ASK_USER_QUESTION_TOOL_NAME]);
 function isPlainOwnRecord(x) {
     try {
         if (x === null || typeof x !== "object" || Array.isArray(x))
@@ -170,7 +172,7 @@ export async function runGateLanes(pass) {
         writeProtectionUnresolved: pass.writeProtectionUnresolved === true,
     });
     const askOriginFacts = (org, ruleCallUnreadable) => ({
-        contentQuestion: callAnswersTo(pass.req, ASK_USER_QUESTION_TOOL_NAME),
+        contentQuestion: heldBy("lanes.contentQuestionClass", QUESTION_TOOL_NAMES, pass.req),
         markedUnresolvable: markedUnresolvable(),
         org,
         ...(ruleCallUnreadable ? { ruleCallUnreadable } : {}),
@@ -195,7 +197,7 @@ export async function runGateLanes(pass) {
     const applyOrgLayer = async (current, args) => {
         if (input.orgRules === undefined)
             return { decision: current, org: undefined };
-        if (toolName === ASK_USER_QUESTION_TOOL_NAME && input.orgRules.contentAskToolMounted === true)
+        if (wireOf("lanes.orgContentAskExemption", pass.req) === ASK_USER_QUESTION_TOOL_NAME && input.orgRules.contentAskToolMounted === true)
             return { decision: current, org: undefined };
         let decided = current;
         let pending;
@@ -271,7 +273,7 @@ export async function runGateLanes(pass) {
         return await settleOrgVerdictWithin(pendingHit.then(normalizePersistedRuleHit).catch(() => ({ unreadable: true })), { unreadable: true }, { ...(input.abortSignal !== undefined ? { signal: input.abortSignal } : {}), timeoutMs: ORG_ADJUDICATION_TIMEOUT_MS });
     };
     const laneReq = { ...pass.req, ...(pass.policyRewrite !== undefined ? { args: pass.policyRewrite } : {}) };
-    const laneAnswer = input.persistedRules !== undefined && pass.req.toolName !== ASK_USER_QUESTION_TOOL_NAME ? await readPersistedRules(laneReq) : undefined;
+    const laneAnswer = input.persistedRules !== undefined && wireOf("lanes.persistedLaneSkip", pass.req) !== ASK_USER_QUESTION_TOOL_NAME ? await readPersistedRules(laneReq) : undefined;
     {
         const tightened = applyPersistedTightening(pass.decision, laneAnswer);
         pass.decision = tightened.decision;
@@ -299,7 +301,7 @@ export async function runGateLanes(pass) {
             pass.decision.action === "ask" &&
             pass.decision.requiresRealApproval !== true &&
             pass.decision.decisionReason !== "hook" &&
-            pass.req.toolName !== ASK_USER_QUESTION_TOOL_NAME &&
+            wireOf("lanes.allowLayerQuestionSkip", pass.req) !== ASK_USER_QUESTION_TOOL_NAME &&
             !markedUnresolvable();
         if (input.persistedRules && allowLayerMayClear()) {
             const answer = laneAnswer ?? {};
@@ -356,7 +358,7 @@ export async function runGateLanes(pass) {
             classifyStanding(stamped, originFacts);
             pass.decision = stampAskOrigin(stamped, originFacts);
         }
-        if (allowLayerMayClear() && pass.decision.action === "ask" && ruleMayClear() && pass.probeBoundaryDeclined !== true && pass.req.toolName === COMMAND_RULE_TOOL) {
+        if (allowLayerMayClear() && pass.decision.action === "ask" && ruleMayClear() && pass.probeBoundaryDeclined !== true && wireOf("lanes.readOnlyShellAllow", pass.req) === COMMAND_RULE_TOOL) {
             const commandParam = catalogRuleFaceOf(COMMAND_RULE_TOOL)?.primaryParams[0] ?? "command";
             const args = pass.req.args;
             const command = typeof args === "object" && args !== null && !Array.isArray(args) ? args[commandParam] : undefined;
@@ -435,7 +437,7 @@ export async function runGateLanes(pass) {
         }
         if (input.sandboxAdmission !== undefined &&
             pass.decision.action === "ask" &&
-            pass.req.toolName !== ASK_USER_QUESTION_TOOL_NAME &&
+            wireOf("lanes.sandboxQuestionSkip", pass.req) !== ASK_USER_QUESTION_TOOL_NAME &&
             input.isMarkedUnresolvable?.(input.event.toolCallId) !== true &&
             pass.decision.requiresRealApproval !== true &&
             pass.decision.decisionReason !== "hook" &&
@@ -463,7 +465,7 @@ export async function runGateLanes(pass) {
         if (pass.decision.action === "ask" && input.permissionMode !== undefined && pass.askClassification !== undefined) {
             const standing = pass.decision;
             const mode = input.permissionMode();
-            const fileCommandByWord = modeAcceptsFileCommand(mode, toolName, pass.policyRewrite ?? pass.currentInput);
+            const fileCommandByWord = modeAcceptsFileCommand(mode, wireOf("lanes.modeFileCommand", pass.req), pass.policyRewrite ?? pass.currentInput);
             const verdict = arbitrateByMode(mode, pass.askClassification, { ...(standing.origin !== undefined ? { origin: standing.origin } : {}), ...(standing.mandate !== undefined ? { mandate: standing.mandate } : {}) }, { fileCommand: pass.shellWritesPlaced === true && fileCommandByWord });
             if (verdict.kind === "ask" && fileCommandByWord && pass.shellWritesPlaced !== true && pass.shellUnplacedOptions !== undefined && pass.askClassification.classes.size === 1 && pass.askClassification.classes.has("ordinary")) {
                 pass.decision = { ...standing, message: fileCommandOptionsSentence(pass.shellUnplacedOptions.program) };
@@ -528,7 +530,7 @@ export async function runGateLanes(pass) {
                     return { suspend: suspended, preToolContext: pass.preToolContext };
             }
         }
-        if (pass.decision.action === "ask" && pass.req.toolName === ASK_USER_QUESTION_TOOL_NAME) {
+        if (pass.decision.action === "ask" && wireOf("lanes.contentAskRoute", pass.req) === ASK_USER_QUESTION_TOOL_NAME) {
             const outcome = input.resolveContentAsk !== undefined ? await (callSignal !== undefined ? input.resolveContentAsk(pass.req, callSignal) : input.resolveContentAsk(pass.req)) : { kind: "unavailable", parkDeclined: false };
             if (outcome.kind === "answered") {
                 pass.decision = { action: "allow", updatedInput: outcome.presentedInput };
@@ -692,7 +694,7 @@ export async function runGateLanes(pass) {
                         break;
                     }
                     let editRuleCallUnreadable = false;
-                    if (input.persistedRules !== undefined && toolName !== ASK_USER_QUESTION_TOOL_NAME) {
+                    if (input.persistedRules !== undefined && wireOf("lanes.persistedEditSkip", pass.req) !== ASK_USER_QUESTION_TOOL_NAME) {
                         const editLane = await readPersistedRules({ toolName, args: editArgs, toolCallId, ...(pass.req.face !== undefined ? { face: pass.req.face } : {}) });
                         editRuleCallUnreadable = ruleCallUnreadableOf(editLane);
                         const editTightened = applyPersistedTightening(recheck, editLane);

package/dist/core/governance-codes.d.ts

@@ -135,7 +135,7 @@ export type NoticeAudience = "user" | "operator";
  * the union's catalog ({@link EngineNotice.code}). The groups below say only which family a row joins,
  * so the catalog is not written a second time here and the two cannot drift.
  */
-export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.context_settings_swapped", "config.read_face_swapped", "config.read_face_deployment_clamped", "config.write_face_swapped", "config.write_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.artifact_host_invalid", "config.task_root_not_canonical", "config.write_protection_target_view_absent", "config.write_protection_unresolved", "config.execution_env_capability_invalid", "config.tool_card_undeclared", "config.tool_face_undeclared", "config.tool_face_invalid", "config.forward_sink_failed", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "config.secret_env_scrubbed", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "resume.legacy_mode_seed_migrated", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "classifier.fallback", "classifier.role_defaulted", "classifier.contract_broken", "classifier.unavailable", "checkpoint.execution_outcome_unrecorded", "delegation.transcript_integrity", "delegation.ask_unresolvable", "mcp.injection_dropped", "mcp.revocation_probe_failed", "mcp.server_redialed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "memory.restore_withheld", "memory.project_scope_absent", "route.fallback_to_primary", "route.classifier_unroutable", "route.base_url_changed_key_unchanged", "route.response_model_mismatch", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "task.interrupt_unconsumed", "approval.read_root_granted", "approval.read_root_grant_rejected", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "skills.listing_truncated", "agents.listing_truncated", "tool_result.offload_put_failed"];
+export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.context_settings_swapped", "config.read_face_swapped", "config.read_face_deployment_clamped", "config.write_face_swapped", "config.write_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.artifact_host_invalid", "config.task_root_not_canonical", "config.write_protection_target_view_absent", "config.write_protection_unresolved", "config.execution_env_capability_invalid", "config.tool_card_undeclared", "config.tool_face_undeclared", "config.tool_face_invalid", "config.forward_sink_failed", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "config.secret_env_scrubbed", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "resume.legacy_mode_seed_migrated", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "classifier.fallback", "classifier.role_defaulted", "classifier.contract_broken", "classifier.unavailable", "checkpoint.execution_outcome_unrecorded", "delegation.transcript_integrity", "delegation.ask_unresolvable", "mcp.injection_dropped", "mcp.revocation_probe_failed", "mcp.server_redialed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "memory.restore_withheld", "memory.project_scope_absent", "route.fallback_to_primary", "route.classifier_unroutable", "route.base_url_changed_key_unchanged", "route.response_model_mismatch", "route.tool_call_id_folded", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "task.interrupt_unconsumed", "approval.read_root_granted", "approval.read_root_grant_rejected", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "skills.listing_truncated", "agents.listing_truncated", "tool_result.offload_put_failed"];
 /** A code this engine mints (see {@link ENGINE_NOTICE_CODES}). NOT the type of
  *  `EngineNotice.code`, which stays `string` — a host forwarding its own notices through the same
  *  sink is a supported shape, and narrowing that field would break it. */

package/dist/core/governance-codes.js

@@ -178,6 +178,7 @@ export const ENGINE_NOTICE_CODES = [
     "route.classifier_unroutable",
     "route.base_url_changed_key_unchanged",
     "route.response_model_mismatch",
+    "route.tool_call_id_folded",
     "task.user_steer_undrained",
     "task.user_followup_undrained",
     "steering.parked_input_blocked",
@@ -269,6 +270,7 @@ const NOTICE_AUDIENCE_TABLE = {
     "route.classifier_unroutable": "operator",
     "route.base_url_changed_key_unchanged": "operator",
     "route.response_model_mismatch": "operator",
+    "route.tool_call_id_folded": "operator",
     "skills.listing_truncated": "operator",
     "agents.listing_truncated": "operator",
     "tool_result.offload_put_failed": "operator",

package/dist/core/hooks.d.ts

@@ -474,6 +474,9 @@ export interface PostToolUseFailureResult {
 /** One resolved call in a postToolBatch payload (CC PostToolBatchToolCall shape, thin projection —
  *  `response` is a bounded text digest of the result, never the full details object). */
 export interface PostToolBatchCall {
+    /** The name the model spelled on the tool_use block (an alias stays an alias) — the reference's PostToolBatch payload
+     *  names each block the same way, while the per-call post hooks receive the resolved tool's wire name. Correlate
+     *  the two faces by `toolCallId`. */
     toolName: string;
     input: unknown;
     toolCallId: string;

package/dist/core/hooks.js

@@ -11,6 +11,7 @@ import { isAskOrigin } from "./ask-origin.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 export { formatHookFeedback } from "./reminder-mint.js";
 import { createSafeNotifier } from "./safe-notify.js";
+import { wireOf } from "./tool-name-readings.js";
 export const DEFAULT_HOOK_TIMEOUT_MS = 600_000;
 export const MAX_HOOK_TIMEOUT_MS = 2_147_483_647;
 const POST_ABORT_GRACE_MS = 1_000;
@@ -247,9 +248,10 @@ export async function runToolGate(input) {
     const { event, preToolUse, adjudicate, resolveAsk, suspendAsk } = input;
     const { toolCallId, toolName } = event;
     const callSignal = input.callSignal;
+    const screenedName = wireOf("gate.preToolUse", event);
     const hookCtx = (seatSignal) => ({
         toolCallId,
-        toolName,
+        toolName: screenedName,
         ...(seatSignal !== undefined ? { signal: seatSignal } : {}),
         ...(() => {
             const c = input.trackedCwd?.();
@@ -284,7 +286,7 @@ export async function runToolGate(input) {
     };
     const screening = preToolUse !== undefined
         ? {
-            screen: (args) => runHookSeat("preToolUse", seatBound(true), (sig) => preToolUse(toolName, args, hookCtx(sig))),
+            screen: (args) => runHookSeat("preToolUse", seatBound(true), (sig) => preToolUse(screenedName, args, hookCtx(sig))),
             screened: screenPreToolUseResult,
             crashReason: preToolUseCrashReason,
             unansweredReason: preToolUseUnansweredBlock,

package/dist/core/mode-policy.js

@@ -1,6 +1,7 @@
 import { createFsWriteGatePolicy } from "./fs-write-gate-policy.js";
 import { isProtectedWrite } from "./tool-registry.js";
 import { rosterEntryNamed } from "./tool-roster.js";
+import { wireOf } from "./tool-name-readings.js";
 import { clampPermissionMode } from "./ask-origin.js";
 import { argvOf, lexShellText } from "../shell/lex.js";
 import { COMMAND_RULE_TOOL } from "./permission-rule-model.js";
@@ -42,7 +43,7 @@ const ENGINE_ROSTER_SOURCES = new Set(["builtin", "synthetic"]);
 export function planRefusesWrite(req, roster, readOnlyDeclared) {
     if (isProtectedWrite(req))
         return true;
-    const row = roster === undefined ? undefined : rosterEntryNamed(roster, req.toolName);
+    const row = roster === undefined ? undefined : rosterEntryNamed(roster, wireOf("mode.planRosterRow", req));
     return row !== undefined && !ENGINE_ROSTER_SOURCES.has(row.source) && row.effect !== "read" && !(row.effectProvenance === "default" && readOnlyDeclared?.(row.name) === true);
 }
 const planAsk = (message) => ({ action: "ask", message, decisionReason: "mode" });

package/dist/core/permission-rule-model.d.ts

@@ -141,8 +141,8 @@ export declare const READ_RULE_TOOL = "Read";
  * catalog's declarations, exactly as the protective fences' covered set does.
  */
 export declare function ruleToolGrammarOf(toolName: string): "command" | "path" | undefined;
-/** The names the persisted grammar judges a call under: every one of the call's rule names (`ruleNamesOf` — the wire
- *  name, then the aliases that resolve to it) the grammar speaks for, so a stored `Bash(…)` or `Edit(…)` row reaches a
+/** The names the persisted grammar judges a call under: every name the call answers to (the model's spelling, the wire
+ *  name, the other aliases that resolve to it) the grammar speaks for, so a stored `Bash(…)` or `Edit(…)` row reaches a
  *  tool that answers to that name under another wire name, as a policy's rule does. Empty ⇒ the grammar speaks for none. */
 export declare function laneToolNamesOf(req: Pick<import("./tool-policy.js").ToolCallRequest, "toolName" | "face">): readonly string[];
 /**

package/dist/core/permission-rule-model.js

@@ -4,7 +4,7 @@ import { compileReadDeny } from "../tools/fs/read-deny.js";
 import { carriesShellRedirection, parseLeadingCommandName, splitShellCompoundSegments } from "../tools/fs/bash-readonly-classifier.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 import { pathTargetOf } from "./tool-registry.js";
-import { ruleNamesOf } from "./tool-roster.js";
+import { heldValues } from "./tool-name-readings.js";
 import { carriesDotSegment, isAbsoluteForFamily, isIdentityDir, isPathIdentity, isShellRootedSpellingUnmapped, isUncIdentity, pathFamilyOf, pathIdentityOf } from "../tools/fs/safety.js";
 import { readShellCommand } from "./shell-lexer.js";
 import { readOnlyLineObjection, readOnlyShellVerdict } from "./read-only-shell.js";
@@ -32,7 +32,7 @@ export function ruleToolGrammarOf(toolName) {
     return pathTargetOf(toolName) !== undefined ? "path" : undefined;
 }
 export function laneToolNamesOf(req) {
-    return ruleNamesOf(req).filter((n) => ruleToolGrammarOf(n) !== undefined);
+    return heldValues("policy.persistedGrammar", { get: (n) => (ruleToolGrammarOf(n) !== undefined ? n : undefined) }, req);
 }
 export const MAX_RULE_TEXT_CHARS = 512;
 export const BARE_INTERPRETER_NAMES = new Set([

package/dist/core/permission-rules.js

@@ -6,7 +6,7 @@ import { pathFamilyOf, pathIdentityOf, spellingOfIdentity } from "../tools/fs/sa
 import { effectivePathTargetOf } from "./effective-path-target.js";
 import { protectivePathTargetOf } from "./tool-registry.js";
 import { ruleDenialSentence } from "./rule-denial-sentence.js";
-import { ruleNamesOf } from "./tool-roster.js";
+import { heldValues } from "./tool-name-readings.js";
 export { parsePermissionRule };
 export const BASH_GENERIC_PARAMS = new Set(catalogRuleFaceOf("Bash")?.params ?? []);
 const DEFAULT_CAPS = {
@@ -381,10 +381,7 @@ export function createPermissionRulePolicy(rules, opts) {
         requiresRealApproval: true,
     });
     const entryFor = (req) => {
-        const entries = ruleNamesOf(req).flatMap((n) => {
-            const e = byTool.get(n);
-            return e !== undefined ? [e] : [];
-        });
+        const entries = heldValues("policy.permissionRules", byTool, req);
         if (entries.length <= 1)
             return entries[0];
         const bare = {};

package/dist/core/runner/active-skill-scope.js

@@ -3,7 +3,7 @@ import { pathTargetValue } from "../tool-registry.js";
 import { pathTargetBaseOf } from "../effective-path-target.js";
 import { PATH_WRITE_TOOLS, isWithin } from "./session-rule-policy.js";
 import { parseSkillToolEntry, skillSpecifierRejection } from "../skill-tool-specifier.js";
-import { ruleNamesOf } from "../tool-roster.js";
+import { heldValues, wireOf } from "../tool-name-readings.js";
 export class ActiveSkillScope {
     frames = [];
     push(frame) {
@@ -23,7 +23,7 @@ export function createActiveSkillScopePolicy(opts) {
     const { scope, env, rootPath, toolEffects } = opts;
     return {
         async check(req, signal) {
-            const names = ruleNamesOf(req);
+            const entriesFor = (byName) => heldValues("policy.skillScope", byName, req).flat();
             const frames = scope.active();
             if (frames.length === 0)
                 return { action: "allow" };
@@ -48,7 +48,7 @@ export function createActiveSkillScopePolicy(opts) {
                 }
                 return { manifest: m, byName };
             });
-            if (perFrame.length === 0 || perFrame.some((f) => !names.some((n) => f.byName.has(n)))) {
+            if (perFrame.length === 0 || perFrame.some((f) => entriesFor(f.byName).length === 0)) {
                 const ids = manifests.map((m) => m.lineageId).join(", ");
                 return {
                     action: "deny",
@@ -57,7 +57,7 @@ export function createActiveSkillScopePolicy(opts) {
                 };
             }
             for (const frame of perFrame) {
-                const alternatives = names.flatMap((n) => frame.byName.get(n) ?? []);
+                const alternatives = entriesFor(frame.byName);
                 const rejections = [];
                 let admitted = false;
                 for (const entry of alternatives) {
@@ -80,7 +80,7 @@ export function createActiveSkillScopePolicy(opts) {
             const declaredTarget = req.face?.pathTarget;
             const skillScopeEligible = declaredTarget !== undefined && declaredTarget.skillScopeEligible === true;
             if (pathConstrainingActive && !skillScopeEligible) {
-                const eff = toolEffects?.get(req.toolName) ?? "write";
+                const eff = toolEffects?.get(wireOf("policy.skillScope.effect", req)) ?? "write";
                 if (eff !== "read") {
                     const ids = manifests.filter((m) => m.allowPaths?.length).map((m) => m.lineageId).join(", ");
                     return {

package/dist/core/runner/decide-continuation.js

@@ -3,6 +3,7 @@ import { boundInputHashOf } from "../canonical-json.js";
 import { CheckpointError } from "../checkpoint-store.js";
 import { formatHookFeedback } from "../hooks.js";
 import { delimitUntrusted, REVIEWER_NOTE_MAX_BODY } from "../untrusted-text.js";
+import { wireOf } from "../tool-name-readings.js";
 export function resumeDecisionWasNegative(resume) {
     const o = resume.outcome;
     return o.decision === "reject" || o.decision === "deny";
@@ -49,7 +50,7 @@ export function sameWinner(incoming, persisted) {
         (persisted.reason === undefined || incoming.reason === persisted.reason));
 }
 export function pendingContentAskCallId(cp) {
-    return cp.pendingAction.kind === "tool_approval" && cp.pendingAction.toolName === ASK_USER_QUESTION_TOOL_NAME
+    return cp.pendingAction.kind === "tool_approval" && wireOf("resume.contentAskRow", cp.pendingAction) === ASK_USER_QUESTION_TOOL_NAME
         ? cp.pendingAction.toolCallId
         : undefined;
 }

package/dist/core/runner/permission-rule-lanes.d.ts

@@ -241,6 +241,9 @@ export declare function createRuleOffersOf(cfg: {
     shellGatedTools: {
         has(name: string): boolean;
     };
+    toolMarkSources: {
+        get(name: string): ReadonlySet<string> | undefined;
+    };
     taskRoot: string | undefined;
     /** The live tracked-cwd ref (read per call — the relative-cd resolution base). */
     cwdRef: {

package/dist/core/runner/permission-rule-lanes.js

@@ -3,7 +3,8 @@ import {} from "../hooks.js";
 import { adjudicatePersistedPathRules, adjudicatePersistedRules, laneToolNamesOf, ruleToolGrammarOf, segmentCoverageOf, suggestRulesForCommand } from "../permission-rule-model.js";
 import { isAbsolutePathForm } from "../../tools/fs/safety.js";
 import { effectivePathTargetOf } from "../effective-path-target.js";
-import { anyNamed, declaredPathTargetOf, firstNamed, protectivePathTargetOf, ruleNamesOf } from "../tool-registry.js";
+import { declaredPathTargetOf, protectivePathTargetOf } from "../tool-registry.js";
+import { heldBy, seatOf, wireOf } from "../tool-name-readings.js";
 import { orgRuleVerdictFor } from "../permission-rule-org.js";
 import { ownerStoreOf } from "../permission-rule-provider.js";
 import { thrownText } from "../thrown-value.js";
@@ -92,7 +93,7 @@ export function createPermissionRuleLanes(cfg) {
     const org = provider.partitions.org
         ? {
             adjudicate: async (req) => {
-                if (req.toolName === cfg.questionToolName && cfg.questionToolMounted)
+                if (wireOf("offer.orgQuestionExemption", req) === cfg.questionToolName && cfg.questionToolMounted)
                     return { status: "available" };
                 let resolution;
                 try {
@@ -158,16 +159,16 @@ export function createPermissionRuleLanes(cfg) {
 }
 export function createRuleOffersOf(cfg) {
     return (call, args, ask) => {
-        const toolName = call.toolName;
+        const toolName = wireOf("offer.laneTool", call);
         if (!cfg.laneArmed || toolName !== PERSISTED_RULE_TOOL)
             return {};
         if ((cfg.principal === undefined || cfg.principal === "") && !cfg.localOwnerDeclared)
             return {};
-        const tierSeat = firstNamed(cfg.irreversibilityTier, ruleNamesOf(call));
+        const tierSeat = seatOf("offer.marks", cfg.irreversibilityTier, call);
         const closedDoor = ruleClearanceOf(ask, {
-            egress: anyNamed(cfg.egressTools, ruleNamesOf(call)),
+            egress: heldBy("offer.marks.egress", cfg.egressTools, call),
             irreversibility: tierSeat?.value,
-            shellGated: tierSeat !== undefined && cfg.shellGatedTools.has(tierSeat.name),
+            shellGated: tierSeat?.shellGated(cfg.shellGatedTools, cfg.toolMarkSources) === true,
         }).word;
         if (closedDoor !== undefined)
             return { ruleOffersAbsence: closedDoor };

package/dist/core/runner/prepare-context-lane.d.ts

@@ -24,6 +24,7 @@ import { type RunnerDeps } from "../types.js";
 import type { Prepared, PreparedMicroCompact } from "./contracts.js";
 import { type GitStatusLaneRef } from "./git-status-frame.js";
 import type { ReadFileState } from "../../tools/fs/safety.js";
+import { type ToolRosterDeltaSeat } from "../tool-roster.js";
 export interface PrepareContextLaneInput {
     /** borrowed-readonly — the task model: the budgets, the trigger-window geometry and `charsPerToken` are read off it. */
     model: Model;
@@ -39,6 +40,8 @@ export interface PrepareContextLaneInput {
     hostTaskId: string;
     /** borrowed-readonly — the run's offload store, or undefined (the caps' and the machine's persist seat). */
     offloadStore: ToolResultStore | undefined;
+    /** borrowed-readonly — the leg's live roster: a recorded tool name is judged as the wire name it resolves to. */
+    toolRosterDeltas: ToolRosterDeltaSeat;
     /** borrowed-readonly — the doors' RESOLVED microCompact knob (immutable values, never the deps bag). */
     microCompactKnob: {
         machine: MicroCompactMachine;
@@ -135,6 +138,7 @@ export interface GuardChainArgs {
     offloadStore: import("../tool-result-store.js").ToolResultStore | undefined;
     sessionId: string;
     taskId: string;
+    toolNameOf?: (recorded: string) => string;
     deps: RunnerDeps;
     trimPressureRef: {
         droppedMessages: boolean;

package/dist/core/runner/prepare-context-lane.js

@@ -8,8 +8,10 @@ import { emitTrace } from "../trace.js";
 import { deliverEngineNotice } from "../types.js";
 import { applyGitFrameGuard } from "./git-status-frame.js";
 import { applyContextShrinkToReadFileState } from "../../tools/fs/index.js";
+import { rosterToolName } from "../tool-roster.js";
 export function prepareContextLane(input) {
-    const { model, deps, sessionId, runId, hostTaskId, offloadStore, microCompactKnob, harness, batchHaltRef, gitStatusRef, postureFrameRef, requestLossyRef, trimPressureRef, readFileState } = input;
+    const { model, deps, sessionId, runId, hostTaskId, offloadStore, toolRosterDeltas, microCompactKnob, harness, batchHaltRef, gitStatusRef, postureFrameRef, requestLossyRef, trimPressureRef, readFileState } = input;
+    const toolNameOf = (recorded) => rosterToolName(toolRosterDeltas.current, recorded);
     const contextOverlay = input.contextOverlay ?? (() => undefined);
     const requestGeometry = () => {
         const current = harness.getModel();
@@ -27,7 +29,7 @@ export function prepareContextLane(input) {
             const replay = replayClearedProjection(healed, microCompact.ledger);
             const replayed = replay.messages;
             const capped = await capAggregateToolResults(replayed, {
-                store: offloadStore,
+                store: offloadStore, toolNameOf,
                 sessionId,
                 onCapped: (info) => pendingProjectionObservations.push(() => emitTrace(deps.tracer, () => ({
                     kind: "tool_result.capped",
@@ -49,7 +51,7 @@ export function prepareContextLane(input) {
             });
             let ccPass;
             const edited = microCompact.machine === "off" ? mediaCapped : clearStaleToolResults(mediaCapped, {
-                budgetTokens: editAt,
+                budgetTokens: editAt, toolNameOf,
                 clearSource: replayed,
                 onCleared: (pass) => { ccPass = pass; },
                 anchoredTotalTokens: estimateContextTokens(mediaCapped, cpt).tokens,
@@ -67,7 +69,7 @@ export function prepareContextLane(input) {
             }
             const chain = await runGuardChain({
                 edited, replayed, index: replay.index, microCompact, guardAt, charsPerToken: cpt, offloadStore,
-                sessionId, taskId: hostTaskId, deps, trimPressureRef, recheck, signal,
+                sessionId, taskId: hostTaskId, deps, trimPressureRef, recheck, signal, toolNameOf,
                 pendingProjectionObservations,
                 ...(readFileState !== undefined ? { readFileState } : {}),
             });
@@ -221,7 +223,7 @@ export async function runGuardChain(args) {
     if (microCompact.machine === "off" && anchoredWorking > guardAt) {
         let blockingPass;
         const blockingEdited = clearStaleToolResults(working, {
-            budgetTokens: guardAt,
+            budgetTokens: guardAt, toolNameOf: args.toolNameOf,
             clearSource: args.replayed,
             onCleared: (pass) => { blockingPass = pass; },
             anchoredTotalTokens: anchoredWorking,