@sema-agent/core 7.35.1 → 7.36.0

package/dist/core/runner/prepare-gate-stations.js

@@ -9,8 +9,10 @@ import { askUnresolvableNotice } from "../ask-unresolvable-notice.js";
 import { askReachesPerson } from "../wiring-manifest.js";
 import { classifierUnavailableSeat } from "./classifier-ladder.js";
 import { PATH_CONFINABLE_WRITE_TOOLS } from "./session-rule-policy.js";
-import { anyNamed, callAnswersTo, callFaceSeat, firstNamed, rosterToolName, ruleNamesOf, toolCallFaceOf } from "../tool-roster.js";
+import { callFaceSeat, rosterToolName, toolCallFaceOf } from "../tool-roster.js";
+import { heldBy, heldValues, seatOf, wireOf } from "../tool-name-readings.js";
 import { noteHostRewrite } from "../frame-settlement.js";
+const PEER_MESSAGE_NAMES = new Set([SEND_MESSAGE_TOOL_NAME]);
 function screenGateResult(result) {
     if (result.suspend !== undefined)
         return { defects: [] };
@@ -88,12 +90,12 @@ export function prepareGateStations(input) {
             harness.on("tool_call", async (called) => {
                 const e = { ...called, toolName: rosterToolName(toolRosterDeltas.current, called.toolName) };
                 const call = { toolName: e.toolName, ...callFaceSeat(toolCallFaceOf(toolRosterDeltas.current, called.toolName)) };
-                const names = ruleNamesOf(call);
-                const tierSeat = firstNamed(irreversibilityTier, names);
+                const tierSeat = seatOf("gate.shellSeat", irreversibilityTier, call);
+                const markSources = new Set(heldValues("gate.markSources", toolMarkSources, call).flatMap((s) => [...s]));
                 blockedToolCalls.delete(e.toolCallId);
                 inheritedAskGrants.delete(e.toolCallId);
                 {
-                    const complianceDeny = names.map((n) => complianceCallDenial(complianceDenies, n)).find((d) => d !== undefined);
+                    const complianceDeny = heldValues("gate.compliance", { get: (n) => complianceCallDenial(complianceDenies, n) }, call)[0];
                     if (complianceDeny !== undefined) {
                         if (blockedTracked)
                             blockedToolCalls.add(e.toolCallId);
@@ -122,19 +124,19 @@ export function prepareGateStations(input) {
                         resolveAsk: resolveAskBound,
                         suspendAsk,
                         resolveContentAsk,
-                        egress: anyNamed(egressTools, names),
-                        peerMessage: callAnswersTo(call, SEND_MESSAGE_TOOL_NAME),
+                        egress: heldBy("gate.egress", egressTools, call),
+                        peerMessage: heldBy("gate.peerMessage", PEER_MESSAGE_NAMES, call),
                         ...(writeProtectionCheck !== undefined ? { writeProtectionCheck } : {}),
                         ...(shellReadCheck !== undefined ? { shellReadCheck } : {}),
                         irreversibility: tierSeat?.value,
-                        reversibilityProbe: tierSeat !== undefined ? reversibilityProbes.get(tierSeat.name) : undefined,
+                        reversibilityProbe: tierSeat?.read(reversibilityProbes),
                         abortSignal: abortController.signal,
                         ...(notifyPermissionDenied ? { permissionDenied: notifyPermissionDenied } : {}),
                         onHookError: notifyHookError,
-                        shellGated: tierSeat !== undefined && shellGatedTools.has(tierSeat.name),
+                        shellGated: tierSeat?.shellGated(shellGatedTools, toolMarkSources) === true,
                         ...(autoModeDecider.current !== undefined ? { autoMode: { decider: autoModeDecider.current, ...(autoModeDenialTracking.current !== undefined ? { denialTracking: autoModeDenialTracking.current } : {}), unavailable: classifierUnavailableSeat({ station: "leg", ...(autoModeDecider.current.timeoutMs !== undefined ? { budgetMs: autoModeDecider.current.timeoutMs } : {}), approvalSeat: askReachesPerson(askRoute), onNotice: deps.onNotice, sessionId, runId }) } } : {}),
                         permissionMode: () => permissionMode.current,
-                        ...(() => { const s = firstNamed(toolMarkSources, names)?.value; return s !== undefined ? { toolMarkSources: s } : {}; })(),
+                        ...(markSources.size > 0 ? { toolMarkSources: markSources } : {}),
                         ...(a2aIsolatePeers === true ? { a2aIsolatePeers: true } : {}),
                         onModeReleased,
                         ancestorArbitrationOf: (toolCallId) => ancestorArbitrations.get(toolCallId),
@@ -243,6 +245,7 @@ export function prepareGateStations(input) {
             }
             let content = e.content;
             let changed = false;
+            const post = { toolName: rosterToolName(toolRosterDeltas.current, e.toolName) };
             if (e.isError) {
                 if (hooks?.postToolUseFailure) {
                     let clonedDetails = e.details;
@@ -251,7 +254,8 @@ export function prepareGateStations(input) {
                     }
                     catch {
                     }
-                    const failureSeat = await runHookSeat("postToolUseFailure", { timeoutMs: hookTimeoutMs, signal: abortController.signal }, (sig) => hooks.postToolUseFailure(e.toolName, e.input, {
+                    const failedName = wireOf("hook.postToolUseFailure", post);
+                    const failureSeat = await runHookSeat("postToolUseFailure", { timeoutMs: hookTimeoutMs, signal: abortController.signal }, (sig) => hooks.postToolUseFailure(failedName, e.input, {
                         error: e.content
                             .filter((c) => c.type === "text")
                             .map((c) => c.text)
@@ -259,7 +263,7 @@ export function prepareGateStations(input) {
                         isInterrupt: abortController.signal.aborted || spec.signal?.aborted === true,
                         content: e.content.map((c) => ({ ...c })),
                         details: clonedDetails,
-                    }, { toolCallId: e.toolCallId, toolName: e.toolName, signal: sig, ...(handsCwdRef?.current !== undefined ? { cwd: handsCwdRef.current } : {}), ...(hookEnvFace !== undefined ? { env: hookEnvFace } : {}), identity: hookIdentity }));
+                    }, { toolCallId: e.toolCallId, toolName: failedName, signal: sig, ...(handsCwdRef?.current !== undefined ? { cwd: handsCwdRef.current } : {}), ...(hookEnvFace !== undefined ? { env: hookEnvFace } : {}), identity: hookIdentity }));
                     if (failureSeat.expired) {
                         notifyOwnHookCrash(hookSeatExpiredError("postToolUseFailure", hookTimeoutMs, failureSeat.cause, "the observation was abandoned and its additionalContext dropped; the failure result itself is unchanged"));
                     }
@@ -271,7 +275,8 @@ export function prepareGateStations(input) {
                 }
             }
             else if (hooks?.postToolUse) {
-                const successSeat = await runHookSeat("postToolUse", { timeoutMs: hookTimeoutMs, signal: abortController.signal }, (sig) => hooks.postToolUse(e.toolName, e.input, { content: e.content, details: e.details, isError: e.isError }, { toolCallId: e.toolCallId, toolName: e.toolName, signal: sig, ...(handsCwdRef?.current !== undefined ? { cwd: handsCwdRef.current } : {}), ...(hookEnvFace !== undefined ? { env: hookEnvFace } : {}), identity: hookIdentity }));
+                const ranName = wireOf("hook.postToolUse", post);
+                const successSeat = await runHookSeat("postToolUse", { timeoutMs: hookTimeoutMs, signal: abortController.signal }, (sig) => hooks.postToolUse(ranName, e.input, { content: e.content, details: e.details, isError: e.isError }, { toolCallId: e.toolCallId, toolName: ranName, signal: sig, ...(handsCwdRef?.current !== undefined ? { cwd: handsCwdRef.current } : {}), ...(hookEnvFace !== undefined ? { env: hookEnvFace } : {}), identity: hookIdentity }));
                 if (successSeat.expired) {
                     notifyOwnHookCrash(hookSeatExpiredError("postToolUse", hookTimeoutMs, successSeat.cause, "the seat was abandoned; the tool result is delivered to the model UNMODIFIED (no updatedOutput, no additionalContext)"));
                 }

package/dist/core/runner/prepare-park-ask.d.ts

@@ -116,6 +116,8 @@ export interface PrepareParkAskInput {
     shellGatedTools: ReadonlySet<string>;
     /** borrowed-readonly — the per-tool tier, read only for the name the call's tier seat is read under (as at the gate). */
     irreversibilityTier: IrreversibilityTier;
+    /** borrowed-readonly — who marked each name's seat (the descriptor's `shellGated` reads it as the gate does). */
+    toolMarkSources: ReadonlyMap<string, ReadonlySet<import("../ask-origin.js").ToolMarkSource>>;
     /** borrowed-readonly — the operator's shell floor (`"always"`), persisted on a shell-gated descriptor; undefined = no floor. */
     effectiveShellGate: ShellGateDoctrine | undefined;
     /** borrowed-readonly — the EFFECTIVE durable-approval opt-in (the caller's, or the synthesized mandate scope): picks the

package/dist/core/runner/prepare-park-ask.js

@@ -15,7 +15,8 @@ import { checkpointScopeOf } from "./checkpoint-scope.js";
 import { CONTENT_ASK_BINDING_CAP } from "./content-ask-bindings.js";
 import { DEFAULT_UNATTENDED_APPROVAL_TTL_MS, publishCommittedSuspend, sanitizedTtlMs } from "./park-commit.js";
 import { remoteEnvFailureNote } from "./remote-env-retry.js";
-import { callFaceSeat, firstNamed, parkedToolIdentity, parkedToolFace, ruleNamesOf } from "../tool-roster.js";
+import { callFaceSeat, parkedToolIdentity, parkedToolFace } from "../tool-roster.js";
+import { seatOf, wireOf } from "../tool-name-readings.js";
 class ParkRefusal extends Error {
     constructor(message, options) {
         super(message, options);
@@ -26,7 +27,7 @@ const wordlessDemand = (toolName) => {
     throw new Error(`a real-approval demand for "${toolName}" reached the park with no origin word — the origin stamp precedes every park`);
 };
 export function prepareParkAsk(input) {
-    const { askLane, saga, spec, deps, sessionId, checkpointStore, toolRosterDeltas, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, advertisedWritableDirs, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedTools, irreversibilityTier, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, ruleOffersOf, now, humanReviewRef, abortController, harness, pausedRef } = input;
+    const { askLane, saga, spec, deps, sessionId, checkpointStore, toolRosterDeltas, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, advertisedWritableDirs, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedTools, irreversibilityTier, toolMarkSources, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, ruleOffersOf, now, humanReviewRef, abortController, harness, pausedRef } = input;
     if (askLane === undefined || saga === undefined)
         return { parkAsk: undefined };
     const { composedCallSignal, approvalPreviewOf } = askLane;
@@ -114,7 +115,7 @@ export function prepareParkAsk(input) {
     };
     const suspendAsk = parkLaneArmed && checkpointStore !== undefined
         ? async (req, postHookArgs, safety, liveFaceUnavailable, realApproval, shadowedRule, askDecisionReason, probeReason, probeCause, segmentCoverage, matchedAskRule, probeMandated, carry) => {
-            const syncFirstEligible = req.toolName === ASK_USER_QUESTION_TOOL_NAME ? contentAskRoutable(req.toolCallId) : isLiveApproverSeat(onAsk);
+            const syncFirstEligible = wireOf("park.syncFirstRoute", req) === ASK_USER_QUESTION_TOOL_NAME ? contentAskRoutable(req.toolCallId) : isLiveApproverSeat(onAsk);
             if (syncFirstEligible &&
                 runtimeCaps?.forceDurableGate !== true &&
                 liveFaceUnavailable !== true &&
@@ -234,7 +235,7 @@ export function prepareParkAsk(input) {
                     remoteHandle = parkOnlyHandle(parkOnlyRemoteEnv);
                 }
                 token = mintCheckpointToken();
-                const tierSeat = firstNamed(irreversibilityTier, ruleNamesOf(req));
+                const tierSeat = seatOf("park.riskDescriptor", irreversibilityTier, req);
                 const riskDescriptor = buildRiskDescriptor({
                     toolName: req.toolName,
                     args: parkedArgs,
@@ -242,7 +243,7 @@ export function prepareParkAsk(input) {
                     ...(shadowedRule !== undefined ? { shadowedRule } : {}),
                     ...(probeReason !== undefined ? { probeReason } : {}),
                     ...(probeCause !== undefined ? { probeCause } : {}),
-                    shellGated: tierSeat !== undefined && shellGatedTools.has(tierSeat.name),
+                    shellGated: tierSeat?.shellGated(shellGatedTools, toolMarkSources) === true,
                     ...(effectiveShellGate !== undefined ? { shellGateDoctrine: effectiveShellGate } : {}),
                 });
                 gate =
@@ -303,7 +304,7 @@ export function prepareParkAsk(input) {
                         kind: "tool_approval",
                         toolCallId: req.toolCallId,
                         toolName: req.toolName,
-                        ...parkedToolIdentity(toolRosterDeltas.current, req.toolName), ...parkedToolFace(toolRosterDeltas.current, req.toolName),
+                        ...parkedToolIdentity(toolRosterDeltas.current, req.toolName), ...parkedToolFace(toolRosterDeltas.current, req),
                         args: parkedArgs,
                         ...(() => {
                             const p = approvalPreviewOf(req.toolName, parkedArgs);

package/dist/core/runner/prepare-policy-chain.d.ts

@@ -85,6 +85,8 @@ export interface PreparePolicyChainInput {
     envHandToolNames: ReadonlySet<string>;
     /** borrowed-readonly — the shell-seat provenance set (the offer factory's `shellGated` mandate term, read per call). */
     shellGatedTools: ReadonlySet<string>;
+    /** borrowed-readonly — who marked each name's seat (the offer factory's `shellGated` term reads it as the gate does). */
+    toolMarkSources: ReadonlyMap<string, ReadonlySet<import("../ask-origin.js").ToolMarkSource>>;
     /** borrowed-readonly — the tracked-cwd seat, read per call by the lanes and the offer factory (never written here). */
     handsCwdRef: CwdRef | undefined;
     /** borrowed-readonly — the compiled read-deny judge, or undefined (the offer factory's directory negative control). */

package/dist/core/runner/prepare-policy-chain.js

@@ -20,9 +20,9 @@ import { askGrantShapeOf } from "./inherited-ask-grants.js";
 import { createPermissionRuleLanes, inheritedAskRuleEvidence, createRuleOffersOf } from "./permission-rule-lanes.js";
 import { createLiveSessionRules, createSessionRulePolicy } from "./session-rule-policy.js";
 import { thrownText } from "../thrown-value.js";
-import { anyNamed, firstNamed, ruleNamesOf } from "../tool-roster.js";
+import { heldBy, seatOf, wireOf } from "../tool-name-readings.js";
 export async function preparePolicyChain(input) {
-    const { spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, additionalRootsCanonical, executionEnv, lockedPreflight, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, envHandToolNames, handsCwdRef, readDenyMatcher, announceRuleStoreSkipped, questionToolMounted, runtimeCaps, inheritedAncestorRules, ancestorSessionRulesRef, inheritedParentConstraints, seedInheritedGate, hasSkillManifest, skillScope, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider, permissionMode, scratchpadDir, toolRosterDeltas, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef } = input;
+    const { spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, additionalRootsCanonical, executionEnv, lockedPreflight, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, toolMarkSources, envHandToolNames, handsCwdRef, readDenyMatcher, announceRuleStoreSkipped, questionToolMounted, runtimeCaps, inheritedAncestorRules, ancestorSessionRulesRef, inheritedParentConstraints, seedInheritedGate, hasSkillManifest, skillScope, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider, permissionMode, scratchpadDir, toolRosterDeltas, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef } = input;
     const ancestorArbitrations = new Map();
     const arbitrateInherited = (ask, toolCallId) => {
         const verdict = arbitrateByMode(permissionMode.current, classifyAsk(ask, INHERITED_STATION_FACTS), { ...(ask.origin !== undefined ? { origin: ask.origin } : {}), ...(ask.mandate !== undefined ? { mandate: ask.mandate } : {}) });
@@ -233,7 +233,8 @@ export async function preparePolicyChain(input) {
         list.push({ cls, layer });
         foldAskClasses.set(toolCallId, list);
     };
-    const sandboxBoundaryCapable = (call) => anyNamed(egressTools, ruleNamesOf(call)) || !envHandToolNames.has(call.toolName);
+    const isDelegatedQuestion = (creq) => wireOf("inherited.questionFloat", creq) === ASK_USER_QUESTION_TOOL_NAME;
+    const sandboxBoundaryCapable = (call) => heldBy("gate.sandboxBoundary.egress", egressTools, call) || !envHandToolNames.has(wireOf("gate.sandboxBoundary.hand", call));
     const emitSandboxAdmitted = (info) => {
         emitTrace(deps.tracer, () => ({
             kind: "permission.sandbox_admitted",
@@ -278,11 +279,10 @@ export async function preparePolicyChain(input) {
         ...(delegation.isDelegatedChild ? { isDelegatedChild: true } : {}),
     });
     const riskAxesOf = (call) => {
-        const names = ruleNamesOf(call);
-        const tier = firstNamed(irreversibilityTier, names)?.value;
-        const negatives = firstNamed(axisExplicitNegatives, names)?.value;
+        const tier = seatOf("report.riskAxes", irreversibilityTier, call)?.value;
+        const negatives = seatOf("report.riskAxes.negatives", axisExplicitNegatives, call)?.value;
         const irreversible = tier === "always" || tier === "maybe" ? true : tier === "never" ? false : negatives?.irreversible;
-        const egress = anyNamed(egressTools, names) ? true : negatives?.egress;
+        const egress = heldBy("report.riskAxes.egress", egressTools, call) ? true : negatives?.egress;
         if (irreversible === undefined && egress === undefined)
             return {};
         return { riskAxes: { ...(irreversible !== undefined ? { irreversible } : {}), ...(egress !== undefined ? { egress } : {}) } };
@@ -310,6 +310,7 @@ export async function preparePolicyChain(input) {
         egressTools,
         irreversibilityTier,
         shellGatedTools,
+        toolMarkSources,
         taskRoot: taskRootFinal,
         cwdRef: handsCwdRef,
         deniesDirectoryRead: readDenyMatcher !== undefined ? (d) => readDenyMatcher.matchPath(d) !== null : undefined,
@@ -420,7 +421,7 @@ export async function preparePolicyChain(input) {
                         return first;
                     if (first.action === "allow")
                         return { action: "allow" };
-                    if (creq.toolName === ASK_USER_QUESTION_TOOL_NAME) {
+                    if (isDelegatedQuestion(creq)) {
                         if (pc.contentMandate !== true || markInheritedUnavailable(creq.toolCallId))
                             return first;
                         return {
@@ -493,7 +494,7 @@ export async function preparePolicyChain(input) {
                 }
                 if (decision.action !== "ask")
                     return decision;
-                if (creq.toolName === ASK_USER_QUESTION_TOOL_NAME) {
+                if (isDelegatedQuestion(creq)) {
                     if (pc.contentMandate !== true || markInheritedUnavailable(creq.toolCallId))
                         return decision;
                     return {

package/dist/core/runner/prepare-safety-scan.js

@@ -4,6 +4,8 @@ import { callerCardIdOf, offendingResultCard, rosterMemberBoundProblem, schemaKe
 import { toolFaceProblem } from "./tool-face-overlay.js";
 import { OFFLOAD_TOOL_NAME } from "../tool-result-store.js";
 import { PRESENT_PLAN_TOOL_NAME, ENTER_PLAN_MODE_TOOL_NAME } from "../present-plan-tool.js";
+const REPEAT_RISK = { read: 0, idempotent: 1, write: 2 };
+const leastRepeatSafe = (a, b) => (REPEAT_RISK[a] >= REPEAT_RISK[b] ? a : b);
 export function prepareSafetyScan(input) {
     const { spec, deps } = input;
     const toolEffects = new Map();
@@ -120,11 +122,16 @@ export function prepareSafetyScan(input) {
         }
     }
     toolEffects.set(OFFLOAD_TOOL_NAME, "read");
+    const claimerEffects = new Map([...claimedAliases].map((a) => [a, toolEffects.get(a) ?? "write"]));
+    const recordHandEffect = (name, effect) => {
+        const claimed = claimerEffects.get(name);
+        toolEffects.set(name, claimed === undefined ? effect : leastRepeatSafe(claimed, effect));
+    };
     if (deps.executionEnvFactory || deps.executionEnv) {
         for (const [name, effect] of handBandEffects())
-            toolEffects.set(name, effect);
+            recordHandEffect(name, effect);
         if (spec.handsReadOnly === true)
-            toolEffects.set("Bash", "read");
+            recordHandEffect("Bash", "read");
     }
     if (spec.enablePlanMode === true) {
         toolEffects.set(PRESENT_PLAN_TOOL_NAME, "read");

package/dist/core/runner/prepare-task.js

@@ -740,7 +740,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 releaseSignal = () => sig.removeEventListener("abort", onExternalAbort);
             }
         }
-        const { hooks, hookTimeoutMs, preToolUseObservational, ownGatePreToolUse, basePolicyForResumeEdit, denyNarrowingPolicy, policyLayers, effectivePolicy, inheritedUnavailableAsks, inheritedAskGrants, askSourceIdentity, riskAxesOf, ruleOffersOf, permissionRuleLane, permissionRuleOrgLane, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, foldAskClasses, ancestorSandboxAdmissions, ancestorArbitrations } = await preparePolicyChain({ spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, additionalRootsCanonical, executionEnv, lockedPreflight, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, envHandToolNames, handsCwdRef, readDenyMatcher, announceRuleStoreSkipped, questionToolMounted, runtimeCaps, inheritedAncestorRules, ancestorSessionRulesRef, inheritedParentConstraints, seedInheritedGate, hasSkillManifest, skillScope, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider: () => autoModeDeciderRef.current, permissionMode, scratchpadDir: spec.envFacts?.scratchpadDir, toolRosterDeltas: rosterSeat, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef });
+        const { hooks, hookTimeoutMs, preToolUseObservational, ownGatePreToolUse, basePolicyForResumeEdit, denyNarrowingPolicy, policyLayers, effectivePolicy, inheritedUnavailableAsks, inheritedAskGrants, askSourceIdentity, riskAxesOf, ruleOffersOf, permissionRuleLane, permissionRuleOrgLane, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, foldAskClasses, ancestorSandboxAdmissions, ancestorArbitrations } = await preparePolicyChain({ spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, additionalRootsCanonical, executionEnv, lockedPreflight, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, toolMarkSources, envHandToolNames, handsCwdRef, readDenyMatcher, announceRuleStoreSkipped, questionToolMounted, runtimeCaps, inheritedAncestorRules, ancestorSessionRulesRef, inheritedParentConstraints, seedInheritedGate, hasSkillManifest, skillScope, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider: () => autoModeDeciderRef.current, permissionMode, scratchpadDir: spec.envFacts?.scratchpadDir, toolRosterDeltas: rosterSeat, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef });
         const { onAsk, preToolContexts, blockedToolCalls, gateOutcomes, batchHaltRef, blockedTracked, incompleteSuspendAdapter, durableSuspendInfraReady, resourceSuspendEligible, usageGovernance, durableApproval, wiringManifest, writeProtection, parkLaneArmed, gateMachineryActive, hookIdentity, hookEnvFace, sessionBoxBound } = prepareWiringManifest({ spec, deps, internals, resume, sessionId, runId, hostTaskId, taskScope, hooks, preToolUseObservational, policyLayers, effectivePolicy, handsEnabled, taskRootFinal, mcp, irreversibleTools, egressTools, shellReadStationArmed: handsReadFace.shellReadStationArmed, toolEffects, ownedEnv, executionEnv, offloadStore, onceLedger, usageWindows, envLifetimeSuspendAt, runtimeCaps, resolvedInteractionPosture, durableQuestionFace, liveQuestionFace, checkpointStore, sessions, modelGateManifest, autoModeArmReason, permissionMode, lockedPreflight, peerLaneRefs, frameSettlement, harness, pausedRef, frozenOnAsk, liveInheritedGate, delegation, toolRoster, readDenyBuiltinTiersActive: handsReadFace.readDenyBuiltinTiersActive, lspManagerWired, lspDiagnosticsLive: lspDiagnostics !== undefined, fileHistoryFact, sessionBox });
         const writeProtectionCheck = writeProtection?.check;
         writeProtectionJudgeRef.current = writeProtection?.judgeTarget;
@@ -753,10 +753,10 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         const { askLane } = prepareAskLane({ gateMachineryActive, abortController, effectivePolicy, budgetSnapshot, handsCwdRef, advertisedWritableDirs, tools, inheritedUnavailableAsks, inheritedAskGrants, onAsk, humanReviewRef, now, ruleOffersOf, askSourceIdentity, riskAxesOf, autoModeDenialTracking: autoModeDenialTrackingRef, spec, deps, sessionId, runId, hooks, hookTimeoutMs, notifyOwnHookCrash, grantReadRoot: handsReadFace.grantReadRoot });
         const { saga } = prepareSuspendSaga({ gateMachineryActive, abortController, harness, checkpointStore, deps, sessionId, hostTaskId, taskScope, liveSpendRef, resume, nestedStats, internals, activeTools, outputRef, readFileStateForCheckpoint, faceCheckpointSection, writeFaceCheckpointSection, reminderMark, handsCwdRef, worktreeSessionRef, undeliveredContinuationRef, inheritedParentConstraints, seedInheritedGate, ancestorRulesNow, inheritedShellGate, permissionMode, inheritedAdmittedOrgScopes, ownOrgVerdictRef, orgGovernedProvenance, announcedListingsRef, gitStatusRef, hookIdentity, placementRootResolved, externalContentTargetActive, remoteEnvFailures, memoryEngineSession, suspendLoopRef, ownedEnv, incompleteSuspendAdapter });
         const { suspendForResource, suspendForPlatformLimit, suspendForReview } = prepareBoundaryParks({ saga, spec, checkpointStore, abortController, harness, session, sessions, sessionId, deps, priorLedger, maxSlices, maxSuspends, resourceTotal, priorSuspendCount, suspendChainBase, humanReviewRef, liveSpendRef, now, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, pausedRef, remoteEnvFailures, resourceSuspendEligible, durableSuspendInfraReady, incompleteSuspendAdapter });
-        const { parkAsk } = prepareParkAsk({ askLane, saga, spec, deps, sessionId, checkpointStore, toolRosterDeltas: rosterSeat, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, advertisedWritableDirs, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedTools, irreversibilityTier, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, ruleOffersOf, now, humanReviewRef, abortController, harness, pausedRef });
+        const { parkAsk } = prepareParkAsk({ askLane, saga, spec, deps, sessionId, checkpointStore, toolRosterDeltas: rosterSeat, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, advertisedWritableDirs, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedTools, irreversibilityTier, toolMarkSources, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, ruleOffersOf, now, humanReviewRef, abortController, harness, pausedRef });
         prepareGateStations({ askLane, parkAsk, tools, toolRosterDeltas: rosterSeat, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, hooks, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, gateOutcomes, batchHaltRef, blockedTracked, hookIdentity, reminderMark, hostTaskId, sessionId, ownGatePreToolUse, hookTimeoutMs, handsCwdRef, readDenyInForce: () => ({ tiers: handsReadFace.readDenyBuiltinTiersActive, rows: [...readDenyAdditionsNormalized.map((e) => e.pattern), ...handsReadFaceInput.pathDenyRules.filter((r) => r.faces.includes("read")).map((r) => r.rule)] }), hookEnvFace, writeProtectionCheck, shellReadCheck, irreversibilityTier, reversibilityProbes, abortController, shellGatedTools, autoModeDecider: autoModeDeciderRef, autoModeDenialTracking: autoModeDenialTrackingRef, askRoute: wiringManifest.ask, permissionMode, toolMarkSources, ...(deps.a2a?.isolatePeers === true ? { a2aIsolatePeers: true } : {}), ancestorArbitrations, runId, stopForDenialLimit, permissionRuleLane, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, notifyOwnHookCrash, frameSettlement });
         const postureFrameRef = {};
-        const { microCompact, charsPerToken } = prepareContextLane({ model, deps, sessionId, runId, hostTaskId, offloadStore, microCompactKnob, harness, batchHaltRef, gitStatusRef, postureFrameRef, requestLossyRef, trimPressureRef, contextOverlay: legContextOverlay, ...(readFileStateForCheckpoint !== undefined ? { readFileState: readFileStateForCheckpoint } : {}) });
+        const { microCompact, charsPerToken } = prepareContextLane({ model, deps, sessionId, runId, hostTaskId, offloadStore, toolRosterDeltas: rosterSeat, microCompactKnob, harness, batchHaltRef, gitStatusRef, postureFrameRef, requestLossyRef, trimPressureRef, contextOverlay: legContextOverlay, ...(readFileStateForCheckpoint !== undefined ? { readFileState: readFileStateForCheckpoint } : {}) });
         const preparedHolder = {};
         const { cacheBreakDetector, cacheFingerprint, promptOverheadTokens, readTaskFile, normalizeAttachmentPath, isDedupStubResult, recentlyReadFiles, onCompactionApplied, detectExternalChanges, listBackgroundTasks, centerCompactionCandidate, effectiveReadFaceObserved, effectiveWriteFaceObserved, effectiveReadDenyObserved } = prepareTurnWiring({ deps, systemPromptSeat, harnessTools, fpRef, model, epochArtifactDigestForSnapshot, promptProfile, fableMitigations, systemBlocks, thinking, spec, sessionId, turnSnapshotRef, promptManifest, charsPerToken, handsEnabled, executionEnv, attachmentRootCanonical, additionalRootsCanonical, additionalReadRootsCanonical, readDenyMatcher, resolvedReadFace, handsCwdRef, readFileStateForCheckpoint, denyNarrowingPolicy, abortController, hostTaskId, taskScope, buildAssembleInputs, centerAdoptionRef, harnessRef, epochDeclaredSections, carrierReadFace, carrierWriteFace, readDenyAdditionsNormalized, preparedHolder });
         await onceLedger.settle(session, announcedListingsRef);

package/dist/core/runner/resume-apply.js

@@ -10,6 +10,7 @@ import { inlineUntrusted } from "../untrusted-text.js";
 import { deepJsonEqual, describeSuppliedValue } from "./decide-continuation.js";
 import { mintGateOutcome } from "./gate-exit.js";
 import { asThrownError, thrownText } from "../thrown-value.js";
+import { wireOf } from "../tool-name-readings.js";
 export async function resumeApply(input) {
     const { cp, config, internals, outcomeGate, wakeMessage, resumeSignal, recheckGovernanceWindow, plainReviewOutcome, plainParkOutcome, runner, effectiveDelegationFacts } = input;
     let plainPolicyOutcome = input.plainPolicyOutcome;
@@ -78,7 +79,7 @@ export async function resumeApply(input) {
         plainPolicyOutcome.decision === "allow" &&
         plainPolicyOutcome.updatedInput !== undefined &&
         cp.pendingAction.kind === "tool_approval" &&
-        cp.pendingAction.toolName !== ASK_USER_QUESTION_TOOL_NAME) {
+        wireOf("resume.editRecheckQuestionSkip", cp.pendingAction) !== ASK_USER_QUESTION_TOOL_NAME) {
         const editedArgs = plainPolicyOutcome.updatedInput;
         const editBudget = {
             resourceRemainingMicroUsd: remainingBudgetMicroUsd(cp.resourceLedger),

package/dist/core/runner/run-attachment-seats.js

@@ -2,6 +2,8 @@ import { eventDefaultOn } from "../../prompt-assembly/event-registry.js";
 import { stripGitStatusUnits } from "./git-status-frame.js";
 import { SKILLS_LISTING_PROBE_HEADER } from "./synthetic-tools.js";
 import { AGENT_LISTING_REMOVED_HEADER, SKILLS_LISTING_DELTA_HEADER, SKILLS_LISTING_REMOVED_HEADER, agentListingDeltaHeader, agentListingInitialHeader, createAttachmentState, replayAnnouncedListing, replayAnnouncedModels } from "./turn-attachments.js";
+import { wireOf } from "../tool-name-readings.js";
+import { rosterToolName } from "../tool-roster.js";
 export async function runAttachmentSeats(input) {
     const { spec, prepared, resume, rs, runner, next } = input;
     rs.counters.wroteThisRun = false;
@@ -174,7 +176,7 @@ export async function runAttachmentSeats(input) {
                     if ((fvMarked || text.includes("<system-reminder>[final verification]")) && rs.counters.finalVerifyInjections < 2)
                         rs.counters.finalVerifyInjections += 1;
                 }
-                else if (m.role === "toolResult" && !rs.counters.wroteThisRun && (prepared.toolEffects.get(m.toolName) ?? "write") !== "read") {
+                else if (m.role === "toolResult" && !rs.counters.wroteThisRun && (prepared.toolEffects.get(wireOf("verify.wroteThisRunSeed", { toolName: rosterToolName(prepared.toolRosterDeltas.current, m.toolName) })) ?? "write") !== "read") {
                     rs.counters.wroteThisRun = true;
                 }
             }

package/dist/core/runner/run-harness-handlers.js

@@ -11,9 +11,13 @@ import { gatedCallIdOf } from "./park-commit.js";
 import { hasVerifiableStructureSignal } from "./grounding-signal.js";
 import { batchResponseDigest, toolEndBodyFrom } from "./tool-end-body.js";
 import { createResponseModelSeat } from "./response-model-seat.js";
+import { createToolCallIdFoldSeat } from "./tool-call-id-fold-seat.js";
+import { wireOf } from "../tool-name-readings.js";
+import { rosterToolName } from "../tool-roster.js";
 export function createHarnessHandlers(input) {
     const { prepared, stats, rs, deps } = input;
     const responseModelSeat = createResponseModelSeat(deps.runnerHooks.onNotice, { sessionId: prepared.sessionId, runId: prepared.runId });
+    const toolCallIdFoldSeat = createToolCallIdFoldSeat(deps.runnerHooks.onNotice, { sessionId: prepared.sessionId, runId: prepared.runId });
     const { spec, queue, internals, ident, parentToolCallId, subagentName, pushContent, emitCommitted, startedToolCallIds, toolStartAt, toolProgress, writeFamilyOf, toolLabels, postToolBatchHook, batchArgs, internalsNotifier } = deps;
     let lastWorkspaceCwd = prepared.cwdRef?.current;
     const announceWorkspaceMove = () => {
@@ -147,6 +151,7 @@ export function createHarnessHandlers(input) {
         }
         if (m.role === "assistant") {
             rs.turn.turnResponseModel = responseModelSeat.observe(m);
+            toolCallIdFoldSeat.observe(m);
         }
         if (m.role === "assistant") {
             const rep = m.repetition;
@@ -219,7 +224,7 @@ export function createHarnessHandlers(input) {
         toolStartAt.delete(event.toolCallId);
         toolProgress.noteEnd(event.toolCallId);
         const toolNow = Date.now();
-        if (!rs.counters.wroteThisRun && (prepared.toolEffects.get(event.toolName) ?? "write") !== "read") {
+        if (!rs.counters.wroteThisRun && (prepared.toolEffects.get(wireOf("verify.wroteThisRun", { toolName: rosterToolName(prepared.toolRosterDeltas.current, event.toolName) })) ?? "write") !== "read") {
             rs.counters.wroteThisRun = true;
         }
         if (rs.attach.attachState !== undefined && !event.isError) {

package/dist/core/runner/run-leg.js

@@ -13,7 +13,7 @@ import { composeApprovalPostureDirective } from "../auto-mode-directive.js";
 import { mintSystemReminder, statedReminderBodiesOf } from "../reminder-mint.js";
 import { hasDestroy } from "../remote-env.js";
 import { advertisedWritableRootsSeat, policyRefusalMessage, refuseOutOfContractDecision } from "../tool-policy.js";
-import { callFaceSeat, judgeParkedToolIdentity, rosterEntryNamed, toolCallFaceOf } from "../tool-roster.js";
+import { callFaceSeat, judgeParkedToolIdentity, parkedRowLiveFace, rosterEntryNamed } from "../tool-roster.js";
 import { deliverEngineNotice } from "../types.js";
 import { delimitUntrusted, inlineUntrusted, REVIEWER_NOTE_MAX_BODY, sanitizeUntrustedText } from "../untrusted-text.js";
 import { errorCodeOf } from "./assemble-result.js";
@@ -34,6 +34,7 @@ import { attachmentEnvelopeTags, collectDateChange, commitAgentListing, commitSk
 import { flushOwedAnnouncedSnapshot } from "./announce-once-ledger.js";
 import { asThrownError, thrownMarksOf, thrownText } from "../thrown-value.js";
 import { ruleSourcePhrase } from "../rule-denial-sentence.js";
+import { wireOf } from "../tool-name-readings.js";
 export async function runLeg(input) {
     const { spec, queue, prepared, resume, rs, isDelegatedChild, entryActor, effectiveTimeoutMs, timeout, pushContent, ident, emitCommitted, writeFamilyOf, startedToolCallIds, announceWorkspaceMove, withBrainSinks, flushGitMirror, loopLatch, notificationLane, unsubscribeTaskNotifications, unsubGitRetry, unsubBoundary, unsub, runner, next } = input;
     let final;
@@ -563,12 +564,13 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
     if (decidedGate === undefined) {
         throw new CheckpointError("checkpoint.invalid_outcome", "pending action reached the resolver with no settlement record on its decision (gateOutcome) — refusing to execute or settle a decision that carries no record");
     }
-    const resolvedArgs = pendingAction.toolName === ASK_USER_QUESTION_TOOL_NAME ? pendingAction.args : (outcome.updatedInput !== undefined ? outcome.updatedInput : pendingAction.args);
+    const resolvedArgs = wireOf("resume.questionArgsShown", pendingAction) === ASK_USER_QUESTION_TOOL_NAME ? pendingAction.args : (outcome.updatedInput !== undefined ? outcome.updatedInput : pendingAction.args);
     const pendingLabel = (() => { const l = prepared.tools.find((t) => t.name === pendingAction.toolName)?.label; return l !== undefined && l !== pendingAction.toolName ? { label: l } : {}; })();
-    emit({ type: "tool_start", toolCallId: pendingAction.toolCallId, toolName: pendingAction.toolName, ...pendingLabel, args: resolvedArgs });
+    const spelledName = pendingAction.names?.[0] ?? pendingAction.toolName;
+    emit({ type: "tool_start", toolCallId: pendingAction.toolCallId, toolName: spelledName, ...pendingLabel, args: resolvedArgs });
     const settleEnd = async (isError, result, gate = decidedGate) => {
         prepared.toolProgressRef.current?.noteEnd(pendingAction.toolCallId);
-        emit({ type: "tool_end", toolCallId: pendingAction.toolCallId, toolName: pendingAction.toolName, ...pendingLabel, isError, ...toolEndBodyFrom(result, isError, prepared.structuredProjector, gate) });
+        emit({ type: "tool_end", toolCallId: pendingAction.toolCallId, toolName: spelledName, ...pendingLabel, isError, ...toolEndBodyFrom(result, isError, prepared.structuredProjector, gate) });
         const word = await resume.recordExecutionOutcome(gate);
         settleExecutionRecord(runner.deps.onNotice, word, { toolName: pendingAction.toolName, gate, sessionId: prepared.sessionId, runId: prepared.runId, scope: resume.cp.scope, ...(resume.cp.checkpointId !== undefined ? { checkpointId: resume.cp.checkpointId } : {}) });
     };
@@ -611,7 +613,7 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
             budget: beltBudget,
             ...(prepared.cwdRef !== undefined ? { cwd: prepared.cwdRef.current } : {}),
             ...advertisedWritableRootsSeat(prepared.advertisedWritableDirs),
-            ...callFaceSeat(toolCallFaceOf(prepared.toolRosterDeltas.current, pendingAction.toolName)),
+            ...callFaceSeat(parkedRowLiveFace(prepared.toolRosterDeltas.current, pendingAction)),
         }, prepared.abortController.signal));
         const beltUnsafe = rechecked.action === "deny" ||
             (rechecked.updatedInput !== undefined && !deepJsonEqual(rechecked.updatedInput, resolvedArgs));
@@ -634,7 +636,7 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
     }
     if (prepared.permissionRuleOrg !== undefined) {
         const orgVerdict = prepared.permissionRuleOrg
-            .adjudicate({ toolName: pendingAction.toolName, args: resolvedArgs, toolCallId: pendingAction.toolCallId, ...callFaceSeat(toolCallFaceOf(prepared.toolRosterDeltas.current, pendingAction.toolName)) })
+            .adjudicate({ toolName: pendingAction.toolName, args: resolvedArgs, toolCallId: pendingAction.toolCallId, ...callFaceSeat(parkedRowLiveFace(prepared.toolRosterDeltas.current, pendingAction)) })
             .catch(() => ({ status: "unavailable", disclosures: ["the org adjudication face threw on resume"] }));
         let orgWaitCancelled = false;
         const org = await settleOrgVerdictWithin(orgVerdict, { status: "unavailable", disclosures: [`the org adjudication face did not answer within ${ORG_ADJUDICATION_TIMEOUT_MS}ms (or the task ended first)`] }, {
@@ -669,7 +671,7 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
             toolName: pendingAction.toolName,
             args: resolvedArgs,
             toolCallId: pendingAction.toolCallId,
-            ...callFaceSeat(toolCallFaceOf(prepared.toolRosterDeltas.current, pendingAction.toolName)),
+            ...callFaceSeat(parkedRowLiveFace(prepared.toolRosterDeltas.current, pendingAction)),
             budget: beltBudget,
             ...(prepared.cwdRef !== undefined ? { cwd: prepared.cwdRef.current } : {}),
             ...advertisedWritableRootsSeat(prepared.advertisedWritableDirs),
@@ -691,7 +693,7 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
                 toolName: pendingAction.toolName,
                 args: resolvedArgs,
                 toolCallId: pendingAction.toolCallId,
-                ...callFaceSeat(toolCallFaceOf(prepared.toolRosterDeltas.current, pendingAction.toolName)),
+                ...callFaceSeat(parkedRowLiveFace(prepared.toolRosterDeltas.current, pendingAction)),
                 budget: beltBudget,
                 ...(prepared.cwdRef !== undefined ? { cwd: prepared.cwdRef.current } : {}),
                 ...advertisedWritableRootsSeat(prepared.advertisedWritableDirs),
@@ -717,7 +719,7 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
     }
     if (prepared.shellReadCheck !== undefined) {
         const edited = outcome.updatedInput !== undefined && !deepJsonEqual(outcome.updatedInput, pendingAction.args);
-        const readCall = { toolName: pendingAction.toolName, ...callFaceSeat(toolCallFaceOf(prepared.toolRosterDeltas.current, pendingAction.toolName)) };
+        const readCall = { toolName: pendingAction.toolName, ...callFaceSeat(parkedRowLiveFace(prepared.toolRosterDeltas.current, pendingAction)) };
         const judged = prepared.shellReadCheck.judge(readCall, resolvedArgs, prepared.cwdRef?.current, prepared.abortController.signal, {
             toolCallId: pendingAction.toolCallId,
             ...(edited ? { seat: "rejudge" } : {}),

package/dist/core/runner/run-recovery-lanes.js

@@ -1,5 +1,6 @@
 import { compactionKindOf } from "../task-notification.js";
 import { planRejectionClears } from "../context-edit.js";
+import { rosterToolName } from "../tool-roster.js";
 import { landStaleResultClears } from "./prepare-context-lane.js";
 import { DEFAULT_COMPACTION_INSTRUCTIONS, maybeCompact, mintCompactedEvent } from "../auto-compaction.js";
 import { emitTrace } from "../trace.js";
@@ -122,6 +123,7 @@ export function runRecoveryLanes(input) {
                         ? { declined: "no_candidates" }
                         : planRejectionClears(proj.messages, {
                             keyOf: proj.keyOf,
+                            toolNameOf: (recorded) => rosterToolName(prepared.toolRosterDeltas.current, recorded),
                             ...(prepared.microCompact.offloadPersist ? { offload: { persist: prepared.microCompact.offloadPersist } } : {}),
                         });
                     if ("declined" in plan) {

package/dist/core/runner/session-rule-policy.js

@@ -2,7 +2,7 @@ import { canonicalizeTarget, isWinFormPath, pathFamilyOf, writeTargetPath } from
 import { createCoarseCommandNamePolicy, namespacedCoveringEntries, namespacedCoveringHit } from "../tool-policy.js";
 import { continuesLineage } from "../session-policy-store.js";
 import { thrownText } from "../thrown-value.js";
-import { toolNameSetHas } from "../tool-roster.js";
+import { heldBy, wireOf } from "../tool-name-readings.js";
 import { ruleDenialSentence } from "../rule-denial-sentence.js";
 import { DEFAULT_GATE_AWAIT_TIMEOUT_MS, gateWaitFailureOf, withGateTimeout } from "../gate-bounded-await.js";
 import { declaredPathTargetOf, isProtectedWrite, pathConfinableWriteToolNames, skillScopeWriteToolNames } from "../tool-registry.js";
@@ -137,9 +137,10 @@ export function createSessionRulePolicy(rules, opts) {
         async check(req, signal) {
             const { toolDeny, toolAllow, toolDenyCovering, toolAllowCovering, cmdPolicy, allowDirs } = compile(await readRules(req.toolCallId, signal));
             const toolName = req.toolName;
-            if (toolNameSetHas(toolDeny, req) || namespacedCoveringHit(toolDenyCovering, toolName))
+            const listed = (set) => heldBy("policy.sessionRules", set, req);
+            if (listed(toolDeny) || namespacedCoveringHit(toolDenyCovering, toolName))
                 return deny(req.toolName);
-            if (toolAllow && !toolNameSetHas(toolAllow, req) && !namespacedCoveringHit(toolAllowCovering, toolName)) {
+            if (toolAllow && !listed(toolAllow) && !namespacedCoveringHit(toolAllowCovering, toolName)) {
                 return deny(req.toolName, "it is not in the session-rule allowlist");
             }
             if (cmdPolicy) {
@@ -151,7 +152,7 @@ export function createSessionRulePolicy(rules, opts) {
             }
             if (allowDirs) {
                 if (!isProtectedWrite(req)) {
-                    const eff = toolEffects?.get(toolName) ?? "write";
+                    const eff = toolEffects?.get(wireOf("policy.sessionRules.effect", req)) ?? "write";
                     if (eff !== "read") {
                         return deny(req.toolName, "it is write-capable and cannot be path-confined, while the rule confines writes to allowDirs");
                     }

package/dist/core/runner/tool-call-id-fold-seat.d.ts

@@ -0,0 +1,13 @@
+import type { EngineNotice } from "../engine-notice.js";
+export interface ToolCallIdFoldSeat {
+    /** Observe one assistant message; announces the run's first folded call. */
+    observe(message: {
+        readonly content?: unknown;
+    }): void;
+}
+/** The notice's attribution ids — the same pair, for the same reason, as {@link ResponseModelSeatIds}. */
+export interface ToolCallIdFoldSeatIds {
+    sessionId: string;
+    runId: string;
+}
+export declare function createToolCallIdFoldSeat(onNotice: ((notice: EngineNotice) => void) | undefined, ids: ToolCallIdFoldSeatIds): ToolCallIdFoldSeat;

package/dist/core/runner/tool-call-id-fold-seat.js

@@ -0,0 +1,31 @@
+import { deliverEngineNotice } from "../engine-notice.js";
+import { providerToolCallId, toolCallIdFoldReason } from "../../brain/tool-call-id.js";
+function isCall(block) {
+    return typeof block === "object" && block !== null && block.type === "toolCall" && typeof block.id === "string";
+}
+export function createToolCallIdFoldSeat(onNotice, ids) {
+    let announced = false;
+    return {
+        observe(message) {
+            if (announced || !Array.isArray(message.content))
+                return;
+            for (const call of message.content.filter(isCall)) {
+                const wireId = providerToolCallId(call);
+                const reason = wireId === call.id ? undefined : toolCallIdFoldReason(wireId);
+                if (reason === undefined)
+                    continue;
+                announced = true;
+                deliverEngineNotice(onNotice, {
+                    code: "route.tool_call_id_folded",
+                    message: `The provider named a tool call with an id outside the shape the engine keys calls under ` +
+                        `(${reason === "length" ? `${wireId.length} characters, over 128` : "a control byte, a space, a non-ASCII character or a `~`"}). ` +
+                        `The engine keys it as "${call.id}" on every face — frames, cards, transcript, park rows — and hands the ` +
+                        `provider its own id back for the call and its result, so the run is unchanged. Once per run; later calls ` +
+                        `with such ids are folded the same way without another notice.`,
+                    detail: { toolCallId: call.id, rawLength: wireId.length, reason, sessionId: ids.sessionId, runId: ids.runId },
+                });
+                return;
+            }
+        },
+    };
+}

package/dist/core/sensitive-path-policy.js

@@ -5,7 +5,7 @@ import { compileSegmentPattern, matchSegmentPatterns, READ_FACE_BUILTIN_DENY_TAB
 import { isProtectedWrite, protectivePathTargetOf } from "./tool-registry.js";
 import { pathTargetBaseOf } from "./effective-path-target.js";
 import { symlinkChainHops } from "./path-identity.js";
-import { toolNameSetHas } from "./tool-roster.js";
+import { heldBy } from "./tool-name-readings.js";
 export function agentConfigDenyPatterns() {
     return READ_FACE_BUILTIN_DENY_TABLE.filter((row) => row.tier === "agent-config").map((row) => readDenyPatternRun(row.pattern).run);
 }
@@ -147,7 +147,7 @@ export function createSensitivePathPolicy(opts) {
         async check(req, signal) {
             if (compiled.length === 0)
                 return { action: "allow" };
-            if (guardedByName !== undefined ? !toolNameSetHas(guardedByName, req) : !isProtectedWrite(req))
+            if (guardedByName !== undefined ? !heldBy("policy.sensitivePathGuardedByName", guardedByName, req) : !isProtectedWrite(req))
                 return { action: "allow" };
             const protective = protectivePathTargetOf(req);
             const path = writeTargetPath(req, protective);

package/dist/core/side-query.d.ts

@@ -76,9 +76,13 @@ export interface SideQuerySpec {
 export interface SideQueryResult {
     /** Concatenated assistant text (may be empty when the reply is tool-calls-only). */
     text: string;
-    /** Tool calls the model made against the DEFINITIONS (never executed by the engine). */
+    /** Tool calls the model made against the DEFINITIONS (never executed by the engine). `id` is the engine id;
+     *  `wireId` is the provider's own spelling, present only when the two differ (`ToolCall.wireId`, the same
+     *  source). A caller replaying a call carries both on its `toolCall` block and keys the result by `id`; one that
+     *  talks to the provider itself hands it `wireId ?? id`. */
     toolCalls: Array<{
         id: string;
+        wireId?: string;
         name: string;
         args: unknown;
     }>;

package/dist/core/side-query.js

@@ -2,6 +2,7 @@ import { resolveTaskModel } from "./roles.js";
 import { readDegradation } from "../brain/degrading.js";
 import { cacheFamilyOf, uncachedInputTokensOf } from "./runner/usage-accounting.js";
 import { providerReportedModel } from "./message-utils.js";
+import { providerToolCallId } from "../brain/tool-call-id.js";
 function normalizeSideQueryUsage(model, u) {
     const input = uncachedInputTokensOf(cacheFamilyOf(model), u);
     return input === u.input ? u : { ...u, input };
@@ -61,7 +62,10 @@ export async function runSideQuery(spec, deps) {
         .join("");
     const toolCalls = msg.content
         .filter((c) => c.type === "toolCall")
-        .map((c) => ({ id: c.id, name: c.name, args: c.arguments }));
+        .map((c) => {
+        const wireId = providerToolCallId(c);
+        return { id: c.id, ...(wireId !== c.id ? { wireId } : {}), name: c.name, args: c.arguments };
+    });
     const degraded = readDegradation(msg);
     const servedModel = typeof msg.model === "string" && msg.model.length > 0 ? msg.model : resolved.model.id;
     const reportedModel = providerReportedModel(msg);