@sema-agent/core 7.35.2 → 7.36.0

package/dist/core/gate-lanes.js

@@ -11,13 +11,15 @@ import { CD_GIT_COMPOUND_SENTENCE, changesDirectoryBeforeGit, readOnlyShellVerdi
 import { readShellCommand } from "./shell-lexer.js";
 import { COMMAND_RULE_TOOL } from "./permission-rule-model.js";
 import { catalogRuleFaceOf } from "./tool-registry.js";
-import { callAnswersTo, callFaceSeat } from "./tool-roster.js";
+import { callFaceSeat } from "./tool-roster.js";
+import { heldBy, wireOf } from "./tool-name-readings.js";
 import { modeAcceptsFileCommand } from "./mode-policy.js";
 import { ORG_ADJUDICATION_TIMEOUT_MS, ORG_RULE_DECISION_REASON, ORG_UNAVAILABLE_DECISION_REASON, settleOrgVerdictWithin } from "./permission-rule-org.js";
 import { exitGate } from "./runner/gate-exit.js";
 import { traceHookCrash } from "./gate-crash-trace.js";
 import { createGateDeadline, awaitWriteProtectionJudgment, withGateTimeout } from "./gate-bounded-await.js";
 import { thrownText } from "./thrown-value.js";
+const QUESTION_TOOL_NAMES = new Set([ASK_USER_QUESTION_TOOL_NAME]);
 function isPlainOwnRecord(x) {
     try {
         if (x === null || typeof x !== "object" || Array.isArray(x))
@@ -170,7 +172,7 @@ export async function runGateLanes(pass) {
         writeProtectionUnresolved: pass.writeProtectionUnresolved === true,
     });
     const askOriginFacts = (org, ruleCallUnreadable) => ({
-        contentQuestion: callAnswersTo(pass.req, ASK_USER_QUESTION_TOOL_NAME),
+        contentQuestion: heldBy("lanes.contentQuestionClass", QUESTION_TOOL_NAMES, pass.req),
         markedUnresolvable: markedUnresolvable(),
         org,
         ...(ruleCallUnreadable ? { ruleCallUnreadable } : {}),
@@ -195,7 +197,7 @@ export async function runGateLanes(pass) {
     const applyOrgLayer = async (current, args) => {
         if (input.orgRules === undefined)
             return { decision: current, org: undefined };
-        if (toolName === ASK_USER_QUESTION_TOOL_NAME && input.orgRules.contentAskToolMounted === true)
+        if (wireOf("lanes.orgContentAskExemption", pass.req) === ASK_USER_QUESTION_TOOL_NAME && input.orgRules.contentAskToolMounted === true)
             return { decision: current, org: undefined };
         let decided = current;
         let pending;
@@ -271,7 +273,7 @@ export async function runGateLanes(pass) {
         return await settleOrgVerdictWithin(pendingHit.then(normalizePersistedRuleHit).catch(() => ({ unreadable: true })), { unreadable: true }, { ...(input.abortSignal !== undefined ? { signal: input.abortSignal } : {}), timeoutMs: ORG_ADJUDICATION_TIMEOUT_MS });
     };
     const laneReq = { ...pass.req, ...(pass.policyRewrite !== undefined ? { args: pass.policyRewrite } : {}) };
-    const laneAnswer = input.persistedRules !== undefined && pass.req.toolName !== ASK_USER_QUESTION_TOOL_NAME ? await readPersistedRules(laneReq) : undefined;
+    const laneAnswer = input.persistedRules !== undefined && wireOf("lanes.persistedLaneSkip", pass.req) !== ASK_USER_QUESTION_TOOL_NAME ? await readPersistedRules(laneReq) : undefined;
     {
         const tightened = applyPersistedTightening(pass.decision, laneAnswer);
         pass.decision = tightened.decision;
@@ -299,7 +301,7 @@ export async function runGateLanes(pass) {
             pass.decision.action === "ask" &&
             pass.decision.requiresRealApproval !== true &&
             pass.decision.decisionReason !== "hook" &&
-            pass.req.toolName !== ASK_USER_QUESTION_TOOL_NAME &&
+            wireOf("lanes.allowLayerQuestionSkip", pass.req) !== ASK_USER_QUESTION_TOOL_NAME &&
             !markedUnresolvable();
         if (input.persistedRules && allowLayerMayClear()) {
             const answer = laneAnswer ?? {};
@@ -356,7 +358,7 @@ export async function runGateLanes(pass) {
             classifyStanding(stamped, originFacts);
             pass.decision = stampAskOrigin(stamped, originFacts);
         }
-        if (allowLayerMayClear() && pass.decision.action === "ask" && ruleMayClear() && pass.probeBoundaryDeclined !== true && pass.req.toolName === COMMAND_RULE_TOOL) {
+        if (allowLayerMayClear() && pass.decision.action === "ask" && ruleMayClear() && pass.probeBoundaryDeclined !== true && wireOf("lanes.readOnlyShellAllow", pass.req) === COMMAND_RULE_TOOL) {
             const commandParam = catalogRuleFaceOf(COMMAND_RULE_TOOL)?.primaryParams[0] ?? "command";
             const args = pass.req.args;
             const command = typeof args === "object" && args !== null && !Array.isArray(args) ? args[commandParam] : undefined;
@@ -435,7 +437,7 @@ export async function runGateLanes(pass) {
         }
         if (input.sandboxAdmission !== undefined &&
             pass.decision.action === "ask" &&
-            pass.req.toolName !== ASK_USER_QUESTION_TOOL_NAME &&
+            wireOf("lanes.sandboxQuestionSkip", pass.req) !== ASK_USER_QUESTION_TOOL_NAME &&
             input.isMarkedUnresolvable?.(input.event.toolCallId) !== true &&
             pass.decision.requiresRealApproval !== true &&
             pass.decision.decisionReason !== "hook" &&
@@ -463,7 +465,7 @@ export async function runGateLanes(pass) {
         if (pass.decision.action === "ask" && input.permissionMode !== undefined && pass.askClassification !== undefined) {
             const standing = pass.decision;
             const mode = input.permissionMode();
-            const fileCommandByWord = modeAcceptsFileCommand(mode, toolName, pass.policyRewrite ?? pass.currentInput);
+            const fileCommandByWord = modeAcceptsFileCommand(mode, wireOf("lanes.modeFileCommand", pass.req), pass.policyRewrite ?? pass.currentInput);
             const verdict = arbitrateByMode(mode, pass.askClassification, { ...(standing.origin !== undefined ? { origin: standing.origin } : {}), ...(standing.mandate !== undefined ? { mandate: standing.mandate } : {}) }, { fileCommand: pass.shellWritesPlaced === true && fileCommandByWord });
             if (verdict.kind === "ask" && fileCommandByWord && pass.shellWritesPlaced !== true && pass.shellUnplacedOptions !== undefined && pass.askClassification.classes.size === 1 && pass.askClassification.classes.has("ordinary")) {
                 pass.decision = { ...standing, message: fileCommandOptionsSentence(pass.shellUnplacedOptions.program) };
@@ -528,7 +530,7 @@ export async function runGateLanes(pass) {
                     return { suspend: suspended, preToolContext: pass.preToolContext };
             }
         }
-        if (pass.decision.action === "ask" && pass.req.toolName === ASK_USER_QUESTION_TOOL_NAME) {
+        if (pass.decision.action === "ask" && wireOf("lanes.contentAskRoute", pass.req) === ASK_USER_QUESTION_TOOL_NAME) {
             const outcome = input.resolveContentAsk !== undefined ? await (callSignal !== undefined ? input.resolveContentAsk(pass.req, callSignal) : input.resolveContentAsk(pass.req)) : { kind: "unavailable", parkDeclined: false };
             if (outcome.kind === "answered") {
                 pass.decision = { action: "allow", updatedInput: outcome.presentedInput };
@@ -692,7 +694,7 @@ export async function runGateLanes(pass) {
                         break;
                     }
                     let editRuleCallUnreadable = false;
-                    if (input.persistedRules !== undefined && toolName !== ASK_USER_QUESTION_TOOL_NAME) {
+                    if (input.persistedRules !== undefined && wireOf("lanes.persistedEditSkip", pass.req) !== ASK_USER_QUESTION_TOOL_NAME) {
                         const editLane = await readPersistedRules({ toolName, args: editArgs, toolCallId, ...(pass.req.face !== undefined ? { face: pass.req.face } : {}) });
                         editRuleCallUnreadable = ruleCallUnreadableOf(editLane);
                         const editTightened = applyPersistedTightening(recheck, editLane);

package/dist/core/governance-codes.d.ts

@@ -135,7 +135,7 @@ export type NoticeAudience = "user" | "operator";
  * the union's catalog ({@link EngineNotice.code}). The groups below say only which family a row joins,
  * so the catalog is not written a second time here and the two cannot drift.
  */
-export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.context_settings_swapped", "config.read_face_swapped", "config.read_face_deployment_clamped", "config.write_face_swapped", "config.write_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.artifact_host_invalid", "config.task_root_not_canonical", "config.write_protection_target_view_absent", "config.write_protection_unresolved", "config.execution_env_capability_invalid", "config.tool_card_undeclared", "config.tool_face_undeclared", "config.tool_face_invalid", "config.forward_sink_failed", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "config.secret_env_scrubbed", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "resume.legacy_mode_seed_migrated", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "classifier.fallback", "classifier.role_defaulted", "classifier.contract_broken", "classifier.unavailable", "checkpoint.execution_outcome_unrecorded", "delegation.transcript_integrity", "delegation.ask_unresolvable", "mcp.injection_dropped", "mcp.revocation_probe_failed", "mcp.server_redialed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "memory.restore_withheld", "memory.project_scope_absent", "route.fallback_to_primary", "route.classifier_unroutable", "route.base_url_changed_key_unchanged", "route.response_model_mismatch", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "task.interrupt_unconsumed", "approval.read_root_granted", "approval.read_root_grant_rejected", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "skills.listing_truncated", "agents.listing_truncated", "tool_result.offload_put_failed"];
+export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.context_settings_swapped", "config.read_face_swapped", "config.read_face_deployment_clamped", "config.write_face_swapped", "config.write_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.artifact_host_invalid", "config.task_root_not_canonical", "config.write_protection_target_view_absent", "config.write_protection_unresolved", "config.execution_env_capability_invalid", "config.tool_card_undeclared", "config.tool_face_undeclared", "config.tool_face_invalid", "config.forward_sink_failed", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "config.secret_env_scrubbed", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "resume.legacy_mode_seed_migrated", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "classifier.fallback", "classifier.role_defaulted", "classifier.contract_broken", "classifier.unavailable", "checkpoint.execution_outcome_unrecorded", "delegation.transcript_integrity", "delegation.ask_unresolvable", "mcp.injection_dropped", "mcp.revocation_probe_failed", "mcp.server_redialed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "memory.restore_withheld", "memory.project_scope_absent", "route.fallback_to_primary", "route.classifier_unroutable", "route.base_url_changed_key_unchanged", "route.response_model_mismatch", "route.tool_call_id_folded", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "task.interrupt_unconsumed", "approval.read_root_granted", "approval.read_root_grant_rejected", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "skills.listing_truncated", "agents.listing_truncated", "tool_result.offload_put_failed"];
 /** A code this engine mints (see {@link ENGINE_NOTICE_CODES}). NOT the type of
  *  `EngineNotice.code`, which stays `string` — a host forwarding its own notices through the same
  *  sink is a supported shape, and narrowing that field would break it. */

package/dist/core/governance-codes.js

@@ -178,6 +178,7 @@ export const ENGINE_NOTICE_CODES = [
     "route.classifier_unroutable",
     "route.base_url_changed_key_unchanged",
     "route.response_model_mismatch",
+    "route.tool_call_id_folded",
     "task.user_steer_undrained",
     "task.user_followup_undrained",
     "steering.parked_input_blocked",
@@ -269,6 +270,7 @@ const NOTICE_AUDIENCE_TABLE = {
     "route.classifier_unroutable": "operator",
     "route.base_url_changed_key_unchanged": "operator",
     "route.response_model_mismatch": "operator",
+    "route.tool_call_id_folded": "operator",
     "skills.listing_truncated": "operator",
     "agents.listing_truncated": "operator",
     "tool_result.offload_put_failed": "operator",

package/dist/core/hooks.d.ts

@@ -474,6 +474,9 @@ export interface PostToolUseFailureResult {
 /** One resolved call in a postToolBatch payload (CC PostToolBatchToolCall shape, thin projection —
  *  `response` is a bounded text digest of the result, never the full details object). */
 export interface PostToolBatchCall {
+    /** The name the model spelled on the tool_use block (an alias stays an alias) — the reference's PostToolBatch payload
+     *  names each block the same way, while the per-call post hooks receive the resolved tool's wire name. Correlate
+     *  the two faces by `toolCallId`. */
     toolName: string;
     input: unknown;
     toolCallId: string;

package/dist/core/hooks.js

@@ -11,6 +11,7 @@ import { isAskOrigin } from "./ask-origin.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 export { formatHookFeedback } from "./reminder-mint.js";
 import { createSafeNotifier } from "./safe-notify.js";
+import { wireOf } from "./tool-name-readings.js";
 export const DEFAULT_HOOK_TIMEOUT_MS = 600_000;
 export const MAX_HOOK_TIMEOUT_MS = 2_147_483_647;
 const POST_ABORT_GRACE_MS = 1_000;
@@ -247,9 +248,10 @@ export async function runToolGate(input) {
     const { event, preToolUse, adjudicate, resolveAsk, suspendAsk } = input;
     const { toolCallId, toolName } = event;
     const callSignal = input.callSignal;
+    const screenedName = wireOf("gate.preToolUse", event);
     const hookCtx = (seatSignal) => ({
         toolCallId,
-        toolName,
+        toolName: screenedName,
         ...(seatSignal !== undefined ? { signal: seatSignal } : {}),
         ...(() => {
             const c = input.trackedCwd?.();
@@ -284,7 +286,7 @@ export async function runToolGate(input) {
     };
     const screening = preToolUse !== undefined
         ? {
-            screen: (args) => runHookSeat("preToolUse", seatBound(true), (sig) => preToolUse(toolName, args, hookCtx(sig))),
+            screen: (args) => runHookSeat("preToolUse", seatBound(true), (sig) => preToolUse(screenedName, args, hookCtx(sig))),
             screened: screenPreToolUseResult,
             crashReason: preToolUseCrashReason,
             unansweredReason: preToolUseUnansweredBlock,

package/dist/core/mode-policy.js

@@ -1,6 +1,7 @@
 import { createFsWriteGatePolicy } from "./fs-write-gate-policy.js";
 import { isProtectedWrite } from "./tool-registry.js";
 import { rosterEntryNamed } from "./tool-roster.js";
+import { wireOf } from "./tool-name-readings.js";
 import { clampPermissionMode } from "./ask-origin.js";
 import { argvOf, lexShellText } from "../shell/lex.js";
 import { COMMAND_RULE_TOOL } from "./permission-rule-model.js";
@@ -42,7 +43,7 @@ const ENGINE_ROSTER_SOURCES = new Set(["builtin", "synthetic"]);
 export function planRefusesWrite(req, roster, readOnlyDeclared) {
     if (isProtectedWrite(req))
         return true;
-    const row = roster === undefined ? undefined : rosterEntryNamed(roster, req.toolName);
+    const row = roster === undefined ? undefined : rosterEntryNamed(roster, wireOf("mode.planRosterRow", req));
     return row !== undefined && !ENGINE_ROSTER_SOURCES.has(row.source) && row.effect !== "read" && !(row.effectProvenance === "default" && readOnlyDeclared?.(row.name) === true);
 }
 const planAsk = (message) => ({ action: "ask", message, decisionReason: "mode" });

package/dist/core/permission-rule-model.d.ts

@@ -141,8 +141,8 @@ export declare const READ_RULE_TOOL = "Read";
  * catalog's declarations, exactly as the protective fences' covered set does.
  */
 export declare function ruleToolGrammarOf(toolName: string): "command" | "path" | undefined;
-/** The names the persisted grammar judges a call under: every one of the call's rule names (`ruleNamesOf` — the wire
- *  name, then the aliases that resolve to it) the grammar speaks for, so a stored `Bash(…)` or `Edit(…)` row reaches a
+/** The names the persisted grammar judges a call under: every name the call answers to (the model's spelling, the wire
+ *  name, the other aliases that resolve to it) the grammar speaks for, so a stored `Bash(…)` or `Edit(…)` row reaches a
  *  tool that answers to that name under another wire name, as a policy's rule does. Empty ⇒ the grammar speaks for none. */
 export declare function laneToolNamesOf(req: Pick<import("./tool-policy.js").ToolCallRequest, "toolName" | "face">): readonly string[];
 /**

package/dist/core/permission-rule-model.js

@@ -4,7 +4,7 @@ import { compileReadDeny } from "../tools/fs/read-deny.js";
 import { carriesShellRedirection, parseLeadingCommandName, splitShellCompoundSegments } from "../tools/fs/bash-readonly-classifier.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 import { pathTargetOf } from "./tool-registry.js";
-import { ruleNamesOf } from "./tool-roster.js";
+import { heldValues } from "./tool-name-readings.js";
 import { carriesDotSegment, isAbsoluteForFamily, isIdentityDir, isPathIdentity, isShellRootedSpellingUnmapped, isUncIdentity, pathFamilyOf, pathIdentityOf } from "../tools/fs/safety.js";
 import { readShellCommand } from "./shell-lexer.js";
 import { readOnlyLineObjection, readOnlyShellVerdict } from "./read-only-shell.js";
@@ -32,7 +32,7 @@ export function ruleToolGrammarOf(toolName) {
     return pathTargetOf(toolName) !== undefined ? "path" : undefined;
 }
 export function laneToolNamesOf(req) {
-    return ruleNamesOf(req).filter((n) => ruleToolGrammarOf(n) !== undefined);
+    return heldValues("policy.persistedGrammar", { get: (n) => (ruleToolGrammarOf(n) !== undefined ? n : undefined) }, req);
 }
 export const MAX_RULE_TEXT_CHARS = 512;
 export const BARE_INTERPRETER_NAMES = new Set([

package/dist/core/permission-rules.js

@@ -6,7 +6,7 @@ import { pathFamilyOf, pathIdentityOf, spellingOfIdentity } from "../tools/fs/sa
 import { effectivePathTargetOf } from "./effective-path-target.js";
 import { protectivePathTargetOf } from "./tool-registry.js";
 import { ruleDenialSentence } from "./rule-denial-sentence.js";
-import { ruleNamesOf } from "./tool-roster.js";
+import { heldValues } from "./tool-name-readings.js";
 export { parsePermissionRule };
 export const BASH_GENERIC_PARAMS = new Set(catalogRuleFaceOf("Bash")?.params ?? []);
 const DEFAULT_CAPS = {
@@ -381,10 +381,7 @@ export function createPermissionRulePolicy(rules, opts) {
         requiresRealApproval: true,
     });
     const entryFor = (req) => {
-        const entries = ruleNamesOf(req).flatMap((n) => {
-            const e = byTool.get(n);
-            return e !== undefined ? [e] : [];
-        });
+        const entries = heldValues("policy.permissionRules", byTool, req);
         if (entries.length <= 1)
             return entries[0];
         const bare = {};

package/dist/core/runner/active-skill-scope.js

@@ -3,7 +3,7 @@ import { pathTargetValue } from "../tool-registry.js";
 import { pathTargetBaseOf } from "../effective-path-target.js";
 import { PATH_WRITE_TOOLS, isWithin } from "./session-rule-policy.js";
 import { parseSkillToolEntry, skillSpecifierRejection } from "../skill-tool-specifier.js";
-import { ruleNamesOf } from "../tool-roster.js";
+import { heldValues, wireOf } from "../tool-name-readings.js";
 export class ActiveSkillScope {
     frames = [];
     push(frame) {
@@ -23,7 +23,7 @@ export function createActiveSkillScopePolicy(opts) {
     const { scope, env, rootPath, toolEffects } = opts;
     return {
         async check(req, signal) {
-            const names = ruleNamesOf(req);
+            const entriesFor = (byName) => heldValues("policy.skillScope", byName, req).flat();
             const frames = scope.active();
             if (frames.length === 0)
                 return { action: "allow" };
@@ -48,7 +48,7 @@ export function createActiveSkillScopePolicy(opts) {
                 }
                 return { manifest: m, byName };
             });
-            if (perFrame.length === 0 || perFrame.some((f) => !names.some((n) => f.byName.has(n)))) {
+            if (perFrame.length === 0 || perFrame.some((f) => entriesFor(f.byName).length === 0)) {
                 const ids = manifests.map((m) => m.lineageId).join(", ");
                 return {
                     action: "deny",
@@ -57,7 +57,7 @@ export function createActiveSkillScopePolicy(opts) {
                 };
             }
             for (const frame of perFrame) {
-                const alternatives = names.flatMap((n) => frame.byName.get(n) ?? []);
+                const alternatives = entriesFor(frame.byName);
                 const rejections = [];
                 let admitted = false;
                 for (const entry of alternatives) {
@@ -80,7 +80,7 @@ export function createActiveSkillScopePolicy(opts) {
             const declaredTarget = req.face?.pathTarget;
             const skillScopeEligible = declaredTarget !== undefined && declaredTarget.skillScopeEligible === true;
             if (pathConstrainingActive && !skillScopeEligible) {
-                const eff = toolEffects?.get(req.toolName) ?? "write";
+                const eff = toolEffects?.get(wireOf("policy.skillScope.effect", req)) ?? "write";
                 if (eff !== "read") {
                     const ids = manifests.filter((m) => m.allowPaths?.length).map((m) => m.lineageId).join(", ");
                     return {

package/dist/core/runner/decide-continuation.js

@@ -3,6 +3,7 @@ import { boundInputHashOf } from "../canonical-json.js";
 import { CheckpointError } from "../checkpoint-store.js";
 import { formatHookFeedback } from "../hooks.js";
 import { delimitUntrusted, REVIEWER_NOTE_MAX_BODY } from "../untrusted-text.js";
+import { wireOf } from "../tool-name-readings.js";
 export function resumeDecisionWasNegative(resume) {
     const o = resume.outcome;
     return o.decision === "reject" || o.decision === "deny";
@@ -49,7 +50,7 @@ export function sameWinner(incoming, persisted) {
         (persisted.reason === undefined || incoming.reason === persisted.reason));
 }
 export function pendingContentAskCallId(cp) {
-    return cp.pendingAction.kind === "tool_approval" && cp.pendingAction.toolName === ASK_USER_QUESTION_TOOL_NAME
+    return cp.pendingAction.kind === "tool_approval" && wireOf("resume.contentAskRow", cp.pendingAction) === ASK_USER_QUESTION_TOOL_NAME
         ? cp.pendingAction.toolCallId
         : undefined;
 }

package/dist/core/runner/permission-rule-lanes.d.ts

@@ -241,6 +241,9 @@ export declare function createRuleOffersOf(cfg: {
     shellGatedTools: {
         has(name: string): boolean;
     };
+    toolMarkSources: {
+        get(name: string): ReadonlySet<string> | undefined;
+    };
     taskRoot: string | undefined;
     /** The live tracked-cwd ref (read per call — the relative-cd resolution base). */
     cwdRef: {

package/dist/core/runner/permission-rule-lanes.js

@@ -3,7 +3,8 @@ import {} from "../hooks.js";
 import { adjudicatePersistedPathRules, adjudicatePersistedRules, laneToolNamesOf, ruleToolGrammarOf, segmentCoverageOf, suggestRulesForCommand } from "../permission-rule-model.js";
 import { isAbsolutePathForm } from "../../tools/fs/safety.js";
 import { effectivePathTargetOf } from "../effective-path-target.js";
-import { anyNamed, declaredPathTargetOf, firstNamed, protectivePathTargetOf, ruleNamesOf } from "../tool-registry.js";
+import { declaredPathTargetOf, protectivePathTargetOf } from "../tool-registry.js";
+import { heldBy, seatOf, wireOf } from "../tool-name-readings.js";
 import { orgRuleVerdictFor } from "../permission-rule-org.js";
 import { ownerStoreOf } from "../permission-rule-provider.js";
 import { thrownText } from "../thrown-value.js";
@@ -92,7 +93,7 @@ export function createPermissionRuleLanes(cfg) {
     const org = provider.partitions.org
         ? {
             adjudicate: async (req) => {
-                if (req.toolName === cfg.questionToolName && cfg.questionToolMounted)
+                if (wireOf("offer.orgQuestionExemption", req) === cfg.questionToolName && cfg.questionToolMounted)
                     return { status: "available" };
                 let resolution;
                 try {
@@ -158,16 +159,16 @@ export function createPermissionRuleLanes(cfg) {
 }
 export function createRuleOffersOf(cfg) {
     return (call, args, ask) => {
-        const toolName = call.toolName;
+        const toolName = wireOf("offer.laneTool", call);
         if (!cfg.laneArmed || toolName !== PERSISTED_RULE_TOOL)
             return {};
         if ((cfg.principal === undefined || cfg.principal === "") && !cfg.localOwnerDeclared)
             return {};
-        const tierSeat = firstNamed(cfg.irreversibilityTier, ruleNamesOf(call));
+        const tierSeat = seatOf("offer.marks", cfg.irreversibilityTier, call);
         const closedDoor = ruleClearanceOf(ask, {
-            egress: anyNamed(cfg.egressTools, ruleNamesOf(call)),
+            egress: heldBy("offer.marks.egress", cfg.egressTools, call),
             irreversibility: tierSeat?.value,
-            shellGated: tierSeat !== undefined && cfg.shellGatedTools.has(tierSeat.name),
+            shellGated: tierSeat?.shellGated(cfg.shellGatedTools, cfg.toolMarkSources) === true,
         }).word;
         if (closedDoor !== undefined)
             return { ruleOffersAbsence: closedDoor };

package/dist/core/runner/prepare-context-lane.d.ts

@@ -24,6 +24,7 @@ import { type RunnerDeps } from "../types.js";
 import type { Prepared, PreparedMicroCompact } from "./contracts.js";
 import { type GitStatusLaneRef } from "./git-status-frame.js";
 import type { ReadFileState } from "../../tools/fs/safety.js";
+import { type ToolRosterDeltaSeat } from "../tool-roster.js";
 export interface PrepareContextLaneInput {
     /** borrowed-readonly — the task model: the budgets, the trigger-window geometry and `charsPerToken` are read off it. */
     model: Model;
@@ -39,6 +40,8 @@ export interface PrepareContextLaneInput {
     hostTaskId: string;
     /** borrowed-readonly — the run's offload store, or undefined (the caps' and the machine's persist seat). */
     offloadStore: ToolResultStore | undefined;
+    /** borrowed-readonly — the leg's live roster: a recorded tool name is judged as the wire name it resolves to. */
+    toolRosterDeltas: ToolRosterDeltaSeat;
     /** borrowed-readonly — the doors' RESOLVED microCompact knob (immutable values, never the deps bag). */
     microCompactKnob: {
         machine: MicroCompactMachine;
@@ -135,6 +138,7 @@ export interface GuardChainArgs {
     offloadStore: import("../tool-result-store.js").ToolResultStore | undefined;
     sessionId: string;
     taskId: string;
+    toolNameOf?: (recorded: string) => string;
     deps: RunnerDeps;
     trimPressureRef: {
         droppedMessages: boolean;

package/dist/core/runner/prepare-context-lane.js

@@ -8,8 +8,10 @@ import { emitTrace } from "../trace.js";
 import { deliverEngineNotice } from "../types.js";
 import { applyGitFrameGuard } from "./git-status-frame.js";
 import { applyContextShrinkToReadFileState } from "../../tools/fs/index.js";
+import { rosterToolName } from "../tool-roster.js";
 export function prepareContextLane(input) {
-    const { model, deps, sessionId, runId, hostTaskId, offloadStore, microCompactKnob, harness, batchHaltRef, gitStatusRef, postureFrameRef, requestLossyRef, trimPressureRef, readFileState } = input;
+    const { model, deps, sessionId, runId, hostTaskId, offloadStore, toolRosterDeltas, microCompactKnob, harness, batchHaltRef, gitStatusRef, postureFrameRef, requestLossyRef, trimPressureRef, readFileState } = input;
+    const toolNameOf = (recorded) => rosterToolName(toolRosterDeltas.current, recorded);
     const contextOverlay = input.contextOverlay ?? (() => undefined);
     const requestGeometry = () => {
         const current = harness.getModel();
@@ -27,7 +29,7 @@ export function prepareContextLane(input) {
             const replay = replayClearedProjection(healed, microCompact.ledger);
             const replayed = replay.messages;
             const capped = await capAggregateToolResults(replayed, {
-                store: offloadStore,
+                store: offloadStore, toolNameOf,
                 sessionId,
                 onCapped: (info) => pendingProjectionObservations.push(() => emitTrace(deps.tracer, () => ({
                     kind: "tool_result.capped",
@@ -49,7 +51,7 @@ export function prepareContextLane(input) {
             });
             let ccPass;
             const edited = microCompact.machine === "off" ? mediaCapped : clearStaleToolResults(mediaCapped, {
-                budgetTokens: editAt,
+                budgetTokens: editAt, toolNameOf,
                 clearSource: replayed,
                 onCleared: (pass) => { ccPass = pass; },
                 anchoredTotalTokens: estimateContextTokens(mediaCapped, cpt).tokens,
@@ -67,7 +69,7 @@ export function prepareContextLane(input) {
             }
             const chain = await runGuardChain({
                 edited, replayed, index: replay.index, microCompact, guardAt, charsPerToken: cpt, offloadStore,
-                sessionId, taskId: hostTaskId, deps, trimPressureRef, recheck, signal,
+                sessionId, taskId: hostTaskId, deps, trimPressureRef, recheck, signal, toolNameOf,
                 pendingProjectionObservations,
                 ...(readFileState !== undefined ? { readFileState } : {}),
             });
@@ -221,7 +223,7 @@ export async function runGuardChain(args) {
     if (microCompact.machine === "off" && anchoredWorking > guardAt) {
         let blockingPass;
         const blockingEdited = clearStaleToolResults(working, {
-            budgetTokens: guardAt,
+            budgetTokens: guardAt, toolNameOf: args.toolNameOf,
             clearSource: args.replayed,
             onCleared: (pass) => { blockingPass = pass; },
             anchoredTotalTokens: anchoredWorking,

package/dist/core/runner/prepare-gate-stations.js

@@ -9,8 +9,10 @@ import { askUnresolvableNotice } from "../ask-unresolvable-notice.js";
 import { askReachesPerson } from "../wiring-manifest.js";
 import { classifierUnavailableSeat } from "./classifier-ladder.js";
 import { PATH_CONFINABLE_WRITE_TOOLS } from "./session-rule-policy.js";
-import { anyNamed, callAnswersTo, callFaceSeat, firstNamed, rosterToolName, ruleNamesOf, toolCallFaceOf } from "../tool-roster.js";
+import { callFaceSeat, rosterToolName, toolCallFaceOf } from "../tool-roster.js";
+import { heldBy, heldValues, seatOf, wireOf } from "../tool-name-readings.js";
 import { noteHostRewrite } from "../frame-settlement.js";
+const PEER_MESSAGE_NAMES = new Set([SEND_MESSAGE_TOOL_NAME]);
 function screenGateResult(result) {
     if (result.suspend !== undefined)
         return { defects: [] };
@@ -88,12 +90,12 @@ export function prepareGateStations(input) {
             harness.on("tool_call", async (called) => {
                 const e = { ...called, toolName: rosterToolName(toolRosterDeltas.current, called.toolName) };
                 const call = { toolName: e.toolName, ...callFaceSeat(toolCallFaceOf(toolRosterDeltas.current, called.toolName)) };
-                const names = ruleNamesOf(call);
-                const tierSeat = firstNamed(irreversibilityTier, names);
+                const tierSeat = seatOf("gate.shellSeat", irreversibilityTier, call);
+                const markSources = new Set(heldValues("gate.markSources", toolMarkSources, call).flatMap((s) => [...s]));
                 blockedToolCalls.delete(e.toolCallId);
                 inheritedAskGrants.delete(e.toolCallId);
                 {
-                    const complianceDeny = names.map((n) => complianceCallDenial(complianceDenies, n)).find((d) => d !== undefined);
+                    const complianceDeny = heldValues("gate.compliance", { get: (n) => complianceCallDenial(complianceDenies, n) }, call)[0];
                     if (complianceDeny !== undefined) {
                         if (blockedTracked)
                             blockedToolCalls.add(e.toolCallId);
@@ -122,19 +124,19 @@ export function prepareGateStations(input) {
                         resolveAsk: resolveAskBound,
                         suspendAsk,
                         resolveContentAsk,
-                        egress: anyNamed(egressTools, names),
-                        peerMessage: callAnswersTo(call, SEND_MESSAGE_TOOL_NAME),
+                        egress: heldBy("gate.egress", egressTools, call),
+                        peerMessage: heldBy("gate.peerMessage", PEER_MESSAGE_NAMES, call),
                         ...(writeProtectionCheck !== undefined ? { writeProtectionCheck } : {}),
                         ...(shellReadCheck !== undefined ? { shellReadCheck } : {}),
                         irreversibility: tierSeat?.value,
-                        reversibilityProbe: tierSeat !== undefined ? reversibilityProbes.get(tierSeat.name) : undefined,
+                        reversibilityProbe: tierSeat?.read(reversibilityProbes),
                         abortSignal: abortController.signal,
                         ...(notifyPermissionDenied ? { permissionDenied: notifyPermissionDenied } : {}),
                         onHookError: notifyHookError,
-                        shellGated: tierSeat !== undefined && shellGatedTools.has(tierSeat.name),
+                        shellGated: tierSeat?.shellGated(shellGatedTools, toolMarkSources) === true,
                         ...(autoModeDecider.current !== undefined ? { autoMode: { decider: autoModeDecider.current, ...(autoModeDenialTracking.current !== undefined ? { denialTracking: autoModeDenialTracking.current } : {}), unavailable: classifierUnavailableSeat({ station: "leg", ...(autoModeDecider.current.timeoutMs !== undefined ? { budgetMs: autoModeDecider.current.timeoutMs } : {}), approvalSeat: askReachesPerson(askRoute), onNotice: deps.onNotice, sessionId, runId }) } } : {}),
                         permissionMode: () => permissionMode.current,
-                        ...(() => { const s = firstNamed(toolMarkSources, names)?.value; return s !== undefined ? { toolMarkSources: s } : {}; })(),
+                        ...(markSources.size > 0 ? { toolMarkSources: markSources } : {}),
                         ...(a2aIsolatePeers === true ? { a2aIsolatePeers: true } : {}),
                         onModeReleased,
                         ancestorArbitrationOf: (toolCallId) => ancestorArbitrations.get(toolCallId),
@@ -243,6 +245,7 @@ export function prepareGateStations(input) {
             }
             let content = e.content;
             let changed = false;
+            const post = { toolName: rosterToolName(toolRosterDeltas.current, e.toolName) };
             if (e.isError) {
                 if (hooks?.postToolUseFailure) {
                     let clonedDetails = e.details;
@@ -251,7 +254,8 @@ export function prepareGateStations(input) {
                     }
                     catch {
                     }
-                    const failureSeat = await runHookSeat("postToolUseFailure", { timeoutMs: hookTimeoutMs, signal: abortController.signal }, (sig) => hooks.postToolUseFailure(e.toolName, e.input, {
+                    const failedName = wireOf("hook.postToolUseFailure", post);
+                    const failureSeat = await runHookSeat("postToolUseFailure", { timeoutMs: hookTimeoutMs, signal: abortController.signal }, (sig) => hooks.postToolUseFailure(failedName, e.input, {
                         error: e.content
                             .filter((c) => c.type === "text")
                             .map((c) => c.text)
@@ -259,7 +263,7 @@ export function prepareGateStations(input) {
                         isInterrupt: abortController.signal.aborted || spec.signal?.aborted === true,
                         content: e.content.map((c) => ({ ...c })),
                         details: clonedDetails,
-                    }, { toolCallId: e.toolCallId, toolName: e.toolName, signal: sig, ...(handsCwdRef?.current !== undefined ? { cwd: handsCwdRef.current } : {}), ...(hookEnvFace !== undefined ? { env: hookEnvFace } : {}), identity: hookIdentity }));
+                    }, { toolCallId: e.toolCallId, toolName: failedName, signal: sig, ...(handsCwdRef?.current !== undefined ? { cwd: handsCwdRef.current } : {}), ...(hookEnvFace !== undefined ? { env: hookEnvFace } : {}), identity: hookIdentity }));
                     if (failureSeat.expired) {
                         notifyOwnHookCrash(hookSeatExpiredError("postToolUseFailure", hookTimeoutMs, failureSeat.cause, "the observation was abandoned and its additionalContext dropped; the failure result itself is unchanged"));
                     }
@@ -271,7 +275,8 @@ export function prepareGateStations(input) {
                 }
             }
             else if (hooks?.postToolUse) {
-                const successSeat = await runHookSeat("postToolUse", { timeoutMs: hookTimeoutMs, signal: abortController.signal }, (sig) => hooks.postToolUse(e.toolName, e.input, { content: e.content, details: e.details, isError: e.isError }, { toolCallId: e.toolCallId, toolName: e.toolName, signal: sig, ...(handsCwdRef?.current !== undefined ? { cwd: handsCwdRef.current } : {}), ...(hookEnvFace !== undefined ? { env: hookEnvFace } : {}), identity: hookIdentity }));
+                const ranName = wireOf("hook.postToolUse", post);
+                const successSeat = await runHookSeat("postToolUse", { timeoutMs: hookTimeoutMs, signal: abortController.signal }, (sig) => hooks.postToolUse(ranName, e.input, { content: e.content, details: e.details, isError: e.isError }, { toolCallId: e.toolCallId, toolName: ranName, signal: sig, ...(handsCwdRef?.current !== undefined ? { cwd: handsCwdRef.current } : {}), ...(hookEnvFace !== undefined ? { env: hookEnvFace } : {}), identity: hookIdentity }));
                 if (successSeat.expired) {
                     notifyOwnHookCrash(hookSeatExpiredError("postToolUse", hookTimeoutMs, successSeat.cause, "the seat was abandoned; the tool result is delivered to the model UNMODIFIED (no updatedOutput, no additionalContext)"));
                 }

package/dist/core/runner/prepare-park-ask.d.ts

@@ -116,6 +116,8 @@ export interface PrepareParkAskInput {
     shellGatedTools: ReadonlySet<string>;
     /** borrowed-readonly — the per-tool tier, read only for the name the call's tier seat is read under (as at the gate). */
     irreversibilityTier: IrreversibilityTier;
+    /** borrowed-readonly — who marked each name's seat (the descriptor's `shellGated` reads it as the gate does). */
+    toolMarkSources: ReadonlyMap<string, ReadonlySet<import("../ask-origin.js").ToolMarkSource>>;
     /** borrowed-readonly — the operator's shell floor (`"always"`), persisted on a shell-gated descriptor; undefined = no floor. */
     effectiveShellGate: ShellGateDoctrine | undefined;
     /** borrowed-readonly — the EFFECTIVE durable-approval opt-in (the caller's, or the synthesized mandate scope): picks the

package/dist/core/runner/prepare-park-ask.js

@@ -15,7 +15,8 @@ import { checkpointScopeOf } from "./checkpoint-scope.js";
 import { CONTENT_ASK_BINDING_CAP } from "./content-ask-bindings.js";
 import { DEFAULT_UNATTENDED_APPROVAL_TTL_MS, publishCommittedSuspend, sanitizedTtlMs } from "./park-commit.js";
 import { remoteEnvFailureNote } from "./remote-env-retry.js";
-import { callFaceSeat, firstNamed, parkedToolIdentity, parkedToolFace, ruleNamesOf } from "../tool-roster.js";
+import { callFaceSeat, parkedToolIdentity, parkedToolFace } from "../tool-roster.js";
+import { seatOf, wireOf } from "../tool-name-readings.js";
 class ParkRefusal extends Error {
     constructor(message, options) {
         super(message, options);
@@ -26,7 +27,7 @@ const wordlessDemand = (toolName) => {
     throw new Error(`a real-approval demand for "${toolName}" reached the park with no origin word — the origin stamp precedes every park`);
 };
 export function prepareParkAsk(input) {
-    const { askLane, saga, spec, deps, sessionId, checkpointStore, toolRosterDeltas, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, advertisedWritableDirs, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedTools, irreversibilityTier, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, ruleOffersOf, now, humanReviewRef, abortController, harness, pausedRef } = input;
+    const { askLane, saga, spec, deps, sessionId, checkpointStore, toolRosterDeltas, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, advertisedWritableDirs, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedTools, irreversibilityTier, toolMarkSources, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, ruleOffersOf, now, humanReviewRef, abortController, harness, pausedRef } = input;
     if (askLane === undefined || saga === undefined)
         return { parkAsk: undefined };
     const { composedCallSignal, approvalPreviewOf } = askLane;
@@ -114,7 +115,7 @@ export function prepareParkAsk(input) {
     };
     const suspendAsk = parkLaneArmed && checkpointStore !== undefined
         ? async (req, postHookArgs, safety, liveFaceUnavailable, realApproval, shadowedRule, askDecisionReason, probeReason, probeCause, segmentCoverage, matchedAskRule, probeMandated, carry) => {
-            const syncFirstEligible = req.toolName === ASK_USER_QUESTION_TOOL_NAME ? contentAskRoutable(req.toolCallId) : isLiveApproverSeat(onAsk);
+            const syncFirstEligible = wireOf("park.syncFirstRoute", req) === ASK_USER_QUESTION_TOOL_NAME ? contentAskRoutable(req.toolCallId) : isLiveApproverSeat(onAsk);
             if (syncFirstEligible &&
                 runtimeCaps?.forceDurableGate !== true &&
                 liveFaceUnavailable !== true &&
@@ -234,7 +235,7 @@ export function prepareParkAsk(input) {
                     remoteHandle = parkOnlyHandle(parkOnlyRemoteEnv);
                 }
                 token = mintCheckpointToken();
-                const tierSeat = firstNamed(irreversibilityTier, ruleNamesOf(req));
+                const tierSeat = seatOf("park.riskDescriptor", irreversibilityTier, req);
                 const riskDescriptor = buildRiskDescriptor({
                     toolName: req.toolName,
                     args: parkedArgs,
@@ -242,7 +243,7 @@ export function prepareParkAsk(input) {
                     ...(shadowedRule !== undefined ? { shadowedRule } : {}),
                     ...(probeReason !== undefined ? { probeReason } : {}),
                     ...(probeCause !== undefined ? { probeCause } : {}),
-                    shellGated: tierSeat !== undefined && shellGatedTools.has(tierSeat.name),
+                    shellGated: tierSeat?.shellGated(shellGatedTools, toolMarkSources) === true,
                     ...(effectiveShellGate !== undefined ? { shellGateDoctrine: effectiveShellGate } : {}),
                 });
                 gate =
@@ -303,7 +304,7 @@ export function prepareParkAsk(input) {
                         kind: "tool_approval",
                         toolCallId: req.toolCallId,
                         toolName: req.toolName,
-                        ...parkedToolIdentity(toolRosterDeltas.current, req.toolName), ...parkedToolFace(toolRosterDeltas.current, req.toolName),
+                        ...parkedToolIdentity(toolRosterDeltas.current, req.toolName), ...parkedToolFace(toolRosterDeltas.current, req),
                         args: parkedArgs,
                         ...(() => {
                             const p = approvalPreviewOf(req.toolName, parkedArgs);

package/dist/core/runner/prepare-policy-chain.d.ts

@@ -85,6 +85,8 @@ export interface PreparePolicyChainInput {
     envHandToolNames: ReadonlySet<string>;
     /** borrowed-readonly — the shell-seat provenance set (the offer factory's `shellGated` mandate term, read per call). */
     shellGatedTools: ReadonlySet<string>;
+    /** borrowed-readonly — who marked each name's seat (the offer factory's `shellGated` term reads it as the gate does). */
+    toolMarkSources: ReadonlyMap<string, ReadonlySet<import("../ask-origin.js").ToolMarkSource>>;
     /** borrowed-readonly — the tracked-cwd seat, read per call by the lanes and the offer factory (never written here). */
     handsCwdRef: CwdRef | undefined;
     /** borrowed-readonly — the compiled read-deny judge, or undefined (the offer factory's directory negative control). */