@sema-agent/core 7.37.1 → 7.38.1

package/dist/core/runner/prepare-artifact.d.ts

@@ -18,7 +18,8 @@ import type { OnAsk } from "../tool-policy.js";
 import { type ArtifactPlane } from "../artifact-host.js";
 import { RosterBuilder } from "../tool-roster.js";
 import type { AgentTool, RunnerDeps } from "../types.js";
-import type { ReadDenyMatcher, ContainmentFace } from "../../tools/fs/index.js";
+import type { ContainmentFace } from "../../tools/fs/index.js";
+import type { PlacedReadDenyMatcher } from "../../tools/fs/read-deny-home.js";
 import { type ArtifactStoreRef } from "./read-root-grant.js";
 import type { Prepared } from "./contracts.js";
 export interface PrepareArtifactInput {
@@ -46,7 +47,7 @@ export interface PrepareArtifactInput {
      *  live set: an in-flight read-root grant widens it). */
     additionalRootsCanonical: () => readonly string[];
     /** borrowed-readonly — the read-deny matcher in force for the run, when any. */
-    readDenyMatcher: ReadDenyMatcher | undefined;
+    readDenyMatcher: PlacedReadDenyMatcher | undefined;
     /** borrowed-readonly — the resolved read face (`"open"` lifts root containment for reads). */
     resolvedReadFace: ContainmentFace | undefined;
     /** borrowed-readonly — the tracked-cwd cell; `current` is read per call as the relative-path base. */

package/dist/core/runner/prepare-context-lane.d.ts

@@ -2,21 +2,23 @@
  * PrepareTask's CONTEXT-LANE phase, verbatim from the driver: the edit/guard budgets, the
  * microCompact machine state with the trigger-window clamp's one loud outlet, the model's chars-per-token coordinate,
  * and the `context` handler registered on the harness — heal → ledger replay → aggregate tool-result and media caps →
- * frontier clear → the guard chain (arms A/B/C) → the git-frame guard → the orphan belt → the lossy-projection flag →
- * the projection seat. The four module-level helpers only this lane called moved with it (the machine-state builder,
- * the frontier-clear recorder, the observation-buffer flush, the guard chain with its two types). The interface is the
- * dependency list the segment had implicitly.
+ * frontier clear → the guard chain (arms A/B/C) → the git-frame guard → the lossy-projection flag → the projection
+ * seat — and the harness's sink for the provider boundary's tool-turn repairs (`engine/llm/tool-turns.ts`, the one
+ * law every request builder reads): the run's `context.tool_turn_repaired` seat, and the lossy flag's second half —
+ * a request the law left recorded content out of is lossy too. The four module-level helpers only this lane called
+ * moved with it (the machine-state builder, the frontier-clear recorder, the observation-buffer flush, the guard chain
+ * with its two types). The interface is the dependency list the segment had implicitly.
  *
  * SYNCHRONOUS FUNCTION, SYNCHRONOUS CALL: the stretch has no await of its own (the handler it registers is async and
  * runs per provider request), so the phase adds no yield between the gate stations before it and the turn wiring after
  * it. Read-stability of the host handles: {@link RunInternals} (`@contract prepare.deps-read-stable`).
  *
- * REGISTRATION SIDE EFFECT, OWNED: this phase registers the ONE `context` handler on the harness; the harness owns the
- * listener for the run's life (it is never unregistered — the harness is per prepare). No other station registers on
- * that hook.
+ * REGISTRATION SIDE EFFECT, OWNED: this phase registers the ONE `context` handler on the harness and sets its
+ * `onToolTurnRepaired` sink; the harness owns both for the run's life (never unregistered — the harness is per
+ * prepare). No other station registers on that hook or sets that sink.
  */
 import { type AgentHarness, type AgentMessage } from "../../internal/harness.js";
-import type { Model } from "../../internal/llm.js";
+import { type Model } from "../../internal/llm.js";
 import { type ClearedProjectionLedger, type MicroCompactMachine, type OccurrenceFingerprint, type OccurrenceIndex } from "../context-edit.js";
 import type { ContextWindowOverlay } from "../context-settings.js";
 import { type ToolResultStore } from "../tool-result-store.js";
@@ -28,9 +30,9 @@ import { type ToolRosterDeltaSeat } from "../tool-roster.js";
 export interface PrepareContextLaneInput {
     /** borrowed-readonly — the task model: the budgets, the trigger-window geometry and `charsPerToken` are read off it. */
     model: Model;
-    /** borrowed-readonly — the deployment seats, whole: `onNotice` (the clamp outlet, the offload-loss announcement), `tracer`
-     *  (the cap / clear / trim frames), `mediaByteCapBytes` and `onMediaStripped` (the media cap), `onError` (the belt line, the
-     *  git-frame degrade) — the guard chain and the machine-state builder read through the whole record. */
+    /** borrowed-readonly — the deployment seats, whole: `onNotice` (the clamp outlet, the offload-loss announcement, the
+     *  tool-turn repair seat), `tracer` (the cap / clear / trim frames), `mediaByteCapBytes` and `onMediaStripped` (the media
+     *  cap), `onError` (the git-frame degrade) — the guard chain and the machine-state builder read through the whole record. */
     deps: RunnerDeps;
     /** borrowed-readonly — the acquired session id (the offload persist key; every disclosure's attribution). */
     sessionId: string;
@@ -47,8 +49,9 @@ export interface PrepareContextLaneInput {
         machine: MicroCompactMachine;
         clearOnRejection: boolean;
     };
-    /** borrowed-mutable — the built harness. Writer here: `on("context", …)` — the ONE registration of the request-build
-     *  handler (the harness owns the listener; nothing unregisters it). */
+    /** borrowed-mutable — the built harness. Writers here: `on("context", …)` — the ONE registration of the request-build
+     *  handler (the harness owns the listener; nothing unregisters it) — and `onToolTurnRepaired`, the provider boundary's
+     *  repair sink. */
     harness: AgentHarness;
     /** borrowed-mutable — the turn's halt fact (`Prepared.batchHaltRef`). Writer here: the handler CLEARS it at every new
      *  provider request (a new request means the halted boundary was legitimately passed). The judgment site sets it. */
@@ -60,8 +63,9 @@ export interface PrepareContextLaneInput {
     postureFrameRef: {
         protectedText?: string;
     };
-    /** borrowed-mutable — the per-request lossy-projection flag. Writer here: the handler re-derives it at every request
-     *  build; the provider-seam recording shim reads it immediately after. */
+    /** borrowed-mutable — the per-request lossy-projection flag. Writers here: the handler re-derives it at every request
+     *  build, and the repair sink raises it when the provider boundary's law left recorded content out of the same request
+     *  (the boundary runs after the handler, before the recording shim); the shim reads it immediately after. */
     requestLossyRef: {
         current: boolean;
     };

package/dist/core/runner/prepare-context-lane.js

@@ -1,6 +1,7 @@
 import { DEFAULT_CHARS_PER_TOKEN, estimateContextTokens } from "../../internal/harness.js";
+import { TOOL_TURN_REPAIR_DROPS } from "../../internal/llm.js";
 import { clearStaleToolResults, createClearedProjectionLedger, dropEmptyFailureAssistants, editBudget, replayClearedProjection, resolveTriggerWindow } from "../context-edit.js";
-import { dropOrphanToolResults, guardBudget, insertTrimNotice, protectGitFrame, trimToBudget } from "../context-guard.js";
+import { guardBudget, insertTrimNotice, protectGitFrame, trimToBudget } from "../context-guard.js";
 import { AGGREGATE_MEDIA_BUDGET_BYTES, capAggregateMediaBytes } from "../media-byte-cap.js";
 import { capAggregateToolResults } from "../tool-result-budget.js";
 import { createOffloadPersist } from "../tool-result-store.js";
@@ -9,6 +10,7 @@ import { deliverEngineNotice } from "../types.js";
 import { applyGitFrameGuard } from "./git-status-frame.js";
 import { applyContextShrinkToReadFileState } from "../../tools/fs/index.js";
 import { rosterToolName } from "../tool-roster.js";
+import { createToolTurnRepairSeat } from "./tool-turn-repair-seat.js";
 export function prepareContextLane(input) {
     const { model, deps, sessionId, runId, hostTaskId, offloadStore, toolRosterDeltas, microCompactKnob, harness, batchHaltRef, gitStatusRef, postureFrameRef, requestLossyRef, trimPressureRef, readFileState } = input;
     const toolNameOf = (recorded) => rosterToolName(toolRosterDeltas.current, recorded);
@@ -20,6 +22,12 @@ export function prepareContextLane(input) {
     };
     const microCompact = buildMicroCompactState(deps, model, sessionId, runId, offloadStore, microCompactKnob, contextOverlay());
     const charsPerToken = model.charsPerToken ?? DEFAULT_CHARS_PER_TOKEN;
+    const announceRepairs = createToolTurnRepairSeat((notice) => deps.onNotice?.(notice), { sessionId, runId });
+    harness.onToolTurnRepaired = (repairs) => {
+        if (repairs.some((repair) => TOOL_TURN_REPAIR_DROPS[repair.form]))
+            requestLossyRef.current = true;
+        announceRepairs(repairs);
+    };
     harness.on("context", async ({ messages, recheck, signal }) => {
         batchHaltRef.current = undefined;
         const pendingProjectionObservations = [];
@@ -97,17 +105,6 @@ export function prepareContextLane(input) {
                 if (kept.action === "kept" || kept.action === "reinserted")
                     trimmed = kept.messages;
             }
-            const swept = dropOrphanToolResults(trimmed);
-            if (swept.dropped.length > 0) {
-                try {
-                    deps.onError?.(new Error(`context belt: dropped ${swept.dropped.length} orphan toolResult(s) whose tool-call assistant was not in the request view — ` +
-                        swept.dropped
-                            .map((d) => `toolCallId=${d.toolCallId} at index ${d.index} (prev=${d.prevRole}, next=${d.nextRole})`)
-                            .join("; ")), { phase: "hook", sessionId });
-                }
-                catch {
-                }
-            }
             requestLossyRef.current =
                 replayed !== healed ||
                     capped !== replayed ||
@@ -115,10 +112,9 @@ export function prepareContextLane(input) {
                     edited !== mediaCapped ||
                     working !== edited ||
                     trimDroppedMessages ||
-                    swept.dropped.length > 0 ||
                     gitStatusRef.overBudgetShrunk === true;
-            microCompact.projectionRef.current = { messages: swept.messages, keyOf: replay.index.keyOf };
-            return { messages: swept.messages };
+            microCompact.projectionRef.current = { messages: trimmed, keyOf: replay.index.keyOf };
+            return { messages: trimmed };
         }
         finally {
             flushProjectionObservations(pendingProjectionObservations);

package/dist/core/runner/prepare-gate-stations.js

@@ -102,7 +102,7 @@ export function prepareGateStations(input) {
                         const gate = directDeny("compliance");
                         gateOutcomes.set(e.toolCallId, gate);
                         if (notifyPermissionDenied) {
-                            await notifyPermissionDenied({ toolName: e.toolName, input: cloneObserverInput(e.input), toolCallId: e.toolCallId, reason: complianceDeny, gate, identity: hookIdentity });
+                            await notifyPermissionDenied({ toolName: e.toolName, input: cloneObserverInput(e.input), toolCallId: e.toolCallId, reason: complianceDeny, gate, identity: hookIdentity, permissionMode: permissionMode.observed });
                         }
                         return { block: true, reason: formatHookFeedback(complianceDeny, reminderMark), preToolContext: [] };
                     }
@@ -115,7 +115,7 @@ export function prepareGateStations(input) {
                         ...(e.signal !== undefined ? { callSignal: e.signal } : {}),
                         identity: hookIdentity,
                         reminderMark,
-                        preToolUse: ownGatePreToolUse,
+                        ...(ownGatePreToolUse !== undefined ? { preToolUse: (name, args, ctx) => ownGatePreToolUse(name, args, { ...ctx, permissionMode: permissionMode.observed }) } : {}),
                         hookTimeoutMs,
                         ...(handsCwdRef !== undefined ? { trackedCwd: () => handsCwdRef.current } : {}),
                         ...(hookEnvFace !== undefined ? { hookEnv: hookEnvFace } : {}),
@@ -131,7 +131,7 @@ export function prepareGateStations(input) {
                         irreversibility: tierSeat?.value,
                         reversibilityProbe: tierSeat?.read(reversibilityProbes),
                         abortSignal: abortController.signal,
-                        ...(notifyPermissionDenied ? { permissionDenied: notifyPermissionDenied } : {}),
+                        ...(notifyPermissionDenied ? { permissionDenied: (p) => notifyPermissionDenied({ ...p, permissionMode: permissionMode.observed }) } : {}),
                         onHookError: notifyHookError,
                         shellGated: tierSeat?.shellGated(shellGatedTools, toolMarkSources) === true,
                         ...(autoModeDecider.current !== undefined ? { autoMode: { decider: autoModeDecider.current, ...(autoModeDenialTracking.current !== undefined ? { denialTracking: autoModeDenialTracking.current } : {}), unavailable: classifierUnavailableSeat({ station: "leg", ...(autoModeDecider.current.timeoutMs !== undefined ? { budgetMs: autoModeDecider.current.timeoutMs } : {}), approvalSeat: askReachesPerson(askRoute), onNotice: deps.onNotice, sessionId, runId }) } } : {}),
@@ -263,7 +263,7 @@ export function prepareGateStations(input) {
                         isInterrupt: abortController.signal.aborted || spec.signal?.aborted === true,
                         content: e.content.map((c) => ({ ...c })),
                         details: clonedDetails,
-                    }, { toolCallId: e.toolCallId, toolName: failedName, signal: sig, ...(handsCwdRef?.current !== undefined ? { cwd: handsCwdRef.current } : {}), ...(hookEnvFace !== undefined ? { env: hookEnvFace } : {}), identity: hookIdentity }));
+                    }, { toolCallId: e.toolCallId, toolName: failedName, signal: sig, ...(handsCwdRef?.current !== undefined ? { cwd: handsCwdRef.current } : {}), ...(hookEnvFace !== undefined ? { env: hookEnvFace } : {}), identity: hookIdentity, permissionMode: permissionMode.observed }));
                     if (failureSeat.expired) {
                         notifyOwnHookCrash(hookSeatExpiredError("postToolUseFailure", hookTimeoutMs, failureSeat.cause, "the observation was abandoned and its additionalContext dropped; the failure result itself is unchanged"));
                     }
@@ -276,7 +276,7 @@ export function prepareGateStations(input) {
             }
             else if (hooks?.postToolUse) {
                 const ranName = wireOf("hook.postToolUse", post);
-                const successSeat = await runHookSeat("postToolUse", { timeoutMs: hookTimeoutMs, signal: abortController.signal }, (sig) => hooks.postToolUse(ranName, e.input, { content: e.content, details: e.details, isError: e.isError }, { toolCallId: e.toolCallId, toolName: ranName, signal: sig, ...(handsCwdRef?.current !== undefined ? { cwd: handsCwdRef.current } : {}), ...(hookEnvFace !== undefined ? { env: hookEnvFace } : {}), identity: hookIdentity }));
+                const successSeat = await runHookSeat("postToolUse", { timeoutMs: hookTimeoutMs, signal: abortController.signal }, (sig) => hooks.postToolUse(ranName, e.input, { content: e.content, details: e.details, isError: e.isError }, { toolCallId: e.toolCallId, toolName: ranName, signal: sig, ...(handsCwdRef?.current !== undefined ? { cwd: handsCwdRef.current } : {}), ...(hookEnvFace !== undefined ? { env: hookEnvFace } : {}), identity: hookIdentity, permissionMode: permissionMode.observed }));
                 if (successSeat.expired) {
                     notifyOwnHookCrash(hookSeatExpiredError("postToolUse", hookTimeoutMs, successSeat.cause, "the seat was abandoned; the tool result is delivered to the model UNMODIFIED (no updatedOutput, no additionalContext)"));
                 }

package/dist/core/runner/prepare-hands-readface.d.ts

@@ -1,5 +1,6 @@
-import { type BeforeWriteHook, type CwdRef, type ReadDenyMatcher, type PathRuleDenyRow, type ContainmentFace } from "../../tools/fs/index.js";
+import { type BeforeWriteHook, type CwdRef, type PathRuleDenyRow, type ContainmentFace } from "../../tools/fs/index.js";
 import { type ReadFileState } from "../../tools/fs/safety.js";
+import { type PlacedReadDenyMatcher } from "../../tools/fs/read-deny-home.js";
 import { type ShellReadAdmission, type ShellReadCheck } from "../../tools/fs/shell-read-check.js";
 import type { ShellReadBoundary } from "../../tools/fs/shell-read-judge.js";
 import type { RunnerDeps, ShellGateDoctrine, TaskSpec } from "../types.js";
@@ -254,8 +255,8 @@ export interface PrepareHandsReadFaceResult {
      *  reader applies the same containment the hands tools do. Undefined ⇔ hands-less. */
     attachmentRootCanonical: string | undefined;
     /** owned — the ONE compiled deny judge per prepare (built-ins ∪ deployment ∪
-     *  task additions). Undefined ⇔ hands-less (its consumers only exist with hands). */
-    readDenyMatcher: ReadDenyMatcher | undefined;
+     *  task additions), carrying the home views of its placement. Undefined ⇔ hands-less (its consumers only exist with hands). */
+    readDenyMatcher: PlacedReadDenyMatcher | undefined;
     /** owned — the shell-seat PROVENANCE set: the shell-running tools whose tier the engine's shell seat (read
      *  boundary + shape tier + shellGate floor) is the SOLE POSITIVE source of — no explicit deployment mark on that name.
      *  The one seat every consumer reads (risk grading, the gate's tighten attribution, the persisted-rule mandate

package/dist/core/runner/prepare-hands-readface.js

@@ -313,6 +313,7 @@ export async function prepareHandsMount(input) {
                 tools: shellReadTools,
                 seatOf: () => (handsReadOnly ? "readonly" : "full_shell"),
                 boundaryOf: () => readonlyBoundary() ?? shellReadBoundary(), rootsCanonical: true,
+                homeViews: readDenyPlacement.matcher.homeViews,
             });
         }
         if (!handsReadOnly) {

package/dist/core/runner/prepare-inherited-gate.js

@@ -36,7 +36,7 @@ export function prepareInheritedGate(input) {
     if (modeSeed.migrated !== undefined) {
         deliverEngineNotice(deps.onNotice, {
             code: "resume.legacy_mode_seed_migrated",
-            message: `the resumed checkpoint row carried pre-mode keys (${modeSeed.migrated.droppedKeys.join(", ")}); read once into ${modeSeed.migrated.permissionMode !== undefined ? `permissionMode: "${modeSeed.migrated.permissionMode}"` : "no mode of its own (the chain's ceiling stands)"}${modeSeed.shellGate !== undefined ? ' with the shell floor "always" kept' : ""} — the next suspend writes the one key; this migration is kept through 7.37.x and removed in 7.38.0, which refuses a row still carrying these keys (resume or abandon such rows before upgrading)`,
+            message: `the resumed checkpoint row carried pre-mode keys (${modeSeed.migrated.droppedKeys.join(", ")}); read once into ${modeSeed.migrated.permissionMode !== undefined ? `permissionMode: "${modeSeed.migrated.permissionMode}"` : "no mode of its own (the chain's ceiling stands)"}${modeSeed.shellGate !== undefined ? ' with the shell floor "always" kept' : ""} — the next suspend writes the one key; this migration is kept through 7.38.x and removed in 7.39.0, which refuses a row still carrying these keys (resume or abandon such rows before upgrading)`,
             detail: { migrated: { ...(modeSeed.migrated.permissionMode !== undefined ? { permissionMode: modeSeed.migrated.permissionMode } : {}), droppedKeys: [...modeSeed.migrated.droppedKeys] }, sessionId, runId },
         });
     }

package/dist/core/runner/prepare-policy-chain.js

@@ -14,7 +14,7 @@ import { createActiveSkillScopePolicy } from "./active-skill-scope.js";
 import { arbitrateByMode, askClassMembersOf, askMandateMember } from "../ask-origin.js";
 import { createModeGatePolicy, mountedToolDeclaresReadOnly } from "../mode-policy.js";
 const ancestorFacts = (ask) => ({ ...(ask ?? {}), ancestorResolved: true });
-import { headlessDenyAtFold, headlessDenyAtRecheck, INHERITED_STATION_FACTS, inheritedAskCarry, judgeInheritedClassifier, lateAskSettlementObserver, settleDenialLimitFallback } from "./denial-limit-arms.js";
+import { headlessDenyAtFold, headlessDenyAtRecheck, INHERITED_STATION_FACTS, inheritedAskCarry, inheritedAskFallbackMessage, judgeInheritedClassifier, lateAskSettlementObserver, settleDenialLimitFallback } from "./denial-limit-arms.js";
 import { settleReadRootGrant } from "./read-root-grant.js";
 import { askGrantShapeOf } from "./inherited-ask-grants.js";
 import { createPermissionRuleLanes, inheritedAskRuleEvidence, createRuleOffersOf } from "./permission-rule-lanes.js";
@@ -24,8 +24,8 @@ import { heldBy, heldValues, seatOf, wireOf } from "../tool-name-readings.js";
 export async function preparePolicyChain(input) {
     const { spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, additionalRootsCanonical, executionEnv, lockedPreflight, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, toolMarkSources, envHandToolNames, handsCwdRef, readDenyMatcher, announceRuleStoreSkipped, questionToolMounted, runtimeCaps, inheritedAncestorRules, ancestorSessionRulesRef, inheritedParentConstraints, seedInheritedGate, hasSkillManifest, skillScope, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider, permissionMode, scratchpadDir, toolRosterDeltas, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef } = input;
     const ancestorArbitrations = new Map();
-    const arbitrateInherited = (ask, toolCallId, classification) => {
-        const verdict = arbitrateByMode(permissionMode.current, classification, { ...(ask.origin !== undefined ? { origin: ask.origin } : {}), ...(ask.mandate !== undefined ? { mandate: ask.mandate } : {}) });
+    const arbitrateInherited = (ask, toolCallId, judged) => {
+        const verdict = arbitrateByMode(permissionMode.current, judged.classification, { origin: judged.origin, ...askMandateMember(ancestorFacts(judged.ask.action === "ask" ? judged.ask : undefined)) });
         if (verdict.kind === "ask" || verdict.kind === "accepted")
             return undefined;
         ancestorArbitrations.set(toolCallId, verdict);
@@ -300,7 +300,7 @@ export async function preparePolicyChain(input) {
         const seat = seatMarksOf(call);
         return {
             ...INHERITED_STATION_FACTS,
-            mandateMarks: { egress: seat.egress, shellGated: seat.shellGated, ...(seat.tier !== undefined ? { irreversibility: seat.tier } : {}) },
+            mandateMarks: { egress: seat.egress, shellGated: false, ...(seat.tier === "always" && !seat.shellGated ? { irreversibility: "always" } : {}) },
             ...(seat.sources.size > 0 ? { toolMarkSources: seat.sources } : {}),
             ...(deps.a2a?.isolatePeers === true ? { a2aIsolatePeers: true } : {}),
         };
@@ -382,7 +382,7 @@ export async function preparePolicyChain(input) {
                 return vetoed(judged.result);
             const { ask: editAsk, fallback: editFallback, mintedHere: editMintedHere } = judged;
             re = editAsk;
-            const editArbitrated = arbitrateInherited(re, creq.toolCallId, judged.classification);
+            const editArbitrated = arbitrateInherited(re, creq.toolCallId, judged);
             if (editArbitrated !== undefined) {
                 const out = editArbitrated.action === "allow" ? { action: "allow", updatedInput: editArgs } : editArbitrated;
                 carryPrecedingSettlement(settledBy, out);
@@ -393,7 +393,7 @@ export async function preparePolicyChain(input) {
                 toolCallId: creq.toolCallId,
                 args: editArgs,
                 ...ruleOffersOf(creq, editArgs, ancestorFacts(re)),
-                message: re.message ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
+                message: re.message ?? inheritedAskFallbackMessage(creq.toolName),
                 ...askSourceIdentity(),
                 ...riskAxesOf(creq),
                 ...(re.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
@@ -463,7 +463,7 @@ export async function preparePolicyChain(input) {
                         recordAncestorSandboxAdmission(creq.toolCallId, creq.toolName);
                         return { action: "allow" };
                     }
-                    const arbitrated = arbitrateInherited(inheritedAsk, creq.toolCallId, judged.classification);
+                    const arbitrated = arbitrateInherited(inheritedAsk, creq.toolCallId, judged);
                     if (arbitrated !== undefined)
                         return arbitrated;
                     const presentedArgs = creq.args;
@@ -473,7 +473,7 @@ export async function preparePolicyChain(input) {
                         toolCallId: creq.toolCallId,
                         args: presentedArgs,
                         ...ruleOffersOf(creq, presentedArgs, ancestorFacts(inheritedAsk.action === "ask" ? inheritedAsk : undefined)),
-                        message: inheritedAsk.message ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
+                        message: inheritedAsk.message ?? inheritedAskFallbackMessage(creq.toolName),
                         ...askSourceIdentity(),
                         ...riskAxesOf(creq),
                         ...(inheritedAsk.action === "ask" && inheritedAsk.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
@@ -537,7 +537,7 @@ export async function preparePolicyChain(input) {
                     recordAncestorSandboxAdmission(creq.toolCallId, creq.toolName);
                     return decision.updatedInput !== undefined ? { action: "allow", updatedInput: decision.updatedInput } : { action: "allow" };
                 }
-                const arbitrated = arbitrateInherited(inheritedAsk.action === "ask" ? { ...inheritedAsk, ...(decision.updatedInput !== undefined ? { updatedInput: decision.updatedInput } : {}) } : inheritedAsk, creq.toolCallId, judged.classification);
+                const arbitrated = arbitrateInherited(inheritedAsk.action === "ask" ? { ...inheritedAsk, ...(decision.updatedInput !== undefined ? { updatedInput: decision.updatedInput } : {}) } : inheritedAsk, creq.toolCallId, judged);
                 if (arbitrated !== undefined)
                     return arbitrated;
                 const askT0 = now();
@@ -546,7 +546,7 @@ export async function preparePolicyChain(input) {
                     toolCallId: creq.toolCallId,
                     args: presentedArgs,
                     ...ruleOffersOf(creq, presentedArgs, ancestorFacts(inheritedAsk.action === "ask" ? inheritedAsk : undefined)),
-                    message: inheritedAsk.message ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
+                    message: inheritedAsk.message ?? inheritedAskFallbackMessage(creq.toolName),
                     ...askSourceIdentity(),
                     ...riskAxesOf(creq),
                     ...(inheritedAsk.action === "ask" && inheritedAsk.requiresRealApproval === true ? { requiresRealApproval: true } : {}),

package/dist/core/runner/prepare-turn-wiring.d.ts

@@ -10,7 +10,7 @@ import { type ToolPolicy } from "../tool-policy.js";
 import type { RunnerDeps, TaskSpec } from "../types.js";
 import type { CwdRef } from "../../tools/fs/fs-shared.js";
 import { type ContainmentFace } from "../../tools/fs/index.js";
-import type { ReadDenyMatcher } from "../../tools/fs/read-deny.js";
+import type { PlacedReadDenyMatcher } from "../../tools/fs/read-deny-home.js";
 import { type ReadFileState } from "../../tools/fs/safety.js";
 import type { Prepared } from "./contracts.js";
 export interface PrepareTurnWiringInput {
@@ -70,7 +70,7 @@ export interface PrepareTurnWiringInput {
     /** borrowed-readonly — the canonical extra read roots (the fence's root set). */
     additionalReadRootsCanonical: ReadonlyArray<string>;
     /** borrowed-readonly — the compiled read-deny judge, or undefined (the reader's withheld arm). */
-    readDenyMatcher: ReadDenyMatcher | undefined;
+    readDenyMatcher: PlacedReadDenyMatcher | undefined;
     /** borrowed-readonly — the resolved read face, or undefined (the fence's ninth argument). */
     resolvedReadFace: ContainmentFace | undefined;
     /** borrowed-readonly — the tracked-cwd seat, read per call by the kept-tail normalizer (never written here). */

package/dist/core/runner/run-harness-handlers.js

@@ -12,12 +12,14 @@ import { hasVerifiableStructureSignal } from "./grounding-signal.js";
 import { batchResponseDigest, toolEndBodyFrom } from "./tool-end-body.js";
 import { createResponseModelSeat } from "./response-model-seat.js";
 import { createToolCallIdFoldSeat } from "./tool-call-id-fold-seat.js";
+import { createToolTurnIncompleteSeat } from "./tool-turn-repair-seat.js";
 import { wireOf } from "../tool-name-readings.js";
 import { rosterToolName } from "../tool-roster.js";
 export function createHarnessHandlers(input) {
     const { prepared, stats, rs, deps } = input;
     const responseModelSeat = createResponseModelSeat(deps.runnerHooks.onNotice, { sessionId: prepared.sessionId, runId: prepared.runId });
     const toolCallIdFoldSeat = createToolCallIdFoldSeat(deps.runnerHooks.onNotice, { sessionId: prepared.sessionId, runId: prepared.runId });
+    const toolTurnIncompleteSeat = createToolTurnIncompleteSeat(deps.runnerHooks.onNotice, { sessionId: prepared.sessionId, runId: prepared.runId });
     const { spec, queue, internals, ident, parentToolCallId, subagentName, pushContent, emitCommitted, startedToolCallIds, toolStartAt, toolProgress, writeFamilyOf, toolLabels, postToolBatchHook, batchArgs, internalsNotifier } = deps;
     let lastWorkspaceCwd = prepared.cwdRef?.current;
     const announceWorkspaceMove = () => {
@@ -152,6 +154,7 @@ export function createHarnessHandlers(input) {
         if (m.role === "assistant") {
             rs.turn.turnResponseModel = responseModelSeat.observe(m);
             toolCallIdFoldSeat.observe(m);
+            toolTurnIncompleteSeat.observe(m);
         }
         if (m.role === "assistant") {
             const rep = m.repetition;

package/dist/core/runner/run-identity-wiring.d.ts

@@ -12,7 +12,7 @@ export interface RunIdentityWiringInput {
      *  task_notification frames. */
     queue: PushQueue<TaskEvent>;
     /** borrowed-mutable — the leg's prepared seat: the harness sinks (`onUndrainedEngineNotes`, `engineInjectionsHeld`,
-     *  `onUndrainedUserInputs`, `onEngineNoteConsumed`, `onToolTurnRepaired`) are installed, `nextTurn` is appended to; the ids, the identity
+     *  `onUndrainedUserInputs`, `onEngineNoteConsumed`) are installed, `nextTurn` is appended to; the ids, the identity
      *  envelope, the hold refs, the memory session and the listing / roster faces are read. */
     prepared: Prepared;
     /** borrowed-readonly — the trusted run-scoped channel: `parentToolCallId`, `onNotifyInjectorReady`. */

package/dist/core/runner/run-identity-wiring.js

@@ -3,7 +3,6 @@ import { createSafeNotifier, observeThenableRejection } from "../safe-notify.js"
 import { recordFrameReceipt, toolResultReceiptKey } from "../frame-settlement.js";
 import { discloseDroppedPending, renderTaskNotificationXml, taskNotificationDedupKey } from "../task-notification.js";
 import { deliverDelegationLifecycle, deliverEngineNotice, undrainedUserInputNotices } from "../types.js";
-import { createToolTurnRepairSeat } from "./tool-turn-repair-seat.js";
 export function runIdentityWiring(input) {
     const { spec, queue, prepared, internals, taskIdRef, onReady, manualCompactRef, notifyRef, captureOptOutRef, mcpRedialRef, injectTaskNotification, deliveredAtTurnOpen, peerInboundChainRef, notificationLane, pendingSessionNotifications, runner } = input;
     notificationLane.harness = prepared.harness;
@@ -85,7 +84,6 @@ export function runIdentityWiring(input) {
         if (key !== undefined)
             recordFrameReceipt(seam, key, carrier.kind === "tool_result" ? carrier.content : undefined, entryId);
     };
-    prepared.harness.onToolTurnRepaired = createToolTurnRepairSeat((notice) => runner.deps.onNotice?.(notice), { sessionId: prepared.sessionId, runId: prepared.runId });
     if (notifyRef)
         notifyRef.inject = injectTaskNotification;
     if (captureOptOutRef && prepared.memoryEngineSession?.captureOptOut !== undefined) {

package/dist/core/runner/run-leg.js

@@ -157,7 +157,7 @@ export async function runLeg(input) {
                             let outcome;
                             try {
                                 const seat = await runHookSeat("userPromptSubmit", { timeoutMs: prepared.hookTimeoutMs, signal: prepared.abortController.signal, abortEnds: true }, (sig) => parkedScreen(steer.text, {
-                                    identity: prepared.hookIdentity,
+                                    identity: prepared.hookIdentity, permissionMode: prepared.permissionMode.observed,
                                     signal: sig,
                                     source: "parked_redelivery",
                                     ...(steer.inputId !== undefined ? { inputId: steer.inputId } : {}),
@@ -283,7 +283,7 @@ export async function runLeg(input) {
             const userPromptSubmit = (spec.hooks ?? runner.deps.hooks)?.userPromptSubmit;
             if (userPromptSubmit) {
                 try {
-                    const promptSeat = await runHookSeat("userPromptSubmit", { timeoutMs: prepared.hookTimeoutMs, signal: prepared.abortController.signal, abortEnds: true }, (sig) => userPromptSubmit(spec.objective, { identity: prepared.hookIdentity, signal: sig, source: "objective", ...(objectiveActor !== undefined ? { actor: snapshotActorAssertion(objectiveActor) } : {}) }));
+                    const promptSeat = await runHookSeat("userPromptSubmit", { timeoutMs: prepared.hookTimeoutMs, signal: prepared.abortController.signal, abortEnds: true }, (sig) => userPromptSubmit(spec.objective, { identity: prepared.hookIdentity, permissionMode: prepared.permissionMode.observed, signal: sig, source: "objective", ...(objectiveActor !== undefined ? { actor: snapshotActorAssertion(objectiveActor) } : {}) }));
                     if (promptSeat.expired) {
                         if (promptSeat.cause === "timeout") {
                             try {

package/dist/core/runner/run-stop-and-final-verify.js

@@ -110,6 +110,7 @@ export function runStopAndFinalVerify(input) {
                     getBranch: () => prepared.session.getBranch(),
                     backgroundTasks: () => prepared.listBackgroundTasks(),
                     identity: prepared.hookIdentity,
+                    permissionMode: prepared.permissionMode.observed,
                     signal: sig,
                 }));
                 if (stopSeat.expired) {

package/dist/core/runner/run-turn-boundary.js

@@ -469,7 +469,7 @@ export function createTurnBoundary(input) {
             const injectedThisTurn = finalVerifyInjectedThisTurn ? "final_verification" : undefined;
             if (!boundarySteered && !prepared.abortController.signal.aborted) {
                 try {
-                    const batchSeat = await runHookSeat("postToolBatch", { timeoutMs: prepared.hookTimeoutMs, signal: prepared.abortController.signal }, (sig) => postToolBatchHook(batch, injectedThisTurn !== undefined ? { injectedThisTurn } : undefined, { identity: prepared.hookIdentity, signal: sig }));
+                    const batchSeat = await runHookSeat("postToolBatch", { timeoutMs: prepared.hookTimeoutMs, signal: prepared.abortController.signal }, (sig) => postToolBatchHook(batch, injectedThisTurn !== undefined ? { injectedThisTurn } : undefined, { identity: prepared.hookIdentity, permissionMode: prepared.permissionMode.observed, signal: sig }));
                     if (batchSeat.expired) {
                         runnerHooks.onError?.(hookSeatExpiredError("postToolBatch", prepared.hookTimeoutMs, batchSeat.cause, "the boundary observation was abandoned and its additionalContext dropped; the turn boundary itself is unchanged"), { phase: "hook", sessionId: prepared.sessionId });
                     }

package/dist/core/runner/session-mode-seats.d.ts

@@ -20,10 +20,19 @@ export interface LegModeCeiling {
     /** The spawning leg's live mode while it runs; the session's current leg's after it (`default` before any leg of
      *  the session committed — no child can read it then). */
     readonly current: PermissionMode;
+    /** The same word read without starting anything (`PermissionModeController.observed` on the leg it reads). Optional on
+     *  the TYPE only: the engine's ceilings always answer it, and a reader falls to `current` when a hand-built ceiling (a
+     *  host's literal, a fixture) carries none — so the member's arrival is additive for every constructor of this shape. */
+    readonly observed?: PermissionMode;
     readonly sessionId: string;
     /** A child leg holds the ceiling until `signal` aborts (its own leg's end): each move of the ceiling re-judges it. */
     hold(holder: ModeCeilingHolder, signal: AbortSignal): void;
 }
+/** A leg's mode seat as a ceiling reads it: the decision read and the observation read. */
+type LegModeSeat = {
+    readonly current: PermissionMode;
+    readonly observed: PermissionMode;
+};
 /**
  * The seats of one Runner, keyed by session id and held WEAKLY: a seat lives while a leg ceiling holds it, and the
  * next leg of the session finds the same object as long as any child still reads it. In-process only — a session
@@ -38,11 +47,10 @@ export declare class SessionModeSeats {
      * session's current leg) and its end (once the leg has STOPPED — its loop settled, not merely cancelled: a cancelled
      * leg whose tool is still pending keeps answering its own children).
      */
-    legCeiling(sessionId: string, leg: {
-        readonly current: PermissionMode;
-    }): {
+    legCeiling(sessionId: string, leg: LegModeSeat): {
         ceiling: LegModeCeiling;
         commit: () => void;
         end: () => void;
     };
 }
+export {};

package/dist/core/runner/session-mode-seats.js

@@ -8,6 +8,9 @@ class Seat {
     get current() {
         return this.leg?.current ?? "default";
     }
+    get observed() {
+        return this.leg?.observed ?? "default";
+    }
     addHolder(holder, via, signal) {
         if (signal.aborted)
             return;
@@ -36,6 +39,9 @@ class LegCeiling {
     get current() {
         return this.live ? this.leg.current : this.seat.current;
     }
+    get observed() {
+        return this.live ? this.leg.observed : (this.seat.observed ?? this.seat.current);
+    }
     hold(holder, signal) {
         this.seat.addHolder(holder, this, signal);
     }

package/dist/core/runner/session-rule-policy.js

@@ -136,11 +136,10 @@ export function createSessionRulePolicy(rules, opts) {
         nameSets: [{ ...(seed.toolDeny?.length ? { deny: [...seed.toolDeny] } : {}), ...(seed.toolAllow?.length ? { allow: [...seed.toolAllow] } : {}) }],
         async check(req, signal) {
             const { toolDeny, toolAllow, toolDenyCovering, toolAllowCovering, cmdPolicy, allowDirs } = compile(await readRules(req.toolCallId, signal));
-            const toolName = req.toolName;
             const listed = (set) => heldBy("policy.sessionRules", set, req);
-            if (listed(toolDeny) || namespacedCoveringHit(toolDenyCovering, toolName))
+            if (listed(toolDeny) || namespacedCoveringHit(toolDenyCovering, req))
                 return deny(req.toolName);
-            if (toolAllow && !listed(toolAllow) && !namespacedCoveringHit(toolAllowCovering, toolName)) {
+            if (toolAllow && !listed(toolAllow) && !namespacedCoveringHit(toolAllowCovering, req)) {
                 return deny(req.toolName, "it is not in the session-rule allowlist");
             }
             if (cmdPolicy) {

package/dist/core/runner/stream-steer-verb.js

@@ -94,7 +94,7 @@ export function streamSteerVerb(input) {
                 if (screen !== undefined) {
                     let decision;
                     try {
-                        const seat = await runHookSeat("userPromptSubmit", { timeoutMs: h.hookTimeoutMs, signal: h.abortController.signal, abortEnds: true }, (sig) => screen(text, { identity: h.hookIdentity, signal: sig, source: "steer", inputId: effectiveInputId, ...(actor !== undefined ? { actor: snapshotActorAssertion(actor) } : {}) }));
+                        const seat = await runHookSeat("userPromptSubmit", { timeoutMs: h.hookTimeoutMs, signal: h.abortController.signal, abortEnds: true }, (sig) => screen(text, { identity: h.hookIdentity, permissionMode: h.permissionMode.observed, signal: sig, source: "steer", inputId: effectiveInputId, ...(actor !== undefined ? { actor: snapshotActorAssertion(actor) } : {}) }));
                         if (seat.expired) {
                             if (seat.cause === "timeout") {
                                 try {

package/dist/core/runner/tool-call-id-fold-seat.js

@@ -1,8 +1,13 @@
 import { deliverEngineNotice } from "../engine-notice.js";
-import { providerToolCallId, toolCallIdFoldReason } from "../../brain/tool-call-id.js";
+import { providerToolCallId, toolCallFoldReason } from "../../brain/tool-call-id.js";
 function isCall(block) {
     return typeof block === "object" && block !== null && block.type === "toolCall" && typeof block.id === "string";
 }
+const REASON_CLAUSE = {
+    charset: () => "named a tool call with an id outside the shape the engine keys calls under (a control byte, a space, a non-ASCII character or a `~`)",
+    length: (wireId) => `named a tool call with an id outside the shape the engine keys calls under (${wireId.length} characters, over 128)`,
+    duplicate: () => "gave two tool calls in one response the same id, and every provider requires a request's call ids to be unique",
+};
 export function createToolCallIdFoldSeat(onNotice, ids) {
     let announced = false;
     return {
@@ -10,19 +15,21 @@ export function createToolCallIdFoldSeat(onNotice, ids) {
             if (announced || !Array.isArray(message.content))
                 return;
             for (const call of message.content.filter(isCall)) {
-                const wireId = providerToolCallId(call);
-                const reason = wireId === call.id ? undefined : toolCallIdFoldReason(wireId);
+                const reason = toolCallFoldReason(call);
                 if (reason === undefined)
                     continue;
                 announced = true;
+                const wireId = providerToolCallId(call);
                 deliverEngineNotice(onNotice, {
                     code: "route.tool_call_id_folded",
-                    message: `The provider named a tool call with an id outside the shape the engine keys calls under ` +
-                        `(${reason === "length" ? `${wireId.length} characters, over 128` : "a control byte, a space, a non-ASCII character or a `~`"}). ` +
-                        `The engine keys it as "${call.id}" on every face — frames, cards, transcript, park rows — and hands the ` +
-                        `provider its own id back for the call and its result, so the run is unchanged. Once per run; later calls ` +
-                        `with such ids are folded the same way without another notice.`,
-                    detail: { toolCallId: call.id, rawLength: wireId.length, reason, sessionId: ids.sessionId, runId: ids.runId },
+                    message: `The provider ${REASON_CLAUSE[reason](wireId)}. ` +
+                        (reason === "duplicate"
+                            ? `The engine keys the later call as "${call.id}" on every face — frames, cards, transcript, park rows — and hands ` +
+                                `the provider a distinct id for it and its result, so both calls run and both results reach the model. `
+                            : `The engine keys it as "${call.id}" on every face — frames, cards, transcript, park rows — and hands the ` +
+                                `provider its own id back for the call and its result, so the run is unchanged. `) +
+                        `Once per run; later calls with such ids are folded the same way without another notice.`,
+                    detail: { toolCallId: call.id, ...(reason === "duplicate" ? {} : { rawLength: wireId.length }), reason, sessionId: ids.sessionId, runId: ids.runId },
                 });
                 return;
             }

package/dist/core/runner/tool-turn-repair-seat.d.ts

@@ -1,8 +1,18 @@
 import type { EngineNotice } from "../engine-notice.js";
-import type { ToolTurnRepair } from "../../internal/llm.js";
+import { type ToolTurnIncompleteCause, type ToolTurnRepair } from "../../internal/llm.js";
 /** The notice's attribution ids — the same pair, for the same reason, as the fold seat's. */
 export interface ToolTurnRepairSeatIds {
     sessionId: string;
     runId: string;
 }
+/** The person's line for one cause — once per run per cause, whichever observer saw it first. */
+export interface ToolTurnIncompleteSeat {
+    /** Announce `count` items of `cause` (and, for a missing result, the calls) unless this run already said it. */
+    announce(cause: ToolTurnIncompleteCause, count: number, toolCallIds?: readonly string[]): void;
+    /** Observe one assistant message: announces each stream drop it reports (`streamDropsOf`). */
+    observe(message: {
+        readonly diagnostics?: unknown;
+    }): void;
+}
+export declare function createToolTurnIncompleteSeat(onNotice: ((notice: EngineNotice) => void) | undefined, ids: ToolTurnRepairSeatIds): ToolTurnIncompleteSeat;
 export declare function createToolTurnRepairSeat(onNotice: ((notice: EngineNotice) => void) | undefined, ids: ToolTurnRepairSeatIds): (repairs: readonly ToolTurnRepair[]) => void;