@sema-agent/core 7.39.2 → 7.40.0

package/dist/core/permission-rules.js

@@ -1,7 +1,7 @@
 import { MCP_NAMESPACE, protocolOf } from "./protocol-table.js";
 import { catalogRuleFaceOf, pathTargetOf } from "./tool-registry.js";
 import { indexOfUnescaped, lastIndexOfUnescaped, parsePermissionRule } from "./permission-rule-syntax.js";
-import { PATH_RULE_BASE_LABEL, READ_RULE_TOOL, isUsablePathBase, parseRuleText, pathRuleHeadOf, pathRuleReachOf, programRunReachOf, ruleBasesNeeded } from "./permission-rule-model.js";
+import { PATH_RULE_BASE_LABEL, PATH_RULE_FACES, callPathFaceOf, isUsablePathBase, parseRuleText, pathRuleHeadOf, pathRuleReachOf, programRunReachOf, ruleBasesNeeded } from "./permission-rule-model.js";
 import { pathFamilyOf, pathIdentityOf, spellingOfIdentity } from "../tools/fs/safety.js";
 import { effectivePathTargetOf } from "./effective-path-target.js";
 import { protectivePathTargetOf } from "./tool-registry.js";
@@ -82,7 +82,6 @@ export const fileToolParamVocabulary = (canonicalTool) => {
     const face = catalogRuleFaceOf(canonicalTool);
     return face?.params === undefined || pathTargetOf(canonicalTool) === undefined ? undefined : new Set(face.params);
 };
-export const PATH_DENY_RULE_FACES = Object.freeze({ [READ_RULE_TOOL]: ["read", "write"], Edit: ["write"] });
 export function pathRuleDenyRowOf(rule, bases) {
     const family = pathFamilyOf(bases);
     const tree = bases.root ?? bases.cwd;
@@ -99,10 +98,6 @@ export function pathRuleDenyRowOf(rule, bases) {
         ...(head !== undefined ? { head: spellingOfIdentity(head, family) } : {}),
     };
 }
-function callPathFaceOf(req) {
-    const target = protectivePathTargetOf(req);
-    return target === undefined ? undefined : target.access === "read" ? "read" : "write";
-}
 function countStars(s) {
     let n = 0;
     for (const c of s)
@@ -218,7 +213,7 @@ function compile(rules, caps, primaryFieldGeneric, ruleFaces, pathBases = {}) {
                 }
                 if (issues.length > 0 && issues[issues.length - 1].rule === text && issues[issues.length - 1].code === "unsupported.path_base")
                     continue;
-                const faces = r.behavior === "deny" ? PATH_DENY_RULE_FACES[toolName] : undefined;
+                const faces = PATH_RULE_FACES[toolName]?.[r.behavior];
                 entry.content[r.behavior].push({ parsed: parsedPath.rule, ruleText: text, ...(r.source !== undefined ? { source: r.source } : {}), ...(faces !== undefined ? { faces } : {}) });
                 byTool.set(toolName, entry);
                 continue;
@@ -340,8 +335,15 @@ export function createPermissionRulePolicy(rules, opts) {
     }
     const coveringHit = (lane, toolName) => lane.length === 0 ? undefined : lane.find((r) => namespacedRuleNameCovers(r.ruleName, toolName));
     const hasCovering = namespacedCovering.deny.length > 0 || namespacedCovering.ask.length > 0 || namespacedCovering.allow.length > 0;
-    const faceDenyRules = [...byTool.values()].flatMap((e) => e.content.deny.filter((r) => r.faces !== undefined));
-    const pathDenyRules = faceDenyRules.map((r) => pathRuleDenyRowOf({ parsed: r.parsed, ruleText: r.ruleText, faces: r.faces }, pathBases));
+    const faceRules = {
+        deny: [...byTool.values()].flatMap((e) => e.content.deny.filter((r) => r.faces !== undefined)),
+        ask: [...byTool.values()].flatMap((e) => e.content.ask.filter((r) => r.faces !== undefined)),
+    };
+    const pathDenyRules = faceRules.deny.map((r) => pathRuleDenyRowOf({ parsed: r.parsed, ruleText: r.ruleText, faces: r.faces }, pathBases));
+    const contentLaneOf = (behavior, entry, callFace) => [
+        ...(entry?.content[behavior].filter((r) => r.faces === undefined) ?? []),
+        ...(callFace !== undefined ? faceRules[behavior].filter((r) => r.faces.includes(callFace)) : []),
+    ];
     const commandParam = catalogRuleFaceOf("Bash")?.primaryParams[0] ?? "command";
     const contentHit = (lane, req) => {
         if (lane.length === 0)
@@ -410,8 +412,8 @@ export function createPermissionRulePolicy(rules, opts) {
                 if (coveringDeny)
                     return { action: "deny", message: ruleDenial(req, coveringDeny.ruleText, coveringDeny.source) };
             }
-            const callFace = faceDenyRules.length > 0 ? callPathFaceOf(req) : undefined;
-            const denyLane = [...(entry?.content.deny.filter((r) => r.faces === undefined) ?? []), ...(callFace !== undefined ? faceDenyRules.filter((r) => r.faces.includes(callFace)) : [])];
+            const callFace = faceRules.deny.length > 0 || faceRules.ask.length > 0 ? callPathFaceOf(req) : undefined;
+            const denyLane = contentLaneOf("deny", entry, callFace);
             const contentDeny = denyLane.length > 0 ? contentHit(denyLane, req) : undefined;
             if (contentDeny !== undefined && contentDeny.unreadable === undefined) {
                 return { action: "deny", message: ruleDenial(req, contentDeny.rule.ruleText, contentDeny.rule.source) };
@@ -434,23 +436,24 @@ export function createPermissionRulePolicy(rules, opts) {
                 if (coveringAsk)
                     return { action: "ask", message: ruleAskMessage(coveringAsk.ruleText, coveringAsk.source), matchedAskRule: coveringAsk.ruleText };
             }
+            const askLane = contentLaneOf("ask", entry, callFace);
+            const contentAsk = askLane.length > 0 ? contentHit(askLane, req) : undefined;
+            if (contentAsk !== undefined) {
+                if (contentAsk.unreadable !== undefined)
+                    return unreadableAsk({ rule: contentAsk.rule, unreadable: contentAsk.unreadable }, "content_ask", req);
+                return { action: "ask", message: ruleAskMessage(contentAsk.rule.ruleText, contentAsk.rule.source), matchedAskRule: contentAsk.rule.ruleText };
+            }
             if (entry) {
-                const contentAsk = contentHit(entry.content.ask, req);
-                if (contentAsk !== undefined) {
-                    if (contentAsk.unreadable !== undefined)
-                        return unreadableAsk({ rule: contentAsk.rule, unreadable: contentAsk.unreadable }, "content_ask", req);
-                    return { action: "ask", message: ruleAskMessage(contentAsk.rule.ruleText, contentAsk.rule.source), matchedAskRule: contentAsk.rule.ruleText };
-                }
                 const paramAsk = matchParamRules(entry.param.ask, req.args, caps.maxScalarValueChars);
                 if (paramAsk) {
                     return { action: "ask", message: ruleAskMessage(paramAsk.ruleText, paramAsk.source), matchedAskRule: paramAsk.ruleText };
                 }
                 if (entry.bare.allow) {
-                    return { action: "allow" };
+                    return { action: "allow", decisionReason: "rule" };
                 }
             }
             if (covering && coveringHit(namespacedCovering.allow, req.toolName)) {
-                return { action: "allow" };
+                return { action: "allow", decisionReason: "rule" };
             }
             if (defaultAction === "allow")
                 return { action: "allow" };

package/dist/core/runner/denial-limit-arms.js

@@ -103,7 +103,7 @@ export async function judgeInheritedClassifier(opts) {
     const attributed = (d) => (verdict.classifier !== undefined ? attestClassifierRound(d, verdict.classifier, req) : d);
     if (verdict.kind === "allow") {
         autoMode.denialTracking?.recordAllow();
-        return { kind: "allow", result: attributed({ action: "allow", ...(opts.allowRewrite !== undefined ? { updatedInput: opts.allowRewrite } : {}) }) };
+        return { kind: "allow", result: attributed({ action: "allow", decisionReason: "classifier", ...(opts.allowRewrite !== undefined ? { updatedInput: opts.allowRewrite } : {}) }) };
     }
     if (verdict.kind === "unavailable") {
         const arm = classifierUnavailableArm({ ask, req, cause: verdict.cause, seat: opts.unavailableSeat, aborted: opts.signal.aborted });

package/dist/core/runner/gate-exit.d.ts

@@ -214,6 +214,10 @@ export interface GatePass {
     hookAsk: Extract<PermissionResult, {
         action: "ask";
     }> | undefined;
+    /** borrowed-mutable — the phase-1 hook answered its own `allow` (the exact word): a statement about this call, read by
+     *  the fold's last station only while the policy left the arguments as the hook saw them. Writer: the dispatch (phase 1).
+     *  Reader: the fold's unstated station. */
+    hookAllowed?: true;
     /** borrowed-mutable — set by a park attempt that FAILED (see `ParkAttemptFailed`). Read at the single deny
      *  exit — whatever the fallback chain then decides to say, it says it knowing the park was tried first.
      *  Writers: the three park sites. */
@@ -256,7 +260,7 @@ export interface GatePass {
      *  policy's answer; then rewritten by every station that changes the verdict (fold, tightens, org, rule
      *  lane, stamp, classifier, sandbox, content lane, resolution, edit chain). */
     decision: PermissionResult;
-    /** borrowed-mutable — which of the gate's OWN post-fold tightens minted the standing ask, if one did — an
+    /** borrowed-mutable — which of the gate's OWN post-fold stations (the tightens and the unstated station) minted the standing ask, if one did — an
      *  input of the ask-origin derivation (`AskOriginFacts.tightened`). Written at most once per pass: every
      *  tighten fires only over a surviving `allow`, and the first one to fire leaves an `ask` the others do not
      *  touch. Recorded by the gate rather than read off `decisionReason` because that member is a policy's to

package/dist/core/runner/permission-rule-lanes.js

@@ -1,6 +1,6 @@
 import { persistedRuleMandateOf, ruleClearanceOf } from "../ask-origin.js";
 import {} from "../hooks.js";
-import { adjudicatePersistedPathRules, adjudicatePersistedRules, laneToolNamesOf, ruleToolGrammarOf, segmentCoverageOf, suggestRulesForCommand } from "../permission-rule-model.js";
+import { adjudicatePersistedPathRules, adjudicatePersistedRules, callPathFaceOf, faceAskSpeaksFor, laneToolNamesOf, ruleToolGrammarOf, segmentCoverageOf, suggestRulesForCommand } from "../permission-rule-model.js";
 import { isAbsolutePathForm } from "../../tools/fs/safety.js";
 import { effectivePathTargetOf } from "../effective-path-target.js";
 import { declaredPathTargetOf, protectivePathTargetOf } from "../tool-registry.js";
@@ -45,7 +45,7 @@ export function pathRuleLaneAnswer(table, req, ctx) {
     const allow = effectivePathTargetOf(req, declaredPathTargetOf(req), bases);
     if (tighten === undefined && allow === undefined)
         return undefined;
-    return persistedRuleAnswerOf(adjudicatePersistedPathRules(table, { tool: req.toolName, cwd: ctx.root, sessionId: ctx.sessionId }, { ...(tighten !== undefined ? { tighten } : {}), ...(allow !== undefined ? { allow } : {}) }, bases));
+    return persistedRuleAnswerOf(adjudicatePersistedPathRules(table, { tool: req.toolName, cwd: ctx.root, sessionId: ctx.sessionId, face: callPathFaceOf(req) }, { ...(tighten !== undefined ? { tighten } : {}), ...(allow !== undefined ? { allow } : {}) }, bases));
 }
 export function orgRuleLane(cfg) {
     return {
@@ -127,8 +127,10 @@ export function createPermissionRuleLanes(cfg) {
     const personalAdjudicate = async (req) => {
         if (anonymous && !cfg.localOwnerDeclared)
             return undefined;
-        const laneNames = laneToolNamesOf(req);
-        if (laneNames.length === 0)
+        const judged = laneToolNamesOf(req).map((n) => [n, ruleToolGrammarOf(n)]);
+        if (!judged.some(([, g]) => g === "path") && faceAskSpeaksFor(callPathFaceOf(req)))
+            judged.push([req.toolName, "path"]);
+        if (judged.length === 0)
             return undefined;
         let view;
         try {
@@ -140,7 +142,7 @@ export function createPermissionRuleLanes(cfg) {
         if (view.unreadable !== undefined)
             skipped(view.unreadable, view.unreadableSources);
         try {
-            const answer = strongestAnswer(laneNames.map((n) => judgeAgainst(view.rules, { ...req, toolName: n }, ruleToolGrammarOf(n))));
+            const answer = strongestAnswer(judged.map(([n, grammar]) => judgeAgainst(view.rules, { ...req, toolName: n }, grammar)));
             return view.unreadable !== undefined && (answer === undefined || "segmentCoverage" in answer) ? { unreadable: true } : answer;
         }
         catch (err) {

package/dist/core/runner/persisted-path-rows.js

@@ -1,7 +1,7 @@
 import { ownerStoreOf } from "../permission-rule-provider.js";
-import { READ_RULE_TOOL, eligiblePersisted, isUsablePathBase, ruleBasesNeeded } from "../permission-rule-model.js";
+import { PATH_RULE_FACES, READ_RULE_TOOL, eligiblePersisted, isUsablePathBase, ruleBasesNeeded } from "../permission-rule-model.js";
 import { isAbsolutePathForm, pathFamilyOf } from "../../tools/fs/safety.js";
-import { PATH_DENY_RULE_FACES, pathRuleDenyRowOf } from "../permission-rules.js";
+import { pathRuleDenyRowOf } from "../permission-rules.js";
 import { inlineUntrusted } from "../untrusted-text.js";
 import { DEFAULT_GATE_AWAIT_TIMEOUT_MS, gateWaitFailureOf, withGateTimeout } from "../gate-bounded-await.js";
 import { thrownText } from "../thrown-value.js";
@@ -34,7 +34,7 @@ export async function persistedPathRowsOf(cfg) {
                 readDirectories.push(rule.command);
             continue;
         }
-        const faces = PATH_DENY_RULE_FACES[rule.tool];
+        const faces = PATH_RULE_FACES[rule.tool]?.deny;
         if (rule.behavior !== "deny" || faces === undefined || (rule.match !== "path" && rule.match !== "subpath") || !eligiblePersisted(rule, { ...call, tool: rule.tool }, "deny"))
             continue;
         const missing = ruleBasesNeeded(rule).filter((b) => !isUsablePathBase(b === "cwd" ? bases.root : bases[b], family));

package/dist/core/runner/prepare-gate-stations.d.ts

@@ -25,7 +25,7 @@
 import type { AgentHarness, AgentTool } from "../../internal/harness.js";
 import type { AskClass } from "../ask-class.js";
 import type { Arbitration, ToolMarkSource } from "../ask-origin.js";
-import type { PermissionModeController } from "../mode-policy.js";
+import { type PermissionModeController } from "../mode-policy.js";
 import type { AutoModeDecider, AutoModeDenialTracker } from "../auto-mode.js";
 import { type ComplianceCapability } from "../compliance.js";
 import { type HookEnvCapabilities, type HookInvocationIdentity, type Hooks } from "../hooks.js";

package/dist/core/runner/prepare-gate-stations.js

@@ -1,4 +1,5 @@
 import { SEND_MESSAGE_TOOL_NAME } from "../../agents/send-message-tool.js";
+import { mountedToolPermissionSeat } from "../mode-policy.js";
 import { complianceCallDenial } from "../compliance.js";
 import { cloneObserverInput, formatHookFeedback, hookSeatExpiredError, runHookSeat, runToolGate } from "../hooks.js";
 import { screenGateOutcome } from "../gate-outcome.js";
@@ -137,6 +138,7 @@ export function prepareGateStations(input) {
                         ...(autoModeDecider.current !== undefined ? { autoMode: { decider: autoModeDecider.current, ...(autoModeDenialTracking.current !== undefined ? { denialTracking: autoModeDenialTracking.current } : {}), unavailable: classifierUnavailableSeat({ station: "leg", ...(autoModeDecider.current.timeoutMs !== undefined ? { budgetMs: autoModeDecider.current.timeoutMs } : {}), approvalSeat: askReachesPerson(askRoute), onNotice: deps.onNotice, sessionId, runId }) } } : {}),
                         permissionMode: () => permissionMode.current,
                         ...(markSources.size > 0 ? { toolMarkSources: markSources } : {}),
+                        ...(mountedToolPermissionSeat(tools, e.toolName) === "passthrough" ? { permissionSeat: "passthrough" } : {}),
                         ...(a2aIsolatePeers === true ? { a2aIsolatePeers: true } : {}),
                         onModeReleased,
                         ancestorArbitrationOf: (toolCallId) => ancestorArbitrations.get(toolCallId),

package/dist/core/runner/prepare-hands-readface.d.ts

@@ -149,7 +149,7 @@ export interface PrepareHandsReadFaceInput {
     reversibilityProbes: ReversibilityProbes;
     /** borrowed-readonly — the run's reminder provenance mark (minted/adopted
      *  by the driver's adoption ladder); threaded into the hands band so the fs-side engine mints
-     *  (the Read cyber/dedup/offset/empty reminders, the gh rate-limit hint) stamp the same mark the
+     *  (the Read dedup/offset/empty reminders, the gh rate-limit hint) stamp the same mark the
      *  system-prompt declaration names. */
     reminderMark: string;
     /** borrowed-mutable — the leg's disclosure trigger counters; the hands

package/dist/core/runner/prepare-hands-readface.js

@@ -366,7 +366,6 @@ export async function prepareHandsMount(input) {
             ...(deps.hands?.commitCoAuthor !== undefined ? { commitCoAuthor: deps.hands.commitCoAuthor } : {}),
             ...(deps.hands?.readImageDownsampler !== undefined ? { readImageDownsampler: deps.hands.readImageDownsampler } : {}),
             ...(deps.hands?.autoBackgroundOnTimeout !== undefined ? { autoBackgroundOnTimeout: deps.hands.autoBackgroundOnTimeout } : {}),
-            ...(deps.hands?.readCyberReminder !== undefined ? { readCyberReminder: deps.hands.readCyberReminder } : {}),
             beforeWrite: async (w) => {
                 const deploymentGate = deps.hands?.beforeWrite;
                 if (deploymentGate) {

package/dist/core/runner/prepare-policy-chain.js

@@ -364,7 +364,8 @@ export async function preparePolicyChain(input) {
             if (re.action === "deny")
                 return vetoed(re);
             if (re.action === "allow") {
-                const out = { action: "allow", updatedInput: re.updatedInput !== undefined ? re.updatedInput : editArgs };
+                const stated = re.updatedInput === undefined ? "mode" : re.decisionReason;
+                const out = { action: "allow", updatedInput: re.updatedInput !== undefined ? re.updatedInput : editArgs, ...(stated !== undefined ? { decisionReason: stated } : {}) };
                 carryEngineAttestations(re, out);
                 carryPrecedingSettlement(settledBy, out);
                 return out;
@@ -384,7 +385,7 @@ export async function preparePolicyChain(input) {
             re = editAsk;
             const editArbitrated = arbitrateInherited(re, creq.toolCallId, judged);
             if (editArbitrated !== undefined) {
-                const out = editArbitrated.action === "allow" ? { action: "allow", updatedInput: editArgs } : editArbitrated;
+                const out = editArbitrated.action === "allow" ? { action: "allow", updatedInput: editArgs, decisionReason: "mode" } : editArbitrated;
                 carryPrecedingSettlement(settledBy, out);
                 return out;
             }
@@ -408,7 +409,7 @@ export async function preparePolicyChain(input) {
                 return rr;
             settledBy = rr;
             if (rr.updatedInput === undefined) {
-                const out = { action: "allow", updatedInput: editArgs };
+                const out = { action: "allow", updatedInput: editArgs, decisionReason: "mode" };
                 carryPrecedingSettlement(rr, out);
                 return out;
             }
@@ -461,7 +462,7 @@ export async function preparePolicyChain(input) {
                     const { ask: inheritedAsk, fallback, mintedHere } = judged;
                     if (fallback === undefined && sandboxAdmissionArmed && policyAskClassOf(pc.policy) === "sandbox_local" && !sandboxBoundaryCapable(creq) && judged.classification.row.sandboxAdmission) {
                         recordAncestorSandboxAdmission(creq.toolCallId, creq.toolName);
-                        return { action: "allow" };
+                        return { action: "allow", decisionReason: "sandbox" };
                     }
                     const arbitrated = arbitrateInherited(inheritedAsk, creq.toolCallId, judged);
                     if (arbitrated !== undefined)
@@ -496,7 +497,7 @@ export async function preparePolicyChain(input) {
                         return recheckApprovedEdit(pc.policy, pc.onAsk, creq, resolved.updatedInput, resolved, csignal, pc.autoMode);
                     }
                     recordInheritedAskGrant(creq.toolCallId, pc.onAsk, resolved.presentedInput, askWaitMs, resolved, askClassMembersOf(judged.classification).classes);
-                    return { action: "allow" };
+                    return { action: "allow", decisionReason: "mode" };
                 },
             }
             : wrapToolPolicy(pc.policy, async (creq, csignal) => {
@@ -535,7 +536,7 @@ export async function preparePolicyChain(input) {
                 const { ask: inheritedAsk, fallback, mintedHere } = judged;
                 if (fallback === undefined && sandboxAdmissionArmed && policyAskClassOf(pc.policy) === "sandbox_local" && !sandboxBoundaryCapable(creq) && judged.classification.row.sandboxAdmission) {
                     recordAncestorSandboxAdmission(creq.toolCallId, creq.toolName);
-                    return decision.updatedInput !== undefined ? { action: "allow", updatedInput: decision.updatedInput } : { action: "allow" };
+                    return decision.updatedInput !== undefined ? { action: "allow", updatedInput: decision.updatedInput, decisionReason: "sandbox" } : { action: "allow", decisionReason: "sandbox" };
                 }
                 const arbitrated = arbitrateInherited(inheritedAsk.action === "ask" ? { ...inheritedAsk, ...(decision.updatedInput !== undefined ? { updatedInput: decision.updatedInput } : {}) } : inheritedAsk, creq.toolCallId, judged);
                 if (arbitrated !== undefined)
@@ -635,6 +636,7 @@ export async function preparePolicyChain(input) {
             const finalReq = { ...req, args: decision.updatedInput };
             let asked;
             const revalidated = {};
+            let restated;
             try {
                 for (const layer of recheckLayers) {
                     const d = refuseOutOfContractDecision(await layer.check(finalReq, signal));
@@ -653,6 +655,8 @@ export async function preparePolicyChain(input) {
                     }
                     if (d.action === "ask" && asked === undefined)
                         asked = d;
+                    if (d.action === "allow" && restated === undefined && d.decisionReason !== undefined)
+                        restated = d.decisionReason;
                     carryEngineAttestations(d, revalidated);
                 }
             }
@@ -665,7 +669,7 @@ export async function preparePolicyChain(input) {
                 return surfaced;
             }
             if (decision.action === "allow") {
-                const owned = { ...decision };
+                const owned = { ...decision, ...(decision.decisionReason === undefined && restated !== undefined ? { decisionReason: restated } : {}) };
                 carryEngineAttestations(decision, owned);
                 carryEngineAttestations(revalidated, owned);
                 return owned;

package/dist/core/runner/prepare-wiring-manifest.d.ts

@@ -33,7 +33,7 @@ import { type LegWriteProtection } from "./write-protection-station.js";
 import { type UsageWindow } from "../usage-window-store.js";
 import type { ToolRoster } from "../tool-roster.js";
 import { type AutoModeArmFact, type WiringManifest, type WiringManifestMcpEntry } from "../wiring-manifest.js";
-import type { PermissionModeController } from "../mode-policy.js";
+import { type PermissionModeController } from "../mode-policy.js";
 import type { AnnounceOnceSink, Prepared, PrepareResume, RunInternals, UsageGovernance } from "./contracts.js";
 export interface PrepareWiringManifestInput {
     /** borrowed-readonly — the REBOUND spec. Read: `onAsk` (the own seat), `onQuestion` (the question seam), `handsReadOnly` / `tools` (the ungated scan),

package/dist/core/runner/prepare-wiring-manifest.js

@@ -12,6 +12,7 @@ import { mountWriteProtection } from "./write-protection-station.js";
 import { autoRunOnRecommendationEffective } from "./memory-consolidation-driver.js";
 import { GLOBAL_USAGE_KEY, usageRetryAfterMs, windowsGovernCost } from "../usage-window-store.js";
 import { LSP_CONTRACT_ID, askSeatEffective, countElicitOptIns, deriveHandsSeam, deriveLspSeam, deriveWiringManifest, resolveAskSeamForm, resolveDeclaredDurability, resolveElicitSeam, resolveQuestionSeam, resolveSubagentTranscriptTier } from "../wiring-manifest.js";
+import { modePolicyOf } from "../mode-policy.js";
 import { DEFAULT_IRREVERSIBLE_SCOPE } from "./checkpoint-scope.js";
 export function mcpManifestEntries(entries, statuses) {
     return (entries ?? []).map((entry) => {
@@ -120,15 +121,18 @@ export function prepareWiringManifest(input) {
     const onAsk = spec.onAsk ?? deps.onAsk;
     const handWriteTools = toolRoster.entries.filter((e) => e.mountedBy === "hands" && (e.effect === "write" || e.effect === "idempotent")).map((e) => e.name);
     const hasEffectAwareGate = Boolean(policyLayers.length > 0 || (hooks?.preToolUse !== undefined && !preToolUseObservational));
-    const destructiveMcpUngated = mcp.tools.some((t) => !irreversibleTools.has(t.name) && !egressTools.has(t.name) && (toolEffects.get(t.name) ?? "write") !== "read");
+    const peerWriteUngated = modePolicyOf(permissionMode.current).unstated === "ask"
+        ? []
+        : mcp.tools.filter((t) => t.permissionSeat === "passthrough" && !irreversibleTools.has(t.name) && !egressTools.has(t.name) && (toolEffects.get(t.name) ?? "write") !== "read").map((t) => t.name);
     const firstPartyWriteUngated = (spec.tools ?? [])
         .map((t) => t.name)
         .filter((name) => !irreversibleTools.has(name) && !egressTools.has(name) && toolEffects.get(name) === "write");
-    if (!hasEffectAwareGate && (handWriteTools.length > 0 || destructiveMcpUngated || firstPartyWriteUngated.length > 0)) {
+    const handOrFirstPartyUngated = !hasEffectAwareGate && (handWriteTools.length > 0 || firstPartyWriteUngated.length > 0);
+    if (handOrFirstPartyUngated || peerWriteUngated.length > 0) {
         const what = [
-            handWriteTools.length > 0 ? `hand tools [${handWriteTools.join(", ")}]` : undefined,
-            destructiveMcpUngated ? "MCP write tools" : undefined,
-            firstPartyWriteUngated.length > 0 ? `write tools [${firstPartyWriteUngated.join(", ")}]` : undefined,
+            !hasEffectAwareGate && handWriteTools.length > 0 ? `hand tools [${handWriteTools.join(", ")}]` : undefined,
+            peerWriteUngated.length > 0 ? `server write tools under ${permissionMode.current} [${peerWriteUngated.join(", ")}]` : undefined,
+            !hasEffectAwareGate && firstPartyWriteUngated.length > 0 ? `write tools [${firstPartyWriteUngated.join(", ")}]` : undefined,
         ]
             .filter(Boolean)
             .join(" + ");
@@ -141,6 +145,7 @@ export function prepareWiringManifest(input) {
             shapes.add(what);
             deps.onError?.(new Error(`write-capable ${what} are present but UNGATED — wire an effect-aware tool policy (or a PreToolUse hook). ` +
                 `bash/MCP irreversible actions are otherwise unadjudicated; the deployment sandbox/egress boundary is the only protection (design/77 §4, design/53 §2.H). ` +
+                (peerWriteUngated.length > 0 ? `Under ${permissionMode.current} a server's tools run with nobody stating them; a deny or ask rule naming them still gates them. ` : "") +
                 `(This warning fires once per deployment per tool-set shape.)`), { phase: "config", sessionId });
         }
     }

package/dist/core/runner/retired-runner-deps.js

@@ -3,6 +3,7 @@ const RETIRED_RUNNER_DEPS_KEYS = {
     legacyRewindBoundaryProbe: "the rewind refusal always names both possibilities (never existed / retired whole-tree era); a deployment that holds that era's table answers the question on its own surface",
     peerAdmission: "the peer lane's knob table is `RunnerDeps.peerLane` (the same fields: admission gate, delivery budgets, listing window)",
     graderEnvFactory: "the grader env reaches the repair loop as `RepairLoopConfig.graderEnv`, minted by the trusted control plane (`assertOracleIsolation` / `GraderEnv` unchanged)",
+    "hands.readCyberReminder": "a Read result carries only the reminders about that read (an empty file, an offset past the end, a file already in context) — no standing content-safety tail, so there is nothing to switch; a deployment that wants that sentence states it in its own `appendSystemPrompt`",
 };
 export function assertNoRetiredRunnerDeps(deps) {
     assertNoRetiredKeys(deps, RETIRED_RUNNER_DEPS_KEYS, "RunnerDeps");

package/dist/core/tool-policy.d.ts

@@ -850,6 +850,13 @@ export declare function createAllowDenyPolicy(opts: {
         list: "allow" | "deny";
         message: string;
     }) => void;
+    /**
+     * What an `allow` list HIT means. `"grant"` (default): the deployment named this tool as permitted — a statement
+     * (`decisionReason: "rule"`) that satisfies the fold's unstated rule for a passthrough-seat tool. `"narrowing"`: the
+     * list only bounds WHICH tools a lane may see (an agent definition's `allowTools`); a hit is scope, not consent, and
+     * answers a bare allow — the mode's unstated question still goes to a person. The deny list is unaffected.
+     */
+    scope?: "grant" | "narrowing";
 }): NamedToolPolicy;
 /**
  * What `createApprovalPolicy`'s `approve` may resolve to: a boolean, or the `AskOutcome` OBJECT minus the
@@ -918,6 +925,13 @@ export declare function createApprovalPolicy(opts: {
  * short-circuit — scanning continues, because a later policy may still `deny` (which outranks ask).
  * With no deny, the first `ask` wins; with neither, `allow`.
  *
+ * **An allow is STATED or not.** A layer that names the call (an allow rule, a list entry, an approver's yes, a mode's
+ * release) says WHY on its allow (`decisionReason`); a bare allow is "no objection" — an empty table, a list the call is
+ * not on, a layer that does not know the tool. The combined allow carries the FIRST stated reason in layer order, and a
+ * statement binds the arguments its layer judged: a layer that rewrites the arguments voids every statement before it (its
+ * own allow, if it states one, speaks for the new arguments). For a tool whose permission seat is `passthrough` an
+ * unstated allow is not a permission — the gate puts the mode's question to it; for every other tool the two forms run alike.
+ *
  * **Idempotency requirement:** because the fold continues past an `ask` to look for a later `deny`, a
  * policy's `check()` can be invoked even after an earlier policy returned `ask`. `check()` MUST be
  * idempotent — repeated calls with the same {@link ToolCallRequest} return the same decision and

package/dist/core/tool-policy.js

@@ -253,6 +253,7 @@ export function constraintChainDigest(chain) {
     return `cpv1:${createHash("sha256").update(stableJson(chain)).digest("hex")}`;
 }
 const ALLOW = Object.freeze({ action: "allow" });
+const ALLOW_BY_RULE = Object.freeze({ action: "allow", decisionReason: "rule" });
 const RETIRED_TEXT_FIELD = "reason";
 export const DECISION_MEMBERS = Object.keys({
     action: 0, updatedInput: 0, message: 0, decisionReason: 0, requiresRealApproval: 0, denialLimitFallback: 0, persistedRuleShadowed: 0, probeReason: 0,
@@ -414,7 +415,7 @@ export function createAllowDenyPolicy(opts) {
             if (allow && !nameListHolds(allow, req) && !namespacedCoveringHit(allowCovering, req)) {
                 return { action: "deny", message: `tool "${req.toolName}" is not in the allowlist` };
             }
-            return ALLOW;
+            return allow && opts.scope !== "narrowing" ? ALLOW_BY_RULE : ALLOW;
         },
     };
 }
@@ -486,11 +487,11 @@ export function createApprovalPolicy(opts) {
                                     : `approval denied for "${req.toolName}"${reading.note !== undefined ? `\nReviewer note:\n${delimitUntrusted("reviewer note", reading.note, REVIEWER_NOTE_MAX_BODY)}` : ""}`,
                         }, reading.settlement);
                     }
-                    return attest({ action: "allow" }, reading.settlement);
+                    return attest({ action: "allow", decisionReason: "mode" }, reading.settlement);
                 }
                 const okRaw = ok;
                 if (okRaw === true)
-                    return attest({ action: "allow" }, settledByDecider("person", "allowed", undefined));
+                    return attest({ action: "allow", decisionReason: "mode" }, settledByDecider("person", "allowed", undefined));
                 if (okRaw !== false) {
                     return attest({
                         action: "deny",
@@ -500,7 +501,9 @@ export function createApprovalPolicy(opts) {
                 }
                 return attest({ action: "deny", message: `approval denied for "${req.toolName}"` }, settledByDecider("person", "refused", undefined));
             }
-            if (opts.denyByDefault && !nameListHolds(auto, req) && !namespacedCoveringHit(autoCovering, req)) {
+            if (nameListHolds(auto, req) || namespacedCoveringHit(autoCovering, req))
+                return ALLOW_BY_RULE;
+            if (opts.denyByDefault) {
                 return { action: "deny", message: `tool "${req.toolName}" requires explicit allow` };
             }
             return ALLOW;
@@ -540,6 +543,7 @@ export function combinePolicies(...policies) {
             let asked;
             let current = req;
             let rewrite;
+            let stated;
             const records = {};
             let anyRecord = false;
             let ruleAskText;
@@ -565,6 +569,10 @@ export function combinePolicies(...policies) {
                 if (d.updatedInput !== undefined) {
                     current = { ...current, args: d.updatedInput };
                     rewrite = d;
+                    stated = d.action === "allow" ? d.decisionReason : undefined;
+                }
+                else if (d.action === "allow" && stated === undefined && d.decisionReason !== undefined) {
+                    stated = d.decisionReason;
                 }
                 if (d.action === "allow" && hasEngineAttestation(d)) {
                     transferEngineAttestations(d, records);
@@ -605,7 +613,8 @@ export function combinePolicies(...policies) {
                     FOLDED_CLASSES_SEAT.set(out, Object.freeze([...folded]));
                 return out;
             }
-            const allowed = rewrite ?? ALLOW;
+            const base = rewrite ?? ALLOW;
+            const allowed = stated !== undefined && base.decisionReason !== stated ? { ...base, decisionReason: stated } : base;
             if (!anyRecord)
                 return allowed;
             const out = { ...allowed };
@@ -659,7 +668,7 @@ export function createCoarseCommandNamePolicy(opts) {
             if (allow && !allow.has(parsed.name)) {
                 return fallback(`command "${parsed.name}" is not in the allowlist`);
             }
-            return ALLOW;
+            return allow ? ALLOW_BY_RULE : ALLOW;
         },
     }, "sandbox_local");
 }

package/dist/core/tool-spec.d.ts

@@ -274,6 +274,16 @@ export interface ToolSpec<TParams extends TSchema = TSchema> {
      * prepare) — omitting `effect` is fine (the default IS `write`).
      */
     egress?: true;
+    /**
+     * The tool's PERMISSION SEAT. `"passthrough"`: the tool states no permission of its own — under an asking permission mode
+     * (`default` / `acceptEdits` / `plan` / `auto` / `dontAsk`) a call to it runs only when some layer STATES an allow (an allow
+     * rule or allow-list entry naming it, an approver's yes, a PreToolUse hook's own `allow`); a policy fold in which nobody
+     * stated it ("no objection") gets the mode's question (class `unstated`, origin `policy`), which dontAsk refuses, auto's
+     * classifier may answer, and `bypassPermissions` never raises. The MCP and A2A materializers set it on a remote peer's
+     * tool. Absent: the tool answers for itself (the engine's own stations and the deployment's declarations). Tightening only —
+     * it can make a tool ask, never let one run.
+     */
+    permissionSeat?: "passthrough";
     /**
      * design/77 §4 (Gate 4 — irreversibility axis): how reversible this tool's effect is. A THIRD axis,
      * orthogonal to {@link effect} (repeat-safety) and {@link egress} (blast-radius). For office/finance

package/dist/core/tools.js

@@ -81,6 +81,7 @@ export function defineTool(spec, options) {
         ...(spec.effect ? { effect: spec.effect } : {}),
         ...(spec.contentOrigin !== undefined ? { contentOrigin: spec.contentOrigin } : {}),
         ...(spec.egress ? { egress: true } : {}),
+        ...(spec.permissionSeat === "passthrough" ? { permissionSeat: "passthrough" } : {}),
         ...(spec.irreversibility !== undefined ? { irreversibility: spec.irreversibility } : {}),
         ...(spec.reversibilityProbe ? { reversibilityProbe: spec.reversibilityProbe } : {}),
         ...(spec.offload !== undefined ? { offload: spec.offload } : {}),

package/dist/engine/loop/types.d.ts

@@ -772,6 +772,12 @@ export interface AgentTool<TParameters extends TSchema = TSchema, TDetails = unk
      * repeat-safety effect below its fail-closed `write` default (only the caller's `toolAxes` does). Absent on non-MCP tools.
      */
     mcpReadOnlyHint?: true;
+    /**
+     * The tool's permission seat — see `ToolSpec.permissionSeat` (src/core/tool-spec.ts). `"passthrough"` = the tool states no
+     * permission of its own; set by the MCP and A2A materializers on a remote peer's tool and carried by `defineTool` from a
+     * spec. Read per call off the leg's live mount array (`mountedToolPermissionSeat`). Absent ⇒ the tool answers for itself.
+     */
+    permissionSeat?: "passthrough";
     /**
      * design/120 P1.5 (CC `isConcurrencySafe(parsedInput)` parity): INPUT-level concurrency refinement
      * for a tool whose safety depends on its arguments — CC's only real consumer is

package/dist/orchestration/workflow.js

@@ -118,7 +118,7 @@ export function applyWorkflowAgentType(spec, agentType, registry) {
     if (out.memoryPersistenceCapable === undefined && def.memoryPersistenceCapable !== undefined)
         out.memoryPersistenceCapable = def.memoryPersistenceCapable;
     if (def.allowTools !== undefined || def.denyTools !== undefined) {
-        const perType = createAllowDenyPolicy({ ...(def.allowTools ? { allow: def.allowTools } : {}), ...(def.denyTools ? { deny: def.denyTools } : {}) });
+        const perType = createAllowDenyPolicy({ ...(def.allowTools ? { allow: def.allowTools } : {}), ...(def.denyTools ? { deny: def.denyTools } : {}), scope: "narrowing" });
         out.toolPolicy = out.toolPolicy ? combinePolicies(out.toolPolicy, perType) : perType;
     }
     return out;

package/dist/tools/fs/fs-read.d.ts

@@ -7,4 +7,4 @@ export declare function createReadFileTool(env: ExecutionEnv, state: ReadFileSta
     taskId?: string;
     principal?: string;
     toolCallId?: string;
-}) => boolean, readCyberReminder?: boolean, readDeny?: import("./read-deny.js").ReadDenyMatcher, readFace?: import("./containment-face.js").ContainmentFace, reminderMark?: string, reminderDisclosureCounts?: ReminderDisclosureCounts): AgentTool;
+}) => boolean, readDeny?: import("./read-deny.js").ReadDenyMatcher, readFace?: import("./containment-face.js").ContainmentFace, reminderMark?: string, reminderDisclosureCounts?: ReminderDisclosureCounts): AgentTool;

package/dist/tools/fs/fs-read.js

@@ -5,13 +5,12 @@ import { decodeTextBytes } from "./encoding.js";
 import { isNotebookPath, parseNotebookCells, renderNotebookCells, stripNotebookImageData, NOTEBOOK_IMAGE_BASE64_BUDGET } from "./notebook.js";
 import { MCP_IMAGE_MAX_BASE64, IMAGE_TARGET_RAW_SIZE } from "../../core/mcp.js";
 import { PDF_MAX_PAGES_PER_READ, pdfMagicMatches } from "./pdf.js";
-import { MAX_READ_BYTES, SLICED_READ_MAX_BYTES, MAX_IMAGE_READ_BYTES, MAX_IMAGE_DOWNSAMPLE_INPUT_BYTES, NO_DOWNSAMPLER_IMAGE_CAP_HINT, resolveAutoDownsampler, MAX_READ_OUTPUT_CHARS, readCyberReminderText, FILE_PATH_PARAMS, countLines, seededFileUnchangedReminder, enoentMessage, } from "./fs-shared.js";
+import { MAX_READ_BYTES, SLICED_READ_MAX_BYTES, MAX_IMAGE_READ_BYTES, MAX_IMAGE_DOWNSAMPLE_INPUT_BYTES, NO_DOWNSAMPLER_IMAGE_CAP_HINT, resolveAutoDownsampler, MAX_READ_OUTPUT_CHARS, FILE_PATH_PARAMS, countLines, seededFileUnchangedReminder, enoentMessage, } from "./fs-shared.js";
 import { readPdfFile, pdfResultToToolReturn } from "./fs-pdf.js";
 import { openSystemReminder } from "../../core/reminder-mint.js";
 import { discloseReminderShaped } from "../../core/reminder-disclosure.js";
 import { toolFace } from "../../core/tool-catalog-entries.js";
-export function createReadFileTool(env, state, rootCanonical, cwdRef, additionalRoots, imageDownsampler, pdfCapabilities, bgOutputReadExemption, readCyberReminder, readDeny, readFace, reminderMark, reminderDisclosureCounts) {
-    const cyberReminder = readCyberReminder === false ? "" : readCyberReminderText(reminderMark);
+export function createReadFileTool(env, state, rootCanonical, cwdRef, additionalRoots, imageDownsampler, pdfCapabilities, bgOutputReadExemption, readDeny, readFace, reminderMark, reminderDisclosureCounts) {
     const reminderDisclosureWindows = new Map();
     const pdfReminderDisclosure = (key) => ({
         mark: reminderMark,
@@ -244,7 +243,6 @@ export function createReadFileTool(env, state, rootCanonical, cwdRef, additional
                     return {
                         content: [
                             ...bodyBlocks,
-                            ...(cyberReminder ? [{ type: "text", text: cyberReminder }] : []),
                             ...(nbDisclosure.trailer !== undefined ? [{ type: "text", text: nbDisclosure.trailer }] : []),
                         ],
                         details: { type: "notebook", file: { filePath: path, cells: parsed.cells.map(stripNotebookImageData) } },
@@ -321,7 +319,7 @@ export function createReadFileTool(env, state, rootCanonical, cwdRef, additional
                 counts: reminderDisclosureCounts,
             });
             return {
-                content: `${nbFallbackPrefix}${header}${body}${cyberReminder}${disclosure.trailer !== undefined ? `\n${disclosure.trailer}` : ""}`,
+                content: `${nbFallbackPrefix}${header}${body}${disclosure.trailer !== undefined ? `\n${disclosure.trailer}` : ""}`,
                 details: {
                     type: "text",
                     file: {

package/dist/tools/fs/fs-shared.d.ts

@@ -145,33 +145,6 @@ export declare function resolveAutoDownsampler(): Promise<ImageDownsampler | und
  *  divergence is a fidelity delta, not a correctness one (the partial-view marker always states the
  *  served window truthfully). */
 export declare const MAX_READ_OUTPUT_CHARS = 100000;
-/** Per-read content-safety reminder appended after a text read.
- *
- *  Attribution, stated precisely because either half alone is wrong. The upstream 88 source DOES carry
- *  the same mechanism — `FileReadTool`'s `CYBER_RISK_MITIGATION_REMINDER`, appended after every text
- *  read, behind a PER-MODEL exemption gate. The 220 baseline does NOT: the text is gone, retired once
- *  the mitigation moved inside the serving model.
- *
- *  This engine keeps it because a BYOM deployment cannot assume its serving model carries the
- *  mitigation, and adjacency is the whole mechanism (a reminder in a system prompt hundreds of turns
- *  back is not what makes a model treat the bytes in front of it as data). It costs ≈50 tokens per text
- *  read, which is why the exemption gate 88 had is restored rather than the append being unconditional:
- *  see `HandsToolkitOptions.readCyberReminder`. Default ON — a deployment that knows its model is
- *  covered turns it off explicitly.
- *
- *  COVERAGE, stated because the switch is easy to over-read: the reminder rides the plain-text read and
- *  the notebook projection. PDF text extraction returns through its own result builder and has never
- *  carried it, so extracted PDF text reaches the model without this mitigation whatever the switch says.
- *  That gap predates the switch; its IMPERSONATION half is closed — the PDF text legs carry the same
- *  detect-and-disclose trailer as this lane (reminder-shaped bytes in extracted PDF text are disclosed
- *  at the outlet, fs-pdf.ts), and their bodies are fenced. The CYBER half (this malware-alertness
- *  sentence) still does not ride PDF text and stays an open item rather than closed silently —
- *  widening it to a third surface is a change to what every PDF read costs, not a wiring fix.
- *
- *  A FUNCTION over the session mark, not a constant: the open tag is rendered by the mint home so it
- *  carries the run's provenance mark; the sentence bytes are unchanged, and a markless call renders
- *  the bare form verbatim. */
-export declare function readCyberReminderText(mark: string | undefined): string;
 export declare const BASH_DEFAULT_TIMEOUT_SEC = 120;
 export declare const BASH_MAX_TIMEOUT_SEC = 600;
 export declare const BASH_DEFAULT_TIMEOUT_MS: number;