@sema-agent/core 7.40.0 → 7.41.0

package/dist/agents/list-agents-tool.d.ts

@@ -3,6 +3,8 @@ import type { TaskAccess } from "../core/task-registry.js";
 import { type RosterEntry } from "./roster-store.js";
 import { type PeerDirectory, type PeerPresence, type PeerSessionRecord } from "./peer-directory.js";
 import type { SubagentTranscriptTier } from "../core/wiring-manifest.js";
+import { formatAgo, type AgentState, type AgentStateSource } from "../core/agent-state.js";
+import type { CheckpointSeat } from "../core/checkpoint-seat.js";
 export declare const LIST_AGENTS_TOOL_NAME = "ListAgents";
 export declare const LIST_AGENTS_TOOL_ALIAS = "ListPeers";
 /** CC `maxResultSizeChars` for this tool. */
@@ -16,8 +18,8 @@ export declare const PEER_LISTING_FRESH_WINDOW_MS: number;
  * addressable by name. Dead and stale rows are what `includeAll` adds.
  */
 export declare function isFreshPeerRow(r: Pick<PeerSessionRecord, "liveness" | "tempo" | "updatedAt">, now: number, windowMs?: number): boolean;
-/** `Ns` / `Nm` / `Nh` / `Nd` — a bounded age word for a listing row; a future stamp reads as `0s`. */
-export declare function formatAgo(ms: number): string;
+/** `Ns` / `Nm` / `Nh` / `Nd` — a bounded age word for a listing row (one definition, shared with the agent-state clauses). */
+export { formatAgo };
 /** The last two path segments of a working directory (what a person recognizes a project by). */
 export declare function cwdTail(cwd: string): string;
 export interface ListAgentsToolOptions {
@@ -42,6 +44,9 @@ export interface ListAgentsToolOptions {
             name?: string;
             status: string;
         } | undefined;
+        /** The live background-agent row's state facts ({@link import("../core/task-registry.js").TaskRegistry.agentStateSource}).
+         *  Absent on a registry that does not offer it ⇒ agent rows carry no `agentState` and no state columns. */
+        agentStateSource?(id: string, access: TaskAccess): AgentStateSource | undefined;
     };
     access?: TaskAccess;
     /** design/147 S3a parity — a delegated child's TRUSTED parent view (owner = the parent's task id,
@@ -62,9 +67,14 @@ export interface ListAgentsToolOptions {
      *  the conversation does not; `none` = only the recorded name. Absent (a direct mount that did not say) ⇒
      *  the `none` wording — a label never promises more than the mount can show. */
     continuationTier?: SubagentTranscriptTier;
+    /** The run's checkpoint seat — where a PARKED agent row's approval card is read from (the same seat the
+     *  Agent tool parks children into). Absent ⇒ the card reads `unreadable`. */
+    checkpointSeat?: CheckpointSeat;
     /** The clock (tests). */
     now?: () => number;
 }
+/** The store seats the listing reads agent rows' facts through, as one bundle a mount helper passes on unchanged. */
+export type ListAgentsReadSeats = Pick<ListAgentsToolOptions, "checkpointSeat">;
 /** One rendered row. `kind` names the lane; `address` is what SendMessage accepts. */
 export interface ListAgentsRow {
     kind: "peer_session" | "background_agent" | "roster";
@@ -88,6 +98,11 @@ export interface ListAgentsRow {
      *  — on the peer lane the common case, since no host writes the activity word. `finished` means
      *  COMPLETED and nothing else: a model applies the continuable rule to that word. */
     state: "busy" | "idle" | "offline" | "running" | "parked" | "finished" | "failed" | "killed" | "cancelled" | "unknown";
+    /** Agent lanes with a live registry row: the agent's current state
+     *  ({@link import("../core/agent-state.js").readAgentState}, the one reading AgentTranscript and TaskOutput
+     *  render too); {@link state} is this status word through the lane table. Absent on peer rows and on a
+     *  roster row with no live row. */
+    agentState?: AgentState;
 }
 export declare function createListAgentsTool(opts: ListAgentsToolOptions): import("../internal/harness-types.js").AgentTool<Type.TObject<{
     includeAll: Type.TOptional<Type.TBoolean>;

package/dist/agents/list-agents-tool.js

@@ -8,6 +8,7 @@ import { PEER_LANE_DEFAULTS } from "./peer-admission.js";
 import { toolFace } from "../core/tool-catalog-entries.js";
 import { thrownText } from "../core/thrown-value.js";
 import { assertNoRetiredKeys } from "../core/retired-keys.js";
+import { agentActivityClause, agentApprovalClause, formatAgo, readAgentState } from "../core/agent-state.js";
 export const LIST_AGENTS_TOOL_NAME = "ListAgents";
 export const LIST_AGENTS_TOOL_ALIAS = "ListPeers";
 export const LIST_AGENTS_MAX_RESULT_CHARS = 10_000;
@@ -19,18 +20,7 @@ export function isFreshPeerRow(r, now, windowMs = PEER_LISTING_FRESH_WINDOW_MS)
         return true;
     return now - r.updatedAt <= windowMs;
 }
-export function formatAgo(ms) {
-    const sec = Math.max(0, Math.floor(ms / 1000));
-    if (sec < 60)
-        return `${sec}s`;
-    const min = Math.floor(sec / 60);
-    if (min < 60)
-        return `${min}m`;
-    const h = Math.floor(min / 60);
-    if (h < 48)
-        return `${h}h`;
-    return `${Math.floor(h / 24)}d`;
-}
+export { formatAgo };
 export function cwdTail(cwd) {
     const parts = cwd.split(/[\\/]+/).filter((p) => p !== "");
     return parts.slice(-2).join("/");
@@ -80,7 +70,7 @@ export function createListAgentsTool(opts) {
                     `pass includeAll: true to also list stale and offline ones. A peer that is offline or unlisted still accepts messages — they are parked ` +
                     `durably in its session box and delivered when it next runs. `
                 : `Peer sessions of this engine are not addressable on this mount (no session directory). `) +
-            `Background agents you spawned are listed with their task_id. ` +
+            `Background agents you spawned are listed with their task_id, their status, when they last did anything, and — for one parked on a durable approval — that approval's card id, state and deadline. ` +
             `A ref is only valid against the listing (or disambiguation error) you read it from — do not invent one.`,
         parameters: Type.Object({
             includeAll: Type.Optional(Type.Boolean({ description: "Also list stale (no activity within the freshness window) and offline peer sessions. Default false." })),
@@ -120,6 +110,10 @@ export function createListAgentsTool(opts) {
                 });
             }
             let registryCapped = false;
+            const agentStateOf = (id, view) => {
+                const src = opts.registry?.agentStateSource?.(id, view);
+                return src === undefined ? undefined : readAgentState(src, opts.checkpointSeat, opts.now?.() ?? Date.now());
+            };
             const views = [opts.access, opts.parentAccess].filter((a) => a !== undefined);
             const seenIds = new Set();
             if (opts.registry !== undefined) {
@@ -131,7 +125,15 @@ export function createListAgentsTool(opts) {
                             continue;
                         seenIds.add(t.task_id);
                         const full = opts.registry.getAccessibleTask(t.task_id, view);
-                        rows.push({ kind: "background_agent", name: full?.name ?? t.description ?? t.task_id, address: t.task_id, state: agentRowState(t.status) });
+                        const stateRead = agentStateOf(t.task_id, view);
+                        const agentState = stateRead instanceof Promise ? await stateRead : stateRead;
+                        rows.push({
+                            kind: "background_agent",
+                            name: full?.name ?? t.description ?? t.task_id,
+                            address: t.task_id,
+                            state: agentRowState(agentState?.status ?? t.status),
+                            ...(agentState !== undefined ? { agentState } : {}),
+                        });
                     }
                 }
             }
@@ -143,7 +145,15 @@ export function createListAgentsTool(opts) {
                             continue;
                         seenIds.add(e.agentId);
                         const live = opts.registry?.getAccessibleTask(e.agentId, view);
-                        rows.push({ kind: "roster", name: e.name, address: e.agentId, state: live === undefined ? "unknown" : agentRowState(live.status) });
+                        const stateRead = live === undefined ? undefined : agentStateOf(e.agentId, view);
+                        const agentState = stateRead instanceof Promise ? await stateRead : stateRead;
+                        rows.push({
+                            kind: "roster",
+                            name: e.name,
+                            address: e.agentId,
+                            state: live === undefined ? "unknown" : agentRowState(agentState?.status ?? live.status),
+                            ...(agentState !== undefined ? { agentState } : {}),
+                        });
                     }
                 }
                 catch {
@@ -159,7 +169,9 @@ export function createListAgentsTool(opts) {
             const lines = rows.map((r) => {
                 const label = r.kind === "peer_session" ? formatPeerNameRef(inlineUntrusted(r.name, 64), r.ref) : inlineUntrusted(r.name, 64);
                 const age = r.kind !== "peer_session" ? undefined : r.lastActiveAt !== undefined ? `active ${formatAgo(now - r.lastActiveAt)} ago` : r.offlineAt !== undefined ? `offline ${formatAgo(now - r.offlineAt)} ago` : "offline";
-                const cols = [label, r.state, age, r.cwd !== undefined ? inlineUntrusted(r.cwd, 64) : undefined, r.presence !== undefined ? renderPresence(r.presence) : undefined, r.kind === "peer_session" ? "peer session" : r.kind === "roster" ? rosterLabel : "agent", r.address];
+                const activity = r.agentState !== undefined ? agentActivityClause(r.agentState) : undefined;
+                const approval = r.agentState?.approval !== undefined ? agentApprovalClause(r.agentState.approval, r.agentState.readAt) : undefined;
+                const cols = [label, r.state, age, activity, approval, r.cwd !== undefined ? inlineUntrusted(r.cwd, 64) : undefined, r.presence !== undefined ? renderPresence(r.presence) : undefined, r.kind === "peer_session" ? "peer session" : r.kind === "roster" ? rosterLabel : "agent", r.address];
                 return cols.filter((c) => c !== undefined).join("  ·  ");
             });
             const finishedCount = rows.filter((r) => r.state === "finished").length;

package/dist/agents/peer-session-drain.d.ts

@@ -6,7 +6,7 @@ import { type PermissionModeClass } from "./cross-session-envelope.js";
 import { type CrossSessionInboundSettingLayers } from "./cross-session-judge.js";
 import { type PeerLaneConfig } from "./peer-admission.js";
 import { type PeerDirectory } from "./peer-directory.js";
-import { createListAgentsTool } from "./list-agents-tool.js";
+import { createListAgentsTool, type ListAgentsReadSeats } from "./list-agents-tool.js";
 import { foldPermissionModeClass } from "./cross-session-judge.js";
 import type { AskEffective } from "../core/wiring-manifest.js";
 import type { SendMessageToolOptions } from "./send-message-tool.js";
@@ -248,6 +248,8 @@ export declare function mountListAgents(args: {
         aliases?: readonly string[];
     }>;
     toolEffects: Map<string, "read" | "write" | "idempotent">;
+    /** The read faces' store seats, handed to the tool unchanged (see {@link ListAgentsReadSeats}). */
+    readSeats?: ListAgentsReadSeats;
 }): ReturnType<typeof createListAgentsTool> | undefined;
 type ListAgentsToolRegistry = NonNullable<Parameters<typeof createListAgentsTool>[0]["registry"]>;
 /** The harness surface the binding needs (structural — the machine itself never sees the harness). */

package/dist/agents/peer-session-drain.js

@@ -702,6 +702,7 @@ export function mountListAgents(args) {
         ...(args.parentTaskId !== undefined ? { parentAccess: { owner: args.parentTaskId, scope: args.scope, ...(args.parentSessionId !== undefined ? { sessionId: args.parentSessionId } : {}) } } : {}),
         ...(args.roster !== undefined ? { roster: args.roster } : {}),
         ...(args.continuationTier !== undefined ? { continuationTier: args.continuationTier } : {}),
+        ...(args.readSeats ?? {}),
     });
 }
 export function bindPeerSessionDrain(harness, opts) {

package/dist/agents/subagent-steps.d.ts

@@ -31,7 +31,8 @@ export interface SubagentStep {
     tool: string;
     /** The step's primary argument, one line: file path / command / pattern. May be "". */
     target: string;
-    /** Result first line — or `error: …` when the tool failed. May be "". */
+    /** Result first line — or `error: …` when the tool failed. May be "" (a result that was only an engine
+     *  reminder block has no line of its own). The engine's marked reminder blocks are not part of a result. */
     outcome: string;
 }
 /** A file the child mutated, with how many times (Write/Edit/MultiEdit/NotebookEdit). */
@@ -104,10 +105,19 @@ export declare class SubagentStepRecorder {
         target?: string;
     } | undefined;
 }
+/** One step read back from a session's persisted messages: a {@link SubagentStep} plus WHEN. */
+export interface TranscriptStep extends SubagentStep {
+    /** Epoch ms: the result message's timestamp when the call has a result, the calling message's when it
+     *  has none. Absent when that message carries no finite timestamp. */
+    at?: number;
+    /** Present (`true`) exactly when the transcript holds the call but no result for it — the call is still
+     *  in flight, or the run stopped before its result was recorded. */
+    inFlight?: true;
+}
 /**
  * Residual lane C — derive the last `lastN` tool steps from a session's PERSISTED messages (the pull-model
  * `AgentTranscript` read face). Mirrors {@link SubagentStepRecorder} but sources from committed history
  * instead of the live event stream, so a parent can retrospectively read a child's tail on demand. Walks
  * assistant `toolCall`s paired with the following `toolResult`, oldest→newest, then keeps the last N.
  */
-export declare function stepsFromMessages(messages: readonly unknown[], lastN: number): SubagentStep[];
+export declare function stepsFromMessages(messages: readonly unknown[], lastN: number): TranscriptStep[];

package/dist/agents/subagent-steps.js

@@ -1,3 +1,4 @@
+import { stripMarkedReminderBlocks } from "../core/reminder-mint.js";
 import { redactSecrets } from "../core/untrusted-egress.js";
 import { isProtectedWrite } from "../core/tool-registry.js";
 import { writeTargetPath } from "../tools/fs/safety.js";
@@ -32,7 +33,7 @@ export function redactThenCut(s, max) {
     return cutAt(redactSecrets(s), max);
 }
 function clip(s) {
-    return redactThenCut(firstLine(s).trim(), FIELD_MAX);
+    return redactThenCut(firstLine(stripMarkedReminderBlocks(s)).trim(), FIELD_MAX);
 }
 export function extractTarget(args) {
     if (args === null || typeof args !== "object")
@@ -51,7 +52,7 @@ export function extractTarget(args) {
     if (primary !== undefined)
         return clip(primary);
     try {
-        return clip(JSON.stringify(a));
+        return clip(JSON.stringify(a, (_key, v) => (typeof v === "string" ? stripMarkedReminderBlocks(v) : v)));
     }
     catch {
         return "";
@@ -162,12 +163,13 @@ export class SubagentStepRecorder {
         return this.actionTool === undefined ? undefined : { toolName: this.actionTool, ...(this.actionTarget !== undefined ? { target: this.actionTarget } : {}) };
     }
 }
+const stampOf = (m) => (typeof m.timestamp === "number" && Number.isFinite(m.timestamp) ? m.timestamp : undefined);
 export function stepsFromMessages(messages, lastN) {
     const results = new Map();
     for (const m of messages) {
         const msg = m;
         if (msg.role === "toolResult" && typeof msg.toolCallId === "string") {
-            results.set(msg.toolCallId, { isError: msg.isError === true, body: outputFirstLineFromContent(msg.content) });
+            results.set(msg.toolCallId, { isError: msg.isError === true, body: outputFirstLineFromContent(msg.content), at: stampOf(msg) });
         }
     }
     const steps = [];
@@ -175,13 +177,15 @@ export function stepsFromMessages(messages, lastN) {
         const msg = m;
         if (msg.role !== "assistant" || !Array.isArray(msg.content))
             continue;
+        const calledAt = stampOf(msg);
         for (const block of msg.content) {
             const b = block;
             if (b.type !== "toolCall" || typeof b.name !== "string")
                 continue;
             const res = typeof b.id === "string" ? results.get(b.id) : undefined;
             const outcome = res ? (res.isError ? cutAt(`error: ${res.body}`, FIELD_MAX) : res.body) : "";
-            steps.push({ tool: b.name, target: extractTarget(b.arguments), outcome });
+            const at = res ? res.at : calledAt;
+            steps.push({ tool: b.name, target: extractTarget(b.arguments), outcome, ...(at !== undefined ? { at } : {}), ...(res === undefined ? { inFlight: true } : {}) });
         }
     }
     const cap = Math.max(0, Math.min(lastN, steps.length));

package/dist/agents/subagent.d.ts

@@ -1,4 +1,4 @@
-import type { RunInternals, RunnerSelfSeat } from "../core/runner/contracts.js";
+import type { RunnerSelfSeat } from "../core/runner/contracts.js";
 import type { AgentDefinition, Model, ModelRef, TaskLimits, TerminalCause, ToolSpec } from "../core/types.js";
 export { childThinkingSeat, deploymentSubagentThinking, deploymentSubagentTierModel } from "./child-model-seat.js";
 import { type ExecutionEnv } from "../internal/harness.js";
@@ -74,22 +74,6 @@ interface ReviewSample {
 /** Layered head/middle/tail sample of `text` under `budget`, with each skipped span marked in band so the
  *  reader can see that the material is discontinuous. Exported for tests (window determinism). */
 export declare function layeredReviewSample(text: string, budget?: number, windows?: number): ReviewSample;
-/**
- * 🔴 design/77 §3 / §7 — skill→subagent manifest-scope PROPAGATION (fail-closed). Given the parent task's
- * live skill-manifest snapshot (from `ctx.activeSkillScope()`), build the inherited-scope frames to thread
- * into a spawned child via the trusted {@link RunInternals.inheritedManifestScope} channel, so the child's
- * tool gate inherits the parent skill's deny-narrowing (a child of a manifested skill is at most as capable
- * as the manifest — MONOTONIC).
- *
- * - Parent has NO active manifest (empty/absent snapshot) → return `undefined` (no inheritance; the child
- *   behaves exactly as today, backward-compatible).
- * - Parent HAS active manifest frames → return them verbatim (the child seeds them as the LIFO base; its
- *   own skill loads can only intersect/narrow further).
- * - Fail-closed: the snapshot is non-empty but its shape is not a recognizable frame array (a future/older
- *   Runner, a tampered accessor) → return a SINGLE DENY-ALL `unresolved` frame, so the child runs under a
- *   deny-all inherited scope rather than UNMANIFESTED. The safe path is the default.
- */
-export declare function inheritedManifestScopeFor(snapshot: readonly unknown[] | undefined): RunInternals["inheritedManifestScope"];
 /** Default model-facing name of the delegation tool (CC 2.1.187 `Agent`; legacy alias `Task`). */
 export declare const DEFAULT_SUBAGENT_TOOL_NAME = "Agent";
 /**

package/dist/agents/subagent.js

@@ -31,6 +31,7 @@ import { shellQuote } from "../tools/fs/search.js";
 import { BG_AGENT_REAP_STOP_ERROR } from "../core/task-registry.js";
 import { readDurableOrgAdmission } from "../core/memory-admission.js";
 import { governanceRetryClass } from "../core/governance-codes.js";
+import { readSkillGrantCapture } from "../core/skill-grant.js";
 import { terminalFrameFacets } from "../core/task-notification.js";
 import { RETAIN_DEFAULT_TTL_MS, RETAIN_DEFAULT_MAX, RUNNING_AGENT_OBSERVE_EVERY_BEATS, DELEGATION_MAX_CONCURRENT_DEFAULT, DELEGATION_MAX_PER_SESSION_DEFAULT } from "../config/defaults.js";
 function rollupDelegatedCost(stats, nested) {
@@ -187,28 +188,6 @@ function withHandbackWarning(warning, result) {
         return result;
     return result ? `${warning}\n\n${result}` : warning;
 }
-export function inheritedManifestScopeFor(snapshot) {
-    if (!snapshot || snapshot.length === 0)
-        return undefined;
-    const frames = [];
-    for (const f of snapshot) {
-        if (f && typeof f === "object" && "kind" in f) {
-            const kind = f.kind;
-            if (kind === "manifest" || kind === "unresolved") {
-                frames.push(f);
-                continue;
-            }
-        }
-        return [
-            {
-                kind: "unresolved",
-                lineageId: "inherited-parent-manifest",
-                reason: "parent skill manifest was active at spawn but its scope could not be propagated to the subagent — fail-closed deny-all",
-            },
-        ];
-    }
-    return frames;
-}
 export const DEFAULT_SUBAGENT_TOOL_NAME = "Agent";
 export const EXTRA_TOOLS_MAX_FACTORY_CALLS_PER_TREE = 64;
 export const DEFAULT_SUBAGENT_MAX_DEPTH = 3;
@@ -1724,6 +1703,14 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                 })()
                 : seatModel?.id;
             const rowModelKey = perCallModel !== undefined ? requestedModel ?? perCallModel.id : typeof seatModel === "string" ? seatModel : seatModel?.id;
+            const inheritedSkillGrants = readSkillGrantCapture(ctx.activeSkillGrants?.());
+            if (inheritedSkillGrants === undefined) {
+                return {
+                    isError: true,
+                    content: "Sub-agent not started: the parent's skill grants could not be read for the child (an unrecognizable capture); a child started without them would lose the parent's disallowed-tools refusals.",
+                    details: { error: "skill_grants.unreadable" },
+                };
+            }
             let worktreeDir;
             if (reviveClaim === undefined && (a.isolation ?? def?.isolation) === "worktree") {
                 const iso = ctx.worktreeIsolation;
@@ -1844,7 +1831,6 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
             if (depth + 1 < maxDepth && defAllowsDelegation) {
                 childTools.push(createSubagentToolNode(opts, depth + 1, nextExcluded, treeBudget));
             }
-            const inheritedManifestScope = inheritedManifestScopeFor(ctx.activeSkillScope?.());
             const childAgentName = (typeof a.description === "string" && a.description.trim() ? a.description.trim() : undefined) ?? def?.name;
             const observerArm = ctx.observersAllowed === true && def !== undefined
                 ? resolveObserverDeclaration({
@@ -2100,7 +2086,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                 : undefined;
             const childInternals = {
                 ...(childPick.modelRef !== undefined ? { inheritedModelRef: childPick.modelRef } : {}),
-                ...(inheritedManifestScope ? { inheritedManifestScope } : {}),
+                ...(inheritedSkillGrants.length > 0 ? { inheritedSkillGrants } : {}),
                 ...(childProvenanceRef !== undefined && provenanceRequest !== undefined ? { delegationProvenance: { ref: childProvenanceRef, contentSafety: provenanceRequest } } : {}),
                 ...(treeScope !== undefined ? { registryScope: treeScope } : {}),
                 ...(ctx.inheritedGateForChildren ? { inheritedGate: ctx.inheritedGateForChildren() } : {}),
@@ -2668,6 +2654,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                                 }
                                 catch {
                                 }
+                                bgForkActivityBeat(e);
                             },
                         };
                     void opts.runner
@@ -3305,6 +3292,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                             }
                             catch {
                             }
+                            bgActivityBeat(e);
                         },
                     };
                 const driveParkedResume = async () => {

package/dist/core/agent-definition.d.ts

@@ -1,7 +1,7 @@
 /**
  * A delegated AGENT's definition and the skills it may mount: `AgentDefinition` (the agent a subagent
- * tool spawns), `SkillManifest` (a skill's on-disk front matter) and `SkillSpec` (the wired form the
- * runner mounts). Layer 0 vocabulary; `types.ts` re-exports the three, so no consumer's import changes.
+ * tool spawns) and `SkillSpec` (the wired form the runner mounts). Layer 0 vocabulary; `types.ts`
+ * re-exports the two, so no consumer's import changes.
  */
 import type { ThinkingLevel } from "../internal/harness.js";
 import type { ModelRef } from "./model-seat.js";
@@ -101,49 +101,28 @@ export interface AgentDefinition {
      */
     observerMessage?: string;
 }
-/**
- * A per-skill runtime capability manifest (design/77 §3 Gate-3). When present, loading the skill
- * SCOPES the rest of the invocation to ONLY these tools/paths via runtime deny-narrowing: a tool call
- * not in `allowTools` (intersected across nested skill frames) is DENIED, and a write whose canonical
- * target falls outside `allowPaths` is DENIED — regardless of how permissive the task policy is.
- *
- * 🔴 **Safe-by-construction:** a manifest can only SUBTRACT capability. The narrowing composes via the
- * `deny > ask > allow` fold (`combinePolicies`) where `deny` short-circuits, so a manifest can never
- * *grant* a tool the task policy withheld — whoever sets a manifest can only restrict further.
- * Worst case (the model never pops the frame) = no narrowing, never widening — still ⊆ task policy.
- *
- * The manifest is CALLER-provided here (same trust level as the rest of `SkillSpec`); deriving it
- * automatically (the auto-promote pipeline) is a separate, deferred concern (design/77 §5).
- */
-export interface SkillManifest {
-    /** The ONLY tool names the invocation may call while this skill's frame is active. */
-    allowTools: string[];
-    /**
-     * Optional path allowlist for WRITE tools (`write_file`/`edit_file`): a write whose canonicalized
-     * target is not inside one of these (path-segment-aware) prefixes is DENIED. Omit = no path narrowing
-     * (only `allowTools` applies). Reads are never path-narrowed (this gate restricts capability, not visibility).
-     *
-     * 🔴 **Fail-closed (MAJOR-2):** `allowPaths` can only confine tools whose write target is a parseable `path`
-     * argument (`write_file`/`edit_file`). While an `allowPaths` constraint is active, any OTHER mutating
-     * (effect:write/idempotent) allowlisted tool — notably `bash`, whose command can write anywhere — is DENIED
-     * outright, because its target cannot be path-confined. So a manifest that lists `bash` together with
-     * `allowPaths` does NOT let bash write/egress anywhere: bash is denied while the path constraint is active.
-     * Confine writes to specific paths via `write_file`/`edit_file` only.
-     */
-    allowPaths?: string[];
-    /** Reserved (design/77 §3): whether egress is permitted under this manifest. Carried through; v1 does
-     *  not act on it beyond the allowTools intersection (egress tools must also be in `allowTools`). */
-    egress?: boolean;
-    /** Stable lineage id of the artifact this manifest came from — used in deny reasons + as the scope key. */
-    lineageId: string;
-}
 /** A skill made available to this task (passed as an object; not loaded from disk). */
 export interface SkillSpec {
     name: string;
     description: string;
     content: string;
-    /** Optional Gate-3 runtime capability manifest (design/77 §3) — see {@link SkillManifest}. */
-    manifest?: SkillManifest;
+    /**
+     * The tools this skill lets run WITHOUT ASKING for the rest of the run it is activated in — the frontmatter
+     * `allowed-tools` list, spelled as a permission rule is spelled: a tool name (`Read`, `mcp__srv__get_issue`), a
+     * protocol namespace (`mcp__srv` / `mcp__srv__*` / `mcp__srv__get_*`), a shell command rule (`Bash(git:*)`) or the Read
+     * directory form (`Read(//abs/dir/**)`). The list is an allow-rule source, not a fence: an unlisted tool is judged as
+     * it always is, and a listed one is released only from the questions an allow rule may clear (a deny or ask rule, the
+     * plan mode, the organization ceiling and every mandated question still stand). Activating a skill that declares
+     * either list asks once (`Execute skill: <name>`, the card listing what it releases); a skill the person invoked by
+     * name ({@link import("./task-spec.js").TaskSpec.userInvokedSkills}) grants without asking. The grant holds for that
+     * run (a steer it takes in does not end it) and the next runTask starts without it. An entry this grammar reads as nothing — `*` (it voids an allow list; on a deny list it is inert and the rest of the
+     * list still refuses), `mcp__*`, a write path, a domain — grants nothing and is announced at the start of the run (`skills.allowed_tool_not_granted`).
+     */
+    allowedTools?: string[];
+    /** The tools refused for the rest of the run this skill is activated in — the frontmatter `disallowed-tools` list,
+     *  in the {@link allowedTools} grammar (a path tool also takes a path pattern here); read wherever a person's deny
+     *  rows are read, ahead of every allow. */
+    disallowedTools?: string[];
     /**
      * Optional attachments bundled with the skill (additive) — the CC bundled-skill shape (a SKILL.md whose
      * body references sibling files by relative path) translated to sema's brain-outside posture, where the

package/dist/core/agent-state.d.ts

@@ -0,0 +1,91 @@
+/**
+ * A background agent's CURRENT state — the one reading every read face renders.
+ *
+ * A parent model answers "how far along is it?" from what its read faces show. Three faces read a
+ * background agent: AgentTranscript (its recent steps), ListAgents (the roster) and TaskOutput (the poll).
+ * Each one projects {@link readAgentState}'s result and renders it with {@link agentStateSummary} /
+ * {@link agentActivityClause} / {@link agentApprovalClause}; none derives status, activity time or approval
+ * facts on its own, so the three cannot disagree about one agent at one instant.
+ *
+ * Sources:
+ *  - the registry row — the live handle this engine process runs ({@link agentStateSourceOfHandle}), or the
+ *    durable record when no live handle answers ({@link agentStateSourceOfRecord});
+ *  - for a row whose status is `parked` only, the approval checkpoint the row names, read through the run's
+ *    checkpoint seat (the same seat the Agent tool parks children into). The checkpoint token is the resume
+ *    capability and never leaves this module: a face renders the checkpoint's non-secret `checkpointId`.
+ *
+ * Absence is stated, never left silent: a missing activity time renders as "last activity unknown (…why)",
+ * and a parked row whose card cannot be read carries `approval.state` `missing` / `unreadable`. A face that
+ * goes quiet on a fact invites the reader to fill the gap with a guess.
+ */
+import type { SemaTaskStatus } from "./task-registry-shared.js";
+import { type CheckpointSeat } from "./checkpoint-seat.js";
+/** The approval card's state: the checkpoint row's own `status`, plus `missing` (the row names no card, or
+ *  the store holds none under its token) and `unreadable` (no checkpoint seat on this face, or the store
+ *  threw). The same five answers the parked-row reconciliation sweep gives the same question. */
+export type AgentApprovalState = "pending" | "resolved" | "expired" | "missing" | "unreadable";
+/** The approval checkpoint a parked agent waits on. */
+export interface AgentApproval {
+    state: AgentApprovalState;
+    /** The checkpoint's non-secret identity (the card id a person sees in the approval inbox). Present when
+     *  the card was read and carries one. */
+    checkpointId?: string;
+    /** The card's SLA / abandonment deadline, epoch ms. Present when the card was read and carries one. */
+    deadline?: number;
+}
+/** Where the row was read from: the live handle this engine process runs, or the durable record (the
+ *  process that wrote it may be another one, or gone). */
+export type AgentStateRow = "live_row" | "durable_row";
+/** One agent's state at {@link readAt}. Times are epoch ms; relative ages appear only in rendered text. */
+export interface AgentState {
+    /** The registry row's own status word. A word outside {@link SemaTaskStatus} reads `unknown`. */
+    status: SemaTaskStatus | "unknown";
+    /** The instant this state was read (epoch ms) — the base every rendered age is computed from. */
+    readAt: number;
+    row: AgentStateRow;
+    /** The row's last recorded change (epoch ms). Live row: every state transition and every tool start /
+     *  end of the direct child moves it. Durable row: when it parked (`parked`) or settled (terminal).
+     *  ABSENT when the source holds no such time — a durable row still marked running (activity in another
+     *  process is not observable here), or a row that never recorded one. */
+    lastActivityAt?: number;
+    /** Present exactly when {@link status} is `parked`. */
+    approval?: AgentApproval;
+}
+/** The row facts {@link readAgentState} reads. Built by the two projections below — never by a face. */
+export interface AgentStateSource {
+    status: string;
+    row: AgentStateRow;
+    lastActivityAt?: number;
+    parkedCheckpointToken?: string;
+}
+/** The live handle's facts: `updatedAt` is moved by every state transition and by each direct-child tool
+ *  lifecycle beat, so it is the row's last activity. */
+export declare function agentStateSourceOfHandle(h: {
+    status: string;
+    updatedAt: number;
+    parkedCheckpointToken?: string;
+}): AgentStateSource;
+/** The durable record's facts. Its `updatedAt` is the writer's liveness lease renewal, not activity, so it
+ *  is never read as such: a parked record answers with `parkedAt`, a terminal one with `settledAt`, and a
+ *  record still marked running answers nothing. */
+export declare function agentStateSourceOfRecord(r: {
+    status: string;
+    parkedAt?: number;
+    settledAt?: number;
+    parkedCheckpointToken?: string;
+}): AgentStateSource;
+/**
+ * THE state of one background agent at `now`. Synchronous unless the row is parked on a card the seat can
+ * read — only that row takes an async frame (the store read); every other row is answered in place.
+ * The caller must already have passed the row through its face's access check: this reads the card the
+ * row names and authorizes nothing.
+ */
+export declare function readAgentState(src: AgentStateSource, seat: CheckpointSeat | undefined, now: number): AgentState | Promise<AgentState>;
+/** `Ns` / `Nm` / `Nh` / `Nd` — a bounded age word; a negative span reads as `0s`. */
+export declare function formatAgo(ms: number): string;
+/** `last activity <age> ago`, or the reason the time is unknown. */
+export declare function agentActivityClause(s: AgentState): string;
+/** `approval <card id> <state>[ (deadline in <age> | deadline passed <age> ago)]` — facts only. */
+export declare function agentApprovalClause(a: AgentApproval, readAt: number): string;
+/** The one-line state sentence: `<status> · <activity clause>[ · <approval clause>]`. */
+export declare function agentStateSummary(s: AgentState): string;

package/dist/core/agent-state.js

@@ -0,0 +1,79 @@
+import { checkpointStoreOfSeat } from "./checkpoint-seat.js";
+import { inlineUntrusted } from "./untrusted-text.js";
+const STATUS_WORDS = { pending: true, running: true, parked: true, completed: true, failed: true, killed: true, cancelled: true };
+export function agentStateSourceOfHandle(h) {
+    return {
+        status: h.status,
+        row: "live_row",
+        lastActivityAt: h.updatedAt,
+        ...(h.parkedCheckpointToken !== undefined ? { parkedCheckpointToken: h.parkedCheckpointToken } : {}),
+    };
+}
+export function agentStateSourceOfRecord(r) {
+    const at = r.status === "parked" ? r.parkedAt : r.status === "running" ? undefined : r.settledAt;
+    return {
+        status: r.status,
+        row: "durable_row",
+        ...(at !== undefined ? { lastActivityAt: at } : {}),
+        ...(r.parkedCheckpointToken !== undefined ? { parkedCheckpointToken: r.parkedCheckpointToken } : {}),
+    };
+}
+const finite = (n) => typeof n === "number" && Number.isFinite(n);
+async function readApprovalCard(store, token) {
+    let cp;
+    try {
+        cp = (await store.get(token));
+    }
+    catch {
+        return { state: "unreadable" };
+    }
+    if (cp === null || cp === undefined)
+        return { state: "missing" };
+    const state = cp.status === "pending" || cp.status === "resolved" || cp.status === "expired" ? cp.status : "unreadable";
+    return {
+        state,
+        ...(typeof cp.checkpointId === "string" && cp.checkpointId !== "" ? { checkpointId: cp.checkpointId } : {}),
+        ...(finite(cp.deadline) ? { deadline: cp.deadline } : {}),
+    };
+}
+export function readAgentState(src, seat, now) {
+    const base = {
+        status: Object.hasOwn(STATUS_WORDS, src.status) ? src.status : "unknown",
+        readAt: now,
+        row: src.row,
+        ...(finite(src.lastActivityAt) ? { lastActivityAt: src.lastActivityAt } : {}),
+    };
+    if (base.status !== "parked")
+        return base;
+    if (src.parkedCheckpointToken === undefined)
+        return { ...base, approval: { state: "missing" } };
+    const store = checkpointStoreOfSeat(seat);
+    if (store === undefined)
+        return { ...base, approval: { state: "unreadable" } };
+    return readApprovalCard(store, src.parkedCheckpointToken).then((approval) => ({ ...base, approval }));
+}
+export function formatAgo(ms) {
+    const sec = Math.max(0, Math.floor(ms / 1000));
+    if (sec < 60)
+        return `${sec}s`;
+    const min = Math.floor(sec / 60);
+    if (min < 60)
+        return `${min}m`;
+    const h = Math.floor(min / 60);
+    if (h < 48)
+        return `${h}h`;
+    return `${Math.floor(h / 24)}d`;
+}
+export function agentActivityClause(s) {
+    if (s.lastActivityAt !== undefined)
+        return `last activity ${formatAgo(s.readAt - s.lastActivityAt)} ago`;
+    return s.row === "durable_row" && s.status === "running" ? "last activity unknown (recorded as running by another engine process)" : "last activity unknown (not recorded)";
+}
+export function agentApprovalClause(a, readAt) {
+    const id = a.checkpointId !== undefined ? ` ${inlineUntrusted(a.checkpointId, 64)}` : "";
+    const deadline = a.deadline === undefined ? "" : a.deadline > readAt ? ` (deadline in ${formatAgo(a.deadline - readAt)})` : ` (deadline passed ${formatAgo(readAt - a.deadline)} ago)`;
+    return `approval${id} ${a.state}${deadline}`;
+}
+export function agentStateSummary(s) {
+    return [s.status, agentActivityClause(s), ...(s.approval !== undefined ? [agentApprovalClause(s.approval, s.readAt)] : [])].join(" · ");
+}