@sema-agent/core 7.40.1 → 7.41.0

package/dist/core/gate-lanes.js

@@ -7,13 +7,14 @@ import { inlineUntrusted } from "./untrusted-text.js";
 import { isRuleBehavior } from "./permission-rule-model.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "./ask-question.js";
 import { applyPersistedTightening, disclosedRuleSet } from "./persisted-rule-arms.js";
+import { skillAllowDecision, skillRowRefusal } from "./skill-grant.js";
 import { CD_GIT_COMPOUND_SENTENCE, changesDirectoryBeforeGit, readOnlyShellVerdict } from "./read-only-shell.js";
 import { readShellCommand } from "./shell-lexer.js";
 import { COMMAND_RULE_TOOL } from "./permission-rule-model.js";
 import { catalogRuleFaceOf } from "./tool-registry.js";
 import { callFaceSeat } from "./tool-roster.js";
 import { heldBy, wireOf } from "./tool-name-readings.js";
-import { asksUnstated, modeAcceptsFileCommand, unstatedAskMessage } from "./mode-policy.js";
+import { asksUnstated, modeAcceptsFileCommand, permissionSeatAt, unstatedAskMessage } from "./mode-policy.js";
 import { ORG_ADJUDICATION_TIMEOUT_MS, ORG_RULE_DECISION_REASON, ORG_UNAVAILABLE_DECISION_REASON, settleOrgVerdictWithin } from "./permission-rule-org.js";
 import { exitGate } from "./runner/gate-exit.js";
 import { traceHookCrash } from "./gate-crash-trace.js";
@@ -167,6 +168,7 @@ export async function runGateLanes(pass) {
         egress: input.egress,
         shellGated: input.shellGated,
         irreversibility: input.irreversibility,
+        requiresUserInteraction: input.requiresUserInteraction,
         probeUnanswered: pass.probeUnanswered === true,
         writeProtected: pass.writeProtected === true,
         writeProtectionUnresolved: pass.writeProtectionUnresolved === true,
@@ -279,6 +281,12 @@ export async function runGateLanes(pass) {
             pass.deniedBy = "persisted_rule";
         if (tightened.tightened === "deny")
             pass.denyCause = undefined;
+        const skillRefusal = pass.decision.action === "deny" ? undefined : skillRowRefusal(input.skillGrants, laneReq);
+        if (skillRefusal !== undefined) {
+            pass.decision = skillRefusal;
+            pass.deniedBy = "policy";
+            pass.denyCause = undefined;
+        }
     }
     if (pass.decision.action === "ask") {
         pass.decision = { ...pass.decision };
@@ -350,6 +358,11 @@ export async function runGateLanes(pass) {
                 };
             }
         }
+        const skillHit = allowLayerMayClear() && pass.decision.action === "ask" && ruleMayClear() ? input.skillGrants?.allowing(pass.req, input.permissionMode?.()) : undefined;
+        if (skillHit !== undefined) {
+            pass.decision = skillAllowDecision(skillHit, pass.policyRewrite);
+            await notifier.notifyAsync(() => input.skillGrants?.onAllowed?.({ toolName: pass.req.toolName, toolCallId, ...skillHit }), "toolGate.skillGrantResolved");
+        }
         const originFacts = askOriginFacts(orgAnswer.org, ruleCallUnreadableOf(laneAnswer));
         if (pass.decision.action === "ask") {
             const stamped = { ...pass.decision, ruleEvidence: mintRuleEvidence(personalEvidence), ...(laneCoverage !== undefined ? { segmentCoverage: laneCoverage } : {}) };
@@ -703,14 +716,20 @@ export async function runGateLanes(pass) {
                             break;
                         }
                     }
+                    const editSkillRefusal = skillRowRefusal(input.skillGrants, { toolName, args: editArgs, toolCallId, ...(pass.req.face !== undefined ? { face: pass.req.face } : {}) });
+                    if (editSkillRefusal !== undefined) {
+                        editDenied = editSkillRefusal;
+                        pass.deniedBy = "policy";
+                        break;
+                    }
                     if (recheck.action === "allow") {
                         if (recheck.updatedInput !== undefined) {
                             editArgs = recheck.updatedInput;
                             editRewrittenSinceHuman = true;
                         }
-                        if (!editRewrittenSinceHuman || !asksUnstated(recheck, input.permissionSeat, input.permissionMode?.(), editHookAllowed && recheck.updatedInput === undefined))
+                        if (!editRewrittenSinceHuman || !asksUnstated(recheck, permissionSeatAt(input, editArgs)?.seat, input.permissionMode?.(), editHookAllowed && recheck.updatedInput === undefined))
                             break;
-                        recheck = { action: "ask", message: unstatedAskMessage(toolName) };
+                        recheck = { action: "ask", message: permissionSeatAt(input, editArgs)?.question ?? unstatedAskMessage(toolName) };
                         pass.tightenedBy = "unstated";
                     }
                     if (recheck.updatedInput !== undefined) {

package/dist/core/governance-codes.d.ts

@@ -136,7 +136,7 @@ export type NoticeAudience = "user" | "operator";
  * the union's catalog ({@link EngineNotice.code}). The groups below say only which family a row joins,
  * so the catalog is not written a second time here and the two cannot drift.
  */
-export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.context_settings_swapped", "config.read_face_swapped", "config.read_face_deployment_clamped", "config.write_face_swapped", "config.write_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.artifact_host_invalid", "config.task_root_not_canonical", "config.write_protection_target_view_absent", "config.write_protection_unresolved", "config.execution_env_capability_invalid", "config.tool_card_undeclared", "config.tool_face_undeclared", "config.tool_face_invalid", "config.forward_sink_failed", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "config.secret_env_scrubbed", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "classifier.fallback", "classifier.role_defaulted", "classifier.contract_broken", "classifier.unavailable", "checkpoint.execution_outcome_unrecorded", "delegation.transcript_integrity", "delegation.ask_unresolvable", "mcp.injection_dropped", "mcp.revocation_probe_failed", "mcp.server_redialed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "memory.restore_withheld", "memory.project_scope_absent", "route.fallback_to_primary", "route.classifier_unroutable", "route.base_url_changed_key_unchanged", "route.response_model_mismatch", "route.tool_call_id_folded", "context.tool_turn_repaired", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "task.interrupt_unconsumed", "task.tool_turn_incomplete", "approval.read_root_granted", "approval.read_root_grant_rejected", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "skills.listing_truncated", "agents.listing_truncated", "tool_result.offload_put_failed", "instructions.source_changed", "session.records_skipped", "memory.layer_locked_legacy", "server.model_unreachable"];
+export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.context_settings_swapped", "config.read_face_swapped", "config.read_face_deployment_clamped", "config.write_face_swapped", "config.write_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.artifact_host_invalid", "config.task_root_not_canonical", "config.write_protection_target_view_absent", "config.write_protection_unresolved", "config.execution_env_capability_invalid", "config.tool_card_undeclared", "config.tool_face_undeclared", "config.tool_face_invalid", "config.forward_sink_failed", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "config.secret_env_scrubbed", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "classifier.fallback", "classifier.role_defaulted", "classifier.contract_broken", "classifier.unavailable", "checkpoint.execution_outcome_unrecorded", "delegation.transcript_integrity", "delegation.ask_unresolvable", "mcp.injection_dropped", "mcp.revocation_probe_failed", "mcp.server_redialed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "memory.restore_withheld", "memory.project_scope_absent", "route.fallback_to_primary", "route.classifier_unroutable", "route.base_url_changed_key_unchanged", "route.response_model_mismatch", "route.tool_call_id_folded", "context.tool_turn_repaired", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "task.interrupt_unconsumed", "task.tool_turn_incomplete", "approval.read_root_granted", "approval.read_root_grant_rejected", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "skills.listing_truncated", "skills.allowed_tool_not_granted", "agents.listing_truncated", "tool_result.offload_put_failed", "instructions.source_changed", "session.records_skipped", "memory.layer_locked_legacy", "server.model_unreachable"];
 /** A catalogued code (see {@link ENGINE_NOTICE_CODES}); {@link NOTICE_MINTER} says who mints it. NOT the type of
  *  `EngineNotice.code`, which stays `string` — a host forwarding its own notices through the same
  *  sink is a supported shape, and narrowing that field would break it. */
@@ -233,6 +233,7 @@ declare const NOTICE_AUDIENCE_TABLE: {
     readonly "route.tool_call_id_folded": "operator";
     readonly "context.tool_turn_repaired": "operator";
     readonly "skills.listing_truncated": "operator";
+    readonly "skills.allowed_tool_not_granted": "operator";
     readonly "agents.listing_truncated": "operator";
     readonly "tool_result.offload_put_failed": "operator";
     readonly "config.forward_sink_failed": "operator";
@@ -343,6 +344,7 @@ declare const NOTICE_MINTER_TABLE: {
     readonly "memory.capture_opted_out": "engine";
     readonly "memory.capture_optout_unpersisted": "engine";
     readonly "skills.listing_truncated": "engine";
+    readonly "skills.allowed_tool_not_granted": "engine";
     readonly "agents.listing_truncated": "engine";
     readonly "tool_result.offload_put_failed": "engine";
     readonly "instructions.source_changed": "server";

package/dist/core/governance-codes.js

@@ -193,6 +193,7 @@ export const ENGINE_NOTICE_CODES = Object.freeze([
     "memory.capture_opted_out",
     "memory.capture_optout_unpersisted",
     "skills.listing_truncated",
+    "skills.allowed_tool_not_granted",
     "agents.listing_truncated",
     "tool_result.offload_put_failed",
     "instructions.source_changed",
@@ -279,6 +280,7 @@ const NOTICE_AUDIENCE_TABLE = {
     "route.tool_call_id_folded": "operator",
     "context.tool_turn_repaired": "operator",
     "skills.listing_truncated": "operator",
+    "skills.allowed_tool_not_granted": "operator",
     "agents.listing_truncated": "operator",
     "tool_result.offload_put_failed": "operator",
     "config.forward_sink_failed": "operator",
@@ -371,6 +373,7 @@ const NOTICE_MINTER_TABLE = {
     "memory.capture_opted_out": "engine",
     "memory.capture_optout_unpersisted": "engine",
     "skills.listing_truncated": "engine",
+    "skills.allowed_tool_not_granted": "engine",
     "agents.listing_truncated": "engine",
     "tool_result.offload_put_failed": "engine",
     "instructions.source_changed": "server",

package/dist/core/hooks.d.ts

@@ -2,6 +2,7 @@ import type { ActorAssertion, DocumentContent, ImageContent, TextContent } from
 import type { ExecutionEnv, FileError, Result, SessionTreeEntry } from "../internal/harness-types.js";
 import type { DecisionReason, PermissionResult, ResolvedAsk, ToolCallFace, ToolCallRequest, ToolPolicy } from "./tool-policy.js";
 import type { GateOutcome } from "./gate-outcome.js";
+import { type PreToolUseScreening } from "./runner/gate-exit.js";
 export { normalizeOrgGateVerdict, normalizePersistedRuleHit } from "./gate-lanes.js";
 export { cloneObserverInput } from "./runner/gate-exit.js";
 import { type AskClass } from "./ask-class.js";
@@ -9,6 +10,9 @@ import { type PermissionMode } from "./ask-origin.js";
 import type { AutoModeDenialTracker } from "./auto-mode.js";
 export { formatHookFeedback } from "./reminder-mint.js";
 import type { WiringLegKind } from "./wiring-manifest.js";
+import { type SafeNotifier } from "./safe-notify.js";
+import type { PermissionSeatInputs } from "./mode-policy.js";
+import type { SkillGateSeats } from "./skill-grant.js";
 /**
  * In-process hook seam (design/37) — a provider-agnostic interception layer modeled on CC's hooks,
  * kept process-internal (no shell/HTTP executors, no settings files). The original tool-call trio:
@@ -1128,7 +1132,7 @@ export type PersistedRuleAnswer = PersistedRuleHit | PersistedRuleCoverage | Per
  *  signal; when the caller also supplies {@link ToolGateInput.callSignal}, the Runner's closures
  *  additionally bind their waits to that per-call signal (`AbortSignal.any` of the two), so a turn
  *  interrupt releases a pending ask instead of leaving it hanging on the run's lifetime alone. */
-export interface ToolGateInput {
+export interface ToolGateInput extends PermissionSeatInputs, SkillGateSeats {
     /** RB-473 batch 2b — bounded disclosure for a HOST callback that throws inside this gate call's
      *  isolation scope (onHookError itself, the deny observer, the durable-park observer). The runner
      *  wires this to an `observer.notify_failed` trace event; absent = counted only (unchanged). */
@@ -1462,9 +1466,10 @@ export interface ToolGateInput {
     /** WHO put the tool's egress / irreversibility marks on the seat ({@link import("./ask-origin.js").ToolMarkSource});
      *  absent or empty with a mark present reads as the deployment's own (fail-closed: an operator's mandate). */
     toolMarkSources?: ReadonlySet<import("./ask-origin.js").ToolMarkSource>;
-    /** The called tool's permission seat ({@link import("./tool-spec.js").ToolSpec.permissionSeat}): `"passthrough"` ⇒ an allow no layer stated
-     *  meets the mode's answer for an unstated call ({@link import("./mode-policy.js").ModePolicy.unstated}). Absent ⇒ the tool answers for itself. */
-    permissionSeat?: "passthrough";
+    /** The called tool's seat carries its server's declaration that a call must be put to a person
+     *  ({@link import("../engine/loop/types.js").AgentTool.mcpRequiresUserInteraction}): a surviving `allow` is tightened to an `ask`, and every ask on the call carries
+     *  the class `requires_user_interaction` and the real-approval bit (no rule, grant, classifier, bypass mode, blanket seat or policy-settled approver answers it). Absent ⇒ not declared. */
+    requiresUserInteraction?: true;
     /** The deployment's A2A peer-isolation switch: a set switch makes the A2A egress default an operator mandate. */
     a2aIsolatePeers?: boolean;
     /** Observe a mode RELEASE (fired before the released allow leaves the arbitration point; `readUnestablished`: the read station could not establish what the call reads). Observe-only. */
@@ -1499,8 +1504,10 @@ export interface ToolGateInput {
      * this leg) and no durable park took the call, so the fail-closed deny STANDS. Fired once per such call
      * from the gate's single deny exit, after every park re-route has had its attempt, with the facts the
      * `delegation.ask_unresolvable` notice is composed from (`ask-unresolvable-notice.ts`);
-     * `parkLaneExisted` = a park lane was armed for this run. Observe-only: a throwing seat never alters
-     * the deny. Absent ⇒ the deny stands silently (a host driving the gate directly, no notice sink).
+     * `parkLaneExisted` = a park lane was armed for this run; `remedy` = the caller-side change that would have let the
+     * call run, present for the causes that say nobody could be asked (`approver_unavailable`, `no_approver_wired`).
+     * Observe-only: a throwing seat never alters the deny. Absent ⇒ the deny stands silently (a host driving the gate
+     * directly, no notice sink).
      */
     onAskUnresolvable?: (info: {
         toolName: string;
@@ -1784,6 +1791,13 @@ export declare function askCarryRowMembers(carry: AskCarry | undefined): {
     askClass?: import("./ask-origin.js").AskClass;
     classes?: readonly import("./ask-origin.js").AskClass[];
 };
+/**
+ * The PreToolUse screening seat ({@link PreToolUseScreening}) for ONE call — seat runner, seat bound, per-screening
+ * context and the fail-closed / deny sentences, built in ONE place for every site that screens a call: the gate's
+ * phase 1 and approved-edit re-screen (through {@link runToolGate}'s pass) and the resumed leg's re-screen of an
+ * approved call. Undefined when no face is wired. `hookSeatMs` is the caller's validated bound.
+ */
+export declare function createPreToolUseScreening(preToolUse: Hooks["preToolUse"] | undefined, input: Pick<ToolGateInput, "event" | "trackedCwd" | "hookEnv" | "identity" | "onHookError" | "abortSignal">, hookSeatMs: number, notifier: SafeNotifier): PreToolUseScreening | undefined;
 /**
  * The design/37 **two-phase tool gate** — the single chokepoint that makes the load-bearing invariant
  * structural ("a hook's `allow` cannot bypass the policy's `deny`/`ask`"):

package/dist/core/hooks.js

@@ -247,11 +247,11 @@ export function askCarryRowMembers(carry) {
         ...(classed !== undefined ? classed : {}),
     };
 }
-export async function runToolGate(input) {
-    const { event, preToolUse, adjudicate, resolveAsk, suspendAsk } = input;
-    const { toolCallId, toolName } = event;
-    const callSignal = input.callSignal;
-    const screenedName = wireOf("gate.preToolUse", event);
+export function createPreToolUseScreening(preToolUse, input, hookSeatMs, notifier) {
+    if (preToolUse === undefined)
+        return undefined;
+    const { toolCallId, toolName } = input.event;
+    const screenedName = wireOf("gate.preToolUse", input.event);
     const hookCtx = (seatSignal) => ({
         toolCallId,
         toolName: screenedName,
@@ -263,38 +263,38 @@ export async function runToolGate(input) {
         ...(input.hookEnv !== undefined ? { env: input.hookEnv } : {}),
         ...(input.identity !== undefined ? { identity: input.identity } : {}),
     });
+    const bound = { timeoutMs: hookSeatMs, ...(input.abortSignal !== undefined ? { signal: input.abortSignal } : {}), abortEnds: true };
+    return {
+        screen: (args) => runHookSeat("preToolUse", bound, (sig) => preToolUse(screenedName, args, hookCtx(sig))),
+        screened: screenPreToolUseResult,
+        crashReason: preToolUseCrashReason,
+        unansweredReason: async (subject, cause) => {
+            if (cause === "timeout")
+                traceHookCrash(input, hookSeatExpiredError("preToolUse", hookSeatMs, cause, `${subject} was NOT executed (fail-closed) and the screening face was signalled to stop`), notifier);
+            return preToolUseUnansweredReason(subject, hookSeatMs, cause);
+        },
+        deniedReason: (answer) => decisionText(answer) ?? `tool "${toolName}" blocked by a PreToolUse hook`,
+        refusedReason: (answer) => String(answer.message ?? `the PreToolUse hook's result for "${toolName}" was refused by the engine`),
+    };
+}
+export async function runToolGate(input) {
+    const { event, preToolUse, adjudicate, resolveAsk, suspendAsk } = input;
+    const { toolCallId, toolName } = event;
+    const callSignal = input.callSignal;
     const modelInput = event.input;
     const notifier = createSafeNotifier(input.onNotifyError !== undefined ? { onError: input.onNotifyError } : undefined);
     const hookSeatMs = resolveHookTimeoutMs(input.hookTimeoutMs, (err) => traceHookCrash(input, err, notifier));
-    const seatBound = (abortEnds) => ({
-        timeoutMs: hookSeatMs,
-        ...(input.abortSignal !== undefined ? { signal: input.abortSignal } : {}),
-        ...(abortEnds ? { abortEnds: true } : {}),
-    });
-    const preToolUseUnansweredBlock = async (subject, cause) => {
-        const reason = preToolUseUnansweredReason(subject, hookSeatMs, cause);
-        if (cause === "timeout") {
-            traceHookCrash(input, hookSeatExpiredError("preToolUse", hookSeatMs, cause, `${subject} was NOT executed (fail-closed) and the screening face was signalled to stop`), notifier);
-        }
-        return reason;
-    };
+    const observerBound = { timeoutMs: hookSeatMs, ...(input.abortSignal !== undefined ? { signal: input.abortSignal } : {}) };
     const notifyPermissionDeniedSeat = async (payload) => {
         if (input.permissionDenied === undefined)
             return;
         await notifier.notifyAsync(async () => {
-            const seat = await runHookSeat("permissionDenied", seatBound(false), (sig) => input.permissionDenied?.({ ...payload, signal: sig }));
+            const seat = await runHookSeat("permissionDenied", observerBound, (sig) => input.permissionDenied?.({ ...payload, signal: sig }));
             if (seat.expired)
                 throw hookSeatExpiredError("permissionDenied", hookSeatMs, seat.cause, "the deny observation was abandoned; the deny itself is unchanged");
         }, "toolGate.permissionDenied");
     };
-    const screening = preToolUse !== undefined
-        ? {
-            screen: (args) => runHookSeat("preToolUse", seatBound(true), (sig) => preToolUse(screenedName, args, hookCtx(sig))),
-            screened: screenPreToolUseResult,
-            crashReason: preToolUseCrashReason,
-            unansweredReason: preToolUseUnansweredBlock,
-        }
-        : undefined;
+    const screening = createPreToolUseScreening(preToolUse, input, hookSeatMs, notifier);
     const pass = {
         input,
         event,
@@ -341,13 +341,13 @@ export async function runToolGate(input) {
         }
         if (r) {
             if (isEngineRefusal(r)) {
-                return await engineFailClosedExit(pass, String(r.message ?? `the PreToolUse hook's result for "${toolName}" was refused by the engine`));
+                return await engineFailClosedExit(pass, screening.refusedReason(r));
             }
             if (r.additionalContext) {
                 pass.preToolContext.push(r.additionalContext);
             }
             if (r.action === "deny") {
-                return hookDenyExit(pass, r);
+                return hookDenyExit(pass, screening.deniedReason(r));
             }
             if (r.updatedInput !== undefined) {
                 pass.currentInput = r.updatedInput;

package/dist/core/mcp-tool-meta.d.ts

@@ -0,0 +1,24 @@
+/**
+ * The per-tool `_meta` declarations a server makes in its tools/list entry that the engine reads at intake: a result-size
+ * threshold (`anthropic/maxResultSizeChars`) and the requirement that a call be put to a person
+ * (`anthropic/requiresUserInteraction`). Pure readers over the entry's `_meta` — the intake (`mcp.ts`) stamps what they answer
+ * on the mounted tool.
+ */
+/**
+ * F4-② (CC :320015/:320061): resolve a server's self-declared per-tool result-size threshold from its
+ * `_meta`. Non-numeric/non-finite/non-positive → undefined (declaration ignored); valid → capped at
+ * {@link MCP_META_RESULT_SIZE_CAP}. Exported for tests.
+ */
+export declare function resolveMcpDeclaredResultSize(meta: Record<string, unknown> | undefined): number | undefined;
+/**
+ * A server's own per-tool declaration that a call must be put to a person, read from its `_meta` by the reference
+ * implementation's rule: the boolean `true` declares it, nothing else does. `declared` is the seat fact the intake stamps on
+ * the mounted tool. A PRESENT value that is not a boolean (the string "true", the number 1, an object, null) is a declaration
+ * the server wrote and this reader cannot honour: `advisory` is the sentence for the operator warning lane saying so (the tool
+ * stays mounted and reads as undeclared), instead of letting a typo quietly read as "no interaction required". `false` and
+ * absence are well-formed and say nothing. Exported for tests.
+ */
+export declare function resolveMcpRequiresUserInteraction(meta: unknown): {
+    declared: boolean;
+    advisory?: string;
+};

package/dist/core/mcp-tool-meta.js

@@ -0,0 +1,17 @@
+const MCP_META_RESULT_SIZE_CAP = 500_000;
+export function resolveMcpDeclaredResultSize(meta) {
+    const declared = meta?.["anthropic/maxResultSizeChars"];
+    if (typeof declared !== "number" || !Number.isFinite(declared) || declared <= 0)
+        return undefined;
+    return Math.min(declared, MCP_META_RESULT_SIZE_CAP);
+}
+const MCP_REQUIRES_USER_INTERACTION_META_KEY = "anthropic/requiresUserInteraction";
+export function resolveMcpRequiresUserInteraction(meta) {
+    const value = meta?.[MCP_REQUIRES_USER_INTERACTION_META_KEY];
+    if (value === true)
+        return { declared: true };
+    if (value === undefined || value === false)
+        return { declared: false };
+    const kind = value === null ? "null" : Array.isArray(value) ? "an array" : typeof value === "object" ? "an object" : `a ${typeof value}`;
+    return { declared: false, advisory: `its _meta["${MCP_REQUIRES_USER_INTERACTION_META_KEY}"] is ${kind}, not the boolean true — the declaration is ignored, so this tool is judged like a server tool that did not declare it` };
+}

package/dist/core/mcp.d.ts

@@ -5,6 +5,7 @@ import type { ImageContent, TextContent } from "../internal/llm.js";
 import { type McpImageResizer } from "./image-downsample.js";
 import type { McpServerSpec, OnElicit, ToolEffect } from "./types.js";
 import { type ReminderDisclosureCounts } from "./reminder-disclosure.js";
+export { resolveMcpDeclaredResultSize } from "./mcp-tool-meta.js";
 /**
  * The safety axes (design/77 §4 irreversibility, design/70 egress) derived from one materialized MCP
  * tool's server-advertised `annotations`. These ride alongside the {@link AgentTool} (which is vendored
@@ -376,12 +377,6 @@ export interface McpServerStatus {
  * silently re-narrowed by a cast.
  */
 export declare const MCP_PREFIX: "mcp__";
-/**
- * F4-② (CC :320015/:320061): resolve a server's self-declared per-tool result-size threshold from its
- * `_meta`. Non-numeric/non-finite/non-positive → undefined (declaration ignored); valid → capped at
- * {@link MCP_META_RESULT_SIZE_CAP}. Exported for tests.
- */
-export declare function resolveMcpDeclaredResultSize(meta: Record<string, unknown> | undefined): number | undefined;
 /**
  * Apply the token gate to a mapped MCP content array (CC `$Mp`/`BMp` shape): text blocks consume a
  * cumulative char budget of `tokens×4`; past the budget they are sliced/dropped head-keep, and the CC

package/dist/core/mcp.js

@@ -17,6 +17,8 @@ import { sliceHeadSafe, sliceTailSafe } from "./surrogate-safe-slice.js";
 import { truncateError } from "./tool-errors.js";
 import { delimitUntrusted, inlineUntrusted, sanitizeUntrustedText } from "./untrusted-text.js";
 import { discloseReminderShaped, observeReminderMarkEcho } from "./reminder-disclosure.js";
+import { resolveMcpDeclaredResultSize, resolveMcpRequiresUserInteraction } from "./mcp-tool-meta.js";
+export { resolveMcpDeclaredResultSize } from "./mcp-tool-meta.js";
 import { withContentOrigin } from "./memory-engine/content-origin.js";
 import { snapshotMcpEntries } from "./locked-config.js";
 import { validateJsonSchemaShape } from "./runner/strict-output-schema.js";
@@ -25,13 +27,6 @@ import { readMember, thrownIs, thrownName, thrownText } from "./thrown-value.js"
 export const MCP_PREFIX = MCP_NAMESPACE.prefix;
 const MCP_OUTPUT_TOKENS_DEFAULT = 25_000;
 const MCP_CHARS_PER_TOKEN = 4;
-const MCP_META_RESULT_SIZE_CAP = 500_000;
-export function resolveMcpDeclaredResultSize(meta) {
-    const declared = meta?.["anthropic/maxResultSizeChars"];
-    if (typeof declared !== "number" || !Number.isFinite(declared) || declared <= 0)
-        return undefined;
-    return Math.min(declared, MCP_META_RESULT_SIZE_CAP);
-}
 function mcpMaxOutputTokens() {
     return resolveEnvBudget(process.env.MAX_MCP_OUTPUT_TOKENS, { name: "MAX_MCP_OUTPUT_TOKENS", unit: "tokens", default: MCP_OUTPUT_TOKENS_DEFAULT });
 }
@@ -1663,6 +1658,9 @@ function intakeListedTools(listed, spec, client, health, imageResizer, reminderD
         const writeEffect = (axis?.effect ?? "write") === "write";
         const mcpToolMeta = t._meta;
         const mcpMaxResultSizeChars = resolveMcpDeclaredResultSize(mcpToolMeta);
+        const interaction = resolveMcpRequiresUserInteraction(mcpToolMeta);
+        if (interaction.advisory !== undefined)
+            advisories.push({ tool: inlineUntrusted(t.name), reason: interaction.advisory });
         const mcpAlwaysLoad = mcpToolMeta?.["anthropic/alwaysLoad"] === true;
         const mounted = {
             name: namespacedName,
@@ -1671,6 +1669,7 @@ function intakeListedTools(listed, spec, client, health, imageResizer, reminderD
             parameters: (effectiveInputSchema ?? { type: "object" }),
             ...(mcpMaxResultSizeChars !== undefined ? { mcpMaxResultSizeChars } : {}),
             ...(mcpAlwaysLoad ? { mcpAlwaysLoad: true } : {}),
+            ...(interaction.declared ? { mcpRequiresUserInteraction: true } : {}),
             mcpRemoteName: remoteName, ...(t.annotations?.readOnlyHint === true ? { mcpReadOnlyHint: true } : {}), permissionSeat: "passthrough",
             execute: async (_toolCallId, params, signal) => {
                 const what = `The call to tool ${inlineUntrusted(remoteName)}`;

package/dist/core/mode-policy.d.ts

@@ -83,10 +83,35 @@ export declare function mountedToolDeclaresReadOnly(tools: readonly AgentTool[],
 export declare function asksUnstated(d: PermissionResult, seat: "passthrough" | undefined, mode: PermissionMode | undefined, hookStated: boolean): boolean;
 /** The unstated question's sentence (the reference implementation's passthrough sentence, without its product name). */
 export declare const unstatedAskMessage: (toolName: string) => string;
+/** One call's permission seat: `passthrough` (an allow nobody stated meets the mode's unstated answer) and the question
+ *  put when it does — absent ⇒ {@link unstatedAskMessage}. */
+export interface PermissionSeatReading {
+    readonly seat: "passthrough";
+    readonly question?: string;
+}
+/** The gate's permission-seat inputs (a member group of `ToolGateInput`), read through {@link permissionSeatAt}. */
+export interface PermissionSeatInputs {
+    /** The called tool's permission seat ({@link import("./tool-spec.js").ToolSpec.permissionSeat}): `"passthrough"` ⇒ an allow no layer stated
+     *  meets the mode's answer for an unstated call ({@link ModePolicy.unstated}). Absent ⇒ the tool answers for itself. */
+    permissionSeat?: "passthrough";
+    /** The seat read off THIS call's arguments, for a tool whose seat depends on them (the Runner wires it for the `Skill`
+     *  tool: a skill that declares a list asks `Execute skill: <name>`). Present ⇒ it is the reading. */
+    permissionSeatOf?: (args: unknown) => PermissionSeatReading | undefined;
+}
+/**
+ * The ONE reading of a call's permission seat, taken on the arguments the gate is judging (the policy's rewrite and the
+ * hook's included): the per-call reader where the tool's seat depends on its arguments, else the mounted tool's static
+ * seat. Read at the fold's last station and at the approved-edit round, on that round's edited bytes.
+ */
+export declare function permissionSeatAt(input: PermissionSeatInputs, args: unknown): PermissionSeatReading | undefined;
 /** The PERMISSION SEAT of the LAST mounted instance of this name (the one a call dispatches to) — `passthrough` when the
  *  instance states no permission of its own ({@link AgentTool.permissionSeat}), else `undefined` (the engine's stations and
  *  the deployment's declarations answer for it). Read per call off the leg's live mount array, so a refresh is seen. */
 export declare function mountedToolPermissionSeat(tools: readonly AgentTool[], toolName: string): "passthrough" | undefined;
+/** Does the LAST mounted instance of this name (the one a call dispatches to) carry its server's declaration that a call must be put to a
+ *  person ({@link AgentTool.mcpRequiresUserInteraction})? Read per call off the leg's live mount array, so a refresh is seen. The gate's
+ *  seat for the `requires_user_interaction` class. */
+export declare function mountedToolRequiresUserInteraction(tools: readonly AgentTool[], toolName: string): boolean;
 /**
  * Is this call a WRITE the `plan` mode asks about? Two faces, one question — does the call write by its declaration:
  *  · a covered path write (the catalog's protective floor: a file-write tool, or a same-name tool wearing its slot), and

package/dist/core/mode-policy.js

@@ -46,9 +46,17 @@ export function asksUnstated(d, seat, mode, hookStated) {
     return d.action === "allow" && d.decisionReason === undefined && !hookStated && seat === "passthrough" && mode !== undefined && modePolicyOf(mode).unstated === "ask";
 }
 export const unstatedAskMessage = (toolName) => `The agent requested permission to use ${toolName}, but it has not been granted yet.`;
+export function permissionSeatAt(input, args) {
+    if (input.permissionSeatOf !== undefined)
+        return input.permissionSeatOf(args);
+    return input.permissionSeat === "passthrough" ? { seat: "passthrough" } : undefined;
+}
 export function mountedToolPermissionSeat(tools, toolName) {
     return tools.findLast((t) => t.name === toolName)?.permissionSeat === "passthrough" ? "passthrough" : undefined;
 }
+export function mountedToolRequiresUserInteraction(tools, toolName) {
+    return tools.findLast((t) => t.name === toolName)?.mcpRequiresUserInteraction === true;
+}
 const ENGINE_ROSTER_SOURCES = new Set(["builtin", "synthetic"]);
 export function planRefusesWrite(req, roster, readOnlyDeclared) {
     if (isProtectedWrite(req))

package/dist/core/protocol-table.d.ts

@@ -80,6 +80,9 @@ export declare const PROTOCOL_TABLE: readonly ProtocolNamespace[];
  *  table rather than written out: a message that hard-codes ONE protocol becomes wrong — while staying
  *  green — the moment a second one is appended, and both messages tell a deployment what to write. */
 export declare const NAMESPACED_NAME_SHAPES: string;
+/** Whether `name` carries the namespace separator — reserved for protocol tool names: a deployment tool's name or alias
+ *  carrying it is refused, and a rule name carrying it with no protocol prefix names no tool. The one spelling of the test. */
+export declare function carriesNamespaceSeparator(name: string): boolean;
 /** The namespace owning `name`, or `undefined` for a caller/first-party tool. */
 export declare function protocolOf(name: string): ProtocolNamespace | undefined;
 export {};

package/dist/core/protocol-table.js

@@ -38,6 +38,9 @@ export const MCP_NAMESPACE = makeProtocolNamespace("mcp", MCP_PREFIX_NAME);
 export const A2A_NAMESPACE = makeProtocolNamespace("a2a", A2A_PREFIX_NAME);
 export const PROTOCOL_TABLE = [MCP_NAMESPACE, A2A_NAMESPACE];
 export const NAMESPACED_NAME_SHAPES = PROTOCOL_TABLE.map((ns) => `${ns.prefix}<peer>__<tool>`).join(", ");
+export function carriesNamespaceSeparator(name) {
+    return name.includes(NAME_SEP);
+}
 export function protocolOf(name) {
     return PROTOCOL_TABLE.find((ns) => name.startsWith(ns.prefix));
 }

package/dist/core/reminder-mint.d.ts

@@ -19,7 +19,8 @@
  *   - **declare** ({@link reminderMarkDeclaration}) — the system-prompt declaration copy that gives
  *     the mark its meaning to the model.
  * plus the tag renderers ({@link openSystemReminder} / {@link mintSystemReminder}) mint sites call
- * so no call site inlines the marking syntax.
+ * so no call site inlines the marking syntax, and the block readers ({@link markedReminderBodiesOf} /
+ * {@link stripMarkedReminderBlocks}) for the same reason on the reading side.
  *
  * SCHEME EVOLUTION CONTRACT (ruled 2026-08-19): the marking scheme is REPLACEABLE. The current
  * scheme is an open-tag attribute (`mark="<22-char base64url>"`), but nothing outside this module
@@ -116,3 +117,22 @@ export declare function engineRegionTextsOf(messages: readonly EngineRegionMessa
  * that must judge what the engine actually SAID reads block bodies and decides per block.
  */
 export declare function markedReminderBodiesOf(text: string, mark: string): string[];
+/**
+ * STRIP port — the reading half of {@link openSystemReminder}: `text` without the blocks the engine marked.
+ *
+ * A marked block is an open tag whose mark attribute carries a mark of the current scheme, through the next close
+ * tag; the attribute's spacing and quote style are not part of that judgment (the engine mints one spelling, a model
+ * that relays a block rewrites it freely, and the mark is what must not travel). Everything in it
+ * goes, and so do the blank lines that stood between it and the text after it, so what followed a block starts
+ * where the block started and the rest of the text keeps its own lines. A marked open with no close (a result cut
+ * mid-block) goes to the end of the text — the open tag is the engine's own mint, and what follows it is the block.
+ *
+ * Only a tag carrying a valid mark is a block here. Reminder-shaped text without the mark, with a value the scheme
+ * does not produce, with whitespace around the `=` or another attribute beside the mark, or spelled in another case is data (the declaration says so) and is
+ * returned untouched; so is a text with no marked open at all — the same string back.
+ *
+ * For a caller that PROJECTS a tool result into a shorter view for a reader who does not hold the result's session
+ * (the parent of a child agent): the block is the engine's note to the context that ran the tool, not part of what
+ * the tool returned, and carries that context's mark.
+ */
+export declare function stripMarkedReminderBlocks(text: string): string;

package/dist/core/reminder-mint.js

@@ -70,3 +70,23 @@ export function markedReminderBodiesOf(text, mark) {
     }
     return out;
 }
+const MARKED_OPEN_TAG = /<system-reminder\s+mark=(["'])([^"'<>]*)\1\s*>/g;
+const CLOSE_TAG = "</system-reminder>";
+const BLANK_LINES = /(?:[ \t]*\r?\n)*/y;
+export function stripMarkedReminderBlocks(text) {
+    let out = "";
+    let from = 0;
+    for (const open of text.matchAll(MARKED_OPEN_TAG)) {
+        const at = open.index;
+        if (at < from || !isValidReminderMark(open[2]))
+            continue;
+        out += text.slice(from, at);
+        const closeAt = text.indexOf(CLOSE_TAG, at + open[0].length);
+        if (closeAt < 0)
+            return out;
+        BLANK_LINES.lastIndex = closeAt + CLOSE_TAG.length;
+        BLANK_LINES.exec(text);
+        from = BLANK_LINES.lastIndex;
+    }
+    return from === 0 ? text : out + text.slice(from);
+}

package/dist/core/retired-keys.d.ts

@@ -5,7 +5,8 @@
  * optional seat reads. Every retired-key door reads through here so no door grows its own idea of "present";
  * each composes its own refusal from the answer. A table row is `{ key: replacement }` — the sentence that says
  * what replaced the seat, quoted in the refusal. A dotted key names a member of a member bag (`attachments.x`),
- * read the same way one step at a time; a step that is not an object or a function holds nothing.
+ * read the same way one step at a time; a step that is not an object or a function holds nothing. A step spelled
+ * `name[]` names an array member and reads every element it holds (`skills[].manifest`: any element carrying it).
  */
 /** The first retired key present on `bag`, in table order, or undefined when none is. */
 export declare function retiredKeyOf(bag: object, table: Readonly<Record<string, string>>): {

package/dist/core/retired-keys.js

@@ -1,7 +1,17 @@
+function presentAt(at, steps) {
+    if (steps.length === 0)
+        return at !== undefined;
+    if (at === null || (typeof at !== "object" && typeof at !== "function"))
+        return false;
+    const [step, ...rest] = steps;
+    if (!step.endsWith("[]"))
+        return presentAt(Reflect.get(at, step), rest);
+    const items = Reflect.get(at, step.slice(0, -2));
+    return Array.isArray(items) && items.some((item) => presentAt(item, rest));
+}
 export function retiredKeyOf(bag, table) {
     for (const [key, replacement] of Object.entries(table)) {
-        const value = key.split(".").reduce((at, step) => (at !== null && (typeof at === "object" || typeof at === "function") ? Reflect.get(at, step) : undefined), bag);
-        if (value !== undefined)
+        if (presentAt(bag, key.split(".")))
             return { key, replacement };
     }
     return undefined;
@@ -18,4 +28,5 @@ export const RETIRED_TASK_SPEC_KEYS = Object.freeze({
     autoModeRequested: 'the permission mode is one key now — write `permissionMode: "auto"`',
     approverPosture: 'a posture never authorized anything; drop the key (the engine renders the posture from the effective mode). Releasing asks is a separate decision: `permissionMode: "bypassPermissions"`',
     "attachments.planModeReminder": "the read-only planning posture is stated whenever the leg's mode is `plan` (first turn, every 5 turns, and an exit frame when it ends) — drop the key",
+    "skills[].manifest": "a skill's tools are its `allowedTools` / `disallowedTools` now — an allow-rule and a deny-rule source for the run the skill is activated in, never a fence; move `manifest.allowTools` to `allowedTools`. To fence tools write deny rules (or a delegated agent definition's `allowTools`); to fence write paths use session `allowDirs`",
 });

package/dist/core/rule-denial-sentence.d.ts

@@ -33,8 +33,8 @@ declare const RULE_SOURCE_PHRASE: {
         readonly named: "permission rule";
     };
     /**
-     * The deny-narrowing fold as a WHOLE — session rules, inherited ancestor rules, the frozen constraint
-     * projections and the active skill scope. Used where the refusing layer's own sentence is carried as the
+     * The deny-narrowing fold as a WHOLE — session rules, inherited ancestor rules and the frozen constraint
+     * projections. Used where the refusing layer's own sentence is carried as the
      * detail and the wrapper must not claim to know which of them spoke.
      */
     readonly narrowing: {