@sema-agent/core 7.40.1 → 7.41.0

package/dist/core/runner/session-rule-policy.d.ts

@@ -2,25 +2,13 @@ import type { ExecutionEnv } from "../../internal/harness-types.js";
 import type { ToolEffect } from "../types.js";
 import { type NamedToolPolicy } from "../tool-policy.js";
 import { type SessionPermissionRules, type SessionPolicyStore, type StoredSessionRules } from "../session-policy-store.js";
-/** Tool names whose write target is the `file_path`/`path` arg ({@link fileArgPath}).
- *
- *  REF-B3 — the ONE definition of that narrower set. Production consumer today:
- *  `createActiveSkillScopePolicy` (runner/active-skill-scope.ts, manifest `allowPaths`). The
- *  `allowDirs`/fs-write faces consume the superset {@link PATH_CONFINABLE_WRITE_TOOLS} instead.
- *
- *  BOUNDARY: this set stays `file_path`-keyed — its members' write target is read by {@link fileArgPath}.
- *  `NotebookEdit` (whose target is `notebook_path`) lives in the superset
- *  {@link PATH_CONFINABLE_WRITE_TOOLS} below, NOT here: `createActiveSkillScopePolicy` reads THIS set and
- *  deliberately keeps fail-closed-denying notebooks under a manifest `allowPaths` fence (widening the
- *  skill face is a separate capability decision). */
-export declare const PATH_WRITE_TOOLS: ReadonlySet<string>;
-/** The FULL path-confinable write-tool set: {@link PATH_WRITE_TOOLS} plus `NotebookEdit`, whose write
- *  target is `notebook_path` and is extracted by the shared tool-aware {@link writeTargetPath} (
- *  notebook_path outranks a decoy `file_path` for that tool).
+/** The FULL path-confinable write-tool set: every catalog tool declaring a write path target — `Write` / `Edit`
+ *  (target `file_path`) and `NotebookEdit`, whose write target is `notebook_path` and is extracted by the shared
+ *  tool-aware {@link writeTargetPath} (notebook_path outranks a decoy `file_path` for that tool).
  *
  *  REF-B3 — the ONE spelling of "tools this codebase can confine by path". Consumers:
  *  {@link createSessionRulePolicy} (below, `allowDirs`) and `createFsWriteGatePolicy`
- *  (core/fs-write-gate-policy.ts), which used to rebuild `[...PATH_WRITE_TOOLS, "NotebookEdit"]` inline.
+ *  (core/fs-write-gate-policy.ts), which used to rebuild `["Write", "Edit", "NotebookEdit"]` inline.
  *  A fourth spelling survives as a LITERAL in core/tool-policy.ts (the transcript-dir gate) because THIS
  *  module imports tool-policy.ts — that one is a documented coordinate held in sync by a source-scan pin
  *  (SW-10), not a silent copy.
@@ -38,10 +26,10 @@ export declare const PATH_CONFINABLE_WRITE_TOOLS: ReadonlySet<string>;
  *  remote and of the OTHER family than the host).
  *
  *  REF-B3 — exported as the single source for the policy modules that fence WRITES by an allowlist of
- *  directories: active-skill-scope.ts (manifest `allowPaths`) and fs-write-gate-policy.ts (`acceptDirs`
+ *  directories: fs-write-gate-policy.ts (`acceptDirs`
  *  /`exemptDirs`), plus the K-PLATFORM sweep tests. The line here used to read "exported ONLY for the
  *  K-PLATFORM sweep tests", which was already false when written (fs-write-gate-policy.ts imports it in
- *  production), and active-skill-scope.ts carried a byte-identical private twin — comment included — so
+ *  production), and a since-retired skill fence carried a byte-identical private twin — comment included — so
  *  a platform-family fix had to be remembered at two coordinates.
  *
  *  The sibling implementation is `within()` in tools/fs/safety.ts (the fs-tool root fence). Those stay
@@ -125,7 +113,7 @@ export declare function createLiveSessionRules(store: SessionPolicyStore, floor:
  *    listed and the un-parseable (a parseable command absent from the deny list stays allowed).
  *  - `allowDirs` (if set) → a WRITE tool must land inside one of the dirs (resolved via `canonicalizeTarget`,
  *    so a symlink can't carry across a write out); a write-capable tool that cannot be path-confined (e.g. `bash`)
- *    is DENIED while `allowDirs` is set (fail-closed, mirrors active-skill-scope MAJOR-2).
+ *    is DENIED while `allowDirs` is set (fail-closed).
  * Returns `allow` when nothing constrains the call. `env`/`rootPath` are the task's real exec env + root, so
  * matching sees the actual filesystem (a remote/E2B task resolves in its container). A relative
  * TARGET prefers the call's live tracked cwd ({@link ToolCallRequest.cwd}) when the engine stamps one;

package/dist/core/runner/session-rule-policy.js

@@ -5,9 +5,8 @@ import { thrownText } from "../thrown-value.js";
 import { heldBy, wireOf } from "../tool-name-readings.js";
 import { ruleDenialSentence } from "../rule-denial-sentence.js";
 import { DEFAULT_GATE_AWAIT_TIMEOUT_MS, gateWaitFailureOf, withGateTimeout } from "../gate-bounded-await.js";
-import { declaredPathTargetOf, isProtectedWrite, pathConfinableWriteToolNames, skillScopeWriteToolNames } from "../tool-registry.js";
+import { declaredPathTargetOf, isProtectedWrite, pathConfinableWriteToolNames } from "../tool-registry.js";
 import { pathTargetBaseOf } from "../effective-path-target.js";
-export const PATH_WRITE_TOOLS = skillScopeWriteToolNames();
 export const PATH_CONFINABLE_WRITE_TOOLS = pathConfinableWriteToolNames();
 export function isWithin(root, p) {
     if (!root)

package/dist/core/runner/skill-base-dir.d.ts

@@ -48,6 +48,16 @@ export declare function substituteSkillRoot(text: string, baseDir: string): stri
  *  receive rather than what the caller typed. Equal to `text.length` when no directory is stated, and the one place the seat's value is SCREENED
  *  ({@link skillBaseDirOf}) — the gate that budgets on this number is the first reader of every skill on every leg. */
 export declare function substitutedSkillLength(text: string, baseDir: unknown): number;
+/** The load gate's ONE reading: does a leg LOAD this skill — is the body it would deliver ({@link substitutedSkillLength}) within
+ *  `limit`? Prepare's gate keeps the skills that load (announcing the rest), and a parked Skill approval's binding reads a
+ *  skill that does not load as absent — so the binding and the activation judge one view. */
+export declare function skillLoadReading(skill: {
+    readonly content: string;
+    readonly baseDir?: unknown;
+}, limit: number): {
+    readonly loads: boolean;
+    readonly delivered: number;
+};
 export declare function substituteSkillRootBounded(text: string, baseDir: string, maxChars: number): {
     text: string;
     totalChars: number;

package/dist/core/runner/skill-base-dir.js

@@ -19,6 +19,10 @@ export function substitutedSkillLength(text, baseDir) {
         return text.length;
     return substituteSkillRootBounded(text, dir, 0).totalChars;
 }
+export function skillLoadReading(skill, limit) {
+    const delivered = substitutedSkillLength(skill.content, skill.baseDir);
+    return { loads: delivered <= limit, delivered };
+}
 export function substituteSkillRootBounded(text, baseDir, maxChars) {
     const parts = [];
     let totalChars = 0;

package/dist/core/runner/synthetic-tools.d.ts

@@ -1,9 +1,8 @@
 import { type TSchema } from "typebox";
 import type { AgentTool } from "../../internal/harness-types.js";
-import type { SkillManifest } from "../types.js";
 import type { TerminalBlockedDetail } from "../terminal-cause.js";
 import { type ResolvedSkillListingBudget } from "../skill-listing-budget.js";
-import type { ActiveSkillScope } from "./active-skill-scope.js";
+import { type SkillGrantTable } from "../skill-grant.js";
 /** Reserved name of the injected structured-output tool (CC 2.1.187 `StructuredOutput`; batch-A rename — old
  *  "submit_output" is canonicalized for pre-rename durable state). */
 export declare const OUTPUT_TOOL_NAME = "StructuredOutput";
@@ -71,8 +70,9 @@ interface SkillLike {
     name: string;
     description: string;
     content: string;
-    /** Optional Gate-3 runtime capability manifest — carried through so a successful `skill` load can push its scope frame; skills without one stay unscoped. */
-    manifest?: SkillManifest;
+    /** The skill's two lists (`SkillSpec.allowedTools` / `disallowedTools`) — carried so a successful activation writes its rows into the run's grant table. */
+    allowedTools?: string[];
+    disallowedTools?: string[];
     /** Optional attachments (SkillSpec.files): paths in the block, delivered inline on invoke under {@link SKILL_ATTACHMENTS_MAX_CHARS}. Same caller-trusted
      *  contract as `content` — core never writes them to disk (deployment's half). */
     files?: Array<{
@@ -110,7 +110,7 @@ export interface SkillListingEntry {
  *  and the tool, so what the prompt promises is exactly what the tool serves. Each field is READ ONCE, BY NAME, and
  *  both consumers see the copy: the gate screens this list while the invoke substitutes from it, so a `get baseDir()`
  *  answering those two reads differently passed a screen that measured a value the model never received — and a rest
- *  copy would silently drop an INHERITED or non-enumerable `manifest`, i.e. widen a skill's capability restriction. */
+ *  copy would silently drop an INHERITED or non-enumerable list, i.e. lose a skill's grant or its refusals. */
 export declare function normalizeSkills(skills: SkillLike[] | undefined): SkillLike[];
 /** [c209-C] The skills listing's lead line — single-sourced so the run loop's durable-resume
  *  transcript probe (MED-3② skills arm, runtask) matches EXACTLY what the initial frame carries
@@ -167,17 +167,11 @@ export declare function renderSkillLinesWithin(skills: ReadonlyArray<SkillListin
 /**
  * The injected `skill` tool: returns a skill's full body as a tool result.
  *
- * When a {@link ActiveSkillScope} is supplied (Gate-3) and the loaded skill carries a
- * `manifest`, a successful load PUSHES a scope frame onto the per-task LIFO stack, so the rest of the
- * invocation is deny-narrowed to the manifest's tools/paths. Nested loads (a skill whose body loads
- * another skill) STACK and compose MONOTONICALLY as the INTERSECTION of every active frame's
- * `allowTools` — a child can only narrow further, never re-grant. Frames are popped at task end (and
- * the test/lifecycle may pop explicitly via `scope.pop()` to model a skill frame closing). Skills with
- * NO manifest push nothing (unscoped, backward-compatible).
- *
- * v1 lifetime is heuristic (a residual): the model controls its own turns, so push-on-load
- * is the trigger and the worst case (a frame never popped) is simply continued narrowing — never a
- * widening, so it stays safe-by-construction.
+ * A SUCCESSFUL activation writes the skill's two lists into the run's grant table (`grants`, origin `model`): its
+ * `allowed-tools` then run without asking and its `disallowed-tools` are refused for the rest of the run; an unknown skill
+ * throws first and writes nothing. Activating a skill that declares a list was itself a question (the gate reads this
+ * tool's seat off the call's arguments — `Execute skill: <name>`), so a write here always follows a statement. The tool
+ * runs ALONE in its batch: a call after it in the same message is judged after the rows exist.
  */
-export declare function createSkillTool(skills: SkillLike[], scope?: ActiveSkillScope): AgentTool;
+export declare function createSkillTool(skills: SkillLike[], grants?: SkillGrantTable): AgentTool;
 export {};

package/dist/core/runner/synthetic-tools.js

@@ -2,6 +2,7 @@ import { Type } from "typebox";
 import { defineTool } from "../tools.js";
 import { sanitizeUntrustedText, SHELLED_BODY_ENVELOPE_TAGS } from "../untrusted-text.js";
 import { SKILL_LISTING_DEFAULT_BUDGET, SKILL_LISTING_DESC_MAX_CHARS_DEFAULT } from "../skill-listing-budget.js";
+import { skillNamedBy } from "../skill-grant.js";
 import { toolFace } from "../tool-catalog-entries.js";
 import { substituteSkillRoot, substituteSkillRootBounded } from "./skill-base-dir.js";
 import { foldListingWithin } from "./listing-fold.js";
@@ -113,9 +114,9 @@ export function normalizeSkills(skills) {
     for (const s of skills ?? []) {
         if (!seen.has(s.name)) {
             seen.add(s.name);
-            const { name, description, content, manifest, files, baseDir, ...rest } = s;
+            const { name, description, content, allowedTools, disallowedTools, files, baseDir, ...rest } = s;
             void rest;
-            out.push({ name, description, content, ...(manifest !== undefined ? { manifest } : {}), ...(files !== undefined ? { files } : {}), ...(baseDir !== undefined ? { baseDir } : {}) });
+            out.push({ name, description, content, ...(allowedTools !== undefined ? { allowedTools: [...allowedTools] } : {}), ...(disallowedTools !== undefined ? { disallowedTools: [...disallowedTools] } : {}), ...(files !== undefined ? { files } : {}), ...(baseDir !== undefined ? { baseDir } : {}) });
         }
     }
     return out.toSorted((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
@@ -158,12 +159,12 @@ export function renderSkillLinesWithin(skills, opts) {
         frame: opts.frame,
     });
 }
-export function createSkillTool(skills, scope) {
-    const byName = new Map(skills.map((s) => [s.name, s]));
+export function createSkillTool(skills, grants) {
     const names = skills.map((s) => s.name).join(", ");
     return defineTool({
         name: SKILL_TOOL_NAME,
         ...toolFace("skill"),
+        executionMode: "sequential",
         description: `Invoke a skill.\n\n` +
             `A skill is a packaged set of instructions the user or project has set up for a particular kind of task (deploy steps, a review checklist, a repo-specific workflow). ` +
             `Available skills appear in a system-reminder listing with one-line descriptions. ` +
@@ -181,15 +182,13 @@ export function createSkillTool(skills, scope) {
         execute: (rawArgs) => {
             const a = (rawArgs ?? {});
             const name = String(a.skill ?? "");
-            const skill = byName.get(name);
+            const skill = skillNamedBy(a, skills);
             if (!skill) {
                 throw new Error(`Unknown skill "${name}". Available skills: ${names}. ` +
                     `(Only skills registered with this deployment are loadable — other products' skills directories are not read. ` +
                     `If the user wants one of those here, read its source file and recreate its content for this deployment instead.)`);
             }
-            if (scope && skill.manifest) {
-                scope.push({ kind: "manifest", manifest: skill.manifest });
-            }
+            grants?.activate(skill, "model");
             const baseDir = skill.baseDir;
             let body = baseDir !== undefined ? substituteSkillRoot(skill.content, baseDir) : skill.content;
             if (skill.files !== undefined && skill.files.length > 0) {

package/dist/core/safety-axis-vocab.d.ts

@@ -31,7 +31,7 @@ export declare const SAFETY_AXIS_VOCABULARY: {
     readonly permissionDecision: readonly ["allow", "ask", "deny"];
 };
 /** The mark tighten's sentence — the ONE spelling of each safety-mark frame (an egress-marked tool = an external write; an
- *  always-irreversible tool), read by the gate's two tighten arms (`gate-fold.ts`) and by the inherited lane's card for a
+ *  always-irreversible tool; a tool whose server declared that a call must be put to a person), read by the gate's two tighten arms (`gate-fold.ts`) and by the inherited lane's card for a
  *  marked tool (`judgeInheritedClassifier`): a person who answers a card for a marked call is told what the mark means,
  *  whichever lane minted the card. */
-export declare function markTightenMessage(toolName: string, mark: "egress" | "irreversible"): string;
+export declare function markTightenMessage(toolName: string, mark: "egress" | "irreversible" | "interaction"): string;

package/dist/core/safety-axis-vocab.js

@@ -10,6 +10,8 @@ export const SAFETY_AXIS_VOCABULARY = {
 const _toolEffectExhaustive = true;
 void _toolEffectExhaustive;
 export function markTightenMessage(toolName, mark) {
+    if (mark === "interaction")
+        return `tool "${toolName}" asks for a person's confirmation (server-declared) — explicit approval required`;
     return mark === "egress"
         ? `tool "${toolName}" performs an external write (egress) — explicit approval required`
         : `tool "${toolName}" performs an irreversible action — explicit approval required`;

package/dist/core/session-policy-store.d.ts

@@ -19,18 +19,19 @@
  * - **NOT A SANDBOX**: command rules inherit the coarse argv[0] matching (wrappers like `sh -c`/`sudo` circumvention);
  *   the real isolation boundary is the executionEnv, never these rules.
  */
+import { type RuleToolNameVerdict } from "./tool-name-aliases.js";
 /** The structured per-session rules. All optional; an absent field imposes no constraint of that kind. */
 export interface SessionPermissionRules {
     /** If set, ONLY these tool names are allowed (others denied). A narrowing allowlist. */
     toolAllow?: string[];
     /** Tool names always denied (deny wins). */
     toolDeny?: string[];
-    /** If set, WRITE tools (`write_file`/`edit_file`) may only target paths within these dirs; a write-capable
-     *  tool that can't be path-confined (e.g. `bash`) is denied while this is set. Stored RAW; resolved at run time. */
+    /** If set, WRITE tools (`Write`/`Edit`) may only target paths within these dirs; a write-capable
+     *  tool that can't be path-confined (e.g. `Bash`) is denied while this is set. Stored RAW; resolved at run time. */
     allowDirs?: string[];
-    /** If set, ONLY these `bash` command names (argv[0]) are allowed. */
+    /** If set, ONLY these `Bash` command names (argv[0]) are allowed. */
     commandAllow?: string[];
-    /** `bash` command names (argv[0]) always denied. */
+    /** `Bash` command names (argv[0]) always denied. */
     commandDeny?: string[];
 }
 /** {@link SessionPermissionRules} plus the monotonic `rev` the store stamps (the OCC key). */
@@ -51,13 +52,54 @@ export interface PutRulesOptions {
      *  this from a verified, role-checked principal (mirrors `steer.trusted`). */
     operator?: boolean;
 }
+/** The {@link SessionPolicyError.detail} of a tool-name refusal: which bucket, which entry, the judgment's word, and the
+ *  1:1 successor when the retired name has one. */
+export interface SessionRuleNameRefusal {
+    field: SessionRuleToolNameField;
+    name: string;
+    verdict: Exclude<RuleToolNameVerdict["kind"], "current">;
+    currentName?: string;
+}
 /** Typed error from {@link SessionPolicyStore.putRules}. `conflict` = stale `expectedRev`; `loosen_forbidden`
  *  = a non-operator write tried to relax the rules; `corrupt` = a backend could not read the erase-surviving
- *  rev mark ({@link SessionPolicyStore.deleteBySession}) and refuses rather than stamp an unproven rev. */
+ *  rev mark ({@link SessionPolicyStore.deleteBySession}) and refuses rather than stamp an unproven rev; the fourth
+ *  code = a tool-name bucket names a retired or prefix-less name ({@link assertSessionRuleNamesCurrent}) — `detail` is
+ *  present on that code and only on it. */
 export declare class SessionPolicyError extends Error {
-    readonly code: "conflict" | "loosen_forbidden" | "corrupt";
-    constructor(code: "conflict" | "loosen_forbidden" | "corrupt", message: string);
+    readonly code: "conflict" | "loosen_forbidden" | "corrupt" | "legacy_tool_name";
+    readonly detail?: SessionRuleNameRefusal | undefined;
+    constructor(code: "conflict" | "loosen_forbidden" | "corrupt" | "legacy_tool_name", message: string, detail?: SessionRuleNameRefusal | undefined);
+}
+/** Which buckets hold TOOL names (the ones a run's policy audit reads as names); a new bucket is given a role here. */
+declare const HOLDS_TOOL_NAMES: {
+    readonly toolAllow: true;
+    readonly toolDeny: true;
+    readonly allowDirs: false;
+    readonly commandAllow: false;
+    readonly commandDeny: false;
+};
+type SessionRuleToolNameField = {
+    [K in keyof typeof HOLDS_TOOL_NAMES]: (typeof HOLDS_TOOL_NAMES)[K] extends true ? K : never;
+}[keyof typeof HOLDS_TOOL_NAMES];
+/** Construction options both bundled stores take. */
+export interface SessionPolicyStoreOptions {
+    /** The names this deployment mounts its OWN tools under — the roster the store judges a rule's tool names against
+     *  ({@link judgeRuleToolName}): a retired name declared here is an ordinary name to the write and to the loosening
+     *  check alike. Absent = none. A name carrying `__` is refused, as it is for a deployment tool. */
+    mountedToolNames?: Iterable<string>;
 }
+/** A store's declared roster from {@link SessionPolicyStoreOptions.mountedToolNames} — the one reader both bundled stores
+ *  (and so `FileStorageBackendOptions.sessionPolicy`) construct through, refusing loudly when it is not a list of plain
+ *  tool names (a bare string would iterate by character). */
+export declare function readMountedToolNames(value: unknown): ReadonlySet<string>;
+/**
+ * The write judge for session rules, against `mountedToolNames` (the store's declaration; empty when it has none): every
+ * entry of a tool-name bucket must be `current` ({@link judgeRuleToolName}), or the write is refused (the fourth
+ * {@link SessionPolicyError} code) — such a name matches no tool, and a run's policy audit refuses to start with it.
+ * Operator writes included. Both bundled stores call it after normalizing and before {@link loosenReasons}; a durable
+ * backend calls it at the same point. The message names the entry and the way out, never a storage location.
+ */
+export declare function assertSessionRuleNamesCurrent(rules: SessionPermissionRules, mountedToolNames?: ReadonlySet<string>): void;
 /**
  * The seam a deployment implements for DURABLE, cross-replica per-session rules. Unset on `RunnerDeps` ⇒ the
  * feature is OFF (no rules read, zero behavior change). Keyed on `(sessionId, principal-owner)`: core passes
@@ -72,6 +114,10 @@ export interface SessionRulesRecord {
 }
 export interface SessionPolicyStore {
     getRules(sessionId: string, principal?: string): Promise<StoredSessionRules | null>;
+    /** Write the rules for a key: CAS on `expectedRev`, then the name judge ({@link assertSessionRuleNamesCurrent} —
+     *  operator writes included), then, for a non-operator write over an existing row, the
+     *  tighten-only check ({@link loosenReasons}) — both against the names the deployment declares it mounts its own
+     *  tools under. */
     putRules(sessionId: string, principal: string | undefined, rules: SessionPermissionRules, opts?: PutRulesOptions): Promise<StoredSessionRules>;
     /**
      * 2c session-sync: every (principal, rules) record for `sessionId` across ALL principals — `getRules`
@@ -126,11 +172,14 @@ declare function lexWithin(root: string, p: string): boolean;
 export declare function normalizeRules(rules: SessionPermissionRules): SessionPermissionRules;
 /**
  * Pure tighten-only diff: the reasons `next` LOOSENS `prior` (empty ⇒ `next` is a pure tightening or no-op).
- * Direction per field — deny-lists: removing an entry loosens. allowlists: removing the list (→ everything
- * allowed) or adding an entry outside the prior set loosens; prior-undefined → any defined next only narrows.
- * allowDirs: removing confinement, or adding a dir not within some prior dir, loosens (coarse raw containment).
+ * Direction per field — deny-lists: removing an entry loosens, except a `toolDeny` entry that is not `current` against
+ * `mountedToolNames` ({@link judgeRuleToolName}: it matches no tool, so removing it relaxes nothing — the way a session's owner
+ * takes out a stale entry that stops every run). allowlists: removing the list (→ everything allowed) or adding an
+ * entry outside the prior set loosens; prior-undefined → any defined next only narrows. allowDirs: removing
+ * confinement, or adding a dir not within some prior dir, loosens (coarse raw containment). `mountedToolNames` = the
+ * store's declaration ({@link SessionPolicyStoreOptions.mountedToolNames}; empty when it has none) — the write judge's too.
  */
-export declare function loosenReasons(prior: SessionPermissionRules, next: SessionPermissionRules): string[];
+export declare function loosenReasons(prior: SessionPermissionRules, next: SessionPermissionRules, mountedToolNames?: ReadonlySet<string>): string[];
 /**
  * Does row `a` belong to the SAME lineage as row `b` — the one question every reader asks before it compares
  * two rows' `rev`, asked in ONE place so a `gen` that is ABSENT cannot mean three different things at three
@@ -158,6 +207,9 @@ export declare function stripRev(rules: SessionPermissionRules): SessionPermissi
  */
 export declare class InMemorySessionPolicyStore implements SessionPolicyStore {
     private readonly map;
+    /** {@link SessionPolicyStoreOptions.mountedToolNames}, read once at construction. */
+    private readonly mountedToolNames;
+    constructor(opts?: SessionPolicyStoreOptions);
     /**
      * The per-key mark {@link SessionPolicyStore.deleteBySession} may not erase: the largest `rev` this key has
      * ever been stamped with, kept outside the row so removing the row cannot roll the counter back. Written by

package/dist/core/session-policy-store.js

@@ -1,13 +1,52 @@
 import { posix } from "node:path";
 import { isWinFormPath } from "../tools/fs/safety.js";
+import { NAMESPACED_NAME_SHAPES, carriesNamespaceSeparator } from "./protocol-table.js";
+import { judgeRuleToolName } from "./tool-name-aliases.js";
 export class SessionPolicyError extends Error {
     code;
-    constructor(code, message) {
+    detail;
+    constructor(code, message, detail) {
         super(message);
         this.code = code;
+        this.detail = detail;
         this.name = "SessionPolicyError";
     }
 }
+const HOLDS_TOOL_NAMES = { toolAllow: true, toolDeny: true, allowDirs: false, commandAllow: false, commandDeny: false };
+const TOOL_NAME_FIELDS = Object.keys(HOLDS_TOOL_NAMES).filter((f) => HOLDS_TOOL_NAMES[f]);
+const NO_DECLARED_TOOLS = new Set();
+export function readMountedToolNames(value) {
+    if (value === undefined)
+        return NO_DECLARED_TOOLS;
+    const refuse = (why) => {
+        throw new TypeError(`session rules store option mountedToolNames ${why} — it lists the names this deployment mounts its own tools under`);
+    };
+    if (typeof value === "string" || typeof value?.[Symbol.iterator] !== "function")
+        refuse("must be an iterable of tool names (an array or a Set), not a single value");
+    const names = new Set();
+    for (const n of value) {
+        if (typeof n !== "string" || n.length === 0)
+            refuse(`holds ${JSON.stringify(n) ?? String(n)}, which is not a non-empty tool name`);
+        if (carriesNamespaceSeparator(n))
+            refuse(`holds ${JSON.stringify(n)}: "__" is reserved for protocol tool names and no deployment tool may carry it`);
+        names.add(n);
+    }
+    return names;
+}
+export function assertSessionRuleNamesCurrent(rules, mountedToolNames = NO_DECLARED_TOOLS) {
+    for (const field of TOOL_NAME_FIELDS) {
+        for (const name of rules[field] ?? []) {
+            const verdict = judgeRuleToolName(name, mountedToolNames);
+            if (verdict.kind === "current")
+                continue;
+            const quoted = JSON.stringify(name);
+            const successor = verdict.kind === "retired" ? verdict.currentName : undefined;
+            throw new SessionPolicyError("legacy_tool_name", verdict.kind === "retired"
+                ? `session rules ${field} names ${quoted}, a retired tool name (${verdict.guidance}) — with it in place no run of this session could start, so nothing was written.${successor !== undefined ? ` Use the current name ${JSON.stringify(successor)}.` : ""} If this deployment mounts its own tool under ${quoted}, declare it in the store's mountedToolNames.`
+                : `session rules ${field} names ${quoted}, which carries the "__" namespace separator but no protocol prefix — no tool is named that way (protocol tools are named ${NAMESPACED_NAME_SHAPES}), and with it in place no run of this session could start, so nothing was written.`, { field, name, verdict: verdict.kind, ...(successor !== undefined ? { currentName: successor } : {}) });
+        }
+    }
+}
 function lexWithin(root, p) {
     const fold = (x) => {
         let n = isWinFormPath(x) ? x.replace(/\\/g, "/") : x;
@@ -35,13 +74,15 @@ export function normalizeRules(rules) {
         out.allowDirs = rules.allowDirs.map((d) => posix.normalize(d).replace(/\/+$/, "") || "/");
     return out;
 }
-export function loosenReasons(prior, next) {
+export function loosenReasons(prior, next, mountedToolNames = NO_DECLARED_TOOLS) {
     const reasons = [];
     for (const field of ["toolDeny", "commandDeny"]) {
         const n = new Set(next[field] ?? []);
-        for (const x of prior[field] ?? [])
-            if (!n.has(x))
-                reasons.push(`removed ${field} "${x}"`);
+        for (const x of prior[field] ?? []) {
+            if (n.has(x) || (field === "toolDeny" && judgeRuleToolName(x, mountedToolNames).kind !== "current"))
+                continue;
+            reasons.push(`removed ${field} "${x}"`);
+        }
     }
     for (const field of ["toolAllow", "commandAllow"]) {
         const p = prior[field];
@@ -79,6 +120,10 @@ export function stripRev(rules) {
 }
 export class InMemorySessionPolicyStore {
     map = new Map();
+    mountedToolNames;
+    constructor(opts) {
+        this.mountedToolNames = readMountedToolNames(opts?.mountedToolNames);
+    }
     highWater = new Map();
     key(sessionId, principal) {
         return JSON.stringify([sessionId, principal ?? null]);
@@ -94,8 +139,9 @@ export class InMemorySessionPolicyStore {
             throw new SessionPolicyError("conflict", `session rules rev mismatch (expected ${opts.expectedRev}, have ${prior?.rev ?? 0})`);
         }
         const clean = normalizeRules(stripRev(rules));
+        assertSessionRuleNamesCurrent(clean, this.mountedToolNames);
         if (prior && opts?.operator !== true) {
-            const loosens = loosenReasons(prior, clean);
+            const loosens = loosenReasons(prior, clean, this.mountedToolNames);
             if (loosens.length > 0) {
                 throw new SessionPolicyError("loosen_forbidden", `a non-operator session-rule write may only tighten; refused: ${loosens.join("; ")}`);
             }