@sema-agent/core 7.41.0 → 7.42.0

package/dist/core/allow-entry.js

@@ -0,0 +1,340 @@
+import { heldBy } from "./tool-name-readings.js";
+import { isNamespacedCoveringRuleName, namespacedRuleNameCovers, parsePermissionRule } from "./permission-rules.js";
+import { protocolOf } from "./protocol-table.js";
+import { COARSE_SHELL_TOOLS } from "./tool-policy.js";
+import { ALLOW_RULE_MEMBERS } from "./allow-rule-shadow.js";
+import { COMMAND_RULE_TOOL, READ_RULE_TOOL, findAdmittingRule, laneToolNamesOf, parseRuleText, programRunReachOf, ruleToolGrammarOf } from "./permission-rule-model.js";
+import { pathRuleLaneAnswer } from "./runner/permission-rule-lanes.js";
+import { splitShellCompoundSegments } from "../tools/fs/bash-readonly-classifier.js";
+import { mandateDisclosureOf } from "./ask-origin.js";
+import { inlineUntrusted } from "./untrusted-text.js";
+import { deliverEngineNotice } from "./engine-notice.js";
+export const ALLOW_ENTRY_INERT_REASONS = Object.freeze(["wildcard_all", "namespace_wildcard", "path_pattern", "domain", "content_unsupported", "grammar"]);
+function ruleRowOf(parsed) {
+    return { ...parsed, scope: { kind: "global" }, adds: [{ dot: { actor: "list", counter: 1 }, origin: "user", createdAt: "" }] };
+}
+const TOOL_NAME_SPELLING = /^[^\s()]+$/;
+export function compileAllowEntry(raw, behavior) {
+    if (raw !== raw.trim())
+        return "grammar";
+    const parsed = parsePermissionRule(raw);
+    const name = parsed.toolName;
+    if (!TOOL_NAME_SPELLING.test(name))
+        return "grammar";
+    if (name === "*")
+        return "wildcard_all";
+    if (parsed.ruleContent === undefined) {
+        const ns = protocolOf(name);
+        if (ns !== undefined) {
+            if (name.slice(ns.prefix.length).split("__")[0]?.includes("*") === true)
+                return "namespace_wildcard";
+            if (isNamespacedCoveringRuleName(name))
+                return { kind: "namespace", pattern: name };
+            return { kind: "tool", name };
+        }
+        return COARSE_SHELL_TOOLS.includes(name) ? { kind: "shell", name } : { kind: "tool", name };
+    }
+    if (name === COMMAND_RULE_TOOL) {
+        const allowRead = parseRuleText(raw, behavior);
+        if ("rule" in allowRead)
+            return { kind: "command", rule: ruleRowOf(allowRead.rule) };
+        if (behavior === "allow" && allowRead.reject.code === "invalid.bare_interpreter_prefix") {
+            const wide = parseRuleText(raw, "deny");
+            if ("rule" in wide)
+                return { kind: "command", rule: ruleRowOf({ ...wide.rule, behavior: "allow" }) };
+        }
+        return "grammar";
+    }
+    if (ruleToolGrammarOf(name) === "path") {
+        const read = parseRuleText(raw, behavior);
+        if ("rule" in read) {
+            if (read.rule.match === "subpath" && read.rule.tool === READ_RULE_TOOL && behavior === "allow")
+                return { kind: "read_dir", rule: ruleRowOf(read.rule) };
+            if (behavior === "deny")
+                return { kind: "path", rule: ruleRowOf(read.rule) };
+        }
+        return "path_pattern";
+    }
+    if (/^domain:/.test(parsed.ruleContent))
+        return "domain";
+    return "content_unsupported";
+}
+export function compileAllowList(entries, behavior) {
+    const voided = behavior === "allow" && entries.some((e) => compileAllowEntry(e, behavior) === "wildcard_all");
+    const rows = [];
+    const inert = [];
+    for (const entry of entries) {
+        const compiled = voided ? "wildcard_all" : compileAllowEntry(entry, behavior);
+        if (typeof compiled === "string")
+            inert.push({ entry, reason: compiled });
+        else
+            rows.push({ entry, compiled });
+    }
+    return { rows, inert };
+}
+function answersTo(req, has) {
+    return heldBy("allowEntry.names", { has }, req);
+}
+export const AUTO_STRIPPED_PROGRAMS = Object.freeze([
+    "python", "python3", "python2", "node", "deno", "tsx", "ruby", "perl", "php", "lua", "npx", "bunx", "npm run", "yarn run", "pnpm run", "bun run", "bash", "sh", "ssh",
+    "zsh", "fish", "eval", "exec", "env", "xargs", "sudo",
+]);
+function shellContentStripped(content) {
+    if (content === undefined || content === "" || /^[\s*]+$/.test(content))
+        return true;
+    const n = content.trim().toLowerCase();
+    if (n === "*")
+        return true;
+    for (const program of AUTO_STRIPPED_PROGRAMS) {
+        const g = program.toLowerCase();
+        if (n === g || n === `${g}:*` || n === `${g} *` || n === `${g}*`)
+            return true;
+        if (n.startsWith(`${g} `) && n.endsWith("*")) {
+            const tail = n.slice(g.length + 1);
+            if (tail.startsWith("-") && !(/^python[\d.]*$/.test(g) && /^-m\s+\w+\.[\w.]+(\s*:|\s+)$/.test(tail.slice(0, -1))))
+                return true;
+        }
+    }
+    return false;
+}
+function shellRuleContent(rule) {
+    const split = splitShellCompoundSegments(rule.command, { trailingTerminator: "keep", redirection: "reject" });
+    const body = "reject" in split ? rule.command : (split.segments[split.segments.length - 1] ?? rule.command).trim();
+    return rule.match === "prefix" ? `${body}:*` : rule.match === "wildcard" ? `${body} *` : body;
+}
+export function autoStripped(compiled, call) {
+    switch (compiled.kind) {
+        case "shell":
+            return true;
+        case "tool":
+            return call !== undefined && answersTo(call, (n) => COARSE_SHELL_TOOLS.includes(n));
+        case "command":
+            return shellContentStripped(shellRuleContent(compiled.rule));
+        case "namespace":
+        case "read_dir":
+        case "path":
+            return false;
+        default: {
+            const exhaustive = compiled;
+            return exhaustive;
+        }
+    }
+}
+export function autoStrippedRule(rule, call) {
+    return rule.behavior === "allow" && rule.tool === COMMAND_RULE_TOOL && autoStripped({ kind: "command", rule }, call);
+}
+function nameRowReaches(compiled, req) {
+    const covers = compiled.kind === "namespace" ? (n) => namespacedRuleNameCovers(compiled.pattern, n) : compiled.kind === "tool" || compiled.kind === "shell" ? (n) => n === compiled.name : undefined;
+    return covers !== undefined && answersTo(req, covers);
+}
+function commandOf(req) {
+    const tool = laneToolNamesOf(req).find((n) => ruleToolGrammarOf(n) === "command");
+    const command = req.args?.command;
+    return tool !== undefined && typeof command === "string" ? { tool, command } : undefined;
+}
+export function judgeAllowEntries(rows, req, behavior, ctx) {
+    const live = rows.filter((r) => r.behavior === behavior);
+    if (live.length === 0)
+        return undefined;
+    for (const row of live)
+        if (nameRowReaches(row.compiled, req))
+            return [row];
+    const call = commandOf(req);
+    const liveCwd = ctx.liveCwd();
+    if (call !== undefined) {
+        const byRule = new Map();
+        for (const r of live)
+            if (r.compiled.kind === "command")
+                byRule.set(r.compiled.rule, r);
+        if (behavior === "allow") {
+            const covering = findAdmittingRule([...byRule.keys()], { tool: call.tool, command: call.command, cwd: ctx.root, ...(ctx.sessionId !== undefined ? { sessionId: ctx.sessionId } : {}), ...(liveCwd !== undefined ? { execCwd: liveCwd } : {}) });
+            const hits = (covering ?? []).flatMap((rule) => byRule.get(rule) ?? []);
+            if (hits.length > 0)
+                return hits;
+        }
+        else {
+            for (const [rule, row] of byRule) {
+                if (programRunReachOf(rule, call.command).reach !== "not_reached")
+                    return [row];
+            }
+        }
+    }
+    const pathKind = behavior === "allow" ? "read_dir" : "path";
+    const pathRows = live.filter((r) => r.compiled.kind === pathKind);
+    if (pathRows.length > 0) {
+        const table = pathRows.map((r) => r.compiled.rule);
+        for (const name of laneToolNamesOf(req).filter((n) => ruleToolGrammarOf(n) === "path")) {
+            const answer = pathRuleLaneAnswer(table, { ...req, toolName: name }, { root: ctx.root, sessionId: ctx.sessionId, liveCwd, home: ctx.home });
+            const spoke = answer !== undefined && ("unreadable" in answer ? behavior === "deny" : "behavior" in answer && answer.behavior === behavior);
+            if (spoke) {
+                const rule = answer !== undefined && "rules" in answer ? answer.rules[0]?.rule : undefined;
+                return [pathRows.find((r) => r.compiled.rule.rule === rule) ?? pathRows[0]];
+            }
+        }
+    }
+    return undefined;
+}
+export function allowingRows(rows, req, mode) {
+    return mode === "auto" ? rows.filter((r) => !autoStripped(r.compiled, req)) : rows;
+}
+export class AllowEntryTable {
+    held = [];
+    seed(entries) {
+        const { rows, inert } = compileAllowList(entries, "allow");
+        for (const r of rows)
+            if (!this.held.some((h) => h.entry === r.entry))
+                this.held.push({ behavior: "allow", entry: r.entry, compiled: r.compiled });
+        return inert;
+    }
+    entries() {
+        return this.held.map((r) => r.entry);
+    }
+    lane(ctx) {
+        return {
+            allowing: (req, mode) => {
+                const hit = judgeAllowEntries(allowingRows(this.held, req, mode), req, "allow", ctx);
+                return hit === undefined ? undefined : { entries: hit.map((r) => r.entry) };
+            },
+        };
+    }
+}
+export function seedAllowEntryTables(tables, lists) {
+    tables.request.seed(lists.inherited ?? []);
+    const requestInert = tables.request.seed(lists.request ?? []);
+    tables.deployment.seed(lists.deployment ?? []);
+    return [...lists.skillInert.map((e) => ({ source: "skill", ...e })), ...requestInert.map((e) => ({ source: "request", ...e }))];
+}
+export function withDeploymentAllowedTools(deps) {
+    if (deps.allowedTools === undefined)
+        return deps;
+    const allowedTools = screenAllowedToolsValue(deps.allowedTools, "RunnerDeps.allowedTools");
+    const inert = compileAllowList(allowedTools ?? [], "allow").inert;
+    if (inert.length > 0)
+        deliverEngineNotice(deps.onNotice, allowedToolsNotGrantedNotice(inert.map((e) => ({ source: "deployment", ...e })), undefined));
+    return { ...deps, allowedTools };
+}
+export const INVALID_PERMISSION_RULES_CODE = "config.invalid_permission_rules";
+export function screenAllowedToolsValue(value, seat) {
+    if (value === undefined)
+        return undefined;
+    const issues = [];
+    if (!Array.isArray(value)) {
+        issues.push({ rule: "", code: "invalid.entry_type", message: `${seat} must be a list of permission-rule strings (got ${value === null ? "null" : typeof value})` });
+    }
+    else {
+        const list = value;
+        list.forEach((entry, i) => {
+            if (typeof entry !== "string")
+                issues.push({ rule: "", code: "invalid.entry_type", message: `${seat}[${i}] must be a permission-rule string (got ${entry === null ? "null" : typeof entry})` });
+        });
+    }
+    if (issues.length > 0) {
+        const e = new Error(`${seat}: ${issues.length} invalid entr${issues.length === 1 ? "y" : "ies"} — refusing rather than running without them:\n${issues.map((i) => `  [${i.code}] ${i.message}`).join("\n")}`);
+        e.code = INVALID_PERMISSION_RULES_CODE;
+        e.issues = issues;
+        throw e;
+    }
+    return Object.freeze([...value]);
+}
+const SHADOW_ENTRIES_MAX = 5;
+const SHADOW_ENTRY_MAX_CHARS = 200;
+export function allowRuleShadowOf(member, entries) {
+    const shown = entries.slice(0, SHADOW_ENTRIES_MAX).map((e) => inlineUntrusted(e, SHADOW_ENTRY_MAX_CHARS));
+    return { member, entries: shown, ...(entries.length > shown.length ? { omitted: entries.length - shown.length } : {}) };
+}
+const MEMBER_SET = new Set(ALLOW_RULE_MEMBERS);
+export function readAllowRuleShadows(value) {
+    try {
+        if (!Array.isArray(value) || value.length === 0)
+            return undefined;
+        const list = value;
+        const out = [];
+        for (const r of list) {
+            if (typeof r !== "object" || r === null)
+                return undefined;
+            const { member, entries, omitted } = r;
+            if (!MEMBER_SET.has(member) || !Array.isArray(entries) || !entries.every((e) => typeof e === "string"))
+                return undefined;
+            const shadow = allowRuleShadowOf(member, entries);
+            const carried = typeof omitted === "number" && Number.isInteger(omitted) && omitted > 0 ? omitted : 0;
+            out.push(carried > 0 ? { ...shadow, omitted: (shadow.omitted ?? 0) + carried } : shadow);
+        }
+        return out;
+    }
+    catch {
+        return undefined;
+    }
+}
+const SHADOW_REASON = {
+    content_question: "the call is the engine's own question to a person",
+    hook: "a PreToolUse hook asks about this call — the deployment's own screening is answered by a person",
+    ancestor: "the task that delegated this one owns this question",
+    unverifiable_delete: "this removal could not be verified safe — it is cleared by confirming this call, never by an allow rule",
+    transcript_write: "this write targets the session transcript — it is cleared by confirming this call, never by an allow rule",
+    org_rule: "an organization policy rule requires approval for this call",
+    governance_unavailable: "this deployment is org-governed and cannot currently read its organization policy",
+    rule_unreadable: "this call could not be read against a deny or ask rule, so whether one forbids it is unknown",
+    ask_rule: mandateDisclosureOf(undefined),
+    denial_limit_fallback: "the auto-mode classifier refused too many calls in a row, so a person decides",
+    requires_user_interaction: "this tool's server declares that a call must be put to a person",
+    operator_forced: "this call arrived already marked as requiring confirmation (an earlier layer of this run, or the task that delegated it, judged it so) — it is cleared by confirming this call, never by a standing allow rule",
+    shell_floor: mandateDisclosureOf("operator_always"),
+    write_protection_unresolved: mandateDisclosureOf("write_protection_unresolved"),
+    probe: mandateDisclosureOf("probe_mandate"),
+    write_protection: mandateDisclosureOf("write_protection"),
+    tool_marks_mcp: mandateDisclosureOf("tool_marks"),
+    tool_marks_a2a: mandateDisclosureOf("tool_marks"),
+    policy_rra: "the deployment's policy requires a real approval for this call",
+    artifact_shared_read: "this read targets another task's shared artifact — it is cleared by confirming this call",
+    mode: "the permission mode puts this question to a person",
+    unstated: "this call arrived already marked as requiring confirmation (an earlier layer of this run, or the task that delegated it, judged it so) — it is cleared by confirming this call, never by a standing allow rule",
+    ordinary: "this call arrived already marked as requiring confirmation (an earlier layer of this run, or the task that delegated it, judged it so) — it is cleared by confirming this call, never by a standing allow rule",
+};
+function memberPhrase(s) {
+    const listed = `${s.entries.join(", ")}${s.omitted !== undefined ? ` and ${s.omitted} more` : ""}`;
+    switch (s.member) {
+        case "hook":
+            return "a PreToolUse hook's allow";
+        case "deployment":
+            return `the deployment's allowedTools (${listed})`;
+        case "persisted":
+            return s.entries.length + (s.omitted ?? 0) === 1 ? `a persisted allow rule (${listed})` : `persisted allow rules (${listed})`;
+        case "skill":
+            return `an active skill's allowed-tools (${listed})`;
+        case "request":
+            return `this run's allowedTools (${listed})`;
+        default: {
+            const exhaustive = s.member;
+            return exhaustive;
+        }
+    }
+}
+export function allowRuleShadowSentence(shadows, ask) {
+    const one = shadows.length === 1 && (shadows[0].member === "hook" || shadows[0].entries.length + (shadows[0].omitted ?? 0) === 1);
+    const why = ask.mandate !== undefined
+        ? mandateDisclosureOf(ask.mandate)
+        : ask.authoredBy === "deployment"
+            ? "this deployment requires a person's confirmation for this call"
+            : SHADOW_REASON[ask.askClass ?? "ordinary"];
+    return `${shadows.map(memberPhrase).join("; ")} ${one ? "matches this call but does not clear the ask" : "match this call but do not clear the ask"} — ${why}`;
+}
+export function cardDisclosureOf(decision, fallbackMessage) {
+    const base = decision.message ?? fallbackMessage;
+    const shadows = readAllowRuleShadows(decision.allowRuleShadowed);
+    if (shadows === undefined)
+        return { message: base };
+    return { message: `${base} (${allowRuleShadowSentence(shadows, decision)})`, allowRuleShadowed: shadows };
+}
+export const ALLOWED_TOOL_NOT_GRANTED_CODE = "permission.allowed_tool_not_granted";
+const NOTICE_ENTRIES_SHOWN = 5;
+export function allowedToolsNotGrantedNotice(inert, sessionId) {
+    const where = (e) => (e.source === "skill" ? `skill ${inlineUntrusted(e.skill, 80)} ${e.list}` : e.source === "request" ? "this run's allowedTools" : "the deployment's allowedTools");
+    const shown = inert.slice(0, NOTICE_ENTRIES_SHOWN).map((e) => `${where(e)} "${inlineUntrusted(e.entry, 120)}" (${e.reason})`);
+    const rest = inert.length - shown.length;
+    return {
+        code: ALLOWED_TOOL_NOT_GRANTED_CODE,
+        message: `${inert.length} allowed-tools entr${inert.length === 1 ? "y grants" : "ies grant"} or refuse${inert.length === 1 ? "s" : ""} nothing — ${shown.join("; ")}${rest > 0 ? `; and ${rest} more` : ""}. ` +
+            "A list holding `*` voids the list, `mcp__*` names no server, and a write-path or domain entry has no allow reading; name the tools (or `mcp__<server>`) instead.",
+        detail: { ...(sessionId !== undefined ? { sessionId } : {}), entries: inert.map((e) => ({ ...e })) },
+    };
+}

package/dist/core/allow-rule-shadow.d.ts

@@ -0,0 +1,18 @@
+/**
+ * The allow layer's DISCLOSURE vocabulary — which member matched a call and could not clear its ask. A leaf: the decision
+ * union (`PermissionResult`), the approval request (`AskRequest`), the park row's risk descriptor and the allow layer all
+ * name these, and nothing here names them back.
+ */
+/** The allow layer's members, in the order the layer reads them: a PreToolUse hook's explicit `allow`, the deployment's
+ *  `RunnerDeps.allowedTools`, a person's stored allow rows, an active skill's `allowed-tools`, the request's
+ *  `TaskSpec.allowedTools`. The closed set {@link AllowRuleShadow.member} names. */
+export declare const ALLOW_RULE_MEMBERS: readonly ["hook", "deployment", "persisted", "skill", "request"];
+export type AllowRuleMember = (typeof ALLOW_RULE_MEMBERS)[number];
+/** One allow-layer member that matched a call and could not clear its ask: the member, and the entries it matched as their
+ *  source spells them (sanitized and capped at the mint; a hook names none — its word is about the call, not an entry).
+ *  `omitted` counts entries beyond the cap, never dropped silently. */
+export interface AllowRuleShadow {
+    readonly member: AllowRuleMember;
+    readonly entries: readonly string[];
+    readonly omitted?: number;
+}

package/dist/core/allow-rule-shadow.js

@@ -0,0 +1 @@
+export const ALLOW_RULE_MEMBERS = Object.freeze(["hook", "deployment", "persisted", "skill", "request"]);

package/dist/core/ask-origin.d.ts

@@ -166,8 +166,8 @@ export declare function stampAskOrigin<T extends Extract<PermissionResult, {
  *    approver and this task's rule lane never adjudicates it;
  *  · the bit already stamped on the ask, which no layer below the mint may clear (tightening-only).
  *
- * And the SHADOW doors, which are not mandates: a matching rule the person already wrote is speaking
- * and is outranked (`persistedRuleShadowed`), or their explicit "ask me each time" rule matched
+ * And the SHADOW doors, which are not mandates: an allow-layer member already matched and is outranked
+ * (`allowRuleShadowed`), or the person's explicit "ask me each time" rule matched
  * (`matchedAskRule`). A rule minted from such a card silences nothing, so the lane offers none — but
  * the reason is that a RULE is already speaking, not that the question is beyond rules, and a surface
  * that auto-answers by posture is not crossing a mandate when it answers one.
@@ -181,7 +181,7 @@ export declare function stampAskOrigin<T extends Extract<PermissionResult, {
  *  · `mandated` — the FACT the ask carries as its own member. Read off the whole mandate set, so which
  *    door is DISPLAYED cannot change it: an ask that is both shadowed and mandated is mandated;
  *  · `ruleMayClear` — the ENFORCEMENT reading the gate's clearing arms take. It is `mandated` plus the
- *    person's explicit `ask` rule, and deliberately NOT `word !== undefined`: `persistedRuleShadowed`
+ *    person's explicit `ask` rule, and deliberately NOT `word !== undefined`: `allowRuleShadowed`
  *    is an ACCOUNT of a refusal that already happened, display-only by contract, and reading it as a
  *    blocker would let a policy forwarding that metadata refuse a call nothing is blocking. A
  *    display word is never an authority;
@@ -205,8 +205,8 @@ export interface RuleClearanceFacts {
     /** The table word a gate stamped beside that bit (see {@link import("./tool-policy.js").AskRequest.mandate}). */
     mandate?: PersistedRuleMandate;
     requiresRealApproval?: boolean;
-    /** A matching persisted allow rule was found and did not clear the ask — carries its text. */
-    persistedRuleShadowed?: string;
+    /** Allow-layer members matched and did not clear the ask (see {@link import("./allow-rule-shadow.js").AllowRuleShadow}). */
+    allowRuleShadowed?: readonly import("./allow-rule-shadow.js").AllowRuleShadow[];
     decisionReason?: import("./tool-policy.js").DecisionReason;
     /** An EXPLICIT `ask` permission rule matched this call (DSL, stamped at the rule policy's three
      *  matched-ask exits — bare, covering and param). */

package/dist/core/ask-origin.js

@@ -32,7 +32,7 @@ export function ruleClearanceOf(ask, marks) {
     const word = (() => {
         if (ask?.requiresRealApproval === true)
             return "mandated";
-        if (ask?.persistedRuleShadowed !== undefined)
+        if (Array.isArray(ask?.allowRuleShadowed) && ask.allowRuleShadowed.length > 0)
             return "shadowed";
         if (ask?.decisionReason === "hook")
             return "mandated";

package/dist/core/auto-mode.d.ts

@@ -414,8 +414,9 @@ export interface AutoModeDenialTracker {
      *  ONCE (a second call with the same member arms nothing), so the hand-out is a recorded fact, not a
      *  convention. */
     armTimedWindow(fallback: UnarmedDenialLimitFallback): DenialLimitFallback;
-    /** A classifier `allow`, or a person's allow of a fallback ask (CC `yR`): consecutive → 0 and the
-     *  timed-card mark cleared. A rule/fast-path allow must NOT call this. */
+    /** A classifier `allow`, a person's allow of a fallback ask (CC `yR`), or — in auto mode — an allow rule or the
+     *  read-only reader clearing the ask (the reference resets the streak when its pipeline answers allow): consecutive → 0
+     *  and the timed-card mark cleared. A hook's allow does not call this. */
     recordAllow(): void;
     /** The current counts (diagnostics / pins). `windowArmedAt` = the epoch-ms instant
      *  {@link armTimedWindow} handed the CURRENT streak's fallback a non-zero window to a live approver

package/dist/core/checkpoint-store.d.ts

@@ -150,22 +150,14 @@ export interface RiskDescriptor {
      *  {@link summary} (a path name can carry the same reordering hazard as a command) + capped.
      *  Omitted when none derivable. */
     touchedPaths?: string[];
-    /** A persisted allow rule MATCHED this call but could not clear the mandated ask —
-     *  the matched rule text (rendered through the same display baseline as {@link summary}, capped),
-     *  threaded to the mint so the durable-park route carries the same disclosure the synchronous ask
-     *  does. The inbox renders "their rule is alive, just outranked" instead of the person concluding
-     *  their rule silently broke. (The baseline is a FAMILY-UNIFORMITY choice AND, on this seat, a
-     *  disclosed one-face NARROWING: the feeding path is the permission-rule store's READ leg, which
-     *  does not re-screen stored rule text through the validator — the bytes may be model-authored or
-     *  a custom provider's, and a store-sourced string can legally carry `\p{Cf}`. For
-     *  validator-screened text the render coincides with the previous `inlineUntrusted` treatment
-     *  (the two differ only on the `\p{Cf}` class, and both fold the width-bearing controls it admits
-     *  (a tab) identically); for a Cf carrier this durable seat STRIPS what the synchronous ask's
-     *  `persistedRuleShadowed` preserves — same value, two byte-forms, diverging exactly on `\p{Cf}`,
-     *  the durable face stripping MORE (the safe direction). This seat carries NO cross-face
-     *  same-value contract (unlike `probeReason`/`probeCause` below), which is why the one-face move
-     *  is legal — a byte-pinning consumer must read per face.) */
-    shadowedRule?: string;
+    /** The allow-layer members that MATCHED this call and could not clear the ask — one record per member (the member and
+     *  the entries it matched), threaded to the mint so the durable-park route carries the same disclosure the synchronous
+     *  card does: the inbox renders "their rule is alive, just outranked" instead of the person concluding it silently broke.
+     *  Each entry is rendered through the same display baseline as {@link summary} and capped (the bytes may be a person's
+     *  stored text, a skill's or a deployment's list — model-authored or a custom provider's — and can carry `\p{Cf}`; this
+     *  durable seat strips what the synchronous card keeps, the safe direction, and carries no cross-face same-value
+     *  contract, so a byte-pinning consumer reads per face). */
+    allowRuleShadowed?: readonly import("./allow-rule-shadow.js").AllowRuleShadow[];
     /** WHY the reversibility probe did not clear this call, in the probe's own
      *  words — the cause the tighten acted on, which until now existed only inside the probe and left the
      *  card showing WHAT is gated with no account of WHY. Present only for a `"maybe"`-tier tighten whose
@@ -380,7 +372,7 @@ export declare function safeDataValue(obj: Record<string, unknown>, key: string)
  *
  * **Redaction is load-bearing** (the `summary`/`touchedPaths` are PERSISTED + surfaced to a human inbox):
  * every model-controlled value in the DESCRIPTOR-OWNED display family (`summary` both arms,
- * `touchedPaths`, `shadowedRule`) goes through
+ * `touchedPaths`, `allowRuleShadowed`) goes through
  * {@link import("./permission-rule-model.js").renderUntrustedCommandText} — which STRIPS the `\p{Cf}`
  * format class (directional controls / zero-width formatters, the display-reordering hazard the
  * `hasBidiControls` bit warns about; #438) and then applies the shared inline form (folds CR/LF/Unicode
@@ -408,8 +400,8 @@ export declare function buildRiskDescriptor(input: {
     shellGated?: boolean;
     /** The resolved doctrine to persist when `shellGated` (see {@link RiskDescriptor.shellGateDoctrine}). */
     shellGateDoctrine?: ShellGateDoctrine;
-    /** The matched-but-outranked persisted rule to persist (see {@link RiskDescriptor.shadowedRule}). */
-    shadowedRule?: string;
+    /** The matched-but-not-cleared allow-layer members to persist (see {@link RiskDescriptor.allowRuleShadowed}). */
+    allowRuleShadowed?: readonly import("./allow-rule-shadow.js").AllowRuleShadow[];
     /** The reversibility probe's cause for not clearing this call (see
      *  {@link RiskDescriptor.probeReason}). Re-neutralized here like its shadowed-rule sibling: this
      *  function is exported, so a caller reaching it directly must get the same redaction the gate applies. */

package/dist/core/checkpoint-store.js

@@ -165,7 +165,7 @@ export function buildRiskDescriptor(input) {
             axes,
             toolName,
             ...(input.shellGated && input.shellGateDoctrine !== undefined ? { shellGateDoctrine: input.shellGateDoctrine } : {}),
-            ...(input.shadowedRule !== undefined ? { shadowedRule: renderUntrustedCommandText(input.shadowedRule, 200) } : {}),
+            ...(input.allowRuleShadowed !== undefined && input.allowRuleShadowed.length > 0 ? { allowRuleShadowed: input.allowRuleShadowed.map((r) => ({ member: r.member, entries: r.entries.map((e) => renderUntrustedCommandText(e, 200)), ...(r.omitted !== undefined ? { omitted: r.omitted } : {}) })) } : {}),
             ...(input.probeReason !== undefined ? { probeReason: inlineUntrusted(input.probeReason, PROBE_REASON_MAX) } : {}),
             ...(() => {
                 if (input.probeCause === undefined)

package/dist/core/decision-receipt.d.ts

@@ -7,8 +7,10 @@ export declare const isEngineRefusal: (d: unknown) => boolean;
  *  compile error rather than a drift between the type and the screen. Module-private (the package publishes the type).
  *  `skill`: an active skill's list spoke — the allow layer's skill member cleared the call (`allowed-tools`), or this
  *  run's deny row refused it (`disallowed-tools`); distinct from `rule` (a deployment policy) and `persisted_rule` (a
- *  person's stored row) because the authority is the skill the run activated. */
-declare const DECISION_REASONS: readonly ["rule", "mode", "hook", "safety", "classifier", "persisted_rule", "sandbox", "org_rule", "org_unavailable", "read_only", "skill"];
+ *  person's stored row) because the authority is the skill the run activated. `deployment_rule` / `request_rule`: an entry
+ *  of the deployment's `RunnerDeps.allowedTools` / of this run's `TaskSpec.allowedTools` cleared the call (the allow layer's
+ *  two entry-list members) — one word per author, so "who said this needs no asking" is read off the decision. */
+declare const DECISION_REASONS: readonly ["rule", "mode", "hook", "safety", "classifier", "persisted_rule", "sandbox", "org_rule", "org_unavailable", "read_only", "skill", "deployment_rule", "request_rule"];
 export type DecisionReason = (typeof DECISION_REASONS)[number];
 export declare const RETIRED_WINDOW_MEMBER_DENY_MESSAGE: string;
 export declare const carriesRetiredWindow: (fallback: unknown) => boolean;

package/dist/core/decision-receipt.js

@@ -8,7 +8,7 @@ export const refusedOutOfContract = (message) => {
     return refused;
 };
 export const isEngineRefusal = (d) => typeof d === "object" && d !== null && ENGINE_REFUSALS.has(d);
-const DECISION_REASONS = Object.freeze(["rule", "mode", "hook", "safety", "classifier", "persisted_rule", "sandbox", "org_rule", "org_unavailable", "read_only", "skill"]);
+const DECISION_REASONS = Object.freeze(["rule", "mode", "hook", "safety", "classifier", "persisted_rule", "sandbox", "org_rule", "org_unavailable", "read_only", "skill", "deployment_rule", "request_rule"]);
 const DECISION_ACTIONS = Object.keys({ allow: 0, deny: 0, ask: 0 });
 const GUARDS = Object.keys({ unverifiable_delete: 0, transcript_write: 0, artifact_shared_read: 0 });
 const RULE_UNREADABLE_WORDS = Object.keys({ content_deny: 0, content_ask: 0, persisted_call: 0 });

package/dist/core/engine-notice.d.ts

@@ -57,11 +57,14 @@ export interface EngineNotice {
      *    at least one type is listed name-only (`nameOnly`) or not at all (`dropped`). Audience `operator`.
      *    `detail: { budgetBytes, total, kept, nameOnly: [name], dropped: [name], sessionId }`; the same
      *    firing rule as its skills sibling below (once per delivered frame, on the carrying message's receipt).
-     *  - `"skills.allowed_tool_not_granted"` — a loaded skill's `allowed-tools` / `disallowed-tools` holds entries that grant
-     *    (or refuse) nothing: `*` (it voids an allow list; on a deny list it reads as nothing and the rest still refuses), `mcp__*` (no server named), a write-path or domain
-     *    entry, a shape the rule grammar does not read. The run goes on and asks for those tools as usual. Audience
-     *    `operator`; once per prepared task, only when such an entry exists. `detail: { sessionId, entries: [{ skill, list,
-     *    entry, reason }] }` (`reason` ∈ `wildcard_all` / `namespace_wildcard` / `path_pattern` / `domain` / `content_unsupported` / `grammar`).
+     *  - `"permission.allowed_tool_not_granted"` — an allow list holds entries that grant (or refuse) nothing: a loaded skill's
+     *    `allowed-tools` / `disallowed-tools`, the request's `TaskSpec.allowedTools`, the deployment's `RunnerDeps.allowedTools`.
+     *    `*` (it voids an allow list; on a deny list it reads as nothing and the rest still refuses), `mcp__*` (no server
+     *    named), a write-path or domain entry, a shape the rule grammar does not read. The run goes on and asks for those tools
+     *    as usual. Audience `user`; once per prepared task for the skill and request lists (`detail.sessionId` present), once
+     *    per Runner for the deployment's (at construction, no session). `detail: { sessionId?, entries: [{ source, entry,
+     *    reason, skill?, list? }] }` (`source` ∈ `skill` / `request` / `deployment`; `skill` and `list` only on a skill's;
+     *    `reason` ∈ `wildcard_all` / `namespace_wildcard` / `path_pattern` / `domain` / `content_unsupported` / `grammar`).
      *  - `"skills.listing_truncated"` — the `<skills>` disclosure block did not fit its byte budget, so
      *    at least one skill is listed without its description (`nameOnly`) or, in the pathological case,
      *    not listed at all (`dropped`); the `Skill` tool still serves every one of them. Audience

package/dist/core/gate-fold.js

@@ -173,7 +173,7 @@ export async function runGateFold(pass) {
                 pass.deniedBy = "write_protection";
         }
     }
-    if (asksUnstated(pass.decision, permissionSeatAt(input, pass.policyRewrite !== undefined ? pass.policyRewrite : pass.currentInput)?.seat, input.permissionMode?.(), pass.hookAllowed === true && pass.decision.updatedInput === undefined)) {
+    if (asksUnstated(pass.decision, permissionSeatAt(input, pass.policyRewrite !== undefined ? pass.policyRewrite : pass.currentInput)?.seat, input.permissionMode?.())) {
         pass.decision = { action: "ask", message: permissionSeatAt(input, pass.policyRewrite !== undefined ? pass.policyRewrite : pass.currentInput)?.question ?? unstatedAskMessage(toolName), ...(pass.policyRewrite !== undefined ? { updatedInput: pass.policyRewrite } : {}) };
         pass.tightenedBy = "unstated";
     }

package/dist/core/gate-lanes.d.ts

@@ -1,53 +1,5 @@
 import { type GatePass } from "./runner/gate-exit.js";
-import type { OrgGateVerdict, PersistedRuleAnswer, PersistedRuleHit, ToolGateResult } from "./hooks.js";
-/**
- * design/252 review r3 — read a foreign {@link OrgGateVerdict} the way the personal-rule answer is read:
- * OWN DATA properties only, never the prototype chain, never an accessor.
- *
- * Unlike the personal-rule normalizer below, this one accepts ANY non-array object as the carrier —
- * not only a plain record. The two seams tighten in opposite directions when a shape is refused: the
- * personal lane is a LOOSENING seam, so refusing a class instance degrades toward asking; this answer
- * carries the org's DENY, and folding a structurally valid `{status:"available", verdict:{behavior:
- * "deny"}}` class instance into `unavailable` would LOOSEN it — from a deny nobody can approve into a
- * real-approval ask a person can clear. A class instance's fields are its own data properties, so the
- * own-data read below already gives the full pollution guarantee (inherited members never authorize);
- * the prototype test added nothing here but the downgrade.
- *
- * The two seams are the same class of trust boundary and were not being read the same way. What that
- * cost here is worse than on the personal lane, because this answer is GOVERNANCE:
- *  · an inherited `revision` (a polluted `Object.prototype`) stamped a fabricated snapshot version onto
- *    a human's approval request — a WRONG record, which is worse than an absent one;
- *  · an inherited `verdict` invented an org rule, and with it an org ask or deny the lane never gave;
- *  · an answer that is not a record at all read as "available, nothing to say", i.e. the governance
- *    fail-open the availability contract exists to prevent.
- * Anything this function cannot read as a well-formed answer becomes `unavailable` — the fail-CLOSED
- * word, never the empty one.
- */
-export declare function normalizeOrgGateVerdict(answer: unknown, unreadable: string): OrgGateVerdict;
-/**
- * Normalize the accepted {@link ToolGateInput.persistedRules} answers into one reading.
- *
- * `{}` = a clean negative (no rule admits this call). `{ unreadable: true }` = the lane could not read
- * its source. `{ hit }` = a match, whose `rules` is the non-empty coverage set (design/375). An answer
- * outside every accepted shape — a number, `null`, an object with neither `rules` nor `unreadable`, an
- * EMPTY `rules` array, the retired pre-375 `{ rule, dots? }` single-rule object — is read as a clean
- * negative rather than a match: this is a LOOSENING seam, so an answer nobody can name degrades toward
- * asking, never toward an allow built on it. All-or-nothing across the set's TEXTS for the same
- * reason: a set with one unreadable member is a different (smaller) claim than the lane made, and a
- * decision must not stand on a claim nobody made — one bad member drops the whole answer to the clean
- * negative. Per-member DOTS stay individually optional (identity lost ⇒ `"not_reported"`, exactly the
- * single-rule contract).
- *
- * The hit's dots are COPIED, not aliased. The array travels onto an ask that may sit in front of a
- * person for a long time; a lane that retains and mutates its own array would otherwise change what the
- * approver is looking at, and what an audit later reads, after the evidence was stamped.
- */
-export declare function normalizePersistedRuleHit(hit: PersistedRuleAnswer): {
-    hit?: PersistedRuleHit;
-    unreadable?: true;
-    reason?: string;
-    coverage?: readonly import("./permission-rule-model.js").SegmentCoverage[];
-};
+import type { ToolGateResult } from "./hooks.js";
 /**
  * Run the lanes over the pass: the org layer over the fold's verdict, then — for a surviving ask — the rewrite
  * merge, the rule lane, the stamp, the classifier, the sandbox leg, the parks, the content lane, the resolution