@sema-agent/core 7.41.0 → 7.42.0

package/dist/core/rule-lane-reads.js

@@ -0,0 +1,164 @@
+import { describeThrown } from "./tool-policy.js";
+import { ORG_ADJUDICATION_TIMEOUT_MS, settleOrgVerdictWithin } from "./permission-rule-org.js";
+import { isRuleBehavior } from "./permission-rule-model.js";
+function isPlainOwnRecord(x) {
+    try {
+        if (x === null || typeof x !== "object" || Array.isArray(x))
+            return false;
+        const p = Object.getPrototypeOf(x);
+        return p === Object.prototype || p === null;
+    }
+    catch {
+        return false;
+    }
+}
+function ownDataValue(obj, key) {
+    try {
+        const d = Object.getOwnPropertyDescriptor(obj, key);
+        return d && "value" in d ? d.value : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function normalizeOrgGateVerdict(answer, unreadable) {
+    const clean = (v) => Object.assign(Object.create(null), v);
+    const readable = (x) => {
+        try {
+            return x !== null && (typeof x === "object" || typeof x === "function") && !Array.isArray(x);
+        }
+        catch {
+            return false;
+        }
+    };
+    if (!readable(answer))
+        return clean({ status: "unavailable", disclosures: [unreadable] });
+    const status = ownDataValue(answer, "status");
+    if (status === "unavailable") {
+        const disclosures = ownDataValue(answer, "disclosures");
+        let lines = [];
+        if (Array.isArray(disclosures)) {
+            try {
+                for (let i = 0; i < disclosures.length; i++) {
+                    const d = disclosures[i];
+                    if (typeof d === "string")
+                        lines.push(d);
+                }
+            }
+            catch {
+                lines = [];
+            }
+        }
+        return clean({ status: "unavailable", disclosures: lines.length > 0 ? lines : [unreadable] });
+    }
+    if (status !== "available")
+        return clean({ status: "unavailable", disclosures: [unreadable] });
+    const revision = ownDataValue(answer, "revision");
+    const revisionCell = typeof revision === "number" && Number.isFinite(revision) ? { revision } : {};
+    const verdict = ownDataValue(answer, "verdict");
+    if (verdict === undefined)
+        return clean({ status: "available", ...revisionCell });
+    if (!readable(verdict))
+        return clean({ status: "unavailable", disclosures: [unreadable] });
+    const behavior = ownDataValue(verdict, "behavior");
+    const rule = ownDataValue(verdict, "rule");
+    if ((behavior !== "deny" && behavior !== "ask") || typeof rule !== "string")
+        return clean({ status: "unavailable", disclosures: [unreadable] });
+    const reason = ownDataValue(verdict, "unreadable");
+    const unreadableCell = behavior === "ask" && typeof reason === "string" ? { unreadable: reason } : {};
+    return clean({ status: "available", verdict: clean({ behavior: behavior, rule, ...unreadableCell }), ...revisionCell });
+}
+function copiedUsableDots(dots) {
+    let copied;
+    try {
+        if (Array.isArray(dots)) {
+            const walked = [];
+            for (let i = 0; i < dots.length; i++) {
+                const d = dots[i];
+                walked.push(isPlainOwnRecord(d) ? { actor: ownDataValue(d, "actor"), counter: ownDataValue(d, "counter") } : { actor: undefined, counter: undefined });
+            }
+            copied = walked;
+        }
+    }
+    catch {
+        copied = undefined;
+    }
+    const usable = copied?.every((d) => typeof d.actor === "string" && typeof d.counter === "number" && Number.isFinite(d.counter)) === true && copied.length > 0;
+    return usable ? { dots: copied } : {};
+}
+export function normalizePersistedRuleHit(hit) {
+    if (!isPlainOwnRecord(hit))
+        return {};
+    if (ownDataValue(hit, "unreadable") === true) {
+        const reason = ownDataValue(hit, "reason");
+        return typeof reason === "string" ? { unreadable: true, reason } : { unreadable: true };
+    }
+    const rulesRaw = ownDataValue(hit, "rules");
+    if (rulesRaw === undefined) {
+        const coverageRaw = ownDataValue(hit, "segmentCoverage");
+        let rows;
+        try {
+            if (Array.isArray(coverageRaw)) {
+                const walked = [];
+                for (let i = 0; i < coverageRaw.length; i++) {
+                    const r = coverageRaw[i];
+                    walked.push(isPlainOwnRecord(r) ? { segment: ownDataValue(r, "segment"), covered: ownDataValue(r, "covered") } : { segment: undefined, covered: undefined });
+                }
+                rows = walked.every((r) => typeof r.segment === "string" && typeof r.covered === "boolean") ? walked : undefined;
+            }
+        }
+        catch {
+            rows = undefined;
+        }
+        return rows !== undefined && rows.length > 0 ? { coverage: rows.map((r) => ({ segment: r.segment, covered: r.covered })) } : {};
+    }
+    let members;
+    try {
+        if (Array.isArray(rulesRaw)) {
+            const walked = [];
+            for (let i = 0; i < rulesRaw.length; i++) {
+                const m = rulesRaw[i];
+                walked.push(isPlainOwnRecord(m) ? { rule: ownDataValue(m, "rule"), dots: ownDataValue(m, "dots") } : { rule: undefined, dots: undefined });
+            }
+            members = walked;
+        }
+    }
+    catch {
+        members = undefined;
+    }
+    if (members === undefined || members.length === 0)
+        return {};
+    if (!members.every((m) => typeof m.rule === "string"))
+        return {};
+    const behavior = ownDataValue(hit, "behavior");
+    if (!isRuleBehavior(behavior))
+        return {};
+    return { hit: { behavior, rules: members.map((m) => ({ rule: m.rule, ...copiedUsableDots(m.dots) })) } };
+}
+export async function readOrgRuleLane(org, req, signal, timeoutMs = ORG_ADJUDICATION_TIMEOUT_MS) {
+    let pending;
+    try {
+        pending = Promise.resolve(org.adjudicate(req));
+    }
+    catch (err) {
+        pending = Promise.resolve({ status: "unavailable", disclosures: [`the org adjudication face threw before answering: ${describeThrown(err)}`] });
+    }
+    const raw = await settleOrgVerdictWithin(pending.catch((err) => ({
+        status: "unavailable",
+        disclosures: [`the org adjudication face threw: ${describeThrown(err)}`],
+    })), {
+        status: "unavailable",
+        disclosures: [`the org adjudication face did not answer within ${timeoutMs}ms (or the task ended first)`],
+    }, { ...(signal !== undefined ? { signal } : {}), timeoutMs });
+    return normalizeOrgGateVerdict(raw, "the org adjudication face answered something this gate cannot read as a verdict — treated as unreadable governance, never as an empty one");
+}
+export async function readPersistedRuleLane(lane, req, signal, timeoutMs = ORG_ADJUDICATION_TIMEOUT_MS) {
+    let pendingHit;
+    try {
+        pendingHit = Promise.resolve(lane?.adjudicate(req));
+    }
+    catch {
+        return { unreadable: true };
+    }
+    return await settleOrgVerdictWithin(pendingHit.then(normalizePersistedRuleHit).catch(() => ({ unreadable: true })), { unreadable: true }, { ...(signal !== undefined ? { signal } : {}), timeoutMs });
+}

package/dist/core/runner/contracts.d.ts

@@ -239,8 +239,8 @@ export type StopForDenialLimit = (info: {
     fallback: DenialLimitFallbackFace;
     settlement?: SettlementKind;
 }) => void;
-/** The gate's seat inputs for one call (the static seat or the `Skill` tool's per-call reader, and the run's skill rows). */
-export type GateSeatInputsFor = (calledName: string, wireName: string) => import("../mode-policy.js").PermissionSeatInputs & SkillGateSeats;
+/** The gate's seat inputs for one call (the static seat or the `Skill` tool's per-call reader, the run's skill and allow-list rows). */
+export type GateSeatInputsFor = (calledName: string, wireName: string) => import("../mode-policy.js").PermissionSeatInputs & SkillGateSeats & import("../allow-entry.js").AllowEntryGateSeats;
 export interface Prepared {
     harness: AgentHarness;
     /** The CONCRETE built-in session (engine-internal: prepare constructs/acquires `StoredSession` itself,
@@ -1810,6 +1810,8 @@ export interface RunInternals {
      * seeding nothing (it carries refusals too). Absent or empty ⇒ nothing inherited.
      */
     inheritedSkillGrants?: readonly SkillGrantRecord[];
+    /** The parent's request allow entries at the spawn (`ctx.activeRequestAllowedTools()`), seeded as this child's own request rows until it ends — the channel of {@link inheritedSkillGrants}. */
+    inheritedAllowedTools?: readonly string[];
     /**
      * When this task runs as a SUB-AGENT spawned under a parent task's
      * tool call, the spawning tool's `ToolExecuteContext.toolCallId`. The Runner stamps it onto this task's

package/dist/core/runner/gate-exit.d.ts

@@ -218,9 +218,9 @@ export interface GatePass {
     hookAsk: Extract<PermissionResult, {
         action: "ask";
     }> | undefined;
-    /** borrowed-mutable — the phase-1 hook answered its own `allow` (the exact word): a statement about this call, read by
-     *  the fold's last station only while the policy left the arguments as the hook saw them. Writer: the dispatch (phase 1).
-     *  Reader: the fold's unstated station. */
+    /** borrowed-mutable — the phase-1 hook answered its own `allow` (the exact word): the allow layer's hook member, which
+     *  speaks only while no policy rewrote the arguments after the hook saw them. Writer: the dispatch (phase 1). Reader: the
+     *  lanes' allow layer (its one reader). */
     hookAllowed?: true;
     /** borrowed-mutable — set by a park attempt that FAILED (see `ParkAttemptFailed`). Read at the single deny
      *  exit — whatever the fallback chain then decides to say, it says it knowing the park was tried first.

package/dist/core/runner/image.js

@@ -1,8 +1,9 @@
 import { isIP } from "node:net";
 import { imageMagicMatches } from "../../tools/fs/safety.js";
-const KNOWN_IMAGE_MIME_TYPES = ["image/png", "image/jpeg", "image/gif", "image/webp"];
+import { ADMITTED_IMAGE_MIME_TYPES } from "../../tools/fs/image-admission.js";
+import { admitInlineImage } from "./inline-image.js";
 function sniffImageMime(bytes) {
-    return KNOWN_IMAGE_MIME_TYPES.find((mime) => imageMagicMatches(bytes, mime));
+    return ADMITTED_IMAGE_MIME_TYPES.find((mime) => imageMagicMatches(bytes, mime));
 }
 function isPrivateV4(ip) {
     const o = ip.split(".").map(Number);
@@ -125,5 +126,5 @@ export async function toImageContent(img, allowUrl) {
         const { buf, mimeType } = await fetchImageCapped(img.url);
         return { type: "image", data: buf.toString("base64"), mimeType };
     }
-    return { type: "image", data: img.data, mimeType: img.mimeType };
+    return admitInlineImage(img);
 }

package/dist/core/runner/inline-image.d.ts

@@ -0,0 +1,14 @@
+/**
+ * The `TaskSpec.images` INLINE arm's admission: the same byte admission a file the Read tool serves passes
+ * (image-admission.ts) — a claimed type the API accepts, within the raw cap, that type's signature, under
+ * the provider's base64 limit. Without it a mis-declared image rode straight to the provider and 400'd the whole
+ * request. Like the Read lane it checks the SIGNATURE, not decodability: a file cut short after its signature
+ * passes (KL-1311a-c). No downsampling here: this arm only refuses what would not survive the wire, and a
+ * valid image reaches the model unchanged. The block is built from the bytes that were checked.
+ */
+import type { ImageContent } from "../../internal/llm.js";
+import type { ImageInput } from "../types.js";
+/** Admit one inline entry (`{ data, mimeType }`) or throw `config.image_invalid`. */
+export declare function admitInlineImage(img: Extract<ImageInput, {
+    data: string;
+}>): Promise<ImageContent>;

package/dist/core/runner/inline-image.js

@@ -0,0 +1,26 @@
+import { admitImageBytes, ADMITTED_IMAGE_MIME_TYPES } from "../../tools/fs/image-admission.js";
+import { MCP_IMAGE_MAX_BASE64 } from "../image-downsample.js";
+function inlineImageRefusal(detail) {
+    const e = new Error(`TaskSpec.images: ${detail}`);
+    e.code = "config.image_invalid";
+    return e;
+}
+export async function admitInlineImage(img) {
+    const data = img.data;
+    const mimeType = img.mimeType;
+    if (typeof data !== "string" || typeof mimeType !== "string")
+        throw inlineImageRefusal("an inline image needs a base64 string `data` and a string `mimeType`.");
+    const admitted = await admitImageBytes(Buffer.from(data, "base64"), mimeType, undefined);
+    if (admitted.ok)
+        return admitted.block;
+    switch (admitted.reason) {
+        case "mime_unsupported":
+            throw inlineImageRefusal(`an inline image declares mimeType ${JSON.stringify(mimeType.slice(0, 80))}, which the model API does not accept (accepted: ${ADMITTED_IMAGE_MIME_TYPES.join(", ")}).`);
+        case "magic_mismatch":
+            throw inlineImageRefusal(`an inline image's bytes do not begin with a ${mimeType} signature (empty, mis-declared, or not base64) — refused rather than sent.`);
+        case "raw_too_large":
+            throw inlineImageRefusal(`an inline image is ${admitted.rawBytes} bytes, over the ${admitted.cap}-byte cap.`);
+        case "base64_too_large":
+            throw inlineImageRefusal(`an inline image's base64 is ${admitted.base64.length} chars, over the ${MCP_IMAGE_MAX_BASE64}-char / 5MB API image limit — shrink it before sending.`);
+    }
+}

package/dist/core/runner/permission-rule-lanes.d.ts

@@ -175,6 +175,8 @@ export declare function createPermissionRuleLanes(cfg: {
     onStoreUnreadable: (at: "call", sources?: EffectivePermissionRules["unreadableSources"]) => void;
     /** The run's cut: a read it interrupts is abandoned quietly — a cancelled wait is no fact about the store. */
     signal?: AbortSignal;
+    /** The allow layer's auto strip over a stored ALLOW row (true ⇒ out of this call's table BEFORE the coverage is chosen). */
+    stripsAllow?: (rule: PersistedRule, req: ToolCallRequest) => boolean;
 }): PermissionRuleLanes;
 /** The closed reason set for the rule-offer factory's empty answer — the same three
  *  spellings the `AskRequest` and durable-row seats declare, kept at the one factory that fills both.
@@ -229,7 +231,7 @@ interface RuleOffersAskFacts extends RuleClearanceFacts {
  * `decision.matchedAskRule === undefined` conjunct on its allow arm), so a person who wrote a
  * standing `Bash` `ask` rule and had no allow rule yet was still offered "allow, and stop asking
  * me this" — and the rule they minted came back on the very next call as a SHADOWED match
- * (`persistedRuleShadowed`, which this door was already refusing). The offer was only ever
+ * (the allow layer's disclosure, which this door was already refusing). The offer was only ever
  * suppressed one call too late, after the useless rule existed. The shadowed conjunct stays: it
  * covers the person who ALREADY has the allow rule; this one covers the person about to mint it.
  *

package/dist/core/runner/permission-rule-lanes.js

@@ -142,7 +142,7 @@ export function createPermissionRuleLanes(cfg) {
         if (view.unreadable !== undefined)
             skipped(view.unreadable, view.unreadableSources);
         try {
-            const answer = strongestAnswer(judged.map(([n, grammar]) => judgeAgainst(view.rules, { ...req, toolName: n }, grammar)));
+            const answer = strongestAnswer(judged.map(([n, grammar]) => judgeAgainst(view.rules.filter((r) => r.behavior !== "allow" || cfg.stripsAllow?.(r, req) !== true), { ...req, toolName: n }, grammar)));
             return view.unreadable !== undefined && (answer === undefined || "segmentCoverage" in answer) ? { unreadable: true } : answer;
         }
         catch (err) {

package/dist/core/runner/prepare-ask-lane.d.ts

@@ -1,22 +1,3 @@
-/**
- * PrepareTask's IN-STREAM ASK LANE, verbatim from the driver's gate-machinery block:
- * the per-call signal composition bound to this task's run signal, the abort-bound `adjudicate` wrapper (the budget
- * snapshot and the live tracked cwd stamped onto every request), the approval-preview projection over the live roster,
- * the `resolveAskBound` mint (the inherited-unavailable intercept, the duplicate-frame grant reuse, the human-review
- * ledger, the bare-human-rejection record), the pre-wrapped deny observer and the hook-crash notifier. The three
- * module-scope helpers only this segment called moved with it (the deny-observer factory, the preview sanitizer and
- * resolver). The interface is the dependency list the segment had implicitly — the closures below
- * used to capture every seat here off the driver's scope.
- *
- * SYNCHRONOUS FUNCTION, SYNCHRONOUS CALL: the stretch has no await of its own (every await lives inside the closures
- * it builds, which run per tool call), so the phase adds no yield between the wiring-manifest station before it and
- * the suspend saga after it (a stretch with no await is extracted as a sync function). Read-stability
- * of the host handles for the call: {@link RunInternals} (`@contract prepare.deps-read-stable`).
- *
- * The lane exists exactly when the wiring-manifest phase's `gateMachineryActive` holds — the driver's `if` around the
- * whole block became this phase's one early return (the block's other four phases key off the lane's presence), so
- * the orchestrator grows no branch.
- */
 import type { AgentTool } from "../../internal/harness.js";
 import type { AdvertisedWritableDirs } from "./advertised-writable-dirs.js";
 import type { AutoModeDenialTracker } from "../auto-mode.js";

package/dist/core/runner/prepare-ask-lane.js

@@ -1,3 +1,4 @@
+import { cardDisclosureOf } from "../allow-entry.js";
 import { primaryActivityArg } from "../arg-summary.js";
 import { hookSeatExpiredError, runHookSeat } from "../hooks.js";
 import { advertisedWritableRootsSeat, isLiveApproverSeat, resolveAsk } from "../tool-policy.js";
@@ -97,12 +98,11 @@ export function prepareAskLane(input) {
                 return { ...(p.preview !== undefined ? { preview: p.preview } : {}), ...(p.withheld !== undefined ? { previewWithheld: p.withheld } : {}) };
             })(),
             ...ruleOffersOf(req, req.args, decision.action === "ask" ? decision : undefined),
-            message: decision.message ?? `approval required for "${req.toolName}"`,
+            ...cardDisclosureOf(decision, `approval required for "${req.toolName}"`),
             ...askSourceIdentity(),
             ...riskAxesOf(req),
             ...(decision.action === "ask" && decision.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
             ...(decision.action === "ask" ? askMandateMember(decision) : {}),
-            ...(decision.action === "ask" && decision.persistedRuleShadowed !== undefined ? { persistedRuleShadowed: decision.persistedRuleShadowed } : {}),
             ...(decision.action === "ask" ? gateAskCarry(decision, isLiveApproverSeat(onAsk), autoModeDenialTracking.current) : {}),
             ...(decision.action === "ask" && decision.probeReason !== undefined ? { probeReason: decision.probeReason } : {}),
             ...(decision.action === "ask" && decision.probeCause !== undefined ? { probeCause: decision.probeCause } : {}),

package/dist/core/runner/prepare-inherited-gate.d.ts

@@ -109,6 +109,8 @@ export interface PrepareInheritedGateInput {
     };
     /** borrowed-readonly — the per-task skill grant table (the ctx's `activeSkillGrants` capture and the checkpoint section read it call-time). Not written here. */
     skillGrants: SkillGrantTable;
+    /** borrowed-readonly — the request's allow-entry table (the ctx's `activeRequestAllowedTools` capture reads it call-time). Not written here. */
+    requestAllowedTools: Pick<import("../allow-entry.js").AllowEntryTable, "entries">;
     /** borrowed-readonly — the filtered display-forwarding wrapper (ctx seat; absent ⇒ no key). */
     forwardEvent: ((e: TaskEvent) => void) | undefined;
     /** borrowed-readonly — the retain ledger (ctx seat; absent ⇒ no key). */

package/dist/core/runner/prepare-inherited-gate.js

@@ -250,6 +250,7 @@ export function prepareInheritedGate(input) {
             ...(centerAdoption !== undefined ? { centerArtifactDigest: centerAdoption.artifact.artifactDigest } : {}),
             ...(centerAdoption?.sourceRevision !== undefined ? { centerSourceRevision: centerAdoption.sourceRevision } : {}),
             activeSkillGrants: () => skillGrants.records(),
+            activeRequestAllowedTools: () => input.requestAllowedTools.entries(),
             inheritedGateForChildren,
             delegationProvenanceForChildren,
             delegationSettlement: delegationSettlementForChildren,

package/dist/core/runner/prepare-park-ask.js

@@ -116,7 +116,7 @@ export function prepareParkAsk(input) {
         }
     };
     const suspendAsk = parkLaneArmed && checkpointStore !== undefined
-        ? async (req, postHookArgs, safety, liveFaceUnavailable, realApproval, shadowedRule, askDecisionReason, probeReason, probeCause, segmentCoverage, matchedAskRule, probeMandated, carry) => {
+        ? async (req, postHookArgs, safety, liveFaceUnavailable, realApproval, allowRuleShadowed, askDecisionReason, probeReason, probeCause, segmentCoverage, matchedAskRule, probeMandated, carry) => {
             const syncFirstEligible = wireOf("park.syncFirstRoute", req) === ASK_USER_QUESTION_TOOL_NAME ? contentAskRoutable(req.toolCallId) : isLiveApproverSeat(onAsk);
             if (syncFirstEligible &&
                 runtimeCaps?.forceDurableGate !== true &&
@@ -238,7 +238,7 @@ export function prepareParkAsk(input) {
                     toolName: req.toolName,
                     args: parkedArgs,
                     safety,
-                    ...(shadowedRule !== undefined ? { shadowedRule } : {}),
+                    ...(allowRuleShadowed !== undefined ? { allowRuleShadowed } : {}),
                     ...(probeReason !== undefined ? { probeReason } : {}),
                     ...(probeCause !== undefined ? { probeCause } : {}),
                     shellGated: tierSeat?.shellGated(shellGatedTools, toolMarkSources) === true,
@@ -283,7 +283,7 @@ export function prepareParkAsk(input) {
                     ...(carry?.mandate !== undefined && !storedShapeMandated ? { mandate: carry.mandate } : {}),
                     ...(carry?.authoredBy === "deployment" ? { authoredBy: "deployment" } : {}),
                     ...(rowRealApproval !== undefined ? { requiresRealApproval: true } : {}),
-                    ...(shadowedRule !== undefined ? { persistedRuleShadowed: shadowedRule } : {}),
+                    ...(allowRuleShadowed !== undefined ? { allowRuleShadowed } : {}),
                     ...(askDecisionReason !== undefined ? { decisionReason: askDecisionReason } : {}),
                     ...(rowMatchedAskRule !== undefined ? { matchedAskRule: rowMatchedAskRule } : {}),
                     ...(probeMandated === true ? { probeMandated: true } : {}),

package/dist/core/runner/prepare-policy-chain.d.ts

@@ -31,6 +31,7 @@ import type { RunnerDeps, RuntimeCaps, TaskSpec, ToolEffect } from "../types.js"
 import type { CwdRef } from "../../tools/fs/fs-shared.js";
 import type { ReadDenyMatcher } from "../../tools/fs/read-deny.js";
 import type { SkillGrantLane, SkillGrantTable } from "../skill-grant.js";
+import { type AllowEntryLane, type AllowEntryTable } from "../allow-entry.js";
 import type { InheritedGate, IrreversibilityTier, PrepareResume, RunInternals, StopForDenialLimit } from "./contracts.js";
 import { type Arbitration } from "../ask-origin.js";
 import { type ModeGateSeats, type PermissionModeController } from "../mode-policy.js";
@@ -121,6 +122,12 @@ export interface PreparePolicyChainInput {
     /** borrowed-readonly — the run's skill grant table; this phase binds its lane to the call facts the person's rule lane
      *  reads (root, session, live cwd, the execution environment's home). Not written here. */
     skillGrants: SkillGrantTable;
+    /** borrowed-readonly — the request's and the deployment's allow-entry tables (prepare seeded them); this phase binds
+     *  their lanes to the same call facts. Not written here. */
+    allowedToolTables: {
+        readonly request: AllowEntryTable;
+        readonly deployment: AllowEntryTable;
+    };
     /** borrowed-readonly — the FROZEN approver seat (the pass-through test's approver identity). */
     frozenOnAsk: OnAsk | undefined;
     /** borrowed-readonly — the identity of this task's hook-env source (the pass-through test's environment term). */
@@ -173,6 +180,11 @@ export interface PreparePolicyChainResult {
     denyNarrowingPolicy: ToolPolicy | undefined;
     /** owned — the skill grant lane (`Prepared.skillGrants`; the gate's skill member and deny rows read it). */
     skillGrantLane: SkillGrantLane;
+    /** owned — the request's and the deployment's allow-entry lanes (the gate's two entry-list members). */
+    allowEntryLanes: {
+        readonly request: AllowEntryLane;
+        readonly deployment: AllowEntryLane;
+    };
     /** owned — the caller-facing policy layers (the wiring manifest reads their COUNT). */
     policyLayers: ToolPolicy[];
     /** owned — THE effective policy the gate station adjudicates with (the fold plus its final-form re-check), or undefined. */

package/dist/core/runner/prepare-policy-chain.js

@@ -10,6 +10,7 @@ import { askApproverIdentity, carryEngineAttestations, carryPrecedingSettlement,
 import { judgeRuleToolName } from "../tool-name-aliases.js";
 import { NAMESPACED_NAME_SHAPES } from "../protocol-table.js";
 import { emitTrace } from "../trace.js";
+import { autoStrippedRule, cardDisclosureOf } from "../allow-entry.js";
 import { arbitrateByMode, askClassMembersOf, askMandateMember } from "../ask-origin.js";
 import { createModeGatePolicy, mountedToolDeclaresReadOnly } from "../mode-policy.js";
 const ancestorFacts = (ask) => ({ ...(ask ?? {}), ancestorResolved: true });
@@ -21,7 +22,7 @@ import { createLiveSessionRules, createSessionRulePolicy } from "./session-rule-
 import { thrownText } from "../thrown-value.js";
 import { heldBy, heldValues, seatOf, wireOf } from "../tool-name-readings.js";
 export async function preparePolicyChain(input) {
-    const { spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, additionalRootsCanonical, executionEnv, lockedPreflight, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, toolMarkSources, envHandToolNames, handsCwdRef, readDenyMatcher, announceRuleStoreSkipped, questionToolMounted, runtimeCaps, inheritedAncestorRules, ancestorSessionRulesRef, inheritedParentConstraints, seedInheritedGate, skillGrants, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider, permissionMode, scratchpadDir, toolRosterDeltas, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef } = input;
+    const { spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, additionalRootsCanonical, executionEnv, lockedPreflight, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, toolMarkSources, envHandToolNames, handsCwdRef, readDenyMatcher, announceRuleStoreSkipped, questionToolMounted, runtimeCaps, inheritedAncestorRules, ancestorSessionRulesRef, inheritedParentConstraints, seedInheritedGate, skillGrants, allowedToolTables, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider, permissionMode, scratchpadDir, toolRosterDeltas, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef } = input;
     const ancestorArbitrations = new Map();
     const arbitrateInherited = (ask, toolCallId, judged) => {
         const verdict = arbitrateByMode(permissionMode.current, judged.classification, { origin: judged.origin, ...askMandateMember(ancestorFacts(judged.ask.action === "ask" ? judged.ask : undefined)) });
@@ -294,7 +295,9 @@ export async function preparePolicyChain(input) {
         };
     };
     const inheritedAskEvidence = inheritedAskRuleEvidence(deps.permissionRuleStore);
-    const skillGrantLane = skillGrants.lane({ root: taskRootFinal, sessionId, liveCwd: () => handsCwdRef?.current, home: executionEnv.homeDir });
+    const listFacts = { root: taskRootFinal, sessionId, liveCwd: () => handsCwdRef?.current, home: executionEnv.homeDir };
+    const skillGrantLane = skillGrants.lane(listFacts);
+    const allowEntryLanes = { request: allowedToolTables.request.lane(listFacts), deployment: allowedToolTables.deployment.lane(listFacts) };
     const { personal: permissionRuleLane, org: permissionRuleOrgLane } = createPermissionRuleLanes({
         provider: deps.permissionRuleStore,
         localOwnerDeclared: deps.localOwnerRules === true,
@@ -309,6 +312,7 @@ export async function preparePolicyChain(input) {
         onDisclosure: (message) => emitTrace(deps.tracer, () => ({ kind: "permission.rule_store_unreadable", version: 1, taskId: hostTaskId, message, ts: Date.now() })),
         onStoreUnreadable: announceRuleStoreSkipped,
         signal: abortController.signal,
+        stripsAllow: (rule, req) => permissionMode.current === "auto" && autoStrippedRule(rule, req),
     });
     const ruleOffersOf = createRuleOffersOf({
         laneArmed: permissionRuleLane !== undefined,
@@ -383,12 +387,11 @@ export async function preparePolicyChain(input) {
                 toolCallId: creq.toolCallId,
                 args: editArgs,
                 ...ruleOffersOf(creq, editArgs, ancestorFacts(re)),
-                message: re.message ?? inheritedAskFallbackMessage(creq.toolName),
+                ...cardDisclosureOf(re, inheritedAskFallbackMessage(creq.toolName)),
                 ...askSourceIdentity(),
                 ...riskAxesOf(creq),
                 ...(re.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
                 ...askMandateMember(ancestorFacts(re)),
-                ...(re.persistedRuleShadowed !== undefined ? { persistedRuleShadowed: re.persistedRuleShadowed } : {}),
                 ...inheritedAskCarry(judged, isLiveApproverSeat(onAskOf), ancestorTracker),
                 ruleEvidence: inheritedAskEvidence,
             }, onAskOf, csignal ?? abortController.signal, lateAskSettlementObserver({ toolName: creq.toolName, toolCallId: creq.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice, onError: deps.onError }));
@@ -463,12 +466,11 @@ export async function preparePolicyChain(input) {
                         toolCallId: creq.toolCallId,
                         args: presentedArgs,
                         ...ruleOffersOf(creq, presentedArgs, ancestorFacts(inheritedAsk.action === "ask" ? inheritedAsk : undefined)),
-                        message: inheritedAsk.message ?? inheritedAskFallbackMessage(creq.toolName),
+                        ...cardDisclosureOf(inheritedAsk, inheritedAskFallbackMessage(creq.toolName)),
                         ...askSourceIdentity(),
                         ...riskAxesOf(creq),
                         ...(inheritedAsk.action === "ask" && inheritedAsk.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
                         ...askMandateMember(ancestorFacts(inheritedAsk.action === "ask" ? inheritedAsk : undefined)),
-                        ...(inheritedAsk.action === "ask" && inheritedAsk.persistedRuleShadowed !== undefined ? { persistedRuleShadowed: inheritedAsk.persistedRuleShadowed } : {}),
                         ...inheritedAskCarry(judged, isLiveApproverSeat(pc.onAsk), pc.autoMode?.denialTracking),
                         ruleEvidence: inheritedAskEvidence,
                     }, pc.onAsk, csignal ?? abortController.signal, lateAskSettlementObserver({ toolName: creq.toolName, toolCallId: creq.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice, onError: deps.onError }));
@@ -536,12 +538,11 @@ export async function preparePolicyChain(input) {
                     toolCallId: creq.toolCallId,
                     args: presentedArgs,
                     ...ruleOffersOf(creq, presentedArgs, ancestorFacts(inheritedAsk.action === "ask" ? inheritedAsk : undefined)),
-                    message: inheritedAsk.message ?? inheritedAskFallbackMessage(creq.toolName),
+                    ...cardDisclosureOf(inheritedAsk, inheritedAskFallbackMessage(creq.toolName)),
                     ...askSourceIdentity(),
                     ...riskAxesOf(creq),
                     ...(inheritedAsk.action === "ask" && inheritedAsk.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
                     ...askMandateMember(ancestorFacts(inheritedAsk.action === "ask" ? inheritedAsk : undefined)),
-                    ...(inheritedAsk.action === "ask" && inheritedAsk.persistedRuleShadowed !== undefined ? { persistedRuleShadowed: inheritedAsk.persistedRuleShadowed } : {}),
                     ...inheritedAskCarry(judged, isLiveApproverSeat(pc.onAsk), pc.autoMode?.denialTracking),
                     ruleEvidence: inheritedAskEvidence,
                 }, pc.onAsk, csignal ?? abortController.signal, lateAskSettlementObserver({ toolName: creq.toolName, toolCallId: creq.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice, onError: deps.onError }));
@@ -666,7 +667,7 @@ export async function preparePolicyChain(input) {
             return decision;
         })
         : foldedPolicy;
-    return { hooks, hookTimeoutMs, preToolUseObservational, ownGatePreToolUse, basePolicyForResumeEdit, denyNarrowingPolicy, skillGrantLane, policyLayers, effectivePolicy, inheritedUnavailableAsks, inheritedAskGrants, askSourceIdentity, riskAxesOf, ruleOffersOf, permissionRuleLane, permissionRuleOrgLane, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, foldAskClasses, ancestorSandboxAdmissions, ancestorArbitrations };
+    return { hooks, hookTimeoutMs, preToolUseObservational, ownGatePreToolUse, basePolicyForResumeEdit, denyNarrowingPolicy, skillGrantLane, allowEntryLanes, policyLayers, effectivePolicy, inheritedUnavailableAsks, inheritedAskGrants, askSourceIdentity, riskAxesOf, ruleOffersOf, permissionRuleLane, permissionRuleOrgLane, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, foldAskClasses, ancestorSandboxAdmissions, ancestorArbitrations };
 }
 const advisedPolicyNames = new WeakMap();
 const ADVISED_KEYS_CAP = 64;

package/dist/core/runner/prepare-project-context.d.ts

@@ -2,6 +2,7 @@ import type { ResolvedSkillListingBudget } from "../skill-listing-budget.js";
 import { type StoredSession } from "../session.js";
 import type { RunnerDeps, TaskSpec, ToolSpec } from "../types.js";
 import { type SkillGrantTable, type SkillSeatReader } from "../skill-grant.js";
+import { type AllowEntryTable } from "../allow-entry.js";
 import type { AnnounceOnceSink, Prepared, PrepareResume, RunInternals, ToolFaceSnapshot } from "./contracts.js";
 import { normalizeSkills } from "./synthetic-tools.js";
 import { RosterBuilder } from "../tool-roster.js";
@@ -9,14 +10,23 @@ export interface PrepareProjectContextInput {
     /** borrowed-readonly — the deployment seams this phase reads: `loadProjectMemory` (the snapshot),
      *  `onError` (the operator lane for a throwing seam / seeding / oversize skill), `sharedMemoryStores`
      *  (the shared-memory pair's switch: wired ⇒ mount). Receiver preserved (`deps.onError?.(…)`). */
-    deps: Pick<RunnerDeps, "loadProjectMemory" | "onError" | "sharedMemoryStores" | "onNotice">;
+    deps: Pick<RunnerDeps, "loadProjectMemory" | "onError" | "sharedMemoryStores" | "onNotice" | "allowedTools">;
     /** borrowed-readonly — the REBOUND spec (`spec′`). Read: `sessionId` (phase derivation + the
      *  continuation projections), `skills` (the roster), `userInvokedSkills` (the person's invoked skills — their
      *  rows are written here), `principal` (the shared-memory tools' trusted identity). Never mutated. */
     spec: Pick<TaskSpec, "sessionId" | "skills" | "userInvokedSkills" | "principal">;
     /** borrowed-readonly — trusted internals: `agentName` (seam ctx), `inheritedSkillGrants` (the parent's captured
-     *  skill grant rows, seeded as `inherited`). `undefined` on a standalone prepare. */
-    internals: Pick<RunInternals, "agentName" | "inheritedSkillGrants"> | undefined;
+     *  skill grant rows, seeded as `inherited`), `inheritedAllowedTools` (the parent's request entries, seeded as this leg's
+     *  own). `undefined` on a standalone prepare. */
+    internals: Pick<RunInternals, "agentName" | "inheritedSkillGrants" | "inheritedAllowedTools"> | undefined;
+    /** borrowed-readonly — the request's `allowedTools`, screened and snapshotted at the config door (before the first await). */
+    allowedTools: readonly string[] | undefined;
+    /** borrowed-mutable — the request's and the deployment's allow-entry tables (identity is the contract: the gate's lanes and
+     *  the delegation capture alias these objects). Seeded here, once; nothing writes them after this phase. */
+    allowedToolTables: {
+        readonly request: AllowEntryTable;
+        readonly deployment: AllowEntryTable;
+    };
     /** borrowed-readonly — the acquired session; only `getBranch()` is read (phase derivation walk).
      *  The read is best-effort: a throw keeps the provisional phase. */
     session: Pick<StoredSession, "getBranch">;

package/dist/core/runner/prepare-project-context.js

@@ -5,14 +5,15 @@ import { hasConversationContent } from "../session.js";
 import { createSharedMemoryTools } from "../shared-memory/tools.js";
 import { SHARED_MEMORY_TOOL_NAMES } from "../shared-memory/types.js";
 import { defineTool } from "../tools.js";
-import { readFrozenSkillGrants, seedSkillGrants, skillEntriesNotGrantedNotice, skillSeatReader } from "../skill-grant.js";
+import { readFrozenSkillGrants, seedSkillGrants, skillSeatReader } from "../skill-grant.js";
+import { allowedToolsNotGrantedNotice, seedAllowEntryTables } from "../allow-entry.js";
 import { deliverEngineNotice } from "../engine-notice.js";
 import { SKILL_CONTENT_MAX_CHARS, SKILL_TOOL_NAME, createSkillTool, normalizeSkills } from "./synthetic-tools.js";
 import { skillLoadReading } from "./skill-base-dir.js";
 import { RosterBuilder } from "../tool-roster.js";
 import { asThrownError } from "../thrown-value.js";
 export async function prepareProjectContext(input) {
-    const { deps, spec, internals, session, sessionId, hostTaskId, taskRootFinal, handsEnabled, delegation, seedContextFiles, memoryBlockFromEngine, skillGrants, roster, toolFaceSnapshot, onceLedger, memoryTools, memoryEngineSession, memorySearchToolsPlanned, memoryPairExcludedName, memoryPairOccupiedName, resume, skillListingBudget } = input;
+    const { deps, spec, internals, session, sessionId, hostTaskId, taskRootFinal, handsEnabled, delegation, seedContextFiles, memoryBlockFromEngine, skillGrants, allowedTools, allowedToolTables, roster, toolFaceSnapshot, onceLedger, memoryTools, memoryEngineSession, memorySearchToolsPlanned, memoryPairExcludedName, memoryPairOccupiedName, resume, skillListingBudget } = input;
     const tools = roster.tools;
     let memoryBlock = memoryBlockFromEngine;
     let instructionSources;
@@ -87,9 +88,9 @@ export async function prepareProjectContext(input) {
     const frozenSkillGrants = readFrozenSkillGrants(resume?.seed.skillGrants);
     if (frozenSkillGrants === undefined)
         throw new Error("the resumed checkpoint's skill-grant section does not read as grant rows — refusing to seed the run without the refusals it carries (the resume screen refuses this row before the claim)");
-    const inert = seedSkillGrants(skillGrants, { skills: skillSpecs, userInvokedSkills: spec.userInvokedSkills, inherited: [...(internals?.inheritedSkillGrants ?? []), ...frozenSkillGrants] });
+    const inert = seedAllowEntryTables(allowedToolTables, { skillInert: seedSkillGrants(skillGrants, { skills: skillSpecs, userInvokedSkills: spec.userInvokedSkills, inherited: [...(internals?.inheritedSkillGrants ?? []), ...frozenSkillGrants] }), inherited: internals?.inheritedAllowedTools, request: allowedTools, deployment: deps.allowedTools });
     if (inert.length > 0)
-        deliverEngineNotice(deps.onNotice, skillEntriesNotGrantedNotice(inert, sessionId));
+        deliverEngineNotice(deps.onNotice, allowedToolsNotGrantedNotice(inert, sessionId));
     if (skillSpecs.length > 0) {
         if (tools.some((t) => t.name === SKILL_TOOL_NAME)) {
             const e = new Error(`Tool name "${SKILL_TOOL_NAME}" is reserved when spec.skills is present.`);