@sema-agent/core 7.41.0 → 7.42.0

package/dist/core/runner/prepare-task.js

@@ -22,6 +22,7 @@ import { STALL_FIRST_BYTE_MS, STALL_FIRST_TOKEN_MS, STALL_IDLE_MS, withBrainCall
 import { OFFLOAD_TOOL_NAME } from "../tool-result-store.js";
 import { OUTPUT_TOOL_NAME, SKILL_TOOL_NAME, createOutputTool } from "./synthetic-tools.js";
 import { skillGateWiring } from "../skill-grant.js";
+import { AllowEntryTable, screenAllowedToolsValue } from "../allow-entry.js";
 import { compileOutputSchema } from "./strict-output-schema.js";
 import { MEMORY_ENGINE_TOOL_NAMES } from "../memory-engine/tools.js";
 import { foldAdmissionFreeze } from "../memory-admission.js";
@@ -279,6 +280,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
     const checkpointStore = resolveCheckpointStore(spec, deps), checkpointSeat = checkpointSeatOf(spec, checkpointStore);
     const permissionModeSeat = refusePermissionModeDoors(spec);
     const outputStyleFrame = resolveOutputStyleFrame(spec.outputStyle);
+    const allowedTools = screenAllowedToolsValue(spec.allowedTools, "TaskSpec.allowedTools");
     const declaredModeAtDoor = (() => {
         const requested = modeRequestAfterResume(permissionModeSeat, recordedModeSeed(resume?.seed.inheritedGate), resume?.outcome);
         const ceiling = internals?.inheritedGate?.permissionModeCeiling?.current ?? internals?.inheritedGate?.permissionMode;
@@ -398,13 +400,14 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         const { canonical: taskRootCanonical } = await resolveTaskRootCanonical({ env: executionEnv, given: taskRootFinal, onNotice: deps.onNotice, sessionId, runId });
         const { trackFileEdit, fileHistoryBoundary, restoredFilePaths, rewindNotes, fileHistoryEnabled, fileHistoryFact, historyScope, historyRoot, historyFs } = await prepareFileHistory({ deps, spec, request: fileHistoryRequest, internals, executionEnv, taskRootFinal, handsEnabled, sessionId, session, abortController });
         const { noteFileEdited, editedFilesSnapshot, harnessRef, toolProgressRef, skillGrants, forwardEvent, reviewRequestRef, requestReview, stopRequestedRef, requestStopAfterTurn, bindPermissionModeSeat, enterPlanMode, subagentRetain, worktreeIsolation } = prepareRunRefs({ spec, internals, executionEnv, taskRootFinal });
+        const allowedToolTables = { request: new AllowEntryTable(), deployment: new AllowEntryTable() };
         const legContextOverlay = () => runnerSelf?.contextOverlayOf?.(harnessRef.current?.getModelRef() ?? resolvedRole.modelRef);
         let resolvedReadFace;
         let resolvedWriteFace;
         let readDenyAdditionsNormalized = [];
         let handsLessResolvedFace;
         let handsLessResolvedWriteFace;
-        const { liveInheritedGate, seedInheritedGate, inheritedAncestorRules, inheritedShellGate, inheritedParentConstraints, permissionMode, commitModeSeats, endModeCeiling, inheritedAdmittedOrgScopes, priorOwnOrgVerdict, orgGovernedProvenance, effectiveShellGate, ownSessionRulesRef, ancestorSessionRulesRef, ancestorRulesNow, memoryAdmittedOrgScopesRef, ownOrgVerdictRef, orgAdmissionCheckpointState, faceCheckpointSection, faceCheckpointState, writeFaceCheckpointSection, skillGrantCheckpointSection, f012CheckpointState, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, frozenOnQuestion, parentSpecSeat, provenanceForChildrenRef, delegationSettlementRef, inheritedGateForChildren, carrierReadFace, carrierWriteFace, fullShellReachable, gateStopRef, stopForDenialLimit, enrichSpecToolCtx } = prepareInheritedGate({ spec, deps, internals, resume, sessions, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, ownedEnv, lockedPreflight, checkpointSeat, toolFaceSnapshot, mountsCallerTool, promptProfile, resolvedInteractionPosture, permissionModeSeat, handsEnabled, reportUsage, harnessRef, skillGrants, forwardEvent, subagentRetain, worktreeIsolation, requestReview, requestStopAfterTurn, enterPlanMode, reminderMark, reminderDisclosureCounts, fileHistoryEnabled, historyScope, historyRoot, historyFs, abortRun: () => { abortController.abort(); void harness.abort(); }, runtimeCaps: () => runtimeCaps, hooks: () => hooks, preToolUseObservational: () => preToolUseObservational, hookTimeoutMs: () => hookTimeoutMs, hookEnvFace: () => hookEnvFace, autoModeDecider: () => autoModeDeciderRef.current, autoModeDenialTracking: () => autoModeDenialTrackingRef.current, autoModeArming: () => autoModeArmingRef.current, agentForkDenial: () => agentForkDenial, observersActive: () => observersActive, resolvedReadFace: () => resolvedReadFace, resolvedWriteFace: () => resolvedWriteFace, readDenyAdditionsNormalized: () => readDenyAdditionsNormalized, handsLessResolvedFace: () => handsLessResolvedFace, handsLessResolvedWriteFace: () => handsLessResolvedWriteFace, centerAdoption: () => centerAdoptionRef.current, memoryEngineSession: () => memoryEngineSession });
+        const { liveInheritedGate, seedInheritedGate, inheritedAncestorRules, inheritedShellGate, inheritedParentConstraints, permissionMode, commitModeSeats, endModeCeiling, inheritedAdmittedOrgScopes, priorOwnOrgVerdict, orgGovernedProvenance, effectiveShellGate, ownSessionRulesRef, ancestorSessionRulesRef, ancestorRulesNow, memoryAdmittedOrgScopesRef, ownOrgVerdictRef, orgAdmissionCheckpointState, faceCheckpointSection, faceCheckpointState, writeFaceCheckpointSection, skillGrantCheckpointSection, f012CheckpointState, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, frozenOnQuestion, parentSpecSeat, provenanceForChildrenRef, delegationSettlementRef, inheritedGateForChildren, carrierReadFace, carrierWriteFace, fullShellReachable, gateStopRef, stopForDenialLimit, enrichSpecToolCtx } = prepareInheritedGate({ spec, deps, internals, resume, sessions, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, ownedEnv, lockedPreflight, checkpointSeat, toolFaceSnapshot, mountsCallerTool, promptProfile, resolvedInteractionPosture, permissionModeSeat, handsEnabled, reportUsage, harnessRef, skillGrants, requestAllowedTools: allowedToolTables.request, forwardEvent, subagentRetain, worktreeIsolation, requestReview, requestStopAfterTurn, enterPlanMode, reminderMark, reminderDisclosureCounts, fileHistoryEnabled, historyScope, historyRoot, historyFs, abortRun: () => { abortController.abort(); void harness.abort(); }, runtimeCaps: () => runtimeCaps, hooks: () => hooks, preToolUseObservational: () => preToolUseObservational, hookTimeoutMs: () => hookTimeoutMs, hookEnvFace: () => hookEnvFace, autoModeDecider: () => autoModeDeciderRef.current, autoModeDenialTracking: () => autoModeDenialTrackingRef.current, autoModeArming: () => autoModeArmingRef.current, agentForkDenial: () => agentForkDenial, observersActive: () => observersActive, resolvedReadFace: () => resolvedReadFace, resolvedWriteFace: () => resolvedWriteFace, readDenyAdditionsNormalized: () => readDenyAdditionsNormalized, handsLessResolvedFace: () => handsLessResolvedFace, handsLessResolvedWriteFace: () => handsLessResolvedWriteFace, centerAdoption: () => centerAdoptionRef.current, memoryEngineSession: () => memoryEngineSession });
         bindPermissionModeSeat(permissionMode);
         const announceRuleStoreSkipped = ruleStoreUnreadableNotice(deps.onNotice, { sessionId, runId });
         const persistedPathRowsRead = persistedPathRowsOfTask({ deps, principal: spec.principal, sessionId, root: taskRootFinal, home: executionEnv.homeDir, taskId: hostTaskId, handsEnabled, signals: [abortController.signal, ...(spec.signal !== undefined ? [spec.signal] : [])], onUnread: announceRuleStoreSkipped });
@@ -616,7 +619,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 deps.onError?.(asThrownError(err), { phase: "config", sessionId });
             }
         }
-        const projectContext = await prepareProjectContext({ deps, spec, internals, session, sessionId, hostTaskId, taskRootFinal, handsEnabled, delegation, seedContextFiles, memoryBlockFromEngine, skillGrants, roster, toolFaceSnapshot, onceLedger, memoryTools, memoryEngineSession, memorySearchToolsPlanned, memoryPairExcludedName, memoryPairOccupiedName, resume, skillListingBudget: doors.skillListingBudget });
+        const projectContext = await prepareProjectContext({ deps, spec, internals, session, sessionId, hostTaskId, taskRootFinal, handsEnabled, delegation, seedContextFiles, memoryBlockFromEngine, skillGrants, allowedTools, allowedToolTables, roster, toolFaceSnapshot, onceLedger, memoryTools, memoryEngineSession, memorySearchToolsPlanned, memoryPairExcludedName, memoryPairOccupiedName, resume, skillListingBudget: doors.skillListingBudget });
         const { memoryBlock: memoryBlockWithProject, instructionSources, projectInstructionContent, skillSpecs, skillSeatOf, skillsListing, sharedMemoryPairMounted, memoryEnginePairMounted } = projectContext;
         const { provider, featureFlags, userSystemPrompt, userAppendSystemPrompt, mcpInstructionsBlock, envFacts, tzValid, userTz, dateAnchor, gitStatusRef } = await preparePromptInputs({ spec, deps, contextOverlay: legContextOverlay(), failClosedReason: selfOrchestrationFailClosedReason(spec, deps), lockedPreflight, selfOrchestrationActive, executionEnv, reminderMark, resolvedReadFace, resolvedWriteFace: resolvedWriteFace?.inForce(), toolFaceSnapshot, promptProfile, fableMitigations, internals, thinking, ownedEnv, delegation, resolvedRole, mcp, model, externalContentTargetActive, resume, handsEnabled, taskRootFinal, additionalRootsCanonical, additionalReadRootsCanonical, sessionId, session, ...(advertisedWritableDirs !== undefined ? { advertisedWritableDirs } : {}) });
         const { deferred, memoryBlock, toolSearch: toolSearchPolicy } = prepareDeferClassify({ spec, deps, roster, toolFaceSnapshot, handsEnabled, fullShellReachable, promptProfile, model, mcp, a2a, sharedMemoryPairMounted, memoryEnginePairMounted, memoryBlock: memoryBlockWithProject, memoryRecallSegment, onceLedger, sessionId });
@@ -730,7 +733,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 releaseSignal = () => sig.removeEventListener("abort", onExternalAbort);
             }
         }
-        const { hooks, hookTimeoutMs, preToolUseObservational, ownGatePreToolUse, basePolicyForResumeEdit, denyNarrowingPolicy, skillGrantLane, policyLayers, effectivePolicy, inheritedUnavailableAsks, inheritedAskGrants, askSourceIdentity, riskAxesOf, ruleOffersOf, permissionRuleLane, permissionRuleOrgLane, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, foldAskClasses, ancestorSandboxAdmissions, ancestorArbitrations } = await preparePolicyChain({ spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, additionalRootsCanonical, executionEnv, lockedPreflight, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, toolMarkSources, envHandToolNames, handsCwdRef, readDenyMatcher, announceRuleStoreSkipped, questionToolMounted, runtimeCaps, inheritedAncestorRules, ancestorSessionRulesRef, inheritedParentConstraints, seedInheritedGate, skillGrants, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider: () => autoModeDeciderRef.current, permissionMode, scratchpadDir: spec.envFacts?.scratchpadDir, toolRosterDeltas: rosterSeat, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef });
+        const { hooks, hookTimeoutMs, preToolUseObservational, ownGatePreToolUse, basePolicyForResumeEdit, denyNarrowingPolicy, skillGrantLane, allowEntryLanes, policyLayers, effectivePolicy, inheritedUnavailableAsks, inheritedAskGrants, askSourceIdentity, riskAxesOf, ruleOffersOf, permissionRuleLane, permissionRuleOrgLane, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, foldAskClasses, ancestorSandboxAdmissions, ancestorArbitrations } = await preparePolicyChain({ spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, additionalRootsCanonical, executionEnv, lockedPreflight, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, toolMarkSources, envHandToolNames, handsCwdRef, readDenyMatcher, announceRuleStoreSkipped, questionToolMounted, runtimeCaps, inheritedAncestorRules, ancestorSessionRulesRef, inheritedParentConstraints, seedInheritedGate, skillGrants, allowedToolTables, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider: () => autoModeDeciderRef.current, permissionMode, scratchpadDir: spec.envFacts?.scratchpadDir, toolRosterDeltas: rosterSeat, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef });
         const { onAsk, preToolContexts, blockedToolCalls, gateOutcomes, batchHaltRef, blockedTracked, incompleteSuspendAdapter, durableSuspendInfraReady, resourceSuspendEligible, usageGovernance, durableApproval, wiringManifest, writeProtection, parkLaneArmed, gateMachineryActive, hookIdentity, hookEnvFace, sessionBoxBound } = prepareWiringManifest({ spec, deps, internals, resume, sessionId, runId, hostTaskId, taskScope, hooks, preToolUseObservational, policyLayers, effectivePolicy, handsEnabled, taskRootFinal, mcp, irreversibleTools, egressTools, shellReadStationArmed: handsReadFace.shellReadStationArmed, toolEffects, ownedEnv, executionEnv, offloadStore, onceLedger, usageWindows, envLifetimeSuspendAt, runtimeCaps, resolvedInteractionPosture, durableQuestionFace, liveQuestionFace, checkpointStore, sessions, modelGateManifest, autoModeArmReason, permissionMode, lockedPreflight, peerLaneRefs, frameSettlement, harness, pausedRef, frozenOnAsk, liveInheritedGate, delegation, toolRoster, readDenyBuiltinTiersActive: handsReadFace.readDenyBuiltinTiersActive, lspManagerWired, lspDiagnosticsLive: lspDiagnostics !== undefined, fileHistoryFact, sessionBox });
         const writeProtectionCheck = writeProtection?.check;
         writeProtectionJudgeRef.current = writeProtection?.judgeTarget;
@@ -744,12 +747,12 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         const { saga } = prepareSuspendSaga({ gateMachineryActive, abortController, harness, checkpointStore, deps, sessionId, hostTaskId, taskScope, liveSpendRef, resume, nestedStats, internals, activeTools, outputRef, readFileStateForCheckpoint, faceCheckpointSection, writeFaceCheckpointSection, skillGrantCheckpointSection, reminderMark, handsCwdRef, worktreeSessionRef, undeliveredContinuationRef, inheritedParentConstraints, seedInheritedGate, ancestorRulesNow, inheritedShellGate, permissionMode, inheritedAdmittedOrgScopes, ownOrgVerdictRef, orgGovernedProvenance, announcedListingsRef, gitStatusRef, hookIdentity, placementRootResolved, externalContentTargetActive, remoteEnvFailures, memoryEngineSession, suspendLoopRef, ownedEnv, incompleteSuspendAdapter });
         const { suspendForResource, suspendForPlatformLimit, suspendForReview } = prepareBoundaryParks({ saga, spec, checkpointStore, abortController, harness, session, sessions, sessionId, deps, priorLedger, maxSlices, maxSuspends, resourceTotal, priorSuspendCount, suspendChainBase, humanReviewRef, liveSpendRef, now, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, pausedRef, remoteEnvFailures, resourceSuspendEligible, durableSuspendInfraReady, incompleteSuspendAdapter });
         const { parkAsk } = prepareParkAsk({ askLane, saga, spec, deps, sessionId, checkpointStore, toolRosterDeltas: rosterSeat, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, advertisedWritableDirs, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedTools, irreversibilityTier, toolMarkSources, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, ruleOffersOf, skillSpecs, now, humanReviewRef, abortController, harness, pausedRef });
-        const seatInputsFor = skillGateWiring({ tools, skillToolName: SKILL_TOOL_NAME, seatOf: skillSeatOf, mode: () => permissionMode.current, lane: skillGrantLane, onAllowed: (info) => emitTrace(deps.tracer, () => ({ kind: "permission.skill_allowed", version: 1, taskId: hostTaskId, ...info, entries: [...info.entries], ts: Date.now() })) });
+        const seatInputsFor = skillGateWiring({ tools, skillToolName: SKILL_TOOL_NAME, seatOf: skillSeatOf, mode: () => permissionMode.current, lane: skillGrantLane, onAllowed: (info) => emitTrace(deps.tracer, () => ({ kind: "permission.skill_allowed", version: 1, taskId: hostTaskId, ...info, entries: [...info.entries], ts: Date.now() })), allowEntries: { deploymentAllows: { ...allowEntryLanes.deployment, onAllowed: (info) => emitTrace(deps.tracer, () => ({ kind: "permission.allowed_tools_allowed", version: 1, taskId: hostTaskId, source: "deployment", ...info, entries: [...info.entries], ts: Date.now() })) }, requestAllows: { ...allowEntryLanes.request, onAllowed: (info) => emitTrace(deps.tracer, () => ({ kind: "permission.allowed_tools_allowed", version: 1, taskId: hostTaskId, source: "request", ...info, entries: [...info.entries], ts: Date.now() })) } } });
         const { approvedCallScreen } = prepareGateStations({ askLane, parkAsk, tools, toolRosterDeltas: rosterSeat, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, hooks, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, gateOutcomes, batchHaltRef, blockedTracked, hookIdentity, reminderMark, hostTaskId, sessionId, ownGatePreToolUse, hookTimeoutMs, handsCwdRef, readDenyInForce: () => ({ tiers: handsReadFace.readDenyBuiltinTiersActive, rows: [...readDenyAdditionsNormalized.map((e) => e.pattern), ...handsReadFaceInput.pathDenyRules.filter((r) => r.faces.includes("read")).map((r) => r.rule)] }), hookEnvFace, writeProtectionCheck, shellReadCheck, irreversibilityTier, reversibilityProbes, abortController, shellGatedTools, autoModeDecider: autoModeDeciderRef, autoModeDenialTracking: autoModeDenialTrackingRef, askRoute: { ...wiringManifest.ask, effective: askSeatEffective(wiringManifest) }, permissionMode, toolMarkSources, ...(deps.a2a?.isolatePeers === true ? { a2aIsolatePeers: true } : {}), ancestorArbitrations, runId, stopForDenialLimit, permissionRuleLane, seatInputsFor, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, notifyOwnHookCrash, frameSettlement });
         const postureFrameRef = { report: (err) => deps.onError?.(err, { phase: "degraded", sessionId }) };
         const { microCompact, charsPerToken } = prepareContextLane({ model, deps, sessionId, runId, hostTaskId, offloadStore, toolRosterDeltas: rosterSeat, microCompactKnob, harness, batchHaltRef, gitStatusRef, postureFrameRef, requestLossyRef, trimPressureRef, contextOverlay: legContextOverlay, ...(readFileStateForCheckpoint !== undefined ? { readFileState: readFileStateForCheckpoint } : {}) });
         const preparedHolder = {};
-        const { cacheBreakDetector, cacheFingerprint, promptOverheadTokens, readTaskFile, normalizeAttachmentPath, isDedupStubResult, recentlyReadFiles, onCompactionApplied, detectExternalChanges, listBackgroundTasks, centerCompactionCandidate, effectiveReadFaceObserved, effectiveWriteFaceObserved, effectiveReadDenyObserved } = prepareTurnWiring({ deps, systemPromptSeat, harnessTools, fpRef, model, epochArtifactDigestForSnapshot, promptProfile, fableMitigations, systemBlocks, thinking, spec, sessionId, turnSnapshotRef, promptManifest, charsPerToken, handsEnabled, executionEnv, attachmentRootCanonical, additionalRootsCanonical, additionalReadRootsCanonical, readDenyMatcher, resolvedReadFace, handsCwdRef, readFileStateForCheckpoint, denyNarrowingPolicy, skillGrants: skillGrantLane, abortController, hostTaskId, taskScope, buildAssembleInputs, centerAdoptionRef, harnessRef, epochDeclaredSections, carrierReadFace, carrierWriteFace, readDenyAdditionsNormalized, preparedHolder });
+        const { cacheBreakDetector, cacheFingerprint, promptOverheadTokens, readTaskFile, normalizeAttachmentPath, isDedupStubResult, recentlyReadFiles, onCompactionApplied, detectExternalChanges, listBackgroundTasks, centerCompactionCandidate, effectiveReadFaceObserved, effectiveWriteFaceObserved, effectiveReadDenyObserved } = prepareTurnWiring({ deps, systemPromptSeat, harnessTools, fpRef, model, epochArtifactDigestForSnapshot, promptProfile, fableMitigations, systemBlocks, thinking, spec, sessionId, turnSnapshotRef, promptManifest, charsPerToken, handsEnabled, executionEnv, attachmentRootCanonical, additionalRootsCanonical, additionalReadRootsCanonical, readDenyMatcher, resolvedReadFace, handsCwdRef, readFileStateForCheckpoint, denyNarrowingPolicy, skillGrants: skillGrantLane, callerPolicy: lockedPreflight.toolPolicy, inheritedPolicies: (inheritedParentConstraints ?? []).map((c) => c.policy), persistedRuleLane: permissionRuleLane, orgRuleLane: permissionRuleOrgLane, abortController, hostTaskId, taskScope, buildAssembleInputs, centerAdoptionRef, harnessRef, epochDeclaredSections, carrierReadFace, carrierWriteFace, readDenyAdditionsNormalized, preparedHolder });
         await onceLedger.settle(session, announcedListingsRef);
         const buildPrepared = () => ({ harness, session, sessionId, runId, registryAccess: { owner: hostTaskId, scope: taskScope }, reminderMark, reminderDisclosureCounts, fullShellReachable, approvalPosture: { get mode() { return permissionMode.current; }, askEffective: askSeatEffective(wiringManifest) }, ...(outputStyleFrame !== undefined ? { outputStyleFrame } : {}), permissionMode, editedFilesSnapshot, taskRootPath: taskRootFinal, model, thinking, compModel: effectiveCompModel, mcp, ...(mcpRedial !== undefined ? { mcpRedial } : {}), ...(a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, gateOutcomes, batchHaltRef, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), ...(fileHistoryBoundary !== undefined ? { fileHistoryBoundary } : {}), ...(effectiveReadFaceObserved !== undefined ? { effectiveReadFace: effectiveReadFaceObserved, effectiveWriteFace: effectiveWriteFaceObserved } : {}), ...(effectiveReadDenyObserved !== undefined ? { effectiveReadDenyPatterns: effectiveReadDenyObserved } : {}), effectiveMemoryScopes: memoryEffectiveScopes, cwdRef: handsCwdRef, toolProgressRef, ...(advertisedWritableDirs !== undefined ? { advertisedWritableDirs } : {}), ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), ...(sealReadStateSeat !== undefined ? { sealReadStateSeat } : {}), denyNarrowingPolicy, skillGrants: skillGrantLane, skillSpecs, ...(permissionRuleLane !== undefined ? { persistedRuleLane: permissionRuleLane } : {}), ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, endModeCeiling, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, pausedRef, undeliveredContinuationRef, suspendProgressRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, workCutRef, brainCallGuardrailRef, gateStopRef, stopForDenialLimit, suspendForReview, ...(readFileStateForCheckpoint !== undefined ? { readFileState: readFileStateForCheckpoint } : {}), resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolRoster, toolRosterDeltas: rosterSeat, structuredProjector, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, microCompact, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), stopRequestedRef, announcedSnapshotRecovered: onceLedger.recovered, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(projectInstructionContent !== undefined ? { projectInstructionContent } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, frameReceipts: { pending: [], listingSnapshotOwed: false }, frameSettlement, ...(peerLaneRefs.boundaryRound !== undefined ? { peerBoundaryRound: peerLaneRefs.boundaryRound } : {}), gitStatusRef, postureFrameRef, listBackgroundTasks, hookIdentity, ...(sessionBoxBound !== undefined ? { sessionBox: sessionBoxBound } : {}), hookTimeoutMs, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}), ...(shellReadCheck !== undefined ? { shellReadCheck } : {}), ...(toolDisclosureSeat !== undefined ? { toolDisclosure: toolDisclosureSeat } : {}), ...(approvedCallScreen !== undefined ? { approvedCallScreen } : {}) });
         rollback.commit();

package/dist/core/runner/prepare-turn-wiring.d.ts

@@ -6,7 +6,8 @@ import type { EpochDeclaredSections } from "../../prompt-assembly/epoch.js";
 import { type TurnPromptSnapshot } from "../../prompt-assembly/turn-snapshot.js";
 import type { PromptTextDeclaration } from "../../prompts/default.js";
 import { CacheBreakDetector, type ToolFingerprintInput } from "../cache-break-detector.js";
-import { type ToolPolicy } from "../tool-policy.js";
+import type { ToolPolicy } from "../tool-policy.js";
+import { type SyntheticReadJudge } from "../synthetic-read-verdict.js";
 import type { RunnerDeps, TaskSpec } from "../types.js";
 import type { CwdRef } from "../../tools/fs/fs-shared.js";
 import { type ContainmentFace } from "../../tools/fs/index.js";
@@ -78,10 +79,19 @@ export interface PrepareTurnWiringInput {
     /** borrowed-mutable — the live read-file state, or undefined. Writers here, at RUN time: `detectExternalChanges` evicts a
      *  not-found entry; `onCompactionApplied` applies a landed compaction to it. The hands phase mints it. */
     readFileStateForCheckpoint: ReadFileState | undefined;
-    /** borrowed-readonly — the deny-narrowing fold, or undefined (one of the changed-files deny door's two authorities). */
+    /** borrowed-readonly — the deny-narrowing fold, or undefined (a layer of the synthetic-Read judge). */
     denyNarrowingPolicy: ToolPolicy | undefined;
-    /** borrowed-readonly — the skill lane: the run's skill deny rows (the deny door's other authority; only `denying` is read). */
+    /** borrowed-readonly — the skill lane: the run's skill deny rows (a layer of the judge; only `denying` is read). */
     skillGrants: Prepared["skillGrants"];
+    /** borrowed-readonly — the deployment's caller policy as resolved through the lock layer, or undefined (a layer of the
+     *  judge, consulted with an aborted signal — never an approver). */
+    callerPolicy: ToolPolicy | undefined;
+    /** borrowed-readonly — each live inherited parent policy (a layer of the judge, consulted like the caller policy). */
+    inheritedPolicies: readonly ToolPolicy[];
+    /** borrowed-readonly — the person's persisted-rule lane, or undefined (a layer of the judge). */
+    persistedRuleLane: Prepared["persistedRuleLane"];
+    /** borrowed-readonly — the org rule lane, or undefined (a layer of the judge). */
+    orgRuleLane: Prepared["permissionRuleOrg"];
     /** borrowed-readonly — the run's abort controller; only `signal` (the deny door's and the stat's signal). */
     abortController: Pick<AbortController, "signal">;
     /** borrowed-readonly — the per-task identity (the background listing's owner). */
@@ -142,6 +152,9 @@ export interface PrepareTurnWiringResult {
     onCompactionApplied: Prepared["onCompactionApplied"];
     /** owned — the boundary-time changed-files scan, or undefined without read state. */
     detectExternalChanges: Prepared["detectExternalChanges"];
+    /** owned — the run's ONE synthetic-Read deny judge over every layer that can refuse a model's `Read` (the
+     *  changed-files door reads it; a face that delivers a file the model did not ask for reads the same one). */
+    syntheticReadVerdict: SyntheticReadJudge;
     /** owned — the post-compact background-task listing (`Prepared.listBackgroundTasks`). */
     listBackgroundTasks: Prepared["listBackgroundTasks"];
     /** owned — the compaction-boundary center adoption candidate, or undefined (no source, or no adoption). */

package/dist/core/runner/prepare-turn-wiring.js

@@ -4,7 +4,8 @@ import { artifactDeclarations } from "../../prompt-assembly/artifact.js";
 import { buildTurnPromptSnapshot } from "../../prompt-assembly/turn-snapshot.js";
 import { CacheBreakDetector, toolsToFingerprintInputs } from "../cache-break-detector.js";
 import { defaultTaskRegistry } from "../task-registry.js";
-import { refuseOutOfContractDecision } from "../tool-policy.js";
+import { createSyntheticReadJudge } from "../synthetic-read-verdict.js";
+import { ORG_ADJUDICATION_TIMEOUT_MS } from "../permission-rule-org.js";
 import { decodeTextBytes } from "../../tools/fs/encoding.js";
 import { applyContextShrinkToReadFileState, isReadDedupStubResult } from "../../tools/fs/index.js";
 import { resolveKey } from "../../tools/fs/safety.js";
@@ -12,7 +13,7 @@ import { PROMPT_HASH_SALT } from "./prompt-hash-salt.js";
 import { CHANGED_FILES_MTIME_EPS_MS } from "./turn-attachments.js";
 import { thrownText } from "../thrown-value.js";
 export function prepareTurnWiring(input) {
-    const { deps, systemPromptSeat, harnessTools, fpRef, model, epochArtifactDigestForSnapshot, promptProfile, fableMitigations, systemBlocks, thinking, spec, sessionId, turnSnapshotRef, promptManifest, charsPerToken, handsEnabled, executionEnv, attachmentRootCanonical, additionalRootsCanonical, additionalReadRootsCanonical, readDenyMatcher, resolvedReadFace, handsCwdRef, readFileStateForCheckpoint, denyNarrowingPolicy, skillGrants, abortController, hostTaskId, taskScope, buildAssembleInputs, centerAdoptionRef, harnessRef, epochDeclaredSections, carrierReadFace, carrierWriteFace, readDenyAdditionsNormalized, preparedHolder } = input;
+    const { deps, systemPromptSeat, harnessTools, fpRef, model, epochArtifactDigestForSnapshot, promptProfile, fableMitigations, systemBlocks, thinking, spec, sessionId, turnSnapshotRef, promptManifest, charsPerToken, handsEnabled, executionEnv, attachmentRootCanonical, additionalRootsCanonical, additionalReadRootsCanonical, readDenyMatcher, resolvedReadFace, handsCwdRef, readFileStateForCheckpoint, denyNarrowingPolicy, skillGrants, callerPolicy, inheritedPolicies, persistedRuleLane, orgRuleLane, abortController, hostTaskId, taskScope, buildAssembleInputs, centerAdoptionRef, harnessRef, epochDeclaredSections, carrierReadFace, carrierWriteFace, readDenyAdditionsNormalized, preparedHolder } = input;
     const cacheBreakDetector = deps.cacheBreakDetection === false ? undefined : new CacheBreakDetector();
     const cacheFingerprint = cacheBreakDetector
         ? { systemPrompt: systemPromptSeat.current, tools: toolsToFingerprintInputs(harnessTools) }
@@ -101,19 +102,18 @@ export function prepareTurnWiring(input) {
     const onCompactionApplied = handsEnabled && readFileStateForCheckpoint
         ? (attachedComplete, preserveReadState) => applyContextShrinkToReadFileState(readFileStateForCheckpoint, { kind: "summarized", attachedComplete, ...(preserveReadState !== undefined ? { preserveKeys: preserveReadState } : {}) })
         : undefined;
-    const changedFilesReadDenied = async (path) => {
-        const probe = { toolName: "Read", args: { file_path: path }, toolCallId: "changed-files-visibility-probe" };
-        if (skillGrants.denying(probe) !== undefined)
-            return true;
-        if (denyNarrowingPolicy === undefined)
-            return false;
-        try {
-            const d = refuseOutOfContractDecision(await denyNarrowingPolicy.check(probe, abortController.signal));
-            return d.action === "deny";
-        }
-        catch {
-            return false;
-        }
+    const syntheticReadVerdict = createSyntheticReadJudge({
+        skillGrants,
+        ...(denyNarrowingPolicy !== undefined ? { denyNarrowingPolicy } : {}),
+        ...(callerPolicy !== undefined ? { callerPolicy } : {}),
+        inheritedPolicies,
+        ...(persistedRuleLane !== undefined ? { persistedRuleLane } : {}),
+        ...(orgRuleLane !== undefined ? { orgRuleLane } : {}),
+        signal: abortController.signal,
+    });
+    const changedFilesReadDenied = async (paths) => {
+        const deadlineAt = Date.now() + ORG_ADJUDICATION_TIMEOUT_MS;
+        return Promise.all(paths.map(async (path) => (await syntheticReadVerdict({ file_path: path }, "changed-files", { deadlineAt })).verdict === "deny"));
     };
     const detectExternalChanges = handsEnabled && readFileStateForCheckpoint
         ? async (maxFiles) => {
@@ -124,8 +124,9 @@ export function prepareTurnWiring(input) {
                 .slice(0, Math.max(0, maxFiles));
             const changed = [];
             const evicted = [];
-            for (const [path, entry] of candidates) {
-                if (await changedFilesReadDenied(path))
+            const denied = await changedFilesReadDenied(candidates.map(([path]) => path));
+            for (const [i, [path, entry]] of candidates.entries()) {
+                if (denied[i] === true)
                     continue;
                 try {
                     const info = await executionEnv.fileInfo(path, abortController.signal);
@@ -202,5 +203,5 @@ export function prepareTurnWiring(input) {
     const effectiveReadFaceObserved = carrierReadFace();
     const effectiveWriteFaceObserved = carrierWriteFace();
     const effectiveReadDenyObserved = readDenyAdditionsNormalized.length > 0 ? readDenyAdditionsNormalized.map((e) => ({ ...e })) : undefined;
-    return { cacheBreakDetector, cacheFingerprint, promptOverheadTokens, readTaskFile, normalizeAttachmentPath, isDedupStubResult, recentlyReadFiles, onCompactionApplied, detectExternalChanges, listBackgroundTasks, centerCompactionCandidate, effectiveReadFaceObserved, effectiveWriteFaceObserved, effectiveReadDenyObserved };
+    return { cacheBreakDetector, cacheFingerprint, promptOverheadTokens, readTaskFile, normalizeAttachmentPath, isDedupStubResult, recentlyReadFiles, onCompactionApplied, detectExternalChanges, syntheticReadVerdict, listBackgroundTasks, centerCompactionCandidate, effectiveReadFaceObserved, effectiveWriteFaceObserved, effectiveReadDenyObserved };
 }

package/dist/core/runner/run-leg.js

@@ -2,7 +2,7 @@ import { snapshotActorAssertion } from "../../internal/llm.js";
 import { redactThenCut } from "../../agents/subagent-steps.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "../ask-question.js";
 import { CheckpointError, readPendingSteerQueue, realApprovalOrgFact, remainingBudgetMicroUsd } from "../checkpoint-store.js";
-import { normalizePersistedRuleHit } from "../gate-lanes.js";
+import { normalizePersistedRuleHit } from "../rule-lane-reads.js";
 import { decidersNote, SETTLEMENT_NOBODY_JUDGED } from "../gate-outcome.js";
 import { formatHookFeedback, hookSeatExpiredError, runHookSeat } from "../hooks.js";
 import { buildAppliedHumanInputEvent, buildHumanInputEvent, projectHumanInput } from "../human-input-projection.js";

package/dist/core/runner/runtask.js

@@ -1,4 +1,5 @@
 import { deliverEngineNotice } from "../types.js";
+import { withDeploymentAllowedTools } from "../allow-entry.js";
 import { uuidv7 } from "../../internal/harness.js";
 import { snapshotActorAssertion } from "../../internal/llm.js";
 import { CheckpointError } from "../checkpoint-store.js";
@@ -77,7 +78,7 @@ export class Runner {
         assertNoRetiredRunnerDeps(deps);
         const runner = this;
         this.depsSeat = { get deps() { return runner.deps; } };
-        this.deps = deps;
+        this.deps = withDeploymentAllowedTools(deps);
         if (this.deps.tiers) {
             this.deps = { ...this.deps, models: expandTiers(this.deps.models, this.deps.tiers) };
         }

package/dist/core/runner-deps.d.ts

@@ -609,6 +609,17 @@ export interface RunnerDeps {
      * adopted principal's bucket forever.
      */
     localOwnerRules?: boolean;
+    /**
+     * The DEPLOYMENT's allow rules — standing yeses its operator writes for every run of this Runner, in the grammar of
+     * {@link import("./task-spec.js").TaskSpec.allowedTools} (the same compiler, matcher and auto-mode strip). One of the allow
+     * layer's members, read beside the request's list, a person's stored rules and a skill's list under one predicate: deny
+     * and ask rules still win, a question no allow rule clears is still put to a person (the entry disclosed as the
+     * deployment's), and a call it clears is attributed to it (`decisionReason: "deployment_rule"`). Lives for the Runner —
+     * read once at construction: a value that is not a list of strings refuses construction (`config.invalid_permission_rules`,
+     * with its issues), and the entries that read as nothing are announced once, when the Runner is built
+     * (`permission.allowed_tool_not_granted`, `detail.entries[].source: "deployment"`).
+     */
+    allowedTools?: readonly string[];
     /**
      * design/182 §9 — DECLARE that this deployment drives cloud sync (`syncPermissionRules`) for the
      * wired rule store. Purely a disclosure input: it is reported as `permissionRules.syncWired` on the

package/dist/core/skill-grant.d.ts

@@ -1,9 +1,8 @@
 import type { PermissionResult, ToolCallRequest } from "./tool-policy.js";
-import { type PersistedRule } from "./permission-rule-model.js";
 import type { PermissionMode } from "./ask-origin.js";
 import { type PermissionSeatInputs, type PermissionSeatReading } from "./mode-policy.js";
 import type { AgentTool } from "../internal/harness-types.js";
-import type { EngineNotice } from "./engine-notice.js";
+import { type AllowEntryGateSeats, type AllowEntryInertReason, type AllowEntryJudgeContext, type CompiledAllowEntry } from "./allow-entry.js";
 /** Who wrote a row: the `Skill` tool on a successful activation, prepare for a skill the person invoked by name, or a
  *  delegated child's seed from its parent. */
 export declare const SKILL_GRANT_ORIGINS: readonly ["model", "user", "inherited"];
@@ -17,45 +16,20 @@ export interface SkillGrantRecord {
     readonly entry: string;
     readonly origin?: SkillGrantOrigin;
 }
-/** Why an entry grants (or refuses) nothing — the closed set the start-of-run notice names. */
-export declare const SKILL_ENTRY_INERT_REASONS: readonly ["wildcard_all", "namespace_wildcard", "path_pattern", "domain", "content_unsupported", "grammar"];
-export type SkillEntryInertReason = (typeof SKILL_ENTRY_INERT_REASONS)[number];
-/** One entry the grammar reads (kind closed): a whole non-shell tool; a protocol namespace; the whole shell tool; a shell
- *  command rule (`interpreter` = an interpreter-headed open prefix); the Read directory form; a deny-side path pattern. */
-type CompiledEntry = {
-    readonly kind: "tool";
-    readonly name: string;
-} | {
-    readonly kind: "namespace";
-    readonly pattern: string;
-} | {
-    readonly kind: "shell";
-    readonly name: string;
-} | {
-    readonly kind: "command";
-    readonly rule: PersistedRule;
-    readonly interpreter: boolean;
-} | {
-    readonly kind: "read_dir";
-    readonly rule: PersistedRule;
-} | {
-    readonly kind: "path";
-    readonly rule: PersistedRule;
-};
 /** One row of the table. */
 export interface SkillGrantRow {
     readonly skill: string;
     readonly origin: SkillGrantOrigin;
     readonly behavior: "allow" | "deny";
     readonly entry: string;
-    readonly compiled: CompiledEntry;
+    readonly compiled: CompiledAllowEntry;
 }
 /** An entry the grammar reads as granting or refusing nothing. */
 export interface SkillInertEntry {
     readonly skill: string;
     readonly list: "allowed-tools" | "disallowed-tools";
     readonly entry: string;
-    readonly reason: SkillEntryInertReason;
+    readonly reason: AllowEntryInertReason;
 }
 /** The two lists a skill declares (the shape of a `SkillSpec`, read by name). */
 export interface SkillGrantSource {
@@ -120,13 +94,6 @@ export declare function compileSkillGrant(skill: SkillGrantSource, origin: Skill
     rows: SkillGrantRow[];
     inert: SkillInertEntry[];
 };
-/** The call facts a content row is judged against — the persisted lane's own bases. */
-export interface SkillGrantJudgeContext {
-    readonly root: string | undefined;
-    readonly sessionId: string | undefined;
-    readonly liveCwd: () => string | undefined;
-    readonly home: string | undefined;
-}
 /** What spoke for a call: the skill and the entries it stands on. */
 export interface SkillGrantHit {
     readonly skill: string;
@@ -178,7 +145,7 @@ export declare function skillSeatReader(skills: readonly SkillGrantSource[]): Sk
 /**
  * The gate's seat inputs for one call, composed in ONE place: the mounted instance's static seat (`calledName`), the `Skill`
  * tool's per-call reader in the leg's live mode (only when the call's wire name is the engine's `Skill` — `skillToolName`),
- * and the run's skill rows with their attribution sink.
+ * the run's skill rows with their attribution sink, and the request's and the deployment's entry lists with theirs.
  */
 export declare function skillGateWiring(opts: {
     tools: readonly AgentTool[];
@@ -187,7 +154,9 @@ export declare function skillGateWiring(opts: {
     mode: () => PermissionMode | undefined;
     lane: SkillGrantLane;
     onAllowed: NonNullable<SkillGateSeats["skillGrants"]>["onAllowed"];
-}): (calledName: string, wireName: string) => PermissionSeatInputs & SkillGateSeats;
+    /** The two entry lists that are not a skill's (the request's, the deployment's), with their attribution sinks. */
+    allowEntries: AllowEntryGateSeats;
+}): (calledName: string, wireName: string) => PermissionSeatInputs & SkillGateSeats & AllowEntryGateSeats;
 /**
  * Seed a task's table at prepare, before any call is gated: the rows from outside this leg's own writers (`inherited` — a
  * parent's capture, held until this child ends, and a resumed leg's frozen rows, which keep the word `model` where the
@@ -217,7 +186,7 @@ export declare class SkillGrantTable {
     /** The rows as portable records (a copy). */
     records(): readonly SkillGrantRecord[];
     /** The lane over this table, bound to the leg's call facts. */
-    lane(ctx: SkillGrantJudgeContext): SkillGrantLane;
+    lane(ctx: AllowEntryJudgeContext): SkillGrantLane;
 }
 /** Read a delegated child's capture ({@link readCarriedRecords}): `undefined` refuses the delegation. */
 export declare function readSkillGrantCapture(snapshot: readonly unknown[] | undefined): readonly SkillGrantRecord[] | undefined;
@@ -227,13 +196,5 @@ export declare function frozenSkillGrants(table: Pick<SkillGrantTable, "records"
 /** Read a park's frozen section ({@link readCarriedRecords}): absent ⇒ none; `undefined` ⇒ damaged — the resume refuses
  *  it before the claim and prepare never seeds from it. */
 export declare function readFrozenSkillGrants(section: unknown): readonly SkillGrantRecord[] | undefined;
-/** The start-of-run notice for entries that grant (or refuse) nothing. */
-export declare const SKILL_ENTRY_NOT_GRANTED_CODE = "skills.allowed_tool_not_granted";
 /** The refusal for a `TaskSpec.userInvokedSkills` name the run does not carry (or a value that is not a list of names). */
 export declare const USER_INVOKED_SKILL_UNKNOWN_CODE = "config.user_invoked_skill_unknown";
-/**
- * The notice for entries this grammar reads as nothing — one per prepared task, delivered only when one exists. The
- * deployment's operator owns the skill files; the run goes on (an entry that grants nothing makes it ask more).
- */
-export declare function skillEntriesNotGrantedNotice(inert: readonly SkillInertEntry[], sessionId: string): EngineNotice;
-export {};

package/dist/core/skill-grant.js

@@ -1,15 +1,11 @@
-import { heldBy, wireOf } from "./tool-name-readings.js";
-import { isNamespacedCoveringRuleName, namespacedRuleNameCovers, parsePermissionRule } from "./permission-rules.js";
-import { protocolOf } from "./protocol-table.js";
-import { COARSE_SHELL_TOOLS } from "./tool-policy.js";
-import { COMMAND_RULE_TOOL, READ_RULE_TOOL, findAdmittingRule, laneToolNamesOf, parseRuleText, programRunReachOf, ruleToolGrammarOf } from "./permission-rule-model.js";
-import { pathRuleLaneAnswer } from "./runner/permission-rule-lanes.js";
+import { wireOf } from "./tool-name-readings.js";
+import { parsePermissionRule } from "./permission-rules.js";
 import { mountedToolPermissionSeat } from "./mode-policy.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 import { boundInputHashOf } from "./canonical-json.js";
+import { allowingRows, autoStripped, compileAllowEntry, compileAllowList, judgeAllowEntries } from "./allow-entry.js";
 export const SKILL_GRANT_ORIGINS = Object.freeze(["model", "user", "inherited"]);
 const FROZEN_SKILL_GRANT_ORIGINS = new Set(["model", "inherited"]);
-export const SKILL_ENTRY_INERT_REASONS = Object.freeze(["wildcard_all", "namespace_wildcard", "path_pattern", "domain", "content_unsupported", "grammar"]);
 export function skillNamedBy(args, skills) {
     const named = args?.skill;
     return typeof named === "string" ? skills.find((s) => s.name === named) : undefined;
@@ -47,50 +43,6 @@ export function detachSkillLists(skills) {
 export function declaresSkillLists(skill) {
     return (skill.allowedTools?.length ?? 0) > 0 || (skill.disallowedTools?.length ?? 0) > 0;
 }
-function ruleRowOf(parsed) {
-    return { ...parsed, scope: { kind: "global" }, adds: [{ dot: { actor: "skill", counter: 1 }, origin: "user", createdAt: "" }] };
-}
-function compileEntry(raw, behavior) {
-    const parsed = parsePermissionRule(raw);
-    const name = parsed.toolName;
-    if (name === "*")
-        return "wildcard_all";
-    if (parsed.ruleContent === undefined) {
-        const ns = protocolOf(name);
-        if (ns !== undefined) {
-            if (name.slice(ns.prefix.length).split("__")[0]?.includes("*") === true)
-                return "namespace_wildcard";
-            if (isNamespacedCoveringRuleName(name))
-                return { kind: "namespace", pattern: name };
-            return { kind: "tool", name };
-        }
-        return COARSE_SHELL_TOOLS.includes(name) ? { kind: "shell", name } : { kind: "tool", name };
-    }
-    if (name === COMMAND_RULE_TOOL) {
-        const allowRead = parseRuleText(raw, behavior);
-        if ("rule" in allowRead)
-            return { kind: "command", rule: ruleRowOf(allowRead.rule), interpreter: false };
-        if (behavior === "allow" && allowRead.reject.code === "invalid.bare_interpreter_prefix") {
-            const wide = parseRuleText(raw, "deny");
-            if ("rule" in wide)
-                return { kind: "command", rule: ruleRowOf({ ...wide.rule, behavior: "allow" }), interpreter: true };
-        }
-        return "grammar";
-    }
-    if (ruleToolGrammarOf(name) === "path") {
-        const read = parseRuleText(raw, behavior);
-        if ("rule" in read) {
-            if (read.rule.match === "subpath" && read.rule.tool === READ_RULE_TOOL && behavior === "allow")
-                return { kind: "read_dir", rule: ruleRowOf(read.rule) };
-            if (behavior === "deny")
-                return { kind: "path", rule: ruleRowOf(read.rule) };
-        }
-        return "path_pattern";
-    }
-    if (/^domain:/.test(parsed.ruleContent))
-        return "domain";
-    return "content_unsupported";
-}
 export function compileSkillGrant(skill, origin) {
     const rows = [];
     const inert = [];
@@ -98,79 +50,17 @@ export function compileSkillGrant(skill, origin) {
         ["allowed-tools", "allow", skill.allowedTools ?? []],
         ["disallowed-tools", "deny", skill.disallowedTools ?? []],
     ]) {
-        const voided = behavior === "allow" && entries.some((e) => parsePermissionRule(e).toolName === "*");
-        for (const entry of entries) {
-            const compiled = voided ? "wildcard_all" : compileEntry(entry, behavior);
-            if (typeof compiled === "string")
-                inert.push({ skill: skill.name, list, entry, reason: compiled });
-            else
-                rows.push({ skill: skill.name, origin, behavior, entry, compiled });
-        }
+        const compiled = compileAllowList(entries, behavior);
+        for (const r of compiled.rows)
+            rows.push({ skill: skill.name, origin, behavior, entry: r.entry, compiled: r.compiled });
+        for (const i of compiled.inert)
+            inert.push({ skill: skill.name, list, entry: i.entry, reason: i.reason });
     }
     return { rows, inert };
 }
-function standsDownIn(row, mode, req) {
-    if (mode !== "auto")
-        return false;
-    if (row.compiled.kind === "shell" || (row.compiled.kind === "command" && row.compiled.interpreter))
-        return true;
-    return row.compiled.kind === "tool" && req !== undefined && answersTo(req, (n) => COARSE_SHELL_TOOLS.includes(n));
-}
-function answersTo(req, has) {
-    return heldBy("skillGrant.names", { has }, req);
-}
-function nameRowReaches(compiled, req) {
-    const covers = compiled.kind === "namespace" ? (n) => namespacedRuleNameCovers(compiled.pattern, n) : compiled.kind === "tool" || compiled.kind === "shell" ? (n) => n === compiled.name : undefined;
-    return covers !== undefined && answersTo(req, covers);
-}
-function commandOf(req) {
-    const tool = laneToolNamesOf(req).find((n) => ruleToolGrammarOf(n) === "command");
-    const command = req.args?.command;
-    return tool !== undefined && typeof command === "string" ? { tool, command } : undefined;
-}
 function judge(rows, req, behavior, ctx) {
-    const live = rows.filter((r) => r.behavior === behavior);
-    if (live.length === 0)
-        return undefined;
-    for (const row of live)
-        if (nameRowReaches(row.compiled, req))
-            return { skill: row.skill, entries: [row.entry] };
-    const call = commandOf(req);
-    const liveCwd = ctx.liveCwd();
-    if (call !== undefined) {
-        const byRule = new Map();
-        for (const r of live)
-            if (r.compiled.kind === "command")
-                byRule.set(r.compiled.rule, r);
-        if (behavior === "allow") {
-            const covering = findAdmittingRule([...byRule.keys()], { tool: call.tool, command: call.command, cwd: ctx.root, ...(ctx.sessionId !== undefined ? { sessionId: ctx.sessionId } : {}), ...(liveCwd !== undefined ? { execCwd: liveCwd } : {}) });
-            const hits = (covering ?? []).flatMap((rule) => byRule.get(rule) ?? []);
-            const first = hits[0];
-            if (first !== undefined)
-                return { skill: first.skill, entries: hits.map((r) => r.entry) };
-        }
-        else {
-            for (const [rule, row] of byRule) {
-                if (programRunReachOf(rule, call.command).reach !== "not_reached")
-                    return { skill: row.skill, entries: [row.entry] };
-            }
-        }
-    }
-    const pathKind = behavior === "allow" ? "read_dir" : "path";
-    const pathRows = live.filter((r) => r.compiled.kind === pathKind);
-    if (pathRows.length > 0) {
-        const table = pathRows.map((r) => r.compiled.rule);
-        for (const name of laneToolNamesOf(req).filter((n) => ruleToolGrammarOf(n) === "path")) {
-            const answer = pathRuleLaneAnswer(table, { ...req, toolName: name }, { root: ctx.root, sessionId: ctx.sessionId, liveCwd, home: ctx.home });
-            const spoke = answer !== undefined && ("unreadable" in answer ? behavior === "deny" : "behavior" in answer && answer.behavior === behavior);
-            if (spoke) {
-                const rule = answer !== undefined && "rules" in answer ? answer.rules[0]?.rule : undefined;
-                const row = pathRows.find((r) => r.compiled.rule.rule === rule) ?? pathRows[0];
-                return { skill: row.skill, entries: [row.entry] };
-            }
-        }
-    }
-    return undefined;
+    const hit = judgeAllowEntries(rows, req, behavior, ctx);
+    return hit === undefined || hit[0] === undefined ? undefined : { skill: hit[0].skill, entries: hit.map((r) => r.entry) };
 }
 export function skillDenyDecision(hit) {
     return {
@@ -195,7 +85,7 @@ const CARD_ENTRIES_MAX = 10;
 const CARD_ENTRY_MAX_CHARS = 120;
 export function skillActivationQuestion(skill, mode) {
     const head = `Execute skill: ${inlineUntrusted(skill.name, 200)}`;
-    const granting = compileSkillGrant(skill, "model").rows.filter((r) => r.behavior === "allow" && !standsDownIn(r, mode));
+    const granting = compileSkillGrant(skill, "model").rows.filter((r) => r.behavior === "allow" && !(mode === "auto" && autoStripped(r.compiled, undefined)));
     if (granting.length === 0)
         return head;
     const shown = granting.slice(0, CARD_ENTRIES_MAX).map((r) => inlineUntrusted(r.entry, CARD_ENTRY_MAX_CHARS));
@@ -216,6 +106,7 @@ export function skillGateWiring(opts) {
         ...(mountedToolPermissionSeat(opts.tools, calledName) === "passthrough" ? { permissionSeat: "passthrough" } : {}),
         ...(opts.seatOf !== undefined && wireName === opts.skillToolName ? { permissionSeatOf: (args) => opts.seatOf?.(args, opts.mode()) } : {}),
         skillGrants,
+        ...opts.allowEntries,
     });
 }
 export function seedSkillGrants(table, opts) {
@@ -248,7 +139,7 @@ export class SkillGrantTable {
     }
     seed(records, origin) {
         for (const r of records) {
-            const compiled = compileEntry(r.entry, r.behavior);
+            const compiled = compileAllowEntry(r.entry, r.behavior);
             if (typeof compiled === "string")
                 continue;
             this.hold({ skill: r.skill, origin: r.origin === "model" ? "model" : origin, behavior: r.behavior, entry: r.entry, compiled });
@@ -259,7 +150,7 @@ export class SkillGrantTable {
     }
     lane(ctx) {
         return {
-            allowing: (req, mode) => judge(this.rowsHeld.filter((r) => !standsDownIn(r, mode, req)), req, "allow", ctx),
+            allowing: (req, mode) => judge(allowingRows(this.rowsHeld, req, mode), req, "allow", ctx),
             denying: (req) => judge(this.rowsHeld, req, "deny", ctx),
         };
     }
@@ -276,7 +167,7 @@ function readCarriedRecords(raw, carrier) {
         const { skill, behavior, entry, origin } = r;
         if (typeof skill !== "string" || typeof entry !== "string" || (behavior !== "allow" && behavior !== "deny"))
             return undefined;
-        if (typeof compileEntry(entry, behavior) === "string")
+        if (typeof compileAllowEntry(entry, behavior) === "string")
             return undefined;
         if (carrier === "capture") {
             out.push({ skill, behavior, entry });
@@ -298,16 +189,4 @@ export function frozenSkillGrants(table) {
 export function readFrozenSkillGrants(section) {
     return readCarriedRecords(section, "frozen");
 }
-export const SKILL_ENTRY_NOT_GRANTED_CODE = "skills.allowed_tool_not_granted";
 export const USER_INVOKED_SKILL_UNKNOWN_CODE = "config.user_invoked_skill_unknown";
-const NOTICE_ENTRIES_SHOWN = 5;
-export function skillEntriesNotGrantedNotice(inert, sessionId) {
-    const shown = inert.slice(0, NOTICE_ENTRIES_SHOWN).map((e) => `${inlineUntrusted(e.skill, 80)}: ${e.list} "${inlineUntrusted(e.entry, 120)}" (${e.reason})`);
-    const rest = inert.length - shown.length;
-    return {
-        code: SKILL_ENTRY_NOT_GRANTED_CODE,
-        message: `${inert.length} skill list entr${inert.length === 1 ? "y grants" : "ies grant"} or refuse${inert.length === 1 ? "s" : ""} nothing — ${shown.join("; ")}${rest > 0 ? `; and ${rest} more` : ""}. ` +
-            "An allowed-tools list holding `*` voids the list, `mcp__*` names no server, and a write-path or domain entry has no allow reading; name the tools (or `mcp__<server>`) instead.",
-        detail: { sessionId, entries: inert.map((e) => ({ skill: e.skill, list: e.list, entry: e.entry, reason: e.reason })) },
-    };
-}