@sema-agent/core 7.42.1 → 7.43.0

package/dist/core/permission-rule-model.js

@@ -37,14 +37,29 @@ export function callPathFaceOf(call) {
 export function faceAskSpeaksFor(face) {
     return face !== undefined && Object.values(PATH_RULE_FACES).some((columns) => columns.ask?.includes(face) === true);
 }
+export const NAME_RULE_FACES = Object.freeze({
+    Skill: Object.freeze({ param: "skill", params: Object.freeze(["skill", "args"]) }),
+});
 export function ruleToolGrammarOf(toolName) {
     if (toolName === COMMAND_RULE_TOOL)
         return "command";
+    if (Object.hasOwn(NAME_RULE_FACES, toolName))
+        return "name";
     return pathTargetOf(toolName) !== undefined ? "path" : undefined;
 }
+export function nameRuleSubjectOf(toolName, args) {
+    const face = Object.hasOwn(NAME_RULE_FACES, toolName) ? NAME_RULE_FACES[toolName] : undefined;
+    if (face === undefined || typeof args !== "object" || args === null || Array.isArray(args) || !Object.hasOwn(args, face.param))
+        return undefined;
+    const value = args[face.param];
+    return typeof value === "string" ? value : undefined;
+}
 export function laneToolNamesOf(req) {
     return heldValues("policy.persistedGrammar", { get: (n) => (ruleToolGrammarOf(n) !== undefined ? n : undefined) }, req);
 }
+function isCommandMatch(match) {
+    return match === "exact" || match === "prefix" || match === "wildcard";
+}
 export const MAX_RULE_TEXT_CHARS = 512;
 export const BARE_INTERPRETER_NAMES = new Set([
     "node", "deno", "bun", "python", "python2", "python3", "perl", "ruby", "php", "osascript",
@@ -247,8 +262,11 @@ export function parseRuleText(text, behavior) {
         return reject("invalid.grammar", `"${text}" is not a Tool(content) rule — a bare tool name claims the whole tool and is not a command rule`);
     }
     if (parsed.toolName !== COMMAND_RULE_TOOL) {
-        if (ruleToolGrammarOf(parsed.toolName) !== "path") {
-            return reject("unsupported.tool", `only Bash command rules and rules on path-targeting tools (Read, Edit, Write, …) have a rule form in this version (got "${parsed.toolName}")`);
+        const grammar = ruleToolGrammarOf(parsed.toolName);
+        if (grammar === "name")
+            return parseNameRuleContent(text, parsed.toolName, parsed.ruleContent, behavior);
+        if (grammar !== "path") {
+            return reject("unsupported.tool", `only Bash command rules, rules on path-targeting tools (Read, Edit, Write, …) and Skill name rules have a rule form in this version (got "${parsed.toolName}")`);
         }
         return parsePathRuleContent(text, parsed.toolName, parsed.ruleContent, behavior);
     }
@@ -303,9 +321,46 @@ export function parseRuleText(text, behavior) {
 export function formatRuleText(command, match, tool) {
     if (match === "subpath")
         return `${tool}(//${command.startsWith("/") ? command.slice(1) : command}/**)`;
-    if (match === "path")
+    if (match === "path" || match === "name")
         return `${tool}(${command})`;
-    return `${tool}(${command}${match === "prefix" ? ":*" : match === "wildcard" ? " *" : ""})`;
+    return `${tool}(${command}${match === "prefix" || match === "name_prefix" ? ":*" : match === "wildcard" ? " *" : ""})`;
+}
+function parseNameRuleContent(text, tool, content, behavior, verifyCanonical = true) {
+    const face = NAME_RULE_FACES[tool];
+    const bare = content.startsWith("/") ? content.slice(1) : content;
+    const colon = bare.indexOf(":");
+    if (face !== undefined && colon > 0 && face.params.includes(bare.slice(0, colon).trim())) {
+        return reject("invalid.grammar", `"${text}" is the parameter spelling, which a ${tool} rule no longer has — a ${tool} rule names the ${face.param} itself: ${tool}(<name>) for one, ${tool}(<name>:*) for every ${face.param} whose name begins with <name>`);
+    }
+    const open = bare.endsWith(":*") || bare.endsWith(" *");
+    const body = open ? bare.slice(0, -2) : bare;
+    const match = open ? "name_prefix" : "name";
+    if (body === "" || body.trim() !== body) {
+        return reject("invalid.grammar", `the name in "${text}" is empty or carries surrounding whitespace — a ${tool} rule names the ${face?.param ?? "name"} exactly as it is spelled, so the spelling must be the one meant`);
+    }
+    if (body.includes("*")) {
+        return reject("unsupported.wildcard", `a \`*\` inside the name of "${text}" matches anything at that position, which has no rule form — only the trailing \`<name>:*\` prefix form does`);
+    }
+    const canonical = formatRuleText(body, match, tool);
+    const back = parsePermissionRule(canonical);
+    if (back.toolName !== tool || back.ruleContent !== (open ? `${body}:*` : body)) {
+        return reject("invalid.grammar", `the name in "${text}" has no spelling the rule syntax reads back (a backslash or an unbalanced parenthesis) — no ${tool} rule can name it`);
+    }
+    const rule = { behavior, rule: canonical, tool, match, command: body };
+    if (verifyCanonical) {
+        const again = parseNameRuleContent(canonical, tool, back.ruleContent, behavior, false);
+        if (!("rule" in again) || again.rule.rule !== canonical || again.rule.match !== match || again.rule.command !== body) {
+            return reject("invalid.grammar", `"${text}" has no canonical spelling that reads back as itself ("${canonical}" does not) — no ${tool} rule can name it exactly`);
+        }
+    }
+    return { rule };
+}
+export function nameRuleAdmits(rule, name) {
+    if (rule.match === "name")
+        return name === rule.command;
+    if (rule.match === "name_prefix")
+        return name.startsWith(rule.command);
+    return false;
 }
 function parsePathRuleContent(text, tool, content, behavior) {
     const dirForm = /^\/\/(.+)\/\*\*$/.exec(content);
@@ -508,7 +563,7 @@ export const PROGRAM_RUN_REACHES = Object.freeze(["reached", "not_reached", "unr
 const REACHED = { reach: "reached" };
 const NOT_REACHED = { reach: "not_reached" };
 export function programRunReachOf(rule, command) {
-    if (rule.match === "subpath" || rule.match === "path")
+    if (!isCommandMatch(rule.match))
         return NOT_REACHED;
     const body = readRuleBody(rule.command);
     if (body === undefined)
@@ -594,7 +649,7 @@ function readCommandMemo(command) {
     return lastRead.shape;
 }
 function admitsUnder(rule, command, reading) {
-    if (rule.match === "subpath" || rule.match === "path")
+    if (!isCommandMatch(rule.match))
         return false;
     const shape = ruleLaneShapeOf(command, reading);
     if ("reject" in shape)
@@ -894,6 +949,25 @@ export function adjudicatePersistedPathRules(rules, call, targets, bases) {
     }
     return undefined;
 }
+export function adjudicatePersistedNameRules(rules, call) {
+    if (call.name === undefined)
+        return undefined;
+    for (const behavior of RULE_BEHAVIORS_BY_PRECEDENCE) {
+        for (const rule of rules) {
+            if (eligiblePersisted(rule, call, behavior) && nameRuleAdmits(rule, call.name))
+                return { behavior, rules: [rule] };
+        }
+    }
+    return undefined;
+}
+export function suggestRuleForName(tool, name) {
+    if (ruleToolGrammarOf(tool) !== "name")
+        return undefined;
+    const parsed = parseRuleText(formatRuleText(name, "name", tool), "allow");
+    if (!("rule" in parsed) || parsed.rule.match !== "name" || parsed.rule.command !== name)
+        return undefined;
+    return { kind: "single", rule: parsed.rule.rule, match: "name", command: name };
+}
 export function segmentCoverageOf(command, rules, call) {
     const folded = foldSpacing(command);
     if (folded === undefined)

package/dist/core/permission-rules.d.ts

@@ -38,6 +38,11 @@
  * A `Read(...)` / `Edit(...)` deny or ask reaches the calls on its behavior's FACES (`PATH_RULE_FACES`), not only
  * its own tool: a `Read` ask asks for a Grep / Glob rooted in its path, judged on that call's own target.
  *
+ * The NAME lane is the same shape for the tools of `NAME_RULE_FACES` (the `Skill` tool): a `Skill(<name>)` / `Skill(<prefix>:*)`
+ * deny or ask — the reference's own spelling — compiles through the same validator (the model's name grammar) and is judged on the
+ * one string the call names (`nameRuleSubjectOf`) with `nameRuleAdmits`, the reader the persisted rule store uses. The parameter
+ * spelling `Skill(skill:<name>)` those tools used to take is retired: refused loudly, its sentence naming the CC form.
+ *
  * 🔴 与 CC 的有意差(design/127 r2):
  *  - CC 参数级 generic 道无 allow lane(gnn 只有 deny/ask)—— 我们同样,且整个 policy 无 allow 臂。
  *  - CC 对尾缀垃圾静默降级为裸名(Lh `n !== len-1`)—— `parsePermissionRule` 保持 CC parity,但
@@ -75,8 +80,9 @@ export interface PermissionRuleIssue {
     /** A `behavior` outside the closed set `deny | ask` (a JS caller's typo, an undefined member, a boxed string): refused —
      *  a rule that matched nothing because its verb was misspelled would be a deny that silently never fires. */
      | "invalid.behavior"
-    /** A content-form Bash deny/ask rule the ONE rule validator refuses (a redirection, a substitution, a
-     *  mid-pattern star, control characters…) — the message carries the validator's own code and sentence. */
+    /** A content-form deny/ask rule the ONE rule validator refuses — the shell's command grammar (a redirection, a substitution,
+     *  a mid-pattern star, control characters…), a path tool's path grammar, a name tool's name grammar (the retired parameter
+     *  spelling `Skill(skill:<name>)`, an empty name…) — the message carries the validator's own code and sentence. */
      | "invalid.command_rule"
     /** An `allowedTools` value (the request's `TaskSpec.allowedTools`, the deployment's `RunnerDeps.allowedTools`) that is
      *  not a list of strings: one issue for a non-list, one per element that is not a string (`rule` is empty — there is

package/dist/core/permission-rules.js

@@ -1,7 +1,8 @@
 import { MCP_NAMESPACE, protocolOf } from "./protocol-table.js";
+import { splitNamespacedName } from "./tool-name-aliases.js";
 import { catalogRuleFaceOf, pathTargetOf } from "./tool-registry.js";
 import { indexOfUnescaped, lastIndexOfUnescaped, parsePermissionRule } from "./permission-rule-syntax.js";
-import { PATH_RULE_BASE_LABEL, PATH_RULE_FACES, callPathFaceOf, isUsablePathBase, parseRuleText, pathRuleHeadOf, pathRuleReachOf, programRunReachOf, ruleBasesNeeded } from "./permission-rule-model.js";
+import { NAME_RULE_FACES, PATH_RULE_BASE_LABEL, PATH_RULE_FACES, callPathFaceOf, isUsablePathBase, nameRuleAdmits, nameRuleSubjectOf, parseRuleText, pathRuleHeadOf, pathRuleReachOf, programRunReachOf, ruleBasesNeeded, ruleToolGrammarOf } from "./permission-rule-model.js";
 import { pathFamilyOf, pathIdentityOf, spellingOfIdentity } from "../tools/fs/safety.js";
 import { effectivePathTargetOf } from "./effective-path-target.js";
 import { protectivePathTargetOf } from "./tool-registry.js";
@@ -58,15 +59,10 @@ export function wildcardMatch(pattern, value) {
     return p === pattern.length;
 }
 function parseNamespacedRuleName(name) {
-    const ns = protocolOf(name);
-    if (ns === undefined)
+    const split = splitNamespacedName(name);
+    if (split === undefined || split.peer === "")
         return undefined;
-    const segments = name.slice(ns.prefix.length).split("__");
-    const peer = segments[0];
-    if (peer === undefined || peer === "")
-        return undefined;
-    const rest = segments.slice(1);
-    return rest.length > 0 ? { protocol: ns.id, peer, tool: rest.join("__") } : { protocol: ns.id, peer };
+    return split.tool !== undefined ? { protocol: split.ns.id, peer: split.peer, tool: split.tool } : { protocol: split.ns.id, peer: split.peer };
 }
 export function namespacedRuleNameCovers(ruleName, toolName) {
     const rule = parseNamespacedRuleName(ruleName);
@@ -215,6 +211,21 @@ function compile(rules, caps, primaryFieldGeneric, ruleFaces, pathBases = {}) {
                 continue;
             }
             const face = resolved.face;
+            if (ruleToolGrammarOf(toolName) === "name") {
+                const parsedName = parseRuleText(text, verb);
+                if ("reject" in parsedName) {
+                    bad(text, "invalid.command_rule", `${parsedName.reject.code}: ${parsedName.reject.message}`);
+                    continue;
+                }
+                const param = NAME_RULE_FACES[toolName].param;
+                if (face?.params !== undefined && !face.params.includes(param)) {
+                    bad(text, "unsupported.param_unknown", `"${param}" is not a parameter of ${toolName} on this leg (it carries ${[...face.params].sort().join(", ")}) — a ${toolName} rule is read against it, so the rule would compile and never match`);
+                    continue;
+                }
+                entry.content[verb].push({ parsed: parsedName.rule, ruleText: text, ...(r.source !== undefined ? { source: r.source } : {}) });
+                byTool.set(toolName, entry);
+                continue;
+            }
             if (face !== undefined && face.pathTargeting === true && colon <= 0) {
                 const parsedPath = parseRuleText(text, verb);
                 if ("reject" in parsedPath) {
@@ -362,6 +373,12 @@ export function createPermissionRulePolicy(rules, opts) {
         const command = isPlainObjectArgs(req.args) ? req.args[commandParam] : undefined;
         let unreadable;
         for (const r of lane) {
+            if (r.parsed.match === "name" || r.parsed.match === "name_prefix") {
+                const named = nameRuleSubjectOf(r.parsed.tool, req.args);
+                if (named !== undefined && nameRuleAdmits(r.parsed, named))
+                    return { rule: r };
+                continue;
+            }
             if (r.parsed.match === "subpath" || r.parsed.match === "path") {
                 if (target === undefined || target.kind === "refused")
                     continue;

package/dist/core/runner/classifier-ladder.d.ts

@@ -110,17 +110,19 @@ export declare function announceClassifierRoleDefaulted(args: {
     runId?: string;
 }): void;
 /**
- * The `classifier.unavailable` notice — a classification that could not RULE (the classifier leg failed, or its
- * per-level budget ran out) and where the call went: `"asked"` = on down the ask chain to this leg's approval seat (a
- * person or a durable park decides; the handed-on ask carries `requiresRealApproval`, so no automatic lane answers it),
- * `"denied"` = refused (no approval seat: nobody to ask). Audience `user`: the refusal is the session user's own
+ * The `classifier.unavailable` notice — a classification that could not RULE (the classifier leg failed, its per-level
+ * budget ran out, or it replied with no verdict — `parse_error`; the code name predates that third cause) and where the
+ * call went: `"asked"` = on down the ask chain to this leg's approval seat (a person or a durable park decides; the
+ * handed-on ask carries `requiresRealApproval` and `classifierNoRuling`, so no automatic lane answers it), `"denied"` =
+ * refused (no approval seat: nobody to ask — a reply with no verdict is then also counted on the denial limit). Audience `user`: the refusal is the session user's own
  * call, and on a lane with no approval face (`-p`) this line is the only place they hear why it did not run. Once
  * per classification that could not answer, from both classifier stations (the leg's gate and an ancestor's frozen
- * classifier in the policy fold) — a call judged by more than one classifier can carry one line per classifier. It is never a block: the denial limit does not count it, so this line is not a step toward the
- * limit's card either.
+ * classifier in the policy fold) — a call judged by more than one classifier can carry one line per classifier. The line
+ * itself is never the count: the unavailable form is never counted; a reply with no verdict refused for want of a seat is
+ * counted by the station's ruling path, not by this line.
  *
- * `detail: { toolName, toolCallId, cause, disposition, sessionId?, runId? }` — `cause` is the
- * `AutoModeUnavailableCause` word (`timeout` / `error`). The sentence names the seat the station forked on — `leg` (this
+ * `detail: { toolName, toolCallId, cause, disposition, sessionId?, runId? }` — `cause` is why the classification did not rule,
+ * an `AutoModeFallbackCause` word (`timeout` / `error`, or `parse_error` for a reply with no verdict). The sentence names the seat the station forked on — `leg` (this
  * run's own approval seat) or `ancestor` (the frozen approver of the ancestor layer whose classifier it was) — and, on a
  * timeout, the budget the classifier actually held (`budgetMs`, the decider's {@link AutoModeDecider.timeoutMs}; a
  * hand-built decider states none, and the sentence names the knob alone).

package/dist/core/runner/classifier-ladder.js

@@ -98,7 +98,9 @@ export function classifierUnavailableNotice(args) {
     const whose = args.station === "ancestor" ? "the classifier of the ancestor layer that asked" : "the classifier";
     const why = args.cause === "timeout"
         ? `${whose} did not answer within its per-level budget (${args.budgetMs !== undefined ? `${args.budgetMs} ms, ` : ""}RunnerDeps.autoMode.timeoutMs)`
-        : `${whose} could not run (error)`;
+        : args.cause === "parse_error"
+            ? args.station === "ancestor" ? `${whose} replied without a verdict` : "the classifier's reply carried no verdict"
+            : `${whose} could not run (error)`;
     const next = args.disposition === "asked"
         ? args.station === "ancestor"
             ? "so the call was handed on to that layer's approver rather than refused by the classifier."

package/dist/core/runner/denial-limit-arms.d.ts

@@ -1,4 +1,4 @@
-import { type AutoModeDecider, type AutoModeDenialLimitOptions, type AutoModeDenialTracker, type DenialLimitFallback, type UnarmedDenialLimitFallback } from "../auto-mode.js";
+import { type AutoModeDecider, type AutoModeDenialLimitOptions, type AutoModeDenialTracker, type AutoModeFallbackCause, type DenialLimitFallback, type UnarmedDenialLimitFallback } from "../auto-mode.js";
 import { type AutoModeArmingRecipe } from "../auto-mode-arming.js";
 import { type ClassifierUnavailableSeat } from "../classifier-unavailable-arm.js";
 import { type PermissionResult, type ResolvedAsk, type ToolCallRequest } from "../tool-policy.js";
@@ -114,6 +114,7 @@ export interface AskRequestCarry {
     askClass?: AskClass;
     classes?: readonly AskClass[];
     denialLimitFallback?: DenialLimitFallback;
+    classifierNoRuling?: AutoModeFallbackCause;
 }
 /** The GATE's own mint station: every member is read off the surviving decision, which is the gate's
  *  OWN snapshot (its stamp point spreads the policy's object and stamps the word and the class onto the copy),
@@ -154,8 +155,9 @@ export type InheritedClassifierJudgment<A extends InheritedAsk> =
  *  `classification` is the class set of the ask handed on, under the same station facts: on the two unchanged-ask
  *  branches the one read the exclusion judged by, on the unavailable and bound branches a read of the object this
  *  station minted (each adds a real-approval bit, which the set must reflect). */
-/** `ask` is the incoming ask unchanged (the arm's receipt snapshot of the ancestor's decision), or — an UNAVAILABLE classification with a live frozen
-*  approver — that ask with the classifier sentence appended; without one it is a `deny` whose attested cause reads `unavailable`. */
+/** `ask` is the incoming ask unchanged (the arm's receipt snapshot of the ancestor's decision), or — a classification that did not rule, with a
+*  live frozen approver — that ask carrying why (`classifierNoRuling`, the sentence appended); without one the unavailable form is a `deny`
+*  whose attested cause reads `unavailable`. */
  | {
     kind: "resolve";
     ask: A;
@@ -163,6 +165,7 @@ export type InheritedClassifierJudgment<A extends InheritedAsk> =
     mintedHere: boolean;
     origin: AskOrigin;
     classification: AskClassification;
+    noRulingHere?: true;
 };
 /**
  * The ancestor's frozen classifier, run BEFORE its frozen approver in the ancestor's own gate order,
@@ -170,10 +173,11 @@ export type InheritedClassifierJudgment<A extends InheritedAsk> =
  * auto-allow (and the streak resets); `block` below the bound ⇒ deny, the exact verdict the ancestor's
  * gate would have produced; `block` AT the bound ⇒ the ask is re-spoken in the classifier's voice as
  * the fallback (`decisionReason:"classifier"`, `requiresRealApproval`, the member carrying counts +
- * window) for the arm to resolve at the frozen approver; `parse_error` ⇒ the same block path with the CC
- * parse-failure sentence (counted); `unavailable` ⇒ the gate's own exit (`classifierUnavailableArm`) on the
- * frozen approver — a live one resolves the incoming ask, none ⇒ a DENY that says so (CC 2.1.250 form), never
- * counted; excluded / no classifier ⇒ the incoming ask, unchanged. The member may ALREADY be on the incoming
+ * window) for the arm to resolve at the frozen approver; a classification that did not rule (`unavailable`, or a reply
+ * with no verdict) ⇒ the gate's own exit (`classifierNoRulingArm`) on the frozen approver — a live one resolves the incoming
+ * ask carrying why (never counted); none ⇒ the unavailable form is a DENY that says so (CC 2.1.250 form, never counted) and
+ * a reply with no verdict takes the block path with the CC parse-failure sentence (counted); a CONFLICTING reply takes the
+ * block path too; excluded / no classifier ⇒ the incoming ask, unchanged. The member may ALREADY be on the incoming
  * ask (a deeper ancestor's fallback, minted inside the nested fold — the case the exclusion names):
  * it rides to the approver and the headless arm unchanged, whichever tracker minted it; only a
  * tracker that counted THIS streak is reset by the person's later allow (`mintedHere`).
@@ -203,11 +207,23 @@ export declare function judgeInheritedClassifier<A extends InheritedAsk>(opts: {
     /** The rewrite the arm's allow would have carried (the ask's own `updatedInput`, the re-check's edited
      *  args) — handed IN so the allow is minted here, attested, once; absent ⇒ a bare allow. */
     allowRewrite?: unknown;
-    /** An `unavailable` verdict's fork facts (`classifierUnavailableArm`): is the frozen approver live; who hears it. */
+    /** An `unavailable` verdict's fork facts (`classifierNoRulingArm`): is the frozen approver live; who hears it. */
     unavailableSeat?: ClassifierUnavailableSeat;
     /** The station's facts for this call (the base with this task's tool seat); absent ⇒ {@link INHERITED_STATION_FACTS}. */
     facts?: AskClassFacts;
 }): Promise<InheritedClassifierJudgment<A>>;
+/** The fallback an inherited station hands its frozen approver, minted ONCE for both ways a bound is reached (a counted ruling
+ *  refusal; a no-ruling card the approver's POLICY refused, {@link settleNoRulingAsk}) — its own object, word and class set. */
+type ResolveJudgment<A extends InheritedAsk> = Extract<InheritedClassifierJudgment<A>, {
+    kind: "resolve";
+}>;
+export declare function inheritedFallbackJudgment<A extends InheritedAsk>(ask: A, fallback: UnarmedDenialLimitFallback, latestBlockedAction: string, facts: AskClassFacts): ResolveJudgment<A>;
+/** One resolution of an inherited ask at its frozen approver (the three arms): a no-ruling card its POLICY refused counts
+ *  ({@link settleNoRulingAsk}); at the bound the call is resolved again there as the fallback. Returns the judgment it answered. */
+export declare function resolveInheritedAsk<A extends InheritedAsk, R extends Pick<ResolvedAsk, "action" | "settlement">>(judged: ResolveJudgment<A>, resolveWith: (j: ResolveJudgment<A>) => Promise<R>, tracker: AutoModeDenialTracker | undefined, toolName: string, facts: AskClassFacts): Promise<{
+    resolved: R;
+    judged: ResolveJudgment<A>;
+}>;
 /** The resolver's answer as the settlement reads it. */
 export type FallbackResolution = Pick<ResolvedAsk, "action" | "settlement" | "approverUnavailable">;
 /** A deny nobody JUDGED, at a wrapper arm — read off the one table over the settlement words
@@ -258,3 +274,4 @@ export declare function lateAskSettlementObserver(args: {
     kind: "error";
     error: unknown;
 }) => void;
+export {};

package/dist/core/runner/denial-limit-arms.js

@@ -1,7 +1,7 @@
 import { markTightenMessage } from "../safety-axis-vocab.js";
-import { classifierParseFailureDenyMessage, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow } from "../auto-mode.js";
+import { classifierParseFailureDenyMessage, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, isAutoModeFallbackCause, rungDidNotRule, unarmedWindow } from "../auto-mode.js";
 import { sanitizeAutoModeArmingRecipe, tightenDenialLimit } from "../auto-mode-arming.js";
-import { classifierUnavailableArm } from "../classifier-unavailable-arm.js";
+import { classifierNoRulingArm, settleNoRulingAsk } from "../classifier-unavailable-arm.js";
 import { attestClassifierDenyCause, attestClassifierRound, carryEngineAttestations } from "../tool-policy.js";
 import { SETTLEMENT_NOBODY_JUDGED } from "../gate-outcome.js";
 import { deliverEngineNotice } from "../types.js";
@@ -44,7 +44,7 @@ export function createDenialLimitStop(opts) {
         if (gateStopRef.terminal !== undefined)
             return;
         const lane = info.settlement === undefined
-            ? `no approver is wired to fall back to`
+            ? `nobody in this run can be asked to answer it`
             : `the durable approval it parked was settled with nobody judging it ("${info.settlement}")`;
         const message = `too many classifier denials in headless mode — ${denialLimitSentence(info.fallback)} The run was stopped: ` +
             `the auto-mode classifier's denial limit falls back to a person, and ${lane} ` +
@@ -61,6 +61,7 @@ export function createDenialLimitStop(opts) {
     return { gateStopRef, stopForDenialLimit };
 }
 export const INHERITED_STATION_FACTS = { contentQuestion: false, markedUnresolvable: false, org: undefined, tightened: undefined, mandateMarks: {} };
+const noRulingCarry = (why) => (isAutoModeFallbackCause(why) ? { classifierNoRuling: why } : {});
 function fallbackCarry(fallback, liveApprover, tracker) {
     if (fallback === undefined)
         return {};
@@ -71,6 +72,7 @@ export function gateAskCarry(decision, liveApprover, tracker) {
         ...(decision.origin !== undefined ? { origin: decision.origin } : {}),
         ...(decision.askClass !== undefined && decision.classes !== undefined ? { askClass: decision.askClass, classes: decision.classes } : {}),
         ...fallbackCarry(decision.denialLimitFallback, liveApprover, tracker),
+        ...noRulingCarry(decision.classifierNoRuling),
     };
 }
 export function inheritedAskCarry(judged, liveApprover, tracker) {
@@ -78,6 +80,7 @@ export function inheritedAskCarry(judged, liveApprover, tracker) {
         origin: judged.origin,
         ...askClassMembersOf(judged.classification),
         ...fallbackCarry(judged.fallback, liveApprover, tracker),
+        ...noRulingCarry(judged.ask.classifierNoRuling),
     };
 }
 export const inheritedAskFallbackMessage = (toolName) => `approval required for "${toolName}" (inherited parent policy)`;
@@ -105,12 +108,12 @@ export async function judgeInheritedClassifier(opts) {
         autoMode.denialTracking?.recordAllow();
         return { kind: "allow", result: attributed({ action: "allow", decisionReason: "classifier", ...(opts.allowRewrite !== undefined ? { updatedInput: opts.allowRewrite } : {}) }) };
     }
-    if (verdict.kind === "unavailable") {
-        const arm = classifierUnavailableArm({ ask, req, cause: verdict.cause, seat: opts.unavailableSeat, aborted: opts.signal.aborted });
-        if (arm.kind === "asked")
-            return { kind: "resolve", ask: arm.ask, fallback: ask.denialLimitFallback, mintedHere: false, origin, classification: classifyAsk(arm.ask, facts) };
+    const noRuling = rungDidNotRule(verdict);
+    const arm = noRuling !== undefined ? classifierNoRulingArm({ ask, req, cause: noRuling, seat: opts.unavailableSeat, aborted: opts.signal.aborted }) : undefined;
+    if (arm?.kind === "asked")
+        return { kind: "resolve", ask: arm.ask, fallback: ask.denialLimitFallback, mintedHere: false, origin, classification: classifyAsk(arm.ask, facts), noRulingHere: true };
+    if (arm?.kind === "denied")
         return { kind: "deny", result: attributed(arm.deny) };
-    }
     const reason = verdict.kind === "block" ? (verdict.reason ? inlineUntrusted(verdict.reason) : "") : classifierParseFailureDenyMessage(verdict.classifier);
     const category = verdict.kind === "block" && verdict.category ? inlineUntrusted(verdict.category) : "";
     const tracked = autoMode.denialTracking?.recordBlock();
@@ -122,10 +125,21 @@ export async function judgeInheritedClassifier(opts) {
         };
         return { kind: "deny", result: attributed(verdict.kind === "parse_error" ? attestClassifierDenyCause(denied, "parse_error", req) : denied) };
     }
-    const fallback = tracked.fallback;
-    const minted = carryEngineAttestations(ask, { ...ask, message: denialLimitFallbackMessage(fallback, reason || category || req.toolName), decisionReason: "classifier", requiresRealApproval: true, denialLimitFallback: fallback });
+    return inheritedFallbackJudgment(ask, tracked.fallback, reason || category || req.toolName, facts);
+}
+export function inheritedFallbackJudgment(ask, fallback, latestBlockedAction, facts) {
+    const { classifierNoRuling: _why, ...standing } = ask;
+    const minted = carryEngineAttestations(ask, { ...standing, message: denialLimitFallbackMessage(fallback, latestBlockedAction), decisionReason: "classifier", requiresRealApproval: true, denialLimitFallback: fallback });
     return { kind: "resolve", ask: minted, fallback, mintedHere: true, origin: askOriginOf(minted, facts), classification: classifyAsk(minted, facts) };
 }
+export async function resolveInheritedAsk(judged, resolveWith, tracker, toolName, facts) {
+    const resolved = await resolveWith(judged);
+    const refallback = settleNoRulingAsk({ ask: judged.ask, mintedHere: judged.noRulingHere === true, resolved, tracker });
+    if (refallback === undefined)
+        return { resolved, judged };
+    const again = inheritedFallbackJudgment(judged.ask, refallback, toolName, facts);
+    return { resolved: await resolveWith(again), judged: again };
+}
 export function headlessDenyAtFold(r) {
     return r.settlement !== undefined && SETTLEMENT_NOBODY_JUDGED[r.settlement.kind];
 }

package/dist/core/runner/gate-exit.js

@@ -139,7 +139,8 @@ export async function exitGate(pass) {
         const gate = mintGateOutcome({ deniedBy: pass.deniedBy, ...(pass.denyCause !== undefined ? { cause: pass.denyCause } : {}), ...(ledger.settled !== undefined ? { settled: ledger.settled } : {}), ...(pass.classifierRound !== undefined ? { classifier: pass.classifierRound } : {}), ...(modeRefusal !== undefined ? { modeRefusal: { mode: modeRefusal.mode, askClass: modeRefusal.askClass, classes: modeRefusal.classes } } : {}) });
         const foldCause = askUnresolvableCauseOf(pass.decision, { toolCallId, toolName });
         const unresolvable = foldCause ?? unresolvableCauseOfSettlement(gate);
-        const remedySeat = unresolvable !== undefined ? askUnresolvableRemedySeat(unresolvable) : undefined;
+        const tableSeat = unresolvable !== undefined ? askUnresolvableRemedySeat(unresolvable) : undefined;
+        const remedySeat = tableSeat === "absent" && input.askSeatForm === "declared_none" && pass.askClassification?.classes.has("content_question") !== true ? "declared_none" : tableSeat;
         const remedy = remedySeat !== undefined ? headlessApprovalRemedy({ mode: input.permissionMode?.(), classification: foldCause !== undefined ? ANCESTOR_UNRESOLVED_CLASSIFICATION : pass.askClassification, approverSeat: remedySeat, coveredWrite: isProtectedWrite(pass.req), ...(pass.shellUnplacedOptions !== undefined ? { unplacedOptions: pass.shellUnplacedOptions } : {}) }) : undefined;
         const denyReason = withParkFailureCause(`${decisionText(pass.decision) ?? `tool "${toolName}" denied by policy`}${remedy !== undefined ? ` — ${remedy}` : ""}`, pass.parkFailed);
         if (unresolvable !== undefined) {

package/dist/core/runner/permission-rule-lanes.d.ts

@@ -32,8 +32,8 @@ import type { PersistedRule, PersistedRuleVerdict, RuleOffer, SegmentCoverage }
 import { type ToolCallLike } from "../tool-registry.js";
 import { type OrgRuleResolution } from "../permission-rule-org.js";
 import { type EffectivePermissionRules, type PermissionRuleStoreProvider } from "../permission-rule-provider.js";
-/** The one SHELL tool the persisted-rule lane's COMMAND grammar speaks for (the rule-offer face mints for
- *  it alone). The PATH grammar's tools are derived from the catalog (`ruleToolGrammarOf`). */
+/** The one SHELL tool the persisted-rule lane's COMMAND grammar speaks for (the rule-offer face mints for it and the
+ *  name tools). The PATH and NAME grammars' tools are derived (`ruleToolGrammarOf`). */
 export declare const PERSISTED_RULE_TOOL = "Bash";
 /**
  * The evidence an INHERITED-lane ask carries.

package/dist/core/runner/permission-rule-lanes.js

@@ -1,6 +1,6 @@
 import { persistedRuleMandateOf, ruleClearanceOf } from "../ask-origin.js";
 import {} from "../hooks.js";
-import { adjudicatePersistedPathRules, adjudicatePersistedRules, callPathFaceOf, faceAskSpeaksFor, laneToolNamesOf, ruleToolGrammarOf, segmentCoverageOf, suggestRulesForCommand } from "../permission-rule-model.js";
+import { adjudicatePersistedNameRules, adjudicatePersistedPathRules, adjudicatePersistedRules, callPathFaceOf, faceAskSpeaksFor, laneToolNamesOf, nameRuleSubjectOf, ruleToolGrammarOf, segmentCoverageOf, suggestRuleForName, suggestRulesForCommand } from "../permission-rule-model.js";
 import { isAbsolutePathForm } from "../../tools/fs/safety.js";
 import { effectivePathTargetOf } from "../effective-path-target.js";
 import { declaredPathTargetOf, protectivePathTargetOf } from "../tool-registry.js";
@@ -155,6 +155,8 @@ export function createPermissionRuleLanes(cfg) {
         const liveCwd = cfg.liveCwd();
         if (grammar === "path")
             return pathRuleLaneAnswer(table, req, { root: cfg.root, sessionId: cfg.sessionId, liveCwd, home: cfg.home });
+        if (grammar === "name")
+            return persistedRuleAnswerOf(adjudicatePersistedNameRules(table, { tool: req.toolName, name: nameRuleSubjectOf(req.toolName, req.args), cwd: cfg.root, sessionId: cfg.sessionId }));
         const command = req.args?.command;
         if (typeof command !== "string")
             return undefined;
@@ -172,7 +174,7 @@ export function createPermissionRuleLanes(cfg) {
 export function createRuleOffersOf(cfg) {
     return (call, args, ask) => {
         const toolName = wireOf("offer.laneTool", call);
-        if (!cfg.laneArmed || toolName !== PERSISTED_RULE_TOOL)
+        if (!cfg.laneArmed || (toolName !== PERSISTED_RULE_TOOL && ruleToolGrammarOf(toolName) !== "name"))
             return {};
         if ((cfg.principal === undefined || cfg.principal === "") && !cfg.localOwnerDeclared)
             return {};
@@ -184,6 +186,10 @@ export function createRuleOffersOf(cfg) {
         }).word;
         if (closedDoor !== undefined)
             return { ruleOffersAbsence: closedDoor };
+        if (ruleToolGrammarOf(toolName) === "name") {
+            const offer = suggestRuleForName(toolName, nameRuleSubjectOf(toolName, args) ?? "");
+            return offer !== undefined ? { ruleOffers: [offer] } : { ruleOffersAbsence: "lane_cannot_speak" };
+        }
         const command = args?.command;
         if (typeof command !== "string")
             return { ruleOffersAbsence: "lane_cannot_speak" };

package/dist/core/runner/prepare-ask-lane.d.ts

@@ -6,6 +6,7 @@ import { type OnAsk, type ToolCallRequest, type ToolPolicy } from "../tool-polic
 import type { RunnerDeps, TaskSpec } from "../types.js";
 import type { CwdRef } from "../../tools/fs/fs-shared.js";
 import type { AskLane, Prepared } from "./contracts.js";
+import type { GrantBindingOf } from "../skill-grant-binding.js";
 import { consumeInheritedAskGrant } from "./inherited-ask-grants.js";
 import { type GrantReadRoot } from "./read-root-grant.js";
 import type { createRuleOffersOf } from "./permission-rule-lanes.js";
@@ -49,6 +50,8 @@ export interface PrepareAskLaneInput {
     now: () => number;
     /** borrowed-readonly — the policy-chain phase's rule-offer factory (the suggestion members the ask mint threads). */
     ruleOffersOf: ReturnType<typeof createRuleOffersOf>;
+    /** borrowed-readonly — the policy-chain phase's Skill-card binding factory (`boundGrants` / `boundGrantDigest` on the ask). */
+    grantBindingOf: GrantBindingOf;
     /** borrowed-readonly — the policy-chain phase's Runner-filled source identity (one factory, every ask mint site). */
     askSourceIdentity: () => {
         principal?: string;

package/dist/core/runner/prepare-ask-lane.js

@@ -59,7 +59,7 @@ function resolveApprovalPreview(tools, toolName, args) {
     }
 }
 export function prepareAskLane(input) {
-    const { gateMachineryActive, abortController, effectivePolicy, budgetSnapshot, handsCwdRef, advertisedWritableDirs, tools, inheritedUnavailableAsks, inheritedAskGrants, onAsk, humanReviewRef, now, ruleOffersOf, askSourceIdentity, riskAxesOf, autoModeDenialTracking, spec, deps, sessionId, runId, hooks, hookTimeoutMs, notifyOwnHookCrash, grantReadRoot } = input;
+    const { gateMachineryActive, abortController, effectivePolicy, budgetSnapshot, handsCwdRef, advertisedWritableDirs, tools, inheritedUnavailableAsks, inheritedAskGrants, onAsk, humanReviewRef, now, ruleOffersOf, grantBindingOf, askSourceIdentity, riskAxesOf, autoModeDenialTracking, spec, deps, sessionId, runId, hooks, hookTimeoutMs, notifyOwnHookCrash, grantReadRoot } = input;
     if (!gateMachineryActive)
         return { askLane: undefined };
     const composedCallSignal = (callSignal) => composeCallSignal(abortController.signal, callSignal);
@@ -98,6 +98,7 @@ export function prepareAskLane(input) {
                 return { ...(p.preview !== undefined ? { preview: p.preview } : {}), ...(p.withheld !== undefined ? { previewWithheld: p.withheld } : {}) };
             })(),
             ...ruleOffersOf(req, req.args, decision.action === "ask" ? decision : undefined),
+            ...grantBindingOf(req, req.args),
             ...cardDisclosureOf(decision, `approval required for "${req.toolName}"`),
             ...askSourceIdentity(),
             ...riskAxesOf(req),

package/dist/core/runner/prepare-caps-and-workflow.d.ts

@@ -30,7 +30,6 @@ import { type CheckpointSeat } from "../checkpoint-seat.js";
 import { type ComplianceCapability } from "../compliance.js";
 import type { LockedPreflight } from "../locked-config.js";
 import type { StoredSession } from "../session.js";
-import type { OnAsk } from "../tool-policy.js";
 import type { RunnerDeps, RuntimeCaps, TaskEvent, TaskSpec, ToolExecuteContext } from "../types.js";
 import type { AutoModeArmFact } from "../wiring-manifest.js";
 import type { AssertAllKeysHandled } from "../ask-origin.js";
@@ -88,8 +87,8 @@ export interface PrepareCapsAndWorkflowInput {
     harnessRef: {
         current?: AgentHarness;
     };
-    /** borrowed-readonly — the FROZEN approver seat (the Workflow mount's parentOnAsk). */
-    frozenOnAsk: OnAsk | undefined;
+    /** borrowed-readonly — the run's approval seat as the config doors froze it (the Workflow mount's parentOnAsk / parentApprovalReach). */
+    askSeat: import("../wiring-manifest.js").AskSeat;
     /** borrowed-readonly — the parent SPEC seat the children inherit (minted once by the inherited-gate phase; the Workflow mount's dep, the same value the delegation ctx carries). */ parentSpecSeat: ParentSpecSeat;
     /** borrowed-readonly — the ONE read-face carrier expression (the Workflow mount's parentReadFace getter calls it). */
     carrierReadFace: () => ContainmentFace | undefined;

package/dist/core/runner/prepare-caps-and-workflow.js

@@ -114,7 +114,7 @@ function autoModeArmReasonOf(intent, facePresent, caps, capsFaulted) {
     return { armed: true, reason: "armed" };
 }
 export async function prepareCapsAndWorkflow(input) {
-    const { spec, deps, parentSpecSeat, checkpointSeat, internals, session, sessionId, runId, hostTaskId, taskScope, taskRootFinal, model, thinking, lockedPreflight, toolEffects, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, harnessRef, frozenOnAsk, carrierReadFace, carrierWriteFace, forwardEvent, inheritedGateForChildren, enrichSpecToolCtx, maybeOffload, requestReview, enterPlanMode, permissionMode, readDenyEntries, peerLaneActive, peerSendMessageBuiltIn, runnerSelf } = input;
+    const { spec, deps, parentSpecSeat, checkpointSeat, internals, session, sessionId, runId, hostTaskId, taskScope, taskRootFinal, model, thinking, lockedPreflight, toolEffects, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, harnessRef, askSeat, carrierReadFace, carrierWriteFace, forwardEvent, inheritedGateForChildren, enrichSpecToolCtx, maybeOffload, requestReview, enterPlanMode, permissionMode, readDenyEntries, peerLaneActive, peerSendMessageBuiltIn, runnerSelf } = input;
     const roster = new RosterBuilder(toolEffects);
     for (const t of spec.tools ?? []) {
         const mounted = mountCallerTool(t);
@@ -326,7 +326,8 @@ export async function prepareCapsAndWorkflow(input) {
                 return model === undefined ? undefined : { model, ...(typeof ref === "string" ? { modelRef: ref } : {}) };
             },
             ...(spec.getApiKeyAndHeaders !== undefined ? { parentGetApiKeyAndHeaders: spec.getApiKeyAndHeaders } : {}),
-            ...(frozenOnAsk !== undefined ? { parentOnAsk: frozenOnAsk } : {}),
+            ...(askSeat.value !== undefined ? { parentOnAsk: askSeat.value } : {}),
+            ...(askSeat.reach !== undefined ? { parentApprovalReach: askSeat.reach } : {}),
             ...(spec.durableApproval !== undefined ? { parentDurableApproval: { ...spec.durableApproval } } : {}),
             ...(internals?.workflowParkedResume !== undefined
                 ? { parkedResume: (resumeFromRunId) => {

package/dist/core/runner/prepare-config-doors.d.ts

@@ -29,6 +29,7 @@ import { type ResolvedSkillListingBudget } from "../skill-listing-budget.js";
 import type { SessionStore } from "../session.js";
 import type { RunnerDeps, TaskLimits, TaskSpec } from "../types.js";
 import { type UsageWindow } from "../usage-window-store.js";
+import { type AskSeat } from "../wiring-manifest.js";
 import type { PrepareResume, RunInternals, ToolFaceSnapshot } from "./contracts.js";
 export declare function limitConfigError(code: string, message: string): Error & {
     code?: string;
@@ -147,6 +148,8 @@ export interface PrepareConfigDoorsResult {
     /** owned — the resolved interaction posture (spec > spawning run > deployment); the
      *  AskUserQuestion mount and the child-ctx injection read this same value. */
     resolvedInteractionPosture: "interactive" | "headless" | undefined;
+    /** owned, frozen — the run's approval seat ({@link resolveAskSeat}), the one read of the seats; later phases read only this. */
+    askSeat: AskSeat;
     /** owned — the validated/resolved microCompact knob ({@link resolveMicroCompactKnob}
      *  for the door + placement reasoning). The per-run state builder consumes exactly these values —
      *  the deps bag is never re-read after this door. */