@sema-agent/core 7.42.1 → 7.43.0

package/dist/core/runner/prepare-wiring-manifest.js

@@ -11,7 +11,7 @@ import { inlineUntrusted } from "../untrusted-text.js";
 import { mountWriteProtection } from "./write-protection-station.js";
 import { autoRunOnRecommendationEffective } from "./memory-consolidation-driver.js";
 import { GLOBAL_USAGE_KEY, usageRetryAfterMs, windowsGovernCost } from "../usage-window-store.js";
-import { LSP_CONTRACT_ID, askSeatEffective, countElicitOptIns, deriveHandsSeam, deriveLspSeam, deriveWiringManifest, resolveAskSeamForm, resolveDeclaredDurability, resolveElicitSeam, resolveQuestionSeam, resolveSubagentTranscriptTier } from "../wiring-manifest.js";
+import { LSP_CONTRACT_ID, askSeatEffective, countElicitOptIns, deriveHandsSeam, deriveLspSeam, deriveWiringManifest, resolveDeclaredDurability, resolveElicitSeam, resolveQuestionSeam, resolveSubagentTranscriptTier } from "../wiring-manifest.js";
 import { modePolicyOf } from "../mode-policy.js";
 import { DEFAULT_IRREVERSIBLE_SCOPE } from "./checkpoint-scope.js";
 export function mcpManifestEntries(entries, statuses) {
@@ -102,9 +102,9 @@ function announceDurableGateUnavailable(args) {
         message: `Durable approval gate mandated but unavailable: ${source === "force_durable_gate" ? "the runtime entitlement forceDurableGate is in force for this principal" : "this task opted into durable approval (durableApproval) with no live approver seat"}, ` +
             `but ${cause === "task_store_disabled" ? 'this task disabled the checkpoint store (checkpointStore: "disabled")' : "this deployment wired no checkpoint store"}, ` +
             `so no interactive ask of this task can be parked for a durable answer. Asks resolve on the live chain instead ` +
-            `(${args.liveApprover ? "a live approver answers permission asks in-stream" : args.blanketAllow ? 'a blanket "allow" posture answers ordinary permission asks without judgment (a mandated ask is refused)' : "permission asks are denied fail-closed — no live approver is wired"}; ` +
+            `(${args.liveApprover ? "a live approver answers permission asks in-stream" : args.blanketAllow ? 'a blanket "allow" posture answers ordinary permission asks without judgment (a mandated ask is refused)' : "permission asks are denied fail-closed — nobody in this run can be asked to approve them"}; ` +
             `${liveQuestionFace ? "a live question face answers AskUserQuestion in-stream" : args.liveQuestionFace ? "AskUserQuestion is withheld from the live face by an inherited durable mandate and refused" : "AskUserQuestion has no live face and is refused"}) ` +
-            `and NO durable approval record is written. ${cause === "task_store_disabled" ? "Run this task with its store" : "Wire a checkpoint store on this deployment"}, or ${source === "force_durable_gate" ? "withdraw the entitlement for principals served here" : "give the task a live approver seat (or drop durableApproval)"}.`,
+            `and NO durable approval record is written. ${cause === "task_store_disabled" ? "Run this task with its store" : "Wire a checkpoint store on this deployment"}, or ${source === "force_durable_gate" ? "withdraw the entitlement for principals served here" : args.declaredNone ? 'run the task where a person can be asked (without approvalReach: "none"), or drop durableApproval' : "give the task a live approver seat (or drop durableApproval)"}.`,
         detail: {
             sessionId: args.sessionId,
             runId: args.runId,
@@ -117,8 +117,8 @@ function announceDurableGateUnavailable(args) {
     });
 }
 export function prepareWiringManifest(input) {
-    const { spec, deps, internals, resume, sessionId, runId, hostTaskId, taskScope, hooks, preToolUseObservational, policyLayers, effectivePolicy, handsEnabled, taskRootFinal, mcp, irreversibleTools, egressTools, toolEffects, ownedEnv, executionEnv, offloadStore, onceLedger, usageWindows, envLifetimeSuspendAt, runtimeCaps, resolvedInteractionPosture, durableQuestionFace, liveQuestionFace, checkpointStore, sessions, modelGateManifest, autoModeArmReason, permissionMode, lockedPreflight, peerLaneRefs, frameSettlement, sessionBox, harness, pausedRef, frozenOnAsk, liveInheritedGate, delegation, toolRoster, readDenyBuiltinTiersActive, lspManagerWired, shellReadStationArmed, lspDiagnosticsLive, fileHistoryFact } = input;
-    const onAsk = spec.onAsk ?? deps.onAsk;
+    const { spec, deps, internals, resume, sessionId, runId, hostTaskId, taskScope, hooks, preToolUseObservational, policyLayers, effectivePolicy, handsEnabled, taskRootFinal, mcp, irreversibleTools, egressTools, toolEffects, ownedEnv, executionEnv, offloadStore, onceLedger, usageWindows, envLifetimeSuspendAt, runtimeCaps, resolvedInteractionPosture, durableQuestionFace, liveQuestionFace, checkpointStore, sessions, modelGateManifest, autoModeArmReason, permissionMode, lockedPreflight, peerLaneRefs, frameSettlement, sessionBox, harness, pausedRef, askSeat, liveInheritedGate, delegation, toolRoster, readDenyBuiltinTiersActive, lspManagerWired, shellReadStationArmed, lspDiagnosticsLive, fileHistoryFact } = input;
+    const onAsk = askSeat.value;
     const handWriteTools = toolRoster.entries.filter((e) => e.mountedBy === "hands" && (e.effect === "write" || e.effect === "idempotent")).map((e) => e.name);
     const hasEffectAwareGate = Boolean(policyLayers.length > 0 || (hooks?.preToolUse !== undefined && !preToolUseObservational));
     const peerWriteUngated = modePolicyOf(permissionMode.current).unstated === "ask"
@@ -181,14 +181,13 @@ export function prepareWiringManifest(input) {
     const writeProtection = mountWriteProtection({ deps, env: handsEnabled ? executionEnv : undefined, rootPath: taskRootFinal, roster: toolRoster, sessionId, runId });
     const wiringQuestionSeam = resolveQuestionSeam(spec, deps);
     const wiringQuestionStripped = internals?.questionFaceStripped === true;
-    const wiringAskSeam = resolveAskSeamForm(spec, deps);
     const wiringManifest = deriveWiringManifest({
         half: "effective",
         leg: resume !== undefined ? "resume" : internals?.isDelegatedChild === true ? "child" : "root",
         teamRole: teamRoleOf({ isDelegatedChild: delegation.isDelegatedChild, ...(internals?.explicitAgentName !== undefined ? { spawnName: internals.explicitAgentName } : {}) }),
         ...(spec.peerPresence !== undefined ? { peerPresence: spec.peerPresence } : {}),
-        askForm: wiringAskSeam.form,
-        ...(wiringAskSeam.provenance !== undefined ? { askProvenance: wiringAskSeam.provenance } : {}),
+        askForm: askSeat.form,
+        ...(askSeat.provenance !== undefined ? { askProvenance: askSeat.provenance } : {}),
         questionWired: wiringQuestionSeam.wired,
         ...(wiringQuestionSeam.provenance !== undefined ? { questionProvenance: wiringQuestionSeam.provenance } : {}),
         ...(wiringQuestionStripped ? { questionStrippedByEngine: true } : {}),
@@ -254,7 +253,7 @@ export function prepareWiringManifest(input) {
         resourceSuspendEligible ||
         platformSuspendArmed ||
         spec.enablePlanMode === true;
-    announceDurableGateUnavailable({ onNotice: deps.onNotice, mandate: durableMandateSourceOf({ forceDurableGate: runtimeCaps?.forceDurableGate === true, durableApprovalDeclared: spec.durableApproval !== undefined, onAsk: frozenOnAsk }), storeWired: checkpointStore !== undefined, taskStoreDisabled: spec.checkpointStore === "disabled", liveApprover: isLiveApproverSeat(frozenOnAsk), blanketAllow: frozenOnAsk === "allow", liveQuestionFace: liveQuestionFace !== undefined, parentConstraints: liveInheritedGate?.parentConstraints, sessionId, runId, principal: spec.principal });
+    announceDurableGateUnavailable({ onNotice: deps.onNotice, mandate: durableMandateSourceOf({ forceDurableGate: runtimeCaps?.forceDurableGate === true, durableApprovalDeclared: spec.durableApproval !== undefined, onAsk }), storeWired: checkpointStore !== undefined, taskStoreDisabled: spec.checkpointStore === "disabled", liveApprover: isLiveApproverSeat(onAsk), blanketAllow: onAsk === "allow", declaredNone: askSeat.reach === "none", liveQuestionFace: liveQuestionFace !== undefined, parentConstraints: liveInheritedGate?.parentConstraints, sessionId, runId, principal: spec.principal });
     const hookIdentity = mintHookInvocationIdentity({
         sessionId,
         taskId: hostTaskId,

package/dist/core/runner/resume-checkpoint-screen.js

@@ -48,7 +48,7 @@ export function resumeCheckpointScreen(input) {
             }
         }
         if (readFrozenSkillGrants(cp.state.skillGrants) === undefined)
-            throw new CheckpointError("checkpoint.invalid_outcome", "this checkpoint carries a skill-grant section (state.skillGrants) that does not read as grant rows — refusing to resume without the grant rows and refusals it carries (corruption guard), the checkpoint stays pending", { reason: "skill_grants_damaged" });
+            throw new CheckpointError("checkpoint.invalid_outcome", "this checkpoint carries a skill-grant section (state.skillGrants) that does not read as grant rows under this engine — a damaged section, or a row an earlier release wrote whose entry this release reads as nothing (an entry with a surrounding space, say) — refusing to resume without the grant rows and refusals it carries; the checkpoint stays pending: finish it on a worker of the release that parked it, or expire it", { reason: "skill_grants_damaged" });
     }
     if (realApprovalOrgFact(preCasGateBit) !== undefined && runner.deps.permissionRuleStore?.partitions.org !== true) {
         throw new CheckpointError("checkpoint.unsupported_version", `this checkpoint's approval was minted under organization governance (org ${String(realApprovalOrgFact(preCasGateBit))}, routed as ${String(preCasGateBit?.origin)}) and this worker has no org adjudication wiring (its permission-rule store carries no org partition) — a governed approval may only be redeemed where governance can be enforced; the checkpoint stays pending, resume it on an org-wired worker`, { reason: "governed_unwired" });

package/dist/core/runner/synthetic-tools.d.ts

@@ -169,9 +169,10 @@ export declare function renderSkillLinesWithin(skills: ReadonlyArray<SkillListin
  *
  * A SUCCESSFUL activation writes the skill's two lists into the run's grant table (`grants`, origin `model`): its
  * `allowed-tools` then run without asking and its `disallowed-tools` are refused for the rest of the run; an unknown skill
- * throws first and writes nothing. Activating a skill that declares a list was itself a question (the gate reads this
+ * throws first and writes nothing, as does one whose `disallowed-tools` holds an entry that reads as nothing (the table
+ * refuses it: the body is not served, nothing is granted). Activating a skill that declares a list was itself a question (the gate reads this
  * tool's seat off the call's arguments — `Execute skill: <name>`), so a write here always follows a statement. The tool
  * runs ALONE in its batch: a call after it in the same message is judged after the rows exist.
  */
-export declare function createSkillTool(skills: SkillLike[], grants?: SkillGrantTable): AgentTool;
+export declare function createSkillTool(skills: SkillLike[], grants: SkillGrantTable): AgentTool;
 export {};

package/dist/core/runner/synthetic-tools.js

@@ -188,7 +188,7 @@ export function createSkillTool(skills, grants) {
                     `(Only skills registered with this deployment are loadable — other products' skills directories are not read. ` +
                     `If the user wants one of those here, read its source file and recreate its content for this deployment instead.)`);
             }
-            grants?.activate(skill, "model");
+            grants.activate(skill, "model");
             const baseDir = skill.baseDir;
             let body = baseDir !== undefined ? substituteSkillRoot(skill.content, baseDir) : skill.content;
             if (skill.files !== undefined && skill.files.length > 0) {

package/dist/core/session-policy-store.d.ts

@@ -53,7 +53,7 @@ export interface PutRulesOptions {
     operator?: boolean;
 }
 /** The {@link SessionPolicyError.detail} of a tool-name refusal: which bucket, which entry, the judgment's word, and the
- *  1:1 successor when the retired name has one. */
+ *  spelling to write instead when the judgment has one (a retired name's 1:1 successor, an unmintable segment's minted name). */
 export interface SessionRuleNameRefusal {
     field: SessionRuleToolNameField;
     name: string;
@@ -63,8 +63,8 @@ export interface SessionRuleNameRefusal {
 /** Typed error from {@link SessionPolicyStore.putRules}. `conflict` = stale `expectedRev`; `loosen_forbidden`
  *  = a non-operator write tried to relax the rules; `corrupt` = a backend could not read the erase-surviving
  *  rev mark ({@link SessionPolicyStore.deleteBySession}) and refuses rather than stamp an unproven rev; the fourth
- *  code = a tool-name bucket names a retired or prefix-less name ({@link assertSessionRuleNamesCurrent}) — `detail` is
- *  present on that code and only on it. */
+ *  code = a tool-name bucket names a retired name, a prefix-less `__` name or a peer segment no mint spells
+ *  ({@link assertSessionRuleNamesCurrent}) — `detail` is present on that code and only on it. */
 export declare class SessionPolicyError extends Error {
     readonly code: "conflict" | "loosen_forbidden" | "corrupt" | "legacy_tool_name";
     readonly detail?: SessionRuleNameRefusal | undefined;

package/dist/core/session-policy-store.js

@@ -40,10 +40,24 @@ export function assertSessionRuleNamesCurrent(rules, mountedToolNames = NO_DECLA
             if (verdict.kind === "current")
                 continue;
             const quoted = JSON.stringify(name);
-            const successor = verdict.kind === "retired" ? verdict.currentName : undefined;
-            throw new SessionPolicyError("legacy_tool_name", verdict.kind === "retired"
-                ? `session rules ${field} names ${quoted}, a retired tool name (${verdict.guidance}) — with it in place no run of this session could start, so nothing was written.${successor !== undefined ? ` Use the current name ${JSON.stringify(successor)}.` : ""} If this deployment mounts its own tool under ${quoted}, declare it in the store's mountedToolNames.`
-                : `session rules ${field} names ${quoted}, which carries the "__" namespace separator but no protocol prefix — no tool is named that way (protocol tools are named ${NAMESPACED_NAME_SHAPES}), and with it in place no run of this session could start, so nothing was written.`, { field, name, verdict: verdict.kind, ...(successor !== undefined ? { currentName: successor } : {}) });
+            const successor = verdict.kind === "unprefixed_namespace" ? undefined : verdict.currentName;
+            let message;
+            switch (verdict.kind) {
+                case "retired":
+                    message = `session rules ${field} names ${quoted}, a retired tool name (${verdict.guidance}) — with it in place no run of this session could start, so nothing was written.${successor !== undefined ? ` Use the current name ${JSON.stringify(successor)}.` : ""} If this deployment mounts its own tool under ${quoted}, declare it in the store's mountedToolNames.`;
+                    break;
+                case "unprefixed_namespace":
+                    message = `session rules ${field} names ${quoted}, which carries the "__" namespace separator but no protocol prefix — no tool is named that way (protocol tools are named ${NAMESPACED_NAME_SHAPES}), and with it in place no run of this session could start, so nothing was written.`;
+                    break;
+                case "unmintable_segment":
+                    message = `session rules ${field} names ${quoted}, which can match no tool (${verdict.guidance}) — with it in place no run of this session could start, so nothing was written.${successor !== undefined ? ` Write ${JSON.stringify(successor)}.` : ""}`;
+                    break;
+                default: {
+                    const exhaustive = verdict;
+                    return exhaustive;
+                }
+            }
+            throw new SessionPolicyError("legacy_tool_name", message, { field, name, verdict: verdict.kind, ...(successor !== undefined ? { currentName: successor } : {}) });
         }
     }
 }

package/dist/core/skill-grant-binding.d.ts

@@ -0,0 +1,44 @@
+/**
+ * What a Skill card's approval is bound to, as ONE value: the skill the call names and the two lists approving it releases,
+ * in the rule grammar's canonical spelling (de-duplicated, sorted). Its hash is the `boundGrantDigest` a parked approval is
+ * judged by, so a reader holds the list a person approved and the binding that covers it as the same fact — the live
+ * `AskRequest`, the parked row and the inbox projection all carry it (minted by `skillGrantBindingMembers`).
+ *
+ * A leaf on purpose: the checkpoint projection reads it at its boundary and may not import the module that mints it (it imports only
+ * the hash).
+ */
+export interface BoundSkillGrants {
+    /** The skill's name as the loaded table spells it, or `null` when the call names no loaded skill (it grants nothing). */
+    readonly skill: string | null;
+    /** The skill's `allowed-tools` entries — what approving the activation lets be used without asking. */
+    readonly allowedTools: readonly string[];
+    /** The skill's `disallowed-tools` entries — what activating it refuses for the rest of the run. */
+    readonly disallowedTools: readonly string[];
+}
+/**
+ * A stored value read as a {@link BoundSkillGrants}, whole or not at all: a fresh copy of the three members and nothing else,
+ * or `undefined` when any member is not of its type. Every member is read ONCE, so the value screened is the value published.
+ */
+export declare function readBoundSkillGrants(raw: unknown): BoundSkillGrants | undefined;
+/** The card members a call to the engine's `Skill` tool carries on every face its card has — empty for any other call. */
+export interface SkillGrantBindingMembers {
+    /** The hash of {@link boundGrants}: the binding a parked approval of the card is judged by. */
+    boundGrantDigest?: string;
+    boundGrants?: BoundSkillGrants;
+}
+/** The leg's binding factory ({@link SkillGrantBindingMembers} for a call over `args`), the one every ask-mint site spreads. */
+export type GrantBindingOf = (call: {
+    readonly toolName: string;
+}, args: unknown) => SkillGrantBindingMembers;
+/**
+ * The binding members of a stored parked row, as the inbox projection publishes them: the digest when it is a string, and the lists
+ * only as the value that digest hashes — {@link readBoundSkillGrants} whole, and equal to the digest by hash. A pair that
+ * disagrees, or lists beside no digest, would show an approver one list while the approval binds another: the lists read as absent.
+ */
+export declare function readBoundBinding(row: {
+    readonly boundGrantDigest?: unknown;
+    readonly boundGrants?: unknown;
+} | undefined): {
+    boundGrantDigest?: string;
+    boundGrants?: BoundSkillGrants;
+};

package/dist/core/skill-grant-binding.js

@@ -0,0 +1,22 @@
+import { boundInputHashOf } from "./canonical-json.js";
+export function readBoundSkillGrants(raw) {
+    if (typeof raw !== "object" || raw === null)
+        return undefined;
+    const { skill, allowedTools: allowed, disallowedTools: disallowed } = raw;
+    if (skill !== null && typeof skill !== "string")
+        return undefined;
+    const entries = (list) => {
+        if (!Array.isArray(list))
+            return undefined;
+        const copy = Array.from(list);
+        return copy.every((e) => typeof e === "string") ? copy : undefined;
+    };
+    const allowedTools = entries(allowed);
+    const disallowedTools = entries(disallowed);
+    return allowedTools !== undefined && disallowedTools !== undefined ? { skill, allowedTools, disallowedTools } : undefined;
+}
+export function readBoundBinding(row) {
+    const digest = row?.boundGrantDigest;
+    const grants = readBoundSkillGrants(row?.boundGrants);
+    return { ...(typeof digest === "string" ? { boundGrantDigest: digest } : {}), ...(grants !== undefined && typeof digest === "string" && boundInputHashOf(grants) === digest ? { boundGrants: grants } : {}) };
+}

package/dist/core/skill-grant.d.ts

@@ -2,7 +2,8 @@ import type { PermissionResult, ToolCallRequest } from "./tool-policy.js";
 import type { PermissionMode } from "./ask-origin.js";
 import { type PermissionSeatInputs, type PermissionSeatReading } from "./mode-policy.js";
 import type { AgentTool } from "../internal/harness-types.js";
-import { type AllowEntryGateSeats, type AllowEntryInertReason, type AllowEntryJudgeContext, type CompiledAllowEntry } from "./allow-entry.js";
+import type { SkillGrantBindingMembers } from "./skill-grant-binding.js";
+import { type AllowEntryGateSeats, type AllowEntryInert, type AllowEntryJudgeContext, type CompiledAllowEntry } from "./allow-entry.js";
 /** Who wrote a row: the `Skill` tool on a successful activation, prepare for a skill the person invoked by name, or a
  *  delegated child's seed from its parent. */
 export declare const SKILL_GRANT_ORIGINS: readonly ["model", "user", "inherited"];
@@ -25,12 +26,12 @@ export interface SkillGrantRow {
     readonly compiled: CompiledAllowEntry;
 }
 /** An entry the grammar reads as granting or refusing nothing. */
-export interface SkillInertEntry {
+export type SkillInertEntry = {
     readonly skill: string;
     readonly list: "allowed-tools" | "disallowed-tools";
-    readonly entry: string;
-    readonly reason: AllowEntryInertReason;
-}
+} & AllowEntryInert;
+/** The names the run mounts, read when a list is — a skill is activated later than prepare, and the roster is read as it stands. */
+export type MountedToolNames = () => ReadonlySet<string>;
 /** The two lists a skill declares (the shape of a `SkillSpec`, read by name). */
 export interface SkillGrantSource {
     readonly name: string;
@@ -45,23 +46,19 @@ export interface SkillGrantSource {
  * the person's invoked names are read through it ({@link seedSkillGrants}).
  */
 export declare function skillNamedBy<T extends Pick<SkillGrantSource, "name">>(args: unknown, skills: readonly T[]): T | undefined;
-/**
- * The digest of what a Skill card disclosed — `Execute skill: <name>` and the lists approving it releases: the skill's name
- * as the table spells it ({@link skillNamedBy} resolved it, so it equals the call's `skill` exactly) and its two lists in the
- * rule grammar's canonical spelling (`Tool()` / `Tool(*)` read as the bare name), de-duplicated and sorted, hashed as the
- * approval binding is hashed (`boundInputHashOf`). `undefined` — no skill named — digests as a nameless skill declaring
- * nothing (activating it grants nothing). Any change to the name or to either list changes it; the body does not. The read
- * point a parked Skill approval binds to (stored beside the row's input binding, compared before the resumed activation).
- */
+/** The digest of what a Skill card disclosed — `Execute skill: <name>` and the lists approving it releases ({@link skillGrantBinding}). The read point a parked Skill approval binds to (stored beside the row's input binding, compared before the resumed activation). */
 export declare function skillGrantDigest(skill: Pick<SkillGrantSource, "name" | "allowedTools" | "disallowedTools"> | undefined): string;
 /**
- * The digest a parked call to the engine's `Skill` tool binds — written by the park beside the row's input binding — or
- * undefined for any other call, and when no skill is loaded (no engine `Skill` tool is mounted, so a call by that name is
- * not an activation).
+ * The card members of a call to the engine's `Skill` tool — the ONE factory every ask spreads them from: the live
+ * `AskRequest` an approver is handed, an ancestor's, the parked row and (through the row) the inbox projection.
+ * `boundGrants` is the skill's name and canonical lists, `boundGrantDigest` its hash — the same value, so what a person was
+ * shown and what an approving resume is judged by cannot differ. The binding is a property of the CALL, whoever asked and
+ * however the question was worded. Empty for any other call, and when no skill is loaded (no engine `Skill` tool is
+ * mounted, so a call by that name is not an activation).
  */
-export declare function skillCallGrantDigest(call: {
+export declare function skillGrantBindingMembers(call: {
     readonly toolName: string;
-}, args: unknown, skills: readonly SkillGrantSource[], skillToolName: string): string | undefined;
+}, args: unknown, skills: readonly SkillGrantSource[], skillToolName: string): SkillGrantBindingMembers;
 /**
  * The approving resume of a parked call, judged against the card it was asked under. A row is a `Skill` approval when it
  * carries a digest (the park said so), or when the resume would run the engine's `Skill` tool on it (skills loaded, the
@@ -87,10 +84,10 @@ export declare function declaresSkillLists(skill: Pick<SkillGrantSource, "allowe
 /**
  * Compile one skill's two lists into rows (`origin` stamped on each) and the entries that read as nothing. An allow list
  * holding `*` voids that list whole (every other entry on it is reported too: the list grants nothing — the safe direction).
- * A `*` on the deny list reads as nothing by itself and the rest of that list still refuses: a deny list never loses an
- * entry to a wildcard beside it.
+ * A `*` on the deny list reads as nothing by itself, like any deny entry that does — and a skill whose deny list holds one
+ * is not written at all ({@link SkillGrantTable.activate}).
  */
-export declare function compileSkillGrant(skill: SkillGrantSource, origin: SkillGrantOrigin): {
+export declare function compileSkillGrant(skill: SkillGrantSource, origin: SkillGrantOrigin, roster?: ReadonlySet<string>): {
     rows: SkillGrantRow[];
     inert: SkillInertEntry[];
 };
@@ -98,8 +95,10 @@ export declare function compileSkillGrant(skill: SkillGrantSource, origin: Skill
 export interface SkillGrantHit {
     readonly skill: string;
     readonly entries: readonly string[];
+    /** On a refusal only: the call activates `skill`, whose `disallowed-tools` entries `entries` read as nothing (why, each). */
+    readonly readsAsNothing?: readonly AllowEntryInert[];
 }
-/** The refusal a deny row writes. */
+/** The refusal a deny hit writes: a deny row's, or an activation's whose deny entries read as nothing. */
 export declare function skillDenyDecision(hit: SkillGrantHit): PermissionResult;
 /** The run's deny rows over `req` through `lane` — the refusal they write, or undefined (no lane, no row). The one
  *  reading the gate's regular decision, its approved-edit round and the resumed execution boundary share. */
@@ -111,12 +110,13 @@ export declare function skillAllowDecision(hit: SkillGrantHit, updatedInput: unk
  * releases anything — the entries it releases for the rest of the run in this mode (an entry that grants nothing, or
  * stands down in this mode, is not named). Deployment text, sanitized and capped.
  */
-export declare function skillActivationQuestion(skill: SkillGrantSource, mode: PermissionMode | undefined): string;
+export declare function skillActivationQuestion(skill: SkillGrantSource, mode: PermissionMode | undefined, roster?: ReadonlySet<string>): string;
 /** The face the gate and the resumed execution boundary read the table through, bound to the leg's call facts. */
 export interface SkillGrantLane {
     /** The allow layer's skill member: what grants this call in this mode, or undefined. */
     allowing(req: ToolCallRequest, mode: PermissionMode | undefined): SkillGrantHit | undefined;
-    /** The run's deny rows: what refuses this call, or undefined. */
+    /** What refuses this call, or undefined: the run's deny rows, else — for a call to the `Skill` tool — a named skill whose
+     *  `disallowed-tools` holds an entry that reads as nothing (`readsAsNothing`). */
     denying(req: ToolCallRequest): SkillGrantHit | undefined;
 }
 /** The gate inputs the run's skill rows ride (a member group of `ToolGateInput`). */
@@ -141,7 +141,7 @@ export interface SkillGateSeats {
 /** The `Skill` tool's per-call seat over the loaded skills: a skill that declares a list states no permission of its own. */
 export type SkillSeatReader = (args: unknown, mode: PermissionMode | undefined) => PermissionSeatReading | undefined;
 /** The reader over these skills (`undefined` when none is loaded): `Execute skill: <name>` for a skill declaring a list. */
-export declare function skillSeatReader(skills: readonly SkillGrantSource[]): SkillSeatReader | undefined;
+export declare function skillSeatReader(skills: readonly SkillGrantSource[], mounted?: MountedToolNames): SkillSeatReader | undefined;
 /**
  * The gate's seat inputs for one call, composed in ONE place: the mounted instance's static seat (`calledName`), the `Skill`
  * tool's per-call reader in the leg's live mode (only when the call's wire name is the engine's `Skill` — `skillToolName`),
@@ -162,7 +162,8 @@ export declare function skillGateWiring(opts: {
  * parent's capture, held until this child ends, and a resumed leg's frozen rows, which keep the word `model` where the
  * model wrote them) and the skills the person invoked by name (`user` — the invocation is the statement, so no card). Every invoked
  * name must be one of the loaded skills; anything else (or a value that is not a list of names) refuses the run loudly
- * (`config.user_invoked_skill_unknown`), never dropped. Returns the entries the grammar reads as nothing, across every
+ * (`config.user_invoked_skill_unknown`), never dropped; an invoked skill, or a carried deny record, whose deny entry reads as
+ * nothing refuses it too ({@link SKILL_DENY_UNREADABLE_CODE}). Returns the entries the grammar reads as nothing, across every
  * loaded skill — the start-of-run notice's content.
  */
 export declare function seedSkillGrants(table: SkillGrantTable, opts: {
@@ -170,23 +171,50 @@ export declare function seedSkillGrants(table: SkillGrantTable, opts: {
     userInvokedSkills: unknown;
     inherited: readonly SkillGrantRecord[] | undefined;
 }): readonly SkillInertEntry[];
+/**
+ * The user-invoked half of {@link seedSkillGrants}, read where no roster exists yet — a resume's pre-claim screen, over the
+ * re-supplied config: the invoked names seeded exactly as prepare seeds them, on a table told no mounted names, so only what
+ * every roster refuses alike refuses here (a name the config's skills do not carry; a deny entry the grammar alone reads as
+ * nothing). A name the leg's roster reads as stale or a near miss is prepare's to refuse; any other throw (a value prepare
+ * reports its own way) is left to prepare.
+ */
+export declare function screenUserInvokedSkills(config: {
+    readonly skills?: readonly SkillGrantSource[];
+    readonly userInvokedSkills?: unknown;
+}): void;
 /** The per-task table. Identity is the contract: the `Skill` tool, prepare's seeds, the tool ctx's snapshot and the
  *  lane all hold this one object. */
 export declare class SkillGrantTable {
     private rowsHeld;
+    private readonly rowKeys;
+    private mounted;
+    private activations;
+    /** State where the run's mounted names are read (prepare, once the roster is assembled): a skill's entries are read against
+     *  them when seeded and whenever the skill is activated. A table never told reads the grammar alone. */
+    bindMountedNames(mounted: MountedToolNames): void;
+    /** State the skills the run's `Skill` tool activates (the list it serves) and its wire name, so a call naming one whose deny
+     *  entries read as nothing is refused where the deny rows are read. A table never told refuses such a skill at activation only. */
+    bindSkills(skills: readonly SkillGrantSource[], skillToolName: string): void;
+    /** The names the run mounts as they stand, or undefined when none were stated. */
+    mountedNames(): ReadonlySet<string> | undefined;
     /** The table never holds the same row twice (skill, origin, list, entry) — one rule for both writers: a re-activation, a
      *  capture re-supplied beside the frozen rows that already carry it. Keyed on the ROW, not the skill: a definition that
      *  changed across a park writes its new rows when it is activated again. */
     private hold;
-    /** Write a skill's rows (rows already held are not held twice). Returns the entries that read as nothing. */
+    /** Write a skill's rows (rows already held are not held twice) — or none, refused with {@link SKILL_DENY_UNREADABLE_CODE},
+     *  when its `disallowed-tools` holds an entry that reads as nothing. Returns the allow entries that read as nothing. */
     activate(skill: SkillGrantSource, origin: SkillGrantOrigin): readonly SkillInertEntry[];
     /** Seed portable records (a delegated child's capture, a resumed leg's frozen rows): a record the model wrote keeps that
-     *  word, every other record seeds under `origin` — `user` is written only from this leg's own spec, never seeded. */
+     *  word, every other record seeds under `origin` — `user` is written only from this leg's own spec, never seeded. Each
+     *  record is read as its writer read it, against the leg's roster: an allow record that reads as nothing grants nothing
+     *  (not held); a deny record that does refuses the seed ({@link SKILL_DENY_UNREADABLE_CODE}) and nothing is held. */
     seed(records: readonly SkillGrantRecord[], origin: SkillGrantOrigin): void;
     /** The rows as portable records (a copy). */
     records(): readonly SkillGrantRecord[];
     /** The lane over this table, bound to the leg's call facts. */
     lane(ctx: AllowEntryJudgeContext): SkillGrantLane;
+    /** A call to the `Skill` tool naming a skill whose deny entries read as nothing, read as the activation would read it. */
+    private activationRefused;
 }
 /** Read a delegated child's capture ({@link readCarriedRecords}): `undefined` refuses the delegation. */
 export declare function readSkillGrantCapture(snapshot: readonly unknown[] | undefined): readonly SkillGrantRecord[] | undefined;
@@ -198,3 +226,6 @@ export declare function frozenSkillGrants(table: Pick<SkillGrantTable, "records"
 export declare function readFrozenSkillGrants(section: unknown): readonly SkillGrantRecord[] | undefined;
 /** The refusal for a `TaskSpec.userInvokedSkills` name the run does not carry (or a value that is not a list of names). */
 export declare const USER_INVOKED_SKILL_UNKNOWN_CODE = "config.user_invoked_skill_unknown";
+/** The refusal for a skill whose `disallowed-tools` holds an entry that reads as nothing: the activation, or the leg that
+ *  would carry the skill's deny record, does not happen. */
+export declare const SKILL_DENY_UNREADABLE_CODE = "config.skill_deny_unreadable";

package/dist/core/skill-grant.js

@@ -3,25 +3,32 @@ import { parsePermissionRule } from "./permission-rules.js";
 import { mountedToolPermissionSeat } from "./mode-policy.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 import { boundInputHashOf } from "./canonical-json.js";
-import { allowingRows, autoStripped, compileAllowEntry, compileAllowList, judgeAllowEntries } from "./allow-entry.js";
+import { allowingRows, autoStripped, compileAllowEntry, compileAllowList, inertEntryPhrase, judgeAllowEntries } from "./allow-entry.js";
 export const SKILL_GRANT_ORIGINS = Object.freeze(["model", "user", "inherited"]);
 const FROZEN_SKILL_GRANT_ORIGINS = new Set(["model", "inherited"]);
 export function skillNamedBy(args, skills) {
     const named = args?.skill;
     return typeof named === "string" ? skills.find((s) => s.name === named) : undefined;
 }
-export function skillGrantDigest(skill) {
+function skillGrantBinding(skill) {
     const canonical = (entries) => [...new Set((entries ?? []).map((e) => {
             const p = parsePermissionRule(e);
             return p.ruleContent === undefined ? p.toolName : `${p.toolName}(${p.ruleContent})`;
         }))].sort();
-    return boundInputHashOf({ skill: skill?.name ?? null, allowedTools: canonical(skill?.allowedTools), disallowedTools: canonical(skill?.disallowedTools) });
+    const boundGrants = { skill: skill?.name ?? null, allowedTools: canonical(skill?.allowedTools), disallowedTools: canonical(skill?.disallowedTools) };
+    return { boundGrantDigest: boundInputHashOf(boundGrants), boundGrants };
+}
+export function skillGrantDigest(skill) {
+    return skillGrantBinding(skill).boundGrantDigest;
 }
-export function skillCallGrantDigest(call, args, skills, skillToolName) {
-    return skills.length > 0 && wireOf("skillGrant.binding", call) === skillToolName ? skillGrantDigest(skillNamedBy(args, skills)) : undefined;
+export function skillGrantBindingMembers(call, args, skills, skillToolName) {
+    return isSkillActivationCall(call, skills, skillToolName) ? skillGrantBinding(skillNamedBy(args, skills)) : {};
+}
+function isSkillActivationCall(call, skills, skillToolName) {
+    return skills.length > 0 && wireOf("skillGrant.binding", call) === skillToolName;
 }
 export function parkedSkillApprovalRefusal(row, args, skills, skillToolName, site = "claim") {
-    if (row.boundGrantDigest === undefined && skillCallGrantDigest(row, args, skills, skillToolName) === undefined)
+    if (row.boundGrantDigest === undefined && skillGrantBindingMembers(row, args, skills, skillToolName).boundGrantDigest === undefined)
         return undefined;
     if (skillGrantDigest(skillNamedBy(args, skills)) === row.boundGrantDigest)
         return undefined;
@@ -43,18 +50,18 @@ export function detachSkillLists(skills) {
 export function declaresSkillLists(skill) {
     return (skill.allowedTools?.length ?? 0) > 0 || (skill.disallowedTools?.length ?? 0) > 0;
 }
-export function compileSkillGrant(skill, origin) {
+export function compileSkillGrant(skill, origin, roster) {
     const rows = [];
     const inert = [];
     for (const [list, behavior, entries] of [
         ["allowed-tools", "allow", skill.allowedTools ?? []],
         ["disallowed-tools", "deny", skill.disallowedTools ?? []],
     ]) {
-        const compiled = compileAllowList(entries, behavior);
+        const compiled = compileAllowList(entries, behavior, roster);
         for (const r of compiled.rows)
             rows.push({ skill: skill.name, origin, behavior, entry: r.entry, compiled: r.compiled });
         for (const i of compiled.inert)
-            inert.push({ skill: skill.name, list, entry: i.entry, reason: i.reason });
+            inert.push({ skill: skill.name, list, ...i });
     }
     return { rows, inert };
 }
@@ -65,10 +72,15 @@ function judge(rows, req, behavior, ctx) {
 export function skillDenyDecision(hit) {
     return {
         action: "deny",
-        message: `the active skill "${inlineUntrusted(hit.skill, 120)}" lists this tool in disallowed-tools (${hit.entries.map((e) => inlineUntrusted(e, 200)).join(", ")}) — refused for the rest of this run`,
+        message: hit.readsAsNothing !== undefined
+            ? skillDenyUnreadable(hit.skill, hit.readsAsNothing, "activation").message
+            : `the active skill "${inlineUntrusted(hit.skill, 120)}" lists this tool in disallowed-tools (${hit.entries.map((e) => inlineUntrusted(e, 200)).join(", ")}) — refused for the rest of this run`,
         decisionReason: "skill",
     };
 }
+function unreadDenyOf(inert) {
+    return inert.filter((i) => i.list === "disallowed-tools");
+}
 export function skillRowRefusal(lane, req) {
     const hit = lane?.denying(req);
     return hit === undefined ? undefined : skillDenyDecision(hit);
@@ -83,21 +95,21 @@ export function skillAllowDecision(hit, updatedInput) {
 }
 const CARD_ENTRIES_MAX = 10;
 const CARD_ENTRY_MAX_CHARS = 120;
-export function skillActivationQuestion(skill, mode) {
+export function skillActivationQuestion(skill, mode, roster) {
     const head = `Execute skill: ${inlineUntrusted(skill.name, 200)}`;
-    const granting = compileSkillGrant(skill, "model").rows.filter((r) => r.behavior === "allow" && !(mode === "auto" && autoStripped(r.compiled, undefined)));
+    const granting = compileSkillGrant(skill, "model", roster).rows.filter((r) => r.behavior === "allow" && !(mode === "auto" && autoStripped(r.compiled, undefined)));
     if (granting.length === 0)
         return head;
     const shown = granting.slice(0, CARD_ENTRIES_MAX).map((r) => inlineUntrusted(r.entry, CARD_ENTRY_MAX_CHARS));
     const rest = granting.length - shown.length;
     return `${head}\nApproving also lets these tools be used without asking for the rest of this run: ${shown.join(", ")}${rest > 0 ? ` and ${rest} more` : ""}`;
 }
-export function skillSeatReader(skills) {
+export function skillSeatReader(skills, mounted) {
     if (skills.length === 0)
         return undefined;
     return (args, mode) => {
         const skill = skillNamedBy(args, skills);
-        return skill !== undefined && declaresSkillLists(skill) ? { seat: "passthrough", question: skillActivationQuestion(skill, mode) } : undefined;
+        return skill !== undefined && declaresSkillLists(skill) ? { seat: "passthrough", question: skillActivationQuestion(skill, mode, mounted?.()) } : undefined;
     };
 }
 export function skillGateWiring(opts) {
@@ -123,27 +135,68 @@ export function seedSkillGrants(table, opts) {
         for (const name of invoked)
             table.activate(named(name), "user");
     }
-    return opts.skills.flatMap((s) => compileSkillGrant(s, "model").inert);
+    const roster = table.mountedNames();
+    return opts.skills.flatMap((s) => compileSkillGrant(s, "model", roster).inert);
+}
+export function screenUserInvokedSkills(config) {
+    if (config.userInvokedSkills === undefined)
+        return;
+    try {
+        seedSkillGrants(new SkillGrantTable(), { skills: config.skills ?? [], userInvokedSkills: config.userInvokedSkills, inherited: [] });
+    }
+    catch (e) {
+        const code = e?.code;
+        if (code === USER_INVOKED_SKILL_UNKNOWN_CODE || code === SKILL_DENY_UNREADABLE_CODE)
+            throw e;
+    }
 }
 export class SkillGrantTable {
     rowsHeld = [];
+    rowKeys = new Set();
+    mounted;
+    activations;
+    bindMountedNames(mounted) {
+        this.mounted = mounted;
+    }
+    bindSkills(skills, skillToolName) {
+        this.activations = { skills, skillToolName };
+    }
+    mountedNames() {
+        return this.mounted?.();
+    }
     hold(row) {
-        if (!this.rowsHeld.some((r) => r.skill === row.skill && r.origin === row.origin && r.behavior === row.behavior && r.entry === row.entry))
-            this.rowsHeld.push(row);
+        const key = JSON.stringify([row.skill, row.origin, row.behavior, row.entry]);
+        if (this.rowKeys.has(key))
+            return;
+        this.rowKeys.add(key);
+        this.rowsHeld.push(row);
     }
     activate(skill, origin) {
-        const { rows, inert } = compileSkillGrant(skill, origin);
+        const { rows, inert } = compileSkillGrant(skill, origin, this.mountedNames());
+        const unreadDeny = unreadDenyOf(inert);
+        if (unreadDeny.length > 0)
+            throw skillDenyUnreadable(skill.name, unreadDeny, "activation");
         for (const row of rows)
             this.hold(row);
         return inert;
     }
     seed(records, origin) {
+        const roster = this.mountedNames();
+        const rows = [];
+        const unreadDeny = [];
         for (const r of records) {
-            const compiled = compileAllowEntry(r.entry, r.behavior);
-            if (typeof compiled === "string")
-                continue;
-            this.hold({ skill: r.skill, origin: r.origin === "model" ? "model" : origin, behavior: r.behavior, entry: r.entry, compiled });
+            const read = compileAllowList([r.entry], r.behavior, roster);
+            const row = read.rows[0];
+            if (row !== undefined)
+                rows.push({ skill: r.skill, origin: r.origin === "model" ? "model" : origin, behavior: r.behavior, entry: r.entry, compiled: row.compiled });
+            else if (r.behavior === "deny")
+                unreadDeny.push(...read.inert.map((i) => ({ skill: r.skill, ...i })));
         }
+        const first = unreadDeny[0];
+        if (first !== undefined)
+            throw skillDenyUnreadable(first.skill, unreadDeny.filter((i) => i.skill === first.skill), "carried");
+        for (const row of rows)
+            this.hold(row);
     }
     records() {
         return this.rowsHeld.map((r) => ({ skill: r.skill, behavior: r.behavior, entry: r.entry, origin: r.origin }));
@@ -151,9 +204,17 @@ export class SkillGrantTable {
     lane(ctx) {
         return {
             allowing: (req, mode) => judge(allowingRows(this.rowsHeld, req, mode), req, "allow", ctx),
-            denying: (req) => judge(this.rowsHeld, req, "deny", ctx),
+            denying: (req) => judge(this.rowsHeld, req, "deny", ctx) ?? this.activationRefused(req),
         };
     }
+    activationRefused(req) {
+        const at = this.activations;
+        if (at === undefined || !isSkillActivationCall(req, at.skills, at.skillToolName))
+            return undefined;
+        const skill = skillNamedBy(req.args, at.skills);
+        const unread = skill === undefined ? [] : unreadDenyOf(compileSkillGrant(skill, "model", this.mountedNames()).inert);
+        return skill === undefined || unread.length === 0 ? undefined : { skill: skill.name, entries: unread.map((i) => i.entry), readsAsNothing: unread };
+    }
 }
 function readCarriedRecords(raw, carrier) {
     if (raw === undefined)
@@ -190,3 +251,15 @@ export function readFrozenSkillGrants(section) {
     return readCarriedRecords(section, "frozen");
 }
 export const USER_INVOKED_SKILL_UNKNOWN_CODE = "config.user_invoked_skill_unknown";
+export const SKILL_DENY_UNREADABLE_CODE = "config.skill_deny_unreadable";
+function skillDenyUnreadable(skill, entries, site) {
+    const listed = entries.map(inertEntryPhrase).join(", ");
+    const one = entries.length === 1;
+    const name = inlineUntrusted(skill, 120);
+    const message = site === "activation"
+        ? `Skill "${name}" was not activated: its disallowed-tools entr${one ? `y ${listed} reads` : `ies ${listed} read`} as nothing — a refusal this engine cannot read is not dropped, so the activation does not happen (its instructions are not loaded and nothing it lists is granted). Spell each entry as the tool is mounted, or remove it, in its definition.`
+        : `the grant rows carried for Skill "${name}" (a park's frozen rows, or a parent's capture) hold the disallowed-tools entr${one ? `y ${listed}, which reads` : `ies ${listed}, which read`} as nothing for this run — a refusal this engine cannot read is not dropped, so this leg does not start without it. A parked task an earlier release wrote can be finished on a worker of that release; otherwise correct the entry in its disallowed-tools and submit the task again.`;
+    const e = new Error(message);
+    e.code = SKILL_DENY_UNREADABLE_CODE;
+    return e;
+}