@sema-agent/core 7.42.1 → 7.44.0

package/dist/core/allow-entry.d.ts

@@ -1,11 +1,24 @@
+import { type RuleToolNameVerdict } from "./tool-name-aliases.js";
 import { type ToolCallRequest } from "./tool-policy.js";
 import { type AllowRuleMember, type AllowRuleShadow } from "./allow-rule-shadow.js";
 import { type PersistedRule } from "./permission-rule-model.js";
 import { type AskClass, type AssertAllKeysHandled, type PermissionMode, type PersistedRuleMandate } from "./ask-origin.js";
 import { type EngineNotice } from "./engine-notice.js";
-/** Why an entry grants (or refuses) nothing — the closed set the start-of-run notice names, for every list. */
-export declare const ALLOW_ENTRY_INERT_REASONS: readonly ["wildcard_all", "namespace_wildcard", "path_pattern", "domain", "content_unsupported", "grammar"];
+/** Why an entry grants (or refuses) nothing — the closed set the start-of-run notice names, for every list. `tool_name`: the
+ *  entry's tool name is one the name judgment reads as stale against the run's roster (`verdict` says which); `near_miss`: the
+ *  run mounts no tool of that exact name but mounts one that differs only by case (`currentName` is its spelling). */
+export declare const ALLOW_ENTRY_INERT_REASONS: readonly ["wildcard_all", "namespace_wildcard", "path_pattern", "domain", "content_unsupported", "grammar", "tool_name", "near_miss"];
 export type AllowEntryInertReason = (typeof ALLOW_ENTRY_INERT_REASONS)[number];
+/** The facts beside a `tool_name` / `near_miss` reason: the judgment's word, and the spelling to write instead when there is one. */
+export interface AllowEntryInertDetail {
+    readonly verdict?: Exclude<RuleToolNameVerdict["kind"], "current">;
+    readonly currentName?: string;
+}
+/** One entry a list reads as nothing. */
+export type AllowEntryInert = {
+    readonly entry: string;
+    readonly reason: AllowEntryInertReason;
+} & AllowEntryInertDetail;
 /** One entry the grammar reads (kind closed): a whole non-shell tool; a protocol namespace; the whole shell tool; a shell
  *  command rule; the Read directory form; a deny-side path pattern (a skill's `disallowed-tools`). */
 export type CompiledAllowEntry = {
@@ -27,22 +40,25 @@ export type CompiledAllowEntry = {
     readonly kind: "path";
     readonly rule: PersistedRule;
 };
-/** Read one entry under one direction. */
-export declare function compileAllowEntry(raw: string, behavior: "allow" | "deny"): CompiledAllowEntry | AllowEntryInertReason;
 /**
- * Compile one list WHOLE: the entries it reads and the ones it reads as nothing. An allow list holding `*` voids the list
- * (every other entry on it reads as nothing too: the list grants nothing — the safe direction). A `*` on a deny list reads
- * as nothing by itself and the rest of that list still refuses: a deny list never loses an entry to a wildcard beside it.
+ * Read one entry under one direction. `roster` = the tool names the run mounts (aliases included): given, the entry's tool name
+ * is also read against it (a stale name, or one that differs from a mounted tool's only by case, reads as `tool_name` /
+ * `near_miss`); absent, the grammar alone is read — what a resume's pre-claim screen can read before the leg has a roster.
+ */
+export declare function compileAllowEntry(raw: string, behavior: "allow" | "deny", roster?: ReadonlySet<string>): CompiledAllowEntry | AllowEntryInertReason;
+/**
+ * Compile one list WHOLE: the entries it reads and the ones it reads as nothing (each with its reason and, for a name the
+ * roster refuses, the judgment's word and the spelling to write). An allow list holding `*` voids the list (every other entry
+ * on it reads as nothing too: the list grants nothing — the safe direction). A `*` on a deny list reads as nothing by itself
+ * and the rest of that list still refuses: a deny list never loses an entry to a wildcard beside it. `roster` as in
+ * {@link compileAllowEntry}.
  */
-export declare function compileAllowList(entries: readonly string[], behavior: "allow" | "deny"): {
+export declare function compileAllowList(entries: readonly string[], behavior: "allow" | "deny", roster?: ReadonlySet<string>): {
     rows: Array<{
         entry: string;
         compiled: CompiledAllowEntry;
     }>;
-    inert: Array<{
-        entry: string;
-        reason: AllowEntryInertReason;
-    }>;
+    inert: AllowEntryInert[];
 };
 /** The programs whose open allow rule the reference implementation drops in auto mode — its interpreter / launcher table
  *  plus the shells and the run-anything builtins (2.1.280). A program that only reaches the network is not here. */
@@ -117,11 +133,10 @@ export interface AllowEntryGateSeats {
  */
 export declare class AllowEntryTable {
     private held;
-    /** Write a list's rows (a row already held is not held twice). Returns the entries that read as nothing. */
-    seed(entries: readonly string[]): ReadonlyArray<{
-        entry: string;
-        reason: AllowEntryInertReason;
-    }>;
+    private readonly heldEntries;
+    /** Write a list's rows (a row already held is not held twice). Returns the entries that read as nothing. `roster` as in
+     *  {@link compileAllowEntry}: a list the leg itself wrote is read against it, a carried one (a delegating parent's capture) is not. */
+    seed(entries: readonly string[], roster?: ReadonlySet<string>): readonly AllowEntryInert[];
     /** The entries held, as written (a copy) — what a delegated child is handed. */
     entries(): readonly string[];
     /** The lane over this table, bound to the leg's call facts. */
@@ -129,8 +144,10 @@ export declare class AllowEntryTable {
 }
 /**
  * Seed one leg's request and deployment tables — a delegated child's captured request entries first (an entry that reads as
- * nothing was announced where it was written), then the leg's own list; the deployment's (announced once, at construction) —
- * and return the dead entries of the leg's OWN lists, the skills' beside the request's, for its one start-of-run notice.
+ * nothing was announced where it was written, and is read without the roster for the same reason), then the leg's own list
+ * against `roster`; the deployment's grammar reading is announced once, at construction, so only its name readings
+ * (`tool_name`, `near_miss` — facts about THIS leg's roster) are announced here — and return the dead entries of the leg's
+ * OWN lists, the skills' beside the request's, for its one start-of-run notice.
  */
 export declare function seedAllowEntryTables(tables: {
     readonly request: AllowEntryTable;
@@ -139,13 +156,11 @@ export declare function seedAllowEntryTables(tables: {
     skillInert: ReadonlyArray<{
         skill: string;
         list: "allowed-tools" | "disallowed-tools";
-        entry: string;
-        reason: AllowEntryInertReason;
-    }>;
+    } & AllowEntryInert>;
     inherited: readonly string[] | undefined;
     request: readonly string[] | undefined;
     deployment: readonly string[] | undefined;
-}): AllowEntryInertNote[];
+}, roster: ReadonlySet<string>): AllowEntryInertNote[];
 /** The deployment's allow rules, read ONCE at construction: screened (a value that is not a list of strings refuses), frozen,
  *  and its dead entries announced once (no session). Returns the deps with the snapshot in place of the caller's list. */
 export declare function withDeploymentAllowedTools<D extends {
@@ -181,6 +196,7 @@ declare const SHADOW_REASON: {
     readonly rule_unreadable: "this call could not be read against a deny or ask rule, so whether one forbids it is unknown";
     readonly ask_rule: string;
     readonly denial_limit_fallback: "the auto-mode classifier refused too many calls in a row, so a person decides";
+    readonly classifier_no_ruling: "the auto-mode classifier could not judge this call, so a person decides";
     readonly requires_user_interaction: "this tool's server declares that a call must be put to a person";
     readonly operator_forced: "this call arrived already marked as requiring confirmation (an earlier layer of this run, or the task that delegated it, judged it so) — it is cleared by confirming this call, never by a standing allow rule";
     readonly shell_floor: string;
@@ -221,21 +237,24 @@ export declare function cardDisclosureOf(decision: {
 /** The notice for list entries that grant (or refuse) nothing — one code for every list. */
 export declare const ALLOWED_TOOL_NOT_GRANTED_CODE = "permission.allowed_tool_not_granted";
 /** One entry that reads as nothing, and the list it came from (a skill's names the skill and which of its two lists). */
-export type AllowEntryInertNote = {
+export type AllowEntryInertNote = ({
     readonly source: "skill";
     readonly skill: string;
     readonly list: "allowed-tools" | "disallowed-tools";
-    readonly entry: string;
-    readonly reason: AllowEntryInertReason;
-} | {
+} & AllowEntryInert) | ({
     readonly source: AllowEntrySource;
-    readonly entry: string;
-    readonly reason: AllowEntryInertReason;
-};
+} & AllowEntryInert);
+/**
+ * One entry that reads as nothing, as a person reads it: the entry as written (quoted, so a surrounding space shows) and why
+ * — the reason word, with the spelling to write when the reading has one. The one phrasing the start-of-run notice and a
+ * skill's refused activation share.
+ */
+export declare function inertEntryPhrase(e: AllowEntryInert): string;
 /**
  * The notice for entries this grammar reads as nothing — delivered only when one exists: once per prepared task for the
  * skill and request lists (`sessionId` given), once per Runner for the deployment's list. The person whose list it is
- * reads it (audience `user`); the run goes on (an entry that grants nothing makes it ask more).
+ * reads it (audience `user`); the run goes on (an entry that grants nothing makes it ask more). A skill whose
+ * `disallowed-tools` holds such an entry is named as one that does not activate.
  */
 export declare function allowedToolsNotGrantedNotice(inert: readonly AllowEntryInertNote[], sessionId: string | undefined): EngineNotice;
 export {};

package/dist/core/allow-entry.js

@@ -1,6 +1,7 @@
 import { heldBy } from "./tool-name-readings.js";
 import { isNamespacedCoveringRuleName, namespacedRuleNameCovers, parsePermissionRule } from "./permission-rules.js";
-import { protocolOf } from "./protocol-table.js";
+import { judgeRuleToolName, splitNamespacedName } from "./tool-name-aliases.js";
+import { catalogToolNames } from "./tool-registry.js";
 import { COARSE_SHELL_TOOLS } from "./tool-policy.js";
 import { ALLOW_RULE_MEMBERS } from "./allow-rule-shadow.js";
 import { COMMAND_RULE_TOOL, READ_RULE_TOOL, findAdmittingRule, laneToolNamesOf, parseRuleText, programRunReachOf, ruleToolGrammarOf } from "./permission-rule-model.js";
@@ -9,66 +10,95 @@ import { splitShellCompoundSegments } from "../tools/fs/bash-readonly-classifier
 import { mandateDisclosureOf } from "./ask-origin.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 import { deliverEngineNotice } from "./engine-notice.js";
-export const ALLOW_ENTRY_INERT_REASONS = Object.freeze(["wildcard_all", "namespace_wildcard", "path_pattern", "domain", "content_unsupported", "grammar"]);
+export const ALLOW_ENTRY_INERT_REASONS = Object.freeze(["wildcard_all", "namespace_wildcard", "path_pattern", "domain", "content_unsupported", "grammar", "tool_name", "near_miss"]);
 function ruleRowOf(parsed) {
     return { ...parsed, scope: { kind: "global" }, adds: [{ dot: { actor: "list", counter: 1 }, origin: "user", createdAt: "" }] };
 }
 const TOOL_NAME_SPELLING = /^[^\s()]+$/;
-export function compileAllowEntry(raw, behavior) {
+function mountedSpellingOf(name, roster) {
+    const folded = name.toLowerCase();
+    for (const mounted of roster)
+        if (mounted.toLowerCase() === folded)
+            return mounted;
+    return undefined;
+}
+function toolNameReading(name, roster) {
+    const verdict = judgeRuleToolName(name, roster);
+    if (verdict.kind !== "current") {
+        const currentName = verdict.kind === "unprefixed_namespace" ? undefined : verdict.currentName;
+        return { inert: "tool_name", detail: { verdict: verdict.kind, ...(currentName !== undefined ? { currentName } : {}) } };
+    }
+    if (roster.has(name) || catalogToolNames().has(name) || splitNamespacedName(name) !== undefined)
+        return undefined;
+    const mounted = mountedSpellingOf(name, roster);
+    return mounted === undefined ? undefined : { inert: "near_miss", detail: { currentName: mounted } };
+}
+function readAllowEntry(raw, behavior, roster) {
+    const inert = (reason) => ({ inert: reason });
+    const row = (compiled) => ({ compiled });
     if (raw !== raw.trim())
-        return "grammar";
+        return inert("grammar");
     const parsed = parsePermissionRule(raw);
     const name = parsed.toolName;
     if (!TOOL_NAME_SPELLING.test(name))
-        return "grammar";
+        return inert("grammar");
     if (name === "*")
-        return "wildcard_all";
+        return inert("wildcard_all");
+    if (roster !== undefined) {
+        const stale = toolNameReading(name, roster);
+        if (stale !== undefined)
+            return stale;
+    }
     if (parsed.ruleContent === undefined) {
-        const ns = protocolOf(name);
-        if (ns !== undefined) {
-            if (name.slice(ns.prefix.length).split("__")[0]?.includes("*") === true)
-                return "namespace_wildcard";
+        const split = splitNamespacedName(name);
+        if (split !== undefined) {
+            if (split.peer.includes("*"))
+                return inert("namespace_wildcard");
             if (isNamespacedCoveringRuleName(name))
-                return { kind: "namespace", pattern: name };
-            return { kind: "tool", name };
+                return row({ kind: "namespace", pattern: name });
+            return row({ kind: "tool", name });
         }
-        return COARSE_SHELL_TOOLS.includes(name) ? { kind: "shell", name } : { kind: "tool", name };
+        return row(COARSE_SHELL_TOOLS.includes(name) ? { kind: "shell", name } : { kind: "tool", name });
     }
     if (name === COMMAND_RULE_TOOL) {
         const allowRead = parseRuleText(raw, behavior);
         if ("rule" in allowRead)
-            return { kind: "command", rule: ruleRowOf(allowRead.rule) };
+            return row({ kind: "command", rule: ruleRowOf(allowRead.rule) });
         if (behavior === "allow" && allowRead.reject.code === "invalid.bare_interpreter_prefix") {
             const wide = parseRuleText(raw, "deny");
             if ("rule" in wide)
-                return { kind: "command", rule: ruleRowOf({ ...wide.rule, behavior: "allow" }) };
+                return row({ kind: "command", rule: ruleRowOf({ ...wide.rule, behavior: "allow" }) });
         }
-        return "grammar";
+        return inert("grammar");
     }
     if (ruleToolGrammarOf(name) === "path") {
         const read = parseRuleText(raw, behavior);
         if ("rule" in read) {
             if (read.rule.match === "subpath" && read.rule.tool === READ_RULE_TOOL && behavior === "allow")
-                return { kind: "read_dir", rule: ruleRowOf(read.rule) };
+                return row({ kind: "read_dir", rule: ruleRowOf(read.rule) });
             if (behavior === "deny")
-                return { kind: "path", rule: ruleRowOf(read.rule) };
+                return row({ kind: "path", rule: ruleRowOf(read.rule) });
         }
-        return "path_pattern";
+        return inert("path_pattern");
     }
     if (/^domain:/.test(parsed.ruleContent))
-        return "domain";
-    return "content_unsupported";
+        return inert("domain");
+    return inert("content_unsupported");
 }
-export function compileAllowList(entries, behavior) {
+export function compileAllowEntry(raw, behavior, roster) {
+    const read = readAllowEntry(raw, behavior, roster);
+    return "compiled" in read ? read.compiled : read.inert;
+}
+export function compileAllowList(entries, behavior, roster) {
     const voided = behavior === "allow" && entries.some((e) => compileAllowEntry(e, behavior) === "wildcard_all");
     const rows = [];
     const inert = [];
     for (const entry of entries) {
-        const compiled = voided ? "wildcard_all" : compileAllowEntry(entry, behavior);
-        if (typeof compiled === "string")
-            inert.push({ entry, reason: compiled });
+        const read = voided ? { inert: "wildcard_all" } : readAllowEntry(entry, behavior, roster);
+        if ("compiled" in read)
+            rows.push({ entry, compiled: read.compiled });
         else
-            rows.push({ entry, compiled });
+            inert.push({ entry, reason: read.inert, ...read.detail });
     }
     return { rows, inert };
 }
@@ -179,11 +209,15 @@ export function allowingRows(rows, req, mode) {
 }
 export class AllowEntryTable {
     held = [];
-    seed(entries) {
-        const { rows, inert } = compileAllowList(entries, "allow");
-        for (const r of rows)
-            if (!this.held.some((h) => h.entry === r.entry))
-                this.held.push({ behavior: "allow", entry: r.entry, compiled: r.compiled });
+    heldEntries = new Set();
+    seed(entries, roster) {
+        const { rows, inert } = compileAllowList(entries, "allow", roster);
+        for (const r of rows) {
+            if (this.heldEntries.has(r.entry))
+                continue;
+            this.heldEntries.add(r.entry);
+            this.held.push({ behavior: "allow", entry: r.entry, compiled: r.compiled });
+        }
         return inert;
     }
     entries() {
@@ -198,11 +232,15 @@ export class AllowEntryTable {
         };
     }
 }
-export function seedAllowEntryTables(tables, lists) {
+export function seedAllowEntryTables(tables, lists, roster) {
     tables.request.seed(lists.inherited ?? []);
-    const requestInert = tables.request.seed(lists.request ?? []);
-    tables.deployment.seed(lists.deployment ?? []);
-    return [...lists.skillInert.map((e) => ({ source: "skill", ...e })), ...requestInert.map((e) => ({ source: "request", ...e }))];
+    const requestInert = tables.request.seed(lists.request ?? [], roster);
+    const deploymentInert = tables.deployment.seed(lists.deployment ?? [], roster).filter((e) => e.reason === "tool_name" || e.reason === "near_miss");
+    return [
+        ...lists.skillInert.map((e) => ({ source: "skill", ...e })),
+        ...requestInert.map((e) => ({ source: "request", ...e })),
+        ...deploymentInert.map((e) => ({ source: "deployment", ...e })),
+    ];
 }
 export function withDeploymentAllowedTools(deps) {
     if (deps.allowedTools === undefined)
@@ -276,6 +314,7 @@ const SHADOW_REASON = {
     rule_unreadable: "this call could not be read against a deny or ask rule, so whether one forbids it is unknown",
     ask_rule: mandateDisclosureOf(undefined),
     denial_limit_fallback: "the auto-mode classifier refused too many calls in a row, so a person decides",
+    classifier_no_ruling: "the auto-mode classifier could not judge this call, so a person decides",
     requires_user_interaction: "this tool's server declares that a call must be put to a person",
     operator_forced: "this call arrived already marked as requiring confirmation (an earlier layer of this run, or the task that delegated it, judged it so) — it is cleared by confirming this call, never by a standing allow rule",
     shell_floor: mandateDisclosureOf("operator_always"),
@@ -327,14 +366,38 @@ export function cardDisclosureOf(decision, fallbackMessage) {
 }
 export const ALLOWED_TOOL_NOT_GRANTED_CODE = "permission.allowed_tool_not_granted";
 const NOTICE_ENTRIES_SHOWN = 5;
+export function inertEntryPhrase(e) {
+    const spelling = e.currentName !== undefined ? inlineUntrusted(e.currentName, 120) : undefined;
+    const why = (() => {
+        if (e.reason === "near_miss")
+            return `near_miss: the mounted spelling is "${spelling}"`;
+        if (e.reason !== "tool_name" || e.verdict === undefined)
+            return e.reason;
+        switch (e.verdict) {
+            case "retired":
+                return `tool_name: a retired tool name${spelling !== undefined ? `, now "${spelling}"` : ""}`;
+            case "unprefixed_namespace":
+                return 'tool_name: a "__" name with no protocol prefix';
+            case "unmintable_segment":
+                return `tool_name: a peer segment the engine never mints${spelling !== undefined ? `, write "${spelling}"` : ""}`;
+            default: {
+                const exhaustive = e.verdict;
+                return exhaustive;
+            }
+        }
+    })();
+    return `${inlineUntrusted(JSON.stringify(e.entry), 122)} (${why})`;
+}
 export function allowedToolsNotGrantedNotice(inert, sessionId) {
     const where = (e) => (e.source === "skill" ? `skill ${inlineUntrusted(e.skill, 80)} ${e.list}` : e.source === "request" ? "this run's allowedTools" : "the deployment's allowedTools");
-    const shown = inert.slice(0, NOTICE_ENTRIES_SHOWN).map((e) => `${where(e)} "${inlineUntrusted(e.entry, 120)}" (${e.reason})`);
+    const shown = inert.slice(0, NOTICE_ENTRIES_SHOWN).map((e) => `${where(e)} ${inertEntryPhrase(e)}`);
     const rest = inert.length - shown.length;
+    const refusing = inert.some((e) => "list" in e && e.list === "disallowed-tools");
     return {
         code: ALLOWED_TOOL_NOT_GRANTED_CODE,
         message: `${inert.length} allowed-tools entr${inert.length === 1 ? "y grants" : "ies grant"} or refuse${inert.length === 1 ? "s" : ""} nothing — ${shown.join("; ")}${rest > 0 ? `; and ${rest} more` : ""}. ` +
-            "A list holding `*` voids the list, `mcp__*` names no server, and a write-path or domain entry has no allow reading; name the tools (or `mcp__<server>`) instead.",
+            "A list holding `*` voids the list, `mcp__*` names no server, a write-path or domain entry has no allow reading, and a tool name must be spelled as the tool is mounted; name the tools (or `mcp__<server>`) instead." +
+            (refusing ? " Such an entry in a disallowed-tools list keeps its Skill from activating: a refusal that reads as nothing is not dropped." : ""),
         detail: { ...(sessionId !== undefined ? { sessionId } : {}), entries: inert.map((e) => ({ ...e })) },
     };
 }

package/dist/core/ask-origin.d.ts

@@ -445,8 +445,11 @@ export type ToolMarkSource = "deployment" | "mcp_annotation" | "a2a_default";
  * row cell by cell, because the reference implementation judges the declaration ahead of its allow-rule lookup and its bypass release.
  * `unstated` is the mode's answer for a call nobody stated: a tool whose permission seat is `passthrough` (it states no
  * permission of its own — a remote peer's tool) reached the end of the fold with an allow no layer stated.
+ * `classifier_no_ruling` is a classifier station's question to a person because the auto-mode classification did not rule
+ * (`classifierNoRuling` — it could not run, or replied with no verdict): the denial-limit fallback's row (only a person
+ * answers it; the classifier is never asked again).
  */
-export declare const ASK_CLASSES: readonly ["content_question", "hook", "ancestor", "unverifiable_delete", "transcript_write", "org_rule", "governance_unavailable", "rule_unreadable", "ask_rule", "denial_limit_fallback", "requires_user_interaction", "operator_forced", "shell_floor", "write_protection_unresolved", "probe", "write_protection", "tool_marks_mcp", "tool_marks_a2a", "policy_rra", "artifact_shared_read", "mode", "unstated", "ordinary"];
+export declare const ASK_CLASSES: readonly ["content_question", "hook", "ancestor", "unverifiable_delete", "transcript_write", "org_rule", "governance_unavailable", "rule_unreadable", "ask_rule", "denial_limit_fallback", "classifier_no_ruling", "requires_user_interaction", "operator_forced", "shell_floor", "write_protection_unresolved", "probe", "write_protection", "tool_marks_mcp", "tool_marks_a2a", "policy_rra", "artifact_shared_read", "mode", "unstated", "ordinary"];
 export type AskClass = (typeof ASK_CLASSES)[number];
 /** Membership test for {@link AskClass} — the word crosses the wire on `tool_end.gate.disposition`. */
 export declare function isAskClass(v: unknown): v is AskClass;
@@ -549,6 +552,13 @@ export declare const MODE_ARBITRATION: {
         readonly ruleMayClear: false;
         readonly hookAskFloor: false;
     };
+    readonly classifier_no_ruling: {
+        readonly bypassImmune: true;
+        readonly classifierEligible: false;
+        readonly sandboxAdmission: false;
+        readonly ruleMayClear: false;
+        readonly hookAskFloor: false;
+    };
     readonly requires_user_interaction: {
         readonly bypassImmune: true;
         readonly classifierEligible: false;
@@ -725,9 +735,10 @@ export declare function classifyAsk(d: Extract<PermissionResult, {
  *  and the ask's prompt as what was requested. The gate appends the caller-side remedy. */
 export declare function headlessDenialMessage(toolName: string, askMessage: string): string;
 /** The state of the approver seat a remedy is written for: `absent` — no approver is wired for the leg; `unavailable` — one is
- *  wired and answered that nobody is reachable for this ask. Absent in the input reads as `absent` (the posture the
- *  function was written for). */
-export type HeadlessApproverSeat = "absent" | "unavailable";
+ *  wired and answered that nobody is reachable for this ask; `declared_none` — the run declared that nobody on it can be
+ *  asked (`approvalReach: "none"`), whatever is wired. Absent in the input reads as `absent` (the posture the function was
+ *  written for). */
+export type HeadlessApproverSeat = "absent" | "unavailable" | "declared_none";
 /**
  * The ONE sentence a headless auto-deny (an ask that reached its final deny because no approver is wired) adds
  * after its refusal: the caller-side change that would have let this call run. Read off the effective mode, the
@@ -741,7 +752,7 @@ export type HeadlessApproverSeat = "absent" | "unavailable";
  *  · any other releasable ask — `bypassPermissions` releases it (disclosed on the call).
  * Every arm also names the approver, in the clause of the seat's own state ({@link HeadlessApproverSeat}): none wired ⇒
  * wire one; one wired that answered `unavailable` for this ask ⇒ make a person reachable through it (a wired approver is
- * never told to be wired). The refusal's tool text and the `delegation.ask_unresolvable` notice both carry this sentence —
+ * never told to be wired); the run declared nobody can be asked ⇒ run it where a person can be, or park it. The refusal's tool text and the `delegation.ask_unresolvable` notice both carry this sentence —
  * they call this function, neither spells it.
  */
 export declare function headlessApprovalRemedy(input: {

package/dist/core/ask-origin.js

@@ -177,6 +177,7 @@ export const ASK_CLASSES = Object.freeze([
     "rule_unreadable",
     "ask_rule",
     "denial_limit_fallback",
+    "classifier_no_ruling",
     "requires_user_interaction",
     "operator_forced",
     "shell_floor",
@@ -206,6 +207,7 @@ export const MODE_ARBITRATION = {
     rule_unreadable: { bypassImmune: false, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false },
     ask_rule: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: true },
     denial_limit_fallback: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false },
+    classifier_no_ruling: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false },
     requires_user_interaction: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: true },
     operator_forced: { bypassImmune: true, classifierEligible: true, sandboxAdmission: true, ruleMayClear: false, hookAskFloor: false },
     shell_floor: { bypassImmune: true, classifierEligible: true, sandboxAdmission: true, ruleMayClear: false, hookAskFloor: false },
@@ -220,7 +222,7 @@ export const MODE_ARBITRATION = {
     unstated: { bypassImmune: false, classifierEligible: true, sandboxAdmission: false, ruleMayClear: true, hookAskFloor: false },
     ordinary: { bypassImmune: false, classifierEligible: true, sandboxAdmission: true, ruleMayClear: true, hookAskFloor: false },
 };
-export const RRA_EXPLAINERS = new Set(["unverifiable_delete", "transcript_write", "org_rule", "governance_unavailable", "rule_unreadable", "denial_limit_fallback", "ancestor", "artifact_shared_read", "requires_user_interaction"]);
+export const RRA_EXPLAINERS = new Set(["unverifiable_delete", "transcript_write", "org_rule", "governance_unavailable", "rule_unreadable", "denial_limit_fallback", "classifier_no_ruling", "ancestor", "artifact_shared_read", "requires_user_interaction"]);
 export const RELEASABLE_ASK_CLASSES = ASK_CLASSES.filter((c) => !MODE_ARBITRATION[c].bypassImmune);
 export const MODE_RELEASE_REASONS = Object.freeze(["rule_unreadable"]);
 const MODE_RELEASE_REASON_SET = new Set(MODE_RELEASE_REASONS);
@@ -253,6 +255,8 @@ export function decisionAskClassesOf(d) {
         out.add("ask_rule");
     if (d.denialLimitFallback !== undefined)
         out.add("denial_limit_fallback");
+    if (d.classifierNoRuling !== undefined)
+        out.add("classifier_no_ruling");
     if (d.authoredBy === "deployment")
         out.add("operator_forced");
     if (d.probeMandated === true)
@@ -333,10 +337,14 @@ export function classifyAsk(d, facts) {
     return { classes, askClass, row: foldArbitrationRow(classes) };
 }
 export function headlessDenialMessage(toolName, askMessage) {
-    return `Permission for this tool use was denied: it requires interactive approval, and permission prompts are not available in this session (no approver is wired for "${toolName}" — headless auto-deny). The action was NOT performed. Do not claim it succeeded, and do not retry it in this session — report the limitation to the user, or suggest an alternative. What was requested: ${askMessage}`;
+    return `Permission for this tool use was denied: it requires interactive approval, and permission prompts are not available in this session (nobody can be asked to approve "${toolName}" in this run — headless auto-deny). The action was NOT performed. Do not claim it succeeded, and do not retry it in this session — report the limitation to the user, or suggest an alternative. What was requested: ${askMessage}`;
 }
 export function headlessApprovalRemedy(input) {
-    const approver = input.approverSeat === "unavailable" ? "make a person reachable through the approver that is wired (it answered `unavailable` for this ask)" : "wire an approver (`onAsk`) to put it to a person";
+    const approver = input.approverSeat === "unavailable"
+        ? "make a person reachable through the approver that is wired (it answered `unavailable` for this ask)"
+        : input.approverSeat === "declared_none"
+            ? 'run it where a person can be asked — this run declares `approvalReach: "none"` (nobody on it can be asked) — or arm a durable approval park so the ask waits for a person'
+            : "wire an approver (`onAsk`) to put it to a person";
     const c = input.classification;
     if (input.mode === "acceptEdits" && input.unplacedOptions !== undefined && (c === undefined || (c.classes.size === 1 && c.classes.has("ordinary"))))
         return `${fileCommandOptionsSentence(input.unplacedOptions.program)} Spell the ${input.unplacedOptions.program} without option words for the mode to answer it, or ${approver}`;

package/dist/core/ask-unresolvable-notice.d.ts

@@ -5,8 +5,9 @@
  *  · `approver_unavailable` — the approver consulted for the call (the run's own seat, or an ancestor's
  *    frozen seat on a delegated child) answered the ROUTING question `unavailable` and no durable park
  *    took the call afterwards (`tool_end.gate.settlement.kind:"approver_unavailable"`);
- *  · `no_approver_wired` — no approver (or, for a question, no question face) is wired for this run, or
- *    the seat is the deny posture string: the headless auto-deny (`settlement.kind:"no_approver"`);
+ *  · `no_approver_wired` — nobody in this run can be asked: no approver (or, for a question, no question face) is
+ *    wired, the seat is the deny posture string, or the run declared that nobody on it can be asked
+ *    (`approvalReach: "none"`): the headless auto-deny (`settlement.kind:"no_approver"`);
  *  · `mandate_unreconstructible` — an inherited durable-approval mandate binds the ask and THIS leg has no
  *    park facility to honor it, so the delegated child refuses in-fold rather than let a synchronous layer
  *    resolve what its ancestor bound to a park (an in-fold deny; no settlement rides the frame).

package/dist/core/ask-unresolvable-notice.js

@@ -6,7 +6,7 @@ export function isAskUnresolvableCause(v) {
 }
 const CAUSE_CLAUSE = {
     approver_unavailable: "the approver reported that nobody is reachable for this ask",
-    no_approver_wired: "no approver (or question face) is wired for this run — the headless posture",
+    no_approver_wired: "nobody in this run can be asked to answer it — the headless posture",
     mandate_unreconstructible: "an inherited durable-approval mandate binds this ask and this leg has no park facility to honor it",
 };
 const CAUSE_REMEDY_SEAT = {

package/dist/core/auto-mode.d.ts

@@ -166,11 +166,12 @@ export declare function rungDidNotRule(v: AutoModeVerdict): AutoModeFallbackCaus
  */
 export declare function classifierUnavailableDenyMessage(toolName: string, cause: AutoModeUnavailableCause, attribution?: AutoModeClassifierRound): string;
 /**
- * The text an ask carries to a person when the classifier could not rule on it and the leg has an approval seat
- * (the gate's classifier station and the inherited station): the ask's own text first — the card still says what
- * is being asked — then why auto mode is asking at all. One writer for both stations.
+ * The text an ask carries to a person when the classifier did not rule on it ({@link rungDidNotRule}) and the leg has an
+ * approval seat (the gate's classifier station and the inherited station): the ask's own text first — the card still
+ * says what is being asked — then why auto mode is asking at all, read off the same cause the ask's `classifierNoRuling`
+ * member carries (a client that does not read the member reads this). One writer for both stations.
  */
-export declare function classifierUnavailableAskMessage(askText: string, cause: AutoModeUnavailableCause): string;
+export declare function classifierNoRulingAskMessage(askText: string, cause: AutoModeFallbackCause): string;
 /**
  * The model-facing deny text for a `parse_error` verdict — CC 2.1.259 `i7t` stem ("Auto mode could not evaluate
  * this action and is blocking it for safety"; 2.1.250 `Ure`): the classifier answered, but not with a verdict,

package/dist/core/auto-mode.js

@@ -84,7 +84,9 @@ export function classifierUnavailableDenyMessage(toolName, cause, attribution) {
         "If it keeps failing, continue with other tasks that don't require this action and come back to it later. " +
         "Note: reading files, searching code, and other read-only operations do not require the classifier and can still be used.");
 }
-export function classifierUnavailableAskMessage(askText, cause) {
+export function classifierNoRulingAskMessage(askText, cause) {
+    if (cause === "parse_error")
+        return `${askText}\n\nThe auto-mode classifier replied without a verdict, so auto mode could not judge this call; it needs an approval instead of the classifier's verdict.`;
     const parenthetical = cause === "timeout" ? " (timed out)" : "";
     return `${askText}\n\nThe auto-mode classifier is temporarily unavailable${parenthetical}, so auto mode could not judge this call; it needs an approval instead of the classifier's verdict.`;
 }