@sema-agent/core 7.42.1 → 7.44.0

package/dist/core/permission-rule-model.d.ts

@@ -156,14 +156,27 @@ export declare function callPathFaceOf(call: ToolCallLike): DenyFace | undefined
 /** Does some {@link PATH_RULE_FACES} ask column hold `face` — may a face-keyed ask row speak for a call on it, whatever
  *  the call's tool is called (a caller's tool declaring a read path target is on the read face too)? */
 export declare function faceAskSpeaksFor(face: DenyFace | undefined): boolean;
+/**
+ * The tools whose rule content NAMES THE VALUE of one parameter instead of a command or a path — the reference's `Skill(<name>)`
+ * form, one row per tool: `param` is the argument the rule's content is read against, `params` every scalar argument the tool
+ * carries (the parameter spelling `Tool(<param>:<pattern>)` those names used to reach is retired for such a tool, see
+ * {@link parseNameRuleContent}). The tool's real schema keys are pinned equal to `params` (test/backlog1318).
+ */
+export declare const NAME_RULE_FACES: Readonly<Record<string, {
+    readonly param: string;
+    readonly params: readonly string[];
+}>>;
 /**
  * Which tools a rule may name — the model's tool set is DERIVED, never a hand-kept list: the shell tool
  * takes the COMMAND grammar; every tool the catalog declares a path target for (Read / Edit / Write /
- * Glob / NotebookEdit / …, `pathTargetOf`) takes the PATH grammar. A rule on any other tool has no
- * content this model can judge and is refused (`unsupported.tool`). The tool set therefore moves with the
- * catalog's declarations, exactly as the protective fences' covered set does.
+ * Glob / NotebookEdit / …, `pathTargetOf`) takes the PATH grammar; the tools of {@link NAME_RULE_FACES} take the NAME grammar.
+ * A rule on any other tool has no content this model can judge and is refused (`unsupported.tool`). The tool set therefore
+ * moves with the catalog's declarations, exactly as the protective fences' covered set does.
  */
-export declare function ruleToolGrammarOf(toolName: string): "command" | "path" | undefined;
+export declare function ruleToolGrammarOf(toolName: string): "command" | "path" | "name" | undefined;
+/** The value a name-grammar tool's call carries in its name argument — the string every NAME rule is read against, the one a
+ *  `Skill` call is resolved by — or undefined (not a name-grammar tool; no such argument; not a string). */
+export declare function nameRuleSubjectOf(toolName: string, args: unknown): string | undefined;
 /** The names the persisted grammar judges a call under: every name the call answers to (the model's spelling, the wire
  *  name, the other aliases that resolve to it) the grammar speaks for, so a stored `Bash(…)` or `Edit(…)` row reaches a
  *  tool that answers to that name under another wire name, as a policy's rule does. Empty ⇒ the grammar speaks for none. */
@@ -191,7 +204,7 @@ export declare function laneToolNamesOf(req: Pick<import("./tool-policy.js").Too
  *    otherwise the working directory). Its predicate is {@link pathRuleReaches}. Not an allow form: a
  *    standing approval by path pattern would be a wider grant than any card ever shows a person.
  */
-export type PersistedRuleMatch = "exact" | "prefix" | "wildcard" | "subpath" | "path";
+export type PersistedRuleMatch = "exact" | "prefix" | "wildcard" | "subpath" | "path" | "name" | "name_prefix";
 /**
  * Where a rule applies — design/382 §4.1, the THREE consent dimensions.
  *
@@ -525,6 +538,9 @@ export declare function parseRuleText(text: string, behavior: RuleBehavior): {
  *  `subpath` the command is the lexical-normal absolute directory (one leading slash), re-spelled in the
  *  double-slash directory form; for `path` it is the pattern as spelled. */
 export declare function formatRuleText(command: string, match: PersistedRuleMatch, tool: PersistedRuleTool): string;
+/** Does a name rule reach this name? `name`: equal; `name_prefix`: begins with it (no boundary — the reference's `startsWith`).
+ *  A rule of any other family reaches no name. */
+export declare function nameRuleAdmits(rule: Pick<PersistedRule, "match" | "command">, name: string): boolean;
 /**
  * The closed set of BASES a path-form pattern resolves against — facts of the CALL (its execution
  * environment and its task), never of the rule:
@@ -675,8 +691,8 @@ export type ProgramRunReachOutcome = {
  * other segment already reached.
  *
  * A rule body the lexer cannot read (foreign store bytes; every entrance validates against exactly
- * this) reaches nothing. A path-family rule (`subpath` / `path`) reaches no command: its predicates are
- * {@link directoryRuleAdmits} and {@link pathRuleReaches}.
+ * this) reaches nothing. A rule of another family (path: `subpath` / `path`; name: `name` / `name_prefix`) reaches no
+ * command: its predicates are {@link directoryRuleAdmits}, {@link pathRuleReachOf} and {@link nameRuleAdmits}.
  */
 export declare function programRunReachOf(rule: Pick<PersistedRule, "match" | "command">, command: string): ProgramRunReachOutcome;
 /** The boolean face of {@link programRunReachOf}: `reached` only. The shadow view and the pins that
@@ -926,6 +942,30 @@ export declare function adjudicatePersistedPathRules(rules: readonly PersistedRu
     readonly tighten?: PathTargetReading;
     readonly allow?: PathTargetReading;
 }, bases: PathRuleBases): PersistedRuleVerdict | undefined;
+/**
+ * The name-family sibling of {@link adjudicatePersistedRules}: the same precedence walk over the rules of one name tool
+ * ({@link NAME_RULE_FACES}), judged on the one string the call names (`nameRuleSubjectOf`). A rule of the tool speaks for the call
+ * when it is live, of this behavior, in scope ({@link eligiblePersisted}, the one predicate) and {@link nameRuleAdmits} the name; the
+ * first behavior in {@link RULE_BEHAVIORS_BY_PRECEDENCE} whose rules speak decides, the first table-order rule of it is the answer.
+ * Every behavior is judged with the one predicate — a name has no "program run" the tightening direction could read wider — and
+ * there is nothing unreadable: a name is a string.
+ */
+export declare function adjudicatePersistedNameRules(rules: readonly PersistedRule[], call: {
+    tool: string;
+    name: string | undefined;
+    cwd: string | undefined;
+    sessionId?: string;
+}): PersistedRuleVerdict | undefined;
+/**
+ * The ONE offer a name tool's approval card carries: the exact rule for the name the call carries (`Skill(<name>)`, the reference's
+ * "don't ask again for <skill>" row), or undefined when no rule spells exactly that name (the round-trip law: the canonical text,
+ * parsed back as an allow, must be the exact name rule over the very name — a leading slash, an interior star or an unreadable
+ * spelling offers nothing rather than a rule that would not clear the ask it was minted on). The reference's second row, the first
+ * word as a prefix, is offered only for a name containing a space; it is not minted here (it would widen past the name shown).
+ */
+export declare function suggestRuleForName(tool: string, name: string): Extract<RuleOffer, {
+    kind: "single";
+}> | undefined;
 /**
  * design/375 §5.2 — the per-segment coverage table for `command`: which segments an eligible rule
  * already admits, judged with the SAME split and the same eligibility predicates as the gate's

package/dist/core/permission-rule-model.js

@@ -37,14 +37,29 @@ export function callPathFaceOf(call) {
 export function faceAskSpeaksFor(face) {
     return face !== undefined && Object.values(PATH_RULE_FACES).some((columns) => columns.ask?.includes(face) === true);
 }
+export const NAME_RULE_FACES = Object.freeze({
+    Skill: Object.freeze({ param: "skill", params: Object.freeze(["skill", "args"]) }),
+});
 export function ruleToolGrammarOf(toolName) {
     if (toolName === COMMAND_RULE_TOOL)
         return "command";
+    if (Object.hasOwn(NAME_RULE_FACES, toolName))
+        return "name";
     return pathTargetOf(toolName) !== undefined ? "path" : undefined;
 }
+export function nameRuleSubjectOf(toolName, args) {
+    const face = Object.hasOwn(NAME_RULE_FACES, toolName) ? NAME_RULE_FACES[toolName] : undefined;
+    if (face === undefined || typeof args !== "object" || args === null || Array.isArray(args) || !Object.hasOwn(args, face.param))
+        return undefined;
+    const value = args[face.param];
+    return typeof value === "string" ? value : undefined;
+}
 export function laneToolNamesOf(req) {
     return heldValues("policy.persistedGrammar", { get: (n) => (ruleToolGrammarOf(n) !== undefined ? n : undefined) }, req);
 }
+function isCommandMatch(match) {
+    return match === "exact" || match === "prefix" || match === "wildcard";
+}
 export const MAX_RULE_TEXT_CHARS = 512;
 export const BARE_INTERPRETER_NAMES = new Set([
     "node", "deno", "bun", "python", "python2", "python3", "perl", "ruby", "php", "osascript",
@@ -247,8 +262,11 @@ export function parseRuleText(text, behavior) {
         return reject("invalid.grammar", `"${text}" is not a Tool(content) rule — a bare tool name claims the whole tool and is not a command rule`);
     }
     if (parsed.toolName !== COMMAND_RULE_TOOL) {
-        if (ruleToolGrammarOf(parsed.toolName) !== "path") {
-            return reject("unsupported.tool", `only Bash command rules and rules on path-targeting tools (Read, Edit, Write, …) have a rule form in this version (got "${parsed.toolName}")`);
+        const grammar = ruleToolGrammarOf(parsed.toolName);
+        if (grammar === "name")
+            return parseNameRuleContent(text, parsed.toolName, parsed.ruleContent, behavior);
+        if (grammar !== "path") {
+            return reject("unsupported.tool", `only Bash command rules, rules on path-targeting tools (Read, Edit, Write, …) and Skill name rules have a rule form in this version (got "${parsed.toolName}")`);
         }
         return parsePathRuleContent(text, parsed.toolName, parsed.ruleContent, behavior);
     }
@@ -303,9 +321,46 @@ export function parseRuleText(text, behavior) {
 export function formatRuleText(command, match, tool) {
     if (match === "subpath")
         return `${tool}(//${command.startsWith("/") ? command.slice(1) : command}/**)`;
-    if (match === "path")
+    if (match === "path" || match === "name")
         return `${tool}(${command})`;
-    return `${tool}(${command}${match === "prefix" ? ":*" : match === "wildcard" ? " *" : ""})`;
+    return `${tool}(${command}${match === "prefix" || match === "name_prefix" ? ":*" : match === "wildcard" ? " *" : ""})`;
+}
+function parseNameRuleContent(text, tool, content, behavior, verifyCanonical = true) {
+    const face = NAME_RULE_FACES[tool];
+    const bare = content.startsWith("/") ? content.slice(1) : content;
+    const colon = bare.indexOf(":");
+    if (face !== undefined && colon > 0 && face.params.includes(bare.slice(0, colon).trim())) {
+        return reject("invalid.grammar", `"${text}" is the parameter spelling, which a ${tool} rule no longer has — a ${tool} rule names the ${face.param} itself: ${tool}(<name>) for one, ${tool}(<name>:*) for every ${face.param} whose name begins with <name>`);
+    }
+    const open = bare.endsWith(":*") || bare.endsWith(" *");
+    const body = open ? bare.slice(0, -2) : bare;
+    const match = open ? "name_prefix" : "name";
+    if (body === "" || body.trim() !== body) {
+        return reject("invalid.grammar", `the name in "${text}" is empty or carries surrounding whitespace — a ${tool} rule names the ${face?.param ?? "name"} exactly as it is spelled, so the spelling must be the one meant`);
+    }
+    if (body.includes("*")) {
+        return reject("unsupported.wildcard", `a \`*\` inside the name of "${text}" matches anything at that position, which has no rule form — only the trailing \`<name>:*\` prefix form does`);
+    }
+    const canonical = formatRuleText(body, match, tool);
+    const back = parsePermissionRule(canonical);
+    if (back.toolName !== tool || back.ruleContent !== (open ? `${body}:*` : body)) {
+        return reject("invalid.grammar", `the name in "${text}" has no spelling the rule syntax reads back (a backslash or an unbalanced parenthesis) — no ${tool} rule can name it`);
+    }
+    const rule = { behavior, rule: canonical, tool, match, command: body };
+    if (verifyCanonical) {
+        const again = parseNameRuleContent(canonical, tool, back.ruleContent, behavior, false);
+        if (!("rule" in again) || again.rule.rule !== canonical || again.rule.match !== match || again.rule.command !== body) {
+            return reject("invalid.grammar", `"${text}" has no canonical spelling that reads back as itself ("${canonical}" does not) — no ${tool} rule can name it exactly`);
+        }
+    }
+    return { rule };
+}
+export function nameRuleAdmits(rule, name) {
+    if (rule.match === "name")
+        return name === rule.command;
+    if (rule.match === "name_prefix")
+        return name.startsWith(rule.command);
+    return false;
 }
 function parsePathRuleContent(text, tool, content, behavior) {
     const dirForm = /^\/\/(.+)\/\*\*$/.exec(content);
@@ -508,7 +563,7 @@ export const PROGRAM_RUN_REACHES = Object.freeze(["reached", "not_reached", "unr
 const REACHED = { reach: "reached" };
 const NOT_REACHED = { reach: "not_reached" };
 export function programRunReachOf(rule, command) {
-    if (rule.match === "subpath" || rule.match === "path")
+    if (!isCommandMatch(rule.match))
         return NOT_REACHED;
     const body = readRuleBody(rule.command);
     if (body === undefined)
@@ -594,7 +649,7 @@ function readCommandMemo(command) {
     return lastRead.shape;
 }
 function admitsUnder(rule, command, reading) {
-    if (rule.match === "subpath" || rule.match === "path")
+    if (!isCommandMatch(rule.match))
         return false;
     const shape = ruleLaneShapeOf(command, reading);
     if ("reject" in shape)
@@ -894,6 +949,25 @@ export function adjudicatePersistedPathRules(rules, call, targets, bases) {
     }
     return undefined;
 }
+export function adjudicatePersistedNameRules(rules, call) {
+    if (call.name === undefined)
+        return undefined;
+    for (const behavior of RULE_BEHAVIORS_BY_PRECEDENCE) {
+        for (const rule of rules) {
+            if (eligiblePersisted(rule, call, behavior) && nameRuleAdmits(rule, call.name))
+                return { behavior, rules: [rule] };
+        }
+    }
+    return undefined;
+}
+export function suggestRuleForName(tool, name) {
+    if (ruleToolGrammarOf(tool) !== "name")
+        return undefined;
+    const parsed = parseRuleText(formatRuleText(name, "name", tool), "allow");
+    if (!("rule" in parsed) || parsed.rule.match !== "name" || parsed.rule.command !== name)
+        return undefined;
+    return { kind: "single", rule: parsed.rule.rule, match: "name", command: name };
+}
 export function segmentCoverageOf(command, rules, call) {
     const folded = foldSpacing(command);
     if (folded === undefined)

package/dist/core/permission-rules.d.ts

@@ -38,6 +38,11 @@
  * A `Read(...)` / `Edit(...)` deny or ask reaches the calls on its behavior's FACES (`PATH_RULE_FACES`), not only
  * its own tool: a `Read` ask asks for a Grep / Glob rooted in its path, judged on that call's own target.
  *
+ * The NAME lane is the same shape for the tools of `NAME_RULE_FACES` (the `Skill` tool): a `Skill(<name>)` / `Skill(<prefix>:*)`
+ * deny or ask — the reference's own spelling — compiles through the same validator (the model's name grammar) and is judged on the
+ * one string the call names (`nameRuleSubjectOf`) with `nameRuleAdmits`, the reader the persisted rule store uses. The parameter
+ * spelling `Skill(skill:<name>)` those tools used to take is retired: refused loudly, its sentence naming the CC form.
+ *
  * 🔴 与 CC 的有意差(design/127 r2):
  *  - CC 参数级 generic 道无 allow lane(gnn 只有 deny/ask)—— 我们同样,且整个 policy 无 allow 臂。
  *  - CC 对尾缀垃圾静默降级为裸名(Lh `n !== len-1`)—— `parsePermissionRule` 保持 CC parity,但
@@ -75,8 +80,9 @@ export interface PermissionRuleIssue {
     /** A `behavior` outside the closed set `deny | ask` (a JS caller's typo, an undefined member, a boxed string): refused —
      *  a rule that matched nothing because its verb was misspelled would be a deny that silently never fires. */
      | "invalid.behavior"
-    /** A content-form Bash deny/ask rule the ONE rule validator refuses (a redirection, a substitution, a
-     *  mid-pattern star, control characters…) — the message carries the validator's own code and sentence. */
+    /** A content-form deny/ask rule the ONE rule validator refuses — the shell's command grammar (a redirection, a substitution,
+     *  a mid-pattern star, control characters…), a path tool's path grammar, a name tool's name grammar (the retired parameter
+     *  spelling `Skill(skill:<name>)`, an empty name…) — the message carries the validator's own code and sentence. */
      | "invalid.command_rule"
     /** An `allowedTools` value (the request's `TaskSpec.allowedTools`, the deployment's `RunnerDeps.allowedTools`) that is
      *  not a list of strings: one issue for a non-list, one per element that is not a string (`rule` is empty — there is

package/dist/core/permission-rules.js

@@ -1,7 +1,8 @@
 import { MCP_NAMESPACE, protocolOf } from "./protocol-table.js";
+import { splitNamespacedName } from "./tool-name-aliases.js";
 import { catalogRuleFaceOf, pathTargetOf } from "./tool-registry.js";
 import { indexOfUnescaped, lastIndexOfUnescaped, parsePermissionRule } from "./permission-rule-syntax.js";
-import { PATH_RULE_BASE_LABEL, PATH_RULE_FACES, callPathFaceOf, isUsablePathBase, parseRuleText, pathRuleHeadOf, pathRuleReachOf, programRunReachOf, ruleBasesNeeded } from "./permission-rule-model.js";
+import { NAME_RULE_FACES, PATH_RULE_BASE_LABEL, PATH_RULE_FACES, callPathFaceOf, isUsablePathBase, nameRuleAdmits, nameRuleSubjectOf, parseRuleText, pathRuleHeadOf, pathRuleReachOf, programRunReachOf, ruleBasesNeeded, ruleToolGrammarOf } from "./permission-rule-model.js";
 import { pathFamilyOf, pathIdentityOf, spellingOfIdentity } from "../tools/fs/safety.js";
 import { effectivePathTargetOf } from "./effective-path-target.js";
 import { protectivePathTargetOf } from "./tool-registry.js";
@@ -58,15 +59,10 @@ export function wildcardMatch(pattern, value) {
     return p === pattern.length;
 }
 function parseNamespacedRuleName(name) {
-    const ns = protocolOf(name);
-    if (ns === undefined)
+    const split = splitNamespacedName(name);
+    if (split === undefined || split.peer === "")
         return undefined;
-    const segments = name.slice(ns.prefix.length).split("__");
-    const peer = segments[0];
-    if (peer === undefined || peer === "")
-        return undefined;
-    const rest = segments.slice(1);
-    return rest.length > 0 ? { protocol: ns.id, peer, tool: rest.join("__") } : { protocol: ns.id, peer };
+    return split.tool !== undefined ? { protocol: split.ns.id, peer: split.peer, tool: split.tool } : { protocol: split.ns.id, peer: split.peer };
 }
 export function namespacedRuleNameCovers(ruleName, toolName) {
     const rule = parseNamespacedRuleName(ruleName);
@@ -215,6 +211,21 @@ function compile(rules, caps, primaryFieldGeneric, ruleFaces, pathBases = {}) {
                 continue;
             }
             const face = resolved.face;
+            if (ruleToolGrammarOf(toolName) === "name") {
+                const parsedName = parseRuleText(text, verb);
+                if ("reject" in parsedName) {
+                    bad(text, "invalid.command_rule", `${parsedName.reject.code}: ${parsedName.reject.message}`);
+                    continue;
+                }
+                const param = NAME_RULE_FACES[toolName].param;
+                if (face?.params !== undefined && !face.params.includes(param)) {
+                    bad(text, "unsupported.param_unknown", `"${param}" is not a parameter of ${toolName} on this leg (it carries ${[...face.params].sort().join(", ")}) — a ${toolName} rule is read against it, so the rule would compile and never match`);
+                    continue;
+                }
+                entry.content[verb].push({ parsed: parsedName.rule, ruleText: text, ...(r.source !== undefined ? { source: r.source } : {}) });
+                byTool.set(toolName, entry);
+                continue;
+            }
             if (face !== undefined && face.pathTargeting === true && colon <= 0) {
                 const parsedPath = parseRuleText(text, verb);
                 if ("reject" in parsedPath) {
@@ -362,6 +373,12 @@ export function createPermissionRulePolicy(rules, opts) {
         const command = isPlainObjectArgs(req.args) ? req.args[commandParam] : undefined;
         let unreadable;
         for (const r of lane) {
+            if (r.parsed.match === "name" || r.parsed.match === "name_prefix") {
+                const named = nameRuleSubjectOf(r.parsed.tool, req.args);
+                if (named !== undefined && nameRuleAdmits(r.parsed, named))
+                    return { rule: r };
+                continue;
+            }
             if (r.parsed.match === "subpath" || r.parsed.match === "path") {
                 if (target === undefined || target.kind === "refused")
                     continue;

package/dist/core/runner/classifier-ladder.d.ts

@@ -110,17 +110,19 @@ export declare function announceClassifierRoleDefaulted(args: {
     runId?: string;
 }): void;
 /**
- * The `classifier.unavailable` notice — a classification that could not RULE (the classifier leg failed, or its
- * per-level budget ran out) and where the call went: `"asked"` = on down the ask chain to this leg's approval seat (a
- * person or a durable park decides; the handed-on ask carries `requiresRealApproval`, so no automatic lane answers it),
- * `"denied"` = refused (no approval seat: nobody to ask). Audience `user`: the refusal is the session user's own
+ * The `classifier.unavailable` notice — a classification that could not RULE (the classifier leg failed, its per-level
+ * budget ran out, or it replied with no verdict — `parse_error`; the code name predates that third cause) and where the
+ * call went: `"asked"` = on down the ask chain to this leg's approval seat (a person or a durable park decides; the
+ * handed-on ask carries `requiresRealApproval` and `classifierNoRuling`, so no automatic lane answers it), `"denied"` =
+ * refused (no approval seat: nobody to ask — a reply with no verdict is then also counted on the denial limit). Audience `user`: the refusal is the session user's own
  * call, and on a lane with no approval face (`-p`) this line is the only place they hear why it did not run. Once
  * per classification that could not answer, from both classifier stations (the leg's gate and an ancestor's frozen
- * classifier in the policy fold) — a call judged by more than one classifier can carry one line per classifier. It is never a block: the denial limit does not count it, so this line is not a step toward the
- * limit's card either.
+ * classifier in the policy fold) — a call judged by more than one classifier can carry one line per classifier. The line
+ * itself is never the count: the unavailable form is never counted; a reply with no verdict refused for want of a seat is
+ * counted by the station's ruling path, not by this line.
  *
- * `detail: { toolName, toolCallId, cause, disposition, sessionId?, runId? }` — `cause` is the
- * `AutoModeUnavailableCause` word (`timeout` / `error`). The sentence names the seat the station forked on — `leg` (this
+ * `detail: { toolName, toolCallId, cause, disposition, sessionId?, runId? }` — `cause` is why the classification did not rule,
+ * an `AutoModeFallbackCause` word (`timeout` / `error`, or `parse_error` for a reply with no verdict). The sentence names the seat the station forked on — `leg` (this
  * run's own approval seat) or `ancestor` (the frozen approver of the ancestor layer whose classifier it was) — and, on a
  * timeout, the budget the classifier actually held (`budgetMs`, the decider's {@link AutoModeDecider.timeoutMs}; a
  * hand-built decider states none, and the sentence names the knob alone).

package/dist/core/runner/classifier-ladder.js

@@ -98,7 +98,9 @@ export function classifierUnavailableNotice(args) {
     const whose = args.station === "ancestor" ? "the classifier of the ancestor layer that asked" : "the classifier";
     const why = args.cause === "timeout"
         ? `${whose} did not answer within its per-level budget (${args.budgetMs !== undefined ? `${args.budgetMs} ms, ` : ""}RunnerDeps.autoMode.timeoutMs)`
-        : `${whose} could not run (error)`;
+        : args.cause === "parse_error"
+            ? args.station === "ancestor" ? `${whose} replied without a verdict` : "the classifier's reply carried no verdict"
+            : `${whose} could not run (error)`;
     const next = args.disposition === "asked"
         ? args.station === "ancestor"
             ? "so the call was handed on to that layer's approver rather than refused by the classifier."

package/dist/core/runner/contracts.d.ts

@@ -33,7 +33,7 @@ import type { AutoModeArmingRecipe } from "../auto-mode-arming.js";
 import type { AutoModeDecider, AutoModeDenialTracker, DenialLimitFallbackFace } from "../auto-mode.js";
 import type { SettlementKind } from "../gate-outcome.js";
 import type { CacheBreakDetector, ToolFingerprintInput } from "../cache-break-detector.js";
-import type { ActorAssertion, Checkpoint, CheckpointState, CheckpointStore, CheckpointToken, PendingSteerEntry, PlatformLimitReason, ReopenReason, ResourceLedger, ResourceLimitReason, ResumeOutcome, SerializedCheckpointState } from "../checkpoint-store.js";
+import type { Checkpoint, CheckpointState, CheckpointStore, CheckpointToken, PendingSteerEntry, PlatformLimitReason, ReopenReason, ResourceLedger, ResourceLimitReason, ResumeOutcome, SerializedCheckpointState } from "../checkpoint-store.js";
 import type { ExecutionOutcomeRecordWord } from "../checkpoint-execution-record.js";
 import type { ClearedProjectionLedger, MicroCompactMachine, OccurrenceIndex } from "../context-edit.js";
 import type { HookInvocationIdentity, Hooks, OrgGateVerdict, PermissionDeniedPayload, PostToolBatchCall, PostToolBatchResult, ToolGateInput } from "../hooks.js";
@@ -2494,21 +2494,6 @@ export interface RunState {
         attachmentsInjected: number;
     };
 }
-/** One accepted live steer's REPLAY identity, the twin of the parked
- *  queue's `samePendingSteerPayload`. `payload` is the exact string handed to the harness, so the text,
- *  the speaker envelope and the trust framing all fold into it; `trusted` is kept SEPARATELY from those
- *  framed bytes so a text that spells its own `<system-reminder>` wrapper can never read as the trusted
- *  arm's byte-equal twin. `actor` carries the attribution the ledger frame reports. */
-export interface AcceptedSteerInput {
-    payload: string;
-    trusted: boolean;
-    /** The NORMALIZED priority the call delivered under (absent input ⇒ "next"),
-     *  the replay identity's sixth axis: same id + same text at a DIFFERENT tier is not a replay —
-     *  a `next` input re-sent as `now` answering "idempotent success" without the interrupt would be
-     *  a disposition lie, so it refuses `duplicate_input_id` like any other identity mismatch. */
-    priority: SystemInjectionPriority;
-    actor?: ActorAssertion;
-}
 /**
  * Config re-supplied to {@link Runner.resume}. A suspended task's tools / model / policy /
  * hooks cannot be reconstructed from a checkpoint token (the session stores neither tool implementations

package/dist/core/runner/denial-limit-arms.d.ts

@@ -1,4 +1,4 @@
-import { type AutoModeDecider, type AutoModeDenialLimitOptions, type AutoModeDenialTracker, type DenialLimitFallback, type UnarmedDenialLimitFallback } from "../auto-mode.js";
+import { type AutoModeDecider, type AutoModeDenialLimitOptions, type AutoModeDenialTracker, type AutoModeFallbackCause, type DenialLimitFallback, type UnarmedDenialLimitFallback } from "../auto-mode.js";
 import { type AutoModeArmingRecipe } from "../auto-mode-arming.js";
 import { type ClassifierUnavailableSeat } from "../classifier-unavailable-arm.js";
 import { type PermissionResult, type ResolvedAsk, type ToolCallRequest } from "../tool-policy.js";
@@ -114,6 +114,7 @@ export interface AskRequestCarry {
     askClass?: AskClass;
     classes?: readonly AskClass[];
     denialLimitFallback?: DenialLimitFallback;
+    classifierNoRuling?: AutoModeFallbackCause;
 }
 /** The GATE's own mint station: every member is read off the surviving decision, which is the gate's
  *  OWN snapshot (its stamp point spreads the policy's object and stamps the word and the class onto the copy),
@@ -154,8 +155,9 @@ export type InheritedClassifierJudgment<A extends InheritedAsk> =
  *  `classification` is the class set of the ask handed on, under the same station facts: on the two unchanged-ask
  *  branches the one read the exclusion judged by, on the unavailable and bound branches a read of the object this
  *  station minted (each adds a real-approval bit, which the set must reflect). */
-/** `ask` is the incoming ask unchanged (the arm's receipt snapshot of the ancestor's decision), or — an UNAVAILABLE classification with a live frozen
-*  approver — that ask with the classifier sentence appended; without one it is a `deny` whose attested cause reads `unavailable`. */
+/** `ask` is the incoming ask unchanged (the arm's receipt snapshot of the ancestor's decision), or — a classification that did not rule, with a
+*  live frozen approver — that ask carrying why (`classifierNoRuling`, the sentence appended); without one the unavailable form is a `deny`
+*  whose attested cause reads `unavailable`. */
  | {
     kind: "resolve";
     ask: A;
@@ -163,6 +165,7 @@ export type InheritedClassifierJudgment<A extends InheritedAsk> =
     mintedHere: boolean;
     origin: AskOrigin;
     classification: AskClassification;
+    noRulingHere?: true;
 };
 /**
  * The ancestor's frozen classifier, run BEFORE its frozen approver in the ancestor's own gate order,
@@ -170,10 +173,11 @@ export type InheritedClassifierJudgment<A extends InheritedAsk> =
  * auto-allow (and the streak resets); `block` below the bound ⇒ deny, the exact verdict the ancestor's
  * gate would have produced; `block` AT the bound ⇒ the ask is re-spoken in the classifier's voice as
  * the fallback (`decisionReason:"classifier"`, `requiresRealApproval`, the member carrying counts +
- * window) for the arm to resolve at the frozen approver; `parse_error` ⇒ the same block path with the CC
- * parse-failure sentence (counted); `unavailable` ⇒ the gate's own exit (`classifierUnavailableArm`) on the
- * frozen approver — a live one resolves the incoming ask, none ⇒ a DENY that says so (CC 2.1.250 form), never
- * counted; excluded / no classifier ⇒ the incoming ask, unchanged. The member may ALREADY be on the incoming
+ * window) for the arm to resolve at the frozen approver; a classification that did not rule (`unavailable`, or a reply
+ * with no verdict) ⇒ the gate's own exit (`classifierNoRulingArm`) on the frozen approver — a live one resolves the incoming
+ * ask carrying why (never counted); none ⇒ the unavailable form is a DENY that says so (CC 2.1.250 form, never counted) and
+ * a reply with no verdict takes the block path with the CC parse-failure sentence (counted); a CONFLICTING reply takes the
+ * block path too; excluded / no classifier ⇒ the incoming ask, unchanged. The member may ALREADY be on the incoming
  * ask (a deeper ancestor's fallback, minted inside the nested fold — the case the exclusion names):
  * it rides to the approver and the headless arm unchanged, whichever tracker minted it; only a
  * tracker that counted THIS streak is reset by the person's later allow (`mintedHere`).
@@ -203,11 +207,23 @@ export declare function judgeInheritedClassifier<A extends InheritedAsk>(opts: {
     /** The rewrite the arm's allow would have carried (the ask's own `updatedInput`, the re-check's edited
      *  args) — handed IN so the allow is minted here, attested, once; absent ⇒ a bare allow. */
     allowRewrite?: unknown;
-    /** An `unavailable` verdict's fork facts (`classifierUnavailableArm`): is the frozen approver live; who hears it. */
+    /** An `unavailable` verdict's fork facts (`classifierNoRulingArm`): is the frozen approver live; who hears it. */
     unavailableSeat?: ClassifierUnavailableSeat;
     /** The station's facts for this call (the base with this task's tool seat); absent ⇒ {@link INHERITED_STATION_FACTS}. */
     facts?: AskClassFacts;
 }): Promise<InheritedClassifierJudgment<A>>;
+/** The fallback an inherited station hands its frozen approver, minted ONCE for both ways a bound is reached (a counted ruling
+ *  refusal; a no-ruling card the approver's POLICY refused, {@link settleNoRulingAsk}) — its own object, word and class set. */
+type ResolveJudgment<A extends InheritedAsk> = Extract<InheritedClassifierJudgment<A>, {
+    kind: "resolve";
+}>;
+export declare function inheritedFallbackJudgment<A extends InheritedAsk>(ask: A, fallback: UnarmedDenialLimitFallback, latestBlockedAction: string, facts: AskClassFacts): ResolveJudgment<A>;
+/** One resolution of an inherited ask at its frozen approver (the three arms): a no-ruling card its POLICY refused counts
+ *  ({@link settleNoRulingAsk}); at the bound the call is resolved again there as the fallback. Returns the judgment it answered. */
+export declare function resolveInheritedAsk<A extends InheritedAsk, R extends Pick<ResolvedAsk, "action" | "settlement">>(judged: ResolveJudgment<A>, resolveWith: (j: ResolveJudgment<A>) => Promise<R>, tracker: AutoModeDenialTracker | undefined, toolName: string, facts: AskClassFacts): Promise<{
+    resolved: R;
+    judged: ResolveJudgment<A>;
+}>;
 /** The resolver's answer as the settlement reads it. */
 export type FallbackResolution = Pick<ResolvedAsk, "action" | "settlement" | "approverUnavailable">;
 /** A deny nobody JUDGED, at a wrapper arm — read off the one table over the settlement words
@@ -258,3 +274,4 @@ export declare function lateAskSettlementObserver(args: {
     kind: "error";
     error: unknown;
 }) => void;
+export {};

package/dist/core/runner/denial-limit-arms.js

@@ -1,7 +1,7 @@
 import { markTightenMessage } from "../safety-axis-vocab.js";
-import { classifierParseFailureDenyMessage, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow } from "../auto-mode.js";
+import { classifierParseFailureDenyMessage, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, isAutoModeFallbackCause, rungDidNotRule, unarmedWindow } from "../auto-mode.js";
 import { sanitizeAutoModeArmingRecipe, tightenDenialLimit } from "../auto-mode-arming.js";
-import { classifierUnavailableArm } from "../classifier-unavailable-arm.js";
+import { classifierNoRulingArm, settleNoRulingAsk } from "../classifier-unavailable-arm.js";
 import { attestClassifierDenyCause, attestClassifierRound, carryEngineAttestations } from "../tool-policy.js";
 import { SETTLEMENT_NOBODY_JUDGED } from "../gate-outcome.js";
 import { deliverEngineNotice } from "../types.js";
@@ -44,7 +44,7 @@ export function createDenialLimitStop(opts) {
         if (gateStopRef.terminal !== undefined)
             return;
         const lane = info.settlement === undefined
-            ? `no approver is wired to fall back to`
+            ? `nobody in this run can be asked to answer it`
             : `the durable approval it parked was settled with nobody judging it ("${info.settlement}")`;
         const message = `too many classifier denials in headless mode — ${denialLimitSentence(info.fallback)} The run was stopped: ` +
             `the auto-mode classifier's denial limit falls back to a person, and ${lane} ` +
@@ -61,6 +61,7 @@ export function createDenialLimitStop(opts) {
     return { gateStopRef, stopForDenialLimit };
 }
 export const INHERITED_STATION_FACTS = { contentQuestion: false, markedUnresolvable: false, org: undefined, tightened: undefined, mandateMarks: {} };
+const noRulingCarry = (why) => (isAutoModeFallbackCause(why) ? { classifierNoRuling: why } : {});
 function fallbackCarry(fallback, liveApprover, tracker) {
     if (fallback === undefined)
         return {};
@@ -71,6 +72,7 @@ export function gateAskCarry(decision, liveApprover, tracker) {
         ...(decision.origin !== undefined ? { origin: decision.origin } : {}),
         ...(decision.askClass !== undefined && decision.classes !== undefined ? { askClass: decision.askClass, classes: decision.classes } : {}),
         ...fallbackCarry(decision.denialLimitFallback, liveApprover, tracker),
+        ...noRulingCarry(decision.classifierNoRuling),
     };
 }
 export function inheritedAskCarry(judged, liveApprover, tracker) {
@@ -78,6 +80,7 @@ export function inheritedAskCarry(judged, liveApprover, tracker) {
         origin: judged.origin,
         ...askClassMembersOf(judged.classification),
         ...fallbackCarry(judged.fallback, liveApprover, tracker),
+        ...noRulingCarry(judged.ask.classifierNoRuling),
     };
 }
 export const inheritedAskFallbackMessage = (toolName) => `approval required for "${toolName}" (inherited parent policy)`;
@@ -105,12 +108,12 @@ export async function judgeInheritedClassifier(opts) {
         autoMode.denialTracking?.recordAllow();
         return { kind: "allow", result: attributed({ action: "allow", decisionReason: "classifier", ...(opts.allowRewrite !== undefined ? { updatedInput: opts.allowRewrite } : {}) }) };
     }
-    if (verdict.kind === "unavailable") {
-        const arm = classifierUnavailableArm({ ask, req, cause: verdict.cause, seat: opts.unavailableSeat, aborted: opts.signal.aborted });
-        if (arm.kind === "asked")
-            return { kind: "resolve", ask: arm.ask, fallback: ask.denialLimitFallback, mintedHere: false, origin, classification: classifyAsk(arm.ask, facts) };
+    const noRuling = rungDidNotRule(verdict);
+    const arm = noRuling !== undefined ? classifierNoRulingArm({ ask, req, cause: noRuling, seat: opts.unavailableSeat, aborted: opts.signal.aborted }) : undefined;
+    if (arm?.kind === "asked")
+        return { kind: "resolve", ask: arm.ask, fallback: ask.denialLimitFallback, mintedHere: false, origin, classification: classifyAsk(arm.ask, facts), noRulingHere: true };
+    if (arm?.kind === "denied")
         return { kind: "deny", result: attributed(arm.deny) };
-    }
     const reason = verdict.kind === "block" ? (verdict.reason ? inlineUntrusted(verdict.reason) : "") : classifierParseFailureDenyMessage(verdict.classifier);
     const category = verdict.kind === "block" && verdict.category ? inlineUntrusted(verdict.category) : "";
     const tracked = autoMode.denialTracking?.recordBlock();
@@ -122,10 +125,21 @@ export async function judgeInheritedClassifier(opts) {
         };
         return { kind: "deny", result: attributed(verdict.kind === "parse_error" ? attestClassifierDenyCause(denied, "parse_error", req) : denied) };
     }
-    const fallback = tracked.fallback;
-    const minted = carryEngineAttestations(ask, { ...ask, message: denialLimitFallbackMessage(fallback, reason || category || req.toolName), decisionReason: "classifier", requiresRealApproval: true, denialLimitFallback: fallback });
+    return inheritedFallbackJudgment(ask, tracked.fallback, reason || category || req.toolName, facts);
+}
+export function inheritedFallbackJudgment(ask, fallback, latestBlockedAction, facts) {
+    const { classifierNoRuling: _why, ...standing } = ask;
+    const minted = carryEngineAttestations(ask, { ...standing, message: denialLimitFallbackMessage(fallback, latestBlockedAction), decisionReason: "classifier", requiresRealApproval: true, denialLimitFallback: fallback });
     return { kind: "resolve", ask: minted, fallback, mintedHere: true, origin: askOriginOf(minted, facts), classification: classifyAsk(minted, facts) };
 }
+export async function resolveInheritedAsk(judged, resolveWith, tracker, toolName, facts) {
+    const resolved = await resolveWith(judged);
+    const refallback = settleNoRulingAsk({ ask: judged.ask, mintedHere: judged.noRulingHere === true, resolved, tracker });
+    if (refallback === undefined)
+        return { resolved, judged };
+    const again = inheritedFallbackJudgment(judged.ask, refallback, toolName, facts);
+    return { resolved: await resolveWith(again), judged: again };
+}
 export function headlessDenyAtFold(r) {
     return r.settlement !== undefined && SETTLEMENT_NOBODY_JUDGED[r.settlement.kind];
 }

package/dist/core/runner/gate-exit.js

@@ -139,7 +139,8 @@ export async function exitGate(pass) {
         const gate = mintGateOutcome({ deniedBy: pass.deniedBy, ...(pass.denyCause !== undefined ? { cause: pass.denyCause } : {}), ...(ledger.settled !== undefined ? { settled: ledger.settled } : {}), ...(pass.classifierRound !== undefined ? { classifier: pass.classifierRound } : {}), ...(modeRefusal !== undefined ? { modeRefusal: { mode: modeRefusal.mode, askClass: modeRefusal.askClass, classes: modeRefusal.classes } } : {}) });
         const foldCause = askUnresolvableCauseOf(pass.decision, { toolCallId, toolName });
         const unresolvable = foldCause ?? unresolvableCauseOfSettlement(gate);
-        const remedySeat = unresolvable !== undefined ? askUnresolvableRemedySeat(unresolvable) : undefined;
+        const tableSeat = unresolvable !== undefined ? askUnresolvableRemedySeat(unresolvable) : undefined;
+        const remedySeat = tableSeat === "absent" && input.askSeatForm === "declared_none" && pass.askClassification?.classes.has("content_question") !== true ? "declared_none" : tableSeat;
         const remedy = remedySeat !== undefined ? headlessApprovalRemedy({ mode: input.permissionMode?.(), classification: foldCause !== undefined ? ANCESTOR_UNRESOLVED_CLASSIFICATION : pass.askClassification, approverSeat: remedySeat, coveredWrite: isProtectedWrite(pass.req), ...(pass.shellUnplacedOptions !== undefined ? { unplacedOptions: pass.shellUnplacedOptions } : {}) }) : undefined;
         const denyReason = withParkFailureCause(`${decisionText(pass.decision) ?? `tool "${toolName}" denied by policy`}${remedy !== undefined ? ` — ${remedy}` : ""}`, pass.parkFailed);
         if (unresolvable !== undefined) {

package/dist/core/runner/permission-rule-lanes.d.ts

@@ -32,8 +32,8 @@ import type { PersistedRule, PersistedRuleVerdict, RuleOffer, SegmentCoverage }
 import { type ToolCallLike } from "../tool-registry.js";
 import { type OrgRuleResolution } from "../permission-rule-org.js";
 import { type EffectivePermissionRules, type PermissionRuleStoreProvider } from "../permission-rule-provider.js";
-/** The one SHELL tool the persisted-rule lane's COMMAND grammar speaks for (the rule-offer face mints for
- *  it alone). The PATH grammar's tools are derived from the catalog (`ruleToolGrammarOf`). */
+/** The one SHELL tool the persisted-rule lane's COMMAND grammar speaks for (the rule-offer face mints for it and the
+ *  name tools). The PATH and NAME grammars' tools are derived (`ruleToolGrammarOf`). */
 export declare const PERSISTED_RULE_TOOL = "Bash";
 /**
  * The evidence an INHERITED-lane ask carries.