@sema-agent/core 7.43.0 → 7.45.0

package/dist/agents/tool-filter.d.ts

@@ -1,4 +1,4 @@
-import type { ToolSpec } from "../core/types.js";
+import type { AgentDefinition, ToolSpec } from "../core/types.js";
 /**
  * Per-agent tool allow/deny (design/38 1A). Statically narrows a tool POOL to the subset a delegated
  * sub-agent / team member may use — assembly-time filtering (the tool simply never appears in the
@@ -16,13 +16,74 @@ import type { ToolSpec } from "../core/types.js";
  * Anchored (dual-leg verified): this spawn-time item-level filter IS the upstream shape for allow
  * entries — CC's resolveAgentTools partitions unknown names into an `invalidTools` bucket nobody
  * consumes at runtime, and a live 2.1.207 probe shows the agent stays listed/delegable with the
- * unknown item silently dropped, zero warnings. The asymmetric prepare-time fail-loud for
- * `TaskSpec.agents` DENY entries is a deliberate sema extension (no upstream deny-list exists): an
- * allow-typo silently narrows (safe direction), a deny-typo silently widens (unacceptable).
+ * unknown item silently dropped, zero warnings. A DENY entry is read as the reference reads it
+ * ({@link readDeniedEntry}: `Tool(content)` names `Tool`, the content is not read, the whole tool is hidden). The
+ * list is judged once before the run, from every place a deployment writes one (prepare's
+ * `judgeDeniedToolNames`): a spelling that can name no tool is refused, the rest is told to the host.
  *
  * Note: `"*"` in `allowTools` is the "allow all" sentinel, so a tool literally NAMED `"*"` cannot be
  * the sole allowed tool via this path (tool names are conventionally identifiers, so this is moot).
  */
+/**
+ * How ONE denied-tools entry is read — the reference reads each as a rule string, without trimming: `Tool(content)` names
+ * `Tool` (the content is dropped, so the whole tool is hidden), `Tool()` and `Tool(*)` are the bare name, and anything else
+ * — a malformed paren form, an entry with surrounding whitespace — is the whole string, which names no tool. A value that is
+ * not a string (a list a host read from a file can hold anything) names no tool either: it reads as `not_a_string` with a
+ * fixed label of its TYPE, and nothing about the value is read, converted or printed — `typeof` and the array test only.
+ */
+export type DeniedEntryReading = {
+    readonly kind: "name";
+    readonly name: string;
+    readonly content: boolean;
+} | {
+    readonly kind: "not_a_string";
+    readonly type: string;
+};
+export declare function readDeniedEntry(entry: unknown): DeniedEntryReading;
+/** A fixed label of a host value's TYPE for a sentence that must not print or convert the value (`typeof` and the array test only). */
+export declare function valueTypeLabel(value: unknown): string;
+/**
+ * How a tool-name list's VALUE (an agent definition's allowed-tools or denied-tools list) reads as a list. A host that reads its
+ * definitions from a file can hand over anything, and a list can be hostile as a container (an accessor or a proxy trap that
+ * throws, an overridden iterator, holes): it is read BY INDEX over its length, once, into a dense copy — no iterator of the host
+ * runs, a hole reads as `undefined` (an entry that is not a string) — and a value that is not an array, or an array whose read
+ * throws, is reported as such and never printed or converted.
+ */
+export type ToolNameListReading = {
+    readonly kind: "entries";
+    readonly entries: readonly unknown[];
+} | {
+    readonly kind: "not_a_list";
+    readonly type: string;
+} | {
+    readonly kind: "unreadable";
+};
+export declare function readToolNameList(value: unknown): ToolNameListReading;
+/** A tool-name list as the mount keeps it: the dense copy when it reads as a list, the failure marker when it cannot be read, else
+ *  the value itself (not a list: the judge refuses it, and its type never changes). */
+export declare function snapshotToolNameList(value: unknown): unknown;
+/** The two tool-name lists of a definition, and the words a sentence calls each. */
+export type ToolNameListSide = "allowed" | "denied";
+/** The sentence for an entry that is not a string: it can be no tool name; the sentence names its place and its type, never its value. */
+export declare function notAStringSentence(where: string, side: ToolNameListSide, index: number, type: string): string;
+/** The sentence for a value that is not a list, or a list that cannot be read: it names the type, never the value. */
+export declare function notAListSentence(where: string, side: ToolNameListSide, list: Exclude<ToolNameListReading, {
+    kind: "entries";
+}>): string;
+/**
+ * Why a host-written tool-name list cannot be one, as a sentence — or `undefined` when it is absent (`undefined` / `null`) or a list
+ * of strings. The one reading the judgment before the run and the spawn-time check of a tool that never went through prepare share.
+ */
+export declare function toolNameListFlaw(where: string, side: ToolNameListSide, value: unknown): string | undefined;
+/** A definition with its two tool-name lists replaced by their one copy — the copy every later reader (the judgment before the
+ *  run, the roster, the filter at each spawn) takes instead of the host's container. */
+export declare function snapshotDefinitionLists(def: AgentDefinition): AgentDefinition;
+/**
+ * The names an allowed-tools value admits, or `undefined` when it names no allowlist: absent, `null`, or a list holding the
+ * wildcard. A list admits its string entries (an entry that is not a string admits nothing); a value that is not a list admits
+ * NOTHING — the judge before the run refuses it, and a reader that meets it first fails closed.
+ */
+export declare function allowedToolNames(allowTools: unknown): ReadonlySet<string> | undefined;
 /**
  * Membership check for ONE tool name under the same allow/deny semantics as {@link resolveToolSubset}
  * (canonicalized both sides; `"*"` allow sentinel; deny wins). Used by the delegation tool to decide

package/dist/agents/tool-filter.js

@@ -1,12 +1,135 @@
+import { parsePermissionRule } from "../core/permission-rule-syntax.js";
+export function readDeniedEntry(entry) {
+    if (typeof entry !== "string")
+        return { kind: "not_a_string", type: valueTypeLabel(entry) };
+    if (entry !== entry.trim())
+        return { kind: "name", name: entry, content: false };
+    const parsed = parsePermissionRule(entry);
+    return { kind: "name", name: parsed.toolName, content: parsed.ruleContent !== undefined };
+}
+export function valueTypeLabel(value) {
+    if (value === null)
+        return "null";
+    switch (typeof value) {
+        case "string":
+            return "a string";
+        case "undefined":
+            return "undefined";
+        case "number":
+            return "a number";
+        case "boolean":
+            return "a boolean";
+        case "bigint":
+            return "a bigint";
+        case "symbol":
+            return "a symbol";
+        case "function":
+            return "a function";
+        default:
+            try {
+                return Array.isArray(value) ? "an array" : "an object";
+            }
+            catch {
+                return "an object";
+            }
+    }
+}
+const isList = (value) => Array.isArray(value);
+const UNREADABLE_LIST = Object.freeze({});
+export function readToolNameList(value) {
+    if (value === UNREADABLE_LIST)
+        return { kind: "unreadable" };
+    let list;
+    try {
+        list = isList(value) ? value : undefined;
+    }
+    catch {
+        return { kind: "not_a_list", type: "an object" };
+    }
+    if (list === undefined)
+        return { kind: "not_a_list", type: valueTypeLabel(value) };
+    try {
+        const entries = [];
+        for (let i = 0; i < list.length; i++)
+            entries.push(list[i]);
+        return { kind: "entries", entries };
+    }
+    catch {
+        return { kind: "unreadable" };
+    }
+}
+export function snapshotToolNameList(value) {
+    const read = readToolNameList(value);
+    return read.kind === "entries" ? read.entries : read.kind === "unreadable" ? UNREADABLE_LIST : value;
+}
+const LIST_NOUN = { allowed: "allowed tools", denied: "denied tools" };
+const LIST_NAME = { allowed: "an allowed-tools list", denied: "a denied-tools list" };
+export function notAStringSentence(where, side, index, type) {
+    return `${where} declares in its ${LIST_NOUN[side]}, as entry ${index + 1}, a value that is ${type}, not a tool name — ${LIST_NAME[side]} holds tool names, each a string. Fix the entry.`;
+}
+export function notAListSentence(where, side, list) {
+    return list.kind === "not_a_list"
+        ? `${where} declares in its ${LIST_NOUN[side]} a value that is ${list.type}, not a list of tool names. Fix the list.`
+        : `${where} declares in its ${LIST_NOUN[side]} a list whose entries cannot be read (an accessor or a proxy trap threw). Fix the list.`;
+}
+export function toolNameListFlaw(where, side, value) {
+    if (value === undefined || value === null)
+        return undefined;
+    const list = readToolNameList(value);
+    if (list.kind !== "entries")
+        return notAListSentence(where, side, list);
+    for (let i = 0; i < list.entries.length; i++) {
+        const entry = list.entries[i];
+        if (typeof entry !== "string")
+            return notAStringSentence(where, side, i, valueTypeLabel(entry));
+    }
+    return undefined;
+}
+export function snapshotDefinitionLists(def) {
+    const copy = { ...def };
+    if (copy.allowTools !== undefined)
+        copy.allowTools = snapshotToolNameList(copy.allowTools);
+    if (copy.denyTools !== undefined)
+        copy.denyTools = snapshotToolNameList(copy.denyTools);
+    return copy;
+}
+export function allowedToolNames(allowTools) {
+    if (allowTools === undefined || allowTools === null)
+        return undefined;
+    const list = readToolNameList(allowTools);
+    if (list.kind !== "entries")
+        return new Set();
+    if (list.entries.includes("*"))
+        return undefined;
+    const names = new Set();
+    for (const entry of list.entries)
+        if (typeof entry === "string")
+            names.add(entry);
+    return names;
+}
+function deniedNames(denyTools) {
+    const names = new Set();
+    const list = readToolNameList(denyTools);
+    if (list.kind !== "entries")
+        return names;
+    for (const entry of list.entries) {
+        const read = readDeniedEntry(entry);
+        if (read.kind === "name")
+            names.add(read.name);
+    }
+    return names;
+}
 export function toolNameAllowed(name, allowTools, denyTools) {
-    const allow = allowTools !== undefined && !allowTools.includes("*") ? new Set(allowTools) : undefined;
-    const deny = denyTools && denyTools.length > 0 ? new Set(denyTools) : undefined;
+    const allow = allowedToolNames(allowTools);
+    const denied = deniedNames(denyTools);
+    const deny = denied.size > 0 ? denied : undefined;
     const n = name;
     return (!allow || allow.has(n)) && (!deny || !deny.has(n));
 }
 export function resolveToolSubset(pool, allowTools, denyTools) {
-    const allow = allowTools !== undefined && !allowTools.includes("*") ? new Set(allowTools) : undefined;
-    const deny = denyTools && denyTools.length > 0 ? new Set(denyTools) : undefined;
+    const allow = allowedToolNames(allowTools);
+    const denied = deniedNames(denyTools);
+    const deny = denied.size > 0 ? denied : undefined;
     if (!allow && !deny)
         return [...pool];
     return pool.filter((t) => {

package/dist/brain/errors.d.ts

@@ -147,6 +147,14 @@ export declare function extractErrorCode(errorMessage: string | undefined): Brai
  *  human text. Pairs with {@link extractErrorCode} so a caller can lift the code and clean the message
  *  without re-hardcoding the code list (the Runner does both when assembling `TaskResult`). */
 export declare function stripErrorCodePrefix(errorMessage: string): string;
+/**
+ * The code a deployment's outbound dispatcher stamps on the error of a proxy that answered the tunnel request
+ * (`CONNECT`) with anything but 200, with the HTTP status the proxy gave in `statusCode` on the same node. Not a
+ * runtime code — undici spells that refusal with prose and no stable code — so it is defined here, once, for the
+ * deployment to mint and for {@link DETERMINISTIC_CONNECT_CODES} to read. The proxy ANSWERED: re-sending the same
+ * request through the same proxy only changes that answer if someone changes the proxy's rules.
+ */
+export declare const PROXY_TUNNEL_REFUSED = "ERR_PROXY_TUNNEL_REFUSED";
 /**
  * Whether a transport-level connect failure is DETERMINISTIC (see {@link DETERMINISTIC_CONNECT_CODES})
  * or gives no such verdict. Classification is by `code` along the error graph — never by message text,
@@ -165,7 +173,18 @@ export declare function stripErrorCodePrefix(errorMessage: string): string;
  * pre-existing behavior.
  */
 export type ConnectFailureClass = "deterministic" | "indeterminate";
+/** What one walk of a transport error's graph found: the verdict, and — only with a `deterministic` one — the proxy
+ *  refusal in it, if any (`status` absent when the node states none readable). One walk answers both, so the verdict
+ *  and the sentence it licenses cannot disagree about which node spoke. */
+export interface ConnectFailureReading {
+    verdict: ConnectFailureClass;
+    proxyRefusal?: {
+        status: number | undefined;
+    };
+}
+export declare function readConnectFailure(e: unknown): ConnectFailureReading;
 export declare function classifyConnectFailure(e: unknown): ConnectFailureClass;
+export declare function proxyTunnelRefusedSentence(status: number | undefined): string;
 /** What a throw out of `fetch` was about: the NETWORK (retryable — the historic reading of every throw
  *  here), or the REQUEST ITSELF, which is deterministic: identical arguments reproduce it every time. */
 export type FetchThrowClass = "transport" | "request_unbuildable";
@@ -174,8 +193,10 @@ export type FetchThrowClass = "transport" | "request_unbuildable";
  *  throws a `TypeError` with no `code` and no `cause`, so the connect classifier answered indeterminate and
  *  the call spent its whole backoff budget on a request the runtime never built).
  *
- *  ONE question — is there TRANSPORT EVIDENCE? — in its two forms: the runtime's own shell sentence, or a
- *  `cause` that is a transport fact rather than a parse verdict. A `TypeError` with neither was never built.
+ *  ONE question — is there TRANSPORT EVIDENCE? — in its three forms: the runtime's own shell sentence, a
+ *  `cause` that is a transport fact rather than a parse verdict, or a graph the connect judge reads as a
+ *  definite answer ({@link classifyConnectFailure}: the same table, the same unanimity). A `TypeError` with none
+ *  was never built.
  *  Measured over ten real shapes; non-`TypeError` stays on the transport arm and an unreadable value answers
  *  `transport`, the pre-existing behavior. Stated cost: KL-933a. */
 export declare function classifyFetchThrow(e: unknown): FetchThrowClass;

package/dist/brain/errors.js

@@ -138,8 +138,13 @@ function hasStaleConnectionCode(e) {
     }
     return false;
 }
-const DETERMINISTIC_CONNECT_CODES = new Set(["ECONNREFUSED", "ENOTFOUND"]);
+export const PROXY_TUNNEL_REFUSED = "ERR_PROXY_TUNNEL_REFUSED";
+const DETERMINISTIC_CONNECT_CODES = new Set(["ECONNREFUSED", "ENOTFOUND", PROXY_TUNNEL_REFUSED]);
 const CONNECT_GRAPH_NODE_BUDGET = 16;
+function proxyStatusOf(node) {
+    const status = readMember(node, "statusCode");
+    return typeof status === "number" && Number.isInteger(status) && status < 600 && namesTheFailure(status) ? status : undefined;
+}
 function walkConnectFailure(node, budget) {
     if (budget.left <= 0)
         return "indeterminate";
@@ -151,6 +156,8 @@ function walkConnectFailure(node, budget) {
     if (typeof code === "string") {
         if (!DETERMINISTIC_CONNECT_CODES.has(code))
             return "indeterminate";
+        if (code === PROXY_TUNNEL_REFUSED && budget.proxy === undefined)
+            budget.proxy = { status: proxyStatusOf(node) };
         verdict = "deterministic";
     }
     if (!isErrorLike(node))
@@ -176,8 +183,23 @@ function walkConnectFailure(node, budget) {
     }
     return verdict;
 }
+export function readConnectFailure(e) {
+    const walk = { left: CONNECT_GRAPH_NODE_BUDGET };
+    if (walkConnectFailure(e, walk) !== "deterministic")
+        return { verdict: "indeterminate" };
+    return walk.proxy === undefined ? { verdict: "deterministic" } : { verdict: "deterministic", proxyRefusal: walk.proxy };
+}
 export function classifyConnectFailure(e) {
-    return walkConnectFailure(e, { left: CONNECT_GRAPH_NODE_BUDGET }) === "deterministic" ? "deterministic" : "indeterminate";
+    return readConnectFailure(e).verdict;
+}
+const PROXY_TUNNEL_REFUSED_SENTENCES = new Map([
+    [407, "proxy authentication required (HTTP 407)"],
+    [403, "proxy forbids this destination (HTTP 403)"],
+]);
+export function proxyTunnelRefusedSentence(status) {
+    if (status === undefined)
+        return "proxy refused the tunnel";
+    return PROXY_TUNNEL_REFUSED_SENTENCES.get(status) ?? `proxy refused the tunnel (HTTP ${status})`;
 }
 const FETCH_TRANSPORT_SHELLS = new Set(["fetch failed", "terminated"]);
 const REQUEST_ARGUMENT_CODES = new Set(["ERR_INVALID_URL"]);
@@ -187,6 +209,8 @@ export function classifyFetchThrow(e) {
     const message = readMember(e, "message");
     if (typeof message === "string" && FETCH_TRANSPORT_SHELLS.has(message))
         return "transport";
+    if (classifyConnectFailure(e) === "deterministic")
+        return "transport";
     const cause = readMember(e, "cause");
     if (cause === undefined || cause === null)
         return "request_unbuildable";

package/dist/brain/stream-engine.d.ts

@@ -27,7 +27,8 @@ export interface StreamEngineConfig extends BrainTimeoutConfig {
     retryDelayMs?: number;
     /**
      * Retries allowed for a DETERMINISTIC connect failure — one whose error codes say the target itself
-     * is not there (`ECONNREFUSED`, or a name with no address; see `errors.ts` `classifyConnectFailure`).
+     * is not there (`ECONNREFUSED`, or a name with no address) or that the proxy on the way refused the tunnel
+     * (`PROXY_TUNNEL_REFUSED`); see `errors.ts` `readConnectFailure`.
      * Absent ⇒ {@link DEFAULT_DETERMINISTIC_CONNECT_RETRIES}.
      *
      * These retries exist for one case only: a peer that is mid-restart and about to accept. Waiting

package/dist/brain/stream-engine.js

@@ -1,7 +1,7 @@
 import { createAssistantMessageEventStream, } from "../internal/llm.js";
 import { STREAM_TORN_WARNING } from "./stream-shared.js";
 import { FLOOR_OUTPUT_TOKENS, parseContextOverflow, planOutputCapAdjustment } from "./context-overflow.js";
-import { abortLikeName, BrainError, brainErrorCodeOf, classifyConnectFailure, classifyFetchThrow, classifyHttp, describeNetworkError, isProviderEchoShape, namesTheFailure, readProviderErrorCode, readProviderRequestId, refusedTheRequest } from "./errors.js";
+import { abortLikeName, BrainError, brainErrorCodeOf, classifyFetchThrow, classifyHttp, describeNetworkError, isProviderEchoShape, namesTheFailure, proxyTunnelRefusedSentence, readConnectFailure, readProviderErrorCode, readProviderRequestId, refusedTheRequest } from "./errors.js";
 import { stripUrlCredentials } from "./route-adjudicator.js";
 import { classifyInputTooLong } from "./input-too-long.js";
 import { FAST_MAX_BACKOFF_MS, providerWaitHint, retryBackoffMs } from "./retry.js";
@@ -531,7 +531,8 @@ export function runStreamingBrain(args) {
                     const retryableByStatus = netErr !== undefined ||
                         (r !== undefined && (r.status >= 500 || r.status === 429 || r.status === 408 || r.status === 409));
                     const retryable = shouldRetryHeaderVerdict(r) ?? retryableByStatus;
-                    const deterministicConnect = netErr !== undefined && classifyConnectFailure(netErr) === "deterministic";
+                    const connectReading = netErr !== undefined ? readConnectFailure(netErr) : undefined;
+                    const deterministicConnect = connectReading?.verdict === "deterministic";
                     const fastLane = deterministicConnect && deterministicLaneActive;
                     const laneMaxRetries = fastLane ? deterministicConnectBudget : maxRetries;
                     const errClass = netErr !== undefined
@@ -552,11 +553,8 @@ export function runStreamingBrain(args) {
                             ? ` (the requested wait was longer than the cap; honoring ${Math.ceil(waitHint.ms / 1000)}s instead of ${Math.ceil(waitHint.rawMs / 1000)}s)`
                             : "";
                         const statusPhase = r?.status === 429 ? "rate_limited" : netErr !== undefined ? "reconnecting" : "retrying";
-                        const reconnectDetail = errClass !== "connect_refused"
-                            ? "connection lost, reconnecting"
-                            : fastLane
-                                ? "no endpoint answering, retrying briefly"
-                                : "no endpoint answering, retrying";
+                        const refusedSubject = connectReading?.proxyRefusal !== undefined ? "proxy refused the tunnel" : "no endpoint answering";
+                        const reconnectDetail = errClass !== "connect_refused" ? "connection lost, reconnecting" : fastLane ? `${refusedSubject}, retrying briefly` : `${refusedSubject}, retrying`;
                         emitBrainTelemetry({ kind: "retry", attempt: attempt + 1, phase: "connect", errClass, nextDelayMs: delayMs });
                         announcedRetry = true;
                         discardResponseBody(r);
@@ -580,8 +578,11 @@ export function runStreamingBrain(args) {
                         attempt++;
                         continue;
                     }
-                    if (netErr)
-                        throw new BrainError("network", describeNetworkError(netErr), undefined, { apiError: true });
+                    if (netErr) {
+                        const chain = describeNetworkError(netErr);
+                        const proxyRefusal = connectReading?.proxyRefusal;
+                        throw new BrainError("network", proxyRefusal === undefined ? chain : `${proxyTunnelRefusedSentence(proxyRefusal.status)} — ${chain}`, undefined, { apiError: true });
+                    }
                     const detail = overflowBody ?? (r ? (await readErrorBody(r, signal)).text : "");
                     const status = r?.status ?? 0;
                     const itl = classifyInputTooLong(status, detail);

package/dist/core/agent-definition.d.ts

@@ -33,7 +33,7 @@ export interface AgentDefinition {
      *  the delegation tool's name cannot re-delegate (CC Explore/Plan `disallowedTools` include Agent,
      *  pretty.js:409189/486948). */
     allowTools?: string[];
-    /** Tool denylist (a deny always wins). See {@link allowTools} for the per-agent delegation-tool note. */
+    /** Tool denylist (a deny always wins), tool NAMES: `Tool(content)` hides the whole `Tool`. See {@link allowTools} for the per-agent delegation-tool note. */
     denyTools?: string[];
     /**
      * F7 (CC 2.1.198 parity, per-agent `skills` — 锚 pretty.js:422126 `e.skills ?? []`, GA/ungated in 198:
@@ -116,7 +116,7 @@ export interface SkillSpec {
      * either list asks once (`Execute skill: <name>`, the card listing what it releases); a skill the person invoked by
      * name ({@link import("./task-spec.js").TaskSpec.userInvokedSkills}) grants without asking. The grant holds for that
      * run (a steer it takes in does not end it) and the next runTask starts without it. An entry this grammar reads as nothing — `*` (it voids an allow list; on a deny list it is inert and the rest of the
-     * list still refuses), `mcp__*`, a write path, a domain — grants nothing and is announced at the start of the run (`permission.allowed_tool_not_granted`).
+     * list still refuses), `mcp__*`, a write path, a domain — grants nothing and is announced at the start of the run (`permission.allowed_tool_not_granted`). A table whose value is not a list (a string, an object…) reads as one such entry; `null` is no table.
      */
     allowedTools?: string[];
     /** The tools refused for the rest of the run this skill is activated in — the frontmatter `disallowed-tools` list,

package/dist/core/allow-entry.d.ts

@@ -3,17 +3,33 @@ import { type ToolCallRequest } from "./tool-policy.js";
 import { type AllowRuleMember, type AllowRuleShadow } from "./allow-rule-shadow.js";
 import { type PersistedRule } from "./permission-rule-model.js";
 import { type AskClass, type AssertAllKeysHandled, type PermissionMode, type PersistedRuleMandate } from "./ask-origin.js";
+import { type ToolNameListReading } from "../agents/tool-filter.js";
 import { type EngineNotice } from "./engine-notice.js";
 /** Why an entry grants (or refuses) nothing — the closed set the start-of-run notice names, for every list. `tool_name`: the
  *  entry's tool name is one the name judgment reads as stale against the run's roster (`verdict` says which); `near_miss`: the
  *  run mounts no tool of that exact name but mounts one that differs only by case (`currentName` is its spelling). */
 export declare const ALLOW_ENTRY_INERT_REASONS: readonly ["wildcard_all", "namespace_wildcard", "path_pattern", "domain", "content_unsupported", "grammar", "tool_name", "near_miss"];
 export type AllowEntryInertReason = (typeof ALLOW_ENTRY_INERT_REASONS)[number];
-/** The facts beside a `tool_name` / `near_miss` reason: the judgment's word, and the spelling to write instead when there is one. */
+/** The facts beside a reason: for `tool_name` / `near_miss` the judgment's word and the spelling to write instead when there is
+ *  one; for a list member that is not a string (`grammar`) the TYPE of the value (`a number`, `null`, `an object`…) — `entry` then
+ *  holds {@link nonStringMemberLabel}, never the value. */
 export interface AllowEntryInertDetail {
     readonly verdict?: Exclude<RuleToolNameVerdict["kind"], "current">;
     readonly currentName?: string;
+    readonly valueType?: string;
 }
+/**
+ * How a list member that is not a string is named wherever a list's entries are named (the inert record's `entry`, the Skill
+ * card's binding): its TYPE, in a spelling no readable entry can have — a readable entry's name holds no whitespace and a
+ * name-only entry holds no parenthesis, and this label holds a space and none. It can equal only another entry that reads as
+ * nothing, so a binding that holds it never stands for an entry that grants or refuses.
+ */
+export declare function nonStringMemberLabel(value: unknown): string;
+/** How a tool-name list's VALUE that is not a list stands as one entry (the same kind of spelling as {@link nonStringMemberLabel}: it
+ *  reads as `grammar`): its TYPE, or that its entries could not be read — never the value. */
+export declare function nonListValueLabel(read: Exclude<ToolNameListReading, {
+    kind: "entries";
+}>): string;
 /** One entry a list reads as nothing. */
 export type AllowEntryInert = {
     readonly entry: string;
@@ -189,6 +205,7 @@ declare const SHADOW_REASON: {
     readonly content_question: "the call is the engine's own question to a person";
     readonly hook: "a PreToolUse hook asks about this call — the deployment's own screening is answered by a person";
     readonly ancestor: "the task that delegated this one owns this question";
+    readonly dangerous_delete: "this removal targets a protected location (the filesystem root, a top-level directory, a home directory, or a workspace directory or one of its ancestors) — it is cleared by confirming this call, never by an allow rule";
     readonly unverifiable_delete: "this removal could not be verified safe — it is cleared by confirming this call, never by an allow rule";
     readonly transcript_write: "this write targets the session transcript — it is cleared by confirming this call, never by an allow rule";
     readonly org_rule: "an organization policy rule requires approval for this call";
@@ -244,6 +261,13 @@ export type AllowEntryInertNote = ({
 } & AllowEntryInert) | ({
     readonly source: AllowEntrySource;
 } & AllowEntryInert);
+/**
+ * THE ONE WRITER of a list entry into a sentence (the start-of-run notice, a skill's refusal and its decisions, a sub-agent
+ * list's refusals and advisories): the entry as a JSON string — quotes, backslashes and the usual escapes — with every
+ * character that prints as nothing, or as a space, written as `\uXXXX` (`\u{…}` beyond the BMP) and a run of spaces kept
+ * space by space, so what a person reads is what the engine read. Capped on what is printed.
+ */
+export declare function renderListEntry(entry: string): string;
 /**
  * One entry that reads as nothing, as a person reads it: the entry as written (quoted, so a surrounding space shows) and why
  * — the reason word, with the spelling to write when the reading has one. The one phrasing the start-of-run notice and a

package/dist/core/allow-entry.js

@@ -9,12 +9,19 @@ import { pathRuleLaneAnswer } from "./runner/permission-rule-lanes.js";
 import { splitShellCompoundSegments } from "../tools/fs/bash-readonly-classifier.js";
 import { mandateDisclosureOf } from "./ask-origin.js";
 import { inlineUntrusted } from "./untrusted-text.js";
+import { valueTypeLabel } from "../agents/tool-filter.js";
 import { deliverEngineNotice } from "./engine-notice.js";
 export const ALLOW_ENTRY_INERT_REASONS = Object.freeze(["wildcard_all", "namespace_wildcard", "path_pattern", "domain", "content_unsupported", "grammar", "tool_name", "near_miss"]);
+export function nonStringMemberLabel(value) {
+    return `<not a string: ${valueTypeLabel(value)}>`;
+}
+export function nonListValueLabel(read) {
+    return read.kind === "not_a_list" ? `<not a list: ${read.type}>` : "<a list whose entries cannot be read>";
+}
 function ruleRowOf(parsed) {
     return { ...parsed, scope: { kind: "global" }, adds: [{ dot: { actor: "list", counter: 1 }, origin: "user", createdAt: "" }] };
 }
-const TOOL_NAME_SPELLING = /^[^\s()]+$/;
+const TOOL_NAME_SPELLING = /^[^\s()\p{Cc}\p{Cf}]+$/u;
 function mountedSpellingOf(name, roster) {
     const folded = name.toLowerCase();
     for (const mounted of roster)
@@ -36,6 +43,8 @@ function toolNameReading(name, roster) {
 function readAllowEntry(raw, behavior, roster) {
     const inert = (reason) => ({ inert: reason });
     const row = (compiled) => ({ compiled });
+    if (typeof raw !== "string")
+        return { inert: "grammar", detail: { valueType: valueTypeLabel(raw) } };
     if (raw !== raw.trim())
         return inert("grammar");
     const parsed = parsePermissionRule(raw);
@@ -94,11 +103,11 @@ export function compileAllowList(entries, behavior, roster) {
     const rows = [];
     const inert = [];
     for (const entry of entries) {
-        const read = voided ? { inert: "wildcard_all" } : readAllowEntry(entry, behavior, roster);
+        const read = typeof entry !== "string" || !voided ? readAllowEntry(entry, behavior, roster) : { inert: "wildcard_all" };
         if ("compiled" in read)
             rows.push({ entry, compiled: read.compiled });
         else
-            inert.push({ entry, reason: read.inert, ...read.detail });
+            inert.push({ entry: typeof entry === "string" ? entry : nonStringMemberLabel(entry), reason: read.inert, ...read.detail });
     }
     return { rows, inert };
 }
@@ -307,6 +316,7 @@ const SHADOW_REASON = {
     content_question: "the call is the engine's own question to a person",
     hook: "a PreToolUse hook asks about this call — the deployment's own screening is answered by a person",
     ancestor: "the task that delegated this one owns this question",
+    dangerous_delete: "this removal targets a protected location (the filesystem root, a top-level directory, a home directory, or a workspace directory or one of its ancestors) — it is cleared by confirming this call, never by an allow rule",
     unverifiable_delete: "this removal could not be verified safe — it is cleared by confirming this call, never by an allow rule",
     transcript_write: "this write targets the session transcript — it is cleared by confirming this call, never by an allow rule",
     org_rule: "an organization policy rule requires approval for this call",
@@ -366,7 +376,22 @@ export function cardDisclosureOf(decision, fallbackMessage) {
 }
 export const ALLOWED_TOOL_NOT_GRANTED_CODE = "permission.allowed_tool_not_granted";
 const NOTICE_ENTRIES_SHOWN = 5;
+const UNSEEN_IN_ENTRY = /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}\p{Zs}]/gu;
+const ENTRY_RENDER_MAX = 122;
+function escapedCodePoint(ch) {
+    const cp = ch.codePointAt(0) ?? 0;
+    const hex = cp.toString(16).padStart(4, "0");
+    return cp > 0xffff ? `\\u{${hex}}` : `\\u${hex}`;
+}
+export function renderListEntry(entry) {
+    const quoted = JSON.stringify(entry)
+        .replace(/ {2,}/g, (run) => "\\u0020".repeat(run.length))
+        .replace(UNSEEN_IN_ENTRY, (ch) => (ch === " " ? ch : escapedCodePoint(ch)));
+    return inlineUntrusted(quoted, ENTRY_RENDER_MAX);
+}
 export function inertEntryPhrase(e) {
+    if (e.valueType !== undefined)
+        return `a value that is ${e.valueType} (grammar: not a string)`;
     const spelling = e.currentName !== undefined ? inlineUntrusted(e.currentName, 120) : undefined;
     const why = (() => {
         if (e.reason === "near_miss")
@@ -386,7 +411,7 @@ export function inertEntryPhrase(e) {
             }
         }
     })();
-    return `${inlineUntrusted(JSON.stringify(e.entry), 122)} (${why})`;
+    return `${renderListEntry(e.entry)} (${why})`;
 }
 export function allowedToolsNotGrantedNotice(inert, sessionId) {
     const where = (e) => (e.source === "skill" ? `skill ${inlineUntrusted(e.skill, 80)} ${e.list}` : e.source === "request" ? "this run's allowedTools" : "the deployment's allowedTools");

package/dist/core/ask-origin.d.ts

@@ -25,6 +25,7 @@
  * the ask). Both stay where they are and are consumed beside the origin, not folded into it.
  */
 import type { PermissionResult } from "./tool-policy.js";
+import type { ContainmentFace } from "../tools/fs/containment-face.js";
 /**
  * The closed set, in AUTHORITY order — the order {@link askOriginOf} resolves a fold in when several
  * facts hold on one call (a hook ask folded over a policy ask, an org stamp over either). The order
@@ -448,8 +449,12 @@ export type ToolMarkSource = "deployment" | "mcp_annotation" | "a2a_default";
  * `classifier_no_ruling` is a classifier station's question to a person because the auto-mode classification did not rule
  * (`classifierNoRuling` — it could not run, or replied with no verdict): the denial-limit fallback's row (only a person
  * answers it; the classifier is never asked again).
+ * `dangerous_delete` is a removal whose target is a protected location (`dangerousRemovalOf`: the filesystem root, a
+ * top-level directory, a home directory, or a workspace directory — the task root, the working directory, an additional
+ * working directory — or an ancestor of one): the reference implementation's dangerous-removal breaker, which no mode,
+ * allow rule or classifier answers. `unverifiable_delete` is its sibling for a target the command text cannot resolve.
  */
-export declare const ASK_CLASSES: readonly ["content_question", "hook", "ancestor", "unverifiable_delete", "transcript_write", "org_rule", "governance_unavailable", "rule_unreadable", "ask_rule", "denial_limit_fallback", "classifier_no_ruling", "requires_user_interaction", "operator_forced", "shell_floor", "write_protection_unresolved", "probe", "write_protection", "tool_marks_mcp", "tool_marks_a2a", "policy_rra", "artifact_shared_read", "mode", "unstated", "ordinary"];
+export declare const ASK_CLASSES: readonly ["content_question", "hook", "ancestor", "dangerous_delete", "unverifiable_delete", "transcript_write", "org_rule", "governance_unavailable", "rule_unreadable", "ask_rule", "denial_limit_fallback", "classifier_no_ruling", "requires_user_interaction", "operator_forced", "shell_floor", "write_protection_unresolved", "probe", "write_protection", "tool_marks_mcp", "tool_marks_a2a", "policy_rra", "artifact_shared_read", "mode", "unstated", "ordinary"];
 export type AskClass = (typeof ASK_CLASSES)[number];
 /** Membership test for {@link AskClass} — the word crosses the wire on `tool_end.gate.disposition`. */
 export declare function isAskClass(v: unknown): v is AskClass;
@@ -457,7 +462,8 @@ export declare function isAskClass(v: unknown): v is AskClass;
 export interface ModeArbitrationRow {
     /** The ask still reaches a person under `bypassPermissions` (the reference implementation's `bypassImmune`). */
     readonly bypassImmune: boolean;
-    /** The auto-mode classifier may answer it. */
+    /** The auto-mode classifier may answer it — as the class stands on its own: the folded row of an ask
+     *  ({@link foldArbitrationRow}) also takes the read face the ask was raised under. */
     readonly classifierEligible: boolean;
     /** The sandbox-admission leg may admit it (containment holds the effect). */
     readonly sandboxAdmission: boolean;
@@ -473,6 +479,8 @@ export interface ModeArbitrationRow {
  * sandbox columns are the fold of the two former per-word lane tables (only `probe` moved: the classifier may
  * now answer it — the read boundary's unestablishable spelling is fed to it as a deny-table row instead), and
  * `ruleMayClear` restates {@link ruleClearanceOf}'s conclusion per class (a real-approval bit is never rule-clearable).
+ * `probe`'s `classifierEligible` is the OPEN read face's reading: a narrowed (`roots`) face withholds the classifier from the class,
+ * folded where the ask's row is ({@link foldArbitrationRow}).
  * `mode` is the permission mode's OWN question (`plan`'s two sentences, `decisionReason: "mode"`): the reference
  * implementation puts it to a person past every allow rule and never to an automatic lane, and its bypass conversion
  * releases it like any other non-immune ask. `unstated` is the reference implementation's passthrough conversion: an allow
@@ -503,6 +511,13 @@ export declare const MODE_ARBITRATION: {
         readonly ruleMayClear: false;
         readonly hookAskFloor: false;
     };
+    readonly dangerous_delete: {
+        readonly bypassImmune: true;
+        readonly classifierEligible: false;
+        readonly sandboxAdmission: false;
+        readonly ruleMayClear: false;
+        readonly hookAskFloor: true;
+    };
     readonly unverifiable_delete: {
         readonly bypassImmune: true;
         readonly classifierEligible: true;
@@ -683,6 +698,8 @@ export interface AskClassFacts extends AskOriginFacts {
     readonly toolMarkSources?: ReadonlySet<ToolMarkSource>;
     readonly a2aIsolatePeers?: boolean;
     readonly ancestorClasses?: ReadonlySet<AskClass>;
+    /** The read face the leg this ask was raised on resolved ({@link ContainmentFace}); absent ⇒ none resolved (a leg with no hands). */
+    readonly readFace?: ContainmentFace;
 }
 /** The classification the arbitration reads: the whole set, the disclosed word (the set's first member in
  *  {@link ASK_CLASSES} order) and the row folded across the set. */
@@ -718,8 +735,10 @@ export declare function decisionAskClassesOf(d: Extract<PermissionResult, {
 }>): Set<AskClass>;
 /** Fold a class set onto one row: `bypassImmune` and `hookAskFloor` by OR (any immune member keeps the ask; any floored
  *  member floors a hook's ask), the three permissive switches by AND (one refusing member withholds the lane). An empty
- *  set is `ordinary`. */
-export declare function foldArbitrationRow(classes: ReadonlySet<AskClass>): ModeArbitrationRow;
+ *  set is `ordinary`. `readFace` is the face the ask was raised under: `roots` takes the classifier's lane from a set that
+ *  holds a class the narrowed face withholds from it — the one place the face enters, so every reader of `classifierEligible`
+ *  reads it already folded. */
+export declare function foldArbitrationRow(classes: ReadonlySet<AskClass>, readFace?: ContainmentFace): ModeArbitrationRow;
 /**
  * The ONE class derivation: the decision half ({@link decisionAskClassesOf}) joined with the gate's own facts —
  * the question tool, an ancestor's mark, the org layer's two arms, the persisted lane's unreadable call, the tool