@sema-agent/core 7.43.0 → 7.45.0

package/dist/core/memory-engine/file-backend.d.ts

@@ -682,9 +682,9 @@ export declare class FileMemoryEngineBackend implements MemoryBackend {
      *  let a transient EIO run the unlocked recovery (and its staged sweep) over a live transaction. */
     private txnInFlight;
     /**
-     * The act gate for store paths ({@link storeTargetEscape}) over `ops`' writes and deletes — shadow
+     * The act gate for store paths ({@link landsOutsideStore}) over `ops`' writes and deletes — shadow
      * ops name control-plane files, not store paths. Refuses with `memory.target_outside_store` at the
-     * first op that would land outside the store, naming the op and where it resolves. Runs over a
+     * first op that would land outside the store, naming the op (its path on `detail.path`). Runs over a
      * whole batch before its commit marker (no journal is written; a caller that staged files removes
      * them) and per op at the act itself; past the marker a refusal keeps the journal, which replays
      * once the path resolves inside the store again.

package/dist/core/memory-engine/file-backend.js

@@ -8,7 +8,7 @@ import { ambiguousOriginRepresentation, committedDistilledOf, committedOriginOf,
 import { convertV1SidecarKeys } from "./delegation-settlement.js";
 import { layerObservationLookup, observedDivergenceNotice } from "./layer-observations.js";
 import { DEFAULT_MAX_ENTRY_DEPTH, MEMORY_INDEX_FILENAME, scanEntryFiles } from "./entry-scan.js";
-import { ControlPlaneCorruptError, CURSORS_FILE, QUARANTINE_DIR, CHALLENGES_FILE, IMPORT_RECEIPTS_DIR, LINEAGE_FILE, SESSION_POLLUTION_DIR, appendChallengeEvents, atomicWriteFileSync, quarantineAndTombstone, captureAndClearLineageForEntries, adoptRootScopeLayout, adoptCanonicalKeyedControlDir, deriveControlPlaneDir, ensureDirExists, enqueueMemoryAnnouncement, importLatchTxnId, importLineageCommitted, importSessionPollution, isContainedIn, permissionRemedyOf, withPermissionRemedy, lineageContributionsOfSession, listSessionPollution, readChallengeEvents, readLineageRecord, registerScope, registeredScopes, releaseImportLatch, layoutNeedsAdoption, resolveMemoryEngineRoot, scopeDirFor, scopeDirName, scopeRegistryShape, stageImportLatch, landingPathOf, storeTargetEscape, TARGET_OUTSIDE_STORE, writeAllSync, } from "./layout.js";
+import { ControlPlaneCorruptError, CURSORS_FILE, QUARANTINE_DIR, CHALLENGES_FILE, IMPORT_RECEIPTS_DIR, LINEAGE_FILE, SESSION_POLLUTION_DIR, appendChallengeEvents, atomicWriteFileSync, quarantineAndTombstone, captureAndClearLineageForEntries, adoptRootScopeLayout, adoptCanonicalKeyedControlDir, deriveControlPlaneDir, ensureDirExists, enqueueMemoryAnnouncement, importLatchTxnId, importLineageCommitted, importSessionPollution, isContainedIn, permissionRemedyOf, withPermissionRemedy, lineageContributionsOfSession, listSessionPollution, readChallengeEvents, readLineageRecord, registerScope, registeredScopes, releaseImportLatch, layoutNeedsAdoption, resolveMemoryEngineRoot, scopeDirFor, scopeDirName, scopeRegistryShape, stageImportLatch, landingPathOf, landsOutsideStore, storeActRefusal, storeRootMovedRefusal, writeAllSync, } from "./layout.js";
 import { screenInboundEntries } from "./data-plane.js";
 import { scanMemoryFileName, scanMemoryWrite } from "./scan.js";
 import { thrownText } from "../thrown-value.js";
@@ -1404,7 +1404,7 @@ export class FileMemoryEngineBackend {
                 }
             }
             this.assertTxnLockOwnership(fenceToken);
-            const replayAt = `the journal replay (journal kept at ${jp})`;
+            const replayAt = "the journal replay (journal kept)";
             this.refuseEscapingTargets(journal.ops, replayAt);
             for (const op of journal.ops) {
                 this.refuseEscapingTargets([op], replayAt);
@@ -1470,10 +1470,8 @@ export class FileMemoryEngineBackend {
             if (op.kind !== "write" && op.kind !== "delete")
                 continue;
             for (const path of op.staged === undefined ? [op.target] : [op.target, op.staged]) {
-                const escape = storeTargetEscape(this.physicalRoot, path);
-                if (escape === undefined)
-                    continue;
-                throw erasureCodedError(`${TARGET_OUTSIDE_STORE}: ${at} refused a ${op.kind} of ${op.target}${path === op.target ? "" : ` (its staged file ${path})`} — ${escape}; not performed`, TARGET_OUTSIDE_STORE);
+                if (landsOutsideStore(this.physicalRoot, path))
+                    throw storeActRefusal(`${path === op.target ? "a" : "the staged file of a"} ${op.kind} at ${at}`, path);
             }
         }
     }
@@ -1481,7 +1479,7 @@ export class FileMemoryEngineBackend {
         const now = landingPathOf(this.directoryRoot);
         if (now === this.physicalRoot)
             return;
-        throw erasureCodedError(`${TARGET_OUTSIDE_STORE}: the store root ${this.directoryRoot} now resolves to ${now}, not ${this.physicalRoot} where this backend opened it — refused; open a new backend on the directory you mean`, TARGET_OUTSIDE_STORE);
+        throw storeRootMovedRefusal("backend", this.directoryRoot);
     }
     sweepStagedFiles() {
         const walk = (d, depth) => {

package/dist/core/memory-engine/layout.d.ts

@@ -259,8 +259,45 @@ export declare function adoptRootScopeLayout(rootPath: string, controlDir: strin
 export declare const canonicalize: typeof physicalPathOfExisting;
 /** True iff `child` (canonicalized) is `root` or inside it. */
 export declare function isContainedIn(root: string, child: string): boolean;
-/** The code an act on a store path is refused with when it would land outside the store ({@link storeTargetEscape}). */
+/** The codes the store's physical form refuses an act with — the whole family, one closed set: {@link TARGET_OUTSIDE_STORE} and
+ *  {@link SCOPE_HOME_NOT_DIRECTORY}. Each is a plain `Error` carrying `code` and a `detail` ({@link StoreFormRefusalDetail}). */
+export declare const STORE_FORM_REFUSAL_CODES: readonly ["memory.target_outside_store", "memory.scope_home_not_directory"];
+export type StoreFormRefusalCode = (typeof STORE_FORM_REFUSAL_CODES)[number];
+/** The code an act on a store path is refused with when it would land outside the store ({@link landsOutsideStore}). */
 export declare const TARGET_OUTSIDE_STORE = "memory.target_outside_store";
+/** The code a scope home that is not a real directory is refused with ({@link assertHomePhysicalForm}). */
+export declare const SCOPE_HOME_NOT_DIRECTORY = "memory.scope_home_not_directory";
+/** What a scope home can be besides a real directory (an `lstat` verdict). */
+export declare const SCOPE_HOME_FORMS: readonly ["symlink", "file", "other"];
+export type ScopeHomeForm = (typeof SCOPE_HOME_FORMS)[number];
+/** How a refusal's sentence names each form. */
+declare const SCOPE_HOME_FORM_PHRASE: {
+    readonly symlink: "a symbolic link";
+    readonly file: "a regular file";
+    readonly other: "a special file";
+};
+export type HomeFormPhraseCoversEveryForm = AssertAllKeysHandled<Exclude<ScopeHomeForm, keyof typeof SCOPE_HOME_FORM_PHRASE>>;
+/** What a store-form refusal carries beside its sentence. The ONE host path lives here and never in the
+ *  sentence; `form` is present on {@link SCOPE_HOME_NOT_DIRECTORY} only. */
+export type StoreFormRefusalDetail = {
+    readonly path: string;
+    readonly form?: ScopeHomeForm;
+};
+/** A refusal the store's physical form earns: a plain `Error` (never the control-plane-damage class —
+ *  the engine's own account is intact, the layout it was handed is not the layout it needs) carrying a
+ *  `code` and a `detail`. */
+export type StoreFormRefusal = Error & {
+    code: StoreFormRefusalCode;
+    detail: StoreFormRefusalDetail;
+};
+/** Seat 1 — an act the store's physical form refuses: `act` names what was refused (no path), `path` is the
+ *  target whose directory resolves outside the store ({@link landsOutsideStore}). */
+export declare function storeActRefusal(act: string, path: string): StoreFormRefusal;
+/** Seat 2 — the store root now resolves to another directory than the one the `holder` first opened; `path` is
+ *  the root's spelling. */
+export declare function storeRootMovedRefusal(holder: "backend" | "engine", path: string): StoreFormRefusal;
+/** Seat 3 — a scope home that is not a real directory. */
+export declare function scopeHomeRefusal(form: ScopeHomeForm, path: string): StoreFormRefusal;
 /** Where an act at `p` lands: the physical path of its normalized spelling (the spelling a child path
  *  joined under it carries), a MISSING tail rejoined under the deepest existing directory (what the act
  *  creates). Any other resolution fault (EACCES, ELOOP, ENOTDIR) is THROWN as itself: an act that
@@ -268,8 +305,8 @@ export declare const TARGET_OUTSIDE_STORE = "memory.target_outside_store";
  *  (a link whose own mode refuses `realpath` is still followed by `unlink` and `rename`). */
 export declare function landingPathOf(p: string): string;
 /**
- * Where a write, rename or delete at `target` would physically LAND, judged against the store's
- * `physicalRoot`: `undefined` = inside, otherwise the reason. The target's directory, resolved through
+ * Whether a write, rename or delete at `target` would physically LAND outside the store, judged against the
+ * store's `physicalRoot` (`true` = outside; the refusal is {@link storeActRefusal}). The target's directory, resolved through
  * every link on its existing prefix (a missing tail is what the act creates, under the deepest existing
  * directory), must be the root or inside it. `physicalRoot` is the root's physical form as the store
  * was opened and is not re-resolved here: a store mounted through a link is judged by what the link
@@ -280,7 +317,7 @@ export declare function landingPathOf(p: string): string;
  * keeps the spelling while the act follows the link out. A directory that cannot be resolved throws its
  * fault ({@link landingPathOf}).
  */
-export declare function storeTargetEscape(physicalRoot: string, target: string): string | undefined;
+export declare function landsOutsideStore(physicalRoot: string, target: string): boolean;
 /** mkdir -p convenience used by the engine/backend (0o700 like the file stores). */
 export declare function ensureDirExists(dir: string): void;
 /** The one remedy every surfaced permission refusal carries — `undefined` unless `err` is a write

package/dist/core/memory-engine/layout.js

@@ -472,11 +472,18 @@ function assertHomePhysicalForm(home) {
         return "absent";
     if (st.isDirectory())
         return "dir";
-    throw new ControlPlaneCorruptError(`scope home ${home} is ${st.isSymbolicLink() ? "a symbolic link" : "not a directory"} — a scope home must be a real directory (fail-closed)`);
+    throw scopeHomeRefusal(st.isSymbolicLink() ? "symlink" : st.isFile() ? "file" : "other", home);
 }
 function ensureScopeHome(home) {
-    if (assertHomePhysicalForm(home) === "absent")
-        mkdirSync(home, { recursive: true });
+    if (assertHomePhysicalForm(home) === "absent") {
+        try {
+            mkdirSync(home, { recursive: true });
+        }
+        catch (err) {
+            assertHomePhysicalForm(home);
+            throw err;
+        }
+    }
     assertHomePhysicalForm(home);
 }
 export function registerScope(memoryDir, controlDir, scope, opts) {
@@ -724,7 +731,30 @@ export function isContainedIn(root, child) {
     const c = canonicalize(child);
     return c === r || c.startsWith(`${r}${sep}`);
 }
+export const STORE_FORM_REFUSAL_CODES = Object.freeze(["memory.target_outside_store", "memory.scope_home_not_directory"]);
 export const TARGET_OUTSIDE_STORE = "memory.target_outside_store";
+export const SCOPE_HOME_NOT_DIRECTORY = "memory.scope_home_not_directory";
+export const SCOPE_HOME_FORMS = Object.freeze(["symlink", "file", "other"]);
+const SCOPE_HOME_FORM_PHRASE = {
+    symlink: "a symbolic link",
+    file: "a regular file",
+    other: "a special file",
+};
+function storeFormRefusal(code, sentence, detail) {
+    const e = new Error(`${code}: ${sentence}`);
+    e.code = code;
+    e.detail = detail;
+    return e;
+}
+export function storeActRefusal(act, path) {
+    return storeFormRefusal(TARGET_OUTSIDE_STORE, `${act} was refused — its directory resolves outside the store root; not performed`, { path });
+}
+export function storeRootMovedRefusal(holder, path) {
+    return storeFormRefusal(TARGET_OUTSIDE_STORE, `the ${holder === "backend" ? "store root" : "memory dir"} now resolves to a different directory than the one this ${holder} ${holder === "backend" ? "opened" : "first mounted"} — refused; open a new ${holder} on the directory you mean`, { path });
+}
+export function scopeHomeRefusal(form, path) {
+    return storeFormRefusal(SCOPE_HOME_NOT_DIRECTORY, `a scope home must be a real directory, but this one is ${SCOPE_HOME_FORM_PHRASE[form]} — refused (fail-closed); put the real directory back`, { path, form });
+}
 export function landingPathOf(p) {
     const normalized = resolve(p);
     try {
@@ -736,9 +766,9 @@ export function landingPathOf(p) {
         return canonicalize(normalized);
     }
 }
-export function storeTargetEscape(physicalRoot, target) {
+export function landsOutsideStore(physicalRoot, target) {
     const dir = landingPathOf(dirname(target));
-    return dir === physicalRoot || dir.startsWith(`${physicalRoot}${sep}`) ? undefined : `its directory resolves to ${dir}, outside the store root ${physicalRoot}`;
+    return dir !== physicalRoot && !dir.startsWith(`${physicalRoot}${sep}`);
 }
 export function ensureDirExists(dir) {
     if (!existsSync(dir))

package/dist/core/permission-rules.d.ts

@@ -149,6 +149,10 @@ export interface PermissionRulePolicyOptions {
      * own; #644). Facts of the DEPLOYMENT and the task, never of the rule — a pattern is stored as spelled.
      * A rule whose base is absent (or not an absolute path) here is refused at compile time
      * (`unsupported.path_base`, naming the base — {@link ruleBasesNeeded} is the same classification).
+     * A call's own target resolves against these bases as given; when they hold neither `root` nor `cwd`,
+     * against the request's (`ToolCallRequest.root` / `.cwd`, stamped by the Runner) — never a mix of the two
+     * sources. A target neither supplies the base for is unreadable: every path rule able to reach the call
+     * answers it with the fail-closed ask (`ruleUnreadable`).
      */
     pathBases?: PathRuleBases;
 }

package/dist/core/permission-rules.js

@@ -366,10 +366,13 @@ export function createPermissionRulePolicy(rules, opts) {
         ...(callFace !== undefined ? faceRules[behavior].filter((r) => r.faces.includes(callFace)) : []),
     ];
     const commandParam = catalogRuleFaceOf("Bash")?.primaryParams[0] ?? "command";
+    const policyNamesTree = pathBases.root !== undefined || pathBases.cwd !== undefined;
+    const callBasesOf = (req) => policyNamesTree ? pathBases : { ...pathBases, ...(typeof req.root === "string" ? { root: req.root } : {}), ...(typeof req.cwd === "string" ? { cwd: req.cwd } : {}) };
     const contentHit = (lane, req) => {
         if (lane.length === 0)
             return undefined;
-        const target = effectivePathTargetOf(req, protectivePathTargetOf(req), pathBases);
+        const bases = callBasesOf(req);
+        const target = effectivePathTargetOf(req, protectivePathTargetOf(req), bases);
         const command = isPlainObjectArgs(req.args) ? req.args[commandParam] : undefined;
         let unreadable;
         for (const r of lane) {
@@ -386,7 +389,7 @@ export function createPermissionRulePolicy(rules, opts) {
                     unreadable ??= { rule: r, unreadable: target.reason };
                     continue;
                 }
-                const outcome = pathRuleReachOf(r.parsed, target.identity, pathBases);
+                const outcome = pathRuleReachOf(r.parsed, target.identity, bases);
                 if (outcome.reach === "reached")
                     return { rule: r };
                 if (outcome.reach === "unreadable")

package/dist/core/real-approval.d.ts

@@ -6,6 +6,7 @@
  * may still refuse it.
  */
 import type { Checkpoint } from "./checkpoint-store.js";
+import type { HostDecider } from "./gate-outcome.js";
 import type { OrgGateVerdict } from "./hooks.js";
 import type { AskRequest, PermissionResult, ResolvedAsk } from "./tool-policy.js";
 /** The synchronous seat's refusal of a configuration's allow: one settlement word for both forms
@@ -16,10 +17,12 @@ export declare function unjudgedAllowRefused(req: AskRequest, by: "blanket" | "p
 /** A durable row demands a person when its gate carries the real-approval bit (the gate's own, which every resume
  *  check reads; the pending action's `requiresRealApproval` is its display twin). */
 export declare function rowDemandsAPerson(cp: Checkpoint): boolean;
-/** A question a durable decide is held against, in each form a station holds one: the parked row, a policy's
- *  re-check of an approver's edit, and the organization's CURRENT verdict about the call. */
-export type HeldQuestion = Checkpoint | PermissionResult | OrgGateVerdict;
-/** Whether a durable decide made by `decidedBy` cannot answer the held question: a question demanding a person is not
+/** A question a decide is held against, in each form a station holds one: the parked row, a policy's re-check of an
+ *  approver's edit, the organization's CURRENT verdict about the call, and the request an approver was handed (the card a
+ *  live door answers). */
+export type HeldQuestion = Checkpoint | PermissionResult | OrgGateVerdict | AskRequest;
+/** Whether a decide made by `decidedBy` cannot answer the held question: a question demanding a person is not
  *  the policy's to answer. One predicate for every station that holds a decide against such a question — the resume
- *  entry (the row, an edit's re-check, the org's current verdict) and the execution belt (the last two, re-read). */
-export declare function policyCannotAnswer(question: HeldQuestion, decidedBy: "person" | "sla_timeout" | "policy"): boolean;
+ *  entry (the row, an edit's re-check, the org's current verdict), the execution belt (the last two, re-read) and a live
+ *  door answering the request an approver was handed. */
+export declare function policyCannotAnswer(question: HeldQuestion, decidedBy: HostDecider): boolean;

package/dist/core/real-approval.js

@@ -16,11 +16,11 @@ export function rowDemandsAPerson(cp) {
     return cp.gate.kind === "irreversible_ask" && cp.gate.realApproval !== undefined;
 }
 function demandsAPerson(question) {
-    if ("gate" in question)
-        return rowDemandsAPerson(question);
-    if ("action" in question)
-        return question.action === "ask" && question.requiresRealApproval === true;
-    return question.status === "available" && question.verdict?.behavior === "ask";
+    const gate = Reflect.get(question, "gate");
+    const verdict = Reflect.get(question, "verdict");
+    const row = typeof gate === "object" && gate !== null && rowDemandsAPerson(question);
+    const org = Reflect.get(question, "status") === "available" && typeof verdict === "object" && verdict !== null && Reflect.get(verdict, "behavior") === "ask";
+    return row || Reflect.get(question, "requiresRealApproval") === true || org;
 }
 export function policyCannotAnswer(question, decidedBy) {
     return decidedBy === "policy" && demandsAPerson(question);

package/dist/core/runner/child-tree.d.ts

@@ -0,0 +1,13 @@
+import type { RunnerDeps } from "../types.js";
+/**
+ * Whether this deployment can place a child agent in a tree OTHER than the caller's — the one fact behind
+ * every request of that shape: an explicit `cwd`, a workflow agent's `isolation: "worktree"`, and the
+ * delegation tool's per-call or per-definition `isolation: "worktree"`.
+ *
+ * Only an `executionEnvFactory` can: it builds one execution env per task, so a child can be rooted
+ * wherever the request says. A static `executionEnv` is ONE shared env with ONE cwd — every child that
+ * runs on it runs in the caller's root, whatever tree it was asked to work in. A request the deployment
+ * cannot honor is refused before the child starts (and, for a worktree, before one is minted); each site
+ * keeps its own code and sentence for the refusal, but none decides the condition itself.
+ */
+export declare function deploymentCanRerootChild(deps: Pick<RunnerDeps, "executionEnvFactory">): boolean;

package/dist/core/runner/child-tree.js

@@ -0,0 +1,3 @@
+export function deploymentCanRerootChild(deps) {
+    return deps.executionEnvFactory !== undefined;
+}

package/dist/core/runner/contracts.d.ts

@@ -31,9 +31,9 @@ import type { MaterializedA2a } from "../a2a.js";
 import type { CompactionForkContext, CompactionPhaseDurations, MaybeCompactOptions, RapidRefillState } from "../auto-compaction.js";
 import type { AutoModeArmingRecipe } from "../auto-mode-arming.js";
 import type { AutoModeDecider, AutoModeDenialTracker, DenialLimitFallbackFace } from "../auto-mode.js";
-import type { SettlementKind } from "../gate-outcome.js";
+import type { HostDecider, SettlementKind } from "../gate-outcome.js";
 import type { CacheBreakDetector, ToolFingerprintInput } from "../cache-break-detector.js";
-import type { ActorAssertion, Checkpoint, CheckpointState, CheckpointStore, CheckpointToken, PendingSteerEntry, PlatformLimitReason, ReopenReason, ResourceLedger, ResourceLimitReason, ResumeOutcome, SerializedCheckpointState } from "../checkpoint-store.js";
+import type { Checkpoint, CheckpointState, CheckpointStore, CheckpointToken, PendingSteerEntry, PlatformLimitReason, ReopenReason, ResourceLedger, ResourceLimitReason, ResumeOutcome, SerializedCheckpointState } from "../checkpoint-store.js";
 import type { ExecutionOutcomeRecordWord } from "../checkpoint-execution-record.js";
 import type { ClearedProjectionLedger, MicroCompactMachine, OccurrenceIndex } from "../context-edit.js";
 import type { HookInvocationIdentity, Hooks, OrgGateVerdict, PermissionDeniedPayload, PostToolBatchCall, PostToolBatchResult, ToolGateInput } from "../hooks.js";
@@ -391,6 +391,8 @@ export interface Prepared {
     /** The per-task logical cwd ref when a real shell is mounted (else undefined). The Runner
      *  reads `cwdRef.current` after each tool to detect a `cd` move and emit `workspace_changed`. */
     cwdRef?: CwdRef;
+    /** The root the hand tools resolve root-relative spellings against (present with hands; read-only hands included). */
+    handsRoot?: string;
     /** The run's TOOL-PROGRESS lane seat, late-bound for the same reason `harnessRef` is (the tool band is
      *  built during prepare; the lane needs `pushContent` and `ident`, which exist only after it returns).
      *  The driver binds `current` right after `pushContent` exists. Always present on a completed prepare —
@@ -442,7 +444,7 @@ export interface Prepared {
         toolCallId: string;
         toolName: string;
         args: unknown;
-        decidedBy: "person" | "sla_timeout" | "policy";
+        decidedBy: HostDecider;
     }) => Promise<{
         readonly refused: string;
     } | {
@@ -2494,21 +2496,6 @@ export interface RunState {
         attachmentsInjected: number;
     };
 }
-/** One accepted live steer's REPLAY identity, the twin of the parked
- *  queue's `samePendingSteerPayload`. `payload` is the exact string handed to the harness, so the text,
- *  the speaker envelope and the trust framing all fold into it; `trusted` is kept SEPARATELY from those
- *  framed bytes so a text that spells its own `<system-reminder>` wrapper can never read as the trusted
- *  arm's byte-equal twin. `actor` carries the attribution the ledger frame reports. */
-export interface AcceptedSteerInput {
-    payload: string;
-    trusted: boolean;
-    /** The NORMALIZED priority the call delivered under (absent input ⇒ "next"),
-     *  the replay identity's sixth axis: same id + same text at a DIFFERENT tier is not a replay —
-     *  a `next` input re-sent as `now` answering "idempotent success" without the interrupt would be
-     *  a disposition lie, so it refuses `duplicate_input_id` like any other identity mismatch. */
-    priority: SystemInjectionPriority;
-    actor?: ActorAssertion;
-}
 /**
  * Config re-supplied to {@link Runner.resume}. A suspended task's tools / model / policy /
  * hooks cannot be reconstructed from a checkpoint token (the session stores neither tool implementations
@@ -2763,6 +2750,10 @@ export interface RunnerSelfSeat {
         toolPolicy?: RunnerDeps["toolPolicy"];
         hooks?: RunnerDeps["hooks"];
     };
+    /** Whether a child task THIS runner runs can be placed in a tree other than the caller's (an explicit cwd, a worktree):
+     *  true only when its deps carry an `executionEnvFactory` (live read — `swapDeps` replaces the deps). The delegation tool asks
+     *  the runner that will run the child, not the one that ran the parent leg. Absent on a hand-built seat ⇒ read as "cannot say" ⇒ no; a hand-built seat answers for the runner its `runTask` forwards to. */
+    canRerootChild?(): boolean;
     /** Fire `RunnerDeps.onTaskOutcome` through the swallow-guarded chokepoint (thin compositions emit at their terminal state). */
     emitTaskOutcome(outcome: TaskOutcome): void;
     /** Run a task to completion. `internals` is the TRUSTED run-scoped channel (never a TaskSpec field). */

package/dist/core/runner/prepare-ask-lane.d.ts

@@ -28,6 +28,8 @@ export interface PrepareAskLaneInput {
     /** borrowed-readonly — the hand's live tracked cwd, or undefined (hands-less). Read per call at RUN time (`current`),
      *  never captured: the fs hand tools resolve their relative paths against this very ref. Not written here. */
     handsCwdRef: CwdRef | undefined;
+    /** borrowed-readonly — the root the hand tools resolve root-relative spellings against, or undefined (hands-less). */
+    handsRoot: string | undefined;
     /** borrowed-readonly — the run's advertised-writable-directory seat, or undefined (hands-less / nothing advertised). `roots` is read at RUN time, never captured: it is the fence's own admitted list and the write gate's exemption domain must be that same list. Not written here. */
     advertisedWritableDirs: Pick<AdvertisedWritableDirs, "roots"> | undefined;
     /** borrowed-readonly — the shared mount roster; read at RUN time by the approval-preview projection (alias-aware

package/dist/core/runner/prepare-ask-lane.js

@@ -59,14 +59,14 @@ function resolveApprovalPreview(tools, toolName, args) {
     }
 }
 export function prepareAskLane(input) {
-    const { gateMachineryActive, abortController, effectivePolicy, budgetSnapshot, handsCwdRef, advertisedWritableDirs, tools, inheritedUnavailableAsks, inheritedAskGrants, onAsk, humanReviewRef, now, ruleOffersOf, grantBindingOf, askSourceIdentity, riskAxesOf, autoModeDenialTracking, spec, deps, sessionId, runId, hooks, hookTimeoutMs, notifyOwnHookCrash, grantReadRoot } = input;
+    const { gateMachineryActive, abortController, effectivePolicy, budgetSnapshot, handsCwdRef, handsRoot, advertisedWritableDirs, tools, inheritedUnavailableAsks, inheritedAskGrants, onAsk, humanReviewRef, now, ruleOffersOf, grantBindingOf, askSourceIdentity, riskAxesOf, autoModeDenialTracking, spec, deps, sessionId, runId, hooks, hookTimeoutMs, notifyOwnHookCrash, grantReadRoot } = input;
     if (!gateMachineryActive)
         return { askLane: undefined };
     const composedCallSignal = (callSignal) => composeCallSignal(abortController.signal, callSignal);
     const adjudicate = effectivePolicy
         ? (req, callSignal) => {
             const signal = composedCallSignal(callSignal);
-            return raceAbort(Promise.resolve(effectivePolicy.check({ ...req, budget: budgetSnapshot, ...(handsCwdRef !== undefined ? { cwd: handsCwdRef.current } : {}), ...advertisedWritableRootsSeat(advertisedWritableDirs) }, signal)), signal, () => ({
+            return raceAbort(Promise.resolve(effectivePolicy.check({ ...req, budget: budgetSnapshot, ...(handsCwdRef !== undefined ? { cwd: handsCwdRef.current } : {}), ...(handsRoot !== undefined ? { root: handsRoot } : {}), ...advertisedWritableRootsSeat(advertisedWritableDirs) }, signal)), signal, () => ({
                 action: "deny",
                 message: "policy check aborted (task timed out or cancelled)",
             }));

package/dist/core/runner/prepare-config-doors.js

@@ -14,6 +14,7 @@ import { applyToolModelGate, assertRestoreGatedToolsValue, modelIdTail } from ".
 import { resolveUsageWindows } from "../usage-window-store.js";
 import { deriveAskEffective, resolveAskSeat, resolveQuestionSeam } from "../wiring-manifest.js";
 import { assertPeerPresenceValue } from "../../agents/peer-directory.js";
+import { snapshotDefinitionLists } from "../../agents/tool-filter.js";
 import { TOTAL_TOKENS_REMINDER_MODES } from "./turn-attachments.js";
 const TASK_LIMIT_KEY_DICT = {
     maxTokens: true,
@@ -359,9 +360,10 @@ export function prepareConfigDoors(input) {
             e.code = "config.agents.no_delegation_tool";
             throw e;
         }
-        const perTask = spec.agents;
+        const perTask = spec.agents.map(snapshotDefinitionLists);
         spec = {
             ...spec,
+            agents: perTask,
             tools: pool.map((t) => {
                 if (typeof t.withAgents !== "function")
                     return t;

package/dist/core/runner/prepare-execution-env.js

@@ -1,12 +1,13 @@
 import { StubExecutionEnv } from "../stub-env.js";
 import { hasDestroy } from "../remote-env.js";
 import { announceMalformedCapabilities } from "./env-capability-census.js";
+import { deploymentCanRerootChild } from "./child-tree.js";
 import { settleTeardownLeg } from "./teardown-bounded.js";
 export async function prepareExecutionEnv(input) {
     const { deps, spec, internals, resume, placementRootResolved, sessionId, forgetOnThrow, rollback } = input;
     let ownedEnv;
     let ownedEnvObservedAt;
-    if (internals?.requestedCwd !== undefined && deps.executionEnvFactory === undefined) {
+    if (internals?.requestedCwd !== undefined && !deploymentCanRerootChild(deps)) {
         await settleTeardownLeg(() => forgetOnThrow(), "forgetOnThrow (cwd-unsupported leg)", (err) => deps.onError?.(err, { phase: "config", sessionId }));
         const e = new Error(`Agent cwd "${internals.requestedCwd}" cannot take effect: this deployment has no executionEnvFactory (a static execution environment cannot be re-rooted per agent). Drop the cwd parameter or deploy a factory.`);
         e.code = "config.cwd_unsupported";

package/dist/core/runner/prepare-gate-stations.d.ts

@@ -37,6 +37,7 @@ import { type WiringManifest } from "../wiring-manifest.js";
 import type { WriteProtectionCheck } from "../write-protect.js";
 import type { ShellReadCheck } from "../../tools/fs/shell-read-check.js";
 import type { CwdRef } from "../../tools/fs/fs-shared.js";
+import type { ContainmentFace } from "../../tools/fs/containment-face.js";
 import type { AskLane, GateSeatInputsFor, IrreversibilityTier, ParkAsk, Prepared, ReversibilityProbes, StopForDenialLimit } from "./contracts.js";
 import type { PermissionRuleLanes } from "./permission-rule-lanes.js";
 import { type ToolRosterDeltaSeat } from "../tool-roster.js";
@@ -167,6 +168,8 @@ export interface PrepareGateStationsInput {
     /** borrowed-readonly — the leg's shell READ STATION (`ToolGateInput.shellReadCheck`), mounted by the hands phase, or
      *  undefined with no real shell: no station, nothing judged. */
     shellReadCheck: ShellReadCheck | undefined;
+    /** borrowed-readonly — the leg's resolved read face (`undefined` with no hands), read per call into the class derivation. */
+    readFace: () => ContainmentFace | undefined;
     /** borrowed-readonly — the per-tool irreversibility tier handed to the gate per call. */
     irreversibilityTier: IrreversibilityTier;
     /** borrowed-readonly — the per-tool reversibility probes handed to the gate per call. */

package/dist/core/runner/prepare-gate-stations.js

@@ -46,7 +46,7 @@ export function maybeHumanRejectionHalt(input) {
     };
 }
 export function prepareGateStations(input) {
-    const { askLane, parkAsk, tools, toolRosterDeltas, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, hooks, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, gateOutcomes, batchHaltRef, blockedTracked, hookIdentity, reminderMark, hostTaskId, sessionId, ownGatePreToolUse, hookTimeoutMs, handsCwdRef, hookEnvFace, writeProtectionCheck, shellReadCheck, irreversibilityTier, reversibilityProbes, abortController, shellGatedTools, autoModeDecider, autoModeDenialTracking, askRoute, permissionMode, toolMarkSources, a2aIsolatePeers, ancestorArbitrations, runId, stopForDenialLimit, permissionRuleLane, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, notifyOwnHookCrash, frameSettlement, seatInputsFor } = input;
+    const { askLane, parkAsk, tools, toolRosterDeltas, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, hooks, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, gateOutcomes, batchHaltRef, blockedTracked, hookIdentity, reminderMark, hostTaskId, sessionId, ownGatePreToolUse, hookTimeoutMs, handsCwdRef, hookEnvFace, writeProtectionCheck, shellReadCheck, readFace, irreversibilityTier, reversibilityProbes, abortController, shellGatedTools, autoModeDecider, autoModeDenialTracking, askRoute, permissionMode, toolMarkSources, a2aIsolatePeers, ancestorArbitrations, runId, stopForDenialLimit, permissionRuleLane, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, notifyOwnHookCrash, frameSettlement, seatInputsFor } = input;
     const gatePreToolUse = ownGatePreToolUse !== undefined ? (name, args, ctx) => ownGatePreToolUse(name, args, { ...ctx, permissionMode: permissionMode.observed }) : undefined;
     const releasesAnnounced = new Map();
     const onModeReleased = (info) => {
@@ -130,6 +130,7 @@ export function prepareGateStations(input) {
                         peerMessage: heldBy("gate.peerMessage", PEER_MESSAGE_NAMES, call),
                         ...(writeProtectionCheck !== undefined ? { writeProtectionCheck } : {}),
                         ...(shellReadCheck !== undefined ? { shellReadCheck } : {}),
+                        readFace,
                         irreversibility: tierSeat?.value,
                         reversibilityProbe: tierSeat?.read(reversibilityProbes),
                         abortSignal: abortController.signal,

package/dist/core/runner/prepare-listings.d.ts

@@ -1,6 +1,6 @@
 /**
- * PrepareTask's LISTINGS phase: the per-task agent definitions' tool-name audit
- * (deny entries fail loud, allow entries advise), the agent-listing announce face read off the
+ * PrepareTask's LISTINGS phase: the sub-agent tool lists' audit (`sub-agent-deny-lists.ts`),
+ * the agent-listing announce face read off the
  * delegation tool's roster (with its deferred / excluded / removal-to-zero arms), the two listing
  * opt-out advisories, the announced-listings mirror seeded from the once-per-session ledger, the
  * deferred roster's ToolSearch ride, and the date_change seam. The body is the driver's stretch moved
@@ -10,8 +10,8 @@
  * the disclosure mount before it and the context-lane seats after it (a stretch
  * with no await is extracted as a sync function — an `async` wrapper would open a microtask window).
  *
- * Throws pass through unchanged: `config.agent.unknown_tool` (a deny entry naming a tool this
- * deployment does not mount — a typo there would silently guard nothing).
+ * Throws pass through unchanged: `config.agent.unknown_tool` (a denied-tools entry that names no
+ * tool — one judgment for every list a deployment writes, in `sub-agent-deny-lists.ts`).
  */
 import type { AgentTool } from "../../internal/harness.js";
 import type { TaskSpec } from "../types.js";

package/dist/core/runner/prepare-listings.js

@@ -1,30 +1,10 @@
 import { formatLocalDate } from "../../prompts/default.js";
+import { auditSubAgentToolLists } from "./sub-agent-deny-lists.js";
 import { SKILL_TOOL_NAME } from "./synthetic-tools.js";
 import { renderAgentListingDelta } from "./turn-attachments.js";
 export function prepareListings(input) {
     const { spec, tools, onceLedger, sessionId, toolFaceSnapshot, activeTools, resume, skillsListing, listingBudget, listingRideRef, renderWithDate, envFacts, tzValid, userTz, dateAnchor } = input;
-    if (spec.agents !== undefined && spec.agents.length > 0) {
-        const known = new Set(tools.flatMap((t) => [t.name, ...(t.aliases ?? [])]));
-        for (const def of spec.agents) {
-            const unknownAllow = (def.allowTools ?? []).filter((n) => n !== "*" && !known.has(n));
-            if (unknownAllow.length > 0) {
-                try {
-                    onceLedger.onError(new Error(`TaskSpec.agents: agent "${def.name}" allows tool(s) ${unknownAllow.join(", ")} not present in this task's assembled roster — likely a typo (the entry would be item-filtered at spawn; the agent stays usable). Advisory only: the delegation pool can differ from this roster, so a tool mounted only on the delegation tool or produced by per-spawn extraTools makes this spurious.`), { phase: "config", sessionId });
-                }
-                catch {
-                }
-            }
-            for (const n of def.denyTools ?? []) {
-                if (n === "*")
-                    continue;
-                if (!known.has(n)) {
-                    const e = new Error(`TaskSpec.agents: agent "${def.name}" declares tool "${n}" in its denied tools, but no such tool exists in this deployment — fix the agent's tools list or mount the tool.`);
-                    e.code = "config.agent.unknown_tool";
-                    throw e;
-                }
-            }
-        }
-    }
+    auditSubAgentToolLists({ spec, tools, onceLedger, sessionId });
     const rosterBearingSpec = (spec.tools ?? []).find((t) => t.agentListing !== undefined && t.agentListing.length > 0);
     const rosterFaceDeferred = rosterBearingSpec !== undefined &&
         !(toolFaceSnapshot.exclude?.includes(rosterBearingSpec.name) ?? false) &&

package/dist/core/runner/prepare-park-ask.d.ts

@@ -94,6 +94,8 @@ export interface PrepareParkAskInput {
     /** borrowed-readonly — the hand's live tracked cwd, or undefined; `current` is read at park time for the re-adjudication.
      *  Not written here. */
     handsCwdRef: CwdRef | undefined;
+    /** borrowed-readonly — the root the live gate stamps beside the cwd ({@link import("./prepare-ask-lane.js").PrepareAskLaneInput.handsRoot}). */
+    handsRoot: string | undefined;
     /** borrowed-readonly — the SAME seat the live gate stamps from ({@link import("./prepare-ask-lane.js").PrepareAskLaneInput.advertisedWritableDirs}): a parked call's projection re-adjudication asks one question about one call, so it must ask it against the same admitted list. Read at park time, not written here. */
     advertisedWritableDirs: Pick<AdvertisedWritableDirs, "roots"> | undefined;
     /** borrowed-readonly — the run's offload store, or undefined (a volatile store holding results refuses the park). */

package/dist/core/runner/prepare-park-ask.js

@@ -27,7 +27,7 @@ const wordlessDemand = (toolName) => {
     throw new Error(`a real-approval demand for "${toolName}" reached the park with no origin word — the origin stamp precedes every park`);
 };
 export function prepareParkAsk(input) {
-    const { askLane, saga, spec, deps, sessionId, checkpointStore, toolRosterDeltas, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, advertisedWritableDirs, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedTools, irreversibilityTier, toolMarkSources, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, ruleOffersOf, grantBindingOf, now, humanReviewRef, abortController, harness, pausedRef } = input;
+    const { askLane, saga, spec, deps, sessionId, checkpointStore, toolRosterDeltas, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, handsRoot, advertisedWritableDirs, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedTools, irreversibilityTier, toolMarkSources, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, ruleOffersOf, grantBindingOf, now, humanReviewRef, abortController, harness, pausedRef } = input;
     if (askLane === undefined || saga === undefined)
         return { parkAsk: undefined };
     const { composedCallSignal, approvalPreviewOf } = askLane;
@@ -165,7 +165,7 @@ export function prepareParkAsk(input) {
                         toolCallId: req.toolCallId,
                         budget: budgetSnapshot,
                         ...callFaceSeat(req.face),
-                        ...(handsCwdRef !== undefined ? { cwd: handsCwdRef.current } : {}),
+                        ...(handsCwdRef !== undefined ? { cwd: handsCwdRef.current } : {}), ...(handsRoot !== undefined ? { root: handsRoot } : {}),
                         ...advertisedWritableRootsSeat(advertisedWritableDirs),
                     }, cutSignal)), cutSignal);
                     if (reprojectedRaced.tag === "aborted")

package/dist/core/runner/prepare-policy-chain.d.ts

@@ -140,6 +140,8 @@ export interface PreparePolicyChainInput {
     /** borrowed-readonly — LATE-BOUND: this task's own classifier instance (the pass-through test's decider term), read at chain
      *  assembly (the arming runs after this phase, and again on a steer into `auto`). */
     autoModeDecider: () => AutoModeDecider | undefined;
+    /** borrowed-readonly — the leg's resolved read face (`undefined` with no hands), read per call into the inherited stations' class derivation. */
+    readFace: () => import("../../tools/fs/containment-face.js").ContainmentFace | undefined;
     /** borrowed-readonly — the leg's live permission-mode seat: the mode gate policy layer and the inherited stations' arbitration
      *  read `current` per call. */
     permissionMode: PermissionModeController;

package/dist/core/runner/prepare-policy-chain.js

@@ -24,7 +24,7 @@ import { createLiveSessionRules, createSessionRulePolicy } from "./session-rule-
 import { thrownText } from "../thrown-value.js";
 import { heldBy, heldValues, seatOf, wireOf } from "../tool-name-readings.js";
 export async function preparePolicyChain(input) {
-    const { spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, additionalRootsCanonical, executionEnv, lockedPreflight, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, toolMarkSources, envHandToolNames, handsCwdRef, readDenyMatcher, announceRuleStoreSkipped, questionToolMounted, runtimeCaps, inheritedAncestorRules, ancestorSessionRulesRef, inheritedParentConstraints, seedInheritedGate, skillGrants, skillSpecs, allowedToolTables, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider, permissionMode, scratchpadDir, toolRosterDeltas, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef } = input;
+    const { spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, additionalRootsCanonical, executionEnv, lockedPreflight, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, toolMarkSources, envHandToolNames, handsCwdRef, readDenyMatcher, announceRuleStoreSkipped, questionToolMounted, runtimeCaps, inheritedAncestorRules, ancestorSessionRulesRef, inheritedParentConstraints, seedInheritedGate, skillGrants, skillSpecs, allowedToolTables, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider, readFace, permissionMode, scratchpadDir, toolRosterDeltas, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef } = input;
     const ancestorArbitrations = new Map();
     const arbitrateInherited = (ask, toolCallId, judged) => {
         const verdict = arbitrateByMode(permissionMode.current, judged.classification, { origin: judged.origin, ...askMandateMember(ancestorFacts(judged.ask.action === "ask" ? judged.ask : undefined)) });
@@ -305,11 +305,13 @@ export async function preparePolicyChain(input) {
     const grantBindingOf = (call, args) => skillGrantBindingMembers(call, args, skillSpecs, SKILL_TOOL_NAME);
     const inheritedStationFacts = (call) => {
         const seat = seatMarksOf(call);
+        const face = readFace();
         return {
             ...INHERITED_STATION_FACTS,
             mandateMarks: { egress: seat.egress, shellGated: false, ...(seat.tier === "always" && !seat.shellGated ? { irreversibility: "always" } : {}) },
             ...(seat.sources.size > 0 ? { toolMarkSources: seat.sources } : {}),
             ...(deps.a2a?.isolatePeers === true ? { a2aIsolatePeers: true } : {}),
+            ...(face !== undefined ? { readFace: face } : {}),
         };
     };
     const inheritedAskEvidence = inheritedAskRuleEvidence(deps.permissionRuleStore);
@@ -616,7 +618,7 @@ export async function preparePolicyChain(input) {
         ...instrumentedChain,
         ...(rewriteCapableLayers ? narrowingLayers : []),
     ];
-    const integrityGuardLayers = [createTranscriptIntegrityPolicy(), createUnverifiableDeletePolicy()];
+    const integrityGuardLayers = [createTranscriptIntegrityPolicy(), createUnverifiableDeletePolicy({ removalSeat: { env: executionEnv, additionalRoots: () => additionalRootsCanonical } })];
     const guardedPolicyLayers = rewriteCapableLayers
         ? [...integrityGuardLayers, ...policyLayers, modeGateLayer, ...integrityGuardLayers]
         : [...integrityGuardLayers, ...policyLayers, modeGateLayer];