@sema-agent/core 7.43.0 → 7.45.0

package/dist/core/runner/prepare-task.js

@@ -26,6 +26,7 @@ import { AllowEntryTable, screenAllowedToolsValue } from "../allow-entry.js";
 import { compileOutputSchema } from "./strict-output-schema.js";
 import { MEMORY_ENGINE_TOOL_NAMES } from "../memory-engine/tools.js";
 import { foldAdmissionFreeze } from "../memory-admission.js";
+import { deploymentCanRerootChild } from "./child-tree.js";
 import { prepareMemory } from "./prepare-memory.js";
 import { prepareMemoryEngineSession } from "./prepare-memory-engine-session.js";
 import { prepareDeferClassify } from "./prepare-defer-classify.js";
@@ -363,9 +364,12 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 e.code = "isolation.unavailable";
                 throw e;
             };
-            if (ownedEnvSeat.current === undefined) {
+            if (!deploymentCanRerootChild(deps)) {
                 failIsolation("no executionEnvFactory is configured (a static/shared execution env cannot mint a per-agent worktree)");
             }
+            else if (ownedEnvSeat.current === undefined) {
+                failIsolation("the executionEnvFactory returned no env instead of a worktree-rooted env");
+            }
             else if (ownedEnvSeat.current === deps.executionEnv) {
                 ownedEnvSeat.current = undefined;
                 failIsolation("the executionEnvFactory returned the shared static env instead of a worktree-rooted env");
@@ -733,7 +737,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 releaseSignal = () => sig.removeEventListener("abort", onExternalAbort);
             }
         }
-        const { hooks, hookTimeoutMs, preToolUseObservational, ownGatePreToolUse, basePolicyForResumeEdit, denyNarrowingPolicy, skillGrantLane, allowEntryLanes, policyLayers, effectivePolicy, inheritedUnavailableAsks, inheritedAskGrants, askSourceIdentity, riskAxesOf, ruleOffersOf, grantBindingOf, permissionRuleLane, permissionRuleOrgLane, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, foldAskClasses, ancestorSandboxAdmissions, ancestorArbitrations } = await preparePolicyChain({ spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, additionalRootsCanonical, executionEnv, lockedPreflight, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, toolMarkSources, envHandToolNames, handsCwdRef, readDenyMatcher, announceRuleStoreSkipped, questionToolMounted, runtimeCaps, inheritedAncestorRules, ancestorSessionRulesRef, inheritedParentConstraints, seedInheritedGate, skillGrants, skillSpecs, allowedToolTables, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider: () => autoModeDeciderRef.current, permissionMode, scratchpadDir: spec.envFacts?.scratchpadDir, toolRosterDeltas: rosterSeat, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef });
+        const { hooks, hookTimeoutMs, preToolUseObservational, ownGatePreToolUse, basePolicyForResumeEdit, denyNarrowingPolicy, skillGrantLane, allowEntryLanes, policyLayers, effectivePolicy, inheritedUnavailableAsks, inheritedAskGrants, askSourceIdentity, riskAxesOf, ruleOffersOf, grantBindingOf, permissionRuleLane, permissionRuleOrgLane, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, foldAskClasses, ancestorSandboxAdmissions, ancestorArbitrations } = await preparePolicyChain({ spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, additionalRootsCanonical, executionEnv, lockedPreflight, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, toolMarkSources, envHandToolNames, handsCwdRef, readDenyMatcher, announceRuleStoreSkipped, questionToolMounted, runtimeCaps, inheritedAncestorRules, ancestorSessionRulesRef, inheritedParentConstraints, seedInheritedGate, skillGrants, skillSpecs, allowedToolTables, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider: () => autoModeDeciderRef.current, readFace: () => resolvedReadFace, permissionMode, scratchpadDir: spec.envFacts?.scratchpadDir, toolRosterDeltas: rosterSeat, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef });
         const { onAsk, preToolContexts, blockedToolCalls, gateOutcomes, batchHaltRef, blockedTracked, incompleteSuspendAdapter, durableSuspendInfraReady, resourceSuspendEligible, usageGovernance, durableApproval, wiringManifest, writeProtection, parkLaneArmed, gateMachineryActive, hookIdentity, hookEnvFace, sessionBoxBound } = prepareWiringManifest({ spec, deps, askSeat: doors.askSeat, internals, resume, sessionId, runId, hostTaskId, taskScope, hooks, preToolUseObservational, policyLayers, effectivePolicy, handsEnabled, taskRootFinal, mcp, irreversibleTools, egressTools, shellReadStationArmed: handsReadFace.shellReadStationArmed, toolEffects, ownedEnv, executionEnv, offloadStore, onceLedger, usageWindows, envLifetimeSuspendAt, runtimeCaps, resolvedInteractionPosture, durableQuestionFace, liveQuestionFace, checkpointStore, sessions, modelGateManifest, autoModeArmReason, permissionMode, lockedPreflight, peerLaneRefs, frameSettlement, harness, pausedRef, liveInheritedGate, delegation, toolRoster, readDenyBuiltinTiersActive: handsReadFace.readDenyBuiltinTiersActive, lspManagerWired, lspDiagnosticsLive: lspDiagnostics !== undefined, fileHistoryFact, sessionBox });
         const writeProtectionCheck = writeProtection?.check;
         writeProtectionJudgeRef.current = writeProtection?.judgeTarget;
@@ -743,18 +747,18 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 return undefined;
             });
         }
-        const { askLane } = prepareAskLane({ gateMachineryActive, abortController, effectivePolicy, budgetSnapshot, handsCwdRef, advertisedWritableDirs, tools, inheritedUnavailableAsks, inheritedAskGrants, onAsk, humanReviewRef, now, ruleOffersOf, grantBindingOf, askSourceIdentity, riskAxesOf, autoModeDenialTracking: autoModeDenialTrackingRef, spec, deps, sessionId, runId, hooks, hookTimeoutMs, notifyOwnHookCrash, grantReadRoot: handsReadFace.grantReadRoot });
+        const { askLane } = prepareAskLane({ gateMachineryActive, abortController, effectivePolicy, budgetSnapshot, handsCwdRef, handsRoot: attachmentRootCanonical, advertisedWritableDirs, tools, inheritedUnavailableAsks, inheritedAskGrants, onAsk, humanReviewRef, now, ruleOffersOf, grantBindingOf, askSourceIdentity, riskAxesOf, autoModeDenialTracking: autoModeDenialTrackingRef, spec, deps, sessionId, runId, hooks, hookTimeoutMs, notifyOwnHookCrash, grantReadRoot: handsReadFace.grantReadRoot });
         const { saga } = prepareSuspendSaga({ gateMachineryActive, abortController, harness, checkpointStore, deps, sessionId, hostTaskId, taskScope, liveSpendRef, resume, nestedStats, internals, activeTools, outputRef, readFileStateForCheckpoint, faceCheckpointSection, writeFaceCheckpointSection, skillGrantCheckpointSection, reminderMark, handsCwdRef, worktreeSessionRef, undeliveredContinuationRef, inheritedParentConstraints, seedInheritedGate, ancestorRulesNow, inheritedShellGate, permissionMode, inheritedAdmittedOrgScopes, ownOrgVerdictRef, orgGovernedProvenance, announcedListingsRef, gitStatusRef, hookIdentity, placementRootResolved, externalContentTargetActive, remoteEnvFailures, memoryEngineSession, suspendLoopRef, ownedEnv, incompleteSuspendAdapter });
         const { suspendForResource, suspendForPlatformLimit, suspendForReview } = prepareBoundaryParks({ saga, spec, checkpointStore, abortController, harness, session, sessions, sessionId, deps, priorLedger, maxSlices, maxSuspends, resourceTotal, priorSuspendCount, suspendChainBase, humanReviewRef, liveSpendRef, now, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, pausedRef, remoteEnvFailures, resourceSuspendEligible, durableSuspendInfraReady, incompleteSuspendAdapter });
-        const { parkAsk } = prepareParkAsk({ askLane, saga, spec, deps, sessionId, checkpointStore, toolRosterDeltas: rosterSeat, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, advertisedWritableDirs, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedTools, irreversibilityTier, toolMarkSources, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, ruleOffersOf, grantBindingOf, now, humanReviewRef, abortController, harness, pausedRef });
+        const { parkAsk } = prepareParkAsk({ askLane, saga, spec, deps, sessionId, checkpointStore, toolRosterDeltas: rosterSeat, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, handsRoot: attachmentRootCanonical, advertisedWritableDirs, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedTools, irreversibilityTier, toolMarkSources, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, ruleOffersOf, grantBindingOf, now, humanReviewRef, abortController, harness, pausedRef });
         const seatInputsFor = skillGateWiring({ tools, skillToolName: SKILL_TOOL_NAME, seatOf: skillSeatOf, mode: () => permissionMode.current, lane: skillGrantLane, onAllowed: (info) => emitTrace(deps.tracer, () => ({ kind: "permission.skill_allowed", version: 1, taskId: hostTaskId, ...info, entries: [...info.entries], ts: Date.now() })), allowEntries: { deploymentAllows: { ...allowEntryLanes.deployment, onAllowed: (info) => emitTrace(deps.tracer, () => ({ kind: "permission.allowed_tools_allowed", version: 1, taskId: hostTaskId, source: "deployment", ...info, entries: [...info.entries], ts: Date.now() })) }, requestAllows: { ...allowEntryLanes.request, onAllowed: (info) => emitTrace(deps.tracer, () => ({ kind: "permission.allowed_tools_allowed", version: 1, taskId: hostTaskId, source: "request", ...info, entries: [...info.entries], ts: Date.now() })) } } });
-        const { approvedCallScreen } = prepareGateStations({ askLane, parkAsk, tools, toolRosterDeltas: rosterSeat, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, hooks, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, gateOutcomes, batchHaltRef, blockedTracked, hookIdentity, reminderMark, hostTaskId, sessionId, ownGatePreToolUse, hookTimeoutMs, handsCwdRef, readDenyInForce: () => ({ tiers: handsReadFace.readDenyBuiltinTiersActive, rows: [...readDenyAdditionsNormalized.map((e) => e.pattern), ...handsReadFaceInput.pathDenyRules.filter((r) => r.faces.includes("read")).map((r) => r.rule)] }), hookEnvFace, writeProtectionCheck, shellReadCheck, irreversibilityTier, reversibilityProbes, abortController, shellGatedTools, autoModeDecider: autoModeDeciderRef, autoModeDenialTracking: autoModeDenialTrackingRef, askRoute: { ...wiringManifest.ask, effective: askSeatEffective(wiringManifest) }, permissionMode, toolMarkSources, ...(deps.a2a?.isolatePeers === true ? { a2aIsolatePeers: true } : {}), ancestorArbitrations, runId, stopForDenialLimit, permissionRuleLane, seatInputsFor, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, notifyOwnHookCrash, frameSettlement });
+        const { approvedCallScreen } = prepareGateStations({ askLane, parkAsk, tools, toolRosterDeltas: rosterSeat, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, hooks, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, gateOutcomes, batchHaltRef, blockedTracked, hookIdentity, reminderMark, hostTaskId, sessionId, ownGatePreToolUse, hookTimeoutMs, handsCwdRef, readDenyInForce: () => ({ tiers: handsReadFace.readDenyBuiltinTiersActive, rows: [...readDenyAdditionsNormalized.map((e) => e.pattern), ...handsReadFaceInput.pathDenyRules.filter((r) => r.faces.includes("read")).map((r) => r.rule)] }), hookEnvFace, writeProtectionCheck, shellReadCheck, readFace: () => resolvedReadFace, irreversibilityTier, reversibilityProbes, abortController, shellGatedTools, autoModeDecider: autoModeDeciderRef, autoModeDenialTracking: autoModeDenialTrackingRef, askRoute: { ...wiringManifest.ask, effective: askSeatEffective(wiringManifest) }, permissionMode, toolMarkSources, ...(deps.a2a?.isolatePeers === true ? { a2aIsolatePeers: true } : {}), ancestorArbitrations, runId, stopForDenialLimit, permissionRuleLane, seatInputsFor, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, notifyOwnHookCrash, frameSettlement });
         const postureFrameRef = { report: (err) => deps.onError?.(err, { phase: "degraded", sessionId }) };
         const { microCompact, charsPerToken } = prepareContextLane({ model, deps, sessionId, runId, hostTaskId, offloadStore, toolRosterDeltas: rosterSeat, microCompactKnob, harness, batchHaltRef, gitStatusRef, postureFrameRef, requestLossyRef, trimPressureRef, contextOverlay: legContextOverlay, ...(readFileStateForCheckpoint !== undefined ? { readFileState: readFileStateForCheckpoint } : {}) });
         const preparedHolder = {};
         const { cacheBreakDetector, cacheFingerprint, promptOverheadTokens, readTaskFile, normalizeAttachmentPath, isDedupStubResult, recentlyReadFiles, onCompactionApplied, detectExternalChanges, listBackgroundTasks, centerCompactionCandidate, effectiveReadFaceObserved, effectiveWriteFaceObserved, effectiveReadDenyObserved } = prepareTurnWiring({ deps, systemPromptSeat, harnessTools, fpRef, model, epochArtifactDigestForSnapshot, promptProfile, fableMitigations, systemBlocks, thinking, spec, sessionId, turnSnapshotRef, promptManifest, charsPerToken, handsEnabled, executionEnv, attachmentRootCanonical, additionalRootsCanonical, additionalReadRootsCanonical, readDenyMatcher, resolvedReadFace, handsCwdRef, readFileStateForCheckpoint, denyNarrowingPolicy, skillGrants: skillGrantLane, callerPolicy: lockedPreflight.toolPolicy, inheritedPolicies: (inheritedParentConstraints ?? []).map((c) => c.policy), persistedRuleLane: permissionRuleLane, orgRuleLane: permissionRuleOrgLane, abortController, hostTaskId, taskScope, buildAssembleInputs, centerAdoptionRef, harnessRef, epochDeclaredSections, carrierReadFace, carrierWriteFace, readDenyAdditionsNormalized, preparedHolder });
         await onceLedger.settle(session, announcedListingsRef);
-        const buildPrepared = () => ({ harness, session, sessionId, runId, registryAccess: { owner: hostTaskId, scope: taskScope }, reminderMark, reminderDisclosureCounts, fullShellReachable, approvalPosture: { get mode() { return permissionMode.current; }, askEffective: askSeatEffective(wiringManifest) }, ...(outputStyleFrame !== undefined ? { outputStyleFrame } : {}), permissionMode, editedFilesSnapshot, taskRootPath: taskRootFinal, model, thinking, compModel: effectiveCompModel, mcp, ...(mcpRedial !== undefined ? { mcpRedial } : {}), ...(a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, gateOutcomes, batchHaltRef, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), ...(fileHistoryBoundary !== undefined ? { fileHistoryBoundary } : {}), ...(effectiveReadFaceObserved !== undefined ? { effectiveReadFace: effectiveReadFaceObserved, effectiveWriteFace: effectiveWriteFaceObserved } : {}), ...(effectiveReadDenyObserved !== undefined ? { effectiveReadDenyPatterns: effectiveReadDenyObserved } : {}), effectiveMemoryScopes: memoryEffectiveScopes, cwdRef: handsCwdRef, toolProgressRef, ...(advertisedWritableDirs !== undefined ? { advertisedWritableDirs } : {}), ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), ...(sealReadStateSeat !== undefined ? { sealReadStateSeat } : {}), denyNarrowingPolicy, skillGrants: skillGrantLane, skillSpecs, ...(permissionRuleLane !== undefined ? { persistedRuleLane: permissionRuleLane } : {}), ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, endModeCeiling, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, pausedRef, undeliveredContinuationRef, suspendProgressRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, workCutRef, brainCallGuardrailRef, gateStopRef, stopForDenialLimit, suspendForReview, ...(readFileStateForCheckpoint !== undefined ? { readFileState: readFileStateForCheckpoint } : {}), resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolRoster, toolRosterDeltas: rosterSeat, structuredProjector, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, microCompact, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), stopRequestedRef, announcedSnapshotRecovered: onceLedger.recovered, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(projectInstructionContent !== undefined ? { projectInstructionContent } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, frameReceipts: { pending: [], listingSnapshotOwed: false }, frameSettlement, ...(peerLaneRefs.boundaryRound !== undefined ? { peerBoundaryRound: peerLaneRefs.boundaryRound } : {}), gitStatusRef, postureFrameRef, listBackgroundTasks, hookIdentity, ...(sessionBoxBound !== undefined ? { sessionBox: sessionBoxBound } : {}), hookTimeoutMs, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}), ...(shellReadCheck !== undefined ? { shellReadCheck } : {}), ...(toolDisclosureSeat !== undefined ? { toolDisclosure: toolDisclosureSeat } : {}), ...(approvedCallScreen !== undefined ? { approvedCallScreen } : {}) });
+        const buildPrepared = () => ({ harness, session, sessionId, runId, registryAccess: { owner: hostTaskId, scope: taskScope }, reminderMark, reminderDisclosureCounts, fullShellReachable, approvalPosture: { get mode() { return permissionMode.current; }, askEffective: askSeatEffective(wiringManifest) }, ...(outputStyleFrame !== undefined ? { outputStyleFrame } : {}), permissionMode, editedFilesSnapshot, taskRootPath: taskRootFinal, model, thinking, compModel: effectiveCompModel, mcp, ...(mcpRedial !== undefined ? { mcpRedial } : {}), ...(a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, gateOutcomes, batchHaltRef, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), ...(fileHistoryBoundary !== undefined ? { fileHistoryBoundary } : {}), ...(effectiveReadFaceObserved !== undefined ? { effectiveReadFace: effectiveReadFaceObserved, effectiveWriteFace: effectiveWriteFaceObserved } : {}), ...(effectiveReadDenyObserved !== undefined ? { effectiveReadDenyPatterns: effectiveReadDenyObserved } : {}), effectiveMemoryScopes: memoryEffectiveScopes, cwdRef: handsCwdRef, ...(attachmentRootCanonical !== undefined ? { handsRoot: attachmentRootCanonical } : {}), toolProgressRef, ...(advertisedWritableDirs !== undefined ? { advertisedWritableDirs } : {}), ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), ...(sealReadStateSeat !== undefined ? { sealReadStateSeat } : {}), denyNarrowingPolicy, skillGrants: skillGrantLane, skillSpecs, ...(permissionRuleLane !== undefined ? { persistedRuleLane: permissionRuleLane } : {}), ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, endModeCeiling, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, pausedRef, undeliveredContinuationRef, suspendProgressRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, workCutRef, brainCallGuardrailRef, gateStopRef, stopForDenialLimit, suspendForReview, ...(readFileStateForCheckpoint !== undefined ? { readFileState: readFileStateForCheckpoint } : {}), resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolRoster, toolRosterDeltas: rosterSeat, structuredProjector, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, microCompact, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), stopRequestedRef, announcedSnapshotRecovered: onceLedger.recovered, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(projectInstructionContent !== undefined ? { projectInstructionContent } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, frameReceipts: { pending: [], listingSnapshotOwed: false }, frameSettlement, ...(peerLaneRefs.boundaryRound !== undefined ? { peerBoundaryRound: peerLaneRefs.boundaryRound } : {}), gitStatusRef, postureFrameRef, listBackgroundTasks, hookIdentity, ...(sessionBoxBound !== undefined ? { sessionBox: sessionBoxBound } : {}), hookTimeoutMs, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}), ...(shellReadCheck !== undefined ? { shellReadCheck } : {}), ...(toolDisclosureSeat !== undefined ? { toolDisclosure: toolDisclosureSeat } : {}), ...(approvedCallScreen !== undefined ? { approvedCallScreen } : {}) });
         rollback.commit();
         commitModeSeats(abortController.signal);
         const prepared = buildPrepared();

package/dist/core/runner/resume-policy-outcome.js

@@ -1,4 +1,5 @@
 import { canonicalizeCapturedPlainData, classifyQuestionOutcome, isLiveQuestionFace } from "../ask-question.js";
+import { isHostDecider } from "../gate-outcome.js";
 import { CHECKPOINT_FEATURES, CheckpointError, checkpointVersionOf, winnerFromOutcome } from "../checkpoint-store.js";
 import { policyCannotAnswer, screenApproverAttribution } from "../tool-policy.js";
 import { sanitizeUntrustedText } from "../untrusted-text.js";
@@ -52,7 +53,7 @@ export function resumePolicyOutcome(input) {
             throw new CheckpointError("checkpoint.invalid_outcome", `resume carries no hostDecision — a policy_ask decide names who decided it ({ decidedBy: "person" | "sla_timeout" | "policy", approver? }); refusing pre-CAS, the checkpoint stays pending`, { field: "hostDecision" });
         }
         const decidedBy = hostDecisionRaw.decidedBy;
-        if (decidedBy !== "person" && decidedBy !== "sla_timeout" && decidedBy !== "policy") {
+        if (!isHostDecider(decidedBy)) {
             throw new CheckpointError("checkpoint.invalid_outcome", `resume hostDecision.decidedBy "${describeSuppliedValue(decidedBy)}" is outside the closed set — it is exactly "person", "sla_timeout" or "policy"; refusing pre-CAS, the checkpoint stays pending`, { field: "hostDecision" });
         }
         const cannotAllow = decision !== "allow"

package/dist/core/runner/run-leg.js

@@ -614,7 +614,7 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
     }
     const executedArgs = humanRewrite !== undefined ? resolvedArgs : screened !== undefined ? screened.args : resolvedArgs;
     const unseen = !deepJsonEqual(executedArgs, pendingAction.args);
-    const beltReq = () => ({ toolName: pendingAction.toolName, args: executedArgs, toolCallId: pendingAction.toolCallId, ...callFaceSeat(parkedRowLiveFace(prepared.toolRosterDeltas.current, pendingAction)), budget: beltBudget, ...(prepared.cwdRef !== undefined ? { cwd: prepared.cwdRef.current } : {}), ...advertisedWritableRootsSeat(prepared.advertisedWritableDirs) });
+    const beltReq = () => ({ toolName: pendingAction.toolName, args: executedArgs, toolCallId: pendingAction.toolCallId, ...callFaceSeat(parkedRowLiveFace(prepared.toolRosterDeltas.current, pendingAction)), budget: beltBudget, ...(prepared.cwdRef !== undefined ? { cwd: prepared.cwdRef.current } : {}), ...(prepared.handsRoot !== undefined ? { root: prepared.handsRoot } : {}), ...advertisedWritableRootsSeat(prepared.advertisedWritableDirs) });
     const unjudgeable = unseen ? chainCannotJudge(resume.cp.state.inheritedGate) : undefined;
     if (unjudgeable !== undefined) {
         const chainDenial = formatHookFeedback(`The approved tool call "${pendingAction.toolName}" was not executed: its input changed after the approval and the inherited ancestor chain cannot judge the changed input (${unjudgeable}). This approval is spent — the call has to be re-issued.`, prepared.reminderMark);

package/dist/core/runner/run-notification-lane.js

@@ -1,6 +1,6 @@
 import { createPeerInboundChainRef, createPeerSelfRef } from "../../agents/peer-admission.js";
 import { boundInputHashOf } from "../canonical-json.js";
-import { createLiveNotificationLane, DurableAppendObligations, isDelegatedAgentTerminal, isTerminalTaskNotification, renderTaskNotificationXml, routeOrParkNotification, SystemInjectionQueue, taskNotificationDedupKey } from "../task-notification.js";
+import { createLiveNotificationLane, DurableAppendObligations, injectionLaneOf, isDelegatedAgentTerminal, isTerminalTaskNotification, renderTaskNotificationXml, routeOrParkNotification, SystemInjectionQueue, taskNotificationDedupKey } from "../task-notification.js";
 import { ToolDetachHub } from "../tool-detach.js";
 import { pendingContentAskCallId } from "./decide-continuation.js";
 export function runNotificationLane(input) {
@@ -76,7 +76,7 @@ async function runNotificationLaneAs(input, obligations) {
                 engineNoteKey: taskNotificationDedupKey(item.payload),
                 ...(item.payload.task_type !== "external" && isTerminalTaskNotification(item.payload) ? { capPreferred: true } : {}),
             };
-            const deliver = item.priority === "later"
+            const deliver = injectionLaneOf(item.priority) === "followUp"
                 ? notificationHarness.followUp(xml, noteOptions)
                 : notificationHarness.steer(xml, { ...noteOptions, ...(item.priority === "now" ? { immediate: true } : {}) });
             void deliver.then(() => item.onDisposition?.("queued"), () => {

package/dist/core/runner/runtask.d.ts

@@ -68,6 +68,8 @@ export declare class Runner implements RunnerSelfSeat {
      *  thin compositions OVER the Runner (`runGoal`) can emit at their terminal state without reaching
      *  into private deps. */
     emitTaskOutcome(outcome: TaskOutcome): void;
+    /** Whether a child this Runner runs can be placed in another tree: {@link RunnerSelfSeat.canRerootChild}. */
+    canRerootChild(): boolean;
     /** The deployment agent catalog (RunnerDeps.agents/builtinAgents), exposed READ-ONLY
      *  so the Agent-tool lane (`createSubagentTool`) defaults to the SAME registry the workflow lane
      *  consumes (single source; the types.ts "pass the same array" follow-on made structural). The array

package/dist/core/runner/runtask.js

@@ -40,6 +40,7 @@ import { resumeClaim } from "./resume-claim.js";
 import { streamSettleBackstop } from "./stream-settle-backstop.js";
 import { streamReap } from "./stream-reap.js";
 import { streamSteerVerb } from "./stream-steer-verb.js";
+import { steeringError } from "./steer-admission.js";
 import { streamLifecycleVerbs } from "./stream-lifecycle-verbs.js";
 import { streamHaltVerbs } from "./stream-halt-verbs.js";
 import { streamModeVerb } from "./stream-mode-verb.js";
@@ -61,6 +62,7 @@ import { runCompactionMachinery } from "./run-compaction-machinery.js";
 import { runStopAndFinalVerify } from "./run-stop-and-final-verify.js";
 import { runRecoveryLanes } from "./run-recovery-lanes.js";
 import { runGitLane } from "./run-git-lane.js";
+import { deploymentCanRerootChild } from "./child-tree.js";
 import { thrownText } from "../thrown-value.js";
 export class Runner {
     deps;
@@ -124,6 +126,7 @@ export class Runner {
     emitTaskOutcome(outcome) {
         emitTaskOutcome(this.deps, outcome);
     }
+    canRerootChild() { return deploymentCanRerootChild(this.deps); }
     get agentCatalog() {
         return {
             ...(this.deps.agents ? { agents: [...this.deps.agents] } : {}),
@@ -411,11 +414,6 @@ export class Runner {
             locallyClaimedTokens: this.locallyClaimedTokens, parentConstraintRegistry: this.parentConstraintRegistry, suspendedEnvReaps: this.suspendedEnvReaps,
         }).onRunRejected);
         void settled.then(() => acceptedSteerInputs.clear(), () => acceptedSteerInputs.clear());
-        const steeringError = (msg, code = "steering.not_running") => {
-            const e = new Error(`cannot steer: ${msg}`);
-            e.code = code;
-            return e;
-        };
         const { reapSuspended } = streamReap({
             live, runner: this.depsSeat,
             locallyClaimedTokens: this.locallyClaimedTokens, parentConstraintRegistry: this.parentConstraintRegistry, suspendedEnvReaps: this.suspendedEnvReaps,

package/dist/core/runner/steer-admission.d.ts

@@ -1,14 +1,15 @@
 /**
- * Admission bookkeeping for HUMAN INPUTS accepted mid-run: the per-leg ordinal an
- * accepted input is stamped with, and the field-for-field "is this repeat the same instruction" test the
- * live steer verb applies under an already-used `inputId`. Two accepting arms share both — the stream's
- * `steer` verb and the run body — which is why the ordinal is keyed on the leg's harness in a module-level
- * WeakMap rather than held by either arm: one counter per leg, one ascending sequence across both.
+ * Admission bookkeeping for HUMAN INPUTS accepted mid-run: the per-leg ordinal an accepted input is stamped
+ * with, and the acceptance frame's once-only seat. Two accepting arms share the ordinal — the stream's `steer`
+ * verb and the run body — which is why it is keyed on the leg's harness in a module-level WeakMap rather than
+ * held by either arm: one counter per leg, one ascending sequence across both. Also the stream verbs' typed
+ * refusal. (Whether a repeat under a used `inputId` is the same instruction is steer-replay.ts's one judgement,
+ * shared with the parked queue.)
  *
  * Run-loop machinery (layer 1), not a driven lane: nothing here takes an Input or hands back a Result, and
  * nothing here reads host state. Named without the `run-` family prefix for that reason.
  */
-import type { AcceptedSteerInput } from "./contracts.js";
+import type { SteerReplayRefusalDetail } from "../steer-replay.js";
 export declare function nextHumanInputSeq(key: object): number;
 /** The identity keys a published `queued` frame carried beyond its own `eventId` (`parentToolCallId`, `sourceTaskId`): one fact, stated
  *  once by the frame's publisher and handed to whoever mints that input's other frames, so two frames of one input are never stamped
@@ -19,8 +20,6 @@ export type AcceptanceIdentity = {
 };
 export declare function armAcceptance(record: object, publish: () => AcceptanceIdentity): void;
 export declare function announceAcceptance(record: object): AcceptanceIdentity | undefined;
-/** Is a repeat under an already-accepted `inputId` the SAME
- *  instruction (an idempotent retry) or a different one wearing a used key? Compared field for field,
- *  exactly like the parked leg's replay check: the key alone is never evidence of a replay, and two
- *  callers colliding on one id must not silently lose the second instruction. */
-export declare function sameAcceptedSteerInput(a: AcceptedSteerInput, b: AcceptedSteerInput): boolean;
+/** The stream verbs' typed refusal: `cannot steer: <msg>`, `code` (`steering.not_running` by default), and the
+ *  refusal's `detail` when the code carries one (`steering.duplicate_input_id` always does). */
+export declare function steeringError(msg: string, code?: string, detail?: SteerReplayRefusalDetail): Error;

package/dist/core/runner/steer-admission.js

@@ -1,4 +1,3 @@
-import { steerPriorityOf } from "../task-notification.js";
 const humanInputOrdinals = new WeakMap();
 export function nextHumanInputSeq(key) {
     let box = humanInputOrdinals.get(key);
@@ -16,11 +15,10 @@ export function armAcceptance(record, publish) {
 export function announceAcceptance(record) {
     return acceptanceSeats.get(record)?.();
 }
-export function sameAcceptedSteerInput(a, b) {
-    return (a.payload === b.payload &&
-        a.trusted === b.trusted &&
-        steerPriorityOf(a) === steerPriorityOf(b) &&
-        a.actor?.id === b.actor?.id &&
-        a.actor?.hostAsserted === b.actor?.hostAsserted &&
-        a.actor?.issuer === b.actor?.issuer);
+export function steeringError(msg, code = "steering.not_running", detail) {
+    const e = new Error(`cannot steer: ${msg}`);
+    e.code = code;
+    if (detail !== undefined)
+        e.detail = detail;
+    return e;
 }

package/dist/core/runner/stream-steer-verb.d.ts

@@ -1,6 +1,7 @@
 import type { PushQueue } from "../push-queue.js";
 import { type TaskEvent, type TaskSpec, type TaskStream } from "../types.js";
-import type { AcceptedSteerInput, LiveHandle, RunInternals, RunnerDepsSeat, TaskStreamLiveSeat } from "./contracts.js";
+import type { LiveHandle, RunInternals, RunnerDepsSeat, TaskStreamLiveSeat } from "./contracts.js";
+import { type SteerReplayRecord, type SteerReplayRefusalDetail } from "../steer-replay.js";
 export interface StreamSteerVerbInput {
     /** borrowed-readonly — the task spec (the hooks seat, `principal`, `taskId`). */
     spec: TaskSpec;
@@ -9,7 +10,7 @@ export interface StreamSteerVerbInput {
     /** borrowed-mutable — the stream's event queue: the `human_input` receipt is pushed here on acceptance. */
     queue: PushQueue<TaskEvent>;
     /** borrowed-mutable — this stream's accepted-input dedup domain (the SAME Map the driver clears when the run settles). */
-    acceptedSteerInputs: Map<string, AcceptedSteerInput>;
+    acceptedSteerInputs: Map<string, SteerReplayRecord>;
     /** borrowed-readonly — the stream's live state: `resultValue` and `handle`, read at each liveness test. */
     live: TaskStreamLiveSeat;
     /** borrowed-readonly — the readiness promise (settles to the live handle, or `undefined` when the run ended first). */
@@ -18,8 +19,8 @@ export interface StreamSteerVerbInput {
     orTimeout: <T>(p: Promise<T>) => Promise<T | undefined>;
     /** borrowed-readonly — the readiness bound in ms; the birth-window poll's deadline reads it too. */
     readyTimeoutMs: number;
-    /** borrowed-readonly — the driver's typed steering refusal (`steering.not_running` by default). */
-    steeringError: (msg: string, code?: string) => Error;
+    /** borrowed-readonly — the driver's typed steering refusal (`steering.not_running` by default; `detail` rides the error). */
+    steeringError: (msg: string, code?: string, detail?: SteerReplayRefusalDetail) => Error;
     /** borrowed-readonly — the Runner's deployment deps, read LIVE (`hooks`, `onError`, `onNotice`, after awaits too). */
     runner: RunnerDepsSeat;
 }

package/dist/core/runner/stream-steer-verb.js

@@ -3,10 +3,11 @@ import { snapshotActorAssertion } from "../../internal/llm.js";
 import { MAX_STEER_INPUT_ID_CHARS } from "../checkpoint-store.js";
 import { formatHookFeedback, hookSeatExpiredError, runHookSeat } from "../hooks.js";
 import { buildHumanInputEvent, frameMidTurnUserInput, projectHumanInput } from "../human-input-projection.js";
-import { isSystemInjectionPriority, steerPriorityOf, SYSTEM_INJECTION_PRIORITIES } from "../task-notification.js";
+import { injectionLaneOf, isSystemInjectionPriority, steerPriorityOf, SYSTEM_INJECTION_PRIORITIES } from "../task-notification.js";
 import { deliverEngineNotice } from "../types.js";
 import { inlineUntrusted, sanitizeUntrustedText } from "../untrusted-text.js";
-import { announceAcceptance, armAcceptance, nextHumanInputSeq, sameAcceptedSteerInput } from "./steer-admission.js";
+import { announceAcceptance, armAcceptance, nextHumanInputSeq } from "./steer-admission.js";
+import { steerReplayRefusal } from "../steer-replay.js";
 import { asThrownError } from "../thrown-value.js";
 export function streamSteerVerb(input) {
     const { spec, internals, queue, acceptedSteerInputs, live, ready, orTimeout, readyTimeoutMs: READY_TIMEOUT_MS, steeringError, runner } = input;
@@ -43,7 +44,6 @@ export function streamSteerVerb(input) {
         };
         let payload;
         let mintsAFrame;
-        let replay;
         const publishQueued = (h) => {
             const identity = internals?.parentToolCallId !== undefined ? { parentToolCallId: internals.parentToolCallId, ...(spec.taskId !== undefined ? { sourceTaskId: spec.taskId } : {}) } : {};
             queue.push({
@@ -66,7 +66,7 @@ export function streamSteerVerb(input) {
             if (!mintsAFrame)
                 return;
             if (typeof inputId === "string")
-                acceptedSteerInputs.set(inputId, replay);
+                acceptedSteerInputs.set(inputId, parkRecord);
             announceAcceptance(parkRecord);
         };
         const deliver = async () => {
@@ -77,16 +77,14 @@ export function streamSteerVerb(input) {
                 throw steeringError("the task is not running");
             payload = trusted ? formatHookFeedback(projected, h.reminderMark) : frameMidTurnUserInput(projected);
             mintsAFrame = payload.trim().length !== 0;
-            replay = { payload, trusted, priority, ...(actor !== undefined ? { actor } : {}) };
             if (typeof inputId === "string") {
                 const prior = acceptedSteerInputs.get(inputId);
                 if (prior !== undefined) {
                     if (live.resultValue !== undefined || h.loop.ended)
                         throw steeringError("the task is no longer running");
-                    if (!sameAcceptedSteerInput(prior, replay)) {
-                        throw steeringError("a different steering instruction was already accepted under this inputId — re-issue this one with a fresh inputId " +
-                            "(an identical payload would have been an idempotent retry)", "steering.duplicate_input_id");
-                    }
+                    const refusal = steerReplayRefusal(prior, parkRecord, { seat: "accepted" });
+                    if (refusal !== undefined)
+                        throw steeringError(refusal.message, "steering.duplicate_input_id", refusal.detail);
                     return;
                 }
             }
@@ -135,7 +133,7 @@ export function streamSteerVerb(input) {
                 const noteOptions = { provenance: "engine-note", callerAuthored: true, parkRecord, ...(actor !== undefined ? { actor } : {}) };
                 if (mintsAFrame)
                     armAcceptance(parkRecord, () => publishQueued(h));
-                if (priority === "later") {
+                if (injectionLaneOf(priority) === "followUp") {
                     await h.harness.followUp(payload, noteOptions);
                     noteAccepted();
                     return;

package/dist/core/runner/sub-agent-deny-lists.d.ts

@@ -0,0 +1,32 @@
+/**
+ * The sub-agent tool lists of one prepared task: the allow advisory for `TaskSpec.agents` and THE judgment of every denied-tools
+ * list a deployment writes — the task's own definitions (`TaskSpec.agents`), the definitions a mounted delegation tool carries
+ * (the `authored` faces — the engine's built-ins name tools of other vocabularies and are not judged) and its tool-level list.
+ * Universe = the task's assembled roster plus every mounted delegation tool's pool, names and aliases; a pool the engine cannot
+ * list (an `extraTools` factory) turns the refusals that need a roster into host notices. A tool's own lists are judged where
+ * the tool is mounted: only a tool a deployment mounted (depth 0) publishes them (`authored`, `agentToolLevelAllowTools`, `agentToolLevelDenyTools`), the
+ * engine's nested copy for a delegated child carries neither.
+ *
+ * Throws `config.agent.unknown_tool` (`refused`, the one site) — synchronous, like the phase that calls it.
+ */
+import type { AgentTool } from "../../internal/harness.js";
+import type { TaskSpec } from "../types.js";
+import type { AnnounceOnceSink } from "./contracts.js";
+/**
+ * The names a definition's denied-tools entries stand for, for a lane that has neither a roster nor a notice sink at the point
+ * it builds its own policy (a workflow leg's agentType): each entry is read by the one reading, so `Tool(content)` denies the
+ * whole tool there too, and an entry that names no tool is refused by the same refusal. The stale-name and told dispositions
+ * need the leg's roster and a sink; the leg's own policy-name audit is what reads them.
+ */
+export declare function deniedToolNamesOf(where: string, value: unknown): string[];
+export interface SubAgentToolListsInput {
+    /** borrowed-readonly — the REBOUND spec: `agents` (the task's definitions) and `tools` (the mounted delegation tools). */
+    spec: Pick<TaskSpec, "agents" | "tools">;
+    /** borrowed-readonly — the FULLY ASSEMBLED mount array (names + aliases = the roster half of the universe). */
+    tools: ReadonlyArray<AgentTool>;
+    /** borrowed-readonly — the once-per-session ledger whose operator sink carries the notices. */
+    onceLedger: Pick<AnnounceOnceSink, "onError">;
+    /** borrowed-readonly — the acquired session's id (operator-line context). */
+    sessionId: string;
+}
+export declare function auditSubAgentToolLists(input: SubAgentToolListsInput): void;

package/dist/core/runner/sub-agent-deny-lists.js

@@ -0,0 +1,121 @@
+import { notAListSentence, notAStringSentence, readDeniedEntry, readToolNameList, valueTypeLabel } from "../../agents/tool-filter.js";
+import { compileAllowList, inertEntryPhrase, renderListEntry } from "../allow-entry.js";
+import { inlineUntrusted } from "../untrusted-text.js";
+const DENY_LIST_NAMES_ONLY = "To block by path or command, write a deny rule in the caller's permission policy: a denied-tools list only takes tool names (it narrows which tools the agent is handed).";
+function refused(message) {
+    const e = new Error(message);
+    e.code = "config.agent.unknown_tool";
+    return e;
+}
+function refusal(where, flaw) {
+    return refused(`${where} declares tool ${inertEntryPhrase(flaw)} in its denied tools, but no tool of that spelling exists in this deployment — fix the entry or mount the tool.${flaw.reason === "grammar" ? ` ${DENY_LIST_NAMES_ONLY}` : ""}`);
+}
+function refusalNotAString(where, side, index, type) {
+    return refused(notAStringSentence(where, side, index, type));
+}
+function refusalNotAList(where, side, list) {
+    return refused(notAListSentence(where, side, list));
+}
+export function deniedToolNamesOf(where, value) {
+    const list = readToolNameList(value);
+    if (list.kind !== "entries")
+        throw refusalNotAList(where, "denied", list);
+    return list.entries.map((entry, index) => {
+        if (entry === "*")
+            return entry;
+        const read = readDeniedEntry(entry);
+        if (read.kind === "not_a_string")
+            throw refusalNotAString(where, "denied", index, read.type);
+        const flaw = compileAllowList([read.name], "deny").inert[0];
+        if (flaw !== undefined && flaw.reason === "grammar")
+            throw refusal(where, { ...flaw, entry: read.name });
+        return read.name;
+    });
+}
+function judgeDeniedToolNames(where, value, universe, advise) {
+    if (value === undefined || value === null)
+        return;
+    const list = readToolNameList(value);
+    if (list.kind !== "entries")
+        throw refusalNotAList(where, "denied", list);
+    let index = -1;
+    for (const entry of list.entries) {
+        index += 1;
+        if (entry === "*")
+            continue;
+        const read = readDeniedEntry(entry);
+        if (read.kind === "not_a_string")
+            throw refusalNotAString(where, "denied", index, read.type);
+        const { name, content } = read;
+        const raw = entry;
+        const { rows, inert } = compileAllowList([name], "deny", universe.known);
+        const flaw = inert[0] === undefined ? undefined : { ...inert[0], entry: raw };
+        const stale = flaw !== undefined && (flaw.reason === "tool_name" || flaw.reason === "near_miss");
+        if (flaw !== undefined && (flaw.reason === "grammar" || (stale && universe.complete)))
+            throw refusal(where, flaw);
+        if (flaw === undefined && universe.known.has(name)) {
+            if (content)
+                advise(new Error(`${where} declares ${renderListEntry(raw)} in its denied tools: this list reads tool names, not content, so the whole tool "${inlineUntrusted(name, 80)}" is denied to the agent. ${DENY_LIST_NAMES_ONLY}`));
+            continue;
+        }
+        advise(new Error(`${where} declares tool ${flaw !== undefined ? inertEntryPhrase(flaw) : renderListEntry(raw)} in its denied tools, a name this task's roster and delegation pools do not carry — the entry hides nothing here. Advisory only: a list shared across deployments is not wrong because one lacks a tool, but a misspelling guards nothing.` +
+            (rows[0]?.compiled.kind === "namespace" ? " This list matches tool names exactly: a server-level entry hides none of that server's tools; name them, or write a deny rule in the caller's permission policy." : "") +
+            (universe.complete ? "" : " A delegation tool this task mounts injects tools the engine cannot enumerate (extraTools), so the name cannot be checked here.")));
+    }
+}
+function judgeAllowedToolList(where, value, known, advise) {
+    if (value === undefined || value === null)
+        return;
+    const list = readToolNameList(value);
+    if (list.kind !== "entries")
+        throw refusalNotAList(where, "allowed", list);
+    const unknownNames = [];
+    let index = -1;
+    for (const entry of list.entries) {
+        index += 1;
+        if (typeof entry !== "string")
+            throw refusalNotAString(where, "allowed", index, valueTypeLabel(entry));
+        if (known !== undefined && entry !== "*" && !known.has(entry))
+            unknownNames.push(entry);
+    }
+    if (unknownNames.length === 0)
+        return;
+    advise(new Error(`${where} allows tool(s) ${unknownNames.map(renderListEntry).join(", ")} not present in this task's assembled roster — likely a typo (the entry would be item-filtered at spawn; the agent stays usable). Advisory only: the delegation pool can differ from this roster, so a tool mounted only on the delegation tool or produced by per-spawn extraTools makes this spurious.`));
+}
+export function auditSubAgentToolLists(input) {
+    const { spec, tools, onceLedger, sessionId } = input;
+    const advise = (err) => {
+        try {
+            onceLedger.onError(err, { phase: "config", sessionId });
+        }
+        catch {
+        }
+    };
+    const delegationTools = (spec.tools ?? []).filter((t) => t.agentToolFaces !== undefined);
+    const taskAgents = spec.agents ?? [];
+    if (taskAgents.length === 0 && delegationTools.length === 0)
+        return;
+    const known = new Set(tools.flatMap((t) => [t.name, ...(t.aliases ?? [])]));
+    const denyKnown = new Set(known);
+    for (const t of delegationTools)
+        for (const p of t.agentToolPool ?? [])
+            for (const n of [p.name, ...(p.aliases ?? [])])
+                denyKnown.add(n);
+    const universe = { known: denyKnown, complete: delegationTools.every((t) => t.agentToolPool !== undefined) };
+    for (const def of taskAgents) {
+        judgeAllowedToolList(`TaskSpec.agents: agent "${def.name}"`, def.allowTools, known, advise);
+        judgeDeniedToolNames(`TaskSpec.agents: agent "${def.name}"`, def.denyTools, universe, advise);
+    }
+    const replaced = new Set(taskAgents.map((d) => d.name));
+    for (const t of delegationTools) {
+        for (const face of t.agentToolFaces ?? []) {
+            if (face.authored === true && !replaced.has(face.name)) {
+                const faceWhere = `delegation tool "${t.name}": agent definition "${face.name}"`;
+                judgeAllowedToolList(faceWhere, face.allowTools, undefined, advise);
+                judgeDeniedToolNames(faceWhere, face.denyTools, universe, advise);
+            }
+        }
+        judgeAllowedToolList(`delegation tool "${t.name}": the tool-level list`, t.agentToolLevelAllowTools, undefined, advise);
+        judgeDeniedToolNames(`delegation tool "${t.name}": the tool-level list`, t.agentToolLevelDenyTools, universe, advise);
+    }
+}

package/dist/core/runner/synthetic-tools.d.ts

@@ -110,7 +110,7 @@ export interface SkillListingEntry {
  *  and the tool, so what the prompt promises is exactly what the tool serves. Each field is READ ONCE, BY NAME, and
  *  both consumers see the copy: the gate screens this list while the invoke substitutes from it, so a `get baseDir()`
  *  answering those two reads differently passed a screen that measured a value the model never received — and a rest
- *  copy would silently drop an INHERITED or non-enumerable list, i.e. lose a skill's grant or its refusals. */
+ *  copy would silently drop an INHERITED or non-enumerable list. The two tables are read by {@link readSkillTable}. */
 export declare function normalizeSkills(skills: SkillLike[] | undefined): SkillLike[];
 /** [c209-C] The skills listing's lead line — single-sourced so the run loop's durable-resume
  *  transcript probe (MED-3② skills arm, runtask) matches EXACTLY what the initial frame carries

package/dist/core/runner/synthetic-tools.js

@@ -2,7 +2,7 @@ import { Type } from "typebox";
 import { defineTool } from "../tools.js";
 import { sanitizeUntrustedText, SHELLED_BODY_ENVELOPE_TAGS } from "../untrusted-text.js";
 import { SKILL_LISTING_DEFAULT_BUDGET, SKILL_LISTING_DESC_MAX_CHARS_DEFAULT } from "../skill-listing-budget.js";
-import { skillNamedBy } from "../skill-grant.js";
+import { readSkillTable, skillNamedBy } from "../skill-grant.js";
 import { toolFace } from "../tool-catalog-entries.js";
 import { substituteSkillRoot, substituteSkillRootBounded } from "./skill-base-dir.js";
 import { foldListingWithin } from "./listing-fold.js";
@@ -116,7 +116,8 @@ export function normalizeSkills(skills) {
             seen.add(s.name);
             const { name, description, content, allowedTools, disallowedTools, files, baseDir, ...rest } = s;
             void rest;
-            out.push({ name, description, content, ...(allowedTools !== undefined ? { allowedTools: [...allowedTools] } : {}), ...(disallowedTools !== undefined ? { disallowedTools: [...disallowedTools] } : {}), ...(files !== undefined ? { files } : {}), ...(baseDir !== undefined ? { baseDir } : {}) });
+            const [allowed, denied] = [readSkillTable(allowedTools), readSkillTable(disallowedTools)];
+            out.push({ name, description, content, ...(allowed !== undefined ? { allowedTools: allowed } : {}), ...(denied !== undefined ? { disallowedTools: denied } : {}), ...(files !== undefined ? { files } : {}), ...(baseDir !== undefined ? { baseDir } : {}) });
         }
     }
     return out.toSorted((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));

package/dist/core/session-policy-store.d.ts

@@ -52,12 +52,16 @@ export interface PutRulesOptions {
      *  this from a verified, role-checked principal (mirrors `steer.trusted`). */
     operator?: boolean;
 }
-/** The {@link SessionPolicyError.detail} of a tool-name refusal: which bucket, which entry, the judgment's word, and the
- *  spelling to write instead when the judgment has one (a retired name's 1:1 successor, an unmintable segment's minted name). */
+/** The {@link SessionPolicyError.detail} of a tool-name refusal: which bucket, which entry, the judgment's word, the judgment's
+ *  one-line sentence when it has one, and the spelling to write instead when the judgment has one (a retired name's 1:1
+ *  successor, an unmintable segment's minted name). */
 export interface SessionRuleNameRefusal {
     field: SessionRuleToolNameField;
     name: string;
     verdict: Exclude<RuleToolNameVerdict["kind"], "current">;
+    /** The `guidance` of the judgment ({@link judgeRuleToolName}), byte for byte — the same string the refusal's sentence quotes. Present for
+     *  `retired` and `unmintable_segment`, the two verdicts that carry one; absent for `unprefixed_namespace`, whose judgment has no sentence of its own. */
+    guidance?: string;
     currentName?: string;
 }
 /** Typed error from {@link SessionPolicyStore.putRules}. `conflict` = stale `expectedRev`; `loosen_forbidden`

package/dist/core/session-policy-store.js

@@ -41,6 +41,7 @@ export function assertSessionRuleNamesCurrent(rules, mountedToolNames = NO_DECLA
                 continue;
             const quoted = JSON.stringify(name);
             const successor = verdict.kind === "unprefixed_namespace" ? undefined : verdict.currentName;
+            const guidance = verdict.kind === "unprefixed_namespace" ? undefined : verdict.guidance;
             let message;
             switch (verdict.kind) {
                 case "retired":
@@ -57,7 +58,7 @@ export function assertSessionRuleNamesCurrent(rules, mountedToolNames = NO_DECLA
                     return exhaustive;
                 }
             }
-            throw new SessionPolicyError("legacy_tool_name", message, { field, name, verdict: verdict.kind, ...(successor !== undefined ? { currentName: successor } : {}) });
+            throw new SessionPolicyError("legacy_tool_name", message, { field, name, verdict: verdict.kind, ...(guidance !== undefined ? { guidance } : {}), ...(successor !== undefined ? { currentName: successor } : {}) });
         }
     }
 }

package/dist/core/skill-grant.d.ts

@@ -76,8 +76,16 @@ export declare function parkedSkillApprovalRefusal(row: {
     readonly args: unknown;
     readonly boundGrantDigest?: string;
 }, args: unknown, skills: readonly SkillGrantSource[], skillToolName: string, site?: "claim" | "execution"): string | undefined;
-/** A resume's skills read ONCE: each definition copied with its two lists, so the parked Skill approval's binding and the
- *  resumed leg's prepare read one value — a later edit to the caller's own objects or arrays reaches neither. */
+/**
+ * A skill's table (`allowed-tools` / `disallowed-tools`) READ ONCE, the one reading every later reader takes instead of the host's
+ * value: absent (`undefined`, or `null` — a frontmatter's empty key) is no table; a list is its dense copy (by index, no iterator
+ * of the host's runs; a member that is not a string stays as it is); a value that is not a list, or a list whose read throws, is
+ * ONE entry that reads as nothing ({@link nonListValueLabel}), so each table applies the law it already has to an entry that reads
+ * as nothing — a deny table keeps its Skill from activating, an allow table is announced and grants nothing. A string is not spread.
+ */
+export declare function readSkillTable(value: unknown): string[] | undefined;
+/** A resume's skills read ONCE: each definition copied with its two tables ({@link readSkillTable}), so the parked Skill approval's
+ *  binding and the resumed leg's prepare read one value — a later edit to the caller's own objects or arrays reaches neither. */
 export declare function detachSkillLists<T extends SkillGrantSource>(skills: readonly T[]): T[];
 /** Does this skill declare a list (either, non-empty)? The one test of "the Skill card is asked for this skill". */
 export declare function declaresSkillLists(skill: Pick<SkillGrantSource, "allowedTools" | "disallowedTools">): boolean;