@sema-agent/core 7.43.0 → 7.45.0

package/dist/core/skill-grant.js

@@ -3,7 +3,8 @@ import { parsePermissionRule } from "./permission-rules.js";
 import { mountedToolPermissionSeat } from "./mode-policy.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 import { boundInputHashOf } from "./canonical-json.js";
-import { allowingRows, autoStripped, compileAllowEntry, compileAllowList, inertEntryPhrase, judgeAllowEntries } from "./allow-entry.js";
+import { readToolNameList } from "../agents/tool-filter.js";
+import { allowingRows, autoStripped, compileAllowEntry, compileAllowList, inertEntryPhrase, judgeAllowEntries, nonListValueLabel, nonStringMemberLabel, renderListEntry } from "./allow-entry.js";
 export const SKILL_GRANT_ORIGINS = Object.freeze(["model", "user", "inherited"]);
 const FROZEN_SKILL_GRANT_ORIGINS = new Set(["model", "inherited"]);
 export function skillNamedBy(args, skills) {
@@ -12,6 +13,8 @@ export function skillNamedBy(args, skills) {
 }
 function skillGrantBinding(skill) {
     const canonical = (entries) => [...new Set((entries ?? []).map((e) => {
+            if (typeof e !== "string")
+                return nonStringMemberLabel(e);
             const p = parsePermissionRule(e);
             return p.ruleContent === undefined ? p.toolName : `${p.toolName}(${p.ruleContent})`;
         }))].sort();
@@ -44,8 +47,21 @@ export function parkedSkillApprovalRefusal(row, args, skills, skillToolName, sit
         ? `${why} — refusing pre-CAS (nothing ran; the checkpoint stays pending). Decide this checkpoint as deny and re-activate it: the new card shows the current lists.`
         : `The approved Skill call was not executed: ${why}. This approval is spent — to use "${chosen}", have the model activate it again: the new card shows its lists.`;
 }
+export function readSkillTable(value) {
+    if (value === undefined || value === null)
+        return undefined;
+    const read = readToolNameList(value);
+    return read.kind === "entries" ? read.entries : [nonListValueLabel(read)];
+}
 export function detachSkillLists(skills) {
-    return skills.map((s) => (typeof s === "object" && s !== null ? { ...s, ...(Array.isArray(s.allowedTools) ? { allowedTools: [...s.allowedTools] } : {}), ...(Array.isArray(s.disallowedTools) ? { disallowedTools: [...s.disallowedTools] } : {}) } : s));
+    return skills.map((s) => {
+        if (typeof s !== "object" || s === null)
+            return s;
+        const { allowedTools: rawAllowed, disallowedTools: rawDenied, ...rest } = s;
+        const allowedTools = readSkillTable(rawAllowed);
+        const disallowedTools = readSkillTable(rawDenied);
+        return { ...rest, ...(allowedTools !== undefined ? { allowedTools } : {}), ...(disallowedTools !== undefined ? { disallowedTools } : {}) };
+    });
 }
 export function declaresSkillLists(skill) {
     return (skill.allowedTools?.length ?? 0) > 0 || (skill.disallowedTools?.length ?? 0) > 0;
@@ -74,7 +90,7 @@ export function skillDenyDecision(hit) {
         action: "deny",
         message: hit.readsAsNothing !== undefined
             ? skillDenyUnreadable(hit.skill, hit.readsAsNothing, "activation").message
-            : `the active skill "${inlineUntrusted(hit.skill, 120)}" lists this tool in disallowed-tools (${hit.entries.map((e) => inlineUntrusted(e, 200)).join(", ")}) — refused for the rest of this run`,
+            : `the active skill "${inlineUntrusted(hit.skill, 120)}" lists this tool in disallowed-tools (${hit.entries.map(renderListEntry).join(", ")}) — refused for the rest of this run`,
         decisionReason: "skill",
     };
 }
@@ -88,7 +104,7 @@ export function skillRowRefusal(lane, req) {
 export function skillAllowDecision(hit, updatedInput) {
     return {
         action: "allow",
-        message: `the active skill "${inlineUntrusted(hit.skill, 120)}" lists this tool in allowed-tools (${hit.entries.map((e) => inlineUntrusted(e, 200)).join(", ")})`,
+        message: `the active skill "${inlineUntrusted(hit.skill, 120)}" lists this tool in allowed-tools (${hit.entries.map(renderListEntry).join(", ")})`,
         decisionReason: "skill",
         ...(updatedInput !== undefined ? { updatedInput } : {}),
     };

package/dist/core/steer-replay.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Is a repeat under an already-used steer `inputId` the same instruction? ONE answer for both seats that hold a
+ * steer under its key — the parked queue (`appendPendingSteer`) and the live verb's accepted-input domain — and that
+ * one answer feeds the replay decision, the refusal's machine-readable `detail.differs` and its sentence.
+ *
+ * Both seats compare the record the CALLER sent (text, trusted, tier, actor) — never the delivered bytes: the live
+ * delivery folds `trusted` (the framing) and the actor (the speaker label) into its payload, so comparing payloads
+ * would report one changed facet as two.
+ */
+import type { ActorAssertion } from "../internal/llm.js";
+import { type SystemInjectionPriority } from "./task-notification.js";
+/** The facets a steer's replay identity is made of, in the order a refusal lists them. Closed. */
+export declare const STEER_REPLAY_FACETS: readonly ["text", "trusted", "priority", "actor"];
+export type SteerReplayFacet = (typeof STEER_REPLAY_FACETS)[number];
+/** What a seat remembers a steer by: the caller's own statement, as validated. The parked entry and the live park
+ *  record both are this shape. An absent `priority` reads as `"next"` ({@link steerPriorityOf}). */
+export interface SteerReplayRecord {
+    readonly text: string;
+    readonly trusted: boolean;
+    readonly priority?: SystemInjectionPriority;
+    readonly actor?: ActorAssertion;
+}
+/** The facets `repeat` differs from `held` in, in {@link STEER_REPLAY_FACETS} order. Empty = the idempotent replay. */
+export declare function steerReplayDiffers(held: SteerReplayRecord, repeat: SteerReplayRecord): SteerReplayFacet[];
+/** `steering.duplicate_input_id`'s machine-readable half: the facets, by name only (never the values). Always
+ *  present on that code, never empty. */
+export interface SteerReplayRefusalDetail {
+    readonly differs: readonly SteerReplayFacet[];
+}
+/** Which seat refuses: the parked queue names the key it holds; the live verb answers about the caller's own key. */
+export type SteerReplaySeat = {
+    readonly seat: "parked";
+    readonly inputId: string;
+} | {
+    readonly seat: "accepted";
+};
+/**
+ * The refusal for a repeat that is not a replay, or `undefined` for one that is. When `text` differs the repeat is
+ * another instruction and the caller is told to take a fresh key. When only the tier / trust / attribution differ it
+ * is the SAME instruction, already accepted, whose standing receipt those facets do not change — a fresh key would
+ * queue it a second time, so the sentence says so instead of advising one.
+ */
+export declare function steerReplayRefusal(held: SteerReplayRecord, repeat: SteerReplayRecord, where: SteerReplaySeat): {
+    message: string;
+    detail: SteerReplayRefusalDetail;
+} | undefined;

package/dist/core/steer-replay.js

@@ -0,0 +1,22 @@
+import { steerPriorityOf } from "./task-notification.js";
+export const STEER_REPLAY_FACETS = Object.freeze(["text", "trusted", "priority", "actor"]);
+const FACET_IS_SAME = {
+    text: (a, b) => a.text === b.text,
+    trusted: (a, b) => a.trusted === b.trusted,
+    priority: (a, b) => steerPriorityOf(a) === steerPriorityOf(b),
+    actor: (a, b) => a.actor?.id === b.actor?.id && a.actor?.hostAsserted === b.actor?.hostAsserted && a.actor?.issuer === b.actor?.issuer,
+};
+export function steerReplayDiffers(held, repeat) {
+    return STEER_REPLAY_FACETS.filter((facet) => !FACET_IS_SAME[facet](held, repeat));
+}
+export function steerReplayRefusal(held, repeat, where) {
+    const differs = steerReplayDiffers(held, repeat);
+    if (differs.length === 0)
+        return undefined;
+    const seat = where.seat === "parked" ? `parked under inputId "${where.inputId}"` : "accepted under this inputId";
+    const listed = differs.join(", ");
+    const message = differs.includes("text")
+        ? `a different steering instruction is already ${seat} (this repeat differs in: ${listed}) — re-issue this one with a fresh inputId (an identical payload would have been an idempotent retry)`
+        : `the same steering instruction is already ${seat}; this repeat differs only in: ${listed}, which cannot change after acceptance — sending it again under another inputId would queue it a second time; to confirm the standing receipt, replay it with its original values`;
+    return { message, detail: { differs } };
+}

package/dist/core/task-event.d.ts

@@ -94,8 +94,9 @@ export type BrainStatusPhase = "rate_limited" | "retrying" | "reconnecting" | "c
  * {@link BrainStatus.errorStatus}; this bucket is the reason a consumer RENDERS and the only carrier for the
  * transport classes, which have no status at all.) Values are about the SHAPE of the failure, never its
  * provider taxonomy:
- *  - `connect_refused` — the attempt got a definite negative about the target itself (nothing accepts
- *    at that address, or the name has no address). This is the class the SHORT retry lane serves.
+ *  - `connect_refused` — the attempt got a definite negative about the way to the target (nothing accepts
+ *    at that address, the name has no address, or the proxy on the way refused the tunnel). This is the class
+ *    the SHORT retry lane serves.
  *  - `transport`      — any other transport-level failure: a connect timeout, a reset, a mid-stream
  *    tear. No verdict about the target; the full ladder applies.
  *  - `stall`          — no failure was observed on the link at all: THIS process cancelled its own

package/dist/core/task-notification.d.ts

@@ -32,10 +32,21 @@ export declare const SYSTEM_INJECTION_PRIORITIES: readonly SystemInjectionPriori
 export declare function isSystemInjectionPriority(value: unknown): value is SystemInjectionPriority;
 /** The ONE reading of a steer's priority: a parked row or an accepted input that carries none means `"next"`
  *  (the default the live admission has always applied) — so a retry that spells the default and a row parked
- *  without it are the same instruction, whichever side normalized. */
+ *  without it are the same instruction, whichever side normalized. A tier outside the closed set throws
+ *  (`steering.invalid_content`, the sentence names the set); `null` is such a tier, not an absent one. */
 export declare function steerPriorityOf(x: {
     readonly priority?: SystemInjectionPriority;
 }): SystemInjectionPriority;
+/** The two queues a person's input rides on a live run: the `steer` lane (the running turn's next boundary) and the
+ *  `followUp` lane (the run's would-otherwise-stop seat). They are also the two families of the stranded-input account — an
+ *  input's account is the one of the lane it was queued on (`USER_INPUT_UNDRAINED_FAMILIES`). */
+export type UserInputLane = "steer" | "followUp";
+/** The ONE reading of "which lane carries this tier": `"later"` rides the follow-up lane (never folded into work in
+ *  progress), `"next"` and `"now"` ride the steer lane (`"now"` additionally cuts the running turn). Both injection
+ *  seats — the steer verb and the notification lane — branch on it. A parked row that carries no tier reads through
+ *  {@link steerPriorityOf} first: `injectionLaneOf(steerPriorityOf(row))`. A tier outside the closed set throws
+ *  (`steering.invalid_content`, the same check and sentence as {@link steerPriorityOf}). */
+export declare function injectionLaneOf(priority: SystemInjectionPriority): UserInputLane;
 export interface TaskNotificationPayload {
     task_id: string;
     /** design/144 §2: `"external"` is CORE-MINTED ONLY — `TaskStream.notify()` casts it onto every

package/dist/core/task-notification.js

@@ -10,8 +10,20 @@ export const SYSTEM_INJECTION_PRIORITIES = ["now", "next", "later"];
 export function isSystemInjectionPriority(value) {
     return typeof value === "string" && SYSTEM_INJECTION_PRIORITIES.includes(value);
 }
+function requireSystemInjectionPriority(value) {
+    if (isSystemInjectionPriority(value))
+        return value;
+    const shown = typeof value === "string" ? JSON.stringify(value.length > 24 ? `${value.slice(0, 24)}…` : value) : value === null ? "null" : typeof value;
+    const refusal = new Error(`a steer priority must be one of ${SYSTEM_INJECTION_PRIORITIES.join("/")}, got ${shown}`);
+    refusal.code = "steering.invalid_content";
+    throw refusal;
+}
 export function steerPriorityOf(x) {
-    return x.priority ?? "next";
+    return x.priority === undefined ? "next" : requireSystemInjectionPriority(x.priority);
+}
+const LANE_OF_PRIORITY = { now: "steer", next: "steer", later: "followUp" };
+export function injectionLaneOf(priority) {
+    return LANE_OF_PRIORITY[requireSystemInjectionPriority(priority)];
 }
 const TASK_NOTIFICATION_TAGS = [
     "task-notification",

package/dist/core/task-spec.d.ts

@@ -551,9 +551,11 @@ export interface TaskSpec {
      * upstream): an `allowTools` entry naming a tool that does not exist is ITEM-FILTERED at spawn (the
      * agent stays listed and delegable; the only host disclosure is a prepare-time HEURISTIC advisory
      * via `RunnerDeps.onError` phase `"config"` for entries unknown to the parent's assembled roster —
-     * zero model-facing warning, the verified upstream shape); a `denyTools` entry naming an
-     * unknown tool is REJECTED at task start (`config.agent.unknown_tool` — a deny-typo silently WIDENS,
-     * the opposite failure direction, sema extension with no upstream deny-list to defer to); and
+     * zero model-facing warning, the verified upstream shape); a `denyTools` entry is read as the
+     * reference reads it (`Tool(content)` hides the whole `Tool`, with a host notice) and judged once, here and for the
+     * delegation tool's own lists alike: a spelling that names no tool, or a stale one (another case of a mounted tool, a
+     * retired name), is REJECTED at task start (`config.agent.unknown_tool`), any other name no tool carries is told to the
+     * host and hides nothing; and
      * providing this field with NO delegation tool mounted is rejected too
      * (`config.agents.no_delegation_tool`) — never a silent no-op. POLICY-NEUTRAL: a
      * roster listing only; the 1.294 tighten-only parent-policy inheritance is applied at spawn time,

package/dist/core/task-stream.d.ts

@@ -43,15 +43,20 @@ export interface TaskStream extends AsyncIterable<TaskEvent> {
      * that arrives while the task is LIVE was the only one that injected twice.
      *  - **Absent ⇒ nothing changes**: a uuidv7 is minted for the event, nothing is recorded for the call,
      *    and the delivered bytes are what they always were. Every pre-existing caller is on this arm.
-     *  - **Replay ⇒ idempotent no-op**: re-steering an id this stream already ACCEPTED, with an identical
-     *    payload (same text, same `trusted`, same `actor`), injects nothing and emits no second
+     *  - **Replay ⇒ idempotent no-op**: re-steering an id this stream already ACCEPTED, with the same
+     *    steer (same text, `trusted`, tier — absent reads `next` — and `actor`), injects nothing and emits no second
      *    `human_input` frame. What is remembered is exactly what QUEUED: a delivery that was refused
      *    (not running) can be retried under its own id, and a call whose DELIVERED payload is
      *    whitespace-only — which the harness discards without minting a frame; note a `trusted` steer is
      *    wrapped first, so it queues even for blank text — reserves nothing, leaving that id usable.
-     *  - **Same id, DIFFERENT instruction ⇒ typed throw** `steering.duplicate_input_id`: a key is not
+     *  - **Same id, not the same steer ⇒ typed throw** `steering.duplicate_input_id`: a key is not
      *    evidence of a replay, and two callers colliding on one id must not silently lose the second
-     *    (the parked leg's `appendPendingSteer` refuses it identically). Re-issue under a fresh id.
+     *    (the parked leg's `appendPendingSteer` judges and refuses it identically). The error carries
+     *    `detail.differs` — the facets that differ (closed `STEER_REPLAY_FACETS`: `text`, `trusted`,
+     *    `priority`, `actor`), compared on what the caller SENT, never on the framed bytes. With `text`
+     *    among them it is another instruction: re-issue it under a fresh id. Without, it is the accepted one
+     *    re-sent at another tier / trust / attribution, which acceptance does not change: a fresh id would
+     *    queue it twice, so replay it with its original values to confirm the receipt.
      *  - **Bad value ⇒ typed throw** `steering.invalid_content`, never a silent fallback to "no id": the
      *    value domain is the parked leg's (a non-empty string of at most `MAX_STEER_INPUT_ID_CHARS`
      *    characters), so one key is accepted or
@@ -107,8 +112,9 @@ export interface TaskStream extends AsyncIterable<TaskEvent> {
      *    relaying steer must gate this option at its own face — relay IS authorization.
      *  An unknown value throws typed `steering.invalid_content` (bad-value loudness). The replay
      *  identity (`inputId` idempotency) includes the NORMALIZED tier: the same text replayed under
-     *  the same id at a different tier refuses `steering.duplicate_input_id` — an "idempotent
-     *  success" that silently skipped the interrupt would be a disposition lie.
+     *  the same id at a different tier refuses `steering.duplicate_input_id` (`detail.differs:
+     *  ["priority"]`) — an "idempotent success" that silently skipped the interrupt would be a
+     *  disposition lie.
      *
      * design/373 §4.3 (D2, ruling of 2026-08-24) — a deployment `userPromptSubmit` hook SCREENS this verb:
      * the steer face is a SERVICE entrance (third-party callers reach a running run through it), so

package/dist/core/tool-errors.d.ts

@@ -123,8 +123,8 @@ export type WorkerErrorClass = "budget" | "limit" | "output" | "suspend" | "revi
  * The `limits.` namespace splits into the `budget` and `limit` classes by exact code — see
  * {@link EXACT_CODE_CLASS}. Operation-level dotted codes that are surfaced to a *caller* and never become a
  * task outcome are deliberately OUT of scope: `steering.*` (`steering.not_running`/`steering.invalid_content`/
- * `steering.duplicate_input_id`/`steering.blocked_by_hook`, rejected to the `steer()` caller — the fourth also
- * rides the resume face as a `CheckpointError` code) and `mcp.*` (`mcp.server_unavailable`, an `onWarn` warning code) — neither
+ * `steering.duplicate_input_id`/`steering.blocked_by_hook`, rejected to the `steer()` caller — the third also
+ * rides the parked queue's `setPendingSteer` face and the fourth the resume face, as `CheckpointError` codes) and `mcp.*` (`mcp.server_unavailable`, an `onWarn` warning code) — neither
  * reaches `TaskResult.errorCode`, so a caller will never pass them here. A genuinely unmapped code → `"unknown"` (which therefore means
  * "known-but-foreign or no code", e.g. a leaked fs/Node code, NOT "an OUR terminal class we forgot to add").
  */

package/dist/core/tool-policy.d.ts

@@ -4,6 +4,7 @@ import { type Settlement } from "./gate-outcome.js";
 export { policyCannotAnswer, rowDemandsAPerson } from "./real-approval.js";
 import { type DecisionReason } from "./decision-receipt.js";
 export { isEngineRefusal } from "./decision-receipt.js";
+import { type RemovalGuardSeat } from "../tools/fs/removal-targets.js";
 /** A tool call presented to a policy before it executes. */
 /** design/388 B6 — the per-call face (see {@link ToolCallRequest.face}). */
 export interface ToolCallFace {
@@ -69,6 +70,15 @@ export interface ToolCallRequest {
      * window — at that declaration, not here.
      */
     cwd?: string;
+    /**
+     * The root this leg's tools resolve a ROOT-relative spelling against (a search tool's relative `path`, a
+     * pattern with no `path`), stamped beside {@link cwd} at every Runner adjudication seat — the same
+     * canonical spelling as `cwd` (the hands' own root, the value `cwd` starts at). Present whenever the leg
+     * mounts file hands, read-only hands included; absent on a hands-less leg and on a bare request. A path
+     * guard whose deployment supplied no base of its own resolves the call's target against `root` / `cwd`.
+     * Read-only, like `cwd`.
+     */
+    root?: string;
     /**
      * The CANONICAL directories THIS RUN'S PROMPT ADVERTISES AS WRITABLE — the admitted list of the root
      * fence's advertised-writable-directory seat (the memory engine's write home, the deployment's
@@ -397,12 +407,12 @@ export type PermissionResult = {
     /** The ask's whole class set, in {@link import("./ask-origin.js").ASK_CLASSES} order (see
      *  {@link AskRequest.classes}). Stamped beside {@link askClass}, under the same rule. */
     classes?: readonly import("./ask-origin.js").AskClass[];
-    /** WHICH integrity guard minted this ask — the unverifiable recursive delete or the session-transcript
-     *  write. ENGINE-STAMPED by the two guard policies; a fold-internal fact the class derivation reads
-     *  ({@link import("./ask-origin.js").classifyAsk}) so the two guards, which mint the same
+    /** WHICH integrity guard minted this ask — a removal of a protected location, an unverifiable recursive delete
+     *  or the session-transcript write. ENGINE-STAMPED by the guard policies; a fold-internal fact the class
+     *  derivation reads ({@link import("./ask-origin.js").classifyAsk}) so the guards, which mint the same
      *  `requiresRealApproval` ask, are told apart by a fact and not by their prose. Never copied onto the
      *  approval request or the park row. */
-    guard?: "unverifiable_delete" | "transcript_write" | "artifact_shared_read";
+    guard?: "dangerous_delete" | "unverifiable_delete" | "transcript_write" | "artifact_shared_read";
     /** The call could not be READ against a rule that may reach it — a content-form deny row, a content-form
      *  ask row, or a persisted-rule row (the lexer's word). ENGINE-STAMPED at the three unreadable mint sites;
      *  the class derivation reads it as `rule_unreadable` (a mode may release it, a person may clear it, no
@@ -1082,6 +1092,7 @@ export declare function createUnverifiableDeletePolicy(opts?: {
     safeVars?: readonly string[];
     /** Override the shell tool names this gate parses (default `Bash`). */
     tools?: string[];
+    removalSeat?: RemovalGuardSeat;
 }): ToolPolicy;
 export declare function createTranscriptIntegrityPolicy(opts?: {
     /** Transcript directories to protect. Default: `($AGENT_DATA_DIR ?? ~/.ai-agent)/sessions`. */

package/dist/core/tool-policy.js

@@ -21,6 +21,7 @@ import { isNamespacedCoveringRuleName, namespacedRuleNameCovers, parsePermission
 import { protocolOf } from "./protocol-table.js";
 import { isAbsoluteForFamily, isAbsolutePathForm, joinForFamily, normalizeAbsPathLexically, pathFamilyOf, writeTargetPath } from "../tools/fs/safety.js";
 import { ASSIGNMENT_PREFIX, writtenAssignmentPrefix } from "../tools/fs/bash-program-position.js";
+import { removalReadingOf } from "../tools/fs/removal-targets.js";
 const nameListHolds = (set, req) => heldBy("policy.nameLists", set, req);
 const shellToolsListHolds = (set, req) => heldBy("policy.shellToolsList", set, req);
 export function advertisedWritableRootsSeat(seat) {
@@ -920,28 +921,23 @@ function hasRecursiveForce(argvTail) {
 export function createUnverifiableDeletePolicy(opts) {
     const safeVars = new Set([...UNVERIFIABLE_DELETE_SAFE_VARS, ...(opts?.safeVars ?? [])]);
     const shellTools = canonicalToolNameSet(opts?.tools);
+    const unverifiable = (command, finding = findUnverifiableRecursiveDelete(command, safeVars)) => (finding === undefined ? ALLOW : removalAsk("unverifiable_delete", finding));
     return brandPolicyAskClass({
-        check(req) {
+        check(req, signal) {
             if (!shellToolsListHolds(shellTools, req))
                 return ALLOW;
             const command = req.args?.command;
             if (typeof command !== "string")
                 return ALLOW;
-            const finding = findUnverifiableRecursiveDelete(command, safeVars);
-            if (finding === undefined)
-                return ALLOW;
-            return {
-                action: "ask",
-                decisionReason: "safety",
-                requiresRealApproval: true,
-                guard: "unverifiable_delete",
-                message: `Unverifiable recursive delete (fail-closed unless cleared): ${finding}. ` +
-                    `Re-run the delete with the resolved literal path written into the command itself ` +
-                    `(or assign the variable in the same command, e.g. \`DIR=/exact/path; rm -rf "$DIR"\`) so the target can be verified.`,
-            };
+            const removal = removalReadingOf(command, req, opts?.removalSeat);
+            return removal === undefined ? unverifiable(command) : removal.judge(signal).then((found) => (found === undefined ? unverifiable(command) : removalAsk(found.guard, found.text)));
         },
     }, "external_authority");
 }
+function removalAsk(guard, text) {
+    const message = guard === "dangerous_delete" ? `Dangerous removal: ${text}. No permission mode, allow rule or classifier clears this — only a person confirming this call does.` : `Unverifiable recursive delete (fail-closed unless cleared): ${text}. Re-run the delete with the resolved literal path written into the command itself (or assign the variable a literal path in the same command, e.g. \`DIR=/exact/path; rm -rf "$DIR"\`) so the target can be verified.`;
+    return { action: "ask", decisionReason: "safety", requiresRealApproval: true, guard, message };
+}
 function pathSegments(p) {
     return p.split(/[\\/]/).filter(Boolean);
 }

package/dist/core/tool-spec.d.ts

@@ -175,18 +175,36 @@ export interface ToolSpec<TParams extends TSchema = TSchema> {
      * offered pool a child of that type actually mounts. Filled by `createSubagentTool` beside
      * `agentListing`; a type with neither list gets the whole offered pool.
      *
-     * Read by ONE consumer: the memory content-origin face, which classifies a delegation RESULT by the
+     * Read by the memory content-origin face, which classifies a delegation RESULT by the
      * child's tool face. A child that can reach a network or protocol tool returns content from outside
      * the trust boundary just as surely as calling that tool here would, and the parent's transcript is
      * where it lands. Static by construction — the child's face is known from its definition, so no
-     * runtime tracking of what the child actually did is involved (that is the v2 ticket).
+     * runtime tracking of what the child actually did is involved (that is the v2 ticket). `authored`
+     * marks the entries minted from a definition a caller wrote on a tool a deployment mounted (not the
+     * engine's built-ins, the general-purpose alias, fork, or the engine's nested copy of the tool for a
+     * delegated child); prepare's deny-name check judges only those.
      */
     agentToolFaces?: ReadonlyArray<{
         name: string;
         allowTools?: readonly string[];
         denyTools?: readonly string[];
         canRedelegate?: boolean;
+        authored?: true;
     }>;
+    /**
+     * The tool-level `denyTools` list of the delegation tool (`SubagentToolOptions.denyTools`, applied when no agent definition is
+     * selected), exactly as written, filled by `createSubagentTool` beside {@link agentToolFaces}; absent when none was written
+     * and on the engine's nested copy for a delegated child. Read by prepare's deny-name check, which judges it with
+     * the `authored` entries of the faces.
+     */
+    agentToolLevelDenyTools?: readonly string[];
+    /**
+     * The tool-level `allowTools` list of the delegation tool (`SubagentToolOptions.allowTools`, applied when no agent definition is
+     * selected), as the tool copied it, filled by `createSubagentTool` beside {@link agentToolLevelDenyTools}; absent when none was
+     * written and on the engine's nested copy for a delegated child. Read by prepare's allowed-list judgment: a value that is not a
+     * list of strings is refused before the run.
+     */
+    agentToolLevelAllowTools?: readonly string[];
     /**
      * design/178 §3 (ruled 2026-08-08) — the POOL a delegated child draws from, as the delegation tool
      * captured it. Read together with {@link agentToolFaces} by the memory content-origin face: the face

package/dist/core/types.d.ts

@@ -29,6 +29,6 @@ export { AUTO_MODE_DENY_SOURCES, isAutoModeDenySource } from "./runtime-caps.js"
 export type { BackgroundChildEvent, DelegationLifecycleEvent } from "./delegation-frames.js";
 export { __resetMalformedDelegationSeatAnnouncement, deliverDelegationLifecycle } from "./delegation-frames.js";
 export type { ProjectMemoryLoad, ResumePreflightInfo, ResumePreflightVerdict, RunnerDeps } from "./runner-deps.js";
-export type { EngineNotice, OwedUserInputAccount, UserSteerUndrainedCause } from "./engine-notice.js";
-export { __resetMalformedNoticeSeatAnnouncement, deliverEngineNotice, owedUserInputCounts, parentLegIds, settleOwedUserInput, undrainedUserInputNotices, USER_STEER_UNDRAINED_CAUSES } from "./engine-notice.js";
+export type { EngineNotice, OwedUserInputAccount, UserInputUndrainedCause } from "./engine-notice.js";
+export { __resetMalformedNoticeSeatAnnouncement, deliverEngineNotice, owedUserInputCounts, parentLegIds, settleOwedUserInput, undrainedUserInputNotices, USER_INPUT_UNDRAINED_CAUSES, USER_INPUT_UNDRAINED_FAMILIES } from "./engine-notice.js";
 export type { AgentTool, Model, StreamFn, ThinkingLevel, ToolInputValidationContext, ToolInputVerdict };

package/dist/core/types.js

@@ -1,4 +1,4 @@
 export { MODEL_ROLES } from "./model-seat.js";
 export { AUTO_MODE_DENY_SOURCES, isAutoModeDenySource } from "./runtime-caps.js";
 export { __resetMalformedDelegationSeatAnnouncement, deliverDelegationLifecycle } from "./delegation-frames.js";
-export { __resetMalformedNoticeSeatAnnouncement, deliverEngineNotice, owedUserInputCounts, parentLegIds, settleOwedUserInput, undrainedUserInputNotices, USER_STEER_UNDRAINED_CAUSES } from "./engine-notice.js";
+export { __resetMalformedNoticeSeatAnnouncement, deliverEngineNotice, owedUserInputCounts, parentLegIds, settleOwedUserInput, undrainedUserInputNotices, USER_INPUT_UNDRAINED_CAUSES, USER_INPUT_UNDRAINED_FAMILIES } from "./engine-notice.js";

package/dist/index.d.ts

@@ -42,7 +42,7 @@ export { StdioLspTransport, type LspChildProcess } from "./engine/lsp/stdio-lsp-
 export { encodeFrame, createFrameDecoder } from "./engine/lsp/frame-decoder.js";
 export { resolveModel, resolveTaskModel, parseModelMention, expandTiers, DEFAULT_TIER_ORDER, CC_MODEL_TIER_ALIASES, ROLE_TIER_DEFAULTS, MODEL_ROLES, type ModelRole, type RoleSpec, type ModelRoles, type ResolvedRole, type ModelMention, } from "./core/roles.js";
 export { selectModel, selectModelOrThrow, type ModelCriteria, type ModelTier } from "./core/select-model.js";
-export { BrainError, classifyHttp, isProviderEchoShape, PROVIDER_ECHO_SHAPE, type BrainErrorCode } from "./brain/errors.js";
+export { BrainError, classifyHttp, isProviderEchoShape, PROVIDER_ECHO_SHAPE, PROXY_TUNNEL_REFUSED, type BrainErrorCode } from "./brain/errors.js";
 export { looksDegenerate, inspectDegenerate, trimDegenerateTail } from "./brain/repetition.js";
 export type { RepetitionEvent, RepetitionInspection } from "./brain/repetition.js";
 export { computeCostMicroUsd, isModelPriced, modelCostToPricing, type ModelPricing, type TokenCounts, } from "./core/pricing.js";
@@ -63,7 +63,8 @@ export { MCP_FAILURE_KINDS, MCP_DELIVERY_VERDICTS, MCP_LIVENESS_STATES, classify
 export { MCP_INJECTION_DROP_REASONS, MCP_INJECTION_DROP_TEXT, mcpInjectionDroppedNotice, type McpInjectionDropReason, type McpInjectionDropFacts } from "./core/mcp-injection-drop.js";
 export { askUnresolvableNotice, type AskUnresolvableFacts } from "./core/ask-unresolvable-notice.js";
 export { ASK_UNRESOLVABLE_CAUSES } from "./core/ask-unresolvable-notice.js";
-export { USER_STEER_UNDRAINED_CAUSES, type UserSteerUndrainedCause } from "./core/engine-notice.js";
+export { USER_INPUT_UNDRAINED_CAUSES, type UserInputUndrainedCause, USER_INPUT_UNDRAINED_FAMILIES } from "./core/engine-notice.js";
+export { STEER_REPLAY_FACETS, type SteerReplayFacet } from "./core/steer-replay.js";
 export { TOOL_TURN_INCOMPLETE_CAUSES, type ToolTurnIncompleteCause } from "./internal/llm.js";
 export { DURABLE_MANDATE_SOURCES } from "./core/tool-policy.js";
 export { TERMINAL_CAUSE_IS_REPLAYABLE, type TerminalFailureDetail, type TerminalBlockedDetail, PROMPT_BLOCK_CAUSES, type PromptBlockCause, isPromptBlockCause } from "./core/terminal-cause.js";
@@ -145,7 +146,7 @@ export { judgeRuleToolName, RULE_TOOL_NAME_VERDICTS, type RuleToolNameVerdict }
 export { DEFAULT_SUBAGENT_TOOL_NAME } from "./agents/subagent.js";
 export { renderTaskNotificationXml, RESUPPLIED_FRAME_PREAMBLE, taskNotificationDedupKey, isDelegatedAgentTerminal, isTerminalTaskNotification, SystemInjectionQueue, type TaskNotificationPayload, type TaskNotificationStatus, type ExternalNotificationInput, type SystemInjection, type SystemInjectionPriority, type NotificationInjectionOutcome, // the injector's outcome words (`parked_durably` = the session's durable box took the frame)
 NOTIFICATION_INJECTION_OUTCOMES, // …and their value half + guard, so a host wiring its own uplink validates a reported outcome without duplicating the vocabulary
-isNotificationInjectionOutcome, SYSTEM_INJECTION_PRIORITIES, isSystemInjectionPriority, steerPriorityOf, AGENT_MESSAGE_TAG, renderAgentMessageFrame, type SemaProvenance, HANDBACK_STATES, type HandbackState, COMPACTION_KINDS, type CompactionKind, handbackStateOf, terminalFrameFacets, } from "./core/task-notification.js";
+isNotificationInjectionOutcome, SYSTEM_INJECTION_PRIORITIES, isSystemInjectionPriority, steerPriorityOf, injectionLaneOf, type UserInputLane, AGENT_MESSAGE_TAG, renderAgentMessageFrame, type SemaProvenance, HANDBACK_STATES, type HandbackState, COMPACTION_KINDS, type CompactionKind, handbackStateOf, terminalFrameFacets, } from "./core/task-notification.js";
 export { TOOL_FAMILIES, TOOL_MOUNT_TAGS, TOOL_APPROVAL_CARDS, TOOL_PATH_ACCESSES, TOOL_PATH_BASES, TOOL_PATH_ABSENCES, TOOL_WIRE_NAME_MAX_CHARS, TOOL_CONTRACT_MAX_CHARS, TOOL_CARD_ID_MAX_CHARS, TOOL_KEY_MAX_CHARS, TOOL_KEYS_MAX, RENDER_HINT_MAX_CHARS, RENDER_HINT_ACTIVITY_MAX_CHARS, RENDER_HINT_MAX_LIST, type ToolFamily, type ToolMountTag, type ToolApprovalCard, type ToolPathAccess, type ToolPathBase, type ToolPathAbsence, type ToolPathTarget, type ToolCallPathTarget, type ToolRosterPathTarget, pathTargetSlotOnly, type ToolRuleFace, type ToolRenderHints, type ToolFaceDeclaration, type ToolCatalogEntry, } from "./core/tool-face.js";
 export { describeToolCatalog, catalogEntriesNamed, catalogToolNames, catalogRuleFaceOf, pathTargetOf, pathTargetValue, protectivePathTargetOf, declaredPathTargetOf, BARE_REQUEST_CODE, isProtectedWrite, isDeclaredWrite, fileOpAccessOf, type ToolCallLike, pathConfinableWriteToolNames, pathTargetingToolNames, compactableToolNames, budgetExemptToolNames, handBandEffects, engineCardTypes, predictMountedToolNames, HANDS_BAND_TAGS, MOUNT_TAG_IN_HANDS_BAND, } from "./core/tool-registry.js";
 export { ToolRosterEntry, ToolRoster, ToolRosterDelta, ToolRosterRenderHints, ROSTER_SOURCES, type RosterSource, type ToolIdentity, toolIdentityOf, mintCapabilityId, diffToolRoster, judgeParkedToolIdentity, ruleFacesFromRoster, toolCallFaceOf, rosterToolName, ruleNamesOf, inputKeysOf, ruleFaceOfInstance, rosterMemberBoundProblem, type RosterBoundMembers, type RosterBoundCode, ToolRosterDeltaSeat, } from "./core/tool-roster.js";
@@ -206,7 +207,8 @@ export { ALLOW_RULE_MEMBERS, type AllowRuleMember, type AllowRuleShadow } from "
 export { mintNamespacePrefix } from "./core/protocol-naming.js";
 export { readDenyClassifierRules, renderClassifierDenyRules, type DerivedDenyRule } from "./core/auto-mode-prompt.js";
 export { AUTO_MODE_DENY_SOURCES, isAutoModeDenySource, type AutoModeDenySource } from "./core/runtime-caps.js";
-export { SETTLEMENT_KINDS, type SettlementKind, isSettlementKind, type Settlement, SETTLEMENT_PARTIES, type SettlementParty, isSettlementParty, SETTLEMENT_IS_REFUSAL, DENIED_BY_VALUES, type DeniedBy, isDeniedBy, DENIED_BY_MAY_VETO, CLASSIFIER_DENY_CAUSES, type ClassifierDenyCause, isClassifierDenyCause, DENIED_BY_MAY_CARRY_CAUSE, type GateDisposition, type GateOutcome, type ModeRelease, type ModeRefusal, screenGateOutcome } from "./core/gate-outcome.js";
+export { SETTLEMENT_KINDS, type SettlementKind, isSettlementKind, type Settlement, SETTLEMENT_PARTIES, type SettlementParty, isSettlementParty, HOST_DECIDERS, type HostDecider, isHostDecider, SETTLEMENT_IS_REFUSAL, DENIED_BY_VALUES, type DeniedBy, isDeniedBy, DENIED_BY_MAY_VETO, CLASSIFIER_DENY_CAUSES, type ClassifierDenyCause, isClassifierDenyCause, DENIED_BY_MAY_CARRY_CAUSE, type GateDisposition, type GateOutcome, type ModeRelease, type ModeRefusal, screenGateOutcome } from "./core/gate-outcome.js";
+export { policyCannotAnswer, type HeldQuestion } from "./core/real-approval.js";
 export { type AskCarry } from "./core/hooks.js";
 export { SWAPPABLE_DEP_SEATS, SWAP_SEAT_NOTICE, isSwappableDepSeat, screenSwappableDeps, type SwappableDepSeat, type SwappableDeps } from "./core/swappable-deps.js";
 export { parseAutoModeResponse, createAutoModeDecider, AUTO_MODE_UNAVAILABLE_CAUSES, isAutoModeUnavailableCause, classifierUnavailableDenyMessage, classifierParseFailureDenyMessage, AUTO_MODE_PARSE_FAILURES, isAutoModeParseFailure, type AutoModeParseFailure, type AutoModeUnavailableCause, AUTO_MODE_CLASSIFIER_FALLBACKS, isAutoModeClassifierFallback, AUTO_MODE_FALLBACK_CAUSES, isAutoModeFallbackCause, type AutoModeClassifierFallback, type AutoModeFallbackCause, type AutoModeClassifierRound, type AutoModeLadderRung, type AutoModeVerdict, type AutoModeDecider, type AutoModeDeciderOptions, type AutoModeClassified, type AutoModeClassifyFn, type AutoModeClassifyInput, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow, type AutoModeDenialTracker, type AutoModeDenialLimitOptions, type DenialLimitCounts, type DenialLimitFallbackFace, type UnarmedDenialLimitFallback, type DenialLimitFallback, type DenialLimitVerdict, } from "./core/auto-mode.js";
@@ -252,6 +254,7 @@ export { formatHookFeedback, runToolGate, createHookEnvCapabilities, createPreTo
 export { HOOK_FAMILIES, HOOKS_INVALID_CODE, type HookFamily, type WiringManifestHookEntry } from "./core/hook-seats.js";
 export { InMemoryMemoryStore, composeMemoryBlock, composeLayeredMemoryBlock, normalizeMemorySpec, type NormalizedMemorySpec, type MemorySpecInput, supportsConsolidation, supportsPeriodicConsolidation, firstSentence, expandLexicalTerms, lexicalSearchMatch, type Embedder, classifyPromotable, enforcePromotableWriteGate, guardedMemoryStore, MemoryGateError, MemoryProjectionError, detectSecret, enforceSecretWriteGate, enforceStructuredNoteSecretGate, type UtilityGate, type MemoryStore, type MemoryVectorMode, type ScoredMemory, type MemoryNoteHeader, type MemoryNoteRecord, type MemoryNoteType, type StructuredNoteInput, MEMORY_PROJECT_KEY_ABSENT_REASONS, type MemoryProjectKeyAbsentReason, type MemoryProjectKey, } from "./core/memory.js";
 export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, type MemoryBackendContractHooks, buildMemoryInstruction, writableRootOf, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_ORIGIN_CAUSES, committedOriginOf, originEquals, consolidationExposedFrontmatter, ambiguousOriginRepresentation, type OriginClearanceRow, type OriginClearanceEvent, type OriginClearanceShadow, committedDistilledOf, distilledEquals, type MemoryEntryDistilled, type MemoryEntryDistilledInput, CONSOLIDATION_DEFAULTS, ConsolidationRefusedError, MEMORY_SEARCH_SUPERSEDED_TAG, consolidationTypeEligible, deriveSupersededSet, memorySupersededNote, readIntentCredentials, supersessionFuseCeiling, deriveShadowedSet, memoryConsolidationRecommendedNotice, memoryConsolidationCommittedNotice, memoryConsolidationConflictNotice, memoryConsolidationIncompleteNotice, memoryConsolidationRefusedNotice, memoryConsolidationWithheldNotice, type ConsolidationGateRead, type ConsolidationGateRow, type ConsolidationIntent, type ConsolidationIntentCredentialRow, type ConsolidationLeaseSeat, type ConsolidationProductProposal, type ConsolidationProposal, type MemoryConsolidationOptions, type ConsolidationCommitReceipt, type ConsolidationReconcileReport, type ConsolidationResolveReceipt, type ConsolidationPlanSummary, type ConsolidationPlanFoldEvidence, type SessionMemoryStatus, DISTILLER_DEFAULT_MAX_INPUTS_PER_PRODUCT, LLM_DISTILLER_CONTRACT, LLM_DISTILLER_CONTRACT_DL2, LLM_DISTILLER_CONTRACT_DL3, LLM_DISTILLER_CONTRACTS, MEMORY_DISTILLER_CONTRACT_V1, contractGroupingDiff, driveConsolidationToFixpoint, isAliasModelId, llmPlanDistiller, mintExposurePartitionedPlan, mintLlmConsolidationPlan, MEMORY_DISTILLER_PURITY_CONTRACT_V1, detectCleanArmVerbatimLeak, type CleanArmLeakFinding, type CleanArmLeakVerdict, type MemoryDistillerPurityContract, openAiCompatChatSeat, parseJsonAnswer, planParseRepairs, sanitizeLlmGroups, scheduleUnderFuse, type ConsolidationDistillFn, type ConsolidationDriveCycleRow, type ConsolidationDriveEngine, type ConsolidationDriveResult, type ConsolidationFoldState, type DistillerCandidate, type DistillerChatAnswer, type DistillerChatFn, type DistillerChatRequest, type FuseSchedule, type LlmConsolidationPlan, type LlmConsolidationPlanArm, type LlmConsolidationPlanProduct, type LlmDistillerContract, type MintLlmConsolidationPlanResult, type PlanParseRepairs, type SanitizedLlmGroups, CONSOLIDATION_DRIVER_PLANS_DIR, CONSOLIDATION_DRIVER_RUNS_FILE, CONSOLIDATION_RUN_STOP_REASONS, archiveDistillerPlan, readConsolidationDriverRun, runMemoryConsolidationDriver, type ConsolidationDriverEngine, type ConsolidationDriverRunRow, type ConsolidationRunReceipt, type ConsolidationRunStopReason, type RunMemoryConsolidationOptions, isInstructionEntry, type MemoryEntryOrigin, type MemoryOriginCause, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, MEMORY_CAPTURE_OPTOUT_NOTICE, memoryCaptureOptedOutNotice, memoryCaptureOptOutUnpersistedNotice, SESSION_CAPTURE_OPTOUT_DIR, markSessionCaptureOptOut, readSessionCaptureOptOut, listSessionCaptureOptOut, fileSessionCaptureRecordStore, type SessionCaptureOptOutRecord, type SessionCaptureOptOutMarkOutcome, type SessionCaptureRecordStore, readV2HeaderHints, type V2HeaderHints, LINEAGE_FILE, CHALLENGES_FILE, CHALLENGED_HISTORY_FILE, CHALLENGE_LEDGER_MAX_EVENTS, rebuildStrictControlPlaneLedger, type ControlPlaneRebuildReceipt, type StrictControlPlaneLedger, type ChallengeAssignment, type ChallengeEvent, type ChallengedHistoryRow, type LineagePendingTxn, type LineagePromotion, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_INDEX_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, type MemorySearchDetails, type MemorySearchHit, type CleanMemorySearchHit, type ExposedMemorySearchHit, MEMORY_EXPOSURE_BANNER, MEMORY_EXPOSURE_HANDLE_TAG, memoryExposureIndexRow, type MemoryGetDetails, type MemoryIndexDetails, type MemoryIndexRow, type CleanMemoryIndexRow, type ExposedMemoryIndexRow, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, type MemoryAnnouncement, type ScanFinding, type MemoryEngineOptions, type MemoryInjection, type EntryProvenanceAccount, type TransferEvidence, type CommittedBinding, type CommittedEntrySnapshot, type CommittedScopeSnapshots, type EntryCustodyReport, erasureSelectHash, type EraseMemoryEntriesInput, type ErasureSelect, type ErasedBinding, type MemoryErasureAttestation, computeMemoryBundleHash, type MemoryExportBundle, type MemoryImportReport, type MemoryExportSnapshot, type MemoryBundleImportPlan, type BundleChallengeRow, type BundleLineageRow, type BundlePollutedSession, type MemoryBackend, type MemoryEntry, type MemoryEntryFrontmatter, type MemoryEntryHeader, type MemoryScopeEnumeration, type ScoredMemoryEntry, type NotePatch, type PatchReport, type MaterializedFile, type MemorySessionHandle, type HarvestReport, type HarvestRejection, type HarvestRejectionCode, type ParsedEntryFile, type ScannedEntryFile, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, type ParsedScopeKey, migrateScope, type MigrateScopeReport, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, type RemoteMemoryFile, type RemoteMemoryBaseline, type RemoteMaterialization, type RemoteHarvestResult, type InboundEntryFinding, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, type MemorySyncCursor, type MemorySyncConflict, type MemorySyncPlan, type RecallSource, syncMemoryScope, type MemorySyncTransport, type MemorySyncRequestBody, type MemorySyncResponseBody, type MemorySyncClientConflict, type SyncMemoryScopeOptions, type MemorySyncClientResult, } from "./core/memory-engine/index.js";
+export { STORE_FORM_REFUSAL_CODES, TARGET_OUTSIDE_STORE, SCOPE_HOME_NOT_DIRECTORY, SCOPE_HOME_FORMS, type StoreFormRefusalCode, type StoreFormRefusalDetail, type StoreFormRefusal, type ScopeHomeForm } from "./core/memory-engine/layout.js";
 export { SHARED_MEMORY_READ_CAP_BYTES, SHARED_MEMORY_LIST_PAGE_SIZE, SharedMemoryStoreError, type SharedMemoryStoreProvider, type SharedMemoryStoreReader, type SharedMemoryPagedList, type SharedMemoryStoreInfo, type SharedMemoryDocumentEntry, type SharedMemorySnapshot, type SharedMemoryRequestContext, type MemoryListDetails, type MemoryReadDetails, } from "./core/shared-memory/types.js";
 export { sharedMemoryStoreContract, type SharedMemoryFixture, type SharedMemoryStoreContractHooks, } from "./core/shared-memory/contract.js";
 export { termSet, jaccardDistance, cosineDistance } from "./core/memory-vector.js";

package/dist/index.js

@@ -29,7 +29,7 @@ export { StdioLspTransport } from "./engine/lsp/stdio-lsp-transport.js";
 export { encodeFrame, createFrameDecoder } from "./engine/lsp/frame-decoder.js";
 export { resolveModel, resolveTaskModel, parseModelMention, expandTiers, DEFAULT_TIER_ORDER, CC_MODEL_TIER_ALIASES, ROLE_TIER_DEFAULTS, MODEL_ROLES, } from "./core/roles.js";
 export { selectModel, selectModelOrThrow } from "./core/select-model.js";
-export { BrainError, classifyHttp, isProviderEchoShape, PROVIDER_ECHO_SHAPE } from "./brain/errors.js";
+export { BrainError, classifyHttp, isProviderEchoShape, PROVIDER_ECHO_SHAPE, PROXY_TUNNEL_REFUSED } from "./brain/errors.js";
 export { looksDegenerate, inspectDegenerate, trimDegenerateTail } from "./brain/repetition.js";
 export { computeCostMicroUsd, isModelPriced, modelCostToPricing, } from "./core/pricing.js";
 export { cacheFamilyOf, promptTokensOf, uncachedInputTokensOf } from "./core/runner/usage-accounting.js";
@@ -49,7 +49,8 @@ export { MCP_FAILURE_KINDS, MCP_DELIVERY_VERDICTS, MCP_LIVENESS_STATES, classify
 export { MCP_INJECTION_DROP_REASONS, MCP_INJECTION_DROP_TEXT, mcpInjectionDroppedNotice } from "./core/mcp-injection-drop.js";
 export { askUnresolvableNotice } from "./core/ask-unresolvable-notice.js";
 export { ASK_UNRESOLVABLE_CAUSES } from "./core/ask-unresolvable-notice.js";
-export { USER_STEER_UNDRAINED_CAUSES } from "./core/engine-notice.js";
+export { USER_INPUT_UNDRAINED_CAUSES, USER_INPUT_UNDRAINED_FAMILIES } from "./core/engine-notice.js";
+export { STEER_REPLAY_FACETS } from "./core/steer-replay.js";
 export { TOOL_TURN_INCOMPLETE_CAUSES } from "./internal/llm.js";
 export { DURABLE_MANDATE_SOURCES } from "./core/tool-policy.js";
 export { TERMINAL_CAUSE_IS_REPLAYABLE, PROMPT_BLOCK_CAUSES, isPromptBlockCause } from "./core/terminal-cause.js";
@@ -117,7 +118,7 @@ export { createFsWriteGatePolicy, WRITE_EXEMPT_DIR_COVERS_ROOT_CODE } from "./co
 export { RETIRED_TOOL_NAMES } from "./core/tool-name-aliases.js";
 export { judgeRuleToolName, RULE_TOOL_NAME_VERDICTS } from "./core/tool-name-aliases.js";
 export { DEFAULT_SUBAGENT_TOOL_NAME } from "./agents/subagent.js";
-export { renderTaskNotificationXml, RESUPPLIED_FRAME_PREAMBLE, taskNotificationDedupKey, isDelegatedAgentTerminal, isTerminalTaskNotification, SystemInjectionQueue, NOTIFICATION_INJECTION_OUTCOMES, isNotificationInjectionOutcome, SYSTEM_INJECTION_PRIORITIES, isSystemInjectionPriority, steerPriorityOf, AGENT_MESSAGE_TAG, renderAgentMessageFrame, HANDBACK_STATES, COMPACTION_KINDS, handbackStateOf, terminalFrameFacets, } from "./core/task-notification.js";
+export { renderTaskNotificationXml, RESUPPLIED_FRAME_PREAMBLE, taskNotificationDedupKey, isDelegatedAgentTerminal, isTerminalTaskNotification, SystemInjectionQueue, NOTIFICATION_INJECTION_OUTCOMES, isNotificationInjectionOutcome, SYSTEM_INJECTION_PRIORITIES, isSystemInjectionPriority, steerPriorityOf, injectionLaneOf, AGENT_MESSAGE_TAG, renderAgentMessageFrame, HANDBACK_STATES, COMPACTION_KINDS, handbackStateOf, terminalFrameFacets, } from "./core/task-notification.js";
 export { TOOL_FAMILIES, TOOL_MOUNT_TAGS, TOOL_APPROVAL_CARDS, TOOL_PATH_ACCESSES, TOOL_PATH_BASES, TOOL_PATH_ABSENCES, TOOL_WIRE_NAME_MAX_CHARS, TOOL_CONTRACT_MAX_CHARS, TOOL_CARD_ID_MAX_CHARS, TOOL_KEY_MAX_CHARS, TOOL_KEYS_MAX, RENDER_HINT_MAX_CHARS, RENDER_HINT_ACTIVITY_MAX_CHARS, RENDER_HINT_MAX_LIST, pathTargetSlotOnly, } from "./core/tool-face.js";
 export { describeToolCatalog, catalogEntriesNamed, catalogToolNames, catalogRuleFaceOf, pathTargetOf, pathTargetValue, protectivePathTargetOf, declaredPathTargetOf, BARE_REQUEST_CODE, isProtectedWrite, isDeclaredWrite, fileOpAccessOf, pathConfinableWriteToolNames, pathTargetingToolNames, compactableToolNames, budgetExemptToolNames, handBandEffects, engineCardTypes, predictMountedToolNames, HANDS_BAND_TAGS, MOUNT_TAG_IN_HANDS_BAND, } from "./core/tool-registry.js";
 export { ToolRosterEntry, ToolRoster, ToolRosterDelta, ToolRosterRenderHints, ROSTER_SOURCES, toolIdentityOf, mintCapabilityId, diffToolRoster, judgeParkedToolIdentity, ruleFacesFromRoster, toolCallFaceOf, rosterToolName, ruleNamesOf, inputKeysOf, ruleFaceOfInstance, rosterMemberBoundProblem, ToolRosterDeltaSeat, } from "./core/tool-roster.js";
@@ -168,7 +169,8 @@ export { ALLOW_RULE_MEMBERS } from "./core/allow-rule-shadow.js";
 export { mintNamespacePrefix } from "./core/protocol-naming.js";
 export { readDenyClassifierRules, renderClassifierDenyRules } from "./core/auto-mode-prompt.js";
 export { AUTO_MODE_DENY_SOURCES, isAutoModeDenySource } from "./core/runtime-caps.js";
-export { SETTLEMENT_KINDS, isSettlementKind, SETTLEMENT_PARTIES, isSettlementParty, SETTLEMENT_IS_REFUSAL, DENIED_BY_VALUES, isDeniedBy, DENIED_BY_MAY_VETO, CLASSIFIER_DENY_CAUSES, isClassifierDenyCause, DENIED_BY_MAY_CARRY_CAUSE, screenGateOutcome } from "./core/gate-outcome.js";
+export { SETTLEMENT_KINDS, isSettlementKind, SETTLEMENT_PARTIES, isSettlementParty, HOST_DECIDERS, isHostDecider, SETTLEMENT_IS_REFUSAL, DENIED_BY_VALUES, isDeniedBy, DENIED_BY_MAY_VETO, CLASSIFIER_DENY_CAUSES, isClassifierDenyCause, DENIED_BY_MAY_CARRY_CAUSE, screenGateOutcome } from "./core/gate-outcome.js";
+export { policyCannotAnswer } from "./core/real-approval.js";
 export {} from "./core/hooks.js";
 export { SWAPPABLE_DEP_SEATS, SWAP_SEAT_NOTICE, isSwappableDepSeat, screenSwappableDeps } from "./core/swappable-deps.js";
 export { parseAutoModeResponse, createAutoModeDecider, AUTO_MODE_UNAVAILABLE_CAUSES, isAutoModeUnavailableCause, classifierUnavailableDenyMessage, classifierParseFailureDenyMessage, AUTO_MODE_PARSE_FAILURES, isAutoModeParseFailure, AUTO_MODE_CLASSIFIER_FALLBACKS, isAutoModeClassifierFallback, AUTO_MODE_FALLBACK_CAUSES, isAutoModeFallbackCause, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow, } from "./core/auto-mode.js";
@@ -198,6 +200,7 @@ export { formatHookFeedback, runToolGate, createHookEnvCapabilities, createPreTo
 export { HOOK_FAMILIES, HOOKS_INVALID_CODE } from "./core/hook-seats.js";
 export { InMemoryMemoryStore, composeMemoryBlock, composeLayeredMemoryBlock, normalizeMemorySpec, supportsConsolidation, supportsPeriodicConsolidation, firstSentence, expandLexicalTerms, lexicalSearchMatch, classifyPromotable, enforcePromotableWriteGate, guardedMemoryStore, MemoryGateError, MemoryProjectionError, detectSecret, enforceSecretWriteGate, enforceStructuredNoteSecretGate, MEMORY_PROJECT_KEY_ABSENT_REASONS, } from "./core/memory.js";
 export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, buildMemoryInstruction, writableRootOf, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_ORIGIN_CAUSES, committedOriginOf, originEquals, consolidationExposedFrontmatter, ambiguousOriginRepresentation, committedDistilledOf, distilledEquals, CONSOLIDATION_DEFAULTS, ConsolidationRefusedError, MEMORY_SEARCH_SUPERSEDED_TAG, consolidationTypeEligible, deriveSupersededSet, memorySupersededNote, readIntentCredentials, supersessionFuseCeiling, deriveShadowedSet, memoryConsolidationRecommendedNotice, memoryConsolidationCommittedNotice, memoryConsolidationConflictNotice, memoryConsolidationIncompleteNotice, memoryConsolidationRefusedNotice, memoryConsolidationWithheldNotice, DISTILLER_DEFAULT_MAX_INPUTS_PER_PRODUCT, LLM_DISTILLER_CONTRACT, LLM_DISTILLER_CONTRACT_DL2, LLM_DISTILLER_CONTRACT_DL3, LLM_DISTILLER_CONTRACTS, MEMORY_DISTILLER_CONTRACT_V1, contractGroupingDiff, driveConsolidationToFixpoint, isAliasModelId, llmPlanDistiller, mintExposurePartitionedPlan, mintLlmConsolidationPlan, MEMORY_DISTILLER_PURITY_CONTRACT_V1, detectCleanArmVerbatimLeak, openAiCompatChatSeat, parseJsonAnswer, planParseRepairs, sanitizeLlmGroups, scheduleUnderFuse, CONSOLIDATION_DRIVER_PLANS_DIR, CONSOLIDATION_DRIVER_RUNS_FILE, CONSOLIDATION_RUN_STOP_REASONS, archiveDistillerPlan, readConsolidationDriverRun, runMemoryConsolidationDriver, isInstructionEntry, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, MEMORY_CAPTURE_OPTOUT_NOTICE, memoryCaptureOptedOutNotice, memoryCaptureOptOutUnpersistedNotice, SESSION_CAPTURE_OPTOUT_DIR, markSessionCaptureOptOut, readSessionCaptureOptOut, listSessionCaptureOptOut, fileSessionCaptureRecordStore, readV2HeaderHints, LINEAGE_FILE, CHALLENGES_FILE, CHALLENGED_HISTORY_FILE, CHALLENGE_LEDGER_MAX_EVENTS, rebuildStrictControlPlaneLedger, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_INDEX_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, MEMORY_EXPOSURE_BANNER, MEMORY_EXPOSURE_HANDLE_TAG, memoryExposureIndexRow, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, erasureSelectHash, computeMemoryBundleHash, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, migrateScope, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, syncMemoryScope, } from "./core/memory-engine/index.js";
+export { STORE_FORM_REFUSAL_CODES, TARGET_OUTSIDE_STORE, SCOPE_HOME_NOT_DIRECTORY, SCOPE_HOME_FORMS } from "./core/memory-engine/layout.js";
 export { SHARED_MEMORY_READ_CAP_BYTES, SHARED_MEMORY_LIST_PAGE_SIZE, SharedMemoryStoreError, } from "./core/shared-memory/types.js";
 export { sharedMemoryStoreContract, } from "./core/shared-memory/contract.js";
 export { termSet, jaccardDistance, cosineDistance } from "./core/memory-vector.js";

package/dist/orchestration/workflow-types.d.ts

@@ -421,6 +421,9 @@ export interface WorkflowRun {
      * read or written carrying this token's `parked` entry, so
      * absence is the confirmed state and an entry written before this member reads as confirmed, exactly as it did; the
      * engine's own material read identity-checks what it finds, so an unconfirmed origin degrades rather than mis-binds.
+     * `parkedBy` is the run standing on the park: a record's run holds it iff `entry.parkedBy === record.id` (never
+     * `originRunId`); inheritance keeps it. `generation` is the inherited entry's, else `0`, plus one per admission — the
+     * highest on a session is the chain's tail, a tie is a fork. Both or neither; an older entry has neither (no holder).
      */
     parks?: Array<{
         callKey: string;
@@ -428,6 +431,8 @@ export interface WorkflowRun {
         token: string;
         originRunId: string;
         originUnconfirmed?: true;
+        parkedBy?: string;
+        generation?: number;
     }>;
     /**
      * Set (`true`) on a resume run's record from its creation and REMOVED the moment its admission completes — so a record

package/dist/orchestration/workflow.d.ts

@@ -223,8 +223,9 @@ export interface WorkflowAgentHandle {
      * legs of one steering ingress are equally replay-safe. ⚠️ ONE arm of that contract is NOT reachable through this
      * handle, deliberately: the idempotent-REPLAY arm ("same id, same payload ⇒ injects nothing"). Each call mints a
      * FRESH unguessable correlation marker into the framing it delivers, so a retry under the same id is a
-     * same-id-DIFFERENT-instruction call and refuses typed `steering.duplicate_input_id`. What the key buys on this
-     * lane is therefore AT-MOST-ONCE: a retried ingress is refused LOUDLY instead of injecting a second copy.
+     * same-id-DIFFERENT-instruction call and refuses typed `steering.duplicate_input_id` (`detail.differs` always names
+     * `text` on this lane). What the key buys on this lane is therefore AT-MOST-ONCE: a retried ingress is refused
+     * LOUDLY instead of injecting a second copy.
      */
     steer(content: string, opts?: {
         inputId?: string;