@sema-agent/core 7.44.0 → 7.45.0

package/dist/agents/tool-filter.js

@@ -1,12 +1,135 @@
+import { parsePermissionRule } from "../core/permission-rule-syntax.js";
+export function readDeniedEntry(entry) {
+    if (typeof entry !== "string")
+        return { kind: "not_a_string", type: valueTypeLabel(entry) };
+    if (entry !== entry.trim())
+        return { kind: "name", name: entry, content: false };
+    const parsed = parsePermissionRule(entry);
+    return { kind: "name", name: parsed.toolName, content: parsed.ruleContent !== undefined };
+}
+export function valueTypeLabel(value) {
+    if (value === null)
+        return "null";
+    switch (typeof value) {
+        case "string":
+            return "a string";
+        case "undefined":
+            return "undefined";
+        case "number":
+            return "a number";
+        case "boolean":
+            return "a boolean";
+        case "bigint":
+            return "a bigint";
+        case "symbol":
+            return "a symbol";
+        case "function":
+            return "a function";
+        default:
+            try {
+                return Array.isArray(value) ? "an array" : "an object";
+            }
+            catch {
+                return "an object";
+            }
+    }
+}
+const isList = (value) => Array.isArray(value);
+const UNREADABLE_LIST = Object.freeze({});
+export function readToolNameList(value) {
+    if (value === UNREADABLE_LIST)
+        return { kind: "unreadable" };
+    let list;
+    try {
+        list = isList(value) ? value : undefined;
+    }
+    catch {
+        return { kind: "not_a_list", type: "an object" };
+    }
+    if (list === undefined)
+        return { kind: "not_a_list", type: valueTypeLabel(value) };
+    try {
+        const entries = [];
+        for (let i = 0; i < list.length; i++)
+            entries.push(list[i]);
+        return { kind: "entries", entries };
+    }
+    catch {
+        return { kind: "unreadable" };
+    }
+}
+export function snapshotToolNameList(value) {
+    const read = readToolNameList(value);
+    return read.kind === "entries" ? read.entries : read.kind === "unreadable" ? UNREADABLE_LIST : value;
+}
+const LIST_NOUN = { allowed: "allowed tools", denied: "denied tools" };
+const LIST_NAME = { allowed: "an allowed-tools list", denied: "a denied-tools list" };
+export function notAStringSentence(where, side, index, type) {
+    return `${where} declares in its ${LIST_NOUN[side]}, as entry ${index + 1}, a value that is ${type}, not a tool name — ${LIST_NAME[side]} holds tool names, each a string. Fix the entry.`;
+}
+export function notAListSentence(where, side, list) {
+    return list.kind === "not_a_list"
+        ? `${where} declares in its ${LIST_NOUN[side]} a value that is ${list.type}, not a list of tool names. Fix the list.`
+        : `${where} declares in its ${LIST_NOUN[side]} a list whose entries cannot be read (an accessor or a proxy trap threw). Fix the list.`;
+}
+export function toolNameListFlaw(where, side, value) {
+    if (value === undefined || value === null)
+        return undefined;
+    const list = readToolNameList(value);
+    if (list.kind !== "entries")
+        return notAListSentence(where, side, list);
+    for (let i = 0; i < list.entries.length; i++) {
+        const entry = list.entries[i];
+        if (typeof entry !== "string")
+            return notAStringSentence(where, side, i, valueTypeLabel(entry));
+    }
+    return undefined;
+}
+export function snapshotDefinitionLists(def) {
+    const copy = { ...def };
+    if (copy.allowTools !== undefined)
+        copy.allowTools = snapshotToolNameList(copy.allowTools);
+    if (copy.denyTools !== undefined)
+        copy.denyTools = snapshotToolNameList(copy.denyTools);
+    return copy;
+}
+export function allowedToolNames(allowTools) {
+    if (allowTools === undefined || allowTools === null)
+        return undefined;
+    const list = readToolNameList(allowTools);
+    if (list.kind !== "entries")
+        return new Set();
+    if (list.entries.includes("*"))
+        return undefined;
+    const names = new Set();
+    for (const entry of list.entries)
+        if (typeof entry === "string")
+            names.add(entry);
+    return names;
+}
+function deniedNames(denyTools) {
+    const names = new Set();
+    const list = readToolNameList(denyTools);
+    if (list.kind !== "entries")
+        return names;
+    for (const entry of list.entries) {
+        const read = readDeniedEntry(entry);
+        if (read.kind === "name")
+            names.add(read.name);
+    }
+    return names;
+}
 export function toolNameAllowed(name, allowTools, denyTools) {
-    const allow = allowTools !== undefined && !allowTools.includes("*") ? new Set(allowTools) : undefined;
-    const deny = denyTools && denyTools.length > 0 ? new Set(denyTools) : undefined;
+    const allow = allowedToolNames(allowTools);
+    const denied = deniedNames(denyTools);
+    const deny = denied.size > 0 ? denied : undefined;
     const n = name;
     return (!allow || allow.has(n)) && (!deny || !deny.has(n));
 }
 export function resolveToolSubset(pool, allowTools, denyTools) {
-    const allow = allowTools !== undefined && !allowTools.includes("*") ? new Set(allowTools) : undefined;
-    const deny = denyTools && denyTools.length > 0 ? new Set(denyTools) : undefined;
+    const allow = allowedToolNames(allowTools);
+    const denied = deniedNames(denyTools);
+    const deny = denied.size > 0 ? denied : undefined;
     if (!allow && !deny)
         return [...pool];
     return pool.filter((t) => {

package/dist/core/agent-definition.d.ts

@@ -33,7 +33,7 @@ export interface AgentDefinition {
      *  the delegation tool's name cannot re-delegate (CC Explore/Plan `disallowedTools` include Agent,
      *  pretty.js:409189/486948). */
     allowTools?: string[];
-    /** Tool denylist (a deny always wins). See {@link allowTools} for the per-agent delegation-tool note. */
+    /** Tool denylist (a deny always wins), tool NAMES: `Tool(content)` hides the whole `Tool`. See {@link allowTools} for the per-agent delegation-tool note. */
     denyTools?: string[];
     /**
      * F7 (CC 2.1.198 parity, per-agent `skills` — 锚 pretty.js:422126 `e.skills ?? []`, GA/ungated in 198:
@@ -116,7 +116,7 @@ export interface SkillSpec {
      * either list asks once (`Execute skill: <name>`, the card listing what it releases); a skill the person invoked by
      * name ({@link import("./task-spec.js").TaskSpec.userInvokedSkills}) grants without asking. The grant holds for that
      * run (a steer it takes in does not end it) and the next runTask starts without it. An entry this grammar reads as nothing — `*` (it voids an allow list; on a deny list it is inert and the rest of the
-     * list still refuses), `mcp__*`, a write path, a domain — grants nothing and is announced at the start of the run (`permission.allowed_tool_not_granted`).
+     * list still refuses), `mcp__*`, a write path, a domain — grants nothing and is announced at the start of the run (`permission.allowed_tool_not_granted`). A table whose value is not a list (a string, an object…) reads as one such entry; `null` is no table.
      */
     allowedTools?: string[];
     /** The tools refused for the rest of the run this skill is activated in — the frontmatter `disallowed-tools` list,

package/dist/core/allow-entry.d.ts

@@ -3,17 +3,33 @@ import { type ToolCallRequest } from "./tool-policy.js";
 import { type AllowRuleMember, type AllowRuleShadow } from "./allow-rule-shadow.js";
 import { type PersistedRule } from "./permission-rule-model.js";
 import { type AskClass, type AssertAllKeysHandled, type PermissionMode, type PersistedRuleMandate } from "./ask-origin.js";
+import { type ToolNameListReading } from "../agents/tool-filter.js";
 import { type EngineNotice } from "./engine-notice.js";
 /** Why an entry grants (or refuses) nothing — the closed set the start-of-run notice names, for every list. `tool_name`: the
  *  entry's tool name is one the name judgment reads as stale against the run's roster (`verdict` says which); `near_miss`: the
  *  run mounts no tool of that exact name but mounts one that differs only by case (`currentName` is its spelling). */
 export declare const ALLOW_ENTRY_INERT_REASONS: readonly ["wildcard_all", "namespace_wildcard", "path_pattern", "domain", "content_unsupported", "grammar", "tool_name", "near_miss"];
 export type AllowEntryInertReason = (typeof ALLOW_ENTRY_INERT_REASONS)[number];
-/** The facts beside a `tool_name` / `near_miss` reason: the judgment's word, and the spelling to write instead when there is one. */
+/** The facts beside a reason: for `tool_name` / `near_miss` the judgment's word and the spelling to write instead when there is
+ *  one; for a list member that is not a string (`grammar`) the TYPE of the value (`a number`, `null`, `an object`…) — `entry` then
+ *  holds {@link nonStringMemberLabel}, never the value. */
 export interface AllowEntryInertDetail {
     readonly verdict?: Exclude<RuleToolNameVerdict["kind"], "current">;
     readonly currentName?: string;
+    readonly valueType?: string;
 }
+/**
+ * How a list member that is not a string is named wherever a list's entries are named (the inert record's `entry`, the Skill
+ * card's binding): its TYPE, in a spelling no readable entry can have — a readable entry's name holds no whitespace and a
+ * name-only entry holds no parenthesis, and this label holds a space and none. It can equal only another entry that reads as
+ * nothing, so a binding that holds it never stands for an entry that grants or refuses.
+ */
+export declare function nonStringMemberLabel(value: unknown): string;
+/** How a tool-name list's VALUE that is not a list stands as one entry (the same kind of spelling as {@link nonStringMemberLabel}: it
+ *  reads as `grammar`): its TYPE, or that its entries could not be read — never the value. */
+export declare function nonListValueLabel(read: Exclude<ToolNameListReading, {
+    kind: "entries";
+}>): string;
 /** One entry a list reads as nothing. */
 export type AllowEntryInert = {
     readonly entry: string;
@@ -189,6 +205,7 @@ declare const SHADOW_REASON: {
     readonly content_question: "the call is the engine's own question to a person";
     readonly hook: "a PreToolUse hook asks about this call — the deployment's own screening is answered by a person";
     readonly ancestor: "the task that delegated this one owns this question";
+    readonly dangerous_delete: "this removal targets a protected location (the filesystem root, a top-level directory, a home directory, or a workspace directory or one of its ancestors) — it is cleared by confirming this call, never by an allow rule";
     readonly unverifiable_delete: "this removal could not be verified safe — it is cleared by confirming this call, never by an allow rule";
     readonly transcript_write: "this write targets the session transcript — it is cleared by confirming this call, never by an allow rule";
     readonly org_rule: "an organization policy rule requires approval for this call";
@@ -244,6 +261,13 @@ export type AllowEntryInertNote = ({
 } & AllowEntryInert) | ({
     readonly source: AllowEntrySource;
 } & AllowEntryInert);
+/**
+ * THE ONE WRITER of a list entry into a sentence (the start-of-run notice, a skill's refusal and its decisions, a sub-agent
+ * list's refusals and advisories): the entry as a JSON string — quotes, backslashes and the usual escapes — with every
+ * character that prints as nothing, or as a space, written as `\uXXXX` (`\u{…}` beyond the BMP) and a run of spaces kept
+ * space by space, so what a person reads is what the engine read. Capped on what is printed.
+ */
+export declare function renderListEntry(entry: string): string;
 /**
  * One entry that reads as nothing, as a person reads it: the entry as written (quoted, so a surrounding space shows) and why
  * — the reason word, with the spelling to write when the reading has one. The one phrasing the start-of-run notice and a

package/dist/core/allow-entry.js

@@ -9,12 +9,19 @@ import { pathRuleLaneAnswer } from "./runner/permission-rule-lanes.js";
 import { splitShellCompoundSegments } from "../tools/fs/bash-readonly-classifier.js";
 import { mandateDisclosureOf } from "./ask-origin.js";
 import { inlineUntrusted } from "./untrusted-text.js";
+import { valueTypeLabel } from "../agents/tool-filter.js";
 import { deliverEngineNotice } from "./engine-notice.js";
 export const ALLOW_ENTRY_INERT_REASONS = Object.freeze(["wildcard_all", "namespace_wildcard", "path_pattern", "domain", "content_unsupported", "grammar", "tool_name", "near_miss"]);
+export function nonStringMemberLabel(value) {
+    return `<not a string: ${valueTypeLabel(value)}>`;
+}
+export function nonListValueLabel(read) {
+    return read.kind === "not_a_list" ? `<not a list: ${read.type}>` : "<a list whose entries cannot be read>";
+}
 function ruleRowOf(parsed) {
     return { ...parsed, scope: { kind: "global" }, adds: [{ dot: { actor: "list", counter: 1 }, origin: "user", createdAt: "" }] };
 }
-const TOOL_NAME_SPELLING = /^[^\s()]+$/;
+const TOOL_NAME_SPELLING = /^[^\s()\p{Cc}\p{Cf}]+$/u;
 function mountedSpellingOf(name, roster) {
     const folded = name.toLowerCase();
     for (const mounted of roster)
@@ -36,6 +43,8 @@ function toolNameReading(name, roster) {
 function readAllowEntry(raw, behavior, roster) {
     const inert = (reason) => ({ inert: reason });
     const row = (compiled) => ({ compiled });
+    if (typeof raw !== "string")
+        return { inert: "grammar", detail: { valueType: valueTypeLabel(raw) } };
     if (raw !== raw.trim())
         return inert("grammar");
     const parsed = parsePermissionRule(raw);
@@ -94,11 +103,11 @@ export function compileAllowList(entries, behavior, roster) {
     const rows = [];
     const inert = [];
     for (const entry of entries) {
-        const read = voided ? { inert: "wildcard_all" } : readAllowEntry(entry, behavior, roster);
+        const read = typeof entry !== "string" || !voided ? readAllowEntry(entry, behavior, roster) : { inert: "wildcard_all" };
         if ("compiled" in read)
             rows.push({ entry, compiled: read.compiled });
         else
-            inert.push({ entry, reason: read.inert, ...read.detail });
+            inert.push({ entry: typeof entry === "string" ? entry : nonStringMemberLabel(entry), reason: read.inert, ...read.detail });
     }
     return { rows, inert };
 }
@@ -307,6 +316,7 @@ const SHADOW_REASON = {
     content_question: "the call is the engine's own question to a person",
     hook: "a PreToolUse hook asks about this call — the deployment's own screening is answered by a person",
     ancestor: "the task that delegated this one owns this question",
+    dangerous_delete: "this removal targets a protected location (the filesystem root, a top-level directory, a home directory, or a workspace directory or one of its ancestors) — it is cleared by confirming this call, never by an allow rule",
     unverifiable_delete: "this removal could not be verified safe — it is cleared by confirming this call, never by an allow rule",
     transcript_write: "this write targets the session transcript — it is cleared by confirming this call, never by an allow rule",
     org_rule: "an organization policy rule requires approval for this call",
@@ -366,7 +376,22 @@ export function cardDisclosureOf(decision, fallbackMessage) {
 }
 export const ALLOWED_TOOL_NOT_GRANTED_CODE = "permission.allowed_tool_not_granted";
 const NOTICE_ENTRIES_SHOWN = 5;
+const UNSEEN_IN_ENTRY = /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}\p{Zs}]/gu;
+const ENTRY_RENDER_MAX = 122;
+function escapedCodePoint(ch) {
+    const cp = ch.codePointAt(0) ?? 0;
+    const hex = cp.toString(16).padStart(4, "0");
+    return cp > 0xffff ? `\\u{${hex}}` : `\\u${hex}`;
+}
+export function renderListEntry(entry) {
+    const quoted = JSON.stringify(entry)
+        .replace(/ {2,}/g, (run) => "\\u0020".repeat(run.length))
+        .replace(UNSEEN_IN_ENTRY, (ch) => (ch === " " ? ch : escapedCodePoint(ch)));
+    return inlineUntrusted(quoted, ENTRY_RENDER_MAX);
+}
 export function inertEntryPhrase(e) {
+    if (e.valueType !== undefined)
+        return `a value that is ${e.valueType} (grammar: not a string)`;
     const spelling = e.currentName !== undefined ? inlineUntrusted(e.currentName, 120) : undefined;
     const why = (() => {
         if (e.reason === "near_miss")
@@ -386,7 +411,7 @@ export function inertEntryPhrase(e) {
             }
         }
     })();
-    return `${inlineUntrusted(JSON.stringify(e.entry), 122)} (${why})`;
+    return `${renderListEntry(e.entry)} (${why})`;
 }
 export function allowedToolsNotGrantedNotice(inert, sessionId) {
     const where = (e) => (e.source === "skill" ? `skill ${inlineUntrusted(e.skill, 80)} ${e.list}` : e.source === "request" ? "this run's allowedTools" : "the deployment's allowedTools");

package/dist/core/ask-origin.d.ts

@@ -25,6 +25,7 @@
  * the ask). Both stay where they are and are consumed beside the origin, not folded into it.
  */
 import type { PermissionResult } from "./tool-policy.js";
+import type { ContainmentFace } from "../tools/fs/containment-face.js";
 /**
  * The closed set, in AUTHORITY order — the order {@link askOriginOf} resolves a fold in when several
  * facts hold on one call (a hook ask folded over a policy ask, an org stamp over either). The order
@@ -448,8 +449,12 @@ export type ToolMarkSource = "deployment" | "mcp_annotation" | "a2a_default";
  * `classifier_no_ruling` is a classifier station's question to a person because the auto-mode classification did not rule
  * (`classifierNoRuling` — it could not run, or replied with no verdict): the denial-limit fallback's row (only a person
  * answers it; the classifier is never asked again).
+ * `dangerous_delete` is a removal whose target is a protected location (`dangerousRemovalOf`: the filesystem root, a
+ * top-level directory, a home directory, or a workspace directory — the task root, the working directory, an additional
+ * working directory — or an ancestor of one): the reference implementation's dangerous-removal breaker, which no mode,
+ * allow rule or classifier answers. `unverifiable_delete` is its sibling for a target the command text cannot resolve.
  */
-export declare const ASK_CLASSES: readonly ["content_question", "hook", "ancestor", "unverifiable_delete", "transcript_write", "org_rule", "governance_unavailable", "rule_unreadable", "ask_rule", "denial_limit_fallback", "classifier_no_ruling", "requires_user_interaction", "operator_forced", "shell_floor", "write_protection_unresolved", "probe", "write_protection", "tool_marks_mcp", "tool_marks_a2a", "policy_rra", "artifact_shared_read", "mode", "unstated", "ordinary"];
+export declare const ASK_CLASSES: readonly ["content_question", "hook", "ancestor", "dangerous_delete", "unverifiable_delete", "transcript_write", "org_rule", "governance_unavailable", "rule_unreadable", "ask_rule", "denial_limit_fallback", "classifier_no_ruling", "requires_user_interaction", "operator_forced", "shell_floor", "write_protection_unresolved", "probe", "write_protection", "tool_marks_mcp", "tool_marks_a2a", "policy_rra", "artifact_shared_read", "mode", "unstated", "ordinary"];
 export type AskClass = (typeof ASK_CLASSES)[number];
 /** Membership test for {@link AskClass} — the word crosses the wire on `tool_end.gate.disposition`. */
 export declare function isAskClass(v: unknown): v is AskClass;
@@ -457,7 +462,8 @@ export declare function isAskClass(v: unknown): v is AskClass;
 export interface ModeArbitrationRow {
     /** The ask still reaches a person under `bypassPermissions` (the reference implementation's `bypassImmune`). */
     readonly bypassImmune: boolean;
-    /** The auto-mode classifier may answer it. */
+    /** The auto-mode classifier may answer it — as the class stands on its own: the folded row of an ask
+     *  ({@link foldArbitrationRow}) also takes the read face the ask was raised under. */
     readonly classifierEligible: boolean;
     /** The sandbox-admission leg may admit it (containment holds the effect). */
     readonly sandboxAdmission: boolean;
@@ -473,6 +479,8 @@ export interface ModeArbitrationRow {
  * sandbox columns are the fold of the two former per-word lane tables (only `probe` moved: the classifier may
  * now answer it — the read boundary's unestablishable spelling is fed to it as a deny-table row instead), and
  * `ruleMayClear` restates {@link ruleClearanceOf}'s conclusion per class (a real-approval bit is never rule-clearable).
+ * `probe`'s `classifierEligible` is the OPEN read face's reading: a narrowed (`roots`) face withholds the classifier from the class,
+ * folded where the ask's row is ({@link foldArbitrationRow}).
  * `mode` is the permission mode's OWN question (`plan`'s two sentences, `decisionReason: "mode"`): the reference
  * implementation puts it to a person past every allow rule and never to an automatic lane, and its bypass conversion
  * releases it like any other non-immune ask. `unstated` is the reference implementation's passthrough conversion: an allow
@@ -503,6 +511,13 @@ export declare const MODE_ARBITRATION: {
         readonly ruleMayClear: false;
         readonly hookAskFloor: false;
     };
+    readonly dangerous_delete: {
+        readonly bypassImmune: true;
+        readonly classifierEligible: false;
+        readonly sandboxAdmission: false;
+        readonly ruleMayClear: false;
+        readonly hookAskFloor: true;
+    };
     readonly unverifiable_delete: {
         readonly bypassImmune: true;
         readonly classifierEligible: true;
@@ -683,6 +698,8 @@ export interface AskClassFacts extends AskOriginFacts {
     readonly toolMarkSources?: ReadonlySet<ToolMarkSource>;
     readonly a2aIsolatePeers?: boolean;
     readonly ancestorClasses?: ReadonlySet<AskClass>;
+    /** The read face the leg this ask was raised on resolved ({@link ContainmentFace}); absent ⇒ none resolved (a leg with no hands). */
+    readonly readFace?: ContainmentFace;
 }
 /** The classification the arbitration reads: the whole set, the disclosed word (the set's first member in
  *  {@link ASK_CLASSES} order) and the row folded across the set. */
@@ -718,8 +735,10 @@ export declare function decisionAskClassesOf(d: Extract<PermissionResult, {
 }>): Set<AskClass>;
 /** Fold a class set onto one row: `bypassImmune` and `hookAskFloor` by OR (any immune member keeps the ask; any floored
  *  member floors a hook's ask), the three permissive switches by AND (one refusing member withholds the lane). An empty
- *  set is `ordinary`. */
-export declare function foldArbitrationRow(classes: ReadonlySet<AskClass>): ModeArbitrationRow;
+ *  set is `ordinary`. `readFace` is the face the ask was raised under: `roots` takes the classifier's lane from a set that
+ *  holds a class the narrowed face withholds from it — the one place the face enters, so every reader of `classifierEligible`
+ *  reads it already folded. */
+export declare function foldArbitrationRow(classes: ReadonlySet<AskClass>, readFace?: ContainmentFace): ModeArbitrationRow;
 /**
  * The ONE class derivation: the decision half ({@link decisionAskClassesOf}) joined with the gate's own facts —
  * the question tool, an ancestor's mark, the org layer's two arms, the persisted lane's unreadable call, the tool

package/dist/core/ask-origin.js

@@ -170,6 +170,7 @@ export const ASK_CLASSES = Object.freeze([
     "content_question",
     "hook",
     "ancestor",
+    "dangerous_delete",
     "unverifiable_delete",
     "transcript_write",
     "org_rule",
@@ -200,6 +201,7 @@ export const MODE_ARBITRATION = {
     content_question: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: true },
     hook: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false },
     ancestor: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false },
+    dangerous_delete: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: true },
     unverifiable_delete: { bypassImmune: true, classifierEligible: true, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: true },
     transcript_write: { bypassImmune: false, classifierEligible: true, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: true },
     org_rule: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false },
@@ -222,7 +224,8 @@ export const MODE_ARBITRATION = {
     unstated: { bypassImmune: false, classifierEligible: true, sandboxAdmission: false, ruleMayClear: true, hookAskFloor: false },
     ordinary: { bypassImmune: false, classifierEligible: true, sandboxAdmission: true, ruleMayClear: true, hookAskFloor: false },
 };
-export const RRA_EXPLAINERS = new Set(["unverifiable_delete", "transcript_write", "org_rule", "governance_unavailable", "rule_unreadable", "denial_limit_fallback", "classifier_no_ruling", "ancestor", "artifact_shared_read", "requires_user_interaction"]);
+const CLASSIFIER_WITHHELD_ON_ROOTS = new Set(["probe"]);
+export const RRA_EXPLAINERS = new Set(["dangerous_delete", "unverifiable_delete", "transcript_write", "org_rule", "governance_unavailable", "rule_unreadable", "denial_limit_fallback", "classifier_no_ruling", "ancestor", "artifact_shared_read", "requires_user_interaction"]);
 export const RELEASABLE_ASK_CLASSES = ASK_CLASSES.filter((c) => !MODE_ARBITRATION[c].bypassImmune);
 export const MODE_RELEASE_REASONS = Object.freeze(["rule_unreadable"]);
 const MODE_RELEASE_REASON_SET = new Set(MODE_RELEASE_REASONS);
@@ -243,6 +246,8 @@ export function screenAskClassMembers(askClass, classes) {
 }
 export function decisionAskClassesOf(d) {
     const out = new Set();
+    if (d.guard === "dangerous_delete")
+        out.add("dangerous_delete");
     if (d.guard === "unverifiable_delete")
         out.add("unverifiable_delete");
     if (d.guard === "transcript_write")
@@ -273,10 +278,11 @@ export function decisionAskClassesOf(d) {
         out.add(c);
     return out;
 }
-export function foldArbitrationRow(classes) {
+export function foldArbitrationRow(classes, readFace) {
     if (classes.size === 0)
         return MODE_ARBITRATION.ordinary;
-    let bypassImmune = false, classifierEligible = true, sandboxAdmission = true, ruleMayClear = true, hookAskFloor = false;
+    const withheld = readFace === "roots" && [...classes].some((c) => CLASSIFIER_WITHHELD_ON_ROOTS.has(c));
+    let bypassImmune = false, classifierEligible = !withheld, sandboxAdmission = true, ruleMayClear = true, hookAskFloor = false;
     for (const c of classes) {
         const row = MODE_ARBITRATION[c];
         bypassImmune ||= row.bypassImmune;
@@ -334,7 +340,7 @@ export function classifyAsk(d, facts) {
     if (classes.size === 0)
         classes.add("ordinary");
     const askClass = ASK_CLASSES.find((c) => classes.has(c));
-    return { classes, askClass, row: foldArbitrationRow(classes) };
+    return { classes, askClass, row: foldArbitrationRow(classes, facts.readFace) };
 }
 export function headlessDenialMessage(toolName, askMessage) {
     return `Permission for this tool use was denied: it requires interactive approval, and permission prompts are not available in this session (nobody can be asked to approve "${toolName}" in this run — headless auto-deny). The action was NOT performed. Do not claim it succeeded, and do not retry it in this session — report the limitation to the user, or suggest an alternative. What was requested: ${askMessage}`;

package/dist/core/checkpoint-store.d.ts

@@ -1,4 +1,4 @@
-import type { GateOutcome } from "./gate-outcome.js";
+import type { GateOutcome, HostDecider } from "./gate-outcome.js";
 import { type ExecutionOutcomeRecordWord } from "./checkpoint-execution-record.js";
 import type { CheckpointPause } from "./pause-registry.js";
 import type { SystemInjectionPriority } from "./task-notification.js";
@@ -625,7 +625,7 @@ export type ResumeOutcome = {
      * authorization; a replay states its own facts.
      */
     hostDecision: {
-        decidedBy: "person" | "sla_timeout" | "policy";
+        decidedBy: HostDecider;
         approver?: string;
     };
     /**

package/dist/core/decision-receipt.js

@@ -11,7 +11,7 @@ export const refusedOutOfContract = (message) => {
 export const isEngineRefusal = (d) => typeof d === "object" && d !== null && ENGINE_REFUSALS.has(d);
 const DECISION_REASONS = Object.freeze(["rule", "mode", "hook", "safety", "classifier", "persisted_rule", "sandbox", "org_rule", "org_unavailable", "read_only", "skill", "deployment_rule", "request_rule"]);
 const DECISION_ACTIONS = Object.keys({ allow: 0, deny: 0, ask: 0 });
-const GUARDS = Object.keys({ unverifiable_delete: 0, transcript_write: 0, artifact_shared_read: 0 });
+const GUARDS = Object.keys({ dangerous_delete: 0, unverifiable_delete: 0, transcript_write: 0, artifact_shared_read: 0 });
 const RULE_UNREADABLE_WORDS = Object.keys({ content_deny: 0, content_ask: 0, persisted_call: 0 });
 const AUTHORED_BY_WORDS = Object.keys({ deployment: 0 });
 const memberOf = (words) => {

package/dist/core/effective-path-target.d.ts

@@ -28,8 +28,8 @@
  *
  * Nothing here judges anything: it answers "which absolute path is this call about". Containment, the
  * sensitive-path deny face and the rule precedence walk are unchanged and still run where they ran.
- * `undefined` means "this call has no path this reading can locate" — the documented fail-toward-asking
- * posture of both lanes (no refusal on the tightening side, no grant on the allow side).
+ * `undefined` means "this call names no path" (no declaration, a non-string slot, an absent slot that targets
+ * nothing); a path the call does name whose base this reading lacks is `unreadable` — never a guess, never silence.
  *
  * RepoMap shares the search tools' root-relative `path` semantics but declares NO path target at all (no
  * rule family reaches it, and the rule grammar is derived from the catalog's path targets), so it has no
@@ -71,8 +71,8 @@ export declare function splitAbsoluteGlobPattern(pattern: string, family: PathFa
 } | undefined;
 /**
  * The reading of a call's path slot under ONE declaration: `path` = the absolute target's identity; `unreadable`
- * = the slot spells a target but the base it needs is not a usable base of this tree (fed to TIGHTENING rows
- * only, as the ask a person clears — never to the allow arm); `refused` = a namespace refusal of the
+ * = the slot spells a target (or targets its base) but the base it needs is not supplied or not a usable base of
+ * this tree (fed to TIGHTENING rows only, as the ask a person clears — never to the allow arm); `refused` = a namespace refusal of the
  * spelling itself (a rule speaks about no such spelling: no verdict, no ask — the fs throat delivers the
  * refusal with the same word); `undefined` = no target in this reading.
  */
@@ -97,8 +97,9 @@ export type PathTargetReading = {
  *  ③ otherwise a `patternParam`'s ABSOLUTE pattern supplies its own base directory;
  *  ④ otherwise the base itself (the tool searches all of it).
  *
- * A base the deployment did not supply yields `undefined`: a relative spelling with nothing to resolve
- * against names no file, and claiming it names `/<spelling>` was a fabrication no fence should judge.
+ * A base the caller did not supply yields `unreadable`: a relative spelling with nothing to resolve against
+ * names a file this reading cannot locate — claiming it names `/<spelling>` would be a fabrication, and
+ * claiming it names nothing would let every rule about that file stay silent.
  */
 export declare function effectivePathTargetOf(call: ToolCallLike, pt: ToolCallPathTarget | undefined, bases: ToolPathBases): PathTargetReading;
 /**

package/dist/core/effective-path-target.js

@@ -31,10 +31,8 @@ export function effectivePathTargetOf(call, pt, bases) {
     if (spelling.spelled !== undefined)
         return resolveSpelling(spelling.spelled, spelling.base, bases);
     const declaredBase = spelling.base;
-    if (declaredBase === undefined)
-        return undefined;
     const family = pathFamilyOf(bases);
-    return isAbsoluteForFamily(family, declaredBase) ? readingOf(pathIdentityOf(declaredBase, family, bases.root ?? bases.cwd)) : unreadableBase(declaredBase);
+    return declaredBase !== undefined && isAbsoluteForFamily(family, declaredBase) ? readingOf(pathIdentityOf(declaredBase, family, bases.root ?? bases.cwd)) : unreadableBase(declaredBase);
 }
 export function effectivePathSpellingOf(call, pt, bases) {
     if (pt === undefined)
@@ -63,9 +61,7 @@ function resolveSpelling(spelled, declaredBase, bases) {
     const tree = bases.root ?? bases.cwd;
     if (isAbsoluteForFamily(family, screened.spelled))
         return readingOf(pathIdentityOf(screened.spelled, family, tree));
-    if (declaredBase === undefined || family === undefined)
-        return undefined;
-    if (!isAbsoluteForFamily(family, declaredBase))
+    if (declaredBase === undefined || family === undefined || !isAbsoluteForFamily(family, declaredBase))
         return unreadableBase(declaredBase);
     return readingOf(pathIdentityOf(joinForFamily(family, declaredBase, screened.spelled), family, tree));
 }
@@ -75,5 +71,5 @@ function readingOf(r) {
     return r.reason === "relative" || r.reason === "unanchored" ? undefined : { kind: "refused", reason: r.reason };
 }
 function unreadableBase(base) {
-    return { kind: "unreadable", reason: `the base this call resolves against (${JSON.stringify(base)}) is not a fully-qualified path of this tree's family` };
+    return { kind: "unreadable", reason: base === undefined ? "the call's path is relative to a base that was not supplied" : `the base this call resolves against (${JSON.stringify(base)}) is not a fully-qualified path of this tree's family` };
 }

package/dist/core/engine-notice.d.ts

@@ -394,8 +394,9 @@ export interface EngineNotice {
      *    frame's two count keys). They are NOT redelivered (a steer aimed at a finished run must not
      *    fire at the next one — unlike ENGINE notes, which pend per session); the loud half of the
      *    #257 contract's "accepted = enqueued, not consumed" sentence;
-     *    `detail: { steer, cause, taskId?, sessionId?, runId? }` / `{ followUp, cause, taskId?, sessionId?, runId? }`
-     *    (`cause` on both rows, closed `USER_INPUT_UNDRAINED_CAUSES`: `"leg_end"` — this engine's arm, the
+     *    `detail: { <countKey>, cause, taskId?, sessionId?, runId? }` (the `code` and the `countKey` of each family are the
+     *    table {@link USER_INPUT_UNDRAINED_FAMILIES}, keyed by the lane the input was queued on — `injectionLaneOf` — and the
+     *    minter writes exactly those; `cause` on both rows, closed `USER_INPUT_UNDRAINED_CAUSES`: `"leg_end"` — this engine's arm, the
      *    leg ended with it still owed; `"crashed"` — minted by the SERVING LAYER, not this engine, before the
      *    session's next run, for inputs it had accepted whose consumption was not confirmed before the process died: their queue was the
      *    serving layer's, so only it can count them, and it picks the family by the LANE the input was queued on (a `later`
@@ -404,7 +405,7 @@ export interface EngineNotice {
      *    per-run identity, the key this account is actually about — see
      *    {@link undrainedUserInputNotices}; all omitted when the caller has none, never fabricated). A delegated child
      *    leg is announced on its PARENT's session as well — the direct parent only — as a second row per family,
-     *    `detail: { steer | followUp, cause, taskId?, sessionId: <the parent's>, childSessionId }` (no `runId`: nothing
+     *    `detail: { <countKey>, cause, taskId?, sessionId: <the parent's>, childSessionId }` (no `runId`: nothing
      *    carries the parent's), message tail `(a child leg, <childSessionId>)`; `childSessionId` present = a child reported it.
      *    Per-run, at most once per family (the terminal sweep is a single site) — which is why
      *    `taskId`/`sessionId` cannot key it: both answer the same value for two runs of one session.
@@ -971,6 +972,22 @@ export declare function settleOwedUserInput(account: OwedUserInputAccount, rowRe
  */
 export declare const USER_INPUT_UNDRAINED_CAUSES: readonly ["leg_end", "crashed"];
 export type UserInputUndrainedCause = (typeof USER_INPUT_UNDRAINED_CAUSES)[number];
+/**
+ * The two families of the stranded-input account, keyed by the lane the input was queued on (`injectionLaneOf` maps a steer's
+ * tier to it): the notice `code` the family is announced under, and the `detail` key that carries its count
+ * (`detail[countKey]`, beside `cause`). {@link undrainedUserInputNotices} writes its rows with exactly these two spellings, so a
+ * serving layer that mints the `crashed` arm picks its family by lane and spells code and count key the way the engine does.
+ */
+export declare const USER_INPUT_UNDRAINED_FAMILIES: Readonly<{
+    readonly steer: Readonly<{
+        readonly code: "task.user_steer_undrained";
+        readonly countKey: "steer";
+    }>;
+    readonly followUp: Readonly<{
+        readonly code: "task.user_followup_undrained";
+        readonly countKey: "followUp";
+    }>;
+}>;
 /** Where a child leg's account is ALSO announced: its spawner's session, and that run's task id when the spawner carried one
  *  (it never carries the run id, and the row never invents one). */
 interface ParentLegIds {

package/dist/core/engine-notice.js

@@ -52,6 +52,12 @@ export function settleOwedUserInput(account, rowReturned, ids, onNotice) {
 }
 const SETTLED_OWED_ACCOUNTS = new WeakSet();
 export const USER_INPUT_UNDRAINED_CAUSES = Object.freeze(["leg_end", "crashed"]);
+const STEER_UNDRAINED = "task.user_steer_undrained";
+const FOLLOWUP_UNDRAINED = "task.user_followup_undrained";
+export const USER_INPUT_UNDRAINED_FAMILIES = Object.freeze({
+    steer: Object.freeze({ code: STEER_UNDRAINED, countKey: "steer" }),
+    followUp: Object.freeze({ code: FOLLOWUP_UNDRAINED, countKey: "followUp" }),
+});
 export function parentLegIds(internals) {
     const parentSessionId = internals?.parentSessionId;
     if (typeof parentSessionId !== "string" || parentSessionId === "")
@@ -73,17 +79,17 @@ export function undrainedUserInputNotices(counts, taskId, sessionId, runId, pare
     const cause = "leg_end";
     if (counts.steer > 0) {
         const message = `${counts.steer} user steer(s) ${tail}`;
-        const count = { steer: counts.steer, cause };
-        own.push({ code: "task.user_steer_undrained", message, detail: { ...count, ...tid, ...sid, ...rid } });
+        const count = { [USER_INPUT_UNDRAINED_FAMILIES.steer.countKey]: counts.steer, cause };
+        own.push({ code: STEER_UNDRAINED, message, detail: { ...count, ...tid, ...sid, ...rid } });
         if (toParent)
-            copies.push({ code: "task.user_steer_undrained", message: `${message}${copyTail}`, detail: { ...count, ...ptid, sessionId: parentSession, childSessionId: sessionId } });
+            copies.push({ code: STEER_UNDRAINED, message: `${message}${copyTail}`, detail: { ...count, ...ptid, sessionId: parentSession, childSessionId: sessionId } });
     }
     if (counts.followUp > 0) {
         const message = `${counts.followUp} user follow-up(s) ${tail}`;
-        const count = { followUp: counts.followUp, cause };
-        own.push({ code: "task.user_followup_undrained", message, detail: { ...count, ...tid, ...sid, ...rid } });
+        const count = { [USER_INPUT_UNDRAINED_FAMILIES.followUp.countKey]: counts.followUp, cause };
+        own.push({ code: FOLLOWUP_UNDRAINED, message, detail: { ...count, ...tid, ...sid, ...rid } });
         if (toParent)
-            copies.push({ code: "task.user_followup_undrained", message: `${message}${copyTail}`, detail: { ...count, ...ptid, sessionId: parentSession, childSessionId: sessionId } });
+            copies.push({ code: FOLLOWUP_UNDRAINED, message: `${message}${copyTail}`, detail: { ...count, ...ptid, sessionId: parentSession, childSessionId: sessionId } });
     }
     return [...own, ...copies];
 }

package/dist/core/gate-lanes.js

@@ -40,6 +40,7 @@ export async function runGateLanes(pass) {
         writeProtected: pass.writeProtected === true,
         writeProtectionUnresolved: pass.writeProtectionUnresolved === true,
     });
+    const readFaceNow = input.readFace?.();
     const askOriginFacts = (org, ruleCallUnreadable) => ({
         contentQuestion: heldBy("lanes.contentQuestionClass", QUESTION_TOOL_NAMES, pass.req),
         markedUnresolvable: markedUnresolvable(),
@@ -49,6 +50,7 @@ export async function runGateLanes(pass) {
         mandateMarks: mandateMarksNow(),
         ...(input.toolMarkSources !== undefined ? { toolMarkSources: input.toolMarkSources } : {}),
         ...(input.a2aIsolatePeers === true ? { a2aIsolatePeers: true } : {}),
+        ...(readFaceNow !== undefined ? { readFace: readFaceNow } : {}),
     });
     const classifyStanding = (unstamped, facts) => (pass.askClassification = classifyAsk(unstamped, facts));
     let orgTightenCount = 0;