@sema-agent/core 7.44.0 → 7.46.0

package/dist/core/runner/persisted-path-rows.js

@@ -1,7 +1,6 @@
 import { ownerStoreOf } from "../permission-rule-provider.js";
-import { PATH_RULE_FACES, READ_RULE_TOOL, eligiblePersisted, isUsablePathBase, ruleBasesNeeded } from "../permission-rule-model.js";
-import { isAbsolutePathForm, pathFamilyOf } from "../../tools/fs/safety.js";
-import { pathRuleDenyRowOf } from "../permission-rules.js";
+import { PATH_RULE_FACES, READ_RULE_TOOL, eligiblePersisted } from "../permission-rule-model.js";
+import { bindPathRules, persistedRowAnchors, projectScopeIdentity } from "../path-rule-binding.js";
 import { inlineUntrusted } from "../untrusted-text.js";
 import { DEFAULT_GATE_AWAIT_TIMEOUT_MS, gateWaitFailureOf, withGateTimeout } from "../gate-bounded-await.js";
 import { thrownText } from "../thrown-value.js";
@@ -21,11 +20,11 @@ export async function persistedPathRowsOf(cfg) {
     }
     if (view.unreadable !== undefined)
         skipped(cfg, view.unreadable, view.unreadableSources);
-    const call = { tool: READ_RULE_TOOL, cwd: cfg.root, sessionId: cfg.sessionId };
-    const bases = { root: cfg.root, ...(cfg.home !== undefined && isAbsolutePathForm(cfg.home) ? { home: cfg.home } : {}) };
-    const family = pathFamilyOf(bases);
+    cfg.onRowsDropped(view.droppedRows);
+    const scopeIdentity = await projectScopeIdentity(view.rules, cfg.rootCanonical, cfg.leads);
+    const call = { tool: READ_RULE_TOOL, cwd: cfg.root, sessionId: cfg.sessionId, ...(scopeIdentity !== undefined ? { scopeIdentity } : {}) };
     const readDirectories = [];
-    const denyRows = [];
+    const denySpecs = [];
     for (const rule of view.rules) {
         if (rule.status !== "live")
             continue;
@@ -37,12 +36,15 @@ export async function persistedPathRowsOf(cfg) {
         const faces = PATH_RULE_FACES[rule.tool]?.deny;
         if (rule.behavior !== "deny" || faces === undefined || (rule.match !== "path" && rule.match !== "subpath") || !eligiblePersisted(rule, { ...call, tool: rule.tool }, "deny"))
             continue;
-        const missing = ruleBasesNeeded(rule).filter((b) => !isUsablePathBase(b === "cwd" ? bases.root : bases[b], family));
-        if (missing.length > 0) {
-            cfg.onDisclosure(`the persisted deny rule ${inlineUntrusted(rule.rule, 200)} needs a ${missing.join(" / ")} base this task does not declare — the shell's file commands and the search tools do not judge it on this leg`);
+        denySpecs.push({ parsed: rule, ruleText: rule.rule, faces, rule });
+    }
+    const denyRows = [];
+    for (const row of bindPathRules(denySpecs, (spec) => persistedRowAnchors(spec.rule.scope, cfg.chainTop))) {
+        if (row.unanchored !== undefined) {
+            cfg.onDisclosure(`the persisted deny rule ${inlineUntrusted(row.rule, 200)} needs a ${row.unanchored.join(" / ")} base this task does not declare — the shell's file commands and the search tools do not judge it on this leg`);
             continue;
         }
-        denyRows.push(pathRuleDenyRowOf({ parsed: rule, ruleText: rule.rule, faces }, bases));
+        denyRows.push(row);
     }
     return { readDirectories, denyRows };
 }
@@ -68,6 +70,20 @@ export function ruleStoreUnreadableNotice(onNotice, ids) {
         deliverEngineNotice(onNotice, { code: "permission.rule_store_unavailable", message: SKIPPED_STORE_SENTENCE[at](which), detail: { at, sessionId: ids.sessionId, runId: ids.runId } });
     };
 }
+export function ruleRowsDroppedNotice(onNotice, ids) {
+    let sent = false;
+    return (rows) => {
+        if (sent || rows === undefined || rows.length === 0)
+            return;
+        sent = true;
+        const one = rows.length === 1;
+        deliverEngineNotice(onNotice, {
+            code: "permission.rule_row_dropped",
+            message: `${rows.length} of your persisted permission rule rows ${one ? "is" : "are"} scoped to a project directory that is not written as a complete absolute path, so ${one ? "it takes" : "they take"} no part in this run's checks — a deny or ask row among them protects nothing. Rewrite ${one ? "it" : "them"} with the project's full path, or remove ${one ? "it" : "them"} (this notice's detail names ${one ? "it" : "them"}).`,
+            detail: { rows: rows.slice(0, 8).map((r) => ({ rule: inlineUntrusted(r.rule, 200), scopeRoot: inlineUntrusted(r.scopeRoot, 200) })), count: rows.length, sessionId: ids.sessionId, runId: ids.runId },
+        });
+    };
+}
 function readsPersistedPathRows(provider, principal, localOwnerDeclared) {
     return provider.partitions.durable && ((principal !== undefined && principal !== "") || localOwnerDeclared);
 }
@@ -81,9 +97,12 @@ export function persistedPathRowsOfTask(t) {
         principal: t.principal,
         sessionId: t.sessionId,
         root: t.root,
-        home: t.home,
+        rootCanonical: t.rootCanonical,
+        leads: t.leads,
+        chainTop: t.chainTop,
         onDisclosure: (message) => emitTrace(t.deps.tracer, () => ({ kind: "permission.rule_store_unreadable", version: 1, taskId: t.taskId, message, ts: Date.now() })),
         onUnread: t.onUnread,
+        onRowsDropped: t.onRowsDropped,
         signal: AbortSignal.any([...t.signals]),
     });
 }

package/dist/core/runner/prepare-ask-lane.d.ts

@@ -1,3 +1,4 @@
+import type { CallTargetStamp } from "../effective-path-target.js";
 import type { AgentTool } from "../../internal/harness.js";
 import type { AdvertisedWritableDirs } from "./advertised-writable-dirs.js";
 import type { AutoModeDenialTracker } from "../auto-mode.js";
@@ -28,6 +29,11 @@ export interface PrepareAskLaneInput {
     /** borrowed-readonly — the hand's live tracked cwd, or undefined (hands-less). Read per call at RUN time (`current`),
      *  never captured: the fs hand tools resolve their relative paths against this very ref. Not written here. */
     handsCwdRef: CwdRef | undefined;
+    /** borrowed-readonly — the root the hand tools resolve root-relative spellings against, or undefined (hands-less). */
+    handsRoot: string | undefined;
+    /** borrowed-readonly — the leg's target-reading stamp ({@link CallTargetStamp}), or undefined (hands-less): the request a
+     *  policy judges carries a reading of its own args. Called at RUN time; a seat with nothing to stamp answers undefined. */
+    stampCallTarget: CallTargetStamp | undefined;
     /** borrowed-readonly — the run's advertised-writable-directory seat, or undefined (hands-less / nothing advertised). `roots` is read at RUN time, never captured: it is the fence's own admitted list and the write gate's exemption domain must be that same list. Not written here. */
     advertisedWritableDirs: Pick<AdvertisedWritableDirs, "roots"> | undefined;
     /** borrowed-readonly — the shared mount roster; read at RUN time by the approval-preview projection (alias-aware

package/dist/core/runner/prepare-ask-lane.js

@@ -59,14 +59,16 @@ function resolveApprovalPreview(tools, toolName, args) {
     }
 }
 export function prepareAskLane(input) {
-    const { gateMachineryActive, abortController, effectivePolicy, budgetSnapshot, handsCwdRef, advertisedWritableDirs, tools, inheritedUnavailableAsks, inheritedAskGrants, onAsk, humanReviewRef, now, ruleOffersOf, grantBindingOf, askSourceIdentity, riskAxesOf, autoModeDenialTracking, spec, deps, sessionId, runId, hooks, hookTimeoutMs, notifyOwnHookCrash, grantReadRoot } = input;
+    const { gateMachineryActive, abortController, effectivePolicy, budgetSnapshot, handsCwdRef, handsRoot, stampCallTarget, advertisedWritableDirs, tools, inheritedUnavailableAsks, inheritedAskGrants, onAsk, humanReviewRef, now, ruleOffersOf, grantBindingOf, askSourceIdentity, riskAxesOf, autoModeDenialTracking, spec, deps, sessionId, runId, hooks, hookTimeoutMs, notifyOwnHookCrash, grantReadRoot } = input;
     if (!gateMachineryActive)
         return { askLane: undefined };
     const composedCallSignal = (callSignal) => composeCallSignal(abortController.signal, callSignal);
     const adjudicate = effectivePolicy
         ? (req, callSignal) => {
             const signal = composedCallSignal(callSignal);
-            return raceAbort(Promise.resolve(effectivePolicy.check({ ...req, budget: budgetSnapshot, ...(handsCwdRef !== undefined ? { cwd: handsCwdRef.current } : {}), ...advertisedWritableRootsSeat(advertisedWritableDirs) }, signal)), signal, () => ({
+            const stampedReq = () => ({ ...req, budget: budgetSnapshot, ...(handsCwdRef !== undefined ? { cwd: handsCwdRef.current } : {}), ...(handsRoot !== undefined ? { root: handsRoot } : {}), ...advertisedWritableRootsSeat(advertisedWritableDirs) });
+            const withReading = stampCallTarget?.(stampedReq(), signal);
+            return raceAbort(withReading === undefined ? Promise.resolve(effectivePolicy.check(stampedReq(), signal)) : withReading.then((r) => effectivePolicy.check(r, signal)), signal, () => ({
                 action: "deny",
                 message: "policy check aborted (task timed out or cancelled)",
             }));

package/dist/core/runner/prepare-config-doors.js

@@ -14,6 +14,7 @@ import { applyToolModelGate, assertRestoreGatedToolsValue, modelIdTail } from ".
 import { resolveUsageWindows } from "../usage-window-store.js";
 import { deriveAskEffective, resolveAskSeat, resolveQuestionSeam } from "../wiring-manifest.js";
 import { assertPeerPresenceValue } from "../../agents/peer-directory.js";
+import { snapshotDefinitionLists } from "../../agents/tool-filter.js";
 import { TOTAL_TOKENS_REMINDER_MODES } from "./turn-attachments.js";
 const TASK_LIMIT_KEY_DICT = {
     maxTokens: true,
@@ -359,9 +360,10 @@ export function prepareConfigDoors(input) {
             e.code = "config.agents.no_delegation_tool";
             throw e;
         }
-        const perTask = spec.agents;
+        const perTask = spec.agents.map(snapshotDefinitionLists);
         spec = {
             ...spec,
+            agents: perTask,
             tools: pool.map((t) => {
                 if (typeof t.withAgents !== "function")
                     return t;

package/dist/core/runner/prepare-execution-env.d.ts

@@ -1,6 +1,6 @@
 import type { ExecutionEnv } from "../../internal/harness.js";
 import type { RunnerDeps, TaskSpec } from "../types.js";
-import type { PrepareResume, RollbackStack, RunInternals } from "./contracts.js";
+import type { ChildPlacement, PrepareResume, RollbackStack, RunInternals } from "./contracts.js";
 /**
  * The ONE reference to a factory-minted env, shared by the driver's detach guard and the rollback entry
  * this phase registers. `current` is the minted env, or `undefined` when the run has none / after the
@@ -19,7 +19,7 @@ export interface PrepareExecutionEnvInput {
     spec: Pick<TaskSpec, "taskId">;
     /** borrowed-readonly — the trusted spawn-side requests: the explicit cwd (a contract), the isolation
      *  request and the parent's cwd (both threaded to the factory ctx). */
-    internals: Pick<RunInternals, "requestedCwd" | "isolation" | "parentCwd"> | undefined;
+    internals: Pick<RunInternals, "requestedCwd" | "isolation" | "parentCwd" | "callerRoot" | "worktreeOffered"> | undefined;
     /** borrowed-readonly — the resume leg, read only to refuse an explicit cwd that a checkpoint workspace
      *  restore would overrule. */
     resume: Pick<PrepareResume, "workspaceHandle"> | undefined;
@@ -50,5 +50,8 @@ export interface PrepareExecutionEnvResult {
     /** borrowed-readonly — the INITIAL task root (the workspace-restore phase may re-root it and returns the
      *  settled root under the NEW name `taskRootFinal`). */
     taskRootInitial: string;
+    /** borrowed-readonly — where a CHILD landed against where its caller asked ({@link childPlacementOnLeg}); absent on a leg no
+     *  delegation caller placed (no `callerRoot`). */
+    placement: ChildPlacement | undefined;
 }
 export declare function prepareExecutionEnv(input: PrepareExecutionEnvInput): Promise<PrepareExecutionEnvResult>;

package/dist/core/runner/prepare-execution-env.js

@@ -1,12 +1,13 @@
 import { StubExecutionEnv } from "../stub-env.js";
 import { hasDestroy } from "../remote-env.js";
 import { announceMalformedCapabilities } from "./env-capability-census.js";
+import { childPlacementOnLeg, deploymentCanRerootChild, worktreeNotHonored } from "./child-tree.js";
 import { settleTeardownLeg } from "./teardown-bounded.js";
 export async function prepareExecutionEnv(input) {
     const { deps, spec, internals, resume, placementRootResolved, sessionId, forgetOnThrow, rollback } = input;
     let ownedEnv;
     let ownedEnvObservedAt;
-    if (internals?.requestedCwd !== undefined && deps.executionEnvFactory === undefined) {
+    if (internals?.requestedCwd !== undefined && !deploymentCanRerootChild(deps)) {
         await settleTeardownLeg(() => forgetOnThrow(), "forgetOnThrow (cwd-unsupported leg)", (err) => deps.onError?.(err, { phase: "config", sessionId }));
         const e = new Error(`Agent cwd "${internals.requestedCwd}" cannot take effect: this deployment has no executionEnvFactory (a static execution environment cannot be re-rooted per agent). Drop the cwd parameter or deploy a factory.`);
         e.code = "config.cwd_unsupported";
@@ -68,8 +69,15 @@ export async function prepareExecutionEnv(input) {
         }
     }
     const handsEnabled = ownedEnv !== undefined || deps.executionEnv !== undefined;
-    const taskRootInitial = internals?.isolation === "worktree" || internals?.requestedCwd !== undefined || !deps.rootPath ? executionEnv.cwd : deps.rootPath;
-    return { executionEnv, ownedEnvSeat, ownedEnvObservedAt, handsEnabled, taskRootInitial };
+    const taskRootInitial = internals?.isolation === "worktree" || internals?.requestedCwd !== undefined || internals?.worktreeOffered === true || !deps.rootPath ? executionEnv.cwd : deps.rootPath;
+    const placement = internals?.callerRoot === undefined ? undefined : await childPlacementOnLeg(executionEnv, { ...internals, callerRoot: internals.callerRoot }, taskRootInitial);
+    if (internals?.worktreeOffered === true && placement === "caller_tree") {
+        await settleTeardownLeg(() => forgetOnThrow(), "forgetOnThrow (worktree-not-honored leg)", (err) => deps.onError?.(err, { phase: "config", sessionId }));
+        await settleTeardownLeg(() => (ownedEnv && hasDestroy(ownedEnv) ? ownedEnv.destroy() : undefined), "ownedEnv.destroy (worktree-not-honored leg)", (err) => deps.onError?.(err, { phase: "config", sessionId }));
+        ownedEnvSeat.current = undefined;
+        throw worktreeNotHonored(executionEnv.cwd);
+    }
+    return { executionEnv, ownedEnvSeat, ownedEnvObservedAt, handsEnabled, taskRootInitial, placement };
 }
 function cwdConflictsRestoreError(requestedCwd) {
     const e = new Error(`RunInternals.requestedCwd ("${requestedCwd}") cannot be combined with a checkpoint workspace restore — ` +

package/dist/core/runner/prepare-gate-stations.d.ts

@@ -24,6 +24,7 @@
  * gate outcome; nothing here changes a word, a source or an order — the stations are moved, not re-adjudicated.
  */
 import type { AgentHarness, AgentTool } from "../../internal/harness.js";
+import type { CallTargetStamp } from "../effective-path-target.js";
 import type { AskClass } from "../ask-class.js";
 import type { Arbitration, ToolMarkSource } from "../ask-origin.js";
 import { type PermissionModeController } from "../mode-policy.js";
@@ -37,6 +38,7 @@ import { type WiringManifest } from "../wiring-manifest.js";
 import type { WriteProtectionCheck } from "../write-protect.js";
 import type { ShellReadCheck } from "../../tools/fs/shell-read-check.js";
 import type { CwdRef } from "../../tools/fs/fs-shared.js";
+import type { ContainmentFace } from "../../tools/fs/containment-face.js";
 import type { AskLane, GateSeatInputsFor, IrreversibilityTier, ParkAsk, Prepared, ReversibilityProbes, StopForDenialLimit } from "./contracts.js";
 import type { PermissionRuleLanes } from "./permission-rule-lanes.js";
 import { type ToolRosterDeltaSeat } from "../tool-roster.js";
@@ -151,6 +153,8 @@ export interface PrepareGateStationsInput {
     /** borrowed-readonly — the hand's live tracked cwd, or undefined; `current` is read per screening / per post seat. Not
      *  written here. */
     handsCwdRef: CwdRef | undefined;
+    /** borrowed-readonly — the leg's target-reading stamp, or undefined (hands-less): the gate stamps its request with it. */
+    stampCallTarget: CallTargetStamp | undefined;
     /** borrowed-readonly — the leg's read-deny table in force, read at a release: the active built-in tiers and the rows
      *  beside them (the deployment's and the task's patterns, the read-face rule rows). Empty ⇒ no table. */
     readDenyInForce: () => {
@@ -167,6 +171,8 @@ export interface PrepareGateStationsInput {
     /** borrowed-readonly — the leg's shell READ STATION (`ToolGateInput.shellReadCheck`), mounted by the hands phase, or
      *  undefined with no real shell: no station, nothing judged. */
     shellReadCheck: ShellReadCheck | undefined;
+    /** borrowed-readonly — the leg's resolved read face (`undefined` with no hands), read per call into the class derivation. */
+    readFace: () => ContainmentFace | undefined;
     /** borrowed-readonly — the per-tool irreversibility tier handed to the gate per call. */
     irreversibilityTier: IrreversibilityTier;
     /** borrowed-readonly — the per-tool reversibility probes handed to the gate per call. */

package/dist/core/runner/prepare-gate-stations.js

@@ -46,7 +46,7 @@ export function maybeHumanRejectionHalt(input) {
     };
 }
 export function prepareGateStations(input) {
-    const { askLane, parkAsk, tools, toolRosterDeltas, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, hooks, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, gateOutcomes, batchHaltRef, blockedTracked, hookIdentity, reminderMark, hostTaskId, sessionId, ownGatePreToolUse, hookTimeoutMs, handsCwdRef, hookEnvFace, writeProtectionCheck, shellReadCheck, irreversibilityTier, reversibilityProbes, abortController, shellGatedTools, autoModeDecider, autoModeDenialTracking, askRoute, permissionMode, toolMarkSources, a2aIsolatePeers, ancestorArbitrations, runId, stopForDenialLimit, permissionRuleLane, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, notifyOwnHookCrash, frameSettlement, seatInputsFor } = input;
+    const { askLane, parkAsk, tools, toolRosterDeltas, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, hooks, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, gateOutcomes, batchHaltRef, blockedTracked, hookIdentity, reminderMark, hostTaskId, sessionId, ownGatePreToolUse, hookTimeoutMs, handsCwdRef, stampCallTarget, hookEnvFace, writeProtectionCheck, shellReadCheck, readFace, irreversibilityTier, reversibilityProbes, abortController, shellGatedTools, autoModeDecider, autoModeDenialTracking, askRoute, permissionMode, toolMarkSources, a2aIsolatePeers, ancestorArbitrations, runId, stopForDenialLimit, permissionRuleLane, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, notifyOwnHookCrash, frameSettlement, seatInputsFor } = input;
     const gatePreToolUse = ownGatePreToolUse !== undefined ? (name, args, ctx) => ownGatePreToolUse(name, args, { ...ctx, permissionMode: permissionMode.observed }) : undefined;
     const releasesAnnounced = new Map();
     const onModeReleased = (info) => {
@@ -120,6 +120,7 @@ export function prepareGateStations(input) {
                         ...(gatePreToolUse !== undefined ? { preToolUse: gatePreToolUse } : {}),
                         hookTimeoutMs,
                         ...(handsCwdRef !== undefined ? { trackedCwd: () => handsCwdRef.current } : {}),
+                        ...(stampCallTarget !== undefined ? { stampCallTarget } : {}),
                         ...(hookEnvFace !== undefined ? { hookEnv: hookEnvFace } : {}),
                         toolFaceOf: (name) => toolCallFaceOf(toolRosterDeltas.current, name === e.toolName ? called.toolName : name),
                         adjudicate,
@@ -130,6 +131,7 @@ export function prepareGateStations(input) {
                         peerMessage: heldBy("gate.peerMessage", PEER_MESSAGE_NAMES, call),
                         ...(writeProtectionCheck !== undefined ? { writeProtectionCheck } : {}),
                         ...(shellReadCheck !== undefined ? { shellReadCheck } : {}),
+                        readFace,
                         irreversibility: tierSeat?.value,
                         reversibilityProbe: tierSeat?.read(reversibilityProbes),
                         abortSignal: abortController.signal,

package/dist/core/runner/prepare-hands-readface.d.ts

@@ -1,6 +1,7 @@
 import { type BeforeWriteHook, type CwdRef, type PathRuleDenyRow, type ContainmentFace } from "../../tools/fs/index.js";
 import { type ReadFileState } from "../../tools/fs/safety.js";
 import { type PlacedReadDenyMatcher } from "../../tools/fs/read-deny-home.js";
+import type { HeadLeads } from "../path-rule-binding.js";
 import { type ShellReadAdmission, type ShellReadCheck } from "../../tools/fs/shell-read-check.js";
 import type { ShellReadBoundary } from "../../tools/fs/shell-read-judge.js";
 import type { RunnerDeps, ShellGateDoctrine, TaskSpec } from "../types.js";
@@ -54,9 +55,12 @@ export interface PrepareHandsReadFaceInput {
     /** borrowed-readonly — the registry scope (`internals?.registryScope ?? spec.principal ??
      *  "default"`, computed in the driver); the band's task-registry scope. */
     taskScope: string;
-    /** borrowed-readonly — the deny tables' permission-rule rows: the path deny rules of the leg's caller policy and of every
-     *  ancestor's (`toolPolicyPathDenyRules`); joined to the read face's matcher and to the shell station's write face. */
-    pathDenyRules: readonly PathRuleDenyRow[];
+    /** borrowed-readonly — the deny tables' permission-rule rows: the face-keyed path deny rules of the leg's caller policy and
+     *  of every ancestor's, each bound where it was installed (`toolPolicyPathRules`), and the person's deny rows; joined to the
+     *  read face's matcher and to the shell station's write face. */
+    denyRuleRows: readonly PathRuleDenyRow[];
+    /** borrowed-readonly — the leg's one resolution of where rule heads lead (the rows' twins, the same the gate's lanes read). */
+    headLeads: HeadLeads;
     /** borrowed-readonly — the two judges a shell command's write targets meet for the mode's file-command placement: the
      *  leg's write-protection judge (read per judgment — it is compiled at the manifest phase, before any gate is mounted)
      *  and the chain's write-target guard (`toolPolicyWriteTargetGuard`). Absent ⇒ neither (a standalone phase drive). */
@@ -93,7 +97,7 @@ export interface PrepareHandsReadFaceInput {
      *  object (R-4: `deps.onError?.()` keeps its receiver; a new deps read must widen this Pick).
      *  `readDenyBuiltinTiers`/`readDenyBuiltinExclude` are SNAPSHOTTED before the first await that
      *  precedes the toolkit compile (the caller retains these arrays by reference). */
-    deps: Pick<RunnerDeps, "onError" | "onNotice" | "tracer" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "readFace" | "writeFace" | "permissionRuleStore" | "hands">;
+    deps: Pick<RunnerDeps, "onError" | "onNotice" | "tracer" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "agentConfigDir" | "readFace" | "writeFace" | "permissionRuleStore" | "hands">;
     /** borrowed-readonly — the trusted spawn-side seats the band forwards: the finished-command
      *  notification lane, the mid-flight detach hub, and the Runner's per-session
      *  read-state seats (absent on a standalone prepare ⇒ the transcript-replay rung covers alone). */

package/dist/core/runner/prepare-hands-readface.js

@@ -2,9 +2,9 @@ import { emitTrace } from "../trace.js";
 import { StubExecutionEnv } from "../stub-env.js";
 import { hasBackgroundShell } from "../background-shell.js";
 import { defaultTaskRegistry } from "../task-registry.js";
-import { bashReversibilityProbe, activeReadDenyBuiltinTiers, readDenyBuiltinConfigOf, compileReadDeny, compileWriteDeny, withRuleRowsWhereTheyLead, readDenySeat, createHandsToolkit, deploymentFaceClampNotice, pdfModelCapabilitiesOf, inheritSessionReadFileState, backgroundOutputReadExemption, resolveContainmentFace, seedReadFileStateFromContext, seedReadFileStateFromTranscript, } from "../../tools/fs/index.js";
+import { bashReversibilityProbe, activeReadDenyBuiltinTiers, readDenyBuiltinConfigOf, compileReadDeny, compileWriteDeny, rowsWhereTheyLead, readDenySeat, createHandsToolkit, deploymentFaceClampNotice, pdfModelCapabilitiesOf, inheritSessionReadFileState, backgroundOutputReadExemption, resolveContainmentFace, seedReadFileStateFromContext, seedReadFileStateFromTranscript, } from "../../tools/fs/index.js";
 import { resolveKey, sha256 } from "../../tools/fs/safety.js";
-import { placeReadDenyAtHome, whereItsAnsweredPrefixLeads } from "../../tools/fs/read-deny-home.js";
+import { placeReadDenyAtHome } from "../../tools/fs/read-deny-home.js";
 import { createShellOverflowSpoolFence } from "../../tools/fs/fs-shared.js";
 import { createShellReadStation } from "../../tools/fs/shell-read-check.js";
 import { composeReadChecks, createFileReadStation } from "../../tools/fs/file-read-check.js";
@@ -220,8 +220,8 @@ export async function prepareHandsMount(input) {
         const seedReadFaceSection = resume?.seed.readFace;
         const readDenyAdditions = [...(deps.readDenyPatterns ?? []), ...(spec.readDenyPatterns ?? []), ...(seedReadFaceSection?.denyEntries ?? [])];
         const readDenyBuiltinCfg = readDenyBuiltinConfigOf({ tiers: deps.readDenyBuiltinTiers, exclude: deps.readDenyBuiltinExclude });
-        const pathDenyRules = await withRuleRowsWhereTheyLead(input.pathDenyRules, (head) => whereItsAnsweredPrefixLeads(executionEnv, head));
-        const readDenyPlacement = await placeReadDenyAtHome(executionEnv, (homes, linked) => compileReadDeny(readDenyAdditions, "readDenyPatterns", readDenyBuiltinCfg, pathDenyRules, homes, linked));
+        const denyRuleRows = rowsWhereTheyLead(input.denyRuleRows, await input.headLeads.resolve(input.denyRuleRows));
+        const readDenyPlacement = await placeReadDenyAtHome(executionEnv, (homes, linked) => compileReadDeny(readDenyAdditions, "readDenyPatterns", readDenyBuiltinCfg, denyRuleRows, homes, linked), undefined, undefined, deps.agentConfigDir);
         readDenyMatcher = readDenyPlacement.matcher;
         readDenyBuiltinTiersActive = activeReadDenyBuiltinTiers(readDenyBuiltinCfg);
         readDenyAdditionsNormalized = compileReadDeny(readDenyAdditions, "readDenyPatterns", { tiers: [] }).entries;
@@ -291,7 +291,7 @@ export async function prepareHandsMount(input) {
                 }
                 : undefined;
         const denySeat = readDenySeat(readDenyMatcher);
-        const writeDeny = compileWriteDeny(pathDenyRules);
+        const writeDeny = compileWriteDeny(denyRuleRows);
         const writeDenySeat = writeDeny.ruleRows.length > 0 ? { writeDenyMatch: (p) => writeDeny.matchPath(p)?.pattern ?? null } : {};
         const shellReadBoundary = () => ({
             roots: [rootCanonical, ...additionalRootsCanonical, ...additionalReadRootsCanonical],
@@ -334,7 +334,7 @@ export async function prepareHandsMount(input) {
             ...(additionalRootsCanonical.length > 0 ? { additionalRoots: additionalRootsCanonical } : {}),
             additionalReadRoots: additionalReadRootsCanonical,
             ...(readDenyAdditions.length > 0 ? { readDenyPatterns: readDenyAdditions } : {}),
-            ...(pathDenyRules.length > 0 ? { pathDenyRules } : {}),
+            ...(denyRuleRows.length > 0 ? { pathDenyRules: denyRuleRows } : {}),
             readDenyHomes: readDenyPlacement.homes,
             readDenyHomeLinks: readDenyPlacement.linked,
             ...(readDenyBuiltinCfg.tiers !== undefined ? { readDenyBuiltinTiers: readDenyBuiltinCfg.tiers } : {}),

package/dist/core/runner/prepare-inherited-gate.d.ts

@@ -43,7 +43,8 @@ import type { OwnOrgAdmissionVerdict } from "../memory-admission.js";
 import type { DelegationContentSafety } from "../memory-engine/delegation-provenance.js";
 import { type SessionPermissionRules } from "../session-policy-store.js";
 import type { SessionStore } from "../session.js";
-import { type OnAsk } from "../tool-policy.js";
+import { type OnAsk, type ToolPolicy } from "../tool-policy.js";
+import type { PathRuleBases } from "../permission-rule-model.js";
 import type { PermissionMode, RunnerDeps, RuntimeCaps, ShellGateDoctrine, TaskEvent, TaskSpec, ToolExecuteContext, ToolSpec } from "../types.js";
 import { PermissionModeController } from "../mode-policy.js";
 import { type SkillGrantTable } from "../skill-grant.js";
@@ -89,6 +90,12 @@ export interface PrepareInheritedGateInput {
     ownedEnv: ExecutionEnv | undefined;
     /** borrowed-readonly — the frozen preflight; only `toolPolicy` (the RESOLVED caller policy the children's chain carries). */
     lockedPreflight: Pick<LockedPreflight, "toolPolicy">;
+    /** borrowed-readonly — the chain's top leg's anchors as this leg reads them (handed on to children), and how this leg
+     *  installs the policies its chain hands it (`chainPolicyOnLeg`). */
+    pathRuleAnchors: {
+        readonly chainTop: PathRuleBases;
+        readonly onLeg: (policy: ToolPolicy, position: number) => ToolPolicy;
+    };
     /** borrowed-readonly — the frozen tool-face snapshot (the ctx forwards exclude / defer / alwaysLoad / restoreGated; the
      *  full-shell predicate reads the exclusion of Bash). */
     toolFaceSnapshot: ToolFaceSnapshot;

package/dist/core/runner/prepare-inherited-gate.js

@@ -5,6 +5,7 @@ import { createPreToolUseConstraintPolicy } from "../hooks.js";
 import { continuesLineage } from "../session-policy-store.js";
 import { StubExecutionEnv } from "../stub-env.js";
 import { askApproverIdentity, durableMandateSourceOf } from "../tool-policy.js";
+import { chainAnchorRecords } from "./child-tree.js";
 import { deliverEngineNotice } from "../types.js";
 import { PermissionModeController, modeRequestAfterResume } from "../mode-policy.js";
 import { SessionModeSeats } from "./session-mode-seats.js";
@@ -13,7 +14,7 @@ import { frozenSkillGrants } from "../skill-grant.js";
 import { attachRebuiltDenialTrackers, createDenialLimitStop } from "./denial-limit-arms.js";
 import { asThrownError } from "../thrown-value.js";
 export function prepareInheritedGate(input) {
-    const { spec, deps, askSeat, internals, resume, sessions, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, ownedEnv, lockedPreflight, toolFaceSnapshot, mountsCallerTool, promptProfile, resolvedInteractionPosture, permissionModeSeat, handsEnabled, reportUsage, harnessRef, skillGrants, forwardEvent, subagentRetain, worktreeIsolation, requestReview, requestStopAfterTurn, enterPlanMode, reminderMark, reminderDisclosureCounts, fileHistoryEnabled, historyScope, historyRoot, historyFs, abortRun } = input;
+    const { spec, deps, askSeat, internals, resume, sessions, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, ownedEnv, lockedPreflight, pathRuleAnchors, toolFaceSnapshot, mountsCallerTool, promptProfile, resolvedInteractionPosture, permissionModeSeat, handsEnabled, reportUsage, harnessRef, skillGrants, forwardEvent, subagentRetain, worktreeIsolation, requestReview, requestStopAfterTurn, enterPlanMode, reminderMark, reminderDisclosureCounts, fileHistoryEnabled, historyScope, historyRoot, historyFs, abortRun } = input;
     const liveInheritedGate = internals?.inheritedGate;
     const seedInheritedGate = resume?.seed.inheritedGate;
     const inheritedAncestorRules = (() => {
@@ -35,7 +36,11 @@ export function prepareInheritedGate(input) {
     })();
     const modeSeed = recordedModeSeed(seedInheritedGate);
     const inheritedShellGate = liveInheritedGate?.shellGate ?? modeSeed.shellGate;
-    const chainView = askSeat.reach === "none" ? liveInheritedGate?.parentConstraints?.map((pc) => (typeof pc.onAsk === "function" ? ((({ onAsk: _person, ...rest }) => rest)(pc)) : pc)) : liveInheritedGate?.parentConstraints;
+    const askView = askSeat.reach === "none" ? liveInheritedGate?.parentConstraints?.map((pc) => (typeof pc.onAsk === "function" ? ((({ onAsk: _person, ...rest }) => rest)(pc)) : pc)) : liveInheritedGate?.parentConstraints;
+    const chainView = askView?.map((pc, position) => {
+        const policy = pathRuleAnchors.onLeg(pc.policy, position);
+        return policy === pc.policy ? pc : { ...pc, policy };
+    });
     const inheritedParentConstraints = attachRebuiltDenialTrackers(chainView, deps.autoMode?.denialLimit);
     const parentSeat = liveInheritedGate?.permissionModeCeiling;
     const ceiling = parentSeat ?? liveInheritedGate?.permissionMode;
@@ -186,6 +191,7 @@ export function prepareInheritedGate(input) {
             permissionMode: permissionMode.current,
             permissionModeCeiling: legModeCeiling,
             ...(parentConstraints.length > 0 ? { parentConstraints } : {}),
+            ...chainAnchorRecords(pathRuleAnchors.chainTop, parentConstraints),
             admittedOrgScopes: memoryAdmittedOrgScopesRef.current,
             ...(orgGovernedProvenance ? { orgAdmissionGoverned: true } : {}),
         };

package/dist/core/runner/prepare-listings.d.ts

@@ -1,6 +1,6 @@
 /**
- * PrepareTask's LISTINGS phase: the per-task agent definitions' tool-name audit
- * (deny entries fail loud, allow entries advise), the agent-listing announce face read off the
+ * PrepareTask's LISTINGS phase: the sub-agent tool lists' audit (`sub-agent-deny-lists.ts`),
+ * the agent-listing announce face read off the
  * delegation tool's roster (with its deferred / excluded / removal-to-zero arms), the two listing
  * opt-out advisories, the announced-listings mirror seeded from the once-per-session ledger, the
  * deferred roster's ToolSearch ride, and the date_change seam. The body is the driver's stretch moved
@@ -10,8 +10,8 @@
  * the disclosure mount before it and the context-lane seats after it (a stretch
  * with no await is extracted as a sync function — an `async` wrapper would open a microtask window).
  *
- * Throws pass through unchanged: `config.agent.unknown_tool` (a deny entry naming a tool this
- * deployment does not mount — a typo there would silently guard nothing).
+ * Throws pass through unchanged: `config.agent.unknown_tool` (a denied-tools entry that names no
+ * tool — one judgment for every list a deployment writes, in `sub-agent-deny-lists.ts`).
  */
 import type { AgentTool } from "../../internal/harness.js";
 import type { TaskSpec } from "../types.js";

package/dist/core/runner/prepare-listings.js

@@ -1,30 +1,10 @@
 import { formatLocalDate } from "../../prompts/default.js";
+import { auditSubAgentToolLists } from "./sub-agent-deny-lists.js";
 import { SKILL_TOOL_NAME } from "./synthetic-tools.js";
 import { renderAgentListingDelta } from "./turn-attachments.js";
 export function prepareListings(input) {
     const { spec, tools, onceLedger, sessionId, toolFaceSnapshot, activeTools, resume, skillsListing, listingBudget, listingRideRef, renderWithDate, envFacts, tzValid, userTz, dateAnchor } = input;
-    if (spec.agents !== undefined && spec.agents.length > 0) {
-        const known = new Set(tools.flatMap((t) => [t.name, ...(t.aliases ?? [])]));
-        for (const def of spec.agents) {
-            const unknownAllow = (def.allowTools ?? []).filter((n) => n !== "*" && !known.has(n));
-            if (unknownAllow.length > 0) {
-                try {
-                    onceLedger.onError(new Error(`TaskSpec.agents: agent "${def.name}" allows tool(s) ${unknownAllow.join(", ")} not present in this task's assembled roster — likely a typo (the entry would be item-filtered at spawn; the agent stays usable). Advisory only: the delegation pool can differ from this roster, so a tool mounted only on the delegation tool or produced by per-spawn extraTools makes this spurious.`), { phase: "config", sessionId });
-                }
-                catch {
-                }
-            }
-            for (const n of def.denyTools ?? []) {
-                if (n === "*")
-                    continue;
-                if (!known.has(n)) {
-                    const e = new Error(`TaskSpec.agents: agent "${def.name}" declares tool "${n}" in its denied tools, but no such tool exists in this deployment — fix the agent's tools list or mount the tool.`);
-                    e.code = "config.agent.unknown_tool";
-                    throw e;
-                }
-            }
-        }
-    }
+    auditSubAgentToolLists({ spec, tools, onceLedger, sessionId });
     const rosterBearingSpec = (spec.tools ?? []).find((t) => t.agentListing !== undefined && t.agentListing.length > 0);
     const rosterFaceDeferred = rosterBearingSpec !== undefined &&
         !(toolFaceSnapshot.exclude?.includes(rosterBearingSpec.name) ?? false) &&

package/dist/core/runner/prepare-park-ask.d.ts

@@ -20,6 +20,7 @@
  * closures, so the orchestrator grows no branch.
  */
 import type { AgentHarness, AgentMessage, AgentTool, ExecutionEnv } from "../../internal/harness.js";
+import type { CallTargetStamp } from "../effective-path-target.js";
 import { type OnQuestion } from "../ask-question.js";
 import { type CheckpointStore } from "../checkpoint-store.js";
 import type { GrantBindingOf } from "../skill-grant-binding.js";
@@ -94,6 +95,10 @@ export interface PrepareParkAskInput {
     /** borrowed-readonly — the hand's live tracked cwd, or undefined; `current` is read at park time for the re-adjudication.
      *  Not written here. */
     handsCwdRef: CwdRef | undefined;
+    /** borrowed-readonly — the root the live gate stamps beside the cwd ({@link import("./prepare-ask-lane.js").PrepareAskLaneInput.handsRoot}). */
+    handsRoot: string | undefined;
+    /** borrowed-readonly — the live gate's target-reading stamp ({@link import("./prepare-ask-lane.js").PrepareAskLaneInput.stampCallTarget}). */
+    stampCallTarget: CallTargetStamp | undefined;
     /** borrowed-readonly — the SAME seat the live gate stamps from ({@link import("./prepare-ask-lane.js").PrepareAskLaneInput.advertisedWritableDirs}): a parked call's projection re-adjudication asks one question about one call, so it must ask it against the same admitted list. Read at park time, not written here. */
     advertisedWritableDirs: Pick<AdvertisedWritableDirs, "roots"> | undefined;
     /** borrowed-readonly — the run's offload store, or undefined (a volatile store holding results refuses the park). */

package/dist/core/runner/prepare-park-ask.js

@@ -27,7 +27,7 @@ const wordlessDemand = (toolName) => {
     throw new Error(`a real-approval demand for "${toolName}" reached the park with no origin word — the origin stamp precedes every park`);
 };
 export function prepareParkAsk(input) {
-    const { askLane, saga, spec, deps, sessionId, checkpointStore, toolRosterDeltas, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, advertisedWritableDirs, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedTools, irreversibilityTier, toolMarkSources, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, ruleOffersOf, grantBindingOf, now, humanReviewRef, abortController, harness, pausedRef } = input;
+    const { askLane, saga, spec, deps, sessionId, checkpointStore, toolRosterDeltas, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, handsRoot, stampCallTarget, advertisedWritableDirs, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedTools, irreversibilityTier, toolMarkSources, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, ruleOffersOf, grantBindingOf, now, humanReviewRef, abortController, harness, pausedRef } = input;
     if (askLane === undefined || saga === undefined)
         return { parkAsk: undefined };
     const { composedCallSignal, approvalPreviewOf } = askLane;
@@ -159,15 +159,17 @@ export function prepareParkAsk(input) {
                     if (!presented.ok) {
                         throw new ParkRefusal(`the stored form of "${req.toolName}"'s arguments could not be presented for re-adjudication (${describeThrown(presented.cause)})`, { cause: presented.cause });
                     }
-                    const reprojectedRaced = await raceSettlementAgainstSignal(Promise.resolve(basePolicyForResumeEdit.check({
+                    const reprojectedReq = () => ({
                         toolName: req.toolName,
                         args: presented.value,
                         toolCallId: req.toolCallId,
                         budget: budgetSnapshot,
                         ...callFaceSeat(req.face),
-                        ...(handsCwdRef !== undefined ? { cwd: handsCwdRef.current } : {}),
+                        ...(handsCwdRef !== undefined ? { cwd: handsCwdRef.current } : {}), ...(handsRoot !== undefined ? { root: handsRoot } : {}),
                         ...advertisedWritableRootsSeat(advertisedWritableDirs),
-                    }, cutSignal)), cutSignal);
+                    });
+                    const withReading = stampCallTarget?.(reprojectedReq(), cutSignal);
+                    const reprojectedRaced = await raceSettlementAgainstSignal(withReading === undefined ? Promise.resolve(basePolicyForResumeEdit.check(reprojectedReq(), cutSignal)) : withReading.then((r) => basePolicyForResumeEdit.check(r, cutSignal)), cutSignal);
                     if (reprojectedRaced.tag === "aborted")
                         return undefined;
                     if (reprojectedRaced.tag === "threw")

package/dist/core/runner/prepare-policy-chain.d.ts

@@ -27,6 +27,8 @@ import { type Hooks } from "../hooks.js";
 import type { LockedPreflight } from "../locked-config.js";
 import type { SessionPermissionRules } from "../session-policy-store.js";
 import { type OnAsk, type ToolPolicy } from "../tool-policy.js";
+import type { PathRuleBases } from "../permission-rule-model.js";
+import type { HeadLeads } from "../path-rule-binding.js";
 import type { RunnerDeps, RuntimeCaps, TaskSpec, ToolEffect } from "../types.js";
 import type { CwdRef } from "../../tools/fs/fs-shared.js";
 import type { ReadDenyMatcher } from "../../tools/fs/read-deny.js";
@@ -65,9 +67,17 @@ export interface PreparePolicyChainInput {
     additionalRootsCanonical: readonly string[];
     /** borrowed-readonly — the run's resolved env (path rules resolve in it; the sandbox declaration is read off it). */
     executionEnv: ExecutionEnv;
-    /** borrowed-readonly — the frozen preflight: `toolPolicy` (the caller slot) and `basePolicyForResumeEdit` (the lock-aware
-     *  resume-edit override). */
+    /** borrowed-readonly — the frozen preflight as installed on this leg: `toolPolicy` (the caller slot) and
+     *  `basePolicyForResumeEdit` (the lock-aware resume-edit override), their path rules anchored where this leg installed them. */
     lockedPreflight: Pick<LockedPreflight, "toolPolicy" | "basePolicyForResumeEdit">;
+    /** borrowed-readonly — the path rules' anchors on this leg: `leg` (this leg's root and environment home — where this
+     *  leg's own lists are installed) and `chainTop` (the top leg's: the person's global / session rows and every `~/`). */
+    pathRuleAnchors: {
+        readonly leg: PathRuleBases;
+        readonly chainTop: PathRuleBases;
+    };
+    /** borrowed-readonly — the leg's one resolution of where rule heads lead (the rows' twins). */
+    headLeads: HeadLeads;
     /** borrowed-readonly — the run's ONE tool roster, read only here (the name audit's universe: names + aliases). */
     tools: ReadonlyArray<AgentTool>;
     /** borrowed-readonly — the harness list (placeholders keep their deferred names), the audit universe's second half. */
@@ -96,6 +106,8 @@ export interface PreparePolicyChainInput {
     readDenyMatcher: ReadDenyMatcher | undefined;
     /** borrowed-readonly — the run's one notice for a person's rule store that could not be read (`ruleStoreUnreadableNotice`). */
     announceRuleStoreSkipped: (at: "prepare" | "call") => void;
+    /** borrowed-readonly — the run's one notice for rows the person's store served that were left out (`ruleRowsDroppedNotice`). */
+    announceRuleRowsDropped: (rows: import("../permission-rule-provider.js").EffectivePermissionRules["droppedRows"]) => void;
     /** borrowed-readonly — whether the question tool mounted (the lanes' question-tool exclusion). */
     questionToolMounted: boolean;
     /** borrowed-readonly — the resolved per-principal entitlements; only `forceDurableGate` (the mandate-park facility and
@@ -140,6 +152,8 @@ export interface PreparePolicyChainInput {
     /** borrowed-readonly — LATE-BOUND: this task's own classifier instance (the pass-through test's decider term), read at chain
      *  assembly (the arming runs after this phase, and again on a steer into `auto`). */
     autoModeDecider: () => AutoModeDecider | undefined;
+    /** borrowed-readonly — the leg's resolved read face (`undefined` with no hands), read per call into the inherited stations' class derivation. */
+    readFace: () => import("../../tools/fs/containment-face.js").ContainmentFace | undefined;
     /** borrowed-readonly — the leg's live permission-mode seat: the mode gate policy layer and the inherited stations' arbitration
      *  read `current` per call. */
     permissionMode: PermissionModeController;