@sema-agent/core 7.45.0 → 7.47.0

package/dist/core/ask-origin.d.ts

@@ -488,6 +488,9 @@ export interface ModeArbitrationRow {
  * tool's effect lands at a remote peer, outside any containment the leg declares). `hookAskFloor` marks the classes the reference's rule / safety check answers
  * `ask` for — an ask rule, a question the tool needs a person for, a dangerous removal, a protected or unresolvable write
  * target, the session transcript, another's shared artifact.
+ * A row is a class's reading on every face but the ones {@link RELEASED_ON_SHELL_FACE} names: `write_protection_unresolved`'s
+ * `bypassImmune` is the file face's (and every other face's) reading, and the shell face reads it released — folded where the
+ * ask's row is ({@link foldArbitrationRow}), listed per face by {@link releasableAskClassesFor}.
  */
 export declare const MODE_ARBITRATION: {
     readonly content_question: {
@@ -668,23 +671,37 @@ export declare const MODE_ARBITRATION: {
 };
 /** The fence over the arbitration table: `never` while every class has a row. */
 export type ArbitrationTableCoversEveryClass = AssertAllKeysHandled<Exclude<AskClass, keyof typeof MODE_ARBITRATION>>;
+/**
+ * The FACE a question was put on — the second axis the permission mode reads a class under, beside the leg's read face
+ * ({@link ContainmentFace}). `shell`: the call's `command` argument is a shell command line the command grammar judges (the
+ * tool catalog's shell face — Bash, Monitor); `other`: every other call (the file tools, MCP, A2A, a caller's own tool). The set
+ * is closed; {@link askFaceOf} is the one derivation of a face from a tool name.
+ */
+export declare const ASK_FACES: readonly ["shell", "other"];
+export type AskFace = (typeof ASK_FACES)[number];
+/** The face of a call, by its WIRE name (the name the gate resolved the call to — a release widens, so an alias a tool merely
+ *  wears does not count): the catalog's shell face for exactly the names that declare the command grammar, `other` for every
+ *  other name. */
+export declare function askFaceOf(toolName: string): AskFace;
 /** The classes whose own mint puts the `requiresRealApproval` bit on the ask — a bit one of them explains is not
  *  the bare bit `policy_rra` names. The mark classes (probe / write protection / tool marks / operator forced / the
  *  shell floor) mint no bit and explain none — except `requires_user_interaction`, whose declaration the origin stamp
  *  turns into the bit on every ask of the tool. */
 export declare const RRA_EXPLAINERS: ReadonlySet<AskClass>;
-/** The classes a permission mode can RELEASE (the `bypassImmune: false` rows) — the only words that can appear on
- *  `GateDisposition.released.askClass`; every other class reaches a person under every mode. */
-export declare const RELEASABLE_ASK_CLASSES: readonly AskClass[];
+/** The classes a permission mode can RELEASE for a call on `face`, in {@link ASK_CLASSES} order. The same list on every face
+ *  but one class — {@link RELEASED_ON_SHELL_FACE}. A frozen list: a caller holding it cannot change the next read. A word
+ *  outside {@link ASK_FACES} throws. */
+export declare function releasableAskClassesFor(face: AskFace): readonly AskClass[];
 /**
  * The closed set of `reason` words a mode release carries (`GateDisposition.released.reason`, the `released` arm of
  * {@link Arbitration}): each is a releasable class the release record names on its own — `rule_unreadable`, a release
- * over a person's rule the call could not be read against. A release carries the first member (array order) its class
+ * over a person's rule the call could not be read against; `write_protection_unresolved`, a release (the shell face only,
+ * {@link RELEASED_ON_SHELL_FACE}) over a write target the judge could not resolve. A release carries the first member (array order) its class
  * set holds, and none when it holds no member. {@link arbitrateByMode} and {@link isModeReleaseReason} read one copy
  * of this list taken at load (a caller that writes into the exported array changes neither), so a new reason is one
  * word here.
  */
-export declare const MODE_RELEASE_REASONS: readonly ["rule_unreadable"];
+export declare const MODE_RELEASE_REASONS: readonly ["rule_unreadable", "write_protection_unresolved"];
 export type ModeReleaseReason = (typeof MODE_RELEASE_REASONS)[number];
 /** Membership test for {@link ModeReleaseReason} — the word crosses the wire on `tool_end.gate.disposition.released.reason`. */
 export declare function isModeReleaseReason(v: unknown): v is ModeReleaseReason;
@@ -700,6 +717,8 @@ export interface AskClassFacts extends AskOriginFacts {
     readonly ancestorClasses?: ReadonlySet<AskClass>;
     /** The read face the leg this ask was raised on resolved ({@link ContainmentFace}); absent ⇒ none resolved (a leg with no hands). */
     readonly readFace?: ContainmentFace;
+    /** The tool face the question was put on ({@link askFaceOf} of the call's tool name); absent ⇒ the face-less reading, which is the `other` face's. */
+    readonly askFace?: AskFace;
 }
 /** The classification the arbitration reads: the whole set, the disclosed word (the set's first member in
  *  {@link ASK_CLASSES} order) and the row folded across the set. */
@@ -735,10 +754,11 @@ export declare function decisionAskClassesOf(d: Extract<PermissionResult, {
 }>): Set<AskClass>;
 /** Fold a class set onto one row: `bypassImmune` and `hookAskFloor` by OR (any immune member keeps the ask; any floored
  *  member floors a hook's ask), the three permissive switches by AND (one refusing member withholds the lane). An empty
- *  set is `ordinary`. `readFace` is the face the ask was raised under: `roots` takes the classifier's lane from a set that
- *  holds a class the narrowed face withholds from it — the one place the face enters, so every reader of `classifierEligible`
- *  reads it already folded. */
-export declare function foldArbitrationRow(classes: ReadonlySet<AskClass>, readFace?: ContainmentFace): ModeArbitrationRow;
+ *  set is `ordinary`. The two faces the ask was raised under enter HERE and nowhere else, so every reader of the folded row
+ *  reads it already folded: `readFace` — `roots` takes the classifier's lane from a set that holds a class the narrowed face
+ *  withholds from it; `askFace` — `shell` reads a class {@link RELEASED_ON_SHELL_FACE} holds as not bypass-immune. Absent
+ *  faces read the table's own rows. */
+export declare function foldArbitrationRow(classes: ReadonlySet<AskClass>, readFace?: ContainmentFace, askFace?: AskFace): ModeArbitrationRow;
 /**
  * The ONE class derivation: the decision half ({@link decisionAskClassesOf}) joined with the gate's own facts —
  * the question tool, an ancestor's mark, the org layer's two arms, the persisted lane's unreadable call, the tool
@@ -814,9 +834,12 @@ export type Arbitration = {
  * The ONE mode read point. `dontAsk` refuses every ask — one value for every class — but a hook's that no member of the
  * set floors (`hookAskFloor`: a hook's ask beside a rule's or a safety check's ask is refused, as the reference's full
  * pipeline refuses it; a hook's ask alone is the reference's forced decision, which never reaches that conversion);
- * `bypassPermissions` refuses a write whose protection could not be judged (a person cannot be asked, and
- * releasing would be looser than the allow the judge already refuses), keeps every immune class and releases the
- * rest; `acceptEdits` answers an ORDINARY ask itself on a call the caller vouches is one of the mode's file commands
+ * `bypassPermissions` refuses a write whose protection could not be judged where that class stays immune (the file
+ * face: a person cannot be asked, and releasing would be looser than the allow the write-protection tighten refuses there —
+ * the folded row says it, {@link foldArbitrationRow}), keeps every immune class and releases the rest: the shell face
+ * releases that class ({@link RELEASED_ON_SHELL_FACE}), and there the tighten turns an allow into the same question rather
+ * than a refusal (`writeProtectionTightenDecision` reads the face), so on neither face is the release looser than an allow;
+ * `acceptEdits` answers an ORDINARY ask itself on a call the caller vouches is one of the mode's file commands
  * (`call.fileCommand`, `accepted`); `plan`, `default` and `auto` hand every ask on (plan's own questions were raised by
  * its write gate; the reference implementation refuses nothing at this point under plan — auto's classifier reads the
  * row at its own station). Reads the class SET and the folded row — never the disclosed word.

package/dist/core/ask-origin.js

@@ -1,3 +1,4 @@
+import { isShellFaceToolName } from "./tool-registry.js";
 export const ASK_ORIGINS = Object.freeze(["content_question", "ancestor_marked", "org_unavailable", "org_rule", "rule_store_unavailable", "hook", "ask_rule", "denial_limit_fallback", "shell_gate_tighten", "safety_tighten", "policy"]);
 const ASK_ORIGIN_SET = new Set(ASK_ORIGINS);
 export function isAskOrigin(v) {
@@ -117,7 +118,7 @@ const MANDATE_DISCLOSURE = {
     write_protection_unresolved: "the write-protection judge could not resolve this write's target, so whether it lands on the protected table is unknown — it is cleared by confirming this call: no standing rule and no automatic decider answers for it, though a wired approver seat can",
 };
 export function mandateDisclosureOf(mandate) {
-    return mandate === undefined ? "an explicit ask rule matched this call (a person's ask-me-each-time outranks a standing allow rule)" : MANDATE_DISCLOSURE[mandate];
+    return mandate === undefined ? "an explicit ask rule matched this call (a person's or the deployment's ask-me-each-time outranks a standing allow rule)" : MANDATE_DISCLOSURE[mandate];
 }
 export function persistedRuleMandateOf(marks) {
     const word = irreversibilityMandateOf(marks);
@@ -224,10 +225,26 @@ export const MODE_ARBITRATION = {
     unstated: { bypassImmune: false, classifierEligible: true, sandboxAdmission: false, ruleMayClear: true, hookAskFloor: false },
     ordinary: { bypassImmune: false, classifierEligible: true, sandboxAdmission: true, ruleMayClear: true, hookAskFloor: false },
 };
+export const ASK_FACES = Object.freeze(["shell", "other"]);
+export function askFaceOf(toolName) {
+    return isShellFaceToolName(toolName) ? "shell" : "other";
+}
+const RELEASED_ON_SHELL_FACE = new Set(["write_protection_unresolved"]);
+function bypassImmuneOn(c, face) {
+    return MODE_ARBITRATION[c].bypassImmune && !(face === "shell" && RELEASED_ON_SHELL_FACE.has(c));
+}
 const CLASSIFIER_WITHHELD_ON_ROOTS = new Set(["probe"]);
 export const RRA_EXPLAINERS = new Set(["dangerous_delete", "unverifiable_delete", "transcript_write", "org_rule", "governance_unavailable", "rule_unreadable", "denial_limit_fallback", "classifier_no_ruling", "ancestor", "artifact_shared_read", "requires_user_interaction"]);
-export const RELEASABLE_ASK_CLASSES = ASK_CLASSES.filter((c) => !MODE_ARBITRATION[c].bypassImmune);
-export const MODE_RELEASE_REASONS = Object.freeze(["rule_unreadable"]);
+const RELEASABLE_BY_FACE = Object.freeze({
+    shell: Object.freeze(ASK_CLASSES.filter((c) => !bypassImmuneOn(c, "shell"))),
+    other: Object.freeze(ASK_CLASSES.filter((c) => !bypassImmuneOn(c, "other"))),
+});
+export function releasableAskClassesFor(face) {
+    if (!ASK_FACES.includes(face))
+        throw new TypeError(`releasableAskClassesFor: "${String(face)}" is not an ask face (${ASK_FACES.join(", ")})`);
+    return RELEASABLE_BY_FACE[face];
+}
+export const MODE_RELEASE_REASONS = Object.freeze(["rule_unreadable", "write_protection_unresolved"]);
 const MODE_RELEASE_REASON_SET = new Set(MODE_RELEASE_REASONS);
 export function isModeReleaseReason(v) {
     return MODE_RELEASE_REASON_SET.has(v);
@@ -278,14 +295,14 @@ export function decisionAskClassesOf(d) {
         out.add(c);
     return out;
 }
-export function foldArbitrationRow(classes, readFace) {
+export function foldArbitrationRow(classes, readFace, askFace) {
     if (classes.size === 0)
         return MODE_ARBITRATION.ordinary;
     const withheld = readFace === "roots" && [...classes].some((c) => CLASSIFIER_WITHHELD_ON_ROOTS.has(c));
     let bypassImmune = false, classifierEligible = !withheld, sandboxAdmission = true, ruleMayClear = true, hookAskFloor = false;
     for (const c of classes) {
         const row = MODE_ARBITRATION[c];
-        bypassImmune ||= row.bypassImmune;
+        bypassImmune ||= bypassImmuneOn(c, askFace);
         classifierEligible &&= row.classifierEligible;
         sandboxAdmission &&= row.sandboxAdmission;
         ruleMayClear &&= row.ruleMayClear;
@@ -340,7 +357,7 @@ export function classifyAsk(d, facts) {
     if (classes.size === 0)
         classes.add("ordinary");
     const askClass = ASK_CLASSES.find((c) => classes.has(c));
-    return { classes, askClass, row: foldArbitrationRow(classes, facts.readFace) };
+    return { classes, askClass, row: foldArbitrationRow(classes, facts.readFace, facts.askFace) };
 }
 export function headlessDenialMessage(toolName, askMessage) {
     return `Permission for this tool use was denied: it requires interactive approval, and permission prompts are not available in this session (nobody can be asked to approve "${toolName}" in this run — headless auto-deny). The action was NOT performed. Do not claim it succeeded, and do not retry it in this session — report the limitation to the user, or suggest an alternative. What was requested: ${askMessage}`;
@@ -379,7 +396,7 @@ export function arbitrateByMode(mode, c, disclosure, call) {
         case "dontAsk":
             return has("hook") && !c.row.hookAskFloor ? { kind: "ask" } : { kind: "denied_by_mode", mode, askClass: c.askClass, classes };
         case "bypassPermissions":
-            if (has("write_protection_unresolved"))
+            if (has("write_protection_unresolved") && c.row.bypassImmune)
                 return { kind: "denied_by_mode", mode, askClass: c.askClass, classes };
             if (c.row.bypassImmune)
                 return { kind: "ask" };

package/dist/core/checkpoint-store.d.ts

@@ -1095,6 +1095,22 @@ export interface CheckpointState {
      * plain on-disk state that survives a process-local suspend (worktrees included — the tree stays on disk).
      */
     handsCwd?: string;
+    /**
+     * The hands band's ROOT at suspend (the canonical root its tools resolve a root-relative spelling against — the
+     * `root` every adjudicated request of the leg carries). Read by ONE seat: the pre-claim recheck of an edited parked
+     * call, which has no environment yet and judges the edit at the row's coordinates (`handsRoot` + {@link handsCwd}).
+     * After the claim the resumed leg uses its own live root. Absent on a row written before this field (that recheck then
+     * reads the root as unknown, as before) and when the task has no hands. An ignorable optional field: an older reader
+     * that does not know it resumes the row as it always did, so it raises no row format.
+     */
+    handsRoot?: string;
+    /**
+     * The home the leg's caller policies installed their `~/` words at (the execution environment's declared home, absolute),
+     * beside {@link handsRoot}: the pre-claim recheck installs the edit-base policy at the row's root and this home, the way
+     * the leg did. Absent on a row written before this field, on a hands-less task and on an environment that declares no
+     * absolute home — a `~/` row then reads unanchored there (never the engine process's home). Ignorable, like `handsRoot`.
+     */
+    handsHome?: string;
     /**
      * the ACTIVE EnterWorktree session at suspend (worktree.ts keeps it in a shared
      * serializable ref, not a closure-only var, precisely so it lands here). Without it a resume LOST the
@@ -1166,6 +1182,21 @@ export interface CheckpointState {
          *  the v2 contract are refused, even when every admitted set en route was EMPTY. Absent on
          *  trees that never had a governance surface. */
         orgAdmissionGoverned?: true;
+        /** The chain's top leg's root and home at suspend (data half): the anchors of the person's global / session path rows
+         *  and of every `~/` row on this chain (a project row anchors at its own scope root). Absent on older checkpoints and on
+         *  a top leg ⇒ the resumed leg is its own top. Rebased with the workspace on a restore elsewhere; a value that is not
+         *  an absolute path anchors nothing (the rows it would anchor read `unreadable`). */
+        pathRuleAnchors?: {
+            readonly root: string;
+            readonly home?: string;
+        };
+        /** Where each parent constraint the suspended leg ran under was installed, position for position (data half; `null`: an
+         *  entry with no path rules). A resume that re-supplies the chain uninstalled installs each entry there. Rebased with the
+         *  workspace; a value that is not an absolute path installs nothing (the entry is installed at the chain top). */
+        pathRuleInstallations?: ReadonlyArray<{
+            readonly root: string;
+            readonly home?: string;
+        } | null>;
         requiresParentConstraint: boolean;
         /** How many opaque parent constraints the suspended leg ran under (present iff `requiresParentConstraint`).
          *  The resume pre-CAS ladder rejects a re-supply whose `parentConstraints.length` differs
@@ -2036,14 +2067,20 @@ export declare function summarizeCheckpoint(cp: Checkpoint): CheckpointSummary;
  *    steer seat, which no worker version reads and the host decides itself, or a retired mode-seed member of
  *    `inheritedGate`, which an engine at 7.38.x or earlier still reads once).
  *  · `invalid_outcome` pre-CAS row-integrity arms: `"real_approval_damaged"`, `"real_approval_forged"`,
- *    `"read_face_damaged"`, `"read_face_forged"`, `"write_face_damaged"`, `"skill_grants_damaged"`, `"constraint_chain_missing"` (all terminal for the row's
+ *    `"read_face_damaged"`, `"read_face_forged"`, `"write_face_damaged"`, `"skill_grants_damaged"`, `"constraint_chain_missing"`, `"hands_coordinates_damaged"` (all terminal for the row's
  *    current bytes — no worker version redeems a damaged row).
  */
 export type CheckpointErrorReason = "version_newer" | "env_factory_missing" | "governed_unwired" | "origin_missing" | "ledger_event_unknown" | "seat_retired" | "real_approval_damaged" | "real_approval_forged" | "read_face_damaged" | "read_face_forged"
 /** `state.writeFace` is present but not a well-formed section. No `_forged` twin: the section is
  *  legal-and-absent at every version, so there is no version to judge a fabrication against — and a
  *  fabricated "open" still needs the LIVE resolution to say open too. */
- | "write_face_damaged" | "skill_grants_damaged" | "constraint_chain_missing";
+ | "write_face_damaged" | "skill_grants_damaged" | "constraint_chain_missing"
+/** `state.handsRoot` / `state.handsHome` / `state.handsCwd` is present but not an absolute path (the row's hands' coordinates). */
+ | "hands_coordinates_damaged"
+/** On `resume.parent_constraint_mismatch`: a re-supplied chain entry whose path rules depend on the leg that installed it has
+ *  no installation record (a chain written before the record existed) / a record that does not cover the chain entry for
+ *  entry / a record member naming no absolute root. */
+ | "installation_record_absent" | "installation_record_misaligned" | "installation_record_invalid";
 /**
  * The codes a RESUME's pre-claim configuration screen carries as `detail.code` of a `checkpoint.config_refused` — the seven
  * words prepare's mode, output-style, approval-reach, invoked-skill and recorded-mode doors throw, held unchanged so one refusal

package/dist/core/effective-path-target.d.ts

@@ -20,9 +20,19 @@
  *
  * The fix is not a fourth arm in the lanes: it is that "which base does this tool resolve against, and what
  * does it target when the slot is empty" is a FACT OF THE TOOL, so the tool declares it once and both
- * sides read the declaration. {@link pathTargetBaseOf} is the shared SELECTION (which base), and each side
- * then applies its own identity to the selected base — lexical-normal here (the rule family's one path
- * identity, zero IO), canonical (symlink-resolving, IO) inside the tool.
+ * sides read the declaration. {@link pathTargetBaseOf} is the shared SELECTION (which base).
+ *
+ * ## The views of one target
+ *
+ * A target is seen three ways: its LEXICAL view (the spelling joined to the selected base, `.` / `..` folded —
+ * zero IO), its CANONICAL view (the same spelling resolved by the execution environment: symlinks, aliases of the
+ * tree, the disk's own case) and the HOPS of its leaf's symlink chain. {@link readPathViews} is the one producer of
+ * those views — the tool's own resolution and its deny judgment read it, and so does {@link readCallTarget}, which
+ * a Runner stamp point calls once per adjudicated call and hands to every rule lane as
+ * `ToolCallRequest.targetReading`. Every rule lane reads a call's target through ONE reader, {@link callTargetViewsOf}:
+ * the reading's views when the call carries one, else the call's own lexical view (a bare request). The judgment over
+ * those views is the deny tables' (`pathRowsReach`): any view a deny or ask row reaches is reached; an allow row admits a
+ * call only when it admits every view of the declared reading.
  *
  * ## What it does NOT decide
  *
@@ -35,7 +45,9 @@
  * rule family reaches it, and the rule grammar is derived from the catalog's path targets), so it has no
  * declaration to read; the day it declares one, it reads the same selector as everything else.
  */
-import { type PathFamily, type PathIdentity, type Win32NamespaceRefusal } from "../tools/fs/safety.js";
+import { canonicalizeTarget, type PathFamily, type PathIdentity, type Win32NamespaceRefusal } from "../tools/fs/safety.js";
+import type { TargetViews } from "../tools/fs/read-deny.js";
+import type { ExecutionEnv } from "../internal/harness-types.js";
 import type { ToolCallPathTarget } from "./tool-face.js";
 import { type ToolCallLike } from "./tool-registry.js";
 /** The bases of ONE CALL a target resolves against: the task root, and the live tracked working directory
@@ -114,3 +126,123 @@ export declare function effectivePathSpellingOf(call: ToolCallLike, pt: ToolCall
 } | {
     readonly refused: Win32NamespaceRefusal;
 } | undefined;
+/**
+ * ONE reading of a call's path slot as VIEWS. `path`: the LEXICAL view (the spelling joined to the selected base and
+ * folded — a native spelling of the tree's family), the CANONICAL view when the environment answered (absent ⇒ not asked
+ * or no answer: an absent view takes no part in a judgment and is never a refusal) and the HOPS of the leaf's symlink
+ * chain when the environment declares one. `unreadable` / `refused` read as in {@link PathTargetReading}.
+ */
+export type CallTargetView = {
+    readonly kind: "path";
+    readonly lexical: string;
+    readonly canonical?: string;
+    readonly hops?: readonly string[];
+} | {
+    readonly kind: "unreadable";
+    readonly reason: string;
+} | {
+    readonly kind: "refused";
+    readonly reason: Win32NamespaceRefusal;
+};
+/**
+ * A call's TARGET READING: the views of each reading of its path slot — `protective`, the tightening direction's
+ * ({@link protectivePathTargetOf}), and `declared`, the allow direction's ({@link declaredPathTargetOf}; absent on a
+ * request that carries no face). It carries no root and no cwd: the call's own `root` / `cwd` are the only copies.
+ */
+export interface CallTargetReading {
+    readonly protective?: CallTargetView;
+    readonly declared?: CallTargetView;
+    /** Where each location on the way to a rule row's head that this leg's lanes hold LEADS in the leg's environment (a
+     *  link, a firmlink, an alias of the tree) — the rows' twins are judged there too. A fact of the judging leg, taken
+     *  once per location per leg; absent when no row head leads elsewhere. */
+    readonly leads?: ReadonlyMap<string, string>;
+}
+/** The environment's answer the canonical view rests on — the throat's own, so the tool keeps reading the refusal it gave. */
+export type CanonicalAnswer = Awaited<ReturnType<typeof canonicalizeTarget>>;
+/** The three views of one spelling as {@link readPathViews} produces them. */
+export interface PathViews {
+    readonly lexical: PathTargetReading;
+    /** `undefined` ⇒ the environment was not asked (none supplied, or a spelling this reading cannot locate). */
+    readonly canonical?: CanonicalAnswer;
+    readonly hops: readonly string[];
+}
+/**
+ * The ONE producer of a target's views: `spelled` against `base` (the base the tool's declaration selected), under the
+ * tree `bases` names. Lexical through the same resolution {@link effectivePathTargetOf} reads; canonical through the
+ * throat's own canonicalizer; the hops (when `opts.hops` and the canonical view answered) through the leaf's chain. The
+ * tool's resolution and deny judgment read this, and so does {@link readCallTarget}; an environment that THROWS
+ * propagates here (each caller holds its own posture: the tool refuses, the reading leaves the view absent).
+ */
+export declare function readPathViews(env: ExecutionEnv | undefined, spelled: string, base: string | undefined, bases: ToolPathBases, signal?: AbortSignal, opts?: {
+    readonly hops?: boolean;
+}): Promise<PathViews>;
+/** The identity of an ABSOLUTE spelling under the tree `bases` names — the target side's one prelude (family, namespace
+ *  screen, identity) for a path a judge already holds (a canonical key, a hop, a lexical view). `undefined` when the
+ *  spelling is not an absolute path of that tree. */
+export declare function absoluteTargetIdentityOf(spelled: string, bases: ToolPathBases): PathIdentity | undefined;
+/**
+ * A call's target reading under ONE call's facts: its `root` / `cwd` (the bases the stamp point reads off the leg) and
+ * the execution environment `env` (absent ⇒ the lexical views alone — the pre-claim recheck, which has no environment).
+ * A canonical view the environment cannot answer (or throws on) is absent, never a refusal (an absent view does not vote).
+ * The two readings share their views when they select the same spelling against the same base (one canonicalization).
+ */
+export declare function readCallTarget(env: ExecutionEnv | undefined, call: ToolCallLike & {
+    readonly root?: string | undefined;
+    readonly cwd?: string | undefined;
+}, signal?: AbortSignal, leads?: ReadonlyMap<string, string | undefined>): Promise<CallTargetReading>;
+/**
+ * `req` with its arguments replaced by `args` and — when `req` carries a reading of its own args — a reading of the NEW
+ * args taken the same way (same environment, same root / cwd, same face). Every seat that rewrites a request's arguments
+ * and hands it on (a composition's rewrite cascade, a re-judgment of the final or an edited form) goes through here, so the
+ * next layer never judges a request its reading does not describe. `signal` is the CURRENT call's: a reading never carries
+ * one call's cancellation into another's. `undefined` ⇒ nothing to re-read: use `{ ...req, args }`.
+ */
+export declare function withArgsReading<R extends {
+    readonly args: unknown;
+    readonly targetReading?: CallTargetReading | undefined;
+}>(req: R, args: unknown, signal: AbortSignal | undefined): Promise<R> | undefined;
+/** The request's target reading, when it describes the request's own `args` (the object it was taken for); otherwise
+ *  nothing — a rule lane then judges the lexical view it always judged. Every rule lane reads the reading through here. */
+export declare function callTargetReadingOf(req: {
+    readonly args: unknown;
+    readonly targetReading?: CallTargetReading | undefined;
+}): CallTargetReading | undefined;
+/**
+ * THE one reader of a call's target for every rule lane, in one direction's reading (`tighten` = the protective reading,
+ * `allow` = the declared one): the views of the call's target reading when it carries one of its own args (lexical,
+ * canonical, the leaf chain's hops), else the call's own lexical view — resolved against the call's `root` / `cwd` when it
+ * carries either, else against `bare` (a host's direct call of a policy: the bases it declared). `undefined` = the call
+ * names no path in this reading (or a spelling the throat refuses — no rule speaks about it); an `unreadable` answer =
+ * the call names a path this reading cannot locate.
+ */
+export declare function callTargetViewsOf(req: ToolCallLike & {
+    readonly root?: string | undefined;
+    readonly cwd?: string | undefined;
+    readonly targetReading?: CallTargetReading | undefined;
+}, direction: "tighten" | "allow", bare?: ToolPathBases): TargetViews | undefined;
+/**
+ * A leg's STAMP seat: `req` with a target reading of its own args, or `undefined` when there is nothing to stamp — the
+ * leg's lanes hold no path rule, the request already carries a reading of its args, or its args are not an object. The
+ * reading is taken under the request's own `root` / `cwd` when it carries them, else the leg's (the same values every
+ * Runner seat stamps), and memoized per args object within one call (its `toolCallId`), so every lane reading one call
+ * costs one reading. `undefined`
+ * rather than a resolved request, so a seat with nothing to do adds no suspension point.
+ */
+export type CallTargetStamp = <R extends ToolCallLike & {
+    readonly toolCallId?: string;
+    readonly root?: string | undefined;
+    readonly cwd?: string | undefined;
+    readonly targetReading?: CallTargetReading | undefined;
+}>(req: R, signal?: AbortSignal) => Promise<R & {
+    readonly targetReading: CallTargetReading;
+}> | undefined;
+/** The stamp seat of one leg: its execution environment, its root and live working directory, whether its lanes hold a
+ *  path rule (read per call — an activated skill can add one), and where the heads of the rows its lanes hold lead in its
+ *  environment (resolved once per location per leg). */
+export declare function legCallTargetStamp(leg: {
+    readonly env: ExecutionEnv;
+    readonly root: string;
+    readonly cwd: () => string | undefined;
+    readonly judgesPaths: () => boolean;
+    readonly leads: () => Promise<ReadonlyMap<string, string | undefined>>;
+}): CallTargetStamp;

package/dist/core/effective-path-target.js

@@ -1,5 +1,7 @@
-import { isAbsoluteForFamily, joinForFamily, pathFamilyOf, pathIdentityOf, win32NamespaceScreen } from "../tools/fs/safety.js";
-import { pathTargetValue } from "./tool-registry.js";
+import { canonicalizeTarget, isAbsoluteForFamily, joinForFamily, pathFamilyOf, pathIdentityOf, spellingOfIdentity, win32NamespaceScreen } from "../tools/fs/safety.js";
+import { declaredPathTargetOf, pathTargetValue, protectivePathTargetOf } from "./tool-registry.js";
+import { symlinkChainHops } from "./path-identity.js";
+import { DEFAULT_GATE_AWAIT_TIMEOUT_MS, withGateTimeout } from "./gate-bounded-await.js";
 export function pathTargetBaseOf(pt, bases) {
     return (pt?.base ?? "cwd") === "root" ? bases.root : (bases.cwd ?? bases.root);
 }
@@ -73,3 +75,109 @@ function readingOf(r) {
 function unreadableBase(base) {
     return { kind: "unreadable", reason: base === undefined ? "the call's path is relative to a base that was not supplied" : `the base this call resolves against (${JSON.stringify(base)}) is not a fully-qualified path of this tree's family` };
 }
+export async function readPathViews(env, spelled, base, bases, signal, opts) {
+    const lexical = resolveSpelling(spelled, base, bases);
+    const family = pathFamilyOf(bases);
+    if (env === undefined || family === undefined || lexical?.kind === "unreadable")
+        return { lexical, hops: [] };
+    const canonical = await canonicalizeTarget(env, spelled, signal, family, base);
+    const climbs = (s) => s !== undefined && (family === "win" ? /(^|[\\/])\.\.([\\/]|$)/ : /(^|\/)\.\.(\/|$)/).test(s);
+    const followsALink = canonical.ok && (climbs(spelled) || climbs(base) || lexical?.kind !== "path" || absoluteTargetIdentityOf(canonical.key, bases) !== lexical.identity);
+    const hops = opts?.hops === true && followsALink ? await withGateTimeout(symlinkChainHops(env, spelled, signal, family, base), DEFAULT_GATE_AWAIT_TIMEOUT_MS, signal, "canonicalChain").catch(() => []) : [];
+    return { lexical, canonical, hops };
+}
+export function absoluteTargetIdentityOf(spelled, bases) {
+    const r = pathIdentityOf(spelled, pathFamilyOf(bases), bases.root ?? bases.cwd);
+    return r.ok ? r.identity : undefined;
+}
+const READ_FOR = new WeakMap();
+const REREAD = new WeakMap();
+export async function readCallTarget(env, call, signal, leads) {
+    const bases = { ...(call.root !== undefined ? { root: call.root } : {}), ...(call.cwd !== undefined ? { cwd: call.cwd } : {}) };
+    const family = pathFamilyOf(bases);
+    const views = new Map();
+    const viewOf = (pt) => {
+        const sel = effectivePathSpellingOf(call, pt, bases);
+        if (sel === undefined)
+            return Promise.resolve(undefined);
+        if ("refused" in sel)
+            return Promise.resolve({ kind: "refused", reason: sel.refused });
+        const target = sel.spelled !== undefined ? { spelled: sel.spelled, base: sel.base } : sel.base !== undefined && isAbsoluteForFamily(family, sel.base) ? { spelled: sel.base, base: undefined } : undefined;
+        if (target === undefined)
+            return Promise.resolve(unreadableBase(sel.base));
+        const { spelled, base } = target;
+        const key = JSON.stringify([spelled, base ?? null]);
+        const prior = views.get(key);
+        if (prior !== undefined)
+            return prior;
+        const read = readPathViews(env, spelled, base, bases, signal, { hops: true })
+            .catch(() => ({ lexical: resolveSpelling(spelled, base, bases), hops: [] }))
+            .then((v) => viewFrom(v, family));
+        views.set(key, read);
+        return read;
+    };
+    const protective = await viewOf(protectivePathTargetOf(call));
+    const declared = call.face === undefined ? undefined : await viewOf(declaredPathTargetOf(call));
+    const led = leads === undefined ? undefined : [...leads].filter((e) => e[1] !== undefined && e[1] !== e[0]);
+    const reading = Object.freeze({ ...(protective !== undefined ? { protective } : {}), ...(declared !== undefined ? { declared } : {}), ...(led !== undefined && led.length > 0 ? { leads: new Map(led) } : {}) });
+    if (typeof call.args === "object" && call.args !== null)
+        READ_FOR.set(reading, call.args);
+    REREAD.set(reading, (args, rereadSignal) => readCallTarget(env, { ...call, args }, rereadSignal, leads));
+    return reading;
+}
+export function withArgsReading(req, args, signal) {
+    const reading = callTargetReadingOf(req);
+    const reread = reading === undefined ? undefined : REREAD.get(reading);
+    return reread === undefined ? undefined : reread(args, signal).then((targetReading) => ({ ...req, args, targetReading }));
+}
+function viewFrom(v, family) {
+    if (v.lexical === undefined)
+        return undefined;
+    if (v.lexical.kind !== "path")
+        return Object.freeze({ ...v.lexical });
+    const canonical = v.canonical?.ok === true ? v.canonical.key : undefined;
+    return Object.freeze({ kind: "path", lexical: spellingOfIdentity(v.lexical.identity, family), ...(canonical !== undefined ? { canonical } : {}), ...(v.hops.length > 0 ? { hops: Object.freeze([...v.hops]) } : {}) });
+}
+export function callTargetReadingOf(req) {
+    const r = req.targetReading;
+    return r !== undefined && READ_FOR.get(r) === req.args ? r : undefined;
+}
+export function callTargetViewsOf(req, direction, bare = {}) {
+    const reading = callTargetReadingOf(req);
+    if (reading !== undefined) {
+        const v = direction === "tighten" ? reading.protective : reading.declared;
+        if (v === undefined || v.kind === "refused")
+            return undefined;
+        if (v.kind === "unreadable")
+            return { spellings: [], unreadable: v.reason };
+        const spellings = [v.lexical];
+        for (const s of [v.canonical, ...(v.hops ?? [])])
+            if (s !== undefined && !spellings.includes(s))
+                spellings.push(s);
+        return { spellings };
+    }
+    const own = req.root !== undefined || req.cwd !== undefined ? { ...(req.root !== undefined ? { root: req.root } : {}), ...(req.cwd !== undefined ? { cwd: req.cwd } : {}) } : bare;
+    const target = effectivePathTargetOf(req, direction === "tighten" ? protectivePathTargetOf(req) : declaredPathTargetOf(req), own);
+    if (target === undefined || target.kind === "refused")
+        return undefined;
+    if (target.kind === "unreadable")
+        return { spellings: [], unreadable: target.reason };
+    return { spellings: [spellingOfIdentity(target.identity, pathFamilyOf(own))] };
+}
+export function legCallTargetStamp(leg) {
+    const taken = new WeakMap();
+    return (req, signal) => {
+        const args = req.args;
+        if (typeof args !== "object" || args === null || callTargetReadingOf(req) !== undefined || !leg.judgesPaths())
+            return undefined;
+        const root = req.root ?? leg.root;
+        const cwd = req.cwd ?? leg.cwd();
+        const prior = taken.get(args);
+        const reading = prior !== undefined && prior.root === root && prior.cwd === cwd && prior.toolName === req.toolName && prior.toolCallId === req.toolCallId && prior.face === req.face
+            ? prior.reading
+            : leg.leads().then((leads) => readCallTarget(leg.env, { toolName: req.toolName, args, ...(req.face !== undefined ? { face: req.face } : {}), root, ...(cwd !== undefined ? { cwd } : {}) }, signal, leads));
+        if (prior?.reading !== reading)
+            taken.set(args, { root, cwd, toolName: req.toolName, toolCallId: req.toolCallId, face: req.face, reading });
+        return reading.then((targetReading) => ({ ...req, targetReading }));
+    };
+}

package/dist/core/engine-notice.d.ts

@@ -368,6 +368,11 @@ export interface EngineNotice {
      *    (one call's own rule check — every later call reads again, so the rows apply as soon as a read succeeds). Once
      *    per run, whichever read fails first; the trace keeps every read's line (`permission.rule_store_unreadable`).
      *    `detail: { at, sessionId, runId }`. Audience `user`.
+     *  - `"permission.rule_row_dropped"` — the person's store served project-scoped rows whose scope root is not a
+     *    complete absolute path (only a foreign writer or a hand edit makes one; every engine write face refuses it): they
+     *    take no part in this run's checks — a deny or ask row among them protects nothing — until they are rewritten or
+     *    removed. Once per run, by whichever read met them first. `detail: { rows, count, sessionId, runId }` — `rows`
+     *    the first eight `{ rule, scopeRoot }` (each bounded), `count` all of them. Audience `user`.
      *  - `"config.durable_gate_unavailable"` — a durable-approval MANDATE is in force on a leg with NO
      *    checkpoint store: the per-principal `forceDurableGate` entitlement, or the task's own
      *    `durableApproval` opt-in with no live approver seat (`durableMandateSourceOf`, the predicate the
@@ -829,11 +834,14 @@ export interface EngineNotice {
      *    boot; deletes in it will fail until the operator restores the bit. Audience `"operator"`; `detail: { layers,
      *    remedy }` — layer directory names and the one command. No session. Once per boot.
      *  - `"server.model_unreachable"` — a model call of this leg ended in error and its last request failed to
-     *    connect. Audience `"user"`; `detail: { code, targetHost, remedy, sessionId, proxyInUse? }` — `code` one of
-     *    `UND_ERR_CONNECT_TIMEOUT` / `ECONNREFUSED` / `ENOTFOUND` / `EAI_AGAIN` / `EHOSTUNREACH` / `ENETUNREACH`;
+     *    connect. Audience `"user"`; `detail: { code, targetHost, remedy, sessionId, taskId?, proxyInUse? }` — `code`
+     *    one of `UND_ERR_CONNECT_TIMEOUT` / `ECONNREFUSED` / `ENOTFOUND` / `EAI_AGAIN` / `EHOSTUNREACH` / `ENETUNREACH`;
      *    `targetHost` the model endpoint's `host:port`; `remedy` the constant `"check VPN / proxy; restart if the
-     *    proxy changed since boot"`; `proxyInUse` present only when that request went through a proxy, its value the
-     *    variable's name (`HTTP_PROXY` or `HTTPS_PROXY`), never the proxy address. No `runId`. Once per leg per target.
+     *    proxy changed since boot"`; `taskId` (server 7.121.0+) the run resource id of the leg this notice belongs to —
+     *    absent on a streaming leg that has no run store, and the SAME value on a resumed leg and its original (a
+     *    per-leg dedup folds the two into one line); `proxyInUse` present only when that request went through a proxy,
+     *    its value the variable's name (`HTTP_PROXY` or `HTTPS_PROXY`), never the proxy address. No `runId`. Once per
+     *    leg per target.
      *
      *  Deliberately NOT a notice family: brain retry/reconnect liveness (a rate limit, a 5xx, a
      *  transient network failure being retried). Those are per-attempt liveness frames with their own

package/dist/core/gate-fold.js

@@ -2,7 +2,7 @@ import { inlineUntrusted } from "./untrusted-text.js";
 import { markTightenMessage } from "./safety-axis-vocab.js";
 import { PROBE_REASON_MAX, normalizeProbeCause } from "./checkpoint-store.js";
 import { normalizeReadRootCandidate } from "./read-root-candidate.js";
-import {} from "./runner/gate-exit.js";
+import { passAskFace } from "./runner/gate-exit.js";
 import { traceHookCrash } from "./gate-crash-trace.js";
 import { writeProtectionMandated, writeProtectionTightenDecision, writeProtectionUnresolved } from "./write-protect.js";
 import { createGateDeadline, awaitWriteProtectionJudgment, gateWaitFailureOf, withGateTimeout } from "./gate-bounded-await.js";
@@ -13,6 +13,9 @@ export async function runGateFold(pass) {
     const { input, toolName, toolCallId, callSignal, ledger, notifier, adjudicate } = pass;
     const boundedAwaitDeadlineMs = createGateDeadline(input, notifier);
     pass.req = { toolName, args: pass.currentInput, toolCallId, ...(pass.req.face !== undefined ? { face: pass.req.face } : {}) };
+    const stamped = input.stampCallTarget?.(pass.req, callSignal ?? input.abortSignal);
+    if (stamped !== undefined)
+        pass.req = await stamped;
     pass.decision = adjudicate ? refuseOutOfContractDecision(await (callSignal !== undefined ? adjudicate(pass.req, callSignal) : adjudicate(pass.req))) : { action: "allow" };
     {
         const refusedBy = ledger.fromDecision(pass.decision);
@@ -164,7 +167,7 @@ export async function runGateFold(pass) {
             pass.writeProtected = true;
         if (verdict !== undefined && writeProtectionUnresolved(verdict))
             pass.writeProtectionUnresolved = true;
-        const decision = verdict === undefined ? undefined : writeProtectionTightenDecision(toolName, verdict);
+        const decision = verdict === undefined ? undefined : writeProtectionTightenDecision(toolName, verdict, passAskFace(pass));
         if (decision !== undefined && writeProtectionStanding === "allow") {
             pass.decision = decision;
             if (decision.action === "ask")