@sema-agent/core 7.48.0 → 7.49.0

package/dist/core/ask-origin.d.ts

@@ -34,6 +34,11 @@ import type { ContainmentFace } from "../tools/fs/containment-face.js";
  *
  *  - `content_question` — the reserved question tool: a content-ROUTING signal, not a permission
  *    question; it leaves the gate through the content channel, never through a permission decider.
+ *  - `plan_review` — a durable PLAN pause: the model's own request (the first-party plan tool) stopped the run for a human
+ *    verdict on a PLAN. Same family as `content_question` — a content-routing ask, never a permission question, so no
+ *    permission decider, classifier or mode answers it and it never reaches an approver as an `AskRequest`. The word is stamped
+ *    by the plan pause's decide lane alone (derived from the row's kind, nothing persisted), so the decided row's record names
+ *    the ask it settled like every other settlement does.
  *  - `ancestor_marked` — the call is MARKED by an ancestor (an inherited approver-unavailable float, or
  *    a durable mandate floated down because this task can park it): it must reach the park with no
  *    synchronous decision-maker in between. The word names WHO raised it (an ancestor's mark), like every
@@ -70,7 +75,7 @@ import type { ContainmentFace } from "../tools/fs/containment-face.js";
  *    observer or an approval card can say WHICH engine layer raised the question, which one word
  *    could not.
  */
-export declare const ASK_ORIGINS: readonly ["content_question", "ancestor_marked", "org_unavailable", "org_rule", "rule_store_unavailable", "hook", "ask_rule", "denial_limit_fallback", "shell_gate_tighten", "safety_tighten", "policy"];
+export declare const ASK_ORIGINS: readonly ["content_question", "plan_review", "ancestor_marked", "org_unavailable", "org_rule", "rule_store_unavailable", "hook", "ask_rule", "denial_limit_fallback", "shell_gate_tighten", "safety_tighten", "policy"];
 export type AskOrigin = (typeof ASK_ORIGINS)[number];
 /** Whether a value is a member of the closed origin set. Exported because the word crosses process
  *  boundaries: a host validating one it received must not hand-roll the set. */
@@ -263,6 +268,7 @@ export declare function ownedClearanceFacts(d: Extract<PermissionResult, {
  */
 export declare const ORIGIN_IMPLIES_REAL_APPROVAL: {
     readonly content_question: false;
+    readonly plan_review: false;
     readonly ancestor_marked: false;
     readonly org_unavailable: "at_derivation";
     readonly org_rule: "at_derivation";
@@ -288,10 +294,10 @@ export type RealApprovalTableCoversEveryOrigin = AssertAllKeysHandled<Exclude<As
  *  - `probe_unanswered` — the probe was consulted and did not answer: the boundary is UNKNOWN.
  *  - `write_protection` — the table covers this write's target. A write onto load-executed configuration
  *    re-authorizes the agent, so the question is a property of the TARGET, not of anyone's hesitation.
- *  - `write_protection_unresolved` — the judge could not RESOLVE the target: `probe_unanswered`'s
- *    doctrine one layer over.
+ *  - `target_unresolved` — the reading of a written target could not say where it leads on disk:
+ *    `probe_unanswered`'s doctrine one layer over.
  */
-export declare const PERSISTED_RULE_MANDATES: readonly ["operator_always", "tool_marks", "probe_mandate", "probe_unanswered", "write_protection", "write_protection_unresolved"];
+export declare const PERSISTED_RULE_MANDATES: readonly ["operator_always", "tool_marks", "probe_mandate", "probe_unanswered", "write_protection", "target_unresolved"];
 export type PersistedRuleMandate = (typeof PERSISTED_RULE_MANDATES)[number];
 /** Membership test for {@link PersistedRuleMandate} — the screen a row reader applies to a stored word. */
 export declare function isPersistedRuleMandate(v: unknown): v is PersistedRuleMandate;
@@ -303,7 +309,7 @@ declare const MANDATE_DISCLOSURE: {
     readonly operator_always: "this deployment mandates per-call confirmation for shell commands (shellGate: always)";
     readonly tool_marks: "this tool carries egress/irreversibility/interaction marks (a mandated confirmation a rule cannot clear)";
     readonly write_protection: "this write's target is on the deployment's write-protection table (the agent's own configuration is guarded one look per write) — it is cleared by confirming this call, never by a standing allow rule";
-    readonly write_protection_unresolved: "the write-protection judge could not resolve this write's target, so whether it lands on the protected table is unknown — it is cleared by confirming this call: no standing rule and no automatic decider answers for it, though a wired approver seat can";
+    readonly target_unresolved: "where this write leads on disk could not be determined (a link on the way could not be examined, or the environment could not resolve the target), so whether it lands on a guarded path is unknown — it is cleared by confirming this call: no standing rule and no automatic decider answers for it, though a wired approver seat can";
 };
 /** The fence over the disclosure table: `never` while every word has a row. */
 export type DisclosureTableCoversEveryMandate = AssertAllKeysHandled<Exclude<PersistedRuleMandate, keyof typeof MANDATE_DISCLOSURE>>;
@@ -330,10 +336,11 @@ export declare function mandateDisclosureOf(mandate: PersistedRuleMandate | unde
  *    above is deliberately the ONLY thing that carves a mandate out of it;
  *  · a tool's OWN `"always"`/`"maybe"` irreversibility tier without the doctrine (`"tool_marks"`).
  *
- * The two per-call write-protection seats sit BELOW the probe words and ABOVE the seat marks, on the
- * ladder's rule: a word no lane may answer outranks the rest, and a fact about THIS call outranks a
- * property of the tool. Judged HERE, not in {@link irreversibilityMandateOf} which {@link safetyAxisOf}
- * shares: such a write is not an irreversible action, and its park stays budgetable.
+ * The unresolved written target sits ABOVE the probe words (the read station mints both on one call, and this one names
+ * why its finding stands); the matched write-protection row sits BELOW them and ABOVE the seat marks, on the ladder's rule:
+ * a word no lane may answer outranks the rest, and a fact about THIS call outranks a property of the tool. Judged HERE, not
+ * in {@link irreversibilityMandateOf} which {@link safetyAxisOf} shares: such a write is not an irreversible action, and
+ * its park stays budgetable.
  *
  * Two consumers, one derivation: the gate's silencing arm (a matching rule is disclosed as shadowed
  * instead of clearing the ask) and the runner's suggestion factory (a mandated ask offers no
@@ -361,9 +368,10 @@ export interface MandateMarks {
      *  for a shell command's written targets). A GATE fact like the org words: it rides the pass, not the decision, so no
      *  layer outside the engine declares it. */
     writeProtected?: boolean;
-    /** The same record for the judge's other non-clear verdict — consulted, could not RESOLVE the target.
-     *  The pair is the write face's twin of `probeMandated` / `probeUnanswered`, mutually exclusive. */
-    writeProtectionUnresolved?: boolean;
+    /** The gate's record that the READING of a written target could not say where it leads on disk (`GatePass.targetUnresolved`:
+     *  a target a shell command's program writes, placed, whose destination the read station could not resolve) — a fact of
+     *  the reading, never a judge's verdict. The write face's twin of `probeUnanswered`. */
+    targetUnresolved?: boolean;
     /** The pass's own record that the probe was consulted and did not answer (`GatePass.probeUnanswered`):
      *  the boundary is unknown, which no standing yes may stand in for. The runner's suggestion factory does
      *  not see the pass and never passes it — a card may offer a rule the lane then discloses as shadowed
@@ -452,9 +460,13 @@ export type ToolMarkSource = "deployment" | "mcp_annotation" | "a2a_default";
  * `dangerous_delete` is a removal whose target is a protected location (`dangerousRemovalOf`: the filesystem root, a
  * top-level directory, a home directory, or a workspace directory — the task root, the working directory, an additional
  * working directory — or an ancestor of one): the reference implementation's dangerous-removal breaker, which no mode,
- * allow rule or classifier answers. `unverifiable_delete` is its sibling for a target the command text cannot resolve.
+ * allow rule or classifier answers. `unverifiable_delete` is its sibling for a target the command text cannot resolve;
+ * `unverifiable_shell_text` is a shell handed text the command does not spell (a program's output, a substitution, a
+ * file's content, an argv a stream fills in): the engine cannot read what that shell will execute. Its row is
+ * `unverifiable_delete`'s save the classifier column — such a shell was `dangerous_delete` before it had a word of its own,
+ * and the classifier did not answer that.
  */
-export declare const ASK_CLASSES: readonly ["content_question", "hook", "ancestor", "dangerous_delete", "unverifiable_delete", "transcript_write", "org_rule", "governance_unavailable", "rule_unreadable", "ask_rule", "denial_limit_fallback", "classifier_no_ruling", "requires_user_interaction", "operator_forced", "shell_floor", "write_protection_unresolved", "probe", "write_protection", "tool_marks_mcp", "tool_marks_a2a", "policy_rra", "artifact_shared_read", "mode", "unstated", "ordinary"];
+export declare const ASK_CLASSES: readonly ["content_question", "hook", "ancestor", "dangerous_delete", "unverifiable_delete", "unverifiable_shell_text", "transcript_write", "org_rule", "governance_unavailable", "rule_unreadable", "ask_rule", "denial_limit_fallback", "classifier_no_ruling", "requires_user_interaction", "operator_forced", "shell_floor", "target_unresolved", "probe", "write_protection", "tool_marks_mcp", "tool_marks_a2a", "policy_rra", "artifact_shared_read", "mode", "unstated", "ordinary"];
 export type AskClass = (typeof ASK_CLASSES)[number];
 /** Membership test for {@link AskClass} — the word crosses the wire on `tool_end.gate.disposition`. */
 export declare function isAskClass(v: unknown): v is AskClass;
@@ -488,7 +500,7 @@ export interface ModeArbitrationRow {
  * tool's effect lands at a remote peer, outside any containment the leg declares). `hookAskFloor` marks the classes the reference's rule / safety check answers
  * `ask` for — an ask rule, a question the tool needs a person for, a dangerous removal, a protected or unresolvable write
  * target, the session transcript, another's shared artifact.
- * A row is a class's reading on every face but the ones {@link RELEASED_ON_SHELL_FACE} names: `write_protection_unresolved`'s
+ * A row is a class's reading on every face but the ones {@link RELEASED_ON_SHELL_FACE} names: `target_unresolved`'s
  * `bypassImmune` is the file face's (and every other face's) reading, and the shell face reads it released — folded where the
  * ask's row is ({@link foldArbitrationRow}), listed per face by {@link releasableAskClassesFor}.
  */
@@ -528,6 +540,13 @@ export declare const MODE_ARBITRATION: {
         readonly ruleMayClear: false;
         readonly hookAskFloor: true;
     };
+    readonly unverifiable_shell_text: {
+        readonly bypassImmune: true;
+        readonly classifierEligible: false;
+        readonly sandboxAdmission: false;
+        readonly ruleMayClear: false;
+        readonly hookAskFloor: true;
+    };
     readonly transcript_write: {
         readonly bypassImmune: false;
         readonly classifierEligible: true;
@@ -598,7 +617,7 @@ export declare const MODE_ARBITRATION: {
         readonly ruleMayClear: false;
         readonly hookAskFloor: false;
     };
-    readonly write_protection_unresolved: {
+    readonly target_unresolved: {
         readonly bypassImmune: true;
         readonly classifierEligible: false;
         readonly sandboxAdmission: true;
@@ -695,13 +714,13 @@ export declare function releasableAskClassesFor(face: AskFace): readonly AskClas
 /**
  * The closed set of `reason` words a mode release carries (`GateDisposition.released.reason`, the `released` arm of
  * {@link Arbitration}): each is a releasable class the release record names on its own — `rule_unreadable`, a release
- * over a person's rule the call could not be read against; `write_protection_unresolved`, a release (the shell face only,
- * {@link RELEASED_ON_SHELL_FACE}) over a write target the judge could not resolve. A release carries the first member (array order) its class
+ * over a person's rule the call could not be read against; `target_unresolved`, a release (the shell face only,
+ * {@link RELEASED_ON_SHELL_FACE}) over a write target whose reading could not say where it leads. A release carries the first member (array order) its class
  * set holds, and none when it holds no member. {@link arbitrateByMode} and {@link isModeReleaseReason} read one copy
  * of this list taken at load (a caller that writes into the exported array changes neither), so a new reason is one
  * word here.
  */
-export declare const MODE_RELEASE_REASONS: readonly ["rule_unreadable", "write_protection_unresolved"];
+export declare const MODE_RELEASE_REASONS: readonly ["rule_unreadable", "target_unresolved"];
 export type ModeReleaseReason = (typeof MODE_RELEASE_REASONS)[number];
 /** Membership test for {@link ModeReleaseReason} — the word crosses the wire on `tool_end.gate.disposition.released.reason`. */
 export declare function isModeReleaseReason(v: unknown): v is ModeReleaseReason;
@@ -834,11 +853,10 @@ export type Arbitration = {
  * The ONE mode read point. `dontAsk` refuses every ask — one value for every class — but a hook's that no member of the
  * set floors (`hookAskFloor`: a hook's ask beside a rule's or a safety check's ask is refused, as the reference's full
  * pipeline refuses it; a hook's ask alone is the reference's forced decision, which never reaches that conversion);
- * `bypassPermissions` refuses a write whose protection could not be judged where that class stays immune (the file
- * face: a person cannot be asked, and releasing would be looser than the allow the write-protection tighten refuses there —
- * the folded row says it, {@link foldArbitrationRow}), keeps every immune class and releases the rest: the shell face
- * releases that class ({@link RELEASED_ON_SHELL_FACE}), and there the tighten turns an allow into the same question rather
- * than a refusal (`writeProtectionTightenDecision` reads the face), so on neither face is the release looser than an allow;
+ * `bypassPermissions` refuses a write whose target's reading could not say where it leads where that class stays immune
+ * (every face but the shell's: a person cannot be asked — the folded row says it, {@link foldArbitrationRow}), keeps every
+ * immune class and releases the rest: the shell face releases that class ({@link RELEASED_ON_SHELL_FACE}), the reference
+ * implementation's answer for a command whose written target could not be resolved;
  * `acceptEdits` answers an ORDINARY ask itself on a call the caller vouches is one of the mode's file commands
  * (`call.fileCommand`, `accepted`); `plan`, `default` and `auto` hand every ask on (plan's own questions were raised by
  * its write gate; the reference implementation refuses nothing at this point under plan — auto's classifier reads the

package/dist/core/ask-origin.js

@@ -1,5 +1,5 @@
 import { isShellFaceToolName } from "./tool-registry.js";
-export const ASK_ORIGINS = Object.freeze(["content_question", "ancestor_marked", "org_unavailable", "org_rule", "rule_store_unavailable", "hook", "ask_rule", "denial_limit_fallback", "shell_gate_tighten", "safety_tighten", "policy"]);
+export const ASK_ORIGINS = Object.freeze(["content_question", "plan_review", "ancestor_marked", "org_unavailable", "org_rule", "rule_store_unavailable", "hook", "ask_rule", "denial_limit_fallback", "shell_gate_tighten", "safety_tighten", "policy"]);
 const ASK_ORIGIN_SET = new Set(ASK_ORIGINS);
 export function isAskOrigin(v) {
     return ASK_ORIGIN_SET.has(v);
@@ -93,6 +93,7 @@ function originLadder(decision, facts) {
 }
 export const ORIGIN_IMPLIES_REAL_APPROVAL = {
     content_question: false,
+    plan_review: false,
     ancestor_marked: false,
     org_unavailable: "at_derivation",
     org_rule: "at_derivation",
@@ -104,7 +105,7 @@ export const ORIGIN_IMPLIES_REAL_APPROVAL = {
     safety_tighten: false,
     policy: false,
 };
-export const PERSISTED_RULE_MANDATES = Object.freeze(["operator_always", "tool_marks", "probe_mandate", "probe_unanswered", "write_protection", "write_protection_unresolved"]);
+export const PERSISTED_RULE_MANDATES = Object.freeze(["operator_always", "tool_marks", "probe_mandate", "probe_unanswered", "write_protection", "target_unresolved"]);
 const PERSISTED_RULE_MANDATE_SET = new Set(PERSISTED_RULE_MANDATES);
 export function isPersistedRuleMandate(v) {
     return PERSISTED_RULE_MANDATE_SET.has(v);
@@ -115,17 +116,17 @@ const MANDATE_DISCLOSURE = {
     operator_always: "this deployment mandates per-call confirmation for shell commands (shellGate: always)",
     tool_marks: "this tool carries egress/irreversibility/interaction marks (a mandated confirmation a rule cannot clear)",
     write_protection: "this write's target is on the deployment's write-protection table (the agent's own configuration is guarded one look per write) — it is cleared by confirming this call, never by a standing allow rule",
-    write_protection_unresolved: "the write-protection judge could not resolve this write's target, so whether it lands on the protected table is unknown — it is cleared by confirming this call: no standing rule and no automatic decider answers for it, though a wired approver seat can",
+    target_unresolved: "where this write leads on disk could not be determined (a link on the way could not be examined, or the environment could not resolve the target), so whether it lands on a guarded path is unknown — it is cleared by confirming this call: no standing rule and no automatic decider answers for it, though a wired approver seat can",
 };
 export function mandateDisclosureOf(mandate) {
     return mandate === undefined ? "an explicit ask rule matched this call (a person's or the deployment's ask-me-each-time outranks a standing allow rule)" : MANDATE_DISCLOSURE[mandate];
 }
 export function persistedRuleMandateOf(marks) {
+    if (marks.targetUnresolved === true)
+        return "target_unresolved";
     const word = irreversibilityMandateOf(marks);
     if (word === "probe_mandate" || word === "probe_unanswered")
         return word;
-    if (marks.writeProtectionUnresolved === true)
-        return "write_protection_unresolved";
     if (marks.writeProtected === true)
         return "write_protection";
     return marks.egress === true || marks.requiresUserInteraction === true ? "tool_marks" : word;
@@ -173,6 +174,7 @@ export const ASK_CLASSES = Object.freeze([
     "ancestor",
     "dangerous_delete",
     "unverifiable_delete",
+    "unverifiable_shell_text",
     "transcript_write",
     "org_rule",
     "governance_unavailable",
@@ -183,7 +185,7 @@ export const ASK_CLASSES = Object.freeze([
     "requires_user_interaction",
     "operator_forced",
     "shell_floor",
-    "write_protection_unresolved",
+    "target_unresolved",
     "probe",
     "write_protection",
     "tool_marks_mcp",
@@ -204,6 +206,7 @@ export const MODE_ARBITRATION = {
     ancestor: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false },
     dangerous_delete: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: true },
     unverifiable_delete: { bypassImmune: true, classifierEligible: true, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: true },
+    unverifiable_shell_text: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: true },
     transcript_write: { bypassImmune: false, classifierEligible: true, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: true },
     org_rule: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false },
     governance_unavailable: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false },
@@ -214,7 +217,7 @@ export const MODE_ARBITRATION = {
     requires_user_interaction: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: true },
     operator_forced: { bypassImmune: true, classifierEligible: true, sandboxAdmission: true, ruleMayClear: false, hookAskFloor: false },
     shell_floor: { bypassImmune: true, classifierEligible: true, sandboxAdmission: true, ruleMayClear: false, hookAskFloor: false },
-    write_protection_unresolved: { bypassImmune: true, classifierEligible: false, sandboxAdmission: true, ruleMayClear: false, hookAskFloor: true },
+    target_unresolved: { bypassImmune: true, classifierEligible: false, sandboxAdmission: true, ruleMayClear: false, hookAskFloor: true },
     probe: { bypassImmune: false, classifierEligible: true, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false },
     write_protection: { bypassImmune: false, classifierEligible: true, sandboxAdmission: true, ruleMayClear: false, hookAskFloor: true },
     tool_marks_mcp: { bypassImmune: false, classifierEligible: true, sandboxAdmission: true, ruleMayClear: false, hookAskFloor: false },
@@ -229,12 +232,12 @@ export const ASK_FACES = Object.freeze(["shell", "other"]);
 export function askFaceOf(toolName) {
     return isShellFaceToolName(toolName) ? "shell" : "other";
 }
-const RELEASED_ON_SHELL_FACE = new Set(["write_protection_unresolved"]);
+const RELEASED_ON_SHELL_FACE = new Set(["target_unresolved"]);
 function bypassImmuneOn(c, face) {
     return MODE_ARBITRATION[c].bypassImmune && !(face === "shell" && RELEASED_ON_SHELL_FACE.has(c));
 }
 const CLASSIFIER_WITHHELD_ON_ROOTS = new Set(["probe"]);
-export const RRA_EXPLAINERS = new Set(["dangerous_delete", "unverifiable_delete", "transcript_write", "org_rule", "governance_unavailable", "rule_unreadable", "denial_limit_fallback", "classifier_no_ruling", "ancestor", "artifact_shared_read", "requires_user_interaction"]);
+export const RRA_EXPLAINERS = new Set(["dangerous_delete", "unverifiable_delete", "unverifiable_shell_text", "transcript_write", "org_rule", "governance_unavailable", "rule_unreadable", "denial_limit_fallback", "classifier_no_ruling", "ancestor", "artifact_shared_read", "requires_user_interaction"]);
 const RELEASABLE_BY_FACE = Object.freeze({
     shell: Object.freeze(ASK_CLASSES.filter((c) => !bypassImmuneOn(c, "shell"))),
     other: Object.freeze(ASK_CLASSES.filter((c) => !bypassImmuneOn(c, "other"))),
@@ -244,7 +247,7 @@ export function releasableAskClassesFor(face) {
         throw new TypeError(`releasableAskClassesFor: "${String(face)}" is not an ask face (${ASK_FACES.join(", ")})`);
     return RELEASABLE_BY_FACE[face];
 }
-export const MODE_RELEASE_REASONS = Object.freeze(["rule_unreadable", "write_protection_unresolved"]);
+export const MODE_RELEASE_REASONS = Object.freeze(["rule_unreadable", "target_unresolved"]);
 const MODE_RELEASE_REASON_SET = new Set(MODE_RELEASE_REASONS);
 export function isModeReleaseReason(v) {
     return MODE_RELEASE_REASON_SET.has(v);
@@ -267,6 +270,8 @@ export function decisionAskClassesOf(d) {
         out.add("dangerous_delete");
     if (d.guard === "unverifiable_delete")
         out.add("unverifiable_delete");
+    if (d.guard === "unverifiable_shell_text")
+        out.add("unverifiable_shell_text");
     if (d.guard === "transcript_write")
         out.add("transcript_write");
     if (d.guard === "artifact_shared_read")
@@ -340,8 +345,8 @@ export function classifyAsk(d, facts) {
     }
     if (marks.probeUnanswered === true)
         classes.add("probe");
-    if (marks.writeProtectionUnresolved === true)
-        classes.add("write_protection_unresolved");
+    if (marks.targetUnresolved === true)
+        classes.add("target_unresolved");
     if (marks.writeProtected === true)
         classes.add("write_protection");
     if (facts.tightened === "unstated")
@@ -396,7 +401,7 @@ export function arbitrateByMode(mode, c, disclosure, call) {
         case "dontAsk":
             return has("hook") && !c.row.hookAskFloor ? { kind: "ask" } : { kind: "denied_by_mode", mode, askClass: c.askClass, classes };
         case "bypassPermissions":
-            if (has("write_protection_unresolved") && c.row.bypassImmune)
+            if (has("target_unresolved") && c.row.bypassImmune)
                 return { kind: "denied_by_mode", mode, askClass: c.askClass, classes };
             if (c.row.bypassImmune)
                 return { kind: "ask" };

package/dist/core/auto-mode-prompt-assets.d.ts

@@ -1,5 +1,5 @@
-/** The auto-mode classifier SYSTEM prompt shell (CC 2.1.207 `auto_mode_system_prompt`, plus the
- *  design/278 G6 passed-through-approval exception in consent-bar principle 7 — see the header note).
+/** The auto-mode classifier SYSTEM prompt shell (CC 2.1.207 `auto_mode_system_prompt`, with consent-bar
+ *  principle 7 at its CC 2.1.291 text — see the header note).
  *  Contains two assembly placeholders consumed by `buildAutoModePrompt`: `<permissions_template>`
  *  (replaced by the permissions document) and `<cross_session_messages_rule>` (replaced with "" —
  *  the 206/207 default). */