@sema-agent/core 7.48.0 → 7.49.0

package/README.md

@@ -44,7 +44,7 @@ const res = await runner.runTask({ objective: "...", model: "main" });
 - **Memory engine.** Scoped long-term memory with a pluggable `MemoryBackend`
   (file-backed or Postgres), plus automatic in-context compaction that keeps long runs inside the
   model's context window without losing the thread.
-- **Multi-agent.** Sub-agent delegation, team discussions, deterministic `runWorkflow`
+- **Multi-agent.** Sub-agent delegation, deterministic `runWorkflow`
   orchestration with durable journals, and opt-in observer agents that monitor and steer a run.
 - **Streaming first.** Every task emits a typed `TaskEvent` stream (reasoning deltas, text deltas,
   tool lifecycle, progress, diagnostics), ready to pipe into SSE via `createTaskServer`.
@@ -110,7 +110,7 @@ token-by-token, or expose the runner over HTTP + SSE — the
 | [04 – Tools and MCP](docs/sdk/04-tools-and-mcp.md) | `defineTool`, the SQL tool, issue-tracker tools, MCP integration |
 | [05 – Streaming and the HTTP Server](docs/sdk/05-streaming-and-http-server.md) | The `TaskEvent` protocol, SSE, `createTaskServer` |
 | [06 – Sessions, Memory, and Compaction](docs/sdk/06-sessions-memory-and-compaction.md) | Session stores, automatic compaction, long-term memory backends |
-| [07 – Multi-Agent](docs/sdk/07-multi-agent.md) | Sub-agents, team discussions, teacher mode |
+| [07 – Multi-Agent](docs/sdk/07-multi-agent.md) | Sub-agent delegation, multi-perspective discussion via sub-agents, cross-session peer messaging |
 | [08 – Workflows](docs/sdk/08-workflows.md) | Deterministic `runWorkflow` orchestration and observability |
 | [09 – Security and Policies](docs/sdk/09-security-and-policies.md) | Tool policies, approvals, shell gating, human-in-the-loop supervision |
 | [10 – Extension Points](docs/sdk/10-extension-points.md) | Custom brains, session stores, execution environments, Postgres adapters |

package/dist/agents/cascade.d.ts

@@ -8,15 +8,12 @@ import type { ModelRef, TaskResult, TaskSpec, TaskStatus } from "../core/types.j
  *
  * APPLICABILITY: cascade only helps when the gate is **decidable** (a schema check, a verifier model, a
  * concrete assertion). Open-ended "completeness" tasks (find every bug, writing quality) have no oracle —
- * the gate keeps passing the first plausible cheap answer and escalation idles. Those want breadth /
- * falsification-style debate (a `team`), not a depth ladder.
+ * the gate keeps passing the first plausible cheap answer and escalation idles. Those want breadth
+ * (several independent agents and a judge), not a depth ladder.
  *
  * Cost note (design/27 §2): each rung is an independent COLD `runTask` — every escalation repays the
  * full input cost. Cascade wins when (a) the cheap rung usually passes and (b) the prompt isn't so large
  * that the restart tax dominates. It is NOT always cheaper than running the strongest model directly.
- *
- * Boundary vs teacher mode: teacher injects advice and continues the SAME session (recovery); cascade
- * does independent re-runs on a model ladder (breadth). Orthogonal, not merged.
  */
 /** A gate's verdict: a bare boolean, or `{ pass, diagnostics }` to attach reasoning to `attempts[]`. */
 export type GateVerdict = boolean | {

package/dist/agents/child-failure.d.ts

@@ -0,0 +1,20 @@
+import { terminalProjection } from "../core/runner/terminal-projection.js";
+import type { TerminalCause } from "../core/types.js";
+/**
+ * A child run's failure words are its provider's or tool's own text and can carry a credential. Every parent-facing reader of them
+ * takes them from here, so they are secret-redacted with `redactSecrets` — the definition `workflow_run.error` uses — once per
+ * source shape, before any field bound can clip a token in half, and no face redacts for itself:
+ *  - {@link childTerminalFace}: a settled child's cause, projected (the report's `error:` line, the card, the task row, the
+ *    notification's summary and digest);
+ *  - {@link childThrownText}: the text of a rejected run;
+ *  - {@link childRejection}: a rejected run's thrown value itself, for the foreground lane, where the tool loop writes the
+ *    parent's tool result from the thrown value's `message`.
+ */
+export declare const childTerminalFace: (terminal: TerminalCause) => ReturnType<typeof terminalProjection>;
+export declare const childThrownText: (err: unknown) => string;
+/**
+ * The thrown value of a rejected child run, re-minted with the redacted sentence: same prototype and own members (`code`,
+ * `details`, `errorKind`, `cause`) — only `message` changes. The copy's `stack` is its own, captured here: the original's
+ * first line carries the message, so it is not carried over. A value with nothing to redact is returned as it is.
+ */
+export declare const childRejection: (err: unknown) => unknown;

package/dist/agents/child-failure.js

@@ -0,0 +1,28 @@
+import { terminalProjection } from "../core/runner/terminal-projection.js";
+import { thrownText } from "../core/thrown-value.js";
+import { redactSecrets } from "../core/untrusted-egress.js";
+export const childTerminalFace = (terminal) => {
+    const face = terminalProjection(terminal);
+    return typeof face.errorMessage === "string" ? { ...face, errorMessage: redactSecrets(face.errorMessage) } : face;
+};
+export const childThrownText = (err) => redactSecrets(thrownText(err));
+export const childRejection = (err) => {
+    const text = thrownText(err);
+    const clean = childThrownText(err);
+    if (clean === text)
+        return err;
+    if (typeof err !== "object" || err === null)
+        return clean;
+    try {
+        const copy = new Error(clean);
+        Object.setPrototypeOf(copy, Object.getPrototypeOf(err));
+        for (const key of Reflect.ownKeys(err)) {
+            if (key !== "message" && key !== "stack")
+                Object.defineProperty(copy, key, Object.getOwnPropertyDescriptor(err, key));
+        }
+        return copy;
+    }
+    catch {
+        return new Error(clean);
+    }
+};

package/dist/agents/cross-session-ref.d.ts

@@ -38,15 +38,23 @@ export declare function normalizePeerName(name: string): string;
 /** The box-address prefixes of design/385 (`session.<id>` per-session box, `principal.<…>` the
  *  cross-principal inbox family). Reserved: a NAME may never spell an address. */
 export declare const PEER_ADDRESS_PREFIXES: readonly string[];
+/** The names that already address a fixed party — CC 2.1.296 `fD` (cli296.js:238093) reads `main`
+ *  (`Og`: the conversation that spawned the run), `team-lead` (`ca`), `user` (`mxe`) and `system`
+ *  (`adt`) off the NORMALIZED key, so every spelling that normalizes to one of them is the name.
+ *  The frames a run speaks (`from`, `teammate_id`, a stop attribution) already carry these four
+ *  words as parties; a spawn named one of them would speak as that party. */
+export declare const RESERVED_AGENT_NAMES: readonly string[];
 /**
  * design/385 §2.2 namespace protection (CC `qd` in spirit): a candidate spawn/session name is refused
  * when its normalized key would shadow an explicit address — a reserved box prefix, a transport
- * scheme (`uds:` / `bridge:` / `did:`), a socket path, an `@`-bearing team form, or the `*`
- * broadcast token. Returns the reason, or `undefined` when the name is admissible. Registration-side
+ * scheme (`uds:` / `bridge:` / `did:`), a socket path, an `@`-bearing team form, the `*` broadcast
+ * token, one of the {@link RESERVED_AGENT_NAMES} (`reserved_name`) or the shape of an agent id
+ * (`agent_id_shape`). Returns the reason, or `undefined` when the name is admissible. Registration-side
  * check (loud refusal at write time); the resolution ladder ranks explicit addresses first regardless.
+ * The spawn face (the Agent tool's `name`) refuses on every reason this returns.
  *
  * The socket-path arm is judged on the RAW name AND on its normalized key (CC `QHe` runs its
  * classifier over both): a name that is a socket path in either spelling is refused, since the
  * resolution ladder would read the raw spelling as an address.
  */
-export declare function reservedPeerNameReason(name: string): "empty" | "address_prefix" | "transport_scheme" | "socket_path" | "at_sign" | "wildcard" | undefined;
+export declare function reservedPeerNameReason(name: string): "empty" | "address_prefix" | "transport_scheme" | "socket_path" | "at_sign" | "wildcard" | "reserved_name" | "agent_id_shape" | undefined;

package/dist/agents/cross-session-ref.js

@@ -46,6 +46,8 @@ const NAMED_PIPE_RE = /^[\\/]{2}[.?][\\/]pipe[\\/]/i;
 function isSocketPathSpelling(text) {
     return SOCKET_PATH_RE.test(text) || NAMED_PIPE_RE.test(text);
 }
+export const RESERVED_AGENT_NAMES = Object.freeze(["main", "team-lead", "user", "system"]);
+const AGENT_ID_SHAPE_RE = /^a(?:[\w-]{1,63}-)?[0-9a-f]{16}$/;
 export function reservedPeerNameReason(name) {
     const key = normalizePeerName(name);
     if (key === "")
@@ -60,5 +62,9 @@ export function reservedPeerNameReason(name) {
         return "transport_scheme";
     if (isSocketPathSpelling(name) || isSocketPathSpelling(key))
         return "socket_path";
+    if (RESERVED_AGENT_NAMES.includes(key))
+        return "reserved_name";
+    if (AGENT_ID_SHAPE_RE.test(key))
+        return "agent_id_shape";
     return undefined;
 }

package/dist/agents/cumulative-stats.d.ts

@@ -1,16 +1,16 @@
 import type { TaskResult } from "../core/types.js";
 /**
  * Shared CUMULATIVE-STATS constructor for the multi-leg agent compositions (cascade rungs, repair-loop
- * attempts, teacher student attempts). All three run `runner.runTask` MORE THAN ONCE and must report the
- * OPERATION's totals, not the last leg's.
+ * attempts, verify legs). Each runs `runner.runTask` MORE THAN ONCE and must report the OPERATION's totals,
+ * not the last leg's.
  *
  * The invariant this exists to hold in ONE place: **every field the accumulator tracks is OVERRIDDEN over
  * the base stats**. A field left un-overridden silently leaks the LAST leg's value dressed up as a
  * cumulative total (the cascade R1-m5 / R3 trap; repair-loop shipped exactly that hole on `humanReview`).
- * Three independent copies of this literal is how that hole survived in one copy while the other two were
- * fixed — hence one constructor, three call sites.
+ * Independent copies of this literal is how that hole survived in one copy while the others were fixed —
+ * hence one constructor.
  *
- * OWN and NESTED stay DISJOINT (the cascade R-5 / teacher A-7 convention): a consumer adds
+ * OWN and NESTED stay DISJOINT (the cascade R-5 convention): a consumer adds
  * `stats.X + stats.nested.X` for the true total; nested cost is never folded into `costMicroUsd`.
  */
 /** Cumulative delegated-subagent (nested) totals, summed across every leg. */
@@ -47,14 +47,11 @@ export interface CumulativeStatsAccumulator {
     cacheWriteTokens: number;
     cacheWriteTokensLong: number;
     /**
-     * Cumulative own LLM cost (micro-USD) EXACTLY as the caller wants it published. Callers differ on the
-     * zero case on purpose and this constructor does not adjudicate: cascade/repair-loop publish a plain `0`
-     * (a run happened, it cost nothing measurable), teacher collapses `0` to `undefined` (the RB-368
-     * "unpriced spend is absent, not free" posture). Unifying the two is a BEHAVIOR change, not a refactor.
+     * Cumulative own LLM cost (micro-USD): a plain `0` when every leg was priced and cost nothing measurable.
      *
      * Ignored entirely when {@link anyLegUnpriced} is set — see there.
      */
-    costMicroUsd: number | undefined;
+    costMicroUsd: number;
     /**
      * TRUE when ANY contributing leg published no `costMicroUsd`, i.e. it ran on a model with neither a
      * `RunnerDeps.pricing` entry nor a `Model.cost` declaration (`stats.costMicroUsd` is contractually
@@ -100,11 +97,11 @@ export interface CumulativeStatsTracker {
  * Create a {@link CumulativeStatsTracker}.
  *
  * {@link buildCumulativeStats} made the OUTPUT literal single-source, but the INPUT fold stayed copied:
- * cascade / repair-loop / teacher each hand-maintain the same dozen `+=` lines, so a new stats field still
- * has to be remembered in four places — the same duplication one level down from the hole this module
- * exists to close. New call sites take this factory instead. Migrating the three originals onto it is a
- * separate change (their folds are equivalent to this one today, but rewriting three shipped compositions
- * is not part of a cost-accounting bug fix).
+ * cascade / repair-loop each hand-maintain the same dozen `+=` lines, so a new stats field still has to be
+ * remembered in three places — the same duplication one level down from the hole this module exists to
+ * close. New call sites take this factory instead. Migrating the two originals onto it is a separate change
+ * (their folds are equivalent to this one today, but rewriting shipped compositions is not part of a
+ * cost-accounting bug fix).
  *
  * OWN and NESTED stay DISJOINT here too: `add` never folds a leg's `nested.*` into the own totals.
  */

package/dist/agents/cumulative-stats.js

@@ -59,7 +59,7 @@ export function createCumulativeStatsTracker() {
             acc.outputTokens += s.outputTokens ?? 0;
             acc.cacheWriteTokens += s.cacheWriteTokens ?? 0;
             acc.cacheWriteTokensLong += s.cacheWriteTokensLong ?? 0;
-            acc.costMicroUsd = (acc.costMicroUsd ?? 0) + (s.costMicroUsd ?? 0);
+            acc.costMicroUsd += s.costMicroUsd ?? 0;
             if (s.costMicroUsd === undefined)
                 acc.anyLegUnpriced = true;
             if (s.costBreakdown) {

package/dist/agents/extra-tool-names.js

@@ -1,6 +1,6 @@
 import { isToolContentOrigin } from "../core/memory-engine/content-origin.js";
 import { inlineUntrusted } from "../core/untrusted-text.js";
-import { readToolNameList, valueTypeLabel } from "./tool-filter.js";
+import { readToolNameList, valueTypeLabel } from "../core/tool-name-list.js";
 export const EXTRA_TOOL_NAMES_CODE = "config.extra_tool_names";
 export function extraToolNamesError(message, reason) {
     const e = new Error(message);

package/dist/agents/inherited-tool-pool.d.ts

@@ -1,15 +1,18 @@
-import type { ToolSpec } from "../core/types.js";
+import type { McpServerSpec, ToolSpec } from "../core/types.js";
+import type { ToolSelector } from "../core/tool-face.js";
+import type { MountedMcp } from "../core/mounted-mcp.js";
 /**
  * What a delegated child inherits when its delegation tool has no explicit pool (`SubagentToolOptions.inheritedTools`):
- * the parent surface, narrowed at spawn by two laws. The mint of the parent bound ({@link callerToolMembership}) and both
- * reads live here, so the law has one home.
+ * the parent surface, narrowed at spawn by two laws, and the parent's MCP declarations. The mint of the parent bound
+ * ({@link callerToolMembership}) and the reads live here, so the law has one home. Which of these tools the child may USE is
+ * not decided here: its own prepare runs its selector over everything it is handed and mounts.
  */
-/** The team task-list family: the pool-borne members of the upstream teammate exception set (the rest of that set,
- *  SendMessage and the Cron trio, is mounted by a child's own prepare and never rides a delegation pool). */
+/** The team task-list family (pool-borne; the catalog marks it a teammate's protocol UNDER the ceiling — a named child holds the ones its
+ *  spawner may use). */
 export declare const TEAM_TASK_LIST_TOOL_NAMES: readonly string[];
-/** The run's `mountsCallerTool` seat: membership BY IDENTITY in `spec.tools` as the caller handed it (a copy of the
- *  array taken now; nothing is read off the entries, so no entry can make the mint throw). */
-export declare function callerToolMembership(tools: readonly ToolSpec[] | undefined): (tool: ToolSpec) => boolean;
+/** The run's `mountsCallerTool` seat: membership BY IDENTITY in `spec.tools` as the caller handed it (the roster snapshot's
+ *  copy of the array — the one read of the slot; nothing is read off the entries, so no entry can make the mint throw). */
+export declare function callerToolMembership(tools: readonly unknown[] | undefined): (tool: ToolSpec) => boolean;
 /**
  * The inherited pool for one spawn.
  *  · ⊆ parent: an entry survives only when the spawning run mounts THAT instance — a same-named replacement (a host's
@@ -20,9 +23,10 @@ export declare function callerToolMembership(tools: readonly ToolSpec[] | undefi
  */
 export declare function inheritedChildPool(surface: readonly ToolSpec[], mountsCallerTool: ((tool: ToolSpec) => boolean) | undefined, anonymousBackground: boolean): ToolSpec[];
 /**
- * The task-list members of a named child's INHERITED pool that stand past its allowlist (upstream: a teammate built from a
- * custom agent type gets `[...type.tools, SendMessage, ...the four when the root has them]` — the root's own first-party
- * tools). Only what the child inherited is widened: a pool the host composed (`tools`, `extraTools`) is judged by the
- * allowlist as written, since a model-chosen name must not lift a host's restriction. A deny still wins.
+ * The MCP servers a delegated child is declared: each server its spawning run declares, exactly as declared, when the child's
+ * selector can admit a tool of it ({@link ToolSelector.admitsPeer} — read off the lists, never off what the server lists now).
+ * A server the selector can never reach is not declared, so it is never dialled or leased for this child. The child connects
+ * from these (through the run tree's pool) and its own selector decides, at intake and on every refresh and re-dial, which of
+ * the server's tools mount.
  */
-export declare function teammateInheritedFamily(inherited: readonly ToolSpec[], denyTools: ReadonlyArray<string> | undefined): ToolSpec[];
+export declare function inheritedMcpDeclarations(mounted: MountedMcp, selector: ToolSelector): McpServerSpec[];

package/dist/agents/inherited-tool-pool.js

@@ -1,4 +1,5 @@
-import { resolveToolSubset } from "./tool-filter.js";
+import { mintNamespacePrefix } from "../core/protocol-naming.js";
+import { MCP_NAMESPACE } from "../core/protocol-table.js";
 import { TASK_CREATE_TOOL_NAME, TASK_GET_TOOL_NAME, TASK_LIST_TOOL_NAME, TASK_UPDATE_TOOL_NAME } from "../core/tool-catalog-entries.js";
 export const TEAM_TASK_LIST_TOOL_NAMES = Object.freeze([TASK_CREATE_TOOL_NAME, TASK_GET_TOOL_NAME, TASK_LIST_TOOL_NAME, TASK_UPDATE_TOOL_NAME]);
 export function callerToolMembership(tools) {
@@ -10,6 +11,6 @@ export function inheritedChildPool(surface, mountsCallerTool, anonymousBackgroun
         return [];
     return surface.filter((t) => mountsCallerTool(t) && !(anonymousBackground && TEAM_TASK_LIST_TOOL_NAMES.includes(t.name)));
 }
-export function teammateInheritedFamily(inherited, denyTools) {
-    return resolveToolSubset(inherited.filter((t) => TEAM_TASK_LIST_TOOL_NAMES.includes(t.name)), undefined, denyTools);
+export function inheritedMcpDeclarations(mounted, selector) {
+    return mounted.servers.filter((m) => selector.admitsPeer(mintNamespacePrefix(MCP_NAMESPACE, m.server.name))).map((m) => m.server);
 }

package/dist/agents/peer-session-drain.d.ts

@@ -2,6 +2,7 @@ import { type MailboxCrossProcessVerdict, type MailboxStore } from "../core/mail
 import { type SessionBoxBinding, type SystemInjectionPriority, type TaskNotificationPayload } from "../core/task-notification.js";
 import { type FrameSettlement } from "../core/frame-settlement.js";
 import { type EngineNotice, type RunnerDeps } from "../core/types.js";
+import type { ToolSelector } from "../core/tool-face.js";
 import { type PermissionModeClass } from "./cross-session-envelope.js";
 import { type CrossSessionInboundSettingLayers } from "./cross-session-judge.js";
 import { type PeerLaneConfig } from "./peer-admission.js";
@@ -214,13 +215,13 @@ export declare function peerLaneSendMessageSeats(args: {
 }): Pick<SendMessageToolOptions, "peerDirectory" | "peerSelfSession" | "peerListingMounted">;
 /**
  * design/385 §5.1 — THE ListAgents mount predicate, single source: the built-in mounts only when the
- * face does not exclude it and no caller tool owns either spelling (`ListAgents` / `ListPeers`) as its
+ * leg's selector admits it and no caller tool owns either spelling (`ListAgents` / `ListPeers`) as its
  * name OR as an alias. Every reader of "is ListAgents on this roster?" — the mount itself and the
  * SendMessage face's listing phrase — calls this one predicate, so a face can never name a tool the
  * roster does not carry (a second, inline copy of the rule drifted on exactly the alias arms).
  */
 export declare function listAgentsMountable(face: {
-    exclude: readonly string[] | undefined;
+    selector: Pick<ToolSelector, "admits">;
     specTools: ReadonlyArray<{
         name: string;
         aliases?: readonly string[];

package/dist/agents/peer-session-drain.js

@@ -684,12 +684,13 @@ export function peerLaneSendMessageSeats(args) {
     };
 }
 export function listAgentsMountable(face) {
-    if ((face.exclude ?? []).includes(LIST_AGENTS_TOOL_NAME))
-        return false;
-    return !face.specTools.some((t) => t.name === LIST_AGENTS_TOOL_NAME || t.name === LIST_AGENTS_TOOL_ALIAS || t.aliases?.includes(LIST_AGENTS_TOOL_NAME) || t.aliases?.includes(LIST_AGENTS_TOOL_ALIAS));
+    return face.selector.admits({ name: LIST_AGENTS_TOOL_NAME, aliases: [LIST_AGENTS_TOOL_ALIAS] }) && listAgentsNameFree(face.specTools);
+}
+function listAgentsNameFree(specTools) {
+    return !specTools.some((t) => t.name === LIST_AGENTS_TOOL_NAME || t.name === LIST_AGENTS_TOOL_ALIAS || t.aliases?.includes(LIST_AGENTS_TOOL_NAME) || t.aliases?.includes(LIST_AGENTS_TOOL_ALIAS));
 }
 export function mountListAgents(args) {
-    if (!listAgentsMountable({ exclude: undefined, specTools: args.specTools }))
+    if (!listAgentsNameFree(args.specTools))
         return undefined;
     args.toolEffects.set(LIST_AGENTS_TOOL_NAME, "read");
     args.toolEffects.set(LIST_AGENTS_TOOL_ALIAS, "read");

package/dist/agents/send-message-tool.js

@@ -18,6 +18,7 @@ import { appendHopToken, judgePeerAdmission, peerAxisToken, resolvePeerLaneConfi
 import { toolFace } from "../core/tool-catalog-entries.js";
 import { thrownText } from "../core/thrown-value.js";
 import { assertNoRetiredKeys } from "../core/retired-keys.js";
+import { clampValuesOf } from "../core/child-clamp-seats.js";
 import { resolveSubagentTranscriptTier } from "../core/wiring-manifest.js";
 export const SEND_MESSAGE_TOOL_NAME = "SendMessage";
 let uplinkSeqGlobal = Date.now();
@@ -1035,16 +1036,8 @@ export function createSendMessageTool(opts) {
                     ...(opts.notify ? { currentParentNotify: opts.notify } : {}),
                     ...(ctx.onQuestion !== undefined && row.sessionScoped !== true ? { currentOnQuestion: ctx.onQuestion } : {}),
                     currentClamps: {
-                        ...(ctx.handsReadOnly === true ? { handsReadOnly: true } : {}),
-                        ...(ctx.readFace === "roots" ? { readFaceRoots: true } : {}),
-                        ...(ctx.writeFace === "roots" ? { writeFaceRoots: true } : {}),
-                        ...(ctx.readDenyPatterns !== undefined ? { readDenyPatterns: ctx.readDenyPatterns } : {}),
-                        ...(ctx.interactiveTools === false ? { interactiveTools: false } : {}),
-                        ...(ctx.approvalReach === "none" ? { approvalReach: "none" } : {}),
-                        ...(ctx.oneShot === true ? { oneShot: true } : {}),
-                        ...(ctx.memoryPersistenceCapable === false ? { memoryPersistenceCapable: false } : {}),
+                        ...clampValuesOf(ctx, ctx.parentSpecSeat),
                         ...(ctx.parentSpecSeat?.memoryOff === true ? { memoryOff: true } : {}),
-                        ...(ctx.parentSpecSeat?.fileHistory === "disabled" ? { fileHistory: "disabled" } : {}),
                     },
                     ...(ctx.autoModeReview !== undefined ? { currentAutoModeReview: ctx.autoModeReview } : {}),
                 });

package/dist/agents/subagent.d.ts

@@ -397,19 +397,6 @@ export interface SubagentSteerHandle {
  *  must not be guessable by untrusted content — the old `steer-a<seq>` global counter let injected text
  *  pre-claim "[steer-aN]" and self-declare correlation; the same fix applies to the new resume markers. */
 export declare function markerFragment(): string;
-/**
- * design/122 D2 — build the `resume` verb for one delegation (closure over the ledger + delegation runner —
- * NEVER the parent tool ctx / spec builder, r1-m5). Validation order: TTL sweep (MAJOR-1) → disposed?
- * (MAJOR-3) → retained/evicted? → still running? → cap → SYNCHRONOUS claim (MAJOR-2: `running = true`
- * before any await; rolled back on pre-launch failure) → session exists AND non-empty (r1-m1).
- * Then: fenced revive prompt (unpredictable marker) →
- * `runTaskStream` on the FROZEN spawn snapshot + `requireExistingSession` (spec is tighten-only: the caller
- * contributes ONLY `content`) → ledger `activeRun` bookkeeping → completion announced through
- * `deps.notify` (no sink ⇒ silent). Which lane
- * that is depends on the mount: the background Agent lane wires the deployment-level background-notify
- * sink, while the SendMessage mount wires the SENDING run's own notification injector — there the
- * completion notice lands in the sender's live injection queue at its next turn boundary.
- */
 export declare function createSubagentResume(deps: {
     ledger: SubagentRetainLedger | undefined;
     parentToolCallId: string;
@@ -441,18 +428,11 @@ export declare function createSubagentResume(deps: {
      *  read-only / hard-headless / one-shot run and still act with the spawn turn's capabilities — the
      *  resumer driving actions it could not perform itself. The fold is a union of restrictions (either
      *  side saying "restricted" wins), never a relaxation: a snapshot clamp is not lifted by a resumer
-     *  that lacks it. Absent ⇒ the snapshot governs alone (prior behavior). */
-    currentClamps?: {
-        handsReadOnly?: true;
-        interactiveTools?: false;
-        approvalReach?: "none";
-        oneShot?: true;
-        memoryPersistenceCapable?: false;
+     *  that lacks it. Absent ⇒ the snapshot governs alone (prior behavior). The seats are the clamp table's rows
+     *  (`ClampValues`: only restricting values), plus the memory-off fact — a rewrite of the `memory` declaration,
+     *  not a value seat. */
+    currentClamps?: import("../core/child-clamp-seats.js").ClampValues & {
         memoryOff?: true;
-        fileHistory?: "disabled";
-        readFaceRoots?: true;
-        writeFaceRoots?: true;
-        readDenyPatterns?: readonly import("../tools/fs/read-deny.js").ReadDenyEntry[];
     };
     /** The RESUMING caller's own handback-review seat (its trusted `ToolExecuteContext.autoModeReview`),
      *  same turn-bound reasoning as `currentOnQuestion` above: a resumed cycle is a completion like any
@@ -704,13 +684,14 @@ export interface SubagentToolOptions {
     inheritedTools?: ToolSpec[];
     /**
      * Tool-level allowlist (design/38 1A), used when NO `agent` is selected (a selected agent definition's
-     * own `allowTools`/`denyTools` REPLACE these). When set, the child sees only these of its pool and of the engine's hand
-     * tools its run mounts (Read / Write / Bash …) (`["*"]` = all). Omit for everything. Allowlist is the security-recommended shape.
-     * NOTE: this filters only the WORK tools — the nested delegation tool is governed by `maxDepth`, not
-     * allow/deny. To deny the child any further delegation, set `maxDepth: 1` (not a `denyTools` entry).
+     * own `allowTools`/`denyTools` REPLACE these). When set, the child may use only what it names, out of everything its run would
+     * mount (its pool, the hands, the engine's own tools, the MCP tools it inherits) — the child's own selector layer, under the
+     * spawning run's selector (`["*"]` = no allowlist of its own). Omit for everything the parent could use. Allowlist is the
+     * security-recommended shape. The nested delegation tool is one of the tools it governs: a child gets one only while under
+     * `maxDepth` AND when these lists admit the delegation tool's name.
      */
     allowTools?: string[];
-    /** Tool-level denylist (design/38 1A), used when no `agent` is selected: names removed from the pool and the hand tools (a deny wins). */
+    /** Tool-level denylist (design/38 1A), used when no `agent` is selected: the denied half of the child's own selector layer (a deny wins). */
     denyTools?: string[];
     /** System prompt / persona for the child. Default (1.259.0, CC 198 parity): the LEAN
      *  {@link SUBAGENT_PROMPT} (agent persona + return contract), NOT the full default constitution role