@sema-agent/core 7.48.0 → 7.49.1

package/dist/core/runner/runtask.js

@@ -14,7 +14,7 @@ import { screenSwappableDeps } from "../swappable-deps.js";
 import { runSideQuery } from "../side-query.js";
 import { PushQueue } from "../push-queue.js";
 import { TtlSessionStore } from "../session-store.js";
-import { errorCodeOf } from "./assemble-result.js";
+import { errorCodeOf } from "./terminal-account.js";
 import { effectiveDelegationFacts, prepareTask } from "./prepare-task.js";
 import { SessionReadFileStates } from "./session-read-file-states.js";
 import { SessionModeSeats } from "./session-mode-seats.js";
@@ -25,7 +25,7 @@ import { PendingSessionNotifications } from "../task-notification.js";
 import { ToolDetachHub } from "../tool-detach.js";
 import { assertContextSettingsValue, assertContextSettingsWords, contextOverlayFor } from "../context-settings.js";
 import { createRunState } from "./initial-run-state.js";
-import { reconciledToolEndBody } from "./tool-end-body.js";
+import { emitSettled, reconciledEnd } from "./tool-end-body.js";
 import { answerFaceForRedeemedCall } from "./decide-continuation.js";
 import { createTurnBoundary } from "./run-turn-boundary.js";
 import { createHarnessHandlers } from "./run-harness-handlers.js";
@@ -463,12 +463,12 @@ export class Runner {
                         const { todoToolMounted, taskToolsMounted, writeFamilyOf, toolStartAt, startedToolCallIds } = runToolMountFacts({ spec, prepared, rs });
                         const { observeReasoningWireFacts, reasoningResolution } = runReasoningSeat({ prepared, rs, taskIdRef });
                         const { effectiveTimeoutMs, walltimeMonotonicDeadline, timeout, pushContent, ownCommittedTailRef, emitCommitted } = runClockAndContent({ spec, prepared, queue, internals, rs, ident, parentToolCallId, startedToolCallIds });
-                        const toolProgress = createToolProgressLane(pushContent, ident);
+                        const toolProgress = createToolProgressLane(pushContent, ident, prepared.toolOccurrences);
                         prepared.toolProgressRef.current = toolProgress;
-                        const { subagentName, withBrainSinks } = runBrainSinks({ queue, internals, rs, ident, parentToolCallId, observeReasoningWireFacts });
+                        const { subagentName, withBrainSinks, withExtraBodyDroppedSink } = runBrainSinks({ queue, internals, rs, ident, parentToolCallId, observeReasoningWireFacts, notice: { onNotice: this.deps.onNotice, sessionId: prepared.sessionId, runId: prepared.runId } });
                         const toolLabels = new Map(prepared.tools.flatMap((t) => (t.label !== undefined && t.label !== t.name ? [[t.name, t.label]] : [])));
                         for (const orphan of prepared.wakeRecovered) {
-                            queue.push({ type: "tool_end", toolCallId: orphan.toolCallId, toolName: orphan.toolName, ...(toolLabels.has(orphan.toolName) ? { label: toolLabels.get(orphan.toolName) } : {}), isError: true, ...reconciledToolEndBody(orphan, prepared.structuredProjector), ...ident() });
+                            emitSettled(prepared.toolOccurrences, { toolCallId: orphan.toolCallId, spelledName: orphan.toolName, ...(toolLabels.has(orphan.toolName) ? { label: toolLabels.get(orphan.toolName) } : {}), args: orphan.args }, reconciledEnd(orphan), { push: (f) => queue.push({ ...f, ...ident() }), structured: prepared.structuredProjector });
                             emitCommitted(orphan.entryId, "toolResult", orphan.toolCallId);
                         }
                         const postToolBatchHook = (spec.hooks ?? this.deps.hooks)?.postToolBatch;
@@ -504,8 +504,8 @@ export class Runner {
                             },
                         });
                         const { flushGitMirror, unsubGitRetry, unsubBoundary, unsub } = runGitLane({ prepared, queue, rs, ident, onMessageUpdate, onMessageEnd, onToolStart, onToolEnd, onTurnEnd, onTurnBoundary, runner: this.depsSeat });
-                        return runLeg({
-                            spec, queue, prepared, resume, rs, isDelegatedChild: internals?.isDelegatedChild === true, entryActor, effectiveTimeoutMs, timeout, pushContent, ident, emitCommitted, writeFamilyOf, startedToolCallIds,
+                        return withExtraBodyDroppedSink(() => runLeg({
+                            spec, queue, prepared, resume, rs, entryActor, effectiveTimeoutMs, timeout, pushContent, ident, emitCommitted, writeFamilyOf, startedToolCallIds,
                             announceWorkspaceMove, withBrainSinks, flushGitMirror, loopLatch, notificationLane, unsubscribeTaskNotifications, unsubGitRetry, unsubBoundary, unsub,
                             runner: this.depsSeat,
                             next: ({ final, threw, abortedLive, userInterruptedLive, strandedHumanAnswers }) => runTerminalAdoption({
@@ -517,7 +517,7 @@ export class Runner {
                                     setResult, onSuggestions, onSuspend, runner: this.depsSeat, sessions: this.sessions,
                                 }),
                             }),
-                        });
+                        }));
                     },
                 });
             },

package/dist/core/runner/session-rule-policy.js

@@ -7,6 +7,8 @@ import { ruleDenialSentence } from "../rule-denial-sentence.js";
 import { DEFAULT_GATE_AWAIT_TIMEOUT_MS, gateWaitFailureOf, withGateTimeout } from "../gate-bounded-await.js";
 import { declaredPathTargetOf, isProtectedWrite, pathConfinableWriteToolNames } from "../tool-registry.js";
 import { pathTargetBaseOf } from "../effective-path-target.js";
+import { judgePathRows } from "../path-guard-rows.js";
+import { domainRow } from "../fs-write-gate-policy.js";
 export const PATH_CONFINABLE_WRITE_TOOLS = pathConfinableWriteToolNames();
 export function isWithin(root, p) {
     if (!root)
@@ -165,17 +167,15 @@ export function createSessionRulePolicy(rules, opts) {
                         return deny(req.toolName, "the call has no resolvable path to confine, while the rule confines writes to allowDirs");
                     }
                     const canon = await canonicalizeTarget(env, path, signal, pathFamilyOf({ root: rootPath, cwd: req.cwd ?? env.cwd }), pathTargetBaseOf(declared, { root: rootPath, cwd: req.cwd }));
-                    if (!canon.ok) {
-                        return deny(req.toolName, `the real target of the write to ${JSON.stringify(path)} could not be resolved against the session-rule allowDirs`);
-                    }
                     const roots = [];
                     for (const raw of allowDirs) {
                         const r = await canonicalizeTarget(env, raw, signal, pathFamilyOf({ root: rootPath ?? env.cwd }), rootPath);
                         if (r.ok)
                             roots.push(r.key);
                     }
-                    if (!roots.some((root) => isWithin(root, canon.key))) {
-                        return deny(req.toolName, `the write to ${JSON.stringify(path)} is outside the session-rule allowDirs (${allowDirs.join(", ")})`);
+                    const views = canon.ok ? { views: [{ path: canon.key, kind: "canonical" }] } : { views: [], unreadable: canon.message };
+                    if (judgePathRows([domainRow("session", roots)], views, "allow") === undefined) {
+                        return deny(req.toolName, canon.ok ? `the write to ${JSON.stringify(path)} is outside the session-rule allowDirs (${allowDirs.join(", ")})` : `the real target of the write to ${JSON.stringify(path)} could not be resolved against the session-rule allowDirs`);
                     }
                 }
             }

package/dist/core/runner/stream-settle-backstop.js

@@ -1,4 +1,4 @@
-import { errorCodeOf } from "./assemble-result.js";
+import { errorCodeOf, thrownFailureOf } from "./terminal-account.js";
 import { resumeDecisionWasNegative } from "./decide-continuation.js";
 import { drainForwardedFramesBeforeDone, forwardsSubagentEvents } from "./prepare-run-refs.js";
 import { hasDestroy } from "../remote-env.js";
@@ -10,7 +10,7 @@ import { asThrownError, readMember, thrownText } from "../thrown-value.js";
 export function streamSettleBackstop(input) {
     const { spec, resume, queue, taskIdRef, entryTracer, runStartedAt, live, runner, sessions, locallyClaimedTokens, parentConstraintRegistry, suspendedEnvReaps } = input;
     const onRunRejected = async (err) => {
-        let code = errorCodeOf(err);
+        let { code, message, detail } = thrownFailureOf(err, thrownText(err));
         const reopenReason = code === "resume.tool_unavailable" || code === "resume.tool_contract_mismatch" ? "tool_unavailable" : "env_failed";
         const reopenable = resume !== undefined && resume.pendingActionStarted !== true && reopenReason !== undefined && !(resumeDecisionWasNegative(resume) && resume.decisionDelivered === true);
         let reopenCommitted = false;
@@ -29,7 +29,10 @@ export function streamSettleBackstop(input) {
                 err = Object.assign(new Error(definitive
                     ? `${reopenMsg} (original resume failure: ${original.message})`
                     : `checkpoint reopen threw mid-flight — state UNKNOWN, confirm via the checkpoint store before retrying: ${reopenMsg} (original resume failure: ${original.message})`, { cause: original }), { code: "checkpoint.reopen_failed" });
-                code = "checkpoint.reopen_failed";
+                const replacement = thrownFailureOf(err, thrownText(err));
+                code = replacement.code;
+                message = replacement.message;
+                detail = replacement.detail;
             }
         }
         if (resume)
@@ -69,7 +72,7 @@ export function streamSettleBackstop(input) {
             taskId: taskIdRef.current ?? "unknown",
             sessionId: taskIdRef.sessionId ?? "unknown",
             ...(taskIdRef.runId !== undefined ? { runId: taskIdRef.runId } : {}),
-            terminal: { kind: "failed", ...(code !== undefined ? { code } : {}), message: thrownText(err) },
+            terminal: { kind: "failed", ...(code !== undefined ? { code } : {}), message, ...(detail !== undefined ? { detail } : {}) },
             result: "",
             ...(remoteEnvFailure !== undefined ? { remoteEnvFailures: remoteEnvFailure } : {}),
             ...(taskIdRef.effectiveMemoryScopes !== undefined ? { effectiveMemoryScopes: taskIdRef.effectiveMemoryScopes } : {}),

package/dist/core/runner/sub-agent-deny-lists.d.ts

@@ -1,15 +1,24 @@
 /**
- * The sub-agent tool lists of one prepared task: the allow advisory for `TaskSpec.agents` and THE judgment of every denied-tools
- * list a deployment writes — the task's own definitions (`TaskSpec.agents`), the definitions a mounted delegation tool carries
- * (the `authored` faces — the engine's built-ins name tools of other vocabularies and are not judged) and its tool-level list.
- * Universe = the task's assembled roster plus every mounted delegation tool's pool, names and aliases; a pool the engine cannot
- * list (an `extraTools` factory with no declared roster) turns the refusals that need a roster into host notices. A tool's own lists are judged where
- * the tool is mounted: only a tool a deployment mounted (depth 0) publishes them (`authored`, `agentToolLevelAllowTools`, `agentToolLevelDenyTools`), the
- * engine's nested copy for a delegated child carries neither.
+ * THE judgment of every tool-name list one prepared task receives — the run's own selector lists (`TaskSpec.allowTools` /
+ * `TaskSpec.excludeTools`, unless the delegation lane spawned it — its spawning run judged them where they were mounted), the definitions it
+ * carries (`TaskSpec.agents`), and the definitions and tool-level lists a mounted delegation tool carries (the `authored` faces
+ * — the engine's built-ins are not judged; only a tool a deployment mounted (depth 0) publishes them). One rule for both sides:
+ * a value that is not a list, an entry that is not a string, a spelling that can name no tool, a stale name and a name the
+ * universe does not carry are REFUSED; a list whose universe the engine cannot list (a delegation tool that injects tools per
+ * spawn with no declared roster) turns the refusals that need a universe into host notices. And one contradiction, judged on
+ * every leg: a denylist (the run's own or one of its ceiling) that reaches a tool the leg's kind relies on (the catalog's
+ * protocol column) is refused — neither a silently ignored deny nor a silently crippled leg.
  *
- * Throws `config.agent.unknown_tool` (`refused`, the one site) — synchronous, like the phase that calls it.
+ * Universe = the task's assembled roster before the valve, every tool the catalog describes, every mounted delegation tool's
+ * pool and the caller's own tools (names and aliases), and the protocol peers the task declares (a namespaced spelling under a
+ * declared peer names a tool of it — the peer's tool list is runtime data, so the peer is what is checked).
+ *
+ * Throws `config.tool_face_control` for the run's own lists and the protocol contradiction, `config.agent.unknown_tool` for a
+ * definition's or a delegation tool's lists — synchronous, like the phase that calls it.
  */
 import type { AgentTool } from "../../internal/harness.js";
+import { type ProtocolId } from "../protocol-table.js";
+import type { ToolLegKind, ToolSelectorLayer } from "../tool-face.js";
 import type { TaskSpec } from "../types.js";
 import type { AnnounceOnceSink } from "./contracts.js";
 /**
@@ -19,14 +28,44 @@ import type { AnnounceOnceSink } from "./contracts.js";
  * need the leg's roster and a sink; the leg's own policy-name audit is what reads them.
  */
 export declare function deniedToolNamesOf(where: string, value: unknown): string[];
-export interface SubAgentToolListsInput {
-    /** borrowed-readonly — the REBOUND spec: `agents` (the task's definitions) and `tools` (the mounted delegation tools). */
+/**
+ * The upstream judgment of a run's own lists, when it holds: the evidence digest the spawning run handed down (live) or the resumed row
+ * recorded, returned only when it equals the digest of the lists this prepare read — the evidence is bound to the lists it was minted
+ * for, so a resume that hands different lists is judged again. The value returned is what this leg's rows record.
+ */
+export declare function boundToolListsJudgment(evidence: string | undefined, own: {
+    readonly allow: readonly string[] | undefined;
+    readonly exclude: readonly string[] | undefined;
+}): string | undefined;
+export interface RunToolListsInput {
+    /** borrowed-readonly — the REBOUND spec: `agents` (the task's definitions) and `tools` (the caller's tools and the mounted delegation tools). */
     spec: Pick<TaskSpec, "agents" | "tools">;
-    /** borrowed-readonly — the FULLY ASSEMBLED mount array (names + aliases = the roster half of the universe). */
+    /** borrowed-readonly — the assembled mount array BEFORE the selector's valve (names + aliases = the roster half of the universe). */
     tools: ReadonlyArray<AgentTool>;
+    /** borrowed-readonly — the peers the task declares, per protocol of the protocol table (its MCP servers, its A2A peers): a namespaced
+     *  spelling under one names a tool of it, whether or not the peer answered with any tool. */
+    declaredPeers: {
+        readonly [P in ProtocolId]: ReadonlyArray<{
+            readonly name: string;
+        }> | undefined;
+    };
+    /** borrowed-readonly — the run's own lists (the selector's own layer), as the doors froze them. */
+    own: {
+        readonly allow: readonly string[] | undefined;
+        readonly exclude: readonly string[] | undefined;
+    };
+    /** borrowed-readonly — every layer of the run's selector (the ceiling, then its own) and the kinds of leg it is. */
+    layers: readonly ToolSelectorLayer[];
+    legs: readonly ToolLegKind[];
+    /** True ⇔ the spawning run's prepare judged exactly these own lists where they were mounted — the evidence digest it handed down
+     *  (live, or recorded on the resumed row) equals the digest of the lists this prepare read ({@link boundToolListsJudgment}). */
+    judgedUpstream: boolean;
+    /** Whose lists the run's own are, when the run that spawned it wrote them ({@link delegationListWhere}); absent ⇒ the run's own
+     *  `TaskSpec` seats. */
+    ownWhere: string | undefined;
     /** borrowed-readonly — the once-per-session ledger whose operator sink carries the notices. */
     onceLedger: Pick<AnnounceOnceSink, "onError">;
     /** borrowed-readonly — the acquired session's id (operator-line context). */
     sessionId: string;
 }
-export declare function auditSubAgentToolLists(input: SubAgentToolListsInput): void;
+export declare function judgeRunToolLists(input: RunToolListsInput): void;

package/dist/core/runner/sub-agent-deny-lists.js

@@ -1,88 +1,91 @@
-import { notAListSentence, notAStringSentence, readDeniedEntry, readToolNameList, valueTypeLabel } from "../../agents/tool-filter.js";
+import { deniedProtocolTools, delegationListWhere, listReaches, notAListSentence, toolListsDigest, notAStringSentence, readAllowedToolList, readDeniedEntry, readDeniedToolList } from "../../agents/tool-filter.js";
+import { readToolNameList, valueTypeLabel } from "../tool-name-list.js";
 import { compileAllowList, inertEntryPhrase, renderListEntry } from "../allow-entry.js";
 import { inlineUntrusted } from "../untrusted-text.js";
-const DENY_LIST_NAMES_ONLY = "To block by path or command, write a deny rule in the caller's permission policy: a denied-tools list only takes tool names (it narrows which tools the agent is handed).";
-function refused(message) {
+import { ENGINE_TOOLS } from "../tool-catalog-entries.js";
+import { mintNamespacePrefix } from "../protocol-naming.js";
+import { PROTOCOL_TABLE, protocolOf } from "../protocol-table.js";
+import { splitNamespacedName } from "../tool-name-aliases.js";
+const DENY_LIST_NAMES_ONLY = "To block by path or command, write a deny rule in the caller's permission policy: a tool-name list only takes tool names (it narrows which tools are mounted).";
+function universeCarries(reach, entry, universe) {
+    for (const name of universe.known)
+        if (listReaches(reach, { name }))
+            return true;
+    const split = splitNamespacedName(entry);
+    if (split === undefined || split.peer === "")
+        return false;
+    return universe.peers.has(mintNamespacePrefix(split.ns, split.peer));
+}
+function refused(message, code, reason) {
     const e = new Error(message);
-    e.code = "config.agent.unknown_tool";
+    e.code = code;
+    e.detail = { reason };
     return e;
 }
-function refusal(where, flaw) {
-    return refused(`${where} declares tool ${inertEntryPhrase(flaw)} in its denied tools, but no tool of that spelling exists in this deployment — fix the entry or mount the tool.${flaw.reason === "grammar" ? ` ${DENY_LIST_NAMES_ONLY}` : ""}`);
-}
-function refusalNotAString(where, side, index, type) {
-    return refused(notAStringSentence(where, side, index, type));
-}
-function refusalNotAList(where, side, list) {
-    return refused(notAListSentence(where, side, list));
-}
-export function deniedToolNamesOf(where, value) {
-    const list = readToolNameList(value);
-    if (list.kind !== "entries")
-        throw refusalNotAList(where, "denied", list);
-    return list.entries.map((entry, index) => {
-        if (entry === "*")
-            return entry;
-        const read = readDeniedEntry(entry);
-        if (read.kind === "not_a_string")
-            throw refusalNotAString(where, "denied", index, read.type);
-        const flaw = compileAllowList([read.name], "deny").inert[0];
-        if (flaw !== undefined && flaw.reason === "grammar")
-            throw refusal(where, { ...flaw, entry: read.name });
-        return read.name;
-    });
-}
-function judgeDeniedToolNames(where, value, universe, advise) {
+const LIST_WORD = { allowed: "allowed tools", denied: "denied tools" };
+function judgeToolNameList(where, side, value, universe, advise, code) {
     if (value === undefined || value === null)
         return;
     const list = readToolNameList(value);
     if (list.kind !== "entries")
-        throw refusalNotAList(where, "denied", list);
+        throw refused(notAListSentence(where, side, list), code, "not_a_list");
     let index = -1;
     for (const entry of list.entries) {
         index += 1;
-        if (entry === "*")
-            continue;
+        if (typeof entry !== "string")
+            throw refused(notAStringSentence(where, side, index, valueTypeLabel(entry)), code, "not_a_string");
+        if (entry === "*") {
+            if (side === "allowed")
+                continue;
+            throw refused(`${where} declares "*" in its ${LIST_WORD[side]}: a denied list has no wildcard — the entry would hide nothing. To give the agent no tools, write an empty allowed list.`, code, "unsupported_pattern");
+        }
         const read = readDeniedEntry(entry);
-        if (read.kind === "not_a_string")
-            throw refusalNotAString(where, "denied", index, read.type);
-        const { name, content } = read;
-        const raw = entry;
-        const { rows, inert } = compileAllowList([name], "deny", universe.known);
-        const flaw = inert[0] === undefined ? undefined : { ...inert[0], entry: raw };
+        const name = side === "denied" && read.kind === "name" ? read.name : entry;
+        const content = side === "denied" && read.kind === "name" && read.content;
+        const reach = side === "denied" ? readDeniedToolList([entry]) : (readAllowedToolList([entry]) ?? readDeniedToolList([]));
+        const split = splitNamespacedName(name);
+        if (split !== undefined && split.peer === "*" && split.tool === undefined) {
+            if (side === "denied")
+                continue;
+            throw refused(`${where} declares ${renderListEntry(entry)} in its ${LIST_WORD[side]}: an allowed list has no protocol-wide form — name a peer (\`${split.ns.prefix}<peer>\`) or its tools.`, code, "unsupported_pattern");
+        }
+        const { inert } = compileAllowList([name], "deny", universe.known);
+        const flaw = inert[0] === undefined ? undefined : { ...inert[0], entry };
         const stale = flaw !== undefined && (flaw.reason === "tool_name" || flaw.reason === "near_miss");
-        if (flaw !== undefined && (flaw.reason === "grammar" || (stale && universe.complete)))
-            throw refusal(where, flaw);
-        if (flaw === undefined && universe.known.has(name)) {
+        if (flaw !== undefined && (flaw.reason === "grammar" || (stale && universe.complete))) {
+            throw refused(`${where} declares tool ${inertEntryPhrase(flaw)} in its ${LIST_WORD[side]}, but no tool of that spelling exists in this deployment — fix the entry or mount the tool.${flaw.reason === "grammar" ? ` ${DENY_LIST_NAMES_ONLY}` : ""}`, code, "unknown_name");
+        }
+        if (flaw === undefined && universeCarries(reach, name, universe)) {
             if (content)
-                advise(new Error(`${where} declares ${renderListEntry(raw)} in its denied tools: this list reads tool names, not content, so the whole tool "${inlineUntrusted(name, 80)}" is denied to the agent. ${DENY_LIST_NAMES_ONLY}`));
+                advise(new Error(`${where} declares ${renderListEntry(entry)} in its denied tools: this list reads tool names, not content, so the whole tool "${inlineUntrusted(name, 80)}" is denied. ${DENY_LIST_NAMES_ONLY}`));
             continue;
         }
-        advise(new Error(`${where} declares tool ${flaw !== undefined ? inertEntryPhrase(flaw) : renderListEntry(raw)} in its denied tools, a name this task's roster and delegation pools do not carry — the entry hides nothing here. Advisory only: a list shared across deployments is not wrong because one lacks a tool, but a misspelling guards nothing.` +
-            (rows[0]?.compiled.kind === "namespace" ? " This list matches tool names exactly: a server-level entry hides none of that server's tools; name them, or write a deny rule in the caller's permission policy." : "") +
-            (universe.complete ? "" : " A delegation tool this task mounts injects tools the engine cannot enumerate (extraTools), so the name cannot be checked here.")));
+        const phrase = flaw !== undefined ? inertEntryPhrase(flaw) : renderListEntry(entry);
+        if (universe.complete)
+            throw refused(`${where} declares tool ${phrase} in its ${LIST_WORD[side]}, a name no tool of this deployment answers to — fix the entry or mount the tool.`, code, "unknown_name");
+        advise(new Error(`${where} declares tool ${phrase} in its ${LIST_WORD[side]}, a name no listed tool answers to — a delegation tool this task mounts injects tools the engine cannot enumerate (extraTools), so the name cannot be checked here.`));
     }
 }
-function judgeAllowedToolList(where, value, known, advise) {
-    if (value === undefined || value === null)
-        return;
+export function deniedToolNamesOf(where, value) {
     const list = readToolNameList(value);
     if (list.kind !== "entries")
-        throw refusalNotAList(where, "allowed", list);
-    const unknownNames = [];
-    let index = -1;
-    for (const entry of list.entries) {
-        index += 1;
-        if (typeof entry !== "string")
-            throw refusalNotAString(where, "allowed", index, valueTypeLabel(entry));
-        if (known !== undefined && entry !== "*" && !known.has(entry))
-            unknownNames.push(entry);
-    }
-    if (unknownNames.length === 0)
-        return;
-    advise(new Error(`${where} allows tool(s) ${unknownNames.map(renderListEntry).join(", ")} not present in this task's assembled roster — likely a typo (the entry would be item-filtered at spawn; the agent stays usable). Advisory only: the delegation pool can differ from this roster, so a tool mounted only on the delegation tool or produced by per-spawn extraTools makes this spurious.`));
+        throw refused(notAListSentence(where, "denied", list), "config.agent.unknown_tool", "not_a_list");
+    return list.entries.map((entry, index) => {
+        if (entry === "*")
+            return entry;
+        const read = readDeniedEntry(entry);
+        if (read.kind === "not_a_string")
+            throw refused(notAStringSentence(where, "denied", index, read.type), "config.agent.unknown_tool", "not_a_string");
+        const flaw = compileAllowList([read.name], "deny").inert[0];
+        if (flaw !== undefined && flaw.reason === "grammar")
+            throw refused(`${where} declares tool ${inertEntryPhrase({ ...flaw, entry: read.name })} in its denied tools, but no tool of that spelling exists in this deployment — fix the entry or mount the tool. ${DENY_LIST_NAMES_ONLY}`, "config.agent.unknown_tool", "unknown_name");
+        return read.name;
+    });
 }
-export function auditSubAgentToolLists(input) {
+export function boundToolListsJudgment(evidence, own) {
+    return evidence !== undefined && evidence === toolListsDigest(own.allow, own.exclude) ? evidence : undefined;
+}
+export function judgeRunToolLists(input) {
     const { spec, tools, onceLedger, sessionId } = input;
     const advise = (err) => {
         try {
@@ -91,31 +94,59 @@ export function auditSubAgentToolLists(input) {
         catch {
         }
     };
+    const denied = deniedProtocolTools(input.layers, input.legs);
+    if (denied.length > 0) {
+        const names = [...new Set(denied.map((h) => `"${h.name}"`))];
+        const one = names.length === 1;
+        const deniedBy = (own, whose) => {
+            const hits = denied.filter((h) => h.own === own).map((h) => `"${h.name}"`);
+            return hits.length > 0 ? [`${whose} denies ${one ? "it" : hits.join(", ")}`] : [];
+        };
+        const by = [...deniedBy(true, input.ownWhere ?? "this run's own excludeTools"), ...deniedBy(false, "an inherited list (the spawning run's excludeTools, or one it inherits)")];
+        throw refused(`This kind of leg (${input.legs.join(", ")}) relies on ${names.join(", ")}, but ${by.join(" and ")} — the leg cannot work without ${one ? "it" : "them"}. Remove the entry from the list that names it.`, "config.tool_face_control", "protocol_denied");
+    }
     const delegationTools = (spec.tools ?? []).filter((t) => t.agentToolFaces !== undefined);
-    const taskAgents = spec.agents ?? [];
-    if (taskAgents.length === 0 && delegationTools.length === 0)
-        return;
-    const known = new Set(tools.flatMap((t) => [t.name, ...(t.aliases ?? [])]));
-    const denyKnown = new Set(known);
+    const known = new Set();
+    const add = (t) => {
+        known.add(t.name);
+        for (const a of t.aliases ?? [])
+            known.add(a);
+    };
+    for (const t of tools)
+        add(t);
+    for (const t of ENGINE_TOOLS)
+        add(t);
+    for (const t of spec.tools ?? [])
+        add(t);
     for (const t of delegationTools)
         for (const p of t.agentToolPool ?? [])
-            for (const n of [p.name, ...(p.aliases ?? [])])
-                denyKnown.add(n);
-    const universe = { known: denyKnown, complete: delegationTools.every((t) => t.agentToolPool !== undefined) };
-    for (const def of taskAgents) {
-        judgeAllowedToolList(`TaskSpec.agents: agent "${def.name}"`, def.allowTools, known, advise);
-        judgeDeniedToolNames(`TaskSpec.agents: agent "${def.name}"`, def.denyTools, universe, advise);
+            add(p);
+    const peers = new Set(PROTOCOL_TABLE.flatMap((ns) => (input.declaredPeers[ns.id] ?? []).map((p) => mintNamespacePrefix(ns, p.name))));
+    for (const name of known) {
+        const ns = protocolOf(name);
+        const split = ns !== undefined ? splitNamespacedName(name) : undefined;
+        if (split !== undefined && split.peer !== "")
+            peers.add(mintNamespacePrefix(split.ns, split.peer));
+    }
+    const universe = { known, peers, complete: delegationTools.every((t) => t.agentToolPool !== undefined) };
+    if (!input.judgedUpstream) {
+        judgeToolNameList(input.ownWhere ?? "TaskSpec.allowTools", "allowed", input.own.allow, { ...universe, complete: true }, advise, "config.tool_face_control");
+        judgeToolNameList(input.ownWhere ?? "TaskSpec.excludeTools", "denied", input.own.exclude, { ...universe, complete: true }, advise, "config.tool_face_control");
+    }
+    for (const def of spec.agents ?? []) {
+        judgeToolNameList(`TaskSpec.agents: agent "${def.name}"`, "allowed", def.allowTools, universe, advise, "config.agent.unknown_tool");
+        judgeToolNameList(`TaskSpec.agents: agent "${def.name}"`, "denied", def.denyTools, universe, advise, "config.agent.unknown_tool");
     }
-    const replaced = new Set(taskAgents.map((d) => d.name));
+    const replaced = new Set((spec.agents ?? []).map((d) => d.name));
     for (const t of delegationTools) {
         for (const face of t.agentToolFaces ?? []) {
             if (face.authored === true && !replaced.has(face.name)) {
-                const faceWhere = `delegation tool "${t.name}": agent definition "${face.name}"`;
-                judgeAllowedToolList(faceWhere, face.allowTools, undefined, advise);
-                judgeDeniedToolNames(faceWhere, face.denyTools, universe, advise);
+                const faceWhere = delegationListWhere(t.name, face.name);
+                judgeToolNameList(faceWhere, "allowed", face.allowTools, universe, advise, "config.agent.unknown_tool");
+                judgeToolNameList(faceWhere, "denied", face.denyTools, universe, advise, "config.agent.unknown_tool");
             }
         }
-        judgeAllowedToolList(`delegation tool "${t.name}": the tool-level list`, t.agentToolLevelAllowTools, undefined, advise);
-        judgeDeniedToolNames(`delegation tool "${t.name}": the tool-level list`, t.agentToolLevelDenyTools, universe, advise);
+        judgeToolNameList(delegationListWhere(t.name, undefined), "allowed", t.agentToolLevelAllowTools, universe, advise, "config.agent.unknown_tool");
+        judgeToolNameList(delegationListWhere(t.name, undefined), "denied", t.agentToolLevelDenyTools, universe, advise, "config.agent.unknown_tool");
     }
 }

package/dist/core/runner/terminal-account.d.ts

@@ -0,0 +1,48 @@
+/**
+ * The terminal's accounts — `terminal.detail` and its members — each read off the ONE seat its fact was minted on, and
+ * admitted as a value this engine did not necessarily build (a host Brain mints the final message too; a host throws
+ * the error): every member read once, words admitted only from their closed sets, a malformed member absent rather than
+ * repaired. Nothing here re-derives a fact from a sentence. The arbitration of WHICH account a terminal carries is
+ * `assemble-result.ts`'s (`terminalCauseOf`); this module only reads.
+ */
+import { type AssistantMessage, type ModelOutputInvalid } from "../../internal/llm.js";
+import { type RequestRoute } from "../../brain/request-route.js";
+import type { TerminalCause } from "../types.js";
+import type { TerminalFailureDetail } from "../terminal-cause.js";
+type ProviderRejected = Extract<TerminalFailureDetail, {
+    kind: "provider_rejected";
+}>;
+/** The terminal message's provider-condition verdict, as the refusal account carries it: each member read once and
+ *  admitted only as a word of its closed set (a host Brain mints this message too); the reset instant only beside a
+ *  condition. Absent members stay absent. */
+export declare function providerVerdictOf(final: AssistantMessage): Pick<ProviderRejected, "providerCondition" | "providerConditionSource" | "providerResetAtMs">;
+/** The terminal message's request route (`apiErrorRoute`), admitted as a shape some request carries
+ *  (`ROUTE_CREDENTIAL_PAIRING`); anything else is no route. */
+export declare function requestRouteOfMessage(final: AssistantMessage): RequestRoute | undefined;
+/** The terminal message's dropped-calls account (`modelOutputInvalid`): `cause` admitted from its closed set (else no
+ *  account); `outputLimit` only beside `truncated`, only with a boolean `capStop`, its counts only as non-negative
+ *  integers — an unreadable limit leaves the cause standing without it. */
+export declare function modelOutputInvalidOfMessage(final: AssistantMessage): ModelOutputInvalid | undefined;
+/**
+ * Extract a machine-readable code from a thrown error (e.g. `SessionError.code`, a Node error code).
+ * Walks the `cause` chain because the harness wraps lower-level errors (e.g. a `SessionError("conflict")`
+ * append failure surfaces as an `AgentHarnessError("unknown")` whose cause is the real one) — so we
+ * prefer the first specific code over a generic `"unknown"` wrapper.
+ */
+export declare function errorCodeOf(err: unknown): string | undefined;
+/** A thrown failure's terminal account — its code ({@link errorCodeOf}), its sentence (the seat's own describing of the
+ *  thrown value, `text`, through the secret word list: a throw's message is the thrower's text, and a credential in it
+ *  must not reach the result any more than one in its `detail`), and, when the coded link's throw site stated a
+ *  structured `detail`, the `coded` account of it. One reading for every seat that turns a throw into a `failed`
+ *  terminal (the run's arbitration in `assemble-result.ts` and the stream lane's settle backstop). */
+export declare function thrownFailureOf(err: unknown, text: string): {
+    code?: string;
+    message: string;
+    detail?: TerminalFailureDetail;
+};
+/** The completion's one account: the final turn ended on a provider word the brain does not read (the turn was kept
+ *  and the run announced the word) — stated beside the completion, in the echo shape the brain carried it in. */
+export declare function completedTerminalOf(final: AssistantMessage | undefined): Extract<TerminalCause, {
+    kind: "completed";
+}>;
+export {};