@sema-agent/core 7.5.0 → 7.5.2

package/dist/core/runner/prepare-policy-chain.js

@@ -0,0 +1,584 @@
+import { SEND_MESSAGE_TOOL_NAME } from "../../agents/send-message-tool.js";
+import { policyAskClassOf } from "../ask-class.js";
+import { ASK_USER_QUESTION_TOOL_NAME } from "../ask-question.js";
+import { resolveCheckpointStore } from "../checkpoint-store.js";
+import { cloneObserverInput, resolveHookTimeoutMs } from "../hooks.js";
+import { isNamespacedCoveringRuleName, namespacedRuleNameCovers } from "../permission-rules.js";
+import { isIsolated } from "../remote-env.js";
+import { askApproverIdentity, checkToolPolicyProjection, combinePolicies, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, isLiveApproverSeat, resolveAsk, toolPolicyNameSets } from "../tool-policy.js";
+import { RETIRED_TOOL_NAMES } from "../tool-name-aliases.js";
+import { NAMESPACED_NAME_SHAPES, protocolOf } from "../protocol-table.js";
+import { emitTrace } from "../trace.js";
+import { createActiveSkillScopePolicy } from "./active-skill-scope.js";
+import { headlessDenyAtFold, headlessDenyAtRecheck, inheritedAskCarry, judgeInheritedClassifier, lateAskSettlementObserver, settleDenialLimitFallback } from "./denial-limit-arms.js";
+import { askGrantShapeOf } from "./inherited-ask-grants.js";
+import { createPermissionRuleLanes, inheritedAskRuleEvidence, createRuleOffersOf } from "./permission-rule-lanes.js";
+import { createSessionRulePolicy } from "./session-rule-policy.js";
+export async function preparePolicyChain(input) {
+    const { spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, lockedPreflight, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, ownToolNames, shellGatedBash, handsCwdRef, readDenyMatcher, questionToolMounted, runtimeCaps, inheritedAncestorRules, inheritedParentConstraints, seedInheritedGate, hasSkillManifest, skillScope, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef } = input;
+    const policy = lockedPreflight.toolPolicy;
+    const auditPolicyNames = (auditee) => {
+        const nameGroups = toolPolicyNameSets(auditee);
+        if (nameGroups.length > 0) {
+            const known = new Set(tools.flatMap((t) => [t.name, ...(t.aliases ?? [])]));
+            for (const t of harnessTools)
+                known.add(t.name);
+            const unmatched = new Set();
+            for (const g of nameGroups) {
+                for (const [kind, list] of [["deny", g.deny], ["ask", g.ask], ["allow", g.allow]]) {
+                    for (const n of list ?? []) {
+                        if (known.has(n))
+                            continue;
+                        if (isNamespacedCoveringRuleName(n) && [...known].some((k) => namespacedRuleNameCovers(n, k)))
+                            continue;
+                        const retired = RETIRED_TOOL_NAMES.get(n);
+                        if (retired !== undefined) {
+                            const err = new Error(`tool policy ${kind}-list entry "${n}" is a RETIRED tool name (${retired}) and matches nothing in this run's roster — legacy-name normalization was removed (RB-476-A), so this entry would silently guard nothing. Update the deployment's rule to the current name.`);
+                            err.code = "config.legacy_tool_name";
+                            throw err;
+                        }
+                        if (n.includes("__") && protocolOf(n) === undefined) {
+                            const err = new Error(`tool policy ${kind}-list entry "${n}" carries the "__" namespace separator but no protocol prefix, and matches nothing in this run's roster — protocol tools are named ${NAMESPACED_NAME_SHAPES}, and legacy-name normalization was removed (RB-476-A), so this entry would silently guard nothing. Prefix the entry with the owning protocol's marker.`);
+                            err.code = "config.legacy_tool_name";
+                            throw err;
+                        }
+                        unmatched.add(`"${n}" (${kind})`);
+                    }
+                }
+            }
+            const dedupeKey = [...unmatched].sort().join("|");
+            const advised = advisedPolicyNames.get(deps) ?? new Set();
+            if (unmatched.size > 0 && !advised.has(dedupeKey)) {
+                advised.add(dedupeKey);
+                if (advised.size > ADVISED_KEYS_CAP) {
+                    const oldest = advised.values().next().value;
+                    if (oldest !== undefined)
+                        advised.delete(oldest);
+                }
+                advisedPolicyNames.set(deps, advised);
+                try {
+                    const e = new Error(`toolPolicy name audit: ${[...unmatched].join(", ")} match(es) no tool mounted this run (primary or alias) — the rule cannot fire here. Often a typo or a self-report/wire name skew (e.g. TodoWrite vs the mounted TaskCreate family; "*" has no wildcard meaning in a name-keyed policy). Advisory only: enforcement is unchanged, and a name can be legitimate for another scenario or a per-spawn tool.`);
+                    e.code = "config.toolpolicy.unmatched_names";
+                    deps.onError?.(e, { phase: "config", sessionId });
+                }
+                catch {
+                }
+            }
+        }
+    };
+    auditPolicyNames(policy);
+    let sessionRulePolicy;
+    if (deps.sessionPolicyStore && spec.sessionId) {
+        const rules = await deps.sessionPolicyStore.getRules(spec.sessionId, spec.principal);
+        if (rules) {
+            sessionRulePolicy = createSessionRulePolicy(rules, { env: executionEnv, rootPath: taskRootFinal, toolEffects });
+            ownSessionRulesRef.current = {
+                sessionId: spec.sessionId,
+                ...(spec.principal !== undefined ? { principal: spec.principal } : {}),
+                rev: rules.rev,
+                rules,
+            };
+        }
+    }
+    const ancestorRulePolicies = [];
+    for (const snap of inheritedAncestorRules ?? []) {
+        let ancestorRules = snap.rules;
+        if (deps.sessionPolicyStore) {
+            try {
+                const live = await deps.sessionPolicyStore.getRules(snap.sessionId, snap.principal);
+                if (live !== null && live.rev >= snap.rev)
+                    ancestorRules = live;
+            }
+            catch {
+            }
+        }
+        ancestorRulePolicies.push(createSessionRulePolicy(ancestorRules, { env: executionEnv, rootPath: taskRootFinal, toolEffects }));
+    }
+    const skillScopePolicy = hasSkillManifest
+        ? createActiveSkillScopePolicy({
+            scope: skillScope,
+            env: executionEnv,
+            rootPath: taskRootFinal,
+            toolEffects,
+        })
+        : undefined;
+    const frozenConstraintLayers = (seedInheritedGate?.constraintChain ?? [])
+        .filter((e) => !("opaque" in e))
+        .map((entry) => ({
+        check: (creq) => checkToolPolicyProjection(entry, creq) ?? { action: "allow" },
+    }));
+    const narrowingLayers = [sessionRulePolicy, ...ancestorRulePolicies, ...frozenConstraintLayers, skillScopePolicy].filter((p) => p !== undefined);
+    for (const layer of narrowingLayers)
+        auditPolicyNames(layer);
+    const denyNarrowingPolicy = narrowingLayers.length === 0 ? undefined : narrowingLayers.length === 1 ? narrowingLayers[0] : combinePolicies(...narrowingLayers);
+    const basePolicyForResumeEdit = lockedPreflight.basePolicyForResumeEdit ?? lockedPreflight.toolPolicy;
+    const hooks = spec.hooks ?? deps.hooks;
+    const hookTimeoutMs = resolveHookTimeoutMs(hooks?.timeoutMs, notifyOwnHookCrash, hooks);
+    const preToolUseObservational = hooks?.preToolUse !== undefined && hooks.preToolUseObservational === true;
+    const ownGatePreToolUse = !preToolUseObservational
+        ? hooks?.preToolUse
+        : async (toolName, input, ctx) => {
+            const r = await hooks.preToolUse(toolName, cloneObserverInput(input), ctx);
+            if (r === undefined)
+                return undefined;
+            try {
+                const action = typeof r.action === "string" ? r.action : "(non-string action)";
+                deps.onError?.(new Error(`a PreToolUse hook declared observational (Hooks.preToolUseObservational) returned a decision ("${action}") while screening ` +
+                    `"${toolName}" — the decision was NOT adopted and the call proceeded as if the hook had no opinion. ` +
+                    `A declared-observational face must return undefined; drop the declaration if its verdicts are meant to count ` +
+                    `(they then also travel to delegated children as an inherited screening constraint).`), { phase: "hook", sessionId, classification: "observational-hook-verdict-ignored" });
+            }
+            catch {
+            }
+            return undefined;
+        };
+    const sameInstanceAncestorCount = policy === undefined ? 0 : (inheritedParentConstraints ?? []).reduce((n, pc) => (pc.policy === policy ? n + 1 : n), 0);
+    const sharedFirstDecision = new Map();
+    const SHARED_FIRST_DECISION_CAP = 256;
+    const inheritedUnavailableAsks = new Set();
+    const INHERITED_UNAVAILABLE_CAP = 256;
+    const markInheritedUnavailable = (toolCallId) => {
+        if (inheritedUnavailableAsks.size >= INHERITED_UNAVAILABLE_CAP && !inheritedUnavailableAsks.has(toolCallId))
+            return false;
+        inheritedUnavailableAsks.add(toolCallId);
+        return true;
+    };
+    const inheritedAskGrants = new Map();
+    const recordInheritedAskGrant = (toolCallId, approver, presented, waitMs) => {
+        if (typeof approver !== "function")
+            return;
+        if (presented === undefined)
+            return;
+        if (inheritedAskGrants.size >= INHERITED_UNAVAILABLE_CAP && !inheritedAskGrants.has(toolCallId))
+            return;
+        const argsJson = askGrantShapeOf(presented);
+        if (argsJson === undefined)
+            return;
+        inheritedAskGrants.set(toolCallId, { approver, argsJson, presented, waitMs });
+    };
+    const sandboxDeclared = isIsolated(executionEnv);
+    const sandboxAdmissionArmed = (() => {
+        if (!sandboxDeclared)
+            return false;
+        const store = resolveCheckpointStore(spec, deps);
+        const missing = [];
+        if (store === undefined)
+            missing.push("a wired CheckpointStore");
+        else if (store.redecision?.reopen !== true)
+            missing.push("a CheckpointStore that DECLARES redecision.reopen (declaration, never duck-typing)");
+        if (spec.durableApproval === undefined && runtimeCaps?.forceDurableGate !== true)
+            missing.push("a durable park (spec.durableApproval, or the forceDurableGate entitlement)");
+        if (missing.length === 0)
+            return true;
+        try {
+            const e = new Error(`sandbox admission mode NOT armed: the execution env declares an isolated sandbox (capabilities.isolation), but the mode's ` +
+                `park prerequisites are missing — ${missing.join("; ")}. Asks keep the conservative default chain (no auto-admission, no boundary park).`);
+            e.code = "config.sandbox_admission_unavailable";
+            deps.onError?.(e, { phase: "config", sessionId, classification: "sandbox-admission-unavailable" });
+        }
+        catch {
+        }
+        return false;
+    })();
+    const foldAskClasses = new Map();
+    const FOLD_ASK_CLASSES_CAP = 256;
+    const recordFoldAskClass = (toolCallId, cls, layer) => {
+        if (!foldAskClasses.has(toolCallId) && foldAskClasses.size >= FOLD_ASK_CLASSES_CAP)
+            return;
+        const list = foldAskClasses.get(toolCallId) ?? [];
+        list.push({ cls, layer });
+        foldAskClasses.set(toolCallId, list);
+    };
+    const sandboxBoundaryCapable = (toolName) => egressTools.has(toolName) || toolName.includes("__") || ownToolNames.has(toolName) || toolName === SEND_MESSAGE_TOOL_NAME;
+    const emitSandboxAdmitted = (info) => {
+        emitTrace(deps.tracer, () => ({
+            kind: "permission.sandbox_admitted",
+            version: 1,
+            taskId: hostTaskId,
+            toolCallId: info.toolCallId,
+            toolName: info.toolName,
+            askClasses: info.askClasses.map((a) => a.cls),
+            sourceLayers: info.askClasses.map((a) => a.layer),
+            boundary: info.boundary,
+            ts: Date.now(),
+        }));
+    };
+    const ancestorSandboxAdmissions = new Map();
+    const recordAncestorSandboxAdmission = (toolCallId, toolName) => {
+        const list = ancestorSandboxAdmissions.get(toolCallId);
+        if (list !== undefined)
+            list.push({ cls: "sandbox_local", layer: "ancestor_constraint" });
+        else
+            ancestorSandboxAdmissions.set(toolCallId, [{ cls: "sandbox_local", layer: "ancestor_constraint" }]);
+        void toolName;
+    };
+    const callerPolicyLayer = policy !== undefined && sameInstanceAncestorCount > 0
+        ? {
+            check: async (creq, csignal) => {
+                const decision = await policy.check(creq, csignal ?? abortController.signal);
+                sharedFirstDecision.set(creq.toolCallId, decision);
+                if (sharedFirstDecision.size > SHARED_FIRST_DECISION_CAP) {
+                    const oldest = sharedFirstDecision.keys().next().value;
+                    if (oldest !== undefined)
+                        sharedFirstDecision.delete(oldest);
+                }
+                return decision;
+            },
+        }
+        : policy;
+    const askSourceIdentity = () => ({
+        principal: spec.principal,
+        sourceTaskId: sessionId,
+        ...(internals?.parentTaskId !== undefined ? { fromSubagent: true } : {}),
+        ...((internals?.explicitAgentName ?? internals?.agentName) !== undefined
+            ? { sourceAgentName: internals?.explicitAgentName ?? internals?.agentName }
+            : {}),
+        ...(delegation.isDelegatedChild ? { isDelegatedChild: true } : {}),
+    });
+    const riskAxesOf = (toolName) => {
+        const tier = irreversibilityTier.get(toolName);
+        const negatives = axisExplicitNegatives.get(toolName);
+        const irreversible = tier === "always" || tier === "maybe" ? true : tier === "never" ? false : negatives?.irreversible;
+        const egress = egressTools.has(toolName) ? true : negatives?.egress;
+        if (irreversible === undefined && egress === undefined)
+            return {};
+        return { riskAxes: { ...(irreversible !== undefined ? { irreversible } : {}), ...(egress !== undefined ? { egress } : {}) } };
+    };
+    const inheritedAskEvidence = inheritedAskRuleEvidence(deps.permissionRuleStore);
+    const { personal: permissionRuleLane, org: permissionRuleOrgLane } = createPermissionRuleLanes({
+        provider: deps.permissionRuleStore,
+        localOwnerDeclared: deps.localOwnerRules === true,
+        principal: spec.principal,
+        sessionId,
+        root: taskRootFinal,
+        liveCwd: () => handsCwdRef?.current,
+        questionToolMounted,
+        questionToolName: ASK_USER_QUESTION_TOOL_NAME,
+        onRevisionDefect: (message) => deps.onError?.(new Error(message), { phase: "config", sessionId }),
+        onDisclosure: (message) => emitTrace(deps.tracer, () => ({ kind: "permission.rule_store_unreadable", version: 1, taskId: hostTaskId, message, ts: Date.now() })),
+    });
+    const ruleOffersOf = createRuleOffersOf({
+        laneArmed: permissionRuleLane !== undefined,
+        principal: spec.principal,
+        localOwnerDeclared: deps.localOwnerRules === true,
+        egressTools,
+        irreversibilityTier,
+        shellGatedBash,
+        taskRoot: taskRootFinal,
+        cwdRef: handsCwdRef,
+        deniesDirectoryRead: readDenyMatcher !== undefined ? (d) => readDenyMatcher.matchPath(d) !== null : undefined,
+    });
+    const recheckApprovedEdit = async (pol, onAskOf, creq, edit, csignal, ancestorDecider, ancestorTracker) => {
+        let editArgs = edit;
+        for (let round = 0;; round++) {
+            if (round >= 3) {
+                return {
+                    action: "deny",
+                    message: `the approval-edit chain for "${creq.toolName}" exceeded the re-approval cap (inherited parent policy) — denied fail-closed; re-submit the edited action directly`,
+                };
+            }
+            let re;
+            try {
+                re = await pol.check({ ...creq, args: editArgs }, csignal ?? abortController.signal);
+            }
+            catch (err) {
+                return {
+                    action: "deny",
+                    message: `inherited parent policy re-check of the approved edit errored for "${creq.toolName}": ${err instanceof Error ? err.message : String(err)}`,
+                };
+            }
+            if (re.action === "deny")
+                return re;
+            if (re.action === "allow") {
+                return { action: "allow", updatedInput: re.updatedInput !== undefined ? re.updatedInput : editArgs };
+            }
+            if (re.updatedInput !== undefined)
+                editArgs = re.updatedInput;
+            const judged = await judgeInheritedClassifier({ autoMode: ancestorDecider !== undefined ? { decider: ancestorDecider, denialTracking: ancestorTracker } : undefined, ask: re, req: { ...creq, args: editArgs }, signal: csignal ?? abortController.signal, subject: "the approved edit" });
+            if (judged.kind === "allow")
+                return { action: "allow", updatedInput: editArgs };
+            if (judged.kind === "deny")
+                return judged.result;
+            const { ask: editAsk, fallback: editFallback, mintedHere: editMintedHere, origin: editOrigin } = judged;
+            re = editAsk;
+            const rr = await resolveAsk({
+                toolName: creq.toolName,
+                toolCallId: creq.toolCallId,
+                args: editArgs,
+                ...ruleOffersOf(creq.toolName, editArgs, { ...(re ?? {}), ancestorResolved: true }),
+                message: re.message ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
+                ...askSourceIdentity(),
+                ...riskAxesOf(creq.toolName),
+                ...(re.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
+                ...(re.persistedRuleShadowed !== undefined ? { persistedRuleShadowed: re.persistedRuleShadowed } : {}),
+                ...inheritedAskCarry(editOrigin, editFallback, isLiveApproverSeat(onAskOf), ancestorTracker),
+                ruleEvidence: inheritedAskEvidence,
+            }, onAskOf, csignal ?? abortController.signal, lateAskSettlementObserver({ toolName: creq.toolName, toolCallId: creq.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice, onError: deps.onError }));
+            settleDenialLimitFallback({ fallback: editFallback, mintedHere: editMintedHere, tracker: ancestorTracker, resolved: rr, headless: headlessDenyAtRecheck, stop: stopForDenialLimit, toolName: creq.toolName, toolCallId: creq.toolCallId });
+            if (rr.action !== "allow")
+                return rr;
+            if (rr.updatedInput === undefined)
+                return { action: "allow", updatedInput: editArgs };
+            editArgs = rr.updatedInput;
+        }
+    };
+    const parentConstraintWrappers = (inheritedParentConstraints ?? []).map((pc) => pc.preToolUse !== undefined &&
+        pc.preToolUse === hooks?.preToolUse &&
+        !preToolUseObservational &&
+        pc.durableMandate !== true &&
+        pc.contentMandate !== true &&
+        askApproverIdentity(pc.onAsk) === askApproverIdentity(frozenOnAsk) &&
+        pc.hookEnv === hookEnvSource &&
+        pc.autoMode?.decider === autoModeDecider
+        ? { check: () => ({ action: "allow" }) }
+        : policy !== undefined && pc.policy === policy
+            ? {
+                check: async (creq, csignal) => {
+                    const first = sharedFirstDecision.get(creq.toolCallId);
+                    if (first === undefined) {
+                        return {
+                            action: "deny",
+                            message: `inherited parent policy could not be arbitrated for "${creq.toolName}" ` +
+                                `(shared-instance first decision unavailable); denied fail-closed`,
+                        };
+                    }
+                    if (first.action === "deny")
+                        return first;
+                    if (first.action === "allow")
+                        return { action: "allow" };
+                    if (creq.toolName === ASK_USER_QUESTION_TOOL_NAME) {
+                        if (pc.contentMandate !== true || markInheritedUnavailable(creq.toolCallId))
+                            return first;
+                        return {
+                            action: "deny",
+                            message: `inherited parent policy requires durable handling of the question raised for "${creq.toolName}" and the marker channel is at capacity — ` +
+                                `denied fail-closed (tighten-only)`,
+                        };
+                    }
+                    if (pc.durableMandate === true) {
+                        if (resolveCheckpointStore(spec, deps) !== undefined &&
+                            (spec.durableApproval !== undefined || runtimeCaps?.forceDurableGate === true) &&
+                            markInheritedUnavailable(creq.toolCallId)) {
+                            return first;
+                        }
+                        return {
+                            action: "deny",
+                            message: `inherited parent policy requires durable approval for "${creq.toolName}" — the parent's durable ` +
+                                `ask cannot be reconstructed in a delegated child; denied fail-closed (tighten-only)`,
+                        };
+                    }
+                    const judged = await judgeInheritedClassifier({ autoMode: pc.autoMode, ask: first, req: creq, signal: csignal ?? abortController.signal, subject: "this call" });
+                    if (judged.kind === "allow")
+                        return { action: "allow" };
+                    if (judged.kind === "deny")
+                        return judged.result;
+                    const { ask: inheritedAsk, fallback, mintedHere, origin: inheritedOrigin } = judged;
+                    if (fallback === undefined && sandboxAdmissionArmed && policyAskClassOf(pc.policy) === "sandbox_local" && !sandboxBoundaryCapable(creq.toolName)) {
+                        recordAncestorSandboxAdmission(creq.toolCallId, creq.toolName);
+                        return { action: "allow" };
+                    }
+                    const presentedArgs = creq.args;
+                    const askT0 = now();
+                    const resolved = await resolveAsk({
+                        toolName: creq.toolName,
+                        toolCallId: creq.toolCallId,
+                        args: presentedArgs,
+                        ...ruleOffersOf(creq.toolName, presentedArgs, { ...(inheritedAsk.action === "ask" ? inheritedAsk : {}), ancestorResolved: true }),
+                        message: inheritedAsk.message ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
+                        ...askSourceIdentity(),
+                        ...riskAxesOf(creq.toolName),
+                        ...(inheritedAsk.action === "ask" && inheritedAsk.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
+                        ...(inheritedAsk.action === "ask" && inheritedAsk.persistedRuleShadowed !== undefined ? { persistedRuleShadowed: inheritedAsk.persistedRuleShadowed } : {}),
+                        ...inheritedAskCarry(inheritedOrigin, fallback, isLiveApproverSeat(pc.onAsk), pc.autoMode?.denialTracking),
+                        ruleEvidence: inheritedAskEvidence,
+                    }, pc.onAsk, csignal ?? abortController.signal, lateAskSettlementObserver({ toolName: creq.toolName, toolCallId: creq.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice, onError: deps.onError }));
+                    const askWaitMs = Math.max(0, now() - askT0);
+                    if (resolved.action === "deny" && resolved.approverUnavailable === true) {
+                        if (markInheritedUnavailable(creq.toolCallId))
+                            return inheritedAsk;
+                        return {
+                            action: "deny",
+                            message: `no approver is reachable for the inherited approval of "${creq.toolName}" and the marker channel is at capacity — denied fail-closed`,
+                        };
+                    }
+                    settleDenialLimitFallback({ fallback, mintedHere, tracker: pc.autoMode?.denialTracking, resolved, headless: headlessDenyAtFold, stop: stopForDenialLimit, toolName: creq.toolName, toolCallId: creq.toolCallId });
+                    if (resolved.action !== "allow")
+                        return resolved;
+                    if (resolved.updatedInput !== undefined) {
+                        return recheckApprovedEdit(pc.policy, pc.onAsk, creq, resolved.updatedInput, csignal, pc.autoMode?.decider, pc.autoMode?.denialTracking);
+                    }
+                    recordInheritedAskGrant(creq.toolCallId, pc.onAsk, resolved.presentedInput, askWaitMs);
+                    return { action: "allow" };
+                },
+            }
+            : {
+                check: async (creq, csignal) => {
+                    let decision;
+                    try {
+                        decision = await pc.policy.check(creq, csignal ?? abortController.signal);
+                    }
+                    catch (err) {
+                        return {
+                            action: "deny",
+                            message: `inherited parent policy errored for "${creq.toolName}": ${err instanceof Error ? err.message : String(err)}`,
+                        };
+                    }
+                    if (decision.action !== "ask")
+                        return decision;
+                    if (creq.toolName === ASK_USER_QUESTION_TOOL_NAME) {
+                        if (pc.contentMandate !== true || markInheritedUnavailable(creq.toolCallId))
+                            return decision;
+                        return {
+                            action: "deny",
+                            message: `inherited parent policy requires durable handling of the question raised for "${creq.toolName}" and the marker channel is at capacity — ` +
+                                `denied fail-closed (tighten-only)`,
+                        };
+                    }
+                    if (pc.durableMandate === true) {
+                        if (resolveCheckpointStore(spec, deps) !== undefined &&
+                            (spec.durableApproval !== undefined || runtimeCaps?.forceDurableGate === true) &&
+                            markInheritedUnavailable(creq.toolCallId)) {
+                            return decision;
+                        }
+                        return {
+                            action: "deny",
+                            message: `inherited parent policy requires durable approval for "${creq.toolName}" — the parent's durable ` +
+                                `ask cannot be reconstructed in a delegated child; denied fail-closed (tighten-only)`,
+                        };
+                    }
+                    const presentedArgs = decision.updatedInput !== undefined ? decision.updatedInput : creq.args;
+                    const judged = await judgeInheritedClassifier({ autoMode: pc.autoMode, ask: decision, req: { ...creq, args: presentedArgs }, signal: csignal ?? abortController.signal, subject: "this call" });
+                    if (judged.kind === "allow")
+                        return decision.updatedInput !== undefined ? { action: "allow", updatedInput: decision.updatedInput } : { action: "allow" };
+                    if (judged.kind === "deny")
+                        return judged.result;
+                    const { ask: inheritedAsk, fallback, mintedHere, origin: inheritedOrigin } = judged;
+                    if (fallback === undefined && sandboxAdmissionArmed && policyAskClassOf(pc.policy) === "sandbox_local" && !sandboxBoundaryCapable(creq.toolName)) {
+                        recordAncestorSandboxAdmission(creq.toolCallId, creq.toolName);
+                        return decision.updatedInput !== undefined ? { action: "allow", updatedInput: decision.updatedInput } : { action: "allow" };
+                    }
+                    const askT0 = now();
+                    const resolved = await resolveAsk({
+                        toolName: creq.toolName,
+                        toolCallId: creq.toolCallId,
+                        args: presentedArgs,
+                        ...ruleOffersOf(creq.toolName, presentedArgs, { ...(inheritedAsk.action === "ask" ? inheritedAsk : {}), ancestorResolved: true }),
+                        message: inheritedAsk.message ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
+                        ...askSourceIdentity(),
+                        ...riskAxesOf(creq.toolName),
+                        ...(inheritedAsk.action === "ask" && inheritedAsk.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
+                        ...(inheritedAsk.action === "ask" && inheritedAsk.persistedRuleShadowed !== undefined ? { persistedRuleShadowed: inheritedAsk.persistedRuleShadowed } : {}),
+                        ...inheritedAskCarry(inheritedOrigin, fallback, isLiveApproverSeat(pc.onAsk), pc.autoMode?.denialTracking),
+                        ruleEvidence: inheritedAskEvidence,
+                    }, pc.onAsk, csignal ?? abortController.signal, lateAskSettlementObserver({ toolName: creq.toolName, toolCallId: creq.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice, onError: deps.onError }));
+                    const askWaitMs = Math.max(0, now() - askT0);
+                    if (resolved.action === "deny" && resolved.approverUnavailable === true) {
+                        if (markInheritedUnavailable(creq.toolCallId))
+                            return inheritedAsk;
+                        return {
+                            action: "deny",
+                            message: `no approver is reachable for the inherited approval of "${creq.toolName}" and the marker channel is at capacity — denied fail-closed`,
+                        };
+                    }
+                    settleDenialLimitFallback({ fallback, mintedHere, tracker: pc.autoMode?.denialTracking, resolved, headless: headlessDenyAtFold, stop: stopForDenialLimit, toolName: creq.toolName, toolCallId: creq.toolCallId });
+                    if (resolved.action !== "allow")
+                        return resolved;
+                    if (resolved.updatedInput !== undefined) {
+                        return recheckApprovedEdit(pc.policy, pc.onAsk, creq, resolved.updatedInput, csignal, pc.autoMode?.decider, pc.autoMode?.denialTracking);
+                    }
+                    if (pc.preToolUse === undefined) {
+                        recordInheritedAskGrant(creq.toolCallId, pc.onAsk, resolved.presentedInput, askWaitMs);
+                    }
+                    return decision.updatedInput !== undefined ? { ...resolved, updatedInput: decision.updatedInput } : resolved;
+                },
+            });
+    const rewriteCapableLayers = policy !== undefined || parentConstraintWrappers.length > 0;
+    const rewriteEmitterIndex = new Map();
+    const rewriteCapableChain = [
+        ...(callerPolicyLayer !== undefined ? [callerPolicyLayer] : []),
+        ...parentConstraintWrappers,
+    ];
+    const callerSlotOffset = callerPolicyLayer !== undefined ? 1 : 0;
+    const sameInstanceAdapterIndices = new Set();
+    (inheritedParentConstraints ?? []).forEach((pc, j) => {
+        if (policy !== undefined && pc.policy === policy)
+            sameInstanceAdapterIndices.add(j + callerSlotOffset);
+    });
+    const instrumentedChain = rewriteCapableChain.map((layer, idx) => ({
+        check: async (creq, csignal) => {
+            const d = await layer.check(creq, csignal);
+            if (d.updatedInput !== undefined)
+                rewriteEmitterIndex.set(creq.toolCallId, idx);
+            if (d.action === "ask") {
+                recordFoldAskClass(creq.toolCallId, idx < callerSlotOffset ? policyAskClassOf(policy) : "mandate", idx < callerSlotOffset ? "caller_policy" : "ancestor_constraint");
+            }
+            return d;
+        },
+    }));
+    const policyLayers = [
+        ...narrowingLayers,
+        ...instrumentedChain,
+        ...(rewriteCapableLayers ? narrowingLayers : []),
+    ];
+    const integrityGuardLayers = [createTranscriptIntegrityPolicy(), createUnverifiableDeletePolicy()];
+    const guardedPolicyLayers = rewriteCapableLayers
+        ? [...integrityGuardLayers, ...policyLayers, ...integrityGuardLayers]
+        : [...integrityGuardLayers, ...policyLayers];
+    const foldedPolicy = guardedPolicyLayers.length === 1 ? guardedPolicyLayers[0] : combinePolicies(...guardedPolicyLayers);
+    const effectivePolicy = foldedPolicy !== undefined && rewriteCapableLayers
+        ? {
+            check: async (req, signal) => {
+                let decision;
+                try {
+                    decision = await foldedPolicy.check(req, signal);
+                }
+                catch (err) {
+                    rewriteEmitterIndex.delete(req.toolCallId);
+                    throw err;
+                }
+                const emitterIdx = rewriteEmitterIndex.get(req.toolCallId);
+                rewriteEmitterIndex.delete(req.toolCallId);
+                if (decision.action === "deny" || decision.updatedInput === undefined)
+                    return decision;
+                const recheckPrefix = rewriteCapableChain.slice(0, emitterIdx ?? rewriteCapableChain.length);
+                const postEmitterSameInstanceAdapters = [];
+                if (emitterIdx !== undefined && emitterIdx > 0) {
+                    for (let i = emitterIdx + 1; i < rewriteCapableChain.length; i++) {
+                        if (sameInstanceAdapterIndices.has(i))
+                            postEmitterSameInstanceAdapters.push(rewriteCapableChain[i]);
+                    }
+                }
+                const recheckLayers = [...recheckPrefix, ...postEmitterSameInstanceAdapters];
+                const finalReq = { ...req, args: decision.updatedInput };
+                let asked;
+                try {
+                    for (const layer of recheckLayers) {
+                        const d = await layer.check(finalReq, signal);
+                        if (d.action === "deny") {
+                            return { ...d, updatedInput: decision.updatedInput };
+                        }
+                        if (d.updatedInput !== undefined) {
+                            return {
+                                action: "deny",
+                                message: "policy required a rewrite during final-form re-check — the arguments that would execute were not accepted as-is (fail-closed; rewrite chains are not iterated to a fixpoint)",
+                                updatedInput: decision.updatedInput,
+                            };
+                        }
+                        if (d.action === "ask" && asked === undefined)
+                            asked = d;
+                    }
+                }
+                finally {
+                    rewriteEmitterIndex.delete(req.toolCallId);
+                }
+                if (asked !== undefined && decision.action === "allow") {
+                    return { ...asked, updatedInput: decision.updatedInput };
+                }
+                return decision;
+            },
+        }
+        : foldedPolicy;
+    return { hooks, hookTimeoutMs, preToolUseObservational, ownGatePreToolUse, basePolicyForResumeEdit, denyNarrowingPolicy, policyLayers, effectivePolicy, inheritedUnavailableAsks, inheritedAskGrants, askSourceIdentity, riskAxesOf, ruleOffersOf, permissionRuleLane, permissionRuleOrgLane, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, foldAskClasses, ancestorSandboxAdmissions };
+}
+const advisedPolicyNames = new WeakMap();
+const ADVISED_KEYS_CAP = 64;