@sema-agent/core 7.5.2 → 7.6.1

package/dist/core/hooks.js

@@ -1,13 +1,14 @@
-import { coreMintedAutoDeniedOf, coreMintedResolutionOf, decisionText, describeThrown, isAskDenyResolution, refuseOutOfContractDecision } from "./tool-policy.js";
+import { decisionText, refuseOutOfContractDecision } from "./tool-policy.js";
+import { createSettlementLedger, engineFailClosedExit, hookDenyExit, traceHookCrash } from "./runner/gate-exit.js";
+import { runGateFold } from "./gate-fold.js";
+import { runGateLanes } from "./gate-lanes.js";
+export { normalizeOrgGateVerdict, normalizePersistedRuleHit, persistedRuleMandateOf } from "./gate-lanes.js";
+export { cloneObserverInput } from "./runner/gate-exit.js";
 import { brandPolicyAskClass } from "./ask-class.js";
-import { askOriginOf, classifierMayAnswer, isAskOrigin } from "./ask-origin.js";
-import { denialLimitFallbackMessage, unarmedWindow } from "./auto-mode.js";
+import { isAskOrigin } from "./ask-origin.js";
 import { inlineUntrusted } from "./untrusted-text.js";
-import { mintSystemReminder } from "./reminder-mint.js";
-import { PROBE_REASON_MAX, normalizeProbeCause } from "./checkpoint-store.js";
-import { ASK_USER_QUESTION_TOOL_NAME } from "./ask-question.js";
+export { formatHookFeedback } from "./reminder-mint.js";
 import { createSafeNotifier } from "./safe-notify.js";
-import { ORG_ADJUDICATION_TIMEOUT_MS, ORG_RULE_DECISION_REASON, ORG_UNAVAILABLE_DECISION_REASON, settleOrgVerdictWithin } from "./permission-rule-org.js";
 export const DEFAULT_HOOK_TIMEOUT_MS = 600_000;
 export const MAX_HOOK_TIMEOUT_MS = 2_147_483_647;
 const POST_ABORT_GRACE_MS = 1_000;
@@ -94,18 +95,6 @@ export function hookSeatExpiredError(seat, timeoutMs, cause, consequence) {
         ? `the deployment's ${seat} hook did not answer within its ${timeoutMs}ms bound (Hooks.timeoutMs) — ${consequence}`
         : `the deployment's ${seat} hook had not answered when the task was cancelled — ${consequence}`);
 }
-export function cloneObserverInput(input) {
-    try {
-        return structuredClone(input);
-    }
-    catch {
-        if (Array.isArray(input))
-            return [...input];
-        if (input !== null && typeof input === "object")
-            return { ...input };
-        return input;
-    }
-}
 const reflectApply = Reflect.apply;
 const getOwnPropertyDescriptor = Object.getOwnPropertyDescriptor;
 const getPrototypeOf = Object.getPrototypeOf;
@@ -179,146 +168,6 @@ export function mintHookInvocationIdentity(facts) {
         ...(facts.parentToolCallId !== undefined ? { parentToolCallId: facts.parentToolCallId } : {}),
     }));
 }
-export function formatHookFeedback(text, mark) {
-    return mintSystemReminder(text, mark);
-}
-const PARK_FAILURE_CAUSE_MAX = 600;
-function withParkFailureCause(reason, parkFailed) {
-    if (parkFailed === undefined)
-        return reason;
-    return (`${reason} — note: a durable approval park was attempted for this call FIRST and could not be minted ` +
-        `(${inlineUntrusted(parkFailed, PARK_FAILURE_CAUSE_MAX)}), so the refusal above is what the fallback had ` +
-        `left to say, not the reason the call stopped.`);
-}
-function isPlainOwnRecord(x) {
-    try {
-        if (x === null || typeof x !== "object" || Array.isArray(x))
-            return false;
-        const p = Object.getPrototypeOf(x);
-        return p === Object.prototype || p === null;
-    }
-    catch {
-        return false;
-    }
-}
-function ownDataValue(obj, key) {
-    try {
-        const d = Object.getOwnPropertyDescriptor(obj, key);
-        return d && "value" in d ? d.value : undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
-export function normalizeOrgGateVerdict(answer, unreadable) {
-    const clean = (v) => Object.assign(Object.create(null), v);
-    const readable = (x) => {
-        try {
-            return x !== null && (typeof x === "object" || typeof x === "function") && !Array.isArray(x);
-        }
-        catch {
-            return false;
-        }
-    };
-    if (!readable(answer))
-        return clean({ status: "unavailable", disclosures: [unreadable] });
-    const status = ownDataValue(answer, "status");
-    if (status === "unavailable") {
-        const disclosures = ownDataValue(answer, "disclosures");
-        let lines = [];
-        if (Array.isArray(disclosures)) {
-            try {
-                for (let i = 0; i < disclosures.length; i++) {
-                    const d = disclosures[i];
-                    if (typeof d === "string")
-                        lines.push(d);
-                }
-            }
-            catch {
-                lines = [];
-            }
-        }
-        return clean({ status: "unavailable", disclosures: lines.length > 0 ? lines : [unreadable] });
-    }
-    if (status !== "available")
-        return clean({ status: "unavailable", disclosures: [unreadable] });
-    const revision = ownDataValue(answer, "revision");
-    const revisionCell = typeof revision === "number" && Number.isFinite(revision) ? { revision } : {};
-    const verdict = ownDataValue(answer, "verdict");
-    if (verdict === undefined)
-        return clean({ status: "available", ...revisionCell });
-    if (!readable(verdict))
-        return clean({ status: "unavailable", disclosures: [unreadable] });
-    const behavior = ownDataValue(verdict, "behavior");
-    const rule = ownDataValue(verdict, "rule");
-    if ((behavior !== "deny" && behavior !== "ask") || typeof rule !== "string")
-        return clean({ status: "unavailable", disclosures: [unreadable] });
-    return clean({ status: "available", verdict: clean({ behavior: behavior, rule }), ...revisionCell });
-}
-function copiedUsableDots(dots) {
-    let copied;
-    try {
-        if (Array.isArray(dots)) {
-            const walked = [];
-            for (let i = 0; i < dots.length; i++) {
-                const d = dots[i];
-                walked.push(isPlainOwnRecord(d) ? { actor: ownDataValue(d, "actor"), counter: ownDataValue(d, "counter") } : { actor: undefined, counter: undefined });
-            }
-            copied = walked;
-        }
-    }
-    catch {
-        copied = undefined;
-    }
-    const usable = copied?.every((d) => typeof d.actor === "string" && typeof d.counter === "number" && Number.isFinite(d.counter)) === true && copied.length > 0;
-    return usable ? { dots: copied } : {};
-}
-export function normalizePersistedRuleHit(hit) {
-    if (typeof hit === "string")
-        return { hit: { rules: [{ rule: hit }] } };
-    if (!isPlainOwnRecord(hit))
-        return {};
-    if (ownDataValue(hit, "unreadable") === true)
-        return { unreadable: true };
-    const rulesRaw = ownDataValue(hit, "rules");
-    if (rulesRaw === undefined) {
-        const coverageRaw = ownDataValue(hit, "segmentCoverage");
-        let rows;
-        try {
-            if (Array.isArray(coverageRaw)) {
-                const walked = [];
-                for (let i = 0; i < coverageRaw.length; i++) {
-                    const r = coverageRaw[i];
-                    walked.push(isPlainOwnRecord(r) ? { segment: ownDataValue(r, "segment"), covered: ownDataValue(r, "covered") } : { segment: undefined, covered: undefined });
-                }
-                rows = walked.every((r) => typeof r.segment === "string" && typeof r.covered === "boolean") ? walked : undefined;
-            }
-        }
-        catch {
-            rows = undefined;
-        }
-        return rows !== undefined && rows.length > 0 ? { coverage: rows.map((r) => ({ segment: r.segment, covered: r.covered })) } : {};
-    }
-    let members;
-    try {
-        if (Array.isArray(rulesRaw)) {
-            const walked = [];
-            for (let i = 0; i < rulesRaw.length; i++) {
-                const m = rulesRaw[i];
-                walked.push(isPlainOwnRecord(m) ? { rule: ownDataValue(m, "rule"), dots: ownDataValue(m, "dots") } : { rule: undefined, dots: undefined });
-            }
-            members = walked;
-        }
-    }
-    catch {
-        members = undefined;
-    }
-    if (members === undefined || members.length === 0)
-        return {};
-    if (!members.every((m) => typeof m.rule === "string"))
-        return {};
-    return { hit: { rules: members.map((m) => ({ rule: m.rule, ...copiedUsableDots(m.dots) })) } };
-}
 function preToolUseCrashReason(subject, err) {
     const raw = err instanceof Error ? err.message.trim() || err.name : String(err);
     const cause = inlineUntrusted(raw, 200);
@@ -382,49 +231,6 @@ export function createPreToolUseConstraintPolicy(preToolUse, env, onCrash, timeo
         },
     }, "hook");
 }
-function traceHookCrash(input, err, notifier) {
-    notifier.notify(() => input.onHookError?.(err), "toolGate.onHookError");
-}
-function withProbeTimeout(p, ms, signal) {
-    if (ms === undefined && signal === undefined)
-        return p;
-    return new Promise((resolve, reject) => {
-        let settled = false;
-        const done = (fn, v) => {
-            if (settled)
-                return;
-            settled = true;
-            if (timer !== undefined)
-                clearTimeout(timer);
-            signal?.removeEventListener("abort", onAbort);
-            fn(v);
-        };
-        const onAbort = () => done(reject, new Error("reversibilityProbe aborted (task ended)"));
-        const timer = ms !== undefined
-            ? setTimeout(() => done(reject, new Error(`reversibilityProbe timed out after ${ms}ms`)), ms)
-            : undefined;
-        if (signal?.aborted) {
-            onAbort();
-            return;
-        }
-        signal?.addEventListener("abort", onAbort);
-        p.then((v) => done(resolve, v), (err) => done(reject, err));
-    });
-}
-const DEFAULT_PROBE_TIMEOUT_MS = 30_000;
-export function persistedRuleMandateOf(marks) {
-    return marks.probeMandated === true
-        ? "probe_mandate"
-        : marks.egress === true
-            ? "tool_marks"
-            : marks.shellGated === true
-                ? marks.irreversibility === "always"
-                    ? "operator_always"
-                    : undefined
-                : marks.irreversibility === "always" || marks.irreversibility === "maybe"
-                    ? "tool_marks"
-                    : undefined;
-}
 export function askCarryRowMembers(carry) {
     if (carry === undefined)
         return {};
@@ -433,9 +239,6 @@ export function askCarryRowMembers(carry) {
         ...(isAskOrigin(carry.origin) ? { origin: carry.origin } : {}),
     };
 }
-function parkWith(suspendAsk, parkArgs, carry) {
-    return suspendAsk(...parkArgs, carry);
-}
 export async function runToolGate(input) {
     const { event, preToolUse, adjudicate, resolveAsk, suspendAsk } = input;
     const { toolCallId, toolName } = event;
@@ -451,12 +254,7 @@ export async function runToolGate(input) {
         ...(input.hookEnv !== undefined ? { env: input.hookEnv } : {}),
         ...(input.identity !== undefined ? { identity: input.identity } : {}),
     });
-    let currentInput = event.input;
-    const preToolContext = [];
-    let hookAsk;
-    let parkFailed;
-    let askDenyResolution;
-    let askAutoDenied = false;
+    const modelInput = event.input;
     const notifier = createSafeNotifier(input.onNotifyError !== undefined ? { onError: input.onNotifyError } : undefined);
     const hookSeatMs = resolveHookTimeoutMs(input.hookTimeoutMs, (err) => traceHookCrash(input, err, notifier));
     const seatBound = (abortEnds) => ({
@@ -480,667 +278,71 @@ export async function runToolGate(input) {
                 throw hookSeatExpiredError("permissionDenied", hookSeatMs, seat.cause, "the deny observation was abandoned; the deny itself is unchanged");
         }, "toolGate.permissionDenied");
     };
-    if (preToolUse) {
+    const screening = preToolUse !== undefined
+        ? {
+            screen: (args) => runHookSeat("preToolUse", seatBound(true), (sig) => preToolUse(toolName, args, hookCtx(sig))),
+            screened: screenPreToolUseResult,
+            crashReason: preToolUseCrashReason,
+            unansweredReason: preToolUseUnansweredBlock,
+        }
+        : undefined;
+    const pass = {
+        input,
+        event,
+        adjudicate,
+        resolveAsk,
+        suspendAsk,
+        toolName,
+        toolCallId,
+        callSignal,
+        notifier,
+        ledger: createSettlementLedger({ toolCallId, toolName }),
+        notifyPermissionDenied: notifyPermissionDeniedSeat,
+        screening,
+        afterFold: runGateLanes,
+        currentInput: modelInput,
+        req: { toolName, args: modelInput, toolCallId },
+        preToolContext: [],
+        hookAsk: undefined,
+        parkFailed: undefined,
+        deniedBy: undefined,
+        decision: { action: "allow" },
+        tightenedBy: undefined,
+        policyRewrite: undefined,
+    };
+    if (screening !== undefined) {
         let r;
         let unanswered;
         try {
-            const seat = await runHookSeat("preToolUse", seatBound(true), (sig) => preToolUse(toolName, currentInput, hookCtx(sig)));
+            const seat = await screening.screen(pass.currentInput);
             if (seat.expired)
                 unanswered = seat.cause;
             else
-                r = screenPreToolUseResult(seat.value);
+                r = screening.screened(seat.value);
         }
         catch (err) {
-            const reason = preToolUseCrashReason(`this call to "${toolName}"`, err);
+            const reason = screening.crashReason(`this call to "${toolName}"`, err);
             traceHookCrash(input, err, notifier);
-            await notifyPermissionDeniedSeat({ toolName, input: cloneObserverInput(currentInput), toolCallId, reason, source: "hook", ...(input.identity !== undefined ? { identity: input.identity } : {}) });
-            return { block: true, reason: formatHookFeedback(reason, input.reminderMark), preToolContext };
+            return await engineFailClosedExit(pass, reason);
         }
         if (unanswered !== undefined) {
-            const reason = await preToolUseUnansweredBlock(`this call to "${toolName}"`, unanswered);
-            await notifyPermissionDeniedSeat({ toolName, input: cloneObserverInput(currentInput), toolCallId, reason, source: "hook", ...(input.identity !== undefined ? { identity: input.identity } : {}) });
-            return { block: true, reason: formatHookFeedback(reason, input.reminderMark), preToolContext };
+            const reason = await screening.unansweredReason(`this call to "${toolName}"`, unanswered);
+            return await engineFailClosedExit(pass, reason);
         }
         if (r) {
             if (r.additionalContext) {
-                preToolContext.push(r.additionalContext);
+                pass.preToolContext.push(r.additionalContext);
             }
             if (r.action === "deny") {
-                return {
-                    block: true,
-                    reason: formatHookFeedback(decisionText(r) ?? `tool "${toolName}" blocked by a PreToolUse hook`, input.reminderMark),
-                    preToolContext,
-                };
+                return hookDenyExit(pass, r);
             }
             if (r.updatedInput !== undefined) {
-                currentInput = r.updatedInput;
+                pass.currentInput = r.updatedInput;
             }
             if (r.action === "ask") {
-                hookAsk = r;
-            }
-        }
-    }
-    const req = { toolName, args: currentInput, toolCallId };
-    let decision = adjudicate ? await (callSignal !== undefined ? adjudicate(req, callSignal) : adjudicate(req)) : { action: "allow" };
-    let denySource = "policy";
-    let policyRewrite;
-    if ((decision.action === "allow" || decision.action === "ask") && decision.updatedInput !== undefined) {
-        policyRewrite = decision.updatedInput;
-    }
-    else if (hookAsk?.updatedInput !== undefined) {
-        policyRewrite = hookAsk.updatedInput;
-    }
-    if (decision.action === "allow" && hookAsk) {
-        decision = {
-            action: "ask",
-            ...(hookAsk.message !== undefined ? { message: hookAsk.message } : {}),
-            decisionReason: "hook",
-            ...(hookAsk.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
-            ...(hookAsk.updatedInput !== undefined ? { updatedInput: hookAsk.updatedInput } : {}),
-        };
-        denySource = "hook";
-    }
-    else if (decision.action === "ask" && hookAsk) {
-        const hookMessage = hookAsk.message;
-        const foldedMessage = hookMessage !== undefined && hookMessage !== decision.message
-            ? `${decision.message !== undefined ? `${decision.message} ` : ""}(a PreToolUse hook also asks: ${hookMessage})`
-            : decision.message;
-        decision = {
-            ...decision,
-            decisionReason: "hook",
-            ...(foldedMessage !== undefined ? { message: foldedMessage } : {}),
-            ...(hookAsk.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
-        };
-    }
-    if (input.egress && decision.action === "allow") {
-        decision = {
-            action: "ask",
-            message: `tool "${toolName}" performs an external write (egress) — explicit approval required`,
-            decisionReason: "safety",
-        };
-        denySource = "safety";
-    }
-    const alreadyAsking = decision.action === "ask";
-    if ((decision.action === "allow" || alreadyAsking) && (input.irreversibility === "always" || input.irreversibility === "maybe")) {
-        let tighten = !alreadyAsking;
-        let probeReason;
-        let probeCause;
-        let probeMandated;
-        if (input.irreversibility === "maybe" && input.reversibilityProbe) {
-            let reversible = false;
-            const probeArgs = policyRewrite !== undefined ? policyRewrite : currentInput;
-            const suppliedProbeMs = input.approvalTimeoutMs;
-            let probeTimeoutMs;
-            if (suppliedProbeMs === undefined) {
-                probeTimeoutMs = DEFAULT_PROBE_TIMEOUT_MS;
-            }
-            else if (Number.isFinite(suppliedProbeMs) && suppliedProbeMs >= 0 && suppliedProbeMs <= 2_147_483_647) {
-                probeTimeoutMs = suppliedProbeMs;
+                pass.hookAsk = r;
             }
-            else {
-                probeTimeoutMs = DEFAULT_PROBE_TIMEOUT_MS;
-                traceHookCrash(input, new Error(`approvalTimeoutMs must be a non-negative finite number no greater than 2147483647 (got ${String(suppliedProbeMs)}) — the reversibilityProbe deadline falls back to the ${DEFAULT_PROBE_TIMEOUT_MS}ms default`), notifier);
-            }
-            try {
-                const verdict = await withProbeTimeout(Promise.resolve(input.reversibilityProbe(probeArgs)), probeTimeoutMs, input.abortSignal);
-                reversible = verdict?.reversible === true;
-                if (!reversible) {
-                    const raw = verdict?.reason;
-                    if (typeof raw === "string" && raw.trim().length > 0)
-                        probeReason = inlineUntrusted(raw, PROBE_REASON_MAX);
-                    probeCause = normalizeProbeCause(verdict?.cause);
-                    if (verdict?.mandated === true)
-                        probeMandated = true;
-                }
-            }
-            catch (err) {
-                reversible = false;
-                if (input.abortSignal?.aborted !== true)
-                    traceHookCrash(input, err, notifier);
-            }
-            tighten = !alreadyAsking && !reversible;
-        }
-        if (tighten) {
-            decision = {
-                action: "ask",
-                message: `tool "${toolName}" performs an irreversible action — explicit approval required`,
-                decisionReason: "safety",
-                ...(probeReason !== undefined ? { probeReason } : {}),
-                ...(probeCause !== undefined ? { probeCause } : {}),
-                ...(probeMandated === true ? { probeMandated: true } : {}),
-            };
-            denySource = input.shellGated === true ? "shellGate" : "safety";
-        }
-        else if (alreadyAsking && probeMandated === true && decision.action === "ask") {
-            decision = { ...decision, probeMandated: true };
         }
     }
-    const breakerKnownOpen = (d) => {
-        try {
-            return d.breakerOpen();
-        }
-        catch {
-            return false;
-        }
-    };
-    if (input.peerMessage === true && decision.action === "allow" && input.autoMode !== undefined && !breakerKnownOpen(input.autoMode.decider)) {
-        decision = {
-            action: "ask",
-            message: `tool "${toolName}" sends a message to another agent — routed for classifier review in auto mode`,
-            decisionReason: "safety",
-        };
-        denySource = "safety";
-    }
-    if (decision.action === "allow" && input.writeProtectionCheck !== undefined) {
-        const writeProtectedHit = input.writeProtectionCheck(toolName, policyRewrite !== undefined ? policyRewrite : currentInput);
-        if (writeProtectedHit !== null) {
-            decision = {
-                action: "ask",
-                message: `tool "${toolName}" writes to a write-protected path (table entry "${writeProtectedHit.name}") — explicit approval required`,
-                decisionReason: "safety",
-            };
-            denySource = "safety";
-        }
-    }
-    let orgRealApprovalRequired = false;
-    let orgAskOrigin;
-    const askOriginFacts = () => ({
-        contentQuestion: toolName === ASK_USER_QUESTION_TOOL_NAME,
-        markedUnresolvable: input.isMarkedUnresolvable?.(input.event.toolCallId) === true,
-        org: orgAskOrigin,
-    });
-    let orgTightenCount = 0;
-    let resolvedApprover;
-    let orgEvidence = (() => {
-        const w = input.orgRules === undefined ? "not_wired" : "not_adjudicated";
-        return { revisionAbsent: w, ruleAbsent: w };
-    })();
-    const mintRuleEvidence = (personal) => ({
-        ...(orgEvidence.revision !== undefined ? { orgRevision: orgEvidence.revision } : { orgRevisionAbsent: orgEvidence.revisionAbsent ?? "not_reported" }),
-        ...(orgEvidence.rule !== undefined ? { orgRule: orgEvidence.rule } : { orgRuleAbsent: orgEvidence.ruleAbsent ?? "not_reported" }),
-        ...(personal.dots !== undefined ? { personalRuleDots: personal.dots } : { personalRuleDotsAbsent: personal.dotsAbsent ?? "not_reported" }),
-    });
-    const applyOrgLayer = async (current, args) => {
-        if (input.orgRules === undefined)
-            return current;
-        if (toolName === ASK_USER_QUESTION_TOOL_NAME && input.orgRules.contentAskToolMounted === true)
-            return current;
-        let decided = current;
-        let pending;
-        try {
-            pending = Promise.resolve(input.orgRules.adjudicate({ toolName, args, toolCallId }));
-        }
-        catch (err) {
-            pending = Promise.resolve({ status: "unavailable", disclosures: [`the org adjudication face threw before answering: ${describeThrown(err)}`] });
-        }
-        const raw = await settleOrgVerdictWithin(pending.catch((err) => ({
-            status: "unavailable",
-            disclosures: [`the org adjudication face threw: ${describeThrown(err)}`],
-        })), {
-            status: "unavailable",
-            disclosures: [`the org adjudication face did not answer within ${ORG_ADJUDICATION_TIMEOUT_MS}ms (or the task ended first)`],
-        }, { ...(input.abortSignal !== undefined ? { signal: input.abortSignal } : {}), timeoutMs: ORG_ADJUDICATION_TIMEOUT_MS });
-        const answer = normalizeOrgGateVerdict(raw, "the org adjudication face answered something this gate cannot read as a verdict — treated as unreadable governance, never as an empty one");
-        if (answer.status === "unavailable") {
-            orgEvidence = { revisionAbsent: "unavailable", ruleAbsent: "unavailable" };
-            orgRealApprovalRequired = true;
-            orgAskOrigin = "unavailable";
-            await notifier.notifyAsync(() => input.orgRules?.onUnavailable?.({ toolName, toolCallId, message: answer.disclosures.join("; ") }), "toolGate.orgSnapshotUnavailable");
-            if (decided.action === "allow") {
-                decided = {
-                    action: "ask",
-                    message: `tool "${toolName}" needs approval: this deployment is org-governed and cannot currently adjudicate ` +
-                        `against an organization policy snapshot — every allow tightens to a real approval until it can`,
-                    decisionReason: ORG_UNAVAILABLE_DECISION_REASON,
-                    requiresRealApproval: true,
-                };
-                orgTightenCount += 1;
-                denySource = "org";
-            }
-            else if (decided.action === "ask" && decided.requiresRealApproval !== true) {
-                decided = { ...decided, requiresRealApproval: true };
-                orgTightenCount += 1;
-            }
-            return decided;
-        }
-        const revisionCell = answer.revision !== undefined ? { revision: answer.revision } : { revisionAbsent: "not_reported" };
-        if (answer.verdict === undefined) {
-            orgEvidence = { ...revisionCell, ruleAbsent: "no_match" };
-            return decided;
-        }
-        const { behavior, rule } = answer.verdict;
-        orgEvidence = { ...revisionCell, rule };
-        if (behavior === "deny") {
-            orgTightenCount += 1;
-            denySource = "org";
-            return { action: "deny", message: `an organization policy rule (${rule}) denies this call`, decisionReason: ORG_RULE_DECISION_REASON };
-        }
-        if (decided.action === "deny")
-            return decided;
-        orgTightenCount += 1;
-        denySource = "org";
-        orgRealApprovalRequired = true;
-        orgAskOrigin = "rule";
-        return decided.action === "ask"
-            ? { ...decided, requiresRealApproval: true }
-            : {
-                action: "ask",
-                message: `an organization policy rule (${rule}) requires approval for this call`,
-                decisionReason: ORG_RULE_DECISION_REASON,
-                requiresRealApproval: true,
-            };
-    };
-    decision = await applyOrgLayer(decision, policyRewrite !== undefined ? policyRewrite : currentInput);
-    if (decision.action === "ask") {
-        if (policyRewrite !== undefined) {
-            currentInput = policyRewrite;
-            req.args = policyRewrite;
-        }
-        const persistedRuleMandate = persistedRuleMandateOf({
-            egress: input.egress,
-            shellGated: input.shellGated,
-            irreversibility: input.irreversibility,
-            probeMandated: decision.action === "ask" && decision.probeMandated === true,
-        });
-        let personalEvidence = { dotsAbsent: input.persistedRules === undefined ? "not_wired" : "not_adjudicated" };
-        let laneCoverage;
-        if (input.persistedRules &&
-            !orgRealApprovalRequired &&
-            decision.action === "ask" &&
-            decision.requiresRealApproval !== true &&
-            decision.decisionReason !== "hook" &&
-            req.toolName !== ASK_USER_QUESTION_TOOL_NAME &&
-            input.isMarkedUnresolvable?.(input.event.toolCallId) !== true) {
-            const answer = await (async () => {
-                let pendingHit;
-                try {
-                    pendingHit = Promise.resolve(input.persistedRules?.admits(req));
-                }
-                catch {
-                    return { unreadable: true };
-                }
-                return await settleOrgVerdictWithin(pendingHit.then(normalizePersistedRuleHit).catch(() => ({ unreadable: true })), { unreadable: true }, { ...(input.abortSignal !== undefined ? { signal: input.abortSignal } : {}), timeoutMs: ORG_ADJUDICATION_TIMEOUT_MS });
-            })();
-            const hitRules = answer.hit?.rules;
-            laneCoverage = answer.coverage;
-            personalEvidence = { dotsAbsent: answer.unreadable === true ? "unavailable" : "no_match" };
-            const disclosedRuleSet = (rules) => {
-                const shown = rules.slice(0, 5).map((r) => inlineUntrusted(r.rule, 200));
-                const rest = rules.length - shown.length;
-                return rest > 0 ? `${shown.join(", ")} and ${rest} more` : shown.join(", ");
-            };
-            const unionDotsOf = (rules) => {
-                const seen = new Set();
-                const union = [];
-                for (const r of rules) {
-                    if (r.dots === undefined || r.dots.length === 0)
-                        return { dotsAbsent: "not_reported" };
-                    for (const d of r.dots) {
-                        const key = JSON.stringify([d.actor, d.counter]);
-                        if (!seen.has(key)) {
-                            seen.add(key);
-                            union.push(d);
-                        }
-                    }
-                }
-                return { dots: union };
-            };
-            if (hitRules !== undefined && persistedRuleMandate === undefined && decision.matchedAskRule === undefined) {
-                decision = {
-                    action: "allow",
-                    message: hitRules.length === 1
-                        ? `a persisted allow rule (${disclosedRuleSet(hitRules)}) covers this call`
-                        : `persisted allow rules (${disclosedRuleSet(hitRules)}) cover every segment of this call`,
-                    decisionReason: "persisted_rule",
-                    ...(policyRewrite !== undefined ? { updatedInput: policyRewrite } : {}),
-                };
-                await notifier.notifyAsync(() => input.persistedRules?.onResolved?.({ toolName: req.toolName, toolCallId, rules: hitRules.map((r) => r.rule) }), "toolGate.persistedRuleResolved");
-            }
-            else if (hitRules !== undefined) {
-                personalEvidence = unionDotsOf(hitRules);
-                const shownRule = disclosedRuleSet(hitRules);
-                const mandateNoun = persistedRuleMandate === "probe_mandate"
-                    ? "the reversibility check declared this call structurally gated (the built-in shell check raises this for a read outside the directories allowed for this session) — it is cleared by confirming this call, never by a standing allow rule"
-                    : persistedRuleMandate === "operator_always"
-                        ? "this deployment mandates per-call confirmation for shell commands (shellGate: always)"
-                        : persistedRuleMandate !== undefined
-                            ? "this tool carries egress/irreversibility marks (a mandated confirmation a rule cannot clear)"
-                            : "an explicit ask rule matched this call (a person's ask-me-each-time outranks a standing allow rule)";
-                decision = {
-                    ...decision,
-                    persistedRuleShadowed: shownRule,
-                    message: hitRules.length === 1
-                        ? `${decision.message !== undefined ? `${decision.message} ` : ""}(a persisted allow rule (${shownRule}) matches this call but does not clear the ask — ${mandateNoun})`
-                        : `${decision.message !== undefined ? `${decision.message} ` : ""}(persisted allow rules (${shownRule}) match this call but do not clear the ask — ${mandateNoun})`,
-                };
-            }
-        }
-        const originFacts = askOriginFacts();
-        if (decision.action === "ask") {
-            const stamped = { ...decision, ruleEvidence: mintRuleEvidence(personalEvidence), ...(laneCoverage !== undefined ? { segmentCoverage: laneCoverage } : {}) };
-            decision = { ...stamped, origin: askOriginOf(stamped, originFacts) };
-        }
-        if (input.autoMode && decision.action === "ask" && decision.origin !== undefined && classifierMayAnswer(decision.origin)) {
-            const verdict = await input.autoMode.decider
-                .decide({ req, askMessage: decisionText(decision) }, input.abortSignal)
-                .catch(() => ({ kind: "unavailable", cause: "error" }));
-            if (verdict.kind === "allow") {
-                input.autoMode.denialTracking?.recordAllow();
-                decision = {
-                    action: "allow",
-                    message: "auto-mode classifier allowed this call",
-                    decisionReason: "classifier",
-                    ...(policyRewrite !== undefined ? { updatedInput: policyRewrite } : {}),
-                };
-            }
-            else if (verdict.kind === "block") {
-                const reason = verdict.reason ? inlineUntrusted(verdict.reason) : "";
-                const category = verdict.category ? inlineUntrusted(verdict.category) : "";
-                const tracked = input.autoMode.denialTracking?.recordBlock();
-                if (tracked?.limitReached === true) {
-                    const fallbackAsk = {
-                        ...decision,
-                        message: denialLimitFallbackMessage(tracked.fallback, reason || category || toolName),
-                        decisionReason: "classifier",
-                        requiresRealApproval: true,
-                        denialLimitFallback: tracked.fallback,
-                    };
-                    decision = { ...fallbackAsk, origin: askOriginOf(fallbackAsk, originFacts) };
-                    denySource = "classifier";
-                }
-                else {
-                    decision = {
-                        action: "deny",
-                        message: `auto-mode classifier blocked this call${reason ? `: ${reason}` : category ? `: [${category}]` : ""}`,
-                        decisionReason: "classifier",
-                    };
-                    denySource = "classifier";
-                }
-            }
-        }
-        if (input.sandboxAdmission !== undefined &&
-            decision.action === "ask" &&
-            req.toolName !== ASK_USER_QUESTION_TOOL_NAME &&
-            input.isMarkedUnresolvable?.(input.event.toolCallId) !== true &&
-            decision.requiresRealApproval !== true &&
-            decision.decisionReason !== "hook" &&
-            hookAsk === undefined &&
-            input.egress !== true &&
-            input.peerMessage !== true &&
-            input.sandboxAdmission.boundaryCapable !== true) {
-            const recorded = input.sandboxAdmission.askClassesOf(toolCallId);
-            const admissible = recorded !== undefined && recorded.length > 0 && recorded.every((r) => r.cls === "sandbox_local");
-            if (admissible) {
-                const askClasses = recorded;
-                input.sandboxAdmission.onAdmitted({ toolCallId, toolName, askClasses, boundary: "sandbox_internal" });
-                preToolContext.push(`permission.sandbox_admitted: this call's pending approval was auto-admitted because the deployment declares an isolated sandbox execution env and the request stays inside it. Recorded for audit.`);
-                decision = {
-                    action: "allow",
-                    message: "admitted inside the deployment-declared sandbox (permission.sandbox_admitted)",
-                    decisionReason: "sandbox",
-                    ...(policyRewrite !== undefined ? { updatedInput: policyRewrite } : {}),
-                };
-            }
-        }
-        const egressTool = input.egress === true;
-        const irreversibleTool = input.irreversibility === "always" || input.irreversibility === "maybe";
-        const safety = egressTool || irreversibleTool ? { egress: egressTool, irreversible: irreversibleTool } : undefined;
-        const realApprovalOf = (d) => d.action === "ask" && d.requiresRealApproval === true
-            ? { origin: orgAskOrigin !== undefined ? `org_${orgAskOrigin}` : "policy" }
-            : undefined;
-        const carryOf = (d) => ({
-            ...(callSignal !== undefined ? { signal: callSignal } : {}),
-            ...(d.action === "ask" && d.denialLimitFallback !== undefined ? { denialLimitFallback: unarmedWindow(d.denialLimitFallback) } : {}),
-            ...(d.action === "ask" && d.origin !== undefined ? { origin: d.origin } : {}),
-        });
-        if (suspendAsk && decision.action === "ask") {
-            const parkArgs = [req, currentInput, safety, undefined, realApprovalOf(decision), decision.action === "ask" ? decision.persistedRuleShadowed : undefined, decision.action === "ask" ? decision.decisionReason : undefined, decision.action === "ask" ? decision.probeReason : undefined, decision.action === "ask" ? decision.probeCause : undefined, decision.action === "ask" ? decision.segmentCoverage : undefined, decision.action === "ask" ? decision.matchedAskRule : undefined, decision.action === "ask" ? decision.probeMandated : undefined];
-            const suspended = await parkWith(suspendAsk, parkArgs, carryOf(decision));
-            if (suspended) {
-                if ("parkFailed" in suspended)
-                    parkFailed = suspended.parkFailed;
-                else
-                    return { suspend: suspended, preToolContext };
-            }
-        }
-        if (decision.action === "ask" && req.toolName === ASK_USER_QUESTION_TOOL_NAME) {
-            const outcome = input.resolveContentAsk !== undefined ? await (callSignal !== undefined ? input.resolveContentAsk(req, callSignal) : input.resolveContentAsk(req)) : { kind: "unavailable", parkDeclined: false };
-            if (outcome.kind === "answered") {
-                decision = { action: "allow", updatedInput: outcome.presentedInput };
-            }
-            else if (outcome.kind === "unavailable") {
-                if (outcome.presentedInput !== undefined) {
-                    currentInput = outcome.presentedInput;
-                    req.args = outcome.presentedInput;
-                }
-                if (suspendAsk && outcome.parkDeclined && parkFailed === undefined) {
-                    const parkArgs = [req, currentInput, safety, true, realApprovalOf(decision), decision.action === "ask" ? decision.persistedRuleShadowed : undefined, decision.action === "ask" ? decision.decisionReason : undefined, decision.action === "ask" ? decision.probeReason : undefined, decision.action === "ask" ? decision.probeCause : undefined, decision.action === "ask" ? decision.segmentCoverage : undefined, decision.action === "ask" ? decision.matchedAskRule : undefined, decision.action === "ask" ? decision.probeMandated : undefined];
-                    const suspended = await parkWith(suspendAsk, parkArgs, carryOf(decision));
-                    if (suspended) {
-                        if ("parkFailed" in suspended)
-                            parkFailed = suspended.parkFailed;
-                        else
-                            return { suspend: suspended, preToolContext };
-                    }
-                }
-                decision = {
-                    action: "deny",
-                    message: "AskUserQuestion could not be parked for a durable human answer on this path (no checkpoint " +
-                        "facility, or the suspend failed) and a synchronous permission approver cannot carry an answer — " +
-                        "the question was NOT shown to anyone. Proceed with your best judgment and state the assumption " +
-                        "you made.",
-                };
-            }
-            else {
-                if (outcome.presentedInput !== undefined)
-                    decision = { action: "allow", updatedInput: outcome.presentedInput };
-                else
-                    decision = { action: "allow" };
-            }
-        }
-        if (decision.action === "ask") {
-            const askBeforeResolve = decision;
-            const resolved = await (callSignal !== undefined ? resolveAsk(decision, req, callSignal) : resolveAsk(decision, req));
-            if (resolved.action !== "ask" && resolved.approver !== undefined)
-                resolvedApprover = resolved.approver;
-            if (resolved.action === "deny" && isAskDenyResolution(resolved.resolution))
-                askDenyResolution = resolved.resolution;
-            if (resolved.action === "deny" && resolved.autoDenied === true)
-                askAutoDenied = true;
-            decision = resolved;
-            if (resolved.action === "deny" && resolved.approverUnavailable === true && suspendAsk && parkFailed === undefined) {
-                const parkArgs = [req, currentInput, safety, true, realApprovalOf(askBeforeResolve), askBeforeResolve.action === "ask" ? askBeforeResolve.persistedRuleShadowed : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.decisionReason : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.probeReason : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.probeCause : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.segmentCoverage : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.matchedAskRule : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.probeMandated : undefined];
-                const suspended = await parkWith(suspendAsk, parkArgs, carryOf(askBeforeResolve));
-                if (suspended) {
-                    if ("parkFailed" in suspended)
-                        parkFailed = suspended.parkFailed;
-                    else
-                        return { suspend: suspended, preToolContext };
-                }
-            }
-            if (askBeforeResolve.action === "ask" && askBeforeResolve.denialLimitFallback !== undefined) {
-                if (decision.action === "allow") {
-                    input.autoMode?.denialTracking?.recordAllow();
-                }
-                else if (askDenyResolution === "no_approver" ||
-                    askDenyResolution === "blanket_allow_refused" ||
-                    askDenyResolution === "approver_unavailable" ||
-                    resolved.approverUnavailable === true) {
-                    try {
-                        input.onHeadlessDenialLimit?.({ toolName, toolCallId, fallback: unarmedWindow(askBeforeResolve.denialLimitFallback) });
-                    }
-                    catch {
-                    }
-                }
-            }
-            if (decision.action === "allow" && decision.updatedInput !== undefined) {
-                let editArgs = decision.updatedInput;
-                let editDenied;
-                let editRewrittenSinceHuman = false;
-                for (let round = 0;; round++) {
-                    if (round >= 3) {
-                        editDenied = {
-                            action: "deny",
-                            message: `the approval-edit chain for "${toolName}" exceeded the re-approval cap — denied fail-closed; re-submit the edited action directly`,
-                        };
-                        denySource = "policy";
-                        break;
-                    }
-                    if (preToolUse) {
-                        let hr;
-                        let hrUnanswered;
-                        try {
-                            const seat = await runHookSeat("preToolUse", seatBound(true), (sig) => preToolUse(toolName, editArgs, hookCtx(sig)));
-                            if (seat.expired)
-                                hrUnanswered = seat.cause;
-                            else
-                                hr = screenPreToolUseResult(seat.value);
-                        }
-                        catch (err) {
-                            traceHookCrash(input, err, notifier);
-                            editDenied = { action: "deny", message: preToolUseCrashReason(`the approved edit for "${toolName}"`, err) };
-                            denySource = "hook";
-                            break;
-                        }
-                        if (hrUnanswered !== undefined) {
-                            editDenied = { action: "deny", message: await preToolUseUnansweredBlock(`the approved edit for "${toolName}"`, hrUnanswered) };
-                            denySource = "hook";
-                            break;
-                        }
-                        if (hr) {
-                            if (hr.additionalContext)
-                                preToolContext.push(hr.additionalContext);
-                            if (hr.action === "deny") {
-                                editDenied = { action: "deny", message: decisionText(hr) ?? `the approved edit for "${toolName}" was blocked by a PreToolUse hook` };
-                                denySource = "hook";
-                                break;
-                            }
-                            if (hr.action === "ask") {
-                                editDenied = {
-                                    action: "deny",
-                                    message: `the approved edit for "${toolName}" raises a new PreToolUse approval requirement the original approval does not cover — denied fail-closed; re-submit the edited action directly`,
-                                };
-                                denySource = "hook";
-                                break;
-                            }
-                            if (hr.updatedInput !== undefined) {
-                                editArgs = hr.updatedInput;
-                                editRewrittenSinceHuman = true;
-                            }
-                        }
-                    }
-                    if (!adjudicate && input.orgRules === undefined)
-                        break;
-                    let recheck = { action: "allow" };
-                    if (adjudicate) {
-                        try {
-                            recheck = await (callSignal !== undefined ? adjudicate({ toolName, args: editArgs, toolCallId }, callSignal) : adjudicate({ toolName, args: editArgs, toolCallId }));
-                        }
-                        catch (err) {
-                            recheck = {
-                                action: "deny",
-                                message: `policy re-check of the approved edit for "${toolName}" errored: ${err instanceof Error ? err.message : String(err)}`,
-                            };
-                        }
-                    }
-                    if (recheck.action === "deny") {
-                        editDenied = recheck;
-                        denySource = "policy";
-                        break;
-                    }
-                    if (recheck.updatedInput !== undefined) {
-                        editArgs = recheck.updatedInput;
-                        editRewrittenSinceHuman = true;
-                    }
-                    const orgTightensBefore = orgTightenCount;
-                    orgAskOrigin = undefined;
-                    recheck = await applyOrgLayer(recheck, editArgs);
-                    const orgRaisedThisRound = orgTightenCount > orgTightensBefore;
-                    if (recheck.action === "deny") {
-                        editDenied = recheck;
-                        break;
-                    }
-                    if (recheck.action === "allow") {
-                        if (recheck.updatedInput !== undefined) {
-                            editArgs = recheck.updatedInput;
-                            editRewrittenSinceHuman = true;
-                        }
-                        break;
-                    }
-                    if (recheck.updatedInput !== undefined) {
-                        editArgs = recheck.updatedInput;
-                        editRewrittenSinceHuman = true;
-                    }
-                    const editAskSnapshot = { ...recheck, ruleEvidence: mintRuleEvidence({ dotsAbsent: "not_adjudicated" }) };
-                    const editAskDecision = { ...editAskSnapshot, origin: askOriginOf(editAskSnapshot, askOriginFacts()) };
-                    const editAskReq = { toolName, args: editArgs, toolCallId };
-                    const rr = await (callSignal !== undefined ? resolveAsk(editAskDecision, editAskReq, callSignal) : resolveAsk(editAskDecision, editAskReq));
-                    resolvedApprover = rr.action !== "ask" ? rr.approver : undefined;
-                    if (rr.action !== "allow") {
-                        if (rr.action === "deny" && isAskDenyResolution(rr.resolution))
-                            askDenyResolution = rr.resolution;
-                        editDenied = rr;
-                        if (!orgRaisedThisRound)
-                            denySource = "policy";
-                        break;
-                    }
-                    if (rr.updatedInput === undefined) {
-                        if (rr.presentedInput !== undefined)
-                            editArgs = rr.presentedInput;
-                        editRewrittenSinceHuman = false;
-                        break;
-                    }
-                    editArgs = rr.updatedInput;
-                    editRewrittenSinceHuman = false;
-                }
-                if (editDenied === undefined && editRewrittenSinceHuman && input.writeProtectionCheck !== undefined) {
-                    const editHit = input.writeProtectionCheck(toolName, editArgs);
-                    if (editHit !== null) {
-                        editDenied = {
-                            action: "deny",
-                            message: `the approved edit for "${toolName}" was rewritten by the restriction chain onto a write-protected path (table entry "${editHit.name}") that no approval covers — denied fail-closed; re-submit the edited action directly`,
-                        };
-                        denySource = "safety";
-                    }
-                }
-                decision = editDenied ?? { ...decision, updatedInput: editArgs };
-            }
-            else if (decision.action === "allow" && decision.updatedInput === undefined && resolved.presentedInput !== undefined) {
-                decision = { ...decision, updatedInput: resolved.presentedInput };
-            }
-        }
-    }
-    if (decision.action === "deny") {
-        const denyReason = withParkFailureCause(decisionText(decision) ?? `tool "${toolName}" denied by policy`, parkFailed);
-        if (decision.updatedInput !== undefined) {
-            currentInput = decision.updatedInput;
-        }
-        const denyResolution = askDenyResolution ?? coreMintedResolutionOf(decision, { toolCallId, toolName });
-        const denyAutoDenied = askAutoDenied || coreMintedAutoDeniedOf(decision, { toolCallId, toolName });
-        await notifyPermissionDeniedSeat({ toolName, input: cloneObserverInput(currentInput), toolCallId, reason: denyReason, source: denySource, ...(denyResolution !== undefined ? { resolution: denyResolution } : {}), ...(denyAutoDenied ? { autoDenied: true } : {}), ...(input.identity !== undefined ? { identity: input.identity } : {}) });
-        const denySettledBy = decision.settledBy;
-        const denyApprover = denySettledBy !== undefined ? resolvedApprover : undefined;
-        return {
-            block: true,
-            reason: formatHookFeedback(denyReason, input.reminderMark),
-            ...(denySettledBy !== undefined ? { settledBy: denySettledBy } : {}),
-            ...(denyResolution !== undefined ? { resolution: denyResolution } : {}),
-            ...(denyAutoDenied ? { autoDenied: true } : {}),
-            ...(denyApprover !== undefined ? { approver: denyApprover } : {}),
-            preToolContext,
-        };
-    }
-    if (decision.action === "allow") {
-        const rw = decision.updatedInput !== undefined ? decision.updatedInput : policyRewrite;
-        if (rw !== undefined)
-            currentInput = rw;
-    }
-    const allowSettledBy = decision.action === "allow" ? decision.settledBy : undefined;
-    const allowApprover = decision.action === "allow" && allowSettledBy !== undefined ? resolvedApprover : undefined;
-    return {
-        updatedInput: currentInput === event.input ? undefined : currentInput,
-        ...(allowSettledBy !== undefined ? { settledBy: allowSettledBy } : {}),
-        ...(allowApprover !== undefined ? { approver: allowApprover } : {}),
-        preToolContext,
-    };
+    return await runGateFold(pass);
 }