@sema-agent/core 7.50.1 → 7.51.0

package/dist/core/runner/session-rule-policy.js

@@ -1,12 +1,13 @@
 import { canonicalizeTarget, isWinFormPath, pathFamilyOf, writeTargetPath } from "../../tools/fs/safety.js";
-import { createCoarseCommandNamePolicy, namespacedCoveringEntries, namespacedCoveringHit } from "../tool-policy.js";
-import { continuesLineage } from "../session-policy-store.js";
-import { thrownText } from "../thrown-value.js";
-import { heldBy, wireOf } from "../tool-name-readings.js";
+import { continuesLineage, readSessionRulesShape } from "../session-policy-store.js";
+import { compileAllowList, compiledEntryName, judgeAllowEntries, uncoveredCommandSegment } from "../allow-entry.js";
+import { inlineUntrusted } from "../untrusted-text.js";
+import { callTargetReadingOf, pathTargetBaseOf, readCallTarget } from "../effective-path-target.js";
+import { egressThrownText } from "../untrusted-egress.js";
+import { wireOf } from "../tool-name-readings.js";
 import { ruleDenialSentence } from "../rule-denial-sentence.js";
 import { DEFAULT_GATE_AWAIT_TIMEOUT_MS, gateWaitFailureOf, withGateTimeout } from "../gate-bounded-await.js";
 import { declaredPathTargetOf, isProtectedWrite, pathConfinableWriteToolNames } from "../tool-registry.js";
-import { pathTargetBaseOf } from "../effective-path-target.js";
 import { judgePathRows } from "../path-guard-rows.js";
 import { domainRow } from "../fs-write-gate-policy.js";
 export const PATH_CONFINABLE_WRITE_TOOLS = pathConfinableWriteToolNames();
@@ -53,7 +54,7 @@ export function createLiveSessionRules(store, floor, hooks) {
             const wait = gateWaitFailureOf(err);
             announce(wait !== undefined
                 ? `the session-policy store read for session ${JSON.stringify(floor.sessionId)} ended without an answer (${wait})`
-                : `the session-policy store threw while re-reading session ${JSON.stringify(floor.sessionId)}: ${thrownText(err)}`);
+                : `the session-policy store threw while re-reading session ${JSON.stringify(floor.sessionId)}: ${egressThrownText("same-principal", err)}`);
             return enforced;
         }
         if (live === null) {
@@ -104,23 +105,30 @@ export function createLiveSessionRules(store, floor, hooks) {
     };
 }
 function compileSessionRules(rules) {
+    const shaped = readSessionRulesShape(rules);
+    if ("fault" in shaped) {
+        const { field, got } = shaped.fault;
+        const what = got === "not a rule bucket" ? "a key that is no rule bucket" : field === "" ? `a value that is ${got}, not an object of rule buckets` : `${field} holding ${got}`;
+        return { deny: [], allow: undefined, allowDirs: undefined, pathRows: false, names: { deny: [], allow: [] }, unreadable: `the session rules cannot be read as rules (they hold ${what}) — every call is refused until they are rewritten` };
+    }
+    const { toolDeny, toolAllow, allowDirs } = shaped.rules;
+    const denyList = compileAllowList(toolDeny ?? [], "deny");
+    const allowList = toolAllow === undefined ? undefined : compileAllowList(toolAllow, "allow");
+    const rowsOf = (behavior, list) => list.rows.map((r) => ({ behavior, entry: r.entry, compiled: r.compiled }));
+    const deny = rowsOf("deny", denyList);
+    const allow = allowList === undefined ? undefined : rowsOf("allow", allowList);
+    const namesOf = (rows, list) => [...rows.map((r) => compiledEntryName(r.compiled)), ...(list?.inert ?? []).map((i) => i.entry)];
     return {
-        toolDeny: new Set(rules.toolDeny ?? []),
-        toolAllow: rules.toolAllow ? new Set(rules.toolAllow) : undefined,
-        toolDenyCovering: namespacedCoveringEntries(rules.toolDeny),
-        toolAllowCovering: namespacedCoveringEntries(rules.toolAllow),
-        cmdPolicy: rules.commandAllow || rules.commandDeny
-            ? createCoarseCommandNamePolicy({
-                ...(rules.commandAllow ? { allow: rules.commandAllow } : {}),
-                ...(rules.commandDeny ? { deny: rules.commandDeny } : {}),
-                defaultAction: "deny",
-            })
-            : undefined,
-        allowDirs: rules.allowDirs && rules.allowDirs.length > 0 ? rules.allowDirs : undefined,
+        deny,
+        allow,
+        allowDirs: allowDirs !== undefined && allowDirs.length > 0 ? allowDirs : undefined,
+        pathRows: [...deny, ...(allow ?? [])].some((r) => r.compiled.kind === "path"),
+        names: { deny: namesOf(deny, denyList), allow: namesOf(allow ?? [], allowList) },
     };
 }
 export function createSessionRulePolicy(rules, opts) {
     const { env, rootPath, toolEffects } = opts;
+    const anchors = opts.anchors ?? (rootPath !== undefined ? { root: rootPath } : {});
     const source = "seed" in rules ? rules : { seed: rules };
     const seed = source.seed;
     const readRules = source.read ?? (() => Promise.resolve(seed));
@@ -133,22 +141,24 @@ export function createSessionRulePolicy(rules, opts) {
         }
         return compiled;
     };
+    const seedNames = compile(seed).names;
     return {
-        nameSets: [{ ...(seed.toolDeny?.length ? { deny: [...seed.toolDeny] } : {}), ...(seed.toolAllow?.length ? { allow: [...seed.toolAllow] } : {}) }],
+        nameSets: [{ ...(seedNames.deny.length > 0 ? { deny: seedNames.deny } : {}), ...(seedNames.allow.length > 0 ? { allow: seedNames.allow } : {}) }],
         async check(req, signal) {
-            const { toolDeny, toolAllow, toolDenyCovering, toolAllowCovering, cmdPolicy, allowDirs } = compile(await readRules(req.toolCallId, signal));
-            const listed = (set) => heldBy("policy.sessionRules", set, req);
-            if (listed(toolDeny) || namespacedCoveringHit(toolDenyCovering, req))
-                return deny(req.toolName);
-            if (toolAllow && !listed(toolAllow) && !namespacedCoveringHit(toolAllowCovering, req)) {
-                return deny(req.toolName, "it is not in the session-rule allowlist");
-            }
-            if (cmdPolicy) {
-                const d = await cmdPolicy.check(req, signal);
-                if (d.action === "deny")
-                    return { ...d, message: ruleDenialSentence({ source: "session", tool: req.toolName, ...(d.message !== undefined ? { detail: d.message } : {}) }) };
-                if (d.action !== "allow")
-                    return d;
+            const { deny: denyRows, allow: allowRows, allowDirs, unreadable, pathRows } = compile(await readRules(req.toolCallId, signal));
+            if (unreadable !== undefined)
+                return deny(req.toolName, unreadable);
+            if (denyRows.length > 0 || allowRows !== undefined) {
+                const located = req.root === undefined && rootPath !== undefined ? { ...req, root: rootPath } : req;
+                const call = pathRows && callTargetReadingOf(req) === undefined ? { ...req, targetReading: await readCallTarget(env, located, signal) } : req;
+                const judged = { root: rootPath, sessionId: undefined, liveCwd: () => req.cwd, anchors };
+                const refusing = denyRows.length > 0 ? judgeAllowEntries(denyRows, call, "deny", judged) : undefined;
+                if (refusing !== undefined)
+                    return deny(req.toolName);
+                if (allowRows !== undefined && judgeAllowEntries(allowRows, call, "allow", judged, "narrowing") === undefined) {
+                    const segment = uncoveredCommandSegment(allowRows, call, judged, "narrowing");
+                    return deny(req.toolName, segment === undefined ? "it is not in the session-rule allowlist" : `it is not in the session-rule allowlist (no entry covers ${JSON.stringify(inlineUntrusted(segment, 200))})`);
+                }
             }
             if (allowDirs) {
                 if (!isProtectedWrite(req)) {
@@ -175,7 +185,7 @@ export function createSessionRulePolicy(rules, opts) {
                     }
                     const views = canon.ok ? { views: [{ path: canon.key, kind: "canonical" }] } : { views: [], unreadable: canon.message };
                     if (judgePathRows([domainRow("session", roots)], views, "allow") === undefined) {
-                        return deny(req.toolName, canon.ok ? `the write to ${JSON.stringify(path)} is outside the session-rule allowDirs (${allowDirs.join(", ")})` : `the real target of the write to ${JSON.stringify(path)} could not be resolved against the session-rule allowDirs`);
+                        return deny(req.toolName, canon.ok ? `the write to ${JSON.stringify(path)} is outside the session-rule allowDirs` : `the real target of the write to ${JSON.stringify(path)} could not be resolved against the session-rule allowDirs`);
                     }
                 }
             }

package/dist/core/runner/stream-lifecycle-verbs.js

@@ -1,4 +1,4 @@
-import { isSystemInjectionPriority, SYSTEM_INJECTION_PRIORITIES } from "../task-notification.js";
+import { isSystemInjectionPriority, SYSTEM_INJECTION_PRIORITIES, TASK_NOTIFICATION_TERMINAL_STATUSES } from "../task-notification.js";
 export function streamLifecycleVerbs(input) {
     const { live, ready, orTimeout, steeringError, notifyRef, captureOptOutRef, mcpRedialRef, manualCompactRef, detachHub } = input;
     const notify = async (input, opts) => {
@@ -10,7 +10,7 @@ export function streamLifecycleVerbs(input) {
         if (typeof input?.task_id !== "string" || input.task_id.trim() === "") {
             throw notifyError("input.task_id must be a non-empty string", "notify.invalid_payload");
         }
-        const VALID_STATUSES = new Set(["completed", "failed", "killed", "cancelled", "event"]);
+        const VALID_STATUSES = new Set([...TASK_NOTIFICATION_TERMINAL_STATUSES, "event"]);
         if (!VALID_STATUSES.has(input.status)) {
             throw notifyError(`input.status must be one of ${[...VALID_STATUSES].join("/")}`, "notify.invalid_payload");
         }

package/dist/core/runner/stream-settle-backstop.js

@@ -1,4 +1,5 @@
 import { errorCodeOf, thrownFailureOf } from "./terminal-account.js";
+import { reopenReasonOf, resumeStartupCauseOf } from "../resume-startup-cause.js";
 import { resumeDecisionWasNegative } from "./decide-continuation.js";
 import { drainForwardedFramesBeforeDone, forwardsSubagentEvents } from "./prepare-run-refs.js";
 import { hasDestroy } from "../remote-env.js";
@@ -11,7 +12,7 @@ export function streamSettleBackstop(input) {
     const { spec, resume, queue, taskIdRef, entryTracer, runStartedAt, live, runner, sessions, locallyClaimedTokens, parentConstraintRegistry, suspendedEnvReaps } = input;
     const onRunRejected = async (err) => {
         let { code, message, detail } = thrownFailureOf(err, thrownText(err));
-        const reopenReason = code === "resume.tool_unavailable" || code === "resume.tool_contract_mismatch" ? "tool_unavailable" : "env_failed";
+        const reopenReason = reopenReasonOf(resumeStartupCauseOf(code));
         const reopenable = resume !== undefined && resume.pendingActionStarted !== true && reopenReason !== undefined && !(resumeDecisionWasNegative(resume) && resume.decisionDelivered === true);
         let reopenCommitted = false;
         let reopenStateUnknown = false;

package/dist/core/runner/sub-agent-deny-lists.d.ts

@@ -3,15 +3,18 @@
  * `TaskSpec.excludeTools`, unless the delegation lane spawned it — its spawning run judged them where they were mounted), the definitions it
  * carries (`TaskSpec.agents`), and the definitions and tool-level lists a mounted delegation tool carries (the `authored` faces
  * — the engine's built-ins are not judged; only a tool a deployment mounted (depth 0) publishes them). One rule for both sides:
- * a value that is not a list, an entry that is not a string, a spelling that can name no tool, a stale name and a name the
- * universe does not carry are REFUSED; a list whose universe the engine cannot list (a delegation tool that injects tools per
- * spawn with no declared roster) turns the refusals that need a universe into host notices. And one contradiction, judged on
- * every leg: a denylist (the run's own or one of its ceiling) that reaches a tool the leg's kind relies on (the catalog's
- * protocol column) is refused — neither a silently ignored deny nor a silently crippled leg.
+ * a value that is not a list, an entry that is not a string and a spelling that can name no tool are REFUSED; an entry whose
+ * name no tool of the universe answers to (a server this deployment does not declare, a stale or misspelt name) is KEPT as
+ * written — the selector reads every entry by name, so a denied one hides a tool of that name whenever one is mounted and an
+ * allowed one admits it — and told to the host, one account per entry. And one contradiction, judged on every leg: a
+ * denylist (the run's own or one of its ceiling) that reaches a tool the leg's kind relies on (the catalog's protocol column)
+ * is refused — neither a silently ignored deny nor a silently crippled leg.
  *
  * Universe = the task's assembled roster before the valve, every tool the catalog describes, every mounted delegation tool's
  * pool and the caller's own tools (names and aliases), and the protocol peers the task declares (a namespaced spelling under a
- * declared peer names a tool of it — the peer's tool list is runtime data, so the peer is what is checked).
+ * declared peer names a tool of it — the peer's tool list is runtime data, so the peer is what is checked). A delegation tool
+ * whose factory injects tools per spawn with no declared roster (`extraTools`) lists none of them here; a kept entry reaches
+ * its products by name like any other later-mounted tool.
  *
  * Throws `config.tool_face_control` for the run's own lists and the protocol contradiction, `config.agent.unknown_tool` for a
  * definition's or a delegation tool's lists — synchronous, like the phase that calls it.
@@ -24,8 +27,9 @@ import type { AnnounceOnceSink } from "./contracts.js";
 /**
  * The names a definition's denied-tools entries stand for, for a lane that has neither a roster nor a notice sink at the point
  * it builds its own policy (a workflow leg's agentType): each entry is read by the one reading, so `Tool(content)` denies the
- * whole tool there too, and an entry that names no tool is refused by the same refusal. The stale-name and told dispositions
- * need the leg's roster and a sink; the leg's own policy-name audit is what reads them.
+ * whole tool there too, a spelling no tool name can have is refused by the same refusal, and a name no tool answers to is
+ * returned as written (the policy denies a call of that name whenever one is made). The account of such a name needs the
+ * leg's roster and a sink; the leg's own policy-name audit is what reads them.
  */
 export declare function deniedToolNamesOf(where: string, value: unknown): string[];
 /**

package/dist/core/runner/sub-agent-deny-lists.js

@@ -23,6 +23,14 @@ function refused(message, code, reason) {
     return e;
 }
 const LIST_WORD = { allowed: "allowed tools", denied: "denied tools" };
+function grammarRefusal(where, side, flaw, code) {
+    return refused(`${where} declares tool ${inertEntryPhrase(flaw)} in its ${LIST_WORD[side]}, a spelling no tool name can have — fix the entry. ${DENY_LIST_NAMES_ONLY}`, code, "unknown_name");
+}
+const KEPT_ENTRY = {
+    allowed: "it grants nothing today and stays in force for a tool of that name mounted later",
+    denied: "it denies nothing today and stays in force for a tool of that name mounted later",
+};
+const PEER_WORD = { mcp: "MCP server", a2a: "A2A peer" };
 function judgeToolNameList(where, side, value, universe, advise, code) {
     if (value === undefined || value === null)
         return;
@@ -40,7 +48,8 @@ function judgeToolNameList(where, side, value, universe, advise, code) {
             throw refused(`${where} declares "*" in its ${LIST_WORD[side]}: a denied list has no wildcard — the entry would hide nothing. To give the agent no tools, write an empty allowed list.`, code, "unsupported_pattern");
         }
         const read = readDeniedEntry(entry);
-        const name = side === "denied" && read.kind === "name" ? read.name : entry;
+        const toolName = read.kind === "name" ? read.name : entry;
+        const name = side === "denied" ? toolName : entry;
         const content = side === "denied" && read.kind === "name" && read.content;
         const reach = side === "denied" ? readDeniedToolList([entry]) : (readAllowedToolList([entry]) ?? readDeniedToolList([]));
         const split = splitNamespacedName(name);
@@ -49,11 +58,13 @@ function judgeToolNameList(where, side, value, universe, advise, code) {
                 continue;
             throw refused(`${where} declares ${renderListEntry(entry)} in its ${LIST_WORD[side]}: an allowed list has no protocol-wide form — name a peer (\`${split.ns.prefix}<peer>\`) or its tools.`, code, "unsupported_pattern");
         }
-        const { inert } = compileAllowList([name], "deny", universe.known);
+        const { inert } = compileAllowList([toolName], "deny", universe.known);
         const flaw = inert[0] === undefined ? undefined : { ...inert[0], entry };
-        const stale = flaw !== undefined && (flaw.reason === "tool_name" || flaw.reason === "near_miss");
-        if (flaw !== undefined && (flaw.reason === "grammar" || (stale && universe.complete))) {
-            throw refused(`${where} declares tool ${inertEntryPhrase(flaw)} in its ${LIST_WORD[side]}, but no tool of that spelling exists in this deployment — fix the entry or mount the tool.${flaw.reason === "grammar" ? ` ${DENY_LIST_NAMES_ONLY}` : ""}`, code, "unknown_name");
+        if (flaw !== undefined && flaw.reason === "grammar")
+            throw grammarRefusal(where, side, flaw, code);
+        if (toolName !== name) {
+            advise(new Error(`${where} declares ${renderListEntry(entry)} in its allowed tools: an allowed list names tools, not content, so this entry grants nothing — name the tool "${inlineUntrusted(toolName, 80)}" to grant it, or move the content rule to a denied list or a permission rule.`));
+            continue;
         }
         if (flaw === undefined && universeCarries(reach, name, universe)) {
             if (content)
@@ -61,9 +72,9 @@ function judgeToolNameList(where, side, value, universe, advise, code) {
             continue;
         }
         const phrase = flaw !== undefined ? inertEntryPhrase(flaw) : renderListEntry(entry);
-        if (universe.complete)
-            throw refused(`${where} declares tool ${phrase} in its ${LIST_WORD[side]}, a name no tool of this deployment answers to — fix the entry or mount the tool.`, code, "unknown_name");
-        advise(new Error(`${where} declares tool ${phrase} in its ${LIST_WORD[side]}, a name no listed tool answers to — a delegation tool this task mounts injects tools the engine cannot enumerate (extraTools), so the name cannot be checked here.`));
+        const undeclared = split !== undefined && split.peer !== "" && !split.peer.includes("*") && !universe.peers.has(mintNamespacePrefix(split.ns, split.peer));
+        const why = undeclared ? `no ${PEER_WORD[split.ns.id]} named "${inlineUntrusted(split.peer, 80)}" is declared for this task` : "no tool of this task answers to that name";
+        advise(new Error(`${where} declares tool ${phrase} in its ${LIST_WORD[side]}: ${why}, so ${KEPT_ENTRY[side]}. If the name is misspelt, fix the entry.`));
     }
 }
 export function deniedToolNamesOf(where, value) {
@@ -78,7 +89,7 @@ export function deniedToolNamesOf(where, value) {
             throw refused(notAStringSentence(where, "denied", index, read.type), "config.agent.unknown_tool", "not_a_string");
         const flaw = compileAllowList([read.name], "deny").inert[0];
         if (flaw !== undefined && flaw.reason === "grammar")
-            throw refused(`${where} declares tool ${inertEntryPhrase({ ...flaw, entry: read.name })} in its denied tools, but no tool of that spelling exists in this deployment — fix the entry or mount the tool. ${DENY_LIST_NAMES_ONLY}`, "config.agent.unknown_tool", "unknown_name");
+            throw grammarRefusal(where, "denied", { ...flaw, entry: read.name }, "config.agent.unknown_tool");
         return read.name;
     });
 }
@@ -128,10 +139,10 @@ export function judgeRunToolLists(input) {
         if (split !== undefined && split.peer !== "")
             peers.add(mintNamespacePrefix(split.ns, split.peer));
     }
-    const universe = { known, peers, complete: delegationTools.every((t) => t.agentToolPool !== undefined) };
+    const universe = { known, peers };
     if (!input.judgedUpstream) {
-        judgeToolNameList(input.ownWhere ?? "TaskSpec.allowTools", "allowed", input.own.allow, { ...universe, complete: true }, advise, "config.tool_face_control");
-        judgeToolNameList(input.ownWhere ?? "TaskSpec.excludeTools", "denied", input.own.exclude, { ...universe, complete: true }, advise, "config.tool_face_control");
+        judgeToolNameList(input.ownWhere ?? "TaskSpec.allowTools", "allowed", input.own.allow, universe, advise, "config.tool_face_control");
+        judgeToolNameList(input.ownWhere ?? "TaskSpec.excludeTools", "denied", input.own.exclude, universe, advise, "config.tool_face_control");
     }
     for (const def of spec.agents ?? []) {
         judgeToolNameList(`TaskSpec.agents: agent "${def.name}"`, "allowed", def.allowTools, universe, advise, "config.agent.unknown_tool");

package/dist/core/runner/terminal-account.js

@@ -3,7 +3,7 @@ import { isProviderEchoShape } from "../../brain/errors.js";
 import { isProviderCondition, isProviderConditionSource } from "../../brain/provider-dialect.js";
 import { admittedRequestRoute } from "../../brain/request-route.js";
 import { readMember } from "../thrown-value.js";
-import { redactSecrets } from "../untrusted-egress.js";
+import { egressText } from "../untrusted-egress.js";
 import { isSensitiveName, looksLikeCredentialValue } from "../secret-env.js";
 import { isSensitiveRecordKey } from "../credential-vocabulary.js";
 export function providerVerdictOf(final) {
@@ -41,7 +41,7 @@ const CODED_DETAIL_CHARS = 16_384;
 const REDACTED = "[redacted]";
 const INDEX_KEY_RE = /^(?:0|[1-9][0-9]*)$/;
 function carriesCredential(text) {
-    return looksLikeCredentialValue(text) || redactSecrets(text) !== text;
+    return looksLikeCredentialValue(text) || egressText("same-principal", text) !== text;
 }
 const NAME_CHARS = 128;
 function namesCredential(name) {
@@ -171,7 +171,7 @@ function codedLinkOf(err) {
     return fallback;
 }
 export function thrownFailureOf(err, text) {
-    const message = redactSecrets(text);
+    const message = egressText("same-principal", text);
     const coded = codedLinkOf(err);
     if (coded === undefined)
         return { message };

package/dist/core/runner/tool-output-projection.js

@@ -1,13 +1,9 @@
 import { isTextBlock, renderContentBlock } from "../../internal/llm.js";
-import { imageBytes, mediaBudgetBytes } from "../media-byte-cap.js";
+import { isMediaBlock, mediaBlockDescriptor, mediaBudgetBytes, omittedMediaDescriptor } from "../media-byte-cap.js";
 import { engineCardTypes } from "../tool-registry.js";
 import { readMember } from "../thrown-value.js";
 const MAX_TOOL_END_OUTPUT_CHARS = 16384;
 const marker = (n) => `…[+${n} chars truncated]`;
-const isMediaBlock = (b) => {
-    const block = b;
-    return (block?.type === "image" || block?.type === "document") && typeof block.data === "string";
-};
 const ownChars = (b) => isTextBlock(b) ? b.text.length + (JSON.stringify({ ...b, type: undefined, text: undefined })?.length ?? 2) - 2 : isMediaBlock(b) ? b.data.length : (JSON.stringify(b)?.length ?? 0);
 const boundTextLane = (blocks, lane) => {
     const sized = lane.map((i) => ({ i, size: ownChars(blocks[i]) }));
@@ -37,12 +33,11 @@ const fitMedia = (media, budget) => {
     for (const [i, m] of media.entries()) {
         const cost = used + m.data.length >= budget ? Infinity : wireBytes(m);
         const kept = used + cost <= budget;
-        const out = kept ? m : { type: m.type, ...(typeof m.mimeType === "string" && m.mimeType.length <= 255 ? { mimeType: m.mimeType } : {}), bytes: imageBytes(m), truncated: true };
+        const out = kept ? m : mediaBlockDescriptor(m);
         const outCost = kept ? cost : wireBytes(out);
         degraded ||= !kept;
         if (used + outCost > budget) {
-            const rest = media.slice(i);
-            blocks.push({ type: "omitted", blocks: rest.length, bytes: rest.reduce((n, r) => n + imageBytes(r), 0), truncated: true });
+            blocks.push(omittedMediaDescriptor(media.slice(i)));
             break;
         }
         used += outCost;

package/dist/core/runner/tool-result-media-seat.d.ts

@@ -0,0 +1,19 @@
+/**
+ * The run's account of the tool-result seat's media refusals (`tool_result.media_refused`, operator). The loop's
+ * post-execution half admits every media block an executed call's result carries (`admitToolResultMedia`, the last step
+ * of `finalizeToolOutcome`) and hands each call's refusals here once; the placeholders already stand in the result, so
+ * this seat only words the account and delivers it on the deployment's notice sink. The detail carries the seat's
+ * closed-set words, counts, the call's identity and a media type only when it can be one — never the bytes.
+ */
+import { type EngineNotice } from "../engine-notice.js";
+import type { ToolResultMediaRefusal } from "../../tools/fs/image-admission.js";
+/** The run's attribution pair, as every per-run notice carries it. */
+export interface ToolResultMediaSeatIds {
+    sessionId: string;
+    runId: string;
+}
+export declare function toolResultMediaRefusedSeat(onNotice: ((notice: EngineNotice) => void) | undefined, ids: ToolResultMediaSeatIds): (info: {
+    toolName: string;
+    toolCallId: string;
+    refused: readonly ToolResultMediaRefusal[];
+}) => void;

package/dist/core/runner/tool-result-media-seat.js

@@ -0,0 +1,13 @@
+import { deliverEngineNotice } from "../engine-notice.js";
+export function toolResultMediaRefusedSeat(onNotice, ids) {
+    return ({ toolName, toolCallId, refused }) => {
+        const reasons = [...new Set(refused.map((r) => r.reason))].join(", ");
+        deliverEngineNotice(onNotice, {
+            code: "tool_result.media_refused",
+            message: `The ${JSON.stringify(toolName)} tool's result carried ${refused.length} media block(s) whose bytes the media admission refused (${reasons}). ` +
+                `Each was replaced in the result by a text placeholder naming the refusal, so neither the model nor the event stream received those bytes; ` +
+                `the tool, or the server behind it, returned bytes that are not what their block claims.`,
+            detail: { toolName, toolCallId, refused: refused.map((r) => ({ ...r })), sessionId: ids.sessionId, runId: ids.runId },
+        });
+    };
+}

package/dist/core/runner/turn-attachments.d.ts

@@ -1,4 +1,5 @@
 import type { McpDroppedTool } from "../mcp.js";
+import type { McpInstructionsEntry } from "../prompt-section-seat.js";
 import type { TaskSpec } from "../types.js";
 import { type SkillListingEntry, type SkillsBlockRender } from "./synthetic-tools.js";
 import { type ResolvedSkillListingBudget } from "../skill-listing-budget.js";
@@ -599,10 +600,7 @@ export interface AttachmentInputs {
     /** G1 续批 mcp_instructions: pending deltas snapshotted from `MaterializedMcp.instructionsDelta`.
      *  CALLER-owned consumption on intact cap survival (same `newTools` discipline). */
     mcpInstructions?: {
-        added: ReadonlyArray<{
-            server: string;
-            text: string;
-        }>;
+        added: ReadonlyArray<McpInstructionsEntry>;
         removed: readonly string[];
     };
     /** [cc216] mcp_dropped_tools: intake-dropped MCP tools snapshotted from
@@ -989,26 +987,29 @@ export declare const MCP_INSTRUCTIONS_MAX_CHARS: number;
  * drift.
  */
 export declare function fenceMcpServerInstructions(server: string, text: string): string;
+/**
+ * The ONE renderer of an MCP instructions entry, read by both lanes. A server's text rides the fence above;
+ * a host's replacement is host text and takes the reference's per-server block, `## <server>` then the
+ * text (cli296.js B[17396126,17396429), `Yqe`), unfenced. Both are bounded by the same per-entry cap and
+ * disclose the same cut, so the frame's size bound holds for the entry that actually rides.
+ */
+export declare function renderMcpInstructionsEntry(entry: McpInstructionsEntry): string;
 /**
  * G1 续批 — MCP server-instruction delta (CC 2.1.198 `mcp_instructions_delta`, bundle
  * pretty.js:599225-599248, headers VERBATIM). Deliberate CC deviations (recorded):
  * - added instruction text is UNTRUSTED server-controlled text → each block rides inside a
  *   `delimitUntrusted` fence (CC injects the raw block; sema's external-inlet posture is fencing —
  *   the text is additionally already `sanitizeUntrustedText`-neutralized at the mcp.ts producer).
- *   The fence is now applied through {@link fenceMcpServerInstructions}, shared with the
- *   STABLE system-prompt lane, so the two lanes can never again carry the same text with different
- *   trust postures — and it carries a per-server {@link MCP_INSTRUCTIONS_MAX_CHARS} bound (the
- *   frame is intact-class: its size is this producer's promise, servers × that cap).
+ *   Each entry renders through {@link renderMcpInstructionsEntry}, shared with the STABLE system-prompt
+ *   lane, so one entry never carries two postures; every entry, server's or host's, carries the per-entry
+ *   {@link MCP_INSTRUCTIONS_MAX_CHARS} bound (the frame is intact-class: its size is entries × that cap).
  * The disconnect list is followed by the CC-verbatim {@link AMBIENT_CONTEXT_NOTE} (CC `Emr`,
  * pretty.js:599240/599992 — resolved by the 2026-07-10 parity spot audit).
  * Removal names are `\n`-joined WITHOUT a `- ` prefix (CC-exact; the agent-listing removal list DOES
  * carry the prefix — the asymmetry is CC's, kept verbatim). Exported for the run loop's
  * intact-survival consumption check (tools_delta discipline).
  */
-export declare function renderMcpInstructionsDelta(added: ReadonlyArray<{
-    server: string;
-    text: string;
-}>, removed: readonly string[]): string | undefined;
+export declare function renderMcpInstructionsDelta(added: ReadonlyArray<McpInstructionsEntry>, removed: readonly string[]): string | undefined;
 /**
  * [cc216] mcp_dropped_tools — announce intake-dropped MCP tools ONCE (CC's
  * `mcp_dropped_tools_delta` system reminder). Per-entry line shape follows CC's `qny`

package/dist/core/runner/turn-attachments.js

@@ -1,5 +1,5 @@
 import { readMember } from "../thrown-value.js";
-import { delimitUntrustedWithClip, sanitizeUntrustedText, SHELLED_BODY_ENVELOPE_TAGS } from "../untrusted-text.js";
+import { delimitUntrustedWithClip, inlineUntrusted, sanitizeUntrustedText, SHELLED_BODY_ENVELOPE_TAGS } from "../untrusted-text.js";
 import { protocolOf } from "../protocol-table.js";
 import { renderSkillLinesWithin, renderSkillsBlock } from "./synthetic-tools.js";
 import { SKILL_LISTING_DEFAULT_BUDGET } from "../skill-listing-budget.js";
@@ -677,16 +677,20 @@ export function commitSkillsListing(state, entries) {
 export const MCP_INSTRUCTIONS_MAX_CHARS = 8 * 1024;
 export function fenceMcpServerInstructions(server, text) {
     const fence = delimitUntrustedWithClip(`MCP server "${server}" instructions`, text, MCP_INSTRUCTIONS_MAX_CHARS);
-    return fence.clipped
-        ? `${fence.text}\n(Truncated by the agent runtime: this server's instructions exceeded ${MCP_INSTRUCTIONS_MAX_CHARS} characters.)`
-        : fence.text;
+    return fence.clipped ? `${fence.text}\n${MCP_INSTRUCTIONS_TRUNCATION_NOTE}` : fence.text;
+}
+const MCP_INSTRUCTIONS_TRUNCATION_NOTE = `(Truncated by the agent runtime: this server's instructions exceeded ${MCP_INSTRUCTIONS_MAX_CHARS} characters.)`;
+export function renderMcpInstructionsEntry(entry) {
+    if (entry.author !== "host")
+        return fenceMcpServerInstructions(entry.server, entry.text);
+    const cps = [...entry.text];
+    const body = cps.length > MCP_INSTRUCTIONS_MAX_CHARS ? `${cps.slice(0, MCP_INSTRUCTIONS_MAX_CHARS - 1).join("")}…\n${MCP_INSTRUCTIONS_TRUNCATION_NOTE}` : entry.text;
+    return `## ${inlineUntrusted(entry.server, 160)}\n${body}`;
 }
 export function renderMcpInstructionsDelta(added, removed) {
     const blocks = [];
     if (added.length > 0) {
-        blocks.push(`# MCP Server Instructions\n\nThe following MCP servers have provided instructions for how to use their tools and resources:\n\n${added
-            .map((a) => fenceMcpServerInstructions(a.server, a.text))
-            .join("\n\n")}`);
+        blocks.push(`# MCP Server Instructions\n\nThe following MCP servers have provided instructions for how to use their tools and resources:\n\n${added.map(renderMcpInstructionsEntry).join("\n\n")}`);
     }
     if (removed.length > 0) {
         blocks.push(`The following MCP servers have disconnected. Their instructions above no longer apply:\n${removed.join("\n")}`);

package/dist/core/runner-deps.d.ts

@@ -145,10 +145,9 @@ export interface RunnerDeps {
      * row (#433 made the registry total over the catalog — no engine-minted code is
      * audience-defaulted any more) — a
      * wire projector forwards it operator-tier and needs no per-session de-duplication of its own.
+     * The probe's second argument, `{ fingerprint }`, is passed exactly when the server's declaration carries one.
      */
-    mcpRevocations?: {
-        isRevoked(serverName: string): boolean;
-    };
+    mcpRevocations?: import("./mcp-server-spec.js").McpRevocationLedger;
     /**
      * design/147 S1c (ruled 2026-07-18) — the DURABLE name→agent roster behind explicit-name
      * addressing, a storage-tier seam like the checkpoint store: core bundles `MemoryRosterStore`
@@ -1144,6 +1143,8 @@ export interface RunnerDeps {
          * prepares. Always filled by the Runner; optional so hand-built ctx objects stay valid.
          */
         sessionId?: string;
+        /** The run this prepare belongs to — the id the `task.start` trace frame, `noteTaskRun` and `TaskResult.runId` carry. Always filled by the Runner. */
+        runId?: string;
         /**
          * design-A C-1/C-2 ([A2]) — where this prepare sits in the snapshot lifecycle; the deployment's
          * cache-invalidation signal (core only derives and forwards it, and ignores the answer):

package/dist/core/safety-merge-corpus.js

@@ -9,11 +9,11 @@ export const SAFETY_MERGE_CONFORMANCE_CORPUS = [
     },
     {
         name: "command-deny-removed",
-        intent: "removing a commandDeny loosens",
-        prior: { commandDeny: ["rm -rf"] },
-        next: { commandDeny: [] },
+        intent: "removing a shell command rule from toolDeny loosens (the command runs again)",
+        prior: { toolDeny: ["Bash(rm:*)"] },
+        next: { toolDeny: [] },
         loosens: true,
-        reasons: ['removed commandDeny "rm -rf"'],
+        reasons: ['removed toolDeny "Bash(rm:*)"'],
     },
     {
         name: "toolAllow-removed-all-allowed",
@@ -32,12 +32,12 @@ export const SAFETY_MERGE_CONFORMANCE_CORPUS = [
         reasons: ['widened toolAllow with "Bash"'],
     },
     {
-        name: "commandAllow-widened",
-        intent: "adding a command outside the org command allowlist loosens",
-        prior: { commandAllow: ["ls"] },
-        next: { commandAllow: ["ls", "curl"] },
+        name: "command-allow-widened",
+        intent: "adding a shell command rule outside the org allowlist loosens",
+        prior: { toolAllow: ["Read", "Bash(ls:*)"] },
+        next: { toolAllow: ["Read", "Bash(ls:*)", "Bash(curl:*)"] },
         loosens: true,
-        reasons: ['widened commandAllow with "curl"'],
+        reasons: ['widened toolAllow with "Bash(curl:*)"'],
     },
     {
         name: "allowDirs-confinement-removed",
@@ -63,14 +63,6 @@ export const SAFETY_MERGE_CONFORMANCE_CORPUS = [
         loosens: true,
         reasons: ['removed toolDeny "Bash"', 'widened allowDirs with "/x"'],
     },
-    {
-        name: "commandAllow-removed-all-allowed",
-        intent: "dropping the COMMAND allowlist (distinct field from toolAllow) re-permits every command — the max loosen on the command axis (review: this branch was unpinned)",
-        prior: { commandAllow: ["ls"] },
-        next: {},
-        loosens: true,
-        reasons: ["removed commandAllow allowlist (all allowed)"],
-    },
     {
         name: "allowDirs-confinement-removed-empty-array",
         intent: "an EXPLICIT empty allowDirs [] removes confinement exactly like undefined (loosenReasons branches on .length===0) — center must treat [] and absent identically",
@@ -184,10 +176,18 @@ export const SAFETY_MERGE_CONFORMANCE_CORPUS = [
         reasons: [],
     },
     {
-        name: "commandAllow-added-from-all",
-        intent: "introducing a command allowlist where there was none narrows from all-allowed (per-field symmetry with toolAllow)",
-        prior: {},
-        next: { commandAllow: ["ls"] },
+        name: "inert-deny-entry-removed-safe",
+        intent: "removing a deny entry that reads as nothing (an empty entry, a wildcard peer, a `__` name with no protocol prefix) relaxes nothing — the comparison reads the EFFECTIVE entries on both sides",
+        prior: { toolDeny: ["Bash", "", "mcp__*", "github__x"] },
+        next: { toolDeny: ["Bash"] },
+        loosens: false,
+        reasons: [],
+    },
+    {
+        name: "inert-allow-entry-added-safe",
+        intent: "adding an allowlist entry that reads as nothing admits nothing, so it widens nothing",
+        prior: { toolAllow: ["Read"] },
+        next: { toolAllow: ["Read", "mcp__*"] },
         loosens: false,
         reasons: [],
     },

package/dist/core/secret-env.js

@@ -7,7 +7,7 @@ function isExemptEnvName(name) {
 }
 const ENV_NAMES = envNameView(CREDENTIAL_VOCABULARY);
 const OTEL_ENV_RE = /^(?:INPUT_)?OTEL_/i;
-const SEMA_NAMESPACE_SECRET_RE = new RegExp(`^SEMA_(?:.*_)?(?:KEY|KEYS|TOKEN|${ENV_NAMES.countedPlural}|SECRET|SECRETS|PASSWORD|PASSWORDS|PASSWD|CREDENTIAL|CREDENTIALS|PRIVATEKEY|APIKEY)(?:_|$)`, "is");
+const SEMA_NAMESPACE_SECRET_RE = new RegExp(`^SEMA_(?:.*_)?${ENV_NAMES.segmentWord}(?:_|$)`, "is");
 const BUNDLER_SETTINGS = ["BUILD", "LOCAL", "MIRROR", "PATH", "WITH", "WITHOUT", "CACHE", "DISABLE", "IGNORE", "ONLY"];
 const BUNDLER_HOST = "(?:[A-Za-z0-9]+(?:___[A-Za-z0-9]+)*__)+[A-Za-z]{2,}";
 const BUNDLER_CREDENTIAL_RE = new RegExp(`^(?:INPUT_)?BUNDLE_(?!(?:${BUNDLER_SETTINGS.join("|")})__(?!${BUNDLER_HOST}$))\\w*__`, "i");