@sema-agent/core 7.50.2 → 7.51.1

package/dist/core/session-policy-store.js

@@ -1,7 +1,12 @@
 import { posix } from "node:path";
 import { isWinFormPath } from "../tools/fs/safety.js";
 import { NAMESPACED_NAME_SHAPES, carriesNamespaceSeparator } from "./protocol-table.js";
-import { judgeRuleToolName } from "./tool-name-aliases.js";
+import { compileAllowList, inertEntryPhrase, readRuleEntry, renderListEntry } from "./allow-entry.js";
+import { valueTypeLabel } from "./tool-name-list.js";
+const SESSION_RULE_BUCKETS = { toolAllow: "allow", toolDeny: "deny", allowDirs: "dirs" };
+const BUCKETS = Object.keys(SESSION_RULE_BUCKETS);
+const ENTRY_FIELDS = BUCKETS.filter((f) => SESSION_RULE_BUCKETS[f] !== "dirs");
+const STORE_STAMPS = new Set(["rev", "gen"]);
 export class SessionPolicyError extends Error {
     code;
     detail;
@@ -12,8 +17,6 @@ export class SessionPolicyError extends Error {
         this.name = "SessionPolicyError";
     }
 }
-const HOLDS_TOOL_NAMES = { toolAllow: true, toolDeny: true, allowDirs: false, commandAllow: false, commandDeny: false };
-const TOOL_NAME_FIELDS = Object.keys(HOLDS_TOOL_NAMES).filter((f) => HOLDS_TOOL_NAMES[f]);
 const NO_DECLARED_TOOLS = new Set();
 export function readMountedToolNames(value) {
     if (value === undefined)
@@ -33,35 +36,6 @@ export function readMountedToolNames(value) {
     }
     return names;
 }
-export function assertSessionRuleNamesCurrent(rules, mountedToolNames = NO_DECLARED_TOOLS) {
-    for (const field of TOOL_NAME_FIELDS) {
-        for (const name of rules[field] ?? []) {
-            const verdict = judgeRuleToolName(name, mountedToolNames);
-            if (verdict.kind === "current")
-                continue;
-            const quoted = JSON.stringify(name);
-            const successor = verdict.kind === "unprefixed_namespace" ? undefined : verdict.currentName;
-            const guidance = verdict.kind === "unprefixed_namespace" ? undefined : verdict.guidance;
-            let message;
-            switch (verdict.kind) {
-                case "retired":
-                    message = `session rules ${field} names ${quoted}, a retired tool name (${verdict.guidance}) — with it in place no run of this session could start, so nothing was written.${successor !== undefined ? ` Use the current name ${JSON.stringify(successor)}.` : ""} If this deployment mounts its own tool under ${quoted}, declare it in the store's mountedToolNames.`;
-                    break;
-                case "unprefixed_namespace":
-                    message = `session rules ${field} names ${quoted}, which carries the "__" namespace separator but no protocol prefix — no tool is named that way (protocol tools are named ${NAMESPACED_NAME_SHAPES}), and with it in place no run of this session could start, so nothing was written.`;
-                    break;
-                case "unmintable_segment":
-                    message = `session rules ${field} names ${quoted}, which can match no tool (${verdict.guidance}) — with it in place no run of this session could start, so nothing was written.${successor !== undefined ? ` Write ${JSON.stringify(successor)}.` : ""}`;
-                    break;
-                default: {
-                    const exhaustive = verdict;
-                    return exhaustive;
-                }
-            }
-            throw new SessionPolicyError("legacy_tool_name", message, { field, name, verdict: verdict.kind, ...(guidance !== undefined ? { guidance } : {}), ...(successor !== undefined ? { currentName: successor } : {}) });
-        }
-    }
-}
 function lexWithin(root, p) {
     const fold = (x) => {
         let n = isWinFormPath(x) ? x.replace(/\\/g, "/") : x;
@@ -75,61 +49,109 @@ function lexWithin(root, p) {
         return true;
     return np === nr || np.startsWith(nr + "/");
 }
-function ruleList(field, value) {
-    if (value === undefined)
-        return undefined;
-    const refuse = (got) => {
-        throw new TypeError(`session rules ${field} must be an array of strings, got ${got} — a rule list is written as a list of names (["rm"], not "rm")`);
-    };
-    if (Array.isArray(value) && Array.from(value).every((entry) => typeof entry === "string")) {
-        if (value.some((entry) => entry.trim() === ""))
-            refuse("an array holding an empty or blank entry");
-        return value;
+export function readSessionRulesShape(value) {
+    const fault = (field, got, sentence) => ({ fault: { field, got }, sentence });
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        const got = Array.isArray(value) ? "an array" : valueTypeLabel(value);
+        return fault("", got, `session rules must be an object of rule buckets (${BUCKETS.join(", ")}), got ${got}`);
     }
-    return refuse(Array.isArray(value) ? "an array holding an entry that is not a string" : value === null ? "null" : `a ${typeof value}`);
+    const rules = {};
+    for (const [key, v] of Object.entries(value)) {
+        if (STORE_STAMPS.has(key) || v === undefined)
+            continue;
+        if (!Object.hasOwn(SESSION_RULE_BUCKETS, key)) {
+            return fault(key, "not a rule bucket", `session rules hold ${JSON.stringify(key)}, which is not a rule bucket — the buckets are ${BUCKETS.join(", ")}, and a shell command rule is a toolDeny / toolAllow entry written Bash(<command>) (Bash(rm:*) matches a command whose first word is rm)`);
+        }
+        const field = key;
+        const listed = Array.isArray(v) ? Array.from(v) : undefined;
+        const got = listed === undefined
+            ? valueTypeLabel(v)
+            : !listed.every((e) => typeof e === "string")
+                ? "an array holding an entry that is not a string"
+                : SESSION_RULE_BUCKETS[field] === "dirs" && listed.some((e) => e.trim() === "")
+                    ? "an array holding an empty or blank entry"
+                    : undefined;
+        if (got !== undefined)
+            return fault(field, got, `session rules ${field} must be an array of ${SESSION_RULE_BUCKETS[field] === "dirs" ? "directory paths" : "rule entries"}, got ${got} — a bucket is written as a list (["Bash(rm:*)"], not "Bash(rm:*)")`);
+        rules[field] = listed;
+    }
+    return { rules };
 }
 export function normalizeRules(rules) {
+    const read = readSessionRulesShape(rules);
+    if ("fault" in read)
+        throw new SessionPolicyError("invalid_shape", read.sentence, read.fault);
     const out = {};
-    const toolAllow = ruleList("toolAllow", rules.toolAllow);
-    const toolDeny = ruleList("toolDeny", rules.toolDeny);
-    const commandAllow = ruleList("commandAllow", rules.commandAllow);
-    const commandDeny = ruleList("commandDeny", rules.commandDeny);
-    const allowDirs = ruleList("allowDirs", rules.allowDirs);
-    if (toolAllow !== undefined)
-        out.toolAllow = [...toolAllow];
-    if (toolDeny !== undefined)
-        out.toolDeny = [...toolDeny];
-    if (commandAllow !== undefined)
-        out.commandAllow = [...commandAllow];
-    if (commandDeny !== undefined)
-        out.commandDeny = [...commandDeny];
-    if (allowDirs !== undefined)
-        out.allowDirs = allowDirs.map((d) => posix.normalize(d).replace(/\/+$/, "") || "/");
+    for (const field of BUCKETS) {
+        const list = read.rules[field];
+        if (list === undefined)
+            continue;
+        out[field] = SESSION_RULE_BUCKETS[field] === "dirs" ? list.map((d) => posix.normalize(d).replace(/\/+$/, "") || "/") : [...list];
+    }
     return out;
 }
-export function loosenReasons(prior, next, mountedToolNames = NO_DECLARED_TOOLS) {
-    const reasons = [];
-    for (const field of ["toolDeny", "commandDeny"]) {
-        const n = new Set(next[field] ?? []);
-        for (const x of prior[field] ?? []) {
-            if (n.has(x) || (field === "toolDeny" && judgeRuleToolName(x, mountedToolNames).kind !== "current"))
+function effectiveEntries(field, list, mountedToolNames) {
+    return compileAllowList(list ?? [], SESSION_RULE_BUCKETS[field], mountedToolNames).rows.map((r) => r.entry);
+}
+function assertEntriesRead(rules, mountedToolNames) {
+    for (const field of ENTRY_FIELDS) {
+        for (const entry of rules[field] ?? []) {
+            const read = readRuleEntry(entry, SESSION_RULE_BUCKETS[field], mountedToolNames);
+            if (read.kind === "row")
                 continue;
-            reasons.push(`removed ${field} "${x}"`);
+            const { kind: _kind, ...why } = read;
+            void _kind;
+            const way = why.verdict === "retired"
+                ? ` If this deployment mounts its own tool under ${renderListEntry(entry)}, declare it in the store's mountedToolNames.`
+                : why.currentName === undefined
+                    ? ` An entry is a tool name (Read; a protocol tool is named ${NAMESPACED_NAME_SHAPES}), a protocol namespace (mcp__<server>), or a rule in its tool's own grammar (Bash(<command>), Edit(<path>), Skill(<name>), WebFetch(domain:<host>)).`
+                    : "";
+            const sentence = why.guidance !== undefined ? ` — ${why.guidance}` : "";
+            throw new SessionPolicyError("inert_entry", `session rules ${field} holds ${inertEntryPhrase({ entry, ...why })}, which ${SESSION_RULE_BUCKETS[field] === "deny" ? "refuses" : "admits"} nothing as written${sentence}; nothing was written.${way}`, { field, entry, ...why });
         }
     }
-    for (const field of ["toolAllow", "commandAllow"]) {
-        const p = prior[field];
-        if (p === undefined)
-            continue;
-        const n = next[field];
-        if (n === undefined) {
-            reasons.push(`removed ${field} allowlist (all allowed)`);
-            continue;
+}
+export function judgeSessionRulesWrite(prior, rules, opts, mountedToolNames = NO_DECLARED_TOOLS) {
+    if (opts?.expectedRev !== undefined && (prior?.rev ?? 0) !== opts.expectedRev) {
+        throw new SessionPolicyError("conflict", `session rules rev mismatch (expected ${opts.expectedRev}, have ${prior?.rev ?? 0})`);
+    }
+    const clean = normalizeRules(rules);
+    assertEntriesRead(clean, mountedToolNames);
+    if (prior !== null && opts?.operator !== true) {
+        const stored = readSessionRulesShape(prior);
+        if ("fault" in stored) {
+            throw new SessionPolicyError("corrupt", `the stored session rules cannot be read as rules (${stored.sentence}) — refusing to judge a non-operator write against them as fewer rules; an operator write replaces them`);
+        }
+        const loosens = loosenReasons(stored.rules, clean, mountedToolNames);
+        if (loosens.length > 0) {
+            throw new SessionPolicyError("loosen_forbidden", `a non-operator session-rule write may only tighten; refused: ${loosens.join("; ")}`);
+        }
+    }
+    return clean;
+}
+export function loosenReasons(priorValue, nextValue, mountedToolNames = NO_DECLARED_TOOLS) {
+    const shapeOf = (side, value) => {
+        const read = readSessionRulesShape(value);
+        if ("fault" in read)
+            throw new SessionPolicyError("invalid_shape", `the ${side} rules: ${read.sentence}`, read.fault);
+        return read.rules;
+    };
+    const prior = shapeOf("prior", priorValue);
+    const next = shapeOf("next", nextValue);
+    const reasons = [];
+    const keptDeny = new Set(effectiveEntries("toolDeny", next.toolDeny, mountedToolNames));
+    for (const x of effectiveEntries("toolDeny", prior.toolDeny, mountedToolNames))
+        if (!keptDeny.has(x))
+            reasons.push(`removed toolDeny ${renderListEntry(x)}`);
+    if (prior.toolAllow !== undefined) {
+        if (next.toolAllow === undefined)
+            reasons.push("removed toolAllow allowlist (all allowed)");
+        else {
+            const had = new Set(effectiveEntries("toolAllow", prior.toolAllow, mountedToolNames));
+            for (const x of effectiveEntries("toolAllow", next.toolAllow, mountedToolNames))
+                if (!had.has(x))
+                    reasons.push(`widened toolAllow with ${renderListEntry(x)}`);
         }
-        const ps = new Set(p);
-        for (const x of n)
-            if (!ps.has(x))
-                reasons.push(`widened ${field} with "${x}"`);
     }
     const pd = prior.allowDirs;
     if (pd !== undefined && pd.length > 0) {
@@ -146,11 +168,6 @@ export function loosenReasons(prior, next, mountedToolNames = NO_DECLARED_TOOLS)
 export function continuesLineage(a, b) {
     return (a.gen ?? 0) === (b.gen ?? 0);
 }
-export function stripRev(rules) {
-    const { ...rest } = rules;
-    delete rest.rev;
-    return rest;
-}
 export class InMemorySessionPolicyStore {
     map = new Map();
     mountedToolNames;
@@ -168,17 +185,7 @@ export class InMemorySessionPolicyStore {
     async putRules(sessionId, principal, rules, opts) {
         const key = this.key(sessionId, principal);
         const prior = this.map.get(key);
-        if (opts?.expectedRev !== undefined && (prior?.rev ?? 0) !== opts.expectedRev) {
-            throw new SessionPolicyError("conflict", `session rules rev mismatch (expected ${opts.expectedRev}, have ${prior?.rev ?? 0})`);
-        }
-        const clean = normalizeRules(stripRev(rules));
-        assertSessionRuleNamesCurrent(clean, this.mountedToolNames);
-        if (prior && opts?.operator !== true) {
-            const loosens = loosenReasons(prior, clean, this.mountedToolNames);
-            if (loosens.length > 0) {
-                throw new SessionPolicyError("loosen_forbidden", `a non-operator session-rule write may only tighten; refused: ${loosens.join("; ")}`);
-            }
-        }
+        const clean = judgeSessionRulesWrite(prior ?? null, rules, opts, this.mountedToolNames);
         const mark = this.highWater.get(key) ?? { rev: 0, gen: 0 };
         const floor = Math.max(prior?.rev ?? 0, mark.rev);
         const gen = prior?.gen ?? mark.gen;

package/dist/core/shell-read-silence.d.ts

@@ -1,6 +1,40 @@
 import type { ShellReadVerdict } from "../tools/fs/shell-read-check.js";
+import { type ShellReadDisposition } from "../tools/fs/shell-read-judge.js";
 import type { GatePass } from "./runner/gate-exit.js";
 import type { AskGuard } from "./tool-policy.js";
+/** One station answer, received and read: what a reader acts on (`kind`) and the answer it acts on (`verdict` — the engine's own
+ *  copy, received once). `unbelieved`: the station's answer was not received or contradicted its own finding, and `verdict` is the
+ *  engine's refusal of it (its sentence names the station's words only where they are words of the closed sets — nothing a station
+ *  spelled reaches the model), reported once on the call's lane ({@link StationAnswerCall.report}). */
+export interface StationAnswerReading {
+    readonly kind: ShellReadDisposition | "silence";
+    readonly verdict: ShellReadVerdict;
+    readonly unbelieved?: true;
+}
+/** The call a reader reads an answer for: its name (the refusal names it), its id, and the lane a station's failure is reported on
+ *  (absent ⇒ unreported — the resumed leg reads the engine's own stations). */
+export interface StationAnswerCall {
+    readonly toolName: string;
+    readonly toolCallId?: string;
+    readonly report?: (err: Error) => void;
+}
+/**
+ * Receive and read a station's answer — the ONE reading for every reader. The answer is received whole ({@link receivedAnswer}:
+ * the engine's one receipt for a caller's object, then each member by its kind — none of the caller's code runs) into the engine's
+ * copy every later read is of; an answer that is not received (an accessor, a member its prototype or a non-enumerable property
+ * supplies, a Proxy anywhere in it, a word that is no string, a mark that is not `true`, not an object) is not believed. Then, in order:
+ *  · `refuse` stands, whatever beside it: no reading is stricter;
+ *  · the station's SILENCE — the finding `unanswered`, or nothing found (`none`) beside a silence mark (`environmentSilent`,
+ *    `rowsUnread`): the station made no finding, whatever disposition it spelled beside it (the engine's own station spells a
+ *    vouch beside unread rows as `unanswered`);
+ *  · a disposition the decision table does not give the finding on any seat, under any form of the question
+ *    ({@link dispositionsOfRow}) — a `vouch` beside a deny hit, an ask beside one, a word outside the closed sets — is NOT believed:
+ *    the station's answer contradicts its own finding, and the reader refuses the call;
+ *  · otherwise the disposition, as the table gives it.
+ * A silence mark beside a finding the station DID make is not the silence: it classes that finding's question
+ * ({@link silencedBy}).
+ */
+export declare function readStationAnswer(answer: ShellReadVerdict, call: StationAnswerCall): StationAnswerReading;
 /** Whose silence a station's answer carries, each its own class on the question it keeps or mints: unread rows are a rule that could
  *  not be read (the rule lane's class); the finding `unanswered` is, unless rows are unread, the environment's silence — shell text the
  *  engine cannot read (a guard) — and the marks only pick whose. Either is a question only a person answers; `probe` follows the finding. */
@@ -12,10 +46,10 @@ export declare function silencedBy(verdict: ShellReadVerdict, d: {
     guards?: readonly AskGuard[];
     requiresRealApproval?: true;
 };
-/** The finding `unanswered` IS the silence, applied once, before any disposition arm: a station — a host-mounted one included — may
- *  spell `vouch` or `mandated` beside it, and neither word vouches for what nobody judged. A deny stands; an ask keeps its words and
- *  gains the silence's class; an allow becomes the silence's question (`ask.message`), one only a person answers. Nothing is admitted,
- *  no `probe` is stamped and no grant is offered — the station made no finding. */
+/** The station's SILENCE ({@link readStationAnswer}), applied once, before any disposition arm: a station — a host-mounted one
+ *  included — may spell `vouch`, `mandated` or `ordinary` beside it, and no word vouches for what nobody judged. A deny stands; an
+ *  ask keeps its words and gains the silence's class; an allow becomes the silence's question (`ask.message`), one only a person
+ *  answers. Nothing is admitted, no `probe` is stamped and no grant is offered — the station made no finding. */
 export declare function applyUnansweredSilence(pass: GatePass, verdict: ShellReadVerdict, ask: {
     readonly message: string;
     readonly account: string | undefined;

package/dist/core/shell-read-silence.js

@@ -1,3 +1,105 @@
+import { types } from "node:util";
+import { dispositionsOfRow, SHELL_READ_FINDINGS } from "../tools/fs/shell-read-judge.js";
+import { receiveContract } from "./decision-receipt.js";
+import { egressThrownText } from "./untrusted-egress.js";
+const DISPOSITIONS = ["refuse", "mandated", "ordinary", "vouch"];
+const MEMBER_KINDS = {
+    disposition: "word",
+    finding: "word",
+    environmentSilent: "mark",
+    rowsUnread: "mark",
+    face: "face",
+    sentence: "word",
+    details: "record",
+    readRootCandidate: "record",
+    unestablished: "mark",
+    writesPlaced: "mark",
+    writeProtected: "mark",
+    targetUnresolved: "mark",
+    unplacedOptions: "record",
+    admit: "admission",
+};
+const VERDICT_MEMBERS = Object.keys(MEMBER_KINDS);
+const DATA_DEPTH = 8;
+function ownedData(value, depth, path) {
+    if (value === null || value === undefined || typeof value === "string" || typeof value === "number" || typeof value === "boolean")
+        return { ok: true, value };
+    if (typeof value !== "object" || depth >= DATA_DEPTH || types.isProxy(value) || path.has(value))
+        return { ok: false };
+    const list = Array.isArray(value);
+    const proto = Object.getPrototypeOf(value);
+    if (list ? proto !== Array.prototype : proto !== Object.prototype && proto !== null)
+        return { ok: false };
+    const own = Object.getOwnPropertyDescriptors(value);
+    path.add(value);
+    try {
+        const out = list ? [] : {};
+        for (const key of Object.keys(own)) {
+            if (list && key === "length")
+                continue;
+            const d = own[key];
+            if (!Object.hasOwn(d, "value") || d.enumerable !== true)
+                return { ok: false };
+            const inner = ownedData(d.value, depth + 1, path);
+            if (!inner.ok)
+                return { ok: false };
+            Object.defineProperty(out, key, { value: inner.value, enumerable: true, writable: true, configurable: true });
+        }
+        return { ok: true, value: out };
+    }
+    finally {
+        path.delete(value);
+    }
+}
+function receivedAnswer(answer, call) {
+    if (typeof answer !== "object" || answer === null)
+        return undefined;
+    const outer = receiveContract(answer, VERDICT_MEMBERS, "");
+    if (outer.kind !== "held")
+        return undefined;
+    const out = {};
+    for (const [member, kind] of Object.entries(MEMBER_KINDS)) {
+        let v = outer.held[member];
+        if (v === undefined)
+            continue;
+        if (kind === "word" ? typeof v !== "string" : kind === "mark" ? v !== true : kind === "face" ? v !== "write" : kind === "admission" ? typeof v !== "function" || types.isProxy(v) : false)
+            return undefined;
+        if (kind === "record") {
+            const data = ownedData(v, 0, new Set());
+            if (!data.ok || typeof data.value !== "object" || data.value === null || Array.isArray(data.value))
+                return undefined;
+            v = data.value;
+        }
+        if (kind === "admission") {
+            const admission = v;
+            v = () => {
+                try {
+                    Reflect.apply(admission, undefined, []);
+                }
+                catch (e) {
+                    call.report?.(new Error(`shell read station's admission threw for tool "${call.toolName}"${call.toolCallId !== undefined ? ` (toolCallId ${call.toolCallId})` : ""} — nothing was admitted: ${egressThrownText("same-principal", e)}`));
+                }
+            };
+        }
+        Object.defineProperty(out, member, { value: v, enumerable: true, writable: true, configurable: true });
+    }
+    return out;
+}
+export function readStationAnswer(answer, call) {
+    const verdict = receivedAnswer(answer, call);
+    if (verdict?.disposition === "refuse")
+        return { kind: "refuse", verdict };
+    if (verdict !== undefined && (verdict.finding === "unanswered" || (verdict.finding === "none" && (verdict.environmentSilent === true || verdict.rowsUnread === true))))
+        return { kind: "silence", verdict };
+    if (verdict !== undefined && DISPOSITIONS.includes(verdict.disposition) && dispositionsOfRow(verdict.finding).has(verdict.disposition))
+        return { kind: verdict.disposition, verdict };
+    const word = (w, set) => (w !== undefined && set.includes(w) ? `"${w}"` : "a word outside its closed set");
+    const sentence = verdict === undefined
+        ? `tool "${call.toolName}" was refused: the read station's answer is not one the engine can receive (an ordinary object holding its members as its own data properties, each of its kind), so it is not believed (denied fail-closed)`
+        : `tool "${call.toolName}" was refused: the read station answered ${word(verdict.disposition, DISPOSITIONS)} beside the finding ${word(verdict.finding, SHELL_READ_FINDINGS)}, an answer the read decision table never gives that finding — the station's answer contradicts its own finding and is not believed (denied fail-closed)`;
+    call.report?.(new Error(`shell read station answered out of its contract for tool "${call.toolName}"${call.toolCallId !== undefined ? ` (toolCallId ${call.toolCallId})` : ""} — ${sentence}`));
+    return { kind: "refuse", verdict: { disposition: "refuse", finding: "none", sentence }, unbelieved: true };
+}
 export function silencedBy(verdict, d) {
     const environment = verdict.environmentSilent === true || (verdict.finding === "unanswered" && verdict.rowsUnread !== true);
     const rows = verdict.rowsUnread === true && d.ruleUnreadable === undefined ? { ruleUnreadable: "persisted_rows" } : {};

package/dist/core/side-query.d.ts

@@ -63,17 +63,16 @@ export interface SideQuerySpec {
      * Per-model auth — MIRRORS {@link TaskSpec.getApiKeyAndHeaders} (same signature, resolved per
      * call against the RESOLVED model, exactly like the task path's per-call hook). The brain
      * contract is the route pairing law (route-adjudicator.ts): a per-model credential (this hook,
-     * or an auth header on `Model.headers`) always rides; the deployment credential rides only where
-     * its pairing is verifiable-or-unpinned — a declared `config.baseUrl` with an off-root model is
-     * refused (`route.credential_mismatch` / `route.credential_missing`), never silently followed.
+     * or an auth header on `Model.headers`) always rides; the deployment credential rides only to the
+     * deployment's own root — a model carrying a root of its own is refused
+     * (`route.credential_mismatch` / `route.credential_missing`), never silently followed.
      * Historically the fallback was unconditional (`options.apiKey ?? config.apiKey`, with a model's
      * own `baseUrl` outranking the brain's), so a side query routed to a model carrying its own
      * `baseUrl` + per-model key sent the GATEWAY key to the per-model (possibly external) URL — the
-     * credential leak the pairing law now stops. Absent seat ⇒ no options are minted (byte-identical
-     * to before): on an UNDECLARED root the construction-time credential still applies (the
-     * quick-start posture), while a declared-root brain + off-root model hard-fails the side query
-     * with the loud refusal (`stopReason: "error"`) instead of leaking — there is no primary model
-     * for a side query to fall back to.
+     * credential leak the pairing law now stops. Absent seat ⇒ no options are minted: the
+     * construction-time credential applies on the deployment's own root, and a model rooted elsewhere
+     * hard-fails the side query with the loud refusal (`stopReason: "error"`) instead of leaking —
+     * there is no primary model for a side query to fall back to.
      */
     getApiKeyAndHeaders?: TaskSpec["getApiKeyAndHeaders"];
     signal?: AbortSignal;

package/dist/core/skill-grant-binding.d.ts

@@ -15,30 +15,51 @@ export interface BoundSkillGrants {
     /** The skill's `disallowed-tools` entries — what activating it refuses for the rest of the run. */
     readonly disallowedTools: readonly string[];
 }
+/**
+ * Why a card carries no binding digest — the closed set of `boundGrantAbsence`: `not_bindable` (the call is not an
+ * activation of the engine's `Skill` tool: it binds no grant) or `unreadable` (the card binds a grant and what it binds
+ * cannot be read: a stored row whose digest is not a string, or that says neither).
+ */
+export declare const BOUND_GRANT_ABSENCES: readonly ["not_bindable", "unreadable"];
+export type BoundGrantAbsence = (typeof BOUND_GRANT_ABSENCES)[number];
 /**
  * A stored value read as a {@link BoundSkillGrants}, whole or not at all: a fresh copy of the three members and nothing else,
  * or `undefined` when any member is not of its type. Every member is read ONCE, so the value screened is the value published.
  */
 export declare function readBoundSkillGrants(raw: unknown): BoundSkillGrants | undefined;
-/** The card members a call to the engine's `Skill` tool carries on every face its card has — empty for any other call. */
-export interface SkillGrantBindingMembers {
-    /** The hash of {@link boundGrants}: the binding a parked approval of the card is judged by. */
-    boundGrantDigest?: string;
-    boundGrants?: BoundSkillGrants;
-}
+/** The card members every ask carries about its binding — exactly one arm: a call to the engine's `Skill` tool carries the
+ *  digest and the value it hashes, every other call the absence word. */
+export type SkillGrantBindingMembers = {
+    readonly boundGrantDigest: string;
+    readonly boundGrants: BoundSkillGrants;
+    readonly boundGrantAbsence?: never;
+} | {
+    readonly boundGrantAbsence: BoundGrantAbsence;
+    readonly boundGrantDigest?: never;
+    readonly boundGrants?: never;
+};
+/** The members of a card that is not a `Skill` activation: the factory's other arm, and what a tool's own consent card (never a
+ *  `Skill` call) spreads. */
+export declare const NOT_BINDABLE: Readonly<{
+    readonly boundGrantAbsence: "not_bindable";
+}>;
 /** The leg's binding factory ({@link SkillGrantBindingMembers} for a call over `args`), the one every ask-mint site spreads. */
 export type GrantBindingOf = (call: {
     readonly toolName: string;
 }, args: unknown) => SkillGrantBindingMembers;
 /**
- * The binding members of a stored parked row, as the inbox projection publishes them: the digest when it is a string, and the lists
- * only as the value that digest hashes — {@link readBoundSkillGrants} whole, and equal to the digest by hash. A pair that
- * disagrees, or lists beside no digest, would show an approver one list while the approval binds another: the lists read as absent.
+ * The binding members of a stored parked row, as the inbox projection publishes them — exactly one of three: the digest when it
+ * is a string (and the lists only as the value that digest hashes — {@link readBoundSkillGrants} whole, and equal to the digest by
+ * hash; a pair that disagrees, or lists beside no digest, would show an approver one list while the approval binds another), else
+ * the row's absence word when it is a member of the set, else `unreadable` — the row does not say what it binds.
  */
 export declare function readBoundBinding(row: {
     readonly boundGrantDigest?: unknown;
     readonly boundGrants?: unknown;
-} | undefined): {
-    boundGrantDigest?: string;
+    readonly boundGrantAbsence?: unknown;
+}): {
+    boundGrantDigest: string;
     boundGrants?: BoundSkillGrants;
+} | {
+    boundGrantAbsence: BoundGrantAbsence;
 };

package/dist/core/skill-grant-binding.js

@@ -1,4 +1,7 @@
 import { boundInputHashOf } from "./canonical-json.js";
+export const BOUND_GRANT_ABSENCES = Object.freeze(["not_bindable", "unreadable"]);
+const BOUND_GRANT_ABSENCE_SET = new Set(BOUND_GRANT_ABSENCES);
+const isBoundGrantAbsence = (v) => BOUND_GRANT_ABSENCE_SET.has(v);
 export function readBoundSkillGrants(raw) {
     if (typeof raw !== "object" || raw === null)
         return undefined;
@@ -15,8 +18,13 @@ export function readBoundSkillGrants(raw) {
     const disallowedTools = entries(disallowed);
     return allowedTools !== undefined && disallowedTools !== undefined ? { skill, allowedTools, disallowedTools } : undefined;
 }
+export const NOT_BINDABLE = Object.freeze({ boundGrantAbsence: "not_bindable" });
 export function readBoundBinding(row) {
-    const digest = row?.boundGrantDigest;
-    const grants = readBoundSkillGrants(row?.boundGrants);
-    return { ...(typeof digest === "string" ? { boundGrantDigest: digest } : {}), ...(grants !== undefined && typeof digest === "string" && boundInputHashOf(grants) === digest ? { boundGrants: grants } : {}) };
+    const digest = row.boundGrantDigest;
+    if (typeof digest === "string") {
+        const grants = readBoundSkillGrants(row.boundGrants);
+        return { boundGrantDigest: digest, ...(grants !== undefined && boundInputHashOf(grants) === digest ? { boundGrants: grants } : {}) };
+    }
+    const word = row.boundGrantAbsence;
+    return { boundGrantAbsence: digest === undefined && isBoundGrantAbsence(word) ? word : "unreadable" };
 }

package/dist/core/skill-grant.d.ts

@@ -2,7 +2,7 @@ import type { PermissionResult, ToolCallRequest } from "./tool-policy.js";
 import type { PermissionMode } from "./ask-origin.js";
 import { type PermissionSeatInputs, type PermissionSeatReading } from "./mode-policy.js";
 import type { AgentTool } from "../internal/harness-types.js";
-import type { SkillGrantBindingMembers } from "./skill-grant-binding.js";
+import { type SkillGrantBindingMembers } from "./skill-grant-binding.js";
 import { type AllowEntryGateSeats, type AllowEntryInert, type AllowEntryJudgeContext, type CompiledAllowEntry } from "./allow-entry.js";
 /** Who wrote a row: the `Skill` tool on a successful activation, prepare for a skill the person invoked by name, or a
  *  delegated child's seed from its parent. */
@@ -53,8 +53,9 @@ export declare function skillGrantDigest(skill: Pick<SkillGrantSource, "name" |
  * `AskRequest` an approver is handed, an ancestor's, the parked row and (through the row) the inbox projection.
  * `boundGrants` is the skill's name and canonical lists, `boundGrantDigest` its hash — the same value, so what a person was
  * shown and what an approving resume is judged by cannot differ. The binding is a property of the CALL, whoever asked and
- * however the question was worded. Empty for any other call, and when no skill is loaded (no engine `Skill` tool is
- * mounted, so a call by that name is not an activation).
+ * however the question was worded. Every other call — and any call when no skill is loaded (no engine `Skill` tool is
+ * mounted, so a call by that name is not an activation) — carries the absence word `not_bindable` instead: one of the two,
+ * always, so no reader infers the binding from a tool name.
  */
 export declare function skillGrantBindingMembers(call: {
     readonly toolName: string;

package/dist/core/skill-grant.js

@@ -3,8 +3,9 @@ import { parsePermissionRule } from "./permission-rules.js";
 import { mountedToolPermissionSeat } from "./mode-policy.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 import { boundInputHashOf } from "./canonical-json.js";
+import { NOT_BINDABLE } from "./skill-grant-binding.js";
 import { readToolNameList } from "./tool-name-list.js";
-import { allowingRows, autoStripped, compileAllowEntry, compileAllowList, inertEntryPhrase, judgeAllowEntries, nonListValueLabel, nonStringMemberLabel, renderListEntry } from "./allow-entry.js";
+import { allowingRows, autoStripped, compileAllowList, readRuleEntry, inertEntryPhrase, judgeAllowEntries, nonListValueLabel, nonStringMemberLabel, renderListEntry } from "./allow-entry.js";
 export const SKILL_GRANT_ORIGINS = Object.freeze(["model", "user", "inherited"]);
 const FROZEN_SKILL_GRANT_ORIGINS = new Set(["model", "inherited"]);
 export function skillNamedBy(args, skills) {
@@ -25,13 +26,13 @@ export function skillGrantDigest(skill) {
     return skillGrantBinding(skill).boundGrantDigest;
 }
 export function skillGrantBindingMembers(call, args, skills, skillToolName) {
-    return isSkillActivationCall(call, skills, skillToolName) ? skillGrantBinding(skillNamedBy(args, skills)) : {};
+    return isSkillActivationCall(call, skills, skillToolName) ? skillGrantBinding(skillNamedBy(args, skills)) : NOT_BINDABLE;
 }
 function isSkillActivationCall(call, skills, skillToolName) {
     return skills.length > 0 && wireOf("skillGrant.binding", call) === skillToolName;
 }
 export function parkedSkillApprovalRefusal(row, args, skills, skillToolName, site = "claim") {
-    if (row.boundGrantDigest === undefined && skillGrantBindingMembers(row, args, skills, skillToolName).boundGrantDigest === undefined)
+    if (row.boundGrantDigest === undefined && !isSkillActivationCall(row, skills, skillToolName))
         return undefined;
     if (skillGrantDigest(skillNamedBy(args, skills)) === row.boundGrantDigest)
         return undefined;
@@ -244,7 +245,7 @@ function readCarriedRecords(raw, carrier) {
         const { skill, behavior, entry, origin } = r;
         if (typeof skill !== "string" || typeof entry !== "string" || (behavior !== "allow" && behavior !== "deny"))
             return undefined;
-        if (typeof compileAllowEntry(entry, behavior) === "string")
+        if (readRuleEntry(entry, behavior).kind === "inert")
             return undefined;
         if (carrier === "capture") {
             out.push({ skill, behavior, entry });

package/dist/core/skills-directory.d.ts

@@ -51,7 +51,9 @@ export type SkillsDirectoryWarningCode =
 /** An attachment was left out (non-text bytes, over budget, unreadable, or resolving outside the skill). */
  | "attachment_skipped"
 /** A file or directory entry existed but could not be read/resolved. */
- | "read_failed";
+ | "read_failed"
+/** A skill directory or its `SKILL.md` resolves outside {@link SkillsDirectoryOptions.containWithin} — skipped. */
+ | "outside_root";
 /** One non-fatal diagnostic from a load. Safe to log: no file contents, only names/reasons. */
 export interface SkillsDirectoryWarning {
     code: SkillsDirectoryWarningCode;
@@ -69,6 +71,15 @@ export interface SkillsDirectoryOptions {
      * ride a separate delivery cap at invoke time, so a generous value here does not enlarge the prompt.
      */
     maxAttachmentBytes?: number;
+    /**
+     * The directory this root's skills must physically lie inside. Declared ⇒ every skill directory, and every
+     * `SKILL.md`, resolves (links followed) inside it or is skipped with an `outside_root` warning; the attachments
+     * already lie inside their skill directory, so they are inside it too. Absent ⇒ each root entry is a mount the
+     * deployment declared, trusted like the root itself. A root a third party writes (a repository's skills
+     * directory) declares the repository root here, so a link in it cannot load a skill from elsewhere on disk.
+     * Must name an existing directory; anything else throws, like an unreadable root.
+     */
+    containWithin?: string;
 }
 /**
  * Load every `SKILL.md`-bearing subdirectory of `dir` into a {@link SkillSpec}, ready for