@sema-agent/core 7.50.2 → 7.51.1

package/dist/core/skills-directory.js

@@ -1,6 +1,7 @@
 import { readFileSync, readdirSync, statSync } from "node:fs";
-import { isAbsolute, join, relative } from "node:path";
+import { join } from "node:path";
 import { physicalPathOf } from "./physical-path.js";
+import { isPhysicallyWithin } from "../tools/fs/path-containment.js";
 import { assertNoRetiredKeys } from "./retired-keys.js";
 import { thrownText } from "./thrown-value.js";
 const SKILL_FILE = "SKILL.md";
@@ -167,12 +168,6 @@ function unquote(value) {
     const inner = value.slice(1, -1);
     return q === '"' ? inner.replace(/\\t/g, "\t").replace(/\\n/g, "\n") : inner;
 }
-function isInsideRoot(root, p) {
-    if (p === root)
-        return true;
-    const rel = relative(root, p);
-    return rel !== "" && !rel.startsWith("..") && !isAbsolute(rel);
-}
 function listRelativeFiles(base, dir, prefix, out, walk) {
     let entries;
     try {
@@ -222,7 +217,7 @@ function resolveInsideSkill(abs, rel, walk) {
         walk.warn({ code: "attachment_skipped", skill: walk.skill, detail: `${rel}: could not be resolved (${errText(err)})` });
         return undefined;
     }
-    if (!isInsideRoot(walk.realRoot, real)) {
+    if (!isPhysicallyWithin(walk.realRoot, real)) {
         walk.warn({
             code: "attachment_skipped",
             skill: walk.skill,
@@ -337,6 +332,18 @@ export function createSkillsFromDirectory(dir, options = {}) {
     catch (err) {
         throw new Error(`skills directory could not be read: ${dir} (${errText(err)})`);
     }
+    const containWithin = options.containWithin;
+    if (containWithin !== undefined) {
+        const isDir = typeof containWithin === "string" && statSync(containWithin, { throwIfNoEntry: false })?.isDirectory() === true;
+        if (!isDir)
+            throw new Error(`skills directory containment root is not a readable directory: ${String(containWithin)}`);
+    }
+    const outside = (skill, path, what) => {
+        if (containWithin === undefined || isPhysicallyWithin(containWithin, path))
+            return false;
+        warn({ code: "outside_root", skill, detail: `${what} resolves outside ${containWithin} — skipped` });
+        return true;
+    };
     const dirNames = [];
     for (const e of entries) {
         if (e.isDirectory()) {
@@ -357,6 +364,8 @@ export function createSkillsFromDirectory(dir, options = {}) {
     const skills = [];
     for (const name of dirNames) {
         const skillDir = join(dir, name);
+        if (outside(name, skillDir, "its directory") || outside(name, join(skillDir, SKILL_FILE), SKILL_FILE))
+            continue;
         let text;
         try {
             text = readFileSync(join(skillDir, SKILL_FILE), "utf8");

package/dist/core/spec-contract.d.ts

@@ -7,7 +7,8 @@
  * 任意命令)。它只能来自部署作者/可信代码路径;LLM 生成的 contract 直接喂 runSpec = 不受信输入获得
  * 命令执行权(越红线),禁止。contract 里的 `spec` **文本**才是 DATA-tier(runSpec 恒围栏置入 objective)。
  * 命令可信 ≠ 它跑的代码可信:门跑的测试会加载模型改过的代码,故门子进程的环境缺省经 `scrubSecretEnv`
- * (`OracleGateSpec.inheritEnv`,与 tool shell 同一三态),凭据名只在部署显式列名 / `"all"` 时交给它。
+ * (`OracleGateSpec.inheritEnv`,与 tool shell 同一三态),凭据名只在部署显式列名 / `"all"` 时交给它;
+ * 部署声明的自有凭据名(`declareWithheldEnv`)在任一形下都不交。
  *
  * 🔴 **oracle 三值(fable-M6)**:每门结果 ∈ {green, red, error} —— 判据不满足 = red;基础设施故障
  * (ENOENT/timeout/maxBuffer/parse 解析不出)= **error 非 red**。假红防线:error 绝不冒充"曾经红过"
@@ -56,8 +57,9 @@ export interface OracleGateSpec {
      * way. Absent / `"scrub"`: the environment without its credential-shaped variables (`scrubSecretEnv`); the command
      * runs code the model wrote, so the credentials are not handed to it by default. `"all"`: the whole environment.
      * A list: exactly the named variables that are set (a strict allow list — `PATH` too, when the command is looked
-     * up on it). Names only, never values: the contract is serializable data. A value of any other shape makes the
-     * gate `error`.
+     * up on it). Under every form, the deployment's declared own credentials (`declareWithheldEnv`) are withheld, and a
+     * list naming one makes the gate `error`. Names only, never values: the contract is serializable data. A value of
+     * any other shape makes the gate `error`.
      */
     inheritEnv?: "all" | "scrub" | string[];
 }

package/dist/core/store-contracts/checkpoint-store-contract.d.ts

@@ -61,6 +61,7 @@ export declare const EXPECTED_LISTBYSCOPE_SUMMARIES: ({
     mandated: boolean;
     mandate: string;
     origin: string;
+    boundGrantAbsence: string;
     spentMicroUsd?: undefined;
 } | {
     token: string;
@@ -79,4 +80,5 @@ export declare const EXPECTED_LISTBYSCOPE_SUMMARIES: ({
     mandated?: undefined;
     mandate?: undefined;
     origin?: undefined;
+    boundGrantAbsence?: undefined;
 })[];

package/dist/core/store-contracts/checkpoint-store-contract.js

@@ -18,6 +18,7 @@ export function createCheckpointFixture(over = {}) {
             toolName: "Write",
             args: { path: "/x", content: "y" },
             boundInputHash: "h0",
+            boundGrantAbsence: "not_bindable",
             batchToolCallIds: ["call-3"],
             completedCallIds: [],
         },
@@ -461,6 +462,7 @@ export async function checkpointListByScopeSummaries(store) {
             origin: "policy",
             mandated: true,
             mandate: "tool_marks",
+            boundGrantAbsence: "not_bindable",
             toolCallId: "call-pr",
             toolName: "open_pr",
             args: { repo: "x" },
@@ -503,6 +505,7 @@ export const EXPECTED_LISTBYSCOPE_SUMMARIES = [
         mandated: true,
         mandate: "tool_marks",
         origin: "policy",
+        boundGrantAbsence: "not_bindable",
     },
     {
         token: "tok-resource",

package/dist/core/swappable-deps.d.ts

@@ -38,6 +38,7 @@
  */
 import type { AssertAllKeysHandled } from "./ask-origin.js";
 import type { RunnerDeps } from "./runner-deps.js";
+import { type ReadDenyDeploymentSeat } from "./read-face-seats.js";
 /**
  * The closed set of hot-swappable deployment seats.
  *  - `models`   — the model catalog generation (the same-name redirect, re-pricing and retirement rules
@@ -59,8 +60,12 @@ import type { RunnerDeps } from "./runner-deps.js";
  *  - `contextSettings` — the per-model context-window overlay ({@link RunnerDeps.contextSettings}); screened
  *                 by the same value gate construction applies (`assertContextSettingsValue`). THE ONE SEAT
  *                 IN-FLIGHT LEGS RE-READ — see the header: it carries geometry, not route.
+ *  - `readDenyPatterns` / `readDenyBuiltinTiers` / `readDenyBuiltinExclude` — the deployment's read-deny
+ *                 declaration (additions, built-in tier selection, built-in row removal); screened by the
+ *                 gates a prepare applies ({@link screenReadDenySeat}). A resumed leg compiles against the
+ *                 seats in force at its prepare (the checkpoint keeps additions only, stricter-wins).
  */
-export declare const SWAPPABLE_DEP_SEATS: readonly ["models", "tiers", "readFace", "writeFace", "contextSettings"];
+export declare const SWAPPABLE_DEP_SEATS: readonly ["models", "tiers", "readFace", "writeFace", "contextSettings", "readDenyPatterns", "readDenyBuiltinTiers", "readDenyBuiltinExclude"];
 export type SwappableDepSeat = (typeof SWAPPABLE_DEP_SEATS)[number];
 /** The candidate a swap takes: the swappable seats of {@link RunnerDeps}, each optional (presence = instruction). */
 export type SwappableDeps = Pick<RunnerDeps, SwappableDepSeat>;
@@ -77,6 +82,9 @@ export declare const SWAP_SEAT_NOTICE: {
     readonly readFace: "config.read_face_swapped";
     readonly writeFace: "config.write_face_swapped";
     readonly contextSettings: "config.context_settings_swapped";
+    readonly readDenyPatterns: "config.read_deny_swapped";
+    readonly readDenyBuiltinTiers: "config.read_deny_swapped";
+    readonly readDenyBuiltinExclude: "config.read_deny_swapped";
 };
 /** The fence over the notice table: `never` while every seat has a row. */
 export type SwapNoticeTableCoversEverySeat = AssertAllKeysHandled<Exclude<SwappableDepSeat, keyof typeof SWAP_SEAT_NOTICE>>;
@@ -106,3 +114,9 @@ export interface ScreenedSwappableDeps {
  * `assertContainmentFaceValue`), so a value the door admits is a value every later prepare admits.
  */
 export declare function screenSwappableDeps(next: unknown): ScreenedSwappableDeps;
+/**
+ * Announce a swap of the deployment's read-deny declaration, after the write: ONE `config.read_deny_swapped`
+ * line however many of its three seats the swap named (the line's contract lives at the notice catalog,
+ * `EngineNotice.code`).
+ */
+export declare function announceReadDenySwap(onNotice: RunnerDeps["onNotice"], seats: readonly SwappableDepSeat[], inForce: Pick<RunnerDeps, ReadDenyDeploymentSeat>): void;

package/dist/core/swappable-deps.js

@@ -1,6 +1,9 @@
 import { assertContainmentFaceValue } from "../tools/fs/containment-face.js";
 import { assertContextSettingsValue } from "./context-settings.js";
-export const SWAPPABLE_DEP_SEATS = Object.freeze(["models", "tiers", "readFace", "writeFace", "contextSettings"]);
+import { READ_DENY_DEPLOYMENT_SEATS, screenReadDenySeat } from "./read-face-seats.js";
+import { deliverEngineNotice } from "./engine-notice.js";
+import { uuidv7 } from "../internal/harness.js";
+export const SWAPPABLE_DEP_SEATS = Object.freeze(["models", "tiers", "readFace", "writeFace", "contextSettings", "readDenyPatterns", "readDenyBuiltinTiers", "readDenyBuiltinExclude"]);
 const SWAPPABLE_DEP_SEAT_SET = new Set(SWAPPABLE_DEP_SEATS);
 export function isSwappableDepSeat(k) {
     return SWAPPABLE_DEP_SEAT_SET.has(k);
@@ -11,6 +14,9 @@ export const SWAP_SEAT_NOTICE = {
     readFace: "config.read_face_swapped",
     writeFace: "config.write_face_swapped",
     contextSettings: "config.context_settings_swapped",
+    readDenyPatterns: "config.read_deny_swapped",
+    readDenyBuiltinTiers: "config.read_deny_swapped",
+    readDenyBuiltinExclude: "config.read_deny_swapped",
 };
 export function screenSwappableDeps(next) {
     if (next === null || typeof next !== "object" || Array.isArray(next)) {
@@ -54,6 +60,11 @@ export function screenSwappableDeps(next) {
             case "contextSettings":
                 candidate.contextSettings = assertContextSettingsValue(v, "swapDeps");
                 break;
+            case "readDenyPatterns":
+            case "readDenyBuiltinTiers":
+            case "readDenyBuiltinExclude":
+                candidate[seat] = screenReadDenySeat(seat, v);
+                break;
             default: {
                 const _exhaustive = seat;
                 throw new Error(`swapDeps: unhandled seat ${String(_exhaustive)}`);
@@ -62,3 +73,16 @@ export function screenSwappableDeps(next) {
     }
     return { seats: present, candidate: candidate };
 }
+export function announceReadDenySwap(onNotice, seats, inForce) {
+    const named = READ_DENY_DEPLOYMENT_SEATS.filter((s) => seats.includes(s));
+    if (named.length === 0)
+        return;
+    const patterns = inForce.readDenyPatterns?.length ?? null;
+    const tiers = inForce.readDenyBuiltinTiers !== undefined ? [...inForce.readDenyBuiltinTiers] : null;
+    const exclude = inForce.readDenyBuiltinExclude?.length ?? null;
+    deliverEngineNotice(onNotice, {
+        code: "config.read_deny_swapped",
+        message: `deployment read-deny declaration swapped (${named.join(", ")}): ${patterns ?? "no"} addition(s), built-in tiers ${tiers === null ? "(default)" : `[${tiers.join(", ")}]`}, ${exclude ?? "no"} built-in row removal(s); in-flight legs keep the deny face they prepared under, new legs compile against the new declaration`,
+        detail: { seats: named, patterns, tiers, exclude, occurrenceId: uuidv7() },
+    });
+}

package/dist/core/synthetic-read-verdict.d.ts

@@ -52,20 +52,22 @@
  *   | any layer                   | the judgment's budget (one dependency timeout, or a  | unanswerable `timed_out`      |
  *   |                             | batch's shared deadline) is spent                    |                               |
  *
- * NEVER AN APPROVER. A deployment policy (the caller's, an inherited parent's) is consulted with an
- * ALREADY-ABORTED signal and no approver seat: the `ToolPolicy.check` contract is that an aborted signal
- * releases a pending approval, and every engine policy factory checks it before reaching a seat (the
- * approval factory answers a deny attested `task_aborted`, read here as `approval_seat`; the inherited
- * PreToolUse constraint does the same before invoking its hook). A deny that carries no engine settlement
- * is a rule's deny and stands. RESIDUALS (stated, not closed): a deployment closure that reaches an
- * approver before it reads its signal can still be asked; a deployment wrapper that answers an aborted
- * signal with a deny of its own (no settlement) is read as a deny — the attachment face then withholds,
- * the notice face stays silent. The engine's own layers (narrowing, skill rows, the two lanes) get the
- * run's real signal: they are pure matchers and store reads.
+ * NEVER AN APPROVER. Every probe STATES that nobody can be asked about it — `approvalReach: "none"` on the request
+ * (`ToolCallRequest.approvalReach`) — and every policy layer is handed a LIVE signal of its own: it ends when the judge stops
+ * waiting for that layer (the layer answered, or its share of the judgment's budget is spent) or when the run's signal ends.
+ * An abort means only that: the task ended, or the judge no longer waits — never "there is no approver". Every engine
+ * policy factory reads the statement before reaching a seat (the approval factory answers a deny attested `no_approver`,
+ * read here as `approval_seat`; the inherited PreToolUse constraint does the same before invoking its hook), and the
+ * engine's own guards composed into a deployment's policy judge the probe as they judge a call — a lookup bounded by a
+ * live deadline answers. A deny that carries no engine settlement is a rule's deny and stands. RESIDUALS (stated, not
+ * closed): a deployment closure that ignores the statement and reaches an approver IS asked — the judge waits for it at
+ * most the judgment's budget (`timed_out`: the write face refuses, the notice face stays silent), then its signal ends
+ * so a closure that honors it releases its approval; a deployment wrapper that answers the statement with a deny of its
+ * own (no settlement) is read as a deny — the attachment face then withholds, the notice face stays silent.
  *
- * THE PROBE'S IDENTITY. Every layer sees the probed tool's name (`Read` / `Write`), the probed arguments, and a stable
- * synthetic call id (`<face>-visibility-probe` for a read, `<face>-write-probe` for a write; {@link syntheticReadProbeId},
- * {@link syntheticWriteProbeId}), so a deployment's audit can tell a probe from a model's call. The write face stamps the
+ * THE PROBE'S IDENTITY. Every layer sees the probed tool's name (`Read` / `Write`), the probed arguments, the statement
+ * above, and a stable synthetic call id (`<face>-visibility-probe` for a read, `<face>-write-probe` for a write;
+ * {@link syntheticReadProbeId}, {@link syntheticWriteProbeId}), so a deployment's audit can tell a probe from a model's call. The write face stamps the
  * facts the live gate stamps on a write (the roster's `Write` face, the tracked cwd and root, the advertised writable
  * directories, the data root's exemption): a containment fence and a data-root exemption judge the probe as they judge the call.
  */
@@ -120,7 +122,7 @@ export interface SyntheticReadLayers {
     };
     /** The leg's target-reading stamp: the probe's request carries a reading of its target, as the live gate's does. */
     stampCallTarget?: CallTargetStamp;
-    /** The run's signal, for the engine's own layers. */
+    /** The run's signal: its end ends the judgment's every wait (each policy layer's own signal ends with it). */
     signal?: AbortSignal;
 }
 /** The arguments a synthetic `Read` carries, and the facts a request stamps. */

package/dist/core/synthetic-read-verdict.js

@@ -19,7 +19,6 @@ function probeFaceWord(face) {
         throw new Error(`synthetic probe id: the probe face must be a lowercase word (letters and hyphens), got ${JSON.stringify(face)}`);
     return face;
 }
-const ABORTED = AbortSignal.abort();
 function sameArguments(value, probed) {
     try {
         return deepJsonEqual(value, probed);
@@ -28,6 +27,22 @@ function sameArguments(value, probed) {
         return false;
     }
 }
+function layerWait(run) {
+    const wait = new AbortController();
+    const runEnded = () => wait.abort(run?.reason);
+    if (run?.aborted === true)
+        runEnded();
+    else
+        run?.addEventListener("abort", runEnded, { once: true });
+    return {
+        signal: wait.signal,
+        end: () => {
+            run?.removeEventListener("abort", runEnded);
+            if (!wait.signal.aborted)
+                wait.abort(new DOMException("the judgment stopped waiting for this layer", "TimeoutError"));
+        },
+    };
+}
 export function createSyntheticReadJudge(layers) {
     const judge = createProbeJudge(layers, "read");
     return async (call, face, budget) => {
@@ -61,9 +76,10 @@ export function createSyntheticWriteJudge(layers, facts) {
 }
 function createProbeJudge(layers, kind) {
     const everyAskHeld = kind === "write";
-    return async (probe, budget) => {
+    return async (unstated, budget) => {
         const deadlineAt = budget?.deadlineAt ?? Date.now() + ORG_ADJUDICATION_TIMEOUT_MS;
         const left = () => Math.max(0, Math.min(ORG_ADJUDICATION_TIMEOUT_MS, deadlineAt - Date.now()));
+        const probe = { ...unstated, approvalReach: "none" };
         const probedArgs = structuredClone(probe.args);
         const stamped = layers.stampCallTarget?.(probe, layers.signal);
         const req = stamped !== undefined ? await stamped : probe;
@@ -84,7 +100,7 @@ function createProbeJudge(layers, kind) {
             cannot(layer, "timed_out", "the judgment's wait budget was spent before this layer was asked");
             return true;
         };
-        const policyLayer = async (layer, policy, signal, ancestorOwned = false) => {
+        const policyLayer = async (layer, policy, ancestorOwned = false) => {
             if (spent(layer))
                 return undefined;
             const waitMs = left();
@@ -92,18 +108,22 @@ function createProbeJudge(layers, kind) {
             let thrown = undefined;
             const TIMEOUT = Symbol("timeout");
             let d;
+            const wait = layerWait(layers.signal);
             try {
                 d = await settleOrgVerdictWithin(Promise.resolve()
-                    .then(() => policy.check(req, signal))
+                    .then(() => policy.check(req, wait.signal))
                     .catch((err) => {
                     thrown = { err };
                     return TIMEOUT;
-                }), TIMEOUT, { ...(layers.signal !== undefined ? { signal: layers.signal } : {}), timeoutMs: waitMs, onFallback: () => void (timedOut = true) });
+                }), TIMEOUT, { signal: wait.signal, timeoutMs: waitMs, onFallback: () => void (timedOut = true) });
             }
             catch (err) {
                 cannot(layer, "threw", describeThrown(err));
                 return undefined;
             }
+            finally {
+                wait.end();
+            }
             if (thrown !== undefined) {
                 cannot(layer, "threw", describeThrown(thrown.err));
                 return undefined;
@@ -144,19 +164,19 @@ function createProbeJudge(layers, kind) {
             cannot("skill_rows", "threw", describeThrown(err));
         }
         if (layers.denyNarrowingPolicy !== undefined) {
-            const v = await policyLayer("narrowing", layers.denyNarrowingPolicy, layers.signal);
+            const v = await policyLayer("narrowing", layers.denyNarrowingPolicy);
             if (v !== undefined)
                 return v;
         }
         if (layers.callerPolicy !== undefined) {
-            const v = await policyLayer("caller_policy", layers.callerPolicy, ABORTED, (layers.inheritedPolicies ?? []).includes(layers.callerPolicy));
+            const v = await policyLayer("caller_policy", layers.callerPolicy, (layers.inheritedPolicies ?? []).includes(layers.callerPolicy));
             if (v !== undefined)
                 return v;
         }
         for (const parent of layers.inheritedPolicies ?? []) {
             if (parent === layers.callerPolicy)
                 continue;
-            const v = await policyLayer("inherited_constraint", parent, ABORTED, true);
+            const v = await policyLayer("inherited_constraint", parent, true);
             if (v !== undefined)
                 return v;
         }

package/dist/core/task-notification.d.ts

@@ -1,7 +1,11 @@
 import type { MailboxAppendMessage, MailboxStore } from "./mailbox-store.js";
+/** The TERMINAL words of {@link TaskNotificationStatus}: the one table every "is this frame a completion?"
+ *  reading asks, exported as a value so a consumer outside the package reads these words rather than its own list. */
+export declare const TASK_NOTIFICATION_TERMINAL_STATUSES: readonly ["completed", "failed", "killed", "cancelled"];
+export type TaskNotificationTerminalStatus = (typeof TASK_NOTIFICATION_TERMINAL_STATUSES)[number];
 /** design/135 G2: `"event"` is the ONE non-terminal member — a Monitor batch notification (new stdout
  *  lines from a still-running watch). Everything else is a terminal completion notification. */
-export type TaskNotificationStatus = "completed" | "failed" | "killed" | "cancelled" | "event";
+export type TaskNotificationStatus = TaskNotificationTerminalStatus | "event";
 export type SystemInjectionPriority = "now" | "next" | "later";
 /**
  * The outcome an injection entry settles with — what the session did with the frame:
@@ -84,8 +88,8 @@ export interface TaskNotificationPayload {
      *  `inlineUntrusted` + attribute-escaping, never as authority. Absent on every internal lane. */
     source?: string;
     /** design/134 §3.3: only on `status:"killed"` — who stopped it. MIRROR of task-registry `StopSource`
-     *  (the single source; inlined here to avoid an import cycle — task-registry imports this module;
-     *  third mirror: types.ts `BackgroundChildEvent.stoppedBy` — keep all three in sync). OPEN ENUM:
+     *  (the single source; inlined here to avoid an import cycle — task-registry imports this module);
+     *  `BackgroundChildEvent.stoppedBy` is typed by this member and projected from it. OPEN ENUM:
      *  consumers must tolerate unknown values (a future "timeout" etc. is not breaking) and fall back
      *  to default copy. */
     stoppedBy?: "user" | "parent" | "system" | (string & {});
@@ -507,6 +511,12 @@ export declare function terminalFrameFacets(facts: {
     warning?: string | undefined;
     compaction?: TaskNotificationPayload["compaction"] | undefined;
 }): Pick<TaskNotificationPayload, "spawnName" | "handback" | "compaction">;
+/**
+ * A delegated child's report as its completion frame carries it — the one value the parent's notification and the fleet
+ * terminal projected from that frame both read: redacted BEFORE the cut, with the pass the task row's copy uses (a token
+ * across the cut is never half-shown), then cut with an honest total. Absent in ⇒ absent out.
+ */
+export declare function notifyResultField(result: string | undefined): string | undefined;
 /** The codec version this engine writes into an `engine_frame` record and the highest it reads. */
 export declare const ENGINE_FRAME_CODEC_VERSION = 1;
 /** The engine's own lanes — the only frames the durable park may encode (an `external` event never is). */

package/dist/core/task-notification.js

@@ -1,7 +1,9 @@
 import { AsyncLocalStorage } from "node:async_hooks";
 import { escapeEnvelopeTag, inlineUntrusted, sanitizeUntrustedText } from "./untrusted-text.js";
+import { egressText } from "./untrusted-egress.js";
 import { PEER_MESSAGE_NOTICE } from "../agents/peer-admission.js";
 import { buildCrossSessionEnvelope, CROSS_SESSION_MESSAGE_NOTICE, neutralizePeerBody } from "../agents/cross-session-envelope.js";
+export const TASK_NOTIFICATION_TERMINAL_STATUSES = Object.freeze(["completed", "failed", "killed", "cancelled"]);
 export const NOTIFICATION_INJECTION_OUTCOMES = Object.freeze(["queued", "parked", "parked_durably", "dropped_duplicate"]);
 export function isNotificationInjectionOutcome(value) {
     return typeof value === "string" && NOTIFICATION_INJECTION_OUTCOMES.includes(value);
@@ -175,6 +177,15 @@ export function terminalFrameFacets(facts) {
         ...(facts.compaction !== undefined ? { compaction: { passes: facts.compaction.passes, breakerOpen: facts.compaction.breakerOpen, ...(facts.compaction.kind !== undefined ? { kind: facts.compaction.kind } : {}) } } : {}),
     };
 }
+const COMPLETION_REPORT_MAX = 2_000;
+export function notifyResultField(result) {
+    if (!result)
+        return undefined;
+    const report = egressText("same-principal", result);
+    return report.length > COMPLETION_REPORT_MAX
+        ? `${report.slice(0, COMPLETION_REPORT_MAX)}\n[result truncated: ${report.length} chars total — ask the agent for it via SendMessage, or read it with TaskOutput where mounted]`
+        : report;
+}
 export const ENGINE_FRAME_CODEC_VERSION = 1;
 export const ENGINE_FRAME_TASK_TYPES = Object.freeze(["background_agent", "monitor", "workflow"]);
 const SHELL_LESS_CARRIERS = ["agentMessage", "crossSessionMessage", "crossSessionNotice", "inboxNotice", "_sema_provenance"];
@@ -257,7 +268,7 @@ export function engineFrameRecordOf(payload, priority, box) {
     };
 }
 const MAX_TOMBSTONES = 5_000;
-const TERMINAL_STATUSES = new Set(["completed", "failed", "killed", "cancelled"]);
+const TERMINAL_STATUSES = new Set(TASK_NOTIFICATION_TERMINAL_STATUSES);
 export function isDelegatedAgentTerminal(n) {
     return n.task_type === "background_agent" && TERMINAL_STATUSES.has(n.status);
 }

package/dist/core/task-spec.d.ts

@@ -478,10 +478,10 @@ export interface TaskSpec {
      *
      * Entries are read like {@link excludeTools}: a wire name or an alias it declares, `mcp__srv` / `mcp__srv__*` for every tool
      * of a server (including tools it lists later), a glob over the tool segment. The engine resolves the list against its OWN
-     * roster at prepare — a host passes the names it was given and never computes a complement. A name no tool answers to, a
-     * protocol-wide `mcp__*`, or an entry that is not a string is REFUSED at prepare (`config.tool_face_control`). The same
-     * compiled selector is applied on every later roster change (an MCP refresh or re-dial, the deferred-search lane): an exact name
-     * admits no new tool. Deferral is reached through ToolSearch, so a list that leaves it out defers nothing.
+     * roster at prepare — a host passes the names it was given. A spelling no tool name can have, `mcp__*`, or an entry that is not
+     * a string is REFUSED at prepare (`config.tool_face_control`); a name no tool answers to is kept and told once (`onError`, phase
+     * `"config"`). The same compiled selector is applied on every later roster change (an MCP refresh or re-dial, the
+     * deferred-search lane). Deferral is reached through ToolSearch, so a list that leaves it out defers nothing.
      *
      * A tool a leg relies on (a delegated child's ReportBlocked, a teammate's SendMessage, a goal iteration's DeclareDone, an
      * observer's report tool — the catalog's protocol column) is not an allowlist's to name; a denylist that reaches one on such a
@@ -494,8 +494,8 @@ export interface TaskSpec {
      * ships the schema bytes every request — measured at zero token savings). The DENY half of the run's tool selector, read
      * exactly as a sub-agent's denied tools are: a wire name or an alias it declares; `Tool(content)` names the whole `Tool`;
      * `mcp__srv` / `mcp__srv__*` / a glob over the tool segment for a server's tools, `mcp__*` for every MCP tool (including tools
-     * a server lists later). A name no tool answers to, `"*"`, or an entry that is not a string is REFUSED at prepare
-     * (`config.tool_face_control`) — a misspelt exclusion guards nothing. A deny wins over {@link allowTools}.
+     * a server lists later). A spelling no tool name can have, `"*"`, or an entry that is not a string is REFUSED at prepare; a name
+     * no tool answers to is kept (it hides a tool of that name mounted later) and told once. A deny wins over {@link allowTools}.
      * ⚠️ A list that reaches a tool this kind of leg relies on (see {@link allowTools}) is refused; excluding a host-requested
      * structural tool (the structured-output tool) can still strand the task — the caller owns that risk.
      */
@@ -610,15 +610,14 @@ export interface TaskSpec {
      * real model ref passed through — core carries no model-word vocabulary). When set (non-empty),
      * `prepareTask` REBUILDS the mounted delegation tool (via {@link ToolSpec.withAgents}) so its roster
      * is the UNION of the boot roster and these definitions — a same-name per-task definition WINS over
-     * the boot one. Validation contract (revision of the posture, dual-leg verified against
-     * upstream): an `allowTools` entry naming a tool that does not exist is ITEM-FILTERED at spawn (the
-     * agent stays listed and delegable; the only host disclosure is a prepare-time HEURISTIC advisory
-     * via `RunnerDeps.onError` phase `"config"` for entries unknown to the parent's assembled roster —
-     * zero model-facing warning, the verified upstream shape); a `denyTools` entry is read as the
-     * reference reads it (`Tool(content)` hides the whole `Tool`, with a host notice) and judged once, here and for the
-     * delegation tool's own lists alike: a spelling that names no tool, or a stale one (another case of a mounted tool, a
-     * retired name), is REJECTED at task start (`config.agent.unknown_tool`), any other name no tool carries is told to the
-     * host and hides nothing; and
+     * the boot one. Validation contract (the reference's shape — an agent's tool list filters by name,
+     * and a name nothing answers never fails the run): both lists are judged once, here and for the
+     * delegation tool's own lists alike; a `denyTools` entry is read as the reference reads it
+     * (`Tool(content)` hides the whole `Tool`, with a host notice); an entry whose spelling no tool name
+     * can have is REJECTED at task start (`config.agent.unknown_tool`); an entry naming a tool that does
+     * not exist (a server this deployment does not declare, a stale or misspelt name) is kept as written
+     * — it denies, or admits, a tool of that name if one is mounted later — and told to the host once
+     * via `RunnerDeps.onError` phase `"config"` (zero model-facing warning); and
      * providing this field with NO delegation tool mounted is rejected too
      * (`config.agents.no_delegation_tool`) — never a silent no-op. POLICY-NEUTRAL: a
      * roster listing only; the 1.294 tighten-only parent-policy inheritance is applied at spawn time,

package/dist/core/tool-name-readings.d.ts

@@ -126,10 +126,6 @@ export declare const NAME_READINGS: {
         readonly kind: "any";
         readonly file: string;
     };
-    readonly "policy.sessionRules": {
-        readonly kind: "any";
-        readonly file: string;
-    };
     readonly "policy.sessionRules.effect": {
         readonly kind: "wire";
         readonly file: string;

package/dist/core/tool-name-readings.js

@@ -33,7 +33,6 @@ export const NAME_READINGS = {
     "policy.nameLists": any(POLICY),
     "policy.shellToolsList": any(POLICY),
     "policy.projectionReplay": any(POLICY),
-    "policy.sessionRules": any("src/core/runner/session-rule-policy.ts"),
     "policy.sessionRules.effect": wire("src/core/runner/session-rule-policy.ts"),
     "allowEntry.names": any("src/core/allow-entry.ts"),
     "skillGrant.binding": wire("src/core/skill-grant.ts"),