@sema-agent/core 7.50.2 → 7.51.1

package/dist/core/tool-policy.d.ts

@@ -130,6 +130,18 @@ export interface ToolCallRequest {
      * a Runner with no `memoryEngineDir` would stamp. Read-only, frozen.
      */
     exemptRoots?: readonly string[];
+    /**
+     * The request's statement that nobody can be asked about THIS call — the word of a run's own declaration
+     * (`TaskSpec.approvalReach`, the closed set `APPROVAL_REACH`), stated per request. Present (`"none"`) on every request the
+     * engine's synthetic probes hand a policy layer (the "would this call be refused outright?" judgments: the visibility
+     * probes of a file the model did not ask to read, the background memory consolidation's write probes); absent on a call
+     * the gate adjudicates, and on a bare request. A policy that would put the call to a person — an approval seat it awaits,
+     * a hook it invokes, a card or a message it sends — answers at once instead: the engine's own factories read this member
+     * before reaching a seat and answer {@link noApproverSeatDeny}; a deployment closure does the same. The signal handed
+     * beside such a request is LIVE (the judge's wait for that layer): an aborted one means only that the task ended.
+     * Read-only.
+     */
+    approvalReach?: import("./wiring-manifest.js").ApprovalReach;
     /**
      * design/80 D-E-core: read-only per-run budget snapshot so a STATELESS policy can self-limit against
      * state that survives suspend/resume (a fresh in-memory counter would reset every leg — the supervisor
@@ -272,11 +284,25 @@ export declare function attest<T extends object>(d: T, call: {
 }, members: AttestationMembers): T;
 /** `d` carrying `record` (a fresh object), or `d` itself when there is no record to put on it. */
 export declare function withAttestation<T extends object>(d: T, record: EngineAttestation | undefined): T;
+/** The `no_approver`-attested deny an engine policy answers on a request that states nobody can be asked about it
+ *  ({@link ToolCallRequest.approvalReach}) instead of reaching a seat — read by a probe as "would ask an approver". */
+export declare function noApproverSeatDeny(req: {
+    toolCallId: string;
+    toolName: string;
+}, message: string, origin: AskOrigin): PermissionResult;
 /** The `task_aborted`-attested deny an engine policy answers on an aborted signal instead of reaching a seat. */
 export declare function abortedSeatDeny(req: {
     toolCallId: string;
     toolName: string;
 }, message: string, origin: AskOrigin): PermissionResult;
+/** THE question every engine factory asks before it would reach a person (an approver it awaits, a hook it invokes): may the
+ *  seat be reached? Not when the task ended (an aborted signal ⇒ {@link abortedSeatDeny}, read first) nor when the request
+ *  states that nobody can be asked about the call ({@link ToolCallRequest.approvalReach} ⇒ {@link noApproverSeatDeny});
+ *  `undefined` ⇒ it may. `say` is the factory's own sentence for each. */
+export declare function unaskedSeatAnswer(req: Pick<ToolCallRequest, "toolCallId" | "toolName" | "approvalReach">, signal: AbortSignal | undefined, say: {
+    aborted: string;
+    unreachable: string;
+}, origin: AskOrigin): PermissionResult | undefined;
 /**
  * design/252 G-7 — how long an approver-attribution identifier may be.
  *
@@ -575,12 +601,14 @@ export declare function decisionText(d: PermissionResult): string | undefined;
  *
  * `check` may be async, which is also how **human-in-the-loop approval** works: a deployment can
  * hold the promise open until an operator approves/denies. `signal` fires when the task aborts
- * (timeout / max turns / cancel) or the asking turn is interrupted (design/384) — honor it to release a
- * pending approval (F4; the Runner also races `check` against it). An already-aborted one: see `check`.
+ * (timeout / max turns / cancel) or the asking turn is interrupted (design/384), and on a synthetic probe when the judge
+ * stops waiting for this layer — honor it to release a pending approval (F4; the Runner also races `check` against it). An
+ * already-aborted one: see `check`. A request that states nobody can be asked about it: {@link ToolCallRequest.approvalReach}.
  */
 export interface ToolPolicy {
     /** @contract policy.check.aborted_signal_reaches_nobody — handed an already-aborted signal, `check` reaches no person and
-     *  no external approval (it answers at once, or with a `task_aborted` deny); visibility probes rely on it. */
+     *  no external approval (it answers at once, or with a `task_aborted` deny). The engine's probes do not rely on it: they hand a
+     *  live signal and state on the request that nobody can be asked (`approvalReach: "none"`, answered with `noApproverSeatDeny`). */
     check(req: ToolCallRequest, signal?: AbortSignal): PermissionResult | Promise<PermissionResult>;
     /**
      * The policy's CONSTRAINT PROJECTION — its deterministic DENY-verdict half expressed as pure data
@@ -1295,10 +1323,12 @@ export interface AskRequest {
      *  mint site added later is covered by construction); optional on the type because a deployment may
      *  invoke its approver function directly. */
     readonly boundInputHash?: string;
-    /** A call to the engine's `Skill` tool: the hash of {@link boundGrants} — the digest a parked approval of the same card is judged by, so a live card reconciles against its parked row by `(toolCallId, boundGrantDigest)` and an answer is remembered by "this tool + this binding". Present exactly on that call (whoever asked, however the question was worded), absent on every other card; `message` renders the same lists narrowed to what releases in the leg's mode. Reconciliation metadata, never adjudication input. */
+    /** A call to the engine's `Skill` tool: the hash of {@link boundGrants} — the digest a parked approval of the same card is judged by, so a live card reconciles against its parked row by `(toolCallId, boundGrantDigest)` and an answer is remembered by "this tool + this binding". Present exactly on that call (whoever asked, however the question was worded); every other card carries {@link boundGrantAbsence} instead; `message` renders the same lists narrowed to what releases in the leg's mode. Reconciliation metadata, never adjudication input. */
     readonly boundGrantDigest?: string;
     /** The value {@link boundGrantDigest} hashes: `{ skill, allowedTools, disallowedTools }` in canonical spelling (de-duplicated, sorted), `skill: null` when no loaded skill is named; a fresh copy per ask; same presence. Display metadata (deployment text — render with contextual escaping). */
     readonly boundGrants?: import("./skill-grant-binding.js").BoundSkillGrants;
+    /** Why this card carries no {@link boundGrantDigest} — every card the engine mints carries exactly one of the two: `not_bindable` (the call is not an activation of the engine's `Skill` tool, so it binds no grant and an answer may be remembered by the tool) or `unreadable` (a Skill card whose binding cannot be read — said by a stored row's reader; a live card always has its digest). The same factory mints both members; the park row and the inbox projection carry the same member. Reconciliation metadata, never adjudication input. */
+    readonly boundGrantAbsence?: import("./skill-grant-binding.js").BoundGrantAbsence;
     /**
      * design/179 §4, re-formed by design/375 §3.1 (BREAKING — this seat REPLACES the retired
      * `ruleSuggestions` key, which is never emitted again; the new name is the safe failure posture for
@@ -1358,8 +1388,9 @@ export interface AskRequest {
      *    seat's to say: it is answered per ask by {@link readRootCandidate}, which is present exactly when
      *    widening the session's read directories would clear this one and absent for every other member of
      *    the family — so a surface reads that seat and never infers an answer from this word;
-     *  · `"shadowed"` — a rule the person already wrote is speaking and does not clear this ask (a
-     *    matching allow rule that the lane refuses to honor here, or their own explicit `ask` rule);
+     *  · `"allow_outranked"` — an allow-layer member already matched this call and this question outranks it
+     *    ({@link allowRuleShadowed} says which): another allow rule would be outranked the same way;
+     *  · `"ask_rule_matched"` — an explicit `ask` rule matched: it keeps asking while it stands;
      *  · `"lane_cannot_speak"` — the lane is armed and this ask IS clearable, but the offer lane
      *    produced no rule for this command. Usually because the grammar has no text for it (a
      *    substitution, a subshell, a backgrounded process, or a simple command carrying a redirection —
@@ -1381,7 +1412,7 @@ export interface AskRequest {
      * and a surface that ignores it renders exactly the card it rendered before. The durable park row
      * carries the same seat under the same contract, filled by the same one factory.
      */
-    readonly ruleOffersAbsence?: "mandated" | "lane_cannot_speak" | "shadowed";
+    readonly ruleOffersAbsence?: import("./ask-origin.js").RuleOffersAbsence;
     /** The human/model-readable prompt explaining what needs approval. */
     message: string;
     /** Runner-filled source identity (design S1d §1): the end-user {@link AskRequest} issuing task's
@@ -1444,7 +1475,7 @@ export interface AskRequest {
      * remembered from an earlier call, at any scope, a session included — can retire this question; it is
      * answered only for THIS call, by an answerer (see the ask-arm member of the same name for who may). ABSENT is not the inverse claim: a person's own explicit `ask` rule and a
      * matching allow rule the lane already refused both leave it absent and still block rule clearance
-     * ({@link ruleOffersAbsence} words those `shadowed`). The wire twin of the
+     * ({@link ruleOffersAbsence} words them `ask_rule_matched` / `allow_outranked`). The wire twin of the
      * {@link PermissionResult} ask-arm member of the same name, minted once by the engine at the gate's
      * origin stamp and copied here by the four mint stations. The DOORS are enumerated once, at
      * {@link import("./ask-origin.js").ruleClearanceOf}: the tool seat's own egress / irreversibility
@@ -1452,7 +1483,7 @@ export interface AskRequest {
      * that could not answer, a write the protection judge matched or could not resolve, governance
      * ({@link requiresRealApproval}), a hook's screening authority, and an ask an ANCESTOR's approver
      * decides. Not a door: a person's own explicit `ask` rule, which {@link ruleOffersAbsence} words
-     * `shadowed` — a rule they wrote is speaking, and a posture answering it crosses no mandate.
+     * `ask_rule_matched` — a rule they wrote is speaking, and a posture answering it crosses no mandate.
      *
      * WHY a surface must read THIS member and not its neighbour. {@link ruleOffersAbsence} answers what
      * the RULE-OFFER LANE has to give, and that lane is structurally silent for any tool it does not

package/dist/core/tool-policy.js

@@ -15,7 +15,7 @@ import { heldBy } from "./tool-name-readings.js";
 import { boundInputHashOf } from "./canonical-json.js";
 import { delimitUntrusted, inlineUntrusted, REVIEWER_NOTE_MAX_BODY } from "./untrusted-text.js";
 import { describeRejectedValue } from "./tool-search-setting.js";
-import { thrownText } from "./thrown-value.js";
+import { egressText, egressThrownText } from "./untrusted-egress.js";
 import { assertNoRetiredToolPolicyKeys, RETIRED_DECISION_MEMBERS } from "./retired-keys.js";
 import { isEngineRefusal, nestedRecordsOf, receiveContract, receiveNestedRecords, refusedOutOfContract, screenContractValues } from "./decision-receipt.js";
 export { isEngineRefusal } from "./decision-receipt.js";
@@ -102,8 +102,25 @@ export function attest(d, call, members) {
 export function withAttestation(d, record) {
     return record === undefined ? d : { ...d, attestation: record };
 }
+const UNASKED_SEAT_SETTLEMENTS = new Set(["task_aborted", "no_approver"]);
+function seatNeverAsked(settlement) {
+    return settlement !== undefined && UNASKED_SEAT_SETTLEMENTS.has(settlement.kind);
+}
+function unaskedSeatDeny(req, kind, message, origin) {
+    return attest({ action: "deny", message }, req, { settlement: settledByNobody(kind), origin });
+}
+export function noApproverSeatDeny(req, message, origin) {
+    return unaskedSeatDeny(req, "no_approver", message, origin);
+}
 export function abortedSeatDeny(req, message, origin) {
-    return attest({ action: "deny", message }, req, { settlement: settledByNobody("task_aborted"), origin });
+    return unaskedSeatDeny(req, "task_aborted", message, origin);
+}
+export function unaskedSeatAnswer(req, signal, say, origin) {
+    if (signal?.aborted === true)
+        return abortedSeatDeny(req, say.aborted, origin);
+    if (req.approvalReach === "none")
+        return noApproverSeatDeny(req, say.unreachable, origin);
+    return undefined;
 }
 export const APPROVER_ATTRIBUTION_MAX_CHARS = 256;
 const APPROVER_REFUSED_CHARS_RE = /[\u0000-\u001f\u007f-\u009f\u061c\u200e\u200f\u2028\u2029\u202a-\u202e\u2066-\u2069]/u;
@@ -442,8 +459,9 @@ export function createApprovalPolicy(opts) {
             }
             if (nameListHolds(need, req) || namespacedCoveringHit(needCovering, req)) {
                 const attestOver = (inputDigest) => (d, settlement) => ({ ...d, attestation: mintAttestation(req, { settlement, origin: "policy", inputDigest }) });
-                if (signal?.aborted)
-                    return abortedSeatDeny(req, `approval aborted for "${req.toolName}" (run or turn interrupted)`, "policy");
+                const unasked = unaskedSeatAnswer(req, signal, { aborted: `approval aborted for "${req.toolName}" (run or turn interrupted)`, unreachable: `approval for "${req.toolName}" was not requested: nobody can be asked about this call` }, "policy");
+                if (unasked !== undefined)
+                    return unasked;
                 const shown = tryCloneArgs(req.args);
                 if (!shown.ok) {
                     return attestOver(boundInputHashOf(req.args))({ action: "deny", message: `approval for "${req.toolName}" could not present the args safely (unclonable value: ${shown.reason}) — denied fail-closed` }, settledByNobody("presentation_failed"));
@@ -565,7 +583,7 @@ export function combinePolicies(...policies) {
             for (const p of policies) {
                 const d = refuseOutOfContractDecision(await p.check(current, signal));
                 if (d.action === "deny") {
-                    if (attestationOf(d, current)?.settlement?.kind !== "task_aborted")
+                    if (!seatNeverAsked(attestationOf(d, current)?.settlement))
                         return settleDeny(d);
                     seatDeny ??= settleDeny(d);
                     continue;
@@ -854,10 +872,10 @@ export function tryCloneArgs(v) {
     }
 }
 export function describeThrown(err) {
-    const contained = containThrownText(thrownText(err));
+    const contained = containThrownText(egressThrownText("same-principal", err));
     if (contained !== "")
         return contained;
-    return containThrownText(describeRejectedValue(err));
+    return containThrownText(egressText("same-principal", describeRejectedValue(err)));
 }
 const THROWN_TEXT_MAX = 300;
 function containThrownText(text) {

package/dist/core/types.d.ts

@@ -18,7 +18,7 @@ export type { PermissionMode } from "./ask-origin.js";
 export type { ToolEffect, ToolContentOrigin, ReversibilityVerdict, ReadRootGrantCandidate, ToolSpec, ToolReturn, NestedUsage, NestedUsageAccum, ToolExecuteContext } from "./tool-spec.js";
 export type { BeforeWriteRequest, BeforeWriteResult, BeforeWriteHook, TrackEditRequest, TrackEditResult, TrackFileEditHook, FileEditedNotice, FileEditedHook, HandsBandOptions } from "./hands-band.js";
 export type { AgentDefinition, SkillSpec } from "./agent-definition.js";
-export type { McpServerSpec, A2aServerSpec, McpElicitRequest, McpElicitResponse, OnElicit } from "./mcp-server-spec.js";
+export type { McpServerSpec, A2aServerSpec, McpElicitRequest, McpElicitResponse, OnElicit, McpRevocationLedger, McpMountIdentity } from "./mcp-server-spec.js";
 export type { TaskLimits } from "./task-limits.js";
 export type { TaskStatus, RemoteEnvFailureNote, EffectiveMemoryScopes, TaskResult, HumanReviewGateRow } from "./task-result.js";
 export type { TerminalCause, PausedCause } from "./terminal-cause.js";
@@ -26,8 +26,8 @@ export type { TaskEventIdentity, BrainStatusPhase, BrainRetryErrClass, BrainStat
 export type { TaskStream } from "./task-stream.js";
 export type { WorkflowGovernanceBaseline, RuntimeCaps, AutoModeDenySource } from "./runtime-caps.js";
 export { AUTO_MODE_DENY_SOURCES, isAutoModeDenySource } from "./runtime-caps.js";
-export type { BackgroundChildEvent, DelegationLifecycleEvent } from "./delegation-frames.js";
-export { __resetMalformedDelegationSeatAnnouncement, deliverDelegationLifecycle, emitsChildRowFrames, taskStartedFrame } from "./delegation-frames.js";
+export type { BackgroundChildEvent, BackgroundChildRow, DelegationLifecycleEvent } from "./delegation-frames.js";
+export { __resetMalformedDelegationSeatAnnouncement, backgroundChildTerminal, deliverDelegationLifecycle, emitsChildRowFrames, taskStartedFrame } from "./delegation-frames.js";
 export type { ProjectMemoryLoad, ResumePreflightInfo, ResumePreflightVerdict, RunnerDeps } from "./runner-deps.js";
 export type { EngineNotice, OwedUserInputAccount, UserInputUndrainedCause } from "./engine-notice.js";
 export { __resetMalformedNoticeSeatAnnouncement, deliverEngineNotice, owedUserInputCounts, parentLegIds, settleOwedUserInput, undrainedUserInputNotices, USER_INPUT_UNDRAINED_CAUSES, USER_INPUT_UNDRAINED_FAMILIES } from "./engine-notice.js";

package/dist/core/types.js

@@ -1,4 +1,4 @@
 export { MODEL_ROLES } from "./model-seat.js";
 export { AUTO_MODE_DENY_SOURCES, isAutoModeDenySource } from "./runtime-caps.js";
-export { __resetMalformedDelegationSeatAnnouncement, deliverDelegationLifecycle, emitsChildRowFrames, taskStartedFrame } from "./delegation-frames.js";
+export { __resetMalformedDelegationSeatAnnouncement, backgroundChildTerminal, deliverDelegationLifecycle, emitsChildRowFrames, taskStartedFrame } from "./delegation-frames.js";
 export { __resetMalformedNoticeSeatAnnouncement, deliverEngineNotice, owedUserInputCounts, parentLegIds, settleOwedUserInput, undrainedUserInputNotices, USER_INPUT_UNDRAINED_CAUSES, USER_INPUT_UNDRAINED_FAMILIES } from "./engine-notice.js";

package/dist/core/untrusted-egress.d.ts

@@ -1,18 +1,67 @@
-import { type RedactionReport } from "./arg-summary.js";
-export type { RedactionFinding, RedactionReport, RedactionConfidence, RedactionSource, SummarizableFinding, } from "./arg-summary.js";
-export { summarizeRedactions } from "./arg-summary.js";
-export declare function redactSecrets(s: string, report?: RedactionReport): string;
-export declare function redactHostLeaks(s: string, report?: RedactionReport): string;
-/** Secret-redact + size-bound (NO injection fence) — the SAME-PRINCIPAL tier: workflow outputs/results/errors
- *  riding back to the launching model/script, run rows behind scope-gated observe. Paths/URLs survive
- *  (the assertion pattern depends on them); secrets never do. */
-export declare function boundedRedactedSummary(value: unknown, max: number): string;
+import { type RedactionReport } from "./redaction-passes.js";
+export type { RedactionFinding, RedactionReport, RedactionConfidence, RedactionSource, SummarizableFinding, } from "./redaction-passes.js";
+export { summarizeRedactions } from "./redaction-passes.js";
 /**
- * The FULL untrusted-egress transform (design/97 CORE-2): full host-leak redaction + size-bound + FENCE. Use
+ * Every exit that redacts — into a model's context, a host's event or error lane, a log line, a person's screen — does it
+ * with ONE pass, its tier's, and nothing else redacts: a text through {@link egressText}, a thrown value's text through
+ * {@link egressThrownText}, a value with members (a thrown error, a marks bag) through {@link egressValue}, which runs the
+ * same pass over every string member. What comes out is an {@link Egress}: a string the type checker knows came out of
+ * that tier. What a tool RETURNS is its content, read by the model that asked for it, and is not redacted (CC redacts
+ * nothing there either); what is redacted is what the engine itself words or carries: errors, summaries, run rows.
+ *
+ * Two tiers, because the faces have two audiences (CC 2.1.212 alignment):
+ *  - **`same-principal`** — the model, the script and the host that launched the work (tool results, workflow agent
+ *    outputs / results / errors, run rows behind the scope-gated observe API, host error lanes): the credential
+ *    vocabulary only. Paths and URLs in a worker's answer are the caller's OWN machine's paths — redacting them killed the
+ *    cross-agent assertion pattern ("return the file you wrote" → `[redacted-path]`) while protecting no one;
+ *    cross-tenant isolation on these faces is ACCESS CONTROL (scope gates), not string surgery. CC redacts nothing here;
+ *    sema keeps the credential pass as a declared superset.
+ *  - **`human`** — text shown to a person or exported beyond the launching principal: the credential vocabulary plus
+ *    every URL and absolute path — host internals, and exfil-lure links in untrusted text.
+ * {@link untrustedEgressForHuman} additionally FENCES its text (design/97 CORE-2), so untrusted content cannot pose as
+ * instructions to its reader.
+ */
+export type EgressTier = "same-principal" | "human";
+declare const EGRESS_TIER: unique symbol;
+/** A string that came out of tier `T`'s pass. Only this module mints one. */
+export type Egress<T extends EgressTier> = string & {
+    readonly [EGRESS_TIER]: T;
+};
+/** Tier `tier`'s one pass over a text. */
+export declare function egressText<T extends EgressTier>(tier: T, text: string, report?: RedactionReport): Egress<T>;
+/** The text a thrown value reads as (`thrownText`), through tier `tier`'s pass: the one form a thrown value's words take
+ *  on their way out of the engine. */
+export declare function egressThrownText<T extends EgressTier>(tier: T, err: unknown): Egress<T>;
+/** The `same-principal` tier's pass, under the name hosts call it by (the engine calls {@link egressText}). */
+export declare function redactSecrets(s: string, report?: RedactionReport): Egress<"same-principal">;
+/** The `human` tier's pass, under the name hosts call it by (the engine calls {@link egressText}). */
+export declare function redactHostLeaks(s: string, report?: RedactionReport): Egress<"human">;
+/**
+ * Tier `tier`'s pass over every string member of `value`, returned as a DATA SNAPSHOT — never the value itself, so nothing
+ * that leaves can run the value's code again (a getter, a serializer, a proxy trap): a host's serializer, a log's inspector
+ * and the loop's own readers (`thrownText`, `thrownMarksOf`) reach what was read, once, and passed. The rules, one each:
+ *  - a string goes through {@link egressText}, and so does every member NAME; a function is code, not data, and is not
+ *    carried at any depth (the value handed in included: it comes back `undefined`); any other primitive is itself;
+ *  - an error (any realm, any class) is re-minted as a plain `Error` — never on the thrown value's prototype, whose
+ *    serializers and accessors would run again — carrying EVERY own member (`message`, `stack`, `cause`, `errors`,
+ *    `details`, `code` …) and its `name`, `message`, `code` and `stack` read once through its chain, all as own data;
+ *  - any other object is what JSON reads: its `toJSON(name)` when it has one (a `URL` is its `href`, a `Date` its ISO
+ *    text; one that answers itself is read for its members), otherwise its own enumerable members;
+ *  - a member whose name is a credential name (the vocabulary's record-key view: `password`, `Authorization`,
+ *    `x-api-key`) and whose reading is a string is the marker whole;
+ *  - cycles and shared members stay shared on the snapshot.
+ */
+export declare function egressValue<T extends EgressTier, V>(tier: T, value: V): V;
+/** The `same-principal` tier's pass + size-bound (NO injection fence): workflow outputs/results/errors riding back to
+ *  the launching model/script, run rows behind scope-gated observe. Paths/URLs survive (the assertion pattern depends on
+ *  them); secrets never do. */
+export declare function boundedRedactedSummary(value: unknown, max: number): Egress<"same-principal">;
+/**
+ * The FULL untrusted-egress transform (design/97 CORE-2): the `human` tier's pass + size-bound + FENCE. Use
  * for any worker prompt/output (#5 transcript) or steer content (#6) shown to a HUMAN or exported beyond the
  * launching principal, so untrusted text can neither leak host internals nor pose as instructions.
  */
 export declare function untrustedEgressForHuman(value: unknown, opts: {
     label: string;
     max: number;
-}): string;
+}): Egress<"human">;

package/dist/core/untrusted-egress.js

@@ -1,8 +1,9 @@
 import { delimitUntrusted, neutralizeForFence } from "./untrusted-text.js";
-import { egressPasses, runRedactionPasses } from "./arg-summary.js";
-import { CREDENTIAL_VOCABULARY, egressPassGroups, URI_SCHEME_SOURCE } from "./credential-vocabulary.js";
+import { egressPasses, runRedactionPasses } from "./redaction-passes.js";
+import { CREDENTIAL_VOCABULARY, egressPassGroups, isSensitiveRecordKey, URI_SCHEME_SOURCE } from "./credential-vocabulary.js";
+import { isErrorLike, readMember, thrownText } from "./thrown-value.js";
 import { sliceHeadSafe } from "./surrogate-safe-slice.js";
-export { summarizeRedactions } from "./arg-summary.js";
+export { summarizeRedactions } from "./redaction-passes.js";
 const URL_OF_ANY_PROTOCOL = new RegExp(String.raw `${URI_SCHEME_SOURCE}:\/\/[^\s"'\`]+`, "gi");
 const BARE_USERNAME_MAX_LEN = 20;
 function redactUserinfo(scheme, userinfoWithAt) {
@@ -18,16 +19,126 @@ function redactUserinfo(scheme, userinfoWithAt) {
 const SECRET_TIER_PASSES = egressPasses(egressPassGroups(CREDENTIAL_VOCABULARY), {
     "url-credentials": (_m, scheme, userinfo) => redactUserinfo(scheme, userinfo),
 });
-export function redactSecrets(s, report) {
-    return runRedactionPasses(s, SECRET_TIER_PASSES, report);
-}
 const HOST_LEAK_PASSES = [
     ...SECRET_TIER_PASSES,
     { kind: "url", confidence: "medium", marker: "[redacted-url]", source: "untrusted-egress", re: URL_OF_ANY_PROTOCOL, replace: "[redacted-url]" },
     { kind: "fs-path", confidence: "low", marker: "[redacted-path]", source: "untrusted-egress", re: /(?:\/[A-Za-z0-9_.-]+){2,}/g, replace: "[redacted-path]" },
 ];
+const TIER_PASSES = { "same-principal": SECRET_TIER_PASSES, human: HOST_LEAK_PASSES };
+export function egressText(tier, text, report) {
+    return runRedactionPasses(text, TIER_PASSES[tier], report);
+}
+export function egressThrownText(tier, err) {
+    return egressText(tier, thrownText(err));
+}
+export function redactSecrets(s, report) {
+    return egressText("same-principal", s, report);
+}
 export function redactHostLeaks(s, report) {
-    return runRedactionPasses(s, HOST_LEAK_PASSES, report);
+    return egressText("human", s, report);
+}
+const VALUE_DEPTH_MAX = 32;
+const VALUE_MEMBERS_MAX = 2_000;
+const WHOLE = "[redacted]";
+export function egressValue(tier, value) {
+    const snapshots = new Map();
+    let budget = VALUE_MEMBERS_MAX;
+    const ownKeys = (o, all) => {
+        try {
+            return all ? Reflect.ownKeys(o) : Object.keys(o);
+        }
+        catch {
+            return undefined;
+        }
+    };
+    const prototypeOf = (o) => {
+        try {
+            return Object.getPrototypeOf(o);
+        }
+        catch {
+            return Object.prototype;
+        }
+    };
+    const readOwn = (o, key) => {
+        try {
+            const d = Reflect.getOwnPropertyDescriptor(o, key);
+            if (d === undefined)
+                return { value: undefined, enumerable: true };
+            return { value: "value" in d ? d.value : d.get?.call(o), enumerable: d.enumerable ?? true };
+        }
+        catch {
+            return { value: undefined, enumerable: true };
+        }
+    };
+    const member = (read, depth, name) => {
+        const out = pass(read, depth + 1, name);
+        return typeof out === "string" && isSensitiveRecordKey(name) ? WHOLE : out;
+    };
+    const fill = (o, depth, keys, snapshot) => {
+        snapshots.set(o, snapshot);
+        for (const key of keys ?? []) {
+            if (budget-- <= 0)
+                break;
+            const read = readOwn(o, key);
+            const name = typeof key === "string" ? egressText(tier, key) : key;
+            Object.defineProperty(snapshot, name, { value: member(read.value, depth, typeof key === "string" ? key : ""), enumerable: read.enumerable, writable: true, configurable: true });
+        }
+        return snapshot;
+    };
+    const errorSnapshot = (o, depth) => {
+        const snapshot = new Error();
+        for (const key of Reflect.ownKeys(snapshot))
+            Reflect.deleteProperty(snapshot, key);
+        fill(o, depth, ownKeys(o, true), snapshot);
+        for (const key of ["name", "message", "code", "stack"]) {
+            if (Object.prototype.hasOwnProperty.call(snapshot, key))
+                continue;
+            const read = readMember(o, key);
+            if (read !== undefined && typeof read !== "function")
+                Object.defineProperty(snapshot, key, { value: member(read, depth, key), enumerable: false, writable: true, configurable: true });
+        }
+        return snapshot;
+    };
+    function pass(v, depth, key) {
+        if (typeof v === "string")
+            return egressText(tier, v);
+        if (typeof v === "function")
+            return undefined;
+        if (typeof v !== "object" || v === null)
+            return v;
+        const known = snapshots.get(v);
+        if (known !== undefined)
+            return known;
+        if (depth >= VALUE_DEPTH_MAX)
+            return WHOLE;
+        if (isErrorLike(v))
+            return errorSnapshot(v, depth);
+        const toJSON = readMember(v, "toJSON");
+        if (typeof toJSON === "function") {
+            let reading;
+            try {
+                reading = toJSON.call(v, key);
+            }
+            catch {
+                return WHOLE;
+            }
+            if (reading !== v) {
+                const out = pass(reading, depth + 1, key);
+                snapshots.set(v, out);
+                return out;
+            }
+        }
+        const array = (() => {
+            try {
+                return Array.isArray(v);
+            }
+            catch {
+                return false;
+            }
+        })();
+        return fill(v, depth, ownKeys(v, false), array ? [] : prototypeOf(v) === null ? Object.create(null) : {});
+    }
+    return pass(value, 0, "");
 }
 const REDACTION_MARKER_RE = /\[redacted(?:-[a-z]+)?\]/g;
 function countRedactionMarkers(s) {
@@ -85,10 +196,10 @@ function boundedString(value, max, redact) {
     return out;
 }
 export function boundedRedactedSummary(value, max) {
-    return boundedString(value, max, redactSecrets);
+    return boundedString(value, max, (s) => egressText("same-principal", s));
 }
 export function untrustedEgressForHuman(value, opts) {
-    const source = boundedString(value, Number.POSITIVE_INFINITY, redactHostLeaks);
+    const source = boundedString(value, Number.POSITIVE_INFINITY, (s) => egressText("human", s));
     const probe = (budget) => {
         const bounded = boundedString(source, budget, (s) => s);
         return { bounded, overflow: [...neutralizeForFence(bounded)].length - opts.max };

package/dist/core/untrusted-text.js

@@ -378,6 +378,22 @@ export const ENGINE_ENVELOPES = Object.freeze([
         fenced: false,
         disclosed: false,
     },
+    ...[
+        "additional_skills_reminder", "application_details", "artifacts", "ask_user_question_tool", "citation_requirements",
+        "claude_behavior", "computer_use", "env", "evenhandedness", "examples", "file_creation_advice", "file_handling_rules",
+        "good_file_sharing_examples", "high_level_computer_use_explanation", "knowledge_cutoff", "legal_and_financial_advice",
+        "lists_and_bullets", "notes_on_user_uploaded_files", "package_management", "producing_outputs", "product_information",
+        "refusal_handling", "responding_to_mistakes_and_criticism", "sharing_files", "strong", "suggesting_claude_actions",
+        "todo_list_tool", "tone_and_formatting", "tool_result_safety", "unnecessary_computer_use_avoidance", "user_wellbeing",
+        "verification_step", "web_content_restrictions", "working_with_user_files",
+    ].map((tag) => ({
+        tag,
+        kind: "not-an-envelope",
+        mint: "prompts/cowork.ts — the Cowork base template's own section markup",
+        guard: "no run-supplied bytes reach it: the template is a constant rendered section by section, and its only fills are the two directory placeholders, engine facts",
+        fenced: false,
+        disclosed: false,
+    })),
 ]);
 const ENVELOPES_BY_TAG = new Map(ENGINE_ENVELOPES.map((e) => [e.tag, e]));
 export function engineEnvelope(tag) {

package/dist/core/wiring-manifest.d.ts

@@ -646,16 +646,30 @@ export declare function deriveAskEffective(form: AskSeamForm, parkEffective: boo
  */
 export declare function askSeatEffective(manifest: Pick<WiringManifest, "ask" | "parkLane">): AskEffective;
 /**
- * Does an ask this leg hands on carrying `requiresRealApproval` reach a PERSON — never an automatic yes? The leg's
- * APPROVAL SEAT, read off the ONE ask derivation above, never re-derived: `human_reachable` (a live approver) and
- * `park_only` (the durable park; where the park cannot take the ask, a blanket seat behind it refuses the bit) are a
- * person; `auto_allow`, `auto_deny` and `unresolved` are nobody (the last the fail-closed reading). The auto-mode
- * classifier stations read it to decide where a classification that could not rule goes: to that person (the ask
- * carrying the bit), or refused.
+ * WHERE an ask carrying `requiresRealApproval` goes from a station — the closed set of the ONE approval-seat decision:
+ * `live_approver` (a live approver callback answers it now), `durable_park` (it parks for a person to answer later),
+ * `none` (nobody can: a blanket policy seat, no seat, or a run that declared nobody can be asked — each only when no park
+ * lane is armed, since an armed park is the deployment's own statement that an answer can wait for a person — or a word that cannot be
+ * resolved — the fail-closed reading).
  */
-export declare function askReachesPerson(ask: {
+export declare const APPROVAL_ROUTES: readonly ["live_approver", "durable_park", "none"];
+export type ApprovalRoute = (typeof APPROVAL_ROUTES)[number];
+/**
+ * The APPROVAL SEAT as a route, read off the ONE ask derivation above, never re-derived: `human_reachable` ⇒
+ * `live_approver`; `park_only` ⇒ `durable_park` (where the park cannot take the ask, a blanket seat behind it refuses the
+ * bit); `auto_allow`, `auto_deny` and `unresolved` ⇒ `none`. Every station that forks on "does a handed-on ask reach a
+ * person" reads this word — the leg's gate from the leg's seat word ({@link askSeatEffective}), an ancestor's frozen seat
+ * through {@link frozenApproverRoute} — and the fork, its observer and the sentence a person reads all read the same word.
+ */
+export declare function approvalRouteOf(ask: {
     readonly effective?: AskEffective;
-}): boolean;
+}): ApprovalRoute;
+/**
+ * The route from an ancestor's FROZEN approver (the inherited fold's station): the same table read with that seat's own
+ * form and no park — the inherited station resolves at the frozen seat, whose only road to a person is a live callback
+ * (the leg's park is reached only through a live approver's `unavailable`), so a blanket or absent frozen seat is `none`.
+ */
+export declare function frozenApproverRoute(onAsk: OnAsk | undefined): ApprovalRoute;
 export declare function deriveWiringManifest(facts: WiringFacts): WiringManifest;
 /** A run's approval seat as its one resolution froze it: the value every reader that needs the approver itself reads
  *  (`undefined` when nothing on this run can be asked), the form the manifest reports and every reader of the word derives

package/dist/core/wiring-manifest.js

@@ -81,16 +81,18 @@ export function deriveAskEffective(form, parkEffective, mode) {
 export function askSeatEffective(manifest) {
     return deriveAskEffective(manifest.ask.form, manifest.parkLane.effective);
 }
-export function askReachesPerson(ask) {
+export const APPROVAL_ROUTES = Object.freeze(["live_approver", "durable_park", "none"]);
+export function approvalRouteOf(ask) {
     const effective = ask.effective ?? "unresolved";
     switch (effective) {
         case "human_reachable":
+            return "live_approver";
         case "park_only":
-            return true;
+            return "durable_park";
         case "auto_allow":
         case "auto_deny":
         case "unresolved":
-            return false;
+            return "none";
         default: {
             const _exhaustive = effective;
             void _exhaustive;
@@ -98,6 +100,12 @@ export function askReachesPerson(ask) {
         }
     }
 }
+export function frozenApproverRoute(onAsk) {
+    return approvalRouteOf({ effective: deriveAskEffective(askSeamFormOf(onAsk) ?? "absent", false) });
+}
+function askSeamFormOf(v) {
+    return typeof v === "function" ? "callback" : v === "allow" ? "allow" : v === "deny" ? "deny" : v === undefined ? "absent" : undefined;
+}
 function deriveParkLane(facts) {
     if (!facts.parkCapable) {
         return { capable: false, effective: false, reasons: ["no_checkpoint_store"] };
@@ -235,7 +243,7 @@ export function resolveAskSeat(spec, deps) {
     if (seat === undefined)
         return Object.freeze(reach === undefined ? { value: undefined, form: "absent" } : { value: undefined, form: "declared_none", reach });
     const v = seat.value;
-    const form = typeof v === "function" ? "callback" : v === "allow" ? "allow" : v === "deny" ? "deny" : undefined;
+    const form = askSeamFormOf(v);
     if (form === undefined) {
         const e = new Error(`the resolved onAsk seat (${seat.provenance}) holds ${JSON.stringify(v)} — not an OnAsk ` +
             `("allow" | "deny" | approver function); refusing to classify it.`);

package/dist/engine/execution-env/kill-tree.js

@@ -1,5 +1,5 @@
 import { spawn, spawnSync } from "node:child_process";
-import { scrubSecretEnv } from "../../core/secret-env.js";
+import { inheritedHostEnv } from "../../core/secret-env.js";
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 const DEFAULT_GRACE_MS = 3000;
@@ -145,7 +145,7 @@ function enumerateDescendantsSync(rootPid) {
     let out;
     try {
         const result = spawnSync("ps", ["-A", "-o", "pid=", "-o", "ppid=", "-o", "etime="], {
-            env: scrubSecretEnv(process.env),
+            env: inheritedHostEnv("scrub"),
             timeout: PS_ENUMERATION_TIMEOUT_MS,
             encoding: "utf8",
             windowsHide: true,
@@ -211,7 +211,7 @@ function parseEtimeSeconds(etime) {
 function runTaskkill(args) {
     try {
         const child = spawn("taskkill", args, {
-            env: scrubSecretEnv(process.env),
+            env: inheritedHostEnv("scrub"),
             stdio: "ignore",
             detached: true,
             windowsHide: true,
@@ -271,7 +271,7 @@ function tryMsysGroupKill(bashPath, pid) {
         `[ -n "$g" ] && [ "$g" != "0" ] && kill -9 -"$g" 2>/dev/null; ` +
         `done; exit 0`;
     try {
-        const child = spawn(bashPath, ["-c", script], { env: scrubSecretEnv(process.env), stdio: "ignore", detached: true, windowsHide: true });
+        const child = spawn(bashPath, ["-c", script], { env: inheritedHostEnv("scrub"), stdio: "ignore", detached: true, windowsHide: true });
         child.on("error", () => { });
         return true;
     }