@sema-agent/core 7.50.2 → 7.51.1

package/dist/engine/execution-env/node-execution-env.d.ts

@@ -88,6 +88,10 @@ export declare class NodeExecutionEnv implements ExecutionEnv, BackgroundShellCa
     /** `ExecutionEnv.cdPath` = the `CDPATH` the shell child receives, read LIVE off the same merge each exec gets (never the
      *  engine process's own environment): its entries, `[]` when the child gets none. Residual: a per-exec `env.CDPATH`. */
     get cdPath(): readonly string[];
+    /** The environment the next shell child would receive, for a READ (the scrub seat is a no-op: a read reports nothing).
+     *  `undefined` when no child would be spawned at all — the policy is refused against the own credentials declared
+     *  since construction, and every spawn throws that reason — so a reader sees "the child gets none", never a throw. */
+    private childEnvForRead;
     private shellPath?;
     private shellEnv?;
     private inheritEnv;
@@ -108,7 +112,9 @@ export declare class NodeExecutionEnv implements ExecutionEnv, BackgroundShellCa
          *  fail-closed (drop secret-pattern keys, keep PATH/build/locale). `"all"` = full inherit (trusted env);
          *  `string[]` = strict allowlist. `shellEnv`/per-exec `env` always pass through. Any other value — an unknown
          *  word, a non-string, a list entry that is not a variable name — throws here (`inheritEnvPolicyProblem`'s
-         *  reason), the same judgment the oracle gate's `inheritEnv` meets. */
+         *  reason), the same judgment the oracle gate's `inheritEnv` meets. Whatever the policy, the deployment's declared
+         *  own credentials (`declareWithheldEnv`) are withheld from the inherited part; a list naming one throws here when
+         *  the declaration came first, and every spawn refuses it (`spawn_error` / `spawn_failed`) whenever it came. */
         inheritEnv?: "all" | "scrub" | string[];
         /** design/105: inject a resident scheduler daemon backend (the shell daemon). Absent ⇒ scheduling INERT. */
         scheduler?: SchedulerCapability;
@@ -125,9 +131,10 @@ export declare class NodeExecutionEnv implements ExecutionEnv, BackgroundShellCa
          * deployments (their pre-suspend dispose becomes a no-op too — do not combine).
          */
         retainBackgroundProcesses?: boolean;
-        /** The D1 scrub decision's observation seat: called with every NON-EMPTY finding set the default
-         *  "scrub" leg withholds from a shell child. Absent ⇒ a once-per-process console summary (loud
-         *  enough to notice, quiet enough not to spam). Never called on the "all"/allowlist legs. */
+        /** The D1 scrub decision's observation seat: called with every NON-EMPTY finding set withheld from a
+         *  shell child — the default "scrub" leg's, and on any leg the declared own credentials the inherited part
+         *  held (kind `own-credential`). Absent ⇒ a once-per-process console summary (loud enough to notice,
+         *  quiet enough not to spam). An allow list withholds nothing else, so it reports nothing. */
         onSecretEnvScrub?: (findings: readonly SecretEnvFinding[]) => void;
         /** #1081 — the structured-notice seat for the SAME withheld-keys disclosure (`EngineNotice`,
          *  `code: "config.secret_env_scrubbed"`, `detail.names`); independent of `onSecretEnvScrub` (a raw

package/dist/engine/execution-env/node-execution-env.js

@@ -7,7 +7,7 @@ import { isAbsolute, join, resolve } from "node:path";
 import { createInterface } from "node:readline";
 import { ExecutionError, err, FileError, ok, toError, } from "../harness/types.js";
 import { killProcessTree, shutdownDebug } from "./kill-tree.js";
-import { __resetSecretEnvScrubNoticeAnnouncement, announceSecretEnvScrub, inheritEnvPolicyProblem, inheritedHostEnv, scrubSecretEnv } from "../../core/secret-env.js";
+import { __resetSecretEnvScrubNoticeAnnouncement, announceSecretEnvScrub, inheritEnvPolicyProblem, inheritedHostEnv } from "../../core/secret-env.js";
 import { physicalPathOfAsync } from "../../core/physical-path.js";
 import { posixModeBitsMeaningful } from "../../core/posix-mode-face.js";
 import { walkSymlinkChain } from "./symlink-chain.js";
@@ -157,7 +157,7 @@ async function runCommand(command, args, timeoutMs) {
             child = spawn(command, args, {
                 stdio: ["ignore", "pipe", "ignore"],
                 windowsHide: true,
-                env: scrubSecretEnv(process.env),
+                env: inheritedHostEnv("scrub"),
             });
         }
         catch {
@@ -315,12 +315,17 @@ export function openSpoolPair(base) {
 export class NodeExecutionEnv {
     cwd;
     get homeDir() {
-        return getShellEnv(this.inheritEnv, this.shellEnv, undefined, () => { }).HOME;
+        return this.childEnvForRead()?.HOME;
     }
     get cdPath() {
-        const value = getShellEnv(this.inheritEnv, this.shellEnv, undefined, () => { }).CDPATH;
+        const value = this.childEnvForRead()?.CDPATH;
         return value === undefined || value === "" ? [] : value.split(":");
     }
+    childEnvForRead() {
+        if (inheritEnvPolicyProblem(this.inheritEnv) !== undefined)
+            return undefined;
+        return getShellEnv(this.inheritEnv, this.shellEnv, undefined, () => { });
+    }
     shellPath;
     shellEnv;
     inheritEnv;

package/dist/engine/harness/agent-harness.d.ts

@@ -310,6 +310,7 @@ export declare class AgentHarness<TSkill extends Skill = Skill, TPromptTemplate
     private abortResultDetails?;
     private loopTrace?;
     private onToolInputValidationFault?;
+    private onToolMediaRefused?;
     private resilience?;
     private maxToolConcurrency?;
     private streamingToolExecution?;
@@ -538,7 +539,7 @@ export declare class AgentHarness<TSkill extends Skill = Skill, TPromptTemplate
     /**
      * Finalize a call this harness's caller executed OUTSIDE a turn (a resumed, already-approved call) exactly as the
      * loop finalizes its own: the same {@link finalizeToolOutcome} over the same `tool_result` emit, so the call meets the
-     * same handlers, the same patch application and the same throwing-hook posture as a live one.
+     * same handlers, the same patch application, the same throwing-hook posture and the same media admission as a live one.
      */
     finalizeToolCall(toolCall: AgentToolCall, args: unknown, executed: ExecutedToolCallOutcome): Promise<ExecutedToolCallOutcome & {
         toolCall: AgentToolCall;

package/dist/engine/harness/agent-harness.js

@@ -294,6 +294,7 @@ export class AgentHarness {
     abortResultDetails;
     loopTrace;
     onToolInputValidationFault;
+    onToolMediaRefused;
     resilience;
     maxToolConcurrency;
     streamingToolExecution;
@@ -329,6 +330,7 @@ export class AgentHarness {
         this.abortResultDetails = options.abortResultDetails;
         this.loopTrace = options.loopTrace;
         this.onToolInputValidationFault = options.onToolInputValidationFault;
+        this.onToolMediaRefused = options.onToolMediaRefused;
         this.resilience = options.resilience;
         this.maxToolConcurrency = options.maxToolConcurrency;
         this.streamingToolExecution = options.streamingToolExecution;
@@ -640,6 +642,7 @@ export class AgentHarness {
             ...(this.stallTimeoutsPerCall !== undefined ? { stallTimeoutsPerCall: this.stallTimeoutsPerCall } : {}),
             ...(this.abortResultDetails !== undefined ? { abortResultDetails: this.abortResultDetails } : {}),
             ...(this.onToolInputValidationFault !== undefined ? { onToolInputValidationFault: this.onToolInputValidationFault } : {}),
+            ...(this.onToolMediaRefused !== undefined ? { onToolMediaRefused: this.onToolMediaRefused } : {}),
             ...(this.resilience !== undefined ? { resilience: this.resilience } : {}),
             ...(this.maxToolConcurrency !== undefined ? { maxToolConcurrency: this.maxToolConcurrency } : {}),
             ...(this.streamingToolExecution === true && (this.getHandlers("tool_call")?.size ?? 0) === 0
@@ -1231,7 +1234,7 @@ export class AgentHarness {
         return patch;
     }
     finalizeToolCall(toolCall, args, executed) {
-        return finalizeToolOutcome(toolCall, executed, (result, isError) => this.afterToolCallHook(toolCall, args, result, isError));
+        return finalizeToolOutcome(toolCall, executed, (result, isError) => this.afterToolCallHook(toolCall, args, result, isError), this.onToolMediaRefused);
     }
     getModel() {
         return this.model;

package/dist/engine/harness/types.d.ts

@@ -1444,6 +1444,9 @@ export interface AgentHarnessOptions<TSkill extends Skill = Skill, TPromptTempla
     /** Loop-config pass-through — see `AgentLoopConfig.onToolInputValidationFault` (a throwing
      *  `AgentTool.validateInput` is read as no verdict and disclosed here). */
     onToolInputValidationFault?: import("../loop/types.js").AgentLoopConfig["onToolInputValidationFault"];
+    /** Loop-config pass-through — see `AgentLoopConfig.onToolMediaRefused` (the tool-result seat's account of the media it
+     *  refused); the harness's own finalization of a resumed approved call reports through the same sink. */
+    onToolMediaRefused?: import("../loop/types.js").AgentLoopConfig["onToolMediaRefused"];
     /**
      * design/131 (拍): per-task resilience intent flags, forwarded to every provider
      * call (`StreamOptions.resilience`) so the deployment's decorator stack (degrading / failover /

package/dist/engine/llm/types.d.ts

@@ -1020,21 +1020,19 @@ export interface RouteCredential {
      *  knob+header pair counts as ONE deployment credential — see `resolveRouteCredential`). */
     carrierBag?: RouteCarrierBag;
 }
-/** The deployment half of the pairing judgment: the brain construction config's DECLARED root.
- *  Absent/empty ⇒ the deployment did not declare its credential's URL half (the unpinned
- *  quick-start posture — see `adjudicateModelRoute`). */
+/** The deployment half of the pairing judgment: the root the brain sends to when an entry names none —
+ *  its construction config's DECLARED root (`baseUrl`), else the lane's own default endpoint
+ *  (`laneDefault`, a constant the brain owns; absent for a lane with no default). That root is the
+ *  deployment credential's one root (see `adjudicateModelRoute`). */
 export interface RoutePairingConfig {
     baseUrl?: string;
+    laneDefault?: string;
 }
 /** How an OK verdict is paired.
  *  - `"per-model"` — per-model credential, paired by construction.
- *  - `"paired"` — deployment credential on the deployment's own declared root.
- *  - `"unpinned"` — deployment credential whose URL half is UNDECLARED (no `config.baseUrl`): allowed
- *    for compatibility with single-endpoint configs (key on config, URL on the model), but the pairing
- *    is unverifiable — a multi-entry deployment in this posture should declare `config.baseUrl` or move
- *    to per-model credentials. Surfaced (not refused) so read faces can annotate it.
+ *  - `"paired"` — deployment credential on the deployment's own root (declared, or the lane default).
  *  - `"keyless"` — no credential anywhere; nothing to protect. */
-export type RoutePairingPosture = "per-model" | "paired" | "unpinned" | "keyless";
+export type RoutePairingPosture = "per-model" | "paired" | "keyless";
 /** Machine codes an adjudication refusal carries (minted here, forwarded verbatim by consumers). */
 export type RouteRefusalCode = "route.credential_mismatch" | "route.credential_missing";
 /** The structured account of a refusal — the two halves and the fix, every URL a DISPLAY spelling. */

package/dist/engine/loop/agent-loop.d.ts

@@ -183,10 +183,15 @@ export declare const TOOL_INPUT_VALIDATION_TIMEOUT_MS = 10000;
  * The post-execution half EVERY executed tool call passes through — the loop's own calls here, and a call
  * the harness executed outside a turn (a resumed approved call, `AgentHarness.finalizeToolCall`) through the
  * same function, so the two cannot drift into two dialects of one finalization: the `afterToolCall` patch
- * (content / details / terminate / isError), the D4 posture on a throwing hook, and the delivery mark.
- * `after` absent ⇒ the executed outcome stands as is (same object).
+ * (content / details / terminate / isError), the D4 posture on a throwing hook, the delivery mark, and last
+ * the media admission — the tool-result seat every supply of media reaches after the last hand that can change
+ * it (`admitToolResultMedia`): a refused block becomes its text placeholder in the result, and `onMediaRefused`
+ * hears the call's refusals once. `after` absent and no media ⇒ the executed outcome stands as is (same object).
  */
-export declare function finalizeToolOutcome<C>(toolCall: C, executed: ExecutedToolCallOutcome, after: ((result: AgentToolResult<unknown>, isError: boolean) => Promise<AfterToolCallResult | undefined>) | undefined): Promise<ExecutedToolCallOutcome & {
+export declare function finalizeToolOutcome<C extends {
+    id: string;
+    name: string;
+}>(toolCall: C, executed: ExecutedToolCallOutcome, after: ((result: AgentToolResult<unknown>, isError: boolean) => Promise<AfterToolCallResult | undefined>) | undefined, onMediaRefused?: AgentLoopConfig["onToolMediaRefused"]): Promise<ExecutedToolCallOutcome & {
     toolCall: C;
 }>;
 export {};

package/dist/engine/loop/agent-loop.js

@@ -3,7 +3,9 @@ import { truncateError } from "../../core/tool-errors.js";
 import { judgeToolNameMiss, mountedToolNames } from "../../core/tool-name-aliases.js";
 import { INTERRUPTED_BY_USER_FOR_TOOL_USE_MARKER, INTERRUPTED_BY_USER_MARKER, } from "../../core/session-reconcile.js";
 import { resolveAgentCoreStreamFn } from "./runtime-deps.js";
-import { isErrorLike, readMember, thrownMarksOf, thrownText } from "../../core/thrown-value.js";
+import { isErrorLike, readMember, thrownMarksOf } from "../../core/thrown-value.js";
+import { egressThrownText, egressValue } from "../../core/untrusted-egress.js";
+import { admitToolResultMedia } from "../../tools/fs/image-admission.js";
 function appendTextDeltaToAssistantMessage(message, contentIndex, delta) {
     const content = [...message.content];
     const currentContent = content[contentIndex];
@@ -1111,7 +1113,7 @@ class StreamToolExecutor {
                 this.retainCancellation(error);
             entry.immediate = {
                 kind: "immediate",
-                result: createErrorToolResult(thrownText(error), error),
+                result: thrownErrorToolResult(error),
                 isError: true,
             };
         }
@@ -1374,7 +1376,7 @@ async function prepareToolCall(currentContext, assistantMessage, toolCall, confi
     catch (error) {
         return {
             kind: "immediate",
-            result: createErrorToolResult(thrownText(error), error),
+            result: thrownErrorToolResult(error),
             isError: true,
         };
     }
@@ -1415,7 +1417,7 @@ async function executePreparedToolCall(prepared, signal, emit, abortResultDetail
         }
         catch (error) {
             outcome = {
-                result: createErrorToolResult(thrownText(error), error),
+                result: thrownErrorToolResult(error),
                 isError: true,
             };
         }
@@ -1425,7 +1427,7 @@ async function executePreparedToolCall(prepared, signal, emit, abortResultDetail
             return outcome;
         const reason = deliveryFailure.reason;
         const details = annotateDeliveryFailure(outcome.result, {
-            message: thrownText(reason),
+            message: egressThrownText("same-principal", reason),
         });
         return details === UNANNOTATED ? outcome : { result: { ...outcome.result, details }, isError: outcome.isError };
     })();
@@ -1497,7 +1499,7 @@ async function executePreparedWithDisclosure(currentContext, assistantMessage, p
         if (isAbortSemanticsError(error))
             throw error;
         executed = {
-            result: createErrorToolResult(`[tool execution harness failed: ${thrownText(error)}]`, error),
+            result: thrownErrorToolResult(error, (words) => `[tool execution harness failed: ${words}]`),
             isError: true,
         };
     }
@@ -1506,9 +1508,9 @@ async function executePreparedWithDisclosure(currentContext, assistantMessage, p
 function finalizeExecutedToolCall(currentContext, assistantMessage, prepared, executed, config, signal) {
     return finalizeToolOutcome(prepared.toolCall, executed, config.afterToolCall === undefined
         ? undefined
-        : (result, isError) => config.afterToolCall({ assistantMessage, toolCall: prepared.toolCall, args: prepared.args, result, isError, context: currentContext }, signal));
+        : (result, isError) => config.afterToolCall({ assistantMessage, toolCall: prepared.toolCall, args: prepared.args, result, isError, context: currentContext }, signal), config.onToolMediaRefused);
 }
-export async function finalizeToolOutcome(toolCall, executed, after) {
+export async function finalizeToolOutcome(toolCall, executed, after, onMediaRefused) {
     let result = executed.result;
     let isError = executed.isError;
     const deliveryMark = readDeliveryFailureMark(executed.result.details);
@@ -1525,7 +1527,7 @@ export async function finalizeToolOutcome(toolCall, executed, after) {
             }
         }
         catch (error) {
-            const note = truncateError(`[post-tool processing failed (the tool already executed): ${thrownText(error)}]`);
+            const note = truncateError(`[post-tool processing failed (the tool already executed): ${egressThrownText("same-principal", error)}]`);
             result = { ...result, content: [...result.content, { type: "text", text: note }] };
         }
         if (deliveryMark !== undefined && readDeliveryFailureMark(result.details) === undefined) {
@@ -1534,6 +1536,18 @@ export async function finalizeToolOutcome(toolCall, executed, after) {
                 result = { ...result, details };
         }
     }
+    const admitting = admitToolResultMedia(result.content, toolCall.name);
+    if (admitting !== undefined) {
+        const admitted = await admitting;
+        result = { ...result, content: admitted.content };
+        if (admitted.refused.length > 0) {
+            try {
+                onMediaRefused?.({ toolName: toolCall.name, toolCallId: toolCall.id, refused: admitted.refused });
+            }
+            catch {
+            }
+        }
+    }
     return { toolCall, result, isError };
 }
 function safeAbortDetails(fn) {
@@ -1563,6 +1577,9 @@ function createErrorToolResult(message, source) {
         details,
     };
 }
+function thrownErrorToolResult(error, frame = (words) => words) {
+    return createErrorToolResult(frame(egressThrownText("same-principal", error)), { details: egressValue("same-principal", thrownMarksOf(error)) });
+}
 async function emitToolExecutionEnd(finalized, emit) {
     await emit({
         type: "tool_execution_end",

package/dist/engine/loop/types.d.ts

@@ -566,6 +566,16 @@ export interface AgentLoopConfig extends SimpleStreamOptions {
         toolCallId: string;
         error: unknown;
     }) => void;
+    /**
+     * Told, once per executed call, of the media blocks the tool-result seat refused (`admitToolResultMedia`, the last step
+     * of the post-execution half): each already stands in the result as a text placeholder naming the tool and the refusal,
+     * so this is the run's account of it, not a decision. Advisory: a throwing sink changes nothing.
+     */
+    onToolMediaRefused?: (info: {
+        toolName: string;
+        toolCallId: string;
+        refused: readonly import("../../tools/fs/image-admission.js").ToolResultMediaRefusal[];
+    }) => void;
     /**
      * Called after a tool finishes executing, before `tool_execution_end` and tool-result message events are emitted.
      *

package/dist/engine/lsp/node-lsp-manager.d.ts

@@ -21,7 +21,8 @@ export interface NodeLspManagerOptions {
     /** Injectable spawn (tests supply a fake server; default = {@link defaultLspSpawn} over `child_process.spawn`). */
     spawn?: LspSpawn;
     /** The language server's environment for the default spawn, verbatim. Omitted ⇒ the host environment scrubbed of
-     *  credential-shaped names (`scrubSecretEnv`, a tool child's scrub). Unread when {@link spawn} is supplied. */
+     *  credential-shaped names and of the declared own credentials (`inheritedHostEnv("scrub")`, a tool child's
+     *  reading; `declareWithheldEnv`). Unread when {@link spawn} is supplied. */
     env?: Record<string, string>;
     /** #1081 — the withheld-keys notice sink, SAME shared once-per-process latch/code as the shell-exec
      *  site's `NodeExecutionEnv.onNotice`. Absent ⇒ console only. Unread when {@link spawn} is supplied. */

package/dist/engine/lsp/node-lsp-manager.js

@@ -9,7 +9,7 @@ import { TransportLspSession } from "../../core/lsp-session.js";
 import { StdioLspTransport } from "./stdio-lsp-transport.js";
 import { MAX_LSP_FILE_BYTES, SharedAbortScope, settleOnAbort } from "../../core/lsp.js";
 import { asThrownError, thrownText } from "../../core/thrown-value.js";
-import { announceSecretEnvScrub, scrubSecretEnv } from "../../core/secret-env.js";
+import { announceSecretEnvScrub, inheritedHostEnv } from "../../core/secret-env.js";
 export const DEFAULT_LSP_SERVERS = {
     typescript: "typescript-language-server --stdio",
     javascript: "typescript-language-server --stdio",
@@ -336,7 +336,7 @@ const lspSpawnWithEnv = (env, onNotice) => (command, args, cwd, signal) => new P
         let scrubbedEnv = env;
         if (scrubbedEnv == null) {
             const findings = [];
-            scrubbedEnv = scrubSecretEnv(process.env, findings);
+            scrubbedEnv = inheritedHostEnv("scrub", findings);
             announceSecretEnvScrub(onNotice, findings);
         }
         child = spawn(command, args, { ...lspSpawnOptions(cwd), env: scrubbedEnv });

package/dist/index.d.ts

@@ -11,6 +11,7 @@ export type { RunInternals, ResolvedWorkspace } from "./core/runner/prepare-task
 export type { RunnerSelfSeat } from "./core/runner/contracts.js";
 export type { BudgetAxis } from "./core/runner/assemble-result.js";
 export { terminalProjection } from "./core/runner/terminal-projection.js";
+export { toolOutputBlockChars } from "./core/runner/tool-output-projection.js";
 export { SESSION_LOG_DIGEST_SCHEME, sessionEntryDigest, sessionLogDigest, sessionLogDigestsComparable, } from "./engine/session/log-digest.js";
 export type { ResumeTaskConfig } from "./core/runner/runtask.js";
 export { defineTool } from "./core/tools.js";
@@ -32,6 +33,7 @@ export { assembleCodeTools, type CodeToolsConfig, CODE_ROLE } from "./scenarios/
 export { TOOL_MODEL_GATE_CLASSES, isModelGatedForClass, type ToolModelGateRule } from "./core/tool-model-gate.js";
 export { capAggregateToolResults, AGGREGATE_TOOL_RESULT_BUDGET_CHARS, type AggregateBudgetOptions, } from "./core/tool-result-budget.js";
 export { capAggregateMediaBytes, AGGREGATE_MEDIA_BUDGET_BYTES, type MediaStripInfo } from "./core/media-byte-cap.js";
+export { isMediaBlock, mediaBlockDescriptor, type MediaDescriptor } from "./core/media-byte-cap.js";
 export { createAskUserQuestionTool, createDurableQuestionPolicy, QUESTION_AWAITS_RESUME, isQuestionUnavailable, type OnQuestionOutcome, type QuestionUnavailable, type OnQuestion, type AskQuestion, type AskQuestionOption, type AskQuestionRequest, type QuestionAnswer, type QuestionAnswerItem, type AskQuestionCardDetails, type AskUserQuestionToolOptions, type AskAnswerContinuationSource, type SyntheticContinuationReason, ASK_USER_QUESTION_TOOL_NAME, } from "./core/ask-question.js";
 export { createLspTool, gitCheckIgnoreFilter, LSP_OPERATIONS, LSP_FAILURE_BRAND, brandLspFailure, lspFailureOf, SharedAbortScope, settleOnAbort, type LspNoneReason, type LspOperation, type LspServerManager, type LspSession, type LspResult, type LspLocation, type LspSymbolInfo, type LspRequestParams, type LspToolOptions, type LspTransport, type LspReadText, } from "./core/lsp.js";
 export { buildRequest, parseResult, callHierarchyMethod, pathToUri } from "./core/lsp-protocol.js";
@@ -74,7 +76,7 @@ export { WORKFLOW_SIZE_GUIDELINE_AGENT_CAPS } from "./orchestration/workflow-siz
 export { ENGINE_AUTHORITY_ENVELOPE_TAGS } from "./core/untrusted-text.js";
 export { materializeA2aTools, A2aRpcError, type MaterializedA2a, type A2aPeerStatus, type A2aRefreshResult, type A2aToolAxis } from "./core/a2a.js";
 export { PROTOCOL_TABLE, MCP_NAMESPACE, A2A_NAMESPACE, protocolOf, type ProtocolNamespace, type ProtocolId } from "./core/protocol-table.js";
-export { InMemorySessionPolicyStore, SessionPolicyError, loosenReasons, normalizeRules, stripRev, assertSessionRuleNamesCurrent, type SessionPolicyStoreOptions, type SessionRuleNameRefusal, type SessionPolicyStore, type SessionPermissionRules, type StoredSessionRules, type SessionRulesRecord, type PutRulesOptions, } from "./core/session-policy-store.js";
+export { InMemorySessionPolicyStore, SessionPolicyError, loosenReasons, normalizeRules, judgeSessionRulesWrite, readSessionRulesShape, type SessionPolicyStoreOptions, type SessionRuleShapeRefusal, type SessionRuleEntryRefusal, type SessionRuleEntryField, type SessionPolicyStore, type SessionPermissionRules, type StoredSessionRules, type SessionRulesRecord, type PutRulesOptions, } from "./core/session-policy-store.js";
 export { SAFETY_MERGE_CONFORMANCE_CORPUS, type SafetyMergeVector } from "./core/safety-merge-corpus.js";
 export { SAFETY_AXIS_VOCABULARY } from "./core/safety-axis-vocab.js";
 export { createSessionRulePolicy } from "./core/runner/session-rule-policy.js";
@@ -97,6 +99,8 @@ export { getShellConfig, isWslBashLauncher } from "./engine/execution-env/node-e
 export { walkSymlinkChain, SYMLINK_CHAIN_MAX_HOPS, type SymlinkHopReader } from "./engine/execution-env/symlink-chain.js";
 export { isSecretEnvKey, scrubSecretEnv } from "./core/secret-env.js";
 export type { SecretEnvFinding, SecretEnvFindingKind } from "./core/secret-env.js";
+export { declareWithheldEnv, inheritedHostEnv, inheritEnvPolicyProblem, type InheritEnvPolicy } from "./core/secret-env.js";
+export { ENGINE_CAPABILITIES, type EngineCapability } from "./core/engine-capabilities.js";
 export { MAX_EXEC_OUTPUT_BYTES, RollingTailBuffer, markTruncated } from "./core/exec-output-tail.js";
 export { physicalPathOf, physicalPathOfExisting } from "./core/physical-path.js";
 export type { ExecutionEnv, FileInfo, Result, FileErrorCode, ExecutionErrorCode, WriteExpectation, WriteReceipt, SymlinkChain, BoundFileObject } from "./internal/harness.js";
@@ -120,6 +124,7 @@ export { deploymentFaceClampNotice, resolveContainmentFace, type ContainmentFace
 export { WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable, compileWriteProtection, type WriteProtectedEntry, type WriteProtectedRow, type WriteProtectedKind, type WriteProtectedHit, type WriteProtectionMatcher, type WriteProtectionVerdict, type WriteProtectionViewAbsence, type WriteProtectionJudgeContext, type WriteProtectionCompileOptions, type WriteProtectionCheck, WRITE_PROTECTION_TARGET_VIEWS, type WriteProtectionTargetView, type WriteProtectionMount, } from "./core/write-protect.js";
 export { InMemoryToolResultStore, OFFLOAD_TOOL_NAME, DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, assertSafeToolResultRef, buildToolResultRef, toolResultContentSegment, MAX_MINTED_TOOL_RESULT_REF_CHARS, type ToolResultProvenance, assertToolResultProvenanceMatch, normalizeToolResultProvenance, toolResultProvenanceOf, ToolResultRefConflictError, TOOL_RESULT_REF_CONFLICT_CODE, type ToolResultStore, type ToolResultSlice, type ToolResultDeletionReport, } from "./core/tool-result-store.js";
 export { InMemoryCheckpointStore, CheckpointError, mintCheckpointId, mintCheckpointToken, checkpointVersionOf, CURRENT_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, ORG_ADMISSION_CHECKPOINT_VERSION, F012_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, debitLedger, remainingBudgetMicroUsd, remainingTokens, winnerFromOutcome, validatePendingSteer, readPendingSteerQueue, appendPendingSteer, MAX_PENDING_STEER_CHARS, MAX_PENDING_STEER_ENTRIES, PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES, PENDING_STEER_FROZEN_FIELDS, ACTOR_ASSERTION_FROZEN_FIELDS, MAX_ACTOR_FIELD_CHARS, MAX_STEER_INPUT_ID_CHARS, type ActorAssertion, type PendingSteerEntry, type PendingSteerInput, riskSeverity, buildRiskDescriptor, summarizeCheckpoint, type RiskDescriptor, type ProbeCause, type ProbeCauseOperands, type CheckpointStore, type CheckpointSummary, type Checkpoint, type CheckpointToken, type CheckpointGate, type CheckpointState, type SerializedCheckpointState, type CheckpointFaultMode, type PendingAction, type ResumeOutcome, type ResolvedOutcome, type ReopenReason, type ResolveExpectation, type TerminalClaimIntent, type TerminalClaimOutcome, type SafetyAxis, type RealApprovalGateBit, type ResourceLedger, type ResourceLimitReason, type PlatformLimitReason, type CheckpointRow, realApprovalOrgFact, resolveCheckpointStore, checkpointStoreExecutionUndeclared, } from "./core/checkpoint-store.js";
+export { REOPEN_REASONS, RESUME_STARTUP_CAUSES, resumeStartupCauseOf, reopenReasonOf, type ResumeStartupCause } from "./core/resume-startup-cause.js";
 export { EXECUTION_OUTCOME_RECORD_WORDS, EXECUTION_RECORD_LEAVES_ROW_UNRECORDED, type ExecutionOutcomeRecordWord, type ExecutionRecordRowFacts, type ExecutionVerdict, ExecutionOutcomeConflictError, checkpointExecutionRecorded, executionRecordDisposition, sameExecutionRecord, executionVerdict, } from "./core/checkpoint-execution-record.js";
 export { PAUSE_REGISTRY, type GateKind, type PendingKind, type ResumeGate, isGateKind, resumeGateMatches, type CheckpointPause, type CheckpointFields, pauseOf, checkpointFrom, facetOf } from "./core/pause-registry.js";
 export { REQUIREMENT_WORDS, type RequirementWord, checkpointRequirementsFor } from "./core/checkpoint-requirements.js";
@@ -147,7 +152,8 @@ export { createFsWriteGatePolicy, WRITE_EXEMPT_DIR_COVERS_ROOT_CODE, type FsWrit
 export { RETIRED_TOOL_NAMES } from "./core/tool-name-aliases.js";
 export { judgeRuleToolName, RULE_TOOL_NAME_VERDICTS, type RuleToolNameVerdict } from "./core/tool-name-aliases.js";
 export { DEFAULT_SUBAGENT_TOOL_NAME } from "./agents/subagent.js";
-export { renderTaskNotificationXml, RESUPPLIED_FRAME_PREAMBLE, taskNotificationDedupKey, isDelegatedAgentTerminal, isTerminalTaskNotification, SystemInjectionQueue, type TaskNotificationPayload, type TaskNotificationStatus, type ExternalNotificationInput, type SystemInjection, type SystemInjectionPriority, type NotificationInjectionOutcome, // the injector's outcome words (`parked_durably` = the session's durable box took the frame)
+export { renderTaskNotificationXml, RESUPPLIED_FRAME_PREAMBLE, taskNotificationDedupKey, isDelegatedAgentTerminal, isTerminalTaskNotification, TASK_NOTIFICATION_TERMINAL_STATUSES, // the terminal words that predicate reads, as a value: a host's own terminal check reads these, never a second list
+type TaskNotificationTerminalStatus, SystemInjectionQueue, type TaskNotificationPayload, type TaskNotificationStatus, type ExternalNotificationInput, type SystemInjection, type SystemInjectionPriority, type NotificationInjectionOutcome, // the injector's outcome words (`parked_durably` = the session's durable box took the frame)
 NOTIFICATION_INJECTION_OUTCOMES, // …and their value half + guard, so a host wiring its own uplink validates a reported outcome without duplicating the vocabulary
 isNotificationInjectionOutcome, SYSTEM_INJECTION_PRIORITIES, isSystemInjectionPriority, steerPriorityOf, injectionLaneOf, type UserInputLane, AGENT_MESSAGE_TAG, renderAgentMessageFrame, type SemaProvenance, HANDBACK_STATES, type HandbackState, COMPACTION_KINDS, type CompactionKind, handbackStateOf, terminalFrameFacets, } from "./core/task-notification.js";
 export { TOOL_FAMILIES, TOOL_MOUNT_TAGS, TOOL_APPROVAL_CARDS, TOOL_PATH_ACCESSES, TOOL_PATH_BASES, TOOL_PATH_ABSENCES, TOOL_WIRE_NAME_MAX_CHARS, TOOL_CONTRACT_MAX_CHARS, TOOL_CARD_ID_MAX_CHARS, TOOL_KEY_MAX_CHARS, TOOL_KEYS_MAX, RENDER_HINT_MAX_CHARS, RENDER_HINT_ACTIVITY_MAX_CHARS, RENDER_HINT_MAX_LIST, type ToolFamily, type ToolMountTag, type ToolApprovalCard, type ToolPathAccess, type ToolPathBase, type ToolPathAbsence, type ToolPathTarget, type ToolCallPathTarget, type ToolRosterPathTarget, pathTargetSlotOnly, type ToolRuleFace, type ToolRenderHints, type ToolFaceDeclaration, type ToolCatalogEntry, } from "./core/tool-face.js";
@@ -194,7 +200,7 @@ export { createAllowDenyPolicy, createApprovalPolicy,
  *  members that seat has no lane for (`"unavailable"`, a routing answer; `updatedInput`, an operator edit a
  *  policy verdict cannot get re-adjudicated). Exported so a host can NAME it instead of deriving it through
  *  `Parameters<typeof createApprovalPolicy>[0]["approve"]`. */
-type ApprovalSeatOutcome, COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, combinePolicies, abortedSeatDeny, receiveHookResult, isEngineRefusal, wrapToolPolicy, decisionText, resolveAsk, toolPolicyNameSets, toolPolicyPathRules, type ToolPolicyNameSets, type NamedToolPolicy, type ToolPolicyProjection, type ToolPolicyProjectionComponent, type ConstraintChainEntry, checkToolPolicyProjection, constraintChainEntryOf, constraintChainDigest, type ToolPolicy, type ToolCallRequest, type PermissionResult, type DecisionReason, screenApproverAttribution, APPROVER_ATTRIBUTION_MAX_CHARS, BIDI_CONTROL_CHARS, carriesBidiControls, type OnAsk, type AskOutcome, type ResolvedAsk, type EngineAttestation, type AskRequest, type AskDelegationProvenance, type AskRuleEvidence, type AskEvidenceAbsence, ASK_EVIDENCE_ABSENCE_VALUES, } from "./core/tool-policy.js";
+type ApprovalSeatOutcome, COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, combinePolicies, abortedSeatDeny, noApproverSeatDeny, receiveHookResult, isEngineRefusal, wrapToolPolicy, decisionText, resolveAsk, toolPolicyNameSets, toolPolicyPathRules, type ToolPolicyNameSets, type NamedToolPolicy, type ToolPolicyProjection, type ToolPolicyProjectionComponent, type ConstraintChainEntry, checkToolPolicyProjection, constraintChainEntryOf, constraintChainDigest, type ToolPolicy, type ToolCallRequest, type PermissionResult, type DecisionReason, screenApproverAttribution, APPROVER_ATTRIBUTION_MAX_CHARS, BIDI_CONTROL_CHARS, carriesBidiControls, type OnAsk, type AskOutcome, type ResolvedAsk, type EngineAttestation, type AskRequest, type AskDelegationProvenance, type AskRuleEvidence, type AskEvidenceAbsence, ASK_EVIDENCE_ABSENCE_VALUES, } from "./core/tool-policy.js";
 export { type ReadRootGrantScreen } from "./core/read-root-grant-screen.js";
 export { type AskOrigin, ASK_ORIGINS, isAskOrigin, ORIGIN_IMPLIES_REAL_APPROVAL, PERSISTED_RULE_MANDATES, type PersistedRuleMandate, isPersistedRuleMandate, screenAskClassMembers } from "./core/ask-origin.js";
 export { PERMISSION_MODES, type PermissionMode, isPermissionMode, PERMISSION_MODE_RANK, clampPermissionMode, ASK_CLASSES, type AskClass, isAskClass, MODE_ARBITRATION, type ModeArbitrationRow, ASK_FACES, type AskFace, askFaceOf, releasableAskClassesFor, MODE_RELEASE_REASONS, type ModeReleaseReason, isModeReleaseReason, RRA_EXPLAINERS, classifyAsk, foldArbitrationRow, type AskClassification, type AskClassFacts, type ToolMarkSource, arbitrateByMode, type Arbitration, fileCommandOptionsSentence } from "./core/ask-origin.js";
@@ -203,12 +209,12 @@ export type { PermissionSeatInputs, PermissionSeatReading } from "./core/mode-po
 export type { SkillGateSeats, SkillGrantHit, SkillGrantLane, SkillGrantOrigin, SkillGrantRecord } from "./core/skill-grant.js";
 export { SKILL_GRANT_ORIGINS } from "./core/skill-grant.js";
 export type { BoundSkillGrants } from "./core/skill-grant-binding.js";
-export { ALLOW_ENTRY_INERT_REASONS, compileAllowEntry, compileAllowList, renderListEntry, type AllowEntryInertReason, type CompiledAllowEntry, type AllowEntryGateSeats, type AllowEntryLane, type AllowEntryHit } from "./core/allow-entry.js";
+export { ALLOW_ENTRY_INERT_REASONS, readRuleEntry, compileAllowList, renderListEntry, type RuleEntryReading, type AllowEntryInertReason, type AllowEntryInertDetail, type CompiledAllowEntry, type AllowEntryGateSeats, type AllowEntryLane, type AllowEntryHit } from "./core/allow-entry.js";
 export { ALLOW_RULE_MEMBERS, type AllowRuleMember, type AllowRuleShadow } from "./core/allow-rule-shadow.js";
 export { mintNamespacePrefix } from "./core/protocol-naming.js";
 export { readDenyClassifierRules, renderClassifierDenyRules, type DerivedDenyRule } from "./core/auto-mode-prompt.js";
 export { AUTO_MODE_DENY_SOURCES, isAutoModeDenySource, type AutoModeDenySource } from "./core/runtime-caps.js";
-export { SETTLEMENT_KINDS, type SettlementKind, isSettlementKind, type Settlement, SETTLEMENT_PARTIES, type SettlementParty, isSettlementParty, HOST_DECIDERS, type HostDecider, type HostDecisionFacts, isHostDecider, SETTLEMENT_IS_REFUSAL, DENIED_BY_VALUES, type DeniedBy, isDeniedBy, DENIED_BY_MAY_VETO, CLASSIFIER_DENY_CAUSES, type ClassifierDenyCause, isClassifierDenyCause, DENIED_BY_MAY_CARRY_CAUSE, type GateDisposition, type GateOutcome, type ModeRelease, type ModeRefusal, screenGateOutcome } from "./core/gate-outcome.js";
+export { SETTLEMENT_KINDS, type SettlementKind, isSettlementKind, type Settlement, SETTLEMENT_PARTIES, type SettlementParty, isSettlementParty, HOST_DECIDERS, type HostDecider, type HostDecisionFacts, isHostDecider, SETTLEMENT_IS_REFUSAL, DENIED_BY_VALUES, type DeniedBy, isDeniedBy, DENIED_BY_MAY_VETO, CLASSIFIER_DENY_CAUSES, type ClassifierDenyCause, isClassifierDenyCause, DENIED_BY_MAY_CARRY_CAUSE, type GateDisposition, type GateOutcome, type ModeRelease, type ModeRefusal, screenGateOutcome, RETIRED_MEMBERS, isRetiredMember } from "./core/gate-outcome.js";
 export { ENGINE_BUILTIN_TOOL_NAMES, isEngineBuiltinToolName } from "./core/tool-catalog-entries.js";
 export { policyCannotAnswer, type HeldQuestion } from "./core/real-approval.js";
 export { type AskCarry } from "./core/hooks.js";
@@ -256,6 +262,7 @@ export { formatHookFeedback, runToolGate, createHookEnvCapabilities, createPreTo
 export { HOOK_FAMILIES, HOOKS_INVALID_CODE, type HookFamily, type WiringManifestHookEntry } from "./core/hook-seats.js";
 export { InMemoryMemoryStore, composeMemoryBlock, composeLayeredMemoryBlock, normalizeMemorySpec, type NormalizedMemorySpec, type MemorySpecInput, supportsConsolidation, supportsPeriodicConsolidation, firstSentence, expandLexicalTerms, lexicalSearchMatch, type Embedder, classifyPromotable, enforcePromotableWriteGate, guardedMemoryStore, MemoryGateError, MemoryProjectionError, detectSecret, enforceSecretWriteGate, enforceStructuredNoteSecretGate, type UtilityGate, type MemoryStore, type MemoryVectorMode, type ScoredMemory, type MemoryNoteHeader, type MemoryNoteRecord, type MemoryNoteType, type StructuredNoteInput, MEMORY_PROJECT_KEY_ABSENT_REASONS, type MemoryProjectKeyAbsentReason, type MemoryProjectKey, } from "./core/memory.js";
 export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, type MemoryBackendContractHooks, buildMemoryInstruction, writableRootOf, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_ORIGIN_CAUSES, committedOriginOf, originEquals, consolidationExposedFrontmatter, ambiguousOriginRepresentation, type OriginClearanceRow, type OriginClearanceEvent, type OriginClearanceShadow, committedDistilledOf, distilledEquals, type MemoryEntryDistilled, type MemoryEntryDistilledInput, CONSOLIDATION_DEFAULTS, ConsolidationRefusedError, MEMORY_SEARCH_SUPERSEDED_TAG, consolidationTypeEligible, deriveSupersededSet, memorySupersededNote, readIntentCredentials, supersessionFuseCeiling, deriveShadowedSet, memoryConsolidationRecommendedNotice, memoryConsolidationCommittedNotice, memoryConsolidationConflictNotice, memoryConsolidationIncompleteNotice, memoryConsolidationRefusedNotice, memoryConsolidationWithheldNotice, type ConsolidationGateRead, type ConsolidationGateRow, type ConsolidationIntent, type ConsolidationIntentCredentialRow, type ConsolidationLeaseSeat, type ConsolidationProductProposal, type ConsolidationProposal, type ConsolidationWriteGate, type MemoryConsolidationOptions, type ConsolidationCommitReceipt, type ConsolidationReconcileReport, type ConsolidationResolveReceipt, type ConsolidationPlanSummary, type ConsolidationPlanFoldEvidence, type SessionMemoryStatus, DISTILLER_DEFAULT_MAX_INPUTS_PER_PRODUCT, LLM_DISTILLER_CONTRACT, LLM_DISTILLER_CONTRACT_DL2, LLM_DISTILLER_CONTRACT_DL3, LLM_DISTILLER_CONTRACTS, MEMORY_DISTILLER_CONTRACT_V1, contractGroupingDiff, driveConsolidationToFixpoint, isAliasModelId, llmPlanDistiller, mintExposurePartitionedPlan, mintLlmConsolidationPlan, MEMORY_DISTILLER_PURITY_CONTRACT_V1, detectCleanArmVerbatimLeak, type CleanArmLeakFinding, type CleanArmLeakVerdict, type MemoryDistillerPurityContract, openAiCompatChatSeat, parseJsonAnswer, planParseRepairs, sanitizeLlmGroups, scheduleUnderFuse, type ConsolidationDistillFn, type ConsolidationDriveCycleRow, type ConsolidationDriveEngine, type ConsolidationDriveResult, type ConsolidationFoldState, type DistillerCandidate, type DistillerChatAnswer, type DistillerChatFn, type DistillerChatRequest, type FuseSchedule, type LlmConsolidationPlan, type LlmConsolidationPlanArm, type LlmConsolidationPlanProduct, type LlmDistillerContract, type MintLlmConsolidationPlanResult, type PlanParseRepairs, type SanitizedLlmGroups, CONSOLIDATION_DRIVER_PLANS_DIR, CONSOLIDATION_DRIVER_RUNS_FILE, CONSOLIDATION_RUN_STOP_REASONS, CONSOLIDATION_WRITE_REFUSED_CODE, archiveDistillerPlan, readConsolidationDriverRun, runMemoryConsolidationDriver, type ConsolidationDriverEngine, type ConsolidationDriverRunRow, type ConsolidationRunReceipt, type ConsolidationRunStopReason, type ConsolidationWriteJudge, type ConsolidationWriteTarget, type RunMemoryConsolidationOptions, isInstructionEntry, type MemoryEntryOrigin, type MemoryOriginCause, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, MEMORY_CAPTURE_OPTOUT_NOTICE, memoryCaptureOptedOutNotice, memoryCaptureOptOutUnpersistedNotice, SESSION_CAPTURE_OPTOUT_DIR, markSessionCaptureOptOut, readSessionCaptureOptOut, listSessionCaptureOptOut, fileSessionCaptureRecordStore, type SessionCaptureOptOutRecord, type SessionCaptureOptOutMarkOutcome, type SessionCaptureRecordStore, readV2HeaderHints, type V2HeaderHints, LINEAGE_FILE, CHALLENGES_FILE, CHALLENGED_HISTORY_FILE, CHALLENGE_LEDGER_MAX_EVENTS, rebuildStrictControlPlaneLedger, type ControlPlaneRebuildReceipt, type StrictControlPlaneLedger, type ChallengeAssignment, type ChallengeEvent, type ChallengedHistoryRow, type LineagePendingTxn, type LineagePromotion, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_INDEX_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, type MemorySearchDetails, type MemorySearchHit, type CleanMemorySearchHit, type ExposedMemorySearchHit, MEMORY_EXPOSURE_BANNER, MEMORY_EXPOSURE_HANDLE_TAG, memoryExposureIndexRow, type MemoryGetDetails, type MemoryIndexDetails, type MemoryIndexRow, type CleanMemoryIndexRow, type ExposedMemoryIndexRow, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, type MemoryAnnouncement, type ScanFinding, type MemoryEngineOptions, type MemoryInjection, type EntryProvenanceAccount, type TransferEvidence, type CommittedBinding, type CommittedEntrySnapshot, type CommittedScopeSnapshots, type EntryCustodyReport, erasureSelectHash, type EraseMemoryEntriesInput, type ErasureSelect, type ErasedBinding, type MemoryErasureAttestation, computeMemoryBundleHash, type MemoryExportBundle, type MemoryImportReport, type MemoryExportSnapshot, type MemoryBundleImportPlan, type BundleChallengeRow, type BundleLineageRow, type BundlePollutedSession, type MemoryBackend, type MemoryEntry, type MemoryEntryFrontmatter, type MemoryEntryHeader, type MemoryScopeEnumeration, type ScoredMemoryEntry, type NotePatch, type PatchReport, type MaterializedFile, type MemorySessionHandle, type HarvestReport, type HarvestRejection, type HarvestRejectionCode, type ParsedEntryFile, type ScannedEntryFile, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, isOrgScopeKey, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, type ParsedScopeKey, migrateScope, type MigrateScopeReport, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, type RemoteMemoryFile, type RemoteMemoryBaseline, type RemoteMaterialization, type RemoteHarvestResult, type InboundEntryFinding, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, type MemorySyncCursor, type MemorySyncConflict, type MemorySyncPlan, type RecallSource, syncMemoryScope, type MemorySyncTransport, type MemorySyncRequestBody, type MemorySyncResponseBody, type MemorySyncClientConflict, type SyncMemoryScopeOptions, type MemorySyncClientResult, } from "./core/memory-engine/index.js";
+export { createConsolidationWriteJudge, deliverWriteRefusal, type ConsolidationWriteJudgeInput } from "./core/runner/memory-consolidation-write-judge.js";
 export { STORE_FORM_REFUSAL_CODES, TARGET_OUTSIDE_STORE, SCOPE_HOME_NOT_DIRECTORY, SCOPE_HOME_FORMS, type StoreFormRefusalCode, type StoreFormRefusalDetail, type StoreFormRefusal, type ScopeHomeForm } from "./core/memory-engine/layout.js";
 export { reanchorMemoryStoreRoot, type StoreRootReanchor } from "./core/memory-engine/layout.js";
 export { SHARED_MEMORY_READ_CAP_BYTES, SHARED_MEMORY_LIST_PAGE_SIZE, SharedMemoryStoreError, type SharedMemoryStoreProvider, type SharedMemoryStoreReader, type SharedMemoryPagedList, type SharedMemoryStoreInfo, type SharedMemoryDocumentEntry, type SharedMemorySnapshot, type SharedMemoryRequestContext, type MemoryListDetails, type MemoryReadDetails, } from "./core/shared-memory/types.js";
@@ -270,6 +277,7 @@ type MemoryConsolidationDriverDeps, } from "./core/runner/memory-consolidation-d
 export { DEFAULT_COMPACTION_INSTRUCTIONS } from "./core/auto-compaction.js";
 export { DEFAULT_SYSTEM_PROMPT, CODE_AGENT_PROMPT, SUBAGENT_PROMPT, CODE_SYSTEM_PROMPT, MEMORY_GUIDANCE, MEMORY_SAFETY, MEMORY_HYGIENE, NO_PERSISTENT_MEMORY_NOTICE, OUTPUT_EFFICIENCY, CYBER_RISK, HARNESS_SECTION_ANCHOR, URL_SAFETY, SUMMARIZE_TOOL_RESULTS, EXECUTION_ENVIRONMENT, EXECUTION_ENVIRONMENT_OPEN_READS, executionEnvironmentBlockFor, harnessContext, buildEnvironmentContext, buildGitSnapshot, buildScratchpadSection, GIT_STATUS_MAX_CHARS, formatLocalDate, type EnvironmentFacts, defaultPromptProvider, composeSystemPrompt, composeConstitution, constitutionBlocks, type PromptBlock, analyzePromptCacheFriendliness, assertPromptCacheFriendly, type PromptProvider, type StablePromptContext, type PromptCacheReport, type PromptTextDeclaration, } from "./prompts/default.js";
 export { SUPERVISOR_PROMPT, ORCHESTRATION_GUIDANCE, ORCHESTRATION_AWARENESS, GOAL_COMPLETION_GUIDANCE } from "./prompts/supervisor.js";
+export { coworkPromptProvider, COWORK_PROMPT_SECTIONS } from "./prompts/cowork.js";
 export { compose, validatePack } from "./prompt-assembly/composer.js";
 export { SEMA_DEFAULT_PACK } from "./prompt-assembly/packs/sema-default.js";
 export { attachToolContract, getToolContract, hasToolContract, computeShapeDigest, projectToolManifest, type ToolContractDescriptor, type ToolOrigin } from "./prompt-assembly/tool-catalog.js";
@@ -330,8 +338,11 @@ export { FileBackgroundAgentStore, type FileBackgroundAgentStoreOptions } from "
 export { A2A_TASK_STATES, type A2ATaskState, type A2ATaskStateReversal, type A2ATaskStateReversalFaithful, type A2ATaskStateReversalLossy, toA2ATaskState, fromA2ATaskState, } from "./core/a2a-task-state.js";
 export { type WorkflowJournalStore, type WorkflowJournalEntry, InMemoryWorkflowJournalStore, callKeyOrdinal, JOURNAL_OVERSIZE_ERROR_CODE, WorkflowJournalOversizeError, assertJournalEntryFits, } from "./core/workflow-journal-store.js";
 export { untrustedEgressForHuman, redactHostLeaks, redactSecrets, boundedRedactedSummary } from "./core/untrusted-egress.js";
+export type { Egress, EgressTier } from "./core/untrusted-egress.js";
 export type { RedactionFinding, RedactionReport, RedactionConfidence, RedactionSource, SummarizableFinding, } from "./core/untrusted-egress.js";
 export { summarizeRedactions } from "./core/untrusted-egress.js";
+export { headerOwnershipCollision } from "./core/protocol-http-auth.js";
+export type { ProtocolHttpAuth } from "./core/protocol-http-auth.js";
 export { MemoryRosterStore, FileRosterStore, type RosterStore, type RosterEntry, type RosterAccess, type RosterGcOptions } from "./agents/roster-store.js";
 export { CONFIG_CATALOG_VERSION, describeConfigCatalog, resolveEffectiveConfig, type ConfigKnob, type ConfigOverrideDeclaration, type ConfigProvenance, type EffectiveConfigField, } from "./config/catalog.js";
 export { normalizeAgentName } from "./core/task-registry.js";
@@ -383,3 +394,9 @@ export type { AgentDefinition, BeforeWriteHook, BeforeWriteRequest, BeforeWriteR
 export { Type } from "typebox";
 export type { TSchema, Static } from "typebox";
 export { explainPromptAssembly, describeDefaultPack, type DefaultPackDescription, type ExplainInput } from "./prompt-assembly/explain.js";
+export { APPROVAL_ROUTES, approvalRouteOf, type ApprovalRoute } from "./core/wiring-manifest.js";
+export { SHADOW_REASON, allowRuleShadowSentence, cardDisclosureOf } from "./core/allow-entry.js";
+export { RULE_OFFERS_ABSENCES, type RuleOffersAbsence } from "./core/ask-origin.js";
+export { BOUND_GRANT_ABSENCES, type BoundGrantAbsence } from "./core/skill-grant-binding.js";
+export { DISPOSABLE_PROMPT_SECTIONS, type DisposablePromptSection, type PromptSectionEntry, type PromptSectionDisposition, type PromptSectionAuthor, type McpInstructionsEntry } from "./core/prompt-section-seat.js";
+export type { McpRevocationLedger, McpMountIdentity } from "./core/mcp-server-spec.js";