@sema-agent/core 7.51.1 → 7.52.0

package/dist/core/mods/stations.js

@@ -0,0 +1,444 @@
+import { types } from "node:util";
+import { resolveModel } from "../roles.js";
+import { brainToRuntime } from "../runtime.js";
+import { deliverEngineNotice } from "../engine-notice.js";
+import { inlineUntrusted } from "../untrusted-text.js";
+import { extensionWords } from "../untrusted-egress.js";
+import { askApproverIdentity, describeThrown, ownArgs } from "../tool-policy.js";
+import { admitMods, expandModPattern } from "./kernel/index.js";
+import { validateOverlay } from "../../prompt-assembly/overlay.js";
+import { modsInvalid } from "./kernel/registration.js";
+import { detachedCopy } from "./kernel/site-rules.js";
+import { isPlainRecord } from "./kernel/receive.js";
+import { engineMethodBottoms } from "./dollar.js";
+import { modSeatsOf, modsReportToOnError, registrationRefusedNotice } from "./host.js";
+export const ENGINE_CORE_ANSWER = Object.freeze({});
+export function engineCore() {
+    return ENGINE_CORE_ANSWER;
+}
+export function agentIdOf(identity) {
+    return identity?.isDelegatedChild === true ? identity.taskId : undefined;
+}
+export function stopEventOf(identity) {
+    return identity?.isDelegatedChild === true ? "classic.SubagentStop" : "classic.Stop";
+}
+export function detachedArgsOf(args) {
+    return isRecord(args) ? detachedCopy(args) : args;
+}
+function isRecord(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+export function judgedInputOf(args) {
+    const owned = ownArgs(args);
+    return owned.ok ? owned.value : args;
+}
+export function admittedChainOf(bus, spec, deps) {
+    const offered = new Map();
+    for (const r of [...(deps.mods ?? []), ...(spec.mods ?? [])])
+        offered.set(r.name, r);
+    const hung = bus.mounted();
+    const links = [];
+    for (const rec of bus.records) {
+        if ("refusedBy" in rec)
+            continue;
+        const registration = offered.get(rec.name);
+        if (registration !== undefined)
+            links.push(Object.freeze({ registration, handlers: Object.freeze(hung.filter((h) => h.plugin === rec.name)) }));
+    }
+    return Object.freeze(links);
+}
+const ADMITTED_CHAINS = new WeakMap();
+function recordAdmittedChain(bus, seats) {
+    const chain = admittedChainOf(bus, { ...(seats.task !== undefined ? { mods: [...seats.task] } : {}) }, { ...(seats.deployment !== undefined ? { mods: [...seats.deployment] } : {}) });
+    ADMITTED_CHAINS.set(bus, chain);
+    return chain;
+}
+export function chainOfBus(bus) {
+    return ADMITTED_CHAINS.get(bus);
+}
+const sameMatcher = (a, b) => {
+    if (a === undefined || b === undefined)
+        return a === b;
+    const ka = Object.keys(a).sort();
+    const kb = Object.keys(b).sort();
+    return ka.length === kb.length && ka.every((k, i) => k === kb[i] && a[k] === b[k]);
+};
+const sameHandler = (a, b) => a.seat === b.seat && a.pattern === b.pattern && a.observe === b.observe && a.caught === b.caught && sameMatcher(a.matcher, b.matcher);
+function sameModLink(a, b) {
+    return a.registration === b.registration && a.handlers.length === b.handlers.length && a.handlers.every((h, j) => sameHandler(h, b.handlers[j]));
+}
+export function sameModChain(a, b) {
+    return a.length === b.length && a.every((l, i) => sameModLink(l, b[i]));
+}
+const judgesCall = (p) => !p.observe;
+export function chainJudges(bus) {
+    return bus.hasHandlers("classic.PreToolUse", judgesCall) || bus.hasHandlers("tool.check", judgesCall);
+}
+const SCREENING_CHAINS = new WeakMap();
+export function recordScreeningChain(policy, chain) {
+    SCREENING_CHAINS.set(policy, chain);
+}
+export function screeningChainOf(policy) {
+    return SCREENING_CHAINS.get(policy);
+}
+export function sameInstallation(pc, leg) {
+    const bus = screeningChainOf(pc.policy);
+    const chain = bus !== undefined ? chainOfBus(bus) : undefined;
+    return (chain !== undefined &&
+        sameModChain(chain, leg.chain) &&
+        askApproverIdentity(pc.onAsk) === askApproverIdentity(leg.onAsk) &&
+        (pc.durableMandate === true) === leg.durableMandate &&
+        (pc.contentMandate === true) === leg.contentMandate &&
+        pc.hookEnv === leg.hookEnv &&
+        pc.autoMode?.decider === leg.decider);
+}
+export function standsInFor(pc, leg, legChainJudges) {
+    return legChainJudges && sameInstallation(pc, { ...leg, durableMandate: false, contentMandate: false });
+}
+const judgesToolCheck = (h) => {
+    const selected = expandModPattern(h.pattern);
+    return !h.observe && "names" in selected && selected.names.includes("tool.check");
+};
+export function screeningInstallationsOf(entries) {
+    return entries.flatMap((pc) => {
+        const bus = screeningChainOf(pc.policy);
+        return bus !== undefined || pc.mods !== undefined ? [{ bus, chain: pc.mods }] : [];
+    });
+}
+export function unraisableGuardsOf(installations) {
+    const guards = installations.flatMap((i) => (i.bus !== undefined ? [] : (i.chain ?? []).filter((l) => l.handlers.some(judgesToolCheck)).map((l) => `"${inlineUntrusted(l.registration.name, 80)}"`)));
+    return guards.length === 0 ? undefined : `an inherited screening entry names the tool.check guard of ${guards.join(", ")}, but its policy is not one createPreToolUseConstraintPolicy minted, so the guard has no chain to judge this leg's calls on — hand the minted policy back as it is`;
+}
+const judges = (p) => judgesCall(p);
+export function inheritedToolChecks(entries, standsIn, settleOf) {
+    const unraisable = unraisableGuardsOf(screeningInstallationsOf(entries));
+    if (unraisable !== undefined)
+        throw modsInvalid(unraisable);
+    const checks = [];
+    for (const pc of entries) {
+        const bus = screeningChainOf(pc.policy);
+        if (bus === undefined || standsIn(pc) || !bus.hasHandlers("tool.check", judges))
+            continue;
+        checks.push(Object.freeze({ bus, judges, settle: settleOf(pc) }));
+    }
+    return Object.freeze(checks);
+}
+export function classicEventBase(identity, permissionMode) {
+    const agentId = agentIdOf(identity);
+    return {
+        ...(identity !== undefined ? { identity } : {}),
+        ...(agentId !== undefined ? { agentId } : {}),
+        ...(permissionMode !== undefined ? { permissionMode } : {}),
+    };
+}
+export async function observeClassic(bus, event, e, signal) {
+    if (!bus.hasHandlers(event))
+        return;
+    try {
+        await bus.dispatch(event, e, { bottom: engineCore, ...(signal !== undefined ? { signal } : {}) });
+    }
+    catch {
+    }
+}
+export async function dispatchClassic(bus, event, e, options) {
+    if (!bus.hasHandlers(event))
+        return undefined;
+    const check = options.checkAnswer;
+    return await bus.dispatch(event, e, {
+        bottom: engineCore,
+        ...(options.signal !== undefined ? { signal: options.signal } : {}),
+        ...(check !== undefined ? { checkAnswer: (a) => (a === ENGINE_CORE_ANSWER ? undefined : check(a)) } : {}),
+    });
+}
+export function stringMembersAnswer(event, members) {
+    return (answer) => {
+        if (answer === null || answer === false)
+            return undefined;
+        if (typeof answer !== "object")
+            return `answered ${typeof answer}; ${event} takes { ${members.map((m) => `${m}?`).join(", ")} }`;
+        for (const m of members) {
+            const v = Reflect.get(answer, m);
+            if (v !== undefined && typeof v !== "string")
+                return `answered a ${typeof v} "${m}"; it is a string`;
+        }
+        return undefined;
+    };
+}
+export function stringMembersOf(answer, members) {
+    const out = {};
+    if (typeof answer !== "object" || answer === null)
+        return out;
+    for (const m of members) {
+        const v = Reflect.get(answer, m);
+        if (typeof v === "string")
+            out[m] = v;
+    }
+    return out;
+}
+const FAILURE_CLAUSE = Object.freeze({
+    threw: (who, why) => `crashed (extension "${who}" ${why})`,
+    timeout: (who, why) => `did not answer (extension "${who}" ${why})`,
+    violation: (who, why) => `gave an answer the station cannot take (extension "${who}" ${why})`,
+    reentry: (who, why) => `was skipped on re-entry and its .catch did not answer (extension "${who}" ${why})`,
+});
+export function failedHandlerClause(f) {
+    return FAILURE_CLAUSE[f.cause](extensionWords(f.registration, 80), extensionWords(f.reason, 200));
+}
+export async function observePermissionDenied(input) {
+    const { payload, hostObserver } = input;
+    const e = { ...payload, ...classicEventBase(payload.identity, payload.permissionMode) };
+    if (input.legBus?.hasHandlers("classic.PermissionDenied") === true)
+        await observeClassic(input.legBus, "classic.PermissionDenied", e, input.signal);
+    if (hostObserver === undefined)
+        return;
+    const own = await admitModChain({
+        deployment: [
+            {
+                name: "toolGate.permissionDenied",
+                tier: "user",
+                uses: { events: ["classic.PermissionDenied"], calls: [] },
+                register: (on) => on("classic.PermissionDenied", async () => void (await hostObserver(payload)), { observe: true }),
+            },
+        ],
+    }, input.onHostObserverFailure);
+    await observeClassic(own, "classic.PermissionDenied", e, input.signal);
+}
+export async function screenUserPrompt(bus, e, signal) {
+    let outcome;
+    try {
+        outcome = await dispatchClassic(bus, "classic.UserPromptSubmit", e, {
+            ...(signal !== undefined ? { signal } : {}),
+            checkAnswer: stringMembersAnswer("classic.UserPromptSubmit", ["block", "additionalContext"]),
+        });
+    }
+    catch (err) {
+        return { kind: "failed", registration: "engine", cause: "threw", reason: `could not raise the screen: ${describeThrown(err)}`, skipped: [] };
+    }
+    if (outcome === undefined)
+        return undefined;
+    if (outcome.kind !== "answered")
+        return outcome;
+    return { kind: "answered", ...stringMembersOf(outcome.answer, ["block", "additionalContext"]) };
+}
+export const TOOL_CHECK_DECISIONS = Object.freeze(["allow", "ask", "deny"]);
+const isToolCheckDecision = (v) => TOOL_CHECK_DECISIONS.some((d) => d === v);
+function readToolCheckAnswer(answer) {
+    if (typeof answer !== "object" || answer === null)
+        return `answered ${answer === null ? "null" : typeof answer}; tool.check takes { decision, reason? }`;
+    const decision = Reflect.get(answer, "decision");
+    const reason = Reflect.get(answer, "reason");
+    if (!isToolCheckDecision(decision))
+        return `no { decision } (one of ${TOOL_CHECK_DECISIONS.join(", ")})`;
+    if (reason !== undefined && typeof reason !== "string")
+        return `answered a ${typeof reason} "reason"; it is a string`;
+    return { decision, ...(reason !== undefined ? { reason } : {}) };
+}
+export async function raiseToolCheck(bus, e, projection, signal, judges) {
+    if (!bus.hasHandlers("tool.check", judges))
+        return undefined;
+    let outcome;
+    try {
+        outcome = await bus.dispatch("tool.check", e, {
+            bottom: () => projection,
+            ...(judges !== undefined ? { participant: judges } : {}),
+            ...(signal !== undefined ? { signal } : {}),
+            checkAnswer: (a) => {
+                const read = readToolCheckAnswer(a);
+                return typeof read === "string" ? read : undefined;
+            },
+        });
+    }
+    catch (err) {
+        return { kind: "failed", registration: "engine", cause: "threw", reason: `could not raise the check: ${describeThrown(err)}`, skipped: [] };
+    }
+    if (outcome.kind !== "answered")
+        return outcome;
+    const read = readToolCheckAnswer(outcome.answer);
+    if (typeof read === "string")
+        return { kind: "failed", registration: outcome.answeredBy ?? "engine", cause: "violation", reason: read, skipped: outcome.skipped };
+    return { kind: "answered", ...read, ...(outcome.answeredBy !== undefined ? { by: outcome.answeredBy } : {}) };
+}
+const NO_COMPOSE = Object.freeze({ deploy: Object.freeze([]), task: Object.freeze([]), warnings: Object.freeze([]) });
+function composeOverlaysOf(answer) {
+    if (!isPlainRecord(answer)) {
+        return `answered ${answer === null ? "null" : Array.isArray(answer) ? "an array" : typeof answer === "object" ? "an object that is not a plain record" : typeof answer}; prompt.compose takes a plain { overlays }`;
+    }
+    const stray = Object.keys(answer).filter((k) => k !== "overlays");
+    if (stray.length > 0)
+        return `the answer carries ${stray.slice(0, 5).map((k) => JSON.stringify(extensionWords(k, 40))).join(", ")} (overlays only)`;
+    const overlays = answer["overlays"];
+    return Array.isArray(overlays) && Object.getPrototypeOf(overlays) === Array.prototype ? overlays : "the answer's overlays is not an ordinary array";
+}
+export async function raisePromptCompose(bus, e, options) {
+    if (!bus.hasHandlers("prompt.compose"))
+        return NO_COMPOSE;
+    const sourceOf = (seat) => (seat === "deployment" ? "deploy" : "task");
+    const bottom = Object.freeze({ overlays: Object.freeze([]) });
+    const taken = new WeakMap([[bottom, Object.freeze([])]]);
+    const HEAD = "the answer does not carry what next() returned unchanged at its head (a handler adds overlays; it never rewrites or removes another's)";
+    let outcome;
+    try {
+        outcome = await bus.dispatch("prompt.compose", e, {
+            bottom: () => bottom,
+            ...(options.signal !== undefined ? { signal: options.signal } : {}),
+            checkAnswer: (answer, _e, by, below) => {
+                if (typeof answer === "object" && answer !== null && taken.has(answer))
+                    return undefined;
+                const mine = composeOverlaysOf(answer);
+                if (typeof mine === "string")
+                    return mine;
+                const returned = below[below.length - 1];
+                const lower = typeof returned === "object" && returned !== null ? taken.get(returned) : undefined;
+                if (lower === undefined) {
+                    return below.length === 0
+                        ? "it answered without next(e) — prompt.compose collects: a handler awaits next(e) and adds after what it returned"
+                        : "next() is still running; prompt.compose answers after it";
+                }
+                if (mine.length < lower.length)
+                    return HEAD;
+                const out = [...lower];
+                for (let i = 0; i < mine.length; i++) {
+                    const under = lower[i];
+                    const v = validateOverlay(mine[i], { source: sourceOf(under?.by.seat ?? by.seat), event: "prompt.compose", lowerAdds: options.lowerAdds });
+                    if (under !== undefined) {
+                        if ("violation" in v || JSON.stringify(v.overlay) !== JSON.stringify(under.overlay))
+                            return HEAD;
+                        continue;
+                    }
+                    if ("violation" in v)
+                        return v.violation;
+                    out.push(Object.freeze({ overlay: v.overlay, by: Object.freeze({ plugin: by.plugin, seat: by.seat }) }));
+                }
+                taken.set(answer, Object.freeze(out));
+                return undefined;
+            },
+        });
+    }
+    catch (err) {
+        return { deploy: [], task: [], warnings: [`prompt.compose could not be raised (${describeThrown(err)}); no mods overlay applies this run`] };
+    }
+    const warnings = (outcome.kind === "aborted" ? [] : outcome.skipped).map((s) => `prompt.compose: extension "${extensionWords(s.registration, 80)}" ${s.cause === "violation" ? "gave an answer the station cannot take" : s.cause}: ${extensionWords(s.reason, 300)} — that answer is skipped; what is below it stands`);
+    if (outcome.kind !== "answered")
+        return { deploy: [], task: [], warnings };
+    const answer = outcome.answer;
+    const contributions = typeof answer === "object" && answer !== null ? taken.get(answer) : undefined;
+    if (contributions === undefined)
+        return { deploy: [], task: [], warnings: [...warnings, "prompt.compose: the chain's answer is not one the station took; no mods overlay applies this run"] };
+    const blocks = [];
+    for (const { overlay, by } of contributions) {
+        const item = { overlay, origin: { source: sourceOf(by.seat), by: by.plugin } };
+        const last = blocks[blocks.length - 1];
+        if (last !== undefined && last.by.plugin === by.plugin && last.by.seat === by.seat)
+            last.items.push(item);
+        else
+            blocks.push({ by, items: [item] });
+    }
+    const inChainOrder = blocks.reverse().flatMap((b) => b.items);
+    return {
+        deploy: Object.freeze(inChainOrder.filter((o) => o.origin.source === "deploy")),
+        task: Object.freeze(inChainOrder.filter((o) => o.origin.source === "task")),
+        warnings,
+    };
+}
+function lateView() {
+    let seats;
+    const need = (method) => {
+        if (seats === undefined)
+            throw new Error(`${method}: the engine facade is not available before the leg is prepared`);
+        return seats;
+    };
+    const view = {
+        env: { exec: (command, options) => need("process.run").exec(command, options) },
+        complete: (request, signal) => need("model.complete").complete(request, signal),
+        book: (reply) => need("model.complete").book(reply),
+        session: {
+            id: () => need("session.id").sessionId,
+            cwd: () => need("session.cwd").cwd(),
+            root: () => need("session.root").root(),
+            model: () => need("session.model").model(),
+            messages: () => need("session.messages").messages(),
+        },
+        now: () => need("clock.now").now(),
+        tools: () => need("tool.list").tools(),
+        agents: () => need("agent.list").agents(),
+    };
+    return {
+        view,
+        bind: (s) => {
+            seats = s;
+        },
+    };
+}
+export async function admitLegMods(input) {
+    const late = lateView();
+    const seats = modSeatsOf(input.spec, input.deps);
+    const bus = await admitMods({
+        side: "engine",
+        seats,
+        bottoms: engineMethodBottoms(late.view),
+        report: modsReportToOnError(input.deps.onError, input.sessionId),
+        describeThrown,
+        isProxy: types.isProxy,
+    });
+    for (const record of bus.records) {
+        if ("refusedBy" in record)
+            deliverEngineNotice(input.deps.onNotice, registrationRefusedNotice(record, input.sessionId));
+    }
+    return { bus, chain: recordAdmittedChain(bus, seats), bindFacade: late.bind };
+}
+function replyText(reply) {
+    return reply.content.flatMap((c) => (c.type === "text" ? [c.text] : [])).join("");
+}
+export function legFacadeSeats(input) {
+    const runtime = brainToRuntime(input.deps.brain);
+    const answeredBy = new Map();
+    const byUsage = new WeakMap();
+    return {
+        exec: (command, options) => input.executionEnv.exec(command, options),
+        complete: async (request, signal) => {
+            const model = request.model !== undefined ? resolveModel(request.model, input.deps.models) : input.model;
+            answeredBy.set(model.id, model);
+            const auth = await input.spec.getApiKeyAndHeaders?.(model);
+            const reply = await runtime.completeSimple(model, { ...request.context, messages: [...request.context.messages] }, { signal, maxTokens: request.maxTokens, ...(auth?.apiKey !== undefined ? { apiKey: auth.apiKey } : {}), ...(auth?.headers !== undefined ? { headers: auth.headers } : {}) });
+            if (reply.stopReason === "error" || reply.stopReason === "aborted")
+                throw new Error(`model.complete: ${reply.errorMessage ?? reply.stopReason}`);
+            if (reply.usage !== undefined)
+                byUsage.set(reply.usage, { model, ...(reply.diagnostics !== undefined ? { diagnostics: reply.diagnostics } : {}) });
+            return Object.freeze({ text: replyText(reply), model: model.id, ...(reply.usage !== undefined ? { usage: reply.usage } : {}) });
+        },
+        sessionId: input.sessionId,
+        book: (reply) => {
+            const seen = reply.usage !== undefined ? byUsage.get(reply.usage) : undefined;
+            const record = seen !== undefined && seen.model.id === reply.model ? seen : undefined;
+            const model = record?.model ?? answeredBy.get(reply.model);
+            if (model === undefined)
+                throw new Error(`model.complete: the reply names model "${reply.model}", which no call of this leg resolved; it is not booked`);
+            input.book(model, { usage: reply.usage, ...(record?.diagnostics !== undefined ? { diagnostics: record.diagnostics } : {}) });
+        },
+        cwd: () => input.cwdRef?.current ?? input.taskRoot,
+        root: () => input.taskRoot,
+        model: () => input.model.id,
+        messages: () => input.lastBrainContext()?.messages ?? [],
+        now: () => (input.deps.now ?? Date.now)(),
+        tools: () => [...input.activeTools],
+        agents: () => (input.agentListing?.entries ?? []).map((e) => e.name),
+    };
+}
+export async function admitModChain(seats, onError) {
+    const bus = await admitMods({
+        side: "engine",
+        seats,
+        bottoms: engineMethodBottoms(lateView().view),
+        report: (err) => {
+            try {
+                onError?.(err);
+            }
+            catch {
+            }
+        },
+        describeThrown,
+        isProxy: types.isProxy,
+    });
+    recordAdmittedChain(bus, seats);
+    return bus;
+}

package/dist/core/own-property-receipt.js

@@ -1,4 +1,5 @@
 import { types } from "node:util";
+import { describeFault, isPlainRecord, receive } from "./mods/kernel/receive.js";
 export function receiptRefusal(message) {
     const e = new Error(message);
     e.code = "config.invalid_argument";
@@ -8,32 +9,19 @@ export function refuseProxy(given, words) {
     if (types.isProxy(given))
         throw receiptRefusal(`${words.subject} must be a plain object, not a Proxy: its ${words.unit}s are read once off its own descriptors, and a Proxy would run its traps in that read — refused rather than wired through it`);
 }
+const CONFIG_RECEIPT_MODE = Object.freeze({ accessors: "call-once", depth: 1, others: "as-is", isProxy: (v) => types.isProxy(v) });
 export function receiveOwnProperties(given, words) {
     refuseProxy(given, words);
-    const proto = Object.getPrototypeOf(given);
-    if (proto !== Object.prototype && proto !== null) {
+    if (!isPlainRecord(given)) {
         throw receiptRefusal(`${words.subject} must be a plain object (its prototype is neither Object.prototype nor null): every ${words.unit} is read once as an own property, and a ${words.unit} its prototype would supply is not read — refused rather than wired without it`);
     }
-    const captured = Object.getOwnPropertyDescriptors(given);
-    const received = Object.create(Object.prototype);
-    for (const name of Object.getOwnPropertyNames(captured)) {
-        const d = captured[name];
-        let value;
-        if (Object.hasOwn(d, "value")) {
-            value = d.value;
-        }
-        else {
-            const get = Object.hasOwn(d, "get") ? d.get : undefined;
-            try {
-                value = get === undefined ? undefined : get.call(given);
-            }
-            catch {
-                throw receiptRefusal(`${words.subject}.${name} threw while it was read ${words.moment} — a ${words.unit} is read once, here; refused rather than wired without it`);
-            }
-        }
-        Object.defineProperty(received, name, { value, enumerable: true, writable: true, configurable: true });
-    }
-    if (Object.getPrototypeOf(given) !== proto)
+    const received = receive(given, CONFIG_RECEIPT_MODE);
+    if (received.ok)
+        return received.value;
+    const name = received.fault.path[0] ?? "";
+    if (received.fault.kind === "getter-threw")
+        throw receiptRefusal(`${words.subject}.${name} threw while it was read ${words.moment} — a ${words.unit} is read once, here; refused rather than wired without it`);
+    if (received.fault.kind === "prototype-moved")
         throw receiptRefusal(`${words.subject}'s prototype changed while its ${words.unit}s were read ${words.moment} — refused rather than wired from a moving object`);
-    return received;
+    throw receiptRefusal(`${words.subject} could not be read ${words.moment}: ${describeFault(received.fault)} — refused rather than wired without it`);
 }

package/dist/core/parent-spec-seat.d.ts

@@ -9,11 +9,12 @@
  * The checkpoint seat (`./checkpoint-seat.ts`) is the same shape for one field; this seat carries the rest.
  */
 import type { OnQuestion } from "./ask-question.js";
-import type { Hooks } from "./hooks.js";
+import type { ModRegistration } from "./mods/kernel/index.js";
+import type { EngineDollar } from "./mods/dollar.js";
 import type { ToolExecuteContext } from "./tool-spec.js";
 import type { TaskSpec } from "./types.js";
 /** The fields of a spec the seat carries — one `Pick`, shared by the mint's input and the apply's target. */
-export type ParentSpecSeatFields = Pick<TaskSpec, "principal" | "oneShot" | "clientContext" | "onQuestion" | "hooks" | "additionalDirectories" | "additionalReadDirectories" | "envFacts" | "memoryPersistenceCapable" | "memory" | "compaction" | "skillListingBudgetFraction" | "skillListingMaxDescChars" | "fileHistory">;
+export type ParentSpecSeatFields = Pick<TaskSpec, "principal" | "oneShot" | "clientContext" | "onQuestion" | "mods" | "additionalDirectories" | "additionalReadDirectories" | "envFacts" | "memoryPersistenceCapable" | "memory" | "compaction" | "skillListingBudgetFraction" | "skillListingMaxDescChars" | "fileHistory" | "promptForm" | "promptBinding">;
 /**
  * The seat a run hands its children. Every member is the parent's own value, frozen at mint (arrays copied and
  * frozen; the facts object copied). Members present iff the parent carries them — an absent member is "nothing to
@@ -23,10 +24,13 @@ export type ParentSpecSeatFields = Pick<TaskSpec, "principal" | "oneShot" | "cli
  *  · `clientContext` — the user's TZ/email facts (the child's environment block localizes the same way).
  *  · `onQuestion` — the parent's FROZEN question face (`spec.onQuestion ?? deps.onQuestion`, the value the parent's
  *    own AskUserQuestion resolves at): the child's question tool MOUNTS on it, so without it the child has no tool.
- *  · `hooks` — the parent's SPEC-level hook seams (`spec.hooks`, the request-level lifecycle hooks a host mounts from
- *    the user's settings). A deployment's `RunnerDeps.hooks` already serve every leg; the spec-level seams did not,
- *    so a `stop` seat a user wired ran for the leader and never for its teammates (CC runs `SubagentStop` from the
- *    same settings). Same law as `onQuestion`: a child's own value wins, the seat fills an unset one.
+ *  · `mods` — the parent's TASK seat of the mods bus (`spec.mods`, the request-level registrations a host mounts from
+ *    the user's settings). A deployment's `RunnerDeps.mods` already serve every leg; the task seat did not, so a
+ *    `classic.Stop` handler a user wired ran for the leader and never for its teammates (CC runs one chain for the
+ *    session and its subagents, the event carrying `agentId`). A child dispatches the travelled registrations as its
+ *    own task seat (its events carry the child's identity); an ancestor's chain still rides the constraint fold, and
+ *    collapses into the child's own phase 1 when the installation is the same. Same law as `onQuestion`: a child's
+ *    own value wins, the seat fills an unset one.
  *  · `additionalDirectories` / `additionalReadDirectories` — the fs-fence widening (deployment property).
  *  · `envFacts` — the sandbox facts (profile / egress / scratchpad).
  *  · `memoryPersistenceCapable` — the deployment's DECLARED persistence statement: `false` is a REMOVAL (floor),
@@ -45,13 +49,18 @@ export type ParentSpecSeatFields = Pick<TaskSpec, "principal" | "oneShot" | "cli
  *    and every leg multiplies it by its own.
  *  · `fileHistory` — the request's file-history off switch (`"disabled"`, its only word), for the edits its delegates
  *    make on its behalf too. An ORDINARY member (fill law); with one word no child can author it back on.
+ *  · `promptForm` — the host form of the system prompt (`"minimal"`, its only word: the core-behavior band is out). A
+ *    host's product choice for the whole delegation tree, so every engine-built child (both delegation lanes and the
+ *    observer sidecar) composes the same set of sections. An ORDINARY member (fill law).
+ *  · `promptBinding` — the center binding (a deployment's scenario name). A child composes its parent's center
+ *    artifact, so it selects that artifact's scoped overlays by the same binding. An ORDINARY member (fill law).
  */
 export interface ParentSpecSeat {
     readonly principal?: string;
     readonly oneShot?: true;
     readonly clientContext?: TaskSpec["clientContext"];
     readonly onQuestion?: OnQuestion;
-    readonly hooks?: Hooks;
+    readonly mods?: readonly ModRegistration<EngineDollar>[];
     readonly additionalDirectories?: readonly string[];
     readonly additionalReadDirectories?: readonly string[];
     readonly envFacts?: TaskSpec["envFacts"];
@@ -61,6 +70,8 @@ export interface ParentSpecSeat {
     readonly skillListingBudgetFraction?: number;
     readonly skillListingMaxDescChars?: number;
     readonly fileHistory?: "disabled";
+    readonly promptForm?: "minimal";
+    readonly promptBinding?: string;
 }
 /** Mint the seat off the parent's REBOUND spec and its frozen question face (spec over deps — the caller resolves it once,
  *  the same value the parent's own question routing reads). Absent fields stay absent; `oneShot` only when `true`. */

package/dist/core/parent-spec-seat.js

@@ -4,7 +4,7 @@ export function parentSpecSeatOf(spec, frozenOnQuestion) {
         ...(spec.oneShot === true ? { oneShot: true } : {}),
         ...(spec.clientContext !== undefined ? { clientContext: spec.clientContext } : {}),
         ...(frozenOnQuestion !== undefined ? { onQuestion: frozenOnQuestion } : {}),
-        ...(spec.hooks !== undefined ? { hooks: spec.hooks } : {}),
+        ...(spec.mods !== undefined ? { mods: spec.mods } : {}),
         ...(spec.additionalDirectories !== undefined ? { additionalDirectories: Object.freeze([...spec.additionalDirectories]) } : {}),
         ...(spec.additionalReadDirectories !== undefined ? { additionalReadDirectories: Object.freeze([...spec.additionalReadDirectories]) } : {}),
         ...(spec.envFacts !== undefined ? { envFacts: Object.freeze({ ...spec.envFacts }) } : {}),
@@ -13,6 +13,8 @@ export function parentSpecSeatOf(spec, frozenOnQuestion) {
         ...(spec.skillListingBudgetFraction !== undefined ? { skillListingBudgetFraction: spec.skillListingBudgetFraction } : {}),
         ...(spec.skillListingMaxDescChars !== undefined ? { skillListingMaxDescChars: spec.skillListingMaxDescChars } : {}),
         ...(spec.fileHistory !== undefined ? { fileHistory: spec.fileHistory } : {}),
+        ...(spec.promptForm !== undefined ? { promptForm: spec.promptForm } : {}),
+        ...(spec.promptBinding !== undefined ? { promptBinding: spec.promptBinding } : {}),
         ...(spec.memory?.enabled === false ? { memoryOff: true } : {}),
     });
 }
@@ -25,7 +27,7 @@ export function applyParentSpecSeat(child, seat) {
         ...fill("principal", seat.principal),
         ...fill("clientContext", seat.clientContext),
         ...fill("onQuestion", seat.onQuestion),
-        ...fill("hooks", seat.hooks),
+        ...fill("mods", seat.mods),
         ...fill("additionalDirectories", (seat.additionalDirectories !== undefined ? [...seat.additionalDirectories] : undefined)),
         ...fill("additionalReadDirectories", (seat.additionalReadDirectories !== undefined ? [...seat.additionalReadDirectories] : undefined)),
         ...fill("envFacts", (seat.envFacts !== undefined ? { ...seat.envFacts } : undefined)),
@@ -33,6 +35,8 @@ export function applyParentSpecSeat(child, seat) {
         ...fill("skillListingBudgetFraction", seat.skillListingBudgetFraction),
         ...fill("skillListingMaxDescChars", seat.skillListingMaxDescChars),
         ...fill("fileHistory", seat.fileHistory),
+        ...fill("promptForm", seat.promptForm),
+        ...fill("promptBinding", seat.promptBinding),
         ...(seat.oneShot === true ? { oneShot: true } : {}),
         ...(seat.memoryPersistenceCapable === false ? { memoryPersistenceCapable: false } : fill("memoryPersistenceCapable", seat.memoryPersistenceCapable)),
         ...(seat.memoryOff === true ? { memory: memoryTurnedOff(child.memory) } : {}),

package/dist/core/path-identity.js

@@ -1,4 +1,5 @@
-import { anchorSpelling, isUncSpelling, win32NamespaceScreen } from "../tools/fs/safety.js";
+import { anchorSpelling, win32NamespaceScreen } from "../tools/fs/safety.js";
+import { isUncSpelling } from "./unc-spelling.js";
 export async function symlinkChainHops(env, path, signal, family, baseCwd) {
     if (typeof env.canonicalChain !== "function")
         return { ok: false, cause: "the environment declares no symlink-chain reader", asked: false };

package/dist/core/permission-rule-syntax.d.ts

@@ -28,3 +28,18 @@ export declare function lastIndexOfUnescaped(s: string, ch: string): number;
  * factory) to refuse the downgrades.
  */
 export declare function parsePermissionRule(rule: string): ParsedPermissionRule;
+/**
+ * Can a rule name this tool name — is it the rule syntax's name head ({@link RULE_TOOL_NAME}) and not the lone `*`? The
+ * lone `*` is the wildcard (every tool), not a name: a tool called `*` could never be granted or refused on its own. The
+ * mount contract for every name a caller tool answers to (its name and each alias), so each one is a name every list can
+ * write; a protocol-minted name (`<ns>__<peer>__<tool>`, segments in `[A-Za-z0-9_-]`) is always one.
+ */
+export declare function isNameableToolName(name: string): boolean;
+/**
+ * One rule entry read by the rule syntax, or `undefined` when the syntax cannot read it: blanks around it, a tool name (the
+ * text before the first unescaped `(`, as written) outside {@link RULE_TOOL_NAME}, or a `(` the parse cannot close at the
+ * entry's end (the lenient parser's downgrade: the whole string read as a name); otherwise {@link parsePermissionRule}'s
+ * reading. THE test of "this is a rule spelling" — every entry list's reader asks it before any rule grammar reads the
+ * content (what the parentheses hold, a parenthesis or a control character included, is that grammar's to judge).
+ */
+export declare function ruleSpellingOf(rule: string): ParsedPermissionRule | undefined;