@sema-agent/core 7.51.2 → 7.52.0

package/dist/agents/agent-transcript-tool.d.ts

@@ -55,7 +55,7 @@ export interface AgentTranscriptToolOptions {
  * with retain off/expired/evicted). Only when BOTH miss does the call return the honest
  * "not retained" / "not found".
  */
-export declare function createAgentTranscriptTool(opts: AgentTranscriptToolOptions): import("../internal/harness-types.js").AgentTool<Type.TObject<{
+export declare function createAgentTranscriptTool(opts: AgentTranscriptToolOptions): import("../core/types.js").AgentTool<Type.TObject<{
     id: Type.TString;
     lastN: Type.TOptional<Type.TInteger>;
 }>, unknown>;

package/dist/agents/cascade.js

@@ -42,6 +42,7 @@ export async function runCascade(runner, spec, config, internals) {
     let ownCacheWrite = 0, ownCacheWriteLong = 0;
     let nestedTokens = 0, nestedTurns = 0, nestedTasks = 0, nestedCostMicro = 0;
     let ownLlmRootMicro = 0, ownCompactionMicro = 0;
+    let ownSideCallMicro;
     let anyRungUnpriced = false;
     let hrCount = 0, hrWaitMs = 0;
     const hrGates = [];
@@ -58,6 +59,7 @@ export async function runCascade(runner, spec, config, internals) {
         anyLegUnpriced: anyRungUnpriced,
         llmRootMicroUsd: ownLlmRootMicro,
         compactionMicroUsd: ownCompactionMicro,
+        ...(ownSideCallMicro !== undefined ? { sideCallMicroUsd: ownSideCallMicro } : {}),
         nested: { tokens: nestedTokens, turns: nestedTurns, tasks: nestedTasks, costMicroUsd: nestedCostMicro },
         humanReview: { count: hrCount, totalWaitMs: hrWaitMs, gates: hrGates },
     });
@@ -120,6 +122,8 @@ export async function runCascade(runner, spec, config, internals) {
         if (s.costBreakdown) {
             ownLlmRootMicro += s.costBreakdown.llmRootMicroUsd;
             ownCompactionMicro += s.costBreakdown.compactionMicroUsd;
+            if (s.costBreakdown.sideCallMicroUsd !== undefined)
+                ownSideCallMicro = (ownSideCallMicro ?? 0) + s.costBreakdown.sideCallMicroUsd;
         }
         if (s.humanReview) {
             hrCount += s.humanReview.count;

package/dist/agents/cumulative-stats.d.ts

@@ -69,6 +69,9 @@ export interface CumulativeStatsAccumulator {
     llmRootMicroUsd: number;
     /** Cumulative within-task compaction LLM cost for the `costBreakdown` taxonomy. */
     compactionMicroUsd: number;
+    /** Cumulative side-call (permission classifier, mods) LLM cost — the "of which" line of `costBreakdown`, INSIDE
+     *  `llmRootMicroUsd`, never a partition member. Undefined until a leg booked one: the cumulative key is then absent too. */
+    sideCallMicroUsd?: number;
     nested: CumulativeNestedTotals;
     humanReview: CumulativeHumanReviewTotals;
 }

package/dist/agents/cumulative-stats.js

@@ -21,6 +21,7 @@ export function buildCumulativeStats(base, acc) {
                 nestedSubagentMicroUsd: acc.nested.costMicroUsd,
                 memoryConsolidationMicroUsd: 0,
                 compactionMicroUsd: acc.compactionMicroUsd,
+                ...(acc.sideCallMicroUsd !== undefined ? { sideCallMicroUsd: acc.sideCallMicroUsd } : {}),
             },
         humanReview: acc.humanReview.count > 0
             ? { count: acc.humanReview.count, totalWaitMs: acc.humanReview.totalWaitMs, gates: acc.humanReview.gates }
@@ -65,6 +66,8 @@ export function createCumulativeStatsTracker() {
             if (s.costBreakdown) {
                 acc.llmRootMicroUsd += s.costBreakdown.llmRootMicroUsd;
                 acc.compactionMicroUsd += s.costBreakdown.compactionMicroUsd;
+                if (s.costBreakdown.sideCallMicroUsd !== undefined)
+                    acc.sideCallMicroUsd = (acc.sideCallMicroUsd ?? 0) + s.costBreakdown.sideCallMicroUsd;
             }
             if (s.humanReview) {
                 acc.humanReview.count += s.humanReview.count;

package/dist/agents/list-agents-tool.d.ts

@@ -104,6 +104,6 @@ export interface ListAgentsRow {
      *  roster row with no live row. */
     agentState?: AgentState;
 }
-export declare function createListAgentsTool(opts: ListAgentsToolOptions): import("../internal/harness-types.js").AgentTool<Type.TObject<{
+export declare function createListAgentsTool(opts: ListAgentsToolOptions): import("../core/types.js").AgentTool<Type.TObject<{
     includeAll: Type.TOptional<Type.TBoolean>;
 }>, unknown>;

package/dist/agents/read-inbox-tool.d.ts

@@ -17,6 +17,6 @@ export interface ReadInboxToolOptions {
     /** The bound drain's pull face, read LATE (the drain binds after the roster is minted). Absent ⇒ no box. */
     pull: () => ((limit?: number, toolCallId?: string, charBudget?: number) => Promise<PulledInbox>) | undefined;
 }
-export declare function createReadInboxTool(opts: ReadInboxToolOptions): import("../internal/harness-types.js").AgentTool<Type.TObject<{
+export declare function createReadInboxTool(opts: ReadInboxToolOptions): import("../core/types.js").AgentTool<Type.TObject<{
     limit: Type.TOptional<Type.TInteger>;
 }>, unknown>;

package/dist/agents/repair-loop.js

@@ -99,6 +99,7 @@ export async function runRepairLoop(runner, implSpec, config) {
     let ownTokens = 0, ownTurns = 0, ownPrompt = 0, ownTotalInput = 0, ownCached = 0, ownOutput = 0;
     let ownCacheWrite = 0, ownCacheWriteLong = 0, ownCostMicro = 0;
     let ownLlmRootMicro = 0, ownCompactionMicro = 0;
+    let ownSideCallMicro;
     let anyAttemptUnpriced = false;
     let nestedTokens = 0, nestedTurns = 0, nestedTasks = 0, nestedCostMicro = 0;
     let hrCount = 0, hrWaitMs = 0;
@@ -119,6 +120,8 @@ export async function runRepairLoop(runner, implSpec, config) {
         if (s.costBreakdown) {
             ownLlmRootMicro += s.costBreakdown.llmRootMicroUsd;
             ownCompactionMicro += s.costBreakdown.compactionMicroUsd;
+            if (s.costBreakdown.sideCallMicroUsd !== undefined)
+                ownSideCallMicro = (ownSideCallMicro ?? 0) + s.costBreakdown.sideCallMicroUsd;
         }
         if (s.humanReview) {
             hrCount += s.humanReview.count;
@@ -145,6 +148,7 @@ export async function runRepairLoop(runner, implSpec, config) {
         anyLegUnpriced: anyAttemptUnpriced,
         llmRootMicroUsd: ownLlmRootMicro,
         compactionMicroUsd: ownCompactionMicro,
+        ...(ownSideCallMicro !== undefined ? { sideCallMicroUsd: ownSideCallMicro } : {}),
         nested: { tokens: nestedTokens, turns: nestedTurns, tasks: nestedTasks, costMicroUsd: nestedCostMicro },
         humanReview: { count: hrCount, totalWaitMs: hrWaitMs, gates: hrGates },
     });

package/dist/agents/send-message-tool.d.ts

@@ -212,23 +212,18 @@ export interface SendMessageToolOptions {
      *  pair). Absent = unknown ⇒ the phrase is hedged. */
     peerListingMounted?: boolean;
 }
-/** RB-382 — max chars of the `summary` arg (the short recap label, distinct from `message`'s much
- *  larger {@link UPLINK_RESULT_MAX}) before ITS OWN truncation. Exported for direct unit-testing only
- *  (module-internal path, same convention as MONITOR_SPILL_CAP_BYTES — not part of the src/index.ts
- *  public surface): the tool's OWN schema already declares `summary: Type.String({ maxLength: 200 })`,
- *  so a call arriving through the normal `AgentTool.execute` gate (`defineTool`'s `Value.Check`, see
- *  core/tools.ts) can never carry a summary longer than this — the clip below is a defense-in-depth
- *  belt for any caller that reaches this function body without going through that gate, not a live
- *  truncation a model-facing call can trigger today. */
+/** Max chars of the `summary` label (the short recap, distinct from `message`'s much larger
+ *  {@link UPLINK_RESULT_MAX}) before its own truncation. The schema declares NO length bound on the field: a
+ *  longer summary — the model's own, or the first line of a long message taken as the default — reaches the
+ *  executor and is cut there by {@link clipSendMessageSummary}, with the cut disclosed. Exported for direct
+ *  unit-testing only (module-internal path, same convention as MONITOR_SPILL_CAP_BYTES — not part of the
+ *  src/index.ts public surface). */
 export declare const SEND_MESSAGE_SUMMARY_MAX = 200;
-/** RB-382 — clip a trimmed, non-empty `summary` to {@link SEND_MESSAGE_SUMMARY_MAX} chars, appending
- *  the SAME "[… truncated: N chars total]" marker style every `message` truncation site in this file
- *  already uses (the four delivery legs each silently did `slice(0, 200)` with no marker at all — a
- *  double standard against `message`'s disclosed truncation in the same file, at least on paper — see
- *  this constant's own doc comment for why the schema gate makes the branch unreachable in practice
- *  today). The cap itself is unchanged; only the missing disclosure is added. RB-419 then folded those
- *  four re-derivations into a SINGLE call site, immediately after the gate that makes the argument
- *  non-empty — so this helper now has exactly one caller in the tool body. */
+/** Clip a trimmed `summary` to {@link SEND_MESSAGE_SUMMARY_MAX} chars, appending the SAME
+ *  "[… truncated: N chars total]" marker style every `message` truncation site in this file uses. This is
+ *  the live truncation of an over-long summary (see the constant's doc: the schema does not bound it), and
+ *  its one caller in the tool body is the label binding right after the argument is read. The cut keeps
+ *  whole code points — a pair straddling the bound is dropped whole, never halved. */
 export declare function clipSendMessageSummary(raw: string): string;
 /**
  * design/276 (direct-mount guidance): the engine's first-party auto-mount declares this tool's safety

package/dist/agents/send-message-tool.js

@@ -18,6 +18,7 @@ import { appendHopToken, judgePeerAdmission, peerAxisToken, resolvePeerLaneConfi
 import { toolFace } from "../core/tool-catalog-entries.js";
 import { thrownText } from "../core/thrown-value.js";
 import { assertNoRetiredKeys } from "../core/retired-keys.js";
+import { sliceHeadSafe } from "../core/surrogate-safe-slice.js";
 import { clampValuesOf } from "../core/child-clamp-seats.js";
 import { resolveSubagentTranscriptTier } from "../core/wiring-manifest.js";
 export const SEND_MESSAGE_TOOL_NAME = "SendMessage";
@@ -35,9 +36,13 @@ function assertNoRetiredSendMessageOptions(opts) {
 }
 export function clipSendMessageSummary(raw) {
     return raw.length > SEND_MESSAGE_SUMMARY_MAX
-        ? `${raw.slice(0, SEND_MESSAGE_SUMMARY_MAX)} [summary truncated: ${raw.length} chars total]`
+        ? `${sliceHeadSafe(raw, SEND_MESSAGE_SUMMARY_MAX)} [summary truncated: ${raw.length} chars total]`
         : raw;
 }
+function defaultSendMessageSummary(message) {
+    const nl = message.indexOf("\n");
+    return (nl === -1 ? message : message.slice(0, nl)).trim();
+}
 const TEAMMATE_MESSAGE_TAG = "teammate-message";
 function frameTeammateMessage(args) {
     const summaryAttr = args.summary !== undefined ? ` summary="${escapeAttributeValue(args.summary)}"` : "";
@@ -88,7 +93,9 @@ export function createSendMessageTool(opts) {
     const baseParameters = Type.Object({
         to: Type.String({ description: 'Recipient: the agent\'s name, or its task_id (a…) returned by the Agent tool with run_in_background. "main" is reserved for the spawning conversation.' }),
         message: Type.String({ description: "The follow-up request. The agent continues from its full prior context." }),
-        summary: Type.Optional(Type.String({ maxLength: 200, description: "A 5-10 word summary shown as a preview in the UI (required when message is a string)" })),
+        summary: Type.Optional(Type.String({
+            description: `A 5-10 word summary shown as a one-line preview in the UI. Defaults to the first line of a plain-text message; longer summaries are truncated to ${SEND_MESSAGE_SUMMARY_MAX} characters rather than rejected.`,
+        })),
     });
     const sendMessageParameters = peerLane.active
         ? Type.Object({ ...baseParameters.properties, message: Type.Optional(Type.String({ description: `${baseParameters.properties.message.description ?? ""} Optional only for a pure notify_when_idle subscription.`.trim() })), ...notifyWhenIdleParameter })
@@ -208,14 +215,7 @@ export function createSendMessageTool(opts) {
                 };
             }
             const summaryArg = typeof a.summary === "string" ? a.summary.trim() : "";
-            if (summaryArg === "" && message !== "") {
-                return {
-                    content: "Message not sent: summary is required when message is a string — pass a 5-10 word summary of the follow-up.",
-                    details: { error: "summary_required", to },
-                    isError: true,
-                };
-            }
-            const summary = clipSendMessageSummary(summaryArg);
+            const summary = clipSendMessageSummary(summaryArg !== "" ? summaryArg : defaultSendMessageSummary(message));
             const senderId = ctx.taskId ?? opts.owner;
             const [parentTaskId, parentSessionId] = ctx.parentTaskId !== undefined ? [ctx.parentTaskId, ctx.parentSessionId] : [opts.parentTaskId, opts.parentSessionId];
             const senderName = ctx.spawnedAgentName ?? opts.senderName;
@@ -1103,9 +1103,7 @@ export function createAgentContinuationVerb(opts) {
                 return enriched;
             },
         });
-        const summaryRaw = (o?.summary ?? content).replace(/\s+/g, " ").trim().slice(0, 200);
-        const summary = summaryRaw === "" ? "operator follow-up" : summaryRaw;
-        const out = await tool.execute(`op-${uuidv7()}`, { to: handle, message: content, summary });
+        const out = await tool.execute(`op-${uuidv7()}`, { to: handle, message: content, ...(o?.summary !== undefined ? { summary: o.summary } : {}) });
         const text = out.content
             .filter((c) => c.type === "text")
             .map((c) => c.text)

package/dist/agents/subagent.js

@@ -1,6 +1,7 @@
 import { Type } from "typebox";
 import { isAbsolute } from "node:path";
 import { backgroundChildTerminal } from "../core/delegation-frames.js";
+import { bindDelegationName } from "../core/delegation-name.js";
 import { resumeStartupCauseOf } from "../core/resume-startup-cause.js";
 import { errorCodeOf } from "../core/runner/terminal-account.js";
 import { applyParentSpecSeat, memoryTurnedOff, parentSpecSeatOfCtx } from "../core/parent-spec-seat.js";
@@ -1358,7 +1359,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
         ...(forkOffered ? [{ name: FORK_SUBAGENT_TYPE, ...(depthPermitsNesting ? { canRedelegate: true } : {}) }] : []),
     ];
     const agentToolPool = delegationPoolFace(opts.tools ?? opts.inheritedTools ?? [], opts.extraTools !== undefined, opts.extraToolNames);
-    return {
+    return bindDelegationName(delegationToolName, {
         name: opts.name ?? DEFAULT_SUBAGENT_TOOL_NAME,
         ...toolFace("agent"),
         agentListing,
@@ -1813,7 +1814,8 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
             }
             const governingLists = def !== undefined ? { allow: def.allowTools, deny: def.denyTools } : { allow: opts.allowTools, deny: opts.denyTools };
             const childOwnLayer = Object.freeze({ ...(governingLists.allow != null ? { allow: Object.freeze([...governingLists.allow]) } : {}), deny: Object.freeze([...(governingLists.deny ?? [])]) });
-            const childListsJudged = toolListsDigest(childOwnLayer.allow, childOwnLayer.deny);
+            const childListsDigest = toolListsDigest(childOwnLayer.allow, childOwnLayer.deny);
+            const childListsJudged = agentToolPool !== undefined ? childListsDigest : undefined;
             const childCeiling = ctx.toolSelector?.layers ?? [];
             const parentMcp = opts.tools === undefined && extraToolsNote === undefined ? ctx.mountedMcp?.() : undefined;
             const childMcp = parentMcp !== undefined ? inheritedMcpDeclarations(parentMcp, compileToolSelector([...childCeiling, childOwnLayer])) : undefined;
@@ -2079,7 +2081,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                 : undefined;
             const childInternals = {
                 ...(ctx.toolSelector !== undefined ? { toolCeiling: childCeiling, ...(childListsJudged !== undefined ? { toolListsJudged: childListsJudged } : {}) } : {}),
-                ownToolListsWhere: delegationListWhere(toolName, def?.name),
+                ...(childListsDigest !== undefined ? { ownToolLists: { toolName, ...(def !== undefined ? { definition: def.name } : {}), lists: childListsDigest } } : {}),
                 ...(parentMcp?.pool !== undefined && childMcp !== undefined && childMcp.length > 0 ? { mcpPool: parentMcp.pool } : {}),
                 ...(childPick.modelRef !== undefined ? { inheritedModelRef: childPick.modelRef } : {}),
                 ...(inheritedSkillGrants.length > 0 ? { inheritedSkillGrants } : {}),
@@ -3853,5 +3855,5 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                 }),
             };
         },
-    };
+    });
 }

package/dist/agents/tool-filter.d.ts

@@ -9,30 +9,36 @@ import { type ToolNameListReading } from "../core/tool-name-list.js";
  * root run (`TaskSpec.allowTools` / `TaskSpec.excludeTools`) and every child (its definition's lists, under the ceiling of the
  * run that spawned it), so there is no spawn-time filter and no complement anywhere.
  *
- *  - an allowed list absent, or holding `"*"`, sets no allowlist on its layer; otherwise the layer keeps only what it names
+ *  - an allowed list absent, or holding `"*"` (any spelling the rule syntax reads as it: `*()`, `*(*)`), sets no allowlist on
+ *    its layer; otherwise the layer keeps only what it names
  *    (`[]` keeps nothing — intentional, not a mistake);
  *  - a denied list removes what it names from whatever remains (a denied tool always loses);
  *  - a layer above a run (its ceiling) bounds it: a child's `"*"` never widens what its parent could use.
  *
- * An entry is read as the reference reads a rule string ({@link readDeniedEntry}: `Tool(content)` names `Tool`, the content is
- * not read, the whole tool is hidden); a protocol spelling (`mcp__srv`, `mcp__srv__*`, a glob over the tool segment) reaches the
+ * An entry is read by the rule syntax ({@link readDeniedEntry}: `Tool(content)` names `Tool`, the content is not read, the
+ * whole tool is hidden; an entry the syntax cannot read names no tool); a protocol spelling (`mcp__srv`, `mcp__srv__*`, a glob over the tool segment) reaches the
  * tools of that peer, including ones it lists later; an entry no tool answers to is kept by name and reaches one mounted later.
  * Judged at the prepare that receives it: a spelling no tool name can have is refused, an unknown name told (`sub-agent-deny-lists.ts`).
  *
- * Note: `"*"` in an allowed list is the "allow all" sentinel, so a tool literally NAMED `"*"` cannot be
- * the sole allowed tool via this path (tool names are conventionally identifiers, so this is moot).
+ * `"*"` in an allowed list is the "allow all" sentinel and never a name: no tool is named `*` (the caller tool name
+ * contract, `caller-tool-name.ts`, refuses it at the mount; engine and protocol-minted names never are).
  */
 /**
- * How ONE denied-tools entry is read — the reference reads each as a rule string, without trimming: `Tool(content)` names
- * `Tool` (the content is dropped, so the whole tool is hidden), `Tool()` and `Tool(*)` are the bare name, and anything else
- * — a malformed paren form, an entry with surrounding whitespace — is the whole string, which names no tool. A value that is
- * not a string (a list a host read from a file can hold anything) names no tool either: it reads as `not_a_string` with a
- * fixed label of its TYPE, and nothing about the value is read, converted or printed — `typeof` and the array test only.
+ * How ONE denied-tools entry is read — by the rule syntax's own test of a rule spelling (`ruleSpellingOf`, the one every entry
+ * list's reader asks), exactly as written: `Tool(content)` names `Tool` (the content is not read here, so the whole tool is
+ * hidden), `Tool()` and `Tool(*)` are the bare name. An entry the syntax cannot read — surrounding whitespace, a tool name
+ * outside its spelling (a blank or an invisible character before the `(`, a leading `-`), a parenthesis that does not close
+ * the entry — names no tool: `unreadable`, the entry as written. A value that is not a string (a list a host read from a file
+ * can hold anything) names no tool either: it reads as `not_a_string` with a fixed label of its TYPE, and nothing about the
+ * value is read, converted or printed — `typeof` and the array test only.
  */
 export type DeniedEntryReading = {
     readonly kind: "name";
     readonly name: string;
     readonly content: boolean;
+} | {
+    readonly kind: "unreadable";
+    readonly entry: string;
 } | {
     readonly kind: "not_a_string";
     readonly type: string;
@@ -79,13 +85,31 @@ export interface ToolNameListReach {
     readonly covering: readonly string[];
     readonly wholeProtocols: ReadonlySet<ProtocolId>;
 }
+/**
+ * The tool ONE entry of a list on `side` reaches ({@link readDeniedEntry}) — the one per-entry reading every list reader takes:
+ * `Tool()` / `Tool(*)` are the bare `Tool` (`*()` / `*(*)` the wildcard `*`); a denied `Tool(content)` hides the whole `Tool`;
+ * an allowed one, an unreadable entry or a non-string reaches nothing (`undefined`).
+ */
+export declare function toolNameOfEntry(entry: unknown, side: ToolNameListSide): string | undefined;
+/**
+ * Is this entry a bare tool name as the rule syntax reads it, written as such (`Read`, `mcp__srv__*`, `*`; never `Read()`,
+ * `Read(*)`, `Read(x)`, an unreadable spelling or a non-string)? The one form a checkpoint row records and is read back in.
+ */
+export declare function isCanonicalToolName(entry: unknown): boolean;
+/**
+ * A tool-name list as a checkpoint row records it: each entry as {@link toolNameOfEntry} reads it, in canonical spelling, an
+ * allowed entry that admits nothing left out — the copy reaches what the list reached, in the spelling a reader accepts
+ * ({@link isCanonicalToolName}). An unreadable entry stays as written: prepare refuses it before the park, the reader again.
+ */
+export declare function persistedToolNameList(entries: readonly string[], side: ToolNameListSide): string[];
 /**
  * What an allowed-tools value admits, or `undefined` when it names no allowlist: absent, `null`, or a list holding the
- * wildcard. A list admits its string entries (an entry that is not a string admits nothing); a value that is not a list admits
- * NOTHING — the judge before the run refuses it, and a reader that meets it first fails closed.
+ * wildcard — an entry {@link toolNameOfEntry} reads as `*` (`*`, `*()`, `*(*)`). A list admits its string entries (an entry that
+ * is not a string admits nothing); a value that is not a list admits NOTHING — the judge before the run refuses it, and a
+ * reader that meets it first fails closed.
  */
 export declare function readAllowedToolList(allowTools: unknown): ToolNameListReach | undefined;
-/** What a denied value hides: its string entries read as {@link readDeniedEntry} reads them (an entry that is not a string, or a value that is not a list, hides nothing). */
+/** What a denied value hides: its string entries read as {@link readDeniedEntry} reads them (an entry it reads as `unreadable` or not a string, or a value that is not a list, hides nothing here — the judgment before the run refuses each). */
 export declare function readDeniedToolList(denyTools: unknown): ToolNameListReach;
 /** Does the list reach this tool — through its wire name, any alias it declares, or a protocol spelling that covers it? The one matcher. */
 export declare function listReaches(reach: ToolNameListReach, tool: {
@@ -99,6 +123,9 @@ type UniverseTool = {
 };
 /** The wire names a leg of these kinds relies on (the catalog's protocol column). */
 export declare function protocolToolNames(legs: readonly ToolLegKind[]): string[];
+/** Is this value a layer — an object (not a list) with the two lists `allow` / `deny`? One that is not admits NOTHING here;
+ *  the judge before the run (`judgeRunToolLists`) refuses it, and a reader that meets it first fails closed. */
+export declare function isToolSelectorLayer(layer: unknown): layer is ToolSelectorLayer;
 /**
  * Compile ONE run's tool selector from its layers (the ceiling it was spawned under, then its own lists — the LAST layer is its own)
  * and the kinds of leg it is. Each list is read by the one reading ({@link readAllowedToolList} / {@link readDeniedToolList}) and

package/dist/agents/tool-filter.js

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import { canonicalize, UNCANONICALIZABLE } from "../core/canonical-json.js";
-import { parsePermissionRule } from "../core/permission-rule-syntax.js";
+import { ruleSpellingOf } from "../core/permission-rule-syntax.js";
 import { TOOL_CATALOG_ENTRIES } from "../core/tool-catalog-entries.js";
 import { isNamespacedCoveringRuleName, namespacedRuleNameCovers } from "../core/namespaced-rule-name.js";
 import { protocolOf } from "../core/protocol-table.js";
@@ -9,9 +9,9 @@ import { readToolNameList, snapshotToolNameList, valueTypeLabel } from "../core/
 export function readDeniedEntry(entry) {
     if (typeof entry !== "string")
         return { kind: "not_a_string", type: valueTypeLabel(entry) };
-    if (entry !== entry.trim())
-        return { kind: "name", name: entry, content: false };
-    const parsed = parsePermissionRule(entry);
+    const parsed = ruleSpellingOf(entry);
+    if (parsed === undefined)
+        return { kind: "unreadable", entry };
     return { kind: "name", name: parsed.toolName, content: parsed.ruleContent !== undefined };
 }
 const LIST_NOUN = { allowed: "allowed tools", denied: "denied tools" };
@@ -52,18 +52,28 @@ export function snapshotDefinitionLists(def) {
         copy.denyTools = snapshotToolNameList(copy.denyTools);
     return copy;
 }
+export function toolNameOfEntry(entry, side) {
+    const read = readDeniedEntry(entry);
+    return read.kind === "name" && (side === "denied" || !read.content) ? read.name : undefined;
+}
+export function isCanonicalToolName(entry) {
+    const read = readDeniedEntry(entry);
+    return read.kind === "name" && !read.content && read.name === entry;
+}
+export function persistedToolNameList(entries, side) {
+    return entries.flatMap((entry) => {
+        const name = toolNameOfEntry(entry, side);
+        if (name !== undefined)
+            return [name];
+        return readDeniedEntry(entry).kind === "name" ? [] : [entry];
+    });
+}
 function reachOf(entries, side) {
     const names = new Set();
     const covering = [];
     const wholeProtocols = new Set();
     for (const entry of entries) {
-        let name;
-        if (side === "denied") {
-            const read = readDeniedEntry(entry);
-            name = read.kind === "name" ? read.name : undefined;
-        }
-        else
-            name = typeof entry === "string" ? entry : undefined;
+        const name = toolNameOfEntry(entry, side);
         if (name === undefined)
             continue;
         const split = splitNamespacedName(name);
@@ -85,7 +95,7 @@ export function readAllowedToolList(allowTools) {
     const list = readToolNameList(allowTools);
     if (list.kind !== "entries")
         return reachOf([], "allowed");
-    if (list.entries.includes("*"))
+    if (list.entries.some((entry) => toolNameOfEntry(entry, "allowed") === "*"))
         return undefined;
     return reachOf(list.entries, "allowed");
 }
@@ -129,9 +139,13 @@ function reachCoversPeer(reach, peer) {
         return split !== undefined && split.ns.id === peer.ns && split.peer === peer.peer && (split.tool === undefined || split.tool === "*");
     });
 }
+export function isToolSelectorLayer(layer) {
+    return typeof layer === "object" && layer !== null && !Array.isArray(layer);
+}
+const NO_TOOL_LAYER = Object.freeze({ allow: reachOf([], "allowed"), deny: reachOf([], "denied") });
 export function compileToolSelector(layers, legs = []) {
     const kept = Object.freeze([...layers]);
-    const compiled = kept.map((l) => ({ allow: readAllowedToolList(l.allow), deny: readDeniedToolList(l.deny) }));
+    const compiled = kept.map((l) => (isToolSelectorLayer(l) ? { allow: readAllowedToolList(l.allow), deny: readDeniedToolList(l.deny) } : NO_TOOL_LAYER));
     const admittedBy = (ls, tool) => ls.every((l) => (l.allow === undefined || listReaches(l.allow, tool)) && !listReaches(l.deny, tool));
     const protocol = new Map(PROTOCOL_ROWS.filter((r) => r.legs.some((l) => legs.includes(l))).map((r) => [r.name, r.underCeiling]));
     return Object.freeze({
@@ -154,7 +168,7 @@ export function compileToolSelector(layers, legs = []) {
     });
 }
 export function deniedProtocolTools(layers, legs) {
-    const denies = layers.map((l) => readDeniedToolList(l.deny));
+    const denies = layers.map((l) => readDeniedToolList(isToolSelectorLayer(l) ? l.deny : undefined));
     const own = denies.slice(-1);
     const inherited = denies.slice(0, -1);
     const hits = new Map();

package/dist/bench/metrics.d.ts

@@ -158,6 +158,7 @@ export interface CoreStatsSubset {
         nestedSubagentMicroUsd: number;
         memoryConsolidationMicroUsd: number;
         compactionMicroUsd: number;
+        sideCallMicroUsd?: number;
     };
     nested?: {
         costMicroUsd?: number;

package/dist/brain/anthropic.js

@@ -6,8 +6,8 @@ import { STREAM_TORN_WARNING, createRepetitionPoll, createStreamEndLedger, model
 import { admitToolCallId, providerResultIds, providerToolCallId, responseToolCallIds } from "./tool-call-id.js";
 import { emitBrainTelemetry, reportReasoningWireFacts } from "./status-sink.js";
 import { errorResultMediaNote, IMAGE_OMITTED_NO_VISION, modelSupportsVision, sendableImages } from "./media-degrade.js";
-import { ANTHROPIC_RESERVED, OUTPUT_CAP_KEYS, applyExtraBody, effectiveOutputCap, lockHeader, mergeHeaders, takeHeaderCasefold } from "./request-params.js";
-import { adjudicateModelRoute, applyRouteCredentialHeaders, assertServableRequestRoot, brainConfigSnapshot, createBrainRouteJudge, joinRequestUrl, resolveRequestRootOf, resolveRouteCredential, routeRefusalText } from "./route-adjudicator.js";
+import { ANTHROPIC_RESERVED, OUTPUT_CAP_KEYS, applyExtraBody, effectiveOutputCap, headerBagOnce, lockHeader, mergeHeaders, takeHeaderCasefold } from "./request-params.js";
+import { admitRouteRequest, applyRouteCredentialHeaders, assertServableRequestRoot, brainConfigSnapshot, createBrainRouteJudge, joinRequestUrl, resolveRequestRootOf, resolveRouteCredential } from "./route-adjudicator.js";
 import { requestRouteOf } from "./request-route.js";
 import { MIN_THINKING_TOKENS, budgetCapSkipsThinking, declaredEffortLevels, reasoningBudgetShare, reasoningRequestCarried, resolveEffort } from "./reasoning.js";
 import { runStreamingBrain } from "./stream-engine.js";
@@ -227,6 +227,7 @@ function closeToolUseBlock(acc, responseIds, closed) {
     return acc.closedTc;
 }
 const ANTHROPIC_LANE_DEFAULT = "https://api.anthropic.com";
+const ANTHROPIC_KEY_HEADER = "x-api-key";
 export function createAnthropicBrain(given = {}) {
     const config = brainConfigSnapshot(given, "createAnthropicBrain config");
     assertServableRequestRoot(config.baseUrl, "config.baseUrl");
@@ -246,17 +247,19 @@ export function createAnthropicBrain(given = {}) {
             maxRetries: options?.maxRetries,
             stallTimeouts: options?.stallTimeouts,
             buildRequest: (overrides) => {
-                const { root, origin: rootOrigin } = resolveRequestRootOf(model.baseUrl, config.baseUrl, ANTHROPIC_LANE_DEFAULT);
+                const routed = { id: model.id, baseUrl: model.baseUrl };
+                const { root, origin: rootOrigin } = resolveRequestRootOf(routed.baseUrl, config.baseUrl, ANTHROPIC_LANE_DEFAULT);
+                const modelHeaders = headerBagOnce(model.headers);
+                const optionsHeaders = headerBagOnce(options?.headers);
                 const routeCredential = resolveRouteCredential({
                     optionsApiKey: options?.apiKey,
-                    optionsHeaders: options?.headers,
-                    modelHeaders: model.headers,
+                    optionsHeaders,
+                    modelHeaders,
                     configApiKey: config.apiKey,
                     configHeaders: config.headers,
+                    keyHeader: ANTHROPIC_KEY_HEADER,
                 });
-                const routeVerdict = adjudicateModelRoute(model, routeCredential, { baseUrl: config.baseUrl, laneDefault: ANTHROPIC_LANE_DEFAULT });
-                if (!routeVerdict.ok)
-                    throw new BrainError("invalid_request", routeRefusalText(routeVerdict));
+                const routeAdmission = admitRouteRequest(routed, routeCredential, { baseUrl: config.baseUrl, laneDefault: ANTHROPIC_LANE_DEFAULT });
                 const apiKey = routeCredential.apiKey;
                 const nonEmptyBlocks = context.systemBlocks?.filter((b) => b.text.length > 0);
                 const system = nonEmptyBlocks?.length
@@ -329,8 +332,8 @@ export function createAnthropicBrain(given = {}) {
                 if (anthCompat.interleavedThinking) {
                     betas.push("interleaved-thinking-2025-05-14");
                 }
-                const headers = mergeHeaders(model.headers, config.headers, options?.headers);
-                applyRouteCredentialHeaders(headers, routeCredential, { model: model.headers, options: options?.headers });
+                const headers = mergeHeaders(modelHeaders, config.headers, optionsHeaders);
+                applyRouteCredentialHeaders(headers, routeCredential);
                 if (betas.length > 0) {
                     const existing = (takeHeaderCasefold(headers, "anthropic-beta") ?? "").split(",").map((b) => b.trim()).filter(Boolean);
                     for (const beta of betas) {
@@ -342,7 +345,7 @@ export function createAnthropicBrain(given = {}) {
                 lockHeader(headers, "content-type", "application/json");
                 lockHeader(headers, "anthropic-version", config.version ?? "2023-06-01");
                 if (apiKey)
-                    headers["x-api-key"] = apiKey;
+                    lockHeader(headers, ANTHROPIC_KEY_HEADER, apiKey);
                 const builtThinkingRequested = body.thinking !== undefined;
                 const builtMaxTokens = body.max_tokens;
                 const builtMaxTokensLane = overrides?.maxOutputTokens !== undefined
@@ -362,6 +365,7 @@ export function createAnthropicBrain(given = {}) {
                     outputCapTokens: effectiveOutputCap(wire, OUTPUT_CAP_KEYS.anthropic),
                     capDerivedPaths: [...OUTPUT_CAP_KEYS.anthropic, "thinking.budget_tokens"],
                     onCommitted: () => {
+                        routeAdmission();
                         thinkingRequested = builtThinkingRequested;
                         sentMaxTokens = builtMaxTokens;
                         sentMaxTokensLane = builtMaxTokensLane;
@@ -768,5 +772,5 @@ export function createAnthropicBrain(given = {}) {
             },
         });
     };
-    return { stream, adjudicateRoute: createBrainRouteJudge({ ...config, laneDefault: ANTHROPIC_LANE_DEFAULT }) };
+    return { stream, adjudicateRoute: createBrainRouteJudge({ ...config, laneDefault: ANTHROPIC_LANE_DEFAULT, keyHeader: ANTHROPIC_KEY_HEADER }) };
 }

package/dist/brain/model-presets.d.ts

@@ -20,12 +20,11 @@ import type { AnthropicMessagesCompat, Model } from "../internal/llm.js";
  */
 export declare const FABLE_5_COMPAT: AnthropicMessagesCompat;
 /**
- * Fable-5 behavioral guidance (CC 2.1.198 `fable_5_mitigations` — Anthropic's own runtime patches
- * for this model class's known behavior pitfalls, adapted; design/119 S3). Carried on the Model as
- * `promptGuidance` DATA — the injection mechanism (`Model.promptGuidance` → system-prompt tail) is
- * generic and model-name-free.
+ * The fable lines the classic prompt shape serves. They are prompt text, so they live with the prompt
+ * text; this name stays exported for hosts that read them. The preset below no longer carries them as
+ * `promptGuidance`: the prompt composes them itself, once, where they are the only fable text.
  */
-export declare const FABLE_5_PROMPT_GUIDANCE: string[];
+export declare const FABLE_5_PROMPT_GUIDANCE: readonly string[];
 /**
  * A ready-to-use `claude-fable-5` {@link Model} (CC 2.1.198 registry facts: 1M-token native context
  * window, 64k default max output — the 128k tier is opt-in via `maxTokens` override, knowledge

package/dist/brain/model-presets.js

@@ -1,12 +1,13 @@
+import { catalogText } from "../prompt-assembly/catalog/index.js";
 export const FABLE_5_COMPAT = {
     thinkingMode: "adaptive",
     effortLevels: ["low", "medium", "high", "xhigh", "max"],
     supportsTemperature: false,
 };
 export const FABLE_5_PROMPT_GUIDANCE = [
-    "Your final message of a turn is the only text the caller is guaranteed to read. Put every conclusion, answer, and deliverable in it — lead with the outcome, then supporting detail. Never leave a result only in an intermediate message or in your reasoning.",
-    "When operating autonomously: before ending your turn, check that the task is actually complete (not just planned); before any state-changing action, re-verify that the evidence supports that specific action rather than pattern-matching a familiar case.",
-    "When calling tools, provide exactly ONE complete JSON value per parameter — never concatenate multiple values, never truncate, never wrap a value in commentary.",
+    catalogText("core/behavior.fable-classic.final-message"),
+    catalogText("core/behavior.fable-classic.autonomy"),
+    catalogText("core/behavior.fable-classic.tool-json"),
 ];
 export function fable5Model(overrides = {}) {
     return {
@@ -23,7 +24,6 @@ export function fable5Model(overrides = {}) {
         maxTokens: 64_000,
         charsPerToken: 3,
         compat: { ...FABLE_5_COMPAT },
-        promptGuidance: [...FABLE_5_PROMPT_GUIDANCE],
         ...overrides,
     };
 }