@sema-agent/core 7.51.2 → 7.52.0

package/dist/core/runner/sub-agent-deny-lists.js

@@ -1,11 +1,63 @@
-import { deniedProtocolTools, delegationListWhere, listReaches, notAListSentence, toolListsDigest, notAStringSentence, readAllowedToolList, readDeniedEntry, readDeniedToolList } from "../../agents/tool-filter.js";
+import { compileToolSelector, deniedProtocolTools, delegationListWhere, isCanonicalToolName, isToolSelectorLayer, listReaches, notAListSentence, toolListsDigest, notAStringSentence, readAllowedToolList, readDeniedEntry, readDeniedToolList } from "../../agents/tool-filter.js";
 import { readToolNameList, valueTypeLabel } from "../tool-name-list.js";
-import { compileAllowList, inertEntryPhrase, renderListEntry } from "../allow-entry.js";
+import { compileAllowList, inertEntryPhrase, renderListEntry, rootFacingToolNames } from "../allow-entry.js";
 import { inlineUntrusted } from "../untrusted-text.js";
 import { ENGINE_TOOLS } from "../tool-catalog-entries.js";
+import { callerToolNameProblem } from "../caller-tool-name.js";
 import { mintNamespacePrefix } from "../protocol-naming.js";
 import { PROTOCOL_TABLE, protocolOf } from "../protocol-table.js";
-import { splitNamespacedName } from "../tool-name-aliases.js";
+import { mountedToolNames, splitNamespacedName } from "../tool-name-aliases.js";
+import { projectionToolNames } from "../tool-policy.js";
+import { declaredDelegationNameOf } from "../delegation-name.js";
+export function renamedDelegationMountSentence(...rosters) {
+    for (const tools of rosters) {
+        if (!Array.isArray(tools))
+            continue;
+        for (const t of tools) {
+            const declared = declaredDelegationNameOf(t);
+            if (declared === undefined)
+                continue;
+            try {
+                const mounted = t.name;
+                if (declared === mounted)
+                    continue;
+                return `The delegation tool declared as "${inlineUntrusted(declared, 80)}" is mounted under the name "${inlineUntrusted(String(mounted), 80)}": one tool would answer to two names (the agent definitions' tool lists, the copy a child is handed and the tool's prompt text speak the declared one; the roster and the model's call speak the mounted one). Mount it under its declared name, or declare the name you mount it under (\`createSubagentTool({ name })\`).`;
+            }
+            catch {
+            }
+        }
+    }
+    return undefined;
+}
+export function refuseRenamedDelegationMounts(...rosters) {
+    const sentence = renamedDelegationMountSentence(...rosters);
+    if (sentence !== undefined)
+        throw refused(sentence, "config.tool_face_control", "renamed_mount");
+}
+function poolOf(tools) {
+    return { tools, names: mountedToolNames([...tools.map((t) => ({ name: t.name })), ...tools.flatMap((t) => t.agentToolPool ?? [])]), complete: tools.every((t) => t.agentToolPool !== undefined) };
+}
+export function delegationPoolReading(callerTools, selector) {
+    return poolOf(callerTools.filter((t) => t.agentToolFaces !== undefined && selector.admits(t)));
+}
+function peersOf(known, declaredPeers) {
+    const peers = new Set(PROTOCOL_TABLE.flatMap((ns) => (declaredPeers[ns.id] ?? []).map((p) => mintNamespacePrefix(ns, p.name))));
+    for (const name of known) {
+        const ns = protocolOf(name);
+        const split = ns !== undefined ? splitNamespacedName(name) : undefined;
+        if (split !== undefined && split.peer !== "")
+            peers.add(mintNamespacePrefix(split.ns, split.peer));
+    }
+    return peers;
+}
+function rootFacingUniverse(mounted, pool, declaredPeers) {
+    const known = rootFacingToolNames([...mounted, ...pool.names]);
+    return { known, peers: peersOf(known, declaredPeers), complete: true, carrierOf: (name) => (mounted.has(name) ? "run" : pool.names.has(name) ? "pool" : "catalog") };
+}
+function childFacingUniverse(pool, declaredPeers) {
+    const known = new Set([...mountedToolNames(ENGINE_TOOLS), ...pool.names]);
+    return { known, peers: peersOf(known, declaredPeers), complete: pool.complete, carrierOf: (name) => (pool.names.has(name) ? "pool" : "catalog") };
+}
 const DENY_LIST_NAMES_ONLY = "To block by path or command, write a deny rule in the caller's permission policy: a tool-name list only takes tool names (it narrows which tools are mounted).";
 function universeCarries(reach, entry, universe) {
     for (const name of universe.known)
@@ -23,34 +75,46 @@ function refused(message, code, reason) {
     return e;
 }
 const LIST_WORD = { allowed: "allowed tools", denied: "denied tools" };
+const NEAR_MISS_EFFECT = {
+    allowed: "it admits nothing, so the tool it was written for is not granted",
+    denied: "it hides nothing, so the tool it was written for stays available to the agent",
+};
+function nearMissRefusal(where, side, flaw, code) {
+    return refused(`${where} declares tool ${inertEntryPhrase(flaw)} in its ${LIST_WORD[side]}, a spelling that reaches no tool a run mounts — ${NEAR_MISS_EFFECT[side]}. Write the name as the tool is mounted.`, code, "near_miss");
+}
 function grammarRefusal(where, side, flaw, code) {
     return refused(`${where} declares tool ${inertEntryPhrase(flaw)} in its ${LIST_WORD[side]}, a spelling no tool name can have — fix the entry. ${DENY_LIST_NAMES_ONLY}`, code, "unknown_name");
 }
+function readableToolNameList(where, side, value, code) {
+    if (value === undefined || value === null)
+        return [];
+    const list = readToolNameList(value);
+    if (list.kind !== "entries")
+        throw refused(notAListSentence(where, side, list), code, "not_a_list");
+    return list.entries.map((entry, index) => {
+        const read = readDeniedEntry(entry);
+        if (read.kind === "not_a_string")
+            throw refused(notAStringSentence(where, side, index, read.type), code, "not_a_string");
+        if (read.kind === "unreadable")
+            throw grammarRefusal(where, side, { entry: read.entry, reason: "grammar" }, code);
+        if (side === "denied" && read.name === "*") {
+            throw refused(`${where} declares ${renderListEntry(entry)} in its ${LIST_WORD[side]}: a denied list has no wildcard — the entry would hide nothing. To give the agent no tools, write an empty allowed list.`, code, "unsupported_pattern");
+        }
+        return { entry: entry, name: read.name, content: read.content };
+    });
+}
 const KEPT_ENTRY = {
     allowed: "it grants nothing today and stays in force for a tool of that name mounted later",
     denied: "it denies nothing today and stays in force for a tool of that name mounted later",
 };
+const KEPT_ENTRY_UNLISTED_POOL = "so it is kept here: the pool this delegation tool hands its child cannot be listed, and the spawned child judges the entry against its own roster (another spelling of a tool it carries refuses the child before it starts; an exact name takes effect; a name nothing answers to there stays in force for a tool of that name mounted later)";
 const PEER_WORD = { mcp: "MCP server", a2a: "A2A peer" };
 function judgeToolNameList(where, side, value, universe, advise, code) {
-    if (value === undefined || value === null)
-        return;
-    const list = readToolNameList(value);
-    if (list.kind !== "entries")
-        throw refused(notAListSentence(where, side, list), code, "not_a_list");
-    let index = -1;
-    for (const entry of list.entries) {
-        index += 1;
-        if (typeof entry !== "string")
-            throw refused(notAStringSentence(where, side, index, valueTypeLabel(entry)), code, "not_a_string");
-        if (entry === "*") {
-            if (side === "allowed")
-                continue;
-            throw refused(`${where} declares "*" in its ${LIST_WORD[side]}: a denied list has no wildcard — the entry would hide nothing. To give the agent no tools, write an empty allowed list.`, code, "unsupported_pattern");
-        }
-        const read = readDeniedEntry(entry);
-        const toolName = read.kind === "name" ? read.name : entry;
-        const name = side === "denied" ? toolName : entry;
-        const content = side === "denied" && read.kind === "name" && read.content;
+    for (const { entry, name: toolName, content: written } of readableToolNameList(where, side, value, code)) {
+        if (toolName === "*" && !written)
+            continue;
+        const name = side === "denied" || !written ? toolName : entry;
+        const content = side === "denied" && written;
         const reach = side === "denied" ? readDeniedToolList([entry]) : (readAllowedToolList([entry]) ?? readDeniedToolList([]));
         const split = splitNamespacedName(name);
         if (split !== undefined && split.peer === "*" && split.tool === undefined) {
@@ -59,9 +123,9 @@ function judgeToolNameList(where, side, value, universe, advise, code) {
             throw refused(`${where} declares ${renderListEntry(entry)} in its ${LIST_WORD[side]}: an allowed list has no protocol-wide form — name a peer (\`${split.ns.prefix}<peer>\`) or its tools.`, code, "unsupported_pattern");
         }
         const { inert } = compileAllowList([toolName], "deny", universe.known);
-        const flaw = inert[0] === undefined ? undefined : { ...inert[0], entry };
-        if (flaw !== undefined && flaw.reason === "grammar")
-            throw grammarRefusal(where, side, flaw, code);
+        const flaw = inert[0] === undefined ? undefined : { ...inert[0], entry, ...(inert[0].reason === "near_miss" && inert[0].currentName !== undefined ? { carriedBy: universe.carrierOf(inert[0].currentName) } : {}) };
+        if (universe.complete && flaw?.currentName !== undefined)
+            throw nearMissRefusal(where, side, flaw, code);
         if (toolName !== name) {
             advise(new Error(`${where} declares ${renderListEntry(entry)} in its allowed tools: an allowed list names tools, not content, so this entry grants nothing — name the tool "${inlineUntrusted(toolName, 80)}" to grant it, or move the content rule to a denied list or a permission rule.`));
             continue;
@@ -73,29 +137,117 @@ function judgeToolNameList(where, side, value, universe, advise, code) {
         }
         const phrase = flaw !== undefined ? inertEntryPhrase(flaw) : renderListEntry(entry);
         const undeclared = split !== undefined && split.peer !== "" && !split.peer.includes("*") && !universe.peers.has(mintNamespacePrefix(split.ns, split.peer));
-        const why = undeclared ? `no ${PEER_WORD[split.ns.id]} named "${inlineUntrusted(split.peer, 80)}" is declared for this task` : "no tool of this task answers to that name";
-        advise(new Error(`${where} declares tool ${phrase} in its ${LIST_WORD[side]}: ${why}, so ${KEPT_ENTRY[side]}. If the name is misspelt, fix the entry.`));
+        const why = undeclared ? `no ${PEER_WORD[split.ns.id]} named "${inlineUntrusted(split.peer, 80)}" is declared for this task` : universe.complete ? "no tool of this task answers to that name" : "no tool this run can list answers to that name";
+        advise(new Error(`${where} declares tool ${phrase} in its ${LIST_WORD[side]}: ${why}, ${universe.complete ? `so ${KEPT_ENTRY[side]}` : KEPT_ENTRY_UNLISTED_POOL}. If the name is misspelt, fix the entry.`));
     }
 }
 export function deniedToolNamesOf(where, value) {
-    const list = readToolNameList(value);
-    if (list.kind !== "entries")
-        throw refused(notAListSentence(where, "denied", list), "config.agent.unknown_tool", "not_a_list");
-    return list.entries.map((entry, index) => {
-        if (entry === "*")
-            return entry;
-        const read = readDeniedEntry(entry);
-        if (read.kind === "not_a_string")
-            throw refused(notAStringSentence(where, "denied", index, read.type), "config.agent.unknown_tool", "not_a_string");
-        const flaw = compileAllowList([read.name], "deny").inert[0];
-        if (flaw !== undefined && flaw.reason === "grammar")
-            throw grammarRefusal(where, "denied", { ...flaw, entry: read.name }, "config.agent.unknown_tool");
-        return read.name;
-    });
+    return readableToolNameList(where, "denied", value, "config.agent.unknown_tool").map((read) => read.name);
+}
+function inheritedListsWhere(ceilings, i) {
+    const up = ceilings - 1 - i;
+    return up === 0 ? "the lists of the run this leg was spawned under" : `the lists of the run ${up} spawn${up === 1 ? "" : "s"} above the run this leg was spawned under`;
+}
+function readSelectorLayer(layer, layerWhere, listWhere, recorded) {
+    if (!isToolSelectorLayer(layer)) {
+        throw refused(`${layerWhere} are a value that is ${valueTypeLabel(layer)}, not a pair of tool-name lists (an allowed and a denied list) — the leg does not start. Fix the layer.`, "config.tool_face_control", "not_a_list");
+    }
+    for (const side of ["allowed", "denied"]) {
+        const where = listWhere(side);
+        const entries = readableToolNameList(where, side, side === "allowed" ? layer.allow : layer.deny, "config.tool_face_control");
+        const written = recorded ? entries.find((read) => !isCanonicalToolName(read.entry)) : undefined;
+        if (written !== undefined) {
+            throw refused(`${where} declares ${renderListEntry(written.entry)} in its ${LIST_WORD[side]}: a row records each tool name in its bare spelling (\`Read\`, never \`Read()\`, \`Read(*)\` or \`Read(…)\`), and this entry was recorded by an engine that read the list otherwise — it is read here neither as that engine read it nor as this one would`, "config.tool_face_control", "unsupported_pattern");
+        }
+    }
+}
+function ownToolListsFlaw(value) {
+    try {
+        if (typeof value !== "object" || value === null || Array.isArray(value))
+            return `a value that is ${valueTypeLabel(value)}, not a tool name with an agent definition name and the digest of the lists it wrote`;
+        const { toolName, definition, lists } = value;
+        if (typeof toolName !== "string" || toolName.length === 0)
+            return `a tool whose name is ${typeof toolName === "string" ? "empty" : `a value that is ${valueTypeLabel(toolName)}`}, not a tool name`;
+        const problem = callerToolNameProblem(toolName);
+        if (problem !== undefined)
+            return `a tool whose name is not one a caller tool can carry (${problem})`;
+        if (definition !== undefined && typeof definition !== "string")
+            return `an agent definition whose name is a value that is ${valueTypeLabel(definition)}, not a name`;
+        if (definition === "")
+            return "an agent definition whose name is empty, not a name";
+        if (lists === undefined)
+            return "a record with no digest of the lists it wrote";
+        if (typeof lists !== "string")
+            return `a digest of the lists it wrote that is a value that is ${valueTypeLabel(lists)}, not a digest`;
+        if (lists.length === 0)
+            return "a digest of the lists it wrote that is empty, not a digest";
+        return undefined;
+    }
+    catch {
+        return "a value that cannot be read";
+    }
+}
+export function persistedToolNamesRefusal(ceiling, chain, ownLists) {
+    const pending = "refused before the claim (the checkpoint stays pending): finish it on a worker of the engine that parked it, or expire it and run the work again";
+    const ownFlaw = ownLists === undefined ? undefined : ownToolListsFlaw(ownLists);
+    if (ownFlaw !== undefined)
+        return { message: `this leg's checkpoint row records the delegation tool that wrote its own lists as ${ownFlaw} — ${pending}`, reason: "invalid_record" };
+    if (ceiling !== undefined) {
+        const layers = readToolNameList(ceiling);
+        if (layers.kind !== "entries")
+            return { message: `the ceiling this leg's checkpoint row recorded is a value that is ${layers.kind === "not_a_list" ? layers.type : "a list that cannot be read"}, not a list of layers — ${pending}`, reason: "not_a_list" };
+        try {
+            layers.entries.forEach((layer, i) => readSelectorLayer(layer, inheritedListsWhere(layers.entries.length, i), () => inheritedListsWhere(layers.entries.length, i), true));
+        }
+        catch (e) {
+            return { message: `${e.message} — as this leg's checkpoint row recorded it; ${pending}`, reason: e.detail.reason };
+        }
+    }
+    if (!Array.isArray(chain))
+        return undefined;
+    const flaw = (() => {
+        for (const [layer, entry] of chain.entries()) {
+            if (typeof entry !== "object" || entry === null || "opaque" in entry || !Array.isArray(entry.components))
+                continue;
+            for (const c of entry.components) {
+                if (typeof c !== "object" || c === null)
+                    continue;
+                const { member, list } = projectionToolNames(c);
+                const where = `layer ${layer + 1}'s ${c.kind === "tool_deny" || c.kind === "tool_allowlist" || c.kind === "shell_command" ? `\`${c.kind}\`` : "component"} ${member}`;
+                const read = readToolNameList(list);
+                if (read.kind !== "entries")
+                    return { what: `${where} as a value that is ${read.kind === "not_a_list" ? read.type : "a list that cannot be read"}, not a list of tool names`, reason: "not_a_list" };
+                const at = read.entries.findIndex((name) => !isCanonicalToolName(name));
+                if (at < 0)
+                    continue;
+                const name = read.entries[at];
+                return typeof name === "string" ? { what: `${renderListEntry(name)} in ${where}`, reason: "unsupported_pattern" } : { what: `in ${where}, as entry ${at + 1}, a value that is ${valueTypeLabel(name)}`, reason: "not_a_string" };
+            }
+        }
+        return undefined;
+    })();
+    return flaw === undefined
+        ? undefined
+        : { reason: flaw.reason, message: `the checkpoint's frozen inherited constraint chain holds ${flaw.what}: a row records each tool name in its bare spelling (\`Read\`, never \`Read()\`, \`Read(*)\` or \`Read(…)\`), and this entry was recorded by a reading that is not the rule syntax's (an earlier engine's name set, or a policy that reads its lists as written) — it is replayed neither as that reading nor as this engine's; ${pending} (with the policy naming the tool itself)` };
+}
+export function refusePersistedToolNames(ceiling, chain, ownLists) {
+    const refusal = persistedToolNamesRefusal(ceiling, chain, ownLists);
+    if (refusal !== undefined)
+        throw refused(refusal.message, "config.tool_face_control", refusal.reason);
 }
 export function boundToolListsJudgment(evidence, own) {
     return evidence !== undefined && evidence === toolListsDigest(own.allow, own.exclude) ? evidence : undefined;
 }
+export function boundOwnToolLists(record, own) {
+    if (record === undefined)
+        return undefined;
+    const flaw = ownToolListsFlaw(record);
+    if (flaw !== undefined) {
+        throw refused(`this leg's internals (RunInternals.ownToolLists) record the delegation tool that wrote its own lists as ${flaw} — the leg does not start. Only the delegation lane writes that record: leave it out.`, "config.tool_face_control", "invalid_record");
+    }
+    const held = record;
+    return held.lists === toolListsDigest(own.allow, own.exclude) ? held : undefined;
+}
 export function judgeRunToolLists(input) {
     const { spec, tools, onceLedger, sessionId } = input;
     const advise = (err) => {
@@ -105,6 +257,13 @@ export function judgeRunToolLists(input) {
         catch {
         }
     };
+    const ownWhere = input.ownBy !== undefined ? delegationListWhere(input.ownBy.toolName, input.ownBy.definition) : undefined;
+    const ceilings = input.layers.length - 1;
+    input.layers.forEach((layer, i) => {
+        const own = i === ceilings;
+        const inherited = own ? undefined : inheritedListsWhere(ceilings, i);
+        readSelectorLayer(layer, inherited ?? "this run's own tool lists", (side) => inherited ?? ownWhere ?? (side === "allowed" ? "TaskSpec.allowTools" : "TaskSpec.excludeTools"), false);
+    });
     const denied = deniedProtocolTools(input.layers, input.legs);
     if (denied.length > 0) {
         const names = [...new Set(denied.map((h) => `"${h.name}"`))];
@@ -113,43 +272,28 @@ export function judgeRunToolLists(input) {
             const hits = denied.filter((h) => h.own === own).map((h) => `"${h.name}"`);
             return hits.length > 0 ? [`${whose} denies ${one ? "it" : hits.join(", ")}`] : [];
         };
-        const by = [...deniedBy(true, input.ownWhere ?? "this run's own excludeTools"), ...deniedBy(false, "an inherited list (the spawning run's excludeTools, or one it inherits)")];
+        const by = [...deniedBy(true, ownWhere ?? "this run's own excludeTools"), ...deniedBy(false, "an inherited list (the spawning run's excludeTools, or one it inherits)")];
         throw refused(`This kind of leg (${input.legs.join(", ")}) relies on ${names.join(", ")}, but ${by.join(" and ")} — the leg cannot work without ${one ? "it" : "them"}. Remove the entry from the list that names it.`, "config.tool_face_control", "protocol_denied");
     }
-    const delegationTools = (spec.tools ?? []).filter((t) => t.agentToolFaces !== undefined);
-    const known = new Set();
-    const add = (t) => {
-        known.add(t.name);
-        for (const a of t.aliases ?? [])
-            known.add(a);
-    };
-    for (const t of tools)
-        add(t);
-    for (const t of ENGINE_TOOLS)
-        add(t);
-    for (const t of spec.tools ?? [])
-        add(t);
-    for (const t of delegationTools)
-        for (const p of t.agentToolPool ?? [])
-            add(p);
-    const peers = new Set(PROTOCOL_TABLE.flatMap((ns) => (input.declaredPeers[ns.id] ?? []).map((p) => mintNamespacePrefix(ns, p.name))));
-    for (const name of known) {
-        const ns = protocolOf(name);
-        const split = ns !== undefined ? splitNamespacedName(name) : undefined;
-        if (split !== undefined && split.peer !== "")
-            peers.add(mintNamespacePrefix(split.ns, split.peer));
-    }
-    const universe = { known, peers };
+    const pool = delegationPoolReading(spec.tools ?? [], compileToolSelector(input.layers, input.legs));
+    const mounted = mountedToolNames([...tools, ...(spec.tools ?? [])]);
     if (!input.judgedUpstream) {
-        judgeToolNameList(input.ownWhere ?? "TaskSpec.allowTools", "allowed", input.own.allow, universe, advise, "config.tool_face_control");
-        judgeToolNameList(input.ownWhere ?? "TaskSpec.excludeTools", "denied", input.own.exclude, universe, advise, "config.tool_face_control");
+        const root = rootFacingUniverse(input.ownBy !== undefined ? new Set([...mounted, input.ownBy.toolName]) : mounted, pool, input.declaredPeers);
+        const own = [["allowed", input.own.allow], ["denied", input.own.exclude]];
+        const tell = input.toldUpstream === true ? () => undefined : advise;
+        for (const [side, value] of own)
+            judgeToolNameList(ownWhere ?? (side === "allowed" ? "TaskSpec.allowTools" : "TaskSpec.excludeTools"), side, value, root, tell, "config.tool_face_control");
     }
+    const children = new Map(pool.tools.map((t) => [t, childFacingUniverse(poolOf([t]), input.declaredPeers)]));
+    const taskTargets = pool.tools.length > 0 ? [...children.values()] : [childFacingUniverse(poolOf([]), input.declaredPeers)];
     for (const def of spec.agents ?? []) {
-        judgeToolNameList(`TaskSpec.agents: agent "${def.name}"`, "allowed", def.allowTools, universe, advise, "config.agent.unknown_tool");
-        judgeToolNameList(`TaskSpec.agents: agent "${def.name}"`, "denied", def.denyTools, universe, advise, "config.agent.unknown_tool");
+        for (const universe of taskTargets) {
+            judgeToolNameList(`TaskSpec.agents: agent "${def.name}"`, "allowed", def.allowTools, universe, advise, "config.agent.unknown_tool");
+            judgeToolNameList(`TaskSpec.agents: agent "${def.name}"`, "denied", def.denyTools, universe, advise, "config.agent.unknown_tool");
+        }
     }
     const replaced = new Set((spec.agents ?? []).map((d) => d.name));
-    for (const t of delegationTools) {
+    for (const [t, universe] of children) {
         for (const face of t.agentToolFaces ?? []) {
             if (face.authored === true && !replaced.has(face.name)) {
                 const faceWhere = delegationListWhere(t.name, face.name);
@@ -161,3 +305,16 @@ export function judgeRunToolLists(input) {
         judgeToolNameList(delegationListWhere(t.name, undefined), "denied", t.agentToolLevelDenyTools, universe, advise, "config.agent.unknown_tool");
     }
 }
+export function judgeHostToolCeiling(layers, agent, above = []) {
+    const where = (i) => `RunWorkflowOptions.toolCeiling, layer ${i + 1}`;
+    layers.forEach((layer, i) => readSelectorLayer(layer, where(i), () => where(i), false));
+    const callerTools = agent.tools ?? [];
+    const own = { ...(agent.allowTools != null ? { allow: agent.allowTools } : {}), deny: agent.excludeTools ?? [] };
+    const pool = delegationPoolReading(callerTools, compileToolSelector([...above, ...layers, own], ["delegated"]));
+    const universe = rootFacingUniverse(mountedToolNames(callerTools), pool, { mcp: undefined, a2a: undefined });
+    const unannounced = () => undefined;
+    layers.forEach((layer, i) => {
+        judgeToolNameList(where(i), "allowed", layer.allow, universe, unannounced, "config.tool_face_control");
+        judgeToolNameList(where(i), "denied", layer.deny, universe, unannounced, "config.tool_face_control");
+    });
+}

package/dist/core/runner/tool-end-body.d.ts

@@ -17,7 +17,7 @@ import type { GateOutcome } from "../gate-outcome.js";
 import type { TaskEvent, TaskEventIdentity } from "../types.js";
 import type { OccurrenceStart, ToolOccurrenceTable } from "./tool-occurrence.js";
 import { type McpDelivered } from "../mcp-failure.js";
-import type { RecoveredOrphan } from "../session-reconcile.js";
+import { type RecoveredOrphan } from "../session-reconcile.js";
 import { type StructuredProjector } from "./tool-output-projection.js";
 import type { WriteFamily } from "./turn-attachments.js";
 /** Derive the thin `response` digest from a harness tool result: model-facing text
@@ -77,16 +77,15 @@ export interface OccurrenceEnd {
     /** The harness result (or the exact text the closing station records). */
     result: unknown;
     isError: boolean;
-    /** POSITIVE evidence the call never executed — the loop's own mark on a call it closed without running it, or the
-     *  reconcile's never-started class. Absent = no such evidence, never "it ran" (see `tool_end.notExecuted`). */
+    /** The CLOSING STATION's own POSITIVE evidence the call never executed — the loop's mark (a halted sibling may well have been let go by the gate) or the reconcile's never-started class; the engine's refusal is read off the occurrence. Absent = no such evidence, never "it ran". */
     notExecuted?: true;
     /** The call is closed by an interruption rather than a result of its own. */
     interrupted?: true;
     /** See {@link toolEndBodyFrom}'s parameter of the same name. */
     gatedCallIdOfRun?: string;
 }
-/** What the end projection decided, for the readers that ride beside the frame (the trace row, the row's record). */
-export interface SettledOccurrence {
+/** What the end projection decided, for the readers that ride beside the frame (the trace row, the row's record, the rows' `notExecuted`). */
+export interface SettledOccurrence extends Pick<OccurrenceEnd, "notExecuted"> {
     /** The latest gate record — the call's disposition (absent when no gate exit saw it). */
     gate?: GateOutcome;
     /** The tool's own error bit, or a refusal recorded after the gate: the engine's record wins over the tool's word. */
@@ -96,7 +95,7 @@ export interface SettledOccurrence {
  * The END projection — the ONE mint of `tool_end`, for every station that closes a call: the live loop's
  * `tool_execution_end`, the resumed leg's resolution, an interrupted run's reconcile and the reconcile replayed at
  * the next process start. It reads the occurrence and nothing else: `gate` is its latest gate record, `isError` is
- * the tool's bit or the refusal that record names, and `notExecuted` rides only on the station's positive evidence.
+ * the tool's bit or the refusal that record names, and `notExecuted` rides on positive evidence only: the station's own or `refusedBeforeRelease` (returned for the rows).
  *
  * A call whose start never went out on this stream (a call the loop never reached, a call announced by a dead
  * process) gets its start minted here first, marked `recovered` and carrying the input the closing station holds —

package/dist/core/runner/tool-end-body.js

@@ -1,6 +1,8 @@
 import {} from "../../internal/harness.js";
 import { readMember } from "../thrown-value.js";
+import { refusedBeforeRelease } from "./tool-not-executed.js";
 import { MCP_DELIVERY_VERDICTS } from "../mcp-failure.js";
+import { closeNeverExecuted } from "../session-reconcile.js";
 import { TOOL_SEARCH_NAME } from "./tool-disclosure.js";
 import { toolOutputFrom } from "./tool-output-projection.js";
 import { TASK_CREATE_TOOL_NAME, TASK_UPDATE_TOOL_NAME, TODO_WRITE_TOOL_NAME } from "../tool-catalog-entries.js";
@@ -63,7 +65,7 @@ export function emitSettled(table, start, end, frames) {
     if (!occ.startEmitted)
         frames.push(startFrameOf(occ, true));
     const gate = occ.gateRounds.at(-1);
-    const isError = end.isError || gate?.disposition.kind === "denied";
+    const isError = end.isError || gate?.disposition.kind === "denied", notExecuted = end.notExecuted === true || refusedBeforeRelease(occ);
     table.close(occ.toolCallId, end.interrupted === true ? "interrupted" : "settled");
     frames.push({
         type: "tool_end",
@@ -73,12 +75,12 @@ export function emitSettled(table, start, end, frames) {
         isError,
         ...toolEndBodyFrom(end.result, isError, frames, gate, end.gatedCallIdOfRun),
         ...(gate?.disposition.kind === "denied" && occ.wireName !== undefined ? { wireName: occ.wireName } : {}),
-        ...(end.notExecuted === true ? { notExecuted: true } : {}),
+        ...(notExecuted ? { notExecuted: true } : {}),
     });
-    return { ...(gate !== undefined ? { gate } : {}), isError };
+    return { ...(gate !== undefined ? { gate } : {}), isError, ...(notExecuted ? { notExecuted: true } : {}) };
 }
 export function reconciledEnd(orphan) {
-    return { result: { content: orphan.text, details: { code: orphan.errorKind } }, isError: true, interrupted: true, ...(orphan.errorKind === "interrupted_never_started" ? { notExecuted: true } : {}) };
+    return { result: { content: orphan.text, details: { code: orphan.errorKind } }, isError: true, interrupted: true, ...(closeNeverExecuted(orphan.errorKind) ? { notExecuted: true } : {}) };
 }
 export function writeFamilyOfCanonical(name) {
     if (name === TASK_CREATE_TOOL_NAME || name === TASK_UPDATE_TOOL_NAME)

package/dist/core/runner/tool-not-executed.d.ts

@@ -0,0 +1,15 @@
+import type { ToolOccurrence } from "./tool-occurrence.js";
+/** The engine's own judgment refused this call and it was never let go to an executor: the latest gate record is a
+ *  refusal and the life never left `announced` — positive evidence the call did not run (a refusal recorded AFTER the
+ *  release, by a station inside the execution, is not). A call whose start this stream never carried (a recovered
+ *  one, closed by a station that knows only its own class) is not read here. */
+export declare function refusedBeforeRelease(occ: Pick<ToolOccurrence, "life" | "gateRounds" | "startEmitted">): boolean;
+/** `details` as a persisted `toolResult` row carries it: `notExecuted` is the ENGINE's key — the settlement's fact when it holds,
+ *  absent otherwise, whatever a tool wrote under that name. Returns `details` itself unless the key has to move; never mutates it. */
+export declare function rowDetailsOf(details: unknown, notExecuted: boolean): unknown;
+/** A row the resumed leg mints (`toolResultMsg`) with the settlement's fact on it. */
+export declare function withRowNotExecuted<T extends object>(row: T, notExecuted: boolean): T;
+/** Write the end projection's one `notExecuted` onto the result the live loop persists as the call's row: the loop builds that message
+ *  from this very result right after the end event. The frame's card was projected from the previous `details` first and keeps its
+ *  members (a row mark is never part of a card). `Reflect.set`: a result that refuses the write keeps its row as it was. */
+export declare function stampRowNotExecuted(result: unknown, notExecuted: boolean): void;

package/dist/core/runner/tool-not-executed.js

@@ -0,0 +1,30 @@
+import { readOwnMembers } from "../thrown-value.js";
+export function refusedBeforeRelease(occ) {
+    return occ.life === "announced" && occ.startEmitted && occ.gateRounds.at(-1)?.disposition.kind === "denied";
+}
+export function rowDetailsOf(details, notExecuted) {
+    const carries = (() => { try {
+        return details !== null && typeof details === "object" && !Array.isArray(details) && Object.keys(details).includes("notExecuted");
+    }
+    catch {
+        return false;
+    } })();
+    if (!notExecuted && !carries)
+        return details;
+    const bag = { ...readOwnMembers(details) };
+    if (notExecuted)
+        bag["notExecuted"] = true;
+    else
+        delete bag["notExecuted"];
+    return bag;
+}
+export function withRowNotExecuted(row, notExecuted) {
+    return notExecuted ? { ...row, details: rowDetailsOf(undefined, true) } : row;
+}
+export function stampRowNotExecuted(result, notExecuted) {
+    if (result === null || typeof result !== "object")
+        return;
+    const next = rowDetailsOf(result.details, notExecuted);
+    if (next !== result.details)
+        Reflect.set(result, "details", next);
+}

package/dist/core/runner/tool-occurrence.d.ts

@@ -6,10 +6,11 @@
  * `tool_progress` heartbeat (`tool-progress-lane.ts`), the trace row's `ok`, and the resumed leg's
  * `executionOutcome` filing. The record has three parts:
  *
- *  - the EXECUTION LIFE, monotonic: `announced` (the start frame is out) → `executing` (the engine started the
- *    tool body itself — the resumed leg; on a live leg the loop starts the body and the runner does not observe
- *    that moment, so a live call stays `announced`) → `settled` or `interrupted`. Leaving a terminal state is an
- *    engine defect and throws;
+ *  - the EXECUTION LIFE, monotonic: `announced` (the start frame is out) → `released` (the engine let the call go
+ *    to its executor: the resumed leg right before it runs the tool body itself, a live leg at the gate's allow
+ *    exit — the loop starts the body after it and the runner does not observe that moment) → `settled` or
+ *    `interrupted`. A call that closes still `announced` was never let go: whatever the tool's body did, this call
+ *    did not do it (`refusedBeforeRelease`, `tool-not-executed.ts`). Leaving a terminal state is an engine defect and throws;
  *  - the WAIT ON A PERSON, re-entrant: every ask put to the person's seat for this call counts one entry and one
  *    exit (several rounds of one gate pass, a confirmation asked during the execution) — a count, never a bit,
  *    because the waits nest and overlap;
@@ -28,7 +29,7 @@ import type { DeniedBy, GateOutcome } from "../gate-outcome.js";
  *  host without `performance` falls back to the wall clock and inherits its rollback behaviour. */
 export declare const occurrenceClock: () => number;
 /** Where a call's execution life stands — see the module header for the order. */
-export type OccurrenceLife = "announced" | "executing" | "settled" | "interrupted";
+export type OccurrenceLife = "announced" | "released" | "settled" | "interrupted";
 /** What opens an occurrence: the facts its start frame carries. */
 export interface OccurrenceStart {
     readonly toolCallId: string;
@@ -78,8 +79,8 @@ export interface ToolOccurrenceTable {
     ensure(start: OccurrenceStart): ToolOccurrence;
     /** The call's start frame is out. */
     noteStartEmitted(toolCallId: string): void;
-    /** The engine starts the tool body. */
-    execute(toolCallId: string): void;
+    /** The engine lets the call go to its executor — the one transition into `released`, whichever leg makes it. */
+    release(toolCallId: string): void;
     /** A gate exit for this call: its record and the input it decided on (frozen by the gate's exit). */
     gateRound(toolCallId: string, outcome: GateOutcome, finalInput?: unknown): void;
     /** A station after the gate refused the call: one more gate record, minted as a veto of whatever the latest one

package/dist/core/runner/tool-occurrence.js

@@ -1,6 +1,6 @@
 import { mintGateOutcome } from "./gate-exit.js";
 export const occurrenceClock = () => (typeof performance !== "undefined" ? performance.now() : Date.now());
-const TERMINAL = { announced: false, executing: false, settled: true, interrupted: true };
+const TERMINAL = { announced: false, released: false, settled: true, interrupted: true };
 export function createToolOccurrenceTable() {
     const byId = new Map();
     const attempts = new Map();
@@ -77,11 +77,11 @@ export function createToolOccurrenceTable() {
         noteStartEmitted(toolCallId) {
             held(toolCallId, "a start frame").startEmitted = true;
         },
-        execute(toolCallId) {
-            const occ = held(toolCallId, "execute");
+        release(toolCallId) {
+            const occ = held(toolCallId, "release");
             if (occ.life !== "announced")
-                throw new Error(`tool occurrence: call "${toolCallId}" (attempt ${occ.attempt}) cannot start executing from "${occ.life}"`);
-            occ.life = "executing";
+                throw new Error(`tool occurrence: call "${toolCallId}" (attempt ${occ.attempt}) cannot be released from "${occ.life}"`);
+            occ.life = "released";
         },
         gateRound(toolCallId, outcome, finalInput) {
             const occ = held(toolCallId, "a gate round");

package/dist/core/runner/tool-result-media-seat.d.ts

@@ -6,7 +6,7 @@
  * closed-set words, counts, the call's identity and a media type only when it can be one — never the bytes.
  */
 import { type EngineNotice } from "../engine-notice.js";
-import type { ToolResultMediaRefusal } from "../../tools/fs/image-admission.js";
+import type { ToolResultMediaRefusal } from "../image-admission.js";
 /** The run's attribution pair, as every per-run notice carries it. */
 export interface ToolResultMediaSeatIds {
     sessionId: string;