@sema-agent/core 7.51.2 → 7.52.0

package/dist/core/tool-policy.js

@@ -19,7 +19,8 @@ import { egressText, egressThrownText } from "./untrusted-egress.js";
 import { assertNoRetiredToolPolicyKeys, RETIRED_DECISION_MEMBERS } from "./retired-keys.js";
 import { isEngineRefusal, nestedRecordsOf, receiveContract, receiveNestedRecords, refusedOutOfContract, screenContractValues } from "./decision-receipt.js";
 export { isEngineRefusal } from "./decision-receipt.js";
-import { isNamespacedCoveringRuleName, namespacedRuleNameCovers, parsePermissionRule } from "./permission-rules.js";
+import { isNamespacedCoveringRuleName, namespacedRuleNameCovers } from "./permission-rules.js";
+import { ruleSpellingOf } from "./permission-rule-syntax.js";
 import { protocolOf } from "./protocol-table.js";
 import { anchorSpelling, isAbsoluteForFamily, normalizeAbsPathLexically, pathFamilyOf, writeTargetPath } from "../tools/fs/safety.js";
 import { KNOWN_SAFE_ROOTS, removalReadingOf } from "../tools/fs/removal-targets.js";
@@ -176,6 +177,9 @@ export function namespacedCoveringEntries(entries) {
 export function namespacedCoveringHit(covering, call) {
     return covering.length > 0 && nameListHolds({ has: (name) => covering.some((e) => namespacedRuleNameCovers(e, name)) }, call);
 }
+export function projectionToolNames(c) {
+    return c.kind === "shell_command" ? { member: "tools", list: c.tools } : { member: "names", list: c.names };
+}
 export function checkToolPolicyProjection(projection, req) {
     const listed = (list) => heldBy("policy.projectionReplay", { has: (n) => list.includes(n) }, req);
     for (const c of projection.components) {
@@ -305,6 +309,12 @@ export function refuseOutOfContractDecision(d, opts) {
         return refusedOutOfContract(`a permission decision's members could not be detached from the layer that returned them (${detached.reason}) — ` +
             `the engine keeps its own copy of what it read; denied fail-closed`);
     }
+    const rewrite = detached.value.updatedInput;
+    const ownedRewrite = rewrite !== undefined ? ownedCopy(rewrite, "updatedInput") : undefined;
+    if (ownedRewrite !== undefined && !ownedRewrite.ok) {
+        return refusedOutOfContract(`a permission decision's members could not be detached from the layer that returned them (${ownedRewrite.reason}) — ` +
+            `the engine keeps its own copy of what it read; denied fail-closed`);
+    }
     const receipt = Object.freeze(attestation !== undefined ? { ...detached.value, attestation } : detached.value);
     for (const v of Object.values(receipt))
         if (Array.isArray(v))
@@ -318,9 +328,6 @@ export function refuseOutOfContractDecision(d, opts) {
     (hookSeam ? HOOK_RECEIPTS : ENGINE_RECEIPTS).add(receipt);
     return receipt;
 }
-export function receiveHookResult(result) {
-    return refuseOutOfContractDecision(result, { reasonIsNonInput: true });
-}
 const DEADLINE_ELAPSED = Symbol("approval.deadline_elapsed");
 function withTimeout(p, ms, onTimeout) {
     if (ms === undefined) {
@@ -353,6 +360,7 @@ export function createAllowDenyPolicy(opts) {
         if (entries === undefined)
             return undefined;
         const kept = [];
+        const seen = new Set();
         for (const entry of entries) {
             const ns = protocolOf(entry);
             if (ns !== undefined) {
@@ -367,8 +375,23 @@ export function createAllowDenyPolicy(opts) {
                     continue;
                 }
             }
-            if (parsePermissionRule(entry).ruleContent === undefined) {
-                kept.push(entry);
+            const spelled = ruleSpellingOf(entry);
+            if (spelled === undefined) {
+                const lesson = `a spelling no tool name can have — the rule syntax reads no tool name in it, so a name set never names a tool by it. Fix the entry.`;
+                invalid.push({ entry, list, message: `"${entry}" is ${lesson}`, lesson });
+                continue;
+            }
+            if (spelled.ruleContent === undefined) {
+                if (spelled.toolName === "*" && list === "deny") {
+                    const lesson = `the wildcard — \`*\` names no tool, and a deny entry reaches the tool it names, so this one would be kept and never match ` +
+                        `(a deny that reads protective and denies nothing). Name the tools to deny; to leave a run no tools, write an empty allow list.`;
+                    invalid.push({ entry, list, message: `"${entry}" is ${lesson}`, lesson });
+                    continue;
+                }
+                if (!seen.has(spelled.toolName)) {
+                    seen.add(spelled.toolName);
+                    kept.push(spelled.toolName);
+                }
                 continue;
             }
             const lesson = `a rule CONTENT form, not a tool name — a name set matches raw tool names, so this entry ` +
@@ -562,7 +585,7 @@ export function combinePolicies(...policies) {
         ...carriedMembersOf(folded),
         async check(req, signal) {
             let asked;
-            let current = req;
+            let current = Object.freeze({ ...req });
             let rewrite;
             let stated;
             let records;
@@ -574,7 +597,7 @@ export function combinePolicies(...policies) {
             let authoredBySeen = false;
             const contributors = [];
             const settleDeny = (d) => {
-                const out = rewrite?.updatedInput !== undefined ? { ...d, updatedInput: rewrite.updatedInput } : d;
+                const out = rewrite !== undefined ? refusalOf(d, current.args) : d;
                 if (records === undefined)
                     return out;
                 return { ...out, attestation: mergeAttestation(req, records, d.attestation) };
@@ -590,7 +613,7 @@ export function combinePolicies(...policies) {
                 }
                 if (d.updatedInput !== undefined) {
                     const reread = withArgsReading(current, d.updatedInput, signal);
-                    current = reread !== undefined ? await reread : { ...current, args: d.updatedInput };
+                    current = Object.freeze(reread !== undefined ? await reread : { ...current, args: d.updatedInput });
                     rewrite = d;
                     stated = d.action === "allow" ? d.decisionReason : undefined;
                 }
@@ -871,6 +894,48 @@ export function tryCloneArgs(v) {
         return { ok: false, reason: describeThrown(err), cause: err };
     }
 }
+export function refusalOf(deny, judged) {
+    return deny.action !== "deny" || deny.updatedInput !== undefined ? deny : { ...deny, updatedInput: judged };
+}
+export function foldHookAsk(verdict, hookAsk) {
+    if (verdict.action === "deny")
+        return verdict;
+    const mandate = hookAsk.requiresRealApproval === true ? { requiresRealApproval: true } : {};
+    if (verdict.action === "allow") {
+        return { action: "ask", ...(hookAsk.message !== undefined ? { message: hookAsk.message } : {}), decisionReason: "hook", ...mandate, ...(hookAsk.updatedInput !== undefined ? { updatedInput: hookAsk.updatedInput } : {}) };
+    }
+    const hookMessage = hookAsk.message;
+    const message = hookMessage !== undefined && hookMessage !== verdict.message ? `${verdict.message !== undefined ? `${verdict.message} ` : ""}(a PreToolUse hook also asks: ${hookMessage})` : verdict.message;
+    return { ...verdict, decisionReason: "hook", ...(message !== undefined ? { message } : {}), ...mandate };
+}
+const OWNED_ARGS = new WeakSet();
+export function ownArgs(v, root = "args") {
+    if (v === null || (typeof v !== "object" && typeof v !== "function") || OWNED_ARGS.has(v))
+        return { ok: true, value: v };
+    const copy = tryCloneArgs(v);
+    return copy.ok ? ownedCopy(copy.value, root) : { ...copy, reason: `unclonable value: ${copy.reason}` };
+}
+function ownedCopy(fresh, root) {
+    const pending = [[fresh, root]];
+    for (let next = pending.pop(); next !== undefined; next = pending.pop()) {
+        const [x, at] = next;
+        if (typeof x !== "object" || x === null || Object.isFrozen(x))
+            continue;
+        const proto = Object.getPrototypeOf(x);
+        if (proto !== Object.prototype && proto !== Array.prototype && proto !== null) {
+            return { ok: false, reason: `${inlineUntrusted(at, 200)} is a ${Object.prototype.toString.call(x).slice(8, -1)}, whose contents cannot be made immutable — args are plain data` };
+        }
+        Object.freeze(x);
+        for (const key of Reflect.ownKeys(x)) {
+            const d = Object.getOwnPropertyDescriptor(x, key);
+            if (d !== undefined && "value" in d)
+                pending.push([d.value, Array.isArray(x) ? `${at}[${String(key)}]` : `${at}.${String(key)}`]);
+        }
+    }
+    if (typeof fresh === "object" && fresh !== null)
+        OWNED_ARGS.add(fresh);
+    return { ok: true, value: fresh };
+}
 export function describeThrown(err) {
     const contained = containThrownText(egressThrownText("same-principal", err));
     if (contained !== "")
@@ -1127,7 +1192,7 @@ function readApproverOutcomeObject(ok, toolName, editLane) {
             `re-adjudication an approver's edit gets; denied fail-closed (approve or refuse what was shown, and route edits ` +
             `through the run's approver seat)`, settledByNobody("approver_contract"));
     }
-    const edit = tryCloneArgs(suppliedEdit);
+    const edit = ownArgs(suppliedEdit);
     if (!edit.ok) {
         return refused(`the approved edit for "${toolName}" is not safely clonable (${edit.reason}) — denied fail-closed`, settledByNobody("presentation_failed"));
     }
@@ -1150,11 +1215,11 @@ async function resolveAskArms(req, onAsk, signal, onLateSettlement) {
     if (signal?.aborted) {
         return { action: "deny", message: `approval aborted for "${req.toolName}" (run or turn interrupted)`, decisionReason: "mode", settlement: settledByNobody("task_aborted") };
     }
-    const presented = tryCloneArgs(req.args);
+    const presented = ownArgs(req.args);
     if (!presented.ok) {
         return {
             action: "deny",
-            message: `approval for "${req.toolName}" could not present the args safely (unclonable value: ${presented.reason}) — denied fail-closed`,
+            message: `approval for "${req.toolName}" could not present the args safely (${presented.reason}) — denied fail-closed`,
             decisionReason: "mode",
             settlement: settledByNobody("presentation_failed"),
         };

package/dist/core/tool-registry.d.ts

@@ -88,6 +88,26 @@ export declare function pathTargetValue(args: unknown, pt: {
     param: string;
     aliases?: readonly string[];
 }): string | undefined;
+/**
+ * CC parity: Read/Edit/Write take the file path as `file_path`. Read the target the same way
+ * EVERYWHERE the path is consumed from a tool-call's args — not just the tool body but ALSO every gate that
+ * extracts the write target to confine it (sensitive-path, session allowDirs, the fs-write gate). A gate that only
+ * read `args.path` would see `undefined` for a `file_path` call and either fail-OPEN (circumvent the guard — a real
+ * hole) or fail-closed (deny a legitimate write). Single source.
+ *
+ * The `path` arm is deliberately BROADER than what Read/Edit/Write accept: their schema requires
+ * `file_path` (fs-shared.ts FILE_PATH_PARAMS; Write alone repairs the `path` spelling onto it BEFORE validation,
+ * `coerceWriteArguments`, so a gate never sees the alias there), but this reader is
+ * shared with gates that judge OTHER tool vocabularies — Glob's real `path` parameter, deployment-authored tools —
+ * and a gate must never see LESS than the tool it is confining might act on. So the asymmetry is the design: the
+ * schema decides what a caller may send, this decides what gets judged, and this side over-reads on purpose.
+ *
+ * `file_path` wins; an empty/non-string `file_path` falls back to `path` (NOT an alias for Read/Edit/Write, whose
+ * schema requires `file_path`). Empty string ⇒ undefined (treated as "no path") so every caller's `=== undefined`
+ * check is sufficient — no separate length-0 guard needed. It lives beside {@link pathTargetValue} and is that
+ * reader over the one slot above: the engine's compaction metadata reads it too, and the engine never imports tools/.
+ */
+export declare function fileArgPath(args: unknown): string | undefined;
 /** The path target of a wire name — the FIRST definition's (every definition under one name declares
  *  the same target; the conformance test pins that). */
 /** A gated call as every fence sees it: the wire name, the args, and the OBJECT face a prepared leg stamped on the

package/dist/core/tool-registry.js

@@ -85,6 +85,10 @@ export function pathTargetValue(args, pt) {
     }
     return undefined;
 }
+const FILE_ARG_PATH_TARGET = { param: "file_path", aliases: ["path"] };
+export function fileArgPath(args) {
+    return pathTargetValue(args, FILE_ARG_PATH_TARGET);
+}
 export function protectivePathTargetOf(call) {
     if (call.face?.pathTarget !== undefined)
         return call.face.pathTarget;

package/dist/core/tool-spec.d.ts

@@ -121,10 +121,14 @@ export interface ReadRootGrantCandidate {
 }
 export interface ToolSpec<TParams extends TSchema = TSchema> {
     /**
-     * Model-facing tool name. MUST NOT contain `__` — that separator is reserved by the PROTOCOL TABLE
-     * (`protocol-table.ts`), the umbrella over every namespaced family the engine speaks: `mcp__<server>__<tool>`,
-     * `a2a__<peer>__<skill>`, and whatever a third protocol appends. A caller tool name carrying it is rejected
-     * at prepare-time (`config.tool_name_invalid`).
+     * Model-facing tool name. It keeps the caller tool name contract (`caller-tool-name.ts`), judged at prepare-time — a
+     * name that breaks it is refused there (`config.tool_name_invalid`) and the run does not start:
+     *  - it is a name a rule can name: ASCII letters, digits and `_ - . : *`, starting with a letter, a digit or `_`, not
+     *    ending with `.` or `:`, and not the lone wildcard `*` — so every allow / deny list can name the tool (a leading `-`,
+     *    a character outside ASCII, a blank or an empty name is refused);
+     *  - it does not contain `__` — that separator is reserved by the PROTOCOL TABLE (`protocol-table.ts`), the umbrella over
+     *    every namespaced family the engine speaks: `mcp__<server>__<tool>`, `a2a__<peer>__<skill>`, and whatever a third
+     *    protocol appends.
      *
      * The live reason (not the retired durable-resume name shim, RB-476-A): every table-driven site — the
      * namespace `parse`, the grouped display key, the permission-rule lanes, the tool-manifest origin
@@ -136,7 +140,7 @@ export interface ToolSpec<TParams extends TSchema = TSchema> {
     /**
      * Backward-compatible model-facing names that should dispatch to this tool. New transcripts and tool rosters
      * should use {@link name}; aliases exist only so old model calls / SDK payloads / resumed sessions don't strand
-     * across a canonical rename.
+     * across a canonical rename. Each alias keeps the same contract as {@link name} (a rule naming an alias reaches the tool).
      */
     aliases?: string[];
     description: string;
@@ -711,7 +715,7 @@ export interface ToolExecuteContext {
              * PreToolUse SCREENING entry (issue #33), whose policy the engine mints. Rebuild it with the
              * exported `createPreToolUseConstraintPolicy(hook, env)` — same callback, same installed env —
              * or the chain handed back here will be short and rejected on the count check. A face that only
-             * observes should carry `Hooks.preToolUseObservational` instead, and then never enters the chain
+             * observes should be declared `{ observe: true }` instead, and then never enters the chain
              * at all; a park under a screening entry announces the requirement on `onError`
              * (classification `screening-constraint-in-durable-chain`) at park time.
              */

package/dist/core/tools.js

@@ -2,6 +2,7 @@ import { Value } from "typebox/value";
 import { formatToolError, formatZodValidationError } from "./tool-errors.js";
 import { readMember } from "./thrown-value.js";
 import { frozenToolSpec } from "./tool-spec-members.js";
+import { carryDelegationName } from "./delegation-name.js";
 import { attachToolContract } from "../prompt-assembly/tool-catalog.js";
 function normalizeContent(ret) {
     if (typeof ret === "string") {
@@ -135,6 +136,7 @@ function buildProduct(spec, owner, options) {
             }
         },
     };
+    carryDelegationName(spec.execute, tool.execute);
     if (spec.contract) {
         attachToolContract(tool, {
             contractId: spec.contract.contractId,

package/dist/core/trace.d.ts

@@ -19,6 +19,44 @@
 import type { BrainRetryErrClass, TaskStatus, ToolEffect } from "./types.js";
 import type { ThinkingLevel } from "../internal/harness-types.js";
 import type { ToolManifestRow } from "../prompt-assembly/tool-catalog.js";
+import type { PromptEpochActivation, PromptIdentityLayers } from "../prompt-assembly/epoch.js";
+import type { ChainLink, SupersededOverlay } from "../prompt-assembly/overlay.js";
+import type { HostForm, HostRole, RendererId } from "../prompt-assembly/catalog/schema.js";
+/** The run's prompt identity as the manifest reports it: the identity digest, its inputs, and the session record that
+ *  names it (the record's counter and how it came to be). */
+export interface PromptManifestIdentity {
+    artifact: string;
+    layers: PromptIdentityLayers;
+    epoch: number;
+    activatedBy: PromptEpochActivation;
+}
+/** The run's selector values — the plain form of the identity's `binding` element. */
+export interface PromptManifestSelectors {
+    binding?: string;
+    traits: string[];
+    host: {
+        role: HostRole;
+        form: HostForm;
+    };
+    facts: Record<string, boolean>;
+}
+/** One rendered section: where it sits, which variant and renderer made it, whose text it carries (`locale`: the
+ *  catalog's canonical text, or text an overlay author wrote), its content digest (`sha256:` unsalted for published
+ *  text, `salted:` for text carrying the task's or the run's own inputs) and its history (`chain`). */
+export interface PromptManifestSection {
+    id: string;
+    band: string;
+    rank: number;
+    variant?: string;
+    renderer?: {
+        id: RendererId;
+        version: number;
+    };
+    chars: number;
+    locale: "canonical" | "overlay";
+    contentHash: string;
+    chain: ChainLink[];
+}
 /**
  * R4 (1.285): the scalar face of `TaskResult.stats.mechanisms`, echoed on `task.end` so "did the
  * engine machinery fire" is answerable from the trace alone. Counters/flags only —
@@ -82,46 +120,27 @@ export type TraceEvent = {
     ts: number;
 } | {
     /**
-     * 提示词主权批 — the labelled composition of the assembled system prompt, emitted once right after
-     * `task.start`. Kills the "which blocks were actually in the prompt" black box: a deployment can
-     * assert the constitution/safety blocks are present (or that their absence was a deliberate
-     * `replaceAll`) instead of diagnosing missing-prompt incidents by archaeology. Metadata-only
-     * (block ids + sizes + short content hashes — never prompt text, per the file-header privacy rule).
+     * The labelled composition of the assembled system prompt (manifest v3), emitted once right after `task.start`:
+     * which prompt this is (the identity and its selector values), which blocks and sections composed it, and where
+     * each section's text came from (its chain of overlays, the superseded ones marked). Metadata-only — ids, sizes
+     * and digests, never prompt text (the file-header privacy rule).
      */
     kind: "prompt.assembled";
-    version: 1;
+    version: 3;
     taskId: string;
-    /** Who owned the constitution layer: "core" (structural default) / "replaced" (provider
-     *  `replaceAll` opt-out) / "provider-assembled" (migration guard pass-through). */
-    constitution: "core" | "replaced" | "provider-assembled";
-    /** Ordered blocks: stable id (e.g. `role.base`, `harness.context`, `memory.safety`,
-     *  `env.context`, `memory.tail`), size in chars, sha256-prefix content hash. [c209-C]:
-     *  `skills.block` is GONE — the skills listing left the stable prefix for the skills_listing
-     *  reminder frame (observable via `steering_injected` source "skills_listing"). */
+    identity: PromptManifestIdentity;
+    selectors: PromptManifestSelectors;
+    /** Ordered blocks: stable id (e.g. `role.base`, `harness.context`, `memory.safety`, `env.context`,
+     *  `memory.tail`), size in chars, salted short content hash — the block-view id wordlist is a downstream contract. */
     blocks: Array<{
         id: string;
         chars: number;
         hash: string;
     }>;
-    /**
-     * Manifest v2 (stage S1, ADDITIVE — the v1 `blocks` id wordlist above is a downstream
-     * contract and stays as-is): the compiled-IR view, one entry per pack section, carrying the
-     * assembly protocol's semantic/lifecycle dimensions (slot/carrier/cadence/cacheClass).
-     * Absent on the legacy free-form provider path (single opaque block, no section structure).
-     * `contentHash` (digest tiering): UNSALTED full sha256, present ONLY on
-     * operator-declared sections (typed `stableBlocks` lane) — the center-publish ↔ manifest
-     * reconciliation anchor. Core-native sections stay salted-only (`hash`).
-     */
-    sections?: Array<{
-        id: string;
-        slot: string;
-        carrier: string;
-        cadence: string;
-        cacheClass: string;
-        chars: number;
-        hash: string;
-        contentHash?: string;
-    }>;
+    sections: PromptManifestSection[];
+    /** Every overlay the composition superseded (a later one on the same target won, or it changed nothing this
+     *  run); absent when none was. */
+    superseded?: SupersededOverlay[];
     /**
      * S2 (additive): the mounted tools plane — per-tool contract identity, durable-replay
      * aliases, presentation-invariant shape digest and full wire-schema digest (initial mount face;

package/dist/core/unc-spelling.d.ts

@@ -0,0 +1,10 @@
+/**
+ * UNC under the win family: two leading separators, a host, a share — either separator, as `path.win32`
+ * reads it. The ONE UNC recognizer behind `isAbsoluteForFamily`, `pathIdentityOf` and `joinForFamily`
+ * (tools/fs/safety.ts), the symlink-chain reader (core/path-identity.ts) and the engine's own chain walk
+ * (engine/execution-env/symlink-chain.ts).
+ *
+ * A pure spelling test with no dependency, so the engine layer and the tools layer both read it from here:
+ * the engine never imports tools/, and tools reach the engine only through the `internal/harness` facade.
+ */
+export declare function isUncSpelling(p: string): boolean;

package/dist/core/unc-spelling.js

@@ -0,0 +1,3 @@
+export function isUncSpelling(p) {
+    return /^[\\/]{2}[^\\/]+[\\/]+[^\\/]/.test(p);
+}

package/dist/core/untrusted-egress.d.ts

@@ -34,6 +34,14 @@ export declare function egressText<T extends EgressTier>(tier: T, text: string,
 export declare function egressThrownText<T extends EgressTier>(tier: T, err: unknown): Egress<T>;
 /** The `same-principal` tier's pass, under the name hosts call it by (the engine calls {@link egressText}). */
 export declare function redactSecrets(s: string, report?: RedactionReport): Egress<"same-principal">;
+/**
+ * An extension's own words — its registration name, a bus reason, a key it wrote — made fit for an operator line: the
+ * `same-principal` egress pass first, then one line and bounded. The pass runs before the cut, so a cut never leaves part
+ * of a credential the pass would have recognised whole. Every station sentence that carries such words reads them here.
+ * It lives beside the pass, not in the stations module: a value import of the stations graph from a station's consumer
+ * closed a load-order cycle through the fs tools' barrel (an export the barrel copied before it existed).
+ */
+export declare function extensionWords(s: string, max: number): string;
 /** The `human` tier's pass, under the name hosts call it by (the engine calls {@link egressText}). */
 export declare function redactHostLeaks(s: string, report?: RedactionReport): Egress<"human">;
 /**

package/dist/core/untrusted-egress.js

@@ -1,4 +1,4 @@
-import { delimitUntrusted, neutralizeForFence } from "./untrusted-text.js";
+import { delimitUntrusted, inlineUntrusted, neutralizeForFence } from "./untrusted-text.js";
 import { egressPasses, runRedactionPasses } from "./redaction-passes.js";
 import { CREDENTIAL_VOCABULARY, egressPassGroups, isSensitiveRecordKey, URI_SCHEME_SOURCE } from "./credential-vocabulary.js";
 import { isErrorLike, readMember, thrownText } from "./thrown-value.js";
@@ -34,6 +34,9 @@ export function egressThrownText(tier, err) {
 export function redactSecrets(s, report) {
     return egressText("same-principal", s, report);
 }
+export function extensionWords(s, max) {
+    return inlineUntrusted(egressText("same-principal", s), max);
+}
 export function redactHostLeaks(s, report) {
     return egressText("human", s, report);
 }

package/dist/core/user-attachment.d.ts

@@ -27,6 +27,7 @@ import type { HumanInputAttachment } from "./task-event.js";
 import { type ModelFileReader } from "../tools/fs/fs-read.js";
 import type { SyntheticReadJudge } from "./synthetic-read-verdict.js";
 import { type ReminderDisclosureCounts } from "./reminder-disclosure.js";
+import type { ContextWindowOverlay } from "./context-settings.js";
 /** At most this many attachments on one objective. */
 export declare const USER_ATTACHMENTS_MAX = 20;
 /** The longest path or name an entry may carry (the platform path limit). */
@@ -133,9 +134,18 @@ export interface ReadUserAttachmentsInput {
  * frame carries the commit its delivery owes, run only when the frame is in the transcript.
  */
 export declare function readUserAttachments(input: ReadUserAttachmentsInput): Promise<MintedAttachmentFrame[]>;
+/** The objective as the window check sees it: a reader of the live overlay over the model's window declarations (the
+ *  same seat the request guard reads) and the objective text's length — it rides the first request ahead of the
+ *  frames. The overlay is a GETTER because it is read when the frames exist, not when the call is made: the reads are
+ *  asynchronous and a deployment may swap its window declarations meanwhile, as it may before any request. */
+export interface AttachmentWindowInput {
+    readonly overlay: () => ContextWindowOverlay | undefined;
+    readonly objectiveChars: number;
+}
 /** The objective lane's read: once the UserPromptSubmit hook let the objective through (a blocked objective reads
- *  nothing), and before the pre-call gate, which prices the frames (`chars`). Commits nothing. */
-export declare function readObjectiveAttachments(prepared: Pick<import("./runner/contracts.js").Prepared, "userAttachments" | "modelFileReader" | "syntheticReadVerdict" | "cwdRef" | "reminderMark" | "reminderDisclosureCounts" | "abortController">, inputId: string, blocked: boolean): Promise<{
+ *  nothing), and before the pre-call gate, which prices the frames (`chars`). Refuses the whole objective when the frames
+ *  and the objective cannot ride one request ({@link refuseFramesOverWindow}). Commits nothing. */
+export declare function readObjectiveAttachments(prepared: Pick<import("./runner/contracts.js").Prepared, "userAttachments" | "modelFileReader" | "syntheticReadVerdict" | "cwdRef" | "reminderMark" | "reminderDisclosureCounts" | "abortController" | "harness">, inputId: string, blocked: boolean, window: AttachmentWindowInput): Promise<{
     frames: MintedAttachmentFrame[];
     chars: number;
 }>;

package/dist/core/user-attachment.js

@@ -3,10 +3,12 @@ import { READ_OUTCOMES } from "../tools/fs/fs-read.js";
 import { renderDirectoryListing } from "../tools/fs/dir-entries.js";
 import { MAX_READ_OUTPUT_CHARS } from "../tools/fs/fs-shared.js";
 import { normalizeFileText } from "../tools/fs/encoding.js";
-import { ADMITTED_IMAGE_MIME_TYPES, admitImageBytes } from "../tools/fs/image-admission.js";
+import { ADMITTED_IMAGE_MIME_TYPES, admitImageBytes } from "./image-admission.js";
 import { PDF_MAX_PAGES_PER_READ } from "../tools/fs/pdf.js";
 import { MARKED_BLOCK_AFTER_DATA, mintSystemReminder } from "./reminder-mint.js";
 import { commitReminderDisclosureEffects, planReminderDisclosure } from "./reminder-disclosure.js";
+import { DEFAULT_CHARS_PER_TOKEN, estimateTokens } from "../internal/harness.js";
+import { guardBudget } from "./context-guard.js";
 export const USER_ATTACHMENTS_MAX = 20;
 export const USER_ATTACHMENT_LABEL_MAX = 4096;
 export const USER_ATTACHMENT_KINDS = Object.freeze(["text", "notebook", "image", "pdf", "directory", "client_text", "client_image"]);
@@ -383,7 +385,19 @@ function mintFrame(r, at, seat) {
     const commit = result !== undefined || extra.length > 0 ? () => seat.commit(result, extra) : undefined;
     return { seed: { content, attachment }, ...(commit !== undefined ? { commit } : {}) };
 }
-export async function readObjectiveAttachments(prepared, inputId, blocked) {
+function refuseFramesOverWindow(frames, model, window) {
+    const budget = guardBudget(model, window.overlay());
+    if (!Number.isFinite(budget))
+        return;
+    const cpt = model.charsPerToken ?? DEFAULT_CHARS_PER_TOKEN;
+    const asMessage = (f) => ({ role: "user", content: [...f.seed.content], timestamp: 0 });
+    const tokens = frames.reduce((n, f) => n + estimateTokens(asMessage(f), cpt), 0) + Math.ceil(window.objectiveChars / cpt);
+    if (tokens <= budget)
+        return;
+    const n = frames.length;
+    throw userAttachmentRefusal(SEAT_FIELD, `the ${n} ${n === 1 ? "attachment" : "attachments"} and the objective come to about ${tokens} tokens, over the ${budget} tokens one request can hold on this model — to send it the engine would have to drop the objective or some of the attachments. Nothing was sent; attach fewer or smaller parts.`);
+}
+export async function readObjectiveAttachments(prepared, inputId, blocked, window) {
     if (blocked || prepared.userAttachments === undefined)
         return { frames: [], chars: 0 };
     const frames = await readUserAttachments({
@@ -397,6 +411,7 @@ export async function readObjectiveAttachments(prepared, inputId, blocked) {
         counts: prepared.reminderDisclosureCounts,
         signal: prepared.abortController.signal,
     });
+    refuseFramesOverWindow(frames, prepared.harness.getModel(), window);
     return { frames, chars: frames.reduce((n, f) => n + f.seed.content.reduce((m, b) => m + (b.type === "text" ? b.text.length : 0), 0), 0) };
 }
 export function lastAttachmentFrameOf(entries, id) {

package/dist/core/wiring-manifest.d.ts

@@ -23,7 +23,7 @@
 import { type PermissionMode } from "./ask-origin.js";
 import type { RunnerDeps, TaskSpec } from "./types.js";
 import { type StoreDurability } from "./checkpoint-store.js";
-import type { WiringManifestHookEntry } from "./hook-seats.js";
+import type { ModAdmissionRecord } from "./mods/kernel/index.js";
 import type { McpDelivered, McpFailureKind, McpServerLiveness } from "./mcp-failure.js";
 import type { WriteProtectionTargetView } from "./write-protect.js";
 import type { OnAsk } from "./tool-policy.js";
@@ -180,7 +180,6 @@ export declare function deriveLspSeam(mounted: boolean, diagnosticsLive: boolean
  * (`schemaVersion` bumps only on a semantic break of an EXISTING field). The TaskEvent face is the
  * host/operator plane — the manifest never enters model context.
  */
-export type { WiringManifestHookEntry };
 export interface WiringManifest {
     schemaVersion: 1;
     /** Present on EFFECTIVE (per-leg) manifests only; the static half has no leg. */
@@ -356,14 +355,16 @@ export interface WiringManifest {
      */
     tools?: import("./tool-roster.js").ToolRoster;
     /**
-     * EFFECTIVE half only: the hook seats this leg wired, one entry per family, in {@link import("./hook-seats.js").HOOK_FAMILIES} order. PRESENT IFF at least one
-     * seat is wired — a deployment that wires none reports nothing here and its manifest (and {@link configFingerprint}) is byte-for-byte what it was; an empty
-     * array is never emitted, so absence reads as "this leg wired no hook RECORD of its own" — NOT as "no hook runs": a delegated child with no local record can
-     * still be screened (and refused) by an ancestor's `preToolUse` through the gate's constraint fold, which this face deliberately does not call a hook of
-     * this leg. Every entry is deployment code the engine awaits on the critical path, fail-closed on the two decision seats. EXCLUDED from
-     * {@link configFingerprint}: the record is a per-task seat, so one assembly's legs legitimately differ on it.
+     * EFFECTIVE half only: the leg's mods admission — one record per registration of the two seats, in run order: a
+     * mounted one with the patterns it actually hung (`events`), the ones it declared observe-only (`observe`) and the
+     * judges skipped while it was judged (`skipped`), or a refused one with who refused it and why (`refusedBy`,
+     * `reason`). PRESENT IFF the leg has a registration — a deployment that wires none reports nothing here and its
+     * manifest (and {@link configFingerprint}) is byte-for-byte what it was. Absence reads as "this leg carries no
+     * registration", NOT as "no extension judges this leg's calls": a delegated child can still be screened by an
+     * ancestor's chain through the gate's constraint fold. EXCLUDED from {@link configFingerprint}: the task seat is a
+     * per-task seat, so one assembly's legs legitimately differ on it.
      */
-    hooks?: readonly WiringManifestHookEntry[];
+    mods?: readonly ModAdmissionRecord[];
     /**
      * EFFECTIVE half only: the LSP code-intelligence seam. PRESENT IFF a manager seat resolved
      * (`spec.lspManager ?? deps.lspManager`); a deployment that wires none reports nothing (byte-for-byte
@@ -412,7 +413,7 @@ export interface WiringManifest {
      * the engine's seats — the same fact `config.write_protection_target_view_absent` announces once per run
      * when a covered write tool is mounted beside a `"spelling-only"` judge.
      *
-     * IN the fingerprint below (unlike `tools`/`lsp`/`hooks`): which view the judge got is an ASSEMBLY fact
+     * IN the fingerprint below (unlike `tools`/`lsp`/`mods`): which view the judge got is an ASSEMBLY fact
      * — it follows the table seat and whether the deployment wired hands at all — so legs of one assembly
      * agree on it, which is exactly the equality the fingerprint advertises.
      *
@@ -466,7 +467,7 @@ export interface WiringManifest {
      * `"on"` — it records (store wired, neither layer declared it off, a filesystem env mounted). `"disabled"` — it does
      * not, whichever layer or missing half made it so (`TaskSpec.fileHistory`, `RunnerDeps.fileHistoryStore: "disabled"`, `RunnerDeps.fileHistoryCapture: "off"`,
      * no store, no filesystem env); the host knows its own deployment seat. ABSENT = an older mint or an external
-     * derivation, never a state. Out of {@link configFingerprint}: the request word is a per-task seat (`hooks` reasoning).
+     * derivation, never a state. Out of {@link configFingerprint}: the request word is a per-task seat (`mods` reasoning).
      */
     fileHistory?: "on" | "disabled";
     /** EFFECTIVE half only — a short, non-sensitive fingerprint (sha256 prefix over the canonical
@@ -544,8 +545,8 @@ export interface WiringFacts {
     mcp?: readonly WiringManifestMcpEntry[];
     /** Effective half only — the leg's minted tool roster (see {@link WiringManifest.tools}). */
     tools?: import("./tool-roster.js").ToolRoster;
-    /** Effective half only — the wired hook seats ({@link WiringManifest.hooks}); an empty array and an absent value derive the same thing (no section). */
-    hooks?: readonly WiringManifestHookEntry[];
+    /** Effective half only — the leg's mods admission records ({@link WiringManifest.mods}); an empty array and an absent value derive the same thing (no section). */
+    mods?: readonly ModAdmissionRecord[];
     /** Effective half only — the LSP seam ({@link WiringManifest.lsp}); absent ⇒ no manager wired. */
     lsp?: {
         mounted: boolean;

package/dist/core/wiring-manifest.js

@@ -210,7 +210,7 @@ export function deriveWiringManifest(facts) {
         ...(facts.half === "effective" && facts.autoMode !== undefined ? { autoMode: readAutoModeFact(facts.autoMode) } : {}),
         ...(facts.half === "effective" && facts.mcp !== undefined ? { mcp: facts.mcp.map((e) => ({ ...e })) } : {}),
         ...(facts.half === "effective" && facts.tools !== undefined ? { tools: facts.tools } : {}),
-        ...(facts.half === "effective" && facts.hooks !== undefined && facts.hooks.length > 0 ? { hooks: facts.hooks.map((h) => ({ ...h })) } : {}),
+        ...(facts.half === "effective" && facts.mods !== undefined && facts.mods.length > 0 ? { mods: [...facts.mods] } : {}),
         ...(facts.half === "effective" && facts.lsp !== undefined ? { lsp: { ...facts.lsp } } : {}),
         ...(facts.half === "effective" && facts.hands !== undefined ? { hands: readHandsFact(facts.hands) } : {}),
         ...(facts.half === "effective" && facts.permissionMode !== undefined ? { permissionMode: readPermissionModeFact(facts.permissionMode) } : {}),
@@ -226,7 +226,7 @@ export function deriveWiringManifest(facts) {
             : {}),
     };
     if (facts.half === "effective") {
-        const { leg: _leg, mcp: _mcp, tools: _tools, lsp: _lsp, hooks: _hooks, teamRole: _teamRole, peerPresence: _peerPresence, fileHistory: _fileHistory, permissionMode: _permissionMode, ...assembly } = manifest;
+        const { leg: _leg, mcp: _mcp, tools: _tools, lsp: _lsp, mods: _mods, teamRole: _teamRole, peerPresence: _peerPresence, fileHistory: _fileHistory, permissionMode: _permissionMode, ...assembly } = manifest;
         const { provenance: _askSeat, ...askForHash } = assembly.ask;
         const { provenance: _questionSeat, ...questionForHash } = assembly.question;
         manifest.configFingerprint = createHash("sha256")

package/dist/engine/compaction/utils.js

@@ -2,8 +2,7 @@ import { renderUserAttachmentView, userAttachmentOf } from "../llm/index.js";
 import { normalizeLlmMessageContent } from "../harness/messages.js";
 import { sliceHeadSafe } from "../../core/surrogate-safe-slice.js";
 import { cutEnginePrefix, cutEngineSegments, flattenableUserText } from "../../core/untrusted-text.js";
-import { fileArgPath } from "../../tools/fs/safety.js";
-import { fileOpAccessOf } from "../../core/tool-registry.js";
+import { fileArgPath, fileOpAccessOf } from "../../core/tool-registry.js";
 export const DURABLE_HISTORY_NAMES = new Map([
     ["read", "read"],
     ["write", "create"],

package/dist/engine/execution-env/node-execution-env.d.ts

@@ -112,9 +112,10 @@ export declare class NodeExecutionEnv implements ExecutionEnv, BackgroundShellCa
          *  fail-closed (drop secret-pattern keys, keep PATH/build/locale). `"all"` = full inherit (trusted env);
          *  `string[]` = strict allowlist. `shellEnv`/per-exec `env` always pass through. Any other value — an unknown
          *  word, a non-string, a list entry that is not a variable name — throws here (`inheritEnvPolicyProblem`'s
-         *  reason), the same judgment the oracle gate's `inheritEnv` meets. Whatever the policy, the deployment's declared
-         *  own credentials (`declareWithheldEnv`) are withheld from the inherited part; a list naming one throws here when
-         *  the declaration came first, and every spawn refuses it (`spawn_error` / `spawn_failed`) whenever it came. */
+         *  reason), the same judgment the oracle gate's `inheritEnv` meets. Whatever the policy, the deployment's own
+         *  credentials (`declareWithheldEnv`: by name, and by a value equal to a declared or engine-held credential value)
+         *  are withheld from the inherited part; a list naming a declared name throws here when the declaration came
+         *  first, and every spawn refuses it (`spawn_error` / `spawn_failed`) whenever it came. */
         inheritEnv?: "all" | "scrub" | string[];
         /** design/105: inject a resident scheduler daemon backend (the shell daemon). Absent ⇒ scheduling INERT. */
         scheduler?: SchedulerCapability;