@sema-agent/core 7.51.2 → 7.52.0

package/dist/core/auto-compaction.js

@@ -1,9 +1,8 @@
 import { CROSS_SESSION_MESSAGE_TAG } from "../agents/cross-session-envelope.js";
 import { DEFAULT_CHARS_PER_TOKEN, DEFAULT_CLAMP_TOLERANCE, DEFAULT_COMPACTION_SETTINGS, CompactionError, compact, computeFileLists, dryRunSummarizationClamp, estimateContextTokens, estimateTokens, formatFileOperations, formatPersistedOutputRefs, prepareCompaction, shouldCompact, } from "../internal/harness.js";
-import { fileArgPath } from "../tools/fs/safety.js";
+import { fileArgPath } from "./tool-registry.js";
 import { contextEditFrontier, resolveTriggerWindow } from "./context-edit.js";
 import { selectCompactionEpoch } from "../prompt-assembly/epoch.js";
-import { SEMA_DEFAULT_PACK } from "../prompt-assembly/packs/sema-default.js";
 import { brainToRuntime } from "./runtime.js";
 import { defuseFenceMarkers, sanitizeUntrustedText } from "./untrusted-text.js";
 import { createSafeNotifier } from "./safe-notify.js";
@@ -158,19 +157,42 @@ export async function maybeCompact(opts) {
     let providerSummary;
     if (opts.summaryProvider && !forceRealSummary && !prep.value.isSplitTurn) {
         const providerModifiedFiles = computeFileLists(prep.value.fileOps).modifiedFilesByRecency;
+        const signal = opts.signal;
+        const cut = Symbol("cut");
+        let release = () => undefined;
+        const cutByAbort = new Promise((resolve) => {
+            if (signal === undefined || signal.aborted)
+                return;
+            const onAbort = () => resolve(cut);
+            signal.addEventListener("abort", onAbort, { once: true });
+            release = () => signal.removeEventListener("abort", onAbort);
+        });
+        let consulted;
         try {
-            const raw = await opts.summaryProvider({
-                messagesToSummarize: prep.value.messagesToSummarize,
-                previousSummary: prep.value.previousSummary,
-                modifiedFiles: providerModifiedFiles,
-            });
-            const trimmed = typeof raw === "string" ? raw.trim() : "";
+            consulted =
+                signal?.aborted === true
+                    ? cut
+                    : await Promise.race([
+                        Promise.resolve(opts.summaryProvider({
+                            messagesToSummarize: prep.value.messagesToSummarize,
+                            previousSummary: prep.value.previousSummary,
+                            modifiedFiles: providerModifiedFiles,
+                        })),
+                        cutByAbort,
+                    ]);
+            const trimmed = typeof consulted === "string" ? consulted.trim() : "";
             if (trimmed) {
                 providerSummary = trimmed;
             }
         }
         catch {
         }
+        finally {
+            release();
+        }
+        if (consulted === cut) {
+            throw Object.assign(new CompactionError("aborted", "compaction cancelled while the summary provider was answering — nothing was persisted"), opts.manualCancelSignal?.aborted === true ? { [COMPACTION_MANUAL_CANCEL_FLAG]: true } : {});
+        }
     }
     let summary;
     let firstKeptEntryId;
@@ -448,18 +470,17 @@ export async function maybeCompact(opts) {
     for (const m of ctx.messages)
         preChars += estimateTokens(m, cpt);
     const ca = opts.centerAdoption;
-    const restatedEpoch = selectCompactionEpoch((await opts.session.getPromptEpoch?.()) ?? undefined, SEMA_DEFAULT_PACK, ca?.declaredSections ?? opts.epochDeclaredSections, ca !== undefined
-        ? ca.clear === true
-            ? { clear: true }
-            : { centerArtifactDigest: ca.centerArtifactDigest, ...(ca.sourceRevision !== undefined ? { sourceRevision: ca.sourceRevision } : {}) }
-        : undefined);
+    const stored = await opts.session.getPromptEpoch?.();
+    const current = stored?.kind === "pin" ? stored.descriptor : undefined;
+    const identityNow = ca?.promptIdentity ?? opts.promptIdentity ?? (current !== undefined ? { layers: current.layers, ...(current.sourceRevision !== undefined ? { sourceRevision: current.sourceRevision } : {}) } : undefined);
+    const restatedEpoch = identityNow !== undefined ? selectCompactionEpoch(current, identityNow.layers, identityNow.sourceRevision) : undefined;
     const restatedListings = await opts.session.getAnnouncedListing().catch(() => undefined);
     if (opts.signal?.aborted === true) {
         throw Object.assign(new Error("compaction cancelled before commit — the abort signal fired during the summary call; nothing was persisted"), opts.manualCancelSignal?.aborted === true ? { [COMPACTION_MANUAL_CANCEL_FLAG]: true } : {});
     }
     await opts.session.appendCompaction(summaryWithAttachments, firstKeptEntryId, summaryTokensBefore, {
         ...(details ?? {}),
-        promptEpoch: restatedEpoch,
+        ...(restatedEpoch !== undefined ? { promptEpoch: restatedEpoch } : {}),
         ...(restatedListings !== undefined ? { announcedListings: restatedListings } : {}),
         ...(opts.activeTools !== undefined && opts.activeTools.length > 0 ? { activeTools: [...opts.activeTools] } : {}),
         ...(opts.gitRestate !== undefined ? { gitAnnouncement: { kind: opts.gitRestate.pending.kind, hash: opts.gitRestate.pending.hash, pending: true } } : {}),
@@ -494,9 +515,9 @@ export async function maybeCompact(opts) {
     }
     catch {
     }
-    if (ca !== undefined) {
+    if (ca !== undefined && restatedEpoch !== undefined) {
         try {
-            ca.apply(restatedEpoch.artifactDigest);
+            ca.apply(restatedEpoch.identity);
         }
         catch {
         }

package/dist/core/auto-promote.d.ts

@@ -106,7 +106,8 @@ export declare const FROZEN_DENYLIST_FLOOR: ReadonlySet<string>;
  *
  * @param artifactText the artifact's raw text (markdown body included).
  * @param declared the artifact's declared tool list (the `SkillSpec` member the loader copies) — its `allowedTools`
- *   entries, each read as a permission rule for the tool it names, are the symbol-drift baseline.
+ *   entries, read by the list reader as a rule for the tool each names (one it reads as nothing names none), are the
+ *   symbol-drift baseline.
  * @param profileTokens optional ADD-ONLY extra denylist tokens (UNIONed onto the frozen floor; cannot remove).
  */
 export declare function deriveTripwire(artifactText: string, declared: Pick<SkillSpec, "allowedTools">, profileTokens?: ReadonlySet<string>): TripwireResult;

package/dist/core/auto-promote.js

@@ -1,5 +1,5 @@
 import { extractSymbols } from "../tools/fs/repo-map.js";
-import { parsePermissionRule } from "./permission-rules.js";
+import { compileAllowList, compiledEntryName } from "./allow-entry.js";
 import { thrownText } from "./thrown-value.js";
 export function decideAutoPromote(i) {
     if (i.tripwire.escalate)
@@ -60,7 +60,7 @@ export function deriveTripwire(artifactText, declared, profileTokens) {
     const reasons = [];
     let escalate = false;
     try {
-        const allow = new Set((declared.allowedTools ?? []).map((entry) => parsePermissionRule(entry).toolName));
+        const allow = new Set(compileAllowList(declared.allowedTools ?? [], "allow").rows.map((r) => compiledEntryName(r.compiled)));
         const symbols = extractSymbols(artifactText);
         for (const sym of symbols) {
             if (!allow.has(sym)) {

package/dist/core/caller-tool-name.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Why `name` cannot be a caller tool's name or alias — or `undefined` when it can. Two clauses, in this order:
+ *  - the name must be one a rule can name ({@link isNameableToolName}; a value that is not a string is none): a tool mounted
+ *    under a name no list can write could be neither granted nor refused by name;
+ *  - `__` is reserved for the protocol namespaces: a caller name carrying it is read as a peer's tool everywhere names are
+ *    parsed (routing, policy, telemetry), and an alias carrying it would sit inside a peer's prefix domain (a refresh would
+ *    classify or clear it as remote, and a remote tool minted under the same name would shadow the local one).
+ */
+export declare function callerToolNameProblem(name: string): string | undefined;

package/dist/core/caller-tool-name.js

@@ -0,0 +1,13 @@
+import { NAMESPACED_NAME_SHAPES, carriesNamespaceSeparator } from "./protocol-table.js";
+import { isNameableToolName } from "./permission-rule-syntax.js";
+export function callerToolNameProblem(name) {
+    if (!isNameableToolName(name)) {
+        return (`a caller tool name or alias must be a name a rule can name — ASCII letters, digits and "_" "-" "." ":" "*", ` +
+            `starting with a letter, a digit or "_", not ending with "." or ":", and not the lone wildcard "*" — ` +
+            `or no allow or deny list could name the tool; rename it`);
+    }
+    if (carriesNamespaceSeparator(name)) {
+        return `"__" is reserved for the engine's protocol tool namespaces (${NAMESPACED_NAME_SHAPES}) and no caller tool name or alias may carry it`;
+    }
+    return undefined;
+}

package/dist/core/checkpoint-requirements.d.ts

@@ -6,7 +6,7 @@ import { type StoreFidelity, type Checkpoint, type CheckpointFeature, type Check
  * had carried beside the one its word now names, and the members added after the table, each a capability a reader
  * must have. Downstream reads them for display only (`CheckpointError.detail.requires`).
  */
-export declare const REQUIREMENT_WORDS: readonly ["resource", "binding", "token", "orgAdmission", "f012", "realApproval", "face", "requirements_digest", "org_admission_inherited", "org_write_grant", "org_governed", "delegation_provenance", "skill_grants", "skill_card_binding", "hands_coordinates", "hands_home", "path_rule_anchors", "path_rule_installations", "permission_mode", "plan_mode_restore", "persisted_rule_mandate", "deployment_authored", "call_names", "write_face", "denial_limit_fallback", "leg_scope", "tool_ceiling", "tool_lists_judged"];
+export declare const REQUIREMENT_WORDS: readonly ["resource", "binding", "token", "orgAdmission", "f012", "realApproval", "face", "requirements_digest", "org_admission_inherited", "org_write_grant", "org_governed", "delegation_provenance", "skill_grants", "skill_card_binding", "hands_coordinates", "hands_home", "path_rule_anchors", "path_rule_installations", "permission_mode", "plan_mode_restore", "persisted_rule_mandate", "deployment_authored", "call_names", "write_face", "denial_limit_fallback", "leg_scope", "tool_ceiling", "tool_lists_judged", "own_tool_lists"];
 export type RequirementWord = (typeof REQUIREMENT_WORDS)[number];
 /** Runtime twin of {@link RequirementWord}. */
 export declare function isRequirementWord(word: unknown): word is RequirementWord;
@@ -224,6 +224,9 @@ export declare const CHECKPOINT_STATE_REQUIREMENTS: {
     readonly toolListsJudged: {
         readonly word: "tool_lists_judged";
     };
+    readonly ownToolLists: {
+        readonly word: "own_tool_lists";
+    };
 };
 export declare const PENDING_ACTION_REQUIREMENTS: {
     readonly tool_approval: {
@@ -576,6 +579,9 @@ export declare const CHECKPOINT_REQUIREMENTS: {
             readonly toolListsJudged: {
                 readonly word: "tool_lists_judged";
             };
+            readonly ownToolLists: {
+                readonly word: "own_tool_lists";
+            };
         };
     };
     readonly resourceLedger: {

package/dist/core/checkpoint-requirements.js

@@ -30,6 +30,7 @@ export const REQUIREMENT_WORDS = Object.freeze([
     "leg_scope",
     "tool_ceiling",
     "tool_lists_judged",
+    "own_tool_lists",
 ]);
 export function isRequirementWord(word) {
     return typeof word === "string" && REQUIREMENT_WORDS.includes(word);
@@ -90,6 +91,7 @@ export const CHECKPOINT_STATE_REQUIREMENTS = {
     legScope: { word: "leg_scope" },
     toolCeiling: { word: "tool_ceiling" },
     toolListsJudged: { word: "tool_lists_judged" },
+    ownToolLists: { word: "own_tool_lists" },
 };
 export const PENDING_ACTION_REQUIREMENTS = {
     tool_approval: {

package/dist/core/checkpoint-store.d.ts

@@ -1338,7 +1338,9 @@ export interface CheckpointState {
     legScope?: string;
     /** The tool-selector layers this LEG was spawned under (`RunInternals.toolCeiling`), stamped at every mint: a resume that hands
      *  no live ceiling restores it, so a resumed child can never use a tool its spawning run could not. Absent ⇒ the leg had no
-     *  ceiling (a root run) or the row was minted before the member. A reader that lacks the word would run the leg unbounded. */
+     *  ceiling (a root run) or the row was minted before the member. A reader that lacks the word would run the leg unbounded.
+     *  Each entry is a tool name in its canonical spelling (`persistedToolNameList`, `src/agents/tool-filter.ts`): a row restored with
+     *  any other entry is refused before the claim (`checkpoint.config_refused`, `detail.code: config.tool_face_control`, `detail.field: inheritedGate`, the row pending). */
     toolCeiling?: ReadonlyArray<{
         readonly allow?: readonly string[];
         readonly deny: readonly string[];
@@ -1348,6 +1350,18 @@ export interface CheckpointState {
      *  that hands different lists is judged again. Absent ⇒ the leg judged its own lists (or the row was minted before the member). A
      *  reader that lacks the word would judge again a list judged against a wider universe, and refuse a leg that was valid. */
     toolListsJudged?: string;
+    /** Whose lists this LEG's own are (`RunInternals.ownToolLists`: the delegation tool that spawned it, by its declared name, the
+     *  agent definition it was spawned as — absent ⇒ the tool's tool-level list — and `lists`, the digest of exactly the lists it wrote),
+     *  stamped at every mint while it holds: a resume that hands no internals restores it while its own lists digest to `lists`, so the
+     *  resumed leg asks its own lists of the same universe (which carries that tool's name — a name of its lineage, mounted or not at its
+     *  depth) and a refusal names the same list; a resume that hands another table reads it as the host's own `TaskSpec` seats. Absent ⇒ the
+     *  leg's lists were not written by a delegation tool (or the row was minted before the member): the leg judges them against its own
+     *  roster as before. A reader that lacks the word would refuse a list the leg's lineage wrote, and refuse a leg that was valid. */
+    ownToolLists?: {
+        readonly toolName: string;
+        readonly definition?: string;
+        readonly lists: string;
+    };
 }
 /**
  * {@link CheckpointState} with **every** field made required-PRESENT, while each value keeps its original
@@ -2082,19 +2096,27 @@ export type CheckpointErrorReason = "version_newer" | "env_factory_missing" | "g
 /** On `resume.parent_constraint_mismatch`: a re-supplied chain entry whose path rules depend on the leg that installed it has
  *  no installation record (a chain written before the record existed) / a record that does not cover the chain entry for
  *  entry / a record member naming no absolute root. */
- | "installation_record_absent" | "installation_record_misaligned" | "installation_record_invalid";
+ | "installation_record_absent" | "installation_record_misaligned" | "installation_record_invalid"
+/** On `checkpoint.config_refused` with `detail.code` `config.tool_face_control` — the arm prepare's own refusal carries as its `detail.reason`:
+ *  a tool-name list the row recorded is not a list / has a member that is not a string / has a spelling no tool name can have / is not in
+ *  the one spelling a row records (`"not_a_list"`, `"not_a_string"`, `"unknown_name"`, `"unsupported_pattern"`); the record of the delegation tool that
+ *  wrote the leg's lists is not one (`"invalid_record"`); the roster the resume hands mounts a delegation tool under another name than it declares
+ *  (`"renamed_mount"`); the process-wide table of declared names is occupied by a value that is not the engine's (`"registry_occupied"`). */
+ | "not_a_list" | "not_a_string" | "unknown_name" | "unsupported_pattern" | "invalid_record" | "renamed_mount" | "registry_occupied";
 /**
- * The codes a RESUME's pre-claim configuration screen carries as `detail.code` of a `checkpoint.config_refused` — the eight
- * words prepare's mode, output-style, approval-reach, invoked-skill, attachment and recorded-mode doors throw, held unchanged so one refusal
+ * The codes a RESUME's pre-claim configuration screen carries as `detail.code` of a `checkpoint.config_refused` — the nine
+ * words prepare's mode, output-style, approval-reach, invoked-skill, attachment, recorded-mode and tool-face doors throw, held unchanged so one refusal
  * reads the same on a fresh run (`TaskResult.errorCode`) and on a resume. `config.spec_retired_key`: a retired spec key;
  * `config.output_style_invalid`: a malformed output-style seat; `config.permission_mode_invalid`: a mode word outside the closed
  * set (the config's `permissionMode`, or one the row recorded); `config.shell_gate_value_retired`: a retired shell-floor word;
  * `config.approval_reach_invalid`: an `approvalReach` outside its set; `config.user_invoked_skill_unknown` / `skill_deny_unreadable`:
  * `userInvokedSkills` names a skill the config does not carry / one whose `disallowed-tools` entry the grammar reads as nothing;
  * `config.user_attachment_invalid`: the config declares `userAttachments` (a resume sends no new human message) or a malformed
- * value there.
+ * value there; `config.tool_face_control`: the tool names the row recorded (its ceiling, its frozen policy chain, the record of who wrote
+ * its lists) are not readable as written, or the roster the resume hands mounts a delegation tool under another name than it declares
+ * (`detail.reason` names which: {@link CheckpointErrorReason}).
  */
-export declare const CHECKPOINT_CONFIG_REFUSAL_CODES: readonly ["config.spec_retired_key", "config.output_style_invalid", "config.permission_mode_invalid", "config.shell_gate_value_retired", "config.approval_reach_invalid", "config.user_invoked_skill_unknown", "config.skill_deny_unreadable", "config.user_attachment_invalid"];
+export declare const CHECKPOINT_CONFIG_REFUSAL_CODES: readonly ["config.spec_retired_key", "config.output_style_invalid", "config.permission_mode_invalid", "config.shell_gate_value_retired", "config.approval_reach_invalid", "config.user_invoked_skill_unknown", "config.skill_deny_unreadable", "config.user_attachment_invalid", "config.tool_face_control"];
 export type CheckpointConfigRefusalCode = (typeof CHECKPOINT_CONFIG_REFUSAL_CODES)[number];
 export declare const isCheckpointConfigRefusalCode: (word: unknown) => word is CheckpointConfigRefusalCode;
 /** A typed checkpoint-store error so callers branch on `code` (mirrors `SessionError`). */
@@ -2204,9 +2226,10 @@ export declare class CheckpointError extends Error {
     /** Parent effective-policy inheritance (shape check): the resume DID re-supply
      *  `internals.inheritedGate.parentConstraints`, but its length differs from the checkpoint's recorded
      *  `parentConstraintCount` — or (F-012 L1) its projection CONTENT digests differently from the
-     *  recorded `constraintDigest` — a partial/mismatched re-supply would silently run the child under a
-     *  thinner (or different) ancestor chain than it suspended with. Rejected pre-CAS (the checkpoint
-     *  stays `pending`); re-resume with the full original chain. */
+     *  recorded `constraintDigest` — or a screening entry names a `tool.check` guard beside a policy the
+     *  constraint mint did not make (no chain to raise it on) — a partial/mismatched re-supply would silently run
+     *  the child under a thinner (or different) ancestor chain than it suspended with. Rejected pre-CAS (the
+     *  checkpoint stays `pending`); re-resume with the full original chain. */
      | "resume.parent_constraint_mismatch"
     /** #449 G1 (codex r2, pre-CAS entrance): a deployment usage-governance window for this resume's
      *  ledger key (the config's principal, else the row's recorded one, else the shared bucket) is
@@ -2406,9 +2429,10 @@ export declare class CheckpointError extends Error {
     /** Parent effective-policy inheritance (shape check): the resume DID re-supply
      *  `internals.inheritedGate.parentConstraints`, but its length differs from the checkpoint's recorded
      *  `parentConstraintCount` — or (F-012 L1) its projection CONTENT digests differently from the
-     *  recorded `constraintDigest` — a partial/mismatched re-supply would silently run the child under a
-     *  thinner (or different) ancestor chain than it suspended with. Rejected pre-CAS (the checkpoint
-     *  stays `pending`); re-resume with the full original chain. */
+     *  recorded `constraintDigest` — or a screening entry names a `tool.check` guard beside a policy the
+     *  constraint mint did not make (no chain to raise it on) — a partial/mismatched re-supply would silently run
+     *  the child under a thinner (or different) ancestor chain than it suspended with. Rejected pre-CAS (the
+     *  checkpoint stays `pending`); re-resume with the full original chain. */
      | "resume.parent_constraint_mismatch"
     /** #449 G1 (codex r2, pre-CAS entrance): a deployment usage-governance window for this resume's
      *  ledger key (the config's principal, else the row's recorded one, else the shared bucket) is

package/dist/core/checkpoint-store.js

@@ -305,7 +305,7 @@ export function summarizeCheckpoint(cp) {
         ...(hasBidi ? { hasBidiControls: true } : {}),
     };
 }
-export const CHECKPOINT_CONFIG_REFUSAL_CODES = Object.freeze(["config.spec_retired_key", "config.output_style_invalid", "config.permission_mode_invalid", "config.shell_gate_value_retired", "config.approval_reach_invalid", "config.user_invoked_skill_unknown", "config.skill_deny_unreadable", "config.user_attachment_invalid"]);
+export const CHECKPOINT_CONFIG_REFUSAL_CODES = Object.freeze(["config.spec_retired_key", "config.output_style_invalid", "config.permission_mode_invalid", "config.shell_gate_value_retired", "config.approval_reach_invalid", "config.user_invoked_skill_unknown", "config.skill_deny_unreadable", "config.user_attachment_invalid", "config.tool_face_control"]);
 export const isCheckpointConfigRefusalCode = (word) => CHECKPOINT_CONFIG_REFUSAL_CODES.some((w) => w === word);
 export class CheckpointError extends Error {
     code;

package/dist/core/child-clamp-seats.d.ts

@@ -130,6 +130,12 @@ export declare const CLAMP_SET: Readonly<{
         readonly script: false;
         readonly carrier: "specSeat";
     }>;
+    promptForm: Readonly<{
+        readonly law: "restricting";
+        readonly value: "minimal";
+        readonly script: false;
+        readonly carrier: "specSeat";
+    }>;
 }>;
 /** One row's seat name. */
 export type ClampSeat = keyof typeof CLAMP_SET;

package/dist/core/child-clamp-seats.js

@@ -101,6 +101,7 @@ export const CLAMP_SET = Object.freeze({
     oneShot: Object.freeze({ law: "restricting", value: true, script: true, carrier: "specSeat" }),
     memoryPersistenceCapable: Object.freeze({ law: "restricting", value: false, script: true, carrier: "specSeat" }),
     fileHistory: Object.freeze({ law: "restricting", value: "disabled", script: false, carrier: "specSeat" }),
+    promptForm: Object.freeze({ law: "restricting", value: "minimal", script: false, carrier: "specSeat" }),
 });
 const ROWS = Object.freeze(Object.entries(CLAMP_SET));
 export const CLAMP_SEATS = Object.freeze(ROWS.map(([seat]) => seat));
@@ -210,7 +211,7 @@ export const CHILD_CLAMP_SEATS_NOT_CARRIED = Object.freeze({
     shellGate: "travels on the inherited-gate lane (`InheritedGate.shellGate`, a trusted internals seat), not on the child spec — a spec-level copy would be a second source for the same clamp",
     permissionMode: "travels on the inherited-gate lane (`InheritedGate.permissionMode` / `permissionModeCeiling` — the parent's declared word and its LIVE seat): a child with no word of its own inherits that ceiling on every read, and a word it does declare is clamped under it; a spec-level copy would freeze the parent's word at spawn and be a second source for the same clamp",
     onAsk: "per-lane by construction: the delegation lane wraps the parent's approver with spawn provenance before it becomes the child's seat, and a lane with no approver must hand down none (a parent that declared nobody can be asked hands down no approver — its frozen seat is empty — and the declaration rides `approvalReach`)",
-    hooks: "a deployment seat, not an inherited clamp — `tightenTaskSpec` refuses to merge two hook sets rather than composing them, so there is no tightening value to carry",
+    mods: "the task seat travels on the parent spec seat (a child dispatches it as its own, its events carrying the child's identity), not as a clamp — a registration adds a handler, it does not narrow a value",
     allowTools: "the tool selector's own layer — a parent bounds its children through the selector's ceiling (`RunInternals.toolCeiling`, a trusted internals seat every engine lane fills), not by copying its own list onto the child seat, which would be a second source for the same bound",
     excludeTools: "the deny half of the same layer as `allowTools` above, same reading: the parent's reaches its children through the ceiling",
     deferTools: "roster disclosure control rather than containment: the lanes that copy it do so beside these seats, and the workflow lane authors its child roster from the governance baseline instead of the host's",

package/dist/core/credential-vocabulary.d.ts

@@ -75,7 +75,13 @@ export interface CredentialVocabulary {
     readonly connectionStringName: RegExp;
     /** Credential env names, each also judged under the `INPUT_` prefix (a GitHub Actions input). */
     readonly exactEnvNames: readonly string[];
-    /** Credential-shaped names that hold no credential: exact names, never a shape. */
+    /** Credential-shaped names that hold no credential: declared names, never a pattern over names (the one pattern is
+     *  {@link CredentialVocabulary.nonSecretNameShape}). Three readings of the same list: the env-name view and the
+     *  record-member reading ({@link isSensitiveRecordKey}) take each as the WHOLE name (`CACHE_KEY` holds a setting,
+     *  `SECRET_CACHE_KEY` a secret, in an environment and in a config or detail record alike); the HTTP header-name
+     *  reading ({@link isSensitiveHeaderName}) takes it as the whole name or the TAIL of a longer one whose front part names
+     *  no credential word (`cf-aig-cache-key`, `X-Idempotency-Key`: a gateway's header for the same non-secret thing;
+     *  `secret-cache-key` stays a secret). */
     readonly nonSecretExactNames: readonly string[];
     /** The one name shape that holds no credential whatever words it carries: git's `GIT_CONFIG_KEY_<n…>` names a
      *  configuration key (its value sits in `GIT_CONFIG_VALUE_<n>`). Read by every name view, beside the exact names. */
@@ -93,6 +99,10 @@ export interface CredentialVocabulary {
  * seconds of synchronous CPU); the bound makes it linear and redacts no less on any URL.
  */
 export declare const URI_SCHEME_SOURCE: string;
+/** The fewest characters a string can have and still be read as a credential: the floor of a vendor-prefixed token's body
+ *  and of a bearer / authorization credential run in this table, and of the value rules of the env scrub. A shorter
+ *  string names no secret, whoever holds it. */
+export declare const CREDENTIAL_MIN_CHARS = 8;
 export declare const CREDENTIAL_VOCABULARY: CredentialVocabulary;
 /** The refuse-write label of a family: its id spelled with `_` (surfaced in the refusal; never the matched value). */
 export declare const refuseLabel: (id: string) => string;
@@ -123,19 +133,34 @@ export interface EnvNameView {
 export declare function envNameView(vocabulary: CredentialVocabulary): EnvNameView;
 /** `camelCase` / `PascalCase` read as `_`-separated words, `OAuth` and `NextAuth` kept whole. */
 export declare function splitCamelCase(name: string): string;
-/** The record-key view: what {@link CREDENTIAL_VOCABULARY} says about the names of a structured record's members (an HTTP
- *  header, a config or detail member) — the credential words of the env-name view, each row's `recordKeys` spellings
- *  besides, and a `separated` word standing alone (`pwd`, `pass`: a record has no shell variable of that name). The names
- *  the vocabulary declares non-secret stay non-secret here too: one fact, one reading in every view. */
+/** The record-key view: what {@link CREDENTIAL_VOCABULARY} says about the names a structured record carries — the member
+ *  of a config or detail record and the HTTP header — the credential words of the env-name view, each row's `recordKeys`
+ *  spellings besides, and a `separated` word standing alone (`pwd`, `pass`: a record has no shell variable of that name).
+ *  The names the vocabulary declares non-secret stay non-secret here too, as the whole name; the header-name reading
+ *  ({@link isSensitiveHeaderName}) alone also takes one as the tail of a longer name — a gateway prefixes the header it
+ *  names the same non-secret thing with (`cf-aig-cache-key`), where a secret named `secret_cache_key` lives in a
+ *  body or a config record and is read whole. */
 export interface RecordKeyView {
     /** A credential word in its position, case-insensitive. Applied to a key with `-` read as `_`, as written and
-     *  camel-split ({@link isSensitiveRecordKey}). */
+     *  camel-split ({@link isSensitiveRecordKey}, {@link isSensitiveHeaderName}). */
     readonly credentialWord: RegExp;
     readonly nonSecretExactNames: ReadonlySet<string>;
     readonly nonSecretNameShape: RegExp;
     readonly nonCredentialPrefix: RegExp;
 }
 export declare function recordKeyView(vocabulary: CredentialVocabulary): RecordKeyView;
-/** Does `key`, the name of a record's member (`Proxy-Authorization`, `pwd`, `X_API_KEY`, `clientSecret`), name a credential?
- *  Case does not matter, `-` and `_` are one. `view` is the vocabulary's record-key view unless a caller holds another. */
+/** Does `key`, the name of a record's MEMBER (`Proxy-Authorization`, `pwd`, `X_API_KEY`, `clientSecret`), name a credential?
+ *  Case does not matter, `-` and `_` are one. A name the vocabulary declares non-secret is none as the WHOLE name only
+ *  (`partition_key`; `x_partition_key` and `secret_cache_key` are still read by their words): a
+ *  secret is named by the system that holds it, and what this reading decides is whether a value is shown or kept out of
+ *  a record. The HTTP header-name reading is {@link isSensitiveHeaderName}. `view` is the vocabulary's record-key view
+ *  unless a caller holds another. */
 export declare function isSensitiveRecordKey(key: string, view?: RecordKeyView): boolean;
+/** Does `name`, an HTTP header's name (`Authorization`, `X-Api-Key`, `cf-aig-cache-key`), name a credential? The
+ *  record-key reading ({@link isSensitiveRecordKey}) plus one exemption: a declared non-secret name is none also as the
+ *  TAIL of a longer name, at a `_` / `-` boundary, whose front part holds no credential word (`cf-aig-cache-key`,
+ *  `X-Idempotency-Key`, `X-Partition-Key`; `secret-cache-key`, `clientAuth-cache-key` and `xcache-key`
+ *  are still read by their words). A gateway prefixes the header it names the same non-secret thing with, and the reading
+ *  that mistakes such a header for a credential drops the key that should have gone out. `view` is the vocabulary's
+ *  record-key view unless a caller holds another. */
+export declare function isSensitiveHeaderName(name: string, view?: RecordKeyView): boolean;

package/dist/core/credential-vocabulary.js

@@ -1,5 +1,6 @@
 export const URI_SCHEME_SOURCE = String.raw `[A-Za-z][A-Za-z0-9+.\-_]{0,63}`;
-const VENDOR_BODY = "[A-Za-z0-9_-]{8,}";
+export const CREDENTIAL_MIN_CHARS = 8;
+const VENDOR_BODY = `[A-Za-z0-9_-]{${CREDENTIAL_MIN_CHARS},}`;
 const VALUE_END = String.raw `\s"';|&`;
 const VALUE_CHAR = `[^${VALUE_END}]`;
 const ESCAPE_DEPTH = 63;
@@ -38,7 +39,7 @@ export const CREDENTIAL_VOCABULARY = {
         { id: "huggingface-token", kind: "prefixed-token", source: "arg-summary", confidence: "high", match: headed("hf_[A-Za-z0-9]{20,}"), strict: /\bhf_(?=[A-Za-z0-9]*[0-9])[A-Za-z0-9]{20,}\b/ },
         { id: "jwt", kind: "jwt", source: "arg-summary", confidence: "high", match: headed("eyJ[A-Za-z0-9._-]{20,}"), strict: /\beyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]{16,}\b/ },
         { id: "private-key", kind: "private-key-block", source: "arg-summary", confidence: "high", match: /-----BEGIN[ A-Z0-9]*PRIVATE KEY(?: BLOCK)?-----[\s\S]*?(?:-----END[ A-Z0-9]*PRIVATE KEY(?: BLOCK)?-----|$)/g, strict: /-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?-----/ },
-        { id: "bearer-token", kind: "bearer-token", source: "arg-summary", confidence: "high", match: headed(String.raw `()[Bb][Ee][Aa][Rr][Ee][Rr]\s+[A-Za-z0-9._~+/-]{8,}=*(?:${BEARER_TAIL})?`), strict: /\bAuthorization:\s*Bearer\s+(?=[A-Za-z0-9._~+/-]*[0-9])[A-Za-z0-9._~+/-]{20,}=*/ },
+        { id: "bearer-token", kind: "bearer-token", source: "arg-summary", confidence: "high", match: headed(String.raw `()[Bb][Ee][Aa][Rr][Ee][Rr]\s+[A-Za-z0-9._~+/-]{${CREDENTIAL_MIN_CHARS},}=*(?:${BEARER_TAIL})?`), strict: /\bAuthorization:\s*Bearer\s+(?=[A-Za-z0-9._~+/-]*[0-9])[A-Za-z0-9._~+/-]{20,}=*/ },
         { id: "authorization-header", kind: "authorization-header", source: "arg-summary", confidence: "high", match: headed(String.raw `(authorization(?:\\{0,${ESCAPE_DEPTH}}["'])?[ \t]*[=:][ \t]*(?:\\{0,${ESCAPE_DEPTH}}["'])?)${HEADER_VALUE}`, "gi") },
         { id: "azure-storage-account-key", kind: "prefixed-token", source: "arg-summary", confidence: "high", match: /(AccountKey=)[A-Za-z0-9+/]{40,}={0,2}/g, strict: /AccountKey=[A-Za-z0-9+/]{40,}={0,2}/ },
         { id: "keyword-value", kind: "keyword-value", source: "arg-summary", confidence: "medium", match: headed(String.raw `((?:token|secret|key|password|passwd|credential)["']?\s*[=:]\s*["']?)${VALUE_CHAR}{4,}${VALUE_RUN_END}`, "gi") },
@@ -82,7 +83,7 @@ export const CREDENTIAL_VOCABULARY = {
         "DEFAULT_WORKFLOW_TOKEN", "SSH_SIGNING_KEY",
     ],
     nonSecretExactNames: [
-        "PARTITION_KEY", "SORT_KEY", "RANGE_KEY", "IDEMPOTENCY_KEY", "CACHE_KEY", "ROUTING_KEY",
+        "PARTITION_KEY", "SORT_KEY", "RANGE_KEY", "IDEMPOTENCY_KEY", "CACHE_KEY",
         "DB_FOREIGN_KEYS", "JSON_SORT_KEYS",
         "MAX_NEW_TOKENS", "MAX_COMPLETION_TOKENS", "AIDER_MAP_TOKENS", "AIDER_MAX_CHAT_HISTORY_TOKENS",
         "MAX_BATCH_PREFILL_TOKENS", "MAX_WAITING_TOKENS", "MAX_TOP_N_TOKENS", "RATE_LIMIT_TOKENS",
@@ -149,9 +150,33 @@ export function recordKeyView(vocabulary) {
     };
 }
 const RECORD_KEYS = recordKeyView(CREDENTIAL_VOCABULARY);
-export function isSensitiveRecordKey(key, view = RECORD_KEYS) {
-    if (view.nonSecretExactNames.has(key.toUpperCase()) || view.nonSecretNameShape.test(key))
-        return false;
-    const words = key.replace(view.nonCredentialPrefix, "").replace(/-/g, "_");
+function holdsCredentialWord(text, view) {
+    const words = text.replace(view.nonCredentialPrefix, "").replace(/-/g, "_");
     return view.credentialWord.test(words) || view.credentialWord.test(splitCamelCase(words));
 }
+function isNonSecretRecordName(key, source, view) {
+    const spelled = key.replace(/-/g, "_");
+    const folded = spelled.toUpperCase();
+    if (view.nonSecretExactNames.has(folded))
+        return true;
+    if (source !== "header")
+        return false;
+    if (folded.length !== spelled.length)
+        return false;
+    for (const name of view.nonSecretExactNames) {
+        if (folded.endsWith(`_${name}`) && !holdsCredentialWord(spelled.slice(0, spelled.length - name.length - 1), view))
+            return true;
+    }
+    return false;
+}
+function readsAsCredential(key, source, view) {
+    if (view.nonSecretNameShape.test(key))
+        return false;
+    return holdsCredentialWord(key, view) && !isNonSecretRecordName(key, source, view);
+}
+export function isSensitiveRecordKey(key, view = RECORD_KEYS) {
+    return readsAsCredential(key, "member", view);
+}
+export function isSensitiveHeaderName(name, view = RECORD_KEYS) {
+    return readsAsCredential(name, "header", view);
+}

package/dist/core/decision-receipt.d.ts

@@ -1,7 +1,7 @@
 import type { PermissionResult } from "./tool-policy.js";
 export declare const refusedOutOfContract: (message: string) => PermissionResult;
-/** Is `d` a refusal the engine itself minted (by object identity — a look-alike `deny` a caller built is not one)? Public: the answer of
- *  `receiveHookResult` is one of two things, and this tells them apart. */
+/** Is `d` a refusal the engine itself minted (by object identity — a look-alike `deny` a caller built is not one)? The receipt's
+ *  answer is one of two things (the engine's refusal or its detached copy), and this tells them apart. */
 export declare const isEngineRefusal: (d: unknown) => boolean;
 /** A decision's `decisionReason` — the closed set; the type is derived FROM this list, so a word added to either side is a
  *  compile error rather than a drift between the type and the screen. Module-private (the package publishes the type).

package/dist/core/delegation-frames.d.ts

@@ -98,13 +98,20 @@ export interface BackgroundChildEvent {
      *  `w*` id. `parentTaskId` stays task-domain (the HOST task) so parent resolvers that only
      *  forward resolved task rows keep working; workflow grouping/nesting is THIS annotation's job. */
     workflowRunId?: string;
-    /** All kinds: the delegating Agent tool call's OWN `toolCallId` —
+    /** All kinds: the delegating tool call's OWN `toolCallId` —
      *  the same identity {@link TaskEvent}'s `parentToolCallId` already carries on every forwarded child
      *  content event (via `RunInternals.parentToolCallId`), extended to this SEPARATE observer/fleet
      *  event family so a consumer does not have to reassemble parent attribution from spawn-frame
      *  ordering alone (the exact gap a cross-repo consumer hit: FIFO-timing + shape-sniffing to guess
      *  which spawn frame a tick/terminal belongs to). Present from spawn — known at birth like
-     *  {@link transcriptId} — not just on the terminal frame. */
+     *  {@link transcriptId} — not just on the terminal frame.
+     *
+     *  Which call that is depends on the lane. An `Agent` delegation (`a*` rows) carries the id of the
+     *  `Agent` call that spawned the child. A workflow's agents (`wa*` rows: spawn, every tick and the terminal
+     *  frame alike) carry the id of the `Workflow` call that launched the run — ONE id shared by every row of
+     *  that run, so the relation is one card to N children and no two rows of a fan-out are told apart by this
+     *  field (their own `taskId` is the per-child key). ABSENT, never invented, on a workflow started with no
+     *  launching tool call. */
     parentToolCallId?: string;
     /** tick: the forwarded `task_progress` frame's own taskId (uuid domain; nested children carry theirs). */
     progressTaskId?: string;

package/dist/core/delegation-name.d.ts

@@ -0,0 +1,18 @@
+/** The table cannot be had: the slot holds a value that is not the engine's table (a deployment reset it), or the slot cannot be written. Registrations would be lost
+ *  and a renamed mount would read as a clean one — so this is a refusal (`config.tool_face_control`, `detail.reason: "registry_occupied"`), never a fresh table. */
+export declare class DelegationRegistryOccupied extends Error {
+    readonly code: "config.tool_face_control";
+    readonly detail: {
+        reason: "registry_occupied";
+    };
+    constructor(why: string);
+}
+/** Binds `name` to `tool.execute` (the function that carries the delegation out) and returns the tool. */
+export declare function bindDelegationName<T extends {
+    readonly execute: unknown;
+}>(name: string, tool: T): T;
+/** A product's wrapper around a bound `execute` is the same delegation: it answers to the name its source did. */
+export declare function carryDelegationName(source: unknown, product: unknown): void;
+/** The name the delegation tool this roster entry carries declared — or `undefined` (not a delegation tool the factory made, or its `execute` was wrapped by the host).
+ *  An entry whose members cannot be read reads as undeclared (the roster snapshot refuses it); an occupied table throws {@link DelegationRegistryOccupied}. */
+export declare function declaredDelegationNameOf(tool: unknown): string | undefined;

package/dist/core/delegation-name.js

@@ -0,0 +1,47 @@
+const DECLARED_NAMES = Symbol.for("sema.core.delegationDeclaredNames");
+export class DelegationRegistryOccupied extends Error {
+    code = "config.tool_face_control";
+    detail = { reason: "registry_occupied" };
+    constructor(why) {
+        super(`The table of declared delegation-tool names (globalThis[Symbol.for("sema.core.delegationDeclaredNames")]) ${why} — a delegation tool mounted under another name than it declares could not be told from a clean mount, so the run does not start. Leave that slot to the engine.`);
+    }
+}
+const tableIfAny = () => {
+    const slot = Reflect.get(globalThis, DECLARED_NAMES);
+    if (slot instanceof WeakMap)
+        return slot;
+    if (slot !== undefined)
+        throw new DelegationRegistryOccupied("holds a value that is not the engine's table");
+    return undefined;
+};
+const tableToBind = () => {
+    const held = tableIfAny();
+    if (held !== undefined)
+        return held;
+    const fresh = new WeakMap();
+    if (!Reflect.set(globalThis, DECLARED_NAMES, fresh))
+        throw new DelegationRegistryOccupied("cannot be written");
+    return fresh;
+};
+export function bindDelegationName(name, tool) {
+    if (typeof tool.execute === "function")
+        tableToBind().set(tool.execute, name);
+    return tool;
+}
+export function carryDelegationName(source, product) {
+    const slot = Reflect.get(globalThis, DECLARED_NAMES);
+    const names = slot instanceof WeakMap ? slot : undefined;
+    const name = names !== undefined && typeof source === "function" ? names.get(source) : undefined;
+    if (name !== undefined && typeof product === "function")
+        names.set(product, name);
+}
+export function declaredDelegationNameOf(tool) {
+    const names = tableIfAny();
+    try {
+        const execute = typeof tool === "object" && tool !== null ? tool.execute : undefined;
+        return typeof execute === "function" ? names?.get(execute) : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/core/engine-capabilities.d.ts

@@ -9,7 +9,14 @@
  *    result (`"all"` and `"scrub"` alike), and an allow list naming one is refused (`inheritEnvPolicyProblem`; every
  *    spawn throws it). The word speaks of INHERITANCE only: the engine process's own environment stays readable to
  *    same-user processes on the host (`ps -E`), so a credential that never enters it remains the root fix.
+ *  - `inherit_env.own_credential_values_withheld` — a child spawned on this host never inherits an env entry whose
+ *    value equals a credential value the deployment declared or the engine holds: `declareWithheldEnv` takes one table
+ *    `{ names, values }`, the engine adds the credentials it takes in, where it receives them (a first-party brain's
+ *    `apiKey` and credential headers, a model entry's credential headers, a protocol peer's credential headers, the
+ *    memory distiller's chat seat key), and `inheritedHostEnv` subtracts every entry whose value is one,
+ *    compared whole, under every policy. A credential resolved per request (a per-model auth hook's answer) is not in
+ *    it: the host that resolves it declares it. The same inheritance-only reading as the word above.
  */
-export declare const ENGINE_CAPABILITIES: readonly ["inherit_env.own_credentials_withheld"];
+export declare const ENGINE_CAPABILITIES: readonly ["inherit_env.own_credentials_withheld", "inherit_env.own_credential_values_withheld"];
 /** One word of {@link ENGINE_CAPABILITIES}. */
 export type EngineCapability = (typeof ENGINE_CAPABILITIES)[number];

package/dist/core/engine-capabilities.js

@@ -1 +1 @@
-export const ENGINE_CAPABILITIES = Object.freeze(["inherit_env.own_credentials_withheld"]);
+export const ENGINE_CAPABILITIES = Object.freeze(["inherit_env.own_credentials_withheld", "inherit_env.own_credential_values_withheld"]);