@sema-agent/core 7.51.2 → 7.53.0

package/dist/core/child-clamp-seats.d.ts

@@ -130,6 +130,12 @@ export declare const CLAMP_SET: Readonly<{
         readonly script: false;
         readonly carrier: "specSeat";
     }>;
+    promptForm: Readonly<{
+        readonly law: "restricting";
+        readonly value: "minimal";
+        readonly script: false;
+        readonly carrier: "specSeat";
+    }>;
 }>;
 /** One row's seat name. */
 export type ClampSeat = keyof typeof CLAMP_SET;

package/dist/core/child-clamp-seats.js

@@ -101,6 +101,7 @@ export const CLAMP_SET = Object.freeze({
     oneShot: Object.freeze({ law: "restricting", value: true, script: true, carrier: "specSeat" }),
     memoryPersistenceCapable: Object.freeze({ law: "restricting", value: false, script: true, carrier: "specSeat" }),
     fileHistory: Object.freeze({ law: "restricting", value: "disabled", script: false, carrier: "specSeat" }),
+    promptForm: Object.freeze({ law: "restricting", value: "minimal", script: false, carrier: "specSeat" }),
 });
 const ROWS = Object.freeze(Object.entries(CLAMP_SET));
 export const CLAMP_SEATS = Object.freeze(ROWS.map(([seat]) => seat));
@@ -210,7 +211,7 @@ export const CHILD_CLAMP_SEATS_NOT_CARRIED = Object.freeze({
     shellGate: "travels on the inherited-gate lane (`InheritedGate.shellGate`, a trusted internals seat), not on the child spec — a spec-level copy would be a second source for the same clamp",
     permissionMode: "travels on the inherited-gate lane (`InheritedGate.permissionMode` / `permissionModeCeiling` — the parent's declared word and its LIVE seat): a child with no word of its own inherits that ceiling on every read, and a word it does declare is clamped under it; a spec-level copy would freeze the parent's word at spawn and be a second source for the same clamp",
     onAsk: "per-lane by construction: the delegation lane wraps the parent's approver with spawn provenance before it becomes the child's seat, and a lane with no approver must hand down none (a parent that declared nobody can be asked hands down no approver — its frozen seat is empty — and the declaration rides `approvalReach`)",
-    hooks: "a deployment seat, not an inherited clamp — `tightenTaskSpec` refuses to merge two hook sets rather than composing them, so there is no tightening value to carry",
+    mods: "the task seat travels on the parent spec seat (a child dispatches it as its own, its events carrying the child's identity), not as a clamp — a registration adds a handler, it does not narrow a value",
     allowTools: "the tool selector's own layer — a parent bounds its children through the selector's ceiling (`RunInternals.toolCeiling`, a trusted internals seat every engine lane fills), not by copying its own list onto the child seat, which would be a second source for the same bound",
     excludeTools: "the deny half of the same layer as `allowTools` above, same reading: the parent's reaches its children through the ceiling",
     deferTools: "roster disclosure control rather than containment: the lanes that copy it do so beside these seats, and the workflow lane authors its child roster from the governance baseline instead of the host's",

package/dist/core/compliance.js

@@ -1,3 +1,4 @@
+import { describeRejectedValue } from "./tool-search-setting.js";
 export const COMPLIANCE_CAPABILITIES = Object.freeze(["mcp_servers", "workflows", "web_fetch", "org_memory_mount"]);
 export const BUILTIN_COMPLIANCE_DENIES = {
     hipaa: ["web_fetch", "org_memory_mount"],
@@ -26,7 +27,8 @@ export function resolveComplianceDenies(posture) {
 export function complianceCapabilityProblem(cap, owner) {
     if (COMPLIANCE_CAPABILITIES.some((member) => member === cap))
         return undefined;
-    return (`${owner} contains "${String(cap)}", not a member of the closed capability set ` +
+    const shown = (typeof cap === "object" && cap !== null) || typeof cap === "function" ? describeRejectedValue(cap) : `"${String(cap)}"`;
+    return (`${owner} contains ${shown}, not a member of the closed capability set ` +
         `(${COMPLIANCE_CAPABILITIES.join(", ")}) — a misspelled deny must never silently not-enforce.`);
 }
 export const WEB_FETCH_TOOL_NAME = "WebFetch";

package/dist/core/credential-vocabulary.d.ts

@@ -75,7 +75,13 @@ export interface CredentialVocabulary {
     readonly connectionStringName: RegExp;
     /** Credential env names, each also judged under the `INPUT_` prefix (a GitHub Actions input). */
     readonly exactEnvNames: readonly string[];
-    /** Credential-shaped names that hold no credential: exact names, never a shape. */
+    /** Credential-shaped names that hold no credential: declared names, never a pattern over names (the one pattern is
+     *  {@link CredentialVocabulary.nonSecretNameShape}). Three readings of the same list: the env-name view and the
+     *  record-member reading ({@link isSensitiveRecordKey}) take each as the WHOLE name (`CACHE_KEY` holds a setting,
+     *  `SECRET_CACHE_KEY` a secret, in an environment and in a config or detail record alike); the HTTP header-name
+     *  reading ({@link isSensitiveHeaderName}) takes it as the whole name or the TAIL of a longer one whose front part names
+     *  no credential word (`cf-aig-cache-key`, `X-Idempotency-Key`: a gateway's header for the same non-secret thing;
+     *  `secret-cache-key` stays a secret). */
     readonly nonSecretExactNames: readonly string[];
     /** The one name shape that holds no credential whatever words it carries: git's `GIT_CONFIG_KEY_<n…>` names a
      *  configuration key (its value sits in `GIT_CONFIG_VALUE_<n>`). Read by every name view, beside the exact names. */
@@ -93,6 +99,10 @@ export interface CredentialVocabulary {
  * seconds of synchronous CPU); the bound makes it linear and redacts no less on any URL.
  */
 export declare const URI_SCHEME_SOURCE: string;
+/** The fewest characters a string can have and still be read as a credential: the floor of a vendor-prefixed token's body
+ *  and of a bearer / authorization credential run in this table, and of the value rules of the env scrub. A shorter
+ *  string names no secret, whoever holds it. */
+export declare const CREDENTIAL_MIN_CHARS = 8;
 export declare const CREDENTIAL_VOCABULARY: CredentialVocabulary;
 /** The refuse-write label of a family: its id spelled with `_` (surfaced in the refusal; never the matched value). */
 export declare const refuseLabel: (id: string) => string;
@@ -123,19 +133,34 @@ export interface EnvNameView {
 export declare function envNameView(vocabulary: CredentialVocabulary): EnvNameView;
 /** `camelCase` / `PascalCase` read as `_`-separated words, `OAuth` and `NextAuth` kept whole. */
 export declare function splitCamelCase(name: string): string;
-/** The record-key view: what {@link CREDENTIAL_VOCABULARY} says about the names of a structured record's members (an HTTP
- *  header, a config or detail member) — the credential words of the env-name view, each row's `recordKeys` spellings
- *  besides, and a `separated` word standing alone (`pwd`, `pass`: a record has no shell variable of that name). The names
- *  the vocabulary declares non-secret stay non-secret here too: one fact, one reading in every view. */
+/** The record-key view: what {@link CREDENTIAL_VOCABULARY} says about the names a structured record carries — the member
+ *  of a config or detail record and the HTTP header — the credential words of the env-name view, each row's `recordKeys`
+ *  spellings besides, and a `separated` word standing alone (`pwd`, `pass`: a record has no shell variable of that name).
+ *  The names the vocabulary declares non-secret stay non-secret here too, as the whole name; the header-name reading
+ *  ({@link isSensitiveHeaderName}) alone also takes one as the tail of a longer name — a gateway prefixes the header it
+ *  names the same non-secret thing with (`cf-aig-cache-key`), where a secret named `secret_cache_key` lives in a
+ *  body or a config record and is read whole. */
 export interface RecordKeyView {
     /** A credential word in its position, case-insensitive. Applied to a key with `-` read as `_`, as written and
-     *  camel-split ({@link isSensitiveRecordKey}). */
+     *  camel-split ({@link isSensitiveRecordKey}, {@link isSensitiveHeaderName}). */
     readonly credentialWord: RegExp;
     readonly nonSecretExactNames: ReadonlySet<string>;
     readonly nonSecretNameShape: RegExp;
     readonly nonCredentialPrefix: RegExp;
 }
 export declare function recordKeyView(vocabulary: CredentialVocabulary): RecordKeyView;
-/** Does `key`, the name of a record's member (`Proxy-Authorization`, `pwd`, `X_API_KEY`, `clientSecret`), name a credential?
- *  Case does not matter, `-` and `_` are one. `view` is the vocabulary's record-key view unless a caller holds another. */
+/** Does `key`, the name of a record's MEMBER (`Proxy-Authorization`, `pwd`, `X_API_KEY`, `clientSecret`), name a credential?
+ *  Case does not matter, `-` and `_` are one. A name the vocabulary declares non-secret is none as the WHOLE name only
+ *  (`partition_key`; `x_partition_key` and `secret_cache_key` are still read by their words): a
+ *  secret is named by the system that holds it, and what this reading decides is whether a value is shown or kept out of
+ *  a record. The HTTP header-name reading is {@link isSensitiveHeaderName}. `view` is the vocabulary's record-key view
+ *  unless a caller holds another. */
 export declare function isSensitiveRecordKey(key: string, view?: RecordKeyView): boolean;
+/** Does `name`, an HTTP header's name (`Authorization`, `X-Api-Key`, `cf-aig-cache-key`), name a credential? The
+ *  record-key reading ({@link isSensitiveRecordKey}) plus one exemption: a declared non-secret name is none also as the
+ *  TAIL of a longer name, at a `_` / `-` boundary, whose front part holds no credential word (`cf-aig-cache-key`,
+ *  `X-Idempotency-Key`, `X-Partition-Key`; `secret-cache-key`, `clientAuth-cache-key` and `xcache-key`
+ *  are still read by their words). A gateway prefixes the header it names the same non-secret thing with, and the reading
+ *  that mistakes such a header for a credential drops the key that should have gone out. `view` is the vocabulary's
+ *  record-key view unless a caller holds another. */
+export declare function isSensitiveHeaderName(name: string, view?: RecordKeyView): boolean;

package/dist/core/credential-vocabulary.js

@@ -1,5 +1,6 @@
 export const URI_SCHEME_SOURCE = String.raw `[A-Za-z][A-Za-z0-9+.\-_]{0,63}`;
-const VENDOR_BODY = "[A-Za-z0-9_-]{8,}";
+export const CREDENTIAL_MIN_CHARS = 8;
+const VENDOR_BODY = `[A-Za-z0-9_-]{${CREDENTIAL_MIN_CHARS},}`;
 const VALUE_END = String.raw `\s"';|&`;
 const VALUE_CHAR = `[^${VALUE_END}]`;
 const ESCAPE_DEPTH = 63;
@@ -38,7 +39,7 @@ export const CREDENTIAL_VOCABULARY = {
         { id: "huggingface-token", kind: "prefixed-token", source: "arg-summary", confidence: "high", match: headed("hf_[A-Za-z0-9]{20,}"), strict: /\bhf_(?=[A-Za-z0-9]*[0-9])[A-Za-z0-9]{20,}\b/ },
         { id: "jwt", kind: "jwt", source: "arg-summary", confidence: "high", match: headed("eyJ[A-Za-z0-9._-]{20,}"), strict: /\beyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]{16,}\b/ },
         { id: "private-key", kind: "private-key-block", source: "arg-summary", confidence: "high", match: /-----BEGIN[ A-Z0-9]*PRIVATE KEY(?: BLOCK)?-----[\s\S]*?(?:-----END[ A-Z0-9]*PRIVATE KEY(?: BLOCK)?-----|$)/g, strict: /-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?-----/ },
-        { id: "bearer-token", kind: "bearer-token", source: "arg-summary", confidence: "high", match: headed(String.raw `()[Bb][Ee][Aa][Rr][Ee][Rr]\s+[A-Za-z0-9._~+/-]{8,}=*(?:${BEARER_TAIL})?`), strict: /\bAuthorization:\s*Bearer\s+(?=[A-Za-z0-9._~+/-]*[0-9])[A-Za-z0-9._~+/-]{20,}=*/ },
+        { id: "bearer-token", kind: "bearer-token", source: "arg-summary", confidence: "high", match: headed(String.raw `()[Bb][Ee][Aa][Rr][Ee][Rr]\s+[A-Za-z0-9._~+/-]{${CREDENTIAL_MIN_CHARS},}=*(?:${BEARER_TAIL})?`), strict: /\bAuthorization:\s*Bearer\s+(?=[A-Za-z0-9._~+/-]*[0-9])[A-Za-z0-9._~+/-]{20,}=*/ },
         { id: "authorization-header", kind: "authorization-header", source: "arg-summary", confidence: "high", match: headed(String.raw `(authorization(?:\\{0,${ESCAPE_DEPTH}}["'])?[ \t]*[=:][ \t]*(?:\\{0,${ESCAPE_DEPTH}}["'])?)${HEADER_VALUE}`, "gi") },
         { id: "azure-storage-account-key", kind: "prefixed-token", source: "arg-summary", confidence: "high", match: /(AccountKey=)[A-Za-z0-9+/]{40,}={0,2}/g, strict: /AccountKey=[A-Za-z0-9+/]{40,}={0,2}/ },
         { id: "keyword-value", kind: "keyword-value", source: "arg-summary", confidence: "medium", match: headed(String.raw `((?:token|secret|key|password|passwd|credential)["']?\s*[=:]\s*["']?)${VALUE_CHAR}{4,}${VALUE_RUN_END}`, "gi") },
@@ -82,7 +83,7 @@ export const CREDENTIAL_VOCABULARY = {
         "DEFAULT_WORKFLOW_TOKEN", "SSH_SIGNING_KEY",
     ],
     nonSecretExactNames: [
-        "PARTITION_KEY", "SORT_KEY", "RANGE_KEY", "IDEMPOTENCY_KEY", "CACHE_KEY", "ROUTING_KEY",
+        "PARTITION_KEY", "SORT_KEY", "RANGE_KEY", "IDEMPOTENCY_KEY", "CACHE_KEY",
         "DB_FOREIGN_KEYS", "JSON_SORT_KEYS",
         "MAX_NEW_TOKENS", "MAX_COMPLETION_TOKENS", "AIDER_MAP_TOKENS", "AIDER_MAX_CHAT_HISTORY_TOKENS",
         "MAX_BATCH_PREFILL_TOKENS", "MAX_WAITING_TOKENS", "MAX_TOP_N_TOKENS", "RATE_LIMIT_TOKENS",
@@ -149,9 +150,33 @@ export function recordKeyView(vocabulary) {
     };
 }
 const RECORD_KEYS = recordKeyView(CREDENTIAL_VOCABULARY);
-export function isSensitiveRecordKey(key, view = RECORD_KEYS) {
-    if (view.nonSecretExactNames.has(key.toUpperCase()) || view.nonSecretNameShape.test(key))
-        return false;
-    const words = key.replace(view.nonCredentialPrefix, "").replace(/-/g, "_");
+function holdsCredentialWord(text, view) {
+    const words = text.replace(view.nonCredentialPrefix, "").replace(/-/g, "_");
     return view.credentialWord.test(words) || view.credentialWord.test(splitCamelCase(words));
 }
+function isNonSecretRecordName(key, source, view) {
+    const spelled = key.replace(/-/g, "_");
+    const folded = spelled.toUpperCase();
+    if (view.nonSecretExactNames.has(folded))
+        return true;
+    if (source !== "header")
+        return false;
+    if (folded.length !== spelled.length)
+        return false;
+    for (const name of view.nonSecretExactNames) {
+        if (folded.endsWith(`_${name}`) && !holdsCredentialWord(spelled.slice(0, spelled.length - name.length - 1), view))
+            return true;
+    }
+    return false;
+}
+function readsAsCredential(key, source, view) {
+    if (view.nonSecretNameShape.test(key))
+        return false;
+    return holdsCredentialWord(key, view) && !isNonSecretRecordName(key, source, view);
+}
+export function isSensitiveRecordKey(key, view = RECORD_KEYS) {
+    return readsAsCredential(key, "member", view);
+}
+export function isSensitiveHeaderName(name, view = RECORD_KEYS) {
+    return readsAsCredential(name, "header", view);
+}

package/dist/core/decision-receipt.d.ts

@@ -1,7 +1,7 @@
 import type { PermissionResult } from "./tool-policy.js";
 export declare const refusedOutOfContract: (message: string) => PermissionResult;
-/** Is `d` a refusal the engine itself minted (by object identity — a look-alike `deny` a caller built is not one)? Public: the answer of
- *  `receiveHookResult` is one of two things, and this tells them apart. */
+/** Is `d` a refusal the engine itself minted (by object identity — a look-alike `deny` a caller built is not one)? The receipt's
+ *  answer is one of two things (the engine's refusal or its detached copy), and this tells them apart. */
 export declare const isEngineRefusal: (d: unknown) => boolean;
 /** A decision's `decisionReason` — the closed set; the type is derived FROM this list, so a word added to either side is a
  *  compile error rather than a drift between the type and the screen. Module-private (the package publishes the type).

package/dist/core/delegation-frames.d.ts

@@ -98,13 +98,20 @@ export interface BackgroundChildEvent {
      *  `w*` id. `parentTaskId` stays task-domain (the HOST task) so parent resolvers that only
      *  forward resolved task rows keep working; workflow grouping/nesting is THIS annotation's job. */
     workflowRunId?: string;
-    /** All kinds: the delegating Agent tool call's OWN `toolCallId` —
+    /** All kinds: the delegating tool call's OWN `toolCallId` —
      *  the same identity {@link TaskEvent}'s `parentToolCallId` already carries on every forwarded child
      *  content event (via `RunInternals.parentToolCallId`), extended to this SEPARATE observer/fleet
      *  event family so a consumer does not have to reassemble parent attribution from spawn-frame
      *  ordering alone (the exact gap a cross-repo consumer hit: FIFO-timing + shape-sniffing to guess
      *  which spawn frame a tick/terminal belongs to). Present from spawn — known at birth like
-     *  {@link transcriptId} — not just on the terminal frame. */
+     *  {@link transcriptId} — not just on the terminal frame.
+     *
+     *  Which call that is depends on the lane. An `Agent` delegation (`a*` rows) carries the id of the
+     *  `Agent` call that spawned the child. A workflow's agents (`wa*` rows: spawn, every tick and the terminal
+     *  frame alike) carry the id of the `Workflow` call that launched the run — ONE id shared by every row of
+     *  that run, so the relation is one card to N children and no two rows of a fan-out are told apart by this
+     *  field (their own `taskId` is the per-child key). ABSENT, never invented, on a workflow started with no
+     *  launching tool call. */
     parentToolCallId?: string;
     /** tick: the forwarded `task_progress` frame's own taskId (uuid domain; nested children carry theirs). */
     progressTaskId?: string;

package/dist/core/delegation-name.d.ts

@@ -0,0 +1,18 @@
+/** The table cannot be had: the slot holds a value that is not the engine's table (a deployment reset it), or the slot cannot be written. Registrations would be lost
+ *  and a renamed mount would read as a clean one — so this is a refusal (`config.tool_face_control`, `detail.reason: "registry_occupied"`), never a fresh table. */
+export declare class DelegationRegistryOccupied extends Error {
+    readonly code: "config.tool_face_control";
+    readonly detail: {
+        reason: "registry_occupied";
+    };
+    constructor(why: string);
+}
+/** Binds `name` to `tool.execute` (the function that carries the delegation out) and returns the tool. */
+export declare function bindDelegationName<T extends {
+    readonly execute: unknown;
+}>(name: string, tool: T): T;
+/** A product's wrapper around a bound `execute` is the same delegation: it answers to the name its source did. */
+export declare function carryDelegationName(source: unknown, product: unknown): void;
+/** The name the delegation tool this roster entry carries declared — or `undefined` (not a delegation tool the factory made, or its `execute` was wrapped by the host).
+ *  An entry whose members cannot be read reads as undeclared (the roster snapshot refuses it); an occupied table throws {@link DelegationRegistryOccupied}. */
+export declare function declaredDelegationNameOf(tool: unknown): string | undefined;

package/dist/core/delegation-name.js

@@ -0,0 +1,47 @@
+const DECLARED_NAMES = Symbol.for("sema.core.delegationDeclaredNames");
+export class DelegationRegistryOccupied extends Error {
+    code = "config.tool_face_control";
+    detail = { reason: "registry_occupied" };
+    constructor(why) {
+        super(`The table of declared delegation-tool names (globalThis[Symbol.for("sema.core.delegationDeclaredNames")]) ${why} — a delegation tool mounted under another name than it declares could not be told from a clean mount, so the run does not start. Leave that slot to the engine.`);
+    }
+}
+const tableIfAny = () => {
+    const slot = Reflect.get(globalThis, DECLARED_NAMES);
+    if (slot instanceof WeakMap)
+        return slot;
+    if (slot !== undefined)
+        throw new DelegationRegistryOccupied("holds a value that is not the engine's table");
+    return undefined;
+};
+const tableToBind = () => {
+    const held = tableIfAny();
+    if (held !== undefined)
+        return held;
+    const fresh = new WeakMap();
+    if (!Reflect.set(globalThis, DECLARED_NAMES, fresh))
+        throw new DelegationRegistryOccupied("cannot be written");
+    return fresh;
+};
+export function bindDelegationName(name, tool) {
+    if (typeof tool.execute === "function")
+        tableToBind().set(tool.execute, name);
+    return tool;
+}
+export function carryDelegationName(source, product) {
+    const slot = Reflect.get(globalThis, DECLARED_NAMES);
+    const names = slot instanceof WeakMap ? slot : undefined;
+    const name = names !== undefined && typeof source === "function" ? names.get(source) : undefined;
+    if (name !== undefined && typeof product === "function")
+        names.set(product, name);
+}
+export function declaredDelegationNameOf(tool) {
+    const names = tableIfAny();
+    try {
+        const execute = typeof tool === "object" && tool !== null ? tool.execute : undefined;
+        return typeof execute === "function" ? names?.get(execute) : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/core/effective-path-target.d.ts

@@ -245,17 +245,36 @@ export declare function readCallTarget(env: ExecutionEnv | undefined, call: Tool
     readonly root?: string | undefined;
     readonly cwd?: string | undefined;
 }, signal?: AbortSignal, leads?: ReadonlyMap<string, string | undefined>): Promise<CallTargetReading>;
+/** The gate's entry records the loop's reading of this call's arguments against the face it stamps on the call. */
+export declare function stampArgsReading(face: object, read: (args: unknown) => unknown): void;
 /**
- * `req` with its arguments replaced by `args` and — when `req` carries a reading of its own args — a reading of the NEW
- * args taken the same way (same environment, same root / cwd, same face). Every seat that rewrites a request's arguments
- * and hands it on (a composition's rewrite cascade, a re-judgment of the final or an edited form) goes through here, so the
- * next layer never judges a request its reading does not describe. `signal` is the CURRENT call's: a reading never carries
- * one call's cancellation into another's. `undefined` ⇒ nothing to re-read: use `{ ...req, args }`.
+ * `args` as the called tool will run them — its argument preparation and schema coercions, the reading the loop gave the
+ * model's call — for the call `req` belongs to; `args` itself when nothing was stamped (a bare request outside a Runner:
+ * a host judging a call reads it the tool's way first). Every seat that adopts a rewrite (a hook's, a policy's, a
+ * person's edit) takes it through here before anything judges it, so what is judged is what runs. A value the reading
+ * leaves as it is comes back as ITSELF (the same object: a target reading taken for it still describes it).
+ */
+export declare function argsAsTheToolReads(req: {
+    readonly face?: object | undefined;
+}, args: unknown): unknown;
+/** `args` through one call's reading `read` (the face-less seat: the resumed call reads through its live tool): ITSELF when the
+ *  reading leaves its bytes as they are, else the reading's value, recorded as read from `args`. */
+export declare function argsReadBy(read: (args: unknown) => unknown, args: unknown): unknown;
+/** The value `args` was read from, when a reading moved it; otherwise `args` itself. */
+export declare function argsReadFrom(args: unknown): unknown;
+/**
+ * `req` with its arguments replaced by `args` AS THE TOOL READS THEM ({@link argsAsTheToolReads}) and — when `req` carries
+ * a reading of its own target — a reading of the NEW args taken the same way (same environment, same root / cwd, same
+ * face). Every seat that rewrites a request's arguments and hands it on (a composition's rewrite cascade, a re-judgment of
+ * the final or an edited form) goes through here, so the next layer never judges a request its reading does not describe
+ * nor arguments the tool would run differently. `signal` is the CURRENT call's: a reading never carries one call's
+ * cancellation into another's.
  */
 export declare function withArgsReading<R extends {
     readonly args: unknown;
     readonly targetReading?: CallTargetReading | undefined;
-}>(req: R, args: unknown, signal: AbortSignal | undefined): Promise<R> | undefined;
+    readonly face?: object | undefined;
+}>(req: R, args: unknown, signal: AbortSignal | undefined): Promise<R>;
 /** The request's target reading, when it describes the request's own `args` (the object it was taken for); otherwise
  *  nothing — a rule lane then judges the lexical view it always judged. Every rule lane reads the reading through here. */
 export declare function callTargetReadingOf(req: {

package/dist/core/effective-path-target.js

@@ -3,6 +3,7 @@ import { declaredPathTargetOf, pathTargetValue, protectivePathTargetOf } from ".
 import { symlinkChainHops } from "./path-identity.js";
 import { DEFAULT_GATE_AWAIT_TIMEOUT_MS, withGateTimeout } from "./gate-bounded-await.js";
 import { thrownText } from "./thrown-value.js";
+import { canonicalize } from "./canonical-json.js";
 export function pathTargetBaseOf(pt, bases) {
     return (pt?.base ?? "cwd") === "root" ? bases.root : (bases.cwd ?? bases.root);
 }
@@ -146,10 +147,31 @@ export async function readCallTarget(env, call, signal, leads) {
     REREAD.set(reading, (args, rereadSignal) => readCallTarget(env, { ...call, args }, rereadSignal, leads));
     return reading;
 }
-export function withArgsReading(req, args, signal) {
+const ARGS_READING = new WeakMap();
+export function stampArgsReading(face, read) {
+    ARGS_READING.set(face, read);
+}
+export function argsAsTheToolReads(req, args) {
+    const read = req.face === undefined ? undefined : ARGS_READING.get(req.face);
+    return read === undefined ? args : argsReadBy(read, args);
+}
+export function argsReadBy(read, args) {
+    const out = read(args);
+    if (out === args || canonicalize(out) === canonicalize(args))
+        return args;
+    if (typeof out === "object" && out !== null)
+        READ_FROM.set(out, args);
+    return out;
+}
+const READ_FROM = new WeakMap();
+export function argsReadFrom(args) {
+    return typeof args === "object" && args !== null && READ_FROM.has(args) ? READ_FROM.get(args) : args;
+}
+export async function withArgsReading(req, args, signal) {
+    const read = argsAsTheToolReads(req, args);
     const reading = callTargetReadingOf(req);
     const reread = reading === undefined ? undefined : REREAD.get(reading);
-    return reread === undefined ? undefined : reread(args, signal).then((targetReading) => ({ ...req, args, targetReading }));
+    return reread === undefined ? { ...req, args: read } : { ...req, args: read, targetReading: await reread(read, signal) };
 }
 function viewFrom(v) {
     if (v.lexical === undefined)

package/dist/core/engine-capabilities.d.ts

@@ -9,7 +9,14 @@
  *    result (`"all"` and `"scrub"` alike), and an allow list naming one is refused (`inheritEnvPolicyProblem`; every
  *    spawn throws it). The word speaks of INHERITANCE only: the engine process's own environment stays readable to
  *    same-user processes on the host (`ps -E`), so a credential that never enters it remains the root fix.
+ *  - `inherit_env.own_credential_values_withheld` — a child spawned on this host never inherits an env entry whose
+ *    value equals a credential value the deployment declared or the engine holds: `declareWithheldEnv` takes one table
+ *    `{ names, values }`, the engine adds the credentials it takes in, where it receives them (a first-party brain's
+ *    `apiKey` and credential headers, a model entry's credential headers, a protocol peer's credential headers, the
+ *    memory distiller's chat seat key), and `inheritedHostEnv` subtracts every entry whose value is one,
+ *    compared whole, under every policy. A credential resolved per request (a per-model auth hook's answer) is not in
+ *    it: the host that resolves it declares it. The same inheritance-only reading as the word above.
  */
-export declare const ENGINE_CAPABILITIES: readonly ["inherit_env.own_credentials_withheld"];
+export declare const ENGINE_CAPABILITIES: readonly ["inherit_env.own_credentials_withheld", "inherit_env.own_credential_values_withheld"];
 /** One word of {@link ENGINE_CAPABILITIES}. */
 export type EngineCapability = (typeof ENGINE_CAPABILITIES)[number];

package/dist/core/engine-capabilities.js

@@ -1 +1 @@
-export const ENGINE_CAPABILITIES = Object.freeze(["inherit_env.own_credentials_withheld"]);
+export const ENGINE_CAPABILITIES = Object.freeze(["inherit_env.own_credentials_withheld", "inherit_env.own_credential_values_withheld"]);

package/dist/core/engine-notice.d.ts

@@ -68,7 +68,11 @@ export interface EngineNotice {
      *    as usual. Audience `user`; once per prepared task for the skill and request lists (`detail.sessionId` present), once
      *    per Runner for the deployment's (at construction, no session). `detail: { sessionId?, entries: [{ source, entry,
      *    reason, skill?, list? }] }` (`source` ∈ `skill` / `request` / `deployment`; `skill` and `list` only on a skill's;
-     *    `reason` ∈ {@link import("./allow-entry.js").ALLOW_ENTRY_INERT_REASONS}).
+     *    `reason` ∈ {@link import("./allow-entry.js").ALLOW_ENTRY_INERT_REASONS}; `entry` is the entry as written — the message spells it — when it is at most `NOTICE_RULE_TEXT_MAX` (1 024) code points; a longer one is cut to 1 024 plus the truncation mark, 1 025 in all).
+     *  - `"mods.registration_refused"` — an extension registration was not mounted: a registration admitted before it
+     *    answered `{ refuse }` on `plugin.register`, or failed while judging it (fail-closed). The run goes on without it.
+     *    Audience `user` (the seat is in `detail`). Once per refused registration per run. `detail: { name, seat, tier,
+     *    refusedBy, reason, sessionId }` (`seat` ∈ `deployment` / `task`).
      *  - `"skills.listing_truncated"` — the `<skills>` disclosure block did not fit its byte budget, so
      *    at least one skill is listed without its description (`nameOnly`) or, in the pathological case,
      *    not listed at all (`dropped`); the `Skill` tool still serves every one of them. Audience
@@ -213,7 +217,7 @@ export interface EngineNotice {
      *    the pairing pre-flight and the seat fell back to the primary model instead of sinking the
      *    task; the notice is the loud half of that swap.
      *    `detail: { seat, from, to, cause, fixHint, sessionId?, runId? }` — `cause` is the refusal code
-     *    (`route.credential_mismatch` / `route.credential_missing`); `sessionId` (#433, additive)
+     *    (a `RouteRefusalCode` word, the verdict's own); `sessionId` (#433, additive)
      *    rides when the adjudicating seat knows its session, and `runId` (#499, additive) names the
      *    INVOCATION whose seats were being resolved — both correlation keys only, the audience stays
      *    `"operator"` (see the registry's entitlement-not-routability note), and `runId` is what tells one
@@ -261,16 +265,17 @@ export interface EngineNotice {
      *    classifier and the leg's own can carry two); not minted while the call is being aborted (a halt, or the run's end). Audience
      *    `user`: on a lane with no approval face this line is the only place the user hears why the call did not
      *    run. It is not a block — the denial limit does not count it.
-     *  - `"route.base_url_changed_key_unchanged"` (key↔URL pairing) — `Runner.swapDeps` moved a
-     *    same-name entry's `baseUrl` while its Model-visible credential half (auth-bearing headers)
-     *    did not change: legal (a provider changing domains), but worth one loud line — if the
-     *    PROVIDER changed, the credential reference needs the same update. Advisory only, never a
-     *    refusal; per-model-hook credentials are invisible to the catalog swap, so the notice is
-     *    deliberately conservative (it may fire when a hook-side credential DID change in lockstep).
-     *    One aggregated notice per swap; `detail: { entries: [{ modelId, from, to }], total,
-     *    occurrenceId }` (rendered list bounded, total always exact); the `occurrenceId` is minted at this
-     *    announcement, independently of the `config.models_swapped` line's own, because the bounded render
-     *    makes two swaps moving the same first entries identical. Dedup key: (code, occurrenceId).
+     *  - `"route.credential_origin_mismatch"` (key↔URL pairing, `src/brain/route-adjudicator.ts`; announced by
+     *    `src/core/runner/credential-origin-seat.ts`) — a request was REFUSED, nothing sent, because the per-model
+     *    credential it would carry is bound to another origin: the law binds a per-model credential to the origin
+     *    (scheme + host + port) of the first request sent carrying it, so an entry whose `baseUrl` moved to another
+     *    host while its credential stayed the same is refused (same-origin path moves are not). The request's own
+     *    failure carries the same code (`[invalid_request] route.credential_origin_mismatch: …`). Minted only for a
+     *    request the gate refused (`routeRefusalError`): a pre-flight or read-face judgment reports nothing, and a derived
+     *    seat refused this way falls back as `route.fallback_to_primary` names. Audience `user` — the person whose request
+     *    failed hears why; the operator hears it through the sink. `detail: { modelId, boundOrigin, requestOrigin,
+     *    sessionId, runId }` — the two origins in display spelling, never a credential or a digest of one. Once per
+     *    run per (modelId, boundOrigin, requestOrigin).
      *  - `"route.response_model_mismatch"` — the provider answered a turn naming a model that is NOT the id
      *    the request was sent with (an alias, a pool or a gateway-side substitution looks exactly like this),
      *    so it is advisory, never a refusal: the engine keeps asking for the catalog's id and reports the
@@ -380,12 +385,20 @@ export interface EngineNotice {
      *    (`isolation`, `suspendable`, `canonicalPathAuthoritative`) with a non-boolean value; ABSENCE is a
      *    supported reading of each and stays silent. Once per key per run; `detail: { key, valueType }`.
      *  - `"config.secret_env_scrubbed"` (#1081) — the D1 fail-closed `scrub` policy, or the deployment's
-     *    declared own credentials (`declareWithheldEnv`), withheld one or more keys from a spawned child's
-     *    environment (a tool's shell, an oracle gate, or a language server).
+     *    own credentials (`declareWithheldEnv`: a declared name, or a value equal to a declared or engine-held
+     *    credential value), withheld one or more keys from a spawned child's environment (a tool's shell, an
+     *    oracle gate, or a language server).
      *    Once per PROCESS, shared by every scrub site ({@link import("./secret-env.js").announceSecretEnvScrub});
      *    `detail: { names, ownCredentials? }` — every withheld key's name, never a value; `ownCredentials`, present
-     *    only when one was withheld, the subset withheld as declared own credentials (under any policy, `"all"`
-     *    included).
+     *    only when one was withheld, the subset withheld as own credentials, by name or by value (under any policy,
+     *    `"all"` included).
+     *  - `"config.credential_not_withheld"` (#1816) — a credential value the engine was handed (a brain's key or credential
+     *    header, a model entry's or a peer's credential header, a consolidation seat's key) is no credential (a placeholder
+     *    such as `EMPTY`, fewer than eight characters, one character repeated): it is used as given, but a variable holding
+     *    the same string is not withheld from a spawned child. Once per PROCESS per value
+     *    ({@link import("./secret-env.js").holdOwnCredentialValues}); `detail: { reason }` — the kind, never the value. Delivered
+     *    to `RunnerDeps.onNotice` from the `new Runner` receipt; the intakes with no structured seat (a brain's construction,
+     *    a request's route reading, a peer's dial, a directly built distiller seat) print its line on `console.warn`.
      *  - `"config.permission_mode_unavailable"` — the permission mode a task requested is not the mode the leg runs
      *    under: the deployment denies it (`by: "operator_deny"` — `RuntimeCaps.bypassPermissions` / `autoMode` is
      *    `false`), a requested `auto` has no classifier face (`by: "face_absent"` — neither the leg's deps nor its chain carry
@@ -426,7 +439,18 @@ export interface EngineNotice {
      *    complete absolute path (only a foreign writer or a hand edit makes one; every engine write face refuses it): they
      *    take no part in this run's checks — a deny or ask row among them protects nothing — until they are rewritten or
      *    removed. Once per run, by whichever read met them first. `detail: { rows, count, sessionId, runId }` — `rows`
-     *    the first eight `{ rule, scopeRoot }` (each bounded), `count` all of them. Audience `user`.
+     *    the first eight `{ rule, scopeRoot }`, `count` all of them; `rule` is the rule text as the store served it, through the same reading
+     *    as `permission.allowed_tool_not_granted`'s `entries[].entry` (the original, not a spelling of it, when it is at most 1 024 code points;
+     *    a longer one is cut to 1 024 plus the truncation mark, 1 025 in all), `scopeRoot` neutralized and bounded. Audience `user`.
+     *  - `"config.session_rules_earlier_grammar"` — a session's stored permission rules (`RunnerDeps.sessionPolicyStore`) hold
+     *    entries the rule grammar they were written in reads as nothing: an allow entry admits nothing, and a `toolDeny` entry
+     *    this engine's grammar reads as no rule makes those rules refuse every call until they are rewritten. The message names
+     *    the session, the bucket, the entries (the first five, the rest counted), the reader's word and the way out. Audience
+     *    `user`. Once per distinct entry set per bucket per rule layer (the run's own rules, each ancestor's inherited ones).
+     *    `detail: { bucket, storedGrammar, entries: [{ entry, reader }], rewrite: { by, stampsGrammar }, rulesSessionId,
+     *    sessionId }` — `entries` every one, `entry` through the same reading as `permission.allowed_tool_not_granted`'s;
+     *    `reader` ∈ `no_rule` / `named_no_tool`; `rewrite.by` = `operator_write_without_rev`; `rulesSessionId` the session
+     *    whose rules they are (an ancestor's on a delegated child), `sessionId` the run that read them.
      *  - `"config.durable_gate_unavailable"` — a durable-approval MANDATE is in force on a leg with NO
      *    checkpoint store: the per-principal `forceDurableGate` entitlement, or the task's own
      *    `durableApproval` opt-in with no live approver seat (`durableMandateSourceOf`, the predicate the
@@ -511,7 +535,9 @@ export interface EngineNotice {
      *    refused) but the run's ending was not its doing: the run's own ending stands and the result will
      *    NOT carry `haltedByUser` for it (the seat signs consumption, never acceptance). TWO mint points,
      *    one fact, one spelling, disjoint: the VERB arm — the halt arrived while the run's ending was already
-     *    owned by its own abort (nothing cut, nothing stopped; once per such verb call, and only while no halt
+     *    owned by its own abort, or after the loop's end (no turn cut, no boundary stopped — a compaction pass the
+     *    run's tail was in is still cut, and says so on its own `compaction_outcome{mooted, reason:"cancelled"}`;
+     *    once per such verb call, and only while no halt
      *    has been ACCEPTED on the run — after one was, the settle arm alone speaks for the run);
      *    the SETTLE arm — the halt was ACCEPTED (it may even have cut a live seat: `{turnCut:true}` +
      *    `task.turn_interrupted`) but the run ended for its own reason before the machinery consumed it —
@@ -551,9 +577,11 @@ export interface EngineNotice {
      *    taskId?, origin }` with `origin` ∈ `"interrupt"` (the verb) | `"walltime"` | `"turns"` |
      *    `"signal"` (every other run-level abort: the task's own `signal`, a parent's cancel, a
      *    `destroy()`, a refused preempt — the leg names the three it can tell apart and files the rest
-     *    here). Audience `"user"`. A stop that arrives
-     *    AFTER the loop's end is refused typed (`steering.not_running`, every verb alike) and mints
-     *    nothing: the refusal itself is the loud answer.
+     *    here). Audience `"user"`. A stop that arrives AFTER the loop's end but before `done` aborted no
+     *    live loop and mints nothing here: it is answered, the end-of-task compaction pass does not run past
+     *    it (cut in flight — `compaction_outcome{mooted, reason:"cancelled"}` — or never started), and the
+     *    loop's ending stands as it was. A stop that arrives once the result is out is refused typed (`steering.not_running`, every
+     *    verb alike): the refusal itself is the loud answer.
      *
      *  - `"approval.read_root_granted"` / `"approval.read_root_grant_rejected"` — an approver's `readRootGrant`
      *    (`AskOutcome`). GRANTED: it equalled the card's `readRootCandidate.dir` beside `allow: true`; this run's READ

package/dist/core/frontmatter-fence.d.ts

@@ -0,0 +1,10 @@
+/** The fence text a writer emits. The reader below accepts exactly this, plus trailing blanks and a CR. */
+export declare const FRONTMATTER_FENCE = "---";
+/** The refusal sentence for a file that OPENS a frontmatter block and never reaches a closing fence. One wording for
+ *  every reader that refuses such a file: the block exists and cannot be read, so reading the file as one with no
+ *  frontmatter (and dropping what the block declared) is not an answer. */
+export declare const UNCLOSED_FRONTMATTER_REASON = "opens with --- but is not closed by a whole-line ---";
+/** True ⇔ `line` is exactly a frontmatter fence: {@link FRONTMATTER_FENCE}, then spaces / tabs only, then
+ *  at most one CR. The line must not contain `\n` (callers split on it first). The SAME predicate judges
+ *  the opening fence (line 0) and the closing fence (the first later line it accepts). */
+export declare function isFrontmatterFence(line: string): boolean;

package/dist/core/frontmatter-fence.js

@@ -0,0 +1,6 @@
+export const FRONTMATTER_FENCE = "---";
+export const UNCLOSED_FRONTMATTER_REASON = "opens with --- but is not closed by a whole-line ---";
+const FENCE_TAIL = /^[ \t]*\r?$/;
+export function isFrontmatterFence(line) {
+    return line.startsWith(FRONTMATTER_FENCE) && FENCE_TAIL.test(line.slice(FRONTMATTER_FENCE.length));
+}

package/dist/core/gate-fold.js

@@ -8,18 +8,19 @@ import { createGateDeadline, awaitWriteProtectionJudgment, gateWaitFailureOf, wi
 import { shellReadFaceWords } from "../tools/fs/shell-read-face.js";
 import { failedJudgmentDeny } from "./runner/policy-throw.js";
 import { thrownText } from "./thrown-value.js";
-import { refuseOutOfContractDecision } from "./tool-policy.js";
+import { argsAsTheToolReads } from "./effective-path-target.js";
+import { foldHookAsk, refuseOutOfContractDecision } from "./tool-policy.js";
 import { applyUnansweredSilence, readStationAnswer, silencedBy } from "./shell-read-silence.js";
 import { asksUnstated, permissionSeatAt, unstatedAskMessage } from "./mode-policy.js";
 export async function runGateFold(pass) {
     const { input, toolName, toolCallId, callSignal, ledger, notifier, adjudicate } = pass;
     const boundedAwaitDeadlineMs = createGateDeadline(input, notifier);
-    pass.req = { toolName, args: pass.currentInput, toolCallId, ...(pass.req.face !== undefined ? { face: pass.req.face } : {}) };
+    pass.req = Object.freeze({ toolName, args: pass.currentInput, toolCallId, ...(pass.req.face !== undefined ? { face: pass.req.face } : {}) });
     let unread;
     try {
         const stamped = input.stampCallTarget?.(pass.req, callSignal ?? input.abortSignal);
         if (stamped !== undefined)
-            pass.req = await stamped;
+            pass.req = Object.freeze(await stamped);
     }
     catch (error) {
         unread = { error };
@@ -37,31 +38,13 @@ export async function runGateFold(pass) {
             pass.classifierRound = attributed;
     }
     if ((pass.decision.action === "allow" || pass.decision.action === "ask") && pass.decision.updatedInput !== undefined) {
-        pass.policyRewrite = pass.decision.updatedInput;
+        pass.policyRewrite = argsAsTheToolReads(pass.req, pass.decision.updatedInput);
     }
     else if (pass.hookAsk?.updatedInput !== undefined) {
-        pass.policyRewrite = pass.hookAsk.updatedInput;
+        pass.policyRewrite = argsAsTheToolReads(pass.req, pass.hookAsk.updatedInput);
     }
-    if (pass.decision.action === "allow" && pass.hookAsk) {
-        pass.decision = {
-            action: "ask",
-            ...(pass.hookAsk.message !== undefined ? { message: pass.hookAsk.message } : {}),
-            decisionReason: "hook",
-            ...(pass.hookAsk.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
-            ...(pass.hookAsk.updatedInput !== undefined ? { updatedInput: pass.hookAsk.updatedInput } : {}),
-        };
-    }
-    else if (pass.decision.action === "ask" && pass.hookAsk) {
-        const hookMessage = pass.hookAsk.message;
-        const foldedMessage = hookMessage !== undefined && hookMessage !== pass.decision.message
-            ? `${pass.decision.message !== undefined ? `${pass.decision.message} ` : ""}(a PreToolUse hook also asks: ${hookMessage})`
-            : pass.decision.message;
-        pass.decision = {
-            ...pass.decision,
-            decisionReason: "hook",
-            ...(foldedMessage !== undefined ? { message: foldedMessage } : {}),
-            ...(pass.hookAsk.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
-        };
+    if (pass.hookAsk !== undefined && pass.decision.action !== "deny") {
+        pass.decision = foldHookAsk(pass.decision, pass.hookAsk);
     }
     if ((pass.decision.action === "allow" || pass.decision.action === "ask") && input.shellReadCheck !== undefined) {
         const station = input.shellReadCheck;