@sema-agent/core 7.51.2 → 7.53.0

package/dist/core/own-property-receipt.js

@@ -1,4 +1,6 @@
 import { types } from "node:util";
+import { describeFault, isPlainRecord, receive } from "./mods/kernel/receive.js";
+import { MODS_VALUE_DEPTH } from "./mods/kernel/site-rules.js";
 export function receiptRefusal(message) {
     const e = new Error(message);
     e.code = "config.invalid_argument";
@@ -8,32 +10,20 @@ export function refuseProxy(given, words) {
     if (types.isProxy(given))
         throw receiptRefusal(`${words.subject} must be a plain object, not a Proxy: its ${words.unit}s are read once off its own descriptors, and a Proxy would run its traps in that read — refused rather than wired through it`);
 }
+export const CONFIG_RECEIPT_MODE = Object.freeze({ accessors: "call-once", depth: 1, others: "as-is", isProxy: (v) => types.isProxy(v) });
+export const DECLARATION_RECEIPT_MODE = Object.freeze({ accessors: "call-once", depth: MODS_VALUE_DEPTH + 1, others: "refuse", freeze: true, isProxy: (v) => types.isProxy(v) });
 export function receiveOwnProperties(given, words) {
     refuseProxy(given, words);
-    const proto = Object.getPrototypeOf(given);
-    if (proto !== Object.prototype && proto !== null) {
+    if (!isPlainRecord(given)) {
         throw receiptRefusal(`${words.subject} must be a plain object (its prototype is neither Object.prototype nor null): every ${words.unit} is read once as an own property, and a ${words.unit} its prototype would supply is not read — refused rather than wired without it`);
     }
-    const captured = Object.getOwnPropertyDescriptors(given);
-    const received = Object.create(Object.prototype);
-    for (const name of Object.getOwnPropertyNames(captured)) {
-        const d = captured[name];
-        let value;
-        if (Object.hasOwn(d, "value")) {
-            value = d.value;
-        }
-        else {
-            const get = Object.hasOwn(d, "get") ? d.get : undefined;
-            try {
-                value = get === undefined ? undefined : get.call(given);
-            }
-            catch {
-                throw receiptRefusal(`${words.subject}.${name} threw while it was read ${words.moment} — a ${words.unit} is read once, here; refused rather than wired without it`);
-            }
-        }
-        Object.defineProperty(received, name, { value, enumerable: true, writable: true, configurable: true });
-    }
-    if (Object.getPrototypeOf(given) !== proto)
+    const received = receive(given, CONFIG_RECEIPT_MODE);
+    if (received.ok)
+        return received.value;
+    const name = received.fault.path[0] ?? "";
+    if (received.fault.kind === "getter-threw")
+        throw receiptRefusal(`${words.subject}.${name} threw while it was read ${words.moment} — a ${words.unit} is read once, here; refused rather than wired without it`);
+    if (received.fault.kind === "prototype-moved")
         throw receiptRefusal(`${words.subject}'s prototype changed while its ${words.unit}s were read ${words.moment} — refused rather than wired from a moving object`);
-    return received;
+    throw receiptRefusal(`${words.subject} could not be read ${words.moment}: ${describeFault(received.fault)} — refused rather than wired without it`);
 }

package/dist/core/parent-spec-seat.d.ts

@@ -9,11 +9,12 @@
  * The checkpoint seat (`./checkpoint-seat.ts`) is the same shape for one field; this seat carries the rest.
  */
 import type { OnQuestion } from "./ask-question.js";
-import type { Hooks } from "./hooks.js";
+import type { ModRegistration } from "./mods/kernel/index.js";
+import type { EngineDollar } from "./mods/dollar.js";
 import type { ToolExecuteContext } from "./tool-spec.js";
 import type { TaskSpec } from "./types.js";
 /** The fields of a spec the seat carries — one `Pick`, shared by the mint's input and the apply's target. */
-export type ParentSpecSeatFields = Pick<TaskSpec, "principal" | "oneShot" | "clientContext" | "onQuestion" | "hooks" | "additionalDirectories" | "additionalReadDirectories" | "envFacts" | "memoryPersistenceCapable" | "memory" | "compaction" | "skillListingBudgetFraction" | "skillListingMaxDescChars" | "fileHistory">;
+export type ParentSpecSeatFields = Pick<TaskSpec, "principal" | "oneShot" | "clientContext" | "onQuestion" | "mods" | "additionalDirectories" | "additionalReadDirectories" | "envFacts" | "memoryPersistenceCapable" | "memory" | "compaction" | "skillListingBudgetFraction" | "skillListingMaxDescChars" | "fileHistory" | "promptForm" | "promptBinding">;
 /**
  * The seat a run hands its children. Every member is the parent's own value, frozen at mint (arrays copied and
  * frozen; the facts object copied). Members present iff the parent carries them — an absent member is "nothing to
@@ -23,10 +24,13 @@ export type ParentSpecSeatFields = Pick<TaskSpec, "principal" | "oneShot" | "cli
  *  · `clientContext` — the user's TZ/email facts (the child's environment block localizes the same way).
  *  · `onQuestion` — the parent's FROZEN question face (`spec.onQuestion ?? deps.onQuestion`, the value the parent's
  *    own AskUserQuestion resolves at): the child's question tool MOUNTS on it, so without it the child has no tool.
- *  · `hooks` — the parent's SPEC-level hook seams (`spec.hooks`, the request-level lifecycle hooks a host mounts from
- *    the user's settings). A deployment's `RunnerDeps.hooks` already serve every leg; the spec-level seams did not,
- *    so a `stop` seat a user wired ran for the leader and never for its teammates (CC runs `SubagentStop` from the
- *    same settings). Same law as `onQuestion`: a child's own value wins, the seat fills an unset one.
+ *  · `mods` — the parent's TASK seat of the mods bus (`spec.mods`, the request-level registrations a host mounts from
+ *    the user's settings). A deployment's `RunnerDeps.mods` already serve every leg; the task seat did not, so a
+ *    `classic.Stop` handler a user wired ran for the leader and never for its teammates (CC runs one chain for the
+ *    session and its subagents, the event carrying `agentId`). A child dispatches the travelled registrations as its
+ *    own task seat (its events carry the child's identity); an ancestor's chain still rides the constraint fold, and
+ *    collapses into the child's own phase 1 when the installation is the same. Same law as `onQuestion`: a child's
+ *    own value wins, the seat fills an unset one.
  *  · `additionalDirectories` / `additionalReadDirectories` — the fs-fence widening (deployment property).
  *  · `envFacts` — the sandbox facts (profile / egress / scratchpad).
  *  · `memoryPersistenceCapable` — the deployment's DECLARED persistence statement: `false` is a REMOVAL (floor),
@@ -45,13 +49,18 @@ export type ParentSpecSeatFields = Pick<TaskSpec, "principal" | "oneShot" | "cli
  *    and every leg multiplies it by its own.
  *  · `fileHistory` — the request's file-history off switch (`"disabled"`, its only word), for the edits its delegates
  *    make on its behalf too. An ORDINARY member (fill law); with one word no child can author it back on.
+ *  · `promptForm` — the host form of the system prompt (`"minimal"`, its only word: the core-behavior band is out). A
+ *    host's product choice for the whole delegation tree, so every engine-built child (both delegation lanes and the
+ *    observer sidecar) composes the same set of sections. An ORDINARY member (fill law).
+ *  · `promptBinding` — the binding (a deployment's scenario name), a prompt selector value. A child composes its
+ *    parent's center artifact, so its overlays' `when.binding` reads the same binding. An ORDINARY member (fill law).
  */
 export interface ParentSpecSeat {
     readonly principal?: string;
     readonly oneShot?: true;
     readonly clientContext?: TaskSpec["clientContext"];
     readonly onQuestion?: OnQuestion;
-    readonly hooks?: Hooks;
+    readonly mods?: readonly ModRegistration<EngineDollar>[];
     readonly additionalDirectories?: readonly string[];
     readonly additionalReadDirectories?: readonly string[];
     readonly envFacts?: TaskSpec["envFacts"];
@@ -61,6 +70,8 @@ export interface ParentSpecSeat {
     readonly skillListingBudgetFraction?: number;
     readonly skillListingMaxDescChars?: number;
     readonly fileHistory?: "disabled";
+    readonly promptForm?: "minimal";
+    readonly promptBinding?: string;
 }
 /** Mint the seat off the parent's REBOUND spec and its frozen question face (spec over deps — the caller resolves it once,
  *  the same value the parent's own question routing reads). Absent fields stay absent; `oneShot` only when `true`. */

package/dist/core/parent-spec-seat.js

@@ -4,7 +4,7 @@ export function parentSpecSeatOf(spec, frozenOnQuestion) {
         ...(spec.oneShot === true ? { oneShot: true } : {}),
         ...(spec.clientContext !== undefined ? { clientContext: spec.clientContext } : {}),
         ...(frozenOnQuestion !== undefined ? { onQuestion: frozenOnQuestion } : {}),
-        ...(spec.hooks !== undefined ? { hooks: spec.hooks } : {}),
+        ...(spec.mods !== undefined ? { mods: spec.mods } : {}),
         ...(spec.additionalDirectories !== undefined ? { additionalDirectories: Object.freeze([...spec.additionalDirectories]) } : {}),
         ...(spec.additionalReadDirectories !== undefined ? { additionalReadDirectories: Object.freeze([...spec.additionalReadDirectories]) } : {}),
         ...(spec.envFacts !== undefined ? { envFacts: Object.freeze({ ...spec.envFacts }) } : {}),
@@ -13,6 +13,8 @@ export function parentSpecSeatOf(spec, frozenOnQuestion) {
         ...(spec.skillListingBudgetFraction !== undefined ? { skillListingBudgetFraction: spec.skillListingBudgetFraction } : {}),
         ...(spec.skillListingMaxDescChars !== undefined ? { skillListingMaxDescChars: spec.skillListingMaxDescChars } : {}),
         ...(spec.fileHistory !== undefined ? { fileHistory: spec.fileHistory } : {}),
+        ...(spec.promptForm !== undefined ? { promptForm: spec.promptForm } : {}),
+        ...(spec.promptBinding !== undefined ? { promptBinding: spec.promptBinding } : {}),
         ...(spec.memory?.enabled === false ? { memoryOff: true } : {}),
     });
 }
@@ -25,7 +27,7 @@ export function applyParentSpecSeat(child, seat) {
         ...fill("principal", seat.principal),
         ...fill("clientContext", seat.clientContext),
         ...fill("onQuestion", seat.onQuestion),
-        ...fill("hooks", seat.hooks),
+        ...fill("mods", seat.mods),
         ...fill("additionalDirectories", (seat.additionalDirectories !== undefined ? [...seat.additionalDirectories] : undefined)),
         ...fill("additionalReadDirectories", (seat.additionalReadDirectories !== undefined ? [...seat.additionalReadDirectories] : undefined)),
         ...fill("envFacts", (seat.envFacts !== undefined ? { ...seat.envFacts } : undefined)),
@@ -33,6 +35,8 @@ export function applyParentSpecSeat(child, seat) {
         ...fill("skillListingBudgetFraction", seat.skillListingBudgetFraction),
         ...fill("skillListingMaxDescChars", seat.skillListingMaxDescChars),
         ...fill("fileHistory", seat.fileHistory),
+        ...fill("promptForm", seat.promptForm),
+        ...fill("promptBinding", seat.promptBinding),
         ...(seat.oneShot === true ? { oneShot: true } : {}),
         ...(seat.memoryPersistenceCapable === false ? { memoryPersistenceCapable: false } : fill("memoryPersistenceCapable", seat.memoryPersistenceCapable)),
         ...(seat.memoryOff === true ? { memory: memoryTurnedOff(child.memory) } : {}),

package/dist/core/path-identity.js

@@ -1,4 +1,5 @@
-import { anchorSpelling, isUncSpelling, win32NamespaceScreen } from "../tools/fs/safety.js";
+import { anchorSpelling, win32NamespaceScreen } from "../tools/fs/safety.js";
+import { isUncSpelling } from "./unc-spelling.js";
 export async function symlinkChainHops(env, path, signal, family, baseCwd) {
     if (typeof env.canonicalChain !== "function")
         return { ok: false, cause: "the environment declares no symlink-chain reader", asked: false };

package/dist/core/permission-rule-model.d.ts

@@ -161,15 +161,43 @@ export declare function callPathFaceOf(call: ToolCallLike): DenyFace | undefined
  *  it, whatever the call's tool is called (a caller's tool declaring a read path target is on the read face too)? */
 export declare function faceRowsSpeakFor(face: DenyFace | undefined): boolean;
 /**
- * The tools whose rule content NAMES THE VALUE of one parameter instead of a command or a path — the reference's `Skill(<name>)`
- * form, one row per tool: `param` is the argument the rule's content is read against, `params` every scalar argument the tool
- * carries (the parameter spelling `Tool(<param>:<pattern>)` those names used to reach is retired for such a tool, see
- * {@link parseNameRuleContent}). The tool's real schema keys are pinned equal to `params` (test/backlog1318).
+ * The tools whose rule content NAMES THE VALUE of one parameter instead of a command or a path — ONE grammar (the name grammar,
+ * match `name`), one row per tool, the row declaring the tool's SPELLING of it:
+ *  · BARE — the reference's `Skill(<name>)` / `Skill(<prefix>:*)`: `param` is the argument the rule's content is read against,
+ *    `params` every scalar argument the tool carries (the parameter spelling `Tool(<param>:<pattern>)` those names used to reach
+ *    is retired for such a tool, see {@link parseNameRuleContent}). The Skill tool's real schema keys are pinned equal to
+ *    `params` (test/backlog1318).
+ *  · KEYED — `words` present: the reference's `Artifact(action:<word>)`, the content carrying the argument's own key. `params`
+ *    is that one key; `words` is the closed set of values the tool itself declares for it (the row points at the tool's own
+ *    set, never a copy), and a rule names exactly one of them — no prefix form, no `*`.
+ * Whatever the spelling, a rule of this grammar says "the call's value of `param` is this value", read by the one subject
+ * reader ({@link nameRuleSubjectOf}), the one predicate ({@link nameRuleAdmits}), the one precedence walk
+ * ({@link adjudicatePersistedNameRules}) and the one offer ({@link suggestRuleForName}).
  */
 export declare const NAME_RULE_FACES: Readonly<Record<string, {
     readonly param: string;
     readonly params: readonly string[];
+    readonly words?: readonly string[];
 }>>;
+/**
+ * Why a call of a KEYED value tool that names no value for the key cannot be read against that key's deny / ask rules, or
+ * undefined (a bare-spelling tool, or no value tool). Every judge reads a call's arguments as the tool reads them
+ * (`argsAsTheToolReads`: its argument preparation, then the schema's coercions); a call that STILL names no value for the key
+ * runs a value no argument shows — a default filled in inside the tool's execution (a caller's tool mounted under the keyed
+ * name, or answering to it, with no argument preparation of its own). Whether a rule by the key reaches such a call is
+ * unknown, so every reader REFUSES it on the key's deny or ask rule — a refusal, never an ask a person could approve past a
+ * deny, and no allow by the key reaches it. A tool whose reading always names the key (the built-in `Artifact`: an absent
+ * action reads as `publish`) never meets this. A bare-spelling tool's call that names nothing is reached by nothing: no
+ * default stands behind it.
+ */
+export declare function keyedValueAbsentReason(tool: string): string | undefined;
+/**
+ * Does the name grammar read this content of this tool? Every content of a bare-spelling tool; on a keyed tool only content
+ * keyed by its own parameter (`action:…` on `Artifact`) — another key (`Artifact(url:…)`) is a rule on another argument,
+ * which the persisted grammar has no form for and the caller policy reads with its generic parameter lane. Undefined grammar
+ * ⇒ false.
+ */
+export declare function nameGrammarReads(tool: string, content: string): boolean;
 /**
  * The tools whose rule content names the HOST of the URL one parameter carries — the reference's `WebFetch(domain:<host>)`
  * form, one row per tool: `param` is the URL argument the host is read from ({@link domainRuleSubjectOf}). Read by
@@ -182,8 +210,9 @@ export declare const DOMAIN_RULE_FACES: Readonly<Record<string, {
  * Which tools a rule may name — the model's tool set is DERIVED, never a hand-kept list: the command rule word
  * ({@link COMMAND_RULE_TOOL}) takes the COMMAND grammar — the other shell-face tools take none of their own, their command is
  * judged by the `Bash(…)` rules ({@link laneToolNamesOf}); every tool the catalog declares a path target for (Read / Edit / Write /
- * Glob / NotebookEdit / …, `pathTargetOf`) takes the PATH grammar; the tools of {@link NAME_RULE_FACES} take the NAME grammar;
- * the tools of {@link DOMAIN_RULE_FACES} the DOMAIN grammar.
+ * Glob / NotebookEdit / …, `pathTargetOf`) takes the PATH grammar; the tools of {@link NAME_RULE_FACES} take the NAME grammar
+ * (each in its row's spelling: bare `Skill(<name>)`, keyed `Artifact(action:<word>)`); the tools of {@link DOMAIN_RULE_FACES} the
+ * DOMAIN grammar.
  * A rule on any other tool has no content this model can judge and is refused (`unsupported.tool`). The tool set therefore
  * moves with the catalog's declarations, exactly as the protective fences' covered set does.
  */
@@ -355,6 +384,21 @@ export interface ParsedRule {
 /** Upper bound on a rule text. Rules are human-authored one-liners; anything longer is a mistake or an
  *  attempt to make the store unreadable. */
 export declare const MAX_RULE_TEXT_CHARS = 512;
+/**
+ * The most code points of a rule's ORIGINAL text a notice's machine-read slot carries: twice the grammar's own bound. A text past
+ * {@link MAX_RULE_TEXT_CHARS} reads as no rule whatever follows its first characters, so the slot keeps room to show it as far as a person
+ * needs to recognise it and no further; every text a rule can be is carried whole. Not exported from the package root: a consumer reads
+ * the slot and never judges its length (it is not a relay that must refuse what the engine did not mint).
+ */
+export declare const NOTICE_RULE_TEXT_MAX: number;
+/**
+ * A rule's (or allow-list entry's) text as a notice's machine-read slot carries it: the original string, untouched, when it is at most
+ * {@link NOTICE_RULE_TEXT_MAX} code points; a longer one is cut to that many and ends in the engine's one truncation mark
+ * ({@link INLINE_TRUNCATION_MARK}), so the longest slot is `NOTICE_RULE_TEXT_MAX + INLINE_TRUNCATION_MARK_CODEPOINTS` (1 025) code points.
+ * The ONE reading both `permission.allowed_tool_not_granted` (`detail.entries[].entry`) and `permission.rule_row_dropped`
+ * (`detail.rows[].rule`) hand their rule text over through — what spells it for a person is the sentence, never this slot.
+ */
+export declare function noticeRuleText(text: string): string;
 /**
  * Interpreter names whose PREFIX form is refused everywhere a rule can enter the store (minting,
  * import, file reload, every backend). `Bash(node:*)` reads as one narrow-looking rule and means "run
@@ -956,7 +1000,9 @@ export declare function commandCoverageOf(rules: readonly PersistedRule[], call:
 };
 /** The answer of {@link adjudicatePersistedRules}: which behavior decided, and the rule(s) it stands
  *  on — a one-element set for a deny/ask (the first table-order rule of the deciding behavior that
- *  reaches the call) and the allow direction's coverage SET ({@link findAdmittingRule}). */
+ *  reaches the call; for a keyed tool's call naming no value for its key, a DENY standing on the first deny — else ask —
+ *  row of that key, which the call cannot be read against: {@link adjudicatePersistedNameRules}) and the allow
+ *  direction's coverage SET ({@link findAdmittingRule}). */
 export interface PersistedRuleVerdict {
     readonly behavior: RuleBehavior;
     readonly rules: readonly PersistedRule[];
@@ -1032,8 +1078,11 @@ export declare function adjudicatePersistedPathRules(rules: readonly PersistedRu
  * ({@link NAME_RULE_FACES}), judged on the one string the call names (`nameRuleSubjectOf`). A rule of the tool speaks for the call
  * when it is live, of this behavior, in scope ({@link eligiblePersisted}, the one predicate) and {@link nameRuleAdmits} the name; the
  * first behavior in {@link RULE_BEHAVIORS_BY_PRECEDENCE} whose rules speak decides, the first table-order rule of it is the answer.
- * Every behavior is judged with the one predicate — a name has no "program run" the tightening direction could read wider — and
- * there is nothing unreadable: a name is a string.
+ * Every behavior is judged with the one predicate — a name has no "program run" the tightening direction could read wider.
+ * A call that names nothing (read as the tool reads it): on a bare-spelling tool it is reached by no rule; on a KEYED tool it
+ * cannot be read against the key's rules ({@link keyedValueAbsentReason}) and is REFUSED — a deny verdict standing on the
+ * first eligible deny row of the key, else its first ask row (an ask a person could approve would let a deny be approved
+ * past) — and no allow row reaches it.
  */
 export declare function adjudicatePersistedNameRules(rules: readonly PersistedRule[], call: {
     tool: string;

package/dist/core/permission-rule-model.js

@@ -3,13 +3,15 @@ import { shellWordsOf } from "../shell/shell-words.js";
 import { parsePermissionRule } from "./permission-rule-syntax.js";
 import { compileReadDeny } from "../tools/fs/read-deny.js";
 import { carriesShellRedirection, parseLeadingCommandName, splitShellCompoundSegments } from "../tools/fs/bash-readonly-classifier.js";
-import { inlineUntrusted } from "./untrusted-text.js";
+import { INLINE_TRUNCATION_MARK, inlineUntrusted } from "./untrusted-text.js";
 import { isShellFaceToolName, pathTargetOf, protectivePathTargetOf } from "./tool-registry.js";
 import { heldValues } from "./tool-name-readings.js";
 import { carriesDotSegment, isAbsoluteForFamily, isIdentityDir, isPathIdentity, isShellRootedSpellingUnmapped, isUncIdentity, pathFamilyOf, pathIdentityOf } from "../tools/fs/safety.js";
 import { bindPathRules, judgeRuleRows, rowsWhereTheyLead } from "./path-rule-binding.js";
 import { readShellCommand } from "./shell-lexer.js";
 import { lineDescriptorsOfText, readOnlyLineObjection, readOnlyShellVerdict } from "./read-only-shell.js";
+import { ARTIFACT_ACTIONS } from "./artifact-host.js";
+import { ARTIFACT_TOOL_NAME } from "./tool-catalog-entries.js";
 export const RULE_BEHAVIORS = Object.freeze(["deny", "ask", "allow"]);
 const RULE_BEHAVIOR_SET = new Set(RULE_BEHAVIORS);
 export function isRuleBehavior(v) {
@@ -43,7 +45,25 @@ export function faceRowsSpeakFor(face) {
 }
 export const NAME_RULE_FACES = Object.freeze({
     Skill: Object.freeze({ param: "skill", params: Object.freeze(["skill", "args"]) }),
+    [ARTIFACT_TOOL_NAME]: Object.freeze({ param: "action", params: Object.freeze(["action"]), words: ARTIFACT_ACTIONS }),
 });
+function keyedValueParamOf(tool) {
+    const face = Object.hasOwn(NAME_RULE_FACES, tool) ? NAME_RULE_FACES[tool] : undefined;
+    return face?.words !== undefined ? face.param : undefined;
+}
+export function keyedValueAbsentReason(tool) {
+    const key = keyedValueParamOf(tool);
+    return key === undefined ? undefined : `the ${tool} call names no ${key} as the tool reads it, so the ${key} it runs is not one its arguments show — a rule by ${key} cannot be read against it`;
+}
+export function nameGrammarReads(tool, content) {
+    if (ruleToolGrammarOf(tool) !== "name")
+        return false;
+    const key = keyedValueParamOf(tool);
+    if (key === undefined)
+        return true;
+    const colon = content.indexOf(":");
+    return colon > 0 && content.slice(0, colon).trim() === key;
+}
 export const DOMAIN_RULE_FACES = Object.freeze({
     WebFetch: Object.freeze({ param: "url" }),
 });
@@ -95,6 +115,20 @@ function isCommandMatch(match) {
     return match === "exact" || match === "prefix" || match === "wildcard";
 }
 export const MAX_RULE_TEXT_CHARS = 512;
+export const NOTICE_RULE_TEXT_MAX = 2 * MAX_RULE_TEXT_CHARS;
+export function noticeRuleText(text) {
+    if (text.length <= NOTICE_RULE_TEXT_MAX)
+        return text;
+    let kept = 0;
+    let end = 0;
+    for (const ch of text) {
+        if (kept === NOTICE_RULE_TEXT_MAX)
+            return `${text.slice(0, end)}${INLINE_TRUNCATION_MARK}`;
+        end += ch.length;
+        kept += 1;
+    }
+    return text;
+}
 export const BARE_INTERPRETER_NAMES = new Set([
     "node", "deno", "bun", "python", "python2", "python3", "perl", "ruby", "php", "osascript",
     "java", "dotnet", "mono", "lua", "luajit", "julia", "Rscript", "tclsh", "groovy", "scala",
@@ -243,6 +277,13 @@ function ruleLaneShapeOf(command, reading) {
 }
 const CONTROL_CHARS_RE = /[\u0000-\u0008\u000A-\u001F\u007F-\u009F\p{Cf}\u2028\u2029]/u;
 const CONTROL_CHARS_GLOBAL_RE = new RegExp(CONTROL_CHARS_RE.source, "gu");
+const RULE_SPELLING_REJECT_BYTES = "<>";
+const RULE_SPELLING_REJECT_RE = new RegExp(`[${RULE_SPELLING_REJECT_BYTES}]`);
+function valueRuleFormsSentence() {
+    return Object.entries(NAME_RULE_FACES)
+        .map(([tool, face]) => (face.words !== undefined ? `${tool}(${face.param}:<${face.param}>) rules` : `${tool}(<${face.param}>) rules`))
+        .join(", ");
+}
 const DISCLOSED_RULE_TEXT_MAX_CHARS = 120;
 export function escapeForDisclosure(value) {
     let text;
@@ -293,13 +334,16 @@ export function parseRuleText(text, behavior) {
     }
     if (parsed.toolName !== COMMAND_RULE_TOOL) {
         const grammar = ruleToolGrammarOf(parsed.toolName);
+        if (grammar === undefined) {
+            return reject("unsupported.tool", `only Bash command rules, rules on path-targeting tools (Read, Edit, Write, …), ${valueRuleFormsSentence()} and WebFetch domain rules have a rule form in this version (got "${parsed.toolName}")`);
+        }
+        if (!tighten && RULE_SPELLING_REJECT_RE.test(parsed.ruleContent)) {
+            return reject("invalid.grammar", `"${text}" carries a shell redirection byte (${[...RULE_SPELLING_REJECT_BYTES].map((b) => `\`${b}\``).join(" or ")}) — no path, name or host allow spells one, and the grant would not read as what it looks like`);
+        }
         if (grammar === "name")
             return parseNameRuleContent(text, parsed.toolName, parsed.ruleContent, behavior);
         if (grammar === "domain")
             return parseDomainRuleContent(text, parsed.toolName, parsed.ruleContent, behavior);
-        if (grammar !== "path") {
-            return reject("unsupported.tool", `only Bash command rules, rules on path-targeting tools (Read, Edit, Write, …), Skill name rules and WebFetch domain rules have a rule form in this version (got "${parsed.toolName}")`);
-        }
         return parsePathRuleContent(text, parsed.toolName, parsed.ruleContent, behavior);
     }
     const content = parsed.ruleContent;
@@ -353,14 +397,18 @@ export function parseRuleText(text, behavior) {
 export function formatRuleText(command, match, tool) {
     if (match === "subpath")
         return `${tool}(//${command.startsWith("/") ? command.slice(1) : command}/**)`;
-    if (match === "path" || match === "name")
+    if (match === "path")
         return `${tool}(${command})`;
+    if (match === "name")
+        return `${tool}(${keyedValueParamOf(tool) !== undefined ? `${keyedValueParamOf(tool)}:` : ""}${command})`;
     if (match === "host" || match === "subdomain")
         return `${tool}(domain:${match === "subdomain" ? "*." : ""}${command})`;
     return `${tool}(${command}${match === "prefix" || match === "name_prefix" ? ":*" : match === "wildcard" ? " *" : ""})`;
 }
 function parseNameRuleContent(text, tool, content, behavior, verifyCanonical = true) {
     const face = NAME_RULE_FACES[tool];
+    if (face?.words !== undefined)
+        return parseKeyedValueRuleContent(text, tool, content, behavior, { param: face.param, words: face.words });
     const bare = content.startsWith("/") ? content.slice(1) : content;
     const colon = bare.indexOf(":");
     if (face !== undefined && colon > 0 && face.params.includes(bare.slice(0, colon).trim())) {
@@ -389,6 +437,24 @@ function parseNameRuleContent(text, tool, content, behavior, verifyCanonical = t
     }
     return { rule };
 }
+function parseKeyedValueRuleContent(text, tool, content, behavior, face) {
+    const vocabulary = face.words.join(", ");
+    const colon = content.indexOf(":");
+    if (colon <= 0 || content.slice(0, colon).trim() !== face.param) {
+        return reject("invalid.grammar", `${tool} rules name the ${face.param}: ${tool}(${face.param}:<${face.param}>) with one of ${vocabulary} ("${text}") — a bare value, or a rule on another argument, has no rule form here`);
+    }
+    const word = content.slice(colon + 1).trim();
+    if (word === "") {
+        return reject("invalid.grammar", `the ${face.param} in "${text}" is empty — ${tool} rules name the ${face.param} exactly as the call carries it`);
+    }
+    if (word.includes("*")) {
+        return reject("unsupported.wildcard", `a \`*\` in the ${face.param} of "${text}" has no rule form — ${tool} rules name one ${face.param} (${vocabulary}); the whole tool is the bare ${tool} entry`);
+    }
+    if (!face.words.includes(word)) {
+        return reject("invalid.grammar", `"${word}" is not one of the ${face.param} values ${tool} declares (${vocabulary}) — the rule would never reach a call`);
+    }
+    return { rule: { behavior, rule: formatRuleText(word, "name", tool), tool, match: "name", command: word } };
+}
 export function nameRuleAdmits(rule, name) {
     if (rule.match === "name")
         return name === rule.command;
@@ -802,7 +868,7 @@ export function directoryIdentityOf(spelling, bases) {
     const r = pathIdentityOf(spelling, pathFamilyOf(bases), bases.root ?? bases.cwd);
     return r.ok ? r.identity : undefined;
 }
-const CD_TARGET_REJECT_CHARS = /[*?[\]{}$`\\'"<>\n\r]/;
+const CD_TARGET_REJECT_CHARS = new RegExp(String.raw `[*?[\]{}$` + "`" + String.raw `\\'"\n\r` + RULE_SPELLING_REJECT_BYTES + "]");
 function cdSegmentDirectoryOf(segment, opts) {
     if (/[^\S \t]/.test(segment))
         return undefined;
@@ -1033,8 +1099,16 @@ export function adjudicatePersistedPathRules(rules, call, views, anchorsOf, lead
     return undefined;
 }
 export function adjudicatePersistedNameRules(rules, call) {
-    if (call.name === undefined)
+    if (call.name === undefined) {
+        if (keyedValueAbsentReason(call.tool) === undefined)
+            return undefined;
+        for (const behavior of ["deny", "ask"]) {
+            const row = rules.find((rule) => rule.match === "name" && eligiblePersisted(rule, call, behavior));
+            if (row !== undefined)
+                return { behavior: "deny", rules: [row] };
+        }
         return undefined;
+    }
     for (const behavior of RULE_BEHAVIORS_BY_PRECEDENCE) {
         for (const rule of rules) {
             if (eligiblePersisted(rule, call, behavior) && nameRuleAdmits(rule, call.name))