@sema-agent/core 7.51.2 → 7.53.0

package/dist/core/retired-keys.d.ts

@@ -20,6 +20,10 @@ export declare function retiredKeyOf(bag: object, table: Readonly<Record<string,
  * `RunWorkflowToolDeps`, `TaskSpec`).
  */
 export declare function assertNoRetiredKeys(bag: object, table: Readonly<Record<string, string>>, owner: string): void;
+/** What replaced the `hooks` record, on a deps bag and on a `TaskSpec` alike: one seat name, one sentence, quoted by both
+ *  tables (this one and `runner/retired-runner-deps.ts`). The record's callbacks never run, so a deny one carried would pass
+ *  unseen — the key is refused by name instead. */
+export declare const RETIRED_HOOKS_REPLACEMENT = "the callback seats are `mods` registrations now \u2014 register the extension on `RunnerDeps.mods` (a deployment's) or `TaskSpec.mods` (a task's), hung on the `classic.*` events (`classic.PreToolUse`, `classic.PostToolUse`, `classic.PostToolBatch`, `classic.UserPromptSubmit`, `classic.Stop`, `classic.SubagentStop`, \u2026); a callback that denied is a handler answering `{ action: \"deny\", message }`";
 /** The RETIRED `TaskSpec` keys, each with the sentence that names its replacement — the table the spec door reads
  *  ({@link assertNoRetiredKeys} with owner `TaskSpec`). A caller still writing one of these is refused by name
  *  (`config.spec_retired_key`), never read as absence: a mode a caller believes it declared must not silently run
@@ -42,7 +46,13 @@ export declare const RETIRED_SHELL_READ_BOUNDARY_KEYS: Readonly<Record<string, s
  *  decision that carries one is denied in the engine's own words, never read without it: the type retires a member only where
  *  a decision is a literal in an annotated position, and a `check` whose return type is inferred still compiles with it. */
 export declare const RETIRED_DECISION_MEMBERS: Readonly<Record<string, string>>;
-/** The `ToolPolicy` door ({@link RETIRED_TOOL_POLICY_KEYS}); `undefined` is no policy. */
-export declare function assertNoRetiredToolPolicyKeys(policy: object | undefined): void;
+/**
+ * The `ToolPolicy` door — every policy the engine installs passes it (a task's or deployment's seat, a combined member, an inherited
+ * constraint): `undefined` (or `null`, the seat's other absence spelling) is no policy; a value that is not an object whose `check`
+ * is a function is no policy either, and refuses by name (`config.invalid_argument`, `detail.field: "ToolPolicy"`) — a policy the
+ * engine cannot call is never installed as if it were absent, which would run the leg with nothing the deployment meant to apply;
+ * a retired member refuses by name ({@link RETIRED_TOOL_POLICY_KEYS}).
+ */
+export declare function assertNoRetiredToolPolicyKeys(policy: unknown): void;
 /** The `ShellReadBoundary` door ({@link RETIRED_SHELL_READ_BOUNDARY_KEYS}). */
 export declare function assertNoRetiredShellReadBoundaryKeys(boundary: object): void;

package/dist/core/retired-keys.js

@@ -24,11 +24,14 @@ export function assertNoRetiredKeys(bag, table, owner) {
     e.code = owner === "TaskSpec" ? "config.spec_retired_key" : "config.deps_retired_key";
     throw e;
 }
+export const RETIRED_HOOKS_REPLACEMENT = 'the callback seats are `mods` registrations now — register the extension on `RunnerDeps.mods` (a deployment\'s) or `TaskSpec.mods` (a task\'s), hung on the `classic.*` events (`classic.PreToolUse`, `classic.PostToolUse`, `classic.PostToolBatch`, `classic.UserPromptSubmit`, `classic.Stop`, `classic.SubagentStop`, …); a callback that denied is a handler answering `{ action: "deny", message }`';
 export const RETIRED_TASK_SPEC_KEYS = Object.freeze({
+    hooks: RETIRED_HOOKS_REPLACEMENT,
     autoModeRequested: 'the permission mode is one key now — write `permissionMode: "auto"`',
     approverPosture: 'a posture never authorized anything; drop the key (the engine renders the posture from the effective mode). Releasing asks is a separate decision: `permissionMode: "bypassPermissions"`',
     "attachments.planModeReminder": "the read-only planning posture is stated whenever the leg's mode is `plan` (first turn, every 5 turns, and an exit frame when it ends) — drop the key",
     "skills[].manifest": "a skill's tools are its `allowedTools` / `disallowedTools` now — an allow-rule and a deny-rule source for the run the skill is activated in, never a fence; move `manifest.allowTools` to `allowedTools`. To fence tools write deny rules (or a delegated agent definition's `allowTools`); to fence write paths use session `allowDirs`",
+    promptProvider: "a task changes prompt text through overlays: its role text is `systemPrompt` (it replaces the role base `promptRole` selects), its added block `appendSystemPrompt`, the minimal form `promptForm: \"minimal\"`; anything else is a `prompt.compose` registration on the task's own `mods` answering `{ overlays }` (an already-assembled prompt is refused, never passed through)",
 });
 export const RETIRED_TOOL_POLICY_KEYS = Object.freeze({
     writeTargetGuard: "the guarded write targets are stated as rows now — `ToolPolicy.writeGuardRows`, an async provider of the one path table's `PathGuardRow`s the leg's ONE write judgment reads for every writer the policy cannot see as a call (the shell's file commands). A wrapper carries it through `wrapToolPolicy`, which reads every member a policy declares",
@@ -42,8 +45,19 @@ export const RETIRED_DECISION_MEMBERS = Object.freeze({
     guard: 'write `guards: ["<word>"]` instead (the same five words, as a list: one ask may stand on several integrity guards)',
 });
 export function assertNoRetiredToolPolicyKeys(policy) {
-    if (policy !== undefined)
+    if (policy === undefined || policy === null)
+        return;
+    const isRecord = typeof policy === "object" && !Array.isArray(policy);
+    if (isRecord)
         assertNoRetiredKeys(policy, RETIRED_TOOL_POLICY_KEYS, "ToolPolicy");
+    const check = isRecord ? policy.check : undefined;
+    if (typeof check !== "function") {
+        const got = typeof policy !== "object" ? typeof policy : Array.isArray(policy) ? "an array" : `an object whose check is ${check === null ? "null" : typeof check}`;
+        const e = new Error(`ToolPolicy must be an object whose \`check\` is a function (got ${got}) — a policy the engine cannot call is refused rather than run as no policy; omit the seat for none.`);
+        e.code = "config.invalid_argument";
+        e.detail = { field: "ToolPolicy" };
+        throw e;
+    }
 }
 export function assertNoRetiredShellReadBoundaryKeys(boundary) {
     assertNoRetiredKeys(boundary, RETIRED_SHELL_READ_BOUNDARY_KEYS, "ShellReadBoundary");

package/dist/core/roles.js

@@ -1,11 +1,29 @@
 import { selectModel } from "./select-model.js";
 import { MODEL_ROLES } from "./types.js";
 export { MODEL_ROLES } from "./types.js";
+function catalogModel(ref, models) {
+    const m = models != null && (typeof models === "object" || typeof models === "function") && Object.hasOwn(models, ref) ? models[ref] : undefined;
+    return m || undefined;
+}
+function modelBindingRefusal(seat, reason, message) {
+    const e = new Error(message);
+    e.code = "config.unknown_role";
+    e.detail = { field: seat, reason };
+    return e;
+}
+function bindingShown(value) {
+    if (typeof value === "string")
+        return JSON.stringify(value.length > 80 ? `${value.slice(0, 80)}…` : value);
+    return value === null ? "null" : Array.isArray(value) ? "a list" : `a ${typeof value}`;
+}
+function unknownModelRefRefusal(ref, seat) {
+    return modelBindingRefusal(seat, "unknown_model_ref", `Unknown model ref ${bindingShown(ref)} in ${seat}. Provide it in RunnerDeps.models or pass a Model object.`);
+}
 export function resolveModel(ref, models) {
     if (typeof ref !== "string") {
         return ref;
     }
-    const m = models !== undefined && Object.hasOwn(models, ref) ? models[ref] : undefined;
+    const m = catalogModel(ref, models);
     if (!m) {
         throw new Error(`Unknown model ref "${ref}". Provide it in RunnerDeps.models or pass a Model object.`);
     }
@@ -33,7 +51,19 @@ export function expandTiers(models, tiers) {
     out[TIER_ALIAS_VIA] = aliasVia;
     const bound = (name) => {
         const b = Object.hasOwn(tiers, name) ? tiers[name] : undefined;
-        return b === undefined ? undefined : resolveModel(b, models);
+        if (b === undefined)
+            return undefined;
+        const seat = `tiers.${name}`;
+        if (typeof b === "string") {
+            const held = catalogModel(b, models);
+            if (held === undefined)
+                throw unknownModelRefRefusal(b, seat);
+            return held;
+        }
+        if (typeof b !== "object" || b === null || Array.isArray(b)) {
+            throw modelBindingRefusal(seat, "not_a_model_ref", `${seat} is ${bindingShown(b)}, not a model reference — a tier binds a catalog model name or a Model object.`);
+        }
+        return b;
     };
     const ownKey = (k) => models !== undefined && Object.hasOwn(models, k) && Boolean(models[k]);
     const landing = (t, self) => {
@@ -131,13 +161,16 @@ const FALLBACK = {
     classifier: ["summarize", "default"],
     consolidate: ["summarize"],
 };
-function specParts(s) {
+function specParts(s, seat = "a role seat") {
     if (s == null) {
         return {};
     }
     if (typeof s === "string") {
         return { model: s };
     }
+    if (typeof s !== "object" && typeof s !== "function") {
+        throw modelBindingRefusal(seat, "not_a_model_ref", `${seat} is ${bindingShown(s)}, not a model reference — a role binds a catalog model name, a Model object or a { model, select, thinking, systemPrompt } record.`);
+    }
     if ("id" in s && "api" in s) {
         return { model: s };
     }
@@ -191,12 +224,17 @@ function mergeRoles(base, over) {
     }
     return out;
 }
-function partsModel(parts, models) {
+function partsModel(parts, models, seat = "a role seat") {
     if (parts.model) {
         return resolveModel(parts.model, models);
     }
     if (parts.select) {
-        return selectModel(models ?? {}, parts.select);
+        const needs = parts.select.needs;
+        if (needs != null && !Array.isArray(needs)) {
+            throw modelBindingRefusal(`${seat}.select`, "not_a_model_ref", `${seat}.select.needs is ${bindingShown(needs)}, not a list of capabilities (vision / reasoning).`);
+        }
+        const held = models != null && typeof models === "object" ? Object.values(models).filter(Boolean) : [];
+        return selectModel(held, parts.select);
     }
     return undefined;
 }
@@ -204,7 +242,7 @@ export function resolveTaskModel(spec, deps) {
     const start = spec.modelRole ?? "default";
     assertKnownRole(start, "modelRole");
     if (spec.model) {
-        const startParts = specParts(mergeRoles(deps.roles, spec.roles)[start]);
+        const startParts = specParts(mergeRoles(deps.roles, spec.roles)[start], `roles.${start}`);
         return {
             model: resolveModel(spec.model, deps.models),
             modelRef: spec.model,
@@ -213,10 +251,10 @@ export function resolveTaskModel(spec, deps) {
         };
     }
     const merged = mergeRoles(deps.roles, spec.roles);
-    const startSystemPrompt = specParts(merged[start]).systemPrompt;
+    const startSystemPrompt = specParts(merged[start], `roles.${start}`).systemPrompt;
     for (const role of [start, ...FALLBACK[start]]) {
-        const parts = specParts(merged[role]);
-        const fromParts = partsModel(parts, deps.models);
+        const parts = specParts(merged[role], `roles.${role}`);
+        const fromParts = partsModel(parts, deps.models, `roles.${role}`);
         const model = fromParts ?? roleTierModel(role, deps.models);
         if (model) {
             const modelRef = fromParts !== undefined ? (parts.model ?? model) : (ROLE_TIER_DEFAULTS[role] ?? model);
@@ -227,5 +265,17 @@ export function resolveTaskModel(spec, deps) {
 }
 export function roleModelIfSet(role, spec, deps) {
     const merged = mergeRoles(deps.roles, spec.roles);
-    return partsModel(specParts(merged[role]), deps.models) ?? roleTierModel(role, deps.models);
+    const seat = `roles.${role}`;
+    const parts = specParts(merged[role], seat);
+    const named = parts.model;
+    if (named) {
+        if (typeof named === "string") {
+            if (catalogModel(named, deps.models) === undefined)
+                throw unknownModelRefRefusal(named, seat);
+        }
+        else if (typeof named !== "object" || Array.isArray(named)) {
+            throw modelBindingRefusal(seat, "not_a_model_ref", `${seat}.model is ${bindingShown(named)}, not a model reference — a role binds a catalog model name or a Model object.`);
+        }
+    }
+    return partsModel(parts, deps.models, seat) ?? roleTierModel(role, deps.models);
 }

package/dist/core/rule-lane-reads.js

@@ -65,7 +65,7 @@ export function normalizeOrgGateVerdict(answer, unreadable) {
     if ((behavior !== "deny" && behavior !== "ask") || typeof rule !== "string")
         return clean({ status: "unavailable", disclosures: [unreadable] });
     const reason = ownDataValue(verdict, "unreadable");
-    const unreadableCell = behavior === "ask" && typeof reason === "string" ? { unreadable: reason } : {};
+    const unreadableCell = typeof reason === "string" ? { unreadable: reason } : {};
     return clean({ status: "available", verdict: clean({ behavior: behavior, rule, ...unreadableCell }), ...revisionCell });
 }
 function copiedDenial(raw, ruleTexts) {

package/dist/core/runner/announce-once-ledger.d.ts

@@ -1,6 +1,6 @@
 import type { AnnouncedListingSnapshot, AnnouncedListingSnapshotInput, AnnouncedMcpFailure } from "../../internal/harness.js";
 import type { SessionTreeEntry } from "../../internal/harness-types.js";
-import type { DateAnchorRead } from "./contracts.js";
+import type { AnnounceOnceSink, DateAnchorRead } from "./contracts.js";
 import type { McpDroppedTool, McpServerStatus } from "../mcp.js";
 import type { RunnerDeps } from "../types.js";
 /** Upper bound on the advisory-digest arm kept in the record (oldest dropped past it). A digest is
@@ -18,6 +18,31 @@ export declare function announceDigest(lane: string, text: string): string;
  *  an equality oracle on a secret is still an oracle. The forwarded line itself is untouched (the sink
  *  owns its own redaction posture); only the identity is judged on the redacted form. */
 export declare function warningDigest(err: unknown): string;
+/** The two built-in memory pairs a mount can decline, each with its sentence frame and the `classification`
+ *  word its advisory carries on the operator sink. */
+declare const MEMORY_MOUNT_ADVISORY: {
+    readonly shared: {
+        readonly label: "Shared memory tools";
+        readonly classification: "shared-memory-not-mounted";
+        readonly tail: "the pair mounts together or not at all";
+    };
+    readonly engine: {
+        readonly label: "Memory tools";
+        readonly classification: "memory-tools-not-mounted";
+        readonly tail: "these tools mount together or not at all";
+    };
+};
+/** Which built-in memory pair an advisory is about. */
+export type MemoryMountPair = keyof typeof MEMORY_MOUNT_ADVISORY;
+/**
+ * THE one mint for "a built-in memory pair was NOT mounted": the shared-memory pair and the engine memory trio each
+ * decline to mount when the deployment's selector excludes a name, when a caller tool already occupies one, or when
+ * mounting them would inject the ToolSearch tool under a name the task already declares — four stations, one sentence
+ * frame, one scope. The fact belongs to the deployment's configuration, so it is told once per RUNNER
+ * ({@link AnnounceOnceLedger.onErrorOncePerRunner}), not once per conversation. `reason` is the clause after the
+ * colon; the pair's `names` are the tools that stay unmounted together.
+ */
+export declare function announceMemoryNotMounted(sink: Pick<AnnounceOnceSink, "onErrorOncePerRunner">, sessionId: string, pair: MemoryMountPair, names: readonly string[], reason: string): void;
 /** The digest of one model-facing dropped-tool entry (server, tool, reason — the three fields the
  *  frame prints). */
 export declare function droppedToolDigest(d: McpDroppedTool): string;
@@ -60,6 +85,10 @@ export interface AnnounceOnceLedger {
      *  the record is dropped; a new one is forwarded to `deps.onError` and recorded. With no sink wired
      *  nothing is recorded either — "announced" means delivered. Same signature as `RunnerDeps.onError`. */
     onError: NonNullable<RunnerDeps["onError"]>;
+    /** The operator-lane sink for a DEPLOYMENT fact (see {@link AnnounceOnceSink.onErrorOncePerRunner}): the same
+     *  `(code, message)` digest, judged against what THIS RUNNER's sink has already been told rather than against
+     *  the session's record. Writes no digest into the record and owes the transcript nothing. */
+    onErrorOncePerRunner: NonNullable<RunnerDeps["onError"]>;
     /** The MODEL-face pending set for this run: the currently failed servers (name/error neutralized +
      *  bounded at intake, the reminder's own bounds) MINUS the pairs already announced on this branch.
      *  As a side effect the record's `mcpFailed` arm is pruned to the pairs that are STILL failing —
@@ -122,3 +151,4 @@ export declare function owedDateAnchor(session: {
 } | undefined, state: {
     announcedDate: string;
 } | undefined): (() => Promise<void>) | undefined;
+export {};

package/dist/core/runner/announce-once-ledger.js

@@ -3,6 +3,7 @@ import { egressText } from "../untrusted-egress.js";
 import { inlineUntrusted } from "../untrusted-text.js";
 import { thrownText } from "../thrown-value.js";
 export const ANNOUNCE_ONCE_MAX_DIGESTS = 200;
+const RUNNER_ANNOUNCED = new WeakMap();
 const DROPPED_TOOL_MODEL_LANE = "mcp_dropped_tools";
 export function announceDigest(lane, text) {
     return createHash("sha256").update(lane).update("\n").update(text).digest("hex");
@@ -13,6 +14,14 @@ export function warningDigest(err) {
     const message = thrownText(err);
     return announceDigest(code, egressText("same-principal", message));
 }
+const MEMORY_MOUNT_ADVISORY = {
+    shared: { label: "Shared memory tools", classification: "shared-memory-not-mounted", tail: "the pair mounts together or not at all" },
+    engine: { label: "Memory tools", classification: "memory-tools-not-mounted", tail: "these tools mount together or not at all" },
+};
+export function announceMemoryNotMounted(sink, sessionId, pair, names, reason) {
+    const p = MEMORY_MOUNT_ADVISORY[pair];
+    sink.onErrorOncePerRunner(new Error(`${p.label} ${names.join("/")} were NOT mounted: ${reason} — ${p.tail}.`), { phase: "config", sessionId, classification: p.classification });
+}
 export function droppedToolDigest(d) {
     return announceDigest(DROPPED_TOOL_MODEL_LANE, `${d.server}\n${d.tool}\n${d.reason}`);
 }
@@ -62,6 +71,19 @@ export async function loadAnnounceOnceLedger(session, checkpointMirror, onError)
             advisories.add(digest);
             dirty = true;
         },
+        onErrorOncePerRunner: (err, ctx) => {
+            if (onError === undefined)
+                return;
+            const digest = warningDigest(err);
+            const told = RUNNER_ANNOUNCED.get(onError) ?? new Set();
+            RUNNER_ANNOUNCED.set(onError, told);
+            if (told.has(digest))
+                return;
+            onError(err, ctx);
+            told.add(digest);
+            if (told.size > ANNOUNCE_ONCE_MAX_DIGESTS)
+                told.delete(told.values().next().value);
+        },
         mcpFailuresToAnnounce: (statuses) => {
             const current = statuses
                 .filter((s) => s.status === "failed")

package/dist/core/runner/assemble-result.d.ts

@@ -67,6 +67,11 @@ export interface Stats {
      *  (so it can't be re-derived from `costMicroUsd` alone). The {@link costBreakdown.compactionMicroUsd}
      *  source. Run-loop internal — not a public `TaskResult.stats` field. */
     compactionMicroUsd?: number;
+    /** The permission classifier's and a mod's model-call cost (micro-USD), accumulated by `recordSideCallUsage`. Folded
+     *  into `costMicroUsd` like compaction, but it STAYS inside {@link costBreakdown.llmRootMicroUsd} (an "of which" line,
+     *  not a partition member). Absent until a call is booked. Run-loop internal — the public figure is
+     *  `costBreakdown.sideCallMicroUsd`. */
+    sideCallMicroUsd?: number;
     /**
      * A thin FINANCE TAXONOMY of the LLM-derived costs the engine actually
      * prices, decomposing the task's spend into report categories (no new persisted structure — derived from
@@ -92,6 +97,10 @@ export interface Stats {
         /** Within-task compaction LLM cost (micro-USD) = the running `compactionMicroUsd` accumulator (the
          *  category Framing-4 missed). This IS part of `costMicroUsd`, so it is subtracted from `llmRoot`. */
         compactionMicroUsd: number;
+        /** Side model-call LLM cost (micro-USD) — the permission classifier's and mods' calls — present once one is booked.
+         *  An "of which" line: it is part of `costMicroUsd` AND of `llmRootMicroUsd` (not subtracted from root), so the
+         *  partition `llmRoot + compaction === costMicroUsd` keeps holding. */
+        sideCallMicroUsd?: number;
     };
 }
 /** The two cumulative budget ceilings a task can trip. Tokens outrank cost when both are

package/dist/core/runner/assemble-result.js

@@ -161,6 +161,7 @@ export function assembleResult(spec, sessionId, final, stats, flags) {
             nestedSubagentMicroUsd,
             memoryConsolidationMicroUsd: 0,
             compactionMicroUsd,
+            ...(stats.sideCallMicroUsd !== undefined ? { sideCallMicroUsd: stats.sideCallMicroUsd } : {}),
         };
     }
     const result = text;
@@ -171,8 +172,9 @@ export function assembleResult(spec, sessionId, final, stats, flags) {
         salvagedOutput = text.trim() || undefined;
     }
     const retryAfterMs = errorCode === "usage.window_exhausted" || errorCode === "memory.admission_required" ? flags.retryAfterMs : undefined;
-    const { compactionMicroUsd: _internalCompaction, ...publicStats } = stats;
+    const { compactionMicroUsd: _internalCompaction, sideCallMicroUsd: _internalSideCall, ...publicStats } = stats;
     void _internalCompaction;
+    void _internalSideCall;
     if (flags.unpricedSpend)
         delete publicStats.costMicroUsd;
     const stampHaltedByUser = haltConsumed(flags.haltConsumption);

package/dist/core/runner/call-hook-stations.d.ts

@@ -8,7 +8,8 @@
  *    the decide that approved it — and the station through `AgentHarness.finalizeToolCall`, the loop's own finalize.
  */
 import type { DocumentContent, ImageContent, TextContent } from "../../internal/llm.js";
-import { type HookEnvCapabilities, type HookInvocationIdentity, type Hooks } from "../hooks.js";
+import { type HookEnvCapabilities, type HookInvocationIdentity } from "../hooks.js";
+import { type LegModBus } from "../mods/stations.js";
 import type { PermissionModeController } from "../mode-policy.js";
 import type { TaskSpec } from "../types.js";
 import type { CwdRef } from "../../tools/fs/fs-shared.js";
@@ -30,32 +31,29 @@ export type ToolResultStation = (e: ToolResultSeatEvent) => Promise<{
     content: Array<TextContent | ImageContent | DocumentContent>;
 } | undefined>;
 export interface ToolResultStationInput {
-    /** borrowed-readonly — the resolved hook record: the two post seats and the failure seat, called through the record. */
-    hooks: Hooks | undefined;
+    /** borrowed-readonly — the leg's mods bus: `classic.PostToolUse` / `classic.PostToolUseFailure` are raised on it, and a
+     *  `classic.PreToolUse` handler arms the station too (its context is drained onto the result here). */
+    modBus: LegModBus;
     /** borrowed-mutable — the blocked/suspended call ids. Writer here: the one-shot `delete`. */
     blockedToolCalls: Set<string>;
-    /** borrowed-readonly — the leg's delta seat: the post seats receive the call's wire name off its current roster. */
+    /** borrowed-readonly — the leg's delta seat: the post events carry the call's wire name off its current roster. */
     toolRosterDeltas: ToolRosterDeltaSeat;
     /** borrowed-mutable — PreToolUse `additionalContext` per call id. Writer here: the one-shot drain (`delete`). */
     preToolContexts: Map<string, string[]>;
-    /** borrowed-readonly — the validated per-prepare hook seat bound. */
-    hookTimeoutMs: number;
-    /** borrowed-readonly — prepare's abort seat; `.signal` bounds the post seats and is the failure seat's interrupt fact. */
+    /** borrowed-readonly — prepare's abort seat; `.signal` is the post events' abort and the failure event's interrupt fact. */
     abortController: {
         readonly signal: AbortSignal;
     };
-    /** borrowed-readonly — the REBOUND spec's `signal` (the failure seat's interrupt fact). */
+    /** borrowed-readonly — the REBOUND spec's `signal` (the failure event's interrupt fact). */
     spec: Pick<TaskSpec, "signal">;
-    /** borrowed-readonly — the hand's live tracked cwd, or undefined; `current` is read per post seat. */
+    /** borrowed-readonly — the hand's live tracked cwd, or undefined; `current` is read per post event. */
     handsCwdRef: CwdRef | undefined;
-    /** borrowed-readonly — the env face the post seats' contexts carry, or undefined. */
+    /** borrowed-readonly — the env face the post events carry, or undefined. */
     hookEnvFace: HookEnvCapabilities | undefined;
-    /** borrowed-readonly — the leg's identity envelope every HookToolContext carries. */
+    /** borrowed-readonly — the leg's identity envelope every post event carries. */
     hookIdentity: HookInvocationIdentity;
-    /** borrowed-readonly — the leg's live permission-mode seat (each context reads `observed`). */
+    /** borrowed-readonly — the leg's live permission-mode seat (each event reads `observed`). */
     permissionMode: PermissionModeController;
-    /** borrowed-readonly — where an expired post seat is reported (the leg's own hook-crash lane). */
-    notifyOwnHookCrash: (err: unknown) => void;
     /** borrowed-readonly — the leg's reminder provenance mark (every hook context line carries it). */
     reminderMark: string;
     /** borrowed-mutable — the leg's settlement seam. Writer here: a carrier whose output a host hook rewrote (`noteHostRewrite`). */
@@ -69,11 +67,11 @@ export declare function createToolResultStation(input: ToolResultStationInput):
 export type ApprovedCallScreen = NonNullable<Prepared["approvedCallScreen"]>;
 export type ApprovedCallVerdict = Awaited<ReturnType<ApprovedCallScreen>>;
 export interface ApprovedCallScreenInput {
-    /** borrowed-readonly — the face the gate screens with (the observational wrapper when declared; the leg's mode on every context). */
-    preToolUse: Hooks["preToolUse"] | undefined;
-    /** borrowed-readonly — the validated per-prepare hook seat bound. */
-    hookTimeoutMs: number;
-    /** borrowed-readonly — prepare's abort seat (the screening seat is abort-ended on it). */
+    /** borrowed-readonly — the leg's mods bus (the re-screen raises `classic.PreToolUse` on it, as the gate does). */
+    modBus: LegModBus;
+    /** borrowed-readonly — the leg's live permission-mode seat (each screening e reads `observed`). */
+    permissionMode: PermissionModeController;
+    /** borrowed-readonly — prepare's abort seat (the screening is abort-ended on it). */
     abortController: {
         readonly signal: AbortSignal;
     };
@@ -83,18 +81,16 @@ export interface ApprovedCallScreenInput {
     hookEnvFace: HookEnvCapabilities | undefined;
     /** borrowed-readonly — the leg's identity envelope. */
     hookIdentity: HookInvocationIdentity;
-    /** borrowed-readonly — the own hook-crash reporter (a crashing or timed-out screening face is reported through it). */
-    notifyOwnHookCrash: (err: unknown) => void;
     /** borrowed-mutable — PreToolUse `additionalContext` per call id. Writer here: `admit`'s stash (the station drains it). */
     preToolContexts: Map<string, string[]>;
 }
 /**
- * The approved call's PreToolUse screening — the gate's own seat, its answer FOLDED UNDER THE DECIDE that approved the
- * call (the decide is the upper bound; the screen can only narrow): a deny, a crash, a silence or a refused answer
- * refuses the call in the live gate's own sentences; an ask is the question the decide already answered — unless it
- * demands a person and the decide was the deployment's policy (the one predicate every resume station holds a decide
- * against); a rewrite is what executes when the decide carried none of its own (the person's bytes are the upper bound);
- * context rides the result. Undefined when no face is wired.
+ * The approved call's PreToolUse screening — the gate's own screening, its answer FOLDED UNDER THE DECIDE that approved
+ * the call (the decide is the upper bound; the screen can only narrow): a deny, a failed or cancelled screening, or a
+ * refused answer refuses the call in the live gate's own sentences; an ask is the question the decide already answered —
+ * unless it demands a person and the decide was the deployment's policy (the one predicate every resume station holds a
+ * decide against); a rewrite is what executes when the decide carried none of its own (the person's bytes are the upper
+ * bound); context rides the result. Undefined when no handler hangs on `classic.PreToolUse`.
  */
 export declare function createApprovedCallScreen(input: ApprovedCallScreenInput): ApprovedCallScreen | undefined;
 /**

package/dist/core/runner/call-hook-stations.js

@@ -1,14 +1,28 @@
-import { createPreToolUseScreening, formatHookFeedback, hookSeatExpiredError, runHookSeat } from "../hooks.js";
-import { isEngineRefusal } from "../tool-policy.js";
+import { createPreToolUseScreening, formatHookFeedback } from "../hooks.js";
+import { classicEventBase, dispatchClassic, stringMembersAnswer, stringMembersOf } from "../mods/stations.js";
 import { policyCannotAnswer } from "../real-approval.js";
-import { traceHookCrash } from "../gate-crash-trace.js";
-import { createSafeNotifier } from "../safe-notify.js";
 import { rosterToolName } from "../tool-roster.js";
 import { wireOf } from "../tool-name-readings.js";
 import { noteHostRewrite } from "../frame-settlement.js";
+function postToolUseAnswer(answer) {
+    const strings = stringMembersAnswer("classic.PostToolUse", ["additionalContext"])(answer);
+    if (strings !== undefined || typeof answer !== "object" || answer === null)
+        return strings;
+    const out = Reflect.get(answer, "updatedOutput");
+    return out === undefined || Array.isArray(out) ? undefined : "answered a non-array \"updatedOutput\"; it replaces the content array";
+}
+function updatedOutputOf(answer) {
+    if (typeof answer !== "object" || answer === null)
+        return undefined;
+    const out = Reflect.get(answer, "updatedOutput");
+    return Array.isArray(out) ? out.filter(isContentBlock) : undefined;
+}
+function isContentBlock(c) {
+    return typeof c === "object" && c !== null && typeof Reflect.get(c, "type") === "string";
+}
 export function createToolResultStation(input) {
-    const { hooks, blockedToolCalls, toolRosterDeltas, preToolContexts, hookTimeoutMs, abortController, spec, handsCwdRef, hookEnvFace, hookIdentity, permissionMode, notifyOwnHookCrash, reminderMark, frameSettlement } = input;
-    const toolResultStationArmed = Boolean(hooks?.postToolUse || hooks?.preToolUse || hooks?.postToolUseFailure);
+    const { modBus, blockedToolCalls, toolRosterDeltas, preToolContexts, abortController, spec, handsCwdRef, hookEnvFace, hookIdentity, permissionMode, reminderMark, frameSettlement } = input;
+    const toolResultStationArmed = modBus.hasHandlers("classic.PostToolUse") || modBus.hasHandlers("classic.PreToolUse") || modBus.hasHandlers("classic.PostToolUseFailure");
     if (toolResultStationArmed) {
         return async (e) => {
             if (blockedToolCalls.delete(e.toolCallId)) {
@@ -17,16 +31,23 @@ export function createToolResultStation(input) {
             let content = e.content;
             let changed = false;
             const post = { toolName: rosterToolName(toolRosterDeltas.current, e.toolName) };
+            const callFacts = (tool) => ({
+                ...classicEventBase(hookIdentity, permissionMode.observed),
+                tool,
+                tool_use_id: e.toolCallId,
+                input: e.input,
+                ...(handsCwdRef?.current !== undefined ? { cwd: handsCwdRef.current } : {}),
+                ...(hookEnvFace !== undefined ? { env: hookEnvFace } : {}),
+            });
             if (e.isError) {
-                if (hooks?.postToolUseFailure) {
+                if (modBus.hasHandlers("classic.PostToolUseFailure")) {
                     let clonedDetails = e.details;
                     try {
                         clonedDetails = structuredClone(e.details);
                     }
                     catch {
                     }
-                    const failedName = wireOf("hook.postToolUseFailure", post);
-                    const failureSeat = await runHookSeat("postToolUseFailure", { timeoutMs: hookTimeoutMs, signal: abortController.signal }, (sig) => hooks.postToolUseFailure(failedName, e.input, {
+                    const failure = {
                         error: e.content
                             .filter((c) => c.type === "text")
                             .map((c) => c.text)
@@ -34,30 +55,26 @@ export function createToolResultStation(input) {
                         isInterrupt: abortController.signal.aborted || spec.signal?.aborted === true,
                         content: e.content.map((c) => ({ ...c })),
                         details: clonedDetails,
-                    }, { toolCallId: e.toolCallId, toolName: failedName, signal: sig, ...(handsCwdRef?.current !== undefined ? { cwd: handsCwdRef.current } : {}), ...(hookEnvFace !== undefined ? { env: hookEnvFace } : {}), identity: hookIdentity, permissionMode: permissionMode.observed }));
-                    if (failureSeat.expired) {
-                        notifyOwnHookCrash(hookSeatExpiredError("postToolUseFailure", hookTimeoutMs, failureSeat.cause, "the observation was abandoned and its additionalContext dropped; the failure result itself is unchanged"));
-                    }
-                    const patch = failureSeat.expired ? undefined : failureSeat.value;
+                    };
+                    const outcome = await dispatchClassic(modBus, "classic.PostToolUseFailure", { ...callFacts(wireOf("hook.postToolUseFailure", post)), failure }, { signal: abortController.signal, checkAnswer: stringMembersAnswer("classic.PostToolUseFailure", ["additionalContext"]) }).catch(() => undefined);
+                    const patch = outcome?.kind === "answered" ? stringMembersOf(outcome.answer, ["additionalContext"]) : undefined;
                     if (patch?.additionalContext) {
                         content = [...content, { type: "text", text: formatHookFeedback(patch.additionalContext, reminderMark) }];
                         changed = true;
                     }
                 }
             }
-            else if (hooks?.postToolUse) {
-                const ranName = wireOf("hook.postToolUse", post);
-                const successSeat = await runHookSeat("postToolUse", { timeoutMs: hookTimeoutMs, signal: abortController.signal }, (sig) => hooks.postToolUse(ranName, e.input, { content: e.content, details: e.details, isError: e.isError }, { toolCallId: e.toolCallId, toolName: ranName, signal: sig, ...(handsCwdRef?.current !== undefined ? { cwd: handsCwdRef.current } : {}), ...(hookEnvFace !== undefined ? { env: hookEnvFace } : {}), identity: hookIdentity, permissionMode: permissionMode.observed }));
-                if (successSeat.expired) {
-                    notifyOwnHookCrash(hookSeatExpiredError("postToolUse", hookTimeoutMs, successSeat.cause, "the seat was abandoned; the tool result is delivered to the model UNMODIFIED (no updatedOutput, no additionalContext)"));
-                }
-                const patch = successSeat.expired ? undefined : successSeat.value;
-                if (patch?.updatedOutput) {
-                    content = patch.updatedOutput;
+            else if (modBus.hasHandlers("classic.PostToolUse")) {
+                const outcome = await dispatchClassic(modBus, "classic.PostToolUse", { ...callFacts(wireOf("hook.postToolUse", post)), output: { content: e.content, details: e.details, isError: e.isError } }, { signal: abortController.signal, checkAnswer: postToolUseAnswer }).catch(() => undefined);
+                const answer = outcome?.kind === "answered" ? outcome.answer : undefined;
+                const updatedOutput = updatedOutputOf(answer);
+                const patch = stringMembersOf(answer, ["additionalContext"]);
+                if (updatedOutput) {
+                    content = updatedOutput;
                     changed = true;
                     noteHostRewrite(frameSettlement, e.toolCallId);
                 }
-                if (patch?.additionalContext) {
+                if (patch.additionalContext) {
                     content = [...content, { type: "text", text: formatHookFeedback(patch.additionalContext, reminderMark) }];
                     changed = true;
                 }
@@ -74,27 +91,26 @@ export function createToolResultStation(input) {
     return undefined;
 }
 export function createApprovedCallScreen(input) {
-    const { preToolUse, hookTimeoutMs, abortController, handsCwdRef, hookEnvFace, hookIdentity, notifyOwnHookCrash, preToolContexts } = input;
-    if (preToolUse === undefined)
+    const { modBus, permissionMode, abortController, handsCwdRef, hookEnvFace, hookIdentity, preToolContexts } = input;
+    if (!modBus.hasHandlers("classic.PreToolUse"))
         return undefined;
     return async ({ toolCallId, toolName, args, decidedBy }) => {
-        const notifier = createSafeNotifier();
-        const seatInput = { event: { toolCallId, toolName, input: args }, ...(handsCwdRef !== undefined ? { trackedCwd: () => handsCwdRef.current } : {}), ...(hookEnvFace !== undefined ? { hookEnv: hookEnvFace } : {}), identity: hookIdentity, onHookError: notifyOwnHookCrash, abortSignal: abortController.signal };
-        const screening = createPreToolUseScreening(preToolUse, seatInput, hookTimeoutMs, notifier);
+        const screening = createPreToolUseScreening({
+            event: { toolCallId, toolName, input: {} },
+            modBus,
+            observedPermissionMode: () => permissionMode.observed,
+            ...(handsCwdRef !== undefined ? { trackedCwd: () => handsCwdRef.current } : {}),
+            ...(hookEnvFace !== undefined ? { hookEnv: hookEnvFace } : {}),
+            identity: hookIdentity,
+            abortSignal: abortController.signal,
+        });
+        if (screening === undefined)
+            return { args, admit: () => undefined };
         const subject = `this call to "${toolName}"`;
-        let r;
-        try {
-            const seat = await screening.screen(args);
-            if (seat.expired)
-                return { refused: await screening.unansweredReason(subject, seat.cause) };
-            r = screening.screened(seat.value);
-        }
-        catch (err) {
-            traceHookCrash(seatInput, err, notifier);
-            return { refused: screening.crashReason(subject, err) };
-        }
-        if (r !== undefined && isEngineRefusal(r))
-            return { refused: screening.refusedReason(r) };
+        const screened = await screening.screen(args, subject);
+        if (screened.kind === "refused")
+            return { refused: screened.reason };
+        const r = screened.answer;
         if (r?.action === "deny")
             return { refused: screening.deniedReason(r) };
         if (r !== undefined && policyCannotAnswer(r, decidedBy))

package/dist/core/runner/caller-stop-gate.d.ts

@@ -0,0 +1,25 @@
+/**
+ * The run's ONE caller-stop gate: tripped by every channel through which the run's CALLER asks it to stop — the
+ * `halt()`, `interrupt()` and `destroy()` verbs (`stop()`) and the caller's own `TaskSpec.signal` (composed into
+ * `signal` at the mint) — at any moment until the run publishes its result, the loop's end included. It answers one
+ * question, "did the caller ask this run to stop?", and every compaction pass of the run reads it the same way: a
+ * tripped gate admits no pass, and a pass in flight carries it both as an abort and as its withdrawal signal, so a
+ * stop landing mid-pass cuts the summary call and the pass reports a cancel. It is not an attribution: who OWNS the
+ * run's ending stays on the loop latch's first-writer seats, and an engine stop (a limit, an output retry cap, a
+ * gate) never trips it.
+ *
+ * Minted once per run beside the loop latch and carried on it (`LiveHandle.loop.callerStop`), so the verbs and the
+ * run body hold the same object.
+ */
+export interface CallerStopGate {
+    /** The verbs' write face; idempotent. */
+    stop(): void;
+    /** The read face: aborted once any caller channel fired. */
+    readonly signal: AbortSignal;
+}
+/**
+ * The caller's own signal is COMPOSED into the read face, not listened to: there is nothing to release, so the gate
+ * keeps answering after the leg dropped its own listener on that signal — which is exactly when the end-of-task
+ * pass runs.
+ */
+export declare function mintCallerStopGate(callerSignal: AbortSignal | undefined): CallerStopGate;