@sema-agent/core 7.51.2 → 7.53.0

package/dist/core/runner/prepare-offload-wrappers.d.ts

@@ -20,10 +20,10 @@ import type { ToolSelector } from "../tool-face.js";
 export interface PrepareOffloadWrappersInput {
     /** borrowed-readonly — the REBOUND spec (the config-doors result); read for the per-task coarse
      *  offload knob only. */
-    spec: Pick<TaskSpec, "toolResultThresholdChars">;
-    /** borrowed-readonly — the leg's compiled selector: an offloaded result is read back through the reader tool, so a leg whose selector
-     *  does not admit the reader (a sub-agent whose lists leave it out, a deployment that excludes it) offloads nothing — a preview that
-     *  sends the model to a tool it does not have is a dead end. */
+    spec: Pick<TaskSpec, "toolResultThresholdChars" | "excludeAllTools">;
+    /** borrowed-readonly — the leg's compiled selector, read through the valve (`valveLeaves`): an offloaded result is read back through the
+     *  reader tool, so a leg whose valve does not leave the reader (a sub-agent whose lists leave it out, a deployment that excludes it, a
+     *  run whose whole face is switched off) offloads nothing — a preview that sends the model to a tool it does not have is a dead end. */
     selector: Pick<ToolSelector, "admits">;
     /** borrowed-readonly — the deployment's coarse offload knob and its injected store (used AS-IS when
      *  present; a Runner-shared instance is viewed per task, see the body). */

package/dist/core/runner/prepare-offload-wrappers.js

@@ -1,5 +1,6 @@
 import { DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, InMemoryToolResultStore, OFFLOAD_TOOL_NAME, RunnerSharedToolResultStore, ScopedToolResultStore, withToolResultOffload, } from "../tool-result-store.js";
 import { faceOf } from "../tool-roster.js";
+import { valveLeaves } from "../../agents/tool-filter.js";
 const FIRST_PARTY_OFFLOAD_THRESHOLD_CHARS = 50_000;
 export function prepareOffloadWrappers(input) {
     const { spec, deps, resume, offloadScope, sessionId, selector } = input;
@@ -21,7 +22,7 @@ export function prepareOffloadWrappers(input) {
     };
     const explicitGlobalThreshold = spec.toolResultThresholdChars ?? deps.toolResultThresholdChars;
     const offloadThreshold = explicitGlobalThreshold ?? DEFAULT_TOOL_RESULT_THRESHOLD_CHARS;
-    const offloadEnabled = Number.isFinite(offloadThreshold) && offloadThreshold > 0 && selector.admits({ name: OFFLOAD_TOOL_NAME });
+    const offloadEnabled = Number.isFinite(offloadThreshold) && offloadThreshold > 0 && valveLeaves(spec, selector)({ name: OFFLOAD_TOOL_NAME });
     const rawOffloadStore = offloadEnabled ? (deps.toolResultStore ?? new InMemoryToolResultStore()) : undefined;
     const offloadStore = rawOffloadStore instanceof RunnerSharedToolResultStore
         ? new ScopedToolResultStore(rawOffloadStore, offloadScope)

package/dist/core/runner/prepare-park-ask.js

@@ -9,7 +9,7 @@ import { pauseOf } from "../pause-registry.js";
 import { askCarryRowMembers } from "../hooks.js";
 import { askMandateMember, ownedClearanceFacts } from "../ask-origin.js";
 import { defaultTaskRegistry } from "../task-registry.js";
-import { advertisedWritableRootsSeat, exemptRootsSeat, isLiveApproverSeat, carriesBidiControls, describeThrown, refuseOutOfContractDecision, tryCloneArgs } from "../tool-policy.js";
+import { advertisedWritableRootsSeat, exemptRootsSeat, isLiveApproverSeat, carriesBidiControls, describeThrown, ownArgs, refuseOutOfContractDecision, tryCloneArgs } from "../tool-policy.js";
 import { InMemoryToolResultStore, ScopedToolResultStore, isVolatileOffloadStore } from "../tool-result-store.js";
 import { raceAbort, raceSettlementAgainstSignal } from "./abort-race.js";
 import { CONTENT_ASK_BINDING_CAP } from "./content-ask-bindings.js";
@@ -43,11 +43,7 @@ export function prepareParkAsk(input) {
                 return;
             contentAskBindings.set(req.toolCallId, { ...entry, questionsHash, deliveryId });
         };
-        const refuseBeforeDelivery = (code, presentedInput) => ({
-            kind: "delivery_failure",
-            code,
-            ...(presentedInput !== undefined ? { presentedInput } : {}),
-        });
+        const refuseBeforeDelivery = (code) => ({ kind: "delivery_failure", code });
         let retained;
         let presented;
         try {
@@ -59,13 +55,13 @@ export function prepareParkAsk(input) {
         }
         const retainedQuestionsHash = boundInputHashOf(retained.questions);
         if (!Value.Check(mountedQuestionTool.parameters, retained) || validateAskQuestions(presented) !== undefined) {
-            return refuseBeforeDelivery("question.malformed_request", retained);
+            return refuseBeforeDelivery("question.malformed_request");
         }
         if (contentAskBindings.size >= CONTENT_ASK_BINDING_CAP && !contentAskBindings.has(req.toolCallId)) {
             return { kind: "unavailable", parkDeclined: true };
         }
         if (contentAskSignal.aborted) {
-            return { kind: "delivery_failure", code: "question.aborted", presentedInput: retained };
+            return { kind: "delivery_failure", code: "question.aborted" };
         }
         try {
             const facePromise = (async () => liveQuestionFace({
@@ -90,13 +86,13 @@ export function prepareParkAsk(input) {
                 const reading = classifyQuestionOutcome(outcome);
                 if (reading.shape === "contradictory") {
                     bindOutcome({ kind: "failed", error: new Error("the question channel returned a contradictory outcome (an unavailable answer)") }, retainedQuestionsHash);
-                    return { kind: "delivery_failure", code: "question.human_channel_failed", presentedInput: retained };
+                    return { kind: "delivery_failure", code: "question.human_channel_failed" };
                 }
                 if (reading.shape === "unavailable")
-                    return { kind: "unavailable", parkDeclined: true, presentedInput: retained };
+                    return { kind: "unavailable", parkDeclined: true };
                 const answerSnapshot = reading.answer;
                 bindOutcome({ kind: "answered", answer: answerSnapshot }, retainedQuestionsHash);
-                return { kind: "answered", presentedInput: retained };
+                return { kind: "answered" };
             }
             const error = settlement.tag === "threw"
                 ? settlement.error
@@ -105,12 +101,11 @@ export function prepareParkAsk(input) {
             return {
                 kind: "delivery_failure",
                 code: settlement.tag === "aborted" || contentAskSignal.aborted ? "question.aborted" : "question.human_channel_failed",
-                presentedInput: retained,
             };
         }
         catch (err) {
             bindOutcome({ kind: "failed", error: err }, retainedQuestionsHash);
-            return { kind: "delivery_failure", code: "question.human_channel_failed", presentedInput: retained };
+            return { kind: "delivery_failure", code: "question.human_channel_failed" };
         }
     };
     const suspendAsk = parkLaneArmed && checkpointStore !== undefined
@@ -180,7 +175,8 @@ export function prepareParkAsk(input) {
                     if (reprojectedRaced.tag === "threw")
                         throw reprojectedRaced.error;
                     const reprojected = refuseOutOfContractDecision(reprojectedRaced.value);
-                    const rewroteTheFiledValue = reprojected.updatedInput !== undefined && !samePlainValue(reprojected.updatedInput, parkedArgs);
+                    const filedAsHeld = ownArgs(parkedArgs);
+                    const rewroteTheFiledValue = reprojected.updatedInput !== undefined && !(filedAsHeld.ok && samePlainValue(reprojected.updatedInput, filedAsHeld.value));
                     if (reprojected.action === "deny" || rewroteTheFiledValue) {
                         throw new ParkRefusal(`the arguments of "${req.toolName}" change shape when stored by this checkpoint backend, and the deployment's tool policy does not accept the stored shape` +
                             `${reprojected.action === "deny" && reprojected.message ? `: ${reprojected.message}` : ""} — ` +

package/dist/core/runner/prepare-policy-chain.d.ts

@@ -23,7 +23,7 @@ import type { AgentTool } from "../../internal/harness.js";
 import type { ExecutionEnv } from "../../internal/harness.js";
 import { type AskClass } from "../ask-class.js";
 import type { AutoModeDecider } from "../auto-mode.js";
-import { type Hooks } from "../hooks.js";
+import { type InheritedToolCheck, type LegModBus, type ModChainLink } from "../mods/stations.js";
 import type { LockedPreflight } from "../locked-config.js";
 import { type SessionPermissionRules } from "../session-policy-store.js";
 import { type OnAsk, type ToolPolicy } from "../tool-policy.js";
@@ -34,6 +34,7 @@ import type { CwdRef } from "../../tools/fs/fs-shared.js";
 import type { ReadDenyMatcher } from "../../tools/fs/read-deny.js";
 import { type SkillGrantLane, type SkillGrantSource, type SkillGrantTable } from "../skill-grant.js";
 import type { GrantBindingOf } from "../skill-grant-binding.js";
+import type { ToolSelector } from "../tool-face.js";
 import { type AllowEntryLane, type AllowEntryTable } from "../allow-entry.js";
 import type { InheritedGate, IrreversibilityTier, PrepareResume, RunInternals, StopForDenialLimit } from "./contracts.js";
 import { type Arbitration } from "../ask-origin.js";
@@ -43,14 +44,14 @@ import { createRuleOffersOf, type PermissionRuleLanes } from "./permission-rule-
 import type { ToolCallLike } from "../tool-registry.js";
 export interface PreparePolicyChainInput {
     /** borrowed-readonly — the REBOUND spec. Read: `sessionId` / `principal` (the session-rule read and the lanes' identity),
-     *  `hooks` (spec over deps), `durableApproval` / `checkpointStore` (the mandate-park facility test and the sandbox arming's park prerequisites), `taskId` (the late-ask observer's detail).
-     *  Never mutated. */
-    spec: Pick<TaskSpec, "sessionId" | "principal" | "hooks" | "durableApproval" | "taskId" | "checkpointStore">;
-    /** borrowed-readonly — the deployment seats: `sessionPolicyStore` (the rule reads), `hooks` (the fallback record),
+     *  `durableApproval` / `checkpointStore` (the mandate-park facility test and the sandbox arming's park prerequisites), `taskId` (the late-ask observer's detail),
+     *  `tools` (the names the caller mounted, for the name audit). Never mutated. */
+    spec: Pick<TaskSpec, "sessionId" | "principal" | "durableApproval" | "taskId" | "checkpointStore" | "tools" | "excludeAllTools">;
+    /** borrowed-readonly — the deployment seats: `sessionPolicyStore` (the rule reads),
      *  `permissionRuleStore` / `localOwnerRules` (the lanes and the offer factory), `onError` / `onNotice` (the advisories,
      *  the refusal disclosures, the late-ask observer), `tracer` (the admission and rule-store frames), `checkpointStore` (the park facility). Receiver preserved;
      *  the advisory dedupe is KEYED on this object's identity. */
-    deps: Pick<RunnerDeps, "sessionPolicyStore" | "hooks" | "permissionRuleStore" | "localOwnerRules" | "onError" | "onNotice" | "tracer" | "checkpointStore" | "a2a">;
+    deps: Pick<RunnerDeps, "sessionPolicyStore" | "permissionRuleStore" | "localOwnerRules" | "onError" | "onNotice" | "tracer" | "checkpointStore" | "a2a">;
     /** borrowed-readonly — the trusted spawn-side channel: `parentTaskId` (the from-subagent bit), `explicitAgentName` /
      *  `agentName` (the source agent name) — the ask source identity's local, trusted facts. */
     internals: Pick<RunInternals, "parentTaskId" | "explicitAgentName" | "agentName"> | undefined;
@@ -82,6 +83,8 @@ export interface PreparePolicyChainInput {
     tools: ReadonlyArray<AgentTool>;
     /** borrowed-readonly — the harness list (placeholders keep their deferred names), the audit universe's second half. */
     harnessTools: ReadonlyArray<AgentTool>;
+    /** borrowed-readonly — the leg's compiled tool selector: the name audit reads the delegation tools it leaves ({@link delegationPoolReading}). */
+    selector: Pick<ToolSelector, "admits">;
     /** borrowed-readonly — the effect collection, read by the narrowing layers (path-confinable write tools). */
     toolEffects: ReadonlyMap<string, ToolEffect>;
     /** borrowed-readonly — the egress mark set (the risk axes, the boundary predicate, the offer factory). */
@@ -146,8 +149,12 @@ export interface PreparePolicyChainInput {
     frozenOnAsk: OnAsk | undefined;
     /** borrowed-readonly — the identity of this task's hook-env source (the pass-through test's environment term). */
     hookEnvSource: unknown;
-    /** borrowed-readonly — the own-hook crash reporter (the timeout seat's bad-value disclosure). */
+    /** borrowed-readonly — the leg's own failure lane (`onError`, phase `hook`, swallow-guarded): an inherited policy that threw. */
     notifyOwnHookCrash: (err: unknown) => void;
+    /** borrowed-readonly — the leg's mods bus (whether this leg's own phase 1 judges with `classic.PreToolUse` — the pass-through test). */
+    modBus: LegModBus;
+    /** borrowed-readonly — this leg's chain identity as its admission recorded it (`chainOfBus`) — the stand-in test's chain term. */
+    ownModChain: readonly ModChainLink[];
     /** borrowed-readonly — LATE-BOUND: this task's own classifier instance (the pass-through test's decider term), read at chain
      *  assembly (the arming runs after this phase, and again on a steer into `auto`). */
     autoModeDecider: () => AutoModeDecider | undefined;
@@ -182,14 +189,6 @@ export interface PreparePolicyChainInput {
     };
 }
 export interface PreparePolicyChainResult {
-    /** owned — the resolved hook record (`spec.hooks ?? deps.hooks`), or undefined. */
-    hooks: Hooks | undefined;
-    /** owned — the per-leg hook timeout, resolved and validated ONCE (`Prepared.hookTimeoutMs`). */
-    hookTimeoutMs: number;
-    /** owned — whether the deployment declared its screening face observational. */
-    preToolUseObservational: boolean;
-    /** owned — the screening face this task's OWN gate runs in phase 1 (the observational wrapper when declared). */
-    ownGatePreToolUse: Hooks["preToolUse"] | undefined;
     /** owned — the resume-edit base policy (`Prepared.basePolicyForResumeEdit`), or undefined. */
     basePolicyForResumeEdit: ToolPolicy | undefined;
     /** owned — the deny-narrowing fold (`Prepared.denyNarrowingPolicy`), or undefined when no layer exists. */
@@ -208,6 +207,9 @@ export interface PreparePolicyChainResult {
     /** borrowed-mutable — the inherited-unavailable marker channel. Writers: the inherited arms here (mark); the gate station
      *  (the lifecycle-end sweep) and the park lane's consumers (delete on consumption). */
     inheritedUnavailableAsks: Set<string>;
+    /** owned — the inherited installations THIS leg's gate raises `tool.check` on after its own bus (every screening entry the
+     *  leg's own gate does not stand in for — the fold's pass-through test), each with the settlement its question takes. */
+    inheritedToolChecks: readonly InheritedToolCheck[];
     /** owned — the inherited stations' MODE ARBITRATIONS by tool call (a release or a refusal made inside the fold,
      *  where an ancestor's ask is arbitrated before its frozen approver). Writers: the three inherited stations here; the gate's
      *  exit reads it onto the disposition and the gate station deletes it at the call's end. */

package/dist/core/runner/prepare-policy-chain.js

@@ -1,21 +1,23 @@
-import { withArgsReading } from "../effective-path-target.js";
+import { argsAsTheToolReads, withArgsReading } from "../effective-path-target.js";
 import { policyAskClassOf } from "../ask-class.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "../ask-question.js";
 import { classifierUnavailableSeat } from "./classifier-ladder.js";
 import { resolveCheckpointStore } from "../checkpoint-store.js";
-import { cloneObserverInput, resolveHookTimeoutMs } from "../hooks.js";
-import { assertHookSeatsCallable } from "../hook-seats.js";
+import { chainJudges, inheritedToolChecks, screeningInstallationsOf, standsInFor } from "../mods/stations.js";
 import { isNamespacedCoveringRuleName, namespacedRuleNameCovers } from "../permission-rules.js";
 import { isIsolated } from "../remote-env.js";
-import { earlierGrammarAdvisory } from "../session-policy-store.js";
-import { askApproverIdentity, attest, attestationOf, checkToolPolicyProjection, combinePolicies, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, durableParkOptInDeclared, isLiveApproverSeat, mergeAttestation, refuseOutOfContractDecision, resolveAsk, toolPolicyNameSets, withAttestation, wrapToolPolicy } from "../tool-policy.js";
+import { deliverEngineNotice } from "../engine-notice.js";
+import { earlierGrammarNotice } from "../session-policy-store.js";
+import { attest, attestationOf, checkToolPolicyProjection, combinePolicies, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, durableParkOptInDeclared, isLiveApproverSeat, mergeAttestation, refuseOutOfContractDecision, resolveAsk, toolPolicyNameSets, withAttestation, wrapToolPolicy } from "../tool-policy.js";
 import { judgeRuleToolName, mountedToolNames } from "../tool-name-aliases.js";
 import { approvalCardMemberOf } from "../tool-roster.js";
 import { NAMESPACED_NAME_SHAPES } from "../protocol-table.js";
 import { emitTrace } from "../trace.js";
 import { skillGrantBindingMembers } from "../skill-grant.js";
 import { SKILL_TOOL_NAME } from "./synthetic-tools.js";
-import { autoStrippedRule, cardDisclosureOf } from "../allow-entry.js";
+import { delegationPoolReading } from "./sub-agent-deny-lists.js";
+import { valveLeaves } from "../../agents/tool-filter.js";
+import { autoStrippedRule, cardDisclosureOf, nearMissSpellingOf, rootFacingToolNames } from "../allow-entry.js";
 import { arbitrateByMode, askClassMembersOf, askFaceOf, askMandateMember } from "../ask-origin.js";
 import { createModeGatePolicy, mountedToolDeclaresReadOnly } from "../mode-policy.js";
 const ancestorFacts = (ask) => ({ ...(ask ?? {}), ancestorResolved: true });
@@ -28,7 +30,7 @@ import { createLiveSessionRules, createSessionRulePolicy } from "./session-rule-
 import { policyThrowLine, reportPolicyThrow } from "./policy-throw.js";
 import { heldBy, heldValues, seatOf, wireOf } from "../tool-name-readings.js";
 export async function preparePolicyChain(input) {
-    const { spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, additionalRootsCanonical, executionEnv, lockedPreflight, pathRuleAnchors, headLeads, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, toolMarkSources, envHandToolNames, handsCwdRef, readDenyMatcher, personRows, questionToolMounted, runtimeCaps, inheritedAncestorRules, ancestorSessionRulesRef, inheritedParentConstraints, seedInheritedGate, skillGrants, skillSpecs, allowedToolTables, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider, readFace, permissionMode, scratchpadDir, toolRosterDeltas, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef } = input;
+    const { spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, additionalRootsCanonical, executionEnv, lockedPreflight, pathRuleAnchors, headLeads, tools, harnessTools, selector, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, toolMarkSources, envHandToolNames, handsCwdRef, readDenyMatcher, personRows, questionToolMounted, runtimeCaps, inheritedAncestorRules, ancestorSessionRulesRef, inheritedParentConstraints, seedInheritedGate, skillGrants, skillSpecs, allowedToolTables, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, modBus, ownModChain, autoModeDecider, readFace, permissionMode, scratchpadDir, toolRosterDeltas, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef } = input;
     const ancestorArbitrations = new Map();
     const arbitrateInherited = (ask, toolCallId, judged) => {
         const verdict = arbitrateByMode(permissionMode.current, judged.classification, { origin: judged.origin, ...askMandateMember(ancestorFacts(judged.ask.action === "ask" ? judged.ask : undefined)) });
@@ -40,32 +42,40 @@ export async function preparePolicyChain(input) {
         return { action: "deny", message: `refused by the ${verdict.mode} permission mode at an inherited ancestor layer (${verdict.askClass})`, decisionReason: "mode" };
     };
     const policy = lockedPreflight.toolPolicy;
-    const auditPolicyNames = (auditee) => {
+    const auditPolicyNames = (auditee, inherited = false) => {
         const nameGroups = toolPolicyNameSets(auditee);
         if (nameGroups.length > 0) {
             const known = mountedToolNames(tools);
             for (const t of harnessTools)
                 known.add(t.name);
+            const pool = delegationPoolReading(spec.tools ?? [], valveLeaves(spec, selector));
+            const callerNames = mountedToolNames(spec.tools ?? []);
+            const rootFacing = rootFacingToolNames([...known, ...callerNames, ...pool.names]);
             const unmatched = new Set();
             for (const g of nameGroups) {
                 for (const [kind, list] of [["deny", g.deny], ["ask", g.ask], ["allow", g.allow]]) {
                     for (const n of list ?? []) {
                         const verdict = judgeRuleToolName(n, known);
-                        if (verdict.kind !== "current") {
+                        const twin = verdict.kind === "current" && !inherited ? nearMissSpellingOf(n, rootFacing) : undefined;
+                        const stale = verdict.kind !== "current" ? verdict : twin !== undefined ? { kind: "case_twin", twin, carrier: known.has(twin) || callerNames.has(twin) ? "run" : pool.names.has(twin) ? "pool" : "catalog" } : undefined;
+                        if (stale !== undefined) {
                             const entry = `tool policy ${kind}-list entry "${n}"`;
                             let message;
-                            switch (verdict.kind) {
+                            switch (stale.kind) {
                                 case "retired":
-                                    message = `${entry} is a RETIRED tool name (${verdict.guidance}) and matches nothing in this run's roster — legacy-name normalization was removed (RB-476-A), so this entry would silently guard nothing. Update the deployment's rule to the current name.`;
+                                    message = `${entry} is a RETIRED tool name (${stale.guidance}) and matches nothing in this run's roster — legacy-name normalization was removed (RB-476-A), so this entry would silently guard nothing. Update the deployment's rule to the current name.`;
                                     break;
                                 case "unprefixed_namespace":
                                     message = `${entry} carries the "__" namespace separator but no protocol prefix, and matches nothing in this run's roster — protocol tools are named ${NAMESPACED_NAME_SHAPES}, and legacy-name normalization was removed (RB-476-A), so this entry would silently guard nothing. Prefix the entry with the owning protocol's marker.`;
                                     break;
                                 case "unmintable_segment":
-                                    message = `${entry} can match no tool, ever (${verdict.guidance}), so it would silently guard nothing.${verdict.currentName !== undefined ? ` Write "${verdict.currentName}".` : ""}`;
+                                    message = `${entry} can match no tool, ever (${stale.guidance}), so it would silently guard nothing.${stale.currentName !== undefined ? ` Write "${stale.currentName}".` : ""}`;
+                                    break;
+                                case "case_twin":
+                                    message = `${entry} differs from ${stale.carrier === "run" ? "the mounted tool" : stale.carrier === "pool" ? "the tool a delegation pool carries" : "the engine's catalog tool"} "${stale.twin}" only in case, and a policy compares tool names exactly, so it matches nothing in this run's roster and would silently guard nothing. Write "${stale.twin}".`;
                                     break;
                                 default: {
-                                    const exhaustive = verdict;
+                                    const exhaustive = stale;
                                     return exhaustive;
                                 }
                             }
@@ -111,7 +121,7 @@ export async function preparePolicyChain(input) {
         catch {
         }
     };
-    const announceEarlierGrammar = (rulesSessionId) => (entries) => deps.onError?.(Object.assign(new Error(earlierGrammarAdvisory(rulesSessionId, entries)), { code: "config.session_rules_earlier_grammar" }), { phase: "config", sessionId });
+    const announceEarlierGrammar = (rulesSessionId) => (entries, field, grammar) => deliverEngineNotice(deps.onNotice, earlierGrammarNotice({ rulesSessionId, sessionId, entries, field, grammar }));
     let sessionRulePolicy;
     if (deps.sessionPolicyStore && spec.sessionId) {
         const store = deps.sessionPolicyStore;
@@ -156,31 +166,12 @@ export async function preparePolicyChain(input) {
         check: (creq) => checkToolPolicyProjection(entry, creq) ?? { action: "allow" },
     }));
     const narrowingLayers = [sessionRulePolicy, ...ancestorRulePolicies, ...frozenConstraintLayers].filter((p) => p !== undefined);
-    for (const layer of narrowingLayers)
-        auditPolicyNames(layer);
+    auditPolicyNames(sessionRulePolicy);
+    for (const layer of ancestorRulePolicies)
+        auditPolicyNames(layer, true);
     const denyNarrowingPolicy = narrowingLayers.length === 0 ? undefined : narrowingLayers.length === 1 ? narrowingLayers[0] : combinePolicies(...narrowingLayers);
     const basePolicyForResumeEdit = lockedPreflight.basePolicyForResumeEdit ?? lockedPreflight.toolPolicy;
-    const hooks = spec.hooks ?? deps.hooks;
-    assertHookSeatsCallable(hooks, spec.hooks !== undefined ? "spec" : "deps");
-    const hookTimeoutMs = resolveHookTimeoutMs(hooks?.timeoutMs, notifyOwnHookCrash, hooks);
-    const preToolUseObservational = hooks?.preToolUse !== undefined && hooks.preToolUseObservational === true;
-    const ownGatePreToolUse = !preToolUseObservational
-        ? hooks?.preToolUse
-        : async (toolName, input, ctx) => {
-            const r = await hooks.preToolUse(toolName, cloneObserverInput(input), ctx);
-            if (r === undefined)
-                return undefined;
-            try {
-                const action = typeof r.action === "string" ? r.action : "(non-string action)";
-                deps.onError?.(new Error(`a PreToolUse hook declared observational (Hooks.preToolUseObservational) returned a decision ("${action}") while screening ` +
-                    `"${toolName}" — the decision was NOT adopted and the call proceeded as if the hook had no opinion. ` +
-                    `A declared-observational face must return undefined; drop the declaration if its verdicts are meant to count ` +
-                    `(they then also travel to delegated children as an inherited screening constraint).`), { phase: "hook", sessionId, classification: "observational-hook-verdict-ignored" });
-            }
-            catch {
-            }
-            return undefined;
-        };
+    const ownChainJudges = chainJudges(modBus);
     const sameInstanceAncestorCount = policy === undefined ? 0 : (inheritedParentConstraints ?? []).reduce((n, pc) => (pc.policy === policy ? n + 1 : n), 0);
     const sharedFirstDecision = new Map();
     const SHARED_FIRST_DECISION_CAP = 256;
@@ -354,7 +345,7 @@ export async function preparePolicyChain(input) {
     const recheckApprovedEdit = async (pol, onAskOf, creq, edit, approved, csignal, ancestorAutoMode) => {
         const ancestorDecider = ancestorAutoMode?.decider;
         const ancestorTracker = ancestorAutoMode?.denialTracking;
-        let editArgs = edit;
+        let editArgs = argsAsTheToolReads(creq, edit);
         let settledBy = approved;
         const onApproval = (d) => withAttestation(d, mergeAttestation(creq, attestationOf(settledBy, creq), attestationOf(d, creq), "answer"));
         const vetoed = onApproval;
@@ -367,8 +358,7 @@ export async function preparePolicyChain(input) {
             }
             let re;
             try {
-                const editReq = withArgsReading(creq, editArgs, csignal ?? abortController.signal);
-                re = refuseOutOfContractDecision(await pol.check(editReq !== undefined ? await editReq : { ...creq, args: editArgs }, csignal ?? abortController.signal));
+                re = refuseOutOfContractDecision(await pol.check(await withArgsReading(creq, editArgs, csignal ?? abortController.signal), csignal ?? abortController.signal));
             }
             catch (err) {
                 reportPolicyThrow(notifyOwnHookCrash, "an inherited parent policy's re-check of the approved edit", creq, err, csignal ?? abortController.signal);
@@ -384,7 +374,7 @@ export async function preparePolicyChain(input) {
                 return onApproval(withAttestation({ action: "allow", updatedInput: re.updatedInput !== undefined ? re.updatedInput : editArgs, ...(stated !== undefined ? { decisionReason: stated } : {}) }, re.attestation));
             }
             if (re.updatedInput !== undefined)
-                editArgs = re.updatedInput;
+                editArgs = argsAsTheToolReads(creq, re.updatedInput);
             const judged = await judgeInheritedClassifier({ liveMode: () => permissionMode.current, autoMode: ancestorAutoMode, ask: re, req: { ...creq, args: editArgs }, signal: csignal ?? abortController.signal, subject: "the approved edit", allowRewrite: editArgs, facts: inheritedStationFacts(creq), unavailableSeat: classifierUnavailableSeat({ station: "ancestor", ...(ancestorDecider?.timeoutMs !== undefined ? { budgetMs: ancestorDecider.timeoutMs } : {}), route: frozenApproverRoute(onAskOf), onNotice: deps.onNotice, sessionId, runId }) });
             if (judged.kind === "allow") {
                 return onApproval(judged.result);
@@ -419,17 +409,69 @@ export async function preparePolicyChain(input) {
             settledBy = rr;
             if (rr.updatedInput === undefined)
                 return onApproval({ action: "allow", updatedInput: editArgs, decisionReason: "mode" });
-            editArgs = rr.updatedInput;
+            editArgs = argsAsTheToolReads(creq, rr.updatedInput);
         }
     };
-    const parentConstraintWrappers = (inheritedParentConstraints ?? []).map((pc) => pc.preToolUse !== undefined &&
-        pc.preToolUse === hooks?.preToolUse &&
-        !preToolUseObservational &&
-        pc.durableMandate !== true &&
-        pc.contentMandate !== true &&
-        askApproverIdentity(pc.onAsk) === askApproverIdentity(frozenOnAsk) &&
-        pc.hookEnv === hookEnvSource &&
-        pc.autoMode?.decider === autoModeDecider()
+    const settleInstallationAsk = async (pc, decision, creq, csignal) => {
+        const settledAs = (result) => ({ kind: "settled", result });
+        if (isDelegatedQuestion(creq)) {
+            if (pc.contentMandate !== true || markInheritedUnavailable(creq.toolCallId))
+                return settledAs(decision);
+            return settledAs({
+                action: "deny",
+                message: `inherited parent policy requires durable handling of the question raised for "${creq.toolName}" and the marker channel is at capacity — ` +
+                    `denied fail-closed (tighten-only)`,
+            });
+        }
+        if (pc.durableMandate === true) {
+            if (mandatedCallFloats(creq.toolCallId))
+                return settledAs(decision);
+            return settledAs(mandateUnreconstructibleDeny(creq));
+        }
+        const presentedArgs = decision.updatedInput !== undefined ? argsAsTheToolReads(creq, decision.updatedInput) : creq.args;
+        const judged = await judgeInheritedClassifier({ liveMode: () => permissionMode.current, autoMode: pc.autoMode, ask: decision, req: { ...creq, args: presentedArgs }, signal: csignal ?? abortController.signal, subject: "this call", allowRewrite: decision.updatedInput, facts: inheritedStationFacts(creq), unavailableSeat: classifierUnavailableSeat({ station: "ancestor", ...(pc.autoMode?.decider.timeoutMs !== undefined ? { budgetMs: pc.autoMode.decider.timeoutMs } : {}), route: frozenApproverRoute(pc.onAsk), onNotice: deps.onNotice, sessionId, runId }) });
+        if (judged.kind === "allow")
+            return settledAs(judged.result);
+        if (judged.kind === "deny")
+            return settledAs(judged.result);
+        const { ask: inheritedAsk, fallback } = judged;
+        if (fallback === undefined && sandboxAdmissionArmed && policyAskClassOf(pc.policy) === "sandbox_local" && !sandboxBoundaryCapable(creq) && judged.classification.row.sandboxAdmission) {
+            recordAncestorSandboxAdmission(creq.toolCallId, creq.toolName);
+            return settledAs(decision.updatedInput !== undefined ? { action: "allow", updatedInput: decision.updatedInput, decisionReason: "sandbox" } : { action: "allow", decisionReason: "sandbox" });
+        }
+        const arbitrated = arbitrateInherited(inheritedAsk.action === "ask" ? { ...inheritedAsk, ...(decision.updatedInput !== undefined ? { updatedInput: decision.updatedInput } : {}) } : inheritedAsk, creq.toolCallId, judged);
+        if (arbitrated !== undefined)
+            return settledAs(arbitrated);
+        const askT0 = now();
+        const { resolved, judged: settled } = await resolveInheritedAsk(judged, (j) => resolveAsk({
+            toolName: creq.toolName,
+            toolCallId: creq.toolCallId,
+            args: presentedArgs,
+            ...ruleOffersOf(creq, presentedArgs, ancestorFacts(j.ask.action === "ask" ? j.ask : undefined)),
+            ...cardDisclosureOf(j.ask, inheritedAskFallbackMessage(creq.toolName)),
+            ...askSourceIdentity(),
+            ...riskAxesOf(creq),
+            ...approvalCardMemberOf(creq),
+            ...grantBindingOf(creq, presentedArgs),
+            ...(j.ask.action === "ask" && j.ask.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
+            ...askMandateMember(ancestorFacts(j.ask.action === "ask" ? j.ask : undefined)),
+            ...inheritedAskCarry(j, isLiveApproverSeat(pc.onAsk), pc.autoMode?.denialTracking),
+            ruleEvidence: inheritedAskEvidence,
+        }, pc.onAsk, csignal ?? abortController.signal, lateAskSettlementObserver({ toolName: creq.toolName, toolCallId: creq.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice, onError: deps.onError })), pc.autoMode?.denialTracking, creq, inheritedStationFacts(creq));
+        void settleReadRootGrant(resolved.readRootGrant, undefined, { toolName: creq.toolName, toolCallId: creq.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice });
+        const askWaitMs = Math.max(0, now() - askT0);
+        if (resolved.action === "deny" && resolved.approverUnavailable === true) {
+            if (markInheritedUnavailable(creq.toolCallId))
+                return settledAs(settled.ask);
+            return settledAs(markerChannelFullDeny(creq));
+        }
+        settleDenialLimitFallback({ fallback: settled.fallback, mintedHere: settled.mintedHere, tracker: pc.autoMode?.denialTracking, resolved, headless: headlessDenyAtFold, stop: stopForDenialLimit, toolName: creq.toolName, toolCallId: creq.toolCallId });
+        if (resolved.action !== "allow")
+            return settledAs(resolved);
+        return { kind: "approved", resolved, askWaitMs, classes: askClassMembersOf(judged.classification).classes };
+    };
+    const legStandsIn = (pc) => standsInFor(pc, { chain: ownModChain, onAsk: frozenOnAsk, hookEnv: hookEnvSource, decider: autoModeDecider() }, ownChainJudges);
+    const parentConstraintWrappers = (inheritedParentConstraints ?? []).map((pc) => legStandsIn(pc)
         ? { check: () => ({ action: "allow" }) }
         : policy !== undefined && pc.policy === policy
             ? {
@@ -521,70 +563,24 @@ export async function preparePolicyChain(input) {
                 }
                 if (decision.action !== "ask")
                     return decision;
-                if (isDelegatedQuestion(creq)) {
-                    if (pc.contentMandate !== true || markInheritedUnavailable(creq.toolCallId))
-                        return decision;
-                    return {
-                        action: "deny",
-                        message: `inherited parent policy requires durable handling of the question raised for "${creq.toolName}" and the marker channel is at capacity — ` +
-                            `denied fail-closed (tighten-only)`,
-                    };
-                }
-                if (pc.durableMandate === true) {
-                    if (mandatedCallFloats(creq.toolCallId))
-                        return decision;
-                    return mandateUnreconstructibleDeny(creq);
-                }
-                const presentedArgs = decision.updatedInput !== undefined ? decision.updatedInput : creq.args;
-                const judged = await judgeInheritedClassifier({ liveMode: () => permissionMode.current, autoMode: pc.autoMode, ask: decision, req: { ...creq, args: presentedArgs }, signal: csignal ?? abortController.signal, subject: "this call", allowRewrite: decision.updatedInput, facts: inheritedStationFacts(creq), unavailableSeat: classifierUnavailableSeat({ station: "ancestor", ...(pc.autoMode?.decider.timeoutMs !== undefined ? { budgetMs: pc.autoMode.decider.timeoutMs } : {}), route: frozenApproverRoute(pc.onAsk), onNotice: deps.onNotice, sessionId, runId }) });
-                if (judged.kind === "allow")
-                    return judged.result;
-                if (judged.kind === "deny")
-                    return judged.result;
-                const { ask: inheritedAsk, fallback } = judged;
-                if (fallback === undefined && sandboxAdmissionArmed && policyAskClassOf(pc.policy) === "sandbox_local" && !sandboxBoundaryCapable(creq) && judged.classification.row.sandboxAdmission) {
-                    recordAncestorSandboxAdmission(creq.toolCallId, creq.toolName);
-                    return decision.updatedInput !== undefined ? { action: "allow", updatedInput: decision.updatedInput, decisionReason: "sandbox" } : { action: "allow", decisionReason: "sandbox" };
-                }
-                const arbitrated = arbitrateInherited(inheritedAsk.action === "ask" ? { ...inheritedAsk, ...(decision.updatedInput !== undefined ? { updatedInput: decision.updatedInput } : {}) } : inheritedAsk, creq.toolCallId, judged);
-                if (arbitrated !== undefined)
-                    return arbitrated;
-                const askT0 = now();
-                const { resolved, judged: settled } = await resolveInheritedAsk(judged, (j) => resolveAsk({
-                    toolName: creq.toolName,
-                    toolCallId: creq.toolCallId,
-                    args: presentedArgs,
-                    ...ruleOffersOf(creq, presentedArgs, ancestorFacts(j.ask.action === "ask" ? j.ask : undefined)),
-                    ...cardDisclosureOf(j.ask, inheritedAskFallbackMessage(creq.toolName)),
-                    ...askSourceIdentity(),
-                    ...riskAxesOf(creq),
-                    ...approvalCardMemberOf(creq),
-                    ...grantBindingOf(creq, presentedArgs),
-                    ...(j.ask.action === "ask" && j.ask.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
-                    ...askMandateMember(ancestorFacts(j.ask.action === "ask" ? j.ask : undefined)),
-                    ...inheritedAskCarry(j, isLiveApproverSeat(pc.onAsk), pc.autoMode?.denialTracking),
-                    ruleEvidence: inheritedAskEvidence,
-                }, pc.onAsk, csignal ?? abortController.signal, lateAskSettlementObserver({ toolName: creq.toolName, toolCallId: creq.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice, onError: deps.onError })), pc.autoMode?.denialTracking, creq, inheritedStationFacts(creq));
-                void settleReadRootGrant(resolved.readRootGrant, undefined, { toolName: creq.toolName, toolCallId: creq.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice });
-                const askWaitMs = Math.max(0, now() - askT0);
-                if (resolved.action === "deny" && resolved.approverUnavailable === true) {
-                    if (markInheritedUnavailable(creq.toolCallId))
-                        return settled.ask;
-                    return markerChannelFullDeny(creq);
-                }
-                settleDenialLimitFallback({ fallback: settled.fallback, mintedHere: settled.mintedHere, tracker: pc.autoMode?.denialTracking, resolved, headless: headlessDenyAtFold, stop: stopForDenialLimit, toolName: creq.toolName, toolCallId: creq.toolCallId });
-                if (resolved.action !== "allow")
-                    return resolved;
+                const settled = await settleInstallationAsk(pc, decision, creq, csignal);
+                if (settled.kind === "settled")
+                    return settled.result;
+                const { resolved } = settled;
                 if (resolved.updatedInput !== undefined) {
                     return recheckApprovedEdit(pc.policy, pc.onAsk, creq, resolved.updatedInput, resolved, csignal, pc.autoMode);
                 }
-                if (pc.preToolUse === undefined) {
-                    recordInheritedAskGrant(creq.toolCallId, pc.onAsk, resolved.presentedInput, askWaitMs, resolved, askClassMembersOf(judged.classification).classes);
+                if (screeningInstallationsOf([pc]).length === 0) {
+                    recordInheritedAskGrant(creq.toolCallId, pc.onAsk, resolved.presentedInput, settled.askWaitMs, resolved, settled.classes);
                 }
                 if (decision.updatedInput === undefined)
                     return resolved;
                 return { ...resolved, updatedInput: decision.updatedInput };
             }));
+    const installationToolChecks = inheritedToolChecks(inheritedParentConstraints ?? [], legStandsIn, (pc) => async (ask, creq, csignal) => {
+        const settled = await settleInstallationAsk(pc, ask, creq, csignal);
+        return settled.kind === "settled" ? settled.result : settled.resolved;
+    });
     const rewriteCapableLayers = policy !== undefined || parentConstraintWrappers.length > 0;
     const rewriteEmitterIndex = new Map();
     const rewriteCapableChain = [
@@ -640,8 +636,7 @@ export async function preparePolicyChain(input) {
                 }
             }
             const recheckLayers = [...recheckPrefix, ...postEmitterSameInstanceAdapters];
-            const finalRead = withArgsReading(req, decision.updatedInput, signal);
-            const finalReq = finalRead !== undefined ? await finalRead : { ...req, args: decision.updatedInput };
+            const finalReq = await withArgsReading(req, decision.updatedInput, signal);
             let asked;
             let revalidated;
             let restated;
@@ -678,7 +673,7 @@ export async function preparePolicyChain(input) {
             return decision;
         })
         : foldedPolicy;
-    return { hooks, hookTimeoutMs, preToolUseObservational, ownGatePreToolUse, basePolicyForResumeEdit, denyNarrowingPolicy, skillGrantLane, allowEntryLanes, policyLayers, effectivePolicy, inheritedUnavailableAsks, inheritedAskGrants, askSourceIdentity, riskAxesOf, ruleOffersOf, grantBindingOf, permissionRuleLane, ruleLaneFacts, permissionRuleOrgLane, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, foldAskClasses, ancestorSandboxAdmissions, ancestorArbitrations };
+    return { basePolicyForResumeEdit, denyNarrowingPolicy, skillGrantLane, allowEntryLanes, policyLayers, effectivePolicy, inheritedUnavailableAsks, inheritedAskGrants, askSourceIdentity, riskAxesOf, ruleOffersOf, grantBindingOf, permissionRuleLane, ruleLaneFacts, permissionRuleOrgLane, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, foldAskClasses, ancestorSandboxAdmissions, ancestorArbitrations, inheritedToolChecks: installationToolChecks };
 }
 const advisedPolicyNames = new WeakMap();
 const ADVISED_KEYS_CAP = 64;

package/dist/core/runner/prepare-project-context.d.ts

@@ -14,7 +14,7 @@ export interface PrepareProjectContextInput {
     /** borrowed-readonly — the REBOUND spec (`spec′`). Read: `sessionId` (phase derivation + the
      *  continuation projections), `skills` (the roster), `userInvokedSkills` (the person's invoked skills — their
      *  rows are written here), `principal` (the shared-memory tools' trusted identity). Never mutated. */
-    spec: Pick<TaskSpec, "sessionId" | "skills" | "userInvokedSkills" | "principal">;
+    spec: Pick<TaskSpec, "sessionId" | "skills" | "userInvokedSkills" | "principal" | "excludeAllTools">;
     /** borrowed-readonly — trusted internals: `agentName` (seam ctx), `inheritedSkillGrants` (the parent's captured
      *  skill grant rows, seeded as `inherited`), `inheritedAllowedTools` (the parent's request entries, seeded as this leg's
      *  own). `undefined` on a standalone prepare. */

package/dist/core/runner/prepare-project-context.js

@@ -8,14 +8,17 @@ import { defineTool } from "../tools.js";
 import { readFrozenSkillGrants, seedSkillGrants, skillSeatReader } from "../skill-grant.js";
 import { allowedToolsNotGrantedNotice, seedAllowEntryTables } from "../allow-entry.js";
 import { deliverEngineNotice } from "../engine-notice.js";
+import { announceMemoryNotMounted } from "./announce-once-ledger.js";
 import { SKILL_CONTENT_MAX_CHARS, SKILL_TOOL_NAME, createSkillTool, normalizeSkills } from "./synthetic-tools.js";
 import { skillLoadReading } from "./skill-base-dir.js";
 import { RosterBuilder } from "../tool-roster.js";
 import { mountedToolNames } from "../tool-name-aliases.js";
+import { valveLeaves } from "../../agents/tool-filter.js";
 import { asThrownError } from "../thrown-value.js";
 export async function prepareProjectContext(input) {
     const { deps, spec, internals, session, sessionId, runId, hostTaskId, taskRootFinal, handsEnabled, delegation, seedContextFiles, memoryBlockFromEngine, skillGrants, allowedTools, allowedToolTables, roster, toolFaceSnapshot, onceLedger, memoryTools, memoryEngineSession, memorySearchToolsPlanned, memoryPairExcludedName, memoryPairOccupiedName, resume, skillListingBudget } = input;
     const tools = roster.tools;
+    const leaves = valveLeaves(spec, toolFaceSnapshot.selector);
     let memoryBlock = memoryBlockFromEngine;
     let instructionSources;
     let projectInstructionContent;
@@ -114,14 +117,12 @@ export async function prepareProjectContext(input) {
             for (const alias of t.aliases ?? [])
                 mountedNameDomain.add(alias);
         }
-        const excludedName = SHARED_MEMORY_TOOL_NAMES.find((n) => !toolFaceSnapshot.selector.admits({ name: n }));
+        const excludedName = SHARED_MEMORY_TOOL_NAMES.find((n) => !leaves({ name: n }));
         const occupiedName = SHARED_MEMORY_TOOL_NAMES.find((n) => mountedNameDomain.has(n));
         if (excludedName !== undefined || occupiedName !== undefined) {
-            onceLedger.onError(new Error(`Shared memory tools ${SHARED_MEMORY_TOOL_NAMES.join("/")} were NOT mounted: ` +
-                (excludedName !== undefined
-                    ? `the run's tool selector (allowTools / excludeTools) does not admit "${excludedName}"`
-                    : `this task already declares a tool named "${occupiedName}" (the built-in yields to it)`) +
-                " — the pair mounts together or not at all."), { phase: "config", sessionId, classification: "shared-memory-not-mounted" });
+            announceMemoryNotMounted(onceLedger, sessionId, "shared", SHARED_MEMORY_TOOL_NAMES, excludedName !== undefined
+                ? `the run's tool face (allowTools / excludeTools / excludeAllTools) does not admit "${excludedName}"`
+                : `this task already declares a tool named "${occupiedName}" (the built-in yields to it)`);
         }
         else {
             roster.mountAll(createSharedMemoryTools({
@@ -137,13 +138,11 @@ export async function prepareProjectContext(input) {
         memoryEnginePairMounted = true;
     }
     else if (memoryEngineSession !== undefined && !memorySearchToolsPlanned) {
-        onceLedger.onError(new Error(`Memory tools ${MEMORY_ENGINE_TOOL_NAMES.join("/")} were NOT mounted: ` +
-            (memoryPairExcludedName !== undefined
-                ? `the run's tool selector (allowTools / excludeTools) does not admit "${memoryPairExcludedName}"`
-                : `this task already declares a tool named "${memoryPairOccupiedName}" (the built-in yields to it)`) +
-            " — these tools mount together or not at all."), { phase: "config", sessionId, classification: "memory-tools-not-mounted" });
+        announceMemoryNotMounted(onceLedger, sessionId, "engine", MEMORY_ENGINE_TOOL_NAMES, memoryPairExcludedName !== undefined
+            ? `the run's tool face (allowTools / excludeTools / excludeAllTools) does not admit "${memoryPairExcludedName}"`
+            : `this task already declares a tool named "${memoryPairOccupiedName}" (the built-in yields to it)`);
     }
-    const skillsListing = skillSpecs.length > 0
+    const skillsListing = skillSpecs.length > 0 && leaves({ name: SKILL_TOOL_NAME })
         ? {
             entries: skillSpecs.map((s) => ({
                 name: s.name,