@sema-agent/core 7.51.2 → 7.53.0

package/dist/core/session-policy-store.js

@@ -1,13 +1,15 @@
 import { posix } from "node:path";
 import { isWinFormPath } from "../tools/fs/safety.js";
-import { NAMESPACED_NAME_SHAPES, carriesNamespaceSeparator } from "./protocol-table.js";
-import { compileAllowList, compiledEntryName, inertEntryPhrase, readRuleEntry, renderListEntry } from "./allow-entry.js";
+import { NAMESPACED_NAME_SHAPES } from "./protocol-table.js";
+import { callerToolNameProblem } from "./caller-tool-name.js";
+import { compileAllowList, compiledEntryName, inertEntryPhrase, readRuleEntry, renderListEntry, rootFacingToolNames } from "./allow-entry.js";
 import { valueTypeLabel } from "./tool-name-list.js";
+import { noticeRuleText } from "./permission-rule-model.js";
 const SESSION_RULE_BUCKETS = { toolAllow: "allow", toolDeny: "deny", allowDirs: "dirs" };
 const BUCKETS = Object.keys(SESSION_RULE_BUCKETS);
 const ENTRY_FIELDS = BUCKETS.filter((f) => SESSION_RULE_BUCKETS[f] !== "dirs");
 const STORE_STAMPS = new Set(["rev", "gen", "grammar"]);
-export const SESSION_RULES_GRAMMAR = 1;
+export const SESSION_RULES_GRAMMAR = 2;
 export class SessionPolicyError extends Error {
     code;
     detail;
@@ -29,10 +31,11 @@ export function readMountedToolNames(value) {
         refuse("must be an iterable of tool names (an array or a Set), not a single value");
     const names = new Set();
     for (const n of value) {
-        if (typeof n !== "string" || n.length === 0)
-            refuse(`holds ${JSON.stringify(n) ?? String(n)}, which is not a non-empty tool name`);
-        if (carriesNamespaceSeparator(n))
-            refuse(`holds ${JSON.stringify(n)}: "__" is reserved for protocol tool names and no deployment tool may carry it`);
+        if (typeof n !== "string")
+            refuse(`holds ${JSON.stringify(n) ?? String(n)}, which is not a tool name`);
+        const problem = callerToolNameProblem(n);
+        if (problem !== undefined)
+            refuse(`holds ${JSON.stringify(n)}: ${problem}`);
         names.add(n);
     }
     return names;
@@ -116,34 +119,122 @@ function canonicalRules(read) {
     }
     return out;
 }
-function readsAsNothingIn(grammar, field, entry, compiled) {
-    return grammar === 0 && SESSION_RULE_BUCKETS[field] === "allow" && compiledEntryName(compiled) !== entry;
+function earlierGrammarReads(grammar, field, entry, reading) {
+    if (grammar >= SESSION_RULES_GRAMMAR)
+        return false;
+    if (reading.kind === "inert" && reading.reason === "grammar")
+        return true;
+    if (grammar !== 0 || SESSION_RULE_BUCKETS[field] !== "allow")
+        return false;
+    return reading.kind === "row" ? compiledEntryName(reading.compiled) !== entry : reading.reason === "wildcard_all";
+}
+function readsAsNoRule(entry, field) {
+    const reading = readRuleEntry(entry, SESSION_RULE_BUCKETS[field]);
+    return reading.kind === "inert" && reading.reason === "grammar";
+}
+const NO_RULE_REASONS = new Set(["grammar", "earlier_grammar"]);
+export function unreadableDenyEntries(rules, roster) {
+    return compileSessionRuleBucket(rules, "toolDeny", roster).inert.filter((i) => NO_RULE_REASONS.has(i.reason));
+}
+function readsAsWildcard(entry) {
+    return compileAllowList([entry], "allow").inert.some((i) => i.reason === "wildcard_all");
+}
+const STAR_IS_NO_ALLOW_RULE = "it is no allow rule in any grammar and a write holding it is refused";
+function starWayOut(onlyStars, others, left) {
+    return onlyStars
+        ? `"*" is no allow rule in any grammar (a write holding it is refused); to drop it, write the session's rules afresh without it ${REWRITE_THROUGH}; ${left}`
+        : `${others}, leaving "*" out — ${STAR_IS_NO_ALLOW_RULE}; ${left}`;
 }
 export function compileSessionRuleBucket(rules, field, roster) {
-    const list = compileAllowList(rules[field] ?? [], SESSION_RULE_BUCKETS[field], roster);
-    const rows = list.rows.filter((r) => !readsAsNothingIn(rules.grammar, field, r.entry, r.compiled));
-    if (rows.length === list.rows.length)
-        return list;
-    const earlier = list.rows.filter((r) => readsAsNothingIn(rules.grammar, field, r.entry, r.compiled)).map((r) => ({ entry: r.entry, reason: "earlier_grammar" }));
-    return { rows, inert: [...list.inert, ...earlier] };
+    const direction = SESSION_RULE_BUCKETS[field];
+    const entries = rules[field] ?? [];
+    const earlier = new Set(entries.filter((e) => earlierGrammarReads(rules.grammar, field, e, readRuleEntry(e, direction, roster))));
+    const whole = compileAllowList(entries, direction, roster);
+    const voided = direction === "allow" && whole.inert.some((i) => i.reason === "wildcard_all");
+    if (earlier.size === 0 || (voided && rules.grammar > 0))
+        return whole;
+    const list = compileAllowList(entries.filter((e) => !earlier.has(e)), direction, roster);
+    return { rows: list.rows, inert: [...list.inert, ...entries.filter((e) => earlier.has(e)).map((entry) => ({ entry, reason: "earlier_grammar" }))] };
 }
 const ADVISORY_ENTRIES_SHOWN = 5;
-export function earlierGrammarAdvisory(sessionId, entries) {
-    const one = entries.length === 1;
-    const shown = entries.slice(0, ADVISORY_ENTRIES_SHOWN).map(renderListEntry).join(", ");
+function shownEntries(entries, render) {
     const rest = entries.length > ADVISORY_ENTRIES_SHOWN ? ` and ${entries.length - ADVISORY_ENTRIES_SHOWN} more` : "";
-    return (`session permission rules of session ${JSON.stringify(sessionId)}: toolAllow ${shown}${rest} ${one ? "was" : "were"} stored before the rule grammar stamp, when session rules compared an entry as a tool name as written, so a parenthesized entry named no tool — ` +
-        `${one ? "it admits" : "they admit"} nothing, as when written. To make ${one ? "it an allow rule" : "them allow rules"}, write the session's rules afresh through this engine (an operator write of a value without the stored row's rev; the write stamps grammar ${SESSION_RULES_GRAMMAR}); left as stored, ${one ? "it keeps" : "they keep"} admitting nothing.`);
+    return `${entries.slice(0, ADVISORY_ENTRIES_SHOWN).map(render).join(", ")}${rest}`;
+}
+const REWRITE_THROUGH = `through this engine (an operator write of a new value without the stored row's rev; the write stamps grammar ${SESSION_RULES_GRAMMAR})`;
+export function earlierGrammarAdvisory(sessionId, entries, field, grammar) {
+    const read = earlierGrammarReadings(entries, field);
+    const noRule = read.filter((r) => r.reader === "no_rule").map((r) => r.entry);
+    const namedNoTool = read.filter((r) => r.reader === "named_no_tool").map((r) => r.entry);
+    const sentences = [...(namedNoTool.length > 0 ? [namedNoToolInGrammar0(namedNoTool)] : []), ...(noRule.length > 0 ? [noRuleInThisGrammar(noRule, field, grammar)] : [])];
+    return `session permission rules of session ${JSON.stringify(sessionId)}: ${sentences.join(" ")}`;
+}
+function earlierGrammarReadings(entries, field) {
+    return entries.map((entry) => ({ entry, reader: readsAsNoRule(entry, field) ? "no_rule" : "named_no_tool" }));
+}
+export function earlierGrammarNotice(input) {
+    const { rulesSessionId, sessionId, entries, field, grammar } = input;
+    return {
+        code: "config.session_rules_earlier_grammar",
+        message: earlierGrammarAdvisory(rulesSessionId, entries, field, grammar),
+        detail: {
+            bucket: field,
+            storedGrammar: grammar,
+            entries: earlierGrammarReadings(entries, field).map((r) => ({ entry: noticeRuleText(r.entry), reader: r.reader })),
+            rewrite: { by: "operator_write_without_rev", stampsGrammar: SESSION_RULES_GRAMMAR },
+            rulesSessionId,
+            sessionId,
+        },
+    };
+}
+function namedNoToolInGrammar0(entries) {
+    const one = entries.length === 1;
+    const wildcard = entries.some(readsAsWildcard);
+    const rules = entries.some((e) => !readsAsWildcard(e));
+    const left = `left as stored, ${one ? "it keeps" : "they keep"} admitting nothing.`;
+    const way = !wildcard
+        ? `To make ${one ? "it an allow rule" : "them allow rules"}, write the session's rules afresh ${REWRITE_THROUGH}; ${left}`
+        : starWayOut(!rules, `To make the parenthesized ones allow rules, write the session's rules afresh ${REWRITE_THROUGH}`, left);
+    return (`toolAllow ${shownEntries(entries, renderListEntry)} ${one ? "was" : "were"} stored before the rule grammar stamp, when session rules compared an entry as a tool name as written, so ${wildcard ? 'an entry that is no bare tool name (a parenthesized rule, or "*")' : "a parenthesized entry"} named no tool — ` +
+        `${one ? "it admits" : "they admit"} nothing, as when written${wildcard ? "; the rest of the list is read as written, not voided" : ""}. ${way}`);
+}
+function noRuleInThisGrammar(entries, field, grammar) {
+    const one = entries.length === 1;
+    const stored = `${field} ${shownEntries(entries, (entry) => inertEntryPhrase({ entry, reason: "grammar" }))} ${one ? "was" : "were"} stored in rule grammar ${grammar}${grammar === 0 ? ", before the rule grammar stamp" : ""}, and this engine's rule grammar (${SESSION_RULES_GRAMMAR}) reads ${one ? "it" : "them"} as no rule`;
+    const way = `write the session's rules afresh ${REWRITE_THROUGH}, leaving ${one ? "it" : "them"} out or spelling the tool's name as a rule spells one — the write judge refuses an entry it cannot read`;
+    if (SESSION_RULE_BUCKETS[field] === "deny") {
+        return `${stored}: rules whose toolDeny holds an entry no grammar reads cannot be read, so every call is refused until they are rewritten. To lift that, ${way}, and a non-operator write cannot loosen rules that refuse every call.`;
+    }
+    const stars = entries.filter(readsAsWildcard).length;
+    const left = `left as stored, ${one ? "it keeps" : "they keep"} admitting nothing.`;
+    const wayOut = stars === 0
+        ? `To allow what ${one ? "it" : "they"} meant, ${way}; ${left}`
+        : starWayOut(stars === entries.length, `To allow what the others meant, write the session's rules afresh ${REWRITE_THROUGH}, spelling each tool's name as a rule spells one`, left);
+    return `${stored} — ${one ? "it admits" : "they admit"} nothing, and the rest of the list is read as written. ${wayOut}`;
+}
+export function earlierGrammarRefusalClause(entries, grammar) {
+    if (entries.length === 0)
+        return "";
+    const noRule = entries.filter((e) => readsAsNoRule(e, "toolAllow")).length;
+    const namedNoTool = entries.filter((e) => !readsAsNoRule(e, "toolAllow"));
+    const stars = namedNoTool.filter(readsAsWildcard).length;
+    const others = namedNoTool.length - stars;
+    const named = [...(stars > 0 ? ['"*"'] : []), ...(others > 0 ? [`${others} parenthesized ${others === 1 ? "entry" : "entries"}`] : [])];
+    const clauses = [
+        ...(namedNoTool.length > 0 ? [`where ${named.join(" and ")} ${namedNoTool.length === 1 ? "names no tool and admits" : "name no tool and admit"} nothing`] : []),
+        ...(noRule > 0 ? [`${namedNoTool.length > 0 ? "and " : "where "}${noRule} ${noRule === 1 ? "entry is" : "entries are"} no rule in this engine's rule grammar (${SESSION_RULES_GRAMMAR}) and ${noRule === 1 ? "admits" : "admit"} nothing`] : []),
+    ];
+    return `; the session's rules are stored in rule grammar ${grammar}, ${clauses.join(" ")}`;
 }
 export function earlierGrammarAnnouncer(sink) {
     const announced = new Set();
-    return (entries) => {
-        const key = JSON.stringify(entries);
+    return (entries, field, grammar) => {
+        const key = JSON.stringify([field, grammar, entries]);
         if (sink === undefined || entries.length === 0 || announced.has(key))
             return;
         announced.add(key);
         try {
-            sink(entries);
+            sink(entries, field, grammar);
         }
         catch {
         }
@@ -153,23 +244,36 @@ function effectiveEntries(rules, field, mountedToolNames) {
     return compileSessionRuleBucket(rules, field, mountedToolNames).rows.map((r) => r.entry);
 }
 function assertEntriesRead(rules, mountedToolNames) {
+    const known = rootFacingToolNames(mountedToolNames);
     for (const field of ENTRY_FIELDS) {
         for (const entry of rules[field] ?? []) {
-            const reading = readRuleEntry(entry, SESSION_RULE_BUCKETS[field], mountedToolNames);
-            const read = reading.kind === "row" && readsAsNothingIn(rules.grammar, field, entry, reading.compiled) ? { kind: "inert", reason: "earlier_grammar" } : reading;
+            const reading = readRuleEntry(entry, SESSION_RULE_BUCKETS[field], known);
+            const read = earlierGrammarReads(rules.grammar, field, entry, reading) ? { kind: "inert", reason: "earlier_grammar" } : reading;
             if (read.kind === "row")
                 continue;
             const { kind: _kind, ...why } = read;
             void _kind;
             const way = why.reason === "earlier_grammar"
-                ? ` These rules are written in grammar ${rules.grammar} (a stored row from before the grammar stamp), in which this entry names no tool. To make it an allow rule, write the rules afresh — a value without the stored row's rev; the write stamps grammar ${SESSION_RULES_GRAMMAR} — or leave the entry out.`
-                : why.verdict === "retired"
+                ? readsAsNoRule(entry, field)
+                    ? ` These rules are written in grammar ${rules.grammar} (a stored row), and this engine's grammar (${SESSION_RULES_GRAMMAR}) reads this entry as no rule (grammar) — ` +
+                        (field === "toolAllow" && readsAsWildcard(entry) ? `leave the entry out: it spells "*", and ${STAR_IS_NO_ALLOW_RULE}.` : "leave the entry out, or spell the tool's name as a rule spells one.")
+                    : ` These rules are written in grammar ${rules.grammar} (a stored row from before the grammar stamp), in which this entry names no tool.` +
+                        (readsAsWildcard(entry)
+                            ? ` It is no allow rule in grammar ${SESSION_RULES_GRAMMAR} either (a write holding it is refused) — leave the entry out.`
+                            : ` To make it an allow rule, write the rules afresh — a value without the stored row's rev; the write stamps grammar ${SESSION_RULES_GRAMMAR} — or leave the entry out.`)
+                : why.verdict === "retired" || why.reason === "near_miss"
                     ? ` If this deployment mounts its own tool under ${renderListEntry(entry)}, declare it in the store's mountedToolNames.`
                     : why.currentName === undefined
                         ? ` An entry is a tool name (Read; a protocol tool is named ${NAMESPACED_NAME_SHAPES}), a protocol namespace (mcp__<server>), or a rule in its tool's own grammar (Bash(<command>), Edit(<path>), Skill(<name>), WebFetch(domain:<host>)).`
                         : "";
             const sentence = why.guidance !== undefined ? ` — ${why.guidance}` : "";
-            throw new SessionPolicyError("inert_entry", `session rules ${field} holds ${inertEntryPhrase({ entry, ...why })}, which ${SESSION_RULE_BUCKETS[field] === "deny" ? "refuses" : "admits"} nothing as written${sentence}; nothing was written.${way}`, { field, entry, ...why });
+            const does = SESSION_RULE_BUCKETS[field] === "allow"
+                ? "admits nothing as written"
+                : NO_RULE_REASONS.has(why.reason)
+                    ? "refuses every call as stored (rules whose toolDeny holds an entry no grammar reads cannot be read) — a write holding it is refused"
+                    : "refuses nothing as written";
+            const carriedBy = why.reason === "near_miss" && why.currentName !== undefined && !mountedToolNames.has(why.currentName) ? { carriedBy: "catalog" } : {};
+            throw new SessionPolicyError("inert_entry", `session rules ${field} holds ${inertEntryPhrase({ entry, ...why, ...carriedBy })}, which ${does}${sentence}; nothing was written.${way}`, { field, entry, ...why });
         }
     }
 }
@@ -201,6 +305,12 @@ export function loosenReasons(priorValue, nextValue, mountedToolNames = NO_DECLA
     };
     const prior = shapeOf("prior", priorValue);
     const next = shapeOf("next", nextValue);
+    if (unreadableDenyEntries(next, mountedToolNames).length > 0)
+        return [];
+    const unreadPrior = unreadableDenyEntries(prior, mountedToolNames);
+    if (unreadPrior.length > 0) {
+        return [`the prior rules refuse every call — their toolDeny holds ${shownEntries(unreadPrior.map((i) => i.entry), (entry) => inertEntryPhrase({ entry, reason: "grammar" }))}, which no grammar reads`];
+    }
     const reasons = [];
     const keptDeny = new Set(effectiveEntries(next, "toolDeny", mountedToolNames));
     for (const x of effectiveEntries(prior, "toolDeny", mountedToolNames))

package/dist/core/session-reconcile.d.ts

@@ -51,6 +51,9 @@ export interface OrphanToolCall {
  *  message and `errorCode` on the synthetic `tool_end` frame, so a consumer never parses the text. Two-valued
  *  (a third value needs a cross-repo slip, see {@link reconcileInterruptedSession}). */
 export type ReconciledErrorKind = "interrupted_never_started" | "interrupted_outcome_unknown";
+/** The class that is positive evidence the call never ran: closed with no start observed. The synthetic `tool_end` frame's
+ *  `notExecuted` (`reconciledEnd`) and the persisted close's `details.notExecuted` both read it — one table, two faces. */
+export declare const closeNeverExecuted: (errorKind: ReconciledErrorKind) => boolean;
 /** One orphan closed by {@link reconcileInterruptedSession}, with everything the caller needs to mint the
  *  matching stream frame WITHOUT re-reading the session. */
 export type RecoveredOrphan = OrphanToolCall & {
@@ -153,6 +156,7 @@ export declare function isInterruptedClose(message: {
 /** The `toolResult` message for one {@link InterruptedResult} — the persisted and the request-view closes are this one shape. */
 export declare function interruptedResultMessage(result: InterruptedResult, timestamp: number): ToolResultMessage<{
     errorKind: ReconciledErrorKind;
+    notExecuted?: true;
 }>;
 /**
  * Reconcile a resumed session's active branch: close any orphan tool calls with a synthetic

package/dist/core/session-reconcile.js

@@ -1,4 +1,5 @@
 import { readMember } from "./thrown-value.js";
+export const closeNeverExecuted = (errorKind) => errorKind === "interrupted_never_started";
 const INTERRUPTED_UNKNOWN = "[INTERRUPTED] The previous run ended before this tool call's result was recorded. Its outcome " +
     "is UNKNOWN — the action may have completed, partially completed, or never run. Do not assume " +
     "success or failure. Before relying on it: if it is safe to read, query the current state to " +
@@ -119,7 +120,7 @@ export function interruptedResultMessage(result, timestamp) {
         toolCallId: result.toolCallId,
         toolName: result.toolName,
         content: [{ type: "text", text: result.text }],
-        details: { errorKind: result.errorKind },
+        details: { errorKind: result.errorKind, ...(closeNeverExecuted(result.errorKind) ? { notExecuted: true } : {}) },
         isError: true,
         timestamp,
     };

package/dist/core/shell-read-silence.js

@@ -2,6 +2,7 @@ import { types } from "node:util";
 import { dispositionsOfRow, SHELL_READ_FINDINGS } from "../tools/fs/shell-read-judge.js";
 import { receiveContract } from "./decision-receipt.js";
 import { egressThrownText } from "./untrusted-egress.js";
+import { receive } from "./mods/kernel/receive.js";
 const DISPOSITIONS = ["refuse", "mandated", "ordinary", "vouch"];
 const MEMBER_KINDS = {
     disposition: "word",
@@ -20,37 +21,7 @@ const MEMBER_KINDS = {
     admit: "admission",
 };
 const VERDICT_MEMBERS = Object.keys(MEMBER_KINDS);
-const DATA_DEPTH = 8;
-function ownedData(value, depth, path) {
-    if (value === null || value === undefined || typeof value === "string" || typeof value === "number" || typeof value === "boolean")
-        return { ok: true, value };
-    if (typeof value !== "object" || depth >= DATA_DEPTH || types.isProxy(value) || path.has(value))
-        return { ok: false };
-    const list = Array.isArray(value);
-    const proto = Object.getPrototypeOf(value);
-    if (list ? proto !== Array.prototype : proto !== Object.prototype && proto !== null)
-        return { ok: false };
-    const own = Object.getOwnPropertyDescriptors(value);
-    path.add(value);
-    try {
-        const out = list ? [] : {};
-        for (const key of Object.keys(own)) {
-            if (list && key === "length")
-                continue;
-            const d = own[key];
-            if (!Object.hasOwn(d, "value") || d.enumerable !== true)
-                return { ok: false };
-            const inner = ownedData(d.value, depth + 1, path);
-            if (!inner.ok)
-                return { ok: false };
-            Object.defineProperty(out, key, { value: inner.value, enumerable: true, writable: true, configurable: true });
-        }
-        return { ok: true, value: out };
-    }
-    finally {
-        path.delete(value);
-    }
-}
+const OWNED_DATA_MODE = Object.freeze({ accessors: "refuse", depth: 8, others: "refuse", isProxy: (v) => types.isProxy(v) });
 function receivedAnswer(answer, call) {
     if (typeof answer !== "object" || answer === null)
         return undefined;
@@ -65,7 +36,7 @@ function receivedAnswer(answer, call) {
         if (kind === "word" ? typeof v !== "string" : kind === "mark" ? v !== true : kind === "face" ? v !== "write" : kind === "admission" ? typeof v !== "function" || types.isProxy(v) : false)
             return undefined;
         if (kind === "record") {
-            const data = ownedData(v, 0, new Set());
+            const data = receive(v, OWNED_DATA_MODE);
             if (!data.ok || typeof data.value !== "object" || data.value === null || Array.isArray(data.value))
                 return undefined;
             v = data.value;

package/dist/core/side-query.d.ts

@@ -63,9 +63,11 @@ export interface SideQuerySpec {
      * Per-model auth — MIRRORS {@link TaskSpec.getApiKeyAndHeaders} (same signature, resolved per
      * call against the RESOLVED model, exactly like the task path's per-call hook). The brain
      * contract is the route pairing law (route-adjudicator.ts): a per-model credential (this hook,
-     * or an auth header on `Model.headers`) always rides; the deployment credential rides only to the
-     * deployment's own root — a model carrying a root of its own is refused
-     * (`route.credential_mismatch` / `route.credential_missing`), never silently followed.
+     * or a credential header on `Model.headers`) rides to the origin it first went out to and is
+     * refused anywhere else (`route.credential_origin_mismatch`); an answer handing the key beside
+     * the lane's own key header is refused as one verdict (`route.credential_answer_conflict`); the
+     * deployment credential rides only to the deployment's own root — a model carrying a root of its
+     * own is refused (`route.credential_mismatch` / `route.credential_missing`), never silently followed.
      * Historically the fallback was unconditional (`options.apiKey ?? config.apiKey`, with a model's
      * own `baseUrl` outranking the brain's), so a side query routed to a model carrying its own
      * `baseUrl` + per-model key sent the GATEWAY key to the per-model (possibly external) URL — the

package/dist/core/skill-grant.d.ts

@@ -69,8 +69,9 @@ export declare function skillGrantBindingMembers(call: {
  * bytes — the row stays pending: deny it, then activate again) and the resumed execution boundary (`site: "execution"`, the
  * bytes that will run, after every station that can rewrite them — the approval is spent: the call does not run). The
  * sentence says which side of the digest differs, read off the row's own arguments: the arguments name another skill than
- * the card's (`row.args`), or the card's skill no longer declares the lists the card showed (or is not served). Names the
- * skills, never a path; says the way out.
+ * the card's (`row.args`), or the card's skill's lists no longer bind to the card's digest (or it is not served) — its
+ * definition changed, or this engine reads an entry of it differently than the engine that parked the row (an entry that
+ * reads as nothing: the digest is the list reader's reading, not the text). Names the skills, never a path; says the way out.
  */
 export declare function parkedSkillApprovalRefusal(row: {
     readonly toolName: string;

package/dist/core/skill-grant.js

@@ -1,25 +1,33 @@
 import { wireOf } from "./tool-name-readings.js";
-import { parsePermissionRule } from "./permission-rules.js";
+import { ruleSpellingOf } from "./permission-rule-syntax.js";
 import { mountedToolPermissionSeat } from "./mode-policy.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 import { boundInputHashOf } from "./canonical-json.js";
 import { NOT_BINDABLE } from "./skill-grant-binding.js";
 import { readToolNameList } from "./tool-name-list.js";
-import { allowingRows, autoStripped, compileAllowList, readRuleEntry, inertEntryPhrase, judgeAllowEntries, nonListValueLabel, nonStringMemberLabel, renderListEntry } from "./allow-entry.js";
+import { allowingRows, autoStripped, compileAllowList, readRuleEntry, inertEntryPhrase, judgeAllowEntries, nonListValueLabel, renderListEntry, spelledListEntry } from "./allow-entry.js";
 export const SKILL_GRANT_ORIGINS = Object.freeze(["model", "user", "inherited"]);
 const FROZEN_SKILL_GRANT_ORIGINS = new Set(["model", "inherited"]);
 export function skillNamedBy(args, skills) {
     const named = args?.skill;
     return typeof named === "string" ? skills.find((s) => s.name === named) : undefined;
 }
+function readsAsNothingLabel(inert) {
+    return `<reads as nothing (${inert.reason}): ${spelledListEntry(inert.entry)}>`;
+}
 function skillGrantBinding(skill) {
-    const canonical = (entries) => [...new Set((entries ?? []).map((e) => {
-            if (typeof e !== "string")
-                return nonStringMemberLabel(e);
-            const p = parsePermissionRule(e);
+    const canonical = (entries, behavior) => {
+        const read = compileAllowList((entries ?? []), behavior);
+        const spelled = read.rows.map((r) => {
+            const p = ruleSpellingOf(r.entry);
+            if (p === undefined)
+                return readsAsNothingLabel({ entry: r.entry, reason: "grammar" });
             return p.ruleContent === undefined ? p.toolName : `${p.toolName}(${p.ruleContent})`;
-        }))].sort();
-    const boundGrants = { skill: skill?.name ?? null, allowedTools: canonical(skill?.allowedTools), disallowedTools: canonical(skill?.disallowedTools) };
+        });
+        const unread = read.inert.map((i) => (i.valueType !== undefined ? i.entry : readsAsNothingLabel(i)));
+        return [...new Set([...spelled, ...unread])].sort();
+    };
+    const boundGrants = { skill: skill?.name ?? null, allowedTools: canonical(skill?.allowedTools, "allow"), disallowedTools: canonical(skill?.disallowedTools, "deny") };
     return { boundGrantDigest: boundInputHashOf(boundGrants), boundGrants };
 }
 export function skillGrantDigest(skill) {
@@ -43,7 +51,7 @@ export function parkedSkillApprovalRefusal(row, args, skills, skillToolName, sit
         ? `this parked Skill activation of "${chosen}" carries no digest of the allowed-tools / disallowed-tools it was asked under (it was parked before Skill approvals bound them), so it cannot cover what the activation grants or refuses`
         : nameIn(args) !== nameIn(row.args)
             ? `this Skill approval was given on the card for "${shown(nameIn(row.args))}", and ${site === "claim" ? "this decision selects" : "the call would now activate"} "${chosen}" — not the Skill that card asked about, so the approval does not cover activating it`
-            : `"${chosen}" no longer declares the allowed-tools / disallowed-tools this Skill approval was asked under — as this resume serves it (one it does not load counts as absent), it changed after the approval was given, so the approval does not cover what activating it would now grant or refuse`;
+            : `the allowed-tools / disallowed-tools of "${chosen}", as this resume serves it (one it does not load counts as absent), no longer bind to the digest this Skill approval was asked under — its definition changed, or this engine reads one of its entries differently than the engine that approved it (an entry that reads as nothing) — so the approval does not cover what activating it would now grant or refuse`;
     return site === "claim"
         ? `${why} — refusing pre-CAS (nothing ran; the checkpoint stays pending). Decide this checkpoint as deny and re-activate it: the new card shows the current lists.`
         : `The approved Skill call was not executed: ${why}. This approval is spent — to use "${chosen}", have the model activate it again: the new card shows its lists.`;

package/dist/core/skills-directory.d.ts

@@ -18,25 +18,45 @@
  * directory third parties can write to is the same as pasting their text into the system prompt. The
  * loader validates SHAPE (spec conformance), never intent.
  *
- * **`allowed-tools` / `disallowed-tools` are COPIED, never judged.** Each frontmatter list reaches
+ * **`allowed-tools` / `disallowed-tools` are COPIED, never judged for what they mean.** Each frontmatter list reaches
  * {@link SkillSpec.allowedTools} / {@link SkillSpec.disallowedTools} entry by entry as the author wrote it — no
- * intersection with a roster, no projection onto a tool name, no refusal, no de-duplication. What an entry means
- * (a tool, a namespace, a command rule, a path, a wildcard that grants nothing) is read in ONE place, the run's
- * grant table, which announces what it cannot read; a loader that also judged would be a second reader of the grammar.
+ * intersection with a roster, no projection onto a tool name, no de-duplication. Each entry must be a rule SPELLING — the
+ * rule syntax's own test, `ruleSpellingOf` (a tool name, then at most one parenthesized rule) — or the skill is refused;
+ * what a spelled entry means (a tool, a namespace, a command rule, a path, a wildcard that grants nothing) is read in ONE
+ * place, the run's grant table, which announces what it cannot read. The deny list has a second spelling,
+ * `disallowedTools`, read where `disallowed-tools` is absent or null (YAML's null is the key's absence); a hyphen key with
+ * a value is the list and the alias is not looked at. The allow list has none. **Each list is read whole by ONE scanner,
+ * {@link scanValue} (its JSDoc states the rules), or the skill is refused by name (`no_frontmatter`)** — never installed
+ * shorter: a `disallowed-tools` that lost entries is a looser skill than the one its author wrote. The scanner reads YAML's
+ * structure as YAML does — a comment, a flow's `,` / `]` and a mapping's `: ` are YAML's inside a rule's parentheses too —
+ * and departs from what YAML and the reference's reader give only where the list is cut into entries, on purpose: the cut
+ * counts a rule's parentheses by depth and refuses an entry whose parentheses are not one group closing it — unmatched
+ * either way, or followed by more text (the reference's zone is boolean and installs such an entry); a `*` entry is
+ * copied, the list not collapsed to `*` alone; tab-indented block items are read (the reference's retry reads them too);
+ * and a block scalar's text is cut line by line — each line of a literal one (`|`) as written, a folded one (`>`) after
+ * YAML's folding, so `>` lines that hold one rule read as that rule (YAML keeps the line breaks of `|` in one string, which
+ * the reference installs as one entry no rule reads).
  *
- * Frontmatter is parsed by a deliberately closed subset reader (no YAML dependency — the runtime
- * dependency budget is a standing constraint): top-level `key: value` scalars, optional surrounding
- * quotes, `#` comment lines, block scalars (`|` / `>` with their indentation + chomping indicators),
- * flow sequences (`[a, b]`, including the multi-line form), and indented mapping bodies skipped
- * wholesale. That covers every field the spec defines, and the same posture the memory-engine
- * frontmatter reader already takes.
+ * Frontmatter is read by a deliberately closed subset reader (no YAML dependency — the runtime dependency budget is a
+ * standing constraint): top-level key lines ({@link yamlKeyLineOf}), `#` comment lines, block scalars (`|` / `>` with their
+ * indentation and chomping indicators), the tool lists, and nested blocks (a mapping or a sequence under a key with nothing
+ * on its line) skipped wholesale but for a line that opens a tool-list key (below). A key other than the tool lists keeps its
+ * value as written on its line (a value that is one quoted scalar, the scanner's own judgment, is that scalar decoded, over
+ * every line it runs); a value of it that opens a quote, a `[` or a `{` and does not
+ * close it refuses the skill too — the same scanner, over the same lines, says so. Every value takes its own lines and no
+ * more, and every line no value takes is judged in one place: an indented `key:` line under a value that is not a nested
+ * block — plain, quoted, a flow, a block scalar — refuses the skill naming both keys (YAML reads no key there), and a
+ * flush-left line that is no key line refuses it naming the line (YAML reads no key there either). A tool list is read only
+ * as a key of the frontmatter, written flush left: a tool-list key written in another key's nested block (at any depth), or
+ * after another key's closing quote or `]` on its line, or as a key of a flow mapping (or a pair in a flow sequence) that
+ * value holds, refuses the skill naming both keys — its list would be lost.
  */
 import type { SkillSpec } from "./types.js";
 /** Why one skill directory (or one of its parts) was not taken as-declared. */
 export type SkillsDirectoryWarningCode = 
 /** The directory holds no `SKILL.md`. */
 "no_skill_file"
-/** `SKILL.md` has no well-formed `---` fenced frontmatter block. */
+/** `SKILL.md` has no well-formed `---` fenced frontmatter block: no opening fence, an opening fence never closed by a whole-line `---`, a tool list (`allowed-tools` / `disallowed-tools`) whose value the reader cannot read as a list, a key whose value opens a quote, a `[` or a `{` it does not close, a value that is not a nested block followed by an indented `key:` line, a tool-list key written anywhere but flush left (in a nested block, or after a closing quote or `]` on a key's line), or a flush-left line that is no key line. */
  | "no_frontmatter"
 /** Required `name` absent. */
  | "missing_name"