@sema-agent/core 7.51.2 → 7.53.0

package/dist/core/tool-policy.js

@@ -16,10 +16,11 @@ import { boundInputHashOf } from "./canonical-json.js";
 import { delimitUntrusted, inlineUntrusted, REVIEWER_NOTE_MAX_BODY } from "./untrusted-text.js";
 import { describeRejectedValue } from "./tool-search-setting.js";
 import { egressText, egressThrownText } from "./untrusted-egress.js";
-import { assertNoRetiredToolPolicyKeys, RETIRED_DECISION_MEMBERS } from "./retired-keys.js";
+import { assertNoRetiredKeys, assertNoRetiredToolPolicyKeys, RETIRED_DECISION_MEMBERS, RETIRED_TOOL_POLICY_KEYS } from "./retired-keys.js";
 import { isEngineRefusal, nestedRecordsOf, receiveContract, receiveNestedRecords, refusedOutOfContract, screenContractValues } from "./decision-receipt.js";
 export { isEngineRefusal } from "./decision-receipt.js";
-import { isNamespacedCoveringRuleName, namespacedRuleNameCovers, parsePermissionRule } from "./permission-rules.js";
+import { isNamespacedCoveringRuleName, namespacedRuleNameCovers } from "./permission-rules.js";
+import { ruleSpellingOf } from "./permission-rule-syntax.js";
 import { protocolOf } from "./protocol-table.js";
 import { anchorSpelling, isAbsoluteForFamily, normalizeAbsPathLexically, pathFamilyOf, writeTargetPath } from "../tools/fs/safety.js";
 import { KNOWN_SAFE_ROOTS, removalReadingOf } from "../tools/fs/removal-targets.js";
@@ -147,7 +148,7 @@ export function decisionText(d) {
 }
 const TOOL_POLICY_CARRIED_MEMBERS = ["projection", "pathRules", "writeGuardRows", "nameSets"];
 export function carriedMembersOf(p) {
-    assertNoRetiredToolPolicyKeys(p);
+    assertNoRetiredKeys(p, RETIRED_TOOL_POLICY_KEYS, "ToolPolicy");
     const out = {};
     const carry = (k) => {
         const v = p[k];
@@ -176,6 +177,9 @@ export function namespacedCoveringEntries(entries) {
 export function namespacedCoveringHit(covering, call) {
     return covering.length > 0 && nameListHolds({ has: (name) => covering.some((e) => namespacedRuleNameCovers(e, name)) }, call);
 }
+export function projectionToolNames(c) {
+    return c.kind === "shell_command" ? { member: "tools", list: c.tools } : { member: "names", list: c.names };
+}
 export function checkToolPolicyProjection(projection, req) {
     const listed = (list) => heldBy("policy.projectionReplay", { has: (n) => list.includes(n) }, req);
     for (const c of projection.components) {
@@ -305,6 +309,12 @@ export function refuseOutOfContractDecision(d, opts) {
         return refusedOutOfContract(`a permission decision's members could not be detached from the layer that returned them (${detached.reason}) — ` +
             `the engine keeps its own copy of what it read; denied fail-closed`);
     }
+    const rewrite = detached.value.updatedInput;
+    const ownedRewrite = rewrite !== undefined ? ownedCopy(rewrite, "updatedInput") : undefined;
+    if (ownedRewrite !== undefined && !ownedRewrite.ok) {
+        return refusedOutOfContract(`a permission decision's members could not be detached from the layer that returned them (${ownedRewrite.reason}) — ` +
+            `the engine keeps its own copy of what it read; denied fail-closed`);
+    }
     const receipt = Object.freeze(attestation !== undefined ? { ...detached.value, attestation } : detached.value);
     for (const v of Object.values(receipt))
         if (Array.isArray(v))
@@ -318,9 +328,6 @@ export function refuseOutOfContractDecision(d, opts) {
     (hookSeam ? HOOK_RECEIPTS : ENGINE_RECEIPTS).add(receipt);
     return receipt;
 }
-export function receiveHookResult(result) {
-    return refuseOutOfContractDecision(result, { reasonIsNonInput: true });
-}
 const DEADLINE_ELAPSED = Symbol("approval.deadline_elapsed");
 function withTimeout(p, ms, onTimeout) {
     if (ms === undefined) {
@@ -353,6 +360,7 @@ export function createAllowDenyPolicy(opts) {
         if (entries === undefined)
             return undefined;
         const kept = [];
+        const seen = new Set();
         for (const entry of entries) {
             const ns = protocolOf(entry);
             if (ns !== undefined) {
@@ -367,8 +375,23 @@ export function createAllowDenyPolicy(opts) {
                     continue;
                 }
             }
-            if (parsePermissionRule(entry).ruleContent === undefined) {
-                kept.push(entry);
+            const spelled = ruleSpellingOf(entry);
+            if (spelled === undefined) {
+                const lesson = `a spelling no tool name can have — the rule syntax reads no tool name in it, so a name set never names a tool by it. Fix the entry.`;
+                invalid.push({ entry, list, message: `"${entry}" is ${lesson}`, lesson });
+                continue;
+            }
+            if (spelled.ruleContent === undefined) {
+                if (spelled.toolName === "*" && list === "deny") {
+                    const lesson = `the wildcard — \`*\` names no tool, and a deny entry reaches the tool it names, so this one would be kept and never match ` +
+                        `(a deny that reads protective and denies nothing). Name the tools to deny; to leave a run no tools, write an empty allow list.`;
+                    invalid.push({ entry, list, message: `"${entry}" is ${lesson}`, lesson });
+                    continue;
+                }
+                if (!seen.has(spelled.toolName)) {
+                    seen.add(spelled.toolName);
+                    kept.push(spelled.toolName);
+                }
                 continue;
             }
             const lesson = `a rule CONTENT form, not a tool name — a name set matches raw tool names, so this entry ` +
@@ -562,7 +585,7 @@ export function combinePolicies(...policies) {
         ...carriedMembersOf(folded),
         async check(req, signal) {
             let asked;
-            let current = req;
+            let current = Object.freeze({ ...req });
             let rewrite;
             let stated;
             let records;
@@ -574,7 +597,7 @@ export function combinePolicies(...policies) {
             let authoredBySeen = false;
             const contributors = [];
             const settleDeny = (d) => {
-                const out = rewrite?.updatedInput !== undefined ? { ...d, updatedInput: rewrite.updatedInput } : d;
+                const out = rewrite !== undefined ? refusalOf(d, current.args) : d;
                 if (records === undefined)
                     return out;
                 return { ...out, attestation: mergeAttestation(req, records, d.attestation) };
@@ -589,8 +612,7 @@ export function combinePolicies(...policies) {
                     continue;
                 }
                 if (d.updatedInput !== undefined) {
-                    const reread = withArgsReading(current, d.updatedInput, signal);
-                    current = reread !== undefined ? await reread : { ...current, args: d.updatedInput };
+                    current = Object.freeze(await withArgsReading(current, d.updatedInput, signal));
                     rewrite = d;
                     stated = d.action === "allow" ? d.decisionReason : undefined;
                 }
@@ -871,6 +893,55 @@ export function tryCloneArgs(v) {
         return { ok: false, reason: describeThrown(err), cause: err };
     }
 }
+export function refusalOf(deny, judged) {
+    return deny.action !== "deny" || deny.updatedInput !== undefined ? deny : { ...deny, updatedInput: judged };
+}
+export function foldHookAsk(verdict, hookAsk) {
+    if (verdict.action === "deny")
+        return verdict;
+    const mandate = hookAsk.requiresRealApproval === true ? { requiresRealApproval: true } : {};
+    if (verdict.action === "allow") {
+        return { action: "ask", ...(hookAsk.message !== undefined ? { message: hookAsk.message } : {}), decisionReason: "hook", ...mandate, ...(hookAsk.updatedInput !== undefined ? { updatedInput: hookAsk.updatedInput } : {}) };
+    }
+    const hookMessage = hookAsk.message;
+    const message = hookMessage !== undefined && hookMessage !== verdict.message ? `${verdict.message !== undefined ? `${verdict.message} ` : ""}(a PreToolUse hook also asks: ${hookMessage})` : verdict.message;
+    return { ...verdict, decisionReason: "hook", ...(message !== undefined ? { message } : {}), ...mandate };
+}
+const OWNED_ARGS = new WeakSet();
+export function ownArgs(v, root = "args") {
+    if (v === null || (typeof v !== "object" && typeof v !== "function") || OWNED_ARGS.has(v))
+        return { ok: true, value: v };
+    const copy = tryCloneArgs(v);
+    return copy.ok ? ownedCopy(copy.value, root) : { ...copy, reason: `unclonable value: ${copy.reason}` };
+}
+export function ownedReading(read) {
+    return (args) => {
+        const out = read(args);
+        const owned = ownArgs(out);
+        return owned.ok ? owned.value : out;
+    };
+}
+function ownedCopy(fresh, root) {
+    const pending = [[fresh, root]];
+    for (let next = pending.pop(); next !== undefined; next = pending.pop()) {
+        const [x, at] = next;
+        if (typeof x !== "object" || x === null || Object.isFrozen(x))
+            continue;
+        const proto = Object.getPrototypeOf(x);
+        if (proto !== Object.prototype && proto !== Array.prototype && proto !== null) {
+            return { ok: false, reason: `${inlineUntrusted(at, 200)} is a ${Object.prototype.toString.call(x).slice(8, -1)}, whose contents cannot be made immutable — args are plain data` };
+        }
+        Object.freeze(x);
+        for (const key of Reflect.ownKeys(x)) {
+            const d = Object.getOwnPropertyDescriptor(x, key);
+            if (d !== undefined && "value" in d)
+                pending.push([d.value, Array.isArray(x) ? `${at}[${String(key)}]` : `${at}.${String(key)}`]);
+        }
+    }
+    if (typeof fresh === "object" && fresh !== null)
+        OWNED_ARGS.add(fresh);
+    return { ok: true, value: fresh };
+}
 export function describeThrown(err) {
     const contained = containThrownText(egressThrownText("same-principal", err));
     if (contained !== "")
@@ -1127,7 +1198,7 @@ function readApproverOutcomeObject(ok, toolName, editLane) {
             `re-adjudication an approver's edit gets; denied fail-closed (approve or refuse what was shown, and route edits ` +
             `through the run's approver seat)`, settledByNobody("approver_contract"));
     }
-    const edit = tryCloneArgs(suppliedEdit);
+    const edit = ownArgs(suppliedEdit);
     if (!edit.ok) {
         return refused(`the approved edit for "${toolName}" is not safely clonable (${edit.reason}) — denied fail-closed`, settledByNobody("presentation_failed"));
     }
@@ -1150,11 +1221,11 @@ async function resolveAskArms(req, onAsk, signal, onLateSettlement) {
     if (signal?.aborted) {
         return { action: "deny", message: `approval aborted for "${req.toolName}" (run or turn interrupted)`, decisionReason: "mode", settlement: settledByNobody("task_aborted") };
     }
-    const presented = tryCloneArgs(req.args);
+    const presented = ownArgs(req.args);
     if (!presented.ok) {
         return {
             action: "deny",
-            message: `approval for "${req.toolName}" could not present the args safely (unclonable value: ${presented.reason}) — denied fail-closed`,
+            message: `approval for "${req.toolName}" could not present the args safely (${presented.reason}) — denied fail-closed`,
             decisionReason: "mode",
             settlement: settledByNobody("presentation_failed"),
         };

package/dist/core/tool-registry.d.ts

@@ -88,6 +88,26 @@ export declare function pathTargetValue(args: unknown, pt: {
     param: string;
     aliases?: readonly string[];
 }): string | undefined;
+/**
+ * CC parity: Read/Edit/Write take the file path as `file_path`. Read the target the same way
+ * EVERYWHERE the path is consumed from a tool-call's args — not just the tool body but ALSO every gate that
+ * extracts the write target to confine it (sensitive-path, session allowDirs, the fs-write gate). A gate that only
+ * read `args.path` would see `undefined` for a `file_path` call and either fail-OPEN (circumvent the guard — a real
+ * hole) or fail-closed (deny a legitimate write). Single source.
+ *
+ * The `path` arm is deliberately BROADER than what Read/Edit/Write accept: their schema requires
+ * `file_path` (fs-shared.ts FILE_PATH_PARAMS; Write alone repairs the `path` spelling onto it BEFORE validation,
+ * `coerceWriteArguments`, so a gate never sees the alias there), but this reader is
+ * shared with gates that judge OTHER tool vocabularies — Glob's real `path` parameter, deployment-authored tools —
+ * and a gate must never see LESS than the tool it is confining might act on. So the asymmetry is the design: the
+ * schema decides what a caller may send, this decides what gets judged, and this side over-reads on purpose.
+ *
+ * `file_path` wins; an empty/non-string `file_path` falls back to `path` (NOT an alias for Read/Edit/Write, whose
+ * schema requires `file_path`). Empty string ⇒ undefined (treated as "no path") so every caller's `=== undefined`
+ * check is sufficient — no separate length-0 guard needed. It lives beside {@link pathTargetValue} and is that
+ * reader over the one slot above: the engine's compaction metadata reads it too, and the engine never imports tools/.
+ */
+export declare function fileArgPath(args: unknown): string | undefined;
 /** The path target of a wire name — the FIRST definition's (every definition under one name declares
  *  the same target; the conformance test pins that). */
 /** A gated call as every fence sees it: the wire name, the args, and the OBJECT face a prepared leg stamped on the

package/dist/core/tool-registry.js

@@ -85,6 +85,10 @@ export function pathTargetValue(args, pt) {
     }
     return undefined;
 }
+const FILE_ARG_PATH_TARGET = { param: "file_path", aliases: ["path"] };
+export function fileArgPath(args) {
+    return pathTargetValue(args, FILE_ARG_PATH_TARGET);
+}
 export function protectivePathTargetOf(call) {
     if (call.face?.pathTarget !== undefined)
         return call.face.pathTarget;

package/dist/core/tool-spec.d.ts

@@ -121,10 +121,14 @@ export interface ReadRootGrantCandidate {
 }
 export interface ToolSpec<TParams extends TSchema = TSchema> {
     /**
-     * Model-facing tool name. MUST NOT contain `__` — that separator is reserved by the PROTOCOL TABLE
-     * (`protocol-table.ts`), the umbrella over every namespaced family the engine speaks: `mcp__<server>__<tool>`,
-     * `a2a__<peer>__<skill>`, and whatever a third protocol appends. A caller tool name carrying it is rejected
-     * at prepare-time (`config.tool_name_invalid`).
+     * Model-facing tool name. It keeps the caller tool name contract (`caller-tool-name.ts`), judged at prepare-time — a
+     * name that breaks it is refused there (`config.tool_name_invalid`) and the run does not start:
+     *  - it is a name a rule can name: ASCII letters, digits and `_ - . : *`, starting with a letter, a digit or `_`, not
+     *    ending with `.` or `:`, and not the lone wildcard `*` — so every allow / deny list can name the tool (a leading `-`,
+     *    a character outside ASCII, a blank or an empty name is refused);
+     *  - it does not contain `__` — that separator is reserved by the PROTOCOL TABLE (`protocol-table.ts`), the umbrella over
+     *    every namespaced family the engine speaks: `mcp__<server>__<tool>`, `a2a__<peer>__<skill>`, and whatever a third
+     *    protocol appends.
      *
      * The live reason (not the retired durable-resume name shim, RB-476-A): every table-driven site — the
      * namespace `parse`, the grouped display key, the permission-rule lanes, the tool-manifest origin
@@ -136,7 +140,7 @@ export interface ToolSpec<TParams extends TSchema = TSchema> {
     /**
      * Backward-compatible model-facing names that should dispatch to this tool. New transcripts and tool rosters
      * should use {@link name}; aliases exist only so old model calls / SDK payloads / resumed sessions don't strand
-     * across a canonical rename.
+     * across a canonical rename. Each alias keeps the same contract as {@link name} (a rule naming an alias reaches the tool).
      */
     aliases?: string[];
     description: string;
@@ -711,7 +715,7 @@ export interface ToolExecuteContext {
              * PreToolUse SCREENING entry (issue #33), whose policy the engine mints. Rebuild it with the
              * exported `createPreToolUseConstraintPolicy(hook, env)` — same callback, same installed env —
              * or the chain handed back here will be short and rejected on the count check. A face that only
-             * observes should carry `Hooks.preToolUseObservational` instead, and then never enters the chain
+             * observes should be declared `{ observe: true }` instead, and then never enters the chain
              * at all; a park under a screening entry announces the requirement on `onError`
              * (classification `screening-constraint-in-durable-chain`) at park time.
              */

package/dist/core/tools.js

@@ -2,6 +2,7 @@ import { Value } from "typebox/value";
 import { formatToolError, formatZodValidationError } from "./tool-errors.js";
 import { readMember } from "./thrown-value.js";
 import { frozenToolSpec } from "./tool-spec-members.js";
+import { carryDelegationName } from "./delegation-name.js";
 import { attachToolContract } from "../prompt-assembly/tool-catalog.js";
 function normalizeContent(ret) {
     if (typeof ret === "string") {
@@ -135,6 +136,7 @@ function buildProduct(spec, owner, options) {
             }
         },
     };
+    carryDelegationName(spec.execute, tool.execute);
     if (spec.contract) {
         attachToolContract(tool, {
             contractId: spec.contract.contractId,

package/dist/core/trace.d.ts

@@ -19,6 +19,44 @@
 import type { BrainRetryErrClass, TaskStatus, ToolEffect } from "./types.js";
 import type { ThinkingLevel } from "../internal/harness-types.js";
 import type { ToolManifestRow } from "../prompt-assembly/tool-catalog.js";
+import type { PromptEpochActivation, PromptIdentityLayers } from "../prompt-assembly/epoch.js";
+import type { ChainLink, SupersededOverlay } from "../prompt-assembly/overlay.js";
+import type { HostForm, HostRole, RendererId } from "../prompt-assembly/catalog/schema.js";
+/** The run's prompt identity as the manifest reports it: the identity digest, its inputs, and the session record that
+ *  names it (the record's counter and how it came to be). */
+export interface PromptManifestIdentity {
+    artifact: string;
+    layers: PromptIdentityLayers;
+    epoch: number;
+    activatedBy: PromptEpochActivation;
+}
+/** The run's selector values — the plain form of the identity's `binding` element. */
+export interface PromptManifestSelectors {
+    binding?: string;
+    traits: string[];
+    host: {
+        role: HostRole;
+        form: HostForm;
+    };
+    facts: Record<string, boolean>;
+}
+/** One rendered section: where it sits, which variant and renderer made it, whose text it carries (`locale`: the
+ *  catalog's canonical text, or text an overlay author wrote), its content digest (`sha256:` unsalted for published
+ *  text, `salted:` for text carrying the task's or the run's own inputs) and its history (`chain`). */
+export interface PromptManifestSection {
+    id: string;
+    band: string;
+    rank: number;
+    variant?: string;
+    renderer?: {
+        id: RendererId;
+        version: number;
+    };
+    chars: number;
+    locale: "canonical" | "overlay";
+    contentHash: string;
+    chain: ChainLink[];
+}
 /**
  * R4 (1.285): the scalar face of `TaskResult.stats.mechanisms`, echoed on `task.end` so "did the
  * engine machinery fire" is answerable from the trace alone. Counters/flags only —
@@ -82,46 +120,27 @@ export type TraceEvent = {
     ts: number;
 } | {
     /**
-     * 提示词主权批 — the labelled composition of the assembled system prompt, emitted once right after
-     * `task.start`. Kills the "which blocks were actually in the prompt" black box: a deployment can
-     * assert the constitution/safety blocks are present (or that their absence was a deliberate
-     * `replaceAll`) instead of diagnosing missing-prompt incidents by archaeology. Metadata-only
-     * (block ids + sizes + short content hashes — never prompt text, per the file-header privacy rule).
+     * The labelled composition of the assembled system prompt (manifest v3), emitted once right after `task.start`:
+     * which prompt this is (the identity and its selector values), which blocks and sections composed it, and where
+     * each section's text came from (its chain of overlays, the superseded ones marked). Metadata-only — ids, sizes
+     * and digests, never prompt text (the file-header privacy rule).
      */
     kind: "prompt.assembled";
-    version: 1;
+    version: 3;
     taskId: string;
-    /** Who owned the constitution layer: "core" (structural default) / "replaced" (provider
-     *  `replaceAll` opt-out) / "provider-assembled" (migration guard pass-through). */
-    constitution: "core" | "replaced" | "provider-assembled";
-    /** Ordered blocks: stable id (e.g. `role.base`, `harness.context`, `memory.safety`,
-     *  `env.context`, `memory.tail`), size in chars, sha256-prefix content hash. [c209-C]:
-     *  `skills.block` is GONE — the skills listing left the stable prefix for the skills_listing
-     *  reminder frame (observable via `steering_injected` source "skills_listing"). */
+    identity: PromptManifestIdentity;
+    selectors: PromptManifestSelectors;
+    /** Ordered blocks: stable id (e.g. `role.base`, `harness.context`, `memory.safety`, `env.context`,
+     *  `memory.tail`), size in chars, salted short content hash — the block-view id wordlist is a downstream contract. */
     blocks: Array<{
         id: string;
         chars: number;
         hash: string;
     }>;
-    /**
-     * Manifest v2 (stage S1, ADDITIVE — the v1 `blocks` id wordlist above is a downstream
-     * contract and stays as-is): the compiled-IR view, one entry per pack section, carrying the
-     * assembly protocol's semantic/lifecycle dimensions (slot/carrier/cadence/cacheClass).
-     * Absent on the legacy free-form provider path (single opaque block, no section structure).
-     * `contentHash` (digest tiering): UNSALTED full sha256, present ONLY on
-     * operator-declared sections (typed `stableBlocks` lane) — the center-publish ↔ manifest
-     * reconciliation anchor. Core-native sections stay salted-only (`hash`).
-     */
-    sections?: Array<{
-        id: string;
-        slot: string;
-        carrier: string;
-        cadence: string;
-        cacheClass: string;
-        chars: number;
-        hash: string;
-        contentHash?: string;
-    }>;
+    sections: PromptManifestSection[];
+    /** Every overlay the composition superseded (a later one on the same target won, or it changed nothing this
+     *  run); absent when none was. */
+    superseded?: SupersededOverlay[];
     /**
      * S2 (additive): the mounted tools plane — per-tool contract identity, durable-replay
      * aliases, presentation-invariant shape digest and full wire-schema digest (initial mount face;

package/dist/core/types.d.ts

@@ -18,8 +18,8 @@ export type { PermissionMode } from "./ask-origin.js";
 export type { ToolEffect, ToolContentOrigin, ReversibilityVerdict, ReadRootGrantCandidate, ToolSpec, ToolReturn, NestedUsage, NestedUsageAccum, ToolExecuteContext } from "./tool-spec.js";
 export type { BeforeWriteRequest, BeforeWriteResult, BeforeWriteHook, TrackEditRequest, TrackEditResult, TrackFileEditHook, FileEditedNotice, FileEditedHook, HandsBandOptions } from "./hands-band.js";
 export type { AgentDefinition, SkillSpec } from "./agent-definition.js";
-export type { McpServerSpec, A2aServerSpec, McpElicitRequest, McpElicitResponse, OnElicit, McpRevocationLedger, McpMountIdentity, McpToolAxesRead } from "./mcp-server-spec.js";
-export { readMcpToolAxes } from "./mcp-server-spec.js";
+export type { McpServerSpec, A2aServerSpec, McpElicitRequest, McpElicitResponse, OnElicit, McpRevocationLedger, McpMountIdentity, DeclarationFault, DeclarationPathRule, DeclarationRead, ToolAxesRead, ToolAxesSurface } from "./mcp-server-spec.js";
+export { DECLARATION_PATH_RULES, declarationFaultOf, declarerWord, readMcpToolAxes, readToolAxes, receiveDeclaration, toolAxesRefusal } from "./mcp-server-spec.js";
 export type { TaskLimits } from "./task-limits.js";
 export type { TaskStatus, RemoteEnvFailureNote, EffectiveMemoryScopes, TaskResult, HumanReviewGateRow } from "./task-result.js";
 export type { TerminalCause, PausedCause } from "./terminal-cause.js";

package/dist/core/types.js

@@ -1,5 +1,5 @@
 export { MODEL_ROLES } from "./model-seat.js";
-export { readMcpToolAxes } from "./mcp-server-spec.js";
+export { DECLARATION_PATH_RULES, declarationFaultOf, declarerWord, readMcpToolAxes, readToolAxes, receiveDeclaration, toolAxesRefusal } from "./mcp-server-spec.js";
 export { AUTO_MODE_DENY_SOURCES, isAutoModeDenySource } from "./runtime-caps.js";
 export { __resetMalformedDelegationSeatAnnouncement, backgroundChildTerminal, deliverDelegationLifecycle, emitsChildRowFrames, taskStartedFrame } from "./delegation-frames.js";
 export { __resetMalformedNoticeSeatAnnouncement, deliverEngineNotice, owedUserInputCounts, parentLegIds, settleOwedUserInput, undrainedUserInputNotices, USER_INPUT_UNDRAINED_CAUSES, USER_INPUT_UNDRAINED_FAMILIES } from "./engine-notice.js";

package/dist/core/unc-spelling.d.ts

@@ -0,0 +1,10 @@
+/**
+ * UNC under the win family: two leading separators, a host, a share — either separator, as `path.win32`
+ * reads it. The ONE UNC recognizer behind `isAbsoluteForFamily`, `pathIdentityOf` and `joinForFamily`
+ * (tools/fs/safety.ts), the symlink-chain reader (core/path-identity.ts) and the engine's own chain walk
+ * (engine/execution-env/symlink-chain.ts).
+ *
+ * A pure spelling test with no dependency, so the engine layer and the tools layer both read it from here:
+ * the engine never imports tools/, and tools reach the engine only through the `internal/harness` facade.
+ */
+export declare function isUncSpelling(p: string): boolean;

package/dist/core/unc-spelling.js

@@ -0,0 +1,3 @@
+export function isUncSpelling(p) {
+    return /^[\\/]{2}[^\\/]+[\\/]+[^\\/]/.test(p);
+}

package/dist/core/untrusted-egress.d.ts

@@ -34,6 +34,14 @@ export declare function egressText<T extends EgressTier>(tier: T, text: string,
 export declare function egressThrownText<T extends EgressTier>(tier: T, err: unknown): Egress<T>;
 /** The `same-principal` tier's pass, under the name hosts call it by (the engine calls {@link egressText}). */
 export declare function redactSecrets(s: string, report?: RedactionReport): Egress<"same-principal">;
+/**
+ * An extension's own words — its registration name, a bus reason, a key it wrote — made fit for an operator line: the
+ * `same-principal` egress pass first, then one line and bounded. The pass runs before the cut, so a cut never leaves part
+ * of a credential the pass would have recognised whole. Every station sentence that carries such words reads them here.
+ * It lives beside the pass, not in the stations module: a value import of the stations graph from a station's consumer
+ * closed a load-order cycle through the fs tools' barrel (an export the barrel copied before it existed).
+ */
+export declare function extensionWords(s: string, max: number): string;
 /** The `human` tier's pass, under the name hosts call it by (the engine calls {@link egressText}). */
 export declare function redactHostLeaks(s: string, report?: RedactionReport): Egress<"human">;
 /**

package/dist/core/untrusted-egress.js

@@ -1,4 +1,4 @@
-import { delimitUntrusted, neutralizeForFence } from "./untrusted-text.js";
+import { delimitUntrusted, inlineUntrusted, neutralizeForFence } from "./untrusted-text.js";
 import { egressPasses, runRedactionPasses } from "./redaction-passes.js";
 import { CREDENTIAL_VOCABULARY, egressPassGroups, isSensitiveRecordKey, URI_SCHEME_SOURCE } from "./credential-vocabulary.js";
 import { isErrorLike, readMember, thrownText } from "./thrown-value.js";
@@ -34,6 +34,9 @@ export function egressThrownText(tier, err) {
 export function redactSecrets(s, report) {
     return egressText("same-principal", s, report);
 }
+export function extensionWords(s, max) {
+    return inlineUntrusted(egressText("same-principal", s), max);
+}
 export function redactHostLeaks(s, report) {
     return egressText("human", s, report);
 }

package/dist/core/untrusted-text.d.ts

@@ -397,6 +397,12 @@ export declare function defuseControlChars(text: string): string;
  * Defense-in-depth, NOT a guarantee (same posture as the rest of this module).
  */
 export declare function inlineUntrusted(text: string, maxLen?: number): string;
+/** The mark a cut text ends in: {@link inlineUntrusted}'s, and a notice's machine-read rule text's
+ *  ({@link import("./permission-rule-model.js").noticeRuleText}) — one ellipsis, spelled once. */
+export declare const INLINE_TRUNCATION_MARK = "\u2026";
+/** The code points {@link inlineUntrusted} may return beyond its content cap: the one truncation mark. The longest result for a cap
+ *  of `maxLen` is `maxLen` plus this. */
+export declare const INLINE_TRUNCATION_MARK_CODEPOINTS: number;
 /** The per-ENTRY ceiling inside a `ProbeCause` operand family (checkpoint-store's
  *  structured probe account), sized like the descriptor's own `touchedPaths` entries (the same thing
  *  on the same card). Per entry, not per cause: that is the whole point of the structured shape —
@@ -414,6 +420,16 @@ export declare const PROBE_CAUSE_PATH_MAX = 200;
  *  (tools/fs) and must fit every load-bearing part inside this bound, the gate, the persist boundary — and
  *  a value import from tools/fs into checkpoint-store closes an ESM cycle. */
 export declare const PROBE_REASON_MAX = 200;
+/**
+ * Whether `text` is a probe's one-sentence account the engine itself could have minted: every mint passes the sentence through
+ * {@link inlineUntrusted} at {@link PROBE_REASON_MAX}, so the longest one is the cap's content plus the truncation ellipsis
+ * ({@link INLINE_TRUNCATION_MARK_CODEPOINTS}), counted in code points. A host that relays the sentence (`RiskDescriptor.probeReason`,
+ * `AskRequest.probeReason`) and meets a longer one has met text the engine did not mint (a third-party producer, a generation
+ * with another cap) — to be dropped whole, not cut, because a cut is another sentence. The bound lives here once; a host asks, it does not count.
+ * The question is total: a value that is not a string is not a sentence the engine mints (every mint is a string), so it answers
+ * `false` — the relay's answer to it, dropping it whole, is the same as to an over-long one.
+ */
+export declare function isMintableProbeReason(text: unknown): boolean;
 /** The one body bound every "reviewer note" relay passes to {@link delimitUntrusted} — the decider's
  *  free text attached to a deny (sync `AskOutcome.reason` and the durable `ResumeOutcome` `reason`
  *  legs alike). A note is steering, not payload: unbounded it can flood the transcript/context the

package/dist/core/untrusted-text.js

@@ -568,18 +568,23 @@ const LABEL_MAX = 160;
 export function inlineUntrusted(text, maxLen = LABEL_MAX) {
     const oneLine = text.replace(/[\s\u0000-\u001f\u007f-\u009f]+/g, " ").trim();
     const cps = [...oneLine];
-    const capped = cps.length > maxLen ? cps.slice(0, maxLen).join("") + "…" : oneLine;
+    const capped = cps.length > maxLen ? cps.slice(0, maxLen).join("") + INLINE_TRUNCATION_MARK : oneLine;
     const out = neutralizeForFence(capped);
     if (maxLen <= 0)
         return "";
     const outCps = [...out];
-    return outCps.length > maxLen + 1 ? outCps.slice(0, maxLen).join("") + "…" : out;
+    return outCps.length > maxLen + INLINE_TRUNCATION_MARK_CODEPOINTS ? outCps.slice(0, maxLen).join("") + INLINE_TRUNCATION_MARK : out;
 }
+export const INLINE_TRUNCATION_MARK = "…";
+export const INLINE_TRUNCATION_MARK_CODEPOINTS = [...INLINE_TRUNCATION_MARK].length;
 function sanitizeLabel(label) {
     return inlineUntrusted(label, LABEL_MAX);
 }
 export const PROBE_CAUSE_PATH_MAX = 200;
 export const PROBE_REASON_MAX = 200;
+export function isMintableProbeReason(text) {
+    return typeof text === "string" && [...text].length <= PROBE_REASON_MAX + INLINE_TRUNCATION_MARK_CODEPOINTS;
+}
 export const REVIEWER_NOTE_MAX_BODY = 2048;
 export function delimitUntrusted(label, text, maxBody) {
     return delimitUntrustedWithClip(label, text, maxBody).text;

package/dist/core/user-attachment.d.ts

@@ -27,6 +27,7 @@ import type { HumanInputAttachment } from "./task-event.js";
 import { type ModelFileReader } from "../tools/fs/fs-read.js";
 import type { SyntheticReadJudge } from "./synthetic-read-verdict.js";
 import { type ReminderDisclosureCounts } from "./reminder-disclosure.js";
+import type { ContextWindowOverlay } from "./context-settings.js";
 /** At most this many attachments on one objective. */
 export declare const USER_ATTACHMENTS_MAX = 20;
 /** The longest path or name an entry may carry (the platform path limit). */
@@ -72,9 +73,20 @@ export type ScreenedUserAttachment = {
     readonly data: string;
     readonly mimeType: string;
 };
-/** The door's refusal: one code, the field named first. */
-export declare function userAttachmentRefusal(field: string, detail: string): Error & {
+/**
+ * The field a refusal names, as one value: `path` is the field path the sentence opens with, and `index` the attachment's
+ * position in the seat (0-based, the `[i]` of that path) — present exactly when the sentence names one attachment; a refusal of
+ * the seat as a whole (not a list, too many, a resume, the window) has no index. Built only by {@link SEAT_REF} /
+ * {@link entryRef} / {@link memberRef}, so the index and the path can never name two attachments.
+ */
+export interface UserAttachmentFieldRef {
+    readonly path: string;
+    readonly index?: number;
+}
+/** The door's refusal: one code, the field named first in the sentence and again in `detail` ({@link UserAttachmentFieldRef}). */
+export declare function userAttachmentRefusal(at: UserAttachmentFieldRef, problem: string): Error & {
     code: "config.user_attachment_invalid";
+    detail: UserAttachmentFieldRef;
 };
 /**
  * The door: screen the seat's value (synchronous; the caller's object is read once, member by member, before the
@@ -133,9 +145,18 @@ export interface ReadUserAttachmentsInput {
  * frame carries the commit its delivery owes, run only when the frame is in the transcript.
  */
 export declare function readUserAttachments(input: ReadUserAttachmentsInput): Promise<MintedAttachmentFrame[]>;
+/** The objective as the window check sees it: a reader of the live overlay over the model's window declarations (the
+ *  same seat the request guard reads) and the objective text's length — it rides the first request ahead of the
+ *  frames. The overlay is a GETTER because it is read when the frames exist, not when the call is made: the reads are
+ *  asynchronous and a deployment may swap its window declarations meanwhile, as it may before any request. */
+export interface AttachmentWindowInput {
+    readonly overlay: () => ContextWindowOverlay | undefined;
+    readonly objectiveChars: number;
+}
 /** The objective lane's read: once the UserPromptSubmit hook let the objective through (a blocked objective reads
- *  nothing), and before the pre-call gate, which prices the frames (`chars`). Commits nothing. */
-export declare function readObjectiveAttachments(prepared: Pick<import("./runner/contracts.js").Prepared, "userAttachments" | "modelFileReader" | "syntheticReadVerdict" | "cwdRef" | "reminderMark" | "reminderDisclosureCounts" | "abortController">, inputId: string, blocked: boolean): Promise<{
+ *  nothing), and before the pre-call gate, which prices the frames (`chars`). Refuses the whole objective when the frames
+ *  and the objective cannot ride one request ({@link refuseFramesOverWindow}). Commits nothing. */
+export declare function readObjectiveAttachments(prepared: Pick<import("./runner/contracts.js").Prepared, "userAttachments" | "modelFileReader" | "syntheticReadVerdict" | "cwdRef" | "reminderMark" | "reminderDisclosureCounts" | "abortController" | "harness">, inputId: string, blocked: boolean, window: AttachmentWindowInput): Promise<{
     frames: MintedAttachmentFrame[];
     chars: number;
 }>;