@sema-agent/core 7.52.0 → 7.54.0

package/dist/core/runner/prepare-policy-chain.js

@@ -1,4 +1,4 @@
-import { withArgsReading } from "../effective-path-target.js";
+import { argsAsTheToolReads, withArgsReading } from "../effective-path-target.js";
 import { policyAskClassOf } from "../ask-class.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "../ask-question.js";
 import { classifierUnavailableSeat } from "./classifier-ladder.js";
@@ -6,7 +6,8 @@ import { resolveCheckpointStore } from "../checkpoint-store.js";
 import { chainJudges, inheritedToolChecks, screeningInstallationsOf, standsInFor } from "../mods/stations.js";
 import { isNamespacedCoveringRuleName, namespacedRuleNameCovers } from "../permission-rules.js";
 import { isIsolated } from "../remote-env.js";
-import { earlierGrammarAdvisory } from "../session-policy-store.js";
+import { deliverEngineNotice } from "../engine-notice.js";
+import { earlierGrammarNotice } from "../session-policy-store.js";
 import { attest, attestationOf, checkToolPolicyProjection, combinePolicies, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, durableParkOptInDeclared, isLiveApproverSeat, mergeAttestation, refuseOutOfContractDecision, resolveAsk, toolPolicyNameSets, withAttestation, wrapToolPolicy } from "../tool-policy.js";
 import { judgeRuleToolName, mountedToolNames } from "../tool-name-aliases.js";
 import { approvalCardMemberOf } from "../tool-roster.js";
@@ -15,6 +16,7 @@ import { emitTrace } from "../trace.js";
 import { skillGrantBindingMembers } from "../skill-grant.js";
 import { SKILL_TOOL_NAME } from "./synthetic-tools.js";
 import { delegationPoolReading } from "./sub-agent-deny-lists.js";
+import { valveLeaves } from "../../agents/tool-filter.js";
 import { autoStrippedRule, cardDisclosureOf, nearMissSpellingOf, rootFacingToolNames } from "../allow-entry.js";
 import { arbitrateByMode, askClassMembersOf, askFaceOf, askMandateMember } from "../ask-origin.js";
 import { createModeGatePolicy, mountedToolDeclaresReadOnly } from "../mode-policy.js";
@@ -46,7 +48,7 @@ export async function preparePolicyChain(input) {
             const known = mountedToolNames(tools);
             for (const t of harnessTools)
                 known.add(t.name);
-            const pool = delegationPoolReading(spec.tools ?? [], selector);
+            const pool = delegationPoolReading(spec.tools ?? [], valveLeaves(spec, selector));
             const callerNames = mountedToolNames(spec.tools ?? []);
             const rootFacing = rootFacingToolNames([...known, ...callerNames, ...pool.names]);
             const unmatched = new Set();
@@ -119,7 +121,7 @@ export async function preparePolicyChain(input) {
         catch {
         }
     };
-    const announceEarlierGrammar = (rulesSessionId) => (entries, field, grammar) => deps.onError?.(Object.assign(new Error(earlierGrammarAdvisory(rulesSessionId, entries, field, grammar)), { code: "config.session_rules_earlier_grammar" }), { phase: "config", sessionId });
+    const announceEarlierGrammar = (rulesSessionId) => (entries, field, grammar) => deliverEngineNotice(deps.onNotice, earlierGrammarNotice({ rulesSessionId, sessionId, entries, field, grammar }));
     let sessionRulePolicy;
     if (deps.sessionPolicyStore && spec.sessionId) {
         const store = deps.sessionPolicyStore;
@@ -343,7 +345,7 @@ export async function preparePolicyChain(input) {
     const recheckApprovedEdit = async (pol, onAskOf, creq, edit, approved, csignal, ancestorAutoMode) => {
         const ancestorDecider = ancestorAutoMode?.decider;
         const ancestorTracker = ancestorAutoMode?.denialTracking;
-        let editArgs = edit;
+        let editArgs = argsAsTheToolReads(creq, edit);
         let settledBy = approved;
         const onApproval = (d) => withAttestation(d, mergeAttestation(creq, attestationOf(settledBy, creq), attestationOf(d, creq), "answer"));
         const vetoed = onApproval;
@@ -356,8 +358,7 @@ export async function preparePolicyChain(input) {
             }
             let re;
             try {
-                const editReq = withArgsReading(creq, editArgs, csignal ?? abortController.signal);
-                re = refuseOutOfContractDecision(await pol.check(editReq !== undefined ? await editReq : { ...creq, args: editArgs }, csignal ?? abortController.signal));
+                re = refuseOutOfContractDecision(await pol.check(await withArgsReading(creq, editArgs, csignal ?? abortController.signal), csignal ?? abortController.signal));
             }
             catch (err) {
                 reportPolicyThrow(notifyOwnHookCrash, "an inherited parent policy's re-check of the approved edit", creq, err, csignal ?? abortController.signal);
@@ -373,7 +374,7 @@ export async function preparePolicyChain(input) {
                 return onApproval(withAttestation({ action: "allow", updatedInput: re.updatedInput !== undefined ? re.updatedInput : editArgs, ...(stated !== undefined ? { decisionReason: stated } : {}) }, re.attestation));
             }
             if (re.updatedInput !== undefined)
-                editArgs = re.updatedInput;
+                editArgs = argsAsTheToolReads(creq, re.updatedInput);
             const judged = await judgeInheritedClassifier({ liveMode: () => permissionMode.current, autoMode: ancestorAutoMode, ask: re, req: { ...creq, args: editArgs }, signal: csignal ?? abortController.signal, subject: "the approved edit", allowRewrite: editArgs, facts: inheritedStationFacts(creq), unavailableSeat: classifierUnavailableSeat({ station: "ancestor", ...(ancestorDecider?.timeoutMs !== undefined ? { budgetMs: ancestorDecider.timeoutMs } : {}), route: frozenApproverRoute(onAskOf), onNotice: deps.onNotice, sessionId, runId }) });
             if (judged.kind === "allow") {
                 return onApproval(judged.result);
@@ -408,7 +409,7 @@ export async function preparePolicyChain(input) {
             settledBy = rr;
             if (rr.updatedInput === undefined)
                 return onApproval({ action: "allow", updatedInput: editArgs, decisionReason: "mode" });
-            editArgs = rr.updatedInput;
+            editArgs = argsAsTheToolReads(creq, rr.updatedInput);
         }
     };
     const settleInstallationAsk = async (pc, decision, creq, csignal) => {
@@ -427,7 +428,7 @@ export async function preparePolicyChain(input) {
                 return settledAs(decision);
             return settledAs(mandateUnreconstructibleDeny(creq));
         }
-        const presentedArgs = decision.updatedInput !== undefined ? decision.updatedInput : creq.args;
+        const presentedArgs = decision.updatedInput !== undefined ? argsAsTheToolReads(creq, decision.updatedInput) : creq.args;
         const judged = await judgeInheritedClassifier({ liveMode: () => permissionMode.current, autoMode: pc.autoMode, ask: decision, req: { ...creq, args: presentedArgs }, signal: csignal ?? abortController.signal, subject: "this call", allowRewrite: decision.updatedInput, facts: inheritedStationFacts(creq), unavailableSeat: classifierUnavailableSeat({ station: "ancestor", ...(pc.autoMode?.decider.timeoutMs !== undefined ? { budgetMs: pc.autoMode.decider.timeoutMs } : {}), route: frozenApproverRoute(pc.onAsk), onNotice: deps.onNotice, sessionId, runId }) });
         if (judged.kind === "allow")
             return settledAs(judged.result);
@@ -635,11 +636,9 @@ export async function preparePolicyChain(input) {
                 }
             }
             const recheckLayers = [...recheckPrefix, ...postEmitterSameInstanceAdapters];
-            const finalRead = withArgsReading(req, decision.updatedInput, signal);
-            const finalReq = finalRead !== undefined ? await finalRead : { ...req, args: decision.updatedInput };
+            const finalReq = await withArgsReading(req, decision.updatedInput, signal);
             let asked;
             let revalidated;
-            let restated;
             try {
                 for (const layer of recheckLayers) {
                     const d = refuseOutOfContractDecision(await layer.check(finalReq, signal));
@@ -655,8 +654,6 @@ export async function preparePolicyChain(input) {
                     }
                     if (d.action === "ask" && asked === undefined)
                         asked = d;
-                    if (d.action === "allow" && restated === undefined && d.decisionReason !== undefined)
-                        restated = d.decisionReason;
                     revalidated = mergeAttestation(req, revalidated, d.attestation);
                 }
             }
@@ -666,10 +663,8 @@ export async function preparePolicyChain(input) {
             if (asked !== undefined && decision.action === "allow") {
                 return { ...asked, updatedInput: decision.updatedInput };
             }
-            if (decision.action === "allow") {
-                const owned = { ...decision, ...(decision.decisionReason === undefined && restated !== undefined ? { decisionReason: restated } : {}) };
-                return withAttestation(owned, mergeAttestation(req, attestationOf(decision, req), revalidated));
-            }
+            if (decision.action === "allow")
+                return withAttestation(decision, mergeAttestation(req, attestationOf(decision, req), revalidated));
             return decision;
         })
         : foldedPolicy;

package/dist/core/runner/prepare-project-context.d.ts

@@ -14,7 +14,7 @@ export interface PrepareProjectContextInput {
     /** borrowed-readonly — the REBOUND spec (`spec′`). Read: `sessionId` (phase derivation + the
      *  continuation projections), `skills` (the roster), `userInvokedSkills` (the person's invoked skills — their
      *  rows are written here), `principal` (the shared-memory tools' trusted identity). Never mutated. */
-    spec: Pick<TaskSpec, "sessionId" | "skills" | "userInvokedSkills" | "principal">;
+    spec: Pick<TaskSpec, "sessionId" | "skills" | "userInvokedSkills" | "principal" | "excludeAllTools">;
     /** borrowed-readonly — trusted internals: `agentName` (seam ctx), `inheritedSkillGrants` (the parent's captured
      *  skill grant rows, seeded as `inherited`), `inheritedAllowedTools` (the parent's request entries, seeded as this leg's
      *  own). `undefined` on a standalone prepare. */

package/dist/core/runner/prepare-project-context.js

@@ -13,10 +13,12 @@ import { SKILL_CONTENT_MAX_CHARS, SKILL_TOOL_NAME, createSkillTool, normalizeSki
 import { skillLoadReading } from "./skill-base-dir.js";
 import { RosterBuilder } from "../tool-roster.js";
 import { mountedToolNames } from "../tool-name-aliases.js";
+import { valveLeaves } from "../../agents/tool-filter.js";
 import { asThrownError } from "../thrown-value.js";
 export async function prepareProjectContext(input) {
     const { deps, spec, internals, session, sessionId, runId, hostTaskId, taskRootFinal, handsEnabled, delegation, seedContextFiles, memoryBlockFromEngine, skillGrants, allowedTools, allowedToolTables, roster, toolFaceSnapshot, onceLedger, memoryTools, memoryEngineSession, memorySearchToolsPlanned, memoryPairExcludedName, memoryPairOccupiedName, resume, skillListingBudget } = input;
     const tools = roster.tools;
+    const leaves = valveLeaves(spec, toolFaceSnapshot.selector);
     let memoryBlock = memoryBlockFromEngine;
     let instructionSources;
     let projectInstructionContent;
@@ -115,11 +117,11 @@ export async function prepareProjectContext(input) {
             for (const alias of t.aliases ?? [])
                 mountedNameDomain.add(alias);
         }
-        const excludedName = SHARED_MEMORY_TOOL_NAMES.find((n) => !toolFaceSnapshot.selector.admits({ name: n }));
+        const excludedName = SHARED_MEMORY_TOOL_NAMES.find((n) => !leaves({ name: n }));
         const occupiedName = SHARED_MEMORY_TOOL_NAMES.find((n) => mountedNameDomain.has(n));
         if (excludedName !== undefined || occupiedName !== undefined) {
             announceMemoryNotMounted(onceLedger, sessionId, "shared", SHARED_MEMORY_TOOL_NAMES, excludedName !== undefined
-                ? `the run's tool selector (allowTools / excludeTools) does not admit "${excludedName}"`
+                ? `the run's tool face (allowTools / excludeTools / excludeAllTools) does not admit "${excludedName}"`
                 : `this task already declares a tool named "${occupiedName}" (the built-in yields to it)`);
         }
         else {
@@ -137,10 +139,10 @@ export async function prepareProjectContext(input) {
     }
     else if (memoryEngineSession !== undefined && !memorySearchToolsPlanned) {
         announceMemoryNotMounted(onceLedger, sessionId, "engine", MEMORY_ENGINE_TOOL_NAMES, memoryPairExcludedName !== undefined
-            ? `the run's tool selector (allowTools / excludeTools) does not admit "${memoryPairExcludedName}"`
+            ? `the run's tool face (allowTools / excludeTools / excludeAllTools) does not admit "${memoryPairExcludedName}"`
             : `this task already declares a tool named "${memoryPairOccupiedName}" (the built-in yields to it)`);
     }
-    const skillsListing = skillSpecs.length > 0
+    const skillsListing = skillSpecs.length > 0 && leaves({ name: SKILL_TOOL_NAME })
         ? {
             entries: skillSpecs.map((s) => ({
                 name: s.name,

package/dist/core/runner/prepare-prompt-assembly.d.ts

@@ -31,7 +31,7 @@ export interface PreparePromptAssemblyInput {
         readonly role?: HostRole;
         readonly form?: HostForm;
     };
-    /** borrowed-readonly — the center binding (`TaskSpec.promptBinding`, validated), or undefined. */
+    /** borrowed-readonly — the run's binding (`TaskSpec.promptBinding`, validated), or undefined: a selector value. */
     binding: string | undefined;
     /** borrowed-readonly — the leg's mods bus: `prompt.compose` collects the deploy and task seats' overlays. */
     modBus: LegModBus;

package/dist/core/runner/prepare-prompt-assembly.js

@@ -1,12 +1,13 @@
 import { createHash } from "node:crypto";
 import { SEND_MESSAGE_TOOL_NAME } from "../../agents/send-message-tool.js";
 import { assemblePrompt } from "../../prompt-assembly/assemble.js";
-import { adoptCenter, centerOverlaysOf } from "../../prompt-assembly/artifact.js";
+import { adoptCenter, centerOverlaysOf, verifyPromptArtifactBody } from "../../prompt-assembly/artifact.js";
+import { refusalClause, storedArtifactLine } from "../../prompt-assembly/artifact-store.js";
 import { catalogDigestOf, digestOf, prepareEpochRecord } from "../../prompt-assembly/epoch.js";
 import { rendererVector } from "../../prompt-assembly/renderers.js";
 import { SEMA_DEFAULT_CATALOG } from "../../prompt-assembly/catalog/index.js";
 import { describeCatalog } from "../../prompt-assembly/explain.js";
-import { selectorsOf } from "../../prompt-assembly/select.js";
+import { selectorRecordOf, selectorsOf } from "../../prompt-assembly/select.js";
 import { auditToolCollisions, projectToolManifest } from "../../prompt-assembly/tool-catalog.js";
 import { buildEnvironmentContext } from "../../prompts/default.js";
 import { raisePromptCompose } from "../mods/stations.js";
@@ -31,13 +32,21 @@ export async function preparePromptAssembly(input) {
     const stored = await session.getPromptEpoch();
     let centerAdoption;
     {
-        const failUnavailable = (what) => {
-            throw Object.assign(new Error(`prompt snapshot unavailable: ${what} (artifact source miss / not verifiable here${deps.promptSource === undefined ? "; RunnerDeps.promptSource is not configured" : ""}) — refusing to recompose a hybrid prompt`), { code: "prompt.snapshot_unavailable" });
+        const failUnavailable = (what, refusal) => {
+            const why = refusal !== undefined ? `the source's copy is ${refusalClause(refusal)}` : `artifact source miss / not verifiable here${deps.promptSource === undefined ? "; RunnerDeps.promptSource is not configured" : ""}`;
+            throw Object.assign(new Error(`prompt snapshot unavailable: ${what} (${why}) — refusing to recompose a hybrid prompt`), { code: "prompt.snapshot_unavailable" });
         };
         const resolvePinned = async (digest, sourceRevision, via) => {
-            const art = await deps.promptSource?.get(digest);
+            const told = {};
+            const art = await deps.promptSource?.get(digest, (r) => void (told.current = r));
             const adopted = art !== undefined ? adoptCenter(art, sourceRevision) : undefined;
-            return adopted ?? failUnavailable(`${via} center prompt artifact ${digest.slice(0, 23)}… has no verified resolvable copy`);
+            if (adopted !== undefined)
+                return adopted;
+            const checked = art !== undefined ? verifyPromptArtifactBody(art) : undefined;
+            const refusal = told.current ?? (checked !== undefined && !checked.ok ? { code: checked.code, reason: checked.reason } : undefined);
+            if (refusal !== undefined)
+                deps.onError?.(new Error(storedArtifactLine(digest, refusal, `the session fails prompt.snapshot_unavailable (a hybrid prompt is never recomposed)`)), { phase: "prompt-constitution", sessionId });
+            return failUnavailable(`${via} center prompt artifact ${digest.slice(0, 23)}… has no verified resolvable copy`, refusal);
         };
         const pinned = stored?.kind === "pin" ? stored.descriptor : undefined;
         const retiredCenterPin = stored?.kind === "legacy" && stored.centerPinned;
@@ -76,14 +85,8 @@ export async function preparePromptAssembly(input) {
         promptProfile,
         fableMitigations,
     };
-    const selectors = selectorsOf(facts, host);
-    const selectorRecord = {
-        ...(binding !== undefined ? { binding } : {}),
-        traits: [...selectors.traits].sort(),
-        host: { role: selectors.host.role, form: selectors.host.form },
-        facts: { ...selectors.facts },
-    };
-    const centerOverlays = centerOverlaysOf(centerAdoption, binding);
+    const selectorRecord = selectorRecordOf(selectorsOf(facts, host, binding));
+    const centerOverlays = centerOverlaysOf(centerAdoption);
     const lowerAdds = new Map();
     for (const { overlay } of [...sugar, ...centerOverlays])
         if (overlay.op === "add")
@@ -91,16 +94,17 @@ export async function preparePromptAssembly(input) {
     const composed = await raisePromptCompose(modBus, {
         model: model.id,
         catalog: describeCatalog().sections,
-        selectors: { traits: [...selectors.traits], host: selectors.host, facts: selectors.facts },
+        selectors: selectorRecord,
     }, { lowerAdds, ...(input.signal !== undefined ? { signal: input.signal } : {}) });
     for (const w of composed.warnings)
         deps.onError?.(new Error(w), { phase: "prompt-constitution", sessionId });
     const taskOverlays = [...sugar, ...composed.task];
     const buildAssembleInputs = (center) => ({
         taskOverlays,
-        centerOverlays: centerOverlaysOf(center, binding),
+        centerOverlays: centerOverlaysOf(center),
         deployOverlays: composed.deploy,
         host,
+        ...(binding !== undefined ? { binding } : {}),
         tools,
         facts,
         ...(envFacts.cwd !== undefined ? { workspaceFolder: envFacts.cwd } : {}),

package/dist/core/runner/prepare-prompt-inputs.d.ts

@@ -27,6 +27,7 @@ import type { SourcedOverlay } from "../../prompt-assembly/overlay.js";
 import type { ContainmentFace } from "../../tools/fs/index.js";
 import type { LockedPreflight } from "../locked-config.js";
 import type { MaterializedMcp } from "../mcp.js";
+import type { RosterBuilder } from "../tool-roster.js";
 import type { ResolvedRole } from "../roles.js";
 import type { RunnerDeps, TaskSpec } from "../types.js";
 import type { SessionTreeEntry } from "../../internal/harness-types.js";
@@ -37,8 +38,8 @@ import { type ContextWindowOverlay } from "../context-settings.js";
 export interface PreparePromptInputsInput {
     /** borrowed-readonly — the REBOUND spec (`spec′`). Read: `systemPrompt` / `appendSystemPrompt` (handed whole to the
      *  request-body sugar), `clientContext` (zone, email), `envFacts` (the deployment's sandbox + resume facts),
-     *  `compaction` (the within-task flag). Never mutated. */
-    spec: Pick<TaskSpec, "systemPrompt" | "appendSystemPrompt" | "clientContext" | "envFacts" | "compaction">;
+     *  `compaction` (the within-task flag), `excludeAllTools` (the valve's whole-face switch). Never mutated. */
+    spec: Pick<TaskSpec, "systemPrompt" | "appendSystemPrompt" | "clientContext" | "envFacts" | "compaction" | "excludeAllTools">;
     /** borrowed-readonly — deployment deps: `onError` (the operator lane: fail-closed advisory, cwd misalignment,
      *  git-lane degrade), `modelKnowledgeCutoffs`. Receiver preserved (`deps.onError?.(…)`). */
     deps: Pick<RunnerDeps, "onError" | "modelKnowledgeCutoffs">;
@@ -61,8 +62,9 @@ export interface PreparePromptInputsInput {
     resolvedReadFace: ContainmentFace | undefined;
     /** borrowed-readonly — the resolved write face (the open-writes flag + the structured env fact). */
     resolvedWriteFace: ContainmentFace | undefined;
-    /** borrowed-readonly — the frozen tool face; only `defer` is read (the Workflow short-pointer flag). */
-    toolFaceSnapshot: Pick<ToolFaceSnapshot, "defer">;
+    /** borrowed-readonly — the frozen tool face; `defer` (the Workflow short-pointer flag) and `selector` (with the spec's whole-face
+     *  switch, the valve's reading that decides which servers' instructions are taught). */
+    toolFaceSnapshot: Pick<ToolFaceSnapshot, "defer" | "selector">;
     /** borrowed-readonly — the resolved prompt profile (rides the flags to the legacy ctx). */
     promptProfile: "simple" | "classic";
     /** borrowed-readonly — the fable-mitigations profile axis (rides the flags with the profile). */
@@ -81,8 +83,12 @@ export interface PreparePromptInputsInput {
     };
     /** borrowed-readonly — the resolved role; only its `systemPrompt` preset is read (second source). */
     resolvedRole: Pick<ResolvedRole, "systemPrompt">;
-    /** borrowed-readonly — the materialized MCP roster; only `serverInstructions` (the disposed entries) is read. */
-    mcp: Pick<MaterializedMcp, "serverInstructions">;
+    /** borrowed-mutable — the materialized MCP roster; `serverInstructions` (the disposed entries) and `tools` (each server's listing: did it list
+     *  any tool) are read, and the instructions lane's ledger is stated: the block is what the model is told at the run's start. */
+    mcp: Pick<MaterializedMcp, "serverInstructions" | "tools" | "instructionsDelta">;
+    /** borrowed-readonly — the run's roster as the protocol-tools phase mounted it (the deployment's overlay applied, the valve not yet):
+     *  the tools the teaching answer reads, with the valve's predicate. */
+    roster: Pick<RosterBuilder, "tools">;
     /** borrowed-readonly — the resolved model (id for the env line + the cutoff lookup). */
     model: Model;
     /** borrowed-readonly — the run's external-content-target fold (the single-source disclosure fact). */

package/dist/core/runner/prepare-prompt-inputs.js

@@ -1,5 +1,7 @@
 import { formatLocalDate, isValidTimeZone } from "../../prompts/default.js";
 import { sugarOverlays } from "../../prompt-assembly/sugar.js";
+import { valveLeaves } from "../../agents/tool-filter.js";
+import { instructionsTaught, toldAtStart } from "../mounted-mcp.js";
 import { isIsolated } from "../remote-env.js";
 import { readDateAnchor } from "./announce-once-ledger.js";
 import { probeGitStatusLane } from "./git-status-frame.js";
@@ -31,9 +33,10 @@ export async function preparePromptInputs(input) {
         isSubagent: delegation.isNonForkChild,
     };
     const sugar = sugarOverlays({ spec, resolvedRole, ...(internals !== undefined ? { internals } : {}) });
-    const mcpInstructionsBlock = mcp.serverInstructions.length
-        ? `# MCP Server Instructions\n${mcp.serverInstructions.map(renderMcpInstructionsEntry).join("\n\n")}`
-        : undefined;
+    const valveLeft = valveLeaves(spec, toolFaceSnapshot.selector);
+    const taught = mcp.serverInstructions.filter((entry) => instructionsTaught(valveLeft, entry.server, input.roster.tools, mcp.tools));
+    toldAtStart(mcp.instructionsDelta, new Set(taught.map((entry) => entry.server)));
+    const mcpInstructionsBlock = taught.length ? `# MCP Server Instructions\n${taught.map(renderMcpInstructionsEntry).join("\n\n")}` : undefined;
     const userTz = spec.clientContext?.timeZone;
     const tzValid = userTz !== undefined && isValidTimeZone(userTz);
     const dateAnchor = await readDateAnchor(session);

package/dist/core/runner/prepare-protocol-tools.d.ts

@@ -32,12 +32,14 @@ import type { AnnounceOnceSink, IrreversibilityTier, Prepared, RollbackStack, To
 import { RosterBuilder, type ToolRosterDeltaSeat } from "../tool-roster.js";
 import type { LegModBus } from "../mods/stations.js";
 export interface PrepareProtocolToolsInput {
-    /** borrowed-readonly — the frozen preflight; only `mcp` (the declared server entries) is read: the
-     *  materialize input, the RefreshMcpTools mount predicate, and whether a real client was acquired. */
-    lockedPreflight: Pick<LockedPreflight, "mcp">;
+    /** borrowed-readonly — the frozen preflight; `mcp` (the declared server entries: the materialize input, the RefreshMcpTools
+     *  mount predicate, and whether a real client was acquired) and `a2a` (the declared peers the door judged: the materialize
+     *  input and whether a handle was acquired) are read. */
+    lockedPreflight: Pick<LockedPreflight, "mcp" | "a2a">;
     /** borrowed-readonly — the REBOUND spec. Read: `principal` (the MCP header / the A2A identity), `tools`
-     *  (the caller names both reserved-name guards check against), `a2a` (the peer entries). */
-    spec: Pick<TaskSpec, "principal" | "tools" | "a2a">;
+     *  (the caller names both reserved-name guards check against), `excludeAllTools` (the valve's whole-face switch: the live roster lane's
+     *  reading, and the first-dial gate). */
+    spec: Pick<TaskSpec, "principal" | "tools" | "excludeAllTools">;
     /** borrowed-readonly — the deployment seats the materializers and their operator faces read: `onElicit`
      *  and `mcpImageResizer` ride into the MCP intake; `onError` takes the A2A warnings (no ledger — a peer is
      *  re-read every prepare); `mcpRevocations` + `onNotice` make the revocation wiring. */

package/dist/core/runner/prepare-protocol-tools.js

@@ -1,6 +1,8 @@
 import { Type } from "typebox";
 import { materializeMcpTools } from "../mcp.js";
-import { applyMcpRosterDelta, commitMcpRosterChanges, redialMcpServer } from "./mcp-redial.js";
+import { applyMcpRosterDelta, commitMcpRosterChanges, redialMcpServer, rosterHolding, settledOnRoster } from "./mcp-redial.js";
+import { valveLeaves, valveLeavesPeer } from "../../agents/tool-filter.js";
+import { resourceFacesLeft } from "../mounted-mcp.js";
 import { materializeA2aTools } from "../a2a.js";
 import { deliverEngineNotice } from "../types.js";
 import { RosterBuilder } from "../tool-roster.js";
@@ -24,8 +26,11 @@ export async function prepareProtocolTools(input) {
     if (overPeer !== undefined) {
         throw Object.assign(new Error(`MCP server name ${JSON.stringify(overPeer.name.slice(0, 40) + "…")} is ${overPeer.name.length} characters; a peer rides every roster row of its tools and the roster's bound on a name is ${TOOL_WIRE_NAME_MAX_CHARS}.`), { code: "config.tool_name_too_long" });
     }
+    const serverReached = valveLeavesPeer(spec, toolFaceSnapshot.selector);
+    const leaves = valveLeaves(spec, toolFaceSnapshot.selector);
+    const resourcesReached = resourceFacesLeft(leaves);
     const mcp = lockedPreflight.mcp?.length
-        ? await materializeMcpTools(lockedPreflight.mcp, spec.principal, deps.onElicit, deps.mcpImageResizer, { reminderMark, counts: reminderDisclosureCounts }, mcpRevocationWiring(deps, runId), mcpPool === undefined ? undefined : { pool: mcpPool.pool, ownsPool: mcpPool.owned }, sectionDisposerOf(input.modBus, abortController.signal))
+        ? await materializeMcpTools(lockedPreflight.mcp, spec.principal, deps.onElicit, deps.mcpImageResizer, { reminderMark, counts: reminderDisclosureCounts }, mcpRevocationWiring(deps, runId), mcpPool === undefined ? undefined : { pool: mcpPool.pool, ownsPool: mcpPool.owned }, sectionDisposerOf(input.modBus, abortController.signal), (entry) => resourcesReached || serverReached(mintNamespacePrefix(MCP_NAMESPACE, entry.name)))
         :
             { tools: [], toolAxes: [], warnings: [], serverInstructions: [], instructionsDelta: { pendingAdds: [], pendingRemovals: [] }, droppedTools: [], statuses: [], refresh: async () => [], reconnect: async (server) => ({ server, prefix: mintNamespacePrefix(MCP_NAMESPACE, server), outcome: "not_declared", reason: "this task declared no MCP servers", toolCount: 0, added: [], removed: [] }), dispose: async () => { } };
     if (lockedPreflight.mcp?.length)
@@ -69,7 +74,7 @@ export async function prepareProtocolTools(input) {
     const rebuildHarnessToolsRef = {};
     const contentOriginWrapRef = {};
     const toolCallGateArmedRef = { armed: false };
-    const rosterApply = { toolFaceSnapshot, withFaces, remoteToolOffload, foldProtocolAxes: (axes, label) => foldProtocolAxes(axes, label), toolEffects, axisExplicitNegatives, roster };
+    const rosterApply = { spec, toolFaceSnapshot, withFaces, remoteToolOffload, foldProtocolAxes: (axes, label) => foldProtocolAxes(axes, label), toolEffects, axisExplicitNegatives, roster, declared: lockedPreflight.mcp ?? [], instructionsDelta: mcp.instructionsDelta };
     const rosterCommit = { rebuildHarnessToolsRef, rosterSeat, toolCallGateArmedRef, irreversibleTools, egressTools };
     const redialInput = { ...rosterApply, ...rosterCommit, mcp, deps, sessionId, runId, irreversibilityTier };
     const mcpRedial = lockedPreflight.mcp?.length ? (server) => redialMcpServer(redialInput, server) : undefined;
@@ -88,14 +93,17 @@ export async function prepareProtocolTools(input) {
                 const lines = [];
                 let changed = false;
                 let anyActiveFailure = false;
+                const reported = [];
                 for (const r of results) {
                     if (r.tools === undefined) {
+                        reported.push(settledOnRoster(r, rosterHolding(rosterApply, r.server), roster));
                         lines.push(`${r.server}: ${r.status}${r.error !== undefined ? ` (${r.error})` : ""}`);
                         if (r.status === "failed")
                             anyActiveFailure = true;
                         continue;
                     }
-                    const applied = applyMcpRosterDelta(rosterApply, { server: r.server, prefix: r.prefix, tools: r.tools, axes: r.axes ?? [], dropped: r.dropped ?? [] });
+                    const applied = applyMcpRosterDelta(rosterApply, { server: r.server, prefix: r.prefix, tools: r.tools, axes: r.axes ?? [], dropped: r.dropped ?? [], ...(r.instructions !== undefined ? { instructions: r.instructions } : {}) });
+                    reported.push(settledOnRoster(r, applied, roster));
                     if (!applied.applied) {
                         lines.push(`${r.server}: failed (${applied.foldError})`);
                         anyActiveFailure = true;
@@ -103,16 +111,15 @@ export async function prepareProtocolTools(input) {
                     }
                     changed = true;
                     const detail = [];
-                    const shownAdded = r.added.filter((n) => !applied.excluded.includes(n));
-                    if (shownAdded.length > 0)
-                        detail.push(`added: ${shownAdded.join(", ")}`);
-                    if (r.removed.length > 0)
-                        detail.push(`removed: ${r.removed.join(", ")}`);
+                    if (applied.added.length > 0)
+                        detail.push(`added: ${applied.added.join(", ")}`);
+                    if (applied.removed.length > 0)
+                        detail.push(`removed: ${applied.removed.join(", ")}`);
                     if (applied.excluded.length > 0)
                         detail.push(`excluded by deployment config (not mounted): ${applied.excluded.join(", ")}`);
                     if ((r.dropped?.length ?? 0) > 0)
                         detail.push(`dropped: ${r.dropped.map((d) => `${d.tool} (${d.reason.length > 90 ? `${d.reason.slice(0, 90)}…` : d.reason})`).join("; ")}`);
-                    lines.push(`${r.server}: refreshed — ${applied.pushed} tool${applied.pushed === 1 ? "" : "s"}${detail.length > 0 ? ` (${detail.join("; ")})` : ""}`);
+                    lines.push(`${r.server}: refreshed — ${applied.mounted.length} tool${applied.mounted.length === 1 ? "" : "s"}${detail.length > 0 ? ` (${detail.join("; ")})` : ""}`);
                 }
                 if (changed) {
                     const ungated = await commitMcpRosterChanges(rosterCommit);
@@ -122,7 +129,7 @@ export async function prepareProtocolTools(input) {
                 const text = lines.length === 0 ? "No connected MCP servers to refresh." : lines.join("\n");
                 return {
                     content: [{ type: "text", text }],
-                    details: { results },
+                    details: { results: reported },
                     terminate: false,
                     ...(anyActiveFailure && !changed ? { isError: true } : {}),
                 };
@@ -157,7 +164,7 @@ export async function prepareProtocolTools(input) {
         }
     };
     foldProtocolAxes(mcp.toolAxes, "MCP");
-    const a2aDeclared = spec.a2a?.length ? spec.a2a : undefined;
+    const a2aDeclared = lockedPreflight.a2a;
     const a2a = a2aDeclared
         ? await materializeA2aTools(a2aDeclared, spec.principal, abortController.signal)
         : { tools: [], toolAxes: [], warnings: [], statuses: [], refresh: async () => [], dispose: async () => { } };

package/dist/core/runner/prepare-question-face.d.ts

@@ -20,7 +20,7 @@ import type { AgentTool } from "../../internal/harness.js";
 import { type OnQuestion } from "../ask-question.js";
 import type { CheckpointStore } from "../checkpoint-store.js";
 import type { RunnerDeps, RuntimeCaps, TaskSpec } from "../types.js";
-import type { PrepareResume } from "./contracts.js";
+import type { PrepareResume, ToolFaceSnapshot } from "./contracts.js";
 import { type ContentAskBinding } from "./content-ask-bindings.js";
 import { RosterBuilder } from "../tool-roster.js";
 export { CONTENT_ASK_BINDING_CAP, type ContentAskBinding } from "./content-ask-bindings.js";
@@ -31,7 +31,9 @@ export interface PrepareQuestionFaceInput {
     /** borrowed-readonly — the REBOUND spec. Read: `durableApproval` (the durable face's opt-in), `interactiveTools`
      *  (the override), `principal` (the tool's source identity), `interactiveQuestionFallback` (restores the
      *  continuation under a resolved posture). Never mutated. */
-    spec: Pick<TaskSpec, "durableApproval" | "interactiveTools" | "principal" | "interactiveQuestionFallback">;
+    spec: Pick<TaskSpec, "durableApproval" | "interactiveTools" | "principal" | "interactiveQuestionFallback" | "excludeAllTools">;
+    /** borrowed-readonly — the frozen tool face; its selector with the spec's `excludeAllTools` is the valve's reading: the tool mounts only if the valve leaves it. */
+    toolFaceSnapshot: Pick<ToolFaceSnapshot, "selector">;
     /** borrowed-readonly — the deployment seat `onError` (the stranded-answer and synthetic-continuation operator
      *  lines; swallow-guarded). */
     deps: Pick<RunnerDeps, "onError">;

package/dist/core/runner/prepare-question-face.js

@@ -1,11 +1,12 @@
-import { createAskUserQuestionTool, isLiveQuestionFace } from "../ask-question.js";
+import { valveLeaves } from "../../agents/tool-filter.js";
+import { ASK_USER_QUESTION_TOOL_NAME, createAskUserQuestionTool, isLiveQuestionFace } from "../ask-question.js";
 import { boundInputHashOf } from "../canonical-json.js";
 import { durableParkOptInDeclared } from "../tool-policy.js";
 import { CONTENT_ASK_BINDING_CAP } from "./content-ask-bindings.js";
 import { RosterBuilder } from "../tool-roster.js";
 export { CONTENT_ASK_BINDING_CAP } from "./content-ask-bindings.js";
 export function prepareQuestionFace(input) {
-    const { frozenOnQuestion, spec, deps, checkpointStore, runtimeCaps, resolvedInteractionPosture, resume, sessionId, roster, inheritedUnavailableAsks } = input;
+    const { frozenOnQuestion, spec, deps, checkpointStore, runtimeCaps, resolvedInteractionPosture, resume, sessionId, roster, toolFaceSnapshot, inheritedUnavailableAsks } = input;
     const tools = roster.tools;
     const onQuestion = frozenOnQuestion;
     const liveQuestionFace = isLiveQuestionFace(onQuestion) ? onQuestion : undefined;
@@ -58,7 +59,7 @@ export function prepareQuestionFace(input) {
             return liveQuestionFace(req, signal);
         }
         : onQuestion;
-    const questionToolMounted = spec.interactiveTools === true || (spec.interactiveTools !== false && (onQuestion !== undefined || durableQuestionFace));
+    const questionToolMounted = (spec.interactiveTools === true || (spec.interactiveTools !== false && (onQuestion !== undefined || durableQuestionFace))) && valveLeaves(spec, toolFaceSnapshot.selector)({ name: ASK_USER_QUESTION_TOOL_NAME });
     let mountedQuestionTool;
     if (questionToolMounted)
         roster.mount((mountedQuestionTool =

package/dist/core/runner/prepare-safety-scan.d.ts

@@ -7,7 +7,7 @@ export interface PrepareSafetyScanInput {
      *  `tools`, `handsReadOnly` and `enablePlanMode`; it never mutates. Typed as a spec whose roster is snapshot faces. */
     spec: RosterSpec;
     /** borrowed-readonly — read only for the hands-enablement fact (`executionEnvFactory`/
-     *  `executionEnv` presence gates the hand-band effect preseed). */
+     *  `executionEnv` presence puts the hand band among the wake candidates). */
     deps: RunnerDeps;
 }
 /**
@@ -26,8 +26,13 @@ export interface PrepareSafetyScanInput {
  *    overrides a scanned value).
  */
 export interface PrepareSafetyScanResult {
-    /** borrowed-mutable — per-tool effect registry (alias-complete), the reconcile/path-policy read. */
+    /** borrowed-mutable — per-tool effect registry (alias-complete), the path-policy / gate read. This scan writes the caller tools'
+     *  own declarations (the roster's kept instance); every engine effect arrives with its tool's mount, never by name beforehand. Open
+     *  defect #2107 (7.55.0, design ticket): a selector that keeps a caller instance under a name and unmounts only the engine's leaves the engine's entry. */
     toolEffects: Map<string, ToolEffect>;
+    /** owned, read once — the wake reconcile's reading (`wakeEffectsOf`): `toolEffects` as this scan leaves it, with every catalog
+     *  definition this leg may still mount (`engineCandidatesOf`) folded in as a candidate. Built before any mount; no later phase writes it. */
+    wakeEffects: Map<string, ToolEffect>;
     /** borrowed-mutable — egress-marked tools (external writes; the gate never auto-allows them). */
     egressTools: Set<string>;
     /** borrowed-mutable — tools whose effect is irreversible (`always`, or `maybe` incl. by probe). */