@sema-agent/core 7.52.0 → 7.54.0

package/dist/core/approval-object.js

@@ -0,0 +1,85 @@
+import { canonicalize } from "./canonical-json.js";
+import { licenseCovers } from "./tool-policy.js";
+import { parkedSkillApprovalRefusal } from "./skill-grant.js";
+import { toolIdentityOf } from "./tool-roster.js";
+import { inlineUntrusted } from "./untrusted-text.js";
+export const APPROVAL_TARGET_ROLES = Object.freeze(["protective", "declared"]);
+export function approvalObjectOf(row) {
+    const { capabilityId, contractId, shapeDigest, implementationRevision, family, pathTarget, targets, boundGrantDigest } = row;
+    const carried = [capabilityId, contractId, shapeDigest, implementationRevision].some((m) => m !== undefined);
+    return {
+        ...(carried ? { tool: { capabilityId, contractId, shapeDigest, implementationRevision, family, pathTarget } } : {}),
+        ...(targets !== undefined ? { targets } : {}),
+        ...(boundGrantDigest !== undefined ? { grants: boundGrantDigest } : {}),
+    };
+}
+export function approvalTargetsOf(reading) {
+    const targets = {};
+    for (const role of APPROVAL_TARGET_ROLES) {
+        const view = reading?.[role];
+        if (view?.kind === "path" && (view.canonical !== undefined || view.unread === true))
+            targets[role] = view.canonical ?? null;
+    }
+    return Object.keys(targets).length > 0 ? { targets } : {};
+}
+export const APPROVAL_STATION_MEMBERS = Object.freeze({
+    claim: Object.freeze(["grants"]),
+    session: Object.freeze(["tool"]),
+    execution: Object.freeze(["tool", "grants", "targets"]),
+});
+const IDENTITY_MEMBERS = Object.freeze(["capabilityId", "contractId", "shapeDigest", "implementationRevision"]);
+const shown = (s) => `"${inlineUntrusted(s, 240)}"`;
+const vetoed = (name, why) => `The approved tool call "${name}" was not executed: ${why}, so the approval does not cover it (resume.target_moved). This approval is spent — the call has to be re-issued: its new card shows what it would act on now.`;
+function faceKey(family, pt) {
+    const slot = pt === undefined ? null : { param: pt.param, access: pt.access, aliases: [...(pt.aliases ?? [])], base: pt.base ?? "cwd", absent: pt.absent ?? "none", patternParam: pt.patternParam ?? null, skillScopeEligible: pt.skillScopeEligible === true };
+    return canonicalize({ family: family ?? null, pathTarget: slot });
+}
+function judgeTool(row, live) {
+    const entry = live.tool;
+    if (entry === undefined)
+        return { member: "tool", disposition: "reopen", code: "resume.tool_unavailable", message: `the approved tool "${row.toolName}" is no longer available on resume — refusing to continue as if it ran; the checkpoint is reopened for a retry with the tool present` };
+    const bound = approvalObjectOf(row).tool;
+    if (bound === undefined)
+        return undefined;
+    const id = toolIdentityOf(entry);
+    const differ = IDENTITY_MEMBERS.filter((k) => bound[k] !== id[k]);
+    if (differ.length > 0) {
+        const named = differ.map((k) => (bound[k] === undefined ? `${k} (missing on the row)` : k)).join(", ");
+        return { member: "tool", disposition: "reopen", code: "resume.tool_contract_mismatch", message: `the approved tool "${row.toolName}" on this leg is not the tool the approval was minted against (${named} differ) — refusing to execute a replacement wearing the name; the checkpoint is reopened for a retry with the original tool present` };
+    }
+    if (faceKey(bound.family, bound.pathTarget) === faceKey(entry.family, entry.pathTarget))
+        return undefined;
+    return { member: "tool", disposition: "veto", code: "resume.target_moved", message: vetoed(row.toolName, "the tool's face (its display family or the path target it declares) changed after the approval") };
+}
+function judgeTargets(row, live) {
+    const bound = row.targets;
+    if (bound === undefined || ("decided" in live && !licenseCovers(row.boundInputHash, live.decided)))
+        return undefined;
+    const roles = typeof bound === "object" && bound !== null && !Array.isArray(bound) ? Object.entries(bound) : [];
+    const whole = roles.length > 0 && roles.every(([k, v]) => APPROVAL_TARGET_ROLES.includes(k) && (v === null || (typeof v === "string" && v.length > 0)));
+    if (!whole)
+        return { member: "targets", disposition: "veto", code: "resume.target_moved", message: vetoed(row.toolName, "the target member of the approval on its checkpoint row is damaged (not a reading → resolved location record)") };
+    const now = approvalTargetsOf(live.targetReading).targets ?? {};
+    const where = (p) => (p === null ? "did not resolve" : `resolved to ${shown(p)}`);
+    for (const [role, was] of roles) {
+        const is = now[role];
+        if (is === was)
+            continue;
+        return { member: "targets", disposition: "veto", code: "resume.target_moved", message: vetoed(row.toolName, is === undefined ? `where its target resolves (it ${where(was)} when the card was asked) could not be established on this leg` : `its target ${is === null ? "does not resolve" : `resolves to ${shown(is)}`} now and ${where(was)} when the card was asked`) };
+    }
+    return undefined;
+}
+function judgeGrants(row, live, station) {
+    const refusal = parkedSkillApprovalRefusal(row, live.args, live.skills ?? [], live.skillToolName ?? "", station);
+    if (refusal === undefined)
+        return undefined;
+    return station === "claim" ? { member: "grants", disposition: "refuse_pending", code: "checkpoint.invalid_outcome", message: refusal } : { member: "grants", disposition: "veto", message: refusal };
+}
+export function judgeApprovalObject(row, live, station) {
+    for (const member of APPROVAL_STATION_MEMBERS[station]) {
+        const miss = member === "tool" ? judgeTool(row, live) : member === "targets" ? judgeTargets(row, live) : judgeGrants(row, live, station === "claim" ? "claim" : "execution");
+        if (miss !== undefined)
+            return miss;
+    }
+    return "match";
+}

package/dist/core/arg-summary.d.ts

@@ -2,8 +2,9 @@ import { type Egress } from "./untrusted-egress.js";
 /** A SHORT, SECRET-SCRUBBED primary-arg summary. Abbreviation REDUCES the surface; the `same-principal` tier's pass
  *  is the leak boundary, on whichever field the summary came from (the value is PERSISTED + SSE-forwarded and may be
  *  read by a platform operator in a multi-tenant deployment). Rules:
- *   • command → the command NAME (skip leading `VAR=val` env-prefixes; bail to `undefined` on a quoted assignment
- *     or a lone assignment; basename a path-form command; `+ …` if it had args).
+ *   • command → the command NAME: the first segment's written command word past its control words and the
+ *     assignments bash strips (bail to `undefined` on an unparseable text, a lone assignment, an assignment-shaped
+ *     or computed command word; basename a path-form command; `+ …` if more follows).
  *   • file path → BASENAME only (no host directory layout).
  *   • url → `new URL` origin+pathname (drops `user:pass@` userinfo + query/fragment).
  *   • else → pattern/query/description, else the first string field whose name is no credential name.

package/dist/core/arg-summary.js

@@ -1,4 +1,5 @@
-import { writtenAssignmentPrefix } from "../tools/fs/bash-program-position.js";
+import { readProgramPosition } from "../tools/fs/bash-program-position.js";
+import { argvOf, lexShell } from "../shell/lex.js";
 import { isSensitiveRecordKey } from "./credential-vocabulary.js";
 import { egressText } from "./untrusted-egress.js";
 const ACTIVITY_ARG_MAX = 80;
@@ -17,17 +18,22 @@ export function primaryActivityArg(args) {
     const path = str("file_path") ?? str("filePath") ?? str("path") ?? str("notebook_path");
     const url = str("url");
     if (command !== undefined) {
-        const tokens = command.trim().split(/\s+/);
-        let i = 0;
-        while (i < tokens.length && writtenAssignmentPrefix(tokens[i]) !== undefined) {
-            if (/["'\\]/.test(tokens[i]))
-                return undefined;
-            i++;
-        }
-        if (i >= tokens.length)
+        const lexed = lexShell(command);
+        if ("parseFailure" in lexed)
+            return undefined;
+        const named = lexed.segments.map((segment) => {
+            const argv = argvOf(segment);
+            const pos = readProgramPosition(argv);
+            return { segment, word: pos.written === undefined ? undefined : argv[pos.written + pos.assignments.length] };
+        }).find((s) => s.word !== undefined);
+        if (named?.word === undefined)
+            return undefined;
+        const word = named.word;
+        if (word.assignment !== undefined || word.expansions.length > 0 || word.unresolved !== undefined)
             return undefined;
-        const name = basename(tokens[i]);
-        val = tokens.length > i + 1 ? `${name} …` : name;
+        const name = basename(word.folded);
+        const more = named.segment.tokens.indexOf(word) < named.segment.tokens.length - 1 || lexed.segments.slice(lexed.segments.indexOf(named.segment) + 1).some((s) => s.tokens.length > 0);
+        val = more ? `${name} …` : name;
     }
     else if (path !== undefined) {
         val = basename(path);

package/dist/core/ask-origin.d.ts

@@ -113,8 +113,8 @@ export interface AskOriginFacts {
     /** Which of the gate's OWN post-fold stations minted the standing ask, if one did — again the gate's
      *  record of its own layer (a station replaces an `allow` wholesale, so at most one fires per pass),
      *  never a read-back of `decisionReason: "safety"` off a decision a policy could have composed. `unstated` is
-     *  the last station: the mode's answer for a call to a tool that states no permission of its own when no layer
-     *  stated the allow — its origin is `policy` (no tighten word), its class `unstated`. */
+     *  the last station: the mode's answer for a call to a tool that states no permission of its own when no answer
+     *  covers the fold's allow — its origin is `policy` (no tighten word), its class `unstated`. */
     readonly tightened: "shell_gate" | "safety" | "unstated" | undefined;
     /** The MANDATE mark inputs of this call — the tool SEAT's marks plus the gate's own per-call records
      *  ({@link MandateMarks}), read from the same two places the lane's own derivation reads them. The
@@ -191,19 +191,15 @@ export type RuleOffersAbsence = (typeof RULE_OFFERS_ABSENCES)[number];
  * the reason is that a RULE is already speaking, not that the question is beyond rules, and a surface
  * that auto-answers by posture is not crossing a mandate when it answers one.
  *
- * FOUR named readings of the one pass, because four callers need four different things and taking
- * the wrong one is how this boundary drifts:
+ * THREE named readings of the one pass, because three callers need three different things and taking
+ * the wrong one is how this boundary drifts. None is the ENFORCEMENT reading: whether an allow rule clears the ask is the
+ * class row's `ruleMayClear` ({@link classifyAsk} — every door below is a class there), read once by the gate's allow layer.
  *  · `word` — the DISCLOSED reason ({@link RuleOffersAbsence}), first door wins, in the display order the card has always
  *    used (governance, the outranked allow, the hook, the ask rule, the two ancestor doors, then the marks). Display
  *    only. A structural door the offer factory owns (no lane wired, a tool it does not speak for, a
  *    task that cannot hold a rule) is decided BEFORE this and is deliberately silent;
  *  · `mandated` — the FACT the ask carries as its own member. Read off the whole mandate set, so which
  *    door is DISPLAYED cannot change it: an ask that is both outranked and mandated is mandated;
- *  · `ruleMayClear` — the ENFORCEMENT reading the gate's clearing arms take. It is `mandated` plus the
- *    person's explicit `ask` rule, and deliberately NOT `word !== undefined`: `allowRuleShadowed`
- *    is an ACCOUNT of a refusal that already happened, display-only by contract, and reading it as a
- *    blocker would let a policy forwarding that metadata refuse a call nothing is blocking. A
- *    display word is never an authority;
  *  · `mandate` — WHICH table word the bit stands on, only when the MARKS family is its whole reason (no
  *    governance, hook or ancestor door, and no bit stamped without a word); absent, the bit's reason is
  *    not one word.
@@ -211,7 +207,6 @@ export type RuleOffersAbsence = (typeof RULE_OFFERS_ABSENCES)[number];
 export declare function ruleClearanceOf(ask: RuleClearanceFacts | undefined, marks: Omit<MandateMarks, "probeMandated">): {
     word?: Exclude<RuleOffersAbsence, "lane_cannot_speak">;
     mandated: boolean;
-    ruleMayClear: boolean;
     mandate?: PersistedRuleMandate;
 };
 /** The facts one ask carries about whether a rule could clear it — the members {@link ruleClearanceOf}
@@ -235,6 +230,8 @@ export interface RuleClearanceFacts {
     /** The engine-stamped probe mandate (the reversibility probe declared this call's demotion
      *  structural — for the built-in shell probe, a read outside the session's allowed directories). */
     probeMandated?: boolean;
+    /** The ask stands on the call's cross-boundary obligation (see {@link import("./tool-policy.js").PermissionResult}). */
+    crossBoundaryMandated?: boolean;
     /** An ancestor's approver answered "unavailable" for this call, or a durable mandate was floated here. */
     inheritedUnresolved?: boolean;
     /** The ask is being resolved at an ANCESTOR's frozen approver (the three inherited-lane mint sites
@@ -309,8 +306,11 @@ export type RealApprovalTableCoversEveryOrigin = AssertAllKeysHandled<Exclude<As
  *    re-authorizes the agent, so the question is a property of the TARGET, not of anyone's hesitation.
  *  - `target_unresolved` — the reading of a written target could not say where it leads on disk:
  *    `probe_unanswered`'s doctrine one layer over.
+ *  - `cross_boundary_taint` — the call's cross-boundary obligation is a person's confirmation (an org-side write from a tree
+ *    that executes on a device of a multi-tenant deployment, or a device-bound call after an off-target read): a fact of
+ *    the tree, not of the tool; read off the ask's own `crossBoundaryMandated` ({@link ruleClearanceOf}).
  */
-export declare const PERSISTED_RULE_MANDATES: readonly ["operator_always", "tool_marks", "probe_mandate", "probe_unanswered", "write_protection", "target_unresolved"];
+export declare const PERSISTED_RULE_MANDATES: readonly ["operator_always", "tool_marks", "probe_mandate", "probe_unanswered", "write_protection", "target_unresolved", "cross_boundary_taint"];
 export type PersistedRuleMandate = (typeof PERSISTED_RULE_MANDATES)[number];
 /** Membership test for {@link PersistedRuleMandate} — the screen a row reader applies to a stored word. */
 export declare function isPersistedRuleMandate(v: unknown): v is PersistedRuleMandate;
@@ -323,6 +323,7 @@ declare const MANDATE_DISCLOSURE: {
     readonly tool_marks: "this tool carries egress/irreversibility/interaction marks (a mandated confirmation a rule cannot clear)";
     readonly write_protection: "this write's target is on the deployment's write-protection table (the agent's own configuration is guarded one look per write) — it is cleared by confirming this call, never by a standing allow rule";
     readonly target_unresolved: "where this write leads on disk could not be determined (a link on the way could not be examined, or the environment could not resolve the target), so whether it lands on a guarded path is unknown — it is cleared by confirming this call: no standing rule and no automatic decider answers for it, though a wired approver seat can";
+    readonly cross_boundary_taint: "this run executes on a device outside the deployment's trust boundary and the deployment is multi-tenant, so an org-side write — or, after an off-target read, a call bound for the device — is confirmed by the deployment's approver for this call: no standing allow rule and no automatic lane answers for it, and an allow the configuration gives (a blanket seat or a policy's answer) is refused";
 };
 /** The fence over the disclosure table: `never` while every word has a row. */
 export type DisclosureTableCoversEveryMandate = AssertAllKeysHandled<Exclude<PersistedRuleMandate, keyof typeof MANDATE_DISCLOSURE>>;
@@ -331,10 +332,9 @@ export type DisclosureTableCoversEveryMandate = AssertAllKeysHandled<Exclude<Per
 export declare function mandateDisclosureOf(mandate: PersistedRuleMandate | undefined): string;
 /**
  * The mandate provenance of one call, judged from the SAME mark inputs the gate is driven with —
- * the single source for "could a persisted allow rule clear this ask?". Allow rules silence the
- * classifier's questions, never a mandated one, and this predicate is the mandated-family half of
- * that boundary (the real-approval/governance half rides the decision's own `requiresRealApproval`
- * bit, which the org layer stamps):
+ * the WORD a mandated ask discloses for its marks (the class derivation reads the same marks as classes,
+ * and the allow layer reads the classes). Allow rules silence the classifier's questions, never a
+ * mandated one; this is the mark family's word for that boundary:
  *  · `probeMandated` — this CALL's own reversibility probe declared its demotion STRUCTURAL
  *    (`"probe_mandate"`), judged FIRST because it is the only per-call member here: the three below
  *    are properties of the TOOL and are true of every call on the seat, so a mandate that is true of
@@ -355,10 +355,11 @@ export declare function mandateDisclosureOf(mandate: PersistedRuleMandate | unde
  * in {@link irreversibilityMandateOf} which {@link safetyAxisOf} shares: such a write is not an irreversible action, and
  * its park stays budgetable.
  *
- * Two consumers, one derivation: the gate's silencing arm (a matching rule is disclosed as outranked
- * instead of clearing the ask) and the runner's suggestion factory (a mandated ask offers no
- * "stop asking me this" option — a rule minted from it would never clear it). A drift between the
- * two would let a card offer a rule the lane then refuses to honor. The per-call member reaches both
+ * Two consumers, one derivation: the ask's stamped `mandated` / `mandate` members and the runner's suggestion factory (a
+ * mandated ask offers no "stop asking me this" option — a rule minted from it would never clear it). Every word here is also a
+ * class the allow layer reads, so an ask this derivation mandates is never cleared by a rule; the converse does not hold — a
+ * class with no word here (a caller policy's own guard on an ask without the real-approval bit) leaves the ask unmandated, and its
+ * card can offer a rule the allow layer then discloses as outranked. The per-call member reaches both
  * the same way every other per-call fact does: the gate stamps it on the surviving ask, the
  * synchronous sites read it off the decision they spread, and the park leg threads its own parameter.
  */
@@ -465,8 +466,10 @@ export type ToolMarkSource = "deployment" | "mcp_annotation" | "a2a_default";
  * `requires_user_interaction` is the SERVER's declaration on the called tool (`_meta["anthropic/requiresUserInteraction"] === true`): a
  * permission question, unlike `content_question` (the reserved question tool's content-routing signal) — it carries that class's arbitration
  * row cell by cell, because the reference implementation judges the declaration ahead of its allow-rule lookup and its bypass release.
+ * `cross_boundary` is an ask carrying `crossBoundaryMandated` (the gate's cross-boundary station mints it with the real-approval bit; the
+ * decision receipt adds the bit to a policy's or hook's own): no rule, classifier, sandbox or mode answers it.
  * `unstated` is the mode's answer for a call nobody stated: a tool whose permission seat is `passthrough` (it states no
- * permission of its own — a remote peer's tool) reached the end of the fold with an allow no layer stated.
+ * permission of its own — a remote peer's tool) reached the end of the fold with an allow no answer covers.
  * `classifier_no_ruling` is a classifier station's question to a person because the auto-mode classification did not rule
  * (`classifierNoRuling` — it could not run, or replied with no verdict): the denial-limit fallback's row (only a person
  * answers it; the classifier is never asked again).
@@ -480,7 +483,7 @@ export type ToolMarkSource = "deployment" | "mcp_annotation" | "a2a_default";
  * `rule_unreadable` is a rule that may govern the call and cannot be read for it: the organization's snapshot, a partition of
  * the person's store, or this call against a deny / ask row (the lexer's word, a content row, the read station's rows).
  */
-export declare const ASK_CLASSES: readonly ["content_question", "hook", "ancestor", "dangerous_delete", "unverifiable_delete", "unverifiable_shell_text", "transcript_write", "org_rule", "rule_unreadable", "ask_rule", "denial_limit_fallback", "classifier_no_ruling", "requires_user_interaction", "operator_forced", "shell_floor", "target_unresolved", "probe", "write_protection", "tool_marks_mcp", "tool_marks_a2a", "policy_rra", "artifact_shared_read", "mode", "unstated", "ordinary"];
+export declare const ASK_CLASSES: readonly ["content_question", "hook", "ancestor", "dangerous_delete", "unverifiable_delete", "unverifiable_shell_text", "transcript_write", "org_rule", "rule_unreadable", "ask_rule", "denial_limit_fallback", "classifier_no_ruling", "requires_user_interaction", "cross_boundary", "operator_forced", "shell_floor", "target_unresolved", "probe", "write_protection", "tool_marks_mcp", "tool_marks_a2a", "policy_rra", "artifact_shared_read", "mode", "unstated", "ordinary"];
 export type AskClass = (typeof ASK_CLASSES)[number];
 /** Membership test for {@link AskClass} — the word crosses the wire on `tool_end.gate.disposition`. */
 export declare function isAskClass(v: unknown): v is AskClass;
@@ -504,7 +507,8 @@ export interface ModeArbitrationRow {
  * The mode × class table. `bypassImmune` is the one new column (nothing said it before); the classifier and
  * sandbox columns are the fold of the two former per-word lane tables (only `probe` moved: the classifier may
  * now answer it — the read boundary's unestablishable spelling is fed to it as a deny-table row instead), and
- * `ruleMayClear` restates {@link ruleClearanceOf}'s conclusion per class (a real-approval bit is never rule-clearable).
+ * `ruleMayClear` is the allow layer's ONE reading: an allow member clears a standing ask exactly when the folded row says so
+ * (every class a real-approval bit, a governance verdict, a hook, a mark or an ask rule brings says no).
  * `probe`'s `classifierEligible` is the OPEN read face's reading: a narrowed (`roots`) face withholds the classifier from the class,
  * folded where the ask's row is ({@link foldArbitrationRow}).
  * `mode` is the permission mode's OWN question (`plan`'s two sentences, `decisionReason: "mode"`): the reference
@@ -610,6 +614,13 @@ export declare const MODE_ARBITRATION: {
         readonly ruleMayClear: false;
         readonly hookAskFloor: true;
     };
+    readonly cross_boundary: {
+        readonly bypassImmune: true;
+        readonly classifierEligible: false;
+        readonly sandboxAdmission: false;
+        readonly ruleMayClear: false;
+        readonly hookAskFloor: false;
+    };
     readonly operator_forced: {
         readonly bypassImmune: true;
         readonly classifierEligible: true;
@@ -751,6 +762,9 @@ export interface AskClassification {
     readonly classes: ReadonlySet<AskClass>;
     readonly askClass: AskClass;
     readonly row: ModeArbitrationRow;
+    /** The tool face the classification was derived on ({@link AskClassFacts.askFace}); absent ⇒ the face-less reading, the `other`
+     *  face's. The mode point and the headless remedy read the face here and nowhere else ({@link bypassImmuneOf}). */
+    readonly askFace?: AskFace;
 }
 /** The two members an ask's classification puts on the approval request and the park row: the disclosed word and
  *  the whole set, the set as an array in {@link ASK_CLASSES} order (so `classes[0] === askClass`). */
@@ -859,14 +873,16 @@ export type Arbitration = {
  * The ONE mode read point. `dontAsk` refuses every ask — one value for every class — but a hook's that no member of the
  * set floors (`hookAskFloor`: a hook's ask beside a rule's or a safety check's ask is refused, as the reference's full
  * pipeline refuses it; a hook's ask alone is the reference's forced decision, which never reaches that conversion);
- * `bypassPermissions` refuses a write whose target's reading could not say where it leads where that class stays immune
- * (every face but the shell's: a person cannot be asked — the folded row says it, {@link foldArbitrationRow}), keeps every
- * immune class and releases the rest: the shell face releases that class ({@link RELEASED_ON_SHELL_FACE}), the reference
- * implementation's answer for a command whose written target could not be resolved;
+ * `bypassPermissions` refuses a write whose target's reading could not say where it leads on a face where THAT class stays
+ * immune (every face but the shell's: a person cannot be asked — the class's own reading on the face the classification records,
+ * {@link bypassImmuneOn}; another immune class beside it does not make it immune), keeps every immune class and releases the
+ * rest: the shell face releases that class ({@link RELEASED_ON_SHELL_FACE}), the reference implementation's answer for a
+ * command whose written target could not be resolved — so on that face an immune class beside it keeps the question;
  * `acceptEdits` answers an ORDINARY ask itself on a call the caller vouches is one of the mode's file commands
  * (`call.fileCommand`, `accepted`); `plan`, `default` and `auto` hand every ask on (plan's own questions were raised by
  * its write gate; the reference implementation refuses nothing at this point under plan — auto's classifier reads the
- * row at its own station). Reads the class SET and the folded row — never the disclosed word.
+ * row at its own station). Reads the class SET on the face the classification records ({@link bypassImmuneOf}) and the folded
+ * row's face-free `hookAskFloor` — never the row's `bypassImmune`, never the disclosed word.
  */
 export declare function arbitrateByMode(mode: PermissionMode, c: AskClassification, disclosure?: {
     origin?: AskOrigin;

package/dist/core/ask-origin.js

@@ -25,7 +25,7 @@ export function stampAskOrigin(decision, facts, classification) {
 }
 export const RULE_OFFERS_ABSENCES = Object.freeze(["mandated", "allow_outranked", "ask_rule_matched", "lane_cannot_speak"]);
 export function ruleClearanceOf(ask, marks) {
-    const marksWord = persistedRuleMandateOf({ ...marks, probeMandated: ask?.probeMandated === true });
+    const marksWord = ask?.crossBoundaryMandated === true ? "cross_boundary_taint" : persistedRuleMandateOf({ ...marks, probeMandated: ask?.probeMandated === true });
     const foldedDoor = (ask?.foldedAskClasses ?? []).some((c) => !MODE_ARBITRATION[c].ruleMayClear);
     const doorOutsideTable = ask?.requiresRealApproval === true || ask?.decisionReason === "hook" || ask?.decisionReason === "mode" || foldedDoor || ask?.authoredBy === "deployment" || ask?.inheritedUnresolved === true || ask?.ancestorResolved === true;
     const mandated = ask?.mandated === true || doorOutsideTable || marksWord !== undefined;
@@ -50,7 +50,7 @@ export function ruleClearanceOf(ask, marks) {
             return "mandated";
         return mandated ? "mandated" : undefined;
     })();
-    return { ...(word !== undefined ? { word } : {}), mandated, ruleMayClear: !mandated && ask?.matchedAskRule === undefined, ...(mandate !== undefined ? { mandate } : {}) };
+    return { ...(word !== undefined ? { word } : {}), mandated, ...(mandate !== undefined ? { mandate } : {}) };
 }
 export function askMandateMember(ask) {
     const { mandated, mandate } = ruleClearanceOf(ask, {});
@@ -58,8 +58,9 @@ export function askMandateMember(ask) {
     return mandated ? { mandated: true, ...(mandate !== undefined ? { mandate } : {}), ...authored } : authored;
 }
 export function ownedClearanceFacts(d) {
-    const { mandated, requiresRealApproval, decisionReason, matchedAskRule, probeMandated, authoredBy, foldedAskClasses } = d;
+    const { mandated, requiresRealApproval, decisionReason, matchedAskRule, probeMandated, crossBoundaryMandated, authoredBy, foldedAskClasses } = d;
     return {
+        ...(crossBoundaryMandated === true ? { crossBoundaryMandated } : {}),
         ...(mandated === true ? { mandated } : {}),
         ...(Array.isArray(foldedAskClasses) && foldedAskClasses.length > 0 ? { foldedAskClasses: [...foldedAskClasses] } : {}),
         ...(authoredBy === "deployment" ? { authoredBy } : {}),
@@ -106,7 +107,7 @@ export const ORIGIN_IMPLIES_REAL_APPROVAL = {
     safety_tighten: false,
     policy: false,
 };
-export const PERSISTED_RULE_MANDATES = Object.freeze(["operator_always", "tool_marks", "probe_mandate", "probe_unanswered", "write_protection", "target_unresolved"]);
+export const PERSISTED_RULE_MANDATES = Object.freeze(["operator_always", "tool_marks", "probe_mandate", "probe_unanswered", "write_protection", "target_unresolved", "cross_boundary_taint"]);
 const PERSISTED_RULE_MANDATE_SET = new Set(PERSISTED_RULE_MANDATES);
 export function isPersistedRuleMandate(v) {
     return PERSISTED_RULE_MANDATE_SET.has(v);
@@ -118,6 +119,7 @@ const MANDATE_DISCLOSURE = {
     tool_marks: "this tool carries egress/irreversibility/interaction marks (a mandated confirmation a rule cannot clear)",
     write_protection: "this write's target is on the deployment's write-protection table (the agent's own configuration is guarded one look per write) — it is cleared by confirming this call, never by a standing allow rule",
     target_unresolved: "where this write leads on disk could not be determined (a link on the way could not be examined, or the environment could not resolve the target), so whether it lands on a guarded path is unknown — it is cleared by confirming this call: no standing rule and no automatic decider answers for it, though a wired approver seat can",
+    cross_boundary_taint: "this run executes on a device outside the deployment's trust boundary and the deployment is multi-tenant, so an org-side write — or, after an off-target read, a call bound for the device — is confirmed by the deployment's approver for this call: no standing allow rule and no automatic lane answers for it, and an allow the configuration gives (a blanket seat or a policy's answer) is refused",
 };
 export function mandateDisclosureOf(mandate) {
     return mandate === undefined ? "an explicit ask rule matched this call (a person's or the deployment's ask-me-each-time outranks a standing allow rule)" : MANDATE_DISCLOSURE[mandate];
@@ -183,6 +185,7 @@ export const ASK_CLASSES = Object.freeze([
     "denial_limit_fallback",
     "classifier_no_ruling",
     "requires_user_interaction",
+    "cross_boundary",
     "operator_forced",
     "shell_floor",
     "target_unresolved",
@@ -215,6 +218,7 @@ export const MODE_ARBITRATION = {
     denial_limit_fallback: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false },
     classifier_no_ruling: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false },
     requires_user_interaction: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: true },
+    cross_boundary: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false },
     operator_forced: { bypassImmune: true, classifierEligible: true, sandboxAdmission: true, ruleMayClear: false, hookAskFloor: false },
     shell_floor: { bypassImmune: true, classifierEligible: true, sandboxAdmission: true, ruleMayClear: false, hookAskFloor: false },
     target_unresolved: { bypassImmune: true, classifierEligible: false, sandboxAdmission: true, ruleMayClear: false, hookAskFloor: true },
@@ -236,8 +240,11 @@ const RELEASED_ON_SHELL_FACE = new Set(["target_unresolved"]);
 function bypassImmuneOn(c, face) {
     return MODE_ARBITRATION[c].bypassImmune && !(face === "shell" && RELEASED_ON_SHELL_FACE.has(c));
 }
+function bypassImmuneOf(c) {
+    return [...c.classes].some((k) => bypassImmuneOn(k, c.askFace));
+}
 const CLASSIFIER_WITHHELD_ON_ROOTS = new Set(["probe"]);
-export const RRA_EXPLAINERS = new Set(["dangerous_delete", "unverifiable_delete", "unverifiable_shell_text", "transcript_write", "org_rule", "rule_unreadable", "denial_limit_fallback", "classifier_no_ruling", "ancestor", "artifact_shared_read", "requires_user_interaction"]);
+export const RRA_EXPLAINERS = new Set(["dangerous_delete", "unverifiable_delete", "unverifiable_shell_text", "transcript_write", "org_rule", "rule_unreadable", "denial_limit_fallback", "classifier_no_ruling", "ancestor", "artifact_shared_read", "requires_user_interaction", "cross_boundary"]);
 const RELEASABLE_BY_FACE = Object.freeze({
     shell: Object.freeze(ASK_CLASSES.filter((c) => !bypassImmuneOn(c, "shell"))),
     other: Object.freeze(ASK_CLASSES.filter((c) => !bypassImmuneOn(c, "other"))),
@@ -280,6 +287,8 @@ export function decisionAskClassesOf(d) {
         out.add("operator_forced");
     if (d.probeMandated === true)
         out.add("probe");
+    if (d.crossBoundaryMandated === true)
+        out.add("cross_boundary");
     if (d.decisionReason === "hook")
         out.add("hook");
     if (d.decisionReason === "mode")
@@ -323,7 +332,7 @@ export function classifyAsk(d, facts) {
         classes.add("requires_user_interaction");
     if (marks.shellGated === true && marks.irreversibility === "always")
         classes.add("shell_floor");
-    const toolMarked = marks.shellGated !== true && (marks.egress === true || marks.irreversibility === "always" || marks.irreversibility === "maybe");
+    const toolMarked = marks.egress === true || (marks.shellGated !== true && (marks.irreversibility === "always" || marks.irreversibility === "maybe"));
     if (toolMarked) {
         const sources = facts.toolMarkSources;
         if (sources === undefined || sources.size === 0 || sources.has("deployment"))
@@ -352,7 +361,7 @@ export function classifyAsk(d, facts) {
     if (classes.size === 0)
         classes.add("ordinary");
     const askClass = ASK_CLASSES.find((c) => classes.has(c));
-    return { classes, askClass, row: foldArbitrationRow(classes, facts.readFace, facts.askFace) };
+    return { classes, askClass, row: foldArbitrationRow(classes, facts.readFace, facts.askFace), ...(facts.askFace !== undefined ? { askFace: facts.askFace } : {}) };
 }
 export function headlessDenialMessage(toolName, askMessage) {
     return `Permission for this tool use was denied: it requires interactive approval, and permission prompts are not available in this session (nobody can be asked to approve "${toolName}" in this run — headless auto-deny). The action was NOT performed. Do not claim it succeeded, and do not retry it in this session — report the limitation to the user, or suggest an alternative. What was requested: ${askMessage}`;
@@ -366,12 +375,12 @@ export function headlessApprovalRemedy(input) {
     const c = input.classification;
     if (input.mode === "acceptEdits" && input.unplacedOptions !== undefined && (c === undefined || (c.classes.size === 1 && c.classes.has("ordinary"))))
         return `${fileCommandOptionsSentence(input.unplacedOptions.program)} Spell the ${input.unplacedOptions.program} without option words for the mode to answer it, or ${approver}`;
-    if (c?.row.bypassImmune === true)
+    if (c !== undefined && bypassImmuneOf(c))
         return `no permission mode releases this ask (${c.askClass}): ${approver}, or change the call`;
     if (input.mode === "plan" && c?.classes.has("mode") === true)
         return `the plan permission mode asks before every write and every call to a tool the engine does not define that is not read-only — leave plan mode (\`setPermissionMode\` to another mode, or approve the plan) to run it, or ${approver}`;
     if (c !== undefined && c.classes.size === 1 && c.classes.has("unstated"))
-        return `no rule, policy or hook granted this tool, and it states no permission of its own — grant it with an allow rule (a permission rule \`allow\` for its name, or an allow-list entry), run with \`permissionMode: "bypassPermissions"\`, or ${approver}`;
+        return `no allow entry, stored allow rule or hook granted this tool, and it states no permission of its own — grant it with an allow entry for its name (\`RunnerDeps.allowedTools\` / \`TaskSpec.allowedTools\`), run with \`permissionMode: "bypassPermissions"\`, or ${approver}`;
     const onlyOrdinary = c === undefined || (c.classes.size === 1 && c.classes.has("ordinary"));
     if (input.coveredWrite && onlyOrdinary) {
         if (input.mode === "acceptEdits")
@@ -391,9 +400,9 @@ export function arbitrateByMode(mode, c, disclosure, call) {
         case "dontAsk":
             return has("hook") && !c.row.hookAskFloor ? { kind: "ask" } : { kind: "denied_by_mode", mode, askClass: c.askClass, classes };
         case "bypassPermissions":
-            if (has("target_unresolved") && c.row.bypassImmune)
+            if (has("target_unresolved") && bypassImmuneOn("target_unresolved", c.askFace))
                 return { kind: "denied_by_mode", mode, askClass: c.askClass, classes };
-            if (c.row.bypassImmune)
+            if (bypassImmuneOf(c))
                 return { kind: "ask" };
             const reason = [...MODE_RELEASE_REASON_SET].find((r) => has(r));
             return {

package/dist/core/ask-question.d.ts

@@ -154,7 +154,6 @@ export type QuestionOutcomeReading =
  * meant to withhold. Neither guess is safe, so neither is made.
  */
 export declare function classifyQuestionOutcome(outcome: OnQuestionOutcome): QuestionOutcomeReading;
-export declare function canonicalizeCapturedPlainData(node: unknown, seen?: WeakSet<object>): boolean;
 /**
  * Narrow an {@link OnQuestionOutcome} to its no-interaction arm — the ONLY value that licenses
  * re-routing a question to a later decider, so it is read strictly (the discriminant must be present

package/dist/core/ask-question.js

@@ -1,6 +1,6 @@
 import { Type } from "typebox";
 import { uuidv7 } from "../engine/session/uuid.js";
-import { boundInputHashOf } from "./canonical-json.js";
+import { boundInputHashOf, capturedJsonOf } from "./canonical-json.js";
 import { defineTool, errorResult } from "./tools.js";
 import { delimitUntrusted, inlineUntrusted } from "./untrusted-text.js";
 import { toolFace } from "./tool-catalog-entries.js";
@@ -25,73 +25,10 @@ export function classifyQuestionOutcome(outcome) {
         return { shape: "unavailable" };
     if (!carriesAnswers)
         return { shape: "contradictory" };
-    let captured;
-    try {
-        captured = structuredClone(answers);
-    }
-    catch {
+    const captured = capturedJsonOf(answers, "list");
+    if (!captured.ok)
         return { shape: "contradictory" };
-    }
-    if (!isCanonicalAnswerTree(captured))
-        return { shape: "contradictory" };
-    return { shape: "answered", answer: { answers: captured } };
-}
-function isCanonicalAnswerTree(answers) {
-    return canonicalizeCapturedPlainData(answers);
-}
-function isUnknownArray(v) {
-    return Array.isArray(v);
-}
-export function canonicalizeCapturedPlainData(node, seen = new WeakSet()) {
-    if (node === null)
-        return true;
-    switch (typeof node) {
-        case "string":
-        case "boolean":
-            return true;
-        case "number":
-            return Number.isFinite(node);
-        case "object":
-            break;
-        default:
-            return false;
-    }
-    const obj = node;
-    if (seen.has(obj))
-        return false;
-    seen.add(obj);
-    if (isUnknownArray(obj)) {
-        const arr = obj;
-        for (let i = 0; i < arr.length; i++) {
-            if (!Object.prototype.hasOwnProperty.call(arr, i))
-                return false;
-            if (arr[i] === undefined)
-                return false;
-            if (Object.is(arr[i], -0))
-                arr[i] = 0;
-            if (!canonicalizeCapturedPlainData(arr[i], seen))
-                return false;
-        }
-        if (Object.keys(arr).length !== arr.length)
-            return false;
-    }
-    else {
-        const proto = Object.getPrototypeOf(obj);
-        if (proto !== Object.prototype && proto !== null)
-            return false;
-        const rec = obj;
-        for (const key of Object.keys(rec)) {
-            if (rec[key] === undefined) {
-                delete rec[key];
-                continue;
-            }
-            if (Object.is(rec[key], -0))
-                rec[key] = 0;
-            if (!canonicalizeCapturedPlainData(rec[key], seen))
-                return false;
-        }
-    }
-    return true;
+    return { shape: "answered", answer: { answers: captured.value } };
 }
 export function isQuestionUnavailable(outcome) {
     return classifyQuestionOutcome(outcome).shape === "unavailable";

package/dist/core/ask-unresolvable-notice.d.ts

@@ -48,8 +48,9 @@ export interface AskUnresolvableFacts {
      *  did not take the call — it declined or failed; `false`: no park lane at all, the usual shape). */
     readonly parkLaneExisted: boolean;
     /** Present for the causes that say nobody could be asked ({@link askUnresolvableRemedySeat}): the caller-side change that
-     *  would have let the call run, as the gate minted it for the refusal's tool text (`headlessApprovalRemedy`, ask-origin.ts)
-     *  — carried verbatim, never re-composed here. */
+     *  would have let the call run, as the gate minted it for the refusal's tool text (`headlessApprovalRemedy`, ask-origin.ts;
+     *  for arguments no approval can be bound to, the binding's own sentence, which is that text — the remedy's approver half would
+     *  not let them run) — carried verbatim, never re-composed here. */
     readonly remedy?: string;
 }
 /**