@sema-agent/core 7.53.0 → 7.54.0

package/LICENSE

@@ -3,7 +3,9 @@ Business Source License 1.1
 Parameters
 
 Licensor:             clay (github.com/clayboby)
-Licensed Work:        @sema-agent/core (sema-core)
+Licensed Work:        @sema-agent/core (sema-core) and the satellite packages
+                      published from this repository (currently
+                      @sema-agent/mods-kernel)
                       (formerly published as @sema-ai/core)
                       The Licensed Work is (c) 2026 clay.
 Additional Use Grant: You may make production use of the Licensed Work for

package/dist/agents/peer-session-drain.d.ts

@@ -276,7 +276,6 @@ export declare function mountListAgents(args: {
         name: string;
         aliases?: readonly string[];
     }>;
-    toolEffects: Map<string, "read" | "write" | "idempotent">;
     /** The read faces' store seats, handed to the tool unchanged (see {@link ListAgentsReadSeats}). */
     readSeats?: ListAgentsReadSeats;
 }): ReturnType<typeof createListAgentsTool> | undefined;

package/dist/agents/peer-session-drain.js

@@ -781,8 +781,6 @@ function listAgentsNameFree(specTools) {
 export function mountListAgents(args) {
     if (!listAgentsNameFree(args.specTools))
         return undefined;
-    args.toolEffects.set(LIST_AGENTS_TOOL_NAME, "read");
-    args.toolEffects.set(LIST_AGENTS_TOOL_ALIAS, "read");
     return createListAgentsTool({
         ...(args.peerDirectory !== undefined ? { peerDirectory: args.peerDirectory } : {}),
         ...(args.freshWindowMs !== undefined ? { freshWindowMs: args.freshWindowMs } : {}),

package/dist/agents/send-message-tool.js

@@ -20,6 +20,7 @@ import { thrownText } from "../core/thrown-value.js";
 import { assertNoRetiredKeys } from "../core/retired-keys.js";
 import { sliceHeadSafe } from "../core/surrogate-safe-slice.js";
 import { clampValuesOf } from "../core/child-clamp-seats.js";
+import { assertParentSpecSeatCurrent } from "../core/parent-spec-seat.js";
 import { resolveSubagentTranscriptTier } from "../core/wiring-manifest.js";
 export const SEND_MESSAGE_TOOL_NAME = "SendMessage";
 let uplinkSeqGlobal = Date.now();
@@ -1010,6 +1011,7 @@ export function createSendMessageTool(opts) {
                 ]);
                 if (!l3Verdict.ok)
                     return admissionRefusal(l3Verdict.reason, who);
+                assertParentSpecSeatCurrent(ctx.parentSpecSeat);
                 const resume = createSubagentResume({
                     ledger,
                     parentToolCallId: resumeToolUseId,
@@ -1035,10 +1037,7 @@ export function createSendMessageTool(opts) {
                     ...(opts.onNotifyError !== undefined ? { onNotifyError: opts.onNotifyError } : {}),
                     ...(opts.notify ? { currentParentNotify: opts.notify } : {}),
                     ...(ctx.onQuestion !== undefined && row.sessionScoped !== true ? { currentOnQuestion: ctx.onQuestion } : {}),
-                    currentClamps: {
-                        ...clampValuesOf(ctx, ctx.parentSpecSeat),
-                        ...(ctx.parentSpecSeat?.memoryOff === true ? { memoryOff: true } : {}),
-                    },
+                    currentClamps: clampValuesOf(ctx, ctx.parentSpecSeat),
                     ...(ctx.autoModeReview !== undefined ? { currentAutoModeReview: ctx.autoModeReview } : {}),
                 });
                 const fromPrefix = senderIsChild ? `(message from teammate "${senderLabel}")\n` : "";

package/dist/agents/subagent.d.ts

@@ -428,11 +428,9 @@ export declare function createSubagentResume(deps: {
      *  resumer driving actions it could not perform itself. The fold is a union of restrictions (either
      *  side saying "restricted" wins), never a relaxation: a snapshot clamp is not lifted by a resumer
      *  that lacks it. Absent ⇒ the snapshot governs alone (prior behavior). The seats are the clamp table's rows
-     *  (`ClampValues`: only restricting values), plus the memory-off fact — a rewrite of the `memory` declaration,
-     *  not a value seat. */
-    currentClamps?: import("../core/child-clamp-seats.js").ClampValues & {
-        memoryOff?: true;
-    };
+     *  (`ClampValues`: only restricting values; a field row's is a partial declaration, written onto the snapshot's own
+     *  declaration, never over it). */
+    currentClamps?: import("../core/child-clamp-seats.js").ClampValues;
     /** The RESUMING caller's own handback-review seat (its trusted `ToolExecuteContext.autoModeReview`),
      *  same turn-bound reasoning as `currentOnQuestion` above: a resumed cycle is a completion like any
      *  other — its work reaches the durable row and the completion notification — and the decider that can

package/dist/agents/subagent.js

@@ -2,10 +2,10 @@ import { Type } from "typebox";
 import { isAbsolute } from "node:path";
 import { backgroundChildTerminal } from "../core/delegation-frames.js";
 import { bindDelegationName } from "../core/delegation-name.js";
-import { resumeStartupCauseOf } from "../core/resume-startup-cause.js";
-import { errorCodeOf } from "../core/runner/terminal-account.js";
-import { applyParentSpecSeat, memoryTurnedOff, parentSpecSeatOfCtx } from "../core/parent-spec-seat.js";
-import { assertClampRecord, childClampSeats, clampSeatsOf, clampSourceOf, engineHeadlessLegSeats, foldClampSources, postureUnderClamps } from "../core/child-clamp-seats.js";
+import { resumeRefusalDetailOf, resumeStartupCauseOf } from "../core/resume-startup-cause.js";
+import { errorCodeOf, thrownFailureOf } from "../core/runner/terminal-account.js";
+import { applyParentSpecSeat, parentSpecSeatOfCtx } from "../core/parent-spec-seat.js";
+import { applyClampSeats, assertClampRecord, childClampSeats, clampSeatsOf, clampSourceOf, engineHeadlessLegSeats, foldClampSources, postureUnderClamps } from "../core/child-clamp-seats.js";
 import { assertNoRetiredKeys } from "../core/retired-keys.js";
 import { stripSpawnTurnQuestionFace } from "../core/ask-question.js";
 import { withDelegationProvenance } from "../core/tool-policy.js";
@@ -510,10 +510,11 @@ function createSteerHandle(stream, parentToolCallId, agentName, settled, retain)
 const RETIRED_RESUME_CLAMP_KEYS = Object.freeze({
     "currentClamps.readFaceRoots": 'the waker\'s read-face clamp is `currentClamps.readFace: "roots"` (the clamp table\'s own seat name)',
     "currentClamps.writeFaceRoots": 'the waker\'s write-face clamp is `currentClamps.writeFace: "roots"` (the clamp table\'s own seat name)',
+    "currentClamps.memoryOff": "the waker's memory-off floor is `currentClamps.memory: { enabled: false }` (the clamp table's own seat, with the one member it clamps)",
 });
 export function createSubagentResume(deps) {
     assertNoRetiredKeys(deps, RETIRED_RESUME_CLAMP_KEYS, "createSubagentResume");
-    assertClampRecord(deps.currentClamps, "createSubagentResume currentClamps", undefined, ["memoryOff"]);
+    assertClampRecord(deps.currentClamps, "createSubagentResume currentClamps");
     const notifier = createSafeNotifier(deps.onNotifyError !== undefined ? { onError: deps.onNotifyError } : undefined);
     const resume = async (content) => {
         const ledger = deps.ledger;
@@ -573,17 +574,15 @@ export function createSubagentResume(deps) {
             entry.resumeCount += 1;
             entry.cycleSeq += 1;
             const wakeClamps = foldClampSources(entry.specSnapshot, deps.currentClamps);
-            const resumeSpec = {
+            const resumeSpec = applyClampSeats({
                 ...entry.specSnapshot,
                 objective: createResumePrompt(marker, content, deps.peerOrigin !== undefined ? "peer" : "operator"),
                 sessionId: entry.childSessionId,
                 requireExistingSession: true,
                 ...(deps.currentOnQuestion !== undefined ? { onQuestion: deps.currentOnQuestion } : {}),
                 ...childClampSeats(wakeClamps),
-                ...clampSeatsOf(wakeClamps, "specSeat"),
-                ...(deps.currentClamps?.memoryOff === true ? { memory: memoryTurnedOff(entry.specSnapshot.memory) } : {}),
                 signal: abort.signal,
-            };
+            }, clampSeatsOf(wakeClamps, "specSeat"));
             if (deps.registry !== undefined && deps.taskId !== undefined && deps.taskAccess !== undefined) {
                 const revived = await deps.registry.reviveBackgroundAgent(deps.taskId, deps.taskAccess, abort);
                 if (!revived.ok) {
@@ -2114,6 +2113,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                 ...(inheritedSkillGrants.length > 0 ? { inheritedSkillGrants } : {}),
                 ...(inheritedAllowedTools !== undefined && inheritedAllowedTools.length > 0 ? { inheritedAllowedTools: [...inheritedAllowedTools] } : {}),
                 ...(childProvenanceRef !== undefined && provenanceRequest !== undefined ? { delegationProvenance: { ref: childProvenanceRef, contentSafety: provenanceRequest } } : {}),
+                ...(reviveClaim === undefined && ctx.crossBoundaryTreeForChildren !== undefined ? { crossBoundaryTree: ctx.crossBoundaryTreeForChildren } : {}),
                 ...(treeScope !== undefined ? { registryScope: treeScope } : {}),
                 ...(ctx.checkpointScopeForChildren !== undefined ? { checkpointScope: ctx.checkpointScopeForChildren } : {}),
                 ...(ctx.inheritedGateForChildren ? { inheritedGate: ctx.inheritedGateForChildren() } : {}),
@@ -2523,6 +2523,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                             ...(rowModelKey !== undefined ? { model: rowModelKey } : {}),
                             deliveryChannel: "attaching",
                             toolUseId: ctx.toolCallId,
+                            ...(ctx.crossBoundaryTreeForChildren !== undefined ? { crossBoundaryTree: ctx.crossBoundaryTreeForChildren } : {}),
                             ...(bg.agentStore !== undefined ? { store: bg.agentStore } : {}),
                             abort,
                         });
@@ -3065,6 +3066,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                             ...(rowModelKey !== undefined ? { model: rowModelKey } : {}),
                             deliveryChannel: "attaching",
                             toolUseId: ctx.toolCallId,
+                            ...(ctx.crossBoundaryTreeForChildren !== undefined ? { crossBoundaryTree: ctx.crossBoundaryTreeForChildren } : {}),
                             ...(bg.agentStore !== undefined ? { store: bg.agentStore } : {}),
                             abort,
                         });
@@ -3667,11 +3669,16 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                     ]);
                     if (startup === "settled") {
                         if (parkedResume !== undefined) {
-                            const failure = await bgChildPromise.then((r) => ({ err: undefined, cause: resumeStartupCauseOf(r.terminal.kind === "failed" ? r.terminal.code : undefined) }), (e) => ({ err: childThrownText(e), cause: resumeStartupCauseOf(errorCodeOf(e)) }));
+                            const failure = await bgChildPromise.then((r) => ({ err: undefined, cause: resumeStartupCauseOf(r.terminal.kind === "failed" ? r.terminal.code : undefined), refusal: undefined }), (e) => ({ err: childThrownText(e), cause: resumeStartupCauseOf(errorCodeOf(e)), refusal: resumeRefusalDetailOf(thrownFailureOf(e, "").detail) }));
                             return {
                                 isError: true,
                                 content: `Parked resume did not complete: ${(failure.err ?? "the resumed run settled before its delivery lane bound").slice(0, 600)}`,
-                                details: { error: "parked_resume.startup_failed", task_id: taskId, ...(failure.cause !== undefined ? { cause: failure.cause } : {}) },
+                                details: {
+                                    error: "parked_resume.startup_failed",
+                                    task_id: taskId,
+                                    ...(failure.cause !== undefined ? { cause: failure.cause } : {}),
+                                    ...(failure.refusal !== undefined ? { detail: failure.refusal } : {}),
+                                },
                             };
                         }
                         return notStartedResult({

package/dist/agents/tool-filter.d.ts

@@ -1,5 +1,5 @@
 import type { AgentDefinition, ToolSpec } from "../core/types.js";
-import type { ToolLegKind, ToolSelector, ToolSelectorLayer } from "../core/tool-face.js";
+import { type ToolLegKind, type ToolSelector, type ToolSelectorLayer } from "../core/tool-face.js";
 import { type ProtocolId } from "../core/protocol-table.js";
 import { type ToolNameListReading } from "../core/tool-name-list.js";
 /**
@@ -121,6 +121,9 @@ type UniverseTool = {
     readonly name: string;
     readonly aliases?: readonly string[];
 };
+/** Do the layers ABOVE a leg decide a protocol row of these kinds? Yes when some kind of the row shares its spawner's tool surface
+ *  ({@link SPAWNER_SURFACE_LEG_KINDS}): the leg holds it exactly when its spawner may. Any other row is the leg's own channel. */
+export declare function protocolRowUnderCeiling(rowLegs: readonly ToolLegKind[]): boolean;
 /** The wire names a leg of these kinds relies on (the catalog's protocol column). */
 export declare function protocolToolNames(legs: readonly ToolLegKind[]): string[];
 /** Is this value a layer — an object (not a list) with the two lists `allow` / `deny`? One that is not admits NOTHING here;
@@ -130,9 +133,9 @@ export declare function isToolSelectorLayer(layer: unknown): layer is ToolSelect
  * Compile ONE run's tool selector from its layers (the ceiling it was spawned under, then its own lists — the LAST layer is its own)
  * and the kinds of leg it is. Each list is read by the one reading ({@link readAllowedToolList} / {@link readDeniedToolList}) and
  * matched by the one matcher ({@link listReaches}); a protocol tool of one of `legs` is admitted whatever the leg's own lists say —
- * and whatever the ceiling says too, unless its row is one the leg shares with its spawner (`protocolUnderCeiling`: the ceiling
- * layers decide it). Whether a list may reach a protocol tool at all is judged at prepare. The layers are kept as handed — the
- * producer passes frozen copies of the lists it read.
+ * and whatever the ceiling says too, unless a kind of its row shares its spawner's tool surface ({@link protocolRowUnderCeiling}):
+ * the ceiling layers decide it. Whether a list may reach a protocol tool at all is judged at prepare. The layers are kept as handed —
+ * the producer passes frozen copies of the lists it read.
  */
 export declare function compileToolSelector(layers: readonly ToolSelectorLayer[], legs?: readonly ToolLegKind[]): ToolSelector;
 /**

package/dist/agents/tool-filter.js

@@ -1,5 +1,6 @@
 import { createHash } from "node:crypto";
 import { canonicalize, UNCANONICALIZABLE } from "../core/canonical-json.js";
+import { SPAWNER_SURFACE_LEG_KINDS } from "../core/tool-face.js";
 import { ruleSpellingOf } from "../core/permission-rule-syntax.js";
 import { TOOL_CATALOG_ENTRIES } from "../core/tool-catalog-entries.js";
 import { isNamespacedCoveringRuleName, namespacedRuleNameCovers } from "../core/namespaced-rule-name.js";
@@ -118,7 +119,10 @@ export function listReaches(reach, tool) {
     }
     return false;
 }
-const PROTOCOL_ROWS = Object.freeze(TOOL_CATALOG_ENTRIES.flatMap((e) => (e.protocol !== undefined ? [Object.freeze({ name: e.name, legs: e.protocol, underCeiling: e.protocolUnderCeiling === true })] : [])));
+const PROTOCOL_ROWS = Object.freeze(TOOL_CATALOG_ENTRIES.flatMap((e) => (e.protocol !== undefined ? [Object.freeze({ name: e.name, legs: e.protocol })] : [])));
+export function protocolRowUnderCeiling(rowLegs) {
+    return rowLegs.some((l) => SPAWNER_SURFACE_LEG_KINDS.includes(l));
+}
 export function protocolToolNames(legs) {
     return [...new Set(PROTOCOL_ROWS.filter((r) => r.legs.some((l) => legs.includes(l))).map((r) => r.name))];
 }
@@ -147,7 +151,7 @@ export function compileToolSelector(layers, legs = []) {
     const kept = Object.freeze([...layers]);
     const compiled = kept.map((l) => (isToolSelectorLayer(l) ? { allow: readAllowedToolList(l.allow), deny: readDeniedToolList(l.deny) } : NO_TOOL_LAYER));
     const admittedBy = (ls, tool) => ls.every((l) => (l.allow === undefined || listReaches(l.allow, tool)) && !listReaches(l.deny, tool));
-    const protocol = new Map(PROTOCOL_ROWS.filter((r) => r.legs.some((l) => legs.includes(l))).map((r) => [r.name, r.underCeiling]));
+    const protocol = new Map(PROTOCOL_ROWS.filter((r) => r.legs.some((l) => legs.includes(l))).map((r) => [r.name, protocolRowUnderCeiling(r.legs)]));
     return Object.freeze({
         layers: kept,
         admits: (tool) => {
@@ -182,7 +186,7 @@ export function deniedProtocolTools(layers, legs) {
         const reached = (ds) => ds.some((d) => listReaches(d, { name: r.name }));
         if (reached(own))
             hits.set(`own:${r.name}`, { name: r.name, own: true });
-        if (!r.underCeiling && reached(inherited))
+        if (!protocolRowUnderCeiling(r.legs) && reached(inherited))
             hits.set(`inherited:${r.name}`, { name: r.name, own: false });
     }
     return [...hits.values()];

package/dist/core/a2a.js

@@ -8,6 +8,7 @@ import { A2A_NAMESPACE } from "./protocol-table.js";
 import { judgeEntryToolAxes, refusedDeclarer, snapshotDeclaredEntry } from "./locked-config.js";
 import { delimitUntrusted, inlineUntrusted } from "./untrusted-text.js";
 import { thrownText } from "./thrown-value.js";
+import { boundaryFlowFace } from "./cross-boundary-taint.js";
 const A2A_REQUEST_TIMEOUT_MS = 30_000;
 const A2A_CARD_TIMEOUT_MS = 10_000;
 const A2A_CALL_TOTAL_TIMEOUT_MS = 10 * 60_000;
@@ -567,9 +568,10 @@ async function materializePeer(peer, principal, lifecycle, signal) {
     for (const skill of card.skills) {
         if (spec.allowSkills !== undefined && !spec.allowSkills.includes(skill.id))
             continue;
-        const tool = buildSkillTool(spec, transport, skill, lifecycle);
+        const declared = declaredAxes?.[skill.id];
+        const tool = { ...buildSkillTool(spec, transport, skill, lifecycle), ...boundaryFlowFace(declared) };
         tools.push(tool);
-        skillAxes.push(a2aAxisFor(tool.name, declaredAxes?.[skill.id]));
+        skillAxes.push(a2aAxisFor(tool.name, declared));
     }
     return {
         tools,

package/dist/core/allow-entry.d.ts

@@ -276,6 +276,7 @@ export declare const SHADOW_REASON: Readonly<{
     readonly denial_limit_fallback: "the auto-mode classifier refused too many calls in a row, so a person decides";
     readonly classifier_no_ruling: "the auto-mode classifier could not judge this call, so a person decides";
     readonly requires_user_interaction: "this tool's server declares that a call must be put to a person";
+    readonly cross_boundary: string;
     readonly operator_forced: "this call arrived already marked as requiring confirmation (an earlier layer of this run, or the task that delegated it, judged it so) — it is cleared by confirming this call, never by a standing allow rule";
     readonly shell_floor: string;
     readonly target_unresolved: string;

package/dist/core/allow-entry.js

@@ -363,6 +363,7 @@ export const SHADOW_REASON = Object.freeze({
     denial_limit_fallback: "the auto-mode classifier refused too many calls in a row, so a person decides",
     classifier_no_ruling: "the auto-mode classifier could not judge this call, so a person decides",
     requires_user_interaction: "this tool's server declares that a call must be put to a person",
+    cross_boundary: mandateDisclosureOf("cross_boundary_taint"),
     operator_forced: "this call arrived already marked as requiring confirmation (an earlier layer of this run, or the task that delegated it, judged it so) — it is cleared by confirming this call, never by a standing allow rule",
     shell_floor: mandateDisclosureOf("operator_always"),
     target_unresolved: mandateDisclosureOf("target_unresolved"),

package/dist/core/approval-object.d.ts

@@ -0,0 +1,87 @@
+import type { PendingAction } from "./checkpoint-store.js";
+import type { CallTargetReading } from "./effective-path-target.js";
+import { type SkillGrantSource } from "./skill-grant.js";
+import type { ToolCallPathTarget, ToolFamily } from "./tool-face.js";
+import { type ToolRosterEntry } from "./tool-roster.js";
+type ParkedApproval = Extract<PendingAction, {
+    kind: "tool_approval";
+}>;
+/** The readings of a call's path slot a target is bound under ({@link CallTargetReading}'s two directions). */
+export declare const APPROVAL_TARGET_ROLES: readonly ["protective", "declared"];
+export type ApprovalTargetRole = (typeof APPROVAL_TARGET_ROLES)[number];
+/** The row's `targets` member: per role, the location the target RESOLVED to when the card was asked (the canonical
+ *  view of that reading), or `null` when the environment was asked and did not answer — an unresolved target binds
+ *  "unresolved", so a later resolution is a move. A role the environment was not asked about is absent; a row with no
+ *  such role carries none. */
+export type ApprovalTargets = {
+    readonly [R in ApprovalTargetRole]?: string | null;
+};
+/** The tool member as the row carries it: every member optional (a row is read, never trusted to be whole). */
+export interface ApprovalTool {
+    readonly capabilityId?: string;
+    readonly contractId?: string;
+    readonly shapeDigest?: string;
+    readonly implementationRevision?: string;
+    readonly family?: ToolFamily;
+    readonly pathTarget?: ToolCallPathTarget;
+}
+export interface ApprovalObject {
+    /** Absent on a row minted before the identity members (all four absent): such a row binds the tool's name alone. */
+    readonly tool?: ApprovalTool;
+    /** The row's member as stored — read, validated, by the judge. */
+    readonly targets?: unknown;
+    readonly grants?: string;
+}
+/** The view of one parked approval's object. */
+export declare function approvalObjectOf(row: ParkedApproval): ApprovalObject;
+/** The `targets` member of a reading: per role, the canonical view, or `null` for a view the environment was asked for
+ *  and did not answer; nothing when no role was read either way (or no reading was taken). The park mints it from the
+ *  gate's reading of the parked bytes; the execution station reads the bytes that will run the same way. */
+export declare function approvalTargetsOf(reading: CallTargetReading | undefined): {
+    targets?: ApprovalTargets;
+};
+/** Where a resume judges the object: before the claim (the decided bytes), before the session is touched (the live
+ *  tool), right before the execution (the tool as mounted then — a host's re-dial can replace it between the two — and the
+ *  bytes that will run, after every station that can rewrite them). */
+export type ApprovalStation = "claim" | "session" | "execution";
+export type ApprovalMember = "tool" | "targets" | "grants";
+/** THE table: the members each station judges. */
+export declare const APPROVAL_STATION_MEMBERS: {
+    readonly [S in ApprovalStation]: readonly ApprovalMember[];
+};
+/** What a station does with a mismatch: refuse with the row still pending (before the claim), reopen it for the
+ *  original tool, or veto the call (not run, approval spent). */
+export type ApprovalDisposition = "refuse_pending" | "reopen" | "veto";
+export interface ApprovalMismatch {
+    readonly member: ApprovalMember;
+    readonly disposition: ApprovalDisposition;
+    /** The machine word: the reopen codes, `resume.target_moved` on a moved face or target (the vetoed call's
+     *  `tool_end.errorCode`); absent on a grants veto. */
+    readonly code?: "resume.tool_unavailable" | "resume.tool_contract_mismatch" | "resume.target_moved" | "checkpoint.invalid_outcome";
+    readonly message: string;
+}
+/** What the station holds of the live call. */
+export interface LiveApprovalObject {
+    /** session / execution: the live roster row the leg would run the call as — `undefined` when the tool is not mounted. */
+    readonly tool?: ToolRosterEntry | undefined;
+    /** claim / execution: the bytes the station judges, the skills this resume serves and the Skill tool's wire name. */
+    readonly args?: unknown;
+    readonly skills?: readonly SkillGrantSource[];
+    readonly skillToolName?: string;
+    /** execution: the reading of the bytes that will run, taken at this station (`undefined`: none could be taken). */
+    readonly targetReading?: CallTargetReading | undefined;
+    /** execution: the bytes the decision rewrote the call to, as the tool reads them; absent when it rewrote nothing. When
+     *  the row's binding does not cover them ({@link licenseCovers}, the one judge of "are these the approved bytes") the
+     *  person approved bytes whose target the row never recorded, and the targets member is not judged. */
+    readonly decided?: unknown;
+}
+/**
+ * THE judge of a parked approval at one station: `"match"`, or the first member the table names for the station that
+ * the live call does not match, with its disposition. Absence is read per member: a tool member with no identity
+ * binds the name alone, and one with SOME identity members is a replacement (never a pre-identity row); a grants
+ * member is judged whenever the call would activate a skill (a row with no digest cannot cover one); a targets member
+ * is judged unless the decision rewrote the bytes to ones the row's binding does not cover, and one that is not a whole
+ * role → location record is damage.
+ */
+export declare function judgeApprovalObject(row: ParkedApproval, live: LiveApprovalObject, station: ApprovalStation): "match" | ApprovalMismatch;
+export {};

package/dist/core/approval-object.js

@@ -0,0 +1,85 @@
+import { canonicalize } from "./canonical-json.js";
+import { licenseCovers } from "./tool-policy.js";
+import { parkedSkillApprovalRefusal } from "./skill-grant.js";
+import { toolIdentityOf } from "./tool-roster.js";
+import { inlineUntrusted } from "./untrusted-text.js";
+export const APPROVAL_TARGET_ROLES = Object.freeze(["protective", "declared"]);
+export function approvalObjectOf(row) {
+    const { capabilityId, contractId, shapeDigest, implementationRevision, family, pathTarget, targets, boundGrantDigest } = row;
+    const carried = [capabilityId, contractId, shapeDigest, implementationRevision].some((m) => m !== undefined);
+    return {
+        ...(carried ? { tool: { capabilityId, contractId, shapeDigest, implementationRevision, family, pathTarget } } : {}),
+        ...(targets !== undefined ? { targets } : {}),
+        ...(boundGrantDigest !== undefined ? { grants: boundGrantDigest } : {}),
+    };
+}
+export function approvalTargetsOf(reading) {
+    const targets = {};
+    for (const role of APPROVAL_TARGET_ROLES) {
+        const view = reading?.[role];
+        if (view?.kind === "path" && (view.canonical !== undefined || view.unread === true))
+            targets[role] = view.canonical ?? null;
+    }
+    return Object.keys(targets).length > 0 ? { targets } : {};
+}
+export const APPROVAL_STATION_MEMBERS = Object.freeze({
+    claim: Object.freeze(["grants"]),
+    session: Object.freeze(["tool"]),
+    execution: Object.freeze(["tool", "grants", "targets"]),
+});
+const IDENTITY_MEMBERS = Object.freeze(["capabilityId", "contractId", "shapeDigest", "implementationRevision"]);
+const shown = (s) => `"${inlineUntrusted(s, 240)}"`;
+const vetoed = (name, why) => `The approved tool call "${name}" was not executed: ${why}, so the approval does not cover it (resume.target_moved). This approval is spent — the call has to be re-issued: its new card shows what it would act on now.`;
+function faceKey(family, pt) {
+    const slot = pt === undefined ? null : { param: pt.param, access: pt.access, aliases: [...(pt.aliases ?? [])], base: pt.base ?? "cwd", absent: pt.absent ?? "none", patternParam: pt.patternParam ?? null, skillScopeEligible: pt.skillScopeEligible === true };
+    return canonicalize({ family: family ?? null, pathTarget: slot });
+}
+function judgeTool(row, live) {
+    const entry = live.tool;
+    if (entry === undefined)
+        return { member: "tool", disposition: "reopen", code: "resume.tool_unavailable", message: `the approved tool "${row.toolName}" is no longer available on resume — refusing to continue as if it ran; the checkpoint is reopened for a retry with the tool present` };
+    const bound = approvalObjectOf(row).tool;
+    if (bound === undefined)
+        return undefined;
+    const id = toolIdentityOf(entry);
+    const differ = IDENTITY_MEMBERS.filter((k) => bound[k] !== id[k]);
+    if (differ.length > 0) {
+        const named = differ.map((k) => (bound[k] === undefined ? `${k} (missing on the row)` : k)).join(", ");
+        return { member: "tool", disposition: "reopen", code: "resume.tool_contract_mismatch", message: `the approved tool "${row.toolName}" on this leg is not the tool the approval was minted against (${named} differ) — refusing to execute a replacement wearing the name; the checkpoint is reopened for a retry with the original tool present` };
+    }
+    if (faceKey(bound.family, bound.pathTarget) === faceKey(entry.family, entry.pathTarget))
+        return undefined;
+    return { member: "tool", disposition: "veto", code: "resume.target_moved", message: vetoed(row.toolName, "the tool's face (its display family or the path target it declares) changed after the approval") };
+}
+function judgeTargets(row, live) {
+    const bound = row.targets;
+    if (bound === undefined || ("decided" in live && !licenseCovers(row.boundInputHash, live.decided)))
+        return undefined;
+    const roles = typeof bound === "object" && bound !== null && !Array.isArray(bound) ? Object.entries(bound) : [];
+    const whole = roles.length > 0 && roles.every(([k, v]) => APPROVAL_TARGET_ROLES.includes(k) && (v === null || (typeof v === "string" && v.length > 0)));
+    if (!whole)
+        return { member: "targets", disposition: "veto", code: "resume.target_moved", message: vetoed(row.toolName, "the target member of the approval on its checkpoint row is damaged (not a reading → resolved location record)") };
+    const now = approvalTargetsOf(live.targetReading).targets ?? {};
+    const where = (p) => (p === null ? "did not resolve" : `resolved to ${shown(p)}`);
+    for (const [role, was] of roles) {
+        const is = now[role];
+        if (is === was)
+            continue;
+        return { member: "targets", disposition: "veto", code: "resume.target_moved", message: vetoed(row.toolName, is === undefined ? `where its target resolves (it ${where(was)} when the card was asked) could not be established on this leg` : `its target ${is === null ? "does not resolve" : `resolves to ${shown(is)}`} now and ${where(was)} when the card was asked`) };
+    }
+    return undefined;
+}
+function judgeGrants(row, live, station) {
+    const refusal = parkedSkillApprovalRefusal(row, live.args, live.skills ?? [], live.skillToolName ?? "", station);
+    if (refusal === undefined)
+        return undefined;
+    return station === "claim" ? { member: "grants", disposition: "refuse_pending", code: "checkpoint.invalid_outcome", message: refusal } : { member: "grants", disposition: "veto", message: refusal };
+}
+export function judgeApprovalObject(row, live, station) {
+    for (const member of APPROVAL_STATION_MEMBERS[station]) {
+        const miss = member === "tool" ? judgeTool(row, live) : member === "targets" ? judgeTargets(row, live) : judgeGrants(row, live, station === "claim" ? "claim" : "execution");
+        if (miss !== undefined)
+            return miss;
+    }
+    return "match";
+}

package/dist/core/arg-summary.d.ts

@@ -2,8 +2,9 @@ import { type Egress } from "./untrusted-egress.js";
 /** A SHORT, SECRET-SCRUBBED primary-arg summary. Abbreviation REDUCES the surface; the `same-principal` tier's pass
  *  is the leak boundary, on whichever field the summary came from (the value is PERSISTED + SSE-forwarded and may be
  *  read by a platform operator in a multi-tenant deployment). Rules:
- *   • command → the command NAME (skip leading `VAR=val` env-prefixes; bail to `undefined` on a quoted assignment
- *     or a lone assignment; basename a path-form command; `+ …` if it had args).
+ *   • command → the command NAME: the first segment's written command word past its control words and the
+ *     assignments bash strips (bail to `undefined` on an unparseable text, a lone assignment, an assignment-shaped
+ *     or computed command word; basename a path-form command; `+ …` if more follows).
  *   • file path → BASENAME only (no host directory layout).
  *   • url → `new URL` origin+pathname (drops `user:pass@` userinfo + query/fragment).
  *   • else → pattern/query/description, else the first string field whose name is no credential name.

package/dist/core/arg-summary.js

@@ -1,4 +1,5 @@
-import { writtenAssignmentPrefix } from "../tools/fs/bash-program-position.js";
+import { readProgramPosition } from "../tools/fs/bash-program-position.js";
+import { argvOf, lexShell } from "../shell/lex.js";
 import { isSensitiveRecordKey } from "./credential-vocabulary.js";
 import { egressText } from "./untrusted-egress.js";
 const ACTIVITY_ARG_MAX = 80;
@@ -17,17 +18,22 @@ export function primaryActivityArg(args) {
     const path = str("file_path") ?? str("filePath") ?? str("path") ?? str("notebook_path");
     const url = str("url");
     if (command !== undefined) {
-        const tokens = command.trim().split(/\s+/);
-        let i = 0;
-        while (i < tokens.length && writtenAssignmentPrefix(tokens[i]) !== undefined) {
-            if (/["'\\]/.test(tokens[i]))
-                return undefined;
-            i++;
-        }
-        if (i >= tokens.length)
+        const lexed = lexShell(command);
+        if ("parseFailure" in lexed)
+            return undefined;
+        const named = lexed.segments.map((segment) => {
+            const argv = argvOf(segment);
+            const pos = readProgramPosition(argv);
+            return { segment, word: pos.written === undefined ? undefined : argv[pos.written + pos.assignments.length] };
+        }).find((s) => s.word !== undefined);
+        if (named?.word === undefined)
+            return undefined;
+        const word = named.word;
+        if (word.assignment !== undefined || word.expansions.length > 0 || word.unresolved !== undefined)
             return undefined;
-        const name = basename(tokens[i]);
-        val = tokens.length > i + 1 ? `${name} …` : name;
+        const name = basename(word.folded);
+        const more = named.segment.tokens.indexOf(word) < named.segment.tokens.length - 1 || lexed.segments.slice(lexed.segments.indexOf(named.segment) + 1).some((s) => s.tokens.length > 0);
+        val = more ? `${name} …` : name;
     }
     else if (path !== undefined) {
         val = basename(path);