@sema-agent/core 7.54.1 → 7.55.0

package/dist/agents/subagent.js

@@ -5,6 +5,7 @@ import { bindDelegationName } from "../core/delegation-name.js";
 import { resumeRefusalDetailOf, resumeStartupCauseOf } from "../core/resume-startup-cause.js";
 import { errorCodeOf, thrownFailureOf } from "../core/runner/terminal-account.js";
 import { applyParentSpecSeat, parentSpecSeatOfCtx } from "../core/parent-spec-seat.js";
+import { ADVISOR_FORK_SENTENCE, ADVISOR_TOOL_NAME } from "../core/advisor-verdict.js";
 import { applyClampSeats, assertClampRecord, childClampSeats, clampSeatsOf, clampSourceOf, engineHeadlessLegSeats, foldClampSources, postureUnderClamps } from "../core/child-clamp-seats.js";
 import { assertNoRetiredKeys } from "../core/retired-keys.js";
 import { stripSpawnTurnQuestionFace } from "../core/ask-question.js";
@@ -17,7 +18,7 @@ import { enqueueMemoryAnnouncement } from "../core/memory-engine/layout.js";
 import { resolveModel, resolveModelDisplayLabel } from "../core/roles.js";
 import { childModelSeat, childThinkingSeat, deploymentStatesSubagentModel, deploymentSubagentThinking, forkModelSeat, inheritedParentModel, runnerRoleMap } from "./child-model-seat.js";
 export { childThinkingSeat, deploymentSubagentThinking, deploymentSubagentTierModel } from "./child-model-seat.js";
-import { OUTPUT_TOOL_NAME, REPORT_BLOCKED_TOOL_NAME } from "../core/runner/synthetic-tools.js";
+import { REPORT_BLOCKED_TOOL_NAME } from "../core/runner/synthetic-tools.js";
 import { TOOL_SEARCH_NAME } from "../core/runner/tool-disclosure.js";
 import { OFFLOAD_TOOL_NAME } from "../core/tool-result-store.js";
 import { compileToolSelector, delegationListWhere, snapshotDefinitionLists, toolListsDigest, toolNameAllowed, toolNameListFlaw } from "./tool-filter.js";
@@ -73,7 +74,8 @@ import { recordRosterSpawn } from "./roster-store.js";
 import { LAUNCH_RECEIPT_OWN_WORDS_CLAUSE, launchReceiptNoQuoteClause } from "./launch-receipt-contract.js";
 import { ObserverDigestTap, ObserverPairing, createObserverReportToolSpec, markObserverTaskId, unmarkObserverTaskId, isObserverTaskId, ObserverResumeStateError, ObserverStoppedByUserError, observerFramingPrompt, observerSlug, resolveObserverDeclaration, } from "./observer.js";
 import { SubagentStepRecorder } from "./subagent-steps.js";
-import { toolFace } from "../core/tool-catalog-entries.js";
+import { OUTPUT_TOOL_NAME, mountRuleFace, toolFace } from "../core/tool-catalog-entries.js";
+import { canonicalNameValue } from "../core/permission-rule-model.js";
 import { inheritedChildPool, inheritedMcpDeclarations } from "./inherited-tool-pool.js";
 import { readMember, thrownText } from "../core/thrown-value.js";
 const BG_AGENT_RESULT_MAX = 4_000;
@@ -1182,18 +1184,36 @@ function chargeDelegationEntryHandle(registry, key, store, handle) {
     armDelegationLedgerLifecycle(registry);
     sweepDelegationLedgerRound(registry, 3);
 }
-export function normalizeSubagentType(value) {
-    return value.normalize("NFKC").toLowerCase().replace(/[\p{White_Space}\p{Pd}_]+/gu, "");
-}
-function foldGeneralPurposeAlias(args, shadowed) {
-    if (shadowed)
+export { normalizeSubagentType } from "../core/permission-rule-model.js";
+function canonicalSubagentTypeArgs(args, accepted, generalPurposeShadowed) {
+    if (args === null || typeof args !== "object" || Array.isArray(args))
         return args;
     const raw = args;
-    if (raw !== null && typeof raw === "object" && raw.subagent_type === GENERAL_PURPOSE_SUBAGENT_TYPE) {
-        const { subagent_type: _dropped, ...rest } = raw;
-        return rest;
+    const requested = raw["subagent_type"];
+    if (requested === undefined || requested === "") {
+        if (!generalPurposeShadowed)
+            return { ...raw, subagent_type: GENERAL_PURPOSE_SUBAGENT_TYPE };
+        if (requested === undefined)
+            return args;
+        const { subagent_type: _empty, ...omitted } = raw;
+        return omitted;
     }
-    return args;
+    if (typeof requested !== "string")
+        return args;
+    const resolved = canonicalNameValue(requested, accepted);
+    return resolved.kind === "entry" && resolved.entry !== requested ? { ...raw, subagent_type: resolved.entry } : args;
+}
+function subagentTypeRefusal(requested, accepted) {
+    if (requested === undefined || requested === "")
+        return undefined;
+    if (typeof requested !== "string")
+        return { content: `Sub-agent not started: subagent_type must be a string. Available subagent_type values: ${accepted.join(", ")}.`, error: "unknown subagent_type" };
+    const resolved = canonicalNameValue(requested, accepted);
+    if (resolved.kind === "ambiguous")
+        return { content: `Sub-agent not started: subagent_type "${requested}" is ambiguous — it matches ${resolved.entries.join(", ")}. Use the exact name.`, error: "ambiguous subagent_type" };
+    if (resolved.kind === "unknown")
+        return { content: `Sub-agent not started: unknown subagent_type "${requested}". Available subagent_type values: ${accepted.join(", ")}.`, error: "unknown subagent_type" };
+    return undefined;
 }
 export const SUBAGENT_SYSTEM_NOTE = "You can delegate a self-contained subtask to an isolated sub-agent via the delegation tool. " +
     "The sub-agent runs in a clean context and returns a single report. Delegate slow, parallelizable, " +
@@ -1379,6 +1399,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
     return bindDelegationName(delegationToolName, {
         name: opts.name ?? DEFAULT_SUBAGENT_TOOL_NAME,
         ...toolFace("agent"),
+        ruleFace: { ...mountRuleFace("agent"), nameValues: acceptedSubagentTypes() },
         agentListing,
         agentToolFaces,
         ...(depth === 0 && opts.allowTools !== undefined ? { agentToolLevelAllowTools: opts.allowTools } : {}),
@@ -1471,9 +1492,13 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                 }
                 : {}),
         }),
-        prepareArguments: (args) => foldGeneralPurposeAlias(args, generalPurposeShadowed),
+        prepareArguments: (args) => canonicalSubagentTypeArgs(args, acceptedSubagentTypes(), generalPurposeShadowed),
+        validateInput: (args) => {
+            const refusal = subagentTypeRefusal(args.subagent_type, acceptedSubagentTypes());
+            return refusal === undefined ? { ok: true } : { ok: false, message: refusal.content, code: refusal.error };
+        },
         execute: async (args, ctx) => {
-            const a = foldGeneralPurposeAlias(args, generalPurposeShadowed);
+            const a = canonicalSubagentTypeArgs(args, acceptedSubagentTypes(), generalPurposeShadowed);
             const parentSpecSeat = parentSpecSeatOfCtx(ctx);
             const reviveClaim = ctx.reviveClaim;
             if (reviveClaim !== undefined && opts.background === undefined) {
@@ -1487,31 +1512,10 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
             if (!prompt) {
                 return notStartedResult({ isError: true, content: "Sub-agent not started: 'prompt' was empty.", details: { error: "empty prompt" } });
             }
-            if (a.subagent_type !== undefined && typeof a.subagent_type !== "string") {
-                return notStartedResult({
-                    isError: true,
-                    content: `Sub-agent not started: subagent_type must be a string. Available subagent_type values: ${acceptedSubagentTypes().join(", ")}.`,
-                    details: { error: "unknown subagent_type" },
-                });
-            }
-            const requestedType = a.subagent_type ?? "";
-            let rawType = requestedType;
-            if (requestedType !== "") {
-                const accepted = acceptedSubagentTypes();
-                if (!accepted.includes(requestedType)) {
-                    const wanted = normalizeSubagentType(requestedType);
-                    const hits = wanted === "" ? [] : accepted.filter((n) => normalizeSubagentType(n) === wanted);
-                    if (hits.length > 1) {
-                        return notStartedResult({
-                            isError: true,
-                            content: `Sub-agent not started: subagent_type "${requestedType}" is ambiguous — it matches ${hits.join(", ")}. Use the exact name.`,
-                            details: { error: "ambiguous subagent_type" },
-                        });
-                    }
-                    if (hits.length === 1)
-                        rawType = hits[0];
-                }
-            }
+            const typeRefusal = subagentTypeRefusal(a.subagent_type, acceptedSubagentTypes());
+            if (typeRefusal !== undefined)
+                return notStartedResult({ isError: true, content: typeRefusal.content, details: { error: typeRefusal.error } });
+            const rawType = typeof a.subagent_type === "string" ? a.subagent_type : "";
             const wantsFork = forkOffered && rawType === FORK_SUBAGENT_TYPE;
             if (reviveClaim !== undefined && wantsFork) {
                 return notStartedResult({ isError: true, content: `Sub-agent not revived: a "${FORK_SUBAGENT_TYPE}" agent cannot be revived — launch a new agent with the needed context instead.`, details: { error: "revive.fork_unsupported" } });
@@ -1520,13 +1524,6 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
             const def = hasAgents && !wantsFork && !omitted ? agentMap.get(rawType) : undefined;
             const wantsBackground = opts.background !== undefined && (a.run_in_background !== false || def?.background === true);
             const spawnAgentType = wantsFork ? FORK_SUBAGENT_TYPE : omitted ? GENERAL_PURPOSE_SUBAGENT_TYPE : rawType;
-            if (!def && !wantsFork && !omitted) {
-                return notStartedResult({
-                    isError: true,
-                    content: `Sub-agent not started: unknown subagent_type "${rawType}". Available subagent_type values: ${acceptedSubagentTypes().join(", ")}.`,
-                    details: { error: "unknown subagent_type" },
-                });
-            }
             const allowFlaw = toolNameListFlaw(delegationListWhere(toolName, def?.name), "allowed", def !== undefined ? def.allowTools : opts.allowTools);
             if (allowFlaw !== undefined)
                 return notStartedResult({ isError: true, content: `Sub-agent not started: ${inlineUntrusted(allowFlaw, 480)}`, details: { error: "config.agent.unknown_tool" } });
@@ -1922,6 +1919,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                     ...(ctx.getApiKeyAndHeaders !== undefined ? { getApiKeyAndHeaders: ctx.getApiKeyAndHeaders } : {}),
                     ...(ctx.checkpointStoreForChildren !== undefined ? { checkpointStore: ctx.checkpointStoreForChildren } : {}),
                     tools: [reportTool],
+                    ...(parentSpecSeat?.advisorModel !== undefined ? { excludeTools: [ADVISOR_TOOL_NAME] } : {}),
                     ...(ctx.deferTools !== undefined ? { deferTools: [...ctx.deferTools] } : {}),
                     ...(ctx.alwaysLoadTools !== undefined ? { alwaysLoadTools: [...ctx.alwaysLoadTools] } : {}),
                     ...(ctx.restoreGatedTools !== undefined ? { restoreGatedTools: ctx.restoreGatedTools === true ? true : [...ctx.restoreGatedTools] } : {}),
@@ -1942,6 +1940,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                     const observerGate = parentGate === undefined
                         ? undefined
                         : {
+                            ...(parentGate.ancestorRules !== undefined ? { ancestorRules: parentGate.ancestorRules } : {}),
                             ...(parentGate.permissionMode !== undefined ? { permissionMode: parentGate.permissionMode } : {}),
                             ...(parentGate.permissionModeCeiling !== undefined ? { permissionModeCeiling: parentGate.permissionModeCeiling } : {}),
                             ...(parentGate.shellGate !== undefined ? { shellGate: parentGate.shellGate } : {}),
@@ -2423,7 +2422,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                 const forkInternals = { ...childInternals, insideFork: true, ...(ctx.reminderMark !== undefined ? { reminderMark: ctx.reminderMark } : {}) };
                 stepRecorder.lockTo(forkedId);
                 const forkWorktreeNote = worktreeDir !== undefined ? forkWorktreeTranslationNote(ctx.parentCwd, worktreeDir) : undefined;
-                const forkObjective = `${FORK_DIRECTIVE_FRAME}${prompt}${forkWorktreeNote !== undefined ? `\n\n${forkWorktreeNote}` : ""}`;
+                const forkObjective = `${FORK_DIRECTIVE_FRAME}${prompt}${forkWorktreeNote !== undefined ? `\n\n${forkWorktreeNote}` : ""}${parentSpecSeat?.advisorModel !== undefined ? `\n\n${ADVISOR_FORK_SENTENCE}` : ""}`;
                 if (wantsBackground) {
                     const bg = opts.background;
                     const notify = ctx.onTaskNotification ?? bg.notify;

package/dist/agents/tool-filter.d.ts

@@ -1,6 +1,5 @@
 import type { AgentDefinition, ToolSpec } from "../core/types.js";
 import { type ToolLegKind, type ToolSelector, type ToolSelectorLayer } from "../core/tool-face.js";
-import { type ProtocolId } from "../core/protocol-table.js";
 import { type ToolNameListReading } from "../core/tool-name-list.js";
 /**
  * The tool selector (design/38 1A, one operation since #1623): what tools a run may use, read once over the universe it can get
@@ -10,27 +9,23 @@ import { type ToolNameListReading } from "../core/tool-name-list.js";
  * run that spawned it), so there is no spawn-time filter and no complement anywhere.
  *
  *  - an allowed list absent, or holding `"*"` (any spelling the rule syntax reads as it: `*()`, `*(*)`), sets no allowlist on
- *    its layer; otherwise the layer keeps only what it names
- *    (`[]` keeps nothing — intentional, not a mistake);
+ *    its layer; otherwise the layer keeps only what it names (`[]` keeps nothing — intentional);
  *  - a denied list removes what it names from whatever remains (a denied tool always loses);
  *  - a layer above a run (its ceiling) bounds it: a child's `"*"` never widens what its parent could use.
  *
- * An entry is read by the rule syntax ({@link readDeniedEntry}: `Tool(content)` names `Tool`, the content is not read, the
- * whole tool is hidden; an entry the syntax cannot read names no tool); a protocol spelling (`mcp__srv`, `mcp__srv__*`, a glob over the tool segment) reaches the
- * tools of that peer, including ones it lists later; an entry no tool answers to is kept by name and reaches one mounted later.
- * Judged at the prepare that receives it: a spelling no tool name can have is refused, an unknown name told (`sub-agent-deny-lists.ts`).
+ * An entry is read by the rule syntax ({@link readDeniedEntry}); a protocol spelling (`mcp__srv`, `mcp__srv__*`, a glob over the
+ * tool segment) reaches the tools of that peer, including ones it lists later; an entry no tool answers to is kept by name and
+ * reaches one mounted later. Judged at the prepare that receives it (`sub-agent-deny-lists.ts`).
  *
- * `"*"` in an allowed list is the "allow all" sentinel and never a name: no tool is named `*` (the caller tool name
- * contract, `caller-tool-name.ts`, refuses it at the mount; engine and protocol-minted names never are).
+ * `"*"` in an allowed list is the "allow all" sentinel and never a name (`caller-tool-name.ts` refuses it at the mount).
  */
 /**
  * How ONE denied-tools entry is read — by the rule syntax's own test of a rule spelling (`ruleSpellingOf`, the one every entry
  * list's reader asks), exactly as written: `Tool(content)` names `Tool` (the content is not read here, so the whole tool is
  * hidden), `Tool()` and `Tool(*)` are the bare name. An entry the syntax cannot read — surrounding whitespace, a tool name
  * outside its spelling (a blank or an invisible character before the `(`, a leading `-`), a parenthesis that does not close
- * the entry — names no tool: `unreadable`, the entry as written. A value that is not a string (a list a host read from a file
- * can hold anything) names no tool either: it reads as `not_a_string` with a fixed label of its TYPE, and nothing about the
- * value is read, converted or printed — `typeof` and the array test only.
+ * the entry — names no tool: `unreadable`, the entry as written. A value that is not a string names no tool either: it reads as
+ * `not_a_string` with a fixed label of its TYPE, and nothing about the value is read, converted or printed.
  */
 export type DeniedEntryReading = {
     readonly kind: "name";
@@ -57,9 +52,9 @@ export declare function notAListSentence(where: string, side: ToolNameListSide,
 export declare function delegationListWhere(toolName: string, definitionName: string | undefined): string;
 /**
  * The digest of a run's own two tool lists as its selector reads them (an absent denied list reads as an empty one): sha256 over the
- * binding serializer's canonical form — the serializer the checkpoint row digest uses. It is the evidence that the spawning run judged
- * EXACTLY these lists (`RunInternals.toolListsJudged`, and the row's `CheckpointState.toolListsJudged` on a resume); `undefined` for
- * lists the serializer cannot encode, which therefore never match any evidence.
+ * binding serializer's canonical form. It is the evidence that the spawning run judged EXACTLY these lists
+ * (`RunInternals.toolListsJudged`, and the row's `CheckpointState.toolListsJudged` on a resume); `undefined` for lists the
+ * serializer cannot encode, which therefore never match any evidence.
  */
 export declare function toolListsDigest(allow: readonly unknown[] | undefined, deny: readonly unknown[] | undefined): string | undefined;
 /**
@@ -67,46 +62,36 @@ export declare function toolListsDigest(allow: readonly unknown[] | undefined, d
  * of strings. The one reading the judgment before the run and the spawn-time check of a tool that never went through prepare share.
  */
 export declare function toolNameListFlaw(where: string, side: ToolNameListSide, value: unknown): string | undefined;
-/** A definition with its two tool-name lists replaced by their one copy — the copy every later reader (the judgment before the
- *  run, the roster, the filter at each spawn) takes instead of the host's container. */
+/** A definition with its two tool-name lists replaced by their one copy — the copy every later reader takes instead of the host's container. */
 export declare function snapshotDefinitionLists(def: AgentDefinition): AgentDefinition;
 /**
- * What ONE tool-name list reaches — the single reading every consumer of an allowed or a denied list takes (the spawn-time
- * filter, the nested-delegation check, the memory content-origin face, the judgment before the run):
- *  - `names`: exact spellings; a tool answers to its wire name and to every alias it declares;
- *  - `covering`: the protocol spellings that cover a SET — a peer (`mcp__srv`), the same set written with the star
- *    (`mcp__srv__*`), a glob over the tool segment (`mcp__srv__get_*`) — matched by the allow layer's own covering matcher,
- *    peers compared exactly, both sides in the same namespace;
- *  - `wholeProtocols`: a denied list's `mcp__*` — every tool of that protocol. An allowed list reads it as nothing (the
- *    reference's allow resolution has no such form: it keeps no MCP tool by it).
+ * What ONE tool-name list reaches — the single reading every consumer of an allowed or a denied list takes: `names` are exact
+ * spellings (a tool answers to its wire name and every alias it declares); `covering` the protocol spellings that cover a SET
+ * (`mcp__srv`, `mcp__srv__*`, `mcp__srv__get_*`; on a denied list also `mcp__*` / `mcp__*__*`, which an allowed list reads as nothing).
  */
 export interface ToolNameListReach {
     readonly names: ReadonlySet<string>;
     readonly covering: readonly string[];
-    readonly wholeProtocols: ReadonlySet<ProtocolId>;
 }
 /**
  * The tool ONE entry of a list on `side` reaches ({@link readDeniedEntry}) — the one per-entry reading every list reader takes:
- * `Tool()` / `Tool(*)` are the bare `Tool` (`*()` / `*(*)` the wildcard `*`); a denied `Tool(content)` hides the whole `Tool`;
- * an allowed one, an unreadable entry or a non-string reaches nothing (`undefined`).
+ * `Tool()` / `Tool(*)` are the bare `Tool`; a denied `Tool(content)` hides the whole `Tool`; an allowed one, an unreadable entry
+ * or a non-string reaches nothing (`undefined`).
  */
 export declare function toolNameOfEntry(entry: unknown, side: ToolNameListSide): string | undefined;
 /**
- * Is this entry a bare tool name as the rule syntax reads it, written as such (`Read`, `mcp__srv__*`, `*`; never `Read()`,
- * `Read(*)`, `Read(x)`, an unreadable spelling or a non-string)? The one form a checkpoint row records and is read back in.
- */
+ * Is this entry a bare tool name as the rule syntax reads it, written as such (`Read`, `mcp__srv__*`, `*`; never `Read()` or
+ * `Read(x)`)? The one form a checkpoint row records and is read back in. */
 export declare function isCanonicalToolName(entry: unknown): boolean;
 /**
- * A tool-name list as a checkpoint row records it: each entry as {@link toolNameOfEntry} reads it, in canonical spelling, an
- * allowed entry that admits nothing left out — the copy reaches what the list reached, in the spelling a reader accepts
- * ({@link isCanonicalToolName}). An unreadable entry stays as written: prepare refuses it before the park, the reader again.
+ * A tool-name list as a checkpoint row records it: each entry as {@link toolNameOfEntry} reads it, in canonical spelling
+ * ({@link isCanonicalToolName}), an allowed entry that admits nothing left out. An unreadable entry stays as written: prepare
+ * refuses it before the park, the reader again.
  */
 export declare function persistedToolNameList(entries: readonly string[], side: ToolNameListSide): string[];
 /**
- * What an allowed-tools value admits, or `undefined` when it names no allowlist: absent, `null`, or a list holding the
- * wildcard — an entry {@link toolNameOfEntry} reads as `*` (`*`, `*()`, `*(*)`). A list admits its string entries (an entry that
- * is not a string admits nothing); a value that is not a list admits NOTHING — the judge before the run refuses it, and a
- * reader that meets it first fails closed.
+ * What an allowed-tools value admits, or `undefined` when it names no allowlist: absent, `null`, or a list holding the wildcard
+ * ({@link toolNameOfEntry} reads `*`, `*()`, `*(*)` as it). A value that is not a list admits NOTHING (refused before the run).
  */
 export declare function readAllowedToolList(allowTools: unknown): ToolNameListReach | undefined;
 /** What a denied value hides: its string entries read as {@link readDeniedEntry} reads them (an entry it reads as `unreadable` or not a string, or a value that is not a list, hides nothing here — the judgment before the run refuses each). */
@@ -132,17 +117,15 @@ export declare function isToolSelectorLayer(layer: unknown): layer is ToolSelect
 /**
  * Compile ONE run's tool selector from its layers (the ceiling it was spawned under, then its own lists — the LAST layer is its own)
  * and the kinds of leg it is. Each list is read by the one reading ({@link readAllowedToolList} / {@link readDeniedToolList}) and
- * matched by the one matcher ({@link listReaches}); a protocol tool of one of `legs` is admitted whatever the leg's own lists say —
- * and whatever the ceiling says too, unless a kind of its row shares its spawner's tool surface ({@link protocolRowUnderCeiling}):
- * the ceiling layers decide it. Whether a list may reach a protocol tool at all is judged at prepare. The layers are kept as handed —
- * the producer passes frozen copies of the lists it read.
+ * matched by the one matcher ({@link listReaches}); a protocol tool of one of `legs` is admitted whatever the leg's own lists say,
+ * and whatever the ceiling says unless a kind of its row shares its spawner's tool surface ({@link protocolRowUnderCeiling}), when
+ * the ceiling layers decide it. Whether a list may reach a protocol tool at all is judged at prepare.
  */
 export declare function compileToolSelector(layers: readonly ToolSelectorLayer[], legs?: readonly ToolLegKind[]): ToolSelector;
 /**
  * What a leg's tool valve leaves mounted — its one reading: nothing under the run's whole-face switch (`excludeAllTools`: every
  * tool unmounts, protocol tools included), else what the compiled selector admits. The valve unmounts by it, and every question
- * prepare asks about the post-valve roster before the valve runs (the full shell's reachability, the memory write channel, the
- * persistence verdict, the two memory pairs' planning) asks it too.
+ * prepare asks about the post-valve roster before the valve runs asks it too.
  */
 export declare function valveLeaves(spec: {
     readonly excludeAllTools?: true;
@@ -150,8 +133,8 @@ export declare function valveLeaves(spec: {
 /**
  * The valve's reading at the SERVER level — {@link valveLeaves} asked of a whole peer before any of its tools is known: can the valve
  * leave a tool of the peer `prefix` (`mcp__srv__`) at all? Nothing under the run's whole-face switch; else what the compiled selector's
- * lists can reach of the peer ({@link ToolSelector.admitsPeer} — read off the lists, never off what the server lists). A peer this
- * answers `false` for leaves no tool on the roster whatever it lists, so a run has no reason to dial it or to teach its instructions.
+ * lists can reach of the peer ({@link ToolSelector.admitsPeer}). A peer answered `false` leaves no tool on the roster, so a run has no
+ * reason to dial it or to teach its instructions.
  */
 export declare function valveLeavesPeer(spec: {
     readonly excludeAllTools?: true;

package/dist/agents/tool-filter.js

@@ -3,9 +3,8 @@ import { canonicalize, UNCANONICALIZABLE } from "../core/canonical-json.js";
 import { SPAWNER_SURFACE_LEG_KINDS } from "../core/tool-face.js";
 import { ruleSpellingOf } from "../core/permission-rule-syntax.js";
 import { TOOL_CATALOG_ENTRIES } from "../core/tool-catalog-entries.js";
-import { isNamespacedCoveringRuleName, namespacedRuleNameCovers } from "../core/namespaced-rule-name.js";
-import { protocolOf } from "../core/protocol-table.js";
-import { splitNamespacedName } from "../core/tool-name-aliases.js";
+import { isNamespacedCoveringRuleName, namespacedRuleNameCovers, namespacedRuleReachInto } from "../core/namespaced-rule-name.js";
+import { splitNamespacedName, wholeProtocolOf } from "../core/tool-name-aliases.js";
 import { readToolNameList, snapshotToolNameList, valueTypeLabel } from "../core/tool-name-list.js";
 export function readDeniedEntry(entry) {
     if (typeof entry !== "string")
@@ -72,23 +71,16 @@ export function persistedToolNameList(entries, side) {
 function reachOf(entries, side) {
     const names = new Set();
     const covering = [];
-    const wholeProtocols = new Set();
     for (const entry of entries) {
         const name = toolNameOfEntry(entry, side);
         if (name === undefined)
             continue;
-        const split = splitNamespacedName(name);
-        if (split !== undefined && split.tool === undefined && split.peer === "*") {
-            if (side === "denied")
-                wholeProtocols.add(split.ns.id);
-            continue;
-        }
-        if (isNamespacedCoveringRuleName(name))
+        if (isNamespacedCoveringRuleName(name, side === "denied" ? "deny" : "allow"))
             covering.push(name);
-        else
+        else if (wholeProtocolOf(name) === undefined)
             names.add(name);
     }
-    return { names, covering, wholeProtocols };
+    return { names, covering };
 }
 export function readAllowedToolList(allowTools) {
     if (allowTools === undefined || allowTools === null)
@@ -111,11 +103,6 @@ export function listReaches(reach, tool) {
         for (const pattern of reach.covering)
             if (namespacedRuleNameCovers(pattern, spelling))
                 return true;
-        if (reach.wholeProtocols.size > 0) {
-            const ns = protocolOf(spelling);
-            if (ns !== undefined && reach.wholeProtocols.has(ns.id))
-                return true;
-        }
     }
     return false;
 }
@@ -127,21 +114,11 @@ export function protocolToolNames(legs) {
     return [...new Set(PROTOCOL_ROWS.filter((r) => r.legs.some((l) => legs.includes(l))).map((r) => r.name))];
 }
 function reachTouchesPeer(reach, peer) {
-    if (reach.wholeProtocols.has(peer.ns))
-        return true;
-    const inPeer = (spelling) => {
-        const split = splitNamespacedName(spelling);
-        return split !== undefined && split.ns.id === peer.ns && split.peer === peer.peer;
-    };
-    return [...reach.names].some(inPeer) || reach.covering.some(inPeer);
+    const into = (spelling) => namespacedRuleReachInto(spelling, peer.ns, peer.peer) !== "none";
+    return [...reach.names].some(into) || reach.covering.some(into);
 }
 function reachCoversPeer(reach, peer) {
-    if (reach.wholeProtocols.has(peer.ns))
-        return true;
-    return reach.covering.some((pattern) => {
-        const split = splitNamespacedName(pattern);
-        return split !== undefined && split.ns.id === peer.ns && split.peer === peer.peer && (split.tool === undefined || split.tool === "*");
-    });
+    return reach.covering.some((pattern) => namespacedRuleReachInto(pattern, peer.ns, peer.peer) === "all");
 }
 export function isToolSelectorLayer(layer) {
     return typeof layer === "object" && layer !== null && !Array.isArray(layer);

package/dist/agents/verify.d.ts

@@ -7,13 +7,13 @@ import type { ModelRef, TaskResult, TaskSpec, TaskStatus, ToolSpec } from "../co
  * an implementation task and tries to BREAK it — read-only, evidence-required, returning a structured
  * verdict — then the gate loops fix→re-verify until PASS or a round cap.
  *
- * PROVENANCE (2026-07-14; re-verified and CORRECTED against CC 2.1.220): distilled and de-branded from the
+ * PROVENANCE (2026-07-14; re-verified and CORRECTED): distilled and de-branded from the
  * MIT-era upstream source's dedicated `verification` agent — which was an Anthropic-internal A/B experiment
- * (third-party default OFF) and has since been RETIRED upstream: 2.1.207 through 2.1.220 ship NO verification
+ * (third-party default OFF) and has since been RETIRED upstream: later releases ship NO verification
  * agent. The current upstream completion-gate shape is (a) the Stop hook (`decision:"block"` + reason fed
  * back — sema's Stop hook is at full parity) and (b) — corrected — NOT a bundled skill. There is no built-in
  * `verify` skill in the 220 corpus. What 220 ships is an INSTRUCTION TO CREATE ONE PER PROJECT: its memory
- * prompt (@190146 (cli250.js:38927)) forbids creating project skills ("never create one — a new project skill
+ * prompt forbids creating project skills ("never create one — a new project skill
  * silently shadows a same-named built-in skill") and makes exactly one exception — "The single exception is
  * verify, because how a project verifies changes is project-specific: put a verify correction in the
  * `.claude/skills/verify/ SKILL.md` closest to the code it covers … and if that file does not exist, create

package/dist/brain/anthropic.js

@@ -9,6 +9,7 @@ import { errorResultMediaNote, IMAGE_OMITTED_NO_VISION, modelSupportsVision, sen
 import { ANTHROPIC_RESERVED, OUTPUT_CAP_KEYS, applyExtraBody, effectiveOutputCap, headerBagOnce, lockHeader, mergeHeaders, takeHeaderCasefold } from "./request-params.js";
 import { admitRouteRequest, applyRouteCredentialHeaders, assertServableRequestRoot, brainConfigSnapshot, createBrainRouteJudge, joinRequestUrl, resolveRequestRootOf, resolveRouteCredential } from "./route-adjudicator.js";
 import { requestRouteOf } from "./request-route.js";
+import { NAMES_AS_WRITTEN, resolveProviderDialect, endpointToolNames } from "./provider-dialect.js";
 import { MIN_THINKING_TOKENS, budgetCapSkipsThinking, declaredEffortLevels, reasoningBudgetShare, reasoningRequestCarried, resolveEffort } from "./reasoning.js";
 import { runStreamingBrain } from "./stream-engine.js";
 import { refuseRetiredTimeoutKnobs } from "./timeout.js";
@@ -49,7 +50,7 @@ function toUserBlocks(content, supportsVision = true) {
         emitBrainTelemetry({ kind: "vision_placeholder", count: omitted });
     return blocks;
 }
-function toAnthropicMessages(ctx, model) {
+function toAnthropicMessages(ctx, model, toolNames) {
     const supportsVision = modelSupportsVision(model);
     const raw = [];
     let pendingDocs = [];
@@ -86,7 +87,7 @@ function toAnthropicMessages(ctx, model) {
                     blocks.push({ type: "text", text: c.text });
                 }
                 else if (c.type === "toolCall") {
-                    blocks.push({ type: "tool_use", id: providerToolCallId(c), name: c.name, input: c.arguments ?? {} });
+                    blocks.push({ type: "tool_use", id: providerToolCallId(c), name: toolNames.sent(c.name), input: c.arguments ?? {} });
                 }
             }
             raw.push({ role: "assistant", content: blocks.length ? blocks : [{ type: "text", text: NO_CONTENT }] });
@@ -155,12 +156,12 @@ function toAnthropicMessages(ctx, model) {
     }
     return merged;
 }
-function toAnthropicTools(ctx, cacheBreakpoints) {
+function toAnthropicTools(ctx, cacheBreakpoints, toolNames) {
     if (!ctx.tools || ctx.tools.length === 0) {
         return undefined;
     }
     return ctx.tools.map((t, i) => ({
-        name: t.name,
+        name: toolNames.sent(t.name),
         description: t.description,
         input_schema: t.parameters,
         ...(cacheBreakpoints && i === ctx.tools.length - 1 ? { cache_control: EPHEMERAL } : {}),
@@ -238,6 +239,7 @@ export function createAnthropicBrain(given = {}) {
         let thinkingRequested = false;
         let sentMaxTokens;
         let sentMaxTokensLane = "config-default";
+        let sentToolNames = NAMES_AS_WRITTEN;
         return runStreamingBrain({
             model,
             doFetch,
@@ -249,6 +251,8 @@ export function createAnthropicBrain(given = {}) {
             buildRequest: (overrides) => {
                 const routed = { id: model.id, baseUrl: model.baseUrl };
                 const { root, origin: rootOrigin } = resolveRequestRootOf(routed.baseUrl, config.baseUrl, ANTHROPIC_DEFAULT_BASE_URL);
+                const url = joinRequestUrl(root, "/v1/messages");
+                const builtToolNames = endpointToolNames(resolveProviderDialect(url, model.api), model.api, (context.tools ?? []).map((t) => t.name));
                 const modelHeaders = headerBagOnce(model.headers);
                 const optionsHeaders = headerBagOnce(options?.headers);
                 const routeCredential = resolveRouteCredential({
@@ -274,12 +278,12 @@ export function createAnthropicBrain(given = {}) {
                 const body = {
                     model: model.id,
                     max_tokens: overrides?.maxOutputTokens ?? options?.maxTokens ?? model.maxTokens ?? config.defaultMaxTokens ?? 4096,
-                    messages: toAnthropicMessages(context, model),
+                    messages: toAnthropicMessages(context, model, builtToolNames),
                     stream: true,
                 };
                 if (system)
                     body.system = system;
-                const tools = toAnthropicTools(context, cacheBreakpoints);
+                const tools = toAnthropicTools(context, cacheBreakpoints, builtToolNames);
                 if (tools)
                     body.tools = tools;
                 const anthCompat = (model.compat ?? {});
@@ -355,9 +359,9 @@ export function createAnthropicBrain(given = {}) {
                         : model.maxTokens !== undefined
                             ? "model"
                             : "config-default";
-                const { body: wire, dropped: extraBodyDropped } = applyExtraBody(body, model.extraBody, ANTHROPIC_RESERVED);
+                const { body: wire, dropped: extraBodyDropped } = applyExtraBody(body, model, ANTHROPIC_RESERVED);
                 return {
-                    url: joinRequestUrl(root, "/v1/messages"),
+                    url,
                     headers,
                     body: JSON.stringify(wire),
                     extraBodyDropped,
@@ -369,6 +373,7 @@ export function createAnthropicBrain(given = {}) {
                         thinkingRequested = builtThinkingRequested;
                         sentMaxTokens = builtMaxTokens;
                         sentMaxTokensLane = builtMaxTokensLane;
+                        sentToolNames = builtToolNames;
                         if (builtReasoningFacts !== undefined)
                             reportReasoningWireFacts(builtReasoningFacts);
                     },
@@ -540,7 +545,7 @@ export function createAnthropicBrain(given = {}) {
                             else if (cb.type === "tool_use") {
                                 acc.type = "tool_use";
                                 acc.toolId = cb.id ?? "";
-                                acc.toolName = cb.name ?? "";
+                                acc.toolName = sentToolNames.called(cb.name ?? "");
                             }
                             else {
                                 acc.type = "text";

package/dist/brain/errors.d.ts

@@ -256,6 +256,21 @@ export declare function abortLikeName(err: unknown): "AbortError" | "TimeoutErro
  *  rather than testing `instanceof BrainError`, which walks a chain a revoked proxy traps — and the one
  *  site that did so sits in an async IIFE with no `.catch`. */
 export declare function brainErrorCodeOf(e: unknown): BrainErrorCode | undefined;
+/** What a thrown brain failure says about itself in machine words: its code, and the structural input-too-long cause
+ *  its minter declared (or ruled out). Empty for a value that carries no brain code. */
+export interface ThrownBrainFailure {
+    readonly code?: BrainErrorCode;
+    readonly errorKind?: "input_too_long";
+    readonly inputTooLongRuledOut?: true;
+}
+/**
+ * The one reading of a thrown brain failure's structure: the code word ({@link brainErrorCodeOf}, never `instanceof`)
+ * and, only when the value carries a code, the input-too-long cause it was minted with — read by brand, so a value from
+ * another realm or behind a revoked proxy reads the same as a local `BrainError`. The stream engine's terminal shell and
+ * every caller that catches a brain call read it, so a failure that is thrown and one that is returned on a message
+ * carry the same facts.
+ */
+export declare function thrownBrainFailure(e: unknown): ThrownBrainFailure;
 /** Render a transport-level error WITHOUT folding away its cause chain: undici rejects with
  *  `TypeError("fetch failed", { cause })` where the CAUSE carries the actionable fact, and the shell
  *  alone reads the same for refused / DNS / mid-stream disconnect. Walks the chain (bounded), appending

package/dist/brain/errors.js

@@ -247,6 +247,16 @@ export function brainErrorCodeOf(e) {
     const code = readMember(e, "code");
     return typeof code === "string" && BRAIN_ERROR_CODES.includes(code) ? code : undefined;
 }
+export function thrownBrainFailure(e) {
+    const code = brainErrorCodeOf(e);
+    if (code === undefined)
+        return {};
+    if (readMember(e, "inputTooLong") === true)
+        return { code, errorKind: "input_too_long" };
+    if (readMember(e, "inputTooLongRuledOut") === true)
+        return { code, inputTooLongRuledOut: true };
+    return { code };
+}
 export function describeNetworkError(e) {
     const top = thrownText(e);
     const parts = [];

package/dist/brain/model-presets.d.ts

@@ -1,5 +1,5 @@
 /**
- * First-party model presets (design/119, CC 2.1.198 rebaseline).
+ * First-party model presets (design/119).
  *
  * sema stays caller-injects-`Model` by design (no baked catalog — the CC catalog/alias/family layer
  * is a product surface we deliberately don't carry). What IS worth shipping is the per-model
@@ -7,12 +7,12 @@
  * (adaptive thinking form, effort tiers, temperature rejection) that a wrong guess turns into a
  * hard 400. These presets are DATA, not mechanism — every field can be overridden by the caller.
  *
- * Pricing is deliberately NOT baked (CC 198 doesn't bake it either): `cost` defaults to zeros and a
+ * Pricing is deliberately NOT baked (the reference doesn't bake it either): `cost` defaults to zeros and a
  * deployment that wants cost accounting fills in the current official per-MTok rates.
  */
 import type { AnthropicMessagesCompat, Model } from "../internal/llm.js";
 /**
- * The Fable-5-class Anthropic wire contract (CC 2.1.198 capability bits, design/119 P0):
+ * The Fable-5-class Anthropic wire contract (capability bits, design/119 P0):
  * - `thinkingMode: "adaptive"` — `thinking: { type: "adaptive" }`, NO budget_tokens (400 on budget).
  * - `effortLevels` — the full five-tier `output_config.effort` range (fable-5 has `xhigh_effort` +
  *   `max_effort`; a model without those bits should declare a shorter list and higher requests clamp).
@@ -26,7 +26,7 @@ export declare const FABLE_5_COMPAT: AnthropicMessagesCompat;
  */
 export declare const FABLE_5_PROMPT_GUIDANCE: readonly string[];
 /**
- * A ready-to-use `claude-fable-5` {@link Model} (CC 2.1.198 registry facts: 1M-token native context
+ * A ready-to-use `claude-fable-5` {@link Model} (registry facts: 1M-token native context
  * window, 64k default max output — the 128k tier is opt-in via `maxTokens` override, knowledge
  * cutoff Jan 2026, `default_effort: "high"`). Override anything per deployment; set `cost` for
  * accounting (not baked — see module note).