@sema-agent/core 7.54.1 → 7.55.0

package/dist/core/allow-rule-shadow.d.ts

@@ -16,3 +16,10 @@ export interface AllowRuleShadow {
     readonly entries: readonly string[];
     readonly omitted?: number;
 }
+/** The allow-layer member that CLEARED a call's ask (`tool_end.gate.disposition.clearedBy`): the shadow record's shape — the member
+ *  and the entries it stood on, sanitized and capped by the same mint — plus, for a LIST member (`request`, `deployment`),
+ *  `positions`: the index of every element of the list the run received that is one of those entries (a string listed twice has
+ *  both indices), so a host reads which line of its own declaration spoke even where the shown text is capped. */
+export interface AllowRuleClearance extends AllowRuleShadow {
+    readonly positions?: readonly number[];
+}

package/dist/core/approval-object.d.ts

@@ -1,7 +1,7 @@
 import type { PendingAction } from "./checkpoint-store.js";
 import type { CallTargetReading } from "./effective-path-target.js";
 import { type SkillGrantSource } from "./skill-grant.js";
-import type { ToolCallPathTarget, ToolFamily } from "./tool-face.js";
+import type { ToolCallPathTarget, ToolFamily, ToolHostTarget } from "./tool-face.js";
 import { type ToolRosterEntry } from "./tool-roster.js";
 type ParkedApproval = Extract<PendingAction, {
     kind: "tool_approval";
@@ -24,6 +24,7 @@ export interface ApprovalTool {
     readonly implementationRevision?: string;
     readonly family?: ToolFamily;
     readonly pathTarget?: ToolCallPathTarget;
+    readonly hostTarget?: ToolHostTarget;
 }
 export interface ApprovalObject {
     /** Absent on a row minted before the identity members (all four absent): such a row binds the tool's name alone. */

package/dist/core/approval-object.js

@@ -5,10 +5,10 @@ import { toolIdentityOf } from "./tool-roster.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 export const APPROVAL_TARGET_ROLES = Object.freeze(["protective", "declared"]);
 export function approvalObjectOf(row) {
-    const { capabilityId, contractId, shapeDigest, implementationRevision, family, pathTarget, targets, boundGrantDigest } = row;
+    const { capabilityId, contractId, shapeDigest, implementationRevision, family, pathTarget, hostTarget, targets, boundGrantDigest } = row;
     const carried = [capabilityId, contractId, shapeDigest, implementationRevision].some((m) => m !== undefined);
     return {
-        ...(carried ? { tool: { capabilityId, contractId, shapeDigest, implementationRevision, family, pathTarget } } : {}),
+        ...(carried ? { tool: { capabilityId, contractId, shapeDigest, implementationRevision, family, pathTarget, hostTarget } } : {}),
         ...(targets !== undefined ? { targets } : {}),
         ...(boundGrantDigest !== undefined ? { grants: boundGrantDigest } : {}),
     };
@@ -30,9 +30,9 @@ export const APPROVAL_STATION_MEMBERS = Object.freeze({
 const IDENTITY_MEMBERS = Object.freeze(["capabilityId", "contractId", "shapeDigest", "implementationRevision"]);
 const shown = (s) => `"${inlineUntrusted(s, 240)}"`;
 const vetoed = (name, why) => `The approved tool call "${name}" was not executed: ${why}, so the approval does not cover it (resume.target_moved). This approval is spent — the call has to be re-issued: its new card shows what it would act on now.`;
-function faceKey(family, pt) {
+function faceKey(family, pt, ht) {
     const slot = pt === undefined ? null : { param: pt.param, access: pt.access, aliases: [...(pt.aliases ?? [])], base: pt.base ?? "cwd", absent: pt.absent ?? "none", patternParam: pt.patternParam ?? null, skillScopeEligible: pt.skillScopeEligible === true };
-    return canonicalize({ family: family ?? null, pathTarget: slot });
+    return canonicalize({ family: family ?? null, pathTarget: slot, hostTarget: ht === undefined ? null : { param: ht.param } });
 }
 function judgeTool(row, live) {
     const entry = live.tool;
@@ -47,9 +47,9 @@ function judgeTool(row, live) {
         const named = differ.map((k) => (bound[k] === undefined ? `${k} (missing on the row)` : k)).join(", ");
         return { member: "tool", disposition: "reopen", code: "resume.tool_contract_mismatch", message: `the approved tool "${row.toolName}" on this leg is not the tool the approval was minted against (${named} differ) — refusing to execute a replacement wearing the name; the checkpoint is reopened for a retry with the original tool present` };
     }
-    if (faceKey(bound.family, bound.pathTarget) === faceKey(entry.family, entry.pathTarget))
+    if (faceKey(bound.family, bound.pathTarget, bound.hostTarget) === faceKey(entry.family, entry.pathTarget, entry.hostTarget))
         return undefined;
-    return { member: "tool", disposition: "veto", code: "resume.target_moved", message: vetoed(row.toolName, "the tool's face (its display family or the path target it declares) changed after the approval") };
+    return { member: "tool", disposition: "veto", code: "resume.target_moved", message: vetoed(row.toolName, "the tool's face (its display family, or the path target or URL slot it declares) changed after the approval") };
 }
 function judgeTargets(row, live) {
     const bound = row.targets;

package/dist/core/ask-origin.d.ts

@@ -251,6 +251,18 @@ export declare function askMandateMember(ask: RuleClearanceFacts | undefined): {
     mandate?: PersistedRuleMandate;
     authoredBy?: "deployment";
 };
+/**
+ * A MANDATE merged onto an ask another layer raised — the one writer of both merge arms (the read station's, the reversibility
+ * probe's; `gate-fold.ts`). The mandate is the fact that a standing allow rule may not clear the ask, and its account is the only
+ * sentence that can say why (the allow layer's disclosure words a `probe_mandate` with it, on the card and in the parked row): the
+ * two travel together. The FIRST layer to mandate an ask brings its account, or none: a `probeReason` the ask arrived with can only
+ * be its own author's prose, and is replaced by the account — or removed where the mandating layer gave none, so it is never read as
+ * the reason the mandate stands; an ask already mandated keeps the first layer's. The ask's action, message, reason and every other
+ * disclosure are untouched.
+ */
+export declare function withProbeMandate<D extends Extract<PermissionResult, {
+    action: "ask";
+}>>(decision: D, account: string | undefined): D;
 /** The clearance facts of an ask the engine did not construct (a policy's verdict), each member read ONCE into
  *  an engine-owned value — for a station that keeps the answer past its own side effects, where the verdict's
  *  accessors must not run again. The members a verdict may carry that narrow what may clear it. */
@@ -300,8 +312,10 @@ export type RealApprovalTableCoversEveryOrigin = AssertAllKeysHandled<Exclude<As
  *
  *  - `operator_always` — the operator's `always` floor: per-call confirmation for shell commands.
  *  - `tool_marks` — the tool's own egress / irreversibility / interaction declaration.
- *  - `probe_mandate` — this call's reversibility probe declared the demotion STRUCTURAL.
- *  - `probe_unanswered` — the probe was consulted and did not answer: the boundary is UNKNOWN.
+ *  - `probe_mandate` — this call's reversibility probe declared the demotion STRUCTURAL. For the engine's own shell station it
+ *    is a FINDING about this call — a path outside the allowed directories (read or written) or a command whose reads it could
+ *    not establish — and the finding's account (the ask's `probeReason`) is the word's whole disclosure ({@link FINDING_ACCOUNT}).
+ *  - `probe_unanswered` — the probe was consulted and did not answer: whether the call is reversible is UNKNOWN.
  *  - `write_protection` — the table covers this write's target. A write onto load-executed configuration
  *    re-authorizes the agent, so the question is a property of the TARGET, not of anyone's hesitation.
  *  - `target_unresolved` — the reading of a written target could not say where it leads on disk:
@@ -314,11 +328,20 @@ export declare const PERSISTED_RULE_MANDATES: readonly ["operator_always", "tool
 export type PersistedRuleMandate = (typeof PERSISTED_RULE_MANDATES)[number];
 /** Membership test for {@link PersistedRuleMandate} — the screen a row reader applies to a stored word. */
 export declare function isPersistedRuleMandate(v: unknown): v is PersistedRuleMandate;
+/** The row of a word whose reason is a FINDING about this very call (what the read station found — a path outside the allowed
+ *  directories, read or written, or a command whose reads it could not establish): no sentence of the table can say which, so
+ *  the reason is the finding's own account — the sentence the station minted for the card, which the ask carries as
+ *  `probeReason` ({@link mandateDisclosureOf} reads it there). A row, not an absence: the word is disclosed, by the ask. */
+export declare const FINDING_ACCOUNT: Readonly<{
+    readonly reasonIs: "the account of the finding, carried on the ask as probeReason";
+}>;
 /** WHY a matching persisted allow rule did not clear the ask, in the sentence a PERSON reads — one row per
  *  word (the ladder this replaces ended in a catch-all arm). Display prose; nothing reads it back to decide. */
-declare const MANDATE_DISCLOSURE: {
-    readonly probe_mandate: "the reversibility check declared this call structurally gated (the built-in shell check raises this for a read outside the directories allowed for this session) — it is cleared by confirming this call, never by a standing allow rule";
-    readonly probe_unanswered: "the reversibility check did not answer for this call (it timed out or failed), so whether the call reads outside the directories allowed for this session is unknown — it is cleared by confirming this call, never by a standing allow rule";
+export declare const MANDATE_DISCLOSURE: {
+    readonly probe_mandate: Readonly<{
+        readonly reasonIs: "the account of the finding, carried on the ask as probeReason";
+    }>;
+    readonly probe_unanswered: "the reversibility check did not answer for this call (it timed out or failed), so whether the call is reversible is unknown — it is cleared by confirming this call, never by a standing allow rule";
     readonly operator_always: "this deployment mandates per-call confirmation for shell commands (shellGate: always)";
     readonly tool_marks: "this tool carries egress/irreversibility/interaction marks (a mandated confirmation a rule cannot clear)";
     readonly write_protection: "this write's target is on the deployment's write-protection table (the agent's own configuration is guarded one look per write) — it is cleared by confirming this call, never by a standing allow rule";
@@ -327,9 +350,18 @@ declare const MANDATE_DISCLOSURE: {
 };
 /** The fence over the disclosure table: `never` while every word has a row. */
 export type DisclosureTableCoversEveryMandate = AssertAllKeysHandled<Exclude<PersistedRuleMandate, keyof typeof MANDATE_DISCLOSURE>>;
-/** The disclosed reason for one word. `undefined` — no mandate — is the lane's OTHER refusal: a standing
- *  "ask me each time" rule matched, which outranks the remembered yes on its own. */
-export declare function mandateDisclosureOf(mandate: PersistedRuleMandate | undefined): string;
+/** The sentence for the lane's OTHER refusal — no mandate: a standing "ask me each time" rule matched, which outranks the
+ *  remembered yes on its own. */
+export declare const ASK_RULE_DISCLOSURE = "an explicit ask rule matched this call (a person's or the deployment's ask-me-each-time outranks a standing allow rule)";
+/**
+ * The disclosed reason for one word. `undefined` — no mandate — is the lane's OTHER refusal ({@link ASK_RULE_DISCLOSURE}).
+ * A word whose row is {@link FINDING_ACCOUNT} is disclosed by the ask's own account of its finding (`account`, the
+ * `probeReason` the ask carries) and by nothing else: with no account there is no sentence (`undefined`) — a word whose reason is
+ * a finding is never worded from a general statement, which would be true of one finding and false of the next. Every
+ * mandate the engine's own read station raises carries its account; an ask that arrives without one (a deployment probe that
+ * supplied no `reason`, a station the host mounted) is a mandate stated without a reason, and the card does not invent one.
+ */
+export declare function mandateDisclosureOf(mandate: PersistedRuleMandate | undefined, account?: string): string | undefined;
 /**
  * The mandate provenance of one call, judged from the SAME mark inputs the gate is driven with —
  * the WORD a mandated ask discloses for its marks (the class derivation reads the same marks as classes,
@@ -809,9 +841,25 @@ export declare function classifyAsk(d: Extract<PermissionResult, {
     action: "ask";
 }>, facts: AskClassFacts): AskClassification;
 /** The refusal the model reads when an ask reaches a run with no approver: the reference implementation's sentence
- *  (2.1.280) — the call did NOT run because this session has no approval surface — with the run's own fact beside it
+ *  the call did NOT run because this session has no approval surface — with the run's own fact beside it
  *  and the ask's prompt as what was requested. The gate appends the caller-side remedy. */
 export declare function headlessDenialMessage(toolName: string, askMessage: string): string;
+/**
+ * The refusal the model reads when the `dontAsk` permission mode refuses an ask (`deniedBy: "mode"`): the reference implementation's
+ * head (whose permission, which mode — with the ask's class beside it) and its guidance ({@link REFUSED_CAPABILITY_GUIDANCE}), then
+ * the way out, the ONE remedy function's `dontAsk` arm ({@link headlessApprovalRemedy}) — the same sentence a headless refusal's
+ * remedy is written by, so a mode refusal and a headless one say the way out in one voice. `ruleShape` is the shape of the allow
+ * rule that would speak for the call (`ruleShapeOf` under `allow`, the rule model's reading of the call's grammar). The sentence
+ * names where allow rules live in a person's words (a settings file, the request's or the deployment's allow list), never a seat
+ * of the library: a host reads the same answer off the denied disposition — `deniedBy: "mode"`, `mode`, and the folded
+ * `classes`, whose row ({@link foldArbitrationRow}) says `ruleMayClear` — and offers its own seat.
+ */
+export declare function dontAskRefusalMessage(input: {
+    readonly toolName: string;
+    readonly classification: AskClassification;
+    readonly coveredWrite: boolean;
+    readonly ruleShape: string;
+}): string;
 /** The state of the approver seat a remedy is written for: `absent` — no approver is wired for the leg; `unavailable` — one is
  *  wired and answered that nobody is reachable for this ask; `declared_none` — the run declared that nobody on it can be
  *  asked (`approvalReach: "none"`), whatever is wired. Absent in the input reads as `absent` (the posture the function was
@@ -832,6 +880,10 @@ export type HeadlessApproverSeat = "absent" | "unavailable" | "declared_none";
  * wire one; one wired that answered `unavailable` for this ask ⇒ make a person reachable through it (a wired approver is
  * never told to be wired); the run declared nobody can be asked ⇒ run it where a person can be, or park it. The refusal's tool text and the `delegation.ask_unresolvable` notice both carry this sentence —
  * they call this function, neither spells it.
+ * Under `dontAsk` (the mode answers no ask: {@link dontAskRefusalMessage} carries this arm) the one question is whether an allow
+ * rule may clear the ask — the folded row's `ruleMayClear`, the allow layer's own reading: yes ⇒ add an allow rule covering the
+ * call, in the tool's rule shape (`ruleShape`, the caller's reading of the call's grammar — never a rule minted for the call), or
+ * run under a mode with an approver; no ⇒ only a person can answer it.
  */
 export declare function headlessApprovalRemedy(input: {
     readonly mode: PermissionMode | undefined;
@@ -841,8 +893,9 @@ export declare function headlessApprovalRemedy(input: {
         readonly program: "cp" | "mv";
     };
     readonly approverSeat?: HeadlessApproverSeat;
+    readonly ruleShape?: string;
 }): string;
-/** The reference implementation's sentence (2.1.280) for a `cp` / `mv` the mode will not answer because it carries option
+/** The reference implementation's sentence for a `cp` / `mv` the mode will not answer because it carries option
  *  words — the approval card's message under `acceptEdits` and the head of the headless remedy. */
 export declare function fileCommandOptionsSentence(program: "cp" | "mv"): string;
 /** What the mode arbitration decided for one surviving ask. `ask` hands it on unchanged (park / approver); `accepted` is
@@ -890,4 +943,3 @@ export declare function arbitrateByMode(mode: PermissionMode, c: AskClassificati
 }, call?: {
     readonly fileCommand?: boolean;
 }): Arbitration;
-export {};

package/dist/core/ask-origin.js

@@ -57,6 +57,12 @@ export function askMandateMember(ask) {
     const authored = ask?.authoredBy === "deployment" ? { authoredBy: "deployment" } : {};
     return mandated ? { mandated: true, ...(mandate !== undefined ? { mandate } : {}), ...authored } : authored;
 }
+export function withProbeMandate(decision, account) {
+    if (decision.probeMandated === true)
+        return decision;
+    const { probeReason: _arrivedWith, ...rest } = decision;
+    return { ...rest, probeMandated: true, ...(account !== undefined ? { probeReason: account } : {}) };
+}
 export function ownedClearanceFacts(d) {
     const { mandated, requiresRealApproval, decisionReason, matchedAskRule, probeMandated, crossBoundaryMandated, authoredBy, foldedAskClasses } = d;
     return {
@@ -112,17 +118,22 @@ const PERSISTED_RULE_MANDATE_SET = new Set(PERSISTED_RULE_MANDATES);
 export function isPersistedRuleMandate(v) {
     return PERSISTED_RULE_MANDATE_SET.has(v);
 }
-const MANDATE_DISCLOSURE = {
-    probe_mandate: "the reversibility check declared this call structurally gated (the built-in shell check raises this for a read outside the directories allowed for this session) — it is cleared by confirming this call, never by a standing allow rule",
-    probe_unanswered: "the reversibility check did not answer for this call (it timed out or failed), so whether the call reads outside the directories allowed for this session is unknown — it is cleared by confirming this call, never by a standing allow rule",
+export const FINDING_ACCOUNT = Object.freeze({ reasonIs: "the account of the finding, carried on the ask as probeReason" });
+export const MANDATE_DISCLOSURE = {
+    probe_mandate: FINDING_ACCOUNT,
+    probe_unanswered: "the reversibility check did not answer for this call (it timed out or failed), so whether the call is reversible is unknown — it is cleared by confirming this call, never by a standing allow rule",
     operator_always: "this deployment mandates per-call confirmation for shell commands (shellGate: always)",
     tool_marks: "this tool carries egress/irreversibility/interaction marks (a mandated confirmation a rule cannot clear)",
     write_protection: "this write's target is on the deployment's write-protection table (the agent's own configuration is guarded one look per write) — it is cleared by confirming this call, never by a standing allow rule",
     target_unresolved: "where this write leads on disk could not be determined (a link on the way could not be examined, or the environment could not resolve the target), so whether it lands on a guarded path is unknown — it is cleared by confirming this call: no standing rule and no automatic decider answers for it, though a wired approver seat can",
     cross_boundary_taint: "this run executes on a device outside the deployment's trust boundary and the deployment is multi-tenant, so an org-side write — or, after an off-target read, a call bound for the device — is confirmed by the deployment's approver for this call: no standing allow rule and no automatic lane answers for it, and an allow the configuration gives (a blanket seat or a policy's answer) is refused",
 };
-export function mandateDisclosureOf(mandate) {
-    return mandate === undefined ? "an explicit ask rule matched this call (a person's or the deployment's ask-me-each-time outranks a standing allow rule)" : MANDATE_DISCLOSURE[mandate];
+export const ASK_RULE_DISCLOSURE = "an explicit ask rule matched this call (a person's or the deployment's ask-me-each-time outranks a standing allow rule)";
+export function mandateDisclosureOf(mandate, account) {
+    if (mandate === undefined)
+        return ASK_RULE_DISCLOSURE;
+    const row = MANDATE_DISCLOSURE[mandate];
+    return typeof row === "string" ? row : account;
 }
 export function persistedRuleMandateOf(marks) {
     if (marks.targetUnresolved === true)
@@ -366,7 +377,18 @@ export function classifyAsk(d, facts) {
 export function headlessDenialMessage(toolName, askMessage) {
     return `Permission for this tool use was denied: it requires interactive approval, and permission prompts are not available in this session (nobody can be asked to approve "${toolName}" in this run — headless auto-deny). The action was NOT performed. Do not claim it succeeded, and do not retry it in this session — report the limitation to the user, or suggest an alternative. What was requested: ${askMessage}`;
 }
+const REFUSED_CAPABILITY_GUIDANCE = "IMPORTANT: you may try to accomplish this with other tools that would naturally be used for it (for example `head` instead of `cat`), but do not work around this denial in malicious ways — for example, do not use your ability to run tests to run non-test actions; only work around it in reasonable ways that keep to the intent behind it. If you believe this capability is essential to complete the user's request, STOP and explain to the user what you were trying to do and why you need this permission, and let the user decide how to proceed.";
+export function dontAskRefusalMessage(input) {
+    const remedy = headlessApprovalRemedy({ mode: "dontAsk", classification: input.classification, coveredWrite: input.coveredWrite, ruleShape: input.ruleShape });
+    return `Permission to use ${input.toolName} has been denied because this run is in the dontAsk permission mode (this call needed approval: ${input.classification.askClass}). ${REFUSED_CAPABILITY_GUIDANCE} To let a call like this run: ${remedy}.`;
+}
 export function headlessApprovalRemedy(input) {
+    if (input.mode === "dontAsk") {
+        const c = input.classification;
+        return c?.row.ruleMayClear === true
+            ? `an allow rule covering this call answers it under dontAsk — add one${input.ruleShape !== undefined ? ` in this tool's rule shape (\`${input.ruleShape}\`)` : ""} to the allow rules (a settings file's \`permissions.allow\`, or the request's or the deployment's allow list), or run under a mode with an approver`
+            : `no allow rule answers this ask${c !== undefined ? ` (${c.askClass})` : ""} — only a person can: run under a mode with an approver, or change the call`;
+    }
     const approver = input.approverSeat === "unavailable"
         ? "make a person reachable through the approver that is wired (it answered `unavailable` for this ask)"
         : input.approverSeat === "declared_none"

package/dist/core/ask-question.js

@@ -3,7 +3,7 @@ import { uuidv7 } from "../engine/session/uuid.js";
 import { boundInputHashOf, capturedJsonOf } from "./canonical-json.js";
 import { defineTool, errorResult } from "./tools.js";
 import { delimitUntrusted, inlineUntrusted } from "./untrusted-text.js";
-import { toolFace } from "./tool-catalog-entries.js";
+import { mountRuleFace, toolFace } from "./tool-catalog-entries.js";
 import { thrownText } from "./thrown-value.js";
 import { heldBy } from "./tool-name-readings.js";
 export const ASK_USER_QUESTION_TOOL_NAME = "AskUserQuestion";
@@ -112,6 +112,7 @@ export function createAskUserQuestionTool(onQuestion, source, opts) {
     return defineTool({
         name: ASK_USER_QUESTION_TOOL_NAME,
         ...toolFace("ask-user-question"),
+        ruleFace: mountRuleFace("ask-user-question"),
         description: "Ask the user a structured multiple-choice question when you are genuinely stuck or a decision is " +
             "the user's to make (which approach, which of these). Provide 1-4 questions, each with 2-4 options " +
             "(label + description). Use sparingly — not for anything you can determine yourself from the code or " +
@@ -256,6 +257,11 @@ export function createAskUserQuestionTool(onQuestion, source, opts) {
             const untrustedParts = [];
             const answeredHeaders = new Set();
             const inlineSafe = (s) => inlineUntrusted(String(s), 300);
+            const echoLabel = (q, label, safe) => {
+                const place = q.options.findIndex((o) => o.label === label);
+                return place < 0 ? safe(label) : `[${place + 1}] ${safe(label)}`;
+            };
+            const asIs = (s) => s;
             const capNote = (s) => (s.length > 4000 ? s.slice(0, 4000) + "…" : s);
             let answers;
             try {
@@ -290,15 +296,15 @@ export function createAskUserQuestionTool(onQuestion, source, opts) {
                         chosen = chosen.slice(0, 1);
                     }
                     if (answeredHeaders.has(q.header)) {
-                        untrustedParts.push(`[${inlineSafe(q.header)}] duplicate answer (already answered): ${[...chosen, ...offList].join(" ")}`);
+                        untrustedParts.push(`[${inlineSafe(q.header)}] duplicate answer (already answered): ${[...chosen.map((s) => echoLabel(q, s, asIs)), ...offList].join(" ")}`);
                     }
                     else {
                         answeredHeaders.add(q.header);
-                        trustedLines.push(`- ${inlineSafe(q.header)}: ${chosen.length > 0 ? chosen.map(inlineSafe).join(", ") : "(no listed option selected)"}`);
+                        trustedLines.push(`- ${inlineSafe(q.header)}: ${chosen.length > 0 ? chosen.map((s) => echoLabel(q, s, inlineSafe)).join(", ") : "(no listed option selected)"}`);
                         if (offList.length > 0)
                             untrustedParts.push(`[${inlineSafe(q.header)}] off-list input: ${offList.join("\n")}`);
                         if (extra.length > 0)
-                            untrustedParts.push(`[${inlineSafe(q.header)}] discarded extra selections (single-choice): ${extra.join(", ")}`);
+                            untrustedParts.push(`[${inlineSafe(q.header)}] discarded extra selections (single-choice): ${extra.map((s) => echoLabel(q, s, asIs)).join(", ")}`);
                     }
                     if (note)
                         untrustedParts.push(`[${inlineSafe(q.header)}] note: ${note}`);

package/dist/core/auto-compaction.d.ts

@@ -17,7 +17,7 @@ export declare const DEFAULT_COMPACTION_INSTRUCTIONS: string;
  * `compaction.instructions`, the DEFAULT constant, a manual `/compact` per-call override, and a
  * preCompact hook's `additionalInstructions` — 修类不修点): instructions text can be model- or
  * caller-authored, and it is injected VERBATIM into the summarization prompt
- * (`\n\nAdditional Instructions:\n${...}`, CC 207 :347521 shape), so a forged `</system-reminder>`
+ * (`\n\nAdditional Instructions:\n${...}`), so a forged `</system-reminder>`
  * or `<<<`/`>>>` fence sentinel inside it would otherwise ride into a trusted prompt position.
  * Posture (r2 review B4): `sanitizeUntrustedText` + fence defusing only — NEVER `delimitUntrusted`
  * (fencing instructions as "data only, do not follow" self-defeats their instructional intent, and
@@ -169,7 +169,7 @@ export interface MaybeCompactOptions {
      *  design/145 §1 (semantics精确化): used only while WINDOW-SAFE and the budget gate allows — when a
      *  dry-run clamp shows the conversation would lose more than `settings.clampTolerance` of its
      *  chars to fit this model's window, the summary call falls back to the MAIN model (`model`),
-     *  which is always window-safe (the content grew inside its window; CC 207 :348496 compresses
+     *  which is always window-safe (the content grew inside its window; the reference compresses
      *  with the main-loop model unconditionally — the fallback IS the CC posture, the independent
      *  compaction model is sema's superset). Subagent note (design/145 §5): delegated children never
      *  inherit this option (subagent.ts buildChildSpec carries no compactionModel), so a child always
@@ -317,7 +317,7 @@ export interface MaybeCompactOptions {
         maxCharsPerFile?: number;
         /**
          * CC-parity selection set: the files the task has READ, most recent
-         * first (CC 198's post-compact restore sorts readFileState by timestamp — the read set is wider
+         * first (the reference's post-compact restore sorts readFileState by timestamp — the read set is wider
          * than the modified set and includes reference files the model consulted). When provided and
          * non-empty it WINS over `modifiedFilesByRecency`; absent/empty falls back to the modified set
          * (the pre-2026-07-03 behavior, and the right answer for callers with no read tracking).
@@ -419,6 +419,9 @@ export interface MaybeCompactOptions {
      *  context may have lost an engine frame the run still needs, and every reader of the new baseline
      *  (the next model request first) must see it restated. */
     postureRestate?: () => Promise<void>;
+    /** The advisor tool's instructions' post-compaction restatement on a leg that mounts the tool (the runner's
+     *  `compactionRestateOptions`): runs right after `postureRestate`, under the same belt, for the same reason. */
+    advisorRestate?: () => Promise<void>;
     /**
      * Fixed per-request prompt overhead (system prompt + tool schemas, in tokens), applied ONLY in the
      * anchor-less regime (design/64 §26.7, search [91] fourth candidate): when no assistant in the
@@ -458,7 +461,7 @@ export interface MaybeCompactOptions {
      * (`reused`) and feeds it back via this option; core treats `summaryProvider` as if absent for that one
      * boundary when `consecutiveProviderReuse >= maxConsecutiveProviderReuse`. Default `3`, a
      * SEMA choice — the earlier "(CC parity)" label was unsupported and is withdrawn (anchoring
-     * re-check 2026-08-23: CC 2.1.223 has no external summary provider and no reuse concept at all;
+     * re-check 2026-08-23: the reference has no external summary provider and no reuse concept at all;
      * its three 3s are the PTL retry cap `b$d`, the consecutive-compaction-failure breaker `C$d` and
      * the rapid-refill trip `Q3u`, none of them this). 3 is picked for the same reason those are: a
      * small bound on how long a degraded path may keep answering before the real one is forced.
@@ -801,8 +804,8 @@ export declare function countSummarizedCrossSessionMessages(branch: ReadonlyArra
  *      SEMA-ONLY DEFENSE, not a CC port — but the ORIGINAL justification for that label was wrong
  *      on both of its premises, and the corrected pair still supports it. (a) "CC's full compact
  *      keeps tail 0 and monotonically shrinks" describes the `GNo` branch, which a LOCAL threshold
- *      compaction never reaches (CC 2.1.223 `y9s` :432704 routes local passes to the reactive
- *      pipeline, which preserves the last group verbatim — `YMo` :399971, `s = 1` :399982); CC's
+ *      compaction never reaches (the reference routes local passes to the reactive
+ *      pipeline, which preserves the last group verbatim); the reference's
  *      default posture therefore has a keep-tail, exactly as ours does. (b) "CC has no
  *      request-layer trim" holds only for the MAIN conversation request: CC does own a
  *      keep-the-newest-groups-that-fit primitive (`UPb` :645223), whose only caller is the
@@ -819,7 +822,7 @@ export declare function nextTrimForceBackoff(prev: boolean, comp: {
     freedTokens?: number;
     naturalTrigger?: boolean;
 }, trimForced?: boolean): boolean;
-/** design/119 S3 (CC 198 rapid_refill_breaker): mutable per-task refill tracking state. */
+/** design/119 S3 (rapid_refill_breaker): mutable per-task refill tracking state. */
 export interface RapidRefillState {
     lastCompactionTurn: number;
     count: number;
@@ -827,7 +830,7 @@ export interface RapidRefillState {
 /** Fresh tracking state (no compaction seen yet). */
 export declare function createRapidRefillState(): RapidRefillState;
 /**
- * design/119 S3 (CC 2.1.198 rapid_refill_breaker, :229717/:476338): record that a compaction just
+ * design/119 S3 (rapid_refill_breaker): record that a compaction just
  * happened at `turn` and report whether the thrash breaker should TRIP. A compaction landing within
  * `minGapTurns` of the previous one is a "rapid refill"; `tripAt` consecutive rapid refills = the
  * context is dominated by incompressible content and further compaction only burns summary calls.

package/dist/core/auto-compaction.js

@@ -504,9 +504,11 @@ export async function maybeCompact(opts) {
         catch {
         }
     }
-    if (opts.postureRestate !== undefined) {
+    for (const restate of [opts.postureRestate, opts.advisorRestate]) {
+        if (restate === undefined)
+            continue;
         try {
-            await opts.postureRestate();
+            await restate();
         }
         catch {
         }

package/dist/core/auto-mode-arming.d.ts

@@ -18,7 +18,7 @@ export declare const AUTO_MODE_ARMING_RECIPE_VERSION = 2;
 export interface AutoModeArmingRecipe {
     /** {@link AUTO_MODE_ARMING_RECIPE_VERSION}. An unknown version is refused, never partially read. */
     v: number;
-    /** `buildAutoModePrompt` rule overrides for the four paired sections (omitted = CC defaults verbatim). */
+    /** `buildAutoModePrompt` rule overrides for the four paired sections (omitted = the defaults). */
     rules?: AutoModeRules;
     /** Settings-plane deny rules rendered into `<settings_deny_rules>`. */
     settingsDenyRules?: readonly string[];
@@ -37,7 +37,7 @@ export interface AutoModeArmingRecipe {
     /** Classify round-trip cap, ms. */
     timeoutMs?: number;
     /**
-     * The classifier DENIAL-LIMIT bounds (`RunnerDeps.autoMode.denialLimit`, CC 2.1.250 `FO`/`AKe`):
+     * The classifier DENIAL-LIMIT bounds (`RunnerDeps.autoMode.denialLimit`):
      * how many blocks the ancestor's classifier was allowed before a person had to look, and the window the
      * fallback ask ran under. A KNOB triple, not prompt body — every member is orderable, so the fold takes
      * the strictest of the two sides rather than refusing on a difference.

package/dist/core/auto-mode-defaults.d.ts

@@ -3,14 +3,14 @@
  * `RunnerDeps.autoMode.timeoutMs` is omitted. Sized for a self-hosted gateway, not a cloud API: a
  * thinking-by-default gateway answers a classification in 5–165 s (Qwen 3.8 p50 11–24 s, kimi and GLM p50
  * ~10 s), and queueing plus prefill of 2–5 min is a normal wait on such a gateway (`docs/TIMEOUTS.md`). 180 s
- * clears the slowest classification observed with margin; CC 2.1.259's per-attempt base is 60 s (`j7e`,
+ * clears the slowest classification observed with margin; the reference's per-attempt base is 60 s (
  * stretched to 120 s with prompt size). Worst-case walk = this × rungs (2) = 360 s. Where the leg has an
  * approval seat a rung that runs out of time costs a question to a person, not a refusal (see the gate's
  * classifier station).
  */
 export declare const AUTO_MODE_DEFAULT_TIMEOUT_MS = 180000;
 /**
- * The classifier call's transient retry budget — the reference implementation's short ladder (2.1.280 `J9e = 4`): a
+ * The classifier call's transient retry budget — the reference implementation's short ladder: a
  * provider error (an HTTP 5xx, a dropped connection) is retried this many times inside the rung's budget, then the rung
  * reports `unavailable` / `error`. Where the leg has an approval seat that question goes to a person, so a long ladder
  * would only make the person wait out the rung's budget and hear "timed out" for a failure that was not one.
@@ -52,8 +52,8 @@ export declare const AUTO_MODE_CLASSIFIER_MAX_TOKENS = 256;
  * which on a default-on gateway is a think). The seat pays for the least the wire can grade plus the verdict,
  * never for an open-ended budget.
  *
- * 2048 is anchored twice: CC 2.1.259 `MU` adds exactly this many tokens to the verdict cap for a model in
- * its `rejects_disabled_thinking` family (2.1.250 `E4`/`BHe`); and it is 2 × `MIN_THINKING_TOKENS` (1024), so
+ * 2048 is anchored twice: the reference adds exactly this many tokens to the verdict cap for a model in
+ * its `rejects_disabled_thinking` family; and it is 2 × `MIN_THINKING_TOKENS` (1024), so
  * on the anthropic BUDGET path a HARD cap of 256 + 2048 clears the cap-wins skip (`budgetCapSkipsThinking`)
  * and hosts a legal `low` budget (`1024 ≤ budget_tokens < max_tokens`) without the brain having to raise a
  * cap it refuses to raise. Live 2026-09-15: deepseek's default think fits it ~90–100% of the time; the tail
@@ -62,8 +62,8 @@ export declare const AUTO_MODE_CLASSIFIER_MAX_TOKENS = 256;
  */
 export declare const AUTO_MODE_CLASSIFIER_LOW_REASONING_BUDGET_TOKENS = 2048;
 /**
- * The RE-ASK seat's allowance — the room a rung gets ONCE after its first attempt produced no verdict: CC
- * 2.1.259's stage-2 classifier cap (`max_tokens: 8192 + bn`). Live 2026-09-15 the thinking tail that overruns
+ * The RE-ASK seat's allowance — the room a rung gets ONCE after its first attempt produced no verdict: the reference's
+ * stage-2 classifier cap (`max_tokens: 8192 + bn`). Live 2026-09-15 the thinking tail that overruns
  * 2048 (deepseek 1–2 of 20, some past 4096; Qwen up to 6k) sits under it. One re-ask, never a loop.
  */
 export declare const AUTO_MODE_CLASSIFIER_THINK_BUDGET_TOKENS = 8192;
@@ -78,14 +78,14 @@ export declare const AUTO_MODE_CLASSIFIER_CONTRACT_BROKEN_AFTER = 2;
  *  recipe canonicalizer needs its VALUE and must not load the assembly face (and its SHA-locked assets)
  *  to get it; `auto-mode-prompt.js` re-exports it, so the public name and its module face are unchanged. */
 export declare const AUTO_MODE_DEFAULTS_SENTINEL = "$defaults";
-/** CC 2.1.250 `FO = {maxConsecutive: 3, maxTotal: 20}` — the classifier DENIAL LIMITS applied when
+/** The classifier DENIAL LIMITS applied when
  *  `RunnerDeps.autoMode.denialLimit` omits a bound. Count-then-judge: the block that reaches a bound is
  *  itself the one that falls back to a person (the 3rd consecutive block asks; the 20th total asks). */
 export declare const AUTO_MODE_DENIAL_LIMIT_DEFAULTS: Readonly<{
     maxConsecutive: number;
     maxTotal: number;
 }>;
-/** CC 2.1.250 `AKe = 120000` — the fallback ask's auto-deny window (ms) when `autoDenyAfterMs` is omitted.
+/** The fallback ask's auto-deny window (ms) when `autoDenyAfterMs` is omitted.
  *  `0` disarms the window (the ask waits on the approver alone — the upstream original "fall back to
  *  prompting" shape). */
 export declare const AUTO_MODE_DENIAL_AUTO_DENY_DEFAULT_MS = 120000;

package/dist/core/auto-mode-prompt-assets.d.ts

@@ -1,10 +1,10 @@
-/** The auto-mode classifier SYSTEM prompt shell (CC 2.1.207 `auto_mode_system_prompt`, with consent-bar
- *  principle 7 at its CC 2.1.291 text — see the header note).
+/** The auto-mode classifier SYSTEM prompt shell (`auto_mode_system_prompt`, with consent-bar
+ *  principle 7 at its later text — see the header note).
  *  Contains two assembly placeholders consumed by `buildAutoModePrompt`: `<permissions_template>`
  *  (replaced by the permissions document) and `<cross_session_messages_rule>` (replaced with "" —
  *  the 206/207 default). */
 export declare const AUTO_MODE_BASE_PROMPT: string;
-/** The external permissions document (CC 2.1.207 `permissions_external`). Four PAIRED placeholder
+/** The external permissions document (`permissions_external`). Four PAIRED placeholder
  *  tags wrap the DEFAULT rule sets (environment / hard deny / soft deny / allow) and one UNPAIRED tag
  *  (`<settings_deny_rules>`) marks the settings-plane deny injection point — all consumed by
  *  `buildAutoModePrompt` with the CC-exact merge semantics (user rules REPLACE the defaults; the

package/dist/core/auto-mode-prompt.d.ts

@@ -7,7 +7,7 @@ import type { Message } from "../internal/llm.js";
 export { AUTO_MODE_DEFAULTS_SENTINEL } from "./auto-mode-defaults.js";
 /** Deployment-authored rule overrides for the four paired sections of the permissions document.
  *  Each entry is ONE rule (rendered as a `- ` bullet); omit a field (or pass an empty array) to keep
- *  the CC default rules for that section verbatim. */
+ *  the default rules for that section. */
 export interface AutoModeRules {
     allow?: readonly string[];
     softDeny?: readonly string[];

package/dist/core/auto-mode.d.ts

@@ -16,7 +16,7 @@ export declare function isAutoModeUnavailableCause(v: unknown): v is AutoModeUna
  * HOW a reply failed to carry a verdict — the closed set behind `parse_error.form`. `missing` = the reader found
  * NO answer (empty text, prose, an answer only inside a thinking block); `conflict` = it found TWO distinct
  * `<block>` answers (raw or thinking-stripped). The split decides who gets a SECOND ATTEMPT at the same
- * question, on both seats that offer one: a missing answer is asked for again (CC 2.1.259 `Vrr` re-asks an
+ * question, on both seats that offer one: a missing answer is asked for again (the reference re-asks an
  * unparseable reply) and handed on to the next candidate ({@link rungDidNotRule}); a conflict gets neither —
  * it carries a `yes`, and any second attempt that answered `no` would erase it. One rule, two seats: whatever
  * a re-ask may not overwrite, a later rung may not overwrite either. Not on any wire face; the trace frame and
@@ -157,7 +157,7 @@ export declare function autoModeRoundNotAsked(reason: unknown): Error & {
  */
 export declare function rungDidNotRule(v: AutoModeVerdict): AutoModeFallbackCause | undefined;
 /**
- * The model-facing deny text for an `unavailable` verdict — CC 2.1.250 `x1t`, with the parenthetical `EIt`
+ * The model-facing deny text for an `unavailable` verdict — with the parenthetical
  * spells for the causes this engine distinguishes (a wall-clock / connection timeout reads " (timed out)";
  * an unknown kind reads nothing). The subject is the classifier itself rather than a model id: without a
  * candidate ladder the decider cannot vouch for a name. One writer for every deny site. ROOT CAUSE, when
@@ -173,8 +173,8 @@ export declare function classifierUnavailableDenyMessage(toolName: string, cause
  */
 export declare function classifierNoRulingAskMessage(askText: string, cause: AutoModeFallbackCause): string;
 /**
- * The model-facing deny text for a `parse_error` verdict — CC 2.1.259 `i7t` stem ("Auto mode could not evaluate
- * this action and is blocking it for safety"; 2.1.250 `Ure`): the classifier answered, but not with a verdict,
+ * The model-facing deny text for a `parse_error` verdict — stem ("Auto mode could not evaluate
+ * this action and is blocking it for safety"): the classifier answered, but not with a verdict,
  * and auto mode blocks what it could not evaluate. With a candidate ladder wired the tail NAMES the model whose
  * reply carried no verdict (`attribution.modelUsed`) — a declared departure from upstream, whose card names no
  * model: the person reading this card is the one who can change the catalog, and on a single-model deployment
@@ -183,8 +183,8 @@ export declare function classifierNoRulingAskMessage(askText: string, cause: Aut
  */
 export declare function classifierParseFailureDenyMessage(attribution?: AutoModeClassifierRound): string;
 /**
- * Parse the classifier's output contract — the CC 2.1.259 verdict reader (`MTt`, its thinking strip `QTt`, its
- * reason reader `TTt`; unchanged from 2.1.250 `wCe`/`xCe`/`yCe`), plus ONE arm of sema's own:
+ * Parse the classifier's output contract — the verdict reader (with its thinking strip and its
+ * reason reader), plus ONE arm of sema's own:
  *   blocked: `<block>yes</block><category>Rule Name</category><reason>[Rule Name] …</reason>`
  *   allowed: `<block>no</block>`
  *
@@ -212,7 +212,7 @@ export declare function classifierParseFailureDenyMessage(attribution?: AutoMode
  * line from the tool name in that case. Downgrading a stated block to `parse_error` would lose the
  * classifier's explicit verdict on the exact calls it flagged.
  *
- * `parse_error` is fail-closed: the gate handles it as a BLOCK (CC 2.1.259's own outcome for a reply with no
+ * `parse_error` is fail-closed: the gate handles it as a BLOCK (the reference's own outcome for a reply with no
  * verdict) that the denial limit counts like any other — never a silent allow, and never a question handed
  * to a person on the classifier's behalf.
  */
@@ -340,8 +340,15 @@ export interface DenialLimitCounts {
     /** Total blocks this run INCLUDING the one that tripped the bound (read before the total-bound reset). */
     readonly total: number;
     /** Which bound tripped. */
-    readonly limit: "consecutive" | "total";
+    readonly limit: DenialLimitBound;
 }
+/** The two denial bounds, spelled once: {@link DenialLimitBound} is derived from this tuple, and every reader of a
+ *  stored or foreign fallback member judges its `limit` word through {@link isDenialLimitBound}. */
+export declare const DENIAL_LIMIT_BOUNDS: readonly ["consecutive", "total"];
+/** Which denial bound tripped: `consecutive` blocks in a row, or the run's `total`. */
+export type DenialLimitBound = (typeof DENIAL_LIMIT_BOUNDS)[number];
+/** Whether a value is one of {@link DENIAL_LIMIT_BOUNDS} — the screen a reader applies to a stored `limit` word. */
+export declare function isDenialLimitBound(v: unknown): v is DenialLimitBound;
 /**
  * The DECISION-layer member of a denial-limit fallback ask (`PermissionResult` ask arm): the counts
  * that tripped the bound, and NOTHING about a window. A window is a fact of the ask's ROUTE — a live
@@ -386,7 +393,8 @@ export type DenialLimitFallbackFace = UnarmedDenialLimitFallback | DenialLimitFa
  * finite non-negative window), nothing else carried. A deployment-written row (a checkpoint store is a
  * host's) can hold any shape; the faces that echo it (the inbox summary) read through here, so a bad
  * shape reads as ABSENT rather than reaching a consumer as a malformed card. Not a parser of intent —
- * `"3"` is not 3.
+ * `"3"` is not 3. The value is a plain record (no member comes from a prototype it was given); each member is read once,
+ * in declaration order, and the answer is the values judged.
  */
 export declare function readDenialLimitFallback(v: unknown): DenialLimitFallback | undefined;
 /** The window-less route's member, spelled in ONE place: every station that hands a fallback somewhere

package/dist/core/auto-mode.js

@@ -1,6 +1,7 @@
 import { AUTO_MODE_DEFAULT_TIMEOUT_MS, AUTO_MODE_DENIAL_AUTO_DENY_DEFAULT_MS, AUTO_MODE_DENIAL_LIMIT_DEFAULTS } from "./auto-mode-defaults.js";
 import { thrownIs } from "./thrown-value.js";
 import { describeRejectedValue } from "./tool-search-setting.js";
+import { isPlainRecord } from "./mods/kernel/receive.js";
 export const AUTO_MODE_UNAVAILABLE_CAUSES = Object.freeze(["error", "timeout"]);
 const AUTO_MODE_UNAVAILABLE_CAUSE_SET = new Set(AUTO_MODE_UNAVAILABLE_CAUSES);
 export function isAutoModeUnavailableCause(v) {
@@ -312,16 +313,18 @@ class AutoModeTimeout extends Error {
     }
 }
 const isAutoModeTimeout = (e) => thrownIs(e, AutoModeTimeout);
+export const DENIAL_LIMIT_BOUNDS = Object.freeze(["consecutive", "total"]);
+export function isDenialLimitBound(v) {
+    return DENIAL_LIMIT_BOUNDS.some((bound) => v === bound);
+}
 export function readDenialLimitFallback(v) {
-    if (typeof v !== "object" || v === null)
+    if (!isPlainRecord(v))
         return undefined;
-    const o = v;
     const count = (x) => typeof x === "number" && Number.isFinite(x) && x >= 0;
-    if (!count(o["consecutive"]) || !count(o["total"]) || !count(o["autoDenyAfterMs"]))
-        return undefined;
-    if (o["limit"] !== "consecutive" && o["limit"] !== "total")
+    const [consecutive, total, limit, autoDenyAfterMs] = [v["consecutive"], v["total"], v["limit"], v["autoDenyAfterMs"]];
+    if (!count(consecutive) || !count(total) || !count(autoDenyAfterMs) || !isDenialLimitBound(limit))
         return undefined;
-    return { consecutive: o["consecutive"], total: o["total"], limit: o["limit"], autoDenyAfterMs: o["autoDenyAfterMs"] };
+    return { consecutive, total, limit, autoDenyAfterMs };
 }
 export function unarmedWindow(fallback) {
     return { ...countsOf(fallback), autoDenyAfterMs: 0 };