@sema-agent/core 7.54.1 → 7.56.0

package/dist/core/allow-entry.d.ts

@@ -1,3 +1,4 @@
+import type { EditRewritten } from "./rewrite-rejudge.js";
 import { type RuleToolNameVerdict } from "./tool-name-aliases.js";
 import type { ToolCallRequest } from "./tool-policy.js";
 import { type AllowRuleMember, type AllowRuleShadow } from "./allow-rule-shadow.js";
@@ -46,14 +47,15 @@ export type AllowEntryInert = {
     readonly entry: string;
     readonly reason: AllowEntryInertReason;
 } & AllowEntryInertDetail;
-/** One entry the grammar reads (kind closed): a whole non-shell tool; a protocol namespace; the whole shell tool; and one
- *  kind per rule grammar (`ruleToolGrammarOf`) — a shell command rule, a path rule, a name rule, a host rule — each the row
- *  the persisted grammar parses, its `behavior` the list's direction. */
+/** One entry the grammar reads (kind closed): a whole non-shell tool; a covering spelling — a set of tool names
+ *  ({@link isCoveringRuleName}: a protocol peer, a glob over a protocol name's tool segment, and on a deny list a `*` anywhere in
+ *  the name, `*` alone every tool); the whole shell tool; and one kind per rule grammar (`ruleToolGrammarOf`) — a shell command
+ *  rule, a path rule, a name rule, a host rule — each the row the persisted grammar parses, its `behavior` the list's direction. */
 export type CompiledAllowEntry = {
     readonly kind: "tool";
     readonly name: string;
 } | {
-    readonly kind: "namespace";
+    readonly kind: "covering";
     readonly pattern: string;
 } | {
     readonly kind: "shell";
@@ -108,15 +110,13 @@ export type RuleEntryReading = {
  * grammar alone is read — what a resume's pre-claim screen can read before the leg has a roster.
  */
 export declare function readRuleEntry(raw: unknown, behavior: "allow" | "deny", roster?: ReadonlySet<string>): RuleEntryReading;
-/** The tool name a compiled entry speaks for — its tool, its namespace spelling, or its rule's tool (what a name audit reads). */
+/** The tool name a compiled entry speaks for — its tool, its covering spelling, or its rule's tool (what a name audit reads). */
 export declare function compiledEntryName(compiled: CompiledAllowEntry): string;
 /**
- * Compile one list WHOLE through {@link readRuleEntry}: the entries it reads and the ones it reads as nothing (each with its
- * reason and, for a name the roster refuses, the judgment's word and the spelling to write). An allow list holding `*` voids
- * the list (every other entry on it reads as nothing too: the list grants nothing — the safe direction) — `*` as the lenient
- * rule parser names it ({@link namesWholeRoster}), so an entry the stricter entry grammar refuses (`* (*)`) still voids. A
- * `*` on a deny list reads as nothing by itself and the rest of that list still refuses: a deny list never loses an entry to
- * a wildcard beside it. `roster` as in {@link readRuleEntry}.
+ * Compile one list through {@link readRuleEntry}, entry by entry: the entries it reads and the ones it reads as nothing (each
+ * with its reason and, for a name the roster refuses, the judgment's word and the spelling to write). No entry changes how
+ * another is read: a `*` on an allow list grants nothing by itself (`wildcard_all`) and the entries beside it keep their
+ * reading; on a deny list it refuses every tool. `roster` as in {@link readRuleEntry}.
  */
 export declare function compileAllowList(entries: readonly string[], behavior: "allow" | "deny", roster?: ReadonlySet<string>): {
     rows: Array<{
@@ -126,7 +126,7 @@ export declare function compileAllowList(entries: readonly string[], behavior: "
     inert: AllowEntryInert[];
 };
 /** The programs whose open allow rule the reference implementation drops in auto mode — its interpreter / launcher table
- *  plus the shells and the run-anything builtins (2.1.280). A program that only reaches the network is not here. */
+ *  plus the shells and the run-anything builtins. A program that only reaches the network is not here. */
 export declare const AUTO_STRIPPED_PROGRAMS: readonly ["python", "python3", "python2", "node", "deno", "tsx", "ruby", "perl", "php", "lua", "npx", "bunx", "npm run", "yarn run", "pnpm run", "bun run", "bash", "sh", "ssh", "zsh", "fish", "eval", "exec", "env", "xargs", "sudo"];
 /**
  * Does auto mode strip this allow entry for this call (see the module doc)? Read for every rule-shaped member — a list
@@ -163,17 +163,23 @@ export declare function uncoveredCommandSegment(rows: readonly AllowEntryRow[],
  * segment covered by a row — or, for a `grant` list, read-only by itself); deny: a row whose program run the call performs (the
  * wide tightening reading; a call that cannot be read against the row is refused too). PATH — the persisted path adjudication
  * (allow: the narrow reading, every view of the target inside what the row names; deny: any view reaching it). NAME / DOMAIN —
- * the one predicate of each (the name the call names, the host it fetches); a keyed tool's call naming no value for its key is
- * refused by a deny list's row of the key and granted by no allow row (the persisted walk's reading, `keyedValueAbsentReason`).
+ * the one predicate of each (the name the call names, the host it reaches — a deny row read on the protective reading, an allow
+ * row on the tool's own declared slot, `callHostTargetOf`; a mounted name tool's value resolved against the agent types the call's
+ * face carries, `nameRuleReach`); a closed-set tool's call naming no value is refused by a deny list's row of the tool and granted
+ * by no allow row (the persisted walk's reading, `nameValueAbsentReason`), a mounted tool's call whose face carries no values is
+ * refused by a deny list's row of the tool and granted by no allow row, and a call whose host cannot be read is refused by a deny
+ * list's host row and granted by no allow row (`adjudicatePersistedDomainRules`).
  */
 export declare function judgeAllowEntries<R extends AllowEntryRow>(rows: readonly R[], req: ToolCallRequest, behavior: "allow" | "deny", ctx: AllowEntryJudgeContext, posture?: AdmissionPosture): readonly R[] | undefined;
 /** The allow rows of a list, as the allow layer reads them in `mode`: the strip applied BEFORE the match (in `auto`). */
 export declare function allowingRows<R extends AllowEntryRow>(rows: readonly R[], req: ToolCallRequest, mode: PermissionMode | undefined): readonly R[];
 /** The two sources {@link AllowEntryTable} holds (a skill's list is the skill table's). */
 export type AllowEntrySource = "request" | "deployment";
-/** What spoke for a call: the entries it stands on, as the list spells them. */
+/** What spoke for a call: the entries it stands on, as the list spells them, and — for entries of the list the run received —
+ *  the index of every element of that list that is one of them (a string listed twice has both). */
 export interface AllowEntryHit {
     readonly entries: readonly string[];
+    readonly positions?: readonly number[];
 }
 /** The face the gate reads one entry list through. */
 export interface AllowEntryLane {
@@ -208,9 +214,16 @@ export interface AllowEntryGateSeats {
 export declare class AllowEntryTable {
     private held;
     private readonly heldEntries;
+    /** Each entry of the list the run RECEIVED for this source, with its indices in that list — what a hit's `positions` read. */
+    private receivedAt;
     /** Write a list's rows (a row already held is not held twice). Returns the entries that read as nothing. `roster` as in
-     *  {@link readRuleEntry}: a list the leg itself wrote is read against it, a carried one (a delegating parent's capture) is not. */
-    seed(entries: readonly string[], roster?: ReadonlySet<string>): readonly AllowEntryInert[];
+     *  {@link readRuleEntry}: a list the leg itself wrote is read against it, a carried one (a delegating parent's capture) is not.
+     *  `received`: this list is the one the run received for the source (the request's `TaskSpec.allowedTools`, the deployment's
+     *  `RunnerDeps.allowedTools`), the list a hit's positions are read in; a carried capture is not. */
+    seed(entries: readonly string[], reading?: {
+        readonly roster?: ReadonlySet<string>;
+        readonly received?: true;
+    }): readonly AllowEntryInert[];
     /** The entries held, as written (a copy) — what a delegated child is handed. */
     entries(): readonly string[];
     /** Does the table hold a path row — must the leg read each call's target views for it? */
@@ -245,21 +258,36 @@ export declare function withDeploymentAllowedTools<D extends {
 }>(deps: D): D;
 /** The code a list value that is not a list of strings refuses with — the policy compiler's family, with its issues. */
 export declare const INVALID_PERMISSION_RULES_CODE = "config.invalid_permission_rules";
+/** The two seats an allow list is handed over at — the library coordinates the refusal carries as `libraryOption`, each with the
+ *  words the sentence says instead. */
+declare const ALLOW_LIST_SEATS: {
+    readonly "TaskSpec.allowedTools": "the request's allow list";
+    readonly "RunnerDeps.allowedTools": "the deployment's allow list";
+};
+type AllowedToolsSeat = keyof typeof ALLOW_LIST_SEATS;
 /**
- * Screen and snapshot one `allowedTools` value (`seat` names the key in the refusal): absent ⇒ undefined; a list of strings
- * ⇒ a frozen copy (the one read every later reader takes); anything else refuses loudly with
- * {@link INVALID_PERMISSION_RULES_CODE} and an issue per defect — never dropped, never read as "no entries".
+ * Screen and snapshot one `allowedTools` value (`seat` is the seat it was handed at; the sentence says it in words, the issues'
+ * `libraryOption` names it): absent ⇒ undefined; a list of strings ⇒ a frozen copy (the one read every later reader takes);
+ * anything else refuses loudly with {@link INVALID_PERMISSION_RULES_CODE} and an issue per defect — never dropped, never read
+ * as "no entries".
  */
-export declare function screenAllowedToolsValue(value: unknown, seat: string): readonly string[] | undefined;
+export declare function screenAllowedToolsValue(value: unknown, seat: AllowedToolsSeat): readonly string[] | undefined;
 /** The disclosure record for one member, minted from the entries it matched: each sanitized (deployment or model-authored
  *  text on a human trust boundary) and capped, the rest counted. */
 export declare function allowRuleShadowOf(member: AllowRuleMember, entries: readonly string[]): AllowRuleShadow;
+/** A disclosure list with one more member's record folded in: ONE record per member — a member already disclosed gains the
+ *  other record's entries after its own (every speaking, in reading order: two shown names that read alike are two speakers),
+ *  the cap kept and the rest counted; any other member is appended. Records are minted values already ({@link allowRuleShadowOf}). */
+export declare function withAllowRuleShadow(list: readonly AllowRuleShadow[], shadow: AllowRuleShadow): AllowRuleShadow[];
 /** Read a disclosure value off a decision WITHOUT trusting it (a policy's own value, an ancestor's): every record a known
  *  member with a list of strings, or nothing — a display member must never throw where a card is minted. */
 export declare function readAllowRuleShadows(value: unknown): readonly AllowRuleShadow[] | undefined;
-/** Why a matched entry did not clear the ask, by the ask's class — one row per class, so a class added later is a
- *  compile error here rather than somebody else's reason on the card. Two facts the ask carries are read first, because
- *  they name the reason more exactly than a class shared by several: a table word (`mandate` — the exact mark) and the
+/** The ask class whose reason is not a row: `probe` is the class of a FINDING about this very call (the read station's, or a
+ *  probe's), and only the ask's own account of it — its `probeReason` — can say which ({@link allowRuleShadowSentence}). */
+export type AccountedClass = "probe";
+/** Why a matched entry did not clear the ask, by the ask's class — one row per class that has a reason of its own, so a class
+ *  added later is a compile error here rather than somebody else's reason on the card. Two facts the ask carries are read first,
+ *  because they name the reason more exactly than a class shared by several: a table word (`mandate` — the exact mark) and the
  *  deployment's own authorship (`authoredBy`) — {@link allowRuleShadowSentence} is the reader that applies that order.
  *  Exported (frozen) so a host that renders the card's "why it cannot be cleared" half reads the engine's row, never a copy. */
 export declare const SHADOW_REASON: Readonly<{
@@ -272,26 +300,25 @@ export declare const SHADOW_REASON: Readonly<{
     readonly transcript_write: "this write targets the session transcript — it is cleared by confirming this call, never by an allow rule";
     readonly org_rule: "an organization policy rule requires approval for this call";
     readonly rule_unreadable: "a rule that may govern this call cannot currently be read (this deployment's organization policy, a partition of the person's standing rules, or this call against a deny or ask rule), so whether one forbids it is unknown";
-    readonly ask_rule: string;
+    readonly ask_rule: "an explicit ask rule matched this call (a person's or the deployment's ask-me-each-time outranks a standing allow rule)";
     readonly denial_limit_fallback: "the auto-mode classifier refused too many calls in a row, so a person decides";
     readonly classifier_no_ruling: "the auto-mode classifier could not judge this call, so a person decides";
     readonly requires_user_interaction: "this tool's server declares that a call must be put to a person";
-    readonly cross_boundary: string;
+    readonly cross_boundary: "this run executes on a device outside the deployment's trust boundary and the deployment is multi-tenant, so an org-side write — or, after an off-target read, a call bound for the device — is confirmed by the deployment's approver for this call: no standing allow rule and no automatic lane answers for it, and an allow the configuration gives (a blanket seat or a policy's answer) is refused";
     readonly operator_forced: "this call arrived already marked as requiring confirmation (an earlier layer of this run, or the task that delegated it, judged it so) — it is cleared by confirming this call, never by a standing allow rule";
-    readonly shell_floor: string;
-    readonly target_unresolved: string;
-    readonly probe: string;
-    readonly write_protection: string;
-    readonly tool_marks_mcp: string;
-    readonly tool_marks_a2a: string;
+    readonly shell_floor: "this deployment mandates per-call confirmation for shell commands (shellGate: always)";
+    readonly target_unresolved: "where this write leads on disk could not be determined (a link on the way could not be examined, or the environment could not resolve the target), so whether it lands on a guarded path is unknown — it is cleared by confirming this call: no standing rule and no automatic decider answers for it, though a wired approver seat can";
+    readonly write_protection: "this write's target is on the deployment's write-protection table (the agent's own configuration is guarded one look per write) — it is cleared by confirming this call, never by a standing allow rule";
+    readonly tool_marks_mcp: "this tool carries egress/irreversibility/interaction marks (a mandated confirmation a rule cannot clear)";
+    readonly tool_marks_a2a: "this tool carries egress/irreversibility/interaction marks (a mandated confirmation a rule cannot clear)";
     readonly policy_rra: "the deployment's policy requires a real approval for this call";
     readonly artifact_shared_read: "this read targets another task's shared artifact — it is cleared by confirming this call";
     readonly mode: "the permission mode puts this question to a person";
     readonly unstated: "this call arrived already marked as requiring confirmation (an earlier layer of this run, or the task that delegated it, judged it so) — it is cleared by confirming this call, never by a standing allow rule";
     readonly ordinary: "this call arrived already marked as requiring confirmation (an earlier layer of this run, or the task that delegated it, judged it so) — it is cleared by confirming this call, never by a standing allow rule";
 }>;
-/** The fence over the reason table: `never` while every class has a row. */
-export type ShadowReasonTableCoversEveryClass = AssertAllKeysHandled<Exclude<AskClass, keyof typeof SHADOW_REASON>>;
+/** The fence over the reason table: `never` while every class that has a reason of its own has a row. */
+export type ShadowReasonTableCoversEveryClass = AssertAllKeysHandled<Exclude<AskClass, keyof typeof SHADOW_REASON | AccountedClass>>;
 /**
  * The disclosure in the sentence a PERSON reads — rendered where a card or a park row is minted, never onto the decision
  * the classifier reads: "<members> match(es) this call but do(es) not clear the ask — <why>".
@@ -300,18 +327,23 @@ export declare function allowRuleShadowSentence(shadows: readonly AllowRuleShado
     askClass?: AskClass;
     mandate?: PersistedRuleMandate;
     authoredBy?: "deployment";
+    probeReason?: string;
 }): string;
-/** The card's two disclosure members off a surviving ask, minted at every station that builds an approval request: the
- *  sanitized records, and the message with the sentence rendered onto it. */
+/** The card's disclosure members off a surviving ask, minted at every station that builds an approval request: the
+ *  sanitized records, the message with the sentence rendered onto it, and the outlet of a person's rewritten edit (the
+ *  approved-edit pass's own member, whose form is the bytes the card presents). */
 export declare function cardDisclosureOf(decision: {
     message?: string;
     allowRuleShadowed?: unknown;
     askClass?: AskClass;
     mandate?: PersistedRuleMandate;
     authoredBy?: "deployment";
+    probeReason?: string;
+    editRewritten?: EditRewritten;
 }, fallbackMessage: string): {
     message: string;
     allowRuleShadowed?: readonly AllowRuleShadow[];
+    editRewritten?: EditRewritten;
 };
 /** The notice for list entries that grant (or refuse) nothing — one code for every list. */
 export declare const ALLOWED_TOOL_NOT_GRANTED_CODE = "permission.allowed_tool_not_granted";
@@ -348,3 +380,4 @@ export declare function inertEntryPhrase(e: AllowEntryInert): string;
  * `disallowed-tools` holds such an entry is named as one that does not activate.
  */
 export declare function allowedToolsNotGrantedNotice(inert: readonly AllowEntryInertNote[], sessionId: string | undefined): EngineNotice;
+export {};

package/dist/core/allow-entry.js

@@ -1,15 +1,17 @@
 import { heldBy } from "./tool-name-readings.js";
-import { isNamespacedCoveringRuleName, namespacedRuleNameCovers } from "./permission-rules.js";
-import { parsePermissionRule, ruleSpellingOf } from "./permission-rule-syntax.js";
+import { ruleIssue } from "./permission-rules.js";
+import { isCoveringRuleName, ruleNameCovers } from "./namespaced-rule-name.js";
+import { ruleSpellingOf } from "./permission-rule-syntax.js";
 import { judgeRuleToolName, splitNamespacedName } from "./tool-name-aliases.js";
 import { catalogToolNames, isShellFaceToolName } from "./tool-registry.js";
 import { ALLOW_RULE_MEMBERS } from "./allow-rule-shadow.js";
-import { COMMAND_RULE_TOOL, adjudicatePersistedDomainRules, adjudicatePersistedNameRules, commandCoverageOf, domainRuleSubjectOf, laneToolNamesOf, nameRuleSubjectOf, noticeRuleText, parseRuleText, programRunReachOf, ruleToolGrammarOf } from "./permission-rule-model.js";
+import { callHostTargetOf } from "./host-target.js";
+import { COMMAND_RULE_TOOL, adjudicatePersistedDomainRules, adjudicatePersistedNameRules, commandCoverageOf, laneToolNamesOf, ruleContentOf, noticeRuleText, parseRuleText, programRunReachOf, ruleToolGrammarOf, commandPatternMayRun } from "./permission-rule-model.js";
 import { pathRuleLaneAnswer } from "./runner/permission-rule-lanes.js";
 import { callTargetReadingOf } from "./effective-path-target.js";
 import { splitShellCompoundSegments } from "../tools/fs/bash-readonly-classifier.js";
-import { mandateDisclosureOf } from "./ask-origin.js";
-import { inlineUntrusted } from "./untrusted-text.js";
+import { ASK_RULE_DISCLOSURE, MANDATE_DISCLOSURE, mandateDisclosureOf } from "./ask-origin.js";
+import { inlineUntrusted, isMintableProbeReason } from "./untrusted-text.js";
 import { valueTypeLabel } from "./tool-name-list.js";
 import { deliverEngineNotice } from "./engine-notice.js";
 export const ALLOW_ENTRY_INERT_REASONS = Object.freeze(["wildcard_all", "namespace_wildcard", "content_unsupported", "grammar", "tool_name", "near_miss", "earlier_grammar"]);
@@ -38,8 +40,8 @@ export function nearMissSpellingOf(name, roster) {
 export function rootFacingToolNames(carried) {
     return new Set([...catalogToolNames(), ...carried]);
 }
-function toolNameReading(name, roster) {
-    const verdict = judgeRuleToolName(name, roster);
+function toolNameReading(name, roster, behavior) {
+    const verdict = judgeRuleToolName(name, roster, behavior);
     if (verdict.kind === "unprefixed_namespace")
         return { kind: "inert", reason: "tool_name", verdict: verdict.kind };
     if (verdict.kind !== "current") {
@@ -57,22 +59,18 @@ export function readRuleEntry(raw, behavior, roster) {
     if (parsed === undefined)
         return inert("grammar");
     const name = parsed.toolName;
-    if (name === "*")
+    if (name === "*" && behavior === "allow")
         return inert("wildcard_all");
     if (roster !== undefined) {
-        const stale = toolNameReading(name, roster);
+        const stale = toolNameReading(name, roster, behavior);
         if (stale !== undefined)
             return stale;
     }
-    if (parsed.ruleContent === undefined) {
-        const split = splitNamespacedName(name);
-        if (split !== undefined) {
-            if (split.peer.includes("*"))
-                return inert("namespace_wildcard");
-            if (isNamespacedCoveringRuleName(name))
-                return row({ kind: "namespace", pattern: name });
-            return row({ kind: "tool", name });
-        }
+    if (ruleContentOf(parsed) === undefined) {
+        if (isCoveringRuleName(name, behavior))
+            return row({ kind: "covering", pattern: name });
+        if (name.includes("*"))
+            return inert(splitNamespacedName(name) !== undefined ? "namespace_wildcard" : "grammar");
         return row(isShellFaceToolName(name) ? { kind: "shell", name } : { kind: "tool", name });
     }
     const grammar = ruleToolGrammarOf(name);
@@ -93,7 +91,7 @@ export function compiledEntryName(compiled) {
         case "tool":
         case "shell":
             return compiled.name;
-        case "namespace":
+        case "covering":
             return compiled.pattern;
         default:
             return compiled.rule.tool;
@@ -103,11 +101,10 @@ function inertReasonOf(code) {
     return code === "unsupported.tool" ? "content_unsupported" : "grammar";
 }
 export function compileAllowList(entries, behavior, roster) {
-    const voided = behavior === "allow" && entries.some(namesWholeRoster);
     const rows = [];
     const inert = [];
     for (const entry of entries) {
-        const read = typeof entry !== "string" || !voided ? readRuleEntry(entry, behavior, roster) : { kind: "inert", reason: "wildcard_all" };
+        const read = readRuleEntry(entry, behavior, roster);
         if (read.kind === "row")
             rows.push({ entry, compiled: read.compiled });
         else {
@@ -118,9 +115,6 @@ export function compileAllowList(entries, behavior, roster) {
     }
     return { rows, inert };
 }
-function namesWholeRoster(entry) {
-    return typeof entry === "string" && entry === entry.trim() && parsePermissionRule(entry).toolName === "*";
-}
 function answersTo(req, has) {
     return heldBy("allowEntry.names", { has }, req);
 }
@@ -158,8 +152,8 @@ export function autoStripped(compiled, call) {
         case "tool":
             return call !== undefined && answersTo(call, isShellFaceToolName);
         case "command":
-            return shellContentStripped(shellRuleContent(compiled.rule));
-        case "namespace":
+            return compiled.rule.match === "pattern" ? commandPatternMayRun(compiled.rule.command, AUTO_STRIPPED_PROGRAMS) : shellContentStripped(shellRuleContent(compiled.rule));
+        case "covering":
         case "path":
         case "name":
         case "domain":
@@ -175,7 +169,7 @@ export function autoStrippedRule(rule, call) {
 }
 const NO_LEADS = new Map();
 function nameRowReaches(compiled, req) {
-    const covers = compiled.kind === "namespace" ? (n) => namespacedRuleNameCovers(compiled.pattern, n) : compiled.kind === "tool" || compiled.kind === "shell" ? (n) => n === compiled.name : undefined;
+    const covers = compiled.kind === "covering" ? (n) => ruleNameCovers(compiled.pattern, n) : compiled.kind === "tool" || compiled.kind === "shell" ? (n) => n === compiled.name : undefined;
     return covers !== undefined && answersTo(req, covers);
 }
 function commandOf(req) {
@@ -240,7 +234,8 @@ export function judgeAllowEntries(rows, req, behavior, ctx, posture = "grant") {
         const table = familyRows.map((r) => r.compiled.rule);
         for (const name of laneToolNamesOf(req).filter((n) => ruleToolGrammarOf(n) === grammar)) {
             const at = { tool: name, cwd: ctx.root, ...(ctx.sessionId !== undefined ? { sessionId: ctx.sessionId } : {}) };
-            const verdict = grammar === "name" ? adjudicatePersistedNameRules(table, { ...at, name: nameRuleSubjectOf(name, req.args) }) : adjudicatePersistedDomainRules(table, { ...at, host: domainRuleSubjectOf(name, req.args) });
+            const named = { ...req, toolName: name };
+            const verdict = grammar === "name" ? adjudicatePersistedNameRules(table, { ...at, request: req }) : adjudicatePersistedDomainRules(table, { ...at, hosts: { tighten: callHostTargetOf(named, "tighten"), grant: callHostTargetOf(named, "grant") } });
             if (verdict !== undefined && verdict.behavior === behavior)
                 return [familyRows.find((r) => r.compiled.rule === verdict.rules[0]) ?? familyRows[0]];
         }
@@ -253,8 +248,19 @@ export function allowingRows(rows, req, mode) {
 export class AllowEntryTable {
     held = [];
     heldEntries = new Set();
-    seed(entries, roster) {
-        const { rows, inert } = compileAllowList(entries, "allow", roster);
+    receivedAt = new Map();
+    seed(entries, reading = {}) {
+        const { rows, inert } = compileAllowList(entries, "allow", reading.roster);
+        if (reading.received === true) {
+            this.receivedAt = new Map();
+            entries.forEach((e, i) => {
+                const at = this.receivedAt.get(e);
+                if (at === undefined)
+                    this.receivedAt.set(e, [i]);
+                else
+                    at.push(i);
+            });
+        }
         for (const r of rows) {
             if (this.heldEntries.has(r.entry))
                 continue;
@@ -273,15 +279,19 @@ export class AllowEntryTable {
         return {
             allowing: (req, mode) => {
                 const hit = judgeAllowEntries(allowingRows(this.held, req, mode), req, "allow", ctx);
-                return hit === undefined ? undefined : { entries: hit.map((r) => r.entry) };
+                if (hit === undefined)
+                    return undefined;
+                const entries = hit.map((r) => r.entry);
+                const positions = entries.flatMap((e) => this.receivedAt.get(e) ?? []).sort((a, b) => a - b);
+                return { entries, ...(positions.length > 0 ? { positions } : {}) };
             },
         };
     }
 }
 export function seedAllowEntryTables(tables, lists, roster) {
     tables.request.seed(lists.inherited ?? []);
-    const requestInert = tables.request.seed(lists.request ?? [], roster);
-    const deploymentInert = tables.deployment.seed(lists.deployment ?? [], roster).filter((e) => e.reason === "tool_name" || e.reason === "near_miss");
+    const requestInert = tables.request.seed(lists.request ?? [], { roster, received: true });
+    const deploymentInert = tables.deployment.seed(lists.deployment ?? [], { roster, received: true }).filter((e) => e.reason === "tool_name" || e.reason === "near_miss");
     return [
         ...lists.skillInert.map((e) => ({ source: "skill", ...e })),
         ...requestInert.map((e) => ({ source: "request", ...e })),
@@ -298,22 +308,27 @@ export function withDeploymentAllowedTools(deps) {
     return { ...deps, allowedTools };
 }
 export const INVALID_PERMISSION_RULES_CODE = "config.invalid_permission_rules";
+const ALLOW_LIST_SEATS = {
+    "TaskSpec.allowedTools": "the request's allow list",
+    "RunnerDeps.allowedTools": "the deployment's allow list",
+};
 export function screenAllowedToolsValue(value, seat) {
     if (value === undefined)
         return undefined;
+    const label = ALLOW_LIST_SEATS[seat];
     const issues = [];
     if (!Array.isArray(value)) {
-        issues.push({ rule: "", code: "invalid.entry_type", message: `${seat} must be a list of permission-rule strings (got ${value === null ? "null" : typeof value})` });
+        issues.push(ruleIssue("", "invalid.entry_type", `${label} must be a list of permission-rule strings (got ${value === null ? "null" : typeof value})`, { name: seat }));
     }
     else {
         const list = value;
         list.forEach((entry, i) => {
             if (typeof entry !== "string")
-                issues.push({ rule: "", code: "invalid.entry_type", message: `${seat}[${i}] must be a permission-rule string (got ${entry === null ? "null" : typeof entry})` });
+                issues.push(ruleIssue("", "invalid.entry_type", `entry ${i} of ${label} must be a permission-rule string (got ${entry === null ? "null" : typeof entry})`, { name: seat }));
         });
     }
     if (issues.length > 0) {
-        const e = new Error(`${seat}: ${issues.length} invalid entr${issues.length === 1 ? "y" : "ies"} — refusing rather than running without them:\n${issues.map((i) => `  [${i.code}] ${i.message}`).join("\n")}`);
+        const e = new Error(`${label}: ${issues.length} invalid entr${issues.length === 1 ? "y" : "ies"} — refusing rather than running without them:\n${issues.map((i) => `  [${i.code}] ${i.message}`).join("\n")}`);
         e.code = INVALID_PERMISSION_RULES_CODE;
         e.issues = issues;
         throw e;
@@ -326,6 +341,16 @@ export function allowRuleShadowOf(member, entries) {
     const shown = entries.slice(0, SHADOW_ENTRIES_MAX).map((e) => inlineUntrusted(e, SHADOW_ENTRY_MAX_CHARS));
     return { member, entries: shown, ...(entries.length > shown.length ? { omitted: entries.length - shown.length } : {}) };
 }
+export function withAllowRuleShadow(list, shadow) {
+    const at = list.findIndex((s) => s.member === shadow.member);
+    if (at < 0)
+        return [...list, shadow];
+    const held = list[at];
+    const entries = [...held.entries, ...shadow.entries];
+    const shown = entries.slice(0, SHADOW_ENTRIES_MAX);
+    const omitted = (held.omitted ?? 0) + (shadow.omitted ?? 0) + (entries.length - shown.length);
+    return list.map((s, i) => (i === at ? { member: held.member, entries: shown, ...(omitted > 0 ? { omitted } : {}) } : s));
+}
 const MEMBER_SET = new Set(ALLOW_RULE_MEMBERS);
 export function readAllowRuleShadows(value) {
     try {
@@ -359,18 +384,17 @@ export const SHADOW_REASON = Object.freeze({
     transcript_write: "this write targets the session transcript — it is cleared by confirming this call, never by an allow rule",
     org_rule: "an organization policy rule requires approval for this call",
     rule_unreadable: "a rule that may govern this call cannot currently be read (this deployment's organization policy, a partition of the person's standing rules, or this call against a deny or ask rule), so whether one forbids it is unknown",
-    ask_rule: mandateDisclosureOf(undefined),
+    ask_rule: ASK_RULE_DISCLOSURE,
     denial_limit_fallback: "the auto-mode classifier refused too many calls in a row, so a person decides",
     classifier_no_ruling: "the auto-mode classifier could not judge this call, so a person decides",
     requires_user_interaction: "this tool's server declares that a call must be put to a person",
-    cross_boundary: mandateDisclosureOf("cross_boundary_taint"),
+    cross_boundary: MANDATE_DISCLOSURE.cross_boundary_taint,
     operator_forced: "this call arrived already marked as requiring confirmation (an earlier layer of this run, or the task that delegated it, judged it so) — it is cleared by confirming this call, never by a standing allow rule",
-    shell_floor: mandateDisclosureOf("operator_always"),
-    target_unresolved: mandateDisclosureOf("target_unresolved"),
-    probe: mandateDisclosureOf("probe_mandate"),
-    write_protection: mandateDisclosureOf("write_protection"),
-    tool_marks_mcp: mandateDisclosureOf("tool_marks"),
-    tool_marks_a2a: mandateDisclosureOf("tool_marks"),
+    shell_floor: MANDATE_DISCLOSURE.operator_always,
+    target_unresolved: MANDATE_DISCLOSURE.target_unresolved,
+    write_protection: MANDATE_DISCLOSURE.write_protection,
+    tool_marks_mcp: MANDATE_DISCLOSURE.tool_marks,
+    tool_marks_a2a: MANDATE_DISCLOSURE.tool_marks,
     policy_rra: "the deployment's policy requires a real approval for this call",
     artifact_shared_read: "this read targets another task's shared artifact — it is cleared by confirming this call",
     mode: "the permission mode puts this question to a person",
@@ -398,19 +422,24 @@ function memberPhrase(s) {
 }
 export function allowRuleShadowSentence(shadows, ask) {
     const one = shadows.length === 1 && (shadows[0].member === "hook" || shadows[0].entries.length + (shadows[0].omitted ?? 0) === 1);
-    const why = ask.mandate !== undefined
-        ? mandateDisclosureOf(ask.mandate)
-        : ask.authoredBy === "deployment"
+    const { askClass, mandate, authoredBy, probeReason } = ask;
+    const account = typeof probeReason === "string" && probeReason.trim().length > 0 && isMintableProbeReason(probeReason) ? probeReason : undefined;
+    const why = mandate !== undefined
+        ? mandateDisclosureOf(mandate, account)
+        : authoredBy === "deployment"
             ? "this deployment requires a person's confirmation for this call"
-            : SHADOW_REASON[ask.askClass ?? "ordinary"];
-    return `${shadows.map(memberPhrase).join("; ")} ${one ? "matches this call but does not clear the ask" : "match this call but do not clear the ask"} — ${why}`;
+            : askClass === "probe"
+                ? account
+                : SHADOW_REASON[askClass ?? "ordinary"];
+    return `${shadows.map(memberPhrase).join("; ")} ${one ? "matches this call but does not clear the ask" : "match this call but do not clear the ask"}${why !== undefined ? ` — ${why}` : ""}`;
 }
 export function cardDisclosureOf(decision, fallbackMessage) {
     const base = decision.message ?? fallbackMessage;
+    const outlet = decision.editRewritten !== undefined ? { editRewritten: decision.editRewritten } : {};
     const shadows = readAllowRuleShadows(decision.allowRuleShadowed);
     if (shadows === undefined)
-        return { message: base };
-    return { message: `${base} (${allowRuleShadowSentence(shadows, decision)})`, allowRuleShadowed: shadows };
+        return { message: base, ...outlet };
+    return { message: `${base} (${allowRuleShadowSentence(shadows, decision)})`, allowRuleShadowed: shadows, ...outlet };
 }
 export const ALLOWED_TOOL_NOT_GRANTED_CODE = "permission.allowed_tool_not_granted";
 const NOTICE_ENTRIES_SHOWN = 5;
@@ -461,7 +490,7 @@ export function allowedToolsNotGrantedNotice(inert, sessionId) {
     return {
         code: ALLOWED_TOOL_NOT_GRANTED_CODE,
         message: `${inert.length} allowed-tools entr${inert.length === 1 ? "y grants" : "ies grant"} or refuse${inert.length === 1 ? "s" : ""} nothing — ${shown.join("; ")}${rest > 0 ? `; and ${rest} more` : ""}. ` +
-            "A list holding `*` voids the list, `mcp__*` names no server, a rule the grammar refuses (`grammar`) or one on a tool with no such rule form (`content_unsupported`: an allow by path is an `Edit(…)` or `Read(…)` rule) grants nothing, and a tool name must be spelled as the tool is mounted; name the tools (or `mcp__<server>`) instead." +
+            "On an allow list a `*` outside a protocol name's tool segment (`*`, `Re*d`, `mcp__*`) names no scope and grants nothing — the entries beside it still grant — and a rule the grammar refuses (`grammar`) or one on a tool with no such rule form (`content_unsupported`: an allow by path is an `Edit(…)` or `Read(…)` rule) grants nothing; a tool name must be spelled as the tool is mounted; name the tools (or `mcp__<server>`) instead." +
             (refusing ? " Such an entry in a disallowed-tools list keeps its Skill from activating: a refusal that reads as nothing is not dropped." : ""),
         detail: { ...(sessionId !== undefined ? { sessionId } : {}), entries: inert.map((e) => ({ ...e, entry: noticeRuleText(e.entry) })) },
     };

package/dist/core/allow-rule-shadow.d.ts

@@ -8,11 +8,18 @@
  *  `TaskSpec.allowedTools`. The closed set {@link AllowRuleShadow.member} names. */
 export declare const ALLOW_RULE_MEMBERS: readonly ["hook", "deployment", "persisted", "skill", "request"];
 export type AllowRuleMember = (typeof ALLOW_RULE_MEMBERS)[number];
-/** One allow-layer member that matched a call and could not clear its ask: the member, and the entries it matched as their
- *  source spells them (sanitized and capped at the mint; a hook names none — its word is about the call, not an entry).
- *  `omitted` counts entries beyond the cap, never dropped silently. */
+/** One allow-layer member that matched a call and could not clear its ask — one record per member: the member, and the
+ *  entries it matched as their source spells them (sanitized and capped at the mint; the hook member names the registrations
+ *  that spoke). `omitted` counts entries beyond the cap, never dropped silently. */
 export interface AllowRuleShadow {
     readonly member: AllowRuleMember;
     readonly entries: readonly string[];
     readonly omitted?: number;
 }
+/** The allow-layer member that CLEARED a call's ask (`tool_end.gate.disposition.clearedBy`): the shadow record's shape — the member
+ *  and the entries it stood on, sanitized and capped by the same mint — plus, for a LIST member (`request`, `deployment`),
+ *  `positions`: the index of every element of the list the run received that is one of those entries (a string listed twice has
+ *  both indices), so a host reads which line of its own declaration spoke even where the shown text is capped. */
+export interface AllowRuleClearance extends AllowRuleShadow {
+    readonly positions?: readonly number[];
+}

package/dist/core/approval-object.d.ts

@@ -1,7 +1,7 @@
 import type { PendingAction } from "./checkpoint-store.js";
 import type { CallTargetReading } from "./effective-path-target.js";
 import { type SkillGrantSource } from "./skill-grant.js";
-import type { ToolCallPathTarget, ToolFamily } from "./tool-face.js";
+import type { ToolCallPathTarget, ToolFamily, ToolHostTarget } from "./tool-face.js";
 import { type ToolRosterEntry } from "./tool-roster.js";
 type ParkedApproval = Extract<PendingAction, {
     kind: "tool_approval";
@@ -24,6 +24,7 @@ export interface ApprovalTool {
     readonly implementationRevision?: string;
     readonly family?: ToolFamily;
     readonly pathTarget?: ToolCallPathTarget;
+    readonly hostTarget?: ToolHostTarget;
 }
 export interface ApprovalObject {
     /** Absent on a row minted before the identity members (all four absent): such a row binds the tool's name alone. */

package/dist/core/approval-object.js

@@ -5,10 +5,10 @@ import { toolIdentityOf } from "./tool-roster.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 export const APPROVAL_TARGET_ROLES = Object.freeze(["protective", "declared"]);
 export function approvalObjectOf(row) {
-    const { capabilityId, contractId, shapeDigest, implementationRevision, family, pathTarget, targets, boundGrantDigest } = row;
+    const { capabilityId, contractId, shapeDigest, implementationRevision, family, pathTarget, hostTarget, targets, boundGrantDigest } = row;
     const carried = [capabilityId, contractId, shapeDigest, implementationRevision].some((m) => m !== undefined);
     return {
-        ...(carried ? { tool: { capabilityId, contractId, shapeDigest, implementationRevision, family, pathTarget } } : {}),
+        ...(carried ? { tool: { capabilityId, contractId, shapeDigest, implementationRevision, family, pathTarget, hostTarget } } : {}),
         ...(targets !== undefined ? { targets } : {}),
         ...(boundGrantDigest !== undefined ? { grants: boundGrantDigest } : {}),
     };
@@ -30,9 +30,9 @@ export const APPROVAL_STATION_MEMBERS = Object.freeze({
 const IDENTITY_MEMBERS = Object.freeze(["capabilityId", "contractId", "shapeDigest", "implementationRevision"]);
 const shown = (s) => `"${inlineUntrusted(s, 240)}"`;
 const vetoed = (name, why) => `The approved tool call "${name}" was not executed: ${why}, so the approval does not cover it (resume.target_moved). This approval is spent — the call has to be re-issued: its new card shows what it would act on now.`;
-function faceKey(family, pt) {
+function faceKey(family, pt, ht) {
     const slot = pt === undefined ? null : { param: pt.param, access: pt.access, aliases: [...(pt.aliases ?? [])], base: pt.base ?? "cwd", absent: pt.absent ?? "none", patternParam: pt.patternParam ?? null, skillScopeEligible: pt.skillScopeEligible === true };
-    return canonicalize({ family: family ?? null, pathTarget: slot });
+    return canonicalize({ family: family ?? null, pathTarget: slot, hostTarget: ht === undefined ? null : { param: ht.param } });
 }
 function judgeTool(row, live) {
     const entry = live.tool;
@@ -47,9 +47,9 @@ function judgeTool(row, live) {
         const named = differ.map((k) => (bound[k] === undefined ? `${k} (missing on the row)` : k)).join(", ");
         return { member: "tool", disposition: "reopen", code: "resume.tool_contract_mismatch", message: `the approved tool "${row.toolName}" on this leg is not the tool the approval was minted against (${named} differ) — refusing to execute a replacement wearing the name; the checkpoint is reopened for a retry with the original tool present` };
     }
-    if (faceKey(bound.family, bound.pathTarget) === faceKey(entry.family, entry.pathTarget))
+    if (faceKey(bound.family, bound.pathTarget, bound.hostTarget) === faceKey(entry.family, entry.pathTarget, entry.hostTarget))
         return undefined;
-    return { member: "tool", disposition: "veto", code: "resume.target_moved", message: vetoed(row.toolName, "the tool's face (its display family or the path target it declares) changed after the approval") };
+    return { member: "tool", disposition: "veto", code: "resume.target_moved", message: vetoed(row.toolName, "the tool's face (its display family, or the path target or URL slot it declares) changed after the approval") };
 }
 function judgeTargets(row, live) {
     const bound = row.targets;