@sema-agent/core 7.54.1 → 7.56.0

package/dist/core/mods/kernel/site-rules.js

@@ -1,5 +1,6 @@
 import { describe } from "./events.js";
-import { describeFault, isPlainRecord, MODS_PAYLOAD_MODE, receive } from "./receive.js";
+import { describeFault, isPlainRecord, MODS_PAYLOAD_MODE, receive, sealedObjects } from "./receive.js";
+export { sealedObjects } from "./receive.js";
 export const MODS_VALUE_DEPTH = 1_000;
 const HANDED_MODE = Object.freeze({ ...MODS_PAYLOAD_MODE, depth: MODS_VALUE_DEPTH + 1, past: "refuse" });
 function payloadMode(isProxy) {
@@ -190,13 +191,13 @@ function rehomed(pinned, held, passed, homes, engines) {
         Object.freeze(to);
     return twins.get(passed);
 }
-export function answerViolation(answer, check, e, by, below) {
+export function answerViolation(answer, check, e, by, below, run) {
     if (answer === undefined)
         return "returned no answer (return next(e) to pass the event on)";
     if (check === undefined)
         return undefined;
     try {
-        return check(answer, e, by, below);
+        return check(answer, e, by, below, run);
     }
     catch {
         return "returned an answer the station cannot read";
@@ -247,50 +248,31 @@ export function receiveEvent(e) {
     const r = receiveRecord(e, MODS_PAYLOAD_MODE);
     return "refusal" in r ? { refusal: r.refusal } : r;
 }
-export function answerUpward(v) {
-    if (typeof v !== "object" || v === null || Object.isFrozen(v))
+export function answerUpward(v, isProxy) {
+    if (typeof v !== "object" || v === null)
         return v;
-    if (Array.isArray(v) && Object.getPrototypeOf(v) === Array.prototype)
-        return Object.freeze([...v]);
-    return isPlainRecord(v) ? Object.freeze({ ...v }) : v;
+    const sealed = sealedObjects([v]);
+    if (sealed.has(v))
+        return v;
+    const r = receive(v, payloadMode(isProxy), sealed);
+    if (!r.ok)
+        throw new TypeError(`the chain's bottom answered ${faultClause(r.fault)}`);
+    return r.value;
 }
-export function receiveAnswer(answer, engines, isProxy) {
-    const r = receive(answer, payloadMode(isProxy), engines);
-    return r.ok ? { answer: r.value } : { refusal: `answered ${faultClause(r.fault)}` };
+function answerMode(isProxy) {
+    return Object.freeze({ ...payloadMode(isProxy), others: "refuse" });
 }
-const DETACHED_MODE = Object.freeze({ accessors: "refuse", depth: Infinity, others: "as-is" });
+export function receiveAnswer(answer, held, isProxy) {
+    const r = receive(answer, answerMode(isProxy), held);
+    if (r.ok)
+        return { answer: r.value };
+    const notData = r.fault.kind === "not-data" || r.fault.kind === "cycle";
+    return { refusal: `answered ${faultClause(r.fault)}${notData ? " (an answer is data: strings, numbers, booleans, null, plain objects and arrays)" : ""}` };
+}
+const DETACHED_MODE = Object.freeze({ accessors: "refuse", depth: Infinity, others: "as-is", leaves: "cloned" });
 export function detachedCopy(e) {
     const r = receive(e, DETACHED_MODE);
     if (!r.ok)
         throw new Error(`the observer's copy of the event could not be made: ${describeFault(r.fault)}`);
-    const copy = r.value;
-    const clones = new Map();
-    const walked = new Set([copy]);
-    const stack = [copy];
-    while (stack.length > 0) {
-        const node = stack.pop();
-        for (const k of Object.keys(node)) {
-            const v = node[k];
-            if (typeof v !== "object" || v === null)
-                continue;
-            if (isPlainRecord(v) || (Array.isArray(v) && Object.getPrototypeOf(v) === Array.prototype)) {
-                if (!walked.has(v)) {
-                    walked.add(v);
-                    stack.push(v);
-                }
-                continue;
-            }
-            if (!clones.has(v)) {
-                let own = v;
-                try {
-                    own = structuredClone(v);
-                }
-                catch {
-                }
-                clones.set(v, own);
-            }
-            Object.defineProperty(node, k, { value: clones.get(v), enumerable: true, writable: true, configurable: true });
-        }
-    }
-    return copy;
+    return r.value;
 }

package/dist/core/mods/spec-seats.d.ts

@@ -0,0 +1,69 @@
+/**
+ * The skill seats of the mods bus (`SkillSpec.mods`), admitted with the leg's other registrations on the task seat. Theirs alone:
+ *  · the SCOPE RECORD — which skill each registration belongs to and which skills are active on the leg (opened by the grant
+ *    table's activation write, or by a resumed leg's frozen scopes; closed with the run that holds the record);
+ *  · two VIEWS of the leg bus: the leg's own raises take a skill's handlers only while its scope is open (presence counts them
+ *    always, so what prepare arms is armed for a scope that opens later); the STANDING chain never holds them — what the leg
+ *    hands its descendants, and what guards every call unconditionally;
+ *  · the SEAT RULE — a skill carries hooks, `classic.*` events only (a method event's chain is dispatched inside the kernel,
+ *    where no scope is read).
+ */
+import type { SkillSpec } from "../agent-definition.js";
+import type { EngineDollar } from "./dollar.js";
+import { type ModBus, type ModRegistration } from "./kernel/index.js";
+/** The leg's record of its skills' scopes, as the activation write point and the park read it. */
+export interface SkillScopes {
+    /** Open `skill`'s scope on this leg: from now to the run's end its registrations take part in the leg's raises. */
+    open(skill: string): void;
+    /** The active skills that carry registrations, sorted — what a park freezes (`undefined` = none). */
+    frozen(): string[] | undefined;
+}
+/** The record, with the readings the views take. */
+export interface ScopeRecord extends SkillScopes {
+    /** The skill a registration (by name) belongs to, or undefined for a registration of no skill. */
+    ownerOf(registration: string): string | undefined;
+    isOpen(skill: string): boolean;
+    /** Whether any skill of the leg carries a registration (none ⇒ both views are the bus itself). */
+    carries(): boolean;
+}
+/** The registrations the leg's skills carry, in the skills' order, and which skill each belongs to. */
+export interface SkillSeats {
+    readonly registrations: readonly ModRegistration<EngineDollar>[];
+    readonly owners: ReadonlyMap<string, string>;
+}
+/**
+ * Read the leg's skills (the skills seat's copy) into their registrations, each READ ONCE into a frozen copy of its members
+ * (`register` still runs with the host's object as `this`): the name the scope owns it by is the very name the kernel admits
+ * it under, and the `uses` the seat rule judges is the very `uses` the kernel holds its `on` to. The seat rule is judged here,
+ * before admission — so no handler of a refused registration ever runs, not even on another registration's `plugin.register`.
+ * Anything else about a registration (its shape, its tier, a duplicate name) is the admission's screen, given the copy.
+ */
+export declare function skillSeatsOf(skills: readonly Pick<SkillSpec, "name" | "mods">[] | undefined): SkillSeats;
+/**
+ * Mint the leg's scope record; `reopened` = the scopes a resumed leg's park froze (open from the start). What a park freezes:
+ * every open scope of a skill that carries registrations on this leg, and every scope this leg reopened (a reopened skill
+ * stays recorded whatever the resumed definition carries — the next resume may restore its hooks). A plain skill's
+ * activation is not recorded: the hooks a skill brings are the ones its definition carried when it was active.
+ */
+export declare function skillScopeRecord(owners: ReadonlyMap<string, string>, reopened: readonly string[] | undefined): ScopeRecord;
+/**
+ * Read a park's frozen skill scopes (`CheckpointState.skillScopes`): absent ⇒ none; a list of skill names ⇒ those (copied by
+ * index, once); anything else ⇒ `undefined`, a damaged section — the resume screen refuses it before the claim, never read as
+ * "no scope" (that would resume the run with the skills' hooks silently shut).
+ */
+export declare function readFrozenSkillScopes(section: unknown): readonly string[] | undefined;
+/** A resumed leg's reopened scopes off its checkpoint state; throws on a damaged section (the screen refused it pre-claim). */
+export declare function frozenSkillScopesOf(state: {
+    readonly skillScopes?: unknown;
+} | undefined): readonly string[] | undefined;
+/**
+ * The leg's own raises over the admitted bus: a skill's handler takes part only while its scope is open; presence
+ * (`hasHandlers`, `mounted`) counts it always. With no skill registration, the bus itself.
+ */
+export declare function scopedLegBus(bus: ModBus, record: ScopeRecord): ModBus;
+/**
+ * The leg's STANDING chain, over the leg bus: every registration that takes part on every raise — a skill's handlers are
+ * absent from it, from presence and from every dispatch. Two readers: what the leg hands its descendants (the screening
+ * constraint is minted over it; the chain identity is its), and what guards every call of the leg unconditionally.
+ */
+export declare function standingBus(leg: ModBus, record: ScopeRecord): ModBus;

package/dist/core/mods/spec-seats.js

@@ -0,0 +1,114 @@
+import { expandOnSide } from "./kernel/index.js";
+import { modsInvalid } from "./kernel/registration.js";
+export function skillSeatsOf(skills) {
+    const registrations = [];
+    const owners = new Map();
+    for (const s of skills ?? []) {
+        for (const r of s.mods ?? []) {
+            const copy = registrationCopy(r);
+            registrations.push(copy);
+            if (typeof copy !== "object" || copy === null)
+                continue;
+            const name = Reflect.get(copy, "name");
+            if (typeof name !== "string")
+                continue;
+            owners.set(name, s.name);
+            refuseNonClassic(name, s.name, Reflect.get(copy, "uses"));
+        }
+    }
+    return { registrations, owners };
+}
+function registrationCopy(r) {
+    if (typeof r !== "object" || r === null)
+        return r;
+    const get = (k) => Reflect.get(r, k);
+    const register = get("register");
+    const uses = get("uses");
+    const list = (v) => (Array.isArray(v) ? Object.freeze(Array.from({ length: v.length }, (_, i) => v[i])) : v);
+    const usesCopy = typeof uses === "object" && uses !== null ? Object.freeze({ events: list(Reflect.get(uses, "events")), calls: list(Reflect.get(uses, "calls")) }) : uses;
+    const copy = { name: get("name"), uses: usesCopy };
+    for (const k of ["tier", "provenance", "budgetMs", "options"]) {
+        const v = get(k);
+        if (v !== undefined)
+            copy[k] = v;
+    }
+    copy["register"] = typeof register === "function" ? (on, options) => Reflect.apply(register, r, [on, options]) : register;
+    return Object.freeze(copy);
+}
+function refuseNonClassic(name, skill, uses) {
+    const events = typeof uses === "object" && uses !== null ? Reflect.get(uses, "events") : undefined;
+    if (!Array.isArray(events))
+        return;
+    for (const p of events) {
+        const expanded = expandOnSide(p, "engine");
+        const other = "names" in expanded ? expanded.names.find((n) => !n.startsWith("classic.")) : undefined;
+        if (other !== undefined)
+            throw modsInvalid(`${name} (TaskSpec.skills["${skill}"].mods): declares "${other}"; a registration a SkillSpec carries hangs classic.* events only — its handlers take part only while that SkillSpec is active, which is read where the leg's stations raise`);
+    }
+}
+export function skillScopeRecord(owners, reopened) {
+    const carrying = new Set(owners.values());
+    const carried = new Set(reopened ?? []);
+    const open = new Set(reopened ?? []);
+    return {
+        open: (skill) => void open.add(skill),
+        frozen: () => {
+            const names = [...open].filter((s) => carrying.has(s) || carried.has(s)).sort();
+            return names.length > 0 ? names : undefined;
+        },
+        ownerOf: (registration) => owners.get(registration),
+        isOpen: (skill) => open.has(skill),
+        carries: () => owners.size > 0,
+    };
+}
+export function readFrozenSkillScopes(section) {
+    if (section === undefined)
+        return [];
+    if (!Array.isArray(section))
+        return undefined;
+    const out = [];
+    for (let i = 0; i < section.length; i++) {
+        const name = section[i];
+        if (typeof name !== "string")
+            return undefined;
+        out.push(name);
+    }
+    return out;
+}
+export function frozenSkillScopesOf(state) {
+    if (state === undefined)
+        return undefined;
+    const scopes = readFrozenSkillScopes(state.skillScopes);
+    if (scopes === undefined)
+        throw new Error("the resumed checkpoint's skill-scope section does not read as a list of SkillSpec names — refusing to resume the run with its active skills' hooks shut (the resume screen refuses this row before the claim)");
+    return scopes;
+}
+const withPart = (options, part) => {
+    const caller = options.participant;
+    return { ...options, participant: (p) => part(p) && (caller === undefined || caller(p)) };
+};
+export function scopedLegBus(bus, record) {
+    if (!record.carries())
+        return bus;
+    const openOrNone = (p) => {
+        const skill = record.ownerOf(p.plugin);
+        return skill === undefined || record.isOpen(skill);
+    };
+    return {
+        records: bus.records,
+        mounted: () => bus.mounted(),
+        hasHandlers: (event, participant) => bus.hasHandlers(event, participant),
+        dispatch: (event, e, options) => bus.dispatch(event, e, withPart(options, openOrNone)),
+    };
+}
+export function standingBus(leg, record) {
+    if (!record.carries())
+        return leg;
+    const noSkill = (p) => record.ownerOf(p.plugin) === undefined;
+    return {
+        records: leg.records,
+        mounted: () => leg.mounted().filter(noSkill),
+        hasHandlers: (event, participant) => leg.hasHandlers(event, (p) => noSkill(p) && (participant === undefined || participant(p))),
+        dispatch: (event, e, options) => leg.dispatch(event, e, withPart(options, noSkill)),
+    };
+}

package/dist/core/mods/stations.d.ts

@@ -2,15 +2,18 @@ import type { ExecutionEnv } from "../../internal/harness-types.js";
 import type { AssistantMessage, Message, Model, Usage } from "../../internal/llm.js";
 import type { CwdRef } from "../../tools/fs/fs-shared.js";
 import { type PermissionResult, type ToolCallRequest } from "../tool-policy.js";
-import type { HookInvocationIdentity, PermissionDeniedPayload } from "../hooks.js";
+import type { ClassicEventBase, HookInvocationIdentity, PermissionDeniedPayload, UserPromptSubmitEvent } from "../hooks.js";
+import type { ClassicEventMap, ClassicEventName } from "./classic-events.js";
 import type { PermissionMode } from "../ask-origin.js";
 import type { RunnerDeps } from "../runner-deps.js";
 import type { TaskSpec } from "../task-spec.js";
-import { type ModBus, type ModMountedHandler, type ModDispatchOutcome, type ModEventName, type ModEventPayload, type ModRegistration } from "./kernel/index.js";
+import { type ModAnswerRanks, type ModBus, type ModCallEntry, type ModMountedHandler, type ModDispatchOutcome, type ModEventPayload, type ModRegistration } from "./kernel/index.js";
 import { type SourcedOverlay } from "../../prompt-assembly/overlay.js";
 import type { BandId } from "../../prompt-assembly/catalog/schema.js";
 import type { ModParticipant } from "./kernel/dispatch.js";
 import { type EngineDollar, type ModelCompleteRequest, type ModelCompleteResult, type ModSeatView } from "./dollar.js";
+import type { SkillSpec } from "../agent-definition.js";
+import { type SkillScopes } from "./spec-seats.js";
 /**
  * What the engine's core answers at the bottom of every classic chain: the engine itself has nothing to add.
  * Frozen and empty, so it reads as "no opinion" in every classic station's answer form, and a handler that
@@ -151,21 +154,23 @@ export declare function inheritedToolChecks<E extends InstallationEntry & {
     readonly mods?: readonly ModChainLink[];
 }>(entries: readonly E[], standsIn: (pc: E) => boolean, settleOf: (pc: E) => InstallationAskSettlement): readonly InheritedToolCheck[];
 /** The members every classic `e` of a leg carries: the identity envelope, the delegated leg's `agentId`, the leg's observed mode. */
-export declare function classicEventBase(identity: HookInvocationIdentity | undefined, permissionMode?: PermissionMode): ModEventPayload;
+export declare function classicEventBase(identity: HookInvocationIdentity | undefined, permissionMode?: PermissionMode): ClassicEventBase;
 /**
  * Raise an observation event (a skip-on-failure event whose answer no station reads): no handler, no dispatch.
  * Its failures are the bus's to report; a rejected dispatch (an engine fault, never a handler's) is swallowed —
- * an observation must never change what it observes.
+ * an observation must never change what it observes. The `e` is the event's own, as {@link ClassicEventMap} types it.
  */
-export declare function observeClassic(bus: LegModBus, event: ModEventName, e: ModEventPayload, signal: AbortSignal | undefined): Promise<void>;
+export declare function observeClassic<K extends ClassicEventName>(bus: LegModBus, event: K, e: ClassicEventMap[K]["e"], signal: AbortSignal | undefined): Promise<void>;
 /**
  * Raise a classic event whose answer the station reads: `undefined` when no handler hangs on it (the station
  * runs as if the bus were not there), else the dispatch outcome. A rejection is an engine fault, never a
  * handler's (handlers fail into the outcome); a decision station fails closed on it, an observation swallows it.
+ * The `e` is the event's own, as {@link ClassicEventMap} types it; a decision event names its answer ranks.
  */
-export declare function dispatchClassic(bus: LegModBus, event: ModEventName, e: ModEventPayload, options: {
+export declare function dispatchClassic<K extends ClassicEventName>(bus: LegModBus, event: K, e: ClassicEventMap[K]["e"], options: {
     readonly signal?: AbortSignal;
     readonly checkAnswer?: (answer: unknown) => string | undefined;
+    readonly ranks?: ModAnswerRanks;
 }): Promise<ModDispatchOutcome | undefined>;
 /** The answer form of a classic event whose answer is an object of optional string members (`block`, `additionalContext`, …). */
 export declare function stringMembersAnswer(event: string, members: readonly string[]): (answer: unknown) => string | undefined;
@@ -205,7 +210,7 @@ export type PromptScreen = {
  * runs past its budget or breaks the site's contract ends the screen `failed`, and every entrance fails closed on it;
  * a cancelled screen ends `aborted` at once. A dispatch the engine itself could not run is `failed` too.
  */
-export declare function screenUserPrompt(bus: LegModBus, e: ModEventPayload, signal: AbortSignal | undefined): Promise<PromptScreen | undefined>;
+export declare function screenUserPrompt(bus: LegModBus, e: UserPromptSubmitEvent, signal: AbortSignal | undefined): Promise<PromptScreen | undefined>;
 /** The three words a `tool.check` verdict speaks. */
 export declare const TOOL_CHECK_DECISIONS: readonly ["allow", "ask", "deny"];
 export type ToolCheckDecision = (typeof TOOL_CHECK_DECISIONS)[number];
@@ -282,12 +287,21 @@ export interface LegFacadeSeats {
     now(): number;
     tools(): readonly string[];
     agents(): readonly string[];
+    /** `$.tool.call`'s host entry (`createToolCallEntry`, `tool-call.ts`). */
+    readonly toolCall: ModCallEntry;
 }
 /** The leg's admitted bus, its chain identity (the one its admission recorded, {@link chainOfBus}) and the binding of the
- *  facade its `$` reaches. */
+ *  facade its `$` reaches. `bus` is the leg bus every station raises on ({@link legBusOf}: an extension's own call's
+ *  events are raised under its frames). */
 export interface LegMods {
     readonly bus: ModBus;
+    /** The leg's standing chain ({@link standingBus}): the bus without the skills' registrations — what the leg hands its
+     *  descendants (its screening constraint is minted over it) and what guards each of its calls unconditionally. The bus
+     *  itself when no skill carries one. */
+    readonly standing: ModBus;
     readonly chain: readonly ModChainLink[];
+    /** The leg's skill scopes (`SkillSpec.mods`): the grant table opens one on each activation, the park freezes them. */
+    readonly skillScopes: SkillScopes;
     /** Bind the engine facade once the leg is prepared. Until then a `$` call throws, naming the method. */
     bindFacade(seats: LegFacadeSeats): void;
 }
@@ -301,6 +315,10 @@ export declare function admitLegMods(input: {
     readonly spec: Pick<TaskSpec, "mods">;
     readonly deps: Pick<RunnerDeps, "mods" | "onError" | "onNotice">;
     readonly sessionId: string;
+    /** The leg's skills as the skills seat read them: each one's registrations join the task seat, scoped to its activation. */
+    readonly skills?: readonly Pick<SkillSpec, "name" | "mods">[];
+    /** The skills a resumed leg's park recorded active (their scopes open from the start). */
+    readonly reopenedSkills?: readonly string[];
 }): Promise<LegMods>;
 /** What a leg hands {@link legFacadeSeats}: the seats it already has. */
 export interface LegFacadeInput {
@@ -328,6 +346,8 @@ export interface LegFacadeInput {
         readonly usage: Usage | undefined;
         readonly diagnostics?: AssistantMessage["diagnostics"];
     }) => void;
+    /** `$.tool.call`'s host entry, over the leg's harness and occurrence table. */
+    readonly toolCall: ModCallEntry;
 }
 /** The engine facade's seats over a prepared leg — each one a seat the leg already has (no new capability). */
 export declare function legFacadeSeats(input: LegFacadeInput): LegFacadeSeats;

package/dist/core/mods/stations.js

@@ -6,11 +6,13 @@ import { inlineUntrusted } from "../untrusted-text.js";
 import { extensionWords } from "../untrusted-egress.js";
 import { askApproverIdentity, describeThrown, ownArgs } from "../tool-policy.js";
 import { admitMods, expandModPattern } from "./kernel/index.js";
+import { legBusOf } from "./extension-call.js";
 import { validateOverlay } from "../../prompt-assembly/overlay.js";
 import { modsInvalid } from "./kernel/registration.js";
 import { isPlainRecord } from "./kernel/receive.js";
 import { engineMethodBottoms } from "./dollar.js";
 import { modSeatsOf, modsReportToOnError, registrationRefusedNotice } from "./host.js";
+import { scopedLegBus, skillScopeRecord, skillSeatsOf, standingBus } from "./spec-seats.js";
 export const ENGINE_CORE_ANSWER = Object.freeze({});
 export function engineCore() {
     return ENGINE_CORE_ANSWER;
@@ -141,6 +143,7 @@ export async function dispatchClassic(bus, event, e, options) {
         bottom: engineCore,
         ...(options.signal !== undefined ? { signal: options.signal } : {}),
         ...(check !== undefined ? { checkAnswer: (a) => (a === ENGINE_CORE_ANSWER ? undefined : check(a)) } : {}),
+        ...(options.ranks !== undefined ? { ranks: options.ranks } : {}),
     });
 }
 export function stringMembersAnswer(event, members) {
@@ -196,12 +199,14 @@ export async function observePermissionDenied(input) {
     }, input.onHostObserverFailure);
     await observeClassic(own, "classic.PermissionDenied", e, input.signal);
 }
+const USER_PROMPT_RANKS = Object.freeze({ of: (a) => (stringMembersOf(a, ["block"]).block ? 1 : 0), top: 1 });
 export async function screenUserPrompt(bus, e, signal) {
     let outcome;
     try {
         outcome = await dispatchClassic(bus, "classic.UserPromptSubmit", e, {
             ...(signal !== undefined ? { signal } : {}),
             checkAnswer: stringMembersAnswer("classic.UserPromptSubmit", ["block", "additionalContext"]),
+            ranks: USER_PROMPT_RANKS,
         });
     }
     catch (err) {
@@ -215,6 +220,13 @@ export async function screenUserPrompt(bus, e, signal) {
 }
 export const TOOL_CHECK_DECISIONS = Object.freeze(["allow", "ask", "deny"]);
 const isToolCheckDecision = (v) => TOOL_CHECK_DECISIONS.some((d) => d === v);
+const TOOL_CHECK_RANKS = Object.freeze({
+    of: (a) => {
+        const read = readToolCheckAnswer(a);
+        return typeof read === "string" ? 0 : read.decision === "deny" ? 2 : read.decision === "ask" ? 1 : 0;
+    },
+    top: 2,
+});
 function readToolCheckAnswer(answer) {
     if (typeof answer !== "object" || answer === null)
         return `answered ${answer === null ? "null" : typeof answer}; tool.check takes { decision, reason? }`;
@@ -239,6 +251,7 @@ export async function raiseToolCheck(bus, e, projection, signal, judges) {
                 const read = readToolCheckAnswer(a);
                 return typeof read === "string" ? read : undefined;
             },
+            ranks: TOOL_CHECK_RANKS,
         });
     }
     catch (err) {
@@ -253,14 +266,13 @@ export async function raiseToolCheck(bus, e, projection, signal, judges) {
 }
 const NO_COMPOSE = Object.freeze({ deploy: Object.freeze([]), task: Object.freeze([]), warnings: Object.freeze([]) });
 function composeOverlaysOf(answer) {
-    if (!isPlainRecord(answer)) {
-        return `answered ${answer === null ? "null" : Array.isArray(answer) ? "an array" : typeof answer === "object" ? "an object that is not a plain record" : typeof answer}; prompt.compose takes a plain { overlays }`;
-    }
+    if (!isPlainRecord(answer))
+        return `answered ${answer === null ? "null" : Array.isArray(answer) ? "an array" : typeof answer}; prompt.compose takes { overlays }`;
     const stray = Object.keys(answer).filter((k) => k !== "overlays");
     if (stray.length > 0)
         return `the answer carries ${stray.slice(0, 5).map((k) => JSON.stringify(extensionWords(k, 40))).join(", ")} (overlays only)`;
     const overlays = answer["overlays"];
-    return Array.isArray(overlays) && Object.getPrototypeOf(overlays) === Array.prototype ? overlays : "the answer's overlays is not an ordinary array";
+    return Array.isArray(overlays) ? overlays : "the answer's overlays is not an array";
 }
 export async function raisePromptCompose(bus, e, options) {
     if (!bus.hasHandlers("prompt.compose"))
@@ -357,6 +369,7 @@ function lateView() {
     };
     return {
         view,
+        entries: { "tool.call": (args, ctx) => need("tool.call").toolCall(args, ctx) },
         bind: (s) => {
             seats = s;
         },
@@ -365,19 +378,21 @@ function lateView() {
 export async function admitLegMods(input) {
     const late = lateView();
     const seats = modSeatsOf(input.spec, input.deps);
-    const bus = await admitMods({
-        side: "engine",
-        seats,
-        bottoms: engineMethodBottoms(late.view),
-        report: modsReportToOnError(input.deps.onError, input.sessionId),
-        describeThrown,
-        isProxy: types.isProxy,
-    });
+    const skillSeats = skillSeatsOf(input.skills);
+    const admitted = skillSeats.registrations.length === 0 ? seats : { ...seats, task: [...(seats.task ?? []), ...skillSeats.registrations] };
+    const report = modsReportToOnError(input.deps.onError, input.sessionId);
+    const kernelBus = await admitMods({ side: "engine", seats: admitted, bottoms: engineMethodBottoms(late.view), entries: late.entries, report, describeThrown, isProxy: types.isProxy });
+    const skillScopes = skillScopeRecord(skillSeats.owners, input.reopenedSkills);
+    const bus = legBusOf(scopedLegBus(kernelBus, skillScopes), report);
+    const standing = standingBus(bus, skillScopes);
     for (const record of bus.records) {
         if ("refusedBy" in record)
             deliverEngineNotice(input.deps.onNotice, registrationRefusedNotice(record, input.sessionId));
     }
-    return { bus, chain: recordAdmittedChain(bus, seats), bindFacade: late.bind };
+    const chain = recordAdmittedChain(bus, seats);
+    if (standing !== bus)
+        ADMITTED_CHAINS.set(standing, chain);
+    return { bus, standing, chain, skillScopes, bindFacade: late.bind };
 }
 function replyText(reply) {
     return reply.content.flatMap((c) => (c.type === "text" ? [c.text] : [])).join("");
@@ -415,6 +430,7 @@ export function legFacadeSeats(input) {
         now: () => (input.deps.now ?? Date.now)(),
         tools: () => [...input.activeTools],
         agents: () => (input.agentListing?.entries ?? []).map((e) => e.name),
+        toolCall: input.toolCall,
     };
 }
 export async function admitModChain(seats, onError) {

package/dist/core/mods/tool-call.d.ts

@@ -0,0 +1,79 @@
+/**
+ * The `tool.call` station: raised on the leg's bus between the gate letting a call go and the tool's body, for every
+ * execution of a call (the live loop's lanes through the loop's execution seat, the resumed leg's approved call through
+ * the same function). The chain's bottom is the tool's body; the event's failure column is `refuse_until_run`, so a
+ * handler's failure refuses the call while the body has not started and, once it has, the body's real result stands.
+ *
+ * `e = { tool, tool_use_id, agentId?, input }` (all four pinned — what the gate judged is what runs; a rewrite belongs to
+ * `classic.PreToolUse`) plus the identity envelope. A handler answers:
+ *  - `next(e)` — the body runs; what came up is `{ result: { content, isError } }`, a frozen view of the real result;
+ *  - `{ deny: <reason> }` — refused before the body: the call is not executed and the record says an extension refused it
+ *    (a deny once the body has started stands in place of a call that ran: a violation, the real result stands);
+ *  - `{ result }` — an extension's own result in place of the body (a string, or a list of text blocks), taken only when
+ *    both facts hold: the gate let this call go without anyone being asked about it (its latest gate record is an allow
+ *    with no settlement, release or clearance — a person's or a rule's yes is a yes to running the tool), and the body
+ *    has not started (the kernel's own record). Either missing, the answer is a violation: before the body the call is
+ *    refused, after it the real result stands. A taken result is the call's result; the record says the body never ran
+ *    and names the extension (`tool_end.notExecuted`, `tool_end.answeredBy`).
+ * Context for the model is added at `classic.PostToolUse`, not here. Whatever an extension answered in place of the body,
+ * the call's post-execution stations stay silent, as for a call the gate blocked.
+ *
+ * `$.tool.call({ tool, ...input })` is the event called (the table's `call` column): the host entry
+ * ({@link createToolCallEntry}) runs the loop's own per-call pipeline for the named tool — the whole gate, this station,
+ * the body, the post-execution stations — under the run's principal, with the caller's frames and origin on every event
+ * its pipeline raises (`extension-call.ts`), and no model message carrying it. It answers this event's own forms:
+ * `{ result: { content, isError } }` (the frozen view a handler's `next` gets), or `{ deny: <reason> }` when the call was
+ * refused (returned, not thrown).
+ */
+import type { AgentToolResult } from "../../internal/harness-types.js";
+import type { HookInvocationIdentity } from "../hooks.js";
+import type { ToolOccurrenceTable } from "../runner/tool-occurrence.js";
+import { type LegModBus } from "./stations.js";
+import type { ModBus, ModCallEntry } from "./kernel/index.js";
+/** One execution as the station sees it: the call, the tool that runs (its mounted name), the arguments the gate let go. */
+export interface ToolCallExecution {
+    readonly toolCallId: string;
+    readonly toolName: string;
+    readonly args: unknown;
+}
+/** The station over one execution: `run` runs the tool's body (at most once); the result is the call's result. */
+export type ToolCallStation = (call: ToolCallExecution, run: () => Promise<AgentToolResult<unknown>>, signal: AbortSignal | undefined) => Promise<AgentToolResult<unknown>>;
+export interface ToolCallStationInput {
+    readonly bus: LegModBus;
+    /** The leg's occurrence table: the gate record a substitute result is read against, and the answered-in-place record. */
+    readonly occurrences: Pick<ToolOccurrenceTable, "get" | "answeredInPlace" | "refuse">;
+    /** The calls whose post-execution stations stay silent (the gate's blocked set). */
+    readonly blockedToolCalls: Set<string>;
+    readonly identity?: HookInvocationIdentity;
+    readonly reminderMark?: string;
+}
+/** The station over the leg's bus, or undefined when no handler hangs on `tool.call` (nothing is raised; the body runs). */
+export declare function createToolCallStation(input: ToolCallStationInput): ToolCallStation | undefined;
+/** What the host entry runs a call on: the leg's harness (the loop's pipeline under the running prompt) and the tool identities. */
+export interface ToolCallEntryInput {
+    /** The leg bus every station raises on ({@link import("./extension-call.js").legBusOf}). */
+    readonly bus: ModBus;
+    readonly harness: Pick<import("../../internal/harness.js").AgentHarness, "callTool">;
+    /** The live roster's face of a mounted tool, by the name it is mounted under (`toolCallFaceOf`): its catalog contract. */
+    readonly faceOf: (toolName: string) => {
+        readonly contractId: string;
+    } | undefined;
+    /** The tool the leg mounted under this name, as the caller handed it (the one an `execute` binding is read off). */
+    readonly specOf: (toolName: string) => unknown;
+}
+/** `$.tool.call`'s host entry: the loop's per-call pipeline for the named tool, run as the caller's call (see the module header). */
+export declare function createToolCallEntry(input: ToolCallEntryInput): ModCallEntry;
+/**
+ * The gate's last word on an extension's own call, at its allow exit, on the arguments it lets go: the loop gives a call that
+ * is not batch-safe (a `cd`) the run to itself, and an extension's call is in no batch of the loop's — so one that is not
+ * batch-safe is let go only when no other call of the run is in flight, and a batch-safe one only while no call that is not
+ * batch-safe has been let go. `batchSafe` is the loop's own reading (`isBatchSafeToolCall`, through the harness). Undefined:
+ * let it go; a sentence: refused before it runs.
+ */
+export declare function extensionCallOverlap(input: {
+    readonly occurrences: Pick<ToolOccurrenceTable, "live">;
+    readonly toolCallId: string;
+    readonly toolName: string;
+    readonly args: unknown;
+    readonly batchSafe: (toolName: string, args: unknown) => boolean;
+}): string | undefined;