@sema-agent/core 7.54.1 → 7.56.0

package/dist/core/runner/gate-exit.d.ts

@@ -22,6 +22,7 @@
  * contract (`ToolGateInput`, `ToolGateResult`, the observer payload), which stays declared there.
  */
 import { type ClassifierDenyCause, type DeniedBy, type GateOutcome, type ModeRefusal, type ModeRelease, type Settlement } from "../gate-outcome.js";
+import type { AllowRuleClearance } from "../allow-rule-shadow.js";
 import type { AutoModeClassifierRound } from "../auto-mode.js";
 import { type Arbitration, type AskClassification, type AskFace, type AskOrigin, type AskOriginFacts } from "../ask-origin.js";
 import { type PermissionResult, type ResolvedAsk, type ToolCallRequest } from "../tool-policy.js";
@@ -49,6 +50,8 @@ export interface GateExitFacts {
     classifier?: AutoModeClassifierRound;
     /** The permission mode RELEASED the surviving ask (the allow exit's account of it); never beside `deniedBy`. */
     released?: ModeRelease;
+    /** An allow-layer member CLEARED the standing ask (the allow exit's account of it); never beside `deniedBy`, a settlement or a release. */
+    clearedBy?: AllowRuleClearance;
     /** The permission mode REFUSED the surviving ask — only beside `deniedBy: "mode"`. */
     modeRefusal?: ModeRefusal;
 }
@@ -235,9 +238,9 @@ export interface GatePass {
     hookAsk: Extract<PermissionResult, {
         action: "ask";
     }> | undefined;
-    /** borrowed-mutable — the phase-1 screen answered its own `allow` (the exact word), naming the registration that answered
-     *  it: the allow layer's hook member (its `entries`), which speaks only while no policy rewrote the arguments after the
-     *  screen saw them. Writer: the dispatch (phase 1). Reader: the lanes' allow layer (its one reader). */
+    /** borrowed-mutable — the screen answered its own `allow` (the exact word) for the bytes that run, naming the registration
+     *  that answered it: the allow layer's hook member (its `entries`). Writers: the dispatch (phase 1) and the fold's second
+     *  look after a policy rewrite (rewrite-rejudge.ts), whose answer replaces the first. Reader: the lanes' allow layer. */
     hookAllowedBy?: readonly string[];
     /** borrowed-mutable — `tool.check` was raised in this pass's first adjudication, which raises it once: set by the
      *  raise in front of the ask branch, read by the raise behind the read-only arm (it then raises nothing). Writer and
@@ -333,6 +336,9 @@ export interface GatePass {
     arbitration?: Exclude<Arbitration, {
         kind: "ask";
     }>;
+    /** borrowed-mutable — the allow-layer member that CLEARED the standing ask and the entries it stood on (the allow exit projects
+     *  it onto the disposition when nobody answered an ask on this pass). Writer: the lanes' allow layer. */
+    clearedBy?: AllowRuleClearance;
 }
 /**
  * The engine's fail-closed block of phase 1 — the PreToolUse face THREW or never ANSWERED, so the engine

package/dist/core/runner/gate-exit.js

@@ -23,7 +23,12 @@ export function mintGateOutcome(facts) {
                 ...(attribution !== undefined ? { classifier: attribution } : {}),
                 ...(facts.modeRefusal !== undefined ? { mode: facts.modeRefusal.mode, askClass: facts.modeRefusal.askClass, classes: Object.freeze([...facts.modeRefusal.classes]) } : {}),
             }
-            : { kind: "allowed", ...(attribution !== undefined ? { classifier: attribution } : {}), ...(facts.released !== undefined ? { released: Object.freeze({ ...facts.released, classes: Object.freeze([...facts.released.classes]) }) } : {}) }),
+            : {
+                kind: "allowed",
+                ...(attribution !== undefined ? { classifier: attribution } : {}),
+                ...(facts.released !== undefined ? { released: Object.freeze({ ...facts.released, classes: Object.freeze([...facts.released.classes]) }) } : {}),
+                ...(facts.clearedBy !== undefined ? { clearedBy: Object.freeze({ ...facts.clearedBy, entries: Object.freeze([...facts.clearedBy.entries]), ...(facts.clearedBy.positions !== undefined ? { positions: Object.freeze([...facts.clearedBy.positions]) } : {}) }) } : {}),
+            }),
         ...(facts.settled !== undefined ? { settlement: settlement, origin: facts.settled.origin } : {}),
     });
     const defects = screenGateOutcome(outcome, { reading: "producer" });
@@ -239,7 +244,7 @@ export function hookDenyExit(pass, deniedReason) {
         preToolContext: pass.preToolContext,
     };
 }
-const ANCESTOR_UNRESOLVED_CLASSIFICATION = classifyAsk({ action: "ask", message: "" }, { contentQuestion: false, markedUnresolvable: true, org: undefined, tightened: undefined, mandateMarks: {} });
+const ancestorUnresolvedClassification = (call) => classifyAsk({ action: "ask", message: "" }, { call, contentQuestion: false, markedUnresolvable: true, org: undefined, tightened: undefined, mandateMarks: {} });
 function unresolvableCauseOfSettlement(gate) {
     if (gate.disposition.kind !== "denied" || gate.disposition.deniedBy !== "ask_resolution" || gate.settlement === undefined)
         return undefined;
@@ -269,12 +274,13 @@ export async function exitGate(pass) {
         const tableSeat = unresolvable !== undefined ? askUnresolvableRemedySeat(unresolvable) : undefined;
         const remedySeat = tableSeat === "absent" && input.askSeatForm === "declared_none" && pass.askClassification?.classes.has("content_question") !== true ? "declared_none" : tableSeat;
         const bindingRefusal = attestationOf(pass.decision, { toolCallId, toolName })?.bindingRefusal;
-        const remedy = bindingRefusal !== undefined ? undefined : remedySeat !== undefined ? headlessApprovalRemedy({ mode: input.permissionMode?.(), classification: foldCause !== undefined ? ANCESTOR_UNRESOLVED_CLASSIFICATION : pass.askClassification, approverSeat: remedySeat, coveredWrite: isProtectedWrite(pass.req), ...(pass.shellUnplacedOptions !== undefined ? { unplacedOptions: pass.shellUnplacedOptions } : {}) }) : undefined;
+        const headless = bindingRefusal !== undefined ? undefined : remedySeat !== undefined ? headlessApprovalRemedy({ mode: input.permissionMode?.(), classification: foldCause !== undefined ? ancestorUnresolvedClassification(pass.req) : pass.askClassification, approverSeat: remedySeat, coveredWrite: isProtectedWrite(pass.req), ...(pass.shellUnplacedOptions !== undefined ? { unplacedOptions: pass.shellUnplacedOptions } : {}) }) : undefined;
+        const remedy = headless?.sentence;
         const denyReason = withParkFailureCause(`${decisionText(pass.decision) ?? `tool "${toolName}" denied by policy`}${remedy !== undefined ? ` — ${remedy}` : ""}`, pass.parkFailed, unresolvable !== undefined);
         if (unresolvable !== undefined) {
             const cause = unresolvable;
             const noticeRemedy = bindingRefusal ?? remedy;
-            pass.notifier.notify(() => input.onAskUnresolvable?.({ toolName, toolCallId, cause, parkLaneExisted: pass.suspendAsk !== undefined, ...(noticeRemedy !== undefined ? { remedy: noticeRemedy } : {}) }), "toolGate.onAskUnresolvable");
+            pass.notifier.notify(() => input.onAskUnresolvable?.({ toolName, toolCallId, cause, parkLaneExisted: pass.suspendAsk !== undefined, ...(noticeRemedy !== undefined ? { remedy: noticeRemedy } : {}), ...(headless !== undefined ? { remedies: headless.remedies } : {}) }), "toolGate.onAskUnresolvable");
         }
         const finalInput = frozenInputSnapshot(pass.currentInput);
         await notifyPermissionDenied({
@@ -315,7 +321,7 @@ export async function exitGate(pass) {
         return undefined; const a = pass.arbitration === undefined ? input.ancestorArbitrationOf?.(toolCallId) : undefined; return a?.kind === "released" ? a : undefined; })();
     return {
         updatedInput: pass.currentInput,
-        gate: mintGateOutcome({ ...(ledger.settled !== undefined ? { settled: ledger.settled } : {}), ...(pass.classifierRound !== undefined ? { classifier: pass.classifierRound } : {}), ...(release !== undefined ? { released: releaseRecordOf(release) } : {}) }),
+        gate: mintGateOutcome({ ...(ledger.settled !== undefined ? { settled: ledger.settled } : {}), ...(pass.classifierRound !== undefined ? { classifier: pass.classifierRound } : {}), ...(release !== undefined ? { released: releaseRecordOf(release) } : {}), ...(pass.clearedBy !== undefined && ledger.settled === undefined && release === undefined ? { clearedBy: pass.clearedBy } : {}) }),
         finalInput: frozenInputSnapshot(pass.currentInput),
         preToolContext: pass.preToolContext,
     };

package/dist/core/runner/image.d.ts

@@ -1,22 +1,12 @@
 import type { ImageContent } from "../../internal/llm.js";
+import { type HostFloor } from "../host-floor.js";
 import type { ImageInput } from "../types.js";
 /**
- * Block obviously-internal hosts (loopback / private ranges / link-local incl. cloud metadata / CGNAT / IPv6
- * ULA, site-local, unspecified, IPv4-mapped, NAT64). Classifies with `net.isIP` rather than a string-prefix
- * regex — the old regex both UNDER-matched (IPv4-mapped `::ffff:`, NAT64, CGNAT 100.64/10, `::`) and
- * OVER-matched (any DNS name starting `fc`/`fd`, e.g. `fdpartners.com`). Numeric IPv4 forms (decimal/octal/hex)
- * are normalized to dotted-decimal by `URL` before this is called, so they're already covered.
- * Note: this checks the LITERAL host; it does NOT resolve DNS, so a hostname resolving to a private IP is not
- * caught here (documented limitation — a deployment needing that supplies its own resolve-and-pin guard).
+ * The guard of a remote image URL: https only, then the one egress hop judge with the private-network floor (`hopRefusal`,
+ * host-floor.ts) — the deployment's host floor (`RunnerDeps.hostFloor`, `floor`) must admit the host, and a private host is
+ * reachable only when the floor's `only` list names it — so an end-user-supplied `images[].url` can't make the server fetch
+ * `169.254.169.254` or a private box. The host is read literally (no DNS resolution). Throws on a refused URL.
  */
-export declare function isPrivateHost(host: string): boolean;
-/**
- * Default SSRF guard for a remote image URL: https only, and no internal/reserved hosts (so an
- * end-user-supplied `images[].url` can't make the server fetch `169.254.169.254` or a private box).
- * Note: this checks the URL host literally — it does not resolve DNS, so a hostname that resolves to
- * a private IP is not caught here; a deployment needing that should supply `RunnerDeps.allowImageUrl`
- * (e.g. a CDN allowlist or a resolve-and-pin check). Throws on a disallowed URL.
- */
-export declare function defaultImageUrlGuard(raw: string): void;
+export declare function defaultImageUrlGuard(raw: string, floor?: HostFloor): void;
 /** Resolve an {@link ImageInput} (inline base64 or a URL to fetch) into a vendored `ImageContent` block. */
-export declare function toImageContent(img: ImageInput, allowUrl?: (url: string) => boolean): Promise<ImageContent>;
+export declare function toImageContent(img: ImageInput, floor: HostFloor | undefined): Promise<ImageContent>;

package/dist/core/runner/image.js

@@ -1,55 +1,10 @@
-import { isIP } from "node:net";
+import { hopRefusal } from "../host-floor.js";
 import { ADMITTED_IMAGE_MIME_TYPES, imageMagicMatches } from "../image-admission.js";
 import { admitInlineImage } from "./inline-image.js";
 function sniffImageMime(bytes) {
     return ADMITTED_IMAGE_MIME_TYPES.find((mime) => imageMagicMatches(bytes, mime));
 }
-function isPrivateV4(ip) {
-    const o = ip.split(".").map(Number);
-    if (o.length !== 4 || o.some((n) => !Number.isInteger(n) || n < 0 || n > 255))
-        return true;
-    const [a, b] = o;
-    return (a === 127 ||
-        a === 10 ||
-        a === 0 ||
-        (a === 172 && b >= 16 && b <= 31) ||
-        (a === 192 && b === 168) ||
-        (a === 169 && b === 254) ||
-        (a === 100 && b >= 64 && b <= 127));
-}
-function embeddedV4(h) {
-    const fromHex = (hi, lo) => {
-        const a = parseInt(hi, 16), c = parseInt(lo, 16);
-        return `${(a >> 8) & 255}.${a & 255}.${(c >> 8) & 255}.${c & 255}`;
-    };
-    let m = /^(?:::ffff:|64:ff9b::)(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/.exec(h);
-    if (m)
-        return m[1];
-    m = /^(?:::ffff:|64:ff9b::)([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(h);
-    if (m)
-        return fromHex(m[1], m[2]);
-    return undefined;
-}
-export function isPrivateHost(host) {
-    const h = host
-        .replace(/^\[|\]$/g, "")
-        .replace(/\.+$/, "")
-        .toLowerCase();
-    if (h === "localhost")
-        return true;
-    const fam = isIP(h);
-    if (fam === 0)
-        return false;
-    if (fam === 4)
-        return isPrivateV4(h);
-    const v4 = embeddedV4(h);
-    if (v4)
-        return isPrivateV4(v4);
-    if (h === "::1" || h === "::")
-        return true;
-    return /^fe[89ab]/.test(h) || /^f[cd]/.test(h) || /^fe[c-f]/.test(h);
-}
-export function defaultImageUrlGuard(raw) {
+export function defaultImageUrlGuard(raw, floor) {
     let u;
     try {
         u = new URL(raw);
@@ -60,9 +15,9 @@ export function defaultImageUrlGuard(raw) {
     if (u.protocol !== "https:") {
         throw new Error(`image url must be https (got "${u.protocol}")`);
     }
-    if (isPrivateHost(u.hostname)) {
-        throw new Error(`image url host not allowed (private/reserved): ${u.hostname}`);
-    }
+    const refused = hopRefusal(u, floor, true);
+    if (refused !== undefined)
+        throw new Error(`image url not fetched — ${refused}`);
 }
 const IMAGE_FETCH_TIMEOUT_MS = 30_000;
 const IMAGE_MAX_BYTES = 20 * 1024 * 1024;
@@ -112,17 +67,11 @@ async function fetchImageCapped(url) {
     }
     return { buf, mimeType: sniffed };
 }
-export async function toImageContent(img, allowUrl) {
+export async function toImageContent(img, floor) {
     if ("url" in img) {
-        if (allowUrl) {
-            if (!allowUrl(img.url)) {
-                throw new Error(`image url rejected by policy: ${img.url}`);
-            }
-        }
-        else {
-            defaultImageUrlGuard(img.url);
-        }
-        const { buf, mimeType } = await fetchImageCapped(img.url);
+        const url = img.url;
+        defaultImageUrlGuard(url, floor);
+        const { buf, mimeType } = await fetchImageCapped(url);
         return { type: "image", data: buf.toString("base64"), mimeType };
     }
     return admitInlineImage(img);

package/dist/core/runner/initial-run-state.js

@@ -4,7 +4,7 @@ export function createRunState() {
         degrade: { degradeToModel: undefined, degraded: undefined, outputErrorStreak: 0, outputInvalid: false, recordDegraded: () => { } },
         limits: { turnsExceeded: false, budgetHit: undefined, budgetAxis: undefined, platformTerminal: undefined, outputRetryCap: 0, effectiveMaxTurns: undefined },
         budget: { remainingMicroUsd: undefined, maxCostMicroUsd: undefined, remainingTokens: undefined, maxTokensWindow: undefined, overBudget: () => undefined, streamCancel: false, callOutputChars: 0, lastStreamBudgetCheck: 0, projectedOverBudget: () => undefined },
-        turn: { callStartAt: undefined, firstTokenAt: undefined, turnUsage: undefined, turnUsageMissing: false, turnStopReason: undefined, turnResponseModel: undefined, lastTurnHadToolCalls: false, toolBatch: [] },
+        turn: { callStartAt: undefined, firstTokenAt: undefined, turnUsage: undefined, turnUsageMissing: false, turnStopReason: undefined, turnResponseModel: undefined, toolBatch: [] },
         counters: { approachNoticesSent: 0, walltimeSyncBackstopFired: false, compactionFloor: 0, trimForceBackoff: false, compactionPasses: 0, repetitionCuts: 0, repetitionSpared: 0, repetitionEvents: [], REPETITION_EVENTS_CAP: 0, preemptIgnoredReported: false, wroteThisRun: false, finalVerifyInjections: 0, groundingSignalPreR9: false, groundingSignalPostR9: false, cadenceTurns: 0 },
         attach: { attachmentsCfg: undefined, agentListingOn: false, skillsListingOn: false, attachState: undefined, dateState: undefined, instrProbe: undefined, instrState: undefined, sizeGuidelineState: undefined, attachmentsInjected: 0 },
     };

package/dist/core/runner/permission-rule-lanes.d.ts

@@ -32,7 +32,7 @@ import { type HeadLeads } from "../path-rule-binding.js";
 import type { ToolCallLike } from "../tool-registry.js";
 import { type OrgRuleResolution } from "../permission-rule-org.js";
 import { type EffectivePermissionRules, type PermissionRuleStoreProvider, type PersonRowsRead } from "../permission-rule-provider.js";
-/** The one SHELL tool the persisted-rule lane's COMMAND grammar speaks for (the rule-offer face mints for it and the name tools); the other grammars' tools are derived (`ruleToolGrammarOf`). */
+/** The one SHELL tool the persisted-rule lane's COMMAND grammar speaks for (the rule-offer face mints for it, the name tools and the host tools); the other grammars' tools are derived (`ruleToolGrammarOf`). */
 export declare const PERSISTED_RULE_TOOL = "Bash";
 /**
  * The evidence an INHERITED-lane ask carries.
@@ -121,7 +121,7 @@ export interface PermissionRuleLanes {
  *  `onDegraded` receives the snapshot's degraded line ({@link describeUnreadableOrgRows}) on every adjudication over a
  *  snapshot carrying a row this layer cannot read. */
 export declare function orgRuleLane(cfg: {
-    read: (toolCallId: string) => Promise<Pick<EffectivePermissionRules, "org">>;
+    read: (toolCallId: string, judged: unknown) => Promise<Pick<EffectivePermissionRules, "org">>;
     questionToolMounted: boolean;
     questionToolName: string;
     onRevisionDefect: (message: string) => void;
@@ -177,10 +177,10 @@ export declare function createPermissionRuleLanes(cfg: {
     onRevisionDefect: (message: string) => void;
     /** Sink for a judgment against the rows that threw, and for the org lane's degraded-snapshot line. */
     onDisclosure: (message: string) => void;
-    /** The run's one reader of the person's rules: the call's ONE read, pinned, that the read station, the org lane and the
-     *  personal lane all take (the lanes consume a reader; they do not make one). */
+    /** The run's one reader of the person's rules: the call's ONE read of the bytes judged, pinned, that the read station, the
+     *  org lane and the personal lane all take (the lanes consume a reader; they do not make one). */
     rows: {
-        pin(toolCallId: string): Promise<PersonRowsRead>;
+        pin(toolCallId: string, judged?: unknown): Promise<PersonRowsRead>;
     };
     /** The allow layer's auto strip over a stored ALLOW row (true ⇒ out of this call's table BEFORE the coverage is chosen). */
     stripsAllow?: (rule: PersistedRule, req: ToolCallRequest) => boolean;
@@ -225,7 +225,7 @@ interface RuleOffersAskFacts extends RuleClearanceFacts {
  *    "stop asking me this" on a card that will keep asking lets a person mint a rule that never
  *    takes effect where they minted it.
  *
- * (CC 2.1.245 toolPolicy 对表, F11: "wildcard `ask` … keeps every matching tool behind a
+ * (toolPolicy 对表, F11: "wildcard `ask` … keeps every matching tool behind a
  * per-call prompt (no persistent always-allow)") — `matchedAskRule` was the one conjunct of the
  * lane's own clearing predicate this door did not mirror, and the asymmetry was live: the
  * persisted-rule lane refuses to clear ANY ask carrying it (`hooks.ts`, the

package/dist/core/runner/permission-rule-lanes.js

@@ -1,12 +1,14 @@
 import { persistedRuleMandateOf, ruleClearanceOf } from "../ask-origin.js";
 import {} from "../hooks.js";
-import { adjudicatePersistedDomainRules, adjudicatePersistedNameRules, adjudicatePersistedPathRules, adjudicatePersistedRules, callPathFaceOf, domainRuleSubjectOf, escapeForDisclosure, faceRowsSpeakFor, laneToolNamesOf, nameRuleSubjectOf, ruleToolGrammarOf, segmentCoverageOf, suggestRuleForName, suggestRulesForCommand } from "../permission-rule-model.js";
+import { adjudicatePersistedDomainRules, adjudicatePersistedNameRules, adjudicatePersistedPathRules, adjudicatePersistedRules, callPathFaceOf, eligiblePersisted, escapeForDisclosure, faceRowsSpeakFor, parseRuleText, laneToolNamesOf, nameRuleSubjectOf, ruleToolGrammarOf, segmentCoverageOf, suggestRuleForHost, suggestRuleForName, suggestRulesForCommand } from "../permission-rule-model.js";
+import { callHostTargetOf } from "../host-target.js";
 import { callTargetViewsOf, validatePath } from "../effective-path-target.js";
 import { bindPathRules, persistedRowAnchors, projectScopeIdentity } from "../path-rule-binding.js";
 import { heldBy, seatOf, wireOf } from "../tool-name-readings.js";
 import { describeUnreadableOrgRows, readOrgRules, settleOrgVerdictWithin } from "../permission-rule-org.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "../ask-question.js";
 import { ownerStoreOf } from "../permission-rule-provider.js";
+import { readPrincipal } from "../principal-name.js";
 import { thrownText } from "../thrown-value.js";
 import { strongestAnswer } from "../persisted-rule-arms.js";
 import { ORG_ADJUDICATION_TIMEOUT_MS } from "../permission-rule-org.js";
@@ -58,7 +60,7 @@ export function orgRuleLane(cfg) {
                 return { status: "available" };
             let resolution;
             try {
-                resolution = (await cfg.read(req.toolCallId)).org;
+                resolution = (await cfg.read(req.toolCallId, req.args)).org;
             }
             catch (err) {
                 return { status: "unavailable", disclosures: [`the permission-rule store threw while resolving the org partition: ${thrownText(err)}`] };
@@ -105,10 +107,10 @@ export function createPermissionRuleLanes(cfg) {
     }
     if (provider === undefined)
         return { personal: undefined, org: undefined };
-    const anonymous = cfg.principal === undefined || cfg.principal === "";
+    const anonymous = readPrincipal(cfg.principal).kind === "absent";
     const reader = cfg.rows;
-    const orgViewOf = async (toolCallId) => {
-        const read = await reader.pin(toolCallId);
+    const orgViewOf = async (toolCallId, judged) => {
+        const read = await reader.pin(toolCallId, judged);
         if (read.org === undefined)
             throw new Error(read.unreadable ?? "the store did not answer");
         return { org: read.org };
@@ -120,14 +122,24 @@ export function createPermissionRuleLanes(cfg) {
         const judged = laneToolNamesOf(req).map((n) => [n, ruleToolGrammarOf(n)]);
         if (!judged.some(([, g]) => g === "path") && faceRowsSpeakFor(callPathFaceOf(req)))
             judged.push([req.toolName, "path"]);
+        const view = await reader.pin(req.toolCallId, req.args);
         if (judged.length === 0)
-            return undefined;
-        const view = await reader.pin(req.toolCallId);
+            return view.unreadable !== undefined ? { unreadable: true } : undefined;
         try {
-            const table = view.rules.filter((r) => r.behavior !== "allow" || cfg.stripsAllow?.(r, req) !== true);
-            const leads = judged.some(([, g]) => g === "path") ? await cfg.leads.resolve(bindPathRules(table.filter((r) => r.match === "path" || r.match === "subpath").map((r) => ({ parsed: r, ruleText: r.rule, rule: r })), (spec) => anchorsOf(spec.rule))) : NO_LEADS;
+            const stripped = view.rules.filter((r) => r.behavior !== "allow" || cfg.stripsAllow?.(r, req) !== true);
+            const judgesPath = judged.some(([, g]) => g === "path");
+            const noRule = [];
+            const table = stripped.filter((r) => {
+                const read = judged.some(([n]) => n === r.tool) || (judgesPath && (r.match === "path" || r.match === "subpath")) ? parseRuleText(r.rule, r.behavior) : undefined;
+                if (read !== undefined && "reject" in read)
+                    noRule.push({ row: r, why: read.reject.message });
+                return read === undefined || !("reject" in read) || r.behavior !== "allow";
+            });
+            const leads = judgesPath ? await cfg.leads.resolve(bindPathRules(table.filter((r) => r.match === "path" || r.match === "subpath").map((r) => ({ parsed: r, ruleText: r.rule, rule: r })), (spec) => anchorsOf(spec.rule))) : NO_LEADS;
             const scopeIdentity = await projectScopeIdentity(table, cfg.rootCanonical, cfg.leads);
-            const answer = strongestAnswer(judged.map(([n, grammar]) => judgeAgainst(table, { ...req, toolName: n }, grammar, leads, scopeIdentity)));
+            const judgedAnswer = strongestAnswer(judged.map(([n, grammar]) => judgeAgainst(table, { ...req, toolName: n }, grammar, leads, scopeIdentity)));
+            const unjudged = noRule.find(({ row }) => (row.behavior === "deny" || row.behavior === "ask") && eligiblePersisted(row, { tool: row.tool, cwd: cfg.root, sessionId: cfg.sessionId, ...(scopeIdentity !== undefined ? { scopeIdentity } : {}) }, row.behavior));
+            const answer = unjudged !== undefined && !(judgedAnswer !== undefined && "behavior" in judgedAnswer && judgedAnswer.behavior === "deny") ? unjudgedRowAnswer(unjudged.row, unjudged.why, req.toolName) : judgedAnswer;
             const stands = answer !== undefined && (("behavior" in answer && answer.behavior === "deny") || "unreadable" in answer);
             return view.unreadable !== undefined && !stands ? { unreadable: true } : answer;
         }
@@ -137,6 +149,11 @@ export function createPermissionRuleLanes(cfg) {
             return { unreadable: true, reason: why };
         }
     };
+    const unjudgedRowAnswer = (row, refusal, tool) => {
+        const why = `the stored ${row.behavior} rule ${escapeForDisclosure(row.rule)} is no rule this engine reads (${refusal})`;
+        cfg.onDisclosure(`the persisted rule lane could not judge a ${tool} call against the rows it read — ${why}`);
+        return { unreadable: true, reason: why };
+    };
     const anchorsOf = (rule) => persistedRowAnchors(rule.scope, cfg.chainTop);
     const judgeAgainst = (table, req, grammar, leads, scopeIdentity) => {
         const liveCwd = cfg.liveCwd();
@@ -144,9 +161,9 @@ export function createPermissionRuleLanes(cfg) {
         if (grammar === "path")
             return pathRuleLaneAnswer(table, req, { root: cfg.root, sessionId: cfg.sessionId, anchorsOf, leads, ...scope });
         if (grammar === "name")
-            return persistedRuleAnswerOf(adjudicatePersistedNameRules(table, { tool: req.toolName, name: nameRuleSubjectOf(req.toolName, req.args), cwd: cfg.root, sessionId: cfg.sessionId, ...scope }));
+            return persistedRuleAnswerOf(adjudicatePersistedNameRules(table, { tool: req.toolName, request: req, cwd: cfg.root, sessionId: cfg.sessionId, ...scope }));
         if (grammar === "domain")
-            return persistedRuleAnswerOf(adjudicatePersistedDomainRules(table, { tool: req.toolName, host: domainRuleSubjectOf(req.toolName, req.args), cwd: cfg.root, sessionId: cfg.sessionId, ...scope }));
+            return persistedRuleAnswerOf(adjudicatePersistedDomainRules(table, { tool: req.toolName, hosts: { tighten: callHostTargetOf(req, "tighten"), grant: callHostTargetOf(req, "grant") }, cwd: cfg.root, sessionId: cfg.sessionId, ...scope }));
         const command = req.args?.command;
         if (typeof command !== "string")
             return undefined;
@@ -163,9 +180,10 @@ export function createPermissionRuleLanes(cfg) {
 export function createRuleOffersOf(cfg) {
     return (call, args, ask) => {
         const toolName = wireOf("offer.laneTool", call);
-        if (!cfg.laneArmed || (toolName !== PERSISTED_RULE_TOOL && ruleToolGrammarOf(toolName) !== "name"))
+        const grammar = ruleToolGrammarOf(toolName);
+        if (!cfg.laneArmed || (toolName !== PERSISTED_RULE_TOOL && grammar !== "name" && grammar !== "domain"))
             return {};
-        if ((cfg.principal === undefined || cfg.principal === "") && !cfg.localOwnerDeclared)
+        if (readPrincipal(cfg.principal).kind === "absent" && !cfg.localOwnerDeclared)
             return {};
         const tierSeat = seatOf("offer.marks", cfg.irreversibilityTier, call);
         const closedDoor = ruleClearanceOf(ask, {
@@ -175,10 +193,15 @@ export function createRuleOffersOf(cfg) {
         }).word;
         if (closedDoor !== undefined)
             return { ruleOffersAbsence: closedDoor };
-        if (ruleToolGrammarOf(toolName) === "name") {
+        if (grammar === "name") {
             const offer = suggestRuleForName(toolName, nameRuleSubjectOf(toolName, args) ?? "");
             return offer !== undefined ? { ruleOffers: [offer] } : { ruleOffersAbsence: "lane_cannot_speak" };
         }
+        if (grammar === "domain") {
+            const host = callHostTargetOf({ toolName: call.toolName, args, face: call.face }, "grant");
+            const offer = host !== undefined && "host" in host ? suggestRuleForHost(toolName, host.host) : undefined;
+            return offer !== undefined ? { ruleOffers: [offer] } : { ruleOffersAbsence: "lane_cannot_speak" };
+        }
         const command = args?.command;
         if (typeof command !== "string")
             return { ruleOffersAbsence: "lane_cannot_speak" };

package/dist/core/runner/person-path-rows.d.ts

@@ -1,12 +1,13 @@
 /**
  * The person's persisted rules as ONE run reads them.
  *
- * ## One read per adjudicated call
+ * ## One read per judgment of a call's bytes
  *
- * A call is judged against ONE read of the store, pinned to its `toolCallId` ({@link PersonPathRows.pin}): whichever of the
- * call's consumers asks first — the read station's judgment, the org layer, the personal rule lane — takes the read, the
- * others are handed the same answer, and the tables the call's tool judges with when it executes are compiled from it
- * ({@link PathTablesFacade.forCall}). A call is an attempt the leg's occurrence table holds; the pin is released when the
+ * A call's bytes are judged against ONE read of the store, pinned to its `toolCallId` ({@link PersonPathRows.pin}): whichever
+ * of the consumers judging those bytes asks first — the read station's judgment, the org layer, the personal rule lane —
+ * takes the read, the others are handed the same answer, and the tables the call's tool judges with when it executes are
+ * compiled from it ({@link PathTablesFacade.forCall}). Judging other bytes of the same call (an approved edit) is another
+ * judgment: it takes a new read, which the call then holds — a rule written while a person decided binds their edit. A call is an attempt the leg's occurrence table holds; the pin is released when the
  * table no longer holds that attempt. A judgment that is no call of the leg (a visibility probe's fixed id, a gate with no
  * leg) keeps nothing: its rule lanes take a read of their own, its read station the run's latest tables.
  *
@@ -106,10 +107,12 @@ export interface PersonPathRows {
     readonly holdsPersonRows: boolean;
     /** The prepare read — the unit's first write. `undefined`, synchronously, when there is no person's rows to read. */
     prime(): Promise<void> | undefined;
-    /** The rows of a call's one read — a call the leg's occurrence table holds: taken by its first consumer, handed to every
-     *  other until the table no longer holds that attempt; any other judgment (no leg, or an id the table does not hold — a
-     *  visibility probe) takes a read of its own, kept by nobody. Bounded ({@link PERSON_READ_BOUND_MS}); never rejects. */
-    pin(toolCallId: string): Promise<PersonRowsRead>;
+    /** The rows of a call's one read of the bytes it judges (`judged`) — a call the leg's occurrence table holds: taken by its
+     *  first consumer, handed to every other that judges the same bytes (or names none) until the table no longer holds that
+     *  attempt; a judgment of OTHER bytes of the call (an approved edit, its outlet form) takes a new read, which the call then
+     *  holds — a judgment reads the store, as the session rules' does. Any other judgment (no leg, or an id the table does not
+     *  hold — a visibility probe) takes a read of its own, kept by nobody. Bounded ({@link PERSON_READ_BOUND_MS}); never rejects. */
+    pin(toolCallId: string, judged?: unknown): Promise<PersonRowsRead>;
     /** Settles once the tables a reader takes are compiled: a pinned call's own; any other reader's (no id, or a call holding
      *  no pin), the unit's newest — through every change that lands meanwhile, within {@link PATH_TABLES_READY_BOUND_MS} —
      *  or at `signal` or the run's cut ({@link PersonPathRowsConfig.signal}). Never rejects: a reader whose wait was cut

package/dist/core/runner/person-path-rows.js

@@ -1,5 +1,7 @@
 import { ownerStoreOf } from "../permission-rule-provider.js";
+import { readPrincipal } from "../principal-name.js";
 import { ORG_ADJUDICATION_TIMEOUT_MS } from "../permission-rule-org.js";
+import { canonicalize } from "../canonical-json.js";
 import { PATH_RULE_FACES, READ_RULE_TOOL, eligiblePersisted, noticeRuleText } from "../permission-rule-model.js";
 import { bindPathRules, persistedRowAnchors, projectScopeIdentity } from "../path-rule-binding.js";
 import { DEFAULT_GATE_AWAIT_TIMEOUT_MS, gateWaitFailureOf, withGateTimeout } from "../gate-bounded-await.js";
@@ -21,7 +23,7 @@ const COMPILED_TABLES_KEPT = 8;
 export const EMPTY_READ_ROOTS = Object.assign(() => [], { forCall: () => () => [], ready: () => Promise.resolve() });
 export function createPersonPathRows(cfg) {
     const provider = cfg.provider;
-    const anonymous = cfg.principal === undefined || cfg.principal === "";
+    const anonymous = readPrincipal(cfg.principal).kind === "absent";
     const holdsPersonRows = provider !== undefined && provider.partitions.durable && (!anonymous || cfg.localOwnerDeclared);
     const partitions = PARTITIONS.filter((p) => (p === "durable" ? provider?.partitions.durable === true : provider?.partitions.session === true));
     const unit = { durable: { failedSeq: 0 }, session: { failedSeq: 0 } };
@@ -186,20 +188,29 @@ export function createPersonPathRows(cfg) {
         pins.delete(toolCallId);
         return undefined;
     };
-    const enter = (toolCallId, attempt) => {
+    const enter = (toolCallId, attempt, judged) => {
         const rows = readOnce("call").then((read) => (entry.read = read));
-        const entry = { attempt, rows, tables: holdsPersonRows ? rows.then((read) => settleTables(entry, read)) : Promise.resolve(), ...(holdsPersonRows ? {} : { settled: {} }) };
+        const entry = { attempt, rows, tables: holdsPersonRows ? rows.then((read) => settleTables(entry, read)) : Promise.resolve(), ...(holdsPersonRows ? {} : { settled: {} }), ...(judged !== undefined ? { judged: { value: judged } } : {}) };
         pins.set(toolCallId, entry);
         return entry;
     };
-    const pin = (toolCallId) => {
+    const serves = (p, judged) => {
+        if (judged === undefined || p.judged === undefined || p.judged.value === judged)
+            return true;
+        p.judged.canonical ??= canonicalize(p.judged.value);
+        return p.judged.canonical === canonicalize(judged);
+    };
+    const pin = (toolCallId, judged) => {
         for (const id of [...pins.keys()])
             pinOf(id);
         const known = pinOf(toolCallId);
-        if (known !== undefined)
+        if (known !== undefined && serves(known, judged)) {
+            if (judged !== undefined)
+                known.judged ??= { value: judged };
             return known.rows;
+        }
         const attempt = cfg.occurrences?.get(toolCallId);
-        return attempt === undefined ? readOnce("call") : enter(toolCallId, attempt).rows;
+        return attempt === undefined ? readOnce("call") : enter(toolCallId, attempt, judged).rows;
     };
     const settleTables = async (entry, read) => {
         try {
@@ -317,7 +328,7 @@ export function onPinnedRead(rows, stations) {
             const id = callOpts.toolCallId;
             if (readStationMemberOf(call, members) === undefined)
                 return check.judge(call, args, cwd, signal, callOpts);
-            const ready = id !== undefined && rows.holds(id) ? rows.pin(id).then(() => rows.tablesReady(id)) : rows.tablesReady(undefined, signal);
+            const ready = id !== undefined && rows.holds(id) ? rows.pin(id, args).then(() => rows.tablesReady(id)) : rows.tablesReady(undefined, signal);
             return ready.then(() => check.judge(call, args, cwd, signal, callOpts) ?? VOUCHED);
         },
         unanswered: (call, cause) => check.unanswered(call, cause),
@@ -367,7 +378,7 @@ export function ruleStoreUnreadableNotice(onNotice, ids) {
         const which = sources !== undefined && sources.length > 0 ? `your persisted permission rules from the ${sourcesWord(sources)} sources` : "your persisted permission rules";
         deliverEngineNotice(onNotice, {
             code: "permission.rule_store_unavailable",
-            message: `${which} could not be read ${at === "prepare" ? "when this run started" : "for a call on this run"}. Until a read of them succeeds, none of their allow rows (Read directory rows included) applies, while the deny and ask rows most recently read from them this run still apply — a deny row you removed since that read keeps refusing until then. While they cannot be read, every call your rules judge (a file read, a write, a command) is asked about rather than allowed, until a read of them succeeds. Every later check reads them again.`,
+            message: `${which} could not be read ${at === "prepare" ? "when this run started" : "for a call on this run"}. Until a read of them succeeds, none of their allow rows (Read directory rows included) applies, while the deny and ask rows most recently read from them this run still apply — a deny row you removed since that read keeps refusing until then. While they cannot be read, every call is asked about rather than allowed, whatever its tool (rules nobody can read may name any), until a read of them succeeds. Every later check reads them again.`,
             detail: { at, sessionId: ids.sessionId, runId: ids.runId },
         });
     };

package/dist/core/runner/prepare-advisor.d.ts

@@ -0,0 +1,63 @@
+/**
+ * PrepareTask's ADVISOR phase: whether this leg mounts the `advisor` tool, and what it owes the model about it. In order —
+ * the deployment switch (`RunnerDeps.advisorTool: "disabled"` ignores the spec's advisor model unread); the static verdict
+ * (`advisorAttachVerdict`, the one answer a host's advisor query reads too); then the mount chain — the reserved name, the
+ * leg's tool selector (its valve's own predicate, asked of the tool's name), the conversation's hold (the transcript), the
+ * advisor route (the shared derived-seat pre-flight, posture `detach`) — and the mount. Its answer is the manifest fact,
+ * the person's notice for a reason they are told (root legs only, once per conversation per pair), and the leg's
+ * instruction seat (what the model is owed, against what it was told in the conversation's current segment).
+ *
+ * Runs after the scaffold mounts and before the tool-face fold, so the deferred classification, the prompt and the
+ * manifest see the roster the leg runs with. A leg whose spec names no advisor model and whose conversation never told
+ * the model about one does nothing here and reads nothing.
+ */
+import type { SessionTreeEntry } from "../../internal/harness-types.js";
+import type { Model } from "../../internal/llm.js";
+import type { CompactionForkContext } from "../auto-compaction.js";
+import type { ToolSelector } from "../tool-face.js";
+import type { RosterBuilder } from "../tool-roster.js";
+import { type RunnerDeps, type TaskSpec } from "../types.js";
+import type { WiringAdvisorFact } from "../wiring-manifest.js";
+import { type AdvisorInstructionSeat } from "./advisor-instructions.js";
+import { type AnnounceOnceLedger } from "./announce-once-ledger.js";
+import type { Prepared } from "./contracts.js";
+export interface PrepareAdvisorInput {
+    /** borrowed-readonly — the REBOUND spec: the advisor model, the caller's tools (the reserved name), the whole-face switch, the auth hook. */
+    spec: Pick<TaskSpec, "advisorModel" | "tools" | "excludeAllTools" | "getApiKeyAndHeaders">;
+    /** borrowed-readonly — the deployment switch as the value door screened it. */
+    advisorTool: "disabled" | undefined;
+    /** borrowed-readonly — the catalog and tiers the verdict reads, the brain the advisor lane books, the notice sink. */
+    deps: Pick<RunnerDeps, "models" | "tiers" | "brain" | "onNotice">;
+    /** borrowed-readonly — the leg's resolved main model. */
+    model: Model;
+    /** borrowed-mutable — the mount array (the advisor tool is mounted on it). */
+    roster: RosterBuilder;
+    /** borrowed-readonly — the leg's frozen tool selector (the valve's predicate). */
+    selector: ToolSelector;
+    /** borrowed-readonly — the acquired session: its branch (the hold, the segment). */
+    session: {
+        getBranch(): Promise<ReadonlyArray<SessionTreeEntry>>;
+    };
+    /** borrowed-readonly — the once-per-session ledger: what the model was told (`arms().advisor`), and the notice's dedupe. */
+    onceLedger: Pick<AnnounceOnceLedger, "arms" | "oncePerSession">;
+    /** borrowed-readonly — a leg the person reads (not a delegated child): only such a leg tells them. */
+    rootLeg: boolean;
+    /** borrowed-readonly — the acquired session's id (the notice's routing key). */
+    sessionId: string;
+    /** borrowed-readonly — this invocation's id (the notices' correlation key). */
+    runId: string | undefined;
+    /** borrowed-readonly — the leg's usage-account door (the run body binds it before any tool call). */
+    sideCallBookRef: Prepared["sideCallBookRef"];
+    /** borrowed-readonly — the request the main lane last sent (read at each call). */
+    lastSentRequest: () => CompactionForkContext | undefined;
+    /** borrowed-readonly — the leg's resolved brain-call guardrail (the value doors' answer; `undefined` = off). */
+    brainCallGuardrailMs: number | undefined;
+}
+export interface PrepareAdvisorResult {
+    /** The manifest's `advisor` fact; absent ⇔ the spec names no advisor model. */
+    manifest: WiringAdvisorFact | undefined;
+    /** The leg's instruction seat; absent when there is nothing to tell and nothing told. */
+    instruction: AdvisorInstructionSeat | undefined;
+}
+/** The phase body — see the module header. Throws only `config.reserved_tool_name` (a caller tool named `advisor` on a leg that mounts it). */
+export declare function prepareAdvisor(input: PrepareAdvisorInput): Promise<PrepareAdvisorResult>;