@sema-agent/core 7.54.1 → 7.56.0

package/dist/core/tool-catalog-entries.js

@@ -6,6 +6,7 @@ export const TASK_GET_TOOL_NAME = "TaskGet";
 export const TASK_UPDATE_TOOL_NAME = "TaskUpdate";
 export const TASK_LIST_TOOL_NAME = "TaskList";
 export const TODO_WRITE_TOOL_NAME = "TodoWrite";
+export const OUTPUT_TOOL_NAME = "StructuredOutput";
 export const REFRESH_MCP_TOOLS_TOOL_NAME = "RefreshMcpTools";
 export const ARTIFACT_TOOL_NAME = "Artifact";
 const shellRuleFace = (params) => ({ grammar: "command", primaryParams: ["command"], params });
@@ -57,7 +58,7 @@ export const TOOL_CATALOG_ENTRIES = [
     },
     {
         id: "bash", name: "Bash", source: "builtin", definedIn: "src/tools/fs/fs-bash.ts", mountedBy: ["hands"],
-        cards: ["bash", "readonly_out_of_root", "read_unestablished", "bash_invalid_timeout"],
+        cards: ["bash", "readonly_out_of_root", "read_unestablished", "bash_invalid_timeout", "bash_self_kill_refused"],
         face: {
             family: "shell", boundaryLegs: ["env"], effect: "write", contentOrigin: "execution", contract: c(FULL_SHELL_CONTRACT_ID),
             ruleFace: SHELL_RULE_FACE,
@@ -115,55 +116,56 @@ export const TOOL_CATALOG_ENTRIES = [
     },
     {
         id: "artifact", name: ARTIFACT_TOOL_NAME, source: "builtin", definedIn: "src/tools/artifact/artifact-tool.ts", mountedBy: ["optional"], cards: ["artifact"],
-        face: { family: "other", boundaryLegs: "per_call", effect: "write", contract: c("core.artifact@1"), ruleFace: { primaryParams: ["action"] }, renderHints: { summaryParams: ["action", "file_path", "url"] } },
+        face: { family: "other", boundaryLegs: "per_call", effect: "write", contract: c("core.artifact@1"), ruleFace: { primaryParams: ["action"], params: ["action", "file_path", "url", "title", "description", "favicon", "label", "baseVersion", "force", "publishContext", "scope", "limit", "path"] }, renderHints: { summaryParams: ["action", "file_path", "url"] } },
     },
-    { id: "enter-worktree", name: "EnterWorktree", source: "builtin", definedIn: "src/tools/worktree.ts", mountedBy: ["hands"], cards: ["worktree"], face: { family: "other", boundaryLegs: ["env"], effect: "write", contract: c("core.enter_worktree@1") } },
-    { id: "exit-worktree", name: "ExitWorktree", source: "builtin", definedIn: "src/tools/worktree.ts", mountedBy: ["hands"], cards: ["worktree"], face: { family: "other", boundaryLegs: ["env"], effect: "write", contract: c("core.exit_worktree@1") } },
-    { id: "task-output-hands", name: "TaskOutput", source: "builtin", definedIn: "src/tools/fs/fs-bash.ts", mountedBy: ["hands"], cards: [], face: { family: "delegate", boundaryLegs: ["env"], effect: "read", contract: TASK_OUTPUT_CONTRACT } },
-    { id: "task-stop-hands", name: "TaskStop", source: "builtin", definedIn: "src/tools/fs/fs-bash.ts", mountedBy: ["hands"], cards: [], face: { family: "delegate", boundaryLegs: ["env"], effect: "write", contract: TASK_STOP_CONTRACT } },
-    { id: "task-output", name: "TaskOutput", source: "builtin", definedIn: "src/core/task-registry.ts", mountedBy: ["delegation"], cards: ["task-output"], face: { family: "delegate", boundaryLegs: "per_call", effect: "read", contract: TASK_OUTPUT_CONTRACT } },
-    { id: "task-stop", name: "TaskStop", source: "builtin", definedIn: "src/core/task-registry.ts", mountedBy: ["delegation"], cards: ["task-stop"], face: { family: "delegate", boundaryLegs: "per_call", effect: "write", contract: TASK_STOP_CONTRACT } },
+    { id: "enter-worktree", name: "EnterWorktree", source: "builtin", definedIn: "src/tools/worktree.ts", mountedBy: ["hands"], cards: ["worktree"], face: { family: "other", boundaryLegs: ["env"], effect: "write", contract: c("core.enter_worktree@1"), ruleFace: { params: ["name", "path", "baseRef"] } } },
+    { id: "exit-worktree", name: "ExitWorktree", source: "builtin", definedIn: "src/tools/worktree.ts", mountedBy: ["hands"], cards: ["worktree"], face: { family: "other", boundaryLegs: ["env"], effect: "write", contract: c("core.exit_worktree@1"), ruleFace: { params: ["keep", "discardChanges", "action", "discard_changes"] } } },
+    { id: "task-output-hands", name: "TaskOutput", source: "builtin", definedIn: "src/tools/fs/fs-bash.ts", mountedBy: ["hands"], cards: [], face: { family: "delegate", boundaryLegs: ["env"], effect: "read", contract: TASK_OUTPUT_CONTRACT, ruleFace: { params: ["task_id", "filter"] } } },
+    { id: "task-stop-hands", name: "TaskStop", source: "builtin", definedIn: "src/tools/fs/fs-bash.ts", mountedBy: ["hands"], cards: [], face: { family: "delegate", boundaryLegs: ["env"], effect: "write", contract: TASK_STOP_CONTRACT, ruleFace: { params: ["task_id", "shell_id"] } } },
+    { id: "task-output", name: "TaskOutput", source: "builtin", definedIn: "src/core/task-registry.ts", mountedBy: ["delegation"], cards: ["task-output"], face: { family: "delegate", boundaryLegs: "per_call", effect: "read", contract: TASK_OUTPUT_CONTRACT, ruleFace: { params: ["task_id", "block", "timeout", "filter"] } } },
+    { id: "task-stop", name: "TaskStop", source: "builtin", definedIn: "src/core/task-registry.ts", mountedBy: ["delegation"], cards: ["task-stop"], face: { family: "delegate", boundaryLegs: "per_call", effect: "write", contract: TASK_STOP_CONTRACT, ruleFace: { params: ["task_id", "shell_id"] } } },
     { id: "monitor", name: "Monitor", source: "builtin", definedIn: "src/tools/monitor.ts", mountedBy: ["backgroundTasks"], cards: ["monitor-start", "readonly_out_of_root", "read_unestablished"], face: { family: "other", boundaryLegs: ["env"], effect: "write", contract: c("core.monitor@1"), ruleFace: shellRuleFace(["command", "description", "timeout_ms", "persistent"]), offloadThresholdChars: 10_000 } },
-    { id: "send-message", name: "SendMessage", protocol: ["teammate"], source: "builtin", definedIn: "src/agents/send-message-tool.ts", mountedBy: ["delegation", "hostInternals", "peerLane"], cards: ["send-message"], face: { family: "protocol", boundaryLegs: ["outside_write"], effect: "write", contract: c("core.send_message@1") } },
-    { id: "agent-transcript", name: "AgentTranscript", source: "builtin", definedIn: "src/agents/agent-transcript-tool.ts", mountedBy: ["delegation"], cards: ["agent-transcript"], face: { family: "delegate", boundaryLegs: [], effect: "read", contract: c("core.agent_transcript@1") } },
-    { id: "list-agents", name: "ListAgents", source: "builtin", definedIn: "src/agents/list-agents-tool.ts", mountedBy: ["delegation", "peerLane"], cards: ["list-agents"], face: { family: "protocol", boundaryLegs: [], effect: "read", aliases: ["ListPeers"], contract: c("core.list_agents@1") } },
-    { id: "read-inbox", name: "ReadInbox", source: "builtin", definedIn: "src/agents/read-inbox-tool.ts", mountedBy: ["peerLane"], cards: ["read-inbox"], face: { family: "protocol", boundaryLegs: [], effect: "read", contract: c("core.read_inbox@1"), offload: false, budgetExempt: true } },
-    { id: "workflow", name: "Workflow", source: "builtin", definedIn: "src/orchestration/run-workflow-tool.ts", mountedBy: ["workflow"], cards: ["workflow-run"], face: { family: "delegate", boundaryLegs: [], effect: "write", contract: c("core.workflow@1") } },
-    { id: "report-blocked", name: "ReportBlocked", protocol: ["delegated"], source: "builtin", definedIn: "src/core/runner/synthetic-tools.ts", mountedBy: ["always"], cards: [], face: { family: "scaffold", boundaryLegs: [], effect: "read", contract: c("core.report_blocked@1") } },
-    { id: "report-findings", name: "ReportFindings", source: "builtin", definedIn: "src/core/runner/synthetic-tools.ts", mountedBy: ["always"], cards: ["report-findings"], face: { family: "scaffold", boundaryLegs: [], effect: "read", contract: c("core.report_findings@1") } },
-    { id: "structured-output", name: "StructuredOutput", protocol: ["structured"], source: "synthetic", definedIn: "src/core/runner/synthetic-tools.ts", mountedBy: ["optional"], cards: [], face: { family: "scaffold", boundaryLegs: [], effect: "read", contract: c("core.structured_output@1") } },
-    { id: "skill", name: "Skill", source: "builtin", definedIn: "src/core/runner/synthetic-tools.ts", mountedBy: ["optional"], cards: [], face: { family: "scaffold", boundaryLegs: [], effect: "read", contract: c("core.skill@1") } },
-    { id: "read-tool-result", name: "ReadToolResult", source: "builtin", definedIn: "src/core/tool-result-store.ts", mountedBy: ["optional"], cards: [], face: { family: "scaffold", boundaryLegs: [], effect: "read", contract: c("core.read_tool_result@1"), budgetExempt: true } },
-    { id: "tool-search", name: "ToolSearch", source: "builtin", definedIn: "src/core/runner/tool-disclosure.ts", mountedBy: ["optional"], cards: ["tool-search"], face: { family: "scaffold", boundaryLegs: [], effect: "read", contract: c("core.tool_search@1") } },
-    { id: "ask-user-question", name: "AskUserQuestion", source: "builtin", definedIn: "src/core/ask-question.ts", mountedBy: ["optional"], cards: ["ask-question"], face: { family: "other", boundaryLegs: [], effect: "read", contract: c("core.ask_user_question@1"), renderHints: { approvalCard: "question" } } },
-    { id: "exit-plan-mode", name: "ExitPlanMode", source: "builtin", definedIn: "src/core/present-plan-tool.ts", mountedBy: ["optional"], cards: ["exit-plan-mode"], face: { family: "plan", boundaryLegs: [], effect: "read", contract: c("core.exit_plan_mode@1"), renderHints: { userFacingName: "", approvalCard: "plan" } } },
-    { id: "enter-plan-mode", name: "EnterPlanMode", source: "builtin", definedIn: "src/core/present-plan-tool.ts", mountedBy: ["optional"], cards: ["enter-plan-mode"], face: { family: "plan", boundaryLegs: [], effect: "read", contract: c("core.enter_plan_mode@1") } },
-    { id: "refresh-mcp-tools", name: REFRESH_MCP_TOOLS_TOOL_NAME, source: "builtin", definedIn: "src/core/runner/prepare-protocol-tools.ts", mountedBy: ["optional"], cards: [], face: { family: "protocol", boundaryLegs: ["outside_read"], effect: "read" } },
-    { id: "memory-search", name: "memory_search", source: "builtin", definedIn: "src/core/memory-engine/tools.ts", mountedBy: ["memory"], cards: [], face: { family: "memory", boundaryLegs: [], effect: "read", contentOrigin: "local", contract: c("core.memory_search@1", "7"), offload: false } },
-    { id: "memory-get", name: "memory_get", source: "builtin", definedIn: "src/core/memory-engine/tools.ts", mountedBy: ["memory"], cards: [], face: { family: "memory", boundaryLegs: [], effect: "read", contentOrigin: "local", contract: c("core.memory_get@1", "7"), offload: false } },
-    { id: "memory-index", name: "memory_index", source: "builtin", definedIn: "src/core/memory-engine/tools.ts", mountedBy: ["memory"], cards: [], face: { family: "memory", boundaryLegs: [], effect: "read", contentOrigin: "local", contract: c("core.memory_index@1", "2"), offload: false } },
-    { id: "memory-list", name: "memory_list", source: "builtin", definedIn: "src/core/shared-memory/tools.ts", mountedBy: ["memory"], cards: [], face: { family: "memory", boundaryLegs: [], effect: "read", contract: c("core.memory_list@1"), offload: false } },
-    { id: "memory-read", name: "memory_read", source: "builtin", definedIn: "src/core/shared-memory/tools.ts", mountedBy: ["memory"], cards: [], face: { family: "memory", boundaryLegs: [], effect: "read", contract: c("core.memory_read@1"), offload: false } },
-    { id: "cron-create", name: "CronCreate", protocol: ["teammate"], source: "builtin", definedIn: "src/tools/scheduler-tools.ts", mountedBy: ["scheduler"], cards: ["cron-create"], face: { family: "other", boundaryLegs: ["env"], effect: "write", contract: c("core.cron_create@1") } },
-    { id: "cron-delete", name: "CronDelete", protocol: ["teammate"], source: "builtin", definedIn: "src/tools/scheduler-tools.ts", mountedBy: ["scheduler"], cards: ["cron-delete"], face: { family: "other", boundaryLegs: ["env"], effect: "idempotent", contract: c("core.cron_delete@1") } },
-    { id: "cron-list", name: "CronList", protocol: ["teammate"], source: "builtin", definedIn: "src/tools/scheduler-tools.ts", mountedBy: ["scheduler"], cards: ["cron-list"], face: { family: "other", boundaryLegs: ["env"], effect: "read", contract: c("core.cron_list@1") } },
-    { id: "schedule-wakeup", name: "ScheduleWakeup", source: "builtin", definedIn: "src/tools/scheduler-tools.ts", mountedBy: ["scheduler"], cards: ["schedule-wakeup"], face: { family: "other", boundaryLegs: ["env"], effect: "write", contract: c("core.schedule_wakeup@1") } },
+    { id: "send-message", name: "SendMessage", protocol: ["teammate"], source: "builtin", definedIn: "src/agents/send-message-tool.ts", mountedBy: ["delegation", "hostInternals", "peerLane"], cards: ["send-message"], face: { family: "protocol", boundaryLegs: ["outside_write"], effect: "write", contract: c("core.send_message@1"), ruleFace: { params: ["to", "message", "summary", "notify_when_idle", "urgent"] } } },
+    { id: "agent-transcript", name: "AgentTranscript", source: "builtin", definedIn: "src/agents/agent-transcript-tool.ts", mountedBy: ["delegation"], cards: ["agent-transcript"], face: { family: "delegate", boundaryLegs: [], effect: "read", contract: c("core.agent_transcript@1"), ruleFace: { params: ["id", "lastN"] } } },
+    { id: "list-agents", name: "ListAgents", source: "builtin", definedIn: "src/agents/list-agents-tool.ts", mountedBy: ["delegation", "peerLane"], cards: ["list-agents"], face: { family: "protocol", boundaryLegs: [], effect: "read", aliases: ["ListPeers"], contract: c("core.list_agents@1"), ruleFace: { params: ["includeAll"] } } },
+    { id: "read-inbox", name: "ReadInbox", source: "builtin", definedIn: "src/agents/read-inbox-tool.ts", mountedBy: ["peerLane"], cards: ["read-inbox"], face: { family: "protocol", boundaryLegs: [], effect: "read", contract: c("core.read_inbox@1"), offload: false, budgetExempt: true, ruleFace: { params: ["limit"] } } },
+    { id: "workflow", name: "Workflow", source: "builtin", definedIn: "src/orchestration/run-workflow-tool.ts", mountedBy: ["workflow"], cards: ["workflow-run"], face: { family: "delegate", boundaryLegs: [], effect: "write", contract: c("core.workflow@1"), renderHints: { approvalCard: "workflow" }, ruleFace: { params: ["script", "name", "scriptPath", "resumeFromRunId"] } } },
+    { id: "report-blocked", name: "ReportBlocked", protocol: ["delegated"], source: "builtin", definedIn: "src/core/runner/synthetic-tools.ts", mountedBy: ["always"], cards: [], face: { family: "scaffold", boundaryLegs: [], effect: "read", contract: c("core.report_blocked@1"), ruleFace: { params: ["reason"] } } },
+    { id: "report-findings", name: "ReportFindings", source: "builtin", definedIn: "src/core/runner/synthetic-tools.ts", mountedBy: ["always"], cards: ["report-findings"], face: { family: "scaffold", boundaryLegs: [], effect: "read", contract: c("core.report_findings@1"), ruleFace: { params: ["level"] } } },
+    { id: "structured-output", name: OUTPUT_TOOL_NAME, protocol: ["structured"], source: "synthetic", definedIn: "src/core/runner/synthetic-tools.ts", mountedBy: ["optional"], cards: [], face: { family: "scaffold", boundaryLegs: [], effect: "read", contract: c("core.structured_output@1") } },
+    { id: "skill", name: "Skill", source: "builtin", definedIn: "src/core/runner/synthetic-tools.ts", mountedBy: ["optional"], cards: [], face: { family: "scaffold", boundaryLegs: [], effect: "read", contract: c("core.skill@1"), renderHints: { approvalCard: "skill" }, ruleFace: { params: ["skill", "args"] } } },
+    { id: "read-tool-result", name: "ReadToolResult", source: "builtin", definedIn: "src/core/tool-result-store.ts", mountedBy: ["optional"], cards: [], face: { family: "scaffold", boundaryLegs: [], effect: "read", contract: c("core.read_tool_result@1"), budgetExempt: true, ruleFace: { params: ["ref", "offset", "limit"] } } },
+    { id: "tool-search", name: "ToolSearch", source: "builtin", definedIn: "src/core/runner/tool-disclosure.ts", mountedBy: ["optional"], cards: ["tool-search"], face: { family: "scaffold", boundaryLegs: [], effect: "read", contract: c("core.tool_search@1"), ruleFace: { params: ["query", "max_results"] } } },
+    { id: "advisor", name: "advisor", source: "builtin", definedIn: "src/core/runner/advisor-tool.ts", mountedBy: ["optional"], cards: ["advisor"], face: { family: "scaffold", boundaryLegs: [], effect: "read", contentOrigin: "local", contract: c("core.advisor@1"), offload: false, budgetExempt: true, ruleFace: { params: [] } } },
+    { id: "ask-user-question", name: "AskUserQuestion", source: "builtin", definedIn: "src/core/ask-question.ts", mountedBy: ["optional"], cards: ["ask-question"], face: { family: "other", boundaryLegs: [], effect: "read", contract: c("core.ask_user_question@1"), renderHints: { approvalCard: "question" }, ruleFace: { params: [] } } },
+    { id: "exit-plan-mode", name: "ExitPlanMode", source: "builtin", definedIn: "src/core/present-plan-tool.ts", mountedBy: ["optional"], cards: ["exit-plan-mode"], face: { family: "plan", boundaryLegs: [], effect: "read", contract: c("core.exit_plan_mode@1"), renderHints: { userFacingName: "", approvalCard: "plan" }, ruleFace: { params: ["plan"] } } },
+    { id: "enter-plan-mode", name: "EnterPlanMode", source: "builtin", definedIn: "src/core/present-plan-tool.ts", mountedBy: ["optional"], cards: ["enter-plan-mode"], face: { family: "plan", boundaryLegs: [], effect: "read", contract: c("core.enter_plan_mode@1"), ruleFace: { params: [] } } },
+    { id: "refresh-mcp-tools", name: REFRESH_MCP_TOOLS_TOOL_NAME, source: "builtin", definedIn: "src/core/runner/prepare-protocol-tools.ts", mountedBy: ["optional"], cards: [], face: { family: "protocol", boundaryLegs: ["outside_read"], effect: "read", ruleFace: { params: ["server"] } } },
+    { id: "memory-search", name: "memory_search", source: "builtin", definedIn: "src/core/memory-engine/tools.ts", mountedBy: ["memory"], cards: [], face: { family: "memory", boundaryLegs: [], effect: "read", contentOrigin: "local", contract: c("core.memory_search@1", "7"), offload: false, ruleFace: { params: ["query", "limit", "includeSuperseded", "includeShadowed"] } } },
+    { id: "memory-get", name: "memory_get", source: "builtin", definedIn: "src/core/memory-engine/tools.ts", mountedBy: ["memory"], cards: [], face: { family: "memory", boundaryLegs: [], effect: "read", contentOrigin: "local", contract: c("core.memory_get@1", "7"), offload: false, ruleFace: { params: ["id", "slug", "scope", "offset", "limit", "lineCursor"] } } },
+    { id: "memory-index", name: "memory_index", source: "builtin", definedIn: "src/core/memory-engine/tools.ts", mountedBy: ["memory"], cards: [], face: { family: "memory", boundaryLegs: [], effect: "read", contentOrigin: "local", contract: c("core.memory_index@1", "2"), offload: false, ruleFace: { params: ["offset", "limit", "listingRev", "scope", "includeSuperseded", "includeShadowed"] } } },
+    { id: "memory-list", name: "memory_list", source: "builtin", definedIn: "src/core/shared-memory/tools.ts", mountedBy: ["memory"], cards: [], face: { family: "memory", boundaryLegs: [], effect: "read", contract: c("core.memory_list@1"), offload: false, ruleFace: { params: ["store", "path_prefix", "cursor"] } } },
+    { id: "memory-read", name: "memory_read", source: "builtin", definedIn: "src/core/shared-memory/tools.ts", mountedBy: ["memory"], cards: [], face: { family: "memory", boundaryLegs: [], effect: "read", contract: c("core.memory_read@1"), offload: false, ruleFace: { params: ["store", "path"] } } },
+    { id: "cron-create", name: "CronCreate", protocol: ["teammate"], source: "builtin", definedIn: "src/tools/scheduler-tools.ts", mountedBy: ["scheduler"], cards: ["cron-create"], face: { family: "other", boundaryLegs: ["env"], effect: "write", contract: c("core.cron_create@1"), ruleFace: { params: ["prompt", "cron", "recurring", "durable", "label"] } } },
+    { id: "cron-delete", name: "CronDelete", protocol: ["teammate"], source: "builtin", definedIn: "src/tools/scheduler-tools.ts", mountedBy: ["scheduler"], cards: ["cron-delete"], face: { family: "other", boundaryLegs: ["env"], effect: "idempotent", contract: c("core.cron_delete@1"), ruleFace: { params: ["id"] } } },
+    { id: "cron-list", name: "CronList", protocol: ["teammate"], source: "builtin", definedIn: "src/tools/scheduler-tools.ts", mountedBy: ["scheduler"], cards: ["cron-list"], face: { family: "other", boundaryLegs: ["env"], effect: "read", contract: c("core.cron_list@1"), ruleFace: { params: [] } } },
+    { id: "schedule-wakeup", name: "ScheduleWakeup", source: "builtin", definedIn: "src/tools/scheduler-tools.ts", mountedBy: ["scheduler"], cards: ["schedule-wakeup"], face: { family: "other", boundaryLegs: ["env"], effect: "write", contract: c("core.schedule_wakeup@1"), ruleFace: { params: ["delaySeconds", "reason", "prompt", "stop", "noop"] } } },
     {
         id: "web-fetch", name: "WebFetch", source: "builtin", definedIn: "src/tools/web.ts", mountedBy: ["scenario"], cards: ["web-fetch"],
-        face: { family: "web", boundaryLegs: ["outside_read"], effect: "read", contentOrigin: "external", contract: c("core.web_fetch@1"), ruleFace: { primaryParams: ["url"] }, renderHints: { summaryParams: ["url"], approvalCard: "fetch" }, compactable: true },
+        face: { family: "web", boundaryLegs: ["outside_read"], effect: "read", contentOrigin: "external", contract: c("core.web_fetch@1"), hostTarget: { param: "url" }, ruleFace: { primaryParams: ["url"], params: ["url", "prompt"] }, renderHints: { summaryParams: ["url"], approvalCard: "fetch" }, compactable: true },
     },
     {
         id: "web-search", name: "WebSearch", source: "builtin", definedIn: "src/tools/web.ts", mountedBy: ["scenario"], cards: ["web-search"],
-        face: { family: "web", boundaryLegs: ["outside_read"], effect: "read", contentOrigin: "external", contract: c("core.web_search@1"), ruleFace: { primaryParams: ["query"] }, renderHints: { summaryParams: ["query"] }, compactable: true },
+        face: { family: "web", boundaryLegs: ["outside_read"], effect: "read", contentOrigin: "external", contract: c("core.web_search@1"), ruleFace: { primaryParams: ["query"], params: ["query"] }, renderHints: { summaryParams: ["query"] }, compactable: true },
     },
-    { id: "todo-write", name: TODO_WRITE_TOOL_NAME, source: "builtin", definedIn: "src/tools/todo.ts", mountedBy: ["scenario"], cards: ["todo"], modelGate: "task-scaffold", face: { family: "plan", boundaryLegs: [], effect: "idempotent", contract: c("core.todo_write@1") } },
-    { id: "task-create", name: TASK_CREATE_TOOL_NAME, protocol: ["teammate"], source: "builtin", definedIn: "src/tools/task-list.ts", mountedBy: ["scenario"], cards: ["task"], modelGate: "task-scaffold", face: { family: "plan", boundaryLegs: [], effect: "write", contract: c("core.task_create@1") } },
-    { id: "task-get", name: TASK_GET_TOOL_NAME, protocol: ["teammate"], source: "builtin", definedIn: "src/tools/task-list.ts", mountedBy: ["scenario"], cards: ["task"], modelGate: "task-scaffold", face: { family: "plan", boundaryLegs: [], effect: "read", contract: c("core.task_get@1") } },
-    { id: "task-update", name: TASK_UPDATE_TOOL_NAME, protocol: ["teammate"], source: "builtin", definedIn: "src/tools/task-list.ts", mountedBy: ["scenario"], cards: ["task"], modelGate: "task-scaffold", face: { family: "plan", boundaryLegs: [], effect: "idempotent", contract: c("core.task_update@1") } },
-    { id: "task-list", name: TASK_LIST_TOOL_NAME, protocol: ["teammate"], source: "builtin", definedIn: "src/tools/task-list.ts", mountedBy: ["scenario"], cards: ["task-list"], modelGate: "task-scaffold", face: { family: "plan", boundaryLegs: [], effect: "read", contract: c("core.task_list@1") } },
-    { id: "agent", name: "Agent", source: "builtin", definedIn: "src/agents/subagent.ts", mountedBy: ["scenario"], cards: ["agent", "fork"], face: { family: "delegate", boundaryLegs: [], contentOrigin: "local", contract: c("core.agent@1") } },
-    { id: "observer-report", name: "ObserverReport", protocol: ["observer"], source: "builtin", definedIn: "src/agents/observer.ts", mountedBy: ["scenario"], cards: [], face: { family: "scaffold", boundaryLegs: [], effect: "write", contract: c("core.observer_report@1") } },
-    { id: "declare-done", name: "DeclareDone", protocol: ["goal"], source: "builtin", definedIn: "src/orchestration/goal.ts", mountedBy: ["scenario"], cards: [], face: { family: "scaffold", boundaryLegs: [], effect: "read" } },
+    { id: "todo-write", name: TODO_WRITE_TOOL_NAME, source: "builtin", definedIn: "src/tools/todo.ts", mountedBy: ["scenario"], cards: ["todo"], modelGate: "task-scaffold", face: { family: "plan", boundaryLegs: [], effect: "idempotent", contract: c("core.todo_write@1"), ruleFace: { params: [] } } },
+    { id: "task-create", name: TASK_CREATE_TOOL_NAME, protocol: ["teammate"], source: "builtin", definedIn: "src/tools/task-list.ts", mountedBy: ["scenario"], cards: ["task"], modelGate: "task-scaffold", face: { family: "plan", boundaryLegs: [], effect: "write", contract: c("core.task_create@1"), ruleFace: { params: ["subject", "description", "activeForm"] } } },
+    { id: "task-get", name: TASK_GET_TOOL_NAME, protocol: ["teammate"], source: "builtin", definedIn: "src/tools/task-list.ts", mountedBy: ["scenario"], cards: ["task"], modelGate: "task-scaffold", face: { family: "plan", boundaryLegs: [], effect: "read", contract: c("core.task_get@1"), ruleFace: { params: ["taskId"] } } },
+    { id: "task-update", name: TASK_UPDATE_TOOL_NAME, protocol: ["teammate"], source: "builtin", definedIn: "src/tools/task-list.ts", mountedBy: ["scenario"], cards: ["task"], modelGate: "task-scaffold", face: { family: "plan", boundaryLegs: [], effect: "idempotent", contract: c("core.task_update@1"), ruleFace: { params: ["taskId", "status", "subject", "description", "activeForm"] } } },
+    { id: "task-list", name: TASK_LIST_TOOL_NAME, protocol: ["teammate"], source: "builtin", definedIn: "src/tools/task-list.ts", mountedBy: ["scenario"], cards: ["task-list"], modelGate: "task-scaffold", face: { family: "plan", boundaryLegs: [], effect: "read", contract: c("core.task_list@1"), ruleFace: { params: [] } } },
+    { id: "agent", name: "Agent", source: "builtin", definedIn: "src/agents/subagent.ts", mountedBy: ["scenario"], cards: ["agent", "fork"], face: { family: "delegate", boundaryLegs: [], contentOrigin: "local", contract: c("core.agent@1"), ruleFace: { params: ["subagent_type", "description", "prompt", "name", "cwd", "model", "isolation", "run_in_background"] } } },
+    { id: "observer-report", name: "ObserverReport", protocol: ["observer"], source: "builtin", definedIn: "src/agents/observer.ts", mountedBy: ["scenario"], cards: [], face: { family: "scaffold", boundaryLegs: [], effect: "write", contract: c("core.observer_report@1"), ruleFace: { params: ["report"] } } },
+    { id: "declare-done", name: "DeclareDone", protocol: ["goal"], source: "builtin", definedIn: "src/orchestration/goal.ts", mountedBy: ["scenario"], cards: [], face: { family: "scaffold", boundaryLegs: [], effect: "read", ruleFace: { params: ["summary"] } } },
 ];
 export const ENGINE_CARDS = Object.freeze({
     mcp: "src/core/mcp.ts",
@@ -172,18 +174,42 @@ export const ENGINE_CARDS = Object.freeze({
     read_path_denied: "src/tools/fs/safety.ts",
     readonly_out_of_root: "src/tools/fs/shell-read-check.ts",
     read_unestablished: "src/tools/fs/shell-read-check.ts",
+    bash_self_kill_refused: "src/tools/fs/pattern-kill-guard.ts",
 });
 const byId = new Map();
 for (const e of TOOL_CATALOG_ENTRIES) {
     if (byId.has(e.id))
         throw new Error(`tool catalog: duplicate definition id ${JSON.stringify(e.id)}`);
+    if (e.face.pathTarget !== undefined && e.face.hostTarget !== undefined)
+        throw new Error(`tool catalog: ${JSON.stringify(e.id)} declares a path target and a host target — a face names one protected target`);
     byId.set(e.id, e);
 }
+const CATALOG_CONTRACTS = new WeakSet();
 export function toolFace(id) {
     const e = byId.get(id);
     if (e === undefined)
         throw new Error(`tool catalog: no definition ${JSON.stringify(id)}`);
-    return { contentOrigin: "local", ...structuredClone(e.face) };
+    const face = { contentOrigin: "local", ...structuredClone(e.face) };
+    if (face.contract !== undefined)
+        CATALOG_CONTRACTS.add(Object.freeze(face.contract));
+    return face;
+}
+export function isCatalogContract(contract) {
+    return typeof contract === "object" && contract !== null && CATALOG_CONTRACTS.has(contract);
+}
+export function engineMountedAs(ids) {
+    const contracts = new Set(ids.map((id) => {
+        const contractId = byId.get(id)?.face.contract?.contractId;
+        if (contractId === undefined)
+            throw new Error(`tool catalog: ${JSON.stringify(id)} declares no contract — an engine mount is judged by its definition's contract`);
+        return contractId;
+    }));
+    return (face) => face?.engineMounted === true && contracts.has(face.contractId);
+}
+export const isEngineShellFace = engineMountedAs(["bash", "bash-readonly"]);
+export function mountRuleFace(id) {
+    const primaryParams = toolFace(id).ruleFace?.primaryParams;
+    return primaryParams === undefined ? undefined : { primaryParams: [...primaryParams] };
 }
 function deepFreeze(value) {
     if (value !== null && typeof value === "object" && !Object.isFrozen(value)) {

package/dist/core/tool-check-reading.d.ts

@@ -11,6 +11,8 @@ export type ToolCheckStanding = Exclude<PermissionResult, {
     action: "deny";
 }>;
 /** What a reading came to. `minted` on an ask: the reading minted it over an allow (the ask carries no stamp of the round yet).
+ *  `cleared`: the allow layer's `hook` member cleared the ask, `entries` naming the registrations that spoke (the allow layer
+ *  records the clearance as it records the member's clear on a `classic.PreToolUse` allow).
  *  `approved`: a person an inherited installation's question went to approved an edit of the call — the gate's approved-edit
  *  pass takes it, as it takes an edit approved at this leg's own question. */
 export type ToolCheckReading = {
@@ -30,6 +32,7 @@ export type ToolCheckReading = {
     readonly allow: Extract<PermissionResult, {
         action: "allow";
     }>;
+    readonly entries: readonly string[];
 } | {
     readonly kind: "shadowed";
     readonly shadows: readonly AllowRuleShadow[];
@@ -53,6 +56,14 @@ export interface ToolCheckCall {
     readonly request: ToolCallRequest;
     readonly signal: AbortSignal | undefined;
 }
+/**
+ * The allow layer's `hook` member clearing an ask — an extension's word that the call needs no asking, whichever event spoke
+ * it (a `classic.PreToolUse` allow at the head of the layer, a `tool.check` allow behind the read-only arm): the allow over
+ * the args the gate judged (the policy's rewrite riding), named by the registrations that spoke.
+ */
+export declare function extensionAllowOf(speakers: readonly string[], rewrite: unknown): Extract<PermissionResult, {
+    action: "allow";
+}>;
 /** One chain a gate raises `tool.check` on: its raise over a projection; for the leg's own bus only, the allow layer's
  *  predicate under which its `allow` may clear an ask; for an inherited installation only, the settlement its question takes. */
 export interface ToolCheckChain {

package/dist/core/tool-check-reading.js

@@ -1,5 +1,5 @@
 import { refusalOf } from "./tool-policy.js";
-import { allowRuleShadowOf } from "./allow-entry.js";
+import { allowRuleShadowOf, withAllowRuleShadow } from "./allow-entry.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 import { failedHandlerClause } from "./mods/stations.js";
 const STANDS = Object.freeze({ kind: "stands" });
@@ -23,9 +23,14 @@ function readToolCheck(heard, standing, call, mayClear) {
     }
     if (standing.action === "allow")
         return STANDS;
+    const entries = heard.by !== undefined ? [heard.by] : [];
     if (mayClear?.() === true)
-        return { kind: "cleared", allow: { action: "allow", message: `${who} allowed this call`, decisionReason: "hook", ...rewritten } };
-    return { kind: "shadowed", shadows: [allowRuleShadowOf("hook", heard.by !== undefined ? [heard.by] : [])] };
+        return { kind: "cleared", allow: extensionAllowOf(entries, call.rewrite), entries };
+    return { kind: "shadowed", shadows: [allowRuleShadowOf("hook", entries)] };
+}
+export function extensionAllowOf(speakers, rewrite) {
+    const who = speakers.length > 0 ? speakers.map((s) => `extension "${inlineUntrusted(s, 80)}"`).join(", ") : "an extension";
+    return { action: "allow", message: `${who} allowed this call`, decisionReason: "hook", ...(rewrite !== undefined ? { updatedInput: rewrite } : {}) };
 }
 function speakerOf(heard) {
     return { who: heard.by !== undefined ? `extension "${inlineUntrusted(heard.by, 80)}"` : "an extension", why: heard.reason !== undefined ? `: ${inlineUntrusted(heard.reason, 500)}` : "" };
@@ -38,7 +43,7 @@ export async function readToolChecks(chains, standing, call, project) {
     let raised = false;
     let current = standing;
     let moved;
-    const shadows = [];
+    let shadows = [];
     for (const chain of chains) {
         const heard = await chain.raise(project(current, chain.mayClear));
         if (heard === undefined)
@@ -62,7 +67,7 @@ export async function readToolChecks(chains, standing, call, project) {
             continue;
         }
         if (reading.kind === "shadowed")
-            shadows.push(...reading.shadows);
+            shadows = reading.shadows.reduce(withAllowRuleShadow, shadows);
         if (reading.kind === "asked") {
             moved = { ...reading, minted: reading.minted || (moved?.kind === "asked" && moved.minted), ...(moved?.kind === "asked" && moved.marked === true ? { marked: true } : {}) };
             current = reading.ask;
@@ -75,6 +80,6 @@ export async function readToolChecks(chains, standing, call, project) {
     if (!raised)
         return undefined;
     if (moved?.kind === "asked" && shadows.length > 0)
-        return { ...moved, ask: { ...moved.ask, allowRuleShadowed: [...(moved.ask.allowRuleShadowed ?? []), ...shadows] } };
+        return { ...moved, ask: { ...moved.ask, allowRuleShadowed: shadows.reduce(withAllowRuleShadow, [...(moved.ask.allowRuleShadowed ?? [])]) } };
     return moved ?? (shadows.length > 0 ? { kind: "shadowed", shadows } : STANDS);
 }

package/dist/core/tool-conformance.js

@@ -33,5 +33,6 @@ export const TOOL_CONFORMANCE_VECTORS = [
         { name: "ToolSearch", why: "needs a deferred tool" },
         { name: "RefreshMcpTools", why: "needs a declared MCP server" },
         { name: "EnterPlanMode", why: "needs a checkpoint store beside plan mode" },
+        { name: "advisor", why: "needs a named advisor model and a ranked pair (TaskSpec.advisorModel, RunnerDeps.tiers)" },
     ]),
 ];

package/dist/core/tool-errors.d.ts

@@ -2,7 +2,7 @@ import type { TSchema } from "typebox";
 /**
  * Truncate a long error to head + "[N characters truncated]" + tail (design/64 §11.2, CC parity).
  *
- * Anchored on CC 2.1.220 `A7e` (the current authority; the previous anchor was CC 88's `toolErrors.ts`,
+ * Cut on the reference's current rule (an older implementation
  * which cut at raw code-unit indices): head and tail are cut on a code-POINT boundary — an astral character
  * straddling either cut is dropped whole rather than emitted as a lone surrogate — and the reported count is
  * `len − head − tail`, i.e. derived from what was actually KEPT, so a rollback is not under-reported.
@@ -10,7 +10,7 @@ import type { TSchema } from "typebox";
  * DELIBERATE DIVERGENCE from the sibling truncators in this repo (mcp.ts `truncateMcpErrorText`,
  * engine/compaction `truncateForSummary`, untrusted-egress `boundedString`), which iterate the kept length
  * down so the marker fits INSIDE the budget (RB-152): here the marker is NOT budgeted — a barely-over input
- * comes back ~36 chars LONGER than the budget. That is CC-verbatim behaviour (`A7e` keeps 5000+marker+5000),
+ * comes back ~36 chars LONGER than the budget. That is the reference's behaviour (it keeps 5000+marker+5000),
  * it is pinned as a contract in test/core-toolgate-coverage.test.ts, and changing it would be a divergence
  * FROM the anchor, not a fix. Recorded as an intentional divergence in the cc-parity divergence registry
  * (internal assets repo, `cc-parity/`), not as an open defect.

package/dist/core/tool-face-reader.js

@@ -2,11 +2,13 @@ import { dataKind, perToolEmptyName, perToolEntryRefusal, quotedName, receivePer
 import { isPlainRecord } from "./mods/kernel/receive.js";
 import { faceProblem } from "./runner/tool-face-overlay.js";
 import { inlineUntrusted } from "./untrusted-text.js";
-const TOOL_FACE_MEMBERS = { family: true, pathTarget: true, renderHints: true, ruleFace: true };
+const TOOL_FACE_MEMBERS = { family: true, pathTarget: true, hostTarget: true, renderHints: true, ruleFace: true };
 const PATH_TARGET_KINDS = { param: "string", aliases: "list", access: "string", skillScopeEligible: "boolean", base: "string", absent: "string", patternParam: "string" };
 const PATH_TARGET_REQUIRED = ["param", "access"];
+const HOST_TARGET_KINDS = { param: "string" };
+const HOST_TARGET_REQUIRED = ["param"];
 const RENDER_HINT_KINDS = { userFacingName: "string", activity: "string", summaryParams: "list", resultCards: "list", approvalCard: "string" };
-const RULE_FACE_KINDS = { primaryParams: "list", params: "list" };
+const RULE_FACE_KINDS = { primaryParams: "list", params: "list", nameValues: "list" };
 function kindProblem(label, value, kind) {
     if (value === undefined)
         return undefined;
@@ -47,7 +49,7 @@ function readOneToolFace(raw) {
     const face = membersOf(raw, "the face", Object.keys(TOOL_FACE_MEMBERS));
     if (typeof face === "string")
         return face;
-    const records = { pathTarget: [PATH_TARGET_KINDS, PATH_TARGET_REQUIRED], renderHints: [RENDER_HINT_KINDS, []], ruleFace: [RULE_FACE_KINDS, []] };
+    const records = { pathTarget: [PATH_TARGET_KINDS, PATH_TARGET_REQUIRED], hostTarget: [HOST_TARGET_KINDS, HOST_TARGET_REQUIRED], renderHints: [RENDER_HINT_KINDS, []], ruleFace: [RULE_FACE_KINDS, []] };
     const entries = [];
     for (const member of Object.keys(face)) {
         const value = face[member];

package/dist/core/tool-face.d.ts

@@ -40,7 +40,7 @@ import type { AssertAllKeysHandled } from "./ask-origin.js";
 /** The closed set of specialised approval cards a shell may pre-select from a render hint. The hint is a
  *  PRE-FILTER: the shell owns each card's input schema and validates the call's full args before
  *  mounting the card (design/388 §2.5 boundary ①). */
-export declare const TOOL_APPROVAL_CARDS: readonly ["file-edit", "file-write", "notebook-edit", "shell", "fetch", "plan", "question", "generic"];
+export declare const TOOL_APPROVAL_CARDS: readonly ["file-edit", "file-write", "notebook-edit", "shell", "fetch", "skill", "workflow", "plan", "question", "generic"];
 export type ToolApprovalCard = (typeof TOOL_APPROVAL_CARDS)[number];
 /** Membership in the closed set — the one screen a stored or declared card word passes before it is read. */
 export declare function isToolApprovalCard(word: unknown): word is ToolApprovalCard;
@@ -141,16 +141,34 @@ export interface ToolRosterPathTarget extends ToolCallPathTarget {
  * So the floor hands over the slot and keeps its mouth shut about the resolution.
  */
 export declare function pathTargetSlotOnly(pt: ToolCallPathTarget): ToolCallPathTarget;
+/**
+ * The parameter that names the URL a tool's call reaches — the HOST-RULE face: the slot a `<Tool>(domain:<host>)` rule of the
+ * tool's name is read on, in every direction (deny / ask / allow), by the one host reader (`callHostTargetOf`, host-target.ts).
+ * Host rules are a grammar of a tool NAME the catalog declares one for (today `WebFetch`); a face may declare a slot only on a
+ * tool of such a name (its wire name), and is refused on any other (`config.tool_face_invalid`). It says WHERE the named host is,
+ * never where the execution goes after it: only the engine's own fetch tool guarantees it connects to no host the gate did not
+ * judge (a cross-host redirect is handed back to the model). A face declares one protected target — this or a
+ * {@link ToolPathTarget}, never both. One shape for every spelling (a catalog row, a `ToolSpec`, the roster row, the call face,
+ * the parked approval row): the slot is all it carries.
+ */
+export interface ToolHostTarget {
+    readonly param: string;
+}
 /**
  * The parameter vocabulary a permission rule (`Tool(param:pattern)`) may name. DERIVED by default from
  * the tool's schema: the SCALAR top-level parameters (string/number/integer/boolean and their enum/const/
  * union forms) plus {@link ToolPathTarget.aliases}; object/array parameters never enter (a rule on them
- * can never match — `matchParamRules` skips non-scalar values). A declaration can only NARROW the derived
+ * can never match — the argument predicate `paramRuleReaches` skips non-scalar values). A declaration can only NARROW the derived
  * set; `primaryParams` defaults to the path target's `param` + aliases.
  */
 export interface ToolRuleFace {
     primaryParams?: readonly string[];
     params?: readonly string[];
+    /** The VALUES this mounted tool takes for the argument its name rules are read against — present on a tool whose rule row says
+     *  its values are the mounted tool's own (the name grammar's `values: "mounted"`, the delegation tool's `Agent(<subagent_type>)`):
+     *  the agent types this mount offers. Data, declared at mount; it rides the roster row and every call's face, and a rule of the
+     *  tool is resolved against it (`canonicalNameValue`). Absent on such a tool ⇒ its calls cannot be read against those rules. */
+    nameValues?: readonly string[];
 }
 /** The roster's WIRE bounds on a tool name and a contract member (design/388 §2.5 / B20). Distinct from
  *  protocol-naming's `TOOL_NAME_MAX_CHARS` (64), the provider-facing bound the MCP/A2A namespacing helper
@@ -211,6 +229,7 @@ export interface ToolFaceDeclaration {
     };
     aliases?: string[];
     pathTarget?: ToolPathTarget;
+    hostTarget?: ToolHostTarget;
     /**
      * The rule face ({@link ToolRuleFace}) and, for a definition whose primary parameter is a shell command line, the grammar
      * that judges it — `grammar: "command"`, the SHELL FACE. Every `Bash(<command>)` rule (the command grammar's one spelling,

package/dist/core/tool-face.js

@@ -1,6 +1,6 @@
 export const TOOL_FAMILIES = Object.freeze(["shell", "file-read", "file-write", "search", "web", "delegate", "plan", "scaffold", "memory", "protocol", "other"]);
 export const TOOL_MOUNT_TAGS = Object.freeze(["hands", "backgroundTasks", "workflow", "delegation", "hostInternals", "peerLane", "scheduler", "memory", "scenario", "always", "optional"]);
-export const TOOL_APPROVAL_CARDS = Object.freeze(["file-edit", "file-write", "notebook-edit", "shell", "fetch", "plan", "question", "generic"]);
+export const TOOL_APPROVAL_CARDS = Object.freeze(["file-edit", "file-write", "notebook-edit", "shell", "fetch", "skill", "workflow", "plan", "question", "generic"]);
 export function isToolApprovalCard(word) {
     return typeof word === "string" && TOOL_APPROVAL_CARDS.includes(word);
 }

package/dist/core/tool-model-gate.d.ts

@@ -1,5 +1,5 @@
 /**
- * design/277 — the tool-registration MODEL GATE (CC 233 counterpart, first formalized there as a
+ * design/277 — the tool-registration MODEL GATE (first formalized upstream as a
  * family+version-floor table over the todo/task-board tool family).
  *
  * WHAT THE GATE IS: a DEFAULT-MOUNT trim, never a capability ban. A {@link ToolSpec.modelGate}
@@ -34,15 +34,15 @@
 import type { ToolSpec } from "./types.js";
 /** The shared tail extractor (BYOM ids may carry provider prefixes — "openrouter/anthropic/claude-fable-5"):
  *  boundary-aware LAST path segment, case-folded. Single source for every model-family/model-id
- *  comparison site (`isFableFamilyModelId` consumes it too — the prompt-shape axis, semantically
- *  independent but sharing the one tail-extraction posture). */
+ *  comparison site (the tool-registration gate's; prompt text never reads a model id — it selects on the model's
+ *  declared traits). */
 export declare function modelIdTail(id: string): string;
 /** One gate class's matching rule (both axes optional; a rule with BOTH axes empty gates nothing —
  *  the per-class OFF shape a deployment reaches by explicitly clearing the axes). */
 export interface ToolModelGateRule {
     /** claude-syntax family+floor rows — meaningful only for ids whose TAIL SEGMENT matches
      *  `claude-<letters>-<digits(-digits)*>`. Version tuples compare positionally, missing positions
-     *  read 0, tuple ≥ floor ⇒ gated (CC 233 comparator, verbatim semantics). Any other id shape
+     *  read 0, tuple ≥ floor ⇒ gated (the reference's comparator semantics). Any other id shape
      *  falls through this axis entirely (fail-open). */
     floors?: ReadonlyArray<readonly [family: string, floor: ReadonlyArray<number>]>;
     /** Exact-id rows (explicit-id discipline): the resolved `Model.id`'s tail segment must equal the
@@ -52,7 +52,7 @@ export interface ToolModelGateRule {
     modelIds?: ReadonlyArray<string>;
 }
 /**
- * The built-in gate table: gate-class → rule. CC 233 z_S floors, verbatim (evidence D2; the
+ * The built-in gate table: gate-class → rule. The reference's floors (evidence D2; the
  * `mythos` row rides per the anchor). v1 vocabulary = ONE class, `"task-scaffold"` — the
  * TodoWrite/TaskCreate/TaskGet/TaskUpdate/TaskList default bundle (`assembleCodeTools`). One class
  * is evidence discipline, not mechanism limit: a family enters this table only with positive

package/dist/core/tool-name-aliases.d.ts

@@ -1,4 +1,5 @@
 import { type ProtocolNamespace } from "./protocol-table.js";
+import type { RuleBehavior } from "./permission-rule-model.js";
 /**
  * RB-476-A stage 2 (ruling 2026-08-02, RB-476 "no compatibility surface survives", replay
  * resolution included) — the durable-name machinery this module used to hold is RETIRED:
@@ -42,10 +43,12 @@ export declare const RULE_TOOL_NAME_VERDICTS: readonly ["current", "retired", "u
  *  - `unmintable_segment` — carries a protocol prefix, but a segment of it is not one the mint produces: the peer segment
  *    (the server / remote agent) is empty or not a spelling the mint produces for any peer (the name is read as written —
  *    peers compare exactly — and every mounted tool carries the minted spelling, so the name reaches none of them), or the
- *    tool segment is EMPTY (a trailing separator, `mcp__srv__`: no tool is minted under an empty segment). `guidance` says
- *    so in one line; `currentName` is the whole name rewritten with the spelling the mint produces (`mcp__github.com__*` →
- *    `mcp__github_com__*`), absent when a segment is empty and there is nothing to rewrite. A tool segment that is not empty
- *    is never judged: it is a literal tool name or a glob over one, and an unmatched one is the audit's advisory.
+ *    tool segment is EMPTY (a trailing separator, `mcp__srv__`: no tool is minted under an empty segment), or the peer segment
+ *    carries a wildcard the list's behavior does not read (`mcp__git*`, `mcp__*`, `mcp__*__get_*` in an allow list — a deny or
+ *    ask list reads every `*` as part of a glob over the whole name, see {@link readsNameGlob}). `guidance`
+ *    says so in one line; `currentName` is the whole name rewritten with the spelling the mint produces (`mcp__github.com__*` →
+ *    `mcp__github_com__*`), absent when a segment is empty or wild and there is nothing to rewrite. A tool segment that is not
+ *    empty is never judged: it is a literal tool name or a glob over one, and an unmatched one is the audit's advisory.
  *
  * `roster` = the tool names (aliases included) the reader knows are mounted: a run's assembled roster at prepare, the
  * names a deployment DECLARES it mounts its own tools under at a session-rule store (an empty set when it declares none).
@@ -65,7 +68,7 @@ export type RuleToolNameVerdict = {
 };
 /**
  * A name in ANY protocol namespace split into its owning namespace, its peer segment and its optional tool segment —
- * CC `rP` (:70710) verbatim, re-anchored on the {@link protocolOf} lookup instead of CC's literal `"mcp"` first split element.
+ * Re-anchored on the {@link protocolOf} lookup instead of CC's literal `"mcp"` first split element.
  * `undefined` for a name that is not namespaced (no protocol prefix). The peer is the first segment — EMPTY for `mcp____x` and
  * for the bare prefix, which name no peer; the tool segment is the REST of the split rejoined, so a tool whose minted segment
  * itself carries the separator (charset normalization maps `get..issue` → `get__issue`) decomposes back to one tool name, and
@@ -77,11 +80,29 @@ export declare function splitNamespacedName(name: string): {
     readonly peer: string;
     readonly tool?: string;
 } | undefined;
-/** See {@link RuleToolNameVerdict}. Pure; the one answer to "is this rule's tool name a name that reaches no tool". */
-export declare function judgeRuleToolName(name: string, roster: ReadonlySet<string>): RuleToolNameVerdict;
+/**
+ * Does a list of this behavior read a `*` in a tool name as a glob over the WHOLE name — anywhere in it, the lone `*` (every tool)
+ * included? A list that RESTRICTS (`deny`, `ask`) does: it reaches every tool any of whose names the glob matches (the reference's
+ * deny and ask lookups match a rule's tool name with `globMatching` on, and its settings validator says "deny and ask rules accept
+ * wildcards anywhere"). A list that GRANTS (`allow`) does not — an allow names the scope it widens, so it reads a `*` only in the
+ * tool segment after a literal `<ns>__<peer>__` ({@link grantWildcardRefusalOf}) — and neither does a caller that states no behavior.
+ */
+export declare function readsNameGlob(behavior: RuleBehavior | undefined): boolean;
+/**
+ * The sentence for a `*` in a tool name that a GRANTING list does not read — anywhere but the tool segment after a literal, non-empty
+ * `<ns>__<peer>__` — or `undefined` (no `*`, or one in that segment). The one test every allow-side reader asks (a policy's allowlist
+ * constructor, an entry list, a run's allowed list, the name judgment's allow arm), so a spelling an allow cannot read is refused
+ * or read as nothing in one sentence wherever it is written.
+ */
+export declare function grantWildcardRefusalOf(name: string): string | undefined;
+/** See {@link RuleToolNameVerdict}. Pure; the one answer to "is this rule's tool name a name that reaches no tool".
+ *  `behavior` = the behavior of the list the name is written in: a restricting one (`deny`, `ask`) reads a `*` anywhere in the name
+ *  as a glob ({@link readsNameGlob}) — such a name outside every namespace, or with a glob in its peer segment, is a pattern and
+ *  `current`; with `allow` or none a wildcard peer names no peer and is `unmintable_segment`. */
+export declare function judgeRuleToolName(name: string, roster: ReadonlySet<string>, behavior?: RuleBehavior): RuleToolNameVerdict;
 /** The two kinds of tool-name miss — a closed set. `unknown`: the name is none the engine ever mounted (a typo, a
  *  guess). `expected-absent`: the name is one the engine RETIRED ({@link RETIRED_TOOL_NAMES}), so its absence is no
- *  surprise and the table says what replaced it (CC 2.1.296 spells the same two words for its render-time miss). */
+ *  surprise and the table says what replaced it (the reference spells the same two words for its render-time miss). */
 export declare const TOOL_MISS_KINDS: readonly ["unknown", "expected-absent"];
 declare const UNKNOWN_MISS: "unknown", ABSENT_MISS: "expected-absent";
 /** What {@link judgeToolNameMiss} answers: the kind (a {@link TOOL_MISS_KINDS} word) and, for `expected-absent`, the clause. */

package/dist/core/tool-name-aliases.js

@@ -53,11 +53,29 @@ export function splitNamespacedName(name) {
     const [peer = "", ...rest] = name.slice(ns.prefix.length).split(NAMESPACE_SEPARATOR);
     return rest.length > 0 ? { ns, peer, tool: rest.join(NAMESPACE_SEPARATOR) } : { ns, peer };
 }
-function unmintableSegmentOf({ ns, peer, tool }) {
+export function readsNameGlob(behavior) {
+    return behavior === "deny" || behavior === "ask";
+}
+function peerWildcardGuidance(ns) {
+    return `an allow entry takes no wildcard in a ${ns.id} name's peer segment — write ${ns.prefix}<peer> (every tool of one peer), ${ns.prefix}<peer>${NAMESPACE_SEPARATOR}<tool> (one tool) or ${ns.prefix}<peer>${NAMESPACE_SEPARATOR}<glob> (the tools of one peer the glob matches); a deny or ask entry may put a \`*\` anywhere in a name`;
+}
+const GRANT_WILDCARD_GUIDANCE = "an allow entry names the tools it grants — a `*` in a tool name is read on an allow list only in the tool segment after a literal <ns>__<peer>__ (mcp__<server>__*), so this entry grants nothing; name the tools, or put the wildcard on a deny or ask entry, which reads a `*` anywhere in a name";
+export function grantWildcardRefusalOf(name) {
+    if (!name.includes("*"))
+        return undefined;
+    const split = splitNamespacedName(name);
+    if (split === undefined)
+        return GRANT_WILDCARD_GUIDANCE;
+    return split.peer !== "" && !split.peer.includes("*") && split.tool !== undefined ? undefined : peerWildcardGuidance(split.ns);
+}
+function unmintableSegmentOf(split, behavior) {
+    const { ns, peer, tool } = split;
     if (peer === "")
         return { kind: "unmintable_segment", guidance: `the ${ns.id} name has an empty peer segment — no tool is minted under it` };
     if (tool === "")
         return { kind: "unmintable_segment", guidance: `the ${ns.id} name has an empty tool segment — no tool is minted under it; write ${ns.prefix}<peer> to cover every tool of a peer, or ${ns.prefix}<peer>${NAMESPACE_SEPARATOR}<tool> for one tool` };
+    if (peer.includes("*"))
+        return readsNameGlob(behavior) ? undefined : { kind: "unmintable_segment", guidance: peerWildcardGuidance(ns) };
     const minted = mintNamespacePrefix(ns, peer).slice(ns.prefix.length, -NAMESPACE_SEPARATOR.length);
     if (minted === peer)
         return undefined;
@@ -67,7 +85,7 @@ function unmintableSegmentOf({ ns, peer, tool }) {
         currentName: `${ns.prefix}${minted}${tool !== undefined ? `${NAMESPACE_SEPARATOR}${tool}` : ""}`,
     };
 }
-export function judgeRuleToolName(name, roster) {
+export function judgeRuleToolName(name, roster, behavior) {
     if (roster.has(name))
         return CURRENT;
     const guidance = RETIRED_TOOL_NAMES.get(name);
@@ -77,8 +95,8 @@ export function judgeRuleToolName(name, roster) {
     }
     const split = splitNamespacedName(name);
     if (split === undefined)
-        return carriesNamespaceSeparator(name) ? UNPREFIXED : CURRENT;
-    return unmintableSegmentOf(split) ?? CURRENT;
+        return carriesNamespaceSeparator(name) && !(readsNameGlob(behavior) && name.includes("*")) ? UNPREFIXED : CURRENT;
+    return unmintableSegmentOf(split, behavior) ?? CURRENT;
 }
 export const TOOL_MISS_KINDS = Object.freeze(["unknown", "expected-absent"]);
 const [UNKNOWN_MISS, ABSENT_MISS] = TOOL_MISS_KINDS;