@sema-agent/core 7.55.0 → 7.56.0

package/dist/core/runner/prepare-config-doors.js

@@ -3,8 +3,10 @@ import { assertContainmentFaceValue } from "../../tools/fs/index.js";
 import { MICRO_COMPACT_MACHINES } from "../context-edit.js";
 import { assertAddOnlySeats } from "../child-clamp-seats.js";
 import { CROSS_BOUNDARY_POSTURES } from "../cross-boundary-taint.js";
+import { compileHostFloor } from "../host-floor.js";
 import { assertNoRetiredRunnerDeps } from "./retired-runner-deps.js";
 import { recordedModeSeed, resolveCheckpointStore } from "../checkpoint-store.js";
+import { assertCheckpointStoreJudgesHolder, assertHolderValue } from "../checkpoint-generation.js";
 import { asResumeConfigRefusal, refusePermissionModeDoors } from "../mode-policy.js";
 import { resolveOutputStyleFrame } from "../output-style.js";
 import { screenUserAttachments } from "../user-attachment.js";
@@ -15,21 +17,24 @@ import { assertAutoConsolidationWirable } from "./memory-consolidation-driver.js
 import { isModelPriced, malformedPricingField, modelCostToPricing } from "../pricing.js";
 import { ENTER_AS_IS, preflightLockedConfig } from "../locked-config.js";
 import { assertRetentionCapability } from "../retention.js";
-import { resolveModel, resolveTaskModel, roleModelIfSet } from "../roles.js";
+import { resolveModel, resolveTaskModel, roleModelIfSet, screenRoleMap } from "../roles.js";
 import { resolveSkillListingBudget } from "../skill-listing-budget.js";
 import { describeRejectedValue } from "../tool-search-setting.js";
 import { assertAdvisorModelShape } from "../advisor-verdict.js";
-import { applyToolModelGate, assertRestoreGatedToolsValue, modelIdTail } from "../tool-model-gate.js";
+import { applyToolModelGate, assertRestoreGatedToolsValue } from "../tool-model-gate.js";
 import { resolveUsageWindows } from "../usage-window-store.js";
 import { deriveAskEffective, resolveAskSeat, resolveQuestionSeam, screenApprovalReach } from "../wiring-manifest.js";
-import { resolveHost } from "../../prompt-assembly/select.js";
+import { effectiveTraitsOf, readModelPromptTraits, resolveHost, resolvePromptLean } from "../../prompt-assembly/select.js";
+import { assertNoRetiredKeys, RETIRED_MODEL_KEYS } from "../retired-keys.js";
 import { resolvePromptBinding } from "../../prompt-assembly/overlay.js";
 import { assertPeerPresenceValue } from "../../agents/peer-directory.js";
 import { snapshotDefinitionLists } from "../../agents/tool-filter.js";
-import { TOTAL_TOKENS_REMINDER_MODES } from "./turn-attachments.js";
-import { rosterFaceOf } from "./caller-roster.js";
+import { mcpUnavailableOn, TOTAL_TOKENS_REMINDER_MODES } from "./turn-attachments.js";
+import { refuseRetiredMember, rosterFaceOf } from "./caller-roster.js";
 import { assertToolBoundaryLegs } from "../tool-roster.js";
+import { assertToolCardDeclarations } from "../../prompt-assembly/tool-catalog.js";
 import { refuseRenamedDelegationMounts } from "./sub-agent-deny-lists.js";
+import { readPrincipal } from "../principal-name.js";
 const TASK_LIMIT_KEY_DICT = {
     maxTokens: true,
     maxCostUsd: true,
@@ -54,6 +59,12 @@ export function limitConfigError(code, message) {
     e.code = code;
     return e;
 }
+export function assertPrincipalValue(raw) {
+    const reading = readPrincipal(raw);
+    if (reading.kind === "invalid") {
+        throw limitConfigError("config.invalid_argument", `TaskSpec.principal must be a principal name when present (got ${reading.fault}) — omit the key for a task with no principal; a provided value that names nobody is refused, never read as "no principal".`);
+    }
+}
 export function resolveTaskLimits(limits) {
     if (limits === undefined)
         return undefined;
@@ -99,6 +110,7 @@ export function resolveTaskLimits(limits) {
 export function resolveAttachmentsConfig(attachments) {
     if (attachments === null || (typeof attachments !== "object" && typeof attachments !== "function"))
         return attachments;
+    mcpUnavailableOn(attachments);
     const mode = attachments.totalTokensReminderMode;
     if (mode !== undefined) {
         const legal = TOTAL_TOKENS_REMINDER_MODES;
@@ -109,15 +121,9 @@ export function resolveAttachmentsConfig(attachments) {
     }
     return attachments;
 }
-export function isFableFamilyModelId(id) {
-    const tail = modelIdTail(id);
-    return /^claude-fable-\d/.test(tail) || /^claude-mythos-5(?!\d)/.test(tail);
-}
-export function resolveModelPromptTraits(model, spec, internals) {
-    return {
-        promptProfile: spec.promptProfile ?? internals?.promptProfile ?? "simple",
-        fableMitigations: isFableFamilyModelId(model.id),
-    };
+export function resolvePromptTraits(model, promptLean) {
+    assertNoRetiredKeys(model, RETIRED_MODEL_KEYS, "Model");
+    return effectiveTraitsOf(readModelPromptTraits(model), promptLean);
 }
 function microCompactConfigError(field, value, legal) {
     let shown;
@@ -173,8 +179,9 @@ export function assertResumeConfigRecord(config) {
     }
 }
 export function configValueDoors(input, enter = ENTER_AS_IS) {
-    const { spec, deps, resumeLeg, sessions } = input;
+    const { spec, deps, resumeLeg, sessions, holder } = input;
     enter("deps", () => assertNoRetiredRunnerDeps(deps));
+    enter("taskConfig", () => assertPrincipalValue(spec.principal));
     enter("taskConfig", () => assertPeerPresenceValue(spec.peerPresence));
     enter("taskConfig", () => assertRestoreGatedToolsValue(spec.restoreGatedTools));
     const microCompactKnob = enter("deps", () => resolveMicroCompactKnob(deps.microCompact));
@@ -213,7 +220,10 @@ export function configValueDoors(input, enter = ENTER_AS_IS) {
                 : undefined,
     };
     const promptHost = enter("taskConfig", () => resolveHost(spec));
+    enter("deps", () => screenRoleMap(deps.roles, "RunnerDeps.roles"));
+    enter("taskConfig", () => screenRoleMap(spec.roles, "TaskSpec.roles"));
     const promptBinding = enter("taskConfig", () => resolvePromptBinding(spec));
+    const promptLean = enter("taskConfig", () => resolvePromptLean(spec));
     if (spec.resumeAt !== undefined)
         enter("taskConfig", () => {
             if (resumeLeg) {
@@ -236,6 +246,7 @@ export function configValueDoors(input, enter = ENTER_AS_IS) {
     const memoryProvenance = enter("deps", () => closedWord(deps.memoryProvenance, "RunnerDeps.memoryProvenance", ["off", "carry"], "carry", "config.memory_provenance", "an unevaluable provenance mode is refused loudly, never folded to either mode."));
     const memoryCapturePolicy = enter("deps", () => closedWord(deps.memoryCapturePolicy, "RunnerDeps.memoryCapturePolicy", ["open", "governed", "capture-required"], "open", "config.memory_capture_policy", "an unevaluable capture posture is refused loudly, never folded to any posture (the fault arms differ per posture, so a guess would pick a polarity nobody configured)."));
     const crossBoundaryPosture = enter("deps", () => closedWord(deps.crossBoundaryPosture, "RunnerDeps.crossBoundaryPosture", CROSS_BOUNDARY_POSTURES, undefined, "config.cross_boundary_posture", "an unevaluable posture is refused loudly, never folded to either word (an absent seat is undeclared, which is its own fact)."));
+    const hostFloor = enter("deps", () => compileHostFloor(deps.hostFloor));
     const advisorTool = enter("deps", () => closedWord(deps.advisorTool, "RunnerDeps.advisorTool", ["disabled"], undefined, "config.advisor_tool_invalid", "the switch has one word; anything else is refused, never read as either state."));
     if (advisorTool === undefined)
         enter("taskConfig", () => assertAdvisorModelShape(spec.advisorModel));
@@ -310,6 +321,8 @@ export function configValueDoors(input, enter = ENTER_AS_IS) {
     const taskGuardrail = spec.limits?.brainCallGuardrailMs;
     const brainCallGuardrailMs = enter(taskGuardrail != null ? "taskConfig" : "deps", () => resolveBrainCallGuardrailMs(taskGuardrail ?? deps.brainCallGuardrailMs));
     const checkpointStore = enter(checkpointStoreSeat(spec), () => resolveCheckpointStore(spec, deps));
+    enter("deps", () => assertHolderValue(holder));
+    enter(checkpointStoreSeat(spec), () => assertCheckpointStoreJudgesHolder(checkpointStoreSeat(spec) === "taskConfig" ? "TaskSpec.checkpointStore" : "RunnerDeps.checkpointStore", checkpointStore, holder));
     const taskStore = checkpointStoreSeat(spec) === "taskConfig" ? checkpointStore : undefined;
     const retention = { policy: deps.retentionPolicy, locked: lockedPreflight.lockedKeys.has("retentionPolicy") };
     enter("deps", () => assertRetentionCapability({
@@ -322,9 +335,9 @@ export function configValueDoors(input, enter = ENTER_AS_IS) {
     }));
     if (taskStore !== undefined)
         enter("taskConfig", () => assertRetentionCapability({ ...retention, stores: [{ name: "checkpointStore", store: taskStore }] }));
-    return { toolFaceLists, promptHost, promptBinding, lockedPreflight, skillListingSeats, skills, projectMemory, microCompactKnob, memoryDelegationEvidence, memoryProvenance, memoryCapturePolicy, usageWindows, brainCallGuardrailMs, crossBoundaryPosture, advisorTool };
+    return { toolFaceLists, promptHost, promptBinding, promptLean, lockedPreflight, skillListingSeats, skills, projectMemory, microCompactKnob, memoryDelegationEvidence, memoryProvenance, memoryCapturePolicy, usageWindows, brainCallGuardrailMs, crossBoundaryPosture, advisorTool, hostFloor };
 }
-export function refuseResumeDoors(config, recordedGate, deps, sessions) {
+export function refuseResumeDoors(config, recordedGate, deps, sessions, holder) {
     asResumeConfigRefusal("taskConfig", () => {
         refusePermissionModeDoors(config);
         resolveOutputStyleFrame(config.outputStyle);
@@ -332,19 +345,20 @@ export function refuseResumeDoors(config, recordedGate, deps, sessions) {
         screenUserInvokedSkills(config);
         screenUserAttachments(config.userAttachments, { resumeLeg: true });
         assertToolBoundaryLegs(config.tools);
+        assertToolCardDeclarations(config.tools);
     });
-    const { lockedPreflight, skills } = configValueDoors({ spec: config, deps, resumeLeg: true, sessions }, asResumeConfigRefusal);
+    const { lockedPreflight, skills } = configValueDoors({ spec: config, deps, resumeLeg: true, sessions, holder }, asResumeConfigRefusal);
     asResumeConfigRefusal("inheritedGate", () => void recordedModeSeed(recordedGate));
     return { ...config, ...(config.mcp !== undefined ? { mcp: lockedPreflight.mcp ?? [] } : {}), ...(config.a2a !== undefined ? { a2a: lockedPreflight.a2a ?? [] } : {}), skills };
 }
 export function prepareConfigDoors(input) {
     const { deps, sessions, resume, internals } = input;
     assertToolBoundaryLegs(input.spec.tools);
+    assertToolCardDeclarations(input.spec.tools);
     let spec = input.spec;
-    const { toolFaceLists, promptHost, promptBinding, lockedPreflight, skillListingSeats, skills, projectMemory, microCompactKnob, memoryDelegationEvidence, memoryProvenance, memoryCapturePolicy, usageWindows, brainCallGuardrailMs, crossBoundaryPosture, advisorTool } = configValueDoors({ spec, deps, resumeLeg: resume !== undefined, sessions });
+    const { toolFaceLists, promptHost, promptBinding, promptLean, lockedPreflight, skillListingSeats, skills, projectMemory, microCompactKnob, memoryDelegationEvidence, memoryProvenance, memoryCapturePolicy, usageWindows, brainCallGuardrailMs, crossBoundaryPosture, advisorTool, hostFloor } = configValueDoors({ spec, deps, resumeLeg: resume !== undefined, sessions, holder: internals?.holder });
     const doorRead = (value) => ({ value, enumerable: value !== undefined, writable: false, configurable: false });
     spec = Object.create(Object.getPrototypeOf(spec), { ...Object.getOwnPropertyDescriptors(spec), skills: doorRead(skills), projectMemory: doorRead(projectMemory) });
-    const promptProfile = resolveModelPromptTraits({ id: "" }, spec, internals).promptProfile;
     const resolvedInteractionPosture = spec.interactionPosture ?? internals?.parentInteractionPosture ?? deps.interactionPosture;
     const askSeat = resolveAskSeat(spec, deps);
     {
@@ -410,7 +424,10 @@ export function prepareConfigDoors(input) {
                 if (typeof t.withAgents !== "function")
                     return t;
                 const rebuilt = t.withAgents(perTask);
-                return rosterFaceOf(t.modelGate !== undefined && rebuilt.modelGate === undefined ? { ...rebuilt, modelGate: t.modelGate } : rebuilt, index);
+                const restamp = t.modelGate !== undefined && rebuilt.modelGate === undefined;
+                if (restamp)
+                    refuseRetiredMember(rebuilt, index);
+                return rosterFaceOf(restamp ? { ...rebuilt, modelGate: t.modelGate } : rebuilt, index);
             }),
         };
     }
@@ -447,7 +464,7 @@ export function prepareConfigDoors(input) {
             throw limitConfigError("config.limit_invalid", `TaskSpec.${dollarCeiling} is a money ceiling, but the price table for model ${JSON.stringify(model.id)} declares an unevaluable ${bad} — every rate must be a finite, non-negative number of USD per 1M tokens. A table like this prices every turn at zero (or below), so the ceiling would never trip: refused rather than enforced in name only.`);
         }
     }
-    const fableMitigations = resolveModelPromptTraits(model, spec, internals).fableMitigations;
+    const promptTraits = resolvePromptTraits(model, promptLean);
     const gateDecision = applyToolModelGate({
         tools: spec.tools,
         modelId: model.id,
@@ -471,7 +488,8 @@ export function prepareConfigDoors(input) {
     return {
         spec,
         toolFaceLists,
-        promptProfile,
+        promptLean,
+        promptTraits,
         promptHost,
         promptBinding,
         lockedPreflight,
@@ -482,12 +500,11 @@ export function prepareConfigDoors(input) {
         model,
         thinking,
         compModel,
-        fableMitigations,
         modelGate,
         memoryDelegationEvidence,
         skillListingBudget,
         memoryProvenance,
-        memoryCapturePolicy, crossBoundaryPosture, advisorTool,
+        memoryCapturePolicy, crossBoundaryPosture, advisorTool, hostFloor,
         usageWindows,
         brainCallGuardrailRef,
         brainCallGuardrailMs,

package/dist/core/runner/prepare-defer-classify.d.ts

@@ -1,4 +1,5 @@
 import type { Model } from "../../internal/llm.js";
+import type { PromptTraitName } from "../../prompt-assembly/catalog/schema.js";
 import type { MaterializedA2a } from "../a2a.js";
 import type { MaterializedMcp } from "../mcp.js";
 import type { RunnerDeps, TaskSpec } from "../types.js";
@@ -11,7 +12,7 @@ export interface PrepareDeferClassifyInput {
     deps: Pick<RunnerDeps, "deferMode" | "toolSearch">;
     /** borrowed-mutable — the shared mount array (later refs alias it; in-place contract, never
      *  re-created). Mutated here, in order: `splice` of every excluded name; element REPLACEMENT with a
-     *  shallow copy for the classic-profile description swap (the caller's ToolSpec object is never
+     *  shallow copy for a description variant chosen by the run's traits (the caller's ToolSpec object is never
      *  mutated); `splice` of a retracted memory group. After this phase: the content-origin wrap
      *  (element replacement with the wrapped object), the disclosure mount, the MCP refresh re-splice. Since
      *  Every one of those writes is a builder verb (`unmountWhere` / `replaceAt`). */
@@ -22,8 +23,8 @@ export interface PrepareDeferClassifyInput {
     handsEnabled: boolean;
     /** borrowed-readonly — the spec-time precomputation the invariant checks the post-exclusion roster against: a mismatch is an engine bug, thrown. */
     fullShellReachable: boolean;
-    /** borrowed-readonly — the resolved prompt profile (`classic` swaps in `descriptionClassic`). */
-    promptProfile: "simple" | "classic";
+    /** borrowed-readonly — the run's effective prompt traits (each tool's description variants are chosen on them). */
+    promptTraits: ReadonlySet<PromptTraitName>;
     /** borrowed-readonly — the resolved model (the deferral gate's threshold reads its context window). */
     model: Model;
     /** borrowed-readonly — the materialized MCP roster; only `tools` is read (protocol names; `mcpAlwaysLoad` self-declarations lose to an operator defer). */

package/dist/core/runner/prepare-defer-classify.js

@@ -1,4 +1,4 @@
-import { getToolContract } from "../../prompt-assembly/tool-catalog.js";
+import { getToolContract, mountDescriptionVariant } from "../../prompt-assembly/tool-catalog.js";
 import { FULL_SHELL_CONTRACT_ID } from "../../tools/fs/index.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "../ask-question.js";
 import { MEMORY_ENGINE_TOOL_NAMES } from "../memory-engine/tools.js";
@@ -17,7 +17,7 @@ function memoryGroupRetractionSet(builtinDeferPairNames, engineTrioInPlay) {
     return new Set([...builtinDeferPairNames, ...(engineTrioInPlay ? MEMORY_ENGINE_TOOL_NAMES : [])]);
 }
 export function prepareDeferClassify(input) {
-    const { spec, deps, roster, toolFaceSnapshot, handsEnabled, fullShellReachable, promptProfile, model, mcp, a2a, sharedMemoryPairMounted, memoryEnginePairMounted, memoryRecallSegment, onceLedger, sessionId } = input;
+    const { spec, deps, roster, toolFaceSnapshot, handsEnabled, fullShellReachable, promptTraits, model, mcp, a2a, sharedMemoryPairMounted, memoryEnginePairMounted, memoryRecallSegment, onceLedger, sessionId } = input;
     const tools = roster.tools;
     let memoryBlock = input.memoryBlock;
     const leaves = valveLeaves(spec, toolFaceSnapshot.selector);
@@ -32,12 +32,11 @@ export function prepareDeferClassify(input) {
             throw e;
         }
     }
-    if (promptProfile === "classic") {
-        for (let i = 0; i < tools.length; i++) {
-            const t = tools[i];
-            if (t.descriptionClassic !== undefined)
-                roster.replaceAt(i, { ...t, description: t.descriptionClassic });
-        }
+    for (let i = 0; i < tools.length; i++) {
+        const t = tools[i];
+        const face = mountDescriptionVariant(t, promptTraits);
+        if (face !== t)
+            roster.replaceAt(i, face);
     }
     const protocolToolNames = [...mcp.tools, ...a2a.tools].filter((t) => protocolOf(t.name) !== undefined).map((t) => t.name);
     const mcpAlwaysLoadNames = mcp.tools

package/dist/core/runner/prepare-file-history.d.ts

@@ -14,15 +14,18 @@
  *
  * The request door (the bad-value doors and every refusal the request decides alone) lives in
  * `./file-history-request.ts` and runs BEFORE the session is acquired; this phase receives its resolution.
- * The module-level helpers below the phase (`restoredAbsPathsOf`,
- * the refusal's epoch-tail wording helper, `adoptForkedFileHistory` with its per-store carry memo,
+ * The module-level helpers below the phase (`adoptForkedFileHistory` with its per-store carry memo,
  * `createFileHistoryBoundarySeat`, `resolveFileHistoryCoordinates` / `resolveFileHistoryScope` /
  * `fileHistoryFilesystemIdentity`, `childScopeRewindRefusal`) moved with it unchanged; the two the test
- * suite reaches through the driver are re-exported from there.
+ * suite reaches through the driver are re-exported from there. The restore itself and the reading of its
+ * answer live in `./file-history-restore.ts`, shared with the out-of-run rewind (`./rewind-files.ts`), which
+ * also reaches down here for the coordinates and the fork carry — a rewind outside a run is the same history
+ * operation as the one this phase runs.
  */
 import type { ExecutionEnv } from "../../internal/harness.js";
 import type { StoredSession } from "../../engine/session/session.js";
 import type { RunnerDeps, TaskResult, TaskSpec, TrackFileEditHook } from "../types.js";
+import type { FileHistoryStore } from "../file-history-store.js";
 import type { FileHistoryBoundarySeat, RunInternals } from "./contracts.js";
 import type { FileHistoryRequest } from "./file-history-request.js";
 export interface PrepareFileHistoryInput {
@@ -36,8 +39,9 @@ export interface PrepareFileHistoryInput {
      *  acquired: every refusal the request and the deployment's seats decide on their own has already thrown. */
     request: FileHistoryRequest;
     /** borrowed-readonly — the trusted lineage a delegating parent handed this run (absent for a root run
-     *  and for a host's own fork), read for the recording-scope decision only. */
-    internals: Pick<RunInternals, "fileHistoryLineage"> | undefined;
+     *  and for a host's own fork), read for the recording-scope decision only; and the Runner's session
+     *  read-state seats, whose restore channel the restore writes the paths it moved into. */
+    internals: Pick<RunInternals, "fileHistoryLineage" | "sessionReadStates"> | undefined;
     /** borrowed-readonly — the run's resolved env (owned or static or the stub); every history verb runs
      *  against ITS filesystem ops. Never rebound or destroyed here. */
     executionEnv: ExecutionEnv;
@@ -60,9 +64,6 @@ export interface PrepareFileHistoryResult {
     /** borrowed-readonly — the turn-start boundary seat runtask drives; `undefined` when not live or when
      *  this run records into its ROOT session's scope (a child mints no boundaries). */
     fileHistoryBoundary: FileHistoryBoundarySeat | undefined;
-    /** borrowed-readonly — the absolute paths the restore MUTATED (empty when no restore ran), for the
-     *  read-face phase's read-state invalidation. */
-    restoredFilePaths: string[];
     /** borrowed-mutable — the non-fatal rewind disclosures (`TaskResult.rewindNotes`). Mutation owners after
      *  this call: none — every push happens inside this phase; the driver only reads it into `Prepared`. */
     rewindNotes: NonNullable<TaskResult["rewindNotes"]>;
@@ -79,6 +80,45 @@ export interface PrepareFileHistoryResult {
     historyFs: string;
 }
 export declare function prepareFileHistory(input: PrepareFileHistoryInput): Promise<PrepareFileHistoryResult>;
+/**
+ * Carry a forked session's file history from its parent scope (the seat §5 names).
+ * Never throws and never fails the turn: a store that cannot carry leaves the fork with an empty
+ * history, which is DEGRADED (a pre-fork boundary is not restorable from the new session) and not
+ * wrong (nothing is silently mis-restored — the restore seat answers "no boundary" honestly).
+ */
+export declare function adoptForkedFileHistory(store: FileHistoryStore, session: {
+    getMetadata(): Promise<{
+        forkedFrom?: string;
+    }>;
+}, sessionId: string, onError: RunnerDeps["onError"]): Promise<void>;
+/**
+ * The run's two file-history COORDINATES, resolved once where store/env/root meet (module-level per
+ * the body ratchet):
+ *  - `historyRoot` — ONE canonical root coordinate for every history verb: capture keys (rel-under-root
+ *    vs absolute, DV-6) must agree with the canonical containment keys the hands band mints — a
+ *    symlinked root spelling (macOS /var → /private/var) would otherwise record in-root files as
+ *    absolute and un-tether them from the root they live in.
+ *  - `historyScope` — WHICH scope this run's first-touch records land in. A top-level run owns its own
+ *    (its sessionId). A delegated child that was handed a {@link RunInternals.fileHistoryLineage} and
+ *    runs on the SAME canonical root records into the lineage's scope — the root session's — so the
+ *    edits a child makes on the user's behalf are part of the ONE history the user rewinds from
+ *    (before this, a child's first touch minted its baseline in a scope no rewind ever read, and the
+ *    parent's own later first touch of that file recorded the child-modified bytes as pristine). A
+ *    child on a DIFFERENT root keeps its own scope: keys are root-relative and carry no root, so a
+ *    record minted under a worktree re-joined against the root session's tree would converge a file
+ *    that run never edited — the structural out-of-scope guarantee the store contract opens with.
+ *    Same-tree equality is judged on TWO coordinates, both minted here: the CANONICAL root spelling
+ *    both sides minted their keys against, and the FILESYSTEM the env is a view of
+ *    ({@link fileHistoryFilesystemIdentity}) — a path string alone is not a tree (two per-task
+ *    sandboxes can both spell `/workspace` and hold unrelated files).
+ * With no live history store there is nothing to coordinate: own scope, uncanonicalized root, no
+ * filesystem identity (nothing reads any of them).
+ */
+export declare function resolveFileHistoryCoordinates(enabled: boolean, env: ExecutionEnv, taskRoot: string, lineage: RunInternals["fileHistoryLineage"], sessionId: string): Promise<{
+    historyRoot: string;
+    historyScope: string;
+    historyFs: string;
+}>;
 /** The ONE reading of {@link RunInternals.fileHistoryLineage} (see {@link resolveFileHistoryCoordinates}):
  *  the lineage's scope iff BOTH tree coordinates match; otherwise the run's own session. */
 export declare function resolveFileHistoryScope(lineage: RunInternals["fileHistoryLineage"], historyRoot: string, historyFs: string, sessionId: string): string;

package/dist/core/runner/prepare-file-history.js

@@ -1,8 +1,9 @@
 import { NodeExecutionEnv } from "../../engine/execution-env/node-execution-env.js";
 import { isRemoteExecutionEnv } from "../remote-env.js";
-import { FILE_HISTORY_ERROR_CODES, FileHistoryStoreError, resolveTrackKey } from "../file-history-store.js";
+import { FILE_HISTORY_ERROR_CODES, FileHistoryStoreError } from "../file-history-store.js";
 import { readMember, thrownText } from "../thrown-value.js";
 import { isGovernanceRetryClass } from "../governance-codes.js";
+import { fileHistoryRestoreLedgerLine, settleFileHistoryRestore } from "./file-history-restore.js";
 export async function prepareFileHistory(input) {
     const { deps, spec, request, internals, executionEnv, taskRootFinal, handsEnabled, sessionId, session, abortController } = input;
     const rewindNotes = [];
@@ -45,25 +46,10 @@ export async function prepareFileHistory(input) {
             });
         }
     }
-    let restoredFilePaths = [];
     if (rewindTarget !== undefined && fileHistoryStore !== undefined && handsEnabled) {
         const restoreSignal = spec.signal ? AbortSignal.any([abortController.signal, spec.signal]) : abortController.signal;
-        const restored = await fileHistoryStore.restore(sessionId, rewindTarget, executionEnv, historyRoot, restoreSignal);
-        const ledgerLine = (r) => `applied ${r.filesChanged.length}, identical ${r.identicalSkipped.length}, refused ${r.refused.length}${r.refused.length > 0 ? ` (${r.refused.map((f) => `${f.path}: ${f.reason}`).join("; ")})` : ""}, failed ${r.failed.length}${r.failed.length > 0 ? ` (${r.failed.map((f) => `${f.path}: ${f.reason}`).join("; ")})` : ""}`;
-        if (restored.outcome === "failed") {
-            if (restored.error?.code === "not_found") {
-                if (rewindBefore)
-                    throw beforeWithoutBoundaryRefusal(rewindTarget, sessionId);
-                const e = new Error(`rewind-files: no file-history boundary exists for entry "${rewindTarget}" on session "${sessionId}" — the working tree was NOT rewound. ${rewindRefusalTail()}`);
-                e.code = "rewind_snapshot.unresolvable";
-                throw e;
-            }
-            const e = new Error(`rewind-files restore failed (${restored.error?.code ?? "restore_failed"}): ${restored.error?.message ?? "unknown"} — ledger: ${ledgerLine(restored)}`);
-            e.code = "rewind.restore_failed";
-            if (restored.error !== undefined)
-                e.detail = { code: restored.error.code, ...(isGovernanceRetryClass(restored.error.permanence) ? { permanence: restored.error.permanence } : {}) };
-            throw e;
-        }
+        const restored = await settleFileHistoryRestore({ store: fileHistoryStore, sessionId, target: rewindTarget, before: rewindBefore, env: executionEnv, root: historyRoot, signal: restoreSignal, readStates: internals?.sessionReadStates });
+        const ledgerLine = fileHistoryRestoreLedgerLine;
         if (restored.outcome === "partial") {
             if (spec.acceptPartialRestore === true) {
                 rewindNotes.push({
@@ -77,7 +63,6 @@ export async function prepareFileHistory(input) {
                 throw e;
             }
         }
-        restoredFilePaths = restoredAbsPathsOf(restored, historyRoot);
     }
     const trackFileEdit = fileHistoryEnabled
         ? async (req) => {
@@ -115,24 +100,7 @@ export async function prepareFileHistory(input) {
         ? createFileHistoryBoundarySeat({ store: fileHistoryStore, sessionId, env: executionEnv, root: historyRoot, onError: deps.onError })
         : undefined;
     const fileHistoryFact = fileHistoryEnabled ? "on" : "disabled";
-    return { trackFileEdit, fileHistoryBoundary, restoredFilePaths, rewindNotes, fileHistoryEnabled, fileHistoryFact, historyScope, historyRoot, historyFs };
-}
-function restoredAbsPathsOf(restored, root) {
-    const out = [];
-    for (const key of [...restored.filesChanged, ...restored.failed.map((f) => f.path)]) {
-        const abs = resolveTrackKey(root, key);
-        if (abs.ok)
-            out.push(abs.abs);
-    }
-    return out;
-}
-function rewindRefusalTail() {
-    return `Boundaries are keyed by a turn's INITIAL entry and exist only for turns that recorded history (a RunnerDeps.fileHistoryStore wired, capture on, and the run's file history not disabled); a boundary from the retired whole-tree snapshot era is not restorable by this seat, and reaped boundaries have none.`;
-}
-function beforeWithoutBoundaryRefusal(target, sessionId) {
-    const e = new Error(`rewind-files: entry "${target}" has no file-history boundary on session "${sessionId}" — a before-restore needs the target's own boundary and never crosses into an earlier turn, so the working tree was NOT rewound. ${rewindRefusalTail()}`);
-    e.code = "rewind_snapshot.unresolvable";
-    return e;
+    return { trackFileEdit, fileHistoryBoundary, rewindNotes, fileHistoryEnabled, fileHistoryFact, historyScope, historyRoot, historyFs };
 }
 const FILE_HISTORY_BOUNDARY_TIMEOUT_MS = 30_000;
 const FILE_HISTORY_LIVENESS_MEMO = new WeakMap();
@@ -160,7 +128,7 @@ function answerOf(call, code) {
         return { ok: false, error: { code: known, message: text, ...(isGovernanceRetryClass(permanence) ? { permanence } : {}) } };
     }, (value) => unanswered(`the history store threw: ${thrownText(value)}`, { value }));
 }
-async function adoptForkedFileHistory(store, session, sessionId, onError) {
+export async function adoptForkedFileHistory(store, session, sessionId, onError) {
     const memo = FILE_HISTORY_CARRY_MEMO.get(store) ?? { settled: new Set(), disclosed: new Set(), inFlight: new Map() };
     FILE_HISTORY_CARRY_MEMO.set(store, memo);
     const discloseOnce = (err) => {
@@ -242,7 +210,7 @@ function createFileHistoryBoundarySeat(opts) {
         },
     };
 }
-async function resolveFileHistoryCoordinates(enabled, env, taskRoot, lineage, sessionId) {
+export async function resolveFileHistoryCoordinates(enabled, env, taskRoot, lineage, sessionId) {
     if (!enabled)
         return { historyRoot: taskRoot, historyScope: sessionId, historyFs: "" };
     const canonRoot = await env.canonicalPath(taskRoot);

package/dist/core/runner/prepare-gate-stations.d.ts

@@ -108,7 +108,7 @@ export interface PrepareGateStationsInput {
     complianceDenies: ReadonlySet<ComplianceCapability>;
     /** borrowed-mutable — the built harness. Writer here: `on("tool_call")` / `on("tool_result")` — the registrations this
      *  phase exists for, in this order, after the driver's boundary-lease handler. */
-    harness: Pick<AgentHarness, "on">;
+    harness: Pick<AgentHarness, "on" | "isBatchSafe">;
     /** borrowed-mutable — the blocked/suspended call ids (`Prepared.blockedToolCalls`). Writers here: the head-of-evaluation
      *  hygiene `delete`, the two short-circuits' and the gate outcome's `add`, the `tool_result` station's one-shot `delete`. */
     blockedToolCalls: Set<string>;

package/dist/core/runner/prepare-gate-stations.js

@@ -13,6 +13,8 @@ import { PATH_CONFINABLE_WRITE_TOOLS } from "./session-rule-policy.js";
 import { callFaceSeat, rosterToolName, toolCallFaceOf } from "../tool-roster.js";
 import { heldBy, heldValues, seatOf, wireOf } from "../tool-name-readings.js";
 import { createApprovedCallScreen, createToolResultStation } from "./call-hook-stations.js";
+import { extensionCallOf } from "../mods/extension-call.js";
+import { extensionCallOverlap } from "../mods/tool-call.js";
 const PEER_MESSAGE_NAMES = new Set([SEND_MESSAGE_TOOL_NAME]);
 function screenGateResult(result) {
     if (result.suspend !== undefined)
@@ -123,7 +125,7 @@ export function prepareGateStations(input) {
                         toolFaceOf: (name) => toolCallFaceOf(toolRosterDeltas.current, name === e.toolName ? called.toolName : name),
                         adjudicate,
                         resolveAsk: (...args) => toolOccurrences.whileAwaitingUser(args[1].toolCallId, () => resolveAskBound(...args)),
-                        suspendAsk,
+                        ...(extensionCallOf(modBus, e.toolCallId) === undefined ? { suspendAsk } : {}),
                         resolveContentAsk: (...args) => toolOccurrences.whileAwaitingUser(args[0].toolCallId, () => resolveContentAsk(...args)),
                         egress: heldBy("gate.egress", egressTools, call),
                         peerMessage: heldBy("gate.peerMessage", PEER_MESSAGE_NAMES, call),
@@ -236,6 +238,13 @@ export function prepareGateStations(input) {
                     }
                     return { block: true, reason: result.reason, ...details };
                 }
+                const overlap = result.suspend === undefined && extensionCallOf(modBus, e.toolCallId) !== undefined ? extensionCallOverlap({ occurrences: toolOccurrences, toolCallId: e.toolCallId, toolName: e.toolName, args: result.finalInput ?? e.input, batchSafe: (n, a) => harness.isBatchSafe(n, a) }) : undefined;
+                if (overlap !== undefined) {
+                    toolOccurrences.refuse(e.toolCallId, "hook");
+                    if (blockedTracked)
+                        blockedToolCalls.add(e.toolCallId);
+                    return { block: true, reason: formatHookFeedback(overlap, reminderMark) };
+                }
                 if (result.suspend === undefined)
                     toolOccurrences.release(e.toolCallId);
                 return result.updatedInput !== undefined ? { updatedInput: result.updatedInput } : undefined;

package/dist/core/runner/prepare-hands-readface.d.ts

@@ -96,7 +96,8 @@ export interface PrepareHandsReadFaceInput {
     deps: Pick<RunnerDeps, "onError" | "onNotice" | "tracer" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "agentConfigDir" | "readFace" | "writeFace" | "permissionRuleStore" | "hands">;
     /** borrowed-readonly — the trusted spawn-side seats the band forwards: the finished-command
      *  notification lane, the mid-flight detach hub, and the Runner's per-session
-     *  read-state seats (absent on a standalone prepare ⇒ the transcript-replay rung covers alone). */
+     *  read-state seats and their restore channel (absent on a standalone prepare ⇒ the transcript-replay rung
+     *  covers alone, and no restore is owed a check — the channel is the Runner's). */
     internals: Pick<RunInternals, "onTaskNotification" | "detachHub" | "sessionReadStates"> | undefined;
     /** borrowed-mutable — the harness seat, read LIVE by the band's queued-human-input predicate (the shell's
      *  auto-backgrounding leg asks it mid-command). Late-bound: the band is built here, the harness later. */
@@ -110,13 +111,6 @@ export interface PrepareHandsReadFaceInput {
     };
     /** borrowed-mutable — the leg's occurrence table; writer here: the shell read station's refused-admission callback. */
     toolOccurrences: ToolOccurrenceTable;
-    /** borrowed-readonly — ABSOLUTE paths this prepare's restore wrote, deleted,
-     *  or failed to write. Every read-state seed above describes the PRE-restore tree, so these keys are
-     *  dropped from the map: the engine replaced those bytes itself, and a surviving entry makes the
-     *  next refusal blame "the user or a linter" for the engine's own write. Absent (the common case)
-     *  when no file restore ran. Fail-closed by construction — dropping a read record only ever
-     *  produces refusals. */
-    restoredFilePaths?: readonly string[];
     /** borrowed-readonly — the memory write gate the memory phase minted (it runs BEFORE this phase: the memory root
      *  must be known before the toolkit compiles), composed into the band's beforeWrite below; undefined for a
      *  memory-less run (every write passes the engine half). */

package/dist/core/runner/prepare-hands-readface.js

@@ -260,22 +260,23 @@ export async function prepareHandsMount(input) {
                 }
             }
         }
-        if (input.restoredFilePaths !== undefined) {
-            for (const abs of input.restoredFilePaths) {
-                const k = await judgeKey(abs);
-                if (k === undefined)
-                    continue;
-                const entry = readFileState.get(k);
-                if (entry === undefined || entry.seededFromContext === true)
-                    continue;
-                const cur = await executionEnv.readTextFile(abs);
-                if (cur.ok && entry.hash === sha256(normalizeFileText(cur.value)))
-                    continue;
-                readFileState.delete(k);
-            }
+        const restoredOwed = sessionSeats?.pendingRestored(sessionId) ?? [];
+        for (const abs of restoredOwed) {
+            const k = await judgeKey(abs);
+            if (k === undefined)
+                continue;
+            const entry = readFileState.get(k);
+            if (entry === undefined || entry.seededFromContext === true)
+                continue;
+            const cur = await executionEnv.readTextFile(abs);
+            if (cur.ok && entry.hash === sha256(normalizeFileText(cur.value)))
+                continue;
+            readFileState.delete(k);
         }
-        if (seatLeafId !== undefined)
+        if (seatLeafId !== undefined) {
             sessionSeats?.adopt(sessionId, readFileState, seatLeafId);
+            sessionSeats?.settleRestored(sessionId, restoredOwed);
+        }
         sealReadStateSeat =
             sessionSeats !== undefined && seatLeafId !== undefined
                 ? (ownCommittedTailEntryId) => {

package/dist/core/runner/prepare-inherited-gate.d.ts

@@ -62,6 +62,8 @@ export interface PrepareInheritedGateInput {
     checkpointSeat: import("../checkpoint-seat.js").CheckpointSeat | undefined;
     /** borrowed-readonly — this leg's checkpoint scope (the driver's one `checkpointScopeOf` derivation): the ctx's `checkpointScopeForChildren`, which every delegation lane copies into its children's internals. */
     checkpointScope: string;
+    /** borrowed-readonly — the deployment's host floor as the config doors compiled it (`RunnerDeps.hostFloor`): the ctx's `hostFloor`, absent when none is declared. */
+    hostFloor: import("../host-floor.js").HostFloor | undefined;
     /** borrowed-readonly — the deployment seats: `autoMode.denialLimit` (the rebuilt trackers' bounds), `memoryScopeAdmission` /
      *  `deploymentMemoryScopes` / `compliancePostureResolver` (the governed-provenance bit), `onError` (the screening-face crash
      *  lane), `onNotice` (the stop seat's notice), `executionEnv` (the hook-env identity predicate), `delegationEntryCaps` (resolved
@@ -109,8 +111,8 @@ export interface PrepareInheritedGateInput {
     mountsCallerTool: (tool: ToolSpec) => boolean;
     /** borrowed-readonly — the ctx's `mountedMcp` seat: the MCP surface the run mounts right now (call-time; the roster is minted after this phase). Present iff the run declared a server. */
     mountedMcp?: () => import("../mounted-mcp.js").MountedMcp;
-    /** borrowed-readonly — the resolved prompt profile (ctx seat). */
-    promptProfile: ToolExecuteContext["promptProfile"];
+    /** borrowed-readonly — the task-level lean switch (ctx seat; absent ⇒ no key). */
+    promptLean: ToolExecuteContext["promptLean"];
     /** borrowed-readonly — the resolved interaction posture (ctx seat; absent ⇒ no key). */
     resolvedInteractionPosture: ToolExecuteContext["interactionPosture"];
     /** borrowed-readonly — the task's own permission-mode key, screened and snapshotted before the first await (undefined =
@@ -160,7 +162,8 @@ export interface PrepareInheritedGateInput {
     /** borrowed-readonly — LATE-BOUND: the per-principal entitlements the caps phase resolves after this one; read only inside
      *  `inheritedGateForChildren` (the two mandate tests), at spawn time. */
     runtimeCaps: () => RuntimeCaps | undefined;
-    /** borrowed-readonly — the leg's mods bus: the chain assembly mints this leg's screening entry over its `classic.PreToolUse` chain. */
+    /** borrowed-readonly — what the leg hands its descendants of its mods bus (`LegMods.handedDown`: without the skills' own
+     *  registrations): the chain assembly mints this leg's screening entry over its `classic.PreToolUse` chain. */
     modBus: LegModBus;
     /** borrowed-readonly — this leg's chain identity as its admission recorded it (`chainOfBus`) — the installation identity's chain term. */
     ownModChain: readonly ModChainLink[];

package/dist/core/runner/prepare-inherited-gate.js

@@ -1,3 +1,4 @@
+import { principalNameOf } from "../principal-name.js";
 import { forkGovernanceDenial, resolveDelegationEntryCaps } from "../../agents/subagent.js";
 import { isLiveQuestionFace } from "../ask-question.js";
 import { parentSpecSeatOf } from "../parent-spec-seat.js";
@@ -16,7 +17,7 @@ import { frozenSkillGrants } from "../skill-grant.js";
 import { attachRebuiltDenialTrackers, createDenialLimitStop } from "./denial-limit-arms.js";
 import { valveLeaves } from "../../agents/tool-filter.js";
 export function prepareInheritedGate(input) {
-    const { spec, deps, askSeat, internals, resume, sessions, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, ownedEnv, lockedPreflight, pathRuleAnchors, toolFaceSnapshot, mountsCallerTool, promptProfile, resolvedInteractionPosture, permissionModeSeat, handsEnabled, reportUsage, harnessRef, skillGrants, forwardEvent, subagentRetain, worktreeIsolation, requestReview, requestStopAfterTurn, enterPlanMode, reminderMark, reminderDisclosureCounts, fileHistoryEnabled, historyScope, historyRoot, historyFs, abortRun } = input;
+    const { spec, deps, askSeat, internals, resume, sessions, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, ownedEnv, lockedPreflight, pathRuleAnchors, toolFaceSnapshot, mountsCallerTool, promptLean, resolvedInteractionPosture, permissionModeSeat, handsEnabled, reportUsage, harnessRef, skillGrants, forwardEvent, subagentRetain, worktreeIsolation, requestReview, requestStopAfterTurn, enterPlanMode, reminderMark, reminderDisclosureCounts, fileHistoryEnabled, historyScope, historyRoot, historyFs, abortRun } = input;
     const liveInheritedGate = internals?.inheritedGate;
     const seedInheritedGate = resume?.seed.inheritedGate;
     const inheritedAncestorRules = (() => {
@@ -221,7 +222,7 @@ export function prepareInheritedGate(input) {
             deferTools: toolFaceSnapshot.defer,
             alwaysLoadTools: toolFaceSnapshot.alwaysLoad,
             ...(toolFaceSnapshot.restoreGated !== undefined ? { restoreGatedTools: toolFaceSnapshot.restoreGated } : {}),
-            promptProfile,
+            ...(promptLean !== undefined ? { promptLean } : {}),
             ...(spec.memoryPersistenceCapable !== undefined ? { memoryPersistenceCapable: spec.memoryPersistenceCapable } : {}),
             get memoryCaptureOptedOut() {
                 return input.memoryEngineSession()?.captureOptOut?.optedOut() ?? false;
@@ -238,6 +239,7 @@ export function prepareInheritedGate(input) {
             },
             getApiKeyAndHeaders: spec.getApiKeyAndHeaders,
             parentCwd: taskRootFinal,
+            ...(input.hostFloor !== undefined ? { hostFloor: input.hostFloor } : {}),
             ...(fileHistoryEnabled ? { fileHistoryLineage: { scope: historyScope, root: historyRoot, fs: historyFs } } : {}),
             reminderMark,
             reminderDisclosureCounts,
@@ -264,7 +266,7 @@ export function prepareInheritedGate(input) {
             ...(sessions.fork !== undefined
                 ? {
                     hostSessionFork: async () => {
-                        const forked = (await sessions.fork(sessionId, spec.principal ?? null)) ?? null;
+                        const forked = (await sessions.fork(sessionId, principalNameOf(spec.principal) ?? null)) ?? null;
                         if (forked === null)
                             return null;
                         return {