@sema-agent/core 7.55.0 → 7.56.0

package/dist/core/runner/run-turn-boundary.js

@@ -255,12 +255,10 @@ export function createTurnBoundary(input) {
                 const pendingTools = tdRef !== undefined && tdRef.pending.length > 0 ? [...tdRef.pending] : undefined;
                 const pendingRemovedTools = tdRef !== undefined && tdRef.pendingRemoved.length > 0 ? [...tdRef.pendingRemoved] : undefined;
                 const pendingReaddedTools = tdRef !== undefined && tdRef.pendingReadded.length > 0 ? [...tdRef.pendingReadded] : undefined;
-                const pendingFailedMcp = tdRef !== undefined && tdRef.pendingFailed.length > 0 ? tdRef.pendingFailed.map((f) => ({ ...f })) : undefined;
-                const mcpToolsDelta = pendingRemovedTools !== undefined || pendingReaddedTools !== undefined || pendingFailedMcp !== undefined
+                const mcpToolsDelta = pendingRemovedTools !== undefined || pendingReaddedTools !== undefined
                     ? {
                         ...(pendingRemovedTools !== undefined ? { removed: pendingRemovedTools } : {}),
                         ...(pendingReaddedTools !== undefined ? { readded: pendingReaddedTools } : {}),
-                        ...(pendingFailedMcp !== undefined ? { failedServers: pendingFailedMcp } : {}),
                     }
                     : undefined;
                 const mcpInstructionsOn = rs.attach.attachmentsCfg?.mcpInstructions === true;
@@ -359,13 +357,6 @@ export function createTurnBoundary(input) {
                             ref.pendingRemoved.splice(0, pendingRemovedTools.length);
                         if (pendingReaddedTools !== undefined)
                             ref.pendingReadded.splice(0, pendingReaddedTools.length);
-                        if (pendingFailedMcp !== undefined) {
-                            ref.pendingFailed.splice(0, pendingFailedMcp.length);
-                            if (!noNextRequest()) {
-                                prepared.announcedListingsRef.mcpFailed = [...(prepared.announcedListingsRef.mcpFailed ?? []), ...pendingFailedMcp];
-                                announcedOnceDirty = true;
-                            }
-                        }
                     }
                 }
                 if ((mcpAdds !== undefined || mcpRemovals !== undefined) &&

package/dist/core/runner/runtask.d.ts

@@ -8,6 +8,7 @@ import type { AgentDefinition, ModelRef, ModelRoles, RunnerDeps, TaskEvent, Task
 import { type ContextSettings, type ContextWindowOverlay } from "../context-settings.js";
 import type { ResumeRun, ResumeTaskConfig, RunInternals, RunnerSelfSeat } from "./contracts.js";
 export type { ResumeTaskConfig } from "./contracts.js";
+import type { RewindFilesRequest, RewindFilesResult } from "../file-history-store.js";
 /**
  * A stateless task runner. Holds shared deps (the external brain, model catalog) and an
  * in-memory session store so that passing a `sessionId` continues a prior conversation.
@@ -133,6 +134,8 @@ export declare class Runner implements RunnerSelfSeat {
      *  the same model resolution as tasks, returns real usage/model. No session, no tool execution, no
      *  policy gate, no accounting — caller-trusted. */
     sideQuery(spec: SideQuerySpec): Promise<SideQueryResult>;
+    /** The out-of-run code-only rewind, no model call and no session entry — the contract is {@link rewindSessionFiles}'s (refused while a leg of this Runner holds or awaits the session's lock). */
+    rewindFiles(request: RewindFilesRequest): Promise<RewindFilesResult>;
     /** Run a task and stream live events; await `.result()` for the final TaskResult. `resume` (internal)
      *  drives a durable resume through the same loop instead of a fresh objective prompt.
      *  `internals` (internal) is a TRUSTED run-scoped channel for live per-task state the

package/dist/core/runner/runtask.js

@@ -7,7 +7,7 @@ import { createRapidRefillState } from "../auto-compaction.js";
 import { boundInputHashOf } from "../canonical-json.js";
 import { emitTrace } from "../trace.js";
 import { emitTaskOutcome } from "../task-outcome.js";
-import { runWithReasoningWireFacts } from "../../brain/status-sink.js";
+import { runWithCapabilityWithheld, runWithReasoningWireFacts } from "../../brain/status-sink.js";
 import { expandTiers } from "../roles.js";
 import { announceReadDenySwap, screenSwappableDeps } from "../swappable-deps.js";
 import { runSideQuery } from "../side-query.js";
@@ -62,6 +62,7 @@ import { runStopAndFinalVerify } from "./run-stop-and-final-verify.js";
 import { runRecoveryLanes } from "./run-recovery-lanes.js";
 import { runGitLane } from "./run-git-lane.js";
 import { deploymentCanRerootChild } from "./child-tree.js";
+import { rewindSessionFiles } from "./rewind-files.js";
 import { thrownText } from "../thrown-value.js";
 export class Runner {
     deps;
@@ -160,11 +161,8 @@ export class Runner {
         await prev.catch(() => { });
         return () => {
             release();
-            void chain.then(() => {
-                if (this.sessionLocks.get(sessionId) === chain) {
-                    this.sessionLocks.delete(sessionId);
-                }
-            });
+            if (this.sessionLocks.get(sessionId) === chain)
+                this.sessionLocks.delete(sessionId);
         };
     }
     swapDeps(next) {
@@ -233,8 +231,9 @@ export class Runner {
         announceReadDenySwap(this.deps.onNotice, seats, this.deps);
     }
     sideQuery(spec) {
-        return runWithReasoningWireFacts(() => { }, () => runSideQuery(spec, { brain: this.deps.brain, models: this.deps.models, roles: this.deps.roles }));
+        return runWithReasoningWireFacts(() => { }, () => runWithCapabilityWithheld(() => { }, () => runSideQuery(spec, { brain: this.deps.brain, models: this.deps.models, roles: this.deps.roles })));
     }
+    rewindFiles(request) { return rewindSessionFiles({ deps: this.deps, sessions: this.sessions, readStates: this.sessionReadStates, sessionBusy: (id) => this.sessionLocks.has(id), takeSessionLock: (id) => this.acquireSessionLock(id) }, request); }
     runTaskStream(spec, resume, internals) {
         if (resume !== undefined && (typeof resume !== "object" || resume.outcome === undefined)) {
             throw new TypeError("runTaskStream: `resume` must be a ResumeRun carrying `outcome` — got a value without one. " +
@@ -403,7 +402,7 @@ export class Runner {
                         const { effectiveTimeoutMs, walltimeMonotonicDeadline, timeout, pushContent, ownCommittedTailRef, emitCommitted } = runClockAndContent({ spec, prepared, queue, internals, rs, ident, parentToolCallId, startedToolCallIds });
                         const toolProgress = createToolProgressLane(pushContent, ident, prepared.toolOccurrences);
                         prepared.toolProgressRef.current = toolProgress;
-                        const { withBrainSinks, withLegRequestSinks } = runBrainSinks({ queue, internals, rs, ident, observeReasoningWireFacts, notice: { onNotice: this.deps.onNotice, sessionId: prepared.sessionId, runId: prepared.runId } });
+                        const { withBrainSinks, withLegRequestSinks } = runBrainSinks({ queue, internals, rs, ident, observeReasoningWireFacts, notice: { onNotice: this.deps.onNotice, sessionId: prepared.sessionId, runId: prepared.runId }, announced: prepared });
                         const toolLabels = new Map(prepared.tools.flatMap((t) => (t.label !== undefined && t.label !== t.name ? [[t.name, t.label]] : [])));
                         for (const orphan of prepared.wakeRecovered) {
                             emitSettled(prepared.toolOccurrences, { toolCallId: orphan.toolCallId, spelledName: orphan.toolName, ...(toolLabels.has(orphan.toolName) ? { label: toolLabels.get(orphan.toolName) } : {}), args: orphan.args }, reconciledEnd(orphan), { push: (f) => queue.push({ ...f, ...ident() }), structured: prepared.structuredProjector, mediaByteCapBytes: this.deps.mediaByteCapBytes });
@@ -502,7 +501,7 @@ export class Runner {
                 token, cp, resumeSignal, recheckGovernanceWindow, store, runner: this.depsSeat,
                 locallyClaimedTokens: this.locallyClaimedTokens, parentConstraintRegistry: this.parentConstraintRegistry, suspendedEnvReaps: this.suspendedEnvReaps,
                 next: () => resumeClaim({
-                    token, cp, store, outcomeForStore,
+                    token, cp, store, outcomeForStore, holder: internals?.holder,
                     locallyClaimedTokens: this.locallyClaimedTokens, parentConstraintRegistry: this.parentConstraintRegistry,
                     next: () => this.resumeHandoff({ token, cp, store, config, internals, resumeInternals, plainPolicyOutcome, redeemedAnswer, outcomeForStore, wakeMessage, wakeHookContext, legMods, resumeSignal }),
                 }),

package/dist/core/runner/session-read-file-states.d.ts

@@ -39,7 +39,22 @@ import type { ReadFileState } from "../../tools/fs/safety.js";
  */
 export declare class SessionReadFileStates {
     private readonly seats;
+    /**
+     * The ONE handoff of "which files did a file-history restore of this session move" to the read state that
+     * must stop vouching for their old bytes — written by every restore (the run's restore seat and the
+     * out-of-run `Runner.rewindFiles`), read by the next leg's read face, which checks each path against the disk
+     * after every seeding rung and settles the batch only once its own map is adopted as the seat. A leg that
+     * throws before adopting, or skips the adoption, leaves the batch for the next one. Bounded like the seats
+     * (LRU over session ids): a dropped batch costs a refusal whose wording blames an outside edit, never an admission.
+     */
+    private readonly restored;
     private static readonly CAP;
+    /** Record the ABSOLUTE paths a restore of `sessionId`'s history wrote, deleted or failed to write. */
+    noteRestored(sessionId: string, absPaths: readonly string[]): void;
+    /** The paths still owed a read-state check on `sessionId` — a copy; nothing is cleared by reading. */
+    pendingRestored(sessionId: string): readonly string[];
+    /** Clear exactly the paths a leg checked and then adopted over; a path noted since stays owed. */
+    settleRestored(sessionId: string, checked: readonly string[]): void;
     /** The session's seat row, or undefined (cross-process / evicted / first turn) ⇒ caller replays.
      *  The caller must verify the anchor against the session's CURRENT branch before using `state`. */
     get(sessionId: string): {

package/dist/core/runner/session-read-file-states.js

@@ -1,6 +1,34 @@
 export class SessionReadFileStates {
     seats = new Map();
+    restored = new Map();
     static CAP = 1024;
+    noteRestored(sessionId, absPaths) {
+        if (absPaths.length === 0)
+            return;
+        const batch = this.restored.get(sessionId) ?? new Set();
+        for (const p of absPaths)
+            batch.add(p);
+        this.restored.delete(sessionId);
+        this.restored.set(sessionId, batch);
+        while (this.restored.size > SessionReadFileStates.CAP) {
+            const oldest = this.restored.keys().next().value;
+            if (oldest === undefined)
+                break;
+            this.restored.delete(oldest);
+        }
+    }
+    pendingRestored(sessionId) {
+        return [...(this.restored.get(sessionId) ?? [])];
+    }
+    settleRestored(sessionId, checked) {
+        const batch = this.restored.get(sessionId);
+        if (batch === undefined)
+            return;
+        for (const p of checked)
+            batch.delete(p);
+        if (batch.size === 0)
+            this.restored.delete(sessionId);
+    }
     get(sessionId) {
         const seat = this.seats.get(sessionId);
         if (seat !== undefined) {

package/dist/core/runner/session-rule-policy.js

@@ -1,5 +1,5 @@
 import { canonicalizeTarget, isWinFormPath, pathFamilyOf, writeTargetPath } from "../../tools/fs/safety.js";
-import { SESSION_RULES_GRAMMAR, compileSessionRuleBucket, continuesLineage, earlierGrammarAnnouncer, earlierGrammarRefusalClause, readSessionRulesShape, unreadableDenyEntries } from "../session-policy-store.js";
+import { SESSION_RULES_GRAMMAR, compileSessionRuleBucket, continuesLineage, earlierGrammarAnnouncer, earlierGrammarEntries, earlierGrammarRefusalClause, readSessionRulesShape, unreadableDenyEntries } from "../session-policy-store.js";
 import { compiledEntryName, judgeAllowEntries, uncoveredCommandSegment } from "../allow-entry.js";
 import { inlineUntrusted } from "../untrusted-text.js";
 import { callTargetReadingOf, pathTargetBaseOf, readCallTarget } from "../effective-path-target.js";
@@ -95,7 +95,7 @@ function compileSessionRules(rules) {
     if ("fault" in shaped) {
         const { field, got } = shaped.fault;
         const what = got === "not a rule bucket" ? "a key that is no rule bucket" : field === "" ? `a value that is ${got}, not an object of rule buckets` : `${field} holding ${got}`;
-        return { deny: [], allow: undefined, earlier: { grammar: SESSION_RULES_GRAMMAR, toolAllow: [], toolDeny: [] }, allowDirs: undefined, pathRows: false, names: { deny: [], allow: [] }, unreadable: refuseEvery(what) };
+        return { deny: [], allow: undefined, earlier: { grammar: SESSION_RULES_GRAMMAR, toolAllow: [], toolDeny: [] }, announced: { toolAllow: [], toolDeny: [] }, allowDirs: undefined, pathRows: false, names: { deny: [], allow: [] }, unreadable: refuseEvery(what) };
     }
     const { toolAllow, allowDirs, grammar } = shaped.rules;
     const unreadDeny = unreadableDenyEntries(shaped.rules).length;
@@ -109,6 +109,7 @@ function compileSessionRules(rules) {
         deny,
         allow,
         earlier: { grammar, toolAllow: named(allowList, true), toolDeny: named(denyList, true) },
+        announced: { toolAllow: earlierGrammarEntries(shaped.rules, "toolAllow"), toolDeny: earlierGrammarEntries(shaped.rules, "toolDeny") },
         allowDirs: allowDirs !== undefined && allowDirs.length > 0 ? allowDirs : undefined,
         pathRows: [...deny, ...(allow ?? [])].some((r) => r.compiled.kind === "path"),
         names: { deny: [...deny.map((r) => compiledEntryName(r.compiled)), ...named(denyList, false)], allow: [...(allow ?? []).map((r) => compiledEntryName(r.compiled)), ...named(allowList, false)] },
@@ -128,7 +129,7 @@ export function createSessionRulePolicy(rules, opts) {
         if (compiled === undefined || compiledFor !== r) {
             compiled = compileSessionRules(r);
             for (const field of ["toolAllow", "toolDeny"])
-                announceEarlier(compiled.earlier[field], field, compiled.earlier.grammar);
+                announceEarlier(compiled.announced[field], field, compiled.earlier.grammar);
             compiledFor = r;
         }
         return compiled;

package/dist/core/runner/shell-env-withheld.d.ts

@@ -0,0 +1,33 @@
+/**
+ * The run's seat for `inherit_env.names_withheld`: the person whose run drives the engine's shell tool is told which
+ * variables of the engine's environment that shell does not receive.
+ *
+ * ONE FACT, ONE MINT. Which entries a shell child loses is decided by the execution environment's one composition
+ * (`inheritedHostEnv(policy, findings)` and the adapter's explicit grants), and the environment hands the result over as
+ * the read `ExecutionEnv.withheldEnv`. This seat reads that answer and tells it; it never recomputes it (the policy and
+ * the grants are the adapter's, not the run's). The split into the scrub's half and the deployment's own credentials is
+ * the one the operator notice uses (`withheldEnvNames`).
+ *
+ * WHEN. At the start of every call to the engine's own shell tool (its mount, judged by the catalog's mount judge), on a
+ * root leg (the person reads the root; the delegation fact is the hook identity's, the leg's one derivation). The answer
+ * is read at each such call because it can grow during a run — a credential the engine takes in when it first routes a
+ * model, dials a peer or builds a seat is withheld from the next child — and a call follows at least one model request.
+ * Told once per SESSION per answer: the digest rides the session's announced record (`advisories`), and a run-time record
+ * write is parked for the leg's flush like every other run-time arm of that record.
+ *
+ * An answer of `"unknown"` is told as unknown, never as silence. A value that is neither a list of findings nor
+ * `"unknown"` (or a read that throws) is a wiring fault: it is announced to the operator under the existing
+ * capability-shape code, once per run, and the person is told nothing — no reading defaults to `"unknown"`.
+ */
+import { type EngineNotice } from "../engine-notice.js";
+import type { ExecutionEnv } from "../../internal/harness.js";
+import type { Prepared } from "./contracts.js";
+export type WithheldShellEnvSeatInput = Pick<Prepared, "sessionId" | "runId" | "hookIdentity" | "toolRosterDeltas" | "announcedListingsRef" | "frameReceipts"> & {
+    readonly harness: {
+        readonly env: Pick<ExecutionEnv, "withheldEnv">;
+    };
+};
+/** The seat, per run. `onToolStart` never throws: a diagnostic may not be what fails a call. */
+export declare function createWithheldShellEnvSeat(prepared: WithheldShellEnvSeatInput, onNotice: ((notice: EngineNotice) => void) | undefined): {
+    onToolStart(toolName: string): void;
+};

package/dist/core/runner/shell-env-withheld.js

@@ -0,0 +1,51 @@
+import { deliverEngineNotice } from "../engine-notice.js";
+import { withheldEnvUserNotice } from "../secret-env.js";
+import { isEngineShellFace } from "../tool-catalog-entries.js";
+import { toolCallFaceOf } from "../tool-roster.js";
+import { announceDigest, withAnnounceDigests } from "./announce-once-ledger.js";
+const isFinding = (f) => typeof f === "object" && f !== null && typeof Reflect.get(f, "key") === "string" && typeof Reflect.get(f, "kind") === "string";
+function readWithheldEnv(env) {
+    try {
+        const value = env.withheldEnv;
+        if (value === "unknown")
+            return "unknown";
+        if (!Array.isArray(value))
+            return { malformed: value === null ? "null" : typeof value };
+        return value.every(isFinding) ? value : { malformed: "array holding a non-finding" };
+    }
+    catch {
+        return { malformed: "unreadable" };
+    }
+}
+export function createWithheldShellEnvSeat(prepared, onNotice) {
+    let shapeFaultTold = false;
+    return {
+        onToolStart(toolName) {
+            if (prepared.hookIdentity.isDelegatedChild || !isEngineShellFace(toolCallFaceOf(prepared.toolRosterDeltas.current, toolName)))
+                return;
+            const answer = readWithheldEnv(prepared.harness.env);
+            if (typeof answer === "object" && "malformed" in answer) {
+                if (shapeFaultTold)
+                    return;
+                shapeFaultTold = true;
+                deliverEngineNotice(onNotice, {
+                    code: "config.execution_env_capability_invalid",
+                    message: `The execution environment declares withheldEnv as (${answer.malformed}), not a list of findings or "unknown". The person whose run drives its shell is told nothing about the variables that shell does not receive. Fix the adapter — this is a wiring fault, not a supported way to leave the member unanswered.`,
+                    detail: { key: "withheldEnv", valueType: answer.malformed },
+                });
+                return;
+            }
+            const notice = withheldEnvUserNotice(answer, { sessionId: prepared.sessionId, runId: prepared.runId });
+            if (notice === undefined)
+                return;
+            const d = notice.detail;
+            const digest = announceDigest(notice.code, `${d.state}\n${[...(d.names ?? [])].sort().join("\n")}\n\n${[...(d.ownCredentials ?? [])].sort().join("\n")}`);
+            const record = prepared.announcedListingsRef;
+            if (record.advisories?.includes(digest) === true)
+                return;
+            deliverEngineNotice(onNotice, notice);
+            record.advisories = withAnnounceDigests(record.advisories, [digest]);
+            prepared.frameReceipts.listingSnapshotOwed = true;
+        },
+    };
+}

package/dist/core/runner/skills-seat.js

@@ -39,7 +39,7 @@ export function readSkillsSeat(skills) {
         const at = `${SKILLS_SEAT}[${i}]`;
         if (typeof raw !== "object" || raw === null || Array.isArray(raw))
             throw skillsSeatRefusal(at, `must be an object { name, description, content } (got ${kindOf(raw)})`);
-        const { name, description, content, allowedTools, disallowedTools, files: rawFiles, baseDir, ...rest } = raw;
+        const { name, description, content, allowedTools, disallowedTools, files: rawFiles, baseDir, mods: rawMods, ...rest } = raw;
         void rest;
         for (const [member, value] of [["name", name], ["description", description], ["content", content]]) {
             if (typeof value !== "string")
@@ -47,11 +47,15 @@ export function readSkillsSeat(skills) {
         }
         const files = readSkillFiles(rawFiles, `${at}.files`);
         skillBaseDirOf(baseDir);
+        if (rawMods !== undefined && !Array.isArray(rawMods))
+            throw skillsSeatRefusal(`${at}.mods`, `must be a list of mods registrations (got ${kindOf(rawMods)})`);
         if (seen.has(name))
             continue;
         seen.add(name);
         const [allowed, denied] = [readSkillTable(allowedTools), readSkillTable(disallowedTools)];
-        out.push({ name, description, content, ...(allowed !== undefined ? { allowedTools: allowed } : {}), ...(denied !== undefined ? { disallowedTools: denied } : {}), ...(files !== undefined ? { files } : {}), ...(baseDir !== undefined ? { baseDir } : {}) });
+        const list = rawMods;
+        const mods = list === undefined ? undefined : Object.freeze(Array.from({ length: list.length }, (_, j) => list[j]));
+        out.push({ name, description, content, ...(allowed !== undefined ? { allowedTools: allowed } : {}), ...(denied !== undefined ? { disallowedTools: denied } : {}), ...(files !== undefined ? { files } : {}), ...(baseDir !== undefined ? { baseDir } : {}), ...(mods !== undefined ? { mods } : {}) });
     }
     return out;
 }

package/dist/core/runner/stream-settle-backstop.js

@@ -74,7 +74,7 @@ export function streamSettleBackstop(input) {
             sessionId: taskIdRef.sessionId ?? "unknown",
             ...(taskIdRef.runId !== undefined ? { runId: taskIdRef.runId } : {}),
             terminal: { kind: "failed", ...(code !== undefined ? { code } : {}), message, ...(detail !== undefined ? { detail } : {}) },
-            result: "",
+            result: "", resultEntryIds: [],
             ...(remoteEnvFailure !== undefined ? { remoteEnvFailures: remoteEnvFailure } : {}),
             ...(taskIdRef.effectiveMemoryScopes !== undefined ? { effectiveMemoryScopes: taskIdRef.effectiveMemoryScopes } : {}),
             ...(taskIdRef.effectiveReasoning !== undefined ? { effectiveReasoning: taskIdRef.effectiveReasoning } : {}),

package/dist/core/runner/sub-agent-deny-lists.js

@@ -6,7 +6,7 @@ import { ENGINE_TOOLS } from "../tool-catalog-entries.js";
 import { callerToolNameProblem } from "../caller-tool-name.js";
 import { mintNamespacePrefix } from "../protocol-naming.js";
 import { PROTOCOL_TABLE, protocolOf } from "../protocol-table.js";
-import { mountedToolNames, splitNamespacedName, wholeProtocolOf } from "../tool-name-aliases.js";
+import { grantWildcardRefusalOf, mountedToolNames, splitNamespacedName } from "../tool-name-aliases.js";
 import { projectionToolNames } from "../tool-policy.js";
 import { declaredDelegationNameOf } from "../delegation-name.js";
 export function renamedDelegationMountSentence(...rosters) {
@@ -97,9 +97,6 @@ function readableToolNameList(where, side, value, code) {
             throw refused(notAStringSentence(where, side, index, read.type), code, "not_a_string");
         if (read.kind === "unreadable")
             throw grammarRefusal(where, side, { entry: read.entry, reason: "grammar" }, code);
-        if (side === "denied" && read.name === "*") {
-            throw refused(`${where} declares ${renderListEntry(entry)} in its ${LIST_WORD[side]}: a denied list has no wildcard — the entry would hide nothing. To give the agent no tools, write an empty allowed list.`, code, "unsupported_pattern");
-        }
         return { entry: entry, name: read.name, content: read.content };
     });
 }
@@ -117,11 +114,11 @@ function judgeToolNameList(where, side, value, universe, advise, code) {
         const content = side === "denied" && written;
         const reach = side === "denied" ? readDeniedToolList([entry]) : (readAllowedToolList([entry]) ?? readDeniedToolList([]));
         const split = splitNamespacedName(name);
-        const whole = wholeProtocolOf(name);
-        if (whole !== undefined) {
+        const toolSplit = splitNamespacedName(toolName);
+        if (toolName.includes("*") && (toolSplit === undefined || toolSplit.peer.includes("*"))) {
             if (side === "denied")
                 continue;
-            throw refused(`${where} declares ${renderListEntry(entry)} in its ${LIST_WORD[side]}: an allowed list has no protocol-wide form — name a peer (\`${whole.prefix}<peer>\`) or one of its tools (\`${whole.prefix}<peer>__<tool>\`).`, code, "unsupported_pattern");
+            throw refused(`${where} declares ${renderListEntry(entry)} in its ${LIST_WORD[side]}: ${grantWildcardRefusalOf(name)}.`, code, "unsupported_pattern");
         }
         const { inert } = compileAllowList([toolName], "deny", universe.known);
         const flaw = inert[0] === undefined ? undefined : { ...inert[0], entry, ...(inert[0].reason === "near_miss" && inert[0].currentName !== undefined ? { carriedBy: universe.carrierOf(inert[0].currentName) } : {}) };

package/dist/core/runner/synthetic-tools.d.ts

@@ -58,6 +58,12 @@ export declare const SKILL_TOOL_NAME = "Skill";
  *  an oversized skill is excluded from the disclosure block and the tool, with an operator-visible config error. The compaction-time retention caps are a
  *  different door, deliberately. */
 export declare const SKILL_CONTENT_MAX_CHARS: number;
+/** The skills a leg LOADS — those the load gate above passes ({@link skillLoadReading}, the one predicate): the skills whose
+ *  hooks the leg's mods admission takes, as the roster's filter (which also reports each one it excludes) takes the same. */
+export declare function skillsThatLoad<T extends {
+    readonly content: string;
+    readonly baseDir?: unknown;
+}>(skills: readonly T[] | undefined): T[];
 /** Total per-invoke cap for a skill's inlined attachments (`SkillSpec.files`) — an ATTACHMENT-face budget, distinct from the (gone) body truncation door:
  *  the body is delivered untruncated at invoke time (CC parity), while attachments ride along bounded and truncation-disclosed. */
 export declare const SKILL_ATTACHMENTS_MAX_CHARS = 50000;

package/dist/core/runner/synthetic-tools.js

@@ -4,7 +4,7 @@ import { sanitizeUntrustedText, SHELLED_BODY_ENVELOPE_TAGS } from "../untrusted-
 import { SKILL_LISTING_DEFAULT_BUDGET, SKILL_LISTING_DESC_MAX_CHARS_DEFAULT } from "../skill-listing-budget.js";
 import { readSkillTable, skillNamedBy } from "../skill-grant.js";
 import { OUTPUT_TOOL_NAME, mountRuleFace, toolFace } from "../tool-catalog-entries.js";
-import { substituteSkillRoot, substituteSkillRootBounded } from "./skill-base-dir.js";
+import { skillLoadReading, substituteSkillRoot, substituteSkillRootBounded } from "./skill-base-dir.js";
 import { readSkillsSeat } from "./skills-seat.js";
 import { foldListingWithin } from "./listing-fold.js";
 export const REPORT_BLOCKED_TOOL_NAME = "ReportBlocked";
@@ -90,6 +90,9 @@ export function createReportFindingsTool() {
 }
 export const SKILL_TOOL_NAME = "Skill";
 export const SKILL_CONTENT_MAX_CHARS = 1024 * 1024;
+export function skillsThatLoad(skills) {
+    return (skills ?? []).filter((s) => skillLoadReading(s, SKILL_CONTENT_MAX_CHARS).loads);
+}
 export const SKILL_ATTACHMENTS_MAX_CHARS = 50_000;
 export const SKILL_ATTACHMENT_PATH_MAX_CHARS = 512;
 const SKILL_FILES_LIST_MAX_CHARS = 200;

package/dist/core/runner/tool-disclosure.d.ts

@@ -64,20 +64,18 @@ export declare function buildDeferredRegistry(deferred: ReadonlySet<string>, too
  * validation, not activation state: a call whose arguments validate against the REAL tool's
  * declared schema runs the real tool directly (activation is only about whether the model has
  * been SHOWN the schema, never an execution gate). Governance cannot be laundered through this
- * lane: policy/effect/irreversibility gates key on the tool NAME maps built from the real
- * declarations, and the engine's approval pipeline runs before any execute — the placeholder
- * object on the harness list plays no part in adjudication.
+ * lane: the gate judges the call before any execute, and the call runs the one mounted instance its
+ * placeholder stands for — the harness resolves a call to its placeholder before the gate, as it
+ * resolves any call to its tool, so what runs is fixed before anything is judged.
  */
 export interface PlaceholderDirectCall {
     /**
-     * Resolve the real tool AT CALL TIME, never from a prepare-time snapshot. The mounted
-     * roster is a LIVE array: an MCP refresh splices a server's name domain out and pushes freshly
-     * materialized tool objects back in, so a Map captured when the placeholder was built would hand
-     * this lane the WITHDRAWN object (stale schema shape gate, stale transport client) long after the
-     * roster moved on. Returns `undefined` when the name no longer resolves — a withdrawn name has no
-     * direct lane, and the caller falls back to the teaching rejection.
+     * The mounted instance this placeholder stands for, bound when the placeholder is minted for it (one
+     * placeholder per instance; a refresh that replaces the instance mints a new placeholder for the new
+     * one). Never re-resolved by name: a call the gate judged while a refresh landed runs the instance it
+     * was resolved to, whose own checks answer a declaration that changed meanwhile.
      */
-    resolveReal: () => PlaceholderDirectTarget | undefined;
+    real: PlaceholderDirectTarget;
     /**
      * The scheduling declaration this placeholder carries while it stands in for the real
      * tool. Mirrors the REAL tool's own `executionMode` (see the mirror rationale in
@@ -91,7 +89,7 @@ export interface PlaceholderDirectCall {
      * schema it hands back actually lives (this result only, versus this result AND every later
      * request's tools block). Absent ⇒ the swap posture.
      *
-   * A FUNCTION, evaluated per call, for the same reason `resolveReal` is: the answer is not
+   * A FUNCTION, evaluated per call: the answer is not
      * a prepare-time constant. The run-wide strategy is, but the per-tool exemption on top of it reads
      * the LIVE roster — an MCP refresh can replace a tool with a declaration that no longer fits the
      * result-text carrier (or one that now does), and a boolean captured when the placeholder was built
@@ -113,7 +111,7 @@ export interface PlaceholderDirectCall {
      */
     activate: () => Promise<string | undefined>;
 }
-/** The live view of the real tool behind a placeholder, resolved per call (see {@link PlaceholderDirectCall.resolveReal}). */
+/** The real tool behind a placeholder (see {@link PlaceholderDirectCall.real}). */
 export interface PlaceholderDirectTarget {
     /** The REAL tool's declared parameter schema — the shape gate for a direct call. */
     parameters: TSchema;

package/dist/core/runner/tool-disclosure.js

@@ -93,9 +93,7 @@ export function createPlaceholderTool(info, direct) {
             parameters: EMPTY_PARAMS,
             ...(direct.executionMode !== undefined ? { executionMode: direct.executionMode } : {}),
             execute: async (toolCallId, params, signal, onUpdate) => {
-                const real = direct.resolveReal();
-                if (real === undefined)
-                    return teachingRejection();
+                const { real } = direct;
                 if (Value.Check(real.parameters, params)) {
                     lastFailureShape = undefined;
                     repeats = 0;

package/dist/core/runner/tool-end-body.d.ts

@@ -95,7 +95,7 @@ export interface SettledOccurrence extends Pick<OccurrenceEnd, "notExecuted"> {
  * The END projection — the ONE mint of `tool_end`, for every station that closes a call: the live loop's
  * `tool_execution_end`, the resumed leg's resolution, an interrupted run's reconcile and the reconcile replayed at
  * the next process start. It reads the occurrence and nothing else: `gate` is its latest gate record, `isError` is
- * the tool's bit or the refusal that record names, and `notExecuted` rides on positive evidence only: the station's own or `refusedBeforeRelease` (returned for the rows).
+ * the tool's bit or the refusal that record names, and `notExecuted` rides on positive evidence only: the station's own or `neverExecuted` (returned for the rows).
  *
  * A call whose start never went out on this stream (a call the loop never reached, a call announced by a dead
  * process) gets its start minted here first, marked `recovered` and carrying the input the closing station holds —

package/dist/core/runner/tool-end-body.js

@@ -1,6 +1,6 @@
 import {} from "../../internal/harness.js";
-import { readMember } from "../thrown-value.js";
-import { refusedBeforeRelease } from "./tool-not-executed.js";
+import { isPlainRecord } from "../mods/kernel/receive.js";
+import { neverExecuted } from "./tool-not-executed.js";
 import { MCP_DELIVERY_VERDICTS } from "../mcp-failure.js";
 import { closeNeverExecuted } from "../session-reconcile.js";
 import { TOOL_SEARCH_NAME } from "./tool-disclosure.js";
@@ -38,11 +38,12 @@ export function batchResponseDigest(result) {
 export function toolEndBodyFrom(result, isError, leg, gate, gatedCallIdOfRun) {
     const o = toolOutputFrom(result, leg.mediaByteCapBytes);
     const st = leg.structured(result);
-    const det = isError ? readMember(result, "details") : undefined;
-    const codeRaw = readMember(det, "code");
-    const kindRaw = readMember(det, "errorKind");
+    const det = isError ? result?.details : undefined;
+    const card = isPlainRecord(det) ? det : undefined;
+    const codeRaw = card?.code;
+    const kindRaw = card?.errorKind;
     const code = typeof codeRaw === "string" ? codeRaw : typeof kindRaw === "string" ? kindRaw : undefined;
-    const deliveredRaw = readMember(det, "delivered");
+    const deliveredRaw = card?.delivered;
     const delivered = typeof deliveredRaw === "string" && MCP_DELIVERY_VERDICTS.includes(deliveredRaw) ? deliveredRaw : undefined;
     const gatedCallId = code === "gate.parked" ? gatedCallIdOfRun : undefined;
     return {
@@ -54,7 +55,7 @@ export function toolEndBodyFrom(result, isError, leg, gate, gatedCallIdOfRun) {
         ...(gate !== undefined ? { gate } : {}),
     };
 }
-const startFrameOf = (o, recovered) => ({ type: "tool_start", toolCallId: o.toolCallId, toolName: o.spelledName, ...(o.label !== undefined ? { label: o.label } : {}), args: o.args, ...(recovered ? { recovered: true } : {}) });
+const startFrameOf = (o, recovered) => ({ type: "tool_start", toolCallId: o.toolCallId, toolName: o.spelledName, ...(o.label !== undefined ? { label: o.label } : {}), args: o.args, ...(recovered ? { recovered: true } : {}), ...(o.requestedBy !== undefined ? { requestedBy: o.requestedBy } : {}) });
 export function announceToolCall(table, start, frames) {
     table.open(start);
     frames.push(startFrameOf(start, false));
@@ -65,7 +66,7 @@ export function emitSettled(table, start, end, frames) {
     if (!occ.startEmitted)
         frames.push(startFrameOf(occ, true));
     const gate = occ.gateRounds.at(-1);
-    const isError = end.isError || gate?.disposition.kind === "denied", notExecuted = end.notExecuted === true || refusedBeforeRelease(occ);
+    const isError = end.isError || gate?.disposition.kind === "denied", notExecuted = end.notExecuted === true || neverExecuted(occ);
     table.close(occ.toolCallId, end.interrupted === true ? "interrupted" : "settled");
     frames.push({
         type: "tool_end",
@@ -75,7 +76,7 @@ export function emitSettled(table, start, end, frames) {
         isError,
         ...toolEndBodyFrom(end.result, isError, frames, gate, end.gatedCallIdOfRun),
         ...(gate?.disposition.kind === "denied" && occ.wireName !== undefined ? { wireName: occ.wireName } : {}),
-        ...(notExecuted ? { notExecuted: true } : {}),
+        ...(notExecuted ? { notExecuted: true } : {}), ...(occ.answeredInPlaceBy !== undefined ? { answeredBy: occ.answeredInPlaceBy } : {}), ...(occ.requestedBy !== undefined ? { requestedBy: occ.requestedBy } : {}),
     });
     return { ...(gate !== undefined ? { gate } : {}), isError, ...(notExecuted ? { notExecuted: true } : {}) };
 }

package/dist/core/runner/tool-not-executed.d.ts

@@ -4,9 +4,14 @@ import type { ToolOccurrence } from "./tool-occurrence.js";
  *  release, by a station inside the execution, is not). A call whose start this stream never carried (a recovered
  *  one, closed by a station that knows only its own class) is not read here. */
 export declare function refusedBeforeRelease(occ: Pick<ToolOccurrence, "life" | "gateRounds" | "startEmitted">): boolean;
+/** The one reading of the engine's positive evidence that a call never ran: refused before it was let go
+ *  ({@link refusedBeforeRelease}), or answered in place of its body by an extension at `tool.call` (the body was never called). */
+export declare function neverExecuted(occ: Pick<ToolOccurrence, "life" | "gateRounds" | "startEmitted" | "answeredInPlaceBy">): boolean;
 /** `details` as a persisted `toolResult` row carries it: `notExecuted` is the ENGINE's key — the settlement's fact when it holds,
  *  absent otherwise, whatever a tool wrote under that name. Returns `details` itself unless the key has to move; never mutates it. */
 export declare function rowDetailsOf(details: unknown, notExecuted: boolean): unknown;
+/** The persisted row's mark: the call this `toolResult` row closes never ran (the key {@link rowDetailsOf} writes). */
+export declare function rowNotExecuted(details: unknown): boolean;
 /** A row the resumed leg mints (`toolResultMsg`) with the settlement's fact on it. */
 export declare function withRowNotExecuted<T extends object>(row: T, notExecuted: boolean): T;
 /** Write the end projection's one `notExecuted` onto the result the live loop persists as the call's row: the loop builds that message

package/dist/core/runner/tool-not-executed.js

@@ -2,6 +2,9 @@ import { readOwnMembers } from "../thrown-value.js";
 export function refusedBeforeRelease(occ) {
     return occ.life === "announced" && occ.startEmitted && occ.gateRounds.at(-1)?.disposition.kind === "denied";
 }
+export function neverExecuted(occ) {
+    return refusedBeforeRelease(occ) || occ.answeredInPlaceBy !== undefined;
+}
 export function rowDetailsOf(details, notExecuted) {
     const carries = (() => { try {
         return details !== null && typeof details === "object" && !Array.isArray(details) && Object.keys(details).includes("notExecuted");
@@ -18,6 +21,14 @@ export function rowDetailsOf(details, notExecuted) {
         delete bag["notExecuted"];
     return bag;
 }
+export function rowNotExecuted(details) {
+    try {
+        return details !== null && typeof details === "object" && details.notExecuted === true;
+    }
+    catch {
+        return false;
+    }
+}
 export function withRowNotExecuted(row, notExecuted) {
     return notExecuted ? { ...row, details: rowDetailsOf(undefined, true) } : row;
 }

package/dist/core/runner/tool-occurrence.d.ts

@@ -42,6 +42,8 @@ export interface OccurrenceStart {
     readonly label?: string;
     /** The arguments the start frame carries (for a recovered start: the call's own input as the transcript holds it). */
     readonly args: unknown;
+    /** An extension's own call (`$.tool.call`): who asked for it — the frames carry it. Absent for a call a model message carried. */
+    readonly requestedBy?: import("../task-event.js").ExtensionRequester;
 }
 /** The record, as its readers see it. Written only through {@link ToolOccurrenceTable}. */
 export interface ToolOccurrence extends OccurrenceStart {
@@ -63,6 +65,9 @@ export interface ToolOccurrence extends OccurrenceStart {
     /** The heartbeat covers it. Cleared when the loop leaves the call behind at a turn end with no end of its own:
      *  the record stays (a later settlement must still know its start frame went out) but no beat describes it. */
     readonly beating: boolean;
+    /** An extension at `tool.call` answered for the call in place of its body — its result, or its refusal — and named here:
+     *  the body was never called (positive evidence the call did not run). Absent: no station answered in its place. */
+    readonly answeredInPlaceBy?: string;
 }
 /** The table of one leg's occurrences — the record's only writer. */
 export interface ToolOccurrenceTable {
@@ -86,6 +91,9 @@ export interface ToolOccurrenceTable {
     /** A station after the gate refused the call: one more gate record, minted as a veto of whatever the latest one
      *  settled (a person's yes stays on the settlement; the refusing layer is the disposition). Returns the record. */
     refuse(toolCallId: string, layer: DeniedBy): GateOutcome;
+    /** An extension at `tool.call` answered for the call before its body was called (the kernel's record says the body had
+     *  not started): the body is never called for this attempt. Once per attempt; a second is an engine defect. */
+    answeredInPlace(toolCallId: string, by: string): void;
     /** An ask for this call is put to the person: the count rises, and the returned `resumeFromUser` lowers it once
      *  (a second call is a no-op). The pair is bound to THIS attempt — a return after the call ended, or after a
      *  reused id re-opened, touches nothing — and an ask for a call this leg does not hold counts nothing: the wait

package/dist/core/runner/tool-occurrence.js

@@ -21,6 +21,7 @@ export function createToolOccurrenceTable() {
             ...(start.wireName !== undefined ? { wireName: start.wireName } : {}),
             ...(start.label !== undefined ? { label: start.label } : {}),
             args: start.args,
+            ...(start.requestedBy !== undefined ? { requestedBy: start.requestedBy } : {}),
             attempt,
             life: "announced",
             awaitingUser: 0,
@@ -96,6 +97,12 @@ export function createToolOccurrenceTable() {
             occ.gateRounds.push(round);
             return round;
         },
+        answeredInPlace(toolCallId, by) {
+            const occ = held(toolCallId, "an answer in place of the body");
+            if (occ.answeredInPlaceBy !== undefined)
+                throw new Error(`tool occurrence: call "${toolCallId}" (attempt ${occ.attempt}) was already answered in place`);
+            occ.answeredInPlaceBy = by;
+        },
         heard(toolCallId) {
             const occ = byId.get(toolCallId);
             if (occ !== undefined)