@sema-agent/core 7.55.0 → 7.56.0

package/dist/core/task-registry.js

@@ -32,6 +32,7 @@ const TASK_PREFIX = {
     background_agent: "a",
     monitor: "m",
 };
+const A_LATER_LEG = Object.freeze({});
 function noTask(taskId, runningAgents) {
     return {
         content: `No task found with ID: ${taskId}${runningAgents ? notFoundRunningAgentsTail(runningAgents) : ""}`,
@@ -871,6 +872,9 @@ export class TaskRegistry {
             return { legs: [] };
         return { legs: verb === "output" ? ["outside_read"] : [] };
     }
+    owedDeliveries(access) {
+        return this.liveTasks(access).map((t) => this.boundaryLegsOf(t.task_id, access, "output", A_LATER_LEG));
+    }
     async pollTask(id, access, opts = {}) {
         const taskId = id.trim();
         const deadline = opts.block ? blockDeadline(opts.timeoutMs, Date.now()) : undefined;
@@ -1017,6 +1021,12 @@ The durable record is still marked running (last update ${new Date(row.updatedAt
     lastGcAt = 0;
     list(access, opts = {}) {
         const limit = Math.min(500, Math.max(1, Math.floor(opts.limit ?? 50)));
+        return this.rowsUnder(access).slice(0, limit);
+    }
+    liveTasks(access) {
+        return this.rowsUnder(access).filter((t) => t.status === "pending" || t.status === "running" || t.status === "parked");
+    }
+    rowsUnder(access) {
         const out = [];
         for (const h of this.handles.values()) {
             if (!canAccess(h, access))
@@ -1034,7 +1044,7 @@ The durable record is still marked running (last update ${new Date(row.updatedAt
             });
         }
         out.sort((a, b) => b.createdAt - a.createdAt);
-        return out.slice(0, limit);
+        return out;
     }
     maybeGc(now = Date.now()) {
         if (now - this.lastGcAt < 60_000)

package/dist/core/task-result.d.ts

@@ -247,6 +247,24 @@ export interface TaskResult {
     effectiveReasoning?: import("../brain/reasoning.js").ResolvedReasoning;
     /** Final assistant text. */
     result: string;
+    /**
+     * Where {@link result} was read from: the session-tree entry ids of the committed assistant messages the engine selected
+     * as the answer's source, in conversation order — the ids `message_committed.entryId` carries on the stream. One id for
+     * an ordinary answer; every member of the continuation chain when a cut answer was continued (`result` is their texts,
+     * joined). `result` is the answer's one authority: a committed message can differ from what streamed (engine notes
+     * placed at finalize, a degenerate cut trimmed), so a consumer that rendered the stream replaces the named messages'
+     * text rows with `result` instead of comparing; one that cannot bind an id (it lost that `message_committed`) reads the
+     * named entries from the session rather than guessing which rows they were.
+     *
+     * EMPTY when `result` was read from no committed message (the run produced no assistant message, or only one that was
+     * never appended — an empty failure). A named message may contribute no text (a tool-calling message a park or a stop
+     * ended on; a thinking-only head of a continuation chain), so `result` may be empty beside a non-empty list. ABSENT when
+     * the provenance is unknown: a record an older engine wrote, a result rebuilt from a checkpoint row alone, or an answer
+     * a leg read from a message committed before it began (whose append that leg never saw).
+     *
+     * Not yet byte-equal: `result` alone drops inline `<think>…</think>` blocks and is trimmed; the named messages keep both.
+     */
+    resultEntryIds?: readonly string[];
     /**
      * Best-effort salvaged assistant text from a terminal FAILURE. Consumption recipe: on a non-`completed`
      * status read `result` FIRST — most failure terminals (max-turns, budget, tool errors, …) still carry

package/dist/core/task-spec.d.ts

@@ -296,12 +296,12 @@ export interface TaskSpec {
     advisorModel?: ModelRef;
     /** Thinking level. If omitted, a default from the resolved role's `RoleSpec.thinking` applies. */
     thinking?: ThinkingLevel;
-    /** This task's role text: it replaces the selected role base (`promptRole`). Text carrying a locked section verbatim
-     *  (an already-assembled prompt) is refused by name (`prompt.assembled_role_refused`). */
+    /** This task's role text: it replaces the role base `promptRole` selects; the task names its role base first, above its role's preset (`RoleSpec`).
+     *  Text carrying a locked section verbatim (an already-assembled prompt) is refused by name (`prompt.assembled_role_refused`). */
     systemPrompt?: string;
-    /** The role base `core/role.base` selects: `"general"` (absent), `"code"`, `"coordinator"`, `"cowork"` (rendered from the
-     *  mounted tools and the working directory); `systemPrompt` replaces whichever is selected. Not inherited (a child gets
-     *  the sub-agent persona). A value outside the closed set (`HOST_ROLES`, tested by `isHostRole`) is refused at prepare. */
+    /** The role base `core/role.base` selects — `"general"`, `"code"`, `"coordinator"`, `"cowork"` (rendered from the mounted tools and the
+     *  working directory) — and the run's host role; `systemPrompt` replaces it. A task naming neither takes its role's preset (`RoleSpec.promptRole` /
+     *  `systemPrompt`) whole; an explicit `"general"` names the general base and ends that chain, absent does not. Not inherited (a child gets the sub-agent persona). Outside the closed set (`HOST_ROLES`, `isHostRole`) ⇒ refused at prepare. */
     promptRole?: import("../prompt-assembly/catalog/schema.js").HostRole;
     /** `"minimal"` leaves the core-behavior band out; the locked sections (mode sections in play among them) and
      *  `appendSystemPrompt` stay. Absent ⇒ standard. Rides the parent spec seat to every engine-built child (a clamp-table
@@ -600,14 +600,14 @@ export interface TaskSpec {
      */
     deferSelfResolve?: boolean;
     /**
-     * R2 双形轴(2026-07-18 裁): which prompt-profile face this task speaks — "simple" (default;
-     * the short-form tool descriptions + lean system sections, what CC serves every non-claude
-     * model id) or "classic" (the long-form face, ≈ CC 4.x-era wording — switchable per task/model,
-     * e.g. serving classic to a model that scores better on it; center distribution rides this field).
-     * Affects PRESENTATION only (descriptions/section wording), never tool behavior or policy.
-     * Inherited by delegated children unless their spec overrides.
+     * The task's one switch on the prompt's shape: `true` adds the `lean_prompt` trait to the model's declared traits
+     * (`Model.promptTraits`), `false` removes it (the long, classic shape of the system sections and tool descriptions),
+     * absent leaves the model's answer. It moves no other trait — a model-family trait stays the model's. PRESENTATION
+     * only (section wording, tool descriptions), never tool behavior or policy. Inherited by delegated children (and
+     * workflow agents) unless their spec writes it; a value that is not a boolean refuses the task
+     * (`config.prompt_selector_invalid`).
      */
-    promptProfile?: "simple" | "classic";
+    promptLean?: boolean;
     /**
      * core half — PER-TASK custom sub-agents. Same shape as the boot injection point
      * ({@link RunnerDeps.agents} / `SubagentToolOptions.agents`): full {@link AgentDefinition} objects
@@ -665,7 +665,7 @@ export interface TaskSpec {
      *  registrations hang handlers on the `classic.*` events the engine's stations raise (tool pre/post/failure/batch,
      *  prompt submit, stop, compaction, permission denied). A delegated child dispatches its parent's task seat as its own
      *  (the parent spec seat fills an unset one). */
-    mods?: readonly import("./mods/kernel/index.js").ModRegistration<import("./mods/dollar.js").EngineDollar>[];
+    mods?: readonly import("./mods/classic-events.js").EngineModRegistration[];
     /**
      * The session's SELF-REPORTED presence for the peer directory (`agent` = what it is, `intent` = what
      * it is doing; each ≤ 120 chars). The engine never writes a directory row: the same object goes out
@@ -1538,6 +1538,11 @@ export interface TaskSpec {
          *  the default was off — a probe pinning "no background_tasks frame without opt-in" reds. */
         backgroundTasks?: boolean;
         toolsDelta?: true;
+        /** The notice that a declared MCP server did not connect for this message: its tools are unavailable for now, and it is
+         *  tried again when the next message arrives. Rides the leg's first request (a fresh leg's first user message, a resumed leg's continuation),
+         *  once per session per server and error. DEFAULT ON — boolean: `false` is the opt-out, a non-boolean is refused at the
+         *  task's door (`config.invalid_argument`). BREAKING: the notice used to ride {@link toolsDelta}, and only a turn boundary. */
+        mcpUnavailable?: boolean;
         /** [c209-C] listing family — DEFAULT ON (boolean, not `true`: explicit `false` is the opt-out;
          *  see the family carve-out note above). BREAKING (B-3): pre-[c209-C] the default was off. */
         agentListing?: boolean;

package/dist/core/tighten-task-spec.js

@@ -1,4 +1,5 @@
 import { combinePolicies } from "./tool-policy.js";
+import { namesEveryTool } from "../agents/tool-filter.js";
 import { clampPermissionMode } from "./ask-origin.js";
 import { CLAMP_SEATS, clampCellOf, clampCellPath, composeClampSeat, loosensClampSeat } from "./child-clamp-seats.js";
 export class TaskSpecTightenError extends Error {
@@ -25,7 +26,7 @@ export function tightenTaskSpec(base, overrides) {
     {
         const b = base.allowTools;
         const o = overrides.allowTools;
-        if (b !== undefined && o !== undefined && !b.includes("*")) {
+        if (b !== undefined && o !== undefined && !b.some(namesEveryTool)) {
             const wider = o.filter((entry) => !b.includes(entry));
             if (wider.length > 0)
                 throw new TaskSpecTightenError(`tightenTaskSpec: cannot widen allowTools beyond the base list (override names ${JSON.stringify(wider)}; the override may only narrow)`);

package/dist/core/tool-catalog-entries.d.ts

@@ -54,6 +54,23 @@ export declare function toolFace(id: string): ToolFaceDeclaration;
 /** Is `contract` a contract object the catalog minted for an engine definition ({@link toolFace}) — the one record of "the engine
  *  declared this", which a value written by hand (the same id spelled out) is not. */
 export declare function isCatalogContract(contract: unknown): boolean;
+/**
+ * "Does this call dispatch to the ENGINE's own instance of one of these definitions?" — the one judge, read off the call's face:
+ * one of the engine's own mount sites mounted the tool (`engineMounted`, the one identity a caller cannot wear), and the
+ * contract it carries is the one the catalog gives one of `ids`. Never the name or the contract alone: a caller's tool can take
+ * an engine name, and a contract id can be written by hand. False for every other call — a caller's or a protocol peer's tool,
+ * a face rebuilt from a park row minted before the row recorded its mount site, a bare request (no face). A row minted since
+ * carries the mount site its roster entry had at the park, so the pre-claim recheck of its edit reads this judge's answer at park time.
+ */
+export declare function engineMountedAs(ids: readonly string[]): (face: {
+    readonly engineMounted?: true;
+    readonly contractId: string;
+} | undefined) => boolean;
+/** Is this call's face the engine's own shell tool (either of its two mounts)? */
+export declare const isEngineShellFace: (face: {
+    readonly engineMounted?: true;
+    readonly contractId: string;
+} | undefined) => boolean;
 /**
  * The rule face a definition whose schema is BUILT PER MOUNT puts on its instance: its row's primaries only (none ⇒ no rule
  * face). The row's `params` is the static view's vocabulary, the fullest mount's; a mount's own is read off the schema it

package/dist/core/tool-catalog-entries.js

@@ -58,7 +58,7 @@ export const TOOL_CATALOG_ENTRIES = [
     },
     {
         id: "bash", name: "Bash", source: "builtin", definedIn: "src/tools/fs/fs-bash.ts", mountedBy: ["hands"],
-        cards: ["bash", "readonly_out_of_root", "read_unestablished", "bash_invalid_timeout"],
+        cards: ["bash", "readonly_out_of_root", "read_unestablished", "bash_invalid_timeout", "bash_self_kill_refused"],
         face: {
             family: "shell", boundaryLegs: ["env"], effect: "write", contentOrigin: "execution", contract: c(FULL_SHELL_CONTRACT_ID),
             ruleFace: SHELL_RULE_FACE,
@@ -174,6 +174,7 @@ export const ENGINE_CARDS = Object.freeze({
     read_path_denied: "src/tools/fs/safety.ts",
     readonly_out_of_root: "src/tools/fs/shell-read-check.ts",
     read_unestablished: "src/tools/fs/shell-read-check.ts",
+    bash_self_kill_refused: "src/tools/fs/pattern-kill-guard.ts",
 });
 const byId = new Map();
 for (const e of TOOL_CATALOG_ENTRIES) {
@@ -190,12 +191,22 @@ export function toolFace(id) {
         throw new Error(`tool catalog: no definition ${JSON.stringify(id)}`);
     const face = { contentOrigin: "local", ...structuredClone(e.face) };
     if (face.contract !== undefined)
-        CATALOG_CONTRACTS.add(face.contract);
+        CATALOG_CONTRACTS.add(Object.freeze(face.contract));
     return face;
 }
 export function isCatalogContract(contract) {
     return typeof contract === "object" && contract !== null && CATALOG_CONTRACTS.has(contract);
 }
+export function engineMountedAs(ids) {
+    const contracts = new Set(ids.map((id) => {
+        const contractId = byId.get(id)?.face.contract?.contractId;
+        if (contractId === undefined)
+            throw new Error(`tool catalog: ${JSON.stringify(id)} declares no contract — an engine mount is judged by its definition's contract`);
+        return contractId;
+    }));
+    return (face) => face?.engineMounted === true && contracts.has(face.contractId);
+}
+export const isEngineShellFace = engineMountedAs(["bash", "bash-readonly"]);
 export function mountRuleFace(id) {
     const primaryParams = toolFace(id).ruleFace?.primaryParams;
     return primaryParams === undefined ? undefined : { primaryParams: [...primaryParams] };

package/dist/core/tool-check-reading.d.ts

@@ -11,6 +11,8 @@ export type ToolCheckStanding = Exclude<PermissionResult, {
     action: "deny";
 }>;
 /** What a reading came to. `minted` on an ask: the reading minted it over an allow (the ask carries no stamp of the round yet).
+ *  `cleared`: the allow layer's `hook` member cleared the ask, `entries` naming the registrations that spoke (the allow layer
+ *  records the clearance as it records the member's clear on a `classic.PreToolUse` allow).
  *  `approved`: a person an inherited installation's question went to approved an edit of the call — the gate's approved-edit
  *  pass takes it, as it takes an edit approved at this leg's own question. */
 export type ToolCheckReading = {
@@ -30,6 +32,7 @@ export type ToolCheckReading = {
     readonly allow: Extract<PermissionResult, {
         action: "allow";
     }>;
+    readonly entries: readonly string[];
 } | {
     readonly kind: "shadowed";
     readonly shadows: readonly AllowRuleShadow[];
@@ -53,6 +56,14 @@ export interface ToolCheckCall {
     readonly request: ToolCallRequest;
     readonly signal: AbortSignal | undefined;
 }
+/**
+ * The allow layer's `hook` member clearing an ask — an extension's word that the call needs no asking, whichever event spoke
+ * it (a `classic.PreToolUse` allow at the head of the layer, a `tool.check` allow behind the read-only arm): the allow over
+ * the args the gate judged (the policy's rewrite riding), named by the registrations that spoke.
+ */
+export declare function extensionAllowOf(speakers: readonly string[], rewrite: unknown): Extract<PermissionResult, {
+    action: "allow";
+}>;
 /** One chain a gate raises `tool.check` on: its raise over a projection; for the leg's own bus only, the allow layer's
  *  predicate under which its `allow` may clear an ask; for an inherited installation only, the settlement its question takes. */
 export interface ToolCheckChain {

package/dist/core/tool-check-reading.js

@@ -1,5 +1,5 @@
 import { refusalOf } from "./tool-policy.js";
-import { allowRuleShadowOf } from "./allow-entry.js";
+import { allowRuleShadowOf, withAllowRuleShadow } from "./allow-entry.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 import { failedHandlerClause } from "./mods/stations.js";
 const STANDS = Object.freeze({ kind: "stands" });
@@ -23,9 +23,14 @@ function readToolCheck(heard, standing, call, mayClear) {
     }
     if (standing.action === "allow")
         return STANDS;
+    const entries = heard.by !== undefined ? [heard.by] : [];
     if (mayClear?.() === true)
-        return { kind: "cleared", allow: { action: "allow", message: `${who} allowed this call`, decisionReason: "hook", ...rewritten } };
-    return { kind: "shadowed", shadows: [allowRuleShadowOf("hook", heard.by !== undefined ? [heard.by] : [])] };
+        return { kind: "cleared", allow: extensionAllowOf(entries, call.rewrite), entries };
+    return { kind: "shadowed", shadows: [allowRuleShadowOf("hook", entries)] };
+}
+export function extensionAllowOf(speakers, rewrite) {
+    const who = speakers.length > 0 ? speakers.map((s) => `extension "${inlineUntrusted(s, 80)}"`).join(", ") : "an extension";
+    return { action: "allow", message: `${who} allowed this call`, decisionReason: "hook", ...(rewrite !== undefined ? { updatedInput: rewrite } : {}) };
 }
 function speakerOf(heard) {
     return { who: heard.by !== undefined ? `extension "${inlineUntrusted(heard.by, 80)}"` : "an extension", why: heard.reason !== undefined ? `: ${inlineUntrusted(heard.reason, 500)}` : "" };
@@ -38,7 +43,7 @@ export async function readToolChecks(chains, standing, call, project) {
     let raised = false;
     let current = standing;
     let moved;
-    const shadows = [];
+    let shadows = [];
     for (const chain of chains) {
         const heard = await chain.raise(project(current, chain.mayClear));
         if (heard === undefined)
@@ -62,7 +67,7 @@ export async function readToolChecks(chains, standing, call, project) {
             continue;
         }
         if (reading.kind === "shadowed")
-            shadows.push(...reading.shadows);
+            shadows = reading.shadows.reduce(withAllowRuleShadow, shadows);
         if (reading.kind === "asked") {
             moved = { ...reading, minted: reading.minted || (moved?.kind === "asked" && moved.minted), ...(moved?.kind === "asked" && moved.marked === true ? { marked: true } : {}) };
             current = reading.ask;
@@ -75,6 +80,6 @@ export async function readToolChecks(chains, standing, call, project) {
     if (!raised)
         return undefined;
     if (moved?.kind === "asked" && shadows.length > 0)
-        return { ...moved, ask: { ...moved.ask, allowRuleShadowed: [...(moved.ask.allowRuleShadowed ?? []), ...shadows] } };
+        return { ...moved, ask: { ...moved.ask, allowRuleShadowed: shadows.reduce(withAllowRuleShadow, [...(moved.ask.allowRuleShadowed ?? [])]) } };
     return moved ?? (shadows.length > 0 ? { kind: "shadowed", shadows } : STANDS);
 }

package/dist/core/tool-model-gate.d.ts

@@ -34,8 +34,8 @@
 import type { ToolSpec } from "./types.js";
 /** The shared tail extractor (BYOM ids may carry provider prefixes — "openrouter/anthropic/claude-fable-5"):
  *  boundary-aware LAST path segment, case-folded. Single source for every model-family/model-id
- *  comparison site (`isFableFamilyModelId` consumes it too — the prompt-shape axis, semantically
- *  independent but sharing the one tail-extraction posture). */
+ *  comparison site (the tool-registration gate's; prompt text never reads a model id — it selects on the model's
+ *  declared traits). */
 export declare function modelIdTail(id: string): string;
 /** One gate class's matching rule (both axes optional; a rule with BOTH axes empty gates nothing —
  *  the per-class OFF shape a deployment reaches by explicitly clearing the axes). */

package/dist/core/tool-name-aliases.d.ts

@@ -44,8 +44,8 @@ export declare const RULE_TOOL_NAME_VERDICTS: readonly ["current", "retired", "u
  *    (the server / remote agent) is empty or not a spelling the mint produces for any peer (the name is read as written —
  *    peers compare exactly — and every mounted tool carries the minted spelling, so the name reaches none of them), or the
  *    tool segment is EMPTY (a trailing separator, `mcp__srv__`: no tool is minted under an empty segment), or the peer segment
- *    carries a wildcard the list's behavior does not read (`mcp__git*`, `mcp__*__get_*`; and `mcp__*` / `mcp__*__*` in an
- *    allow list — a deny or ask list reads those two as every tool of the protocol, see {@link wholeProtocolOf}). `guidance`
+ *    carries a wildcard the list's behavior does not read (`mcp__git*`, `mcp__*`, `mcp__*__get_*` in an allow list — a deny or
+ *    ask list reads every `*` as part of a glob over the whole name, see {@link readsNameGlob}). `guidance`
  *    says so in one line; `currentName` is the whole name rewritten with the spelling the mint produces (`mcp__github.com__*` →
  *    `mcp__github_com__*`), absent when a segment is empty or wild and there is nothing to rewrite. A tool segment that is not
  *    empty is never judged: it is a literal tool name or a glob over one, and an unmatched one is the audit's advisory.
@@ -81,24 +81,24 @@ export declare function splitNamespacedName(name: string): {
     readonly tool?: string;
 } | undefined;
 /**
- * The protocol a name spells as a WHOLE — `mcp__*` and `mcp__*__*`, the two spellings that name every tool of every peer of one
- * namespace — or `undefined` for any other name. THE one reading of that spelling: the name judgment, the covering matcher, the
- * entry reader and the tool-name lists all ask it, so none keeps a second list of the spellings.
+ * Does a list of this behavior read a `*` in a tool name as a glob over the WHOLE name — anywhere in it, the lone `*` (every tool)
+ * included? A list that RESTRICTS (`deny`, `ask`) does: it reaches every tool any of whose names the glob matches (the reference's
+ * deny and ask lookups match a rule's tool name with `globMatching` on, and its settings validator says "deny and ask rules accept
+ * wildcards anywhere"). A list that GRANTS (`allow`) does not — an allow names the scope it widens, so it reads a `*` only in the
+ * tool segment after a literal `<ns>__<peer>__` ({@link grantWildcardRefusalOf}) — and neither does a caller that states no behavior.
  */
-export declare function wholeProtocolOf(name: string): ProtocolNamespace | undefined;
+export declare function readsNameGlob(behavior: RuleBehavior | undefined): boolean;
 /**
- * Does a list of this behavior read a whole-protocol spelling ({@link wholeProtocolOf})? A list that RESTRICTS (`deny`, `ask`) does:
- * the spelling reaches every tool of the protocol. A list that GRANTS (`allow`) does not — an allow names the scope it widens,
- * and the reference's allow settings refuse a wildcard in the server position — and neither does a caller that states no
- * behavior: the spelling then names no tool, the reading every list had before it was one.
+ * The sentence for a `*` in a tool name that a GRANTING list does not read — anywhere but the tool segment after a literal, non-empty
+ * `<ns>__<peer>__` — or `undefined` (no `*`, or one in that segment). The one test every allow-side reader asks (a policy's allowlist
+ * constructor, an entry list, a run's allowed list, the name judgment's allow arm), so a spelling an allow cannot read is refused
+ * or read as nothing in one sentence wherever it is written.
  */
-export declare function readsWholeProtocol(behavior: RuleBehavior | undefined): boolean;
-/** The judgment's sentence for a namespaced name whose peer segment carries a wildcard the list's `behavior` does not read, else `undefined`
- *  — only that arm of the judgment, for the stations that ask it with no roster (a rule policy's compile, an allowlist constructor). */
-export declare function wildcardPeerRefusalOf(name: string, behavior: RuleBehavior | undefined): string | undefined;
+export declare function grantWildcardRefusalOf(name: string): string | undefined;
 /** See {@link RuleToolNameVerdict}. Pure; the one answer to "is this rule's tool name a name that reaches no tool".
- *  `behavior` = the behavior of the list the name is written in: a restricting one (`deny`, `ask`) reads the whole-protocol
- *  spelling ({@link wholeProtocolOf}) as `current`; with `allow` or none the spelling names no peer and is `unmintable_segment`. */
+ *  `behavior` = the behavior of the list the name is written in: a restricting one (`deny`, `ask`) reads a `*` anywhere in the name
+ *  as a glob ({@link readsNameGlob}) — such a name outside every namespace, or with a glob in its peer segment, is a pattern and
+ *  `current`; with `allow` or none a wildcard peer names no peer and is `unmintable_segment`. */
 export declare function judgeRuleToolName(name: string, roster: ReadonlySet<string>, behavior?: RuleBehavior): RuleToolNameVerdict;
 /** The two kinds of tool-name miss — a closed set. `unknown`: the name is none the engine ever mounted (a typo, a
  *  guess). `expected-absent`: the name is one the engine RETIRED ({@link RETIRED_TOOL_NAMES}), so its absence is no

package/dist/core/tool-name-aliases.js

@@ -53,19 +53,20 @@ export function splitNamespacedName(name) {
     const [peer = "", ...rest] = name.slice(ns.prefix.length).split(NAMESPACE_SEPARATOR);
     return rest.length > 0 ? { ns, peer, tool: rest.join(NAMESPACE_SEPARATOR) } : { ns, peer };
 }
-const WHOLE_PROTOCOL_PEER = "*";
-export function wholeProtocolOf(name) {
-    const split = splitNamespacedName(name);
-    return split !== undefined && spellsWholeProtocol(split) ? split.ns : undefined;
-}
-function spellsWholeProtocol(split) {
-    return split.peer === WHOLE_PROTOCOL_PEER && (split.tool === undefined || split.tool === "*");
-}
-export function readsWholeProtocol(behavior) {
+export function readsNameGlob(behavior) {
     return behavior === "deny" || behavior === "ask";
 }
 function peerWildcardGuidance(ns) {
-    return `a ${ns.id} entry takes no wildcard in its peer segment — write ${ns.prefix}<peer> (every tool of one peer) or ${ns.prefix}<peer>${NAMESPACE_SEPARATOR}<tool> (one tool); a deny or ask entry may also write ${ns.prefix}* or ${ns.prefix}*${NAMESPACE_SEPARATOR}* for every ${ns.id} tool`;
+    return `an allow entry takes no wildcard in a ${ns.id} name's peer segment — write ${ns.prefix}<peer> (every tool of one peer), ${ns.prefix}<peer>${NAMESPACE_SEPARATOR}<tool> (one tool) or ${ns.prefix}<peer>${NAMESPACE_SEPARATOR}<glob> (the tools of one peer the glob matches); a deny or ask entry may put a \`*\` anywhere in a name`;
+}
+const GRANT_WILDCARD_GUIDANCE = "an allow entry names the tools it grants — a `*` in a tool name is read on an allow list only in the tool segment after a literal <ns>__<peer>__ (mcp__<server>__*), so this entry grants nothing; name the tools, or put the wildcard on a deny or ask entry, which reads a `*` anywhere in a name";
+export function grantWildcardRefusalOf(name) {
+    if (!name.includes("*"))
+        return undefined;
+    const split = splitNamespacedName(name);
+    if (split === undefined)
+        return GRANT_WILDCARD_GUIDANCE;
+    return split.peer !== "" && !split.peer.includes("*") && split.tool !== undefined ? undefined : peerWildcardGuidance(split.ns);
 }
 function unmintableSegmentOf(split, behavior) {
     const { ns, peer, tool } = split;
@@ -74,7 +75,7 @@ function unmintableSegmentOf(split, behavior) {
     if (tool === "")
         return { kind: "unmintable_segment", guidance: `the ${ns.id} name has an empty tool segment — no tool is minted under it; write ${ns.prefix}<peer> to cover every tool of a peer, or ${ns.prefix}<peer>${NAMESPACE_SEPARATOR}<tool> for one tool` };
     if (peer.includes("*"))
-        return spellsWholeProtocol(split) && readsWholeProtocol(behavior) ? undefined : { kind: "unmintable_segment", guidance: peerWildcardGuidance(ns) };
+        return readsNameGlob(behavior) ? undefined : { kind: "unmintable_segment", guidance: peerWildcardGuidance(ns) };
     const minted = mintNamespacePrefix(ns, peer).slice(ns.prefix.length, -NAMESPACE_SEPARATOR.length);
     if (minted === peer)
         return undefined;
@@ -84,13 +85,6 @@ function unmintableSegmentOf(split, behavior) {
         currentName: `${ns.prefix}${minted}${tool !== undefined ? `${NAMESPACE_SEPARATOR}${tool}` : ""}`,
     };
 }
-export function wildcardPeerRefusalOf(name, behavior) {
-    const split = splitNamespacedName(name);
-    if (split === undefined || !split.peer.includes("*"))
-        return undefined;
-    const verdict = unmintableSegmentOf(split, behavior);
-    return verdict?.kind === "unmintable_segment" ? verdict.guidance : undefined;
-}
 export function judgeRuleToolName(name, roster, behavior) {
     if (roster.has(name))
         return CURRENT;
@@ -101,7 +95,7 @@ export function judgeRuleToolName(name, roster, behavior) {
     }
     const split = splitNamespacedName(name);
     if (split === undefined)
-        return carriesNamespaceSeparator(name) ? UNPREFIXED : CURRENT;
+        return carriesNamespaceSeparator(name) && !(readsNameGlob(behavior) && name.includes("*")) ? UNPREFIXED : CURRENT;
     return unmintableSegmentOf(split, behavior) ?? CURRENT;
 }
 export const TOOL_MISS_KINDS = Object.freeze(["unknown", "expected-absent"]);

package/dist/core/tool-name-readings.d.ts

@@ -8,7 +8,8 @@
  *                 answers to ({@link heldBy}); a set-valued table is read as the union of its entries ({@link heldValues}).
  *  · `seat`     — a multi-key seat keyed on engine names: ONE name is chosen ({@link seatOf}) and every key of the seat is
  *                 read under it. `tier` = the name whose irreversibility tier is strictest (`never < maybe < always`, an
- *                 absent tier lowest, ties to the earlier name of the call); `member` = the first name the table holds.
+ *                 absent tier lowest; a tie goes to the call's wire name — the tool that runs judges its own call with its
+ *                 own probe — then to the earlier name of the call); `member` = the first name the table holds.
  *  · `wire`     — a GRANT or a ROUTING keyed on an engine name: the call's wire name only ({@link wireOf}).
  *  · `spelling` — a record of what the model said (stream frames, transcripts, counters): the harness event's own name;
  *                 no port — listed so the table is complete.
@@ -78,10 +79,6 @@ export declare const NAME_READINGS: {
         readonly rank: "member";
         readonly file: string;
     };
-    readonly "lanes.contentQuestionClass": {
-        readonly kind: "any";
-        readonly file: string;
-    };
     readonly "lanes.readOnlyShellAllow": {
         readonly kind: "wire";
         readonly file: string;
@@ -90,22 +87,10 @@ export declare const NAME_READINGS: {
         readonly kind: "wire";
         readonly file: string;
     };
-    readonly "lanes.contentAskRoute": {
-        readonly kind: "wire";
-        readonly file: string;
-    };
     readonly "lanes.orgContentAskExemption": {
         readonly kind: "wire";
         readonly file: string;
     };
-    readonly "lanes.allowLayerQuestionSkip": {
-        readonly kind: "wire";
-        readonly file: string;
-    };
-    readonly "lanes.sandboxQuestionSkip": {
-        readonly kind: "wire";
-        readonly file: string;
-    };
     readonly "policy.nameLists": {
         readonly kind: "any";
         readonly file: string;
@@ -142,10 +127,6 @@ export declare const NAME_READINGS: {
         readonly kind: "any";
         readonly file: string;
     };
-    readonly "policy.durableQuestion": {
-        readonly kind: "any";
-        readonly file: string;
-    };
     readonly "policy.sensitivePathGuardedByName": {
         readonly kind: "any";
         readonly file: string;
@@ -240,10 +221,6 @@ export declare const NAME_READINGS: {
         readonly kind: "spelling";
         readonly file: string;
     };
-    readonly "inherited.questionFloat": {
-        readonly kind: "wire";
-        readonly file: string;
-    };
     readonly "inherited.askFace": {
         readonly kind: "wire";
         readonly file: string;
@@ -252,14 +229,6 @@ export declare const NAME_READINGS: {
         readonly kind: "wire";
         readonly file: string;
     };
-    readonly "resume.editRecheckQuestionSkip": {
-        readonly kind: "wire";
-        readonly file: string;
-    };
-    readonly "resume.questionArgsShown": {
-        readonly kind: "wire";
-        readonly file: string;
-    };
     readonly "budget.exemptResult": {
         readonly kind: "wire";
         readonly file: string;
@@ -347,8 +316,9 @@ export interface TierSeat extends Seat<IrreversibilityTierWord> {
     }): boolean;
 }
 /**
- * A `seat` site's read. A `tier` seat takes the irreversibility tier table and picks the name whose tier is strictest;
- * a `member` seat takes a table (a map, or a set whose value reads `true`) and picks the first name it holds.
+ * A `seat` site's read. A `tier` seat takes the irreversibility tier table and picks the name whose tier is strictest, a tie
+ * going to the call's wire name, then to its earlier name; a `member` seat takes a table (a map, or a set whose value reads
+ * `true`) and picks the first name it holds.
  */
 export declare function seatOf(site: TierSeatSite, tiers: {
     get(name: string): IrreversibilityTierWord | undefined;

package/dist/core/tool-name-readings.js

@@ -21,13 +21,9 @@ export const NAME_READINGS = {
     "gate.preToolUse": wire("src/core/hooks.ts"),
     "gate.askFace": wire("src/core/runner/gate-exit.ts"),
     "fold.readStation": seat("member", "src/tools/fs/shell-read-check.ts"),
-    "lanes.contentQuestionClass": any(LANES),
     "lanes.readOnlyShellAllow": wire(LANES),
     "lanes.modeFileCommand": wire(LANES),
-    "lanes.contentAskRoute": wire(LANES),
     "lanes.orgContentAskExemption": wire(LANES),
-    "lanes.allowLayerQuestionSkip": wire(LANES),
-    "lanes.sandboxQuestionSkip": wire(LANES),
     "policy.nameLists": any(POLICY),
     "policy.shellToolsList": any(POLICY),
     "policy.projectionReplay": any(POLICY),
@@ -37,7 +33,6 @@ export const NAME_READINGS = {
     "gate.skillActivationSeat": wire(GATE),
     "policy.permissionRules": any("src/core/permission-rules.ts"),
     "policy.persistedGrammar": any("src/core/permission-rule-model.ts"),
-    "policy.durableQuestion": any("src/core/ask-question.ts"),
     "policy.sensitivePathGuardedByName": any("src/core/sensitive-path-policy.ts"),
     "floor.protectivePathTarget": seat("member", "src/core/tool-registry.ts"),
     "floor.protectiveHostTarget": seat("member", "src/core/host-target.ts"),
@@ -60,11 +55,8 @@ export const NAME_READINGS = {
     "stats.subagentToolCounter": spelling("src/agents/subagent.ts"),
     "activity.sink": spelling(HANDLERS),
     "reconcile.orphanEffect": spelling("src/core/session-reconcile.ts"),
-    "inherited.questionFloat": wire(CHAIN),
     "inherited.askFace": wire(CHAIN),
     "card.reserved": wire("src/core/tool-roster.ts"),
-    "resume.editRecheckQuestionSkip": wire("src/core/runner/resume-apply.ts"),
-    "resume.questionArgsShown": wire("src/core/runner/run-leg.ts"),
     "budget.exemptResult": wire("src/core/tool-result-budget.ts"),
     "compaction.compactableResult": wire("src/core/context-edit.ts"),
 };
@@ -112,7 +104,7 @@ export function seatOf(site, table, call) {
     const valueAt = (n) => (typeof table.get === "function" ? table.get(n) : table.has(n) ? true : undefined);
     if (r.kind === "seat" && r.rank === "tier") {
         let best;
-        for (const n of names) {
+        for (const n of [call.toolName, ...names.filter((name) => name !== call.toolName)]) {
             const v = valueAt(n);
             if (v === undefined)
                 continue;