@sema-agent/core 7.55.0 → 7.56.0

package/dist/brain/reasoning-request.js

@@ -0,0 +1,174 @@
+import { capabilityHeld } from "./model-capability.js";
+import { headerListEntries, lockHeader, takeHeaderSpellings } from "./request-params.js";
+import { MIN_THINKING_TOKENS, RESPONSES_APIS, budgetCapSkipsThinking, declaredEffortLevels, declaredOffSpelling, mintEffortWireValue, reasoningBudgetShare, reasoningRequestCarried, resolveEffort, thinkingOffSpelled, } from "./reasoning.js";
+export function lowestReasoningSeat(model) {
+    return thinkingOffSpelled(model) ? "off" : "low";
+}
+const BETA_EFFORT = "effort-2025-11-24";
+const BETA_CONTEXT_MANAGEMENT = "context-management-2025-06-27";
+const BETA_INTERLEAVED_THINKING = "interleaved-thinking-2025-05-14";
+function put(body, key, value) {
+    body[key] = value;
+    return undefined;
+}
+function withTemplateKwarg(body, enabled) {
+    const kwargs = (typeof body.chat_template_kwargs === "object" && body.chat_template_kwargs) || {};
+    return put(body, "chat_template_kwargs", { ...kwargs, enable_thinking: enabled });
+}
+function withEffort(body, effort, supportsEffort) {
+    if (!supportsEffort || effort === undefined)
+        return undefined;
+    body.reasoning_effort = effort;
+    return effort;
+}
+const COMPLETIONS_DIALECT = {
+    openai: {
+        off: (body, model) => {
+            const spelling = declaredOffSpelling(model);
+            return spelling === undefined ? undefined : withEffort(body, spelling, true);
+        },
+        on: withEffort,
+    },
+    openrouter: {
+        off: (body) => put(body, "reasoning", { enabled: false }),
+        on: (body, effort) => {
+            put(body, "reasoning", { effort });
+            return effort;
+        },
+    },
+    deepseek: {
+        off: (body) => put(body, "thinking", { type: "disabled" }),
+        on: (body, effort, supportsEffort) => {
+            put(body, "thinking", { type: "enabled" });
+            return withEffort(body, effort, supportsEffort);
+        },
+    },
+    together: {
+        off: (body) => put(body, "reasoning", { enabled: false }),
+        on: (body, effort, supportsEffort) => {
+            put(body, "reasoning", { enabled: true });
+            return withEffort(body, effort, supportsEffort);
+        },
+    },
+    qwen: { off: (body) => put(body, "enable_thinking", false), on: (body) => put(body, "enable_thinking", true) },
+    zai: { off: (body) => put(body, "enable_thinking", false), on: (body) => put(body, "enable_thinking", true) },
+    "qwen-chat-template": { off: (body) => withTemplateKwarg(body, false), on: (body) => withTemplateKwarg(body, true) },
+};
+function completionsDialectOf(format) {
+    return typeof format === "string" && Object.prototype.hasOwnProperty.call(COMPLETIONS_DIALECT, format) ? COMPLETIONS_DIALECT[format] : undefined;
+}
+const bodyOnly = (body, effort) => ({ body, headers: {}, effort, wireFacts: undefined });
+function applyCompletions(input, body) {
+    const { model, level } = input;
+    const compat = (model.compat ?? {});
+    const dialect = completionsDialectOf(compat.thinkingFormat ?? "openai");
+    if (capabilityHeld(model, "reasoning") && level === "off")
+        return bodyOnly(body, dialect?.off(body, model));
+    if (!reasoningRequestCarried(model, level))
+        return bodyOnly(body);
+    const supportsEffort = compat.supportsReasoningEffort ?? true;
+    const wire = mintEffortWireValue(level, model, compat.reasoningEffortLevels).wireValue;
+    return bodyOnly(body, dialect?.on(body, wire, supportsEffort));
+}
+function applyResponses(input, body) {
+    const { model, level } = input;
+    const effort = responsesEffort(model, level);
+    if (effort !== undefined)
+        body.reasoning = { effort };
+    return bodyOnly(body, effort);
+}
+function responsesEffort(model, level) {
+    if (capabilityHeld(model, "reasoning") && level === "off")
+        return declaredOffSpelling(model);
+    const compat = (model.compat ?? {});
+    if (compat.supportsReasoningEffort === false)
+        return undefined;
+    if (!reasoningRequestCarried(model, level))
+        return undefined;
+    return mintEffortWireValue(level, model, compat.reasoningEffortLevels).wireValue;
+}
+function thinkingBudget(maxTokens, share, fixed, hardCap) {
+    const max = hardCap ? maxTokens : Math.max(maxTokens, MIN_THINKING_TOKENS * 2);
+    const want = fixed ?? Math.floor(max * share);
+    const budget = Math.min(Math.max(MIN_THINKING_TOKENS, want), max - 1);
+    return { max, budget };
+}
+function applyMessages(input, body) {
+    const { model, level } = input;
+    const compat = (model.compat ?? {});
+    let wireFacts;
+    let thinkingOn = false;
+    if (reasoningRequestCarried(model, level)) {
+        if (compat.thinkingMode === "adaptive") {
+            body.thinking = { type: "adaptive" };
+            thinkingOn = true;
+        }
+        else {
+            if (body.max_tokens === undefined || body.max_tokens === null) {
+                throw new TypeError("applyReasoningToRequest: the Messages budget form needs a body.max_tokens (it sizes the thinking budget)");
+            }
+            const maxTokens = body.max_tokens;
+            const hardCap = input.budget?.capIsHard ?? true;
+            wireFacts = { outputCapTokens: maxTokens, hardOutputCap: hardCap };
+            if (budgetCapSkipsThinking(wireFacts.outputCapTokens, wireFacts.hardOutputCap)) {
+                delete body.thinking;
+            }
+            else {
+                const share = input.budget?.share ?? reasoningBudgetShare(level);
+                const { max, budget } = thinkingBudget(maxTokens, share, input.budget?.tokens, hardCap);
+                if (!Number.isFinite(Number(max)) || !Number.isFinite(budget)) {
+                    const shown = (value) => (typeof value === "string" ? JSON.stringify(value) : String(value));
+                    throw new TypeError(`applyReasoningToRequest: the Messages budget form cannot size a thinking budget from body.max_tokens ${shown(body.max_tokens)}, ` +
+                        `budget.share ${shown(share)}, budget.tokens ${shown(input.budget?.tokens)} (cap ${shown(max)}, budget ${shown(budget)}); each must read as a finite number`);
+                }
+                body.max_tokens = max;
+                body.thinking = { type: "enabled", budget_tokens: budget };
+                thinkingOn = true;
+            }
+        }
+        if (thinkingOn)
+            delete body.temperature;
+    }
+    else if (capabilityHeld(model, "reasoning") && level === "off" && compat.thinkingMode !== "adaptive") {
+        body.thinking = { type: "disabled" };
+    }
+    const betas = [];
+    let effort;
+    const declaredEffort = declaredEffortLevels(compat.effortLevels);
+    if (declaredEffort !== undefined && reasoningRequestCarried(model, level)) {
+        const { effective } = resolveEffort(level, declaredEffort);
+        effort = effective === "minimal" ? "low" : effective;
+        body.output_config = { effort };
+        betas.push(BETA_EFFORT);
+    }
+    if (compat.contextManagement && thinkingOn) {
+        body.context_management = { edits: [{ type: "clear_thinking_20251015", keep: "all" }] };
+        betas.push(BETA_CONTEXT_MANAGEMENT);
+    }
+    if (compat.interleavedThinking)
+        betas.push(BETA_INTERLEAVED_THINKING);
+    return { body, headers: betas.length > 0 ? { "anthropic-beta": betas.join(",") } : {}, effort, wireFacts };
+}
+export function applyReasoningToRequest(input) {
+    const body = { ...input.body };
+    if (input.api === "anthropic-messages")
+        return applyMessages(input, body);
+    if (RESPONSES_APIS.has(input.api))
+        return applyResponses(input, body);
+    return applyCompletions(input, body);
+}
+export function mergeReasoningHeaders(headers, patch) {
+    for (const [name, value] of Object.entries(patch)) {
+        const lower = name.toLowerCase();
+        if (lower !== "anthropic-beta") {
+            lockHeader(headers, lower, value);
+            continue;
+        }
+        const present = takeHeaderSpellings(headers, lower).flatMap((held) => headerListEntries(held));
+        for (const beta of headerListEntries(value)) {
+            if (!present.includes(beta))
+                present.push(beta);
+        }
+        headers[lower] = present.join(",");
+    }
+}

package/dist/brain/reasoning.d.ts

@@ -18,8 +18,8 @@ export type ReasoningIntensity = ThinkingLevel;
 export declare function isThinkingLevel(v: unknown): v is ThinkingLevel;
 /**
  * THE thinking-request ENTRY predicate — does this request enter an applier's emission path at all?
- * One conjunction, three arms: the model declares reasoning (TRUTHINESS — the adapters' own
- * judgment, see the r5 note in {@link resolveReasoning}), the requested value is a real
+ * One conjunction, three arms: the model holds reasoning (`capabilityHeld`, the one capability reading —
+ * a declaration of the wrong shape throws there instead of reading by truthiness), the requested value is a real
  * {@link ThinkingLevel} (an out-of-contract value — a typo'd tier, a caller's own enum — reads as
  * ABSENCE, never as a declared tier), and it is not the explicit `"off"`.
  *
@@ -29,8 +29,8 @@ export declare function isThinkingLevel(v: unknown): v is ThinkingLevel;
  * their own reporting shape (the `graded:false` intent-echo family, each pinned with its rationale
  * where it lives); this predicate only closes the gate the three appliers used to re-spell.
  *
- * Single-sourced here because every wire applier (openai.ts `applyThinking`, anthropic.ts's thinking
- * + effort arms, open-responses.ts `resolveWireEffort`) would otherwise re-spell the same three
+ * Single-sourced here because every wire applier (the completions, Messages and Responses arms of
+ * `applyReasoningToRequest`, in reasoning-request.ts) would otherwise re-spell the same three
  * conjuncts while the REPORTING resolver ({@link resolveReasoning}) mirrored one of them, so a
  * garbage tier puts ZERO parameters on the wire while the resolution claims a clamped-to-minimal
  * gradient. A predicate the appliers and the reporter both call cannot drift.
@@ -58,7 +58,7 @@ export type ReasoningFormat = "openai" | "openrouter" | "deepseek" | "together"
  *  `reasoning_effort` path (thinking FORM is `thinkingMode`; effort carries the intensity). */
  | "effort"
 /** OpenAI Responses API (`openai-responses` / `azure-openai-responses`, design/163): the tier rides
- *  the NESTED `reasoning: { effort }` request field (open-responses.ts `resolveWireEffort`), clamped
+ *  the NESTED `reasoning: { effort }` request field (the Responses arm of `applyReasoningToRequest`), clamped
  *  by the same {@link resolveEffort} against `compat.reasoningEffortLevels` — NOT the completions
  *  top-level `reasoning_effort` the `"openai"` tag names. #325 review r3: before this member the
  *  resolver fell through to the completions default and labeled Responses resolutions `"openai"`. */
@@ -127,7 +127,7 @@ export declare function declaredOffSpelling(model: OffCapabilityModel): string |
  * `reasoning:{enabled:false}` all spell it; the effort-only wires (stock openai completions, the Responses
  * lane) spell it only through a deployment-declared off spelling ({@link declaredOffSpelling}).
  *
- * A model whose `reasoning` is FALSY spells NOTHING: every applier returns before writing any key for it, so
+ * A model that does not hold reasoning (declared false, or undeclared — `capabilityHeld`) spells NOTHING: every applier returns before writing any key for it, so
  * the request is the gateway's own default — and a default-on gateway thinks regardless (three of four live
  * endpoints, 2026-09-15). This arm used to answer `true` ("a non-reasoning model never thinks"): the engine
  * may size a request by what it SENT, never by what it hopes a gateway does when told nothing. What this
@@ -172,8 +172,8 @@ export interface ReasoningWireFacts {
 export declare function declaredEffortLevels(v: unknown): readonly ThinkingLevel[] | undefined;
 /**
  * The effort-lane WIRE-VALUE mint — clamp ({@link resolveEffort}) + the `Model.thinkingLevelMap`
- * translation in ONE place, consumed by both completions-family appliers (openai.ts `applyThinking`,
- * open-responses.ts `resolveWireEffort`) AND the reporting dispatch ({@link resolveReasoning}'s
+ * translation in ONE place, consumed by both effort-lane arms of `applyReasoningToRequest` (completions,
+ * Responses) AND the reporting dispatch ({@link resolveReasoning}'s
  * arms), so the value that reaches the wire and the resolution a trace/result face claims are two
  * reads of one computation, never parallel re-derivations. Map semantics (the field's contract): a
  * MISSING key ⇒ provider default (the clamped tier name as-is); a STRING ⇒ that provider-specific
@@ -200,7 +200,7 @@ export interface ResolvedReasoning extends ReasoningResolution {
     endpoint: string;
     /**
      * Present (true) only when the request never CARRIES at all: {@link reasoningRequestCarried} false
-     * on a non-"off" request — the model declares NO reasoning capability (`Model.reasoning` falsy),
+     * on a non-"off" request — the model does not hold reasoning (`capabilityHeld`: declared false or undeclared),
      * OR the requested value is not a valid {@link ThinkingLevel} (an out-of-contract tier every wire
      * applier reads as ABSENCE — the same three-conjunct gate all of them share) — or, with
      * {@link ReasoningWireFacts} supplied, the anthropic budget path's cap-wins skip
@@ -212,7 +212,7 @@ export interface ResolvedReasoning extends ReasoningResolution {
      * reason at its own tier — the brains deliberately send no disable key for a model declared
      * non-reasoning, so the engine cannot claim a measured off there; `format` tells a consumer which
      * family applies (on every other format, absence is the closest the wire has to off — see
-     * applyThinking's own contract). `format`/`endpoint` report the family that WOULD have carried the
+     * the completions arm's own contract). `format`/`endpoint` report the family that WOULD have carried the
      * tier (the why-shape a consumer diagnoses with, not a claim about the request). Absent on every
      * reasoning-capable resolution, so existing consumers see byte-identical objects. Loud-bad-values
      * rule: the one arm where the request evaporates must not be the one arm with no report.
@@ -240,7 +240,7 @@ export interface ResolvedReasoning extends ReasoningResolution {
  *   drops the value — trace/result-face drift.
  *
  * - A request that never CARRIES ({@link reasoningRequestCarried} false on a non-"off" value: the model's
- *   `reasoning` capability flag is FALSY, or the requested value is not a valid tier — no brain emits any
+ *   `reasoning` capability is not held, or the requested value is not a valid tier — no brain emits any
  *   thinking parameter for either, whatever the format) → `effective:"off"`, `graded:false`, `clamped:true`,
  *   `dropped:true` — the loud-drop arm. Describing the capability dispatch instead would report a
  *   resolution the request never carried, leaving the one arm where the request evaporates as the one

package/dist/brain/reasoning.js

@@ -1,3 +1,4 @@
+import { capabilityHeld } from "./model-capability.js";
 const RANK = {
     off: 0,
     minimal: 1,
@@ -11,7 +12,7 @@ export function isThinkingLevel(v) {
     return typeof v === "string" && Object.prototype.hasOwnProperty.call(RANK, v);
 }
 export function reasoningRequestCarried(model, reasoning) {
-    return !!model.reasoning && isThinkingLevel(reasoning) && reasoning !== "off";
+    return capabilityHeld(model, "reasoning") && isThinkingLevel(reasoning) && reasoning !== "off";
 }
 export function rankOf(level) {
     return RANK[level];
@@ -31,7 +32,7 @@ export function declaredOffSpelling(model) {
     return typeof mapped === "string" && mapped !== "" ? mapped : undefined;
 }
 export function thinkingOffSpelled(model) {
-    if (!model.reasoning)
+    if (!capabilityHeld(model, "reasoning"))
         return false;
     const compat = (model.compat ?? {});
     if (model.api === "anthropic-messages")
@@ -101,7 +102,7 @@ function dispatchReasoning(requested, model, facts) {
     return { ...mint.resolution, format, endpoint };
 }
 export function reasoningEffortLevelsOf(model) {
-    if (!model.reasoning)
+    if (!capabilityHeld(model, "reasoning"))
         return undefined;
     const compat = (model.compat ?? {});
     if (model.api === "anthropic-messages") {

package/dist/brain/request-params.d.ts

@@ -122,12 +122,15 @@ export declare function applyExtraBody(body: Record<string, unknown>, model: Pic
 export declare function lockHeader(headers: Record<string, string>, lowerName: string, value: string): void;
 /**
  * #343 (review r4) — case-fold READ-AND-CLAIM for an AUGMENTABLE structural header (`anthropic-beta`):
- * returns the current value under whatever spelling the user bag carried and deletes that spelling,
- * so the caller's canonical lowercase write REPLACES it instead of duplicating beside it (the
+ * returns the value under EVERY spelling the bag carried, in key order, and deletes them all, so the
+ * caller's canonical lowercase write REPLACES them instead of duplicating beside them (the
  * read-modify-write used to key the read by the exact lowercase name and miss `Anthropic-Beta`,
- * losing the user's betas from the merge AND double-sending the header).
+ * losing the user's betas from the merge AND double-sending the header). A spelling is claimed whatever
+ * it holds — its value is returned as it is, so a spelling holding `undefined` does not end the claim.
  */
-export declare function takeHeaderCasefold(headers: Record<string, string>, lowerName: string): string | undefined;
+export declare function takeHeaderSpellings(headers: Record<string, string>, lowerName: string): unknown[];
+/** The entries of a comma-list header value (`" a , b,,c"` → `a`, `b`, `c`); a value that is not a string carries none. */
+export declare function headerListEntries(value: unknown): string[];
 /** A caller's header bag read ONCE, into a plain copy of its own enumerable entries — what a request build hands both
  *  the route law (which credential rides, and its identity) and the merge (what goes on the wire), so a bag whose getters
  *  or keys answer differently on a second read cannot be judged as one bag and sent as another. */

package/dist/brain/request-params.js

@@ -92,15 +92,18 @@ export function lockHeader(headers, lowerName, value) {
     }
     headers[lowerName] = value;
 }
-export function takeHeaderCasefold(headers, lowerName) {
+export function takeHeaderSpellings(headers, lowerName) {
+    const values = [];
     for (const k of Object.keys(headers)) {
         if (k.toLowerCase() === lowerName) {
-            const v = headers[k];
+            values.push(headers[k]);
             delete headers[k];
-            return v;
         }
     }
-    return undefined;
+    return values;
+}
+export function headerListEntries(value) {
+    return typeof value === "string" ? value.split(",").map((entry) => entry.trim()).filter((entry) => entry !== "") : [];
 }
 export function headerBagOnce(bag) {
     return bag === undefined ? undefined : { ...bag };

package/dist/brain/status-sink.d.ts

@@ -1,5 +1,6 @@
 import type { BrainRetryErrClass, BrainStatus } from "../core/types.js";
 import type { ReasoningWireFacts } from "./reasoning.js";
+import type { CapabilityDeclaration, ModelCapability } from "./model-capability.js";
 /** Run `fn` with a per-task brain-status sink in scope. ALS propagates it through the async brain calls
  *  inside `fn` (the harness's prompt → brain.stream → connect/retry loop), so {@link emitBrainStatus}
  *  reaches THIS task's sink and nothing else. */
@@ -168,3 +169,22 @@ export declare function runWithCredentialOriginRefusals<T>(observe: (r: Credenti
  *  `routeRefusalError`; a judgment that only advises reports nothing). The
  *  observer is the Runner's own seat, whose one delivery is the guarded `deliverEngineNotice` — nothing is swallowed here. */
 export declare function reportCredentialOriginRefusal(report: CredentialOriginRefusalReport): void;
+/** A request that withheld a capability from the model it was sent to: the model, the capability, the model's declaration
+ *  that withheld it (`capabilityOf`), and how many blocks it replaced. */
+export interface CapabilityWithheldReport {
+    modelId: string;
+    capability: ModelCapability;
+    cause: Exclude<CapabilityDeclaration, "declared_on">;
+    count: number;
+}
+/**
+ * Run `fn` with a per-run withheld-capability sink in scope — the SIXTH brain→runner ALS channel, with the fourth's shape
+ * and for its reasons: the WHOLE leg (the end-of-task compaction runs after the leg's prompt, and a child leg running
+ * inside its parent's tool call must report to its own leg, not to the scope it inherited), not shielded around the leg's
+ * internal calls, not revoked on settlement, no-op outside the scope.
+ */
+export declare function runWithCapabilityWithheld<T>(observe: (r: CapabilityWithheldReport) => void, fn: () => Promise<T>): Promise<T>;
+/** Report a withheld capability to the active per-run sink, if any (called by the message assemblers' one emit,
+ *  `reportImagesWithheld`). The observer is the Runner's own seat, whose one delivery is the guarded `deliverEngineNotice`
+ *  — nothing is swallowed here: a seat that fails otherwise fails the request build, never the person's notice in silence. */
+export declare function reportCapabilityWithheld(report: CapabilityWithheldReport): void;

package/dist/brain/status-sink.js

@@ -75,3 +75,10 @@ export function runWithCredentialOriginRefusals(observe, fn) {
 export function reportCredentialOriginRefusal(report) {
     credentialOriginRefusalSinkStore.getStore()?.observe(report);
 }
+const capabilityWithheldSinkStore = new AsyncLocalStorage();
+export function runWithCapabilityWithheld(observe, fn) {
+    return capabilityWithheldSinkStore.run({ observe }, fn);
+}
+export function reportCapabilityWithheld(report) {
+    capabilityWithheldSinkStore.getStore()?.observe(report);
+}

package/dist/core/a2a.d.ts

@@ -1,4 +1,5 @@
 import type { AgentTool } from "../internal/harness-types.js";
+import { type HostFloor } from "./host-floor.js";
 import type { A2aServerSpec, ToolEffect } from "./types.js";
 /** The hard per-skill description bound (ruled 2026-08-03: ~2KiB). */
 export declare const A2A_SKILL_DESCRIPTION_MAX_CHARS = 2048;
@@ -96,4 +97,4 @@ export declare class A2aRpcError extends Error {
  * `allSettled` keeps it fail-open: one unreachable peer is a skipped peer with a warning, never a task
  * that cannot start.
  */
-export declare function materializeA2aTools(specs: readonly A2aServerSpec[], principal?: string, signal?: AbortSignal): Promise<MaterializedA2a>;
+export declare function materializeA2aTools(specs: readonly A2aServerSpec[], principal?: string, signal?: AbortSignal, hostFloor?: HostFloor): Promise<MaterializedA2a>;

package/dist/core/a2a.js

@@ -1,7 +1,8 @@
 import { randomUUID } from "node:crypto";
 import { Type } from "typebox";
 import { A2A_TASK_STATES } from "./a2a-task-state.js";
-import { assertEndpointBound, redirectPolicy, resolveProtocolHttpHeaders, underDeclaredHeaders } from "./protocol-http-auth.js";
+import { assertEndpointBound, carriesDeclaredHeaders, resolveProtocolHttpHeaders, underDeclaredHeaders } from "./protocol-http-auth.js";
+import { fetchFollowing, hopRefusal, HOST_FLOOR_REFUSED_CODE } from "./host-floor.js";
 import { describeHttpTransportFailure } from "./mcp-failure.js";
 import { findNamespacePrefixCollision, mintNamespacePrefix, mintNamespacedToolName } from "./protocol-naming.js";
 import { A2A_NAMESPACE } from "./protocol-table.js";
@@ -77,6 +78,7 @@ function safeId(v) {
         return undefined;
     return inlineUntrusted(s, A2A_ID_MAX_CHARS);
 }
+const A2A_MAX_REDIRECTS = 20;
 function withRequestDeadline(outer, timeoutMs) {
     const controller = new AbortController();
     let timedOut = false;
@@ -144,21 +146,25 @@ async function readBoundedText(res, what) {
 async function requestJson(t, what, init) {
     const doFetch = resolveFetch();
     const deadline = withRequestDeadline(init.signal, init.timeoutMs);
+    const peerLabel = inlineUntrusted(t.peer, A2A_ID_MAX_CHARS);
     try {
-        const res = await doFetch(init.url, {
+        const followed = await fetchFollowing(doFetch, new URL(init.url), {
             method: init.method,
-            signal: deadline.signal,
-            redirect: redirectPolicy(t.headers),
             headers: underDeclaredHeaders({ accept: "application/json", "a2a-version": A2A_PROTOCOL_VERSION, ...(init.body !== undefined ? { "content-type": "application/json" } : {}) }, t.headers),
             ...(init.body !== undefined ? { body: init.body } : {}),
-        });
-        const text = await readBoundedText(res, `${what} from A2A peer "${inlineUntrusted(t.peer, A2A_ID_MAX_CHARS)}"`);
+            signal: deadline.signal,
+        }, { refusal: (url) => hopRefusal(url, t.floor, false), follows: () => !carriesDeclaredHeaders(t.headers), maxRedirects: A2A_MAX_REDIRECTS });
+        if (followed.kind === "refused")
+            throw Object.assign(new Error(`a2a: ${what} on peer "${peerLabel}" is not sent — ${followed.reason}`), { code: HOST_FLOOR_REFUSED_CODE });
+        if (followed.kind === "too_many")
+            throw new Error(`a2a: ${what} on peer "${peerLabel}" was redirected more than ${A2A_MAX_REDIRECTS} times`);
+        const res = followed.res;
+        const text = await readBoundedText(res, `${what} from A2A peer "${peerLabel}"`);
         return { status: res.status, text };
     }
     catch (err) {
         if (init.signal?.aborted === true)
             throw err;
-        const peerLabel = inlineUntrusted(t.peer, A2A_ID_MAX_CHARS);
         if (deadline.timedOut()) {
             throw new Error(`a2a: ${what} on peer "${peerLabel}" got no answer within ${init.timeoutMs}ms. The client stopped waiting — the peer may still be acting on the request, so treat the outcome as UNKNOWN and verify before retrying.`, { cause: err });
         }
@@ -553,16 +559,16 @@ function declaredPeerOf(declared, index) {
     const judged = judgeEntryToolAxes(snapshot, "a2a");
     return judged.ok ? { spec: judged.entry } : { spec: snapshot, refusal: judged.error };
 }
-async function materializePeer(peer, principal, lifecycle, signal) {
+async function materializePeer(peer, principal, lifecycle, signal, floor) {
     if ("refusal" in peer)
         throw peer.refusal;
     const { spec } = peer;
     const declaredAxes = spec.toolAxes;
     const headers = resolveProtocolHttpHeaders(A2A_NAMESPACE.id, spec, principal);
-    const discovery = { peer: spec.name, endpoint: spec.url, headers };
+    const discovery = { peer: spec.name, endpoint: spec.url, headers, floor };
     const card = readCard(spec.name, await discoverCardBody(spec, discovery, signal), spec.url);
     assertEndpointBound(A2A_NAMESPACE.id, spec.name, card.endpoint, spec.cardUrl === undefined ? [spec.url] : [spec.url, spec.cardUrl], headers);
-    const transport = { peer: spec.name, endpoint: card.endpoint, headers };
+    const transport = { peer: spec.name, endpoint: card.endpoint, headers, floor };
     const tools = [];
     const skillAxes = [];
     for (const skill of card.skills) {
@@ -592,7 +598,7 @@ function asPeerWarning(spec, err) {
     warning.code = "a2a.peer_unavailable";
     return warning;
 }
-export async function materializeA2aTools(specs, principal, signal) {
+export async function materializeA2aTools(specs, principal, signal, hostFloor) {
     const peers = specs.map((spec, index) => declaredPeerOf(spec, index));
     if (peers.length > 0) {
         const collision = findNamespacePrefixCollision(A2A_NAMESPACE, peers.map((p) => p.spec.name));
@@ -610,7 +616,7 @@ export async function materializeA2aTools(specs, principal, signal) {
     const toolAxes = [];
     const warnings = [];
     const statuses = [];
-    const settled = await Promise.allSettled(peers.map((peer) => materializePeer(peer, principal, lifecycle, signal)));
+    const settled = await Promise.allSettled(peers.map((peer) => materializePeer(peer, principal, lifecycle, signal, hostFloor)));
     for (let i = 0; i < peers.length; i++) {
         const spec = peers[i].spec;
         const outcome = settled[i];
@@ -645,7 +651,7 @@ export async function materializeA2aTools(specs, principal, signal) {
                 }
                 const previous = statuses.find((s) => s.name === spec.name)?.toolNames ?? [];
                 try {
-                    const fresh = await materializePeer(target, principal, lifecycle, signal);
+                    const fresh = await materializePeer(target, principal, lifecycle, signal, hostFloor);
                     const names = fresh.tools.map((t) => t.name);
                     results.push({
                         peer: spec.name,

package/dist/core/agent-definition.d.ts

@@ -157,4 +157,14 @@ export interface SkillSpec {
      * byte-identical result; a placeholder with no directory stays verbatim.
      */
     baseDir?: string;
+    /**
+     * The hooks this skill carries — registrations on the mods bus (the `TaskSpec.mods` form: user tier, a name unique in the
+     * run), whose handlers take part only while the skill is ACTIVE on the leg that loads it: from its activation (the `Skill`
+     * tool's success, or prepare for a skill the person invoked by name; a resumed run reopens the skills its park recorded
+     * active) to the end of that run. A host compiles a frontmatter `hooks:` table into one such registration; the engine
+     * reads no hook grammar. Each hangs `classic.*` events only (any other event refuses the prepare, `config.mods_invalid`).
+     * They are admitted with the leg's other registrations at its prepare (so a skill never activated still counts as a hook
+     * the leg may run) and stay the leg's own: a delegated child neither dispatches them nor is screened by them.
+     */
+    mods?: readonly import("./mods/classic-events.js").EngineModRegistration[];
 }

package/dist/core/allow-entry.d.ts

@@ -1,3 +1,4 @@
+import type { EditRewritten } from "./rewrite-rejudge.js";
 import { type RuleToolNameVerdict } from "./tool-name-aliases.js";
 import type { ToolCallRequest } from "./tool-policy.js";
 import { type AllowRuleMember, type AllowRuleShadow } from "./allow-rule-shadow.js";
@@ -46,14 +47,15 @@ export type AllowEntryInert = {
     readonly entry: string;
     readonly reason: AllowEntryInertReason;
 } & AllowEntryInertDetail;
-/** One entry the grammar reads (kind closed): a whole non-shell tool; a protocol namespace; the whole shell tool; and one
- *  kind per rule grammar (`ruleToolGrammarOf`) — a shell command rule, a path rule, a name rule, a host rule — each the row
- *  the persisted grammar parses, its `behavior` the list's direction. */
+/** One entry the grammar reads (kind closed): a whole non-shell tool; a covering spelling — a set of tool names
+ *  ({@link isCoveringRuleName}: a protocol peer, a glob over a protocol name's tool segment, and on a deny list a `*` anywhere in
+ *  the name, `*` alone every tool); the whole shell tool; and one kind per rule grammar (`ruleToolGrammarOf`) — a shell command
+ *  rule, a path rule, a name rule, a host rule — each the row the persisted grammar parses, its `behavior` the list's direction. */
 export type CompiledAllowEntry = {
     readonly kind: "tool";
     readonly name: string;
 } | {
-    readonly kind: "namespace";
+    readonly kind: "covering";
     readonly pattern: string;
 } | {
     readonly kind: "shell";
@@ -108,15 +110,13 @@ export type RuleEntryReading = {
  * grammar alone is read — what a resume's pre-claim screen can read before the leg has a roster.
  */
 export declare function readRuleEntry(raw: unknown, behavior: "allow" | "deny", roster?: ReadonlySet<string>): RuleEntryReading;
-/** The tool name a compiled entry speaks for — its tool, its namespace spelling, or its rule's tool (what a name audit reads). */
+/** The tool name a compiled entry speaks for — its tool, its covering spelling, or its rule's tool (what a name audit reads). */
 export declare function compiledEntryName(compiled: CompiledAllowEntry): string;
 /**
- * Compile one list WHOLE through {@link readRuleEntry}: the entries it reads and the ones it reads as nothing (each with its
- * reason and, for a name the roster refuses, the judgment's word and the spelling to write). An allow list holding `*` voids
- * the list (every other entry on it reads as nothing too: the list grants nothing — the safe direction) — `*` as the lenient
- * rule parser names it ({@link namesWholeRoster}), so an entry the stricter entry grammar refuses (`* (*)`) still voids. A
- * `*` on a deny list reads as nothing by itself and the rest of that list still refuses: a deny list never loses an entry to
- * a wildcard beside it. `roster` as in {@link readRuleEntry}.
+ * Compile one list through {@link readRuleEntry}, entry by entry: the entries it reads and the ones it reads as nothing (each
+ * with its reason and, for a name the roster refuses, the judgment's word and the spelling to write). No entry changes how
+ * another is read: a `*` on an allow list grants nothing by itself (`wildcard_all`) and the entries beside it keep their
+ * reading; on a deny list it refuses every tool. `roster` as in {@link readRuleEntry}.
  */
 export declare function compileAllowList(entries: readonly string[], behavior: "allow" | "deny", roster?: ReadonlySet<string>): {
     rows: Array<{
@@ -275,6 +275,10 @@ export declare function screenAllowedToolsValue(value: unknown, seat: AllowedToo
 /** The disclosure record for one member, minted from the entries it matched: each sanitized (deployment or model-authored
  *  text on a human trust boundary) and capped, the rest counted. */
 export declare function allowRuleShadowOf(member: AllowRuleMember, entries: readonly string[]): AllowRuleShadow;
+/** A disclosure list with one more member's record folded in: ONE record per member — a member already disclosed gains the
+ *  other record's entries after its own (every speaking, in reading order: two shown names that read alike are two speakers),
+ *  the cap kept and the rest counted; any other member is appended. Records are minted values already ({@link allowRuleShadowOf}). */
+export declare function withAllowRuleShadow(list: readonly AllowRuleShadow[], shadow: AllowRuleShadow): AllowRuleShadow[];
 /** Read a disclosure value off a decision WITHOUT trusting it (a policy's own value, an ancestor's): every record a known
  *  member with a list of strings, or nothing — a display member must never throw where a card is minted. */
 export declare function readAllowRuleShadows(value: unknown): readonly AllowRuleShadow[] | undefined;
@@ -325,8 +329,9 @@ export declare function allowRuleShadowSentence(shadows: readonly AllowRuleShado
     authoredBy?: "deployment";
     probeReason?: string;
 }): string;
-/** The card's two disclosure members off a surviving ask, minted at every station that builds an approval request: the
- *  sanitized records, and the message with the sentence rendered onto it. */
+/** The card's disclosure members off a surviving ask, minted at every station that builds an approval request: the
+ *  sanitized records, the message with the sentence rendered onto it, and the outlet of a person's rewritten edit (the
+ *  approved-edit pass's own member, whose form is the bytes the card presents). */
 export declare function cardDisclosureOf(decision: {
     message?: string;
     allowRuleShadowed?: unknown;
@@ -334,9 +339,11 @@ export declare function cardDisclosureOf(decision: {
     mandate?: PersistedRuleMandate;
     authoredBy?: "deployment";
     probeReason?: string;
+    editRewritten?: EditRewritten;
 }, fallbackMessage: string): {
     message: string;
     allowRuleShadowed?: readonly AllowRuleShadow[];
+    editRewritten?: EditRewritten;
 };
 /** The notice for list entries that grant (or refuse) nothing — one code for every list. */
 export declare const ALLOWED_TOOL_NOT_GRANTED_CODE = "permission.allowed_tool_not_granted";