@sema-agent/core 7.55.0 → 7.57.0

package/dist/core/protocol-http-auth.js

@@ -1,4 +1,6 @@
-import { credentialHeaderValues, holdOwnCredentialValues } from "./secret-env.js";
+import { authSchemeCredentials, credentialHeaderValues, holdOwnCredentialValues } from "./secret-env.js";
+import { readMember } from "./thrown-value.js";
+import { egressText, redactionMarkerSpans } from "./untrusted-egress.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 export function headerOwnershipCollision(t) {
     const owners = new Map();
@@ -30,12 +32,174 @@ export function underDeclaredHeaders(defaults, declared) {
     const owned = new Set(Object.keys(declared ?? {}).map((k) => k.toLowerCase()));
     return { ...Object.fromEntries(Object.entries(defaults).filter(([k]) => !owned.has(k.toLowerCase()))), ...declared };
 }
+const httpTrimmed = (value) => value.replace(/^[\t\n\r ]+|[\t\n\r ]+$/g, "");
+export function declaredHeaderValues(transport, principal) {
+    const out = new Set();
+    try {
+        const headers = readMember(transport, "headers");
+        if (typeof headers === "object" && headers !== null) {
+            for (const value of Object.values(headers))
+                if (typeof value === "string")
+                    out.add(value);
+        }
+    }
+    catch {
+    }
+    const principalHeader = readMember(transport, "principalHeader");
+    if (typeof principalHeader === "string" && principalHeader !== "" && principal !== undefined)
+        out.add(principal);
+    out.delete("");
+    return [...out];
+}
+function percentEncoded(value) {
+    try {
+        return encodeURIComponent(value);
+    }
+    catch {
+        return value;
+    }
+}
+const formEncoded = (value) => new URLSearchParams([["v", value]]).toString().slice(2);
+function requestEchoSpellings(value) {
+    const sent = httpTrimmed(value);
+    const rest = authSchemeCredentials(sent);
+    const spellings = new Set();
+    for (const base of rest === undefined ? [value, sent] : [value, sent, rest]) {
+        const json = JSON.stringify(base).slice(1, -1);
+        const component = percentEncoded(base);
+        const form = formEncoded(base);
+        for (const spelling of [base, json, json.replace(/\//g, "\\/"), base.replace(/ /g, "+"), component, component.replace(/%20/g, "+"), form.replace(/\+/g, "%20"), form])
+            spellings.add(spelling);
+    }
+    return [...spellings];
+}
+const ECHO_MARKER = "[redacted]";
+const COOKIE_START = String.raw `(?<![\w-])(?<cookie>(?:[Ss][Ee][Tt]-)?[Cc][Oo][Oo][Kk][Ii][Ee])(?<quote>["']?)[ \t]*:`;
+function stringEnd(text, at) {
+    for (let i = at + 1; i < text.length; i++) {
+        if (text[i] === "\\")
+            i++;
+        else if (text[i] === text[at])
+            return i + 1;
+    }
+    return text.length;
+}
+function structuredEnd(text, at) {
+    const c = text[at];
+    if (c === '"' || c === "'")
+        return stringEnd(text, at);
+    if (c !== "[" && c !== "{") {
+        let i = at;
+        while (i < text.length && !",}]\r\n".includes(text[i]))
+            i++;
+        return i;
+    }
+    let depth = 0;
+    for (let i = at; i < text.length; i++) {
+        const d = text[i];
+        if (d === '"' || d === "'")
+            i = stringEnd(text, i) - 1;
+        else if (d === "[" || d === "{")
+            depth++;
+        else if ((d === "]" || d === "}") && --depth === 0)
+            return i + 1;
+    }
+    return text.length;
+}
+export function scrubRequestEcho(text, declared) {
+    const removed = requestEchoRanges(text, declared);
+    if (removed.length === 0)
+        return text;
+    removed.sort((a, b) => a[0] - b[0] || b[1] - a[1]);
+    let out = "";
+    let kept = 0;
+    for (const [start, end] of removed) {
+        if (start < kept) {
+            kept = Math.max(kept, end);
+            continue;
+        }
+        out += text.slice(kept, start) + ECHO_MARKER;
+        kept = end;
+    }
+    return out + text.slice(kept);
+}
+function requestEchoRanges(text, declared) {
+    const forms = new Set();
+    for (const value of declared)
+        for (const spelling of requestEchoSpellings(value))
+            forms.add(spelling);
+    forms.delete("");
+    const members = cookieMembers(text);
+    const removed = members.map(([, from, end]) => [from, end]);
+    const markers = redactionMarkerSpans(text);
+    for (const hit of valueHits(text, [...forms])) {
+        if (members.some(([name, from]) => hit[0] >= name && hit[1] <= from))
+            continue;
+        if (markers.some(([from, end]) => hit[0] >= from && hit[1] <= end))
+            continue;
+        const reach = markers.filter(([from, end]) => hit[0] < end && hit[1] > from);
+        removed.push([Math.min(hit[0], ...reach.map(([from]) => from)), Math.max(hit[1], ...reach.map(([, end]) => end))]);
+    }
+    return removed;
+}
+function vocabularyValues(text) {
+    const report = { findings: [] };
+    egressText("same-principal", text, report);
+    return report.findings.map(({ span: [from, end] }) => {
+        const found = text.slice(from, end);
+        const rendered = egressText("same-principal", found);
+        let head = 0;
+        while (head < found.length && head < rendered.length && found[head] === rendered[head])
+            head++;
+        let tail = 0;
+        while (tail < found.length - head && tail < rendered.length - head && found[found.length - 1 - tail] === rendered[rendered.length - 1 - tail])
+            tail++;
+        const value = found.slice(head, found.length - tail);
+        return value === "" ? found : value;
+    });
+}
+export function remoteWords(text, declared) {
+    if (requestEchoRanges(text, declared).length === 0)
+        return egressText("same-principal", text);
+    return egressText("same-principal", scrubRequestEcho(text, [...declared, ...vocabularyValues(text)]));
+}
+function cookieMembers(text) {
+    const members = [];
+    const pattern = new RegExp(COOKIE_START, "g");
+    for (let m = pattern.exec(text); m !== null; m = pattern.exec(text)) {
+        const structured = m.groups?.quote !== "";
+        let from = pattern.lastIndex;
+        while (from < text.length && (structured ? /\s/ : /[ \t]/).test(text[from]))
+            from++;
+        let end = from;
+        if (structured)
+            end = structuredEnd(text, from);
+        else
+            while (end < text.length && text[end] !== "\r" && text[end] !== "\n")
+                end++;
+        members.push([m.index, from, end]);
+        pattern.lastIndex = end;
+    }
+    return members;
+}
+function valueHits(text, forms) {
+    if (forms.length === 0 || text === "")
+        return [];
+    const alternatives = [...forms].sort((a, b) => b.length - a.length).map((f) => f.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"));
+    const hits = [];
+    try {
+        const pattern = new RegExp(alternatives.join("|"), "gi");
+        for (let m = pattern.exec(text); m !== null; m = pattern.exec(text))
+            hits.push([m.index, pattern.lastIndex]);
+    }
+    catch {
+        return [[0, text.length]];
+    }
+    return hits;
+}
 export function carriesDeclaredHeaders(headers) {
     return headers !== undefined && Object.keys(headers).length > 0;
 }
-export function redirectPolicy(headers) {
-    return carriesDeclaredHeaders(headers) ? "manual" : "follow";
-}
 export function assertEndpointBound(protocol, peer, endpoint, declared, headers) {
     if (!carriesDeclaredHeaders(headers))
         return;

package/dist/core/protocol-naming.d.ts

@@ -60,6 +60,26 @@ export declare function findNamespacePrefixCollision(ns: ProtocolNamespace, peer
     prefix: string;
     peers: [string, string];
 } | undefined;
+/**
+ * EVERY peer in `peers` that mints a {@link mintNamespacePrefix} an earlier peer already minted, in list order, each paired with the
+ * FIRST peer that holds the prefix — empty when every peer owns its own. {@link findNamespacePrefixCollision} is its first row: one
+ * piece of arithmetic answers both the question "is there a collision" and the question "which names, all of them".
+ */
+export declare function findNamespacePrefixCollisions(ns: ProtocolNamespace, peers: readonly string[]): Array<{
+    prefix: string;
+    peers: [string, string];
+}>;
+/**
+ * One peer's claim ledger for tool names: the function it returns takes a REMOTE tool name, mints its wire name
+ * ({@link mintNamespacedToolName}) and answers `{ minted }` when the name is free, or `{ minted, heldBy }` when an earlier call
+ * already minted it — `heldBy` is the RAW name that took it first (it keeps the name; the ledger never re-binds). A listing's
+ * intake and a judge over declared names ask the same ledger; `heldBy === tool` (the same raw name again) stays distinguishable
+ * from two different raw names that folded together.
+ */
+export declare function createToolNameClaims(ns: ProtocolNamespace, peer: string): (tool: string) => {
+    minted: string;
+    heldBy?: string;
+};
 /**
  * The full registered name for `(peer, tool)` in `ns`. Always starts with {@link mintNamespacePrefix}'s
  * answer for the same peer (the invariant ticket #9's pins hold), and never exceeds

package/dist/core/protocol-naming.js

@@ -27,15 +27,32 @@ export function mintNamespacePrefix(ns, peer) {
     return `${ns.prefix}${settlePeerSegment(clampNameSegment(normalizeNameSegment(peer), peerBudget))}${NAME_SEP}`;
 }
 export function findNamespacePrefixCollision(ns, peers) {
+    return findNamespacePrefixCollisions(ns, peers)[0];
+}
+export function findNamespacePrefixCollisions(ns, peers) {
     const seen = new Map();
+    const collisions = [];
     for (const peer of peers) {
         const prefix = mintNamespacePrefix(ns, peer);
         const first = seen.get(prefix);
-        if (first !== undefined)
-            return { prefix, peers: [first, peer] };
+        if (first !== undefined) {
+            collisions.push({ prefix, peers: [first, peer] });
+            continue;
+        }
         seen.set(prefix, peer);
     }
-    return undefined;
+    return collisions;
+}
+export function createToolNameClaims(ns, peer) {
+    const held = new Map();
+    return (tool) => {
+        const minted = mintNamespacedToolName(ns, peer, tool);
+        const heldBy = held.get(minted);
+        if (heldBy !== undefined)
+            return { minted, heldBy };
+        held.set(minted, tool);
+        return { minted };
+    };
 }
 export function mintNamespacedToolName(ns, peer, tool) {
     const prefix = mintNamespacePrefix(ns, peer);

package/dist/core/read-only-shell.d.ts

@@ -8,6 +8,20 @@ export type ReadOnlyShellVerdict = {
     readonly readOnly: false;
     readonly reason: string;
 };
+/** How a caller asks: a shape it already read, the session's working directory, the whole line's descriptor
+ *  bindings when it judges one segment of a longer line, and the deployment's programs. */
+export interface ReadOnlyShellOptions {
+    /** The command already read with {@link readShellCommand} (the gate reads every shell command once). */
+    readonly shape?: ShellCommandShape | undefined;
+    /** Where the session stands: a `cd` beside a `git` that lands here is no line objection. */
+    readonly cwd?: string | undefined;
+    /** The descriptor bindings of the WHOLE line, for a caller that judges one segment of it. */
+    readonly bound?: LineDescriptors | (() => LineDescriptors) | undefined;
+    /** The programs a deployment lets a face run: every program the line names (each segment's program past a `command` /
+     *  `builtin` prefix, and the program an `xargs` segment hands its input to) must be one of them, else the
+     *  line is not read-only for that face. It only ever narrows — a program here whose call writes is still not read-only. */
+    readonly readers?: ReadonlySet<string> | undefined;
+}
 /** The reference implementation's question for a compound that changes directory and runs git (`cd-git-compound`). */
 export declare const CD_GIT_COMPOUND_SENTENCE = "This command changes directory before running a version-control command, which can pick up untrusted hooks or repository configuration from the target directory. Approve only if you trust it.";
 /**
@@ -17,8 +31,8 @@ export declare const CD_GIT_COMPOUND_SENTENCE = "This command changes directory
  */
 export declare function changesDirectoryBeforeGit(shape: ShellCommandShape, cwd?: string): boolean;
 /**
- * Read `command` as the allow layer must: read-only, or the first reason it is not. A shape already read by
- * the caller may be handed in (the gate reads every shell command once).
+ * Read `command` as every read-only consumer must: read-only, or the first reason it is not. A shape already read
+ * by the caller may be handed in (the gate reads every shell command once).
  *
  * @contract read_only_shell.every_segment — a command line is read-only iff the lexer reads it whole (no
  * unreadable segment, no group/subshell/control structure, no background `&`), no word anywhere carries a
@@ -30,10 +44,11 @@ export declare function changesDirectoryBeforeGit(shape: ShellCommandShape, cwd?
  * the exact forms, `echo`/`ls`/`cd`/`find`/`printf`/`history`/`arch`/`ifconfig`); else the flag-vetted
  * table with its per-row danger predicates, and the `uniq`/`jq` forms. A `cd` beside a `git` in one line
  * is never read-only (the git command's repository is then not the session's) unless the `cd` lands where the session
- * stands ({@link changesDirectoryBeforeGit}). Anything the reading does not positively admit is NOT read-only — the
- * answer is never a guess, and a `false` costs one question.
+ * stands ({@link changesDirectoryBeforeGit}). Given {@link ReadOnlyShellOptions.readers}, a program the line names
+ * outside them is an objection of its own, met where the reading meets the program. Anything the reading does not
+ * positively admit is NOT read-only — the answer is never a guess, and a `false` costs one question.
  */
-export declare function readOnlyShellVerdict(command: string, shape?: ShellCommandShape, cwd?: string, bound?: LineDescriptors | (() => LineDescriptors)): ReadOnlyShellVerdict;
+export declare function readOnlyShellVerdict(command: string, opts?: ReadOnlyShellOptions): ReadOnlyShellVerdict;
 /**
  * The reader's LINE-level objection to `command` — what makes no segment of it read-only in its place, whatever the
  * segment reads on its own: the line's structure, or a `cd` beside a `git` ({@link changesDirectoryBeforeGit}). A caller

package/dist/core/read-only-shell.js

@@ -1,10 +1,12 @@
 import { posix } from "node:path";
 import { lexedWordOf, readShellCommand } from "./shell-run-candidates.js";
+import { unlistedReaderSentence } from "../tools/fs/bash-readonly-classifier.js";
 import { descriptorsOfPlan, newLineDescriptors, standardDeviceUnrebound } from "../tools/fs/shell-read-device.js";
 import { planShellReads } from "../tools/fs/shell-read-plan.js";
 import { writesOnlyStandardDevices } from "../tools/fs/shell-read-write-targets.js";
 import { FIND_ACTION_PRIMARIES, FIND_NEWER_PRIMARY, FIND_VALUE_PRIMARIES, FLAG_VALUE_ACCEPTS, READ_ONLY_BARE_ONLY, READ_ONLY_BARE_PROGRAMS, READ_ONLY_COMMAND_TABLE, READ_ONLY_ENV_NAMES, READ_ONLY_EXACT_FORMS, READ_ONLY_GLOB_PROGRAMS, XARGS_READ_ONLY_TARGETS, dockerRetargetDanger, } from "./read-only-shell-table.js";
 const NOT = (reason) => ({ readOnly: false, reason });
+const READ_ONLY = { readOnly: true };
 export const CD_GIT_COMPOUND_SENTENCE = "This command changes directory before running a version-control command, which can pick up untrusted hooks or repository configuration from the target directory. Approve only if you trust it.";
 export function changesDirectoryBeforeGit(shape, cwd) {
     const programs = shape.segments.map((s) => peelBuiltinPrefix(s.argv.slice(leadingAssignmentCount(s.argv)).map((w) => w.text))[0] ?? "");
@@ -20,7 +22,6 @@ export function changesDirectoryBeforeGit(shape, cwd) {
     const trim = (p) => p.replace(/\/+$/, "") || "/";
     return trim(posix.resolve(cwd, target.text)) !== trim(cwd);
 }
-const READ_ONLY = { readOnly: true };
 const BARE_PROGRAMS = new Set(READ_ONLY_BARE_PROGRAMS.filter((p) => !p.includes(" ")));
 const BARE_MULTIWORD = READ_ONLY_BARE_PROGRAMS.filter((p) => p.includes(" ")).map((p) => p.split(" "));
 const GLOB_PROGRAMS = new Set(READ_ONLY_GLOB_PROGRAMS);
@@ -41,7 +42,11 @@ const PRINTF_ESCAPE = new RegExp(`%[^%a-zA-Z]*${PRINTF_LENGTH}\\\\[0-7xX]`);
 const PRINTF_NUMERIC = new RegExp(`%[-+ 0#']*[0-9.*]*${PRINTF_LENGTH}[diouxXeEfFgGaAn]`);
 const JQ_DANGER_FLAG = /^['"]?-[a-zA-Z]*[fL]/;
 const JQ_DANGER_TEXT = /--from-file|--rawfile|--slurpfile|--run-tests|--library-path|\benv\b|\$ENV\b|\binclude\b|\bimport\b/;
-export function readOnlyShellVerdict(command, shape = readShellCommand(command), cwd, bound) {
+export function readOnlyShellVerdict(command, opts = {}) {
+    const { cwd, bound, readers } = opts;
+    if (readers !== undefined && typeof readers.has !== "function")
+        throw new TypeError("readOnlyShellVerdict: `readers` must be a Set of program names");
+    const shape = opts.shape ?? readShellCommand(command);
     const line = lineStructureObjection(shape);
     if (line !== undefined)
         return NOT(line);
@@ -66,12 +71,15 @@ export function readOnlyShellVerdict(command, shape = readShellCommand(command),
     let boundOfText;
     const bindings = () => (boundOfText ??= (typeof bound === "function" ? bound() : bound) ?? lineDescriptorsOfText(command));
     for (const seg of shape.segments) {
-        const verdict = segmentVerdict(seg, descriptors, bindings);
+        const verdict = segmentVerdict(seg, descriptors, bindings, readers);
         if (!verdict.readOnly)
             return verdict;
     }
     return READ_ONLY;
 }
+function unlistedObjection(program, readers) {
+    return readers !== undefined && !readers.has(program) ? NOT(unlistedReaderSentence(program)) : undefined;
+}
 const CD_GIT_REASON = "a compound that changes directory and runs git";
 function lineStructureObjection(shape) {
     if (shape.grouped)
@@ -144,16 +152,11 @@ function peelBuiltinPrefix(words) {
                 return t;
             t = t.slice(r);
         }
-        else if (t[0] === "noglob") {
-            if (t.length <= 1)
-                return t;
-            t = t.slice(1);
-        }
         else
             return t;
     }
 }
-function segmentVerdict(seg, line, bindings) {
+function segmentVerdict(seg, line, bindings, readers) {
     for (const r of seg.redirections) {
         const target = r.target.text;
         if (!READING_REDIRECTS.has(r.op) && !standardDeviceUnrebound(target, line, []) && !(r.op === ">&" && /^\d+$/.test(target)))
@@ -174,6 +177,9 @@ function segmentVerdict(seg, line, bindings) {
         return NOT("a bare assignment runs no program");
     const words = peelBuiltinPrefix(run.map((w) => w.text));
     const program = words[0];
+    const unlisted = unlistedObjection(program, readers);
+    if (unlisted !== undefined)
+        return unlisted;
     if (run.some((w) => expansionKind(w) === "glob"))
         return GLOB_PROGRAMS.has(program) ? READ_ONLY : NOT(`\`${program}\` with a glob argument — the glob may name anything`);
     if (DEVICE_WRITERS.has(program) && writesOnlyStandardDevices(program, words.slice(1), bindings()))
@@ -181,7 +187,7 @@ function segmentVerdict(seg, line, bindings) {
     const structural = structuralReading(words);
     if (structural !== null)
         return structural ? READ_ONLY : NOT(`\`${program}\` with these arguments is not a read-only form`);
-    return tableReading(words, run);
+    return tableReading(words, run, readers);
 }
 export function lineDescriptorsOfText(command) {
     return descriptorsOfPlan(planShellReads(command, { readers: new Set(), cwd: "/", roots: [] }));
@@ -248,7 +254,7 @@ function printfReading(words) {
     }
     return true;
 }
-function tableReading(words, run) {
+function tableReading(words, run, readers) {
     const program = words[0];
     const hit = TABLE_ROWS.find((r) => words.length >= r.words.length && r.words.every((w, i) => words[i] === w));
     if (hit !== undefined) {
@@ -259,7 +265,8 @@ function tableReading(words, run) {
             if (a.includes("{") && (a.includes(",") || a.includes("..")))
                 return NOT(`\`${program}\`: a brace pattern argument`);
         }
-        if (!flagWalk(args, hit.row, program))
+        const named = [];
+        if (!flagWalk(args, hit.row, program, named))
             return NOT(`\`${program}\`: an option outside its read-only set (or a malformed option value)`);
         if (hit.row.wordsShape !== undefined ? !hit.row.wordsShape(args) : run.some((w) => w.raw.includes("`")))
             return NOT(`\`${program}\`: arguments outside its read-only form`);
@@ -267,6 +274,11 @@ function tableReading(words, run) {
             return NOT(`\`${program}\`: a line break inside an argument`);
         if (hit.row.dangerous?.(args) === true)
             return NOT(`\`${program}\`: an argument form upstream marks as writing, executing or resolving`);
+        for (const target of named) {
+            const unlisted = unlistedObjection(target, readers);
+            if (unlisted !== undefined)
+                return unlisted;
+        }
         return READ_ONLY;
     }
     if (program === "uniq" && words.slice(1).every((w, i, all) => /^-[a-zA-Z]+$/.test(w) || /^--[a-zA-Z-]+(=\S+)?$/.test(w) || (i > 0 && /^-[fsw]$/.test(all[i - 1]) && /^\d+$/.test(w))))
@@ -296,7 +308,7 @@ function jqReading(args) {
     }
     return true;
 }
-function flagWalk(args, row, program) {
+function flagWalk(args, row, program, named) {
     let i = 0;
     while (i < args.length) {
         let word = args[i];
@@ -309,7 +321,10 @@ function flagWalk(args, row, program) {
                 i++;
                 word = args[i];
             }
-            return XARGS_TARGETS.includes(word);
+            if (!XARGS_TARGETS.includes(word))
+                return false;
+            named.push(word);
+            return true;
         }
         if (word === "--") {
             if (row.respectsDoubleDash !== false)

package/dist/core/remote-env.d.ts

@@ -323,7 +323,7 @@ export interface RemoteExecutionEnv extends ExecutionEnv {
      * `{isolation:true, suspendable:true}` adapter); **partial-capability** adapters (SSH/ADB: `{false, false}`
      * — a real machine/device, not snapshotable and not isolated) declare it here. **Required + explicit** so
      * the orchestrator never has to guess: there is no safe default (assuming isolation when there is none is a
-     * security hole; assuming suspendable crashes on `suspendVM`). Use {@link isSuspendable}/{@link isIsolated}
+     * security hole; assuming suspendable crashes on `suspendVM`). Use {@link isSuspendable}/{@link isIsolated}/{@link processTableOf}
      * rather than the structural {@link isRemoteExecutionEnv} (method presence ≠ semantics — a stub `suspendVM`
      * that returns `"unsupported"` still satisfies the structural check). Extensible: add fields as new
      * partial-capability classes appear.
@@ -355,6 +355,29 @@ export interface RemoteExecutionEnv extends ExecutionEnv {
          *  Read STRICTLY through {@link canonicalPathIsAuthoritative}, like every other capability whose
          *  `true` changes what a containment leg does; a wrong-SHAPE value reads absent and is announced. */
         canonicalPathAuthoritative?: boolean;
+        /** True iff the commands this env runs are processes on a table that holds THIS process — the table the
+         *  engine itself and the processes above it are on, so a kill the model writes there can reach them.
+         *  `true` for an adapter that spawns the commands as this process's own descendants (a host lane), and
+         *  for one whose commands run in a PID namespace that contains this process's (the host of the container
+         *  the engine runs in); `false` only for one whose commands run where this process is not: another
+         *  machine (SSH host, device, cloud sandbox) or a PID namespace this process is not in (a sandbox
+         *  container, a pod). Not {@link isolation}: a non-isolated SSH host is a real machine and still another
+         *  table. The self-preservation guard of the Bash tool asks its question exactly when this is `true`
+         *  (and for every env that is not remote at all), and does not ask where it is `false`.
+         *
+         *  What a `true` buys is the guard's question exactly as a NodeExecutionEnv gets it, limits included: on this
+         *  process's own table, of the platform's `pgrep`, with the kill's words as written, from this process's own
+         *  working directory. It is put as for this process's descendants, so for commands on the same table that
+         *  are not (SSH to `localhost`) BSD's `pgrep` leaves its OWN caller's ancestors out where the real kill would
+         *  not, and from an enclosing namespace the question sees only this process's namespace, not the ancestors
+         *  above it.
+         *
+         *  REQUIRED, with no default: either reading of an absent value is wrong somewhere (assuming `true`
+         *  refuses an ordinary `pkill` in a sandbox because a word matched this engine here; assuming `false`
+         *  lets a host lane's `pkill` end the session that issued it). So an absent or non-boolean value is
+         *  announced once per run at the env's admission point and the guard refuses every pattern kill that needs the question on
+         *  that env (`pkill -P $$` runs), naming this declaration, until the adapter states it. Read through {@link processTableOf}. */
+        sharesProcessTable: boolean;
     };
     /** Identity of the connected workspace (design/48 §5 gap 1). Synchronous: it is data the env already holds. */
     workspaceHandle(): WorkspaceHandle;
@@ -634,3 +657,16 @@ export declare function boundaryIsTheSandbox(env: ExecutionEnv): boolean;
  * has no case to fire on.
  */
 export declare function canonicalPathIsAuthoritative(env: ExecutionEnv): boolean;
+/**
+ * Which process table this env's commands run on, as its adapter declares it
+ * ({@link RemoteExecutionEnv.capabilities}.sharesProcessTable):
+ *  · `"this"` — a table that holds this process: a remote env that declares `true`, and every env that is not
+ *    remote. The second is the base contract's in-process env (its commands are this process's children); an
+ *    adapter that runs commands elsewhere without the remote seam has no block to declare in and is read the
+ *    same way, which errs toward asking (a refusal of a kill that could not have reached this process);
+ *  · `"other"` — a remote env that declares `false`;
+ *  · `"undeclared"` — a remote env whose declaration is absent, not a boolean, or cannot be read (a throwing
+ *    getter or Proxy trap). There is no default to fold it to, so the caller refuses what it cannot answer.
+ * Total: it never throws. It does not announce — the admission census does, once per run.
+ */
+export declare function processTableOf(env: ExecutionEnv): "this" | "other" | "undeclared";

package/dist/core/remote-env.js

@@ -67,3 +67,14 @@ export function boundaryIsTheSandbox(env) {
 export function canonicalPathIsAuthoritative(env) {
     return isRemoteExecutionEnv(env) ? env.capabilities.canonicalPathAuthoritative === true : false;
 }
+export function processTableOf(env) {
+    try {
+        if (!isRemoteExecutionEnv(env))
+            return "this";
+        const declared = env.capabilities.sharesProcessTable;
+        return declared === true ? "this" : declared === false ? "other" : "undeclared";
+    }
+    catch {
+        return "undeclared";
+    }
+}

package/dist/core/resume-startup-cause.d.ts

@@ -84,6 +84,28 @@ export type ReopenReasonTableCoversEveryCause = AssertAllKeysHandled<Exclude<Res
  * decision is untouched, and the retry replays it.
  */
 export declare function reopenReasonOf(cause: ResumeStartupCause | undefined): ReopenReason;
-/** What the result of a returned resume leg says after its checkpoint was reopened, per reason. */
-export declare function reopenedUnstartedSentence(reason: ReopenReason): string;
+/**
+ * What happened to a claimed row whose approved action never started — the one closed outcome every exit of such a leg reports
+ * (the thrown-prepare backstop, the returned-leg settle, the post-claim abort): `reopened` under a reason (the row is pending again),
+ * `declined` (the store's `reopen` answered `false`: the row is no longer the resolved row this leg claimed — missing, expired, its
+ * decided action already disposed, or pending again — which the boolean does not say), `unknown` (the reopen threw: the write may have
+ * committed and only its acknowledgement been lost, so the row's state cannot be proven from here).
+ */
+export type UnstartedRow = {
+    readonly kind: "reopened";
+    readonly reason: ReopenReason;
+} | {
+    readonly kind: "declined";
+} | {
+    readonly kind: "unknown";
+    readonly thrown: unknown;
+};
+/**
+ * THE compensation of a claimed leg whose approved action never started: the claim's reversal (`reopen`, bound to the row) asked once,
+ * under `reason`, and read into {@link UnstartedRow} — its answer, never a code sniffed off whatever it threw (a store's own error may
+ * carry any code, and a throw after a committed write is not a refusal). Every exit calls it; none re-reads the outcome another way.
+ */
+export declare function compensateUnstarted(reopen: (reason: ReopenReason) => Promise<"reopened" | "declined">, reason: ReopenReason): Promise<UnstartedRow>;
+/** The sentence for {@link UnstartedRow} — one per outcome, the same on every exit; the exit puts its own lead before it. */
+export declare function unstartedRowSentence(row: UnstartedRow): string;
 export {};

package/dist/core/resume-startup-cause.js

@@ -1,3 +1,4 @@
+import { egressThrownText } from "./untrusted-egress.js";
 export const REOPEN_REASONS = Object.freeze(["env_failed", "tool_unavailable", "constraint_rejected", "config_refused"]);
 export const RESUME_STARTUP_CAUSES = Object.freeze(["environment", "session_gone", "transcript_corrupt", "tool_unavailable", "configuration", "decision_rejected"]);
 const CAUSE_OF_CODE = new Map([
@@ -44,7 +45,25 @@ const REOPEN_REASON_OF_CAUSE = {
 export function reopenReasonOf(cause) {
     return cause === undefined ? "env_failed" : REOPEN_REASON_OF_CAUSE[cause];
 }
-export function reopenedUnstartedSentence(reason) {
+export async function compensateUnstarted(reopen, reason) {
+    try {
+        return (await reopen(reason)) === "reopened" ? { kind: "reopened", reason } : { kind: "declined" };
+    }
+    catch (thrown) {
+        return { kind: "unknown", thrown };
+    }
+}
+export function unstartedRowSentence(row) {
+    switch (row.kind) {
+        case "reopened":
+            return reopenedUnstartedSentence(row.reason);
+        case "declined":
+            return "the approved action never started, and the store DECLINED to reopen the checkpoint — it is no longer the resolved row this leg claimed (missing, expired, its decided action already disposed, or pending again): read the row before deciding; if it is resolved or gone, a retry needs a fresh approval";
+        case "unknown":
+            return `the approved action never started, and reopening the checkpoint FAILED IN FLIGHT (${egressThrownText("same-principal", row.thrown)}) — its state UNKNOWN, unprovable from here: re-read it before deciding; do NOT issue a fresh approval on the assumption the old one is dead`;
+    }
+}
+function reopenedUnstartedSentence(reason) {
     switch (reason) {
         case "env_failed":
             return "the approved action never started, so the checkpoint was REOPENED (pending): the same approval can be resumed again, do not ask for a fresh one";

package/dist/core/retired-keys.d.ts

@@ -20,6 +20,14 @@ export declare function retiredKeyOf(bag: object, table: Readonly<Record<string,
  * `RunWorkflowToolDeps`, `TaskSpec`).
  */
 export declare function assertNoRetiredKeys(bag: object, table: Readonly<Record<string, string>>, owner: string): void;
+/** The refusal {@link assertNoRetiredKeys} throws for a hit — the one sentence and code, for a caller that has to read the bag
+ *  itself (to tell a refusal from a member that cannot be read) and must not read it a second time. */
+export declare function retiredKeyRefusal(hit: {
+    key: string;
+    replacement: string;
+}, owner: string): Error & {
+    code: string;
+};
 /** What replaced the `hooks` record, on a deps bag and on a `TaskSpec` alike: one seat name, one sentence, quoted by both
  *  tables (this one and `runner/retired-runner-deps.ts`). The record's callbacks never run, so a deny one carried would pass
  *  unseen — the key is refused by name instead. */
@@ -29,6 +37,14 @@ export declare const RETIRED_HOOKS_REPLACEMENT = "the callback seats are `mods`
  *  (`config.spec_retired_key`), never read as absence: a mode a caller believes it declared must not silently run
  *  as another. */
 export declare const RETIRED_TASK_SPEC_KEYS: Readonly<Record<string, string>>;
+/** The RETIRED `ToolSpec` members — a spec still carrying one is refused by name (`config.deps_retired_key`) where the
+ *  factory reads the spec, never dropped unseen: a description the author wrote for one prompt shape would silently
+ *  never be shown. */
+export declare const RETIRED_TOOL_SPEC_KEYS: Readonly<Record<string, string>>;
+/** The RETIRED {@link import("../engine/llm/types.js").Model} members — a model still carrying one is refused by name
+ *  (`config.deps_retired_key`) at the model door, never read as absence: text a deployment believes it appended would
+ *  silently not reach the model. */
+export declare const RETIRED_MODEL_KEYS: Readonly<Record<string, string>>;
 /** The RETIRED `ToolPolicy` members — a policy still carrying one is refused by name (`config.deps_retired_key`) wherever
  *  the engine reads a policy's members: the intake of the caller's policy (prepare, and a resume before its claim), the
  *  by-name member reader the wrap and the path-rule installation share, and `combinePolicies`. A member the policy no

package/dist/core/retired-keys.js

@@ -18,11 +18,13 @@ export function retiredKeyOf(bag, table) {
 }
 export function assertNoRetiredKeys(bag, table, owner) {
     const hit = retiredKeyOf(bag, table);
-    if (hit === undefined)
-        return;
+    if (hit !== undefined)
+        throw retiredKeyRefusal(hit, owner);
+}
+export function retiredKeyRefusal(hit, owner) {
     const e = new Error(`${owner}.${hit.key} is retired and is not read by this engine — ${hit.replacement}. Refused rather than ignored: a seat that is silently dropped reads to the deployment as wired.`);
     e.code = owner === "TaskSpec" ? "config.spec_retired_key" : "config.deps_retired_key";
-    throw e;
+    return e;
 }
 export const RETIRED_HOOKS_REPLACEMENT = 'the callback seats are `mods` registrations now — register the extension on `RunnerDeps.mods` (a deployment\'s) or `TaskSpec.mods` (a task\'s), hung on the `classic.*` events (`classic.PreToolUse`, `classic.PostToolUse`, `classic.PostToolBatch`, `classic.UserPromptSubmit`, `classic.Stop`, `classic.SubagentStop`, …); a callback that denied is a handler answering `{ action: "deny", message }`';
 export const RETIRED_TASK_SPEC_KEYS = Object.freeze({
@@ -32,6 +34,13 @@ export const RETIRED_TASK_SPEC_KEYS = Object.freeze({
     "attachments.planModeReminder": "the read-only planning posture is stated whenever the leg's mode is `plan` (first turn, every 5 turns, and an exit frame when it ends) — drop the key",
     "skills[].manifest": "a skill's tools are its `allowedTools` / `disallowedTools` now — an allow-rule and a deny-rule source for the run the skill is activated in, never a fence; move `manifest.allowTools` to `allowedTools`. To fence tools write deny rules (or a delegated agent definition's `allowTools`); to fence write paths use session `allowDirs`",
     promptProvider: "a task changes prompt text through overlays: its role text is `systemPrompt` (it replaces the role base `promptRole` selects), its added block `appendSystemPrompt`, the minimal form `promptForm: \"minimal\"`; anything else is a `prompt.compose` registration on the task's own `mods` answering `{ overlays }` (an already-assembled prompt is refused, never passed through)",
+    promptProfile: 'the prompt\'s shape is the `lean_prompt` trait now — write `promptLean: false` for the long (classic) shape, `promptLean: true` (or nothing, on a model that declares `lean_prompt`) for the lean one',
+});
+export const RETIRED_TOOL_SPEC_KEYS = Object.freeze({
+    descriptionClassic: 'a description\'s other forms are `descriptionVariants` now — the long form is `{ id: "classic", traits: { noneOf: ["lean_prompt"] }, text }`, chosen at mount by the run\'s prompt traits',
+});
+export const RETIRED_MODEL_KEYS = Object.freeze({
+    promptGuidance: "a model selects prompt text by its traits now — declare them in `Model.promptTraits` (the reference's capability names, or a deployment's own `x-<namespace>-<name>`); text meant for one model is an overlay (a center artifact's `add` to the `behavior` band, or a `prompt.compose` registration) whose `when.traits.allOf` names that trait",
 });
 export const RETIRED_TOOL_POLICY_KEYS = Object.freeze({
     writeTargetGuard: "the guarded write targets are stated as rows now — `ToolPolicy.writeGuardRows`, an async provider of the one path table's `PathGuardRow`s the leg's ONE write judgment reads for every writer the policy cannot see as a call (the shell's file commands). A wrapper carries it through `wrapToolPolicy`, which reads every member a policy declares",
@@ -40,9 +49,12 @@ export const RETIRED_SHELL_READ_BOUNDARY_KEYS = Object.freeze({
     writeProtectionJudge: 'the station asks ONE write judgment, `ShellReadBoundary.writeTargetJudge`, over the write-protection table and the deployment\'s guarded write rows together — it answers `"protected"`, `"guarded"` or `undefined`, not a boolean',
     writeTargetGuard: 'the deployment\'s guarded write rows join the same one judgment, `ShellReadBoundary.writeTargetJudge` (`"guarded"` for a target a `ToolPolicy.writeGuardRows` row covers) — the boundary has no second write seat',
 });
+const GUARDS_ARE_ENGINE_FINDINGS = "state `requiresRealApproval: true` for a person's confirmation — the integrity guards are the engine's findings, carried on its attestation record (install the engine's guard policy for one)";
 export const RETIRED_DECISION_MEMBERS = Object.freeze({
     reason: 'rename it to "message" (the one text field a decision carries)',
-    guard: 'write `guards: ["<word>"]` instead (the same five words, as a list: one ask may stand on several integrity guards)',
+    guard: GUARDS_ARE_ENGINE_FINDINGS,
+    guards: GUARDS_ARE_ENGINE_FINDINGS,
+    foldedAskClasses: "the classes of the asks a policy fold collapsed ride the engine's attestation record that combinePolicies writes (a spread of its answer keeps the record); a policy does not state them",
 });
 export function assertNoRetiredToolPolicyKeys(policy) {
     if (policy === undefined || policy === null)