@sema-agent/core 7.55.0 → 7.57.0

package/dist/brain/request-params.d.ts

@@ -122,17 +122,26 @@ export declare function applyExtraBody(body: Record<string, unknown>, model: Pic
 export declare function lockHeader(headers: Record<string, string>, lowerName: string, value: string): void;
 /**
  * #343 (review r4) — case-fold READ-AND-CLAIM for an AUGMENTABLE structural header (`anthropic-beta`):
- * returns the current value under whatever spelling the user bag carried and deletes that spelling,
- * so the caller's canonical lowercase write REPLACES it instead of duplicating beside it (the
+ * returns the value under EVERY spelling the bag carried, in key order, and deletes them all, so the
+ * caller's canonical lowercase write REPLACES them instead of duplicating beside them (the
  * read-modify-write used to key the read by the exact lowercase name and miss `Anthropic-Beta`,
- * losing the user's betas from the merge AND double-sending the header).
+ * losing the user's betas from the merge AND double-sending the header). A spelling is claimed whatever
+ * it holds — its value is returned as it is, so a spelling holding `undefined` does not end the claim.
  */
-export declare function takeHeaderCasefold(headers: Record<string, string>, lowerName: string): string | undefined;
+export declare function takeHeaderSpellings(headers: Record<string, string>, lowerName: string): unknown[];
+/** The entries of a comma-list header value (`" a , b,,c"` → `a`, `b`, `c`); a value that is not a string carries none. */
+export declare function headerListEntries(value: unknown): string[];
 /** A caller's header bag read ONCE, into a plain copy of its own enumerable entries — what a request build hands both
  *  the route law (which credential rides, and its identity) and the merge (what goes on the wire), so a bag whose getters
  *  or keys answer differently on a second read cannot be judged as one bag and sent as another. */
 export declare function headerBagOnce(bag: Readonly<Record<string, string>> | undefined): Record<string, string> | undefined;
 export declare function mergeHeaders(...bags: Array<Record<string, string> | undefined>): Record<string, string>;
+/** The values a request is DECLARED with ({@link import("./stream-engine.js").SSERequest.declared}): every value of the header bags it was
+ *  built from — the route's credential headers included, as the merge after `applyRouteCredentialHeaders` holds them — the values the
+ *  deployment or the call stated outside a bag (a configured protocol version, each entry of a list header the brain re-folds), and the
+ *  key when it names a secret ({@link namesASecret}: a placeholder key is left in the words as it is left to every child). The values the
+ *  brain writes itself (a structural lock, the default version, the beta entries it chose) are not among them. */
+export declare function declaredRequestValues(bags: ReadonlyArray<Readonly<Record<string, string>> | undefined>, stated: ReadonlyArray<string | undefined>, key: string | undefined): string[];
 /**
  * The output-cap key(s) each lane's wire form uses. A lane's set is exactly the keys THAT lane's
  * endpoint reads — a stray cap key belonging to another wire form is inert there and must not be

package/dist/brain/request-params.js

@@ -1,4 +1,4 @@
-import { isCredentialHeaderName } from "../core/secret-env.js";
+import { isCredentialHeaderName, namesASecret } from "../core/secret-env.js";
 import { isPlainRecord } from "../core/mods/kernel/receive.js";
 import { BrainError } from "./errors.js";
 export const OPENAI_RESERVED = new Set([
@@ -92,15 +92,18 @@ export function lockHeader(headers, lowerName, value) {
     }
     headers[lowerName] = value;
 }
-export function takeHeaderCasefold(headers, lowerName) {
+export function takeHeaderSpellings(headers, lowerName) {
+    const values = [];
     for (const k of Object.keys(headers)) {
         if (k.toLowerCase() === lowerName) {
-            const v = headers[k];
+            values.push(headers[k]);
             delete headers[k];
-            return v;
         }
     }
-    return undefined;
+    return values;
+}
+export function headerListEntries(value) {
+    return typeof value === "string" ? value.split(",").map((entry) => entry.trim()).filter((entry) => entry !== "") : [];
 }
 export function headerBagOnce(bag) {
     return bag === undefined ? undefined : { ...bag };
@@ -126,6 +129,19 @@ export function mergeHeaders(...bags) {
     }
     return out;
 }
+export function declaredRequestValues(bags, stated, key) {
+    const out = new Set();
+    for (const bag of bags)
+        for (const value of Object.values(bag ?? {}))
+            if (typeof value === "string" && value !== "")
+                out.add(value);
+    for (const value of stated)
+        if (value !== undefined && value !== "")
+            out.add(value);
+    if (key !== undefined && namesASecret(key))
+        out.add(key);
+    return [...out];
+}
 export const OUTPUT_CAP_KEYS = {
     openai: ["max_tokens", "max_completion_tokens"],
     anthropic: ["max_tokens"],

package/dist/brain/status-sink.d.ts

@@ -1,5 +1,6 @@
 import type { BrainRetryErrClass, BrainStatus } from "../core/types.js";
 import type { ReasoningWireFacts } from "./reasoning.js";
+import type { CapabilityDeclaration, ModelCapability } from "./model-capability.js";
 /** Run `fn` with a per-task brain-status sink in scope. ALS propagates it through the async brain calls
  *  inside `fn` (the harness's prompt → brain.stream → connect/retry loop), so {@link emitBrainStatus}
  *  reaches THIS task's sink and nothing else. */
@@ -168,3 +169,22 @@ export declare function runWithCredentialOriginRefusals<T>(observe: (r: Credenti
  *  `routeRefusalError`; a judgment that only advises reports nothing). The
  *  observer is the Runner's own seat, whose one delivery is the guarded `deliverEngineNotice` — nothing is swallowed here. */
 export declare function reportCredentialOriginRefusal(report: CredentialOriginRefusalReport): void;
+/** A request that withheld a capability from the model it was sent to: the model, the capability, the model's declaration
+ *  that withheld it (`capabilityOf`), and how many blocks it replaced. */
+export interface CapabilityWithheldReport {
+    modelId: string;
+    capability: ModelCapability;
+    cause: Exclude<CapabilityDeclaration, "declared_on">;
+    count: number;
+}
+/**
+ * Run `fn` with a per-run withheld-capability sink in scope — the SIXTH brain→runner ALS channel, with the fourth's shape
+ * and for its reasons: the WHOLE leg (the end-of-task compaction runs after the leg's prompt, and a child leg running
+ * inside its parent's tool call must report to its own leg, not to the scope it inherited), not shielded around the leg's
+ * internal calls, not revoked on settlement, no-op outside the scope.
+ */
+export declare function runWithCapabilityWithheld<T>(observe: (r: CapabilityWithheldReport) => void, fn: () => Promise<T>): Promise<T>;
+/** Report a withheld capability to the active per-run sink, if any (called by the message assemblers' one emit,
+ *  `reportImagesWithheld`). The observer is the Runner's own seat, whose one delivery is the guarded `deliverEngineNotice`
+ *  — nothing is swallowed here: a seat that fails otherwise fails the request build, never the person's notice in silence. */
+export declare function reportCapabilityWithheld(report: CapabilityWithheldReport): void;

package/dist/brain/status-sink.js

@@ -75,3 +75,10 @@ export function runWithCredentialOriginRefusals(observe, fn) {
 export function reportCredentialOriginRefusal(report) {
     credentialOriginRefusalSinkStore.getStore()?.observe(report);
 }
+const capabilityWithheldSinkStore = new AsyncLocalStorage();
+export function runWithCapabilityWithheld(observe, fn) {
+    return capabilityWithheldSinkStore.run({ observe }, fn);
+}
+export function reportCapabilityWithheld(report) {
+    capabilityWithheldSinkStore.getStore()?.observe(report);
+}

package/dist/brain/stream-engine.d.ts

@@ -109,6 +109,12 @@ export declare const WAITING_FIRST_TOKEN_EVERY_MS = 30000;
 export interface SSERequest {
     url: string;
     headers: Record<string, string>;
+    /**
+     * Every header value this request was DECLARED with — the model entry's, the deployment's and the call's header bags as the
+     * route kept them, and the key — as the adapter built them. An endpoint's words lose these before the engine carries them
+     * ({@link remoteWords}); the engine's own protocol words (`content-type`, the version and the beta list it chose) are not declared.
+     */
+    declared: readonly string[];
     body: string;
     /**
      * The per-request output cap this request ACTUALLY carries on the wire, when the adapter sets one
@@ -194,6 +200,9 @@ export interface StreamControls {
      *  raising the provider's own in-band failure from `finalize`: the terminal message the engine mints for that
      *  failure keeps it (the text the provider streamed, the usage it reported), rather than an empty shell. */
     keepOutput(output: KeptOutput): void;
+    /** The provider's own words in an in-band failure, as the engine carries them: this attempt's request ({@link SSERequest.declared}) taken
+     *  out, then the credential vocabulary. A judge that reads the frame (the condition, the input-too-long anchor) reads the raw words. */
+    providerWords(words: string): string;
 }
 /** The output a parser hands over with {@link StreamControls.keepOutput}. */
 export interface KeptOutput {

package/dist/brain/stream-engine.js

@@ -9,7 +9,7 @@ import { FAST_MAX_BACKOFF_MS, providerWaitHint, retryBackoffMs } from "./retry.j
 import { bindBrainStatusEmitter, emitBrainStatus, emitBrainTelemetry, reportExtraBodyDropped } from "./status-sink.js";
 import { createAttemptController, firstByteWindow, refuseRetiredTimeoutKnobs, resolveFirstByteRetries, resolveWatchdogMs, STALL_FIRST_BYTE_MS, STALL_FIRST_TOKEN_MS, STALL_IDLE_MS, } from "./timeout.js";
 import { readMember, thrownText } from "../core/thrown-value.js";
-import { egressText } from "../core/untrusted-egress.js";
+import { remoteWords } from "../core/protocol-http-auth.js";
 const DEFAULT_MAX_RETRIES = 10;
 const MAX_RETRIES_ENV_CEILING = 15;
 const MAX_RETRIES_ENV = "SEMA_MAX_RETRIES";
@@ -294,6 +294,13 @@ export function runStreamingBrain(args) {
     let attemptPartial;
     let attemptOutput;
     let routeSeen;
+    let declaredSeen = [];
+    const echoCarried = (value, field) => {
+        if (remoteWords(value, declaredSeen) === value)
+            return value;
+        emitBrainTelemetry({ kind: "echo_dropped", field });
+        return undefined;
+    };
     void run()
         .catch((err) => {
         const aborted = signal?.aborted === true || isAbortError(err);
@@ -313,7 +320,8 @@ export function runStreamingBrain(args) {
             errorMsg.usage = kept.usage;
         }
         errorMsg.stopReason = aborted ? "aborted" : "error";
-        errorMsg.errorMessage = thrownText(err);
+        const said = thrownText(err);
+        errorMsg.errorMessage = brainErrorCodeOf(err) !== undefined ? said : remoteWords(said, declaredSeen);
         const failure = aborted ? {} : thrownBrainFailure(err);
         if (failure.code !== undefined) {
             if (failure.errorKind !== undefined)
@@ -328,13 +336,17 @@ export function runStreamingBrain(args) {
                 const statusNum = typeof status === "number" ? status : undefined;
                 if (namesTheFailure(statusNum))
                     errorMsg.apiErrorStatus = statusNum;
-                if (requestIdSeen !== undefined)
-                    errorMsg.requestId = requestIdSeen;
+                const requestId = requestIdSeen === undefined ? undefined : echoCarried(requestIdSeen, "requestId");
+                if (requestId !== undefined)
+                    errorMsg.requestId = requestId;
                 if (routeSeen !== undefined)
                     errorMsg.apiErrorRoute = routeSeen;
                 const providerCode = readMember(err, "providerCode");
-                if ((statusNum === undefined || refusedTheRequest(statusNum)) && typeof providerCode === "string" && isProviderEchoShape(providerCode))
-                    errorMsg.apiErrorCode = providerCode;
+                if ((statusNum === undefined || refusedTheRequest(statusNum)) && typeof providerCode === "string" && isProviderEchoShape(providerCode)) {
+                    const apiErrorCode = echoCarried(providerCode, "apiErrorCode");
+                    if (apiErrorCode !== undefined)
+                        errorMsg.apiErrorCode = apiErrorCode;
+                }
                 const condition = readMember(err, "providerCondition");
                 const source = readMember(err, "providerConditionSource");
                 if (isProviderCondition(condition) && isProviderConditionSource(source)) {
@@ -370,6 +382,7 @@ export function runStreamingBrain(args) {
             r.onCommitted?.();
             reportRequestStrip(model, r);
             routeSeen = admittedRequestRoute(r.route);
+            declaredSeen = r.declared;
         };
         commit(req);
         const dialect = resolveProviderDialect(req.url, model.api);
@@ -475,7 +488,7 @@ export function runStreamingBrain(args) {
                     }
                     else if (classifyFetchThrow(e) === "request_unbuildable") {
                         cc.dispose();
-                        throw new BrainError("invalid_request", `${httpLabel} request could not be built: ${egressText("same-principal", stripUrlCredentials(thrownText(e)))}`);
+                        throw new BrainError("invalid_request", `${httpLabel} request could not be built: ${remoteWords(stripUrlCredentials(thrownText(e)), req.declared)}`);
                     }
                     else {
                         netErr = e;
@@ -634,14 +647,14 @@ export function runStreamingBrain(args) {
                         continue;
                     }
                     if (netErr) {
-                        const chain = describeNetworkError(netErr);
+                        const chain = remoteWords(describeNetworkError(netErr), req.declared);
                         const proxyRefusal = connectReading?.proxyRefusal;
                         throw new BrainError("network", proxyRefusal === undefined ? chain : `${proxyTunnelRefusedSentence(proxyRefusal.status)} — ${chain}`, undefined, { apiError: true });
                     }
                     if (r !== undefined && errorBody === undefined)
                         errorBody = await readErrorBody(r, signal);
                     const terminalVerdict = judge();
-                    const detail = errorBody?.text ?? "";
+                    const detail = errorBody === undefined ? "" : remoteWords(errorBody.endedNormally ? errorBody.text : errorBody.text.replace(/\S+$/u, ""), req.declared);
                     const status = r?.status ?? 0;
                     const itl = terminalVerdict?.inputTooLong ?? "no";
                     const providerCode = refusedTheRequest(status) ? readProviderErrorCode(errorBody) : undefined;
@@ -737,6 +750,7 @@ export function runStreamingBrain(args) {
                 keepOutput: (output) => {
                     attemptOutput = output;
                 },
+                providerWords: (words) => remoteWords(words, req.declared),
             });
             const INBAND_OVERLOAD_WARNING = "API overloaded mid-response. The response above may be incomplete.";
             const onLineOverloadTierA = (line) => {
@@ -761,7 +775,7 @@ export function runStreamingBrain(args) {
                         throw e;
                     failure = {
                         kind: "connection",
-                        err: new BrainError("network", `mid-stream read failed: ${describeNetworkError(e)}`, undefined, { apiError: true }),
+                        err: new BrainError("network", `mid-stream read failed: ${remoteWords(describeNetworkError(e), req.declared)}`, undefined, { apiError: true }),
                     };
                     break readLoop;
                 }

package/dist/brain/stream-shared.d.ts

@@ -17,9 +17,10 @@ import { type AssistantMessage, type ModelOutputInvalid, type StreamDropCause }
 /** The warning (the reference's former words; later replaced by a resume request) stamped beside `partialFinalized` when a stream ended before its close — by the
  *  mid-stream promotion (the body threw) and by the parsers' own finalize (content arrived, no finish frame). */
 export declare const STREAM_TORN_WARNING = "Connection closed mid-response. The response above may be incomplete.";
-/** A provider word as a stream-end seat carries it: the word in the provider echo shape, else `?` — the fact that a
- *  word arrived survives, bytes outside the shape do not (the echo discipline: dropped, never rewritten). */
-export declare function echoFoldedWord(raw: string): string;
+/** A provider word as a stream-end seat carries it: the word in the provider echo shape that the stream's mint
+ *  (`providerWords`) leaves as it is, else `?` — the fact that a word arrived survives, bytes outside the shape or holding
+ *  what the request was declared with do not (the echo discipline: dropped, never rewritten). */
+export declare function echoFoldedWord(raw: string, providerWords: (words: string) => string): string;
 /**
  * The record of what arrived after a stream's first terminal statement — the one ordering rule both wire parsers
  * apply: the first ending (a finish / stop reason, a message stop, an in-band error) decides the turn; after it the
@@ -27,7 +28,7 @@ export declare function echoFoldedWord(raw: string): string;
  * here. Rides `AssistantMessage.streamEndIgnored` (the first refused frame's kind and word, how many came); the
  * Runner announces it (`route.stream_end_ignored`).
  */
-export declare function createStreamEndLedger(): {
+export declare function createStreamEndLedger(providerWords: (words: string) => string): {
     note(statement: StreamEndStatement, word: string): void;
     readonly ignored: AssistantMessage["streamEndIgnored"];
 };

package/dist/brain/stream-shared.js

@@ -3,14 +3,14 @@ import { inspectDegenerate } from "./repetition.js";
 import { emitBrainTelemetry } from "./status-sink.js";
 import { stampStreamDrops } from "../internal/llm.js";
 export const STREAM_TORN_WARNING = "Connection closed mid-response. The response above may be incomplete.";
-export function echoFoldedWord(raw) {
-    return isProviderEchoShape(raw) ? raw : "?";
+export function echoFoldedWord(raw, providerWords) {
+    return isProviderEchoShape(raw) && providerWords(raw) === raw ? raw : "?";
 }
-export function createStreamEndLedger() {
+export function createStreamEndLedger(providerWords) {
     let ignored;
     return {
         note(statement, word) {
-            ignored = ignored === undefined ? { statement, word: echoFoldedWord(word), frames: 1 } : { ...ignored, frames: ignored.frames + 1 };
+            ignored = ignored === undefined ? { statement, word: echoFoldedWord(word, providerWords), frames: 1 } : { ...ignored, frames: ignored.frames + 1 };
         },
         get ignored() {
             return ignored;

package/dist/core/a2a.d.ts

@@ -1,4 +1,5 @@
 import type { AgentTool } from "../internal/harness-types.js";
+import { type HostFloor } from "./host-floor.js";
 import type { A2aServerSpec, ToolEffect } from "./types.js";
 /** The hard per-skill description bound (ruled 2026-08-03: ~2KiB). */
 export declare const A2A_SKILL_DESCRIPTION_MAX_CHARS = 2048;
@@ -96,4 +97,4 @@ export declare class A2aRpcError extends Error {
  * `allSettled` keeps it fail-open: one unreachable peer is a skipped peer with a warning, never a task
  * that cannot start.
  */
-export declare function materializeA2aTools(specs: readonly A2aServerSpec[], principal?: string, signal?: AbortSignal): Promise<MaterializedA2a>;
+export declare function materializeA2aTools(specs: readonly A2aServerSpec[], principal?: string, signal?: AbortSignal, hostFloor?: HostFloor): Promise<MaterializedA2a>;

package/dist/core/a2a.js

@@ -1,7 +1,8 @@
 import { randomUUID } from "node:crypto";
 import { Type } from "typebox";
 import { A2A_TASK_STATES } from "./a2a-task-state.js";
-import { assertEndpointBound, redirectPolicy, resolveProtocolHttpHeaders, underDeclaredHeaders } from "./protocol-http-auth.js";
+import { assertEndpointBound, carriesDeclaredHeaders, resolveProtocolHttpHeaders, underDeclaredHeaders } from "./protocol-http-auth.js";
+import { fetchFollowing, hopRefusal, HOST_FLOOR_REFUSED_CODE } from "./host-floor.js";
 import { describeHttpTransportFailure } from "./mcp-failure.js";
 import { findNamespacePrefixCollision, mintNamespacePrefix, mintNamespacedToolName } from "./protocol-naming.js";
 import { A2A_NAMESPACE } from "./protocol-table.js";
@@ -77,6 +78,7 @@ function safeId(v) {
         return undefined;
     return inlineUntrusted(s, A2A_ID_MAX_CHARS);
 }
+const A2A_MAX_REDIRECTS = 20;
 function withRequestDeadline(outer, timeoutMs) {
     const controller = new AbortController();
     let timedOut = false;
@@ -144,21 +146,25 @@ async function readBoundedText(res, what) {
 async function requestJson(t, what, init) {
     const doFetch = resolveFetch();
     const deadline = withRequestDeadline(init.signal, init.timeoutMs);
+    const peerLabel = inlineUntrusted(t.peer, A2A_ID_MAX_CHARS);
     try {
-        const res = await doFetch(init.url, {
+        const followed = await fetchFollowing(doFetch, new URL(init.url), {
             method: init.method,
-            signal: deadline.signal,
-            redirect: redirectPolicy(t.headers),
             headers: underDeclaredHeaders({ accept: "application/json", "a2a-version": A2A_PROTOCOL_VERSION, ...(init.body !== undefined ? { "content-type": "application/json" } : {}) }, t.headers),
             ...(init.body !== undefined ? { body: init.body } : {}),
-        });
-        const text = await readBoundedText(res, `${what} from A2A peer "${inlineUntrusted(t.peer, A2A_ID_MAX_CHARS)}"`);
+            signal: deadline.signal,
+        }, { refusal: (url) => hopRefusal(url, t.floor, false), follows: () => !carriesDeclaredHeaders(t.headers), maxRedirects: A2A_MAX_REDIRECTS });
+        if (followed.kind === "refused")
+            throw Object.assign(new Error(`a2a: ${what} on peer "${peerLabel}" is not sent — ${followed.reason}`), { code: HOST_FLOOR_REFUSED_CODE });
+        if (followed.kind === "too_many")
+            throw new Error(`a2a: ${what} on peer "${peerLabel}" was redirected more than ${A2A_MAX_REDIRECTS} times`);
+        const res = followed.res;
+        const text = await readBoundedText(res, `${what} from A2A peer "${peerLabel}"`);
         return { status: res.status, text };
     }
     catch (err) {
         if (init.signal?.aborted === true)
             throw err;
-        const peerLabel = inlineUntrusted(t.peer, A2A_ID_MAX_CHARS);
         if (deadline.timedOut()) {
             throw new Error(`a2a: ${what} on peer "${peerLabel}" got no answer within ${init.timeoutMs}ms. The client stopped waiting — the peer may still be acting on the request, so treat the outcome as UNKNOWN and verify before retrying.`, { cause: err });
         }
@@ -553,16 +559,16 @@ function declaredPeerOf(declared, index) {
     const judged = judgeEntryToolAxes(snapshot, "a2a");
     return judged.ok ? { spec: judged.entry } : { spec: snapshot, refusal: judged.error };
 }
-async function materializePeer(peer, principal, lifecycle, signal) {
+async function materializePeer(peer, principal, lifecycle, signal, floor) {
     if ("refusal" in peer)
         throw peer.refusal;
     const { spec } = peer;
     const declaredAxes = spec.toolAxes;
     const headers = resolveProtocolHttpHeaders(A2A_NAMESPACE.id, spec, principal);
-    const discovery = { peer: spec.name, endpoint: spec.url, headers };
+    const discovery = { peer: spec.name, endpoint: spec.url, headers, floor };
     const card = readCard(spec.name, await discoverCardBody(spec, discovery, signal), spec.url);
     assertEndpointBound(A2A_NAMESPACE.id, spec.name, card.endpoint, spec.cardUrl === undefined ? [spec.url] : [spec.url, spec.cardUrl], headers);
-    const transport = { peer: spec.name, endpoint: card.endpoint, headers };
+    const transport = { peer: spec.name, endpoint: card.endpoint, headers, floor };
     const tools = [];
     const skillAxes = [];
     for (const skill of card.skills) {
@@ -592,7 +598,7 @@ function asPeerWarning(spec, err) {
     warning.code = "a2a.peer_unavailable";
     return warning;
 }
-export async function materializeA2aTools(specs, principal, signal) {
+export async function materializeA2aTools(specs, principal, signal, hostFloor) {
     const peers = specs.map((spec, index) => declaredPeerOf(spec, index));
     if (peers.length > 0) {
         const collision = findNamespacePrefixCollision(A2A_NAMESPACE, peers.map((p) => p.spec.name));
@@ -610,7 +616,7 @@ export async function materializeA2aTools(specs, principal, signal) {
     const toolAxes = [];
     const warnings = [];
     const statuses = [];
-    const settled = await Promise.allSettled(peers.map((peer) => materializePeer(peer, principal, lifecycle, signal)));
+    const settled = await Promise.allSettled(peers.map((peer) => materializePeer(peer, principal, lifecycle, signal, hostFloor)));
     for (let i = 0; i < peers.length; i++) {
         const spec = peers[i].spec;
         const outcome = settled[i];
@@ -645,7 +651,7 @@ export async function materializeA2aTools(specs, principal, signal) {
                 }
                 const previous = statuses.find((s) => s.name === spec.name)?.toolNames ?? [];
                 try {
-                    const fresh = await materializePeer(target, principal, lifecycle, signal);
+                    const fresh = await materializePeer(target, principal, lifecycle, signal, hostFloor);
                     const names = fresh.tools.map((t) => t.name);
                     results.push({
                         peer: spec.name,

package/dist/core/agent-definition.d.ts

@@ -157,4 +157,14 @@ export interface SkillSpec {
      * byte-identical result; a placeholder with no directory stays verbatim.
      */
     baseDir?: string;
+    /**
+     * The hooks this skill carries — registrations on the mods bus (the `TaskSpec.mods` form: user tier, a name unique in the
+     * run), whose handlers take part only while the skill is ACTIVE on the leg that loads it: from its activation (the `Skill`
+     * tool's success, or prepare for a skill the person invoked by name; a resumed run reopens the skills its park recorded
+     * active) to the end of that run. A host compiles a frontmatter `hooks:` table into one such registration; the engine
+     * reads no hook grammar. Each hangs `classic.*` events only (any other event refuses the prepare, `config.mods_invalid`).
+     * They are admitted with the leg's other registrations at its prepare (so a skill never activated still counts as a hook
+     * the leg may run) and stay the leg's own: a delegated child neither dispatches them nor is screened by them.
+     */
+    mods?: readonly import("./mods/classic-events.js").EngineModRegistration[];
 }

package/dist/core/allow-entry.d.ts

@@ -1,3 +1,4 @@
+import type { EditRewritten } from "./rewrite-rejudge.js";
 import { type RuleToolNameVerdict } from "./tool-name-aliases.js";
 import type { ToolCallRequest } from "./tool-policy.js";
 import { type AllowRuleMember, type AllowRuleShadow } from "./allow-rule-shadow.js";
@@ -46,14 +47,15 @@ export type AllowEntryInert = {
     readonly entry: string;
     readonly reason: AllowEntryInertReason;
 } & AllowEntryInertDetail;
-/** One entry the grammar reads (kind closed): a whole non-shell tool; a protocol namespace; the whole shell tool; and one
- *  kind per rule grammar (`ruleToolGrammarOf`) — a shell command rule, a path rule, a name rule, a host rule — each the row
- *  the persisted grammar parses, its `behavior` the list's direction. */
+/** One entry the grammar reads (kind closed): a whole non-shell tool; a covering spelling — a set of tool names
+ *  ({@link isCoveringRuleName}: a protocol peer, a glob over a protocol name's tool segment, and on a deny list a `*` anywhere in
+ *  the name, `*` alone every tool); the whole shell tool; and one kind per rule grammar (`ruleToolGrammarOf`) — a shell command
+ *  rule, a path rule, a name rule, a host rule — each the row the persisted grammar parses, its `behavior` the list's direction. */
 export type CompiledAllowEntry = {
     readonly kind: "tool";
     readonly name: string;
 } | {
-    readonly kind: "namespace";
+    readonly kind: "covering";
     readonly pattern: string;
 } | {
     readonly kind: "shell";
@@ -71,15 +73,6 @@ export type CompiledAllowEntry = {
     readonly kind: "domain";
     readonly rule: PersistedRule;
 };
-/**
- * THE near-miss reading of a tool name the judgment calls current: the spelling the run mounts when the run mounts no tool of this
- * exact name but one that differs from it only by case (`BASH` beside `Bash`), else `undefined`. Two kinds of name are never a near
- * miss, because the roster they would be read against is not the final one: an engine tool's (the engine mounts some of its tools
- * after a list is read) and a protocol tool's (a refresh mounts and unmounts them while the run goes on) — in both the exact
- * spelling can be the right one by the time it matters. Every station that asks "is this name a case twin of a mounted tool" reads
- * this answer: an entry list ({@link readRuleEntry}), a tool policy's name lists (the prepare-time policy-name audit).
- */
-export declare function nearMissSpellingOf(name: string, roster: ReadonlySet<string>): string | undefined;
 /**
  * THE universe a ROOT-facing tool-name list is read against: every name the engine's catalog carries, and the names the reader knows
  * are carried (`carried`). A list is root-facing when it bounds the tools of the run that holds it — the run's own `allowTools` /
@@ -108,15 +101,13 @@ export type RuleEntryReading = {
  * grammar alone is read — what a resume's pre-claim screen can read before the leg has a roster.
  */
 export declare function readRuleEntry(raw: unknown, behavior: "allow" | "deny", roster?: ReadonlySet<string>): RuleEntryReading;
-/** The tool name a compiled entry speaks for — its tool, its namespace spelling, or its rule's tool (what a name audit reads). */
+/** The tool name a compiled entry speaks for — its tool, its covering spelling, or its rule's tool (what a name audit reads). */
 export declare function compiledEntryName(compiled: CompiledAllowEntry): string;
 /**
- * Compile one list WHOLE through {@link readRuleEntry}: the entries it reads and the ones it reads as nothing (each with its
- * reason and, for a name the roster refuses, the judgment's word and the spelling to write). An allow list holding `*` voids
- * the list (every other entry on it reads as nothing too: the list grants nothing — the safe direction) — `*` as the lenient
- * rule parser names it ({@link namesWholeRoster}), so an entry the stricter entry grammar refuses (`* (*)`) still voids. A
- * `*` on a deny list reads as nothing by itself and the rest of that list still refuses: a deny list never loses an entry to
- * a wildcard beside it. `roster` as in {@link readRuleEntry}.
+ * Compile one list through {@link readRuleEntry}, entry by entry: the entries it reads and the ones it reads as nothing (each
+ * with its reason and, for a name the roster refuses, the judgment's word and the spelling to write). No entry changes how
+ * another is read: a `*` on an allow list grants nothing by itself (`wildcard_all`) and the entries beside it keep their
+ * reading; on a deny list it refuses every tool. `roster` as in {@link readRuleEntry}.
  */
 export declare function compileAllowList(entries: readonly string[], behavior: "allow" | "deny", roster?: ReadonlySet<string>): {
     rows: Array<{
@@ -135,7 +126,9 @@ export declare const AUTO_STRIPPED_PROGRAMS: readonly ["python", "python3", "pyt
  * disclosed.
  */
 export declare function autoStripped(compiled: CompiledAllowEntry, call: ToolCallRequest | undefined): boolean;
-/** {@link autoStripped} over a person's stored ALLOW row (a deny / ask row is never stripped; a path row never is). */
+/** {@link autoStripped} over a person's stored ALLOW row, read as its list twin ({@link entryOfRow}): a row is stripped exactly when
+ *  the entry spelling the same rule is (a deny / ask row never is; a row no grammar reads has no twin and is not stripped here — the
+ *  lane reads no allow it cannot parse). */
 export declare function autoStrippedRule(rule: PersistedRule, call: ToolCallRequest): boolean;
 /** One row a list matcher reads. */
 export interface AllowEntryRow {
@@ -275,6 +268,10 @@ export declare function screenAllowedToolsValue(value: unknown, seat: AllowedToo
 /** The disclosure record for one member, minted from the entries it matched: each sanitized (deployment or model-authored
  *  text on a human trust boundary) and capped, the rest counted. */
 export declare function allowRuleShadowOf(member: AllowRuleMember, entries: readonly string[]): AllowRuleShadow;
+/** A disclosure list with one more member's record folded in: ONE record per member — a member already disclosed gains the
+ *  other record's entries after its own (every speaking, in reading order: two shown names that read alike are two speakers),
+ *  the cap kept and the rest counted; any other member is appended. Records are minted values already ({@link allowRuleShadowOf}). */
+export declare function withAllowRuleShadow(list: readonly AllowRuleShadow[], shadow: AllowRuleShadow): AllowRuleShadow[];
 /** Read a disclosure value off a decision WITHOUT trusting it (a policy's own value, an ancestor's): every record a known
  *  member with a list of strings, or nothing — a display member must never throw where a card is minted. */
 export declare function readAllowRuleShadows(value: unknown): readonly AllowRuleShadow[] | undefined;
@@ -325,8 +322,9 @@ export declare function allowRuleShadowSentence(shadows: readonly AllowRuleShado
     authoredBy?: "deployment";
     probeReason?: string;
 }): string;
-/** The card's two disclosure members off a surviving ask, minted at every station that builds an approval request: the
- *  sanitized records, and the message with the sentence rendered onto it. */
+/** The card's disclosure members off a surviving ask, minted at every station that builds an approval request: the
+ *  sanitized records, the message with the sentence rendered onto it, and the outlet of a person's rewritten edit (the
+ *  approved-edit pass's own member, whose form is the bytes the card presents). */
 export declare function cardDisclosureOf(decision: {
     message?: string;
     allowRuleShadowed?: unknown;
@@ -334,9 +332,11 @@ export declare function cardDisclosureOf(decision: {
     mandate?: PersistedRuleMandate;
     authoredBy?: "deployment";
     probeReason?: string;
+    editRewritten?: EditRewritten;
 }, fallbackMessage: string): {
     message: string;
     allowRuleShadowed?: readonly AllowRuleShadow[];
+    editRewritten?: EditRewritten;
 };
 /** The notice for list entries that grant (or refuse) nothing — one code for every list. */
 export declare const ALLOWED_TOOL_NOT_GRANTED_CODE = "permission.allowed_tool_not_granted";