@sema-agent/core 7.56.0 → 7.57.0

package/dist/core/permission-rule-consent.js

@@ -1,5 +1,5 @@
 import { randomBytes } from "node:crypto";
-import { escapeForDisclosure, hasUnrenderableCharacters, parseRuleText, ruleAdmitsCommand, ruleBreadthWarningsOf, ruleToolGrammarOf, segmentCoverageOf, suggestRuleForHost, suggestRuleForName, suggestRulesForCommand, EDITED_RULE_BREADTH_WARNING_CODES, RULE_OFFER_KINDS, UNCOVERED_SEGMENT_REASONS, RULE_BEHAVIORS, RULE_BEHAVIOR_PRECEDENCE, isRuleBehavior, } from "./permission-rule-model.js";
+import { COMMAND_RULE_TOOL, cardRuleFormOf, escapeForDisclosure, hasUnrenderableCharacters, parseRuleText, ruleAdmitsCommand, ruleBreadthWarningsOf, segmentCoverageOf, suggestRuleForHost, suggestRuleForName, suggestRuleForTool, suggestRulesForCommand, EDITED_RULE_BREADTH_WARNING_CODES, RULE_OFFER_KINDS, UNCOVERED_SEGMENT_REASONS, RULE_BEHAVIORS, RULE_BEHAVIOR_PRECEDENCE, isRuleBehavior, } from "./permission-rule-model.js";
 import { readRuleOwner, sameRuleOwner } from "./rule-owner.js";
 import { principalNameOf, readPrincipal } from "./principal-name.js";
 import { isPlainRecord } from "./mods/kernel/receive.js";
@@ -236,6 +236,12 @@ function approvalRecordDamageOf(rec) {
             if (rec.kind === "card" && cand.behavior !== "allow") {
                 return `card offer ${at} references candidate ${member}, a ${cand.behavior} rule — a card mints allow candidates only`;
             }
+            if (rec.kind === "card") {
+                const read = parseRuleText(cand.rule, cand.behavior);
+                if ("rule" in read && read.rule.match === "tool" && (typeof rec.command === "string" || cardRuleFormOf(read.rule.tool) !== "tool")) {
+                    return `card offer ${at} references candidate ${member}, the whole-tool rule "${escapeForDisclosure(read.rule.rule)}" — the engine mints one only on the whole-tool card of a tool with no rule grammar`;
+                }
+            }
             if (!isValidConsentScope(cand.scope)) {
                 return `offer ${at} references candidate ${member}, whose scope is not a consent-face scope (global, project, or session)`;
             }
@@ -262,7 +268,7 @@ function approvalRecordDamageOf(rec) {
                 }
                 if (detail.length > 0) {
                     const rows = detail;
-                    const table = typeof rec.command === "string" ? segmentCoverageOf(rec.command, { persisted: [] }, { tool: CARD_RULE_TOOL, cwd: undefined }) : undefined;
+                    const table = typeof rec.command === "string" ? segmentCoverageOf(rec.command, { persisted: [] }, { tool: COMMAND_RULE_TOOL, cwd: undefined }) : undefined;
                     if (table === undefined) {
                         return `card batch offer ${at} carries reason rows but the record's command cannot back them — a row without a readable source command is a row nobody can audit`;
                     }
@@ -379,10 +385,10 @@ export async function prepareCardApproval(opts) {
         e.code = "config.invalid_argument";
         throw e;
     }
-    const grammar = ruleToolGrammarOf(opts.toolName);
-    const oneRuleCard = grammar === "name" || grammar === "domain" ? grammar : undefined;
-    if (opts.toolName !== CARD_RULE_TOOL && oneRuleCard === undefined)
+    const form = cardRuleFormOf(opts.toolName);
+    if (form === undefined)
         return undefined;
+    const oneRuleCard = form === "command" ? undefined : form;
     const scope = (() => {
         if (opts.scope !== undefined) {
             if (!isValidConsentScope(opts.scope)) {
@@ -409,14 +415,14 @@ export async function prepareCardApproval(opts) {
         try {
             const view = await effectiveOrThrow(storeForOwner(opts.deps.provider, owner), opts.sessionId !== undefined ? { sessionId: opts.sessionId } : undefined);
             const table = view.rules;
-            coverage = segmentCoverageOf(opts.command, { persisted: table }, { tool: CARD_RULE_TOOL, cwd: opts.cwd, sessionId: opts.sessionId, ...(opts.execCwd !== undefined ? { execCwd: opts.execCwd } : {}) });
+            coverage = segmentCoverageOf(opts.command, { persisted: table }, { tool: COMMAND_RULE_TOOL, cwd: opts.cwd, sessionId: opts.sessionId, ...(opts.execCwd !== undefined ? { execCwd: opts.execCwd } : {}) });
         }
         catch {
             coverage = undefined;
         }
     }
     const suggested = oneRuleCard !== undefined
-        ? [oneRuleCard === "name" ? suggestRuleForName(opts.toolName, opts.command) : suggestRuleForHost(opts.toolName, opts.command)].filter((o) => o !== undefined)
+        ? [oneRuleCard === "name" ? suggestRuleForName(opts.toolName, opts.command) : oneRuleCard === "domain" ? suggestRuleForHost(opts.toolName, opts.command) : opts.command === "" ? suggestRuleForTool(opts.toolName) : undefined].filter((o) => o !== undefined)
         : suggestRulesForCommand(opts.command, {
             ...(coverage !== undefined ? { coverage } : {}),
             scope,
@@ -468,7 +474,6 @@ export async function prepareCardApproval(opts) {
         candidates,
     };
 }
-const CARD_RULE_TOOL = "Bash";
 export async function confirmRuleApproval(opts) {
     const caller = resolveCallerOwner(opts.principal, opts.owner, "confirmRuleApproval");
     const no = (reason, detail) => ({
@@ -546,6 +551,9 @@ function checkEditedRuleText(text, command) {
     const parsed = parseSubmittedSpelling(text);
     if ("reject" in parsed)
         return { ok: false, code: parsed.reject.code, message: parsed.reject.message };
+    if (parsed.rule.match === "tool") {
+        return { ok: false, message: `the edited rule "${parsed.rule.rule}" names the whole tool — a card's edit names a command rule, and a standing yes to every command is not one a card mints` };
+    }
     if (!ruleAdmitsCommand(parsed.rule, command)) {
         return {
             ok: false,
@@ -838,18 +846,15 @@ export async function prepareCcImport(opts) {
                     skipped.push({ rule: String(entry), reason: `settings ${behavior} entry is not a string` });
                     continue;
                 }
-                if (!/^[A-Za-z][A-Za-z0-9_]*\(.*\)$/.test(entry)) {
-                    const reason = /^[A-Za-z][A-Za-z0-9_-]*$/.test(entry)
-                        ? "unsupported.form: a bare tool-name entry is a name-set item, not a command rule — it stays in the settings file, unimported"
-                        : "unsupported.form: not a command rule spelling this version imports — it stays in the settings file, unimported";
-                    skipped.push({ rule: entry, reason });
-                    continue;
-                }
                 const parsed = parseRuleText(entry, behavior);
                 if ("reject" in parsed) {
                     skipped.push({ rule: entry, reason: `${parsed.reject.code}: ${parsed.reject.message}` });
                     continue;
                 }
+                if (parsed.rule.match === "tool") {
+                    skipped.push({ rule: entry, reason: "unsupported.form: a bare tool-name entry is a name-set item the host carries from the settings layer's own lists — it stays in the settings file, unimported" });
+                    continue;
+                }
                 if (candidates.some((c) => c.behavior === behavior && c.rule === parsed.rule.rule && sameScope(c.scope, scope)))
                     continue;
                 candidates.push({ behavior, rule: parsed.rule.rule, scope });

package/dist/core/permission-rule-model.d.ts

@@ -77,6 +77,7 @@ import { type DenyFace } from "../tools/fs/read-deny.js";
 import type { AssertAllKeysHandled, RuleOffersAbsence } from "./ask-origin.js";
 import { type ToolCallLike } from "./tool-registry.js";
 import { type HostReading } from "./host-target.js";
+import { type NamedCall } from "./tool-name-readings.js";
 import { type PathDenialEvidence, type PathFamily, type PathIdentity } from "../tools/fs/safety.js";
 import { type TargetViews } from "./path-rule-binding.js";
 /**
@@ -284,6 +285,18 @@ export declare const DOMAIN_RULE_MARKER = "domain:";
  */
 export type RuleGrammar = "command" | "path" | "name" | "domain";
 export declare function ruleToolGrammarOf(toolName: string): RuleGrammar | undefined;
+/**
+ * THE rule a tool's approval card mints a "don't ask again" option in — one answer, read by the offer factory and the consent door
+ * alike: `command` for the command rule word (the shell card's command rules), `name` / `domain` for a tool of those grammars (the one
+ * exact value rule), `tool` for a call no rule word speaks for under any name it answers to ({@link laneToolNamesOf} empty: the
+ * whole-tool rule, the reference's fallback card), and `undefined` for the rest — a path tool (no path offer is minted), a shell-face
+ * sibling of the command word (its commands are `Bash(…)` rules), and a tool that answers to one of those under an alias it declares
+ * (a caller's shell wearing `Bash`: a one-click whole-tool yes on it would be a licence for every program): its card names that it has
+ * no rule to offer. `toolName` is the wire name the card mints on; `call` the call's names (absent: the wire name alone — the
+ * consent door, which holds no face).
+ */
+export type CardRuleForm = "command" | "name" | "domain" | "tool";
+export declare function cardRuleFormOf(toolName: string, call?: NamedCall): CardRuleForm | undefined;
 /** The parameter a shell-face tool's rule content names as one of the tool's own scalar arguments (`Monitor(description:*)`,
  *  `Bash(timeout:5)`), or undefined — the content is then a command spelling. */
 export declare function shellRuleParamOf(tool: string, content: string): string | undefined;
@@ -311,11 +324,11 @@ export declare function nameRuleSubjectOf(toolName: string, args: unknown): stri
  *  domain tool's its own name — so a stored `Bash(…)` or `Edit(…)` row reaches a tool that answers to that name under another wire
  *  name, as a policy's rule does. Every lane that judges a call by a rule's word reads it here: the policy compiler, the
  *  person's stored rows, the org partition, the allow lists. Empty ⇒ no grammar speaks for the call. */
-export declare function laneToolNamesOf(req: Pick<import("./tool-policy.js").ToolCallRequest, "toolName" | "face">): readonly string[];
+export declare function laneToolNamesOf(req: NamedCall): readonly string[];
 /** The match words a persisted rule is stored with, spelled once: {@link PersistedRuleMatch} is derived from this
  *  tuple (each form is documented there). A store backend that checks a stored row's `match` reads this value
  *  rather than keeping its own list. */
-export declare const PERSISTED_RULE_MATCHES: readonly ["exact", "prefix", "wildcard", "pattern", "subpath", "path", "name", "name_prefix", "host", "subdomain"];
+export declare const PERSISTED_RULE_MATCHES: readonly ["exact", "prefix", "wildcard", "pattern", "subpath", "path", "name", "name_prefix", "host", "subdomain", "tool"];
 /**
  * Match forms, one family per grammar (`prefix` and `wildcard` are one predicate):
  *  · `exact` — admits the one string the rule spells.
@@ -347,6 +360,8 @@ export declare const PERSISTED_RULE_MATCHES: readonly ["exact", "prefix", "wildc
  *  · `name` / `name_prefix` — the NAME grammar ({@link parseNameRuleContent}).
  *  · `host` / `subdomain` — the DOMAIN grammar ({@link parseDomainRuleContent}): one exact host, or every
  *    host below one domain.
+ *  · `tool` — the WHOLE-TOOL form, a rule with no content (`SendUserFile`, `Bash`, `mcp__srv__get_issue`), on any tool:
+ *    `command` is empty and the rule reaches every call that answers to the name it spells ({@link wholeToolRuleReaches}).
  */
 export type PersistedRuleMatch = (typeof PERSISTED_RULE_MATCHES)[number];
 /**
@@ -1275,6 +1290,32 @@ export declare function adjudicatePersistedDomainRules(rules: readonly Persisted
     sessionId?: string;
     scopeIdentity?: ScopeRootIdentity;
 }): PersistedRuleVerdict | undefined;
+/**
+ * THE predicate of a whole-tool rule (`match: "tool"`) over one call: the rule reaches the call iff the call answers to the name it
+ * spells, under every name the call answers to (the model's spelling, the wire name, the aliases that resolve to it) — the
+ * reference's tool-wide matcher. Every reader of a rule with no content asks it: an entry list's whole-tool row and a person's stored
+ * whole-tool row alike.
+ */
+export declare function wholeToolRuleReaches(tool: string, call: NamedCall): boolean;
+/**
+ * The whole-tool sibling of {@link adjudicatePersistedRules}: the same precedence walk (deny > ask > allow) over the whole-tool rows
+ * (`match: "tool"`) that reach the call ({@link wholeToolRuleReaches}) and are eligible under their own tool ({@link eligiblePersisted},
+ * the one predicate); the first behavior with such a row decides, the first table-order row of it is the answer.
+ */
+export declare function adjudicatePersistedToolRules(rules: readonly PersistedRule[], call: {
+    request: NamedCall;
+    cwd: string | undefined;
+    sessionId?: string;
+    scopeIdentity?: ScopeRootIdentity;
+}): PersistedRuleVerdict | undefined;
+/**
+ * The ONE offer the card of a tool with no rule grammar carries ({@link cardRuleFormOf} `tool`): the whole-tool rule on its name (the
+ * reference's fallback card, "don't ask again for <tool>"), or undefined when the name has no such rule (the round-trip law: the bare
+ * name, parsed back as an allow, must be the whole-tool rule on that very name).
+ */
+export declare function suggestRuleForTool(tool: string): Extract<RuleOffer, {
+    kind: "single";
+}> | undefined;
 /**
  * The ONE offer a host tool's approval card carries: the exact rule for the host the call reaches (`WebFetch(domain:<host>)`, the
  * reference's "don't ask again for <host>" row), or undefined when no rule spells exactly that host (the round-trip law: the

package/dist/core/permission-rule-model.js

@@ -2,13 +2,15 @@ import { homedir } from "node:os";
 import { shellWordsOf } from "../shell/shell-words.js";
 import { lexShell } from "../shell/lex.js";
 import { readProgramPosition } from "../tools/fs/bash-program-position.js";
-import { parsePermissionRule, ruleSpellingOf } from "./permission-rule-syntax.js";
+import { isNameableToolName, parsePermissionRule, ruleSpellingOf } from "./permission-rule-syntax.js";
+import { isCoveringRuleName } from "./namespaced-rule-name.js";
+import { toolNameFaultOf } from "./tool-name-aliases.js";
 import { compileReadDeny } from "../tools/fs/read-deny.js";
 import { carriesShellRedirection, parseLeadingCommandName, splitShellCompoundSegments } from "../tools/fs/bash-readonly-classifier.js";
 import { INLINE_TRUNCATION_MARK, inlineUntrusted } from "./untrusted-text.js";
-import { catalogRuleFaceOf, hostTargetOf, isShellFaceToolName, pathTargetOf, protectivePathTargetOf } from "./tool-registry.js";
+import { catalogRuleFaceOf, catalogToolNames, hostTargetOf, isShellFaceToolName, pathTargetOf, protectivePathTargetOf } from "./tool-registry.js";
 import { HOST_UNREADABLE_SENTENCE, hostPatternAdmits, readHostPattern, spelledHostPattern } from "./host-target.js";
-import { heldValues } from "./tool-name-readings.js";
+import { heldBy, heldValues } from "./tool-name-readings.js";
 import { carriesDotSegment, isAbsoluteForFamily, isIdentityDir, isPathIdentity, isShellRootedSpellingUnmapped, isUncIdentity, pathFamilyOf, pathIdentityOf } from "../tools/fs/safety.js";
 import { bindPathRules, judgeRuleRows, rowsWhereTheyLead } from "./path-rule-binding.js";
 import { readShellCommand } from "./shell-run-candidates.js";
@@ -135,6 +137,14 @@ export function ruleToolGrammarOf(toolName) {
         return "domain";
     return pathTargetOf(toolName) !== undefined ? "path" : undefined;
 }
+export function cardRuleFormOf(toolName, call = { toolName }) {
+    if (toolName === COMMAND_RULE_TOOL)
+        return "command";
+    const grammar = ruleToolGrammarOf(toolName);
+    if (grammar === "name" || grammar === "domain")
+        return grammar;
+    return grammar === undefined && laneToolNamesOf(call).length === 0 && laneToolNamesOf({ toolName }).length === 0 ? "tool" : undefined;
+}
 export function shellRuleParamOf(tool, content) {
     const colon = content.indexOf(":");
     if (colon <= 0)
@@ -172,7 +182,7 @@ function ruleWordOf(name) {
         return COMMAND_RULE_TOOL;
     return ruleToolGrammarOf(name) !== undefined ? name : undefined;
 }
-export const PERSISTED_RULE_MATCHES = Object.freeze(["exact", "prefix", "wildcard", "pattern", "subpath", "path", "name", "name_prefix", "host", "subdomain"]);
+export const PERSISTED_RULE_MATCHES = Object.freeze(["exact", "prefix", "wildcard", "pattern", "subpath", "path", "name", "name_prefix", "host", "subdomain", "tool"]);
 function isCommandMatch(match) {
     return match === "exact" || match === "prefix" || match === "wildcard" || match === "pattern";
 }
@@ -415,6 +425,19 @@ export function respelledRuleTextOf(text, behavior) {
     const read = parseRuleText(candidate, behavior);
     return "rule" in read ? read.rule.rule : undefined;
 }
+function parseWholeToolRule(text, tool, behavior) {
+    if (!isNameableToolName(tool) || isCoveringRuleName(tool, behavior)) {
+        return reject("invalid.grammar", `"${text}" names a set of tools — a stored rule names one tool, or one tool's content; a set of tools is a list entry's form`);
+    }
+    const fault = toolNameFaultOf(tool, catalogToolNames(), behavior);
+    if (fault === undefined)
+        return { rule: { behavior, rule: tool, tool, match: "tool", command: "" } };
+    const why = fault.reason === "near_miss"
+        ? `is another spelling of "${fault.currentName}", which the engine's tool catalog names — a rule names its tool exactly as spelled, so this one would reach no tool`
+        : `names no tool under that name${fault.guidance !== undefined ? ` — ${fault.guidance}` : ""}`;
+    const write = fault.currentName !== undefined && !why.includes(`"${fault.currentName}"`) ? `; write "${fault.currentName}"` : "";
+    return reject("unsupported.tool", `"${text}" ${why}${write}`);
+}
 export function parseRuleText(text, behavior) {
     if (!isRuleBehavior(behavior)) {
         return reject("invalid.grammar", `rule "${text}" was parsed under behavior ${escapeForDisclosure(behavior)}, which is not one of ${RULE_BEHAVIORS.join("/")}`);
@@ -438,9 +461,8 @@ export function parseRuleText(text, behavior) {
         };
     }
     const ruleContent = ruleContentOf(parsed);
-    if (ruleContent === undefined) {
-        return reject("invalid.grammar", `"${text}" is not a Tool(content) rule — a bare tool name claims the whole tool and is not a command rule`);
-    }
+    if (ruleContent === undefined)
+        return parseWholeToolRule(text, parsed.toolName, behavior);
     if (parsed.toolName !== COMMAND_RULE_TOOL) {
         const grammar = ruleToolGrammarOf(parsed.toolName);
         if (grammar === undefined) {
@@ -510,6 +532,8 @@ export function parseRuleText(text, behavior) {
     return { rule: { behavior, rule: formatRuleText(command, match, COMMAND_RULE_TOOL), tool: COMMAND_RULE_TOOL, match, command } };
 }
 export function formatRuleText(command, match, tool) {
+    if (match === "tool")
+        return tool;
     if (match === "subpath")
         return `${tool}(//${command.startsWith("/") ? command.slice(1) : command}/**)`;
     if (match === "path")
@@ -1318,7 +1342,7 @@ export function commandCoverageOf(rules, call) {
     return covering.length > 0 ? { covering } : { uncovered: undefined };
 }
 function readsOnlyAsSegment(segment, lineObjection, whole) {
-    return lineObjection === undefined && !movesShellCursor(segment) && readOnlyShellVerdict(segment, undefined, undefined, () => lineDescriptorsOfText(whole)).readOnly;
+    return lineObjection === undefined && !movesShellCursor(segment) && readOnlyShellVerdict(segment, { bound: () => lineDescriptorsOfText(whole) }).readOnly;
 }
 function firstEligibleDirectoryRule(rules, directory, call) {
     for (const rule of rules) {
@@ -1434,6 +1458,26 @@ export function adjudicatePersistedDomainRules(rules, call) {
     }
     return undefined;
 }
+export function wholeToolRuleReaches(tool, call) {
+    return heldBy("policy.persistedToolRule", { has: (name) => name === tool }, call);
+}
+export function adjudicatePersistedToolRules(rules, call) {
+    const at = { cwd: call.cwd, ...(call.sessionId !== undefined ? { sessionId: call.sessionId } : {}), ...(call.scopeIdentity !== undefined ? { scopeIdentity: call.scopeIdentity } : {}) };
+    for (const behavior of RULE_BEHAVIORS_BY_PRECEDENCE) {
+        const row = rules.find((rule) => rule.match === "tool" && wholeToolRuleReaches(rule.tool, call.request) && eligiblePersisted(rule, { ...at, tool: rule.tool }, behavior));
+        if (row !== undefined)
+            return { behavior, rules: [row] };
+    }
+    return undefined;
+}
+export function suggestRuleForTool(tool) {
+    if (cardRuleFormOf(tool) !== "tool")
+        return undefined;
+    const parsed = parseRuleText(formatRuleText("", "tool", tool), "allow");
+    if (!("rule" in parsed) || parsed.rule.match !== "tool" || parsed.rule.tool !== tool)
+        return undefined;
+    return { kind: "single", rule: parsed.rule.rule, match: "tool", command: "" };
+}
 export function suggestRuleForHost(tool, host) {
     if (ruleToolGrammarOf(tool) !== "domain")
         return undefined;

package/dist/core/permission-rule-org.js

@@ -301,7 +301,7 @@ function readOrgRow(row, index) {
     const parsed = parseRuleText(text, said);
     if ("reject" in parsed)
         return unreadable(parsed.reject.code, undefined, parsed.reject.respelling);
-    if (parsed.rule.tool !== COMMAND_RULE_TOOL)
+    if (parsed.rule.tool !== COMMAND_RULE_TOOL || parsed.rule.match === "tool")
         return unreadable("unsupported.tool");
     return { kind: "read", index, rule: text, behavior: said, parsed: parsed.rule };
 }

package/dist/core/protocol-http-auth.d.ts

@@ -14,6 +14,7 @@
  * declared headers follows no redirect, {@link carriesDeclaredHeaders}).
  */
 import type { ProtocolId } from "./protocol-table.js";
+import { type Egress } from "./untrusted-egress.js";
 /** The per-peer HTTP auth declaration every protocol spec carries in the same two fields. */
 export interface ProtocolHttpAuth {
     headers?: Record<string, string>;
@@ -53,10 +54,23 @@ export declare function declaredHeaderValues(transport: unknown, principal?: str
  * from outside takes its own range and the member's value goes with it. A declared value that is also an ordinary word or number (`en`, `1`,
  * `application/json`) goes wherever it occurs in the remote's words, in any case — a legibility cost, never a leak; the failure's closed
  * fields (code, status, delivery) are not text. A declaration too large for one matcher (tens of thousands of characters, which no header
- * carries) makes the whole text the marker: the pass never throws and never shows what it could not match. Run BEFORE the credential
- * vocabulary: that pass rewrites parts of a value, after which the value no longer matches whole.
+ * carries) makes the whole text the marker: the pass never throws and never shows what it could not match. A hit that lies wholly inside
+ * a marker a pass already wrote (the exact literals, `redactionMarkerSpans`) is no hit, and one that reaches into a marker takes the
+ * whole marker with it, so the pass over its own output answers the same text.
  */
 export declare function scrubRequestEcho(text: string, declared: readonly string[]): string;
+/**
+ * THE one form a remote endpoint's words take when the engine carries them in its own words — an MCP server's failure, a model
+ * provider's error body, frame or transport failure, a memory distiller seat's failure: what the request was declared with
+ * ({@link scrubRequestEcho}: `declared` is required, so no mint reads a remote's words without naming its request), then the credential
+ * vocabulary. Words with no declared value in them read exactly as the vocabulary renders them. Where a declared value is there, the
+ * values the vocabulary finds in the ORIGINAL words are taken out with it, so neither disarms the other: removing a declared `Bearer`
+ * cannot hide the token after it from the vocabulary, and the vocabulary rewriting part of a declared value cannot leave the rest. A
+ * caller that bounds the text for display cuts what this returns, never the remote's raw words, so a cut can leave no part of a value.
+ * The function is a fixed point (its own output answers the same text). A store, a log or an event lane that receives the result does
+ * not redact again: persistence is not an exit, the mint is.
+ */
+export declare function remoteWords(text: string, declared: readonly string[]): Egress<"same-principal">;
 /** Whether a resolved header set carries anything the declaration bound to its endpoints — a request that does follows no redirect (the
  *  next hop is not a declared endpoint; A2A's follow law reads this). */
 export declare function carriesDeclaredHeaders(headers: Record<string, string> | undefined): boolean;

package/dist/core/protocol-http-auth.js

@@ -1,5 +1,6 @@
 import { authSchemeCredentials, credentialHeaderValues, holdOwnCredentialValues } from "./secret-env.js";
 import { readMember } from "./thrown-value.js";
+import { egressText, redactionMarkerSpans } from "./untrusted-egress.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 export function headerOwnershipCollision(t) {
     const owners = new Map();
@@ -106,17 +107,7 @@ function structuredEnd(text, at) {
     return text.length;
 }
 export function scrubRequestEcho(text, declared) {
-    const forms = new Set();
-    for (const value of declared)
-        for (const spelling of requestEchoSpellings(value))
-            forms.add(spelling);
-    forms.delete("");
-    const members = cookieMembers(text);
-    const removed = members.map(([, from, end]) => [from, end]);
-    for (const hit of valueHits(text, [...forms])) {
-        if (!members.some(([name, from]) => hit[0] >= name && hit[1] <= from))
-            removed.push(hit);
-    }
+    const removed = requestEchoRanges(text, declared);
     if (removed.length === 0)
         return text;
     removed.sort((a, b) => a[0] - b[0] || b[1] - a[1]);
@@ -132,6 +123,46 @@ export function scrubRequestEcho(text, declared) {
     }
     return out + text.slice(kept);
 }
+function requestEchoRanges(text, declared) {
+    const forms = new Set();
+    for (const value of declared)
+        for (const spelling of requestEchoSpellings(value))
+            forms.add(spelling);
+    forms.delete("");
+    const members = cookieMembers(text);
+    const removed = members.map(([, from, end]) => [from, end]);
+    const markers = redactionMarkerSpans(text);
+    for (const hit of valueHits(text, [...forms])) {
+        if (members.some(([name, from]) => hit[0] >= name && hit[1] <= from))
+            continue;
+        if (markers.some(([from, end]) => hit[0] >= from && hit[1] <= end))
+            continue;
+        const reach = markers.filter(([from, end]) => hit[0] < end && hit[1] > from);
+        removed.push([Math.min(hit[0], ...reach.map(([from]) => from)), Math.max(hit[1], ...reach.map(([, end]) => end))]);
+    }
+    return removed;
+}
+function vocabularyValues(text) {
+    const report = { findings: [] };
+    egressText("same-principal", text, report);
+    return report.findings.map(({ span: [from, end] }) => {
+        const found = text.slice(from, end);
+        const rendered = egressText("same-principal", found);
+        let head = 0;
+        while (head < found.length && head < rendered.length && found[head] === rendered[head])
+            head++;
+        let tail = 0;
+        while (tail < found.length - head && tail < rendered.length - head && found[found.length - 1 - tail] === rendered[rendered.length - 1 - tail])
+            tail++;
+        const value = found.slice(head, found.length - tail);
+        return value === "" ? found : value;
+    });
+}
+export function remoteWords(text, declared) {
+    if (requestEchoRanges(text, declared).length === 0)
+        return egressText("same-principal", text);
+    return egressText("same-principal", scrubRequestEcho(text, [...declared, ...vocabularyValues(text)]));
+}
 function cookieMembers(text) {
     const members = [];
     const pattern = new RegExp(COOKIE_START, "g");

package/dist/core/protocol-naming.d.ts

@@ -60,6 +60,26 @@ export declare function findNamespacePrefixCollision(ns: ProtocolNamespace, peer
     prefix: string;
     peers: [string, string];
 } | undefined;
+/**
+ * EVERY peer in `peers` that mints a {@link mintNamespacePrefix} an earlier peer already minted, in list order, each paired with the
+ * FIRST peer that holds the prefix — empty when every peer owns its own. {@link findNamespacePrefixCollision} is its first row: one
+ * piece of arithmetic answers both the question "is there a collision" and the question "which names, all of them".
+ */
+export declare function findNamespacePrefixCollisions(ns: ProtocolNamespace, peers: readonly string[]): Array<{
+    prefix: string;
+    peers: [string, string];
+}>;
+/**
+ * One peer's claim ledger for tool names: the function it returns takes a REMOTE tool name, mints its wire name
+ * ({@link mintNamespacedToolName}) and answers `{ minted }` when the name is free, or `{ minted, heldBy }` when an earlier call
+ * already minted it — `heldBy` is the RAW name that took it first (it keeps the name; the ledger never re-binds). A listing's
+ * intake and a judge over declared names ask the same ledger; `heldBy === tool` (the same raw name again) stays distinguishable
+ * from two different raw names that folded together.
+ */
+export declare function createToolNameClaims(ns: ProtocolNamespace, peer: string): (tool: string) => {
+    minted: string;
+    heldBy?: string;
+};
 /**
  * The full registered name for `(peer, tool)` in `ns`. Always starts with {@link mintNamespacePrefix}'s
  * answer for the same peer (the invariant ticket #9's pins hold), and never exceeds

package/dist/core/protocol-naming.js

@@ -27,15 +27,32 @@ export function mintNamespacePrefix(ns, peer) {
     return `${ns.prefix}${settlePeerSegment(clampNameSegment(normalizeNameSegment(peer), peerBudget))}${NAME_SEP}`;
 }
 export function findNamespacePrefixCollision(ns, peers) {
+    return findNamespacePrefixCollisions(ns, peers)[0];
+}
+export function findNamespacePrefixCollisions(ns, peers) {
     const seen = new Map();
+    const collisions = [];
     for (const peer of peers) {
         const prefix = mintNamespacePrefix(ns, peer);
         const first = seen.get(prefix);
-        if (first !== undefined)
-            return { prefix, peers: [first, peer] };
+        if (first !== undefined) {
+            collisions.push({ prefix, peers: [first, peer] });
+            continue;
+        }
         seen.set(prefix, peer);
     }
-    return undefined;
+    return collisions;
+}
+export function createToolNameClaims(ns, peer) {
+    const held = new Map();
+    return (tool) => {
+        const minted = mintNamespacedToolName(ns, peer, tool);
+        const heldBy = held.get(minted);
+        if (heldBy !== undefined)
+            return { minted, heldBy };
+        held.set(minted, tool);
+        return { minted };
+    };
 }
 export function mintNamespacedToolName(ns, peer, tool) {
     const prefix = mintNamespacePrefix(ns, peer);

package/dist/core/read-only-shell.d.ts

@@ -8,6 +8,20 @@ export type ReadOnlyShellVerdict = {
     readonly readOnly: false;
     readonly reason: string;
 };
+/** How a caller asks: a shape it already read, the session's working directory, the whole line's descriptor
+ *  bindings when it judges one segment of a longer line, and the deployment's programs. */
+export interface ReadOnlyShellOptions {
+    /** The command already read with {@link readShellCommand} (the gate reads every shell command once). */
+    readonly shape?: ShellCommandShape | undefined;
+    /** Where the session stands: a `cd` beside a `git` that lands here is no line objection. */
+    readonly cwd?: string | undefined;
+    /** The descriptor bindings of the WHOLE line, for a caller that judges one segment of it. */
+    readonly bound?: LineDescriptors | (() => LineDescriptors) | undefined;
+    /** The programs a deployment lets a face run: every program the line names (each segment's program past a `command` /
+     *  `builtin` prefix, and the program an `xargs` segment hands its input to) must be one of them, else the
+     *  line is not read-only for that face. It only ever narrows — a program here whose call writes is still not read-only. */
+    readonly readers?: ReadonlySet<string> | undefined;
+}
 /** The reference implementation's question for a compound that changes directory and runs git (`cd-git-compound`). */
 export declare const CD_GIT_COMPOUND_SENTENCE = "This command changes directory before running a version-control command, which can pick up untrusted hooks or repository configuration from the target directory. Approve only if you trust it.";
 /**
@@ -17,8 +31,8 @@ export declare const CD_GIT_COMPOUND_SENTENCE = "This command changes directory
  */
 export declare function changesDirectoryBeforeGit(shape: ShellCommandShape, cwd?: string): boolean;
 /**
- * Read `command` as the allow layer must: read-only, or the first reason it is not. A shape already read by
- * the caller may be handed in (the gate reads every shell command once).
+ * Read `command` as every read-only consumer must: read-only, or the first reason it is not. A shape already read
+ * by the caller may be handed in (the gate reads every shell command once).
  *
  * @contract read_only_shell.every_segment — a command line is read-only iff the lexer reads it whole (no
  * unreadable segment, no group/subshell/control structure, no background `&`), no word anywhere carries a
@@ -30,10 +44,11 @@ export declare function changesDirectoryBeforeGit(shape: ShellCommandShape, cwd?
  * the exact forms, `echo`/`ls`/`cd`/`find`/`printf`/`history`/`arch`/`ifconfig`); else the flag-vetted
  * table with its per-row danger predicates, and the `uniq`/`jq` forms. A `cd` beside a `git` in one line
  * is never read-only (the git command's repository is then not the session's) unless the `cd` lands where the session
- * stands ({@link changesDirectoryBeforeGit}). Anything the reading does not positively admit is NOT read-only — the
- * answer is never a guess, and a `false` costs one question.
+ * stands ({@link changesDirectoryBeforeGit}). Given {@link ReadOnlyShellOptions.readers}, a program the line names
+ * outside them is an objection of its own, met where the reading meets the program. Anything the reading does not
+ * positively admit is NOT read-only — the answer is never a guess, and a `false` costs one question.
  */
-export declare function readOnlyShellVerdict(command: string, shape?: ShellCommandShape, cwd?: string, bound?: LineDescriptors | (() => LineDescriptors)): ReadOnlyShellVerdict;
+export declare function readOnlyShellVerdict(command: string, opts?: ReadOnlyShellOptions): ReadOnlyShellVerdict;
 /**
  * The reader's LINE-level objection to `command` — what makes no segment of it read-only in its place, whatever the
  * segment reads on its own: the line's structure, or a `cd` beside a `git` ({@link changesDirectoryBeforeGit}). A caller