@sema-agent/core 7.6.0 → 7.6.2

package/dist/core/gate-lanes.js

@@ -0,0 +1,626 @@
+import { decisionText, describeThrown } from "./tool-policy.js";
+import { askOriginOf, classifierMayAnswer } from "./ask-origin.js";
+import { denialLimitFallbackMessage, unarmedWindow } from "./auto-mode.js";
+import { inlineUntrusted } from "./untrusted-text.js";
+import { ASK_USER_QUESTION_TOOL_NAME } from "./ask-question.js";
+import { ORG_ADJUDICATION_TIMEOUT_MS, ORG_RULE_DECISION_REASON, ORG_UNAVAILABLE_DECISION_REASON, settleOrgVerdictWithin } from "./permission-rule-org.js";
+import { exitGate, traceHookCrash } from "./runner/gate-exit.js";
+function isPlainOwnRecord(x) {
+    try {
+        if (x === null || typeof x !== "object" || Array.isArray(x))
+            return false;
+        const p = Object.getPrototypeOf(x);
+        return p === Object.prototype || p === null;
+    }
+    catch {
+        return false;
+    }
+}
+function ownDataValue(obj, key) {
+    try {
+        const d = Object.getOwnPropertyDescriptor(obj, key);
+        return d && "value" in d ? d.value : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function normalizeOrgGateVerdict(answer, unreadable) {
+    const clean = (v) => Object.assign(Object.create(null), v);
+    const readable = (x) => {
+        try {
+            return x !== null && (typeof x === "object" || typeof x === "function") && !Array.isArray(x);
+        }
+        catch {
+            return false;
+        }
+    };
+    if (!readable(answer))
+        return clean({ status: "unavailable", disclosures: [unreadable] });
+    const status = ownDataValue(answer, "status");
+    if (status === "unavailable") {
+        const disclosures = ownDataValue(answer, "disclosures");
+        let lines = [];
+        if (Array.isArray(disclosures)) {
+            try {
+                for (let i = 0; i < disclosures.length; i++) {
+                    const d = disclosures[i];
+                    if (typeof d === "string")
+                        lines.push(d);
+                }
+            }
+            catch {
+                lines = [];
+            }
+        }
+        return clean({ status: "unavailable", disclosures: lines.length > 0 ? lines : [unreadable] });
+    }
+    if (status !== "available")
+        return clean({ status: "unavailable", disclosures: [unreadable] });
+    const revision = ownDataValue(answer, "revision");
+    const revisionCell = typeof revision === "number" && Number.isFinite(revision) ? { revision } : {};
+    const verdict = ownDataValue(answer, "verdict");
+    if (verdict === undefined)
+        return clean({ status: "available", ...revisionCell });
+    if (!readable(verdict))
+        return clean({ status: "unavailable", disclosures: [unreadable] });
+    const behavior = ownDataValue(verdict, "behavior");
+    const rule = ownDataValue(verdict, "rule");
+    if ((behavior !== "deny" && behavior !== "ask") || typeof rule !== "string")
+        return clean({ status: "unavailable", disclosures: [unreadable] });
+    return clean({ status: "available", verdict: clean({ behavior: behavior, rule }), ...revisionCell });
+}
+function copiedUsableDots(dots) {
+    let copied;
+    try {
+        if (Array.isArray(dots)) {
+            const walked = [];
+            for (let i = 0; i < dots.length; i++) {
+                const d = dots[i];
+                walked.push(isPlainOwnRecord(d) ? { actor: ownDataValue(d, "actor"), counter: ownDataValue(d, "counter") } : { actor: undefined, counter: undefined });
+            }
+            copied = walked;
+        }
+    }
+    catch {
+        copied = undefined;
+    }
+    const usable = copied?.every((d) => typeof d.actor === "string" && typeof d.counter === "number" && Number.isFinite(d.counter)) === true && copied.length > 0;
+    return usable ? { dots: copied } : {};
+}
+export function normalizePersistedRuleHit(hit) {
+    if (typeof hit === "string")
+        return { hit: { rules: [{ rule: hit }] } };
+    if (!isPlainOwnRecord(hit))
+        return {};
+    if (ownDataValue(hit, "unreadable") === true)
+        return { unreadable: true };
+    const rulesRaw = ownDataValue(hit, "rules");
+    if (rulesRaw === undefined) {
+        const coverageRaw = ownDataValue(hit, "segmentCoverage");
+        let rows;
+        try {
+            if (Array.isArray(coverageRaw)) {
+                const walked = [];
+                for (let i = 0; i < coverageRaw.length; i++) {
+                    const r = coverageRaw[i];
+                    walked.push(isPlainOwnRecord(r) ? { segment: ownDataValue(r, "segment"), covered: ownDataValue(r, "covered") } : { segment: undefined, covered: undefined });
+                }
+                rows = walked.every((r) => typeof r.segment === "string" && typeof r.covered === "boolean") ? walked : undefined;
+            }
+        }
+        catch {
+            rows = undefined;
+        }
+        return rows !== undefined && rows.length > 0 ? { coverage: rows.map((r) => ({ segment: r.segment, covered: r.covered })) } : {};
+    }
+    let members;
+    try {
+        if (Array.isArray(rulesRaw)) {
+            const walked = [];
+            for (let i = 0; i < rulesRaw.length; i++) {
+                const m = rulesRaw[i];
+                walked.push(isPlainOwnRecord(m) ? { rule: ownDataValue(m, "rule"), dots: ownDataValue(m, "dots") } : { rule: undefined, dots: undefined });
+            }
+            members = walked;
+        }
+    }
+    catch {
+        members = undefined;
+    }
+    if (members === undefined || members.length === 0)
+        return {};
+    if (!members.every((m) => typeof m.rule === "string"))
+        return {};
+    return { hit: { rules: members.map((m) => ({ rule: m.rule, ...copiedUsableDots(m.dots) })) } };
+}
+export function persistedRuleMandateOf(marks) {
+    return marks.probeMandated === true
+        ? "probe_mandate"
+        : marks.egress === true
+            ? "tool_marks"
+            : marks.shellGated === true
+                ? marks.irreversibility === "always"
+                    ? "operator_always"
+                    : undefined
+                : marks.irreversibility === "always" || marks.irreversibility === "maybe"
+                    ? "tool_marks"
+                    : undefined;
+}
+function parkWith(suspendAsk, parkArgs, carry) {
+    return suspendAsk(...parkArgs, carry);
+}
+export async function runGateLanes(pass) {
+    const { input, toolName, toolCallId, callSignal, ledger, notifier, screening, adjudicate, resolveAsk, suspendAsk } = pass;
+    let orgRealApprovalRequired = false;
+    const askOriginFacts = (org) => ({
+        contentQuestion: toolName === ASK_USER_QUESTION_TOOL_NAME,
+        markedUnresolvable: input.isMarkedUnresolvable?.(input.event.toolCallId) === true,
+        org,
+        tightened: pass.tightenedBy,
+    });
+    let orgTightenCount = 0;
+    let orgEvidence = (() => {
+        const w = input.orgRules === undefined ? "not_wired" : "not_adjudicated";
+        return { revisionAbsent: w, ruleAbsent: w };
+    })();
+    const mintRuleEvidence = (personal) => ({
+        ...(orgEvidence.revision !== undefined ? { orgRevision: orgEvidence.revision } : { orgRevisionAbsent: orgEvidence.revisionAbsent ?? "not_reported" }),
+        ...(orgEvidence.rule !== undefined ? { orgRule: orgEvidence.rule } : { orgRuleAbsent: orgEvidence.ruleAbsent ?? "not_reported" }),
+        ...(personal.dots !== undefined ? { personalRuleDots: personal.dots } : { personalRuleDotsAbsent: personal.dotsAbsent ?? "not_reported" }),
+    });
+    const applyOrgLayer = async (current, args) => {
+        if (input.orgRules === undefined)
+            return { decision: current, org: undefined };
+        if (toolName === ASK_USER_QUESTION_TOOL_NAME && input.orgRules.contentAskToolMounted === true)
+            return { decision: current, org: undefined };
+        let decided = current;
+        let pending;
+        try {
+            pending = Promise.resolve(input.orgRules.adjudicate({ toolName, args, toolCallId }));
+        }
+        catch (err) {
+            pending = Promise.resolve({ status: "unavailable", disclosures: [`the org adjudication face threw before answering: ${describeThrown(err)}`] });
+        }
+        const raw = await settleOrgVerdictWithin(pending.catch((err) => ({
+            status: "unavailable",
+            disclosures: [`the org adjudication face threw: ${describeThrown(err)}`],
+        })), {
+            status: "unavailable",
+            disclosures: [`the org adjudication face did not answer within ${ORG_ADJUDICATION_TIMEOUT_MS}ms (or the task ended first)`],
+        }, { ...(input.abortSignal !== undefined ? { signal: input.abortSignal } : {}), timeoutMs: ORG_ADJUDICATION_TIMEOUT_MS });
+        const answer = normalizeOrgGateVerdict(raw, "the org adjudication face answered something this gate cannot read as a verdict — treated as unreadable governance, never as an empty one");
+        if (answer.status === "unavailable") {
+            orgEvidence = { revisionAbsent: "unavailable", ruleAbsent: "unavailable" };
+            orgRealApprovalRequired = true;
+            await notifier.notifyAsync(() => input.orgRules?.onUnavailable?.({ toolName, toolCallId, message: answer.disclosures.join("; ") }), "toolGate.orgSnapshotUnavailable");
+            if (decided.action === "allow") {
+                decided = {
+                    action: "ask",
+                    message: `tool "${toolName}" needs approval: this deployment is org-governed and cannot currently adjudicate ` +
+                        `against an organization policy snapshot — every allow tightens to a real approval until it can`,
+                    decisionReason: ORG_UNAVAILABLE_DECISION_REASON,
+                    requiresRealApproval: true,
+                };
+                orgTightenCount += 1;
+            }
+            else if (decided.action === "ask" && decided.requiresRealApproval !== true) {
+                decided = { ...decided, requiresRealApproval: true };
+                orgTightenCount += 1;
+            }
+            return { decision: decided, org: "unavailable" };
+        }
+        const revisionCell = answer.revision !== undefined ? { revision: answer.revision } : { revisionAbsent: "not_reported" };
+        if (answer.verdict === undefined) {
+            orgEvidence = { ...revisionCell, ruleAbsent: "no_match" };
+            return { decision: decided, org: undefined };
+        }
+        const { behavior, rule } = answer.verdict;
+        orgEvidence = { ...revisionCell, rule };
+        if (behavior === "deny") {
+            orgTightenCount += 1;
+            pass.deniedBy = "org";
+            return { decision: { action: "deny", message: `an organization policy rule (${rule}) denies this call`, decisionReason: ORG_RULE_DECISION_REASON }, org: undefined };
+        }
+        if (decided.action === "deny")
+            return { decision: decided, org: undefined };
+        orgTightenCount += 1;
+        orgRealApprovalRequired = true;
+        return {
+            decision: decided.action === "ask"
+                ? { ...decided, requiresRealApproval: true }
+                : {
+                    action: "ask",
+                    message: `an organization policy rule (${rule}) requires approval for this call`,
+                    decisionReason: ORG_RULE_DECISION_REASON,
+                    requiresRealApproval: true,
+                },
+            org: "rule",
+        };
+    };
+    const orgAnswer = await applyOrgLayer(pass.decision, pass.policyRewrite !== undefined ? pass.policyRewrite : pass.currentInput);
+    pass.decision = orgAnswer.decision;
+    if (pass.decision.action === "ask") {
+        if (pass.policyRewrite !== undefined) {
+            pass.currentInput = pass.policyRewrite;
+            pass.req.args = pass.policyRewrite;
+        }
+        const persistedRuleMandate = persistedRuleMandateOf({
+            egress: input.egress,
+            shellGated: input.shellGated,
+            irreversibility: input.irreversibility,
+            probeMandated: pass.decision.action === "ask" && pass.decision.probeMandated === true,
+        });
+        let personalEvidence = { dotsAbsent: input.persistedRules === undefined ? "not_wired" : "not_adjudicated" };
+        let laneCoverage;
+        if (input.persistedRules &&
+            !orgRealApprovalRequired &&
+            pass.decision.action === "ask" &&
+            pass.decision.requiresRealApproval !== true &&
+            pass.decision.decisionReason !== "hook" &&
+            pass.req.toolName !== ASK_USER_QUESTION_TOOL_NAME &&
+            input.isMarkedUnresolvable?.(input.event.toolCallId) !== true) {
+            const answer = await (async () => {
+                let pendingHit;
+                try {
+                    pendingHit = Promise.resolve(input.persistedRules?.admits(pass.req));
+                }
+                catch {
+                    return { unreadable: true };
+                }
+                return await settleOrgVerdictWithin(pendingHit.then(normalizePersistedRuleHit).catch(() => ({ unreadable: true })), { unreadable: true }, { ...(input.abortSignal !== undefined ? { signal: input.abortSignal } : {}), timeoutMs: ORG_ADJUDICATION_TIMEOUT_MS });
+            })();
+            const hitRules = answer.hit?.rules;
+            laneCoverage = answer.coverage;
+            personalEvidence = { dotsAbsent: answer.unreadable === true ? "unavailable" : "no_match" };
+            const disclosedRuleSet = (rules) => {
+                const shown = rules.slice(0, 5).map((r) => inlineUntrusted(r.rule, 200));
+                const rest = rules.length - shown.length;
+                return rest > 0 ? `${shown.join(", ")} and ${rest} more` : shown.join(", ");
+            };
+            const unionDotsOf = (rules) => {
+                const seen = new Set();
+                const union = [];
+                for (const r of rules) {
+                    if (r.dots === undefined || r.dots.length === 0)
+                        return { dotsAbsent: "not_reported" };
+                    for (const d of r.dots) {
+                        const key = JSON.stringify([d.actor, d.counter]);
+                        if (!seen.has(key)) {
+                            seen.add(key);
+                            union.push(d);
+                        }
+                    }
+                }
+                return { dots: union };
+            };
+            if (hitRules !== undefined && persistedRuleMandate === undefined && pass.decision.matchedAskRule === undefined) {
+                pass.decision = {
+                    action: "allow",
+                    message: hitRules.length === 1
+                        ? `a persisted allow rule (${disclosedRuleSet(hitRules)}) covers this call`
+                        : `persisted allow rules (${disclosedRuleSet(hitRules)}) cover every segment of this call`,
+                    decisionReason: "persisted_rule",
+                    ...(pass.policyRewrite !== undefined ? { updatedInput: pass.policyRewrite } : {}),
+                };
+                await notifier.notifyAsync(() => input.persistedRules?.onResolved?.({ toolName: pass.req.toolName, toolCallId, rules: hitRules.map((r) => r.rule) }), "toolGate.persistedRuleResolved");
+            }
+            else if (hitRules !== undefined) {
+                personalEvidence = unionDotsOf(hitRules);
+                const shownRule = disclosedRuleSet(hitRules);
+                const mandateNoun = persistedRuleMandate === "probe_mandate"
+                    ? "the reversibility check declared this call structurally gated (the built-in shell check raises this for a read outside the directories allowed for this session) — it is cleared by confirming this call, never by a standing allow rule"
+                    : persistedRuleMandate === "operator_always"
+                        ? "this deployment mandates per-call confirmation for shell commands (shellGate: always)"
+                        : persistedRuleMandate !== undefined
+                            ? "this tool carries egress/irreversibility marks (a mandated confirmation a rule cannot clear)"
+                            : "an explicit ask rule matched this call (a person's ask-me-each-time outranks a standing allow rule)";
+                pass.decision = {
+                    ...pass.decision,
+                    persistedRuleShadowed: shownRule,
+                    message: hitRules.length === 1
+                        ? `${pass.decision.message !== undefined ? `${pass.decision.message} ` : ""}(a persisted allow rule (${shownRule}) matches this call but does not clear the ask — ${mandateNoun})`
+                        : `${pass.decision.message !== undefined ? `${pass.decision.message} ` : ""}(persisted allow rules (${shownRule}) match this call but do not clear the ask — ${mandateNoun})`,
+                };
+            }
+        }
+        const originFacts = askOriginFacts(orgAnswer.org);
+        if (pass.decision.action === "ask") {
+            const stamped = { ...pass.decision, ruleEvidence: mintRuleEvidence(personalEvidence), ...(laneCoverage !== undefined ? { segmentCoverage: laneCoverage } : {}) };
+            pass.decision = { ...stamped, origin: askOriginOf(stamped, originFacts) };
+        }
+        if (pass.decision.action === "ask")
+            ledger.supersede();
+        if (input.autoMode && pass.decision.action === "ask" && pass.decision.origin !== undefined && classifierMayAnswer(pass.decision.origin)) {
+            const verdict = await input.autoMode.decider
+                .decide({ req: pass.req, askMessage: decisionText(pass.decision) }, input.abortSignal)
+                .catch(() => ({ kind: "unavailable", cause: "error" }));
+            if (verdict.kind === "allow") {
+                input.autoMode.denialTracking?.recordAllow();
+                pass.decision = {
+                    action: "allow",
+                    message: "auto-mode classifier allowed this call",
+                    decisionReason: "classifier",
+                    ...(pass.policyRewrite !== undefined ? { updatedInput: pass.policyRewrite } : {}),
+                };
+            }
+            else if (verdict.kind === "block") {
+                const reason = verdict.reason ? inlineUntrusted(verdict.reason) : "";
+                const category = verdict.category ? inlineUntrusted(verdict.category) : "";
+                const tracked = input.autoMode.denialTracking?.recordBlock();
+                if (tracked?.limitReached === true) {
+                    const fallbackAsk = {
+                        ...pass.decision,
+                        message: denialLimitFallbackMessage(tracked.fallback, reason || category || toolName),
+                        decisionReason: "classifier",
+                        requiresRealApproval: true,
+                        denialLimitFallback: tracked.fallback,
+                    };
+                    pass.decision = { ...fallbackAsk, origin: askOriginOf(fallbackAsk, originFacts) };
+                }
+                else {
+                    pass.decision = {
+                        action: "deny",
+                        message: `auto-mode classifier blocked this call${reason ? `: ${reason}` : category ? `: [${category}]` : ""}`,
+                        decisionReason: "classifier",
+                    };
+                    pass.deniedBy = "classifier";
+                }
+            }
+        }
+        if (input.sandboxAdmission !== undefined &&
+            pass.decision.action === "ask" &&
+            pass.req.toolName !== ASK_USER_QUESTION_TOOL_NAME &&
+            input.isMarkedUnresolvable?.(input.event.toolCallId) !== true &&
+            pass.decision.requiresRealApproval !== true &&
+            pass.decision.decisionReason !== "hook" &&
+            pass.hookAsk === undefined &&
+            input.egress !== true &&
+            input.peerMessage !== true &&
+            input.sandboxAdmission.boundaryCapable !== true) {
+            const recorded = input.sandboxAdmission.askClassesOf(toolCallId);
+            const admissible = recorded !== undefined && recorded.length > 0 && recorded.every((r) => r.cls === "sandbox_local");
+            if (admissible) {
+                const askClasses = recorded;
+                input.sandboxAdmission.onAdmitted({ toolCallId, toolName, askClasses, boundary: "sandbox_internal" });
+                pass.preToolContext.push(`permission.sandbox_admitted: this call's pending approval was auto-admitted because the deployment declares an isolated sandbox execution env and the request stays inside it. Recorded for audit.`);
+                pass.decision = {
+                    action: "allow",
+                    message: "admitted inside the deployment-declared sandbox (permission.sandbox_admitted)",
+                    decisionReason: "sandbox",
+                    ...(pass.policyRewrite !== undefined ? { updatedInput: pass.policyRewrite } : {}),
+                };
+            }
+        }
+        const egressTool = input.egress === true;
+        const irreversibleTool = input.irreversibility === "always" || input.irreversibility === "maybe";
+        const safety = egressTool || irreversibleTool ? { egress: egressTool, irreversible: irreversibleTool } : undefined;
+        const realApprovalOf = (d) => {
+            if (d.action !== "ask" || d.requiresRealApproval !== true)
+                return undefined;
+            if (d.origin === undefined)
+                throw new Error(`a real-approval ask for "${toolName}" reached a park site with no origin word — the origin stamp precedes every park`);
+            return { origin: d.origin, ...(originFacts.org !== undefined ? { org: originFacts.org } : {}) };
+        };
+        const carryOf = (d) => ({
+            ...(callSignal !== undefined ? { signal: callSignal } : {}),
+            ...(d.action === "ask" && d.denialLimitFallback !== undefined ? { denialLimitFallback: unarmedWindow(d.denialLimitFallback) } : {}),
+            ...(d.action === "ask" && d.origin !== undefined ? { origin: d.origin } : {}),
+        });
+        if (suspendAsk && pass.decision.action === "ask") {
+            const parkArgs = [pass.req, pass.currentInput, safety, undefined, realApprovalOf(pass.decision), pass.decision.action === "ask" ? pass.decision.persistedRuleShadowed : undefined, pass.decision.action === "ask" ? pass.decision.decisionReason : undefined, pass.decision.action === "ask" ? pass.decision.probeReason : undefined, pass.decision.action === "ask" ? pass.decision.probeCause : undefined, pass.decision.action === "ask" ? pass.decision.segmentCoverage : undefined, pass.decision.action === "ask" ? pass.decision.matchedAskRule : undefined, pass.decision.action === "ask" ? pass.decision.probeMandated : undefined];
+            const suspended = await parkWith(suspendAsk, parkArgs, carryOf(pass.decision));
+            if (suspended) {
+                if ("parkFailed" in suspended)
+                    pass.parkFailed = suspended.parkFailed;
+                else
+                    return { suspend: suspended, preToolContext: pass.preToolContext };
+            }
+        }
+        if (pass.decision.action === "ask" && pass.req.toolName === ASK_USER_QUESTION_TOOL_NAME) {
+            const outcome = input.resolveContentAsk !== undefined ? await (callSignal !== undefined ? input.resolveContentAsk(pass.req, callSignal) : input.resolveContentAsk(pass.req)) : { kind: "unavailable", parkDeclined: false };
+            if (outcome.kind === "answered") {
+                pass.decision = { action: "allow", updatedInput: outcome.presentedInput };
+            }
+            else if (outcome.kind === "unavailable") {
+                if (outcome.presentedInput !== undefined) {
+                    pass.currentInput = outcome.presentedInput;
+                    pass.req.args = outcome.presentedInput;
+                }
+                if (suspendAsk && outcome.parkDeclined && pass.parkFailed === undefined) {
+                    const parkArgs = [pass.req, pass.currentInput, safety, true, realApprovalOf(pass.decision), pass.decision.action === "ask" ? pass.decision.persistedRuleShadowed : undefined, pass.decision.action === "ask" ? pass.decision.decisionReason : undefined, pass.decision.action === "ask" ? pass.decision.probeReason : undefined, pass.decision.action === "ask" ? pass.decision.probeCause : undefined, pass.decision.action === "ask" ? pass.decision.segmentCoverage : undefined, pass.decision.action === "ask" ? pass.decision.matchedAskRule : undefined, pass.decision.action === "ask" ? pass.decision.probeMandated : undefined];
+                    const suspended = await parkWith(suspendAsk, parkArgs, carryOf(pass.decision));
+                    if (suspended) {
+                        if ("parkFailed" in suspended)
+                            pass.parkFailed = suspended.parkFailed;
+                        else
+                            return { suspend: suspended, preToolContext: pass.preToolContext };
+                    }
+                }
+                if (pass.decision.origin === undefined)
+                    throw new Error(`the content ask for "${toolName}" reached its refusal without an origin word`);
+                ledger.set({ settlement: { kind: input.resolveContentAsk !== undefined ? "approver_unavailable" : "no_approver", who: { party: "none" }, when: Date.now() }, origin: pass.decision.origin });
+                pass.deniedBy = "ask_resolution";
+                pass.decision = {
+                    action: "deny",
+                    message: "AskUserQuestion could not be parked for a durable human answer on this path (no checkpoint " +
+                        "facility, or the suspend failed) and a synchronous permission approver cannot carry an answer — " +
+                        "the question was NOT shown to anyone. Proceed with your best judgment and state the assumption " +
+                        "you made.",
+                };
+            }
+            else {
+                if (outcome.presentedInput !== undefined)
+                    pass.decision = { action: "allow", updatedInput: outcome.presentedInput };
+                else
+                    pass.decision = { action: "allow" };
+            }
+        }
+        if (pass.decision.action === "ask") {
+            const askBeforeResolve = pass.decision;
+            const resolved = await (callSignal !== undefined ? resolveAsk(pass.decision, pass.req, callSignal) : resolveAsk(pass.decision, pass.req));
+            ledger.fromResolved(resolved, askBeforeResolve, toolName);
+            if (resolved.action === "deny")
+                pass.deniedBy = "ask_resolution";
+            pass.decision = resolved;
+            if (resolved.action === "deny" && resolved.approverUnavailable === true && suspendAsk && pass.parkFailed === undefined) {
+                const parkArgs = [pass.req, pass.currentInput, safety, true, realApprovalOf(askBeforeResolve), askBeforeResolve.action === "ask" ? askBeforeResolve.persistedRuleShadowed : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.decisionReason : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.probeReason : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.probeCause : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.segmentCoverage : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.matchedAskRule : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.probeMandated : undefined];
+                const suspended = await parkWith(suspendAsk, parkArgs, carryOf(askBeforeResolve));
+                if (suspended) {
+                    if ("parkFailed" in suspended)
+                        pass.parkFailed = suspended.parkFailed;
+                    else
+                        return { suspend: suspended, preToolContext: pass.preToolContext };
+                }
+            }
+            if (askBeforeResolve.action === "ask" && askBeforeResolve.denialLimitFallback !== undefined) {
+                if (pass.decision.action === "allow") {
+                    input.autoMode?.denialTracking?.recordAllow();
+                }
+                else if ((resolved.action === "deny" &&
+                    (resolved.settlement.kind === "no_approver" || resolved.settlement.kind === "blanket_allow_refused" || resolved.settlement.kind === "approver_unavailable")) ||
+                    resolved.approverUnavailable === true) {
+                    try {
+                        input.onHeadlessDenialLimit?.({ toolName, toolCallId, fallback: unarmedWindow(askBeforeResolve.denialLimitFallback) });
+                    }
+                    catch {
+                    }
+                }
+            }
+            if (pass.decision.action === "allow" && pass.decision.updatedInput !== undefined) {
+                let editArgs = pass.decision.updatedInput;
+                let editDenied;
+                let editRewrittenSinceHuman = false;
+                for (let round = 0;; round++) {
+                    if (round >= 3) {
+                        editDenied = {
+                            action: "deny",
+                            message: `the approval-edit chain for "${toolName}" exceeded the re-approval cap — denied fail-closed; re-submit the edited action directly`,
+                        };
+                        pass.deniedBy = "policy";
+                        break;
+                    }
+                    if (screening !== undefined) {
+                        let hr;
+                        let hrUnanswered;
+                        try {
+                            const seat = await screening.screen(editArgs);
+                            if (seat.expired)
+                                hrUnanswered = seat.cause;
+                            else
+                                hr = screening.screened(seat.value);
+                        }
+                        catch (err) {
+                            traceHookCrash(input, err, notifier);
+                            editDenied = { action: "deny", message: screening.crashReason(`the approved edit for "${toolName}"`, err) };
+                            pass.deniedBy = "hook";
+                            break;
+                        }
+                        if (hrUnanswered !== undefined) {
+                            editDenied = { action: "deny", message: await screening.unansweredReason(`the approved edit for "${toolName}"`, hrUnanswered) };
+                            pass.deniedBy = "hook";
+                            break;
+                        }
+                        if (hr) {
+                            if (hr.additionalContext)
+                                pass.preToolContext.push(hr.additionalContext);
+                            if (hr.action === "deny") {
+                                editDenied = { action: "deny", message: decisionText(hr) ?? `the approved edit for "${toolName}" was blocked by a PreToolUse hook` };
+                                pass.deniedBy = "hook";
+                                break;
+                            }
+                            if (hr.action === "ask") {
+                                editDenied = {
+                                    action: "deny",
+                                    message: `the approved edit for "${toolName}" raises a new PreToolUse approval requirement the original approval does not cover — denied fail-closed; re-submit the edited action directly`,
+                                };
+                                pass.deniedBy = "hook";
+                                break;
+                            }
+                            if (hr.updatedInput !== undefined) {
+                                editArgs = hr.updatedInput;
+                                editRewrittenSinceHuman = true;
+                            }
+                        }
+                    }
+                    if (!adjudicate && input.orgRules === undefined)
+                        break;
+                    let recheck = { action: "allow" };
+                    if (adjudicate) {
+                        try {
+                            recheck = await (callSignal !== undefined ? adjudicate({ toolName, args: editArgs, toolCallId }, callSignal) : adjudicate({ toolName, args: editArgs, toolCallId }));
+                        }
+                        catch (err) {
+                            recheck = {
+                                action: "deny",
+                                message: `policy re-check of the approved edit for "${toolName}" errored: ${err instanceof Error ? err.message : String(err)}`,
+                            };
+                        }
+                    }
+                    {
+                        const refusedBy = ledger.fromDecision(recheck);
+                        if (recheck.action === "deny" && refusedBy !== undefined) {
+                            editDenied = recheck;
+                            pass.deniedBy = refusedBy;
+                            break;
+                        }
+                    }
+                    if (recheck.updatedInput !== undefined) {
+                        editArgs = recheck.updatedInput;
+                        editRewrittenSinceHuman = true;
+                    }
+                    const editOrg = await applyOrgLayer(recheck, editArgs);
+                    recheck = editOrg.decision;
+                    if (recheck.action === "deny") {
+                        editDenied = recheck;
+                        break;
+                    }
+                    if (recheck.action === "allow") {
+                        if (recheck.updatedInput !== undefined) {
+                            editArgs = recheck.updatedInput;
+                            editRewrittenSinceHuman = true;
+                        }
+                        break;
+                    }
+                    if (recheck.updatedInput !== undefined) {
+                        editArgs = recheck.updatedInput;
+                        editRewrittenSinceHuman = true;
+                    }
+                    const editAskSnapshot = { ...recheck, ruleEvidence: mintRuleEvidence({ dotsAbsent: "not_adjudicated" }) };
+                    const editAskDecision = { ...editAskSnapshot, origin: askOriginOf(editAskSnapshot, askOriginFacts(editOrg.org)) };
+                    const editAskReq = { toolName, args: editArgs, toolCallId };
+                    const rr = await (callSignal !== undefined ? resolveAsk(editAskDecision, editAskReq, callSignal) : resolveAsk(editAskDecision, editAskReq));
+                    ledger.fromResolved(rr, editAskDecision, toolName);
+                    if (rr.action !== "allow") {
+                        editDenied = rr;
+                        pass.deniedBy = "ask_resolution";
+                        break;
+                    }
+                    if (rr.updatedInput === undefined) {
+                        if (rr.presentedInput !== undefined)
+                            editArgs = rr.presentedInput;
+                        editRewrittenSinceHuman = false;
+                        break;
+                    }
+                    editArgs = rr.updatedInput;
+                    editRewrittenSinceHuman = false;
+                }
+                if (editDenied === undefined && editRewrittenSinceHuman && input.writeProtectionCheck !== undefined) {
+                    const editHit = input.writeProtectionCheck(toolName, editArgs);
+                    if (editHit !== null) {
+                        editDenied = {
+                            action: "deny",
+                            message: `the approved edit for "${toolName}" was rewritten by the restriction chain onto a write-protected path (table entry "${editHit.name}") that no approval covers — denied fail-closed; re-submit the edited action directly`,
+                        };
+                        pass.deniedBy = "write_protection";
+                    }
+                }
+                pass.decision = editDenied ?? { ...pass.decision, updatedInput: editArgs };
+            }
+            else if (pass.decision.action === "allow" && pass.decision.updatedInput === undefined && resolved.presentedInput !== undefined) {
+                pass.decision = { ...pass.decision, updatedInput: resolved.presentedInput };
+            }
+        }
+    }
+    return await exitGate(pass);
+}