@sema-agent/core 7.7.0 → 7.8.0

package/dist/engine/compaction/utils.d.ts

@@ -1,5 +1,11 @@
 import type { Message } from "../llm/index.js";
 import type { AgentMessage } from "../loop/types.js";
+/**
+ * design/388 A-18 — the FROZEN history table: tool names a persisted pre-rename transcript may still carry
+ * (the upstream trio and the pre-CC-name core trio), mapped to the path access the live definition declares.
+ * Never grows: a new name declares its access on the catalog instead. Registered with the name-table gate.
+ */
+export declare const DURABLE_HISTORY_NAMES: ReadonlyMap<string, "read" | "create" | "edit">;
 /** File paths touched by a session branch or compaction range. */
 export interface FileOperations {
     /** Files read but not necessarily modified. */

package/dist/engine/compaction/utils.js

@@ -2,6 +2,15 @@ import { normalizeLlmMessageContent } from "../harness/messages.js";
 import { sliceHeadSafe } from "../../core/surrogate-safe-slice.js";
 import { cutEnginePrefix, cutEngineSegments, flattenableUserText } from "../../core/untrusted-text.js";
 import { fileArgPath } from "../../tools/fs/safety.js";
+import { fileOpAccessOf } from "../../core/tool-registry.js";
+export const DURABLE_HISTORY_NAMES = new Map([
+    ["read", "read"],
+    ["write", "create"],
+    ["edit", "edit"],
+    ["read_file", "read"],
+    ["write_file", "create"],
+    ["edit_file", "edit"],
+]);
 export function createFileOps() {
     return {
         read: new Set(),
@@ -35,25 +44,16 @@ export function extractFileOpsFromMessage(message, fileOps) {
         if (!path) {
             continue;
         }
-        switch (block.name) {
-            case "read":
-            case "Read":
-            case "read_file":
-                fileOps.read.add(path);
-                break;
-            case "write":
-            case "Write":
-            case "write_file":
-                fileOps.written.add(path);
-                touchModified(fileOps, path);
-                break;
-            case "edit":
-            case "Edit":
-            case "edit_file":
-            case "MultiEdit":
-                fileOps.edited.add(path);
-                touchModified(fileOps, path);
-                break;
+        const access = fileOpAccessOf(block.name) ?? DURABLE_HISTORY_NAMES.get(block.name);
+        if (access === "read")
+            fileOps.read.add(path);
+        else if (access === "create") {
+            fileOps.written.add(path);
+            touchModified(fileOps, path);
+        }
+        else if (access === "edit") {
+            fileOps.edited.add(path);
+            touchModified(fileOps, path);
         }
     }
 }

package/dist/engine/loop/types.d.ts

@@ -750,6 +750,12 @@ export interface AgentTool<TParameters extends TSchema = TSchema, TDetails = unk
      * server's own channel for keeping one tool's full schema inlined. Absent on non-MCP tools.
      */
     mcpAlwaysLoad?: boolean;
+    /**
+     * design/388 — the server's RAW tool name this mounted MCP tool was accepted under (byte-exact, the `tools/call`
+     * spelling). The `toolFaces` overlay binds to it: two raw names can fold onto one minted wire name, and an overlay
+     * keyed by the folded-away spelling must stay inert rather than land on the other tool. Absent on non-MCP tools.
+     */
+    mcpRemoteName?: string;
     /**
      * design/120 P1.5 (CC `isConcurrencySafe(parsedInput)` parity): INPUT-level concurrency refinement
      * for a tool whose safety depends on its arguments — CC's only real consumer is

package/dist/index.d.ts

@@ -24,9 +24,9 @@ export { createTodoWriteTool } from "./tools/todo.js";
 export { createTaskListTools, createMemoryTaskListStore, assertJsonMetadata, type TaskListItem, type TaskListStore } from "./tools/task-list.js";
 export { assembleCodeTools, type CodeToolsConfig, CODE_ROLE } from "./scenarios/full-body.js";
 export { TOOL_MODEL_GATE_CLASSES, isModelGatedForClass, type ToolModelGateRule } from "./core/tool-model-gate.js";
-export { capAggregateToolResults, AGGREGATE_TOOL_RESULT_BUDGET_CHARS, DEFAULT_BUDGET_EXEMPT_TOOLS, type AggregateBudgetOptions, } from "./core/tool-result-budget.js";
+export { capAggregateToolResults, AGGREGATE_TOOL_RESULT_BUDGET_CHARS, type AggregateBudgetOptions, } from "./core/tool-result-budget.js";
 export { capAggregateMediaBytes, AGGREGATE_MEDIA_BUDGET_BYTES, type MediaStripInfo } from "./core/media-byte-cap.js";
-export { createAskUserQuestionTool, createDurableQuestionPolicy, QUESTION_AWAITS_RESUME, isQuestionUnavailable, type OnQuestionOutcome, type QuestionUnavailable, type OnQuestion, type AskQuestion, type AskQuestionOption, type AskQuestionRequest, type QuestionAnswer, type QuestionAnswerItem, type AskQuestionCardDetails, type AskUserQuestionToolOptions, type AskAnswerContinuationSource, type SyntheticContinuationReason, } from "./core/ask-question.js";
+export { createAskUserQuestionTool, createDurableQuestionPolicy, QUESTION_AWAITS_RESUME, isQuestionUnavailable, type OnQuestionOutcome, type QuestionUnavailable, type OnQuestion, type AskQuestion, type AskQuestionOption, type AskQuestionRequest, type QuestionAnswer, type QuestionAnswerItem, type AskQuestionCardDetails, type AskUserQuestionToolOptions, type AskAnswerContinuationSource, type SyntheticContinuationReason, ASK_USER_QUESTION_TOOL_NAME, } from "./core/ask-question.js";
 export { createLspTool, gitCheckIgnoreFilter, LSP_OPERATIONS, LSP_FAILURE_BRAND, brandLspFailure, lspFailureOf, SharedAbortScope, settleOnAbort, type LspNoneReason, type LspOperation, type LspServerManager, type LspSession, type LspResult, type LspLocation, type LspSymbolInfo, type LspRequestParams, type LspToolOptions, type LspTransport, type LspReadText, } from "./core/lsp.js";
 export { buildRequest, parseResult, callHierarchyMethod, pathToUri } from "./core/lsp-protocol.js";
 export { TransportLspSession, type SessionWarmup } from "./core/lsp-session.js";
@@ -91,7 +91,7 @@ export { sanitizeUntrustedText, delimitUntrusted, inlineUntrusted } from "./core
 export { mintReminderMark, isValidReminderMark, openSystemReminder, mintSystemReminder, reminderMarkDeclaration } from "./core/reminder-mint.js";
 export { deriveInvariants, checkInvariants } from "./core/property-harness.js";
 export type { InvariantKind, FunctionContract, Invariant, InvariantViolation, CheckResult, } from "./core/property-harness.js";
-export { HAND_TOOL_EFFECTS, bashReversibilityProbe, BASH_READONLY_DEFAULT_ALLOW, parseLeadingCommandName, classifyCompoundReadonly, MAX_EDIT_BYTES } from "./tools/fs/index.js";
+export { bashReversibilityProbe, BASH_READONLY_DEFAULT_ALLOW, parseLeadingCommandName, classifyCompoundReadonly, MAX_EDIT_BYTES } from "./tools/fs/index.js";
 export { classifyCompoundReadonlyDetailed, formatOutOfRootReadApprovalOption, type BashReadonlyRootBoundary, type CompoundReadonlyVerdict, } from "./tools/fs/index.js";
 export { resolveBashTimeoutCaps } from "./tools/fs/index.js";
 export { READ_FACE_DEFAULT_DENY_ENTRIES, READ_FACE_BUILTIN_DENY_TABLE, READ_DENY_BUILTIN_TIERS, READ_DENY_DEFAULT_TIERS, resolveReadDenyBuiltins, compileReadDeny, type ReadDenyEntry, type ReadDenyMatcher, type NormalizedReadDenyEntry, type ReadDenyBuiltinTier, type ReadDenyBuiltinRow, type ReadDenyBuiltinConfig, } from "./tools/fs/index.js";
@@ -124,6 +124,17 @@ export { createFsWriteGatePolicy, type FsWriteGatePolicyOptions } from "./core/f
 export { RETIRED_TOOL_NAMES } from "./core/tool-name-aliases.js";
 export { DEFAULT_SUBAGENT_TOOL_NAME } from "./agents/subagent.js";
 export { renderTaskNotificationXml, taskNotificationDedupKey, isDelegatedAgentTerminal, isTerminalTaskNotification, SystemInjectionQueue, type TaskNotificationPayload, type TaskNotificationStatus, type ExternalNotificationInput, type SystemInjection, type SystemInjectionPriority, SYSTEM_INJECTION_PRIORITIES, isSystemInjectionPriority, AGENT_MESSAGE_TAG, renderAgentMessageFrame, type SemaProvenance, } from "./core/task-notification.js";
+export { TOOL_FAMILIES, TOOL_MOUNT_TAGS, TOOL_APPROVAL_CARDS, TOOL_PATH_ACCESSES, TOOL_WIRE_NAME_MAX_CHARS, TOOL_CONTRACT_MAX_CHARS, TOOL_KEY_MAX_CHARS, TOOL_KEYS_MAX, RENDER_HINT_MAX_CHARS, RENDER_HINT_ACTIVITY_MAX_CHARS, RENDER_HINT_MAX_LIST, type ToolFamily, type ToolMountTag, type ToolApprovalCard, type ToolPathAccess, type ToolPathTarget, type ToolRuleFace, type ToolRenderHints, type ToolFaceDeclaration, type ToolCatalogEntry, } from "./core/tool-face.js";
+export { describeToolCatalog, catalogEntriesNamed, catalogToolNames, catalogRuleFaceOf, pathTargetOf, pathTargetValue, protectivePathTargetOf, declaredPathTargetOf, isProtectedWrite, isDeclaredWrite, fileOpAccessOf, type ToolCallLike, pathConfinableWriteToolNames, skillScopeWriteToolNames, pathTargetingToolNames, compactableToolNames, budgetExemptToolNames, handBandEffects, engineCardTypes, predictMountedToolNames, HANDS_BAND_TAGS, MOUNT_TAG_IN_HANDS_BAND, } from "./core/tool-registry.js";
+export { ToolRosterEntry, ToolRoster, ToolRosterDelta, ToolRosterRenderHints, ROSTER_SOURCES, type RosterSource, type ToolIdentity, toolIdentityOf, mintCapabilityId, diffToolRoster, judgeParkedToolIdentity, ruleFacesFromRoster, toolCallFaceOf, inputKeysOf, ruleFaceOfInstance, ToolRosterDeltaSeat, } from "./core/tool-roster.js";
+export { type ToolCallFace } from "./core/tool-policy.js";
+export { TOOL_CONFORMANCE_VECTORS, describeToolConformanceVectors, type ToolConformanceVector } from "./core/tool-conformance.js";
+export { applyMcpToolFaces, toolFaceProblem, APPROVAL_CARD_REQUIRED_KEYS, type McpToolFace } from "./core/runner/tool-face-overlay.js";
+export { createStructuredProjector } from "./core/runner/tool-output-projection.js";
+export { parkedToolIdentity } from "./core/tool-roster.js";
+export { type ToolCallIdentity } from "./core/fs-write-gate-policy.js";
+export { type RuleFaceView, catalogRuleFaceView } from "./core/permission-rules.js";
+export { DURABLE_HISTORY_NAMES } from "./engine/compaction/utils.js";
 export { describeStaticWiring, deriveWiringManifest, deriveAskEffective, resolveDeclaredDurability, resolveSubagentTranscriptTier, type SubagentTranscriptTier, resolveAskSeamForm, resolveQuestionSeam, countElicitOptIns, AUTO_MODE_ARM_REASONS, type AutoModeArmReason, type WiringManifest, type WiringManifestMcpEntry, type WiringFacts, type WiringLegKind, type AskSeamForm, type AskEffective, type QuestionChannelState, type SeamProvenance, type ParkLaneReason, type ManifestDurability, type StaticWiringDeps, type StaticWiringSpec, } from "./core/wiring-manifest.js";
 export { probeParkRoundTrip, durableParkGapOf, durableParkGapFor, PARK_SELFCHECK_SCOPE_PREFIX, type ParkSelfCheckResult, type ParkProbeFinding, type ParkProbeFindingCode, } from "./core/park-selfcheck.js";
 export { type StoreDurability } from "./core/checkpoint-store.js";
@@ -280,7 +291,7 @@ export { defineAgent } from "./agents/agent-definition.js";
 export { builtinAgentDefinitions, BUILTIN_READONLY_DENY_TOOLS, EXPLORE_WHEN_TO_USE, EXPLORE_WHEN_TO_USE_LEAN, PLAN_WHEN_TO_USE, EXPLORE_SYSTEM_PROMPT, PLAN_SYSTEM_PROMPT, } from "./agents/builtin-agents.js";
 export { runTeamDiscussion, type TeamDiscussionOptions, type TeamMember, type TeamResult, type TeamTurn, type TeamEvent, } from "./agents/team.js";
 export { createTaskServer, type TaskServerOptions, type TaskRequestBody, } from "./server/http.js";
-export { clearStaleToolResults, COMPACTABLE_TOOLS, editBudget, type ContextEditOptions, } from "./core/context-edit.js";
+export { clearStaleToolResults, editBudget, type ContextEditOptions, } from "./core/context-edit.js";
 export { createOpenAIBrain, type OpenAIBrainConfig } from "./brain/openai.js";
 export { createAnthropicBrain, type AnthropicBrainConfig } from "./brain/anthropic.js";
 export { createOpenResponsesBrain, type OpenResponsesBrainConfig } from "./brain/open-responses.js";

package/dist/index.js

@@ -12,9 +12,9 @@ export { createTodoWriteTool } from "./tools/todo.js";
 export { createTaskListTools, createMemoryTaskListStore, assertJsonMetadata } from "./tools/task-list.js";
 export { assembleCodeTools, CODE_ROLE } from "./scenarios/full-body.js";
 export { TOOL_MODEL_GATE_CLASSES, isModelGatedForClass } from "./core/tool-model-gate.js";
-export { capAggregateToolResults, AGGREGATE_TOOL_RESULT_BUDGET_CHARS, DEFAULT_BUDGET_EXEMPT_TOOLS, } from "./core/tool-result-budget.js";
+export { capAggregateToolResults, AGGREGATE_TOOL_RESULT_BUDGET_CHARS, } from "./core/tool-result-budget.js";
 export { capAggregateMediaBytes, AGGREGATE_MEDIA_BUDGET_BYTES } from "./core/media-byte-cap.js";
-export { createAskUserQuestionTool, createDurableQuestionPolicy, QUESTION_AWAITS_RESUME, isQuestionUnavailable, } from "./core/ask-question.js";
+export { createAskUserQuestionTool, createDurableQuestionPolicy, QUESTION_AWAITS_RESUME, isQuestionUnavailable, ASK_USER_QUESTION_TOOL_NAME, } from "./core/ask-question.js";
 export { createLspTool, gitCheckIgnoreFilter, LSP_OPERATIONS, LSP_FAILURE_BRAND, brandLspFailure, lspFailureOf, SharedAbortScope, settleOnAbort, } from "./core/lsp.js";
 export { buildRequest, parseResult, callHierarchyMethod, pathToUri } from "./core/lsp-protocol.js";
 export { TransportLspSession } from "./core/lsp-session.js";
@@ -70,7 +70,7 @@ export { runExecGate } from "./core/exec-gate.js";
 export { sanitizeUntrustedText, delimitUntrusted, inlineUntrusted } from "./core/untrusted-text.js";
 export { mintReminderMark, isValidReminderMark, openSystemReminder, mintSystemReminder, reminderMarkDeclaration } from "./core/reminder-mint.js";
 export { deriveInvariants, checkInvariants } from "./core/property-harness.js";
-export { HAND_TOOL_EFFECTS, bashReversibilityProbe, BASH_READONLY_DEFAULT_ALLOW, parseLeadingCommandName, classifyCompoundReadonly, MAX_EDIT_BYTES } from "./tools/fs/index.js";
+export { bashReversibilityProbe, BASH_READONLY_DEFAULT_ALLOW, parseLeadingCommandName, classifyCompoundReadonly, MAX_EDIT_BYTES } from "./tools/fs/index.js";
 export { classifyCompoundReadonlyDetailed, formatOutOfRootReadApprovalOption, } from "./tools/fs/index.js";
 export { resolveBashTimeoutCaps } from "./tools/fs/index.js";
 export { READ_FACE_DEFAULT_DENY_ENTRIES, READ_FACE_BUILTIN_DENY_TABLE, READ_DENY_BUILTIN_TIERS, READ_DENY_DEFAULT_TIERS, resolveReadDenyBuiltins, compileReadDeny, } from "./tools/fs/index.js";
@@ -100,6 +100,17 @@ export { createFsWriteGatePolicy } from "./core/fs-write-gate-policy.js";
 export { RETIRED_TOOL_NAMES } from "./core/tool-name-aliases.js";
 export { DEFAULT_SUBAGENT_TOOL_NAME } from "./agents/subagent.js";
 export { renderTaskNotificationXml, taskNotificationDedupKey, isDelegatedAgentTerminal, isTerminalTaskNotification, SystemInjectionQueue, SYSTEM_INJECTION_PRIORITIES, isSystemInjectionPriority, AGENT_MESSAGE_TAG, renderAgentMessageFrame, } from "./core/task-notification.js";
+export { TOOL_FAMILIES, TOOL_MOUNT_TAGS, TOOL_APPROVAL_CARDS, TOOL_PATH_ACCESSES, TOOL_WIRE_NAME_MAX_CHARS, TOOL_CONTRACT_MAX_CHARS, TOOL_KEY_MAX_CHARS, TOOL_KEYS_MAX, RENDER_HINT_MAX_CHARS, RENDER_HINT_ACTIVITY_MAX_CHARS, RENDER_HINT_MAX_LIST, } from "./core/tool-face.js";
+export { describeToolCatalog, catalogEntriesNamed, catalogToolNames, catalogRuleFaceOf, pathTargetOf, pathTargetValue, protectivePathTargetOf, declaredPathTargetOf, isProtectedWrite, isDeclaredWrite, fileOpAccessOf, pathConfinableWriteToolNames, skillScopeWriteToolNames, pathTargetingToolNames, compactableToolNames, budgetExemptToolNames, handBandEffects, engineCardTypes, predictMountedToolNames, HANDS_BAND_TAGS, MOUNT_TAG_IN_HANDS_BAND, } from "./core/tool-registry.js";
+export { ToolRosterEntry, ToolRoster, ToolRosterDelta, ToolRosterRenderHints, ROSTER_SOURCES, toolIdentityOf, mintCapabilityId, diffToolRoster, judgeParkedToolIdentity, ruleFacesFromRoster, toolCallFaceOf, inputKeysOf, ruleFaceOfInstance, ToolRosterDeltaSeat, } from "./core/tool-roster.js";
+export {} from "./core/tool-policy.js";
+export { TOOL_CONFORMANCE_VECTORS, describeToolConformanceVectors } from "./core/tool-conformance.js";
+export { applyMcpToolFaces, toolFaceProblem, APPROVAL_CARD_REQUIRED_KEYS } from "./core/runner/tool-face-overlay.js";
+export { createStructuredProjector } from "./core/runner/tool-output-projection.js";
+export { parkedToolIdentity } from "./core/tool-roster.js";
+export {} from "./core/fs-write-gate-policy.js";
+export { catalogRuleFaceView } from "./core/permission-rules.js";
+export { DURABLE_HISTORY_NAMES } from "./engine/compaction/utils.js";
 export { describeStaticWiring, deriveWiringManifest, deriveAskEffective, resolveDeclaredDurability, resolveSubagentTranscriptTier, resolveAskSeamForm, resolveQuestionSeam, countElicitOptIns, AUTO_MODE_ARM_REASONS, } from "./core/wiring-manifest.js";
 export { probeParkRoundTrip, durableParkGapOf, durableParkGapFor, PARK_SELFCHECK_SCOPE_PREFIX, } from "./core/park-selfcheck.js";
 export {} from "./core/checkpoint-store.js";
@@ -236,7 +247,7 @@ export { defineAgent } from "./agents/agent-definition.js";
 export { builtinAgentDefinitions, BUILTIN_READONLY_DENY_TOOLS, EXPLORE_WHEN_TO_USE, EXPLORE_WHEN_TO_USE_LEAN, PLAN_WHEN_TO_USE, EXPLORE_SYSTEM_PROMPT, PLAN_SYSTEM_PROMPT, } from "./agents/builtin-agents.js";
 export { runTeamDiscussion, } from "./agents/team.js";
 export { createTaskServer, } from "./server/http.js";
-export { clearStaleToolResults, COMPACTABLE_TOOLS, editBudget, } from "./core/context-edit.js";
+export { clearStaleToolResults, editBudget, } from "./core/context-edit.js";
 export { createOpenAIBrain } from "./brain/openai.js";
 export { createAnthropicBrain } from "./brain/anthropic.js";
 export { createOpenResponsesBrain } from "./brain/open-responses.js";

package/dist/orchestration/goal.js

@@ -3,16 +3,17 @@ import { Type } from "typebox";
 import { delimitUntrusted } from "../core/untrusted-text.js";
 import { OUTPUT_TOOL_NAME } from "../core/runner/synthetic-tools.js";
 import { isDurablePause, pauseFamily } from "../agents/suspend-guard.js";
+import { toolFace } from "../core/tool-catalog-entries.js";
 export const DECLARE_DONE_TOOL_NAME = "DeclareDone";
 function createDeclareDoneTool(ref) {
     return {
         name: DECLARE_DONE_TOOL_NAME,
+        ...toolFace("declare-done"),
         description: "Call this ONLY when you believe the goal is FULLY achieved — verified against evidence, not just " +
             "attempted. Provide a concise summary of what was achieved and how you verified it. Calling this " +
             "declares completion; a verification check then runs. If it passes, the goal stops and surfaces for " +
             "human review. If it does NOT pass, you will be asked to keep working with the verification feedback.",
         parameters: Type.Object({ summary: Type.String() }),
-        effect: "read",
         execute: (args) => {
             ref.declared = true;
             ref.summary = String(args.summary ?? "").trim();

package/dist/orchestration/run-spec.js

@@ -7,7 +7,7 @@ import { isDurablePause } from "../agents/suspend-guard.js";
 import { terminalProjection } from "../core/runner/terminal-projection.js";
 import { isAbsolutePathForm, writeTargetPath } from "../tools/fs/safety.js";
 import { captureBaseline, resolveFrozenPaths, restoreFrozenPaths, runOracle, snapshotFrozenPaths, specError, } from "../core/spec-contract.js";
-const WRITE_TOOLS = new Set(["Write", "Edit", "NotebookEdit"]);
+import { isProtectedWrite } from "../core/tool-registry.js";
 const CASE_INSENSITIVE_FS = process.platform === "darwin" || process.platform === "win32";
 const pathKey = (p) => {
     let n = p.replace(/\\/g, "/");
@@ -19,11 +19,9 @@ function frozenDenyPolicy(rootDir, frozenResolved) {
     const frozen = new Set(frozenResolved.map(pathKey));
     return {
         check(req) {
-            const toolName = req.toolName;
-            if (!WRITE_TOOLS.has(toolName))
+            if (!isProtectedWrite(req))
                 return { action: "allow" };
-            const args = req.args;
-            const raw = writeTargetPath(toolName, args);
+            const raw = writeTargetPath(req);
             if (typeof raw !== "string" || raw.length === 0)
                 return { action: "allow" };
             const absForm = isAbsolutePathForm(raw);

package/dist/orchestration/run-workflow-tool.js

@@ -10,6 +10,7 @@ import { parseWorkflowMeta, splitWorkflowMeta, workflowScriptReadsClockOrRandom
 import { mergeWorkflowArgs, normalizeStringArg } from "./workflow-script-store.js";
 import { builtinWorkflowListings, canonicalWorkflowName, resolveBuiltinWorkflow, workflowNameProbeOrder } from "./builtin-workflows.js";
 import { workflowSizeGuidelineSection } from "./workflow-size-guideline.js";
+import { toolFace } from "../core/tool-catalog-entries.js";
 export const RUN_WORKFLOW_TOOL_NAME = "Workflow";
 function stripCodeFences(s) {
     const t = s.trim();
@@ -244,7 +245,7 @@ export async function createRunWorkflowTool(d) {
     const structuredError = (message) => errorResult(JSON.stringify({ error: message }));
     return defineTool({
         name: RUN_WORKFLOW_TOOL_NAME,
-        contract: { contractId: "core.workflow@1", implementationRevision: "1" },
+        ...toolFace("workflow"),
         approvalPreview: (raw) => {
             const a = (raw ?? {});
             if (typeof a.name === "string" && a.name)
@@ -374,7 +375,6 @@ export async function createRunWorkflowTool(d) {
                     "Requires a journal-backed deployment; omit for a fresh run.",
             })),
         }),
-        effect: "write",
         execute: async (rawArgs, ctx) => {
             const rawScript = rawArgs.script;
             const rawName = rawArgs.name;

package/dist/prompt-assembly/event-registry.js

@@ -6,7 +6,7 @@ export const EVENT_PROMPT_REGISTRY = new Map([
     { kind: "plan_mode", carrier: "message.user-prefix", trust: "operator", dedupe: "replace-by-key", defaultPolicy: "off", rendererRef: "turn-attachments.ts#PLAN_MODE_FULL_BODY" },
     { kind: "date_change", carrier: "message.user-prefix", trust: "operator", dedupe: "replace-by-key", defaultPolicy: "always", rendererRef: "turn-attachments.ts#renderDateChange" },
     { kind: "instructions_change", carrier: "message.user-prefix", trust: "operator", dedupe: "replace-by-key", maxBytes: 512, defaultPolicy: "always", rendererRef: "turn-attachments.ts#collectInstructionsChange" },
-    { kind: "workflow_size_guideline_change", carrier: "message.user-prefix", trust: "operator", dedupe: "replace-by-key", defaultPolicy: "always", rendererRef: "runtask.ts#workflowSizeGuidelineChangeNotice" },
+    { kind: "workflow_size_guideline_change", carrier: "message.user-prefix", trust: "operator", dedupe: "replace-by-key", defaultPolicy: "always", rendererRef: "run-turn-boundary.ts#workflowSizeGuidelineChangeNotice" },
     { kind: "budget_usd", carrier: "message.user-prefix", trust: "operator", dedupe: "replace-by-key", defaultPolicy: "off", rendererRef: "turn-attachments.ts#renderBudgetUsd" },
     { kind: "total_tokens_reminder", carrier: "message.user-prefix", trust: "operator", dedupe: "replace-by-key", defaultPolicy: "on", rendererRef: "turn-attachments.ts#renderTotalTokensReminder" },
     { kind: "background_tasks", carrier: "message.user-prefix", trust: "operator", dedupe: "replace-by-key", defaultPolicy: "on", rendererRef: "turn-attachments.ts#renderBackgroundTasks" },
@@ -16,8 +16,8 @@ export const EVENT_PROMPT_REGISTRY = new Map([
     { kind: "mcp_instructions", carrier: "message.user-prefix", trust: "external", dedupe: "replace-by-key", defaultPolicy: "off", rendererRef: "turn-attachments.ts#renderMcpInstructionsDelta" },
     { kind: "mcp_dropped_tools", carrier: "message.user-prefix", trust: "external", dedupe: "replace-by-key", defaultPolicy: "off", rendererRef: "turn-attachments.ts#renderMcpDroppedTools" },
     { kind: "git_status", carrier: "message.user-prefix", trust: "external", dedupe: "replace-by-key", defaultPolicy: "always", rendererRef: "git-status-frame.ts#renderGitStatusFrameBody" },
-    { kind: "limit_approach_converge", carrier: "message.user-prefix", trust: "operator", dedupe: "once-per-run", defaultPolicy: "always", rendererRef: "runtask.ts#limitApproachFrames" },
-    { kind: "limit_approach_deliver", carrier: "message.user-prefix", trust: "operator", dedupe: "once-per-run", defaultPolicy: "always", rendererRef: "runtask.ts#limitApproachFrames" },
+    { kind: "limit_approach_converge", carrier: "message.user-prefix", trust: "operator", dedupe: "once-per-run", defaultPolicy: "always", rendererRef: "run-turn-boundary.ts#limitApproachFrames" },
+    { kind: "limit_approach_deliver", carrier: "message.user-prefix", trust: "operator", dedupe: "once-per-run", defaultPolicy: "always", rendererRef: "run-turn-boundary.ts#limitApproachFrames" },
     { kind: "final_verification", carrier: "message.user-prefix", trust: "operator", dedupe: "once-per-run", defaultPolicy: "always", rendererRef: "runtask.ts#final-verification" },
 ].map((e) => [e.kind, e]));
 export function eventDefaultOn(kind) {

package/dist/prompt-assembly/tool-catalog.d.ts

@@ -61,7 +61,7 @@ export declare function attachToolContract(tool: AgentTool, input: AttachContrac
 export declare function getToolContract(tool: AgentTool, fallbackOrigin?: ToolOrigin): ToolContractDescriptor;
 export declare function hasToolContract(tool: AgentTool): boolean;
 /** Manifest projection for the final mounted tool set (manifest v2 `tools`, protocol §5.4). */
-export declare function projectToolManifest(tools: AgentTool[], originOf?: (tool: AgentTool) => ToolOrigin): ToolManifestRow[];
+export declare function projectToolManifest(tools: readonly AgentTool[], originOf?: (tool: AgentTool) => ToolOrigin): ToolManifestRow[];
 /**
  * RB-15: wire-identity collision audit over the FINAL mounted tool set.
  * Rules (plan §6.2 tool row):
@@ -71,7 +71,7 @@ export declare function projectToolManifest(tools: AgentTool[], originOf?: (tool
  *     a built-in; the harness Map keeps the later mount) — NOT fatal, but returned as an explicit
  *     exemption record so the mount site can surface it (observable, never silent).
  */
-export declare function auditToolCollisions(tools: AgentTool[]): {
+export declare function auditToolCollisions(tools: readonly AgentTool[]): {
     yields: Array<{
         name: string;
     }>;

package/dist/tools/fs/fs-bash.d.ts

@@ -62,7 +62,7 @@ export declare function bashReversibilityProbe(allow?: readonly string[], bounda
  * the read-only allowlist face (`core.bash_readonly@1`). Consumed by prepare-task's
  * fullShellReachable roster assertion (its first load-bearing consumer).
  */
-export declare const FULL_SHELL_CONTRACT_ID = "core.bash@1";
+export { FULL_SHELL_CONTRACT_ID } from "../../core/tool-catalog-entries.js";
 /** The CC-verbatim exit-1 interpretation for `command`, or undefined when exit 1 means a real error.
  *  Conservative parse: last `;`/`&&`/`||`/newline statement → last `|` pipeline segment → leading
  *  command name (env-assignments skipped, path prefix stripped); `git grep`/`git diff` special-cased

package/dist/tools/fs/fs-bash.js

@@ -2,7 +2,7 @@ import { Type } from "typebox";
 import { defineTool, errorResult } from "../../core/tools.js";
 import { defaultTaskRegistry } from "../../core/task-registry.js";
 import { accountDroppedBytes, spoolDropNote } from "../../core/task-registry-shared.js";
-import { TASK_OUTPUT_TOOL_NAME, TASK_STOP_TOOL_NAME, TASK_OUTPUT_CONTRACT, TASK_STOP_CONTRACT, TASK_OUTPUT_MISSING_ID_MESSAGE, TASK_STOP_MISSING_ID_MESSAGE, TASK_STOP_PARAMS, resolveTaskIdArg, ENV_DIRECT_TASK_TOOL_CAPS, composeTaskOutputDescription, composeTaskOutputParams, composeTaskStopDescription, } from "../../core/task-tool-shape.js";
+import { TASK_OUTPUT_TOOL_NAME, TASK_STOP_TOOL_NAME, TASK_OUTPUT_MISSING_ID_MESSAGE, TASK_STOP_MISSING_ID_MESSAGE, TASK_STOP_PARAMS, resolveTaskIdArg, ENV_DIRECT_TASK_TOOL_CAPS, composeTaskOutputDescription, composeTaskOutputParams, composeTaskStopDescription, } from "../../core/task-tool-shape.js";
 import { hasBackgroundShell } from "../../core/background-shell.js";
 import { delimitUntrusted } from "../../core/untrusted-text.js";
 import { MCP_IMAGE_MAX_BASE64 } from "../../core/mcp.js";
@@ -12,6 +12,7 @@ import { ghRateLimitHint } from "./gh-rate-limit.js";
 import { resolveBashTimeoutCaps, bashTimeoutCapsSec, bashTimeoutArgRefusal, bashTimeoutParamDescription, envErrorDetail, bashMaxOutputChars, clipShellOutput, writeShellOverflowFile, createShellOverflowSpoolFence, shellRecoveryHint, CWD_SENTINEL, BASH_READONLY_CONFINEMENT_NOTE, } from "./fs-shared.js";
 import { PROBE_CAUSE_PATH_MAX, inlineUntrusted } from "../../core/untrusted-text.js";
 import { BASH_CLASSIFY_DEFAULT_ALLOW, BASH_READONLY_DEFAULT_ALLOW, coarseReadonlyCheck, classifyBoundedReadonlyPollLoop, classifyCompoundReadonlyDetailed, classifyOutOfRootReadGate, classifySimpleCommandReadBoundary, NOT_AUTO_ALLOWED, } from "./bash-readonly-classifier.js";
+import { toolFace } from "../../core/tool-catalog-entries.js";
 const RECURSIVE_CAUSE_MAX_PATHS = 3;
 const RECURSIVE_READ_CAUSE_CODE = "shell.recursive_read_unbounded";
 function operandFamily(paths) {
@@ -58,7 +59,7 @@ export function bashReversibilityProbe(allow, boundary) {
             : { reversible: false, ...outOfRootGate() };
     };
 }
-export const FULL_SHELL_CONTRACT_ID = "core.bash@1";
+export { FULL_SHELL_CONTRACT_ID } from "../../core/tool-catalog-entries.js";
 const EXIT1_INTERPRETATION = {
     grep: "No matches found",
     rg: "No matches found",
@@ -537,7 +538,7 @@ export function createBashTool(env, rootCanonical, coAuthor = false, cwdRef = {
     const bgEnvIsolatedOwned = hasDestroy(env) && isIsolated(env);
     return defineTool({
         name: "Bash",
-        contract: { contractId: FULL_SHELL_CONTRACT_ID, implementationRevision: "1" },
+        ...toolFace("bash"),
         description: bashDescription(coAuthor, timeoutCaps, bgNotifies, bgRetained, bgSessionScoped, bgEnvIsolatedOwned),
         parameters: Type.Object({
             command: Type.String({ description: "The command to execute" }),
@@ -559,8 +560,6 @@ export function createBashTool(env, rootCanonical, coAuthor = false, cwdRef = {
                 description: "Set to true to run this command in the background.",
             })),
         }),
-        effect: "write",
-        contentOrigin: "execution",
         isConcurrencySafe: (args) => {
             const cmd = args?.command;
             if (typeof cmd !== "string")
@@ -991,7 +990,7 @@ export function createBashReadonlyTool(env, rootCanonical, allow, opts) {
     const canonicalBoundary = createCanonicalReadBoundary(env, readRoots);
     return defineTool({
         name: "Bash",
-        contract: { contractId: "core.bash_readonly@1", implementationRevision: "1" },
+        ...toolFace("bash-readonly"),
         description: `Run a SINGLE read-only inspection command (e.g. ${sample}, …) and return its output. Shell ` +
             "operators (pipes, redirects, ;, &&, command substitution, subshells) are rejected and only " +
             "allowlisted commands run. Reads are confined to the workspace root(s): a path outside them is " +
@@ -1002,7 +1001,6 @@ export function createBashReadonlyTool(env, rootCanonical, allow, opts) {
             command: Type.String({ description: "A single allowlisted read-only command (no shell operators)." }),
             timeout: Type.Optional(Type.Number({ description: bashTimeoutParamDescription(timeoutCaps, true) })),
         }),
-        effect: "read",
         execute: async (args, ctx) => {
             const { command, timeout } = args;
             const timeoutRefusal = bashTimeoutArgRefusal(timeout, timeoutCaps);
@@ -1035,10 +1033,9 @@ export function createBashReadonlyTool(env, rootCanonical, allow, opts) {
 export function createEnvTaskOutputTool(env) {
     return defineTool({
         name: TASK_OUTPUT_TOOL_NAME,
-        contract: TASK_OUTPUT_CONTRACT,
+        ...toolFace("task-output-hands"),
         description: composeTaskOutputDescription(ENV_DIRECT_TASK_TOOL_CAPS),
         parameters: composeTaskOutputParams(ENV_DIRECT_TASK_TOOL_CAPS),
-        effect: "read",
         execute: async (args) => {
             const { task_id, filter } = args;
             const id = resolveTaskIdArg(task_id);
@@ -1073,10 +1070,9 @@ export function createEnvTaskOutputTool(env) {
 export function createEnvTaskStopTool(env, registry = defaultTaskRegistry) {
     return defineTool({
         name: TASK_STOP_TOOL_NAME,
-        contract: TASK_STOP_CONTRACT,
+        ...toolFace("task-stop-hands"),
         description: composeTaskStopDescription(ENV_DIRECT_TASK_TOOL_CAPS),
         parameters: TASK_STOP_PARAMS,
-        effect: "write",
         execute: async (args) => {
             const { task_id, shell_id } = args;
             const id = resolveTaskIdArg(task_id, shell_id);

package/dist/tools/fs/fs-read.js

@@ -9,6 +9,7 @@ import { MAX_READ_BYTES, SLICED_READ_MAX_BYTES, MAX_IMAGE_READ_BYTES, MAX_IMAGE_
 import { readPdfFile, pdfResultToToolReturn } from "./fs-pdf.js";
 import { openSystemReminder } from "../../core/reminder-mint.js";
 import { discloseReminderShaped } from "../../core/reminder-disclosure.js";
+import { toolFace } from "../../core/tool-catalog-entries.js";
 export function createReadFileTool(env, state, rootCanonical, cwdRef, additionalRoots, imageDownsampler, pdfCapabilities, bgOutputReadExemption, readCyberReminder, readDeny, readFace, reminderMark, reminderDisclosureCounts) {
     const cyberReminder = readCyberReminder === false ? "" : readCyberReminderText(reminderMark);
     const reminderDisclosureWindows = new Map();
@@ -23,7 +24,7 @@ export function createReadFileTool(env, state, rootCanonical, cwdRef, additional
         : "- `file_path` may be relative (resolved against the tracked working directory) or absolute (within the configured roots).\n";
     return defineTool({
         name: "Read",
-        contract: { contractId: "core.read@1", implementationRevision: "1" },
+        ...toolFace("read"),
         description: "Reads a file from the local filesystem.\n" +
             "\n" +
             pathBoundLine +
@@ -55,7 +56,6 @@ export function createReadFileTool(env, state, rootCanonical, cwdRef, additional
             limit: Type.Optional(Type.Integer({ minimum: 1, description: "The number of lines to read. Only provide if the file is too large to read at once. (Default: the whole file, bounded by the output-token cap.)" })),
             pages: Type.Optional(Type.String({ description: `Page range for PDF files (e.g., "1-5", "3", "10-20"). Only applicable to PDF files. Maximum ${PDF_MAX_PAGES_PER_READ} pages per request.` })),
         }),
-        effect: "read",
         execute: async (args, ctx) => {
             const { offset, limit, pages } = args;
             const path = fileArgPath(args);

package/dist/tools/fs/fs-search-tools.d.ts

@@ -1,5 +1,4 @@
 import type { AgentTool, ExecutionEnv } from "../../internal/harness-types.js";
-import type { ToolEffect } from "../../core/types.js";
 import type { ReadDenyMatcher } from "./read-deny.js";
 import type { ReadFace } from "./read-face.js";
 /**
@@ -13,9 +12,3 @@ import type { ReadFace } from "./read-face.js";
 export declare function grepDetailFields(text: string, mode: "files_with_matches" | "content" | "count", offset?: number, structuredRows?: readonly import("./search.js").GrepRow[]): Record<string, unknown>;
 export declare function createGrepTool(env: ExecutionEnv, rootCanonical: string, additionalRoots?: readonly string[], readDeny?: ReadDenyMatcher, readFace?: ReadFace): AgentTool;
 export declare function createGlobTool(env: ExecutionEnv, rootCanonical: string, additionalRoots?: readonly string[], readDeny?: ReadDenyMatcher, readFace?: ReadFace): AgentTool;
-/** Static side-effect class of every hand tool, by name (design/44 §3). Used by prepare-task to (a) feed
- *  wake/resume reconciliation and (b) drive the verifier read-only boundary. Every mutating hand tool is
- *  `write` (RB-264 ⑥W1 folded `Write` back in — see below); `bash` is `write` (a command can do anything);
- *  `bash_readonly` is `read` (so it survives the verifier boundary — but still goes through the policy
- *  gate, council #7: effect:read is a redo-safety class, never a policy circumvention). */
-export declare const HAND_TOOL_EFFECTS: Readonly<Record<string, ToolEffect>>;

package/dist/tools/fs/fs-search-tools.js

@@ -2,6 +2,7 @@ import { Type } from "typebox";
 import { defineTool, errorResult } from "../../core/tools.js";
 import { resolveKey, violationText, violationDetails } from "./safety.js";
 import { runGrepDetailed, runGlobDetailed, splitAbsoluteGlobPattern, invalidGlobTokens } from "./search.js";
+import { toolFace } from "../../core/tool-catalog-entries.js";
 export function grepDetailFields(text, mode, offset, structuredRows) {
     const structuredIdentityComplete = structuredRows !== undefined && structuredRows.every((r) => r.path !== undefined || r.text === "--");
     const structuredPaths = structuredIdentityComplete && structuredRows !== undefined ? [...new Set(structuredRows.filter((r) => r.path !== undefined).map((r) => r.path))] : undefined;
@@ -74,7 +75,7 @@ export function grepDetailFields(text, mode, offset, structuredRows) {
 export function createGrepTool(env, rootCanonical, additionalRoots, readDeny, readFace) {
     return defineTool({
         name: "Grep",
-        contract: { contractId: "core.grep@1", implementationRevision: "1" },
+        ...toolFace("grep"),
         description: "Content search built on ripgrep. Prefer this over `grep`/`rg` via Bash — results integrate with the permission UI and file links.\n" +
             "\n" +
             '- Full regex syntax (e.g. "log.*Error", "function\\s+\\w+"). Ripgrep, not grep — escape literal braces (`interface\\{\\}`).\n' +
@@ -107,7 +108,6 @@ export function createGrepTool(env, rootCanonical, additionalRoots, readDeny, re
             })),
             offset: Type.Optional(Type.Number({ description: "Skip the first N output lines (pagination partner of head_limit)." })),
         }),
-        effect: "read",
         execute: async (args, ctx) => {
             const retired = args;
             for (const [name, repair] of [
@@ -175,7 +175,7 @@ export function createGrepTool(env, rootCanonical, additionalRoots, readDeny, re
 export function createGlobTool(env, rootCanonical, additionalRoots, readDeny, readFace) {
     return defineTool({
         name: "Glob",
-        contract: { contractId: "core.glob@1", implementationRevision: "1" },
+        ...toolFace("glob"),
         description: 'Fast file pattern matching. Supports glob patterns like "**/*.js" or "src/**/*.ts". Returns matching file paths sorted by modification time.\n' +
             "\n" +
             "- On environments that do not report modification times, results fall back to alphabetical order\n" +
@@ -194,7 +194,6 @@ export function createGlobTool(env, rootCanonical, additionalRoots, readDeny, re
             })),
             max_results: Type.Optional(Type.Number({ description: "Cap results (default 500)." })),
         }),
-        effect: "read",
         execute: async (args, ctx) => {
             let { pattern, path } = args;
             const { max_results } = args;
@@ -222,15 +221,3 @@ export function createGlobTool(env, rootCanonical, additionalRoots, readDeny, re
         },
     });
 }
-export const HAND_TOOL_EFFECTS = {
-    Read: "read",
-    Edit: "write",
-    Write: "write",
-    NotebookEdit: "write",
-    Grep: "read",
-    Glob: "read",
-    RepoMap: "read",
-    Bash: "write",
-    TaskOutput: "read",
-    TaskStop: "write",
-};

package/dist/tools/fs/fs-write.js

@@ -4,6 +4,7 @@ import { defineTool, errorResult } from "../../core/tools.js";
 import { sha256, resolveKey, violationText, violationDetails, requireRead, checkStale, checkEditMatch, checkNoChange, fileArgPath, resolveQuoteMatch, adaptNewStringQuotes, resolveEscapeMatch, adaptNewStringEscapes, escapeMatchWasAttempted, ESCAPE_MATCH_MISS_NOTE, deletionOldString, countOccurrences, READ_REFUSED_ESCAPE_HINT, } from "./safety.js";
 import { decodeTextBytes, encodeTextForFile, normalizeEditText, normalizeFileText } from "./encoding.js";
 import { MAX_EDIT_BYTES, decodeEditBytes, tooLargeToEditMessage, truncatedUtf16BodyMessage, persistedTextOf, notReadRefusalText, enoentMessage, FILE_STATE_TRAILER, FILE_PATH_PARAMS, ipynbRedirect, countLines, applyRecordedEdit, } from "./fs-shared.js";
+import { toolFace } from "../../core/tool-catalog-entries.js";
 async function envFinalWrite(env, key, content, signal, opts) {
     const fireEdited = () => {
         if (opts?.edited?.hook === undefined)
@@ -88,7 +89,7 @@ async function gateToolWrite(hook, tool, path, key, content) {
 export function createEditFileTool(env, state, rootCanonical, cwdRef, additionalRoots, beforeWrite, trackEdit, onEdited) {
     return defineTool({
         name: "Edit",
-        contract: { contractId: "core.edit@1", implementationRevision: "1" },
+        ...toolFace("edit"),
         description: "Performs exact string replacement in a file.\n" +
             "\n" +
             "- You must Read the file in this conversation before editing, or the call will fail.\n" +
@@ -101,7 +102,6 @@ export function createEditFileTool(env, state, rootCanonical, cwdRef, additional
             new_string: Type.Optional(Type.String({ description: "The text to replace it with (must be different from old_string)" })),
             replace_all: Type.Optional(Type.Boolean({ description: "Replace all occurrences of old_string (default false)" })),
         }),
-        effect: "write",
         validateInput: async (args, ctx) => {
             const a = args;
             if (Array.isArray(a.edits) && a.edits.length > 0)
@@ -327,7 +327,7 @@ export function createEditFileTool(env, state, rootCanonical, cwdRef, additional
 export function createWriteFileTool(env, state, rootCanonical, cwdRef, additionalRoots, beforeWrite, trackEdit, onEdited) {
     return defineTool({
         name: "Write",
-        contract: { contractId: "core.write@1", implementationRevision: "1" },
+        ...toolFace("write"),
         description: "Writes a file to the local filesystem, overwriting if one exists.\n" +
             "\n" +
             "When to use: creating a new file, or fully replacing one you've already Read. Overwriting an existing " +
@@ -337,7 +337,6 @@ export function createWriteFileTool(env, state, rootCanonical, cwdRef, additiona
             ...FILE_PATH_PARAMS,
             content: Type.String({ description: "The content to write to the file" }),
         }),
-        effect: "write",
         validateInput: async (args, ctx) => {
             const path = fileArgPath(args);
             if (path === undefined)
@@ -427,7 +426,7 @@ const NOTEBOOK_CELL_ID_REQUIRED_MESSAGE = `Error (NotebookEdit): cell_id is requ
 export function createNotebookEditTool(env, state, rootCanonical, cwdRef, additionalRoots, beforeWrite, trackEdit, onEdited) {
     return defineTool({
         name: "NotebookEdit",
-        contract: { contractId: "core.notebook_edit@1", implementationRevision: "1" },
+        ...toolFace("notebook-edit"),
         description: "Replaces, inserts, or deletes a single cell in a Jupyter notebook (.ipynb file).\n" +
             "\n" +
             "Usage:\n" +
@@ -449,7 +448,6 @@ export function createNotebookEditTool(env, state, rootCanonical, cwdRef, additi
                 description: "The type of edit to make (replace, insert, delete). Defaults to replace.",
             })),
         }),
-        effect: "write",
         validateInput: async (args, ctx) => {
             const a = args;
             const mode = a.edit_mode ?? "replace";

package/dist/tools/fs/repo-map.js

@@ -2,6 +2,7 @@ import { Type } from "typebox";
 import { defineTool, errorResult } from "../../core/tools.js";
 import { resolveKey, violationText, violationDetails } from "./safety.js";
 import { buildIgnore, denyWithheldNote, walk, walkIsPartial } from "./search.js";
+import { toolFace } from "../../core/tool-catalog-entries.js";
 const DEFAULT_MAX_CHARS = 16_000;
 const DEFAULT_MAX_FILES = 400;
 const FILE_SCAN_MAX_BYTES = 256 * 1024;
@@ -82,7 +83,7 @@ function rankEntries(a, b) {
 export function createRepoMapTool(env, rootCanonical, additionalRoots, readDeny, readFace) {
     return defineTool({
         name: "RepoMap",
-        contract: { contractId: "core.repo_map@1", implementationRevision: "1" },
+        ...toolFace("repo-map"),
         description: "Get a compact map of the repository: each source file with its top-level symbols (functions, " +
             "classes, types). Use this FIRST to orient in an unfamiliar codebase before grepping — it shows " +
             "what exists and where, so you can jump to the relevant files. Token-budgeted and honest about " +
@@ -92,7 +93,6 @@ export function createRepoMapTool(env, rootCanonical, additionalRoots, readDeny,
             max_chars: Type.Optional(Type.Number({ description: `Token budget for the rendered map in chars (default ${DEFAULT_MAX_CHARS}; a very small value yields only a truncation note).` })),
             max_files: Type.Optional(Type.Number({ description: `Max files to scan (default ${DEFAULT_MAX_FILES}).` })),
         }),
-        effect: "read",
         execute: async (args, ctx) => {
             const a = args;
             const signal = ctx.signal;

package/dist/tools/fs/safety.d.ts

@@ -1,4 +1,5 @@
 import type { ExecutionEnv } from "../../internal/harness-types.js";
+import { protectivePathTargetOf, type ToolCallLike } from "../../core/tool-registry.js";
 /**
  * batch-B (CC 2.1.187 parity): Read/Edit/Write take the file path as `file_path`. Read the target the same way
  * EVERYWHERE the path is consumed from a tool-call's args — not just the tool body but ALSO every gate that
@@ -28,7 +29,7 @@ export declare function fileArgPath(args: unknown): string | undefined;
  * this module stays dependency-free of the alias table — "NotebookEdit" is the canonical CC name and
  * old→new normalization is identity for it).
  */
-export declare function writeTargetPath(canonicalName: string, args: unknown): string | undefined;
+export declare function writeTargetPath(call: ToolCallLike, pt?: ReturnType<typeof protectivePathTargetOf>): string | undefined;
 /**
  * The "hand" file tools (design/44) — safety invariants ported from CC's `FileEditTool` (design/43 Rule
  * 7): without these a weak model blind-edits / overwrites files (P0 safety, not polish). This module is