agentfootprint 13.0.0 → 14.0.0

package/dist/core/agent/stages/toolCalls/access/capabilityQuestion.js

@@ -0,0 +1,81 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildCapabilityQuestion = void 0;
+const bindings_js_1 = require("./bindings.js");
+const frozenCopy_js_1 = require("../../../../../lib/frozenCopy.js");
+/** Bind the existing per-call capability question to its original live cells. */
+function buildCapabilityQuestion(bindings) {
+    /**
+     * Ask the checker about ONE capability beyond `'tool_call'`, and apply
+     * the verdict exactly as the gate above applies its own (9.11.0).
+     *
+     * Called only when BOTH sides declared the capability, so a checker
+     * that never opted in is never asked and never has to answer a
+     * question it was not written for. `sequence` is deliberately absent —
+     * the port says it is empty for non-`tool_call` capabilities, and the
+     * in-flight tool sequence is not evidence about a capability.
+     */
+    const askCapability = async (capability, target, genericHaltText) => {
+        if (!bindings.permissionChecker)
+            return;
+        try {
+            const decision = await bindings.permissionChecker.check({
+                capability,
+                actor: 'agent',
+                target,
+                context: (0, bindings_js_1.checkerContextOf)(bindings.viewOf(bindings.callArguments.callArgs)),
+                history: bindings.historyForCallbacks(),
+                iteration: bindings.iteration,
+                ...(bindings.runIdentity && { identity: bindings.runIdentity }),
+                ...(bindings.env.signal && { signal: bindings.env.signal }),
+            });
+            bindings.emitSecurity('agentfootprint.permission.check', {
+                capability,
+                actor: 'agent',
+                target,
+                result: decision.result,
+                ...(decision.policyRuleId !== undefined && { policyRuleId: decision.policyRuleId }),
+                ...(decision.rationale !== undefined && { rationale: decision.rationale }),
+                ...(decision.reason !== undefined && { reason: decision.reason }),
+            });
+            if (decision.result === 'deny') {
+                bindings.execution.denied = true;
+                bindings.outcome.result =
+                    decision.tellLLM ?? `[permission denied: ${decision.rationale ?? 'policy'}]`;
+            }
+            else if (decision.result === 'halt') {
+                bindings.execution.denied = true;
+                // Same reasoning as the tool_call halt: `reason` is a telemetry
+                // tag and teaching the model the rule space is not a service.
+                const tellLLM = decision.tellLLM ?? genericHaltText;
+                bindings.outcome.result = tellLLM;
+                bindings.execution.haltContext = {
+                    reason: decision.reason ?? decision.rationale ?? 'policy-halt',
+                    tellLLM,
+                    ...(bindings.permissionChecker.name && { checkerId: bindings.permissionChecker.name }),
+                };
+            }
+        }
+        catch (permErr) {
+            (0, frozenCopy_js_1.warnFrozenWrite)('permission checker', permErr, 'the call was denied');
+            // Fail closed, and say so terminally — the 9.4.0 lesson applies
+            // whole: an operator's outage text reads as weather to a model.
+            bindings.execution.denied = true;
+            const msg = permErr instanceof Error ? permErr.message : String(permErr);
+            bindings.emitSecurity('agentfootprint.permission.check', {
+                capability,
+                actor: 'agent',
+                target,
+                result: 'deny',
+                rationale: `permission-checker threw: ${msg}`,
+            });
+            bindings.outcome.result =
+                `[permission denied: Tool '${bindings.tc.name}' could not be authorized. This will not ` +
+                    `change during this run — do not call it again. Continue without it, or say ` +
+                    `what you are unable to do.]`;
+        }
+    };
+    return askCapability;
+}
+exports.buildCapabilityQuestion = buildCapabilityQuestion;
+//# sourceMappingURL=capabilityQuestion.js.map

package/dist/core/agent/stages/toolCalls/access/capabilityQuestion.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilityQuestion.js","sourceRoot":"","sources":["../../../../../../src/core/agent/stages/toolCalls/access/capabilityQuestion.ts"],"names":[],"mappings":";;;AAMA,+CAAiD;AACjD,oEAAmE;AAmBnE,iFAAiF;AACjF,SAAgB,uBAAuB,CAAC,QAAoC;IAC1E;;;;;;;;;OASG;IACH,MAAM,aAAa,GAAG,KAAK,EACzB,UAAgC,EAChC,MAAc,EACd,eAAuB,EACR,EAAE;QACjB,IAAI,CAAC,QAAQ,CAAC,iBAAiB;YAAE,OAAO;QACxC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,iBAAiB,CAAC,KAAK,CAAC;gBACtD,UAAU;gBACV,KAAK,EAAE,OAAO;gBACd,MAAM;gBACN,OAAO,EAAE,IAAA,8BAAgB,EAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;gBAC3E,OAAO,EAAE,QAAQ,CAAC,mBAAmB,EAAE;gBACvC,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,GAAG,CAAC,QAAQ,CAAC,WAAW,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC;gBAC/D,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;aAC5D,CAAC,CAAC;YACH,QAAQ,CAAC,YAAY,CAAC,iCAAiC,EAAE;gBACvD,UAAU;gBACV,KAAK,EAAE,OAAO;gBACd,MAAM;gBACN,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,GAAG,CAAC,QAAQ,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC;gBACnF,GAAG,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC;gBAC1E,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;aAClE,CAAC,CAAC;YACH,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC/B,QAAQ,CAAC,SAAS,CAAC,MAAM,GAAG,IAAI,CAAC;gBACjC,QAAQ,CAAC,OAAO,CAAC,MAAM;oBACrB,QAAQ,CAAC,OAAO,IAAI,uBAAuB,QAAQ,CAAC,SAAS,IAAI,QAAQ,GAAG,CAAC;YACjF,CAAC;iBAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBACtC,QAAQ,CAAC,SAAS,CAAC,MAAM,GAAG,IAAI,CAAC;gBACjC,gEAAgE;gBAChE,8DAA8D;gBAC9D,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,IAAI,eAAe,CAAC;gBACpD,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC;gBAClC,QAAQ,CAAC,SAAS,CAAC,WAAW,GAAG;oBAC/B,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,SAAS,IAAI,aAAa;oBAC9D,OAAO;oBACP,GAAG,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC;iBACvF,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,OAAO,EAAE,CAAC;YACjB,IAAA,+BAAe,EAAC,oBAAoB,EAAE,OAAO,EAAE,qBAAqB,CAAC,CAAC;YACtE,gEAAgE;YAChE,gEAAgE;YAChE,QAAQ,CAAC,SAAS,CAAC,MAAM,GAAG,IAAI,CAAC;YACjC,MAAM,GAAG,GAAG,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACzE,QAAQ,CAAC,YAAY,CAAC,iCAAiC,EAAE;gBACvD,UAAU;gBACV,KAAK,EAAE,OAAO;gBACd,MAAM;gBACN,MAAM,EAAE,MAAM;gBACd,SAAS,EAAE,6BAA6B,GAAG,EAAE;aAC9C,CAAC,CAAC;YACH,QAAQ,CAAC,OAAO,CAAC,MAAM;gBACrB,6BAA6B,QAAQ,CAAC,EAAE,CAAC,IAAI,2CAA2C;oBACxF,6EAA6E;oBAC7E,6BAA6B,CAAC;QAClC,CAAC;IACH,CAAC,CAAC;IACF,OAAO,aAAa,CAAC;AACvB,CAAC;AAzED,0DAyEC"}

package/dist/core/agent/stages/toolCalls/access/checkInAdmission.js

@@ -0,0 +1,144 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.admitCheckInCall = void 0;
+const checkin_js_1 = require("../../../../checkin.js");
+const consentRequest_js_1 = require("../../../../consentRequest.js");
+const bindings_js_1 = require("./bindings.js");
+const frozenCopy_js_1 = require("../../../../../lib/frozenCopy.js");
+const typedEmit_js_1 = require("../../../../../recorders/core/typedEmit.js");
+const toolShownArgs_js_1 = require("../../../../toolShownArgs.js");
+const privateAnswers_js_1 = require("../../../arguments/privateAnswers.js");
+/** Existing checkInAdmission body; the owning handler retains its admission guard and native pause return. */
+async function admitCheckInCall(scope, deps, frame) {
+    // Computed ONLY for a checkIn-declaring tool → zero cost otherwise.
+    // Shape shared with the ask-resume gate; see `historyForCheckIn`.
+    const historyForEvidence = frame.historyForCheckIn(scope, frame.historyForCallbacks());
+    const trips = (0, checkin_js_1.shouldCheckIn)(frame.tool.checkIn, frame.viewOf(frame.callArguments.callArgs) ?? frame.callArguments.callArgs, {
+        iteration: frame.iteration,
+        toolCallId: frame.tc.id,
+        history: historyForEvidence,
+    });
+    if (trips && frame.askedLayer === undefined)
+        (0, privateAnswers_js_1.requirePrivateQuestionSupport)(scope, [frame.tool]);
+    // The request the person would be asked (`core/consentRequest.ts`):
+    // an id their decision must quote, bound to a detached copy of this
+    // exact call — minted only for a call that is about to pause.
+    const bound = trips && frame.askedLayer === undefined
+        ? (0, consentRequest_js_1.mintConsentRequest)({
+            gate: 'checkIn',
+            tool: frame.tc.name,
+            toolCallId: frame.tc.id,
+            party: frame.resolved.party,
+            args: frame.callArguments.callArgs,
+        }, frame.decisionLedger)
+        : undefined;
+    // What the person is shown — and the evidence assembler and every
+    // `checkin.request` listener handed: the call's shared frozen copy
+    // (equal to `bound.args`, which was copied from the same arguments).
+    // The paused state keeps `bound.args`, the copy the request is bound
+    // to, so nothing that sees the question can change the call the
+    // answer runs.
+    const shown = bound === undefined ? undefined : frame.viewOf((0, toolShownArgs_js_1.shownArgsOf)(frame.tool, bound.args));
+    if (!trips) {
+        // Predicate said no — fall through to the normal credential+execute
+        // path below (this `if` block is the ONLY thing the gate adds).
+    }
+    else if (frame.askedLayer !== undefined) {
+        // One human question per resume (honesty layer 2, step 4): this
+        // batch already paused to ask the person for argument values, and
+        // the re-run that carries the answer has no second pause to give.
+        // The gate's question is not asked and the tool does not run.
+        frame.consentGate.checkInRefused = true;
+        frame.outcome.error = true;
+        // The person's answers the call carried are kept for its next
+        // proposal, where the check-in pauses as it always does.
+        frame.outcome.result =
+            frame.askedLayer.secondPauseRefusal(frame.tc.name, 'check-in') +
+                frame.askedLayer.keptNote(scope, frame.tc.name, frame.resolution, frame.tool, frame.callArguments.callArgs);
+    }
+    else if (bound === undefined || shown === undefined) {
+        // A call no approval could be bound to is refused, never asked.
+        frame.consentGate.checkInRefused = true;
+        frame.outcome.error = true;
+        frame.outcome.result = (0, bindings_js_1.unboundCallRefusal)(frame.tc.name, 'checkIn');
+    }
+    else {
+        (0, privateAnswers_js_1.markPrivateCheckIn)(scope, frame.tool, bound.args);
+        // The tool's declared decision component (9.24.0), judged BEFORE
+        // the evidence pack is assembled — a gate that cannot be honored
+        // as declared refuses before any work, and a dangling propsRef is
+        // refused at this source rather than discovered by the screen.
+        const gateComponent = frame.tool.checkInComponent !== undefined
+            ? await frame.assertComponentDeliverable(scope, frame.tc.name, frame.tool.checkInComponent, `tool '${frame.tc.name}' checkInComponent`)
+            : undefined;
+        const intent = scope.llmLatestContent ? String(scope.llmLatestContent) : undefined;
+        let evidence;
+        try {
+            evidence = await deps.checkIn.assembler({
+                tool: { name: frame.tc.name, description: frame.tool.schema.description },
+                args: shown,
+                ...(intent !== undefined && { intent }),
+                iteration: frame.iteration,
+                history: historyForEvidence,
+                scorer: deps.checkIn.scorer,
+                ...(frame.env.signal && { signal: frame.env.signal }),
+            });
+        }
+        catch (err) {
+            // An assembler that wrote into its frozen arguments fails the
+            // check-in as any throw does — said once, in dev mode.
+            (0, frozenCopy_js_1.warnFrozenWrite)('check-in evidence assembler', err, 'the check-in failed');
+            throw err;
+        }
+        const request = {
+            id: bound.request.id,
+            tool: frame.tc.name,
+            args: shown,
+            ...(intent !== undefined && { intent }),
+            evidence,
+            ...(gateComponent !== undefined && { component: gateComponent }),
+        };
+        (0, typedEmit_js_1.typedEmit)(scope, 'agentfootprint.checkin.request', {
+            toolName: frame.tc.name,
+            toolCallId: frame.tc.id,
+            iteration: frame.iteration,
+            request: request,
+        });
+        // Commit partial state so resume() finds history intact (mirror the
+        // pauseHere path). The bound copy of the args rides the checkpoint,
+        // so an APPROVED tool executes exactly what was asked.
+        scope.history = frame.newHistory;
+        scope.pausedToolCallId = frame.tc.id;
+        scope.pausedToolName = frame.tc.name;
+        scope.pausedToolStartMs = frame.startMs;
+        scope.pausedCheckIn = true;
+        scope.pausedCheckInArgs = bound.args;
+        scope.pausedRequest = bound.request;
+        // Same carrier as the middleware-ask pause (9.92.0).
+        if (frame.resolved.party !== undefined)
+            scope.pausedToolParty = frame.resolved.party;
+        // Which surface will collect the decision — read back on resume
+        // so `checkin.decision` says which component ANSWERED. Written
+        // only when one exists (byte-identical otherwise).
+        if (gateComponent !== undefined)
+            scope.pausedComponentId = gateComponent.componentId;
+        // Open until a person decides: `submitted`, without the text.
+        frame.fileScript(scope, {
+            tool: frame.tool,
+            toolName: frame.tc.name,
+            toolCallId: frame.tc.id,
+            iteration: frame.iteration,
+            proposed: frame.proposedProgram,
+            submitted: frame.programOfCall(frame.tool, bound.args),
+            settlement: 'not-entered',
+            paused: true,
+        });
+        // Returning a defined value triggers the footprintjs pause; the
+        // returned object becomes the checkpoint's pauseData. detectPause
+        // surfaces `pauseData.checkIn` as `outcome.checkIn`.
+        return { toolCallId: frame.tc.id, toolName: frame.tc.name, checkIn: request };
+    }
+    return undefined;
+}
+exports.admitCheckInCall = admitCheckInCall;
+//# sourceMappingURL=checkInAdmission.js.map

package/dist/core/agent/stages/toolCalls/access/checkInAdmission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkInAdmission.js","sourceRoot":"","sources":["../../../../../../src/core/agent/stages/toolCalls/access/checkInAdmission.ts"],"names":[],"mappings":";;;AAUA,uDAA4E;AAC5E,qEAIuC;AACvC,+CAAmD;AACnD,oEAAmE;AACnE,6EAAuE;AAEvE,mEAA2D;AAC3D,4EAG8C;AAgC9C,8GAA8G;AACvG,KAAK,UAAU,gBAAgB,CACpC,KAA6B,EAC7B,IAA2C,EAC3C,KAA4B;IAE5B,oEAAoE;IACpE,kEAAkE;IAClE,MAAM,kBAAkB,GAAG,KAAK,CAAC,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,mBAAmB,EAAE,CAAC,CAAC;IACvF,MAAM,KAAK,GAAG,IAAA,0BAAa,EACzB,KAAK,CAAC,IAAI,CAAC,OAAQ,EACnB,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,aAAa,CAAC,QAAQ,EAC1E;QACE,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC,EAAE;QACvB,OAAO,EAAE,kBAAkB;KAC5B,CACF,CAAC;IACF,IAAI,KAAK,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;QAAE,IAAA,iDAA6B,EAAC,KAAK,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAChG,oEAAoE;IACpE,oEAAoE;IACpE,8DAA8D;IAC9D,MAAM,KAAK,GACT,KAAK,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;QACrC,CAAC,CAAC,IAAA,sCAAkB,EAChB;YACE,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI;YACnB,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC,EAAE;YACvB,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK;YAC3B,IAAI,EAAE,KAAK,CAAC,aAAa,CAAC,QAAQ;SACf,EACrB,KAAK,CAAC,cAAc,CACrB;QACH,CAAC,CAAC,SAAS,CAAC;IAChB,kEAAkE;IAClE,mEAAmE;IACnE,qEAAqE;IACrE,qEAAqE;IACrE,gEAAgE;IAChE,eAAe;IACf,MAAM,KAAK,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAA,8BAAW,EAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAClG,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,oEAAoE;QACpE,gEAAgE;IAClE,CAAC;SAAM,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAC1C,gEAAgE;QAChE,kEAAkE;QAClE,kEAAkE;QAClE,8DAA8D;QAC9D,KAAK,CAAC,WAAW,CAAC,cAAc,GAAG,IAAI,CAAC;QACxC,KAAK,CAAC,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC;QAC3B,8DAA8D;QAC9D,yDAAyD;QACzD,KAAK,CAAC,OAAO,CAAC,MAAM;YAClB,KAAK,CAAC,UAAU,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,UAAU,CAAC;gBAC9D,KAAK,CAAC,UAAU,CAAC,QAAQ,CACvB,KAAK,EACL,KAAK,CAAC,EAAE,CAAC,IAAI,EACb,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,aAAa,CAAC,QAAQ,CAC7B,CAAC;IACN,CAAC;SAAM,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACtD,gEAAgE;QAChE,KAAK,CAAC,WAAW,CAAC,cAAc,GAAG,IAAI,CAAC;QACxC,KAAK,CAAC,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC;QAC3B,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,IAAA,gCAAkB,EAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACtE,CAAC;SAAM,CAAC;QACN,IAAA,sCAAkB,EAAC,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAClD,iEAAiE;QACjE,iEAAiE;QACjE,kEAAkE;QAClE,+DAA+D;QAC/D,MAAM,aAAa,GACjB,KAAK,CAAC,IAAI,CAAC,gBAAgB,KAAK,SAAS;YACvC,CAAC,CAAC,MAAM,KAAK,CAAC,0BAA0B,CACpC,KAAK,EACL,KAAK,CAAC,EAAE,CAAC,IAAI,EACb,KAAK,CAAC,IAAI,CAAC,gBAAgB,EAC3B,SAAS,KAAK,CAAC,EAAE,CAAC,IAAI,oBAAoB,CAC3C;YACH,CAAC,CAAC,SAAS,CAAC;QAChB,MAAM,MAAM,GAAG,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACnF,IAAI,QAAoC,CAAC;QACzC,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAQ,CAAC,SAAS,CAAC;gBACvC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE;gBACzE,IAAI,EAAE,KAAK;gBACX,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,CAAC;gBACvC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,OAAO,EAAE,kBAAkB;gBAC3B,MAAM,EAAE,IAAI,CAAC,OAAQ,CAAC,MAAM;gBAC5B,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;aACtD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,8DAA8D;YAC9D,uDAAuD;YACvD,IAAA,+BAAe,EAAC,6BAA6B,EAAE,GAAG,EAAE,qBAAqB,CAAC,CAAC;YAC3E,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,OAAO,GAAmB;YAC9B,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE;YACpB,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI;YACnB,IAAI,EAAE,KAAK;YACX,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,CAAC;YACvC,QAAQ;YACR,GAAG,CAAC,aAAa,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC;SACjE,CAAC;QACF,IAAA,wBAAS,EAAC,KAAK,EAAE,gCAAgC,EAAE;YACjD,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI;YACvB,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC,EAAE;YACvB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,OAAuD;SACjE,CAAC,CAAC;QACH,oEAAoE;QACpE,oEAAoE;QACpE,uDAAuD;QACvD,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC;QACjC,KAAK,CAAC,gBAAgB,GAAG,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;QACrC,KAAK,CAAC,cAAc,GAAG,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC;QACrC,KAAK,CAAC,iBAAiB,GAAG,KAAK,CAAC,OAAO,CAAC;QACxC,KAAK,CAAC,aAAa,GAAG,IAAI,CAAC;QAC3B,KAAK,CAAC,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC;QACrC,KAAK,CAAC,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC;QACpC,qDAAqD;QACrD,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS;YAAE,KAAK,CAAC,eAAe,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;QACrF,gEAAgE;QAChE,+DAA+D;QAC/D,mDAAmD;QACnD,IAAI,aAAa,KAAK,SAAS;YAAE,KAAK,CAAC,iBAAiB,GAAG,aAAa,CAAC,WAAW,CAAC;QACrF,8DAA8D;QAC9D,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE;YACtB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI;YACvB,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC,EAAE;YACvB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,KAAK,CAAC,eAAe;YAC/B,SAAS,EAAE,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC;YACtD,UAAU,EAAE,aAAa;YACzB,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;QACH,gEAAgE;QAChE,kEAAkE;QAClE,qDAAqD;QACrD,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAChF,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAnJD,4CAmJC"}

package/dist/core/agent/stages/toolCalls/access/heldAnswer.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildHeldAnswer = void 0;
+const consentRequest_js_1 = require("../../../../consentRequest.js");
+/** Bind a resumed consent decision using the current middleware view. */
+function buildHeldAnswer(readMiddleware, decisionLedger) {
+    /**
+     * The decision a consent-gate resume carries, held to the request this run
+     * paused on and to the exact call it was bound to (`core/consentRequest.ts`)
+     * — or a `ResumeDecisionError` / `DecisionRequiredError`, thrown before
+     * anything about the call runs. Pure: the decision is spent by the branch
+     * that USES it (`spendDecision`), so a resume stopped before that (a refused
+     * findings reference) leaves it unspent.
+     *
+     * THE door every resume of a consent gate passes through: an agent's own
+     * `resume()` asks the same pure question first, but a composition resumes a
+     * nested agent's chart directly, and only this handler sees every decision
+     * that is used. So this is where a request is held and spent, once.
+     */
+    const heldAnswer = (scope, input, gate) => {
+        const read = (key) => scope.$getValue(key);
+        const toolName = read('pausedToolName');
+        const middleware = gate === 'ask' ? read('pausedAskMiddleware') : undefined;
+        return (0, consentRequest_js_1.heldDecision)(input, {
+            kind: gate,
+            ...(typeof toolName === 'string' && { toolName }),
+            ...(typeof middleware === 'string' && { middleware }),
+        }, read('pausedRequest'), (0, consentRequest_js_1.gatedCallOf)(read, gate), 
+        // An ask's approval holds only for the rules it was asked under — this
+        // agent's chain, by link name.
+        (readMiddleware() ?? []).map((link) => link.name), 
+        // …and a request minted under a ledger that can prove is spent only
+        // there: never silently in this agent's ledger if it is another one.
+        decisionLedger);
+    };
+    return heldAnswer;
+}
+exports.buildHeldAnswer = buildHeldAnswer;
+//# sourceMappingURL=heldAnswer.js.map

package/dist/core/agent/stages/toolCalls/access/heldAnswer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"heldAnswer.js","sourceRoot":"","sources":["../../../../../../src/core/agent/stages/toolCalls/access/heldAnswer.ts"],"names":[],"mappings":";;;AACA,qEAA+F;AAM/F,yEAAyE;AACzE,SAAgB,eAAe,CAC7B,cAA2D,EAC3D,cAA8B;IAE9B;;;;;;;;;;;;OAYG;IACH,MAAM,UAAU,GAAG,CACjB,KAA6B,EAC7B,KAAc,EACd,IAAqB,EACJ,EAAE;QACnB,MAAM,IAAI,GAAG,CAAC,GAAW,EAAW,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACxC,MAAM,UAAU,GAAG,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5E,OAAO,IAAA,gCAAY,EACjB,KAAK,EACL;YACE,IAAI,EAAE,IAAI;YACV,GAAG,CAAC,OAAO,QAAQ,KAAK,QAAQ,IAAI,EAAE,QAAQ,EAAE,CAAC;YACjD,GAAG,CAAC,OAAO,UAAU,KAAK,QAAQ,IAAI,EAAE,UAAU,EAAE,CAAC;SACtD,EACD,IAAI,CAAC,eAAe,CAAC,EACrB,IAAA,+BAAW,EAAC,IAAI,EAAE,IAAI,CAAC;QACvB,uEAAuE;QACvE,+BAA+B;QAC/B,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;QACjD,oEAAoE;QACpE,qEAAqE;QACrE,cAAc,CACf,CAAC;IACJ,CAAC,CAAC;IACF,OAAO,UAAU,CAAC;AACpB,CAAC;AA3CD,0CA2CC"}

package/dist/core/agent/stages/toolCalls/access/middlewareAdmission.js

@@ -0,0 +1,141 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.admitMiddlewareCall = void 0;
+const runChain_js_1 = require("../../../../../tools/runChain.js");
+const consentRequest_js_1 = require("../../../../consentRequest.js");
+const bindings_js_1 = require("./bindings.js");
+const ledger_js_1 = require("../../../middleware/ledger.js");
+/** Existing middlewareAdmission body; the owning handler retains its admission guard and native pause return. */
+async function admitMiddlewareCall(scope, deps, frame) {
+    const chain = await (0, runChain_js_1.runToolChain)(deps.toolMiddleware, {
+        toolName: frame.tc.name,
+        // Provenance from the tool that is about to run, so a policy can
+        // scope to the server that served it. Absent for our own tools.
+        ...(frame.tool?.source !== undefined && { toolSource: frame.tool.source }),
+        toolCallId: frame.tc.id,
+        iteration: frame.iteration,
+        args: frame.callArguments.callArgs,
+        history: frame.historyForCallbacks(),
+        ...(frame.runIdentity && { identity: frame.runIdentity }),
+        ...(frame.env.signal && { signal: frame.env.signal }),
+        // One human question per resume: this batch already asked the
+        // person for argument values, so a link that also wants a person
+        // gets the chain's named refusal and the tool does not run.
+        ...(frame.oneQuestionAsked && { askPolicy: 'refuse' }),
+    });
+    // The rules the asked call still has to pass once the person
+    // answers: the asking link and every link after it, by name.
+    const askChain = chain.kind === 'ask'
+        ? deps.toolMiddleware.slice(chain.index).map((link) => link.name)
+        : undefined;
+    // The request the person would be asked (`core/consentRequest.ts`):
+    // an id their decision must quote, bound to a detached copy of this
+    // exact call — the args AS TRANSFORMED SO FAR, where the chain
+    // resumes and the rules from there on. Minted only for a call that
+    // is about to pause.
+    const bound = chain.kind === 'ask'
+        ? (0, consentRequest_js_1.mintConsentRequest)({
+            gate: 'ask',
+            tool: frame.tc.name,
+            toolCallId: frame.tc.id,
+            party: frame.resolved.party,
+            args: chain.args,
+            middleware: chain.middleware,
+            askIndex: chain.index,
+            chain: askChain,
+        }, frame.decisionLedger)
+        : undefined;
+    // An ask no approval could be bound to asked nobody, and its row
+    // says so (`unboundAskRows`).
+    const chainRows = chain.kind === 'ask' && bound === undefined
+        ? (0, bindings_js_1.unboundAskRows)(chain.decisions, chain.middleware, chain.payload.question)
+        : chain.decisions;
+    // Under the inputs layer, a rewrite of a RULED tool's arguments is
+    // filed with the NAMES of the keys it changed (honesty layer 2) —
+    // the answer's standing reads a rewritten ruled argument with no
+    // declared origin as assumed. Every other row: as it always was.
+    (0, ledger_js_1.recordDecisions)(scope, frame.inputs !== undefined ? frame.inputs.decisionsToRecord(frame.tool, chainRows) : chainRows);
+    frame.callArguments.callArgs = chain.args;
+    frame.callArguments.chainedArgs = chain.args;
+    // The links were handed the live arguments (a link rewrites by what
+    // it hands back, and may have edited them in place): the shared
+    // frozen copy is made again from what the chain handed back.
+    frame.invalidateViews();
+    if (chain.kind === 'deny') {
+        frame.execution.denied = true;
+        // A link that ASKED, refused by the one-question law: the person's
+        // answers this call carried are kept for its next proposal.
+        frame.outcome.result =
+            chain.refusedAsk === true && frame.askedLayer !== undefined
+                ? chain.reason +
+                    frame.askedLayer.keptNote(scope, frame.tc.name, frame.resolution, frame.tool, frame.callArguments.callArgs)
+                : chain.reason;
+    }
+    else if (chain.kind === 'ask' && bound === undefined) {
+        // A call no approval could be bound to is refused, never asked.
+        frame.execution.denied = true;
+        frame.outcome.error = true;
+        frame.outcome.result = (0, bindings_js_1.unboundCallRefusal)(frame.tc.name, 'ask');
+    }
+    else if (chain.kind === 'ask' && bound !== undefined) {
+        // The typed half of the question (9.24.0), judged BEFORE anything
+        // is committed: a component the screen could not render must
+        // refuse here, at the source, not pause and be discovered. The
+        // `ask()` constructor already checked the shape; a hand-built
+        // outcome literal bypasses it, so the shape is re-asserted at
+        // this boundary (cheap, idempotent) along with the propsRef
+        // resolution only a raise site can judge. Asks without a
+        // component skip all of it.
+        const askComponent = chain.payload.component !== undefined
+            ? await frame.assertComponentDeliverable(scope, frame.tc.name, chain.payload.component, `ask middleware '${chain.middleware}'`)
+            : undefined;
+        // Commit partial state so resume() finds history intact (the
+        // pauseHere / check-in path does the same). The TRANSFORMED args
+        // ride the checkpoint — the bound copy: a person approves what the
+        // chain produced, not what the model originally proposed.
+        scope.history = frame.newHistory;
+        scope.pausedToolCallId = frame.tc.id;
+        scope.pausedToolName = frame.tc.name;
+        scope.pausedToolStartMs = frame.startMs;
+        scope.pausedAsk = true;
+        scope.pausedAskArgs = bound.args;
+        scope.pausedAskIndex = chain.index;
+        scope.pausedAskMiddleware = chain.middleware;
+        scope.pausedAskChain = askChain;
+        scope.pausedRequest = bound.request;
+        // The party this call was resolved against (9.92.0) — so a resume
+        // in a FRESH instance dispatches to the same party, never to the
+        // build-time map's first holder. Pause-path-only.
+        if (frame.resolved.party !== undefined)
+            scope.pausedToolParty = frame.resolved.party;
+        // Which surface will collect the decision — carried so the
+        // resume-side ledger rows can say which component ANSWERED.
+        // Written only when one exists: a component-less ask's
+        // checkpoint stays byte-identical.
+        if (askComponent !== undefined)
+            scope.pausedComponentId = askComponent.componentId;
+        // The call is open, waiting on a person: its script row says
+        // `submitted`, without the text — the settled row carries it.
+        frame.fileScript(scope, {
+            tool: frame.tool,
+            toolName: frame.tc.name,
+            toolCallId: frame.tc.id,
+            iteration: frame.iteration,
+            proposed: frame.proposedProgram,
+            submitted: frame.programOfCall(frame.tool, bound.args),
+            settlement: 'not-entered',
+            paused: true,
+        });
+        // A defined return value triggers the footprintjs pause; this
+        // object becomes the checkpoint's pauseData, and detectPause
+        // surfaces `pauseData.ask` as `outcome.ask`.
+        return {
+            toolCallId: frame.tc.id,
+            toolName: frame.tc.name,
+            ask: { ...chain.payload, middleware: chain.middleware, id: bound.request.id },
+        };
+    }
+    return undefined;
+}
+exports.admitMiddlewareCall = admitMiddlewareCall;
+//# sourceMappingURL=middlewareAdmission.js.map

package/dist/core/agent/stages/toolCalls/access/middlewareAdmission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middlewareAdmission.js","sourceRoot":"","sources":["../../../../../../src/core/agent/stages/toolCalls/access/middlewareAdmission.ts"],"names":[],"mappings":";;;AASA,kEAAgE;AAChE,qEAIuC;AACvC,+CAAmE;AACnE,6DAAgE;AAmChE,iHAAiH;AAC1G,KAAK,UAAU,mBAAmB,CACvC,KAA6B,EAC7B,IAAkD,EAClD,KAA+B;IAE/B,MAAM,KAAK,GAAG,MAAM,IAAA,0BAAY,EAAC,IAAI,CAAC,cAAe,EAAE;QACrD,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI;QACvB,iEAAiE;QACjE,gEAAgE;QAChE,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QAC1E,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC,EAAE;QACvB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,IAAI,EAAE,KAAK,CAAC,aAAa,CAAC,QAAQ;QAClC,OAAO,EAAE,KAAK,CAAC,mBAAmB,EAAE;QACpC,GAAG,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;QACzD,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;QACrD,8DAA8D;QAC9D,iEAAiE;QACjE,4DAA4D;QAC5D,GAAG,CAAC,KAAK,CAAC,gBAAgB,IAAI,EAAE,SAAS,EAAE,QAAiB,EAAE,CAAC;KAChE,CAAC,CAAC;IACH,6DAA6D;IAC7D,6DAA6D;IAC7D,MAAM,QAAQ,GACZ,KAAK,CAAC,IAAI,KAAK,KAAK;QAClB,CAAC,CAAC,IAAI,CAAC,cAAe,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;QAClE,CAAC,CAAC,SAAS,CAAC;IAChB,oEAAoE;IACpE,oEAAoE;IACpE,+DAA+D;IAC/D,mEAAmE;IACnE,qBAAqB;IACrB,MAAM,KAAK,GACT,KAAK,CAAC,IAAI,KAAK,KAAK;QAClB,CAAC,CAAC,IAAA,sCAAkB,EAChB;YACE,IAAI,EAAE,KAAK;YACX,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI;YACnB,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC,EAAE;YACvB,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK;YAC3B,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,KAAK,CAAC,KAAK;YACrB,KAAK,EAAE,QAAQ;SACI,EACrB,KAAK,CAAC,cAAc,CACrB;QACH,CAAC,CAAC,SAAS,CAAC;IAChB,iEAAiE;IACjE,8BAA8B;IAC9B,MAAM,SAAS,GACb,KAAK,CAAC,IAAI,KAAK,KAAK,IAAI,KAAK,KAAK,SAAS;QACzC,CAAC,CAAC,IAAA,4BAAc,EAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC3E,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC;IACtB,mEAAmE;IACnE,kEAAkE;IAClE,iEAAiE;IACjE,iEAAiE;IACjE,IAAA,2BAAe,EACb,KAAK,EACL,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAC/F,CAAC;IACF,KAAK,CAAC,aAAa,CAAC,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC;IAC1C,KAAK,CAAC,aAAa,CAAC,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC;IAC7C,oEAAoE;IACpE,gEAAgE;IAChE,6DAA6D;IAC7D,KAAK,CAAC,eAAe,EAAE,CAAC;IACxB,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC1B,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,IAAI,CAAC;QAC9B,mEAAmE;QACnE,4DAA4D;QAC5D,KAAK,CAAC,OAAO,CAAC,MAAM;YAClB,KAAK,CAAC,UAAU,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;gBACzD,CAAC,CAAC,KAAK,CAAC,MAAM;oBACZ,KAAK,CAAC,UAAU,CAAC,QAAQ,CACvB,KAAK,EACL,KAAK,CAAC,EAAE,CAAC,IAAI,EACb,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,aAAa,CAAC,QAAQ,CAC7B;gBACH,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;IACrB,CAAC;SAAM,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACvD,gEAAgE;QAChE,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,IAAI,CAAC;QAC9B,KAAK,CAAC,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC;QAC3B,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,IAAA,gCAAkB,EAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAClE,CAAC;SAAM,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACvD,kEAAkE;QAClE,6DAA6D;QAC7D,+DAA+D;QAC/D,8DAA8D;QAC9D,8DAA8D;QAC9D,4DAA4D;QAC5D,yDAAyD;QACzD,4BAA4B;QAC5B,MAAM,YAAY,GAChB,KAAK,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS;YACnC,CAAC,CAAC,MAAM,KAAK,CAAC,0BAA0B,CACpC,KAAK,EACL,KAAK,CAAC,EAAE,CAAC,IAAI,EACb,KAAK,CAAC,OAAO,CAAC,SAAS,EACvB,mBAAmB,KAAK,CAAC,UAAU,GAAG,CACvC;YACH,CAAC,CAAC,SAAS,CAAC;QAChB,6DAA6D;QAC7D,iEAAiE;QACjE,mEAAmE;QACnE,0DAA0D;QAC1D,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC;QACjC,KAAK,CAAC,gBAAgB,GAAG,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;QACrC,KAAK,CAAC,cAAc,GAAG,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC;QACrC,KAAK,CAAC,iBAAiB,GAAG,KAAK,CAAC,OAAO,CAAC;QACxC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;QACvB,KAAK,CAAC,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC;QACjC,KAAK,CAAC,cAAc,GAAG,KAAK,CAAC,KAAK,CAAC;QACnC,KAAK,CAAC,mBAAmB,GAAG,KAAK,CAAC,UAAU,CAAC;QAC7C,KAAK,CAAC,cAAc,GAAG,QAAQ,CAAC;QAChC,KAAK,CAAC,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC;QACpC,kEAAkE;QAClE,iEAAiE;QACjE,kDAAkD;QAClD,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS;YAAE,KAAK,CAAC,eAAe,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;QACrF,2DAA2D;QAC3D,4DAA4D;QAC5D,uDAAuD;QACvD,mCAAmC;QACnC,IAAI,YAAY,KAAK,SAAS;YAAE,KAAK,CAAC,iBAAiB,GAAG,YAAY,CAAC,WAAW,CAAC;QACnF,6DAA6D;QAC7D,8DAA8D;QAC9D,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE;YACtB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI;YACvB,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC,EAAE;YACvB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,KAAK,CAAC,eAAe;YAC/B,SAAS,EAAE,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC;YACtD,UAAU,EAAE,aAAa;YACzB,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;QACH,8DAA8D;QAC9D,6DAA6D;QAC7D,6CAA6C;QAC7C,OAAO;YACL,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC,EAAE;YACvB,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI;YACvB,GAAG,EAAE,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE;SAC9E,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAvJD,kDAuJC"}

package/dist/core/agent/stages/toolCalls/access/toolPermission.js

@@ -0,0 +1,103 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkToolPermission = void 0;
+const extractSequence_js_1 = require("../../../../../security/extractSequence.js");
+const bindings_js_1 = require("./bindings.js");
+const frozenCopy_js_1 = require("../../../../../lib/frozenCopy.js");
+/** Existing toolPermission body; the owning handler retains its admission guard and native pause return. */
+async function checkToolPermission(frame) {
+    try {
+        // Sequence is derived from history at check time (not parallel
+        // state) — single source of truth, survives resumeOnError.
+        const sequence = (0, extractSequence_js_1.extractSequence)(frame.historyForCallbacks(), frame.iteration);
+        const decision = await frame.permissionChecker.check({
+            capability: 'tool_call',
+            actor: 'agent',
+            target: frame.tc.name,
+            // The call's shared frozen copy, never the arguments it runs with.
+            context: (0, bindings_js_1.checkerContextOf)(frame.viewOf(frame.runArgs)),
+            sequence,
+            history: frame.historyForCallbacks(),
+            iteration: frame.iteration,
+            ...(frame.runIdentity && { identity: frame.runIdentity }),
+            ...(frame.env.signal && { signal: frame.env.signal }),
+        });
+        frame.emitSecurity('agentfootprint.permission.check', {
+            capability: 'tool_call',
+            actor: 'agent',
+            target: frame.tc.name,
+            result: decision.result,
+            ...(decision.policyRuleId !== undefined && { policyRuleId: decision.policyRuleId }),
+            ...(decision.rationale !== undefined && { rationale: decision.rationale }),
+            ...(decision.reason !== undefined && { reason: decision.reason }),
+        });
+        // LENS · tool-result · persistent-history
+        // reads: the checker's own words ← decision.tellLLM ?? decision.rationale (an AUTHORITY omission: the rule space is never named)
+        // known gap: the generic fallback anchors a per-call refusal to the whole run and is on the record as
+        // unrepaired in test/modelFacingScan.test.ts · `LEDGER`, under this file's own key.
+        // Do not widen it here without that test.
+        // law: may omit, never deny; every clause anchored to the call it was composed on.
+        if (decision.result === 'deny') {
+            frame.execution.denied = true;
+            // Deny default keeps the existing v2.4 shape (carries
+            // rationale text — historically intentional, since deny
+            // lets the LLM recover and rationale is consumer-supplied).
+            const tellLLM = decision.tellLLM ?? `[permission denied: ${decision.rationale ?? 'policy'}]`;
+            frame.outcome.result = tellLLM;
+        }
+        else if (decision.result === 'halt') {
+            frame.execution.denied = true;
+            // Halt default is DELIBERATELY GENERIC — never falls back
+            // to `reason` (which is telemetry, e.g. 'security:exfiltration'
+            // — leaking that to the LLM teaches it the rule space).
+            // Consumers who want a richer message provide `tellLLM` explicitly.
+            const tellLLM = decision.tellLLM ?? `Tool '${frame.tc.name}' is not available in this context.`;
+            frame.outcome.result = tellLLM;
+            frame.execution.haltContext = {
+                reason: decision.reason ?? decision.rationale ?? 'policy-halt',
+                tellLLM,
+                ...(frame.permissionChecker.name && { checkerId: frame.permissionChecker.name }),
+            };
+        }
+    }
+    catch (permErr) {
+        // A checker that wrote into its frozen `context` lands here too —
+        // said once, in dev mode, so a checker that normalised in place
+        // does not deny every call in silence.
+        (0, frozenCopy_js_1.warnFrozenWrite)('permission checker', permErr, 'the call was denied');
+        // A checker that threw is treated as deny-by-default — fail closed:
+        // something that did not answer did not say yes.
+        //
+        // ── What the MODEL is told, and why it changed in 9.4.0 ────────
+        // It used to be told the checker's own error text. Those messages
+        // are written for operators and read as WEATHER — "not available
+        // right now", "ECONNREFUSED", "timed out" — so a model does the
+        // reasonable thing and tries again. In a real deployment one did
+        // exactly that, burned every iteration to `maxIterations`, and
+        // returned the empty string; nobody could see why, because the
+        // reason never left the tool result.
+        //
+        // The refusal is now TERMINAL and says so, in the bracketed form
+        // the local policy has always used (`[permission denied: …]`) —
+        // the one a model adapts to cleanly. The thrown message is an
+        // operator's fact and stays on the typed event's `rationale`,
+        // where it was already going: an outage is not something a model
+        // should be invited to argue with, and infrastructure text does
+        // not belong in a transcript.
+        frame.execution.denied = true;
+        const msg = permErr instanceof Error ? permErr.message : String(permErr);
+        frame.emitSecurity('agentfootprint.permission.check', {
+            capability: 'tool_call',
+            actor: 'agent',
+            target: frame.tc.name,
+            result: 'deny',
+            rationale: `permission-checker threw: ${msg}`,
+        });
+        frame.outcome.result =
+            `[permission denied: Tool '${frame.tc.name}' could not be authorized. This will not ` +
+                `change during this run — do not call it again. Continue without it, or say ` +
+                `what you are unable to do.]`;
+    }
+}
+exports.checkToolPermission = checkToolPermission;
+//# sourceMappingURL=toolPermission.js.map

package/dist/core/agent/stages/toolCalls/access/toolPermission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"toolPermission.js","sourceRoot":"","sources":["../../../../../../src/core/agent/stages/toolCalls/access/toolPermission.ts"],"names":[],"mappings":";;;AAKA,mFAA6E;AAC7E,+CAAiD;AACjD,oEAAmE;AAsBnE,4GAA4G;AACrG,KAAK,UAAU,mBAAmB,CAAC,KAA+B;IACvE,IAAI,CAAC;QACH,+DAA+D;QAC/D,2DAA2D;QAC3D,MAAM,QAAQ,GAAG,IAAA,oCAAe,EAAC,KAAK,CAAC,mBAAmB,EAAE,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAC/E,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,KAAK,CAAC;YACnD,UAAU,EAAE,WAAW;YACvB,KAAK,EAAE,OAAO;YACd,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI;YACrB,mEAAmE;YACnE,OAAO,EAAE,IAAA,8BAAgB,EAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACtD,QAAQ;YACR,OAAO,EAAE,KAAK,CAAC,mBAAmB,EAAE;YACpC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,GAAG,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;YACzD,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;SACtD,CAAC,CAAC;QACH,KAAK,CAAC,YAAY,CAAC,iCAAiC,EAAE;YACpD,UAAU,EAAE,WAAW;YACvB,KAAK,EAAE,OAAO;YACd,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI;YACrB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,GAAG,CAAC,QAAQ,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC;YACnF,GAAG,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC;YAC1E,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;SAClE,CAAC,CAAC;QACH,0CAA0C;QAC1C,iIAAiI;QACjI,sGAAsG;QACtG,oFAAoF;QACpF,0CAA0C;QAC1C,mFAAmF;QACnF,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC/B,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,IAAI,CAAC;YAC9B,sDAAsD;YACtD,wDAAwD;YACxD,4DAA4D;YAC5D,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,IAAI,uBAAuB,QAAQ,CAAC,SAAS,IAAI,QAAQ,GAAG,CAAC;YAC7F,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC;QACjC,CAAC;aAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACtC,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,IAAI,CAAC;YAC9B,0DAA0D;YAC1D,gEAAgE;YAChE,wDAAwD;YACxD,oEAAoE;YACpE,MAAM,OAAO,GACX,QAAQ,CAAC,OAAO,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC,IAAI,qCAAqC,CAAC;YAClF,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC;YAC/B,KAAK,CAAC,SAAS,CAAC,WAAW,GAAG;gBAC5B,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,SAAS,IAAI,aAAa;gBAC9D,OAAO;gBACP,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC;aACjF,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,OAAO,EAAE,CAAC;QACjB,kEAAkE;QAClE,gEAAgE;QAChE,uCAAuC;QACvC,IAAA,+BAAe,EAAC,oBAAoB,EAAE,OAAO,EAAE,qBAAqB,CAAC,CAAC;QACtE,oEAAoE;QACpE,iDAAiD;QACjD,EAAE;QACF,kEAAkE;QAClE,kEAAkE;QAClE,iEAAiE;QACjE,gEAAgE;QAChE,iEAAiE;QACjE,+DAA+D;QAC/D,+DAA+D;QAC/D,qCAAqC;QACrC,EAAE;QACF,iEAAiE;QACjE,gEAAgE;QAChE,8DAA8D;QAC9D,8DAA8D;QAC9D,iEAAiE;QACjE,gEAAgE;QAChE,8BAA8B;QAC9B,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,IAAI,CAAC;QAC9B,MAAM,GAAG,GAAG,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACzE,KAAK,CAAC,YAAY,CAAC,iCAAiC,EAAE;YACpD,UAAU,EAAE,WAAW;YACvB,KAAK,EAAE,OAAO;YACd,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI;YACrB,MAAM,EAAE,MAAM;YACd,SAAS,EAAE,6BAA6B,GAAG,EAAE;SAC9C,CAAC,CAAC;QACH,KAAK,CAAC,OAAO,CAAC,MAAM;YAClB,6BAA6B,KAAK,CAAC,EAAE,CAAC,IAAI,2CAA2C;gBACrF,6EAA6E;gBAC7E,6BAA6B,CAAC;IAClC,CAAC;AACH,CAAC;AA5FD,kDA4FC"}

package/dist/core/agent/stages/toolCalls/batch/completion.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.completeToolBatch = void 0;
+const typedEmit_js_1 = require("../../../../../recorders/core/typedEmit.js");
+/** The existing synchronous batchCompletion phase; no new await or checkpoint carrier. */
+function completeToolBatch(scope, frame) {
+    scope.history = frame.newHistory;
+    if (frame.inputsLayer === true && frame.askAnswered !== true && scope.argumentAsk !== undefined)
+        scope.argumentAsk = undefined;
+    // The batch-end aggregate for conflicting transition proposals
+    // (9.19.0) — fires only when ≥2 accepted proposals named different
+    // targets; the per-effect events above already told each story.
+    frame.emitTransitionConflict(scope, frame.iteration, frame.transitionState);
+    (0, typedEmit_js_1.typedEmit)(scope, 'agentfootprint.agent.iteration_end', {
+        turnIndex: 0,
+        iterIndex: frame.iteration,
+        toolCallCount: frame.toolCalls.length,
+        // The PLAIN local array, not `scope.history` — a TypedScope array
+        // read returns a live deep-Proxy view, which is not structured-
+        // clone-safe. Event payloads must be detached plain data so they
+        // survive RFC-001 'clone' capture (observerDelivery: 'deferred')
+        // and never hand consumers a mutable view of engine state.
+        history: frame.newHistory,
+    });
+    scope.iteration = frame.iteration + 1;
+}
+exports.completeToolBatch = completeToolBatch;
+//# sourceMappingURL=completion.js.map

package/dist/core/agent/stages/toolCalls/batch/completion.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"completion.js","sourceRoot":"","sources":["../../../../../../src/core/agent/stages/toolCalls/batch/completion.ts"],"names":[],"mappings":";;;AAIA,6EAAuE;AAmBvE,0FAA0F;AAC1F,SAAgB,iBAAiB,CAC/B,KAA6B,EAC7B,KAA6B;IAE7B,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC;IACjC,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS;QAC7F,KAAK,CAAC,WAAW,GAAG,SAAS,CAAC;IAEhC,+DAA+D;IAC/D,mEAAmE;IACnE,gEAAgE;IAChE,KAAK,CAAC,sBAAsB,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;IAE5E,IAAA,wBAAS,EAAC,KAAK,EAAE,oCAAoC,EAAE;QACrD,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,aAAa,EAAE,KAAK,CAAC,SAAS,CAAC,MAAM;QACrC,kEAAkE;QAClE,gEAAgE;QAChE,iEAAiE;QACjE,iEAAiE;QACjE,2DAA2D;QAC3D,OAAO,EAAE,KAAK,CAAC,UAAU;KAC1B,CAAC,CAAC;IACH,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;AACxC,CAAC;AAzBD,8CAyBC"}