pomerado 0.1.2 → 0.2.0

package/dist/typescript/src/execution/sign-in-diagnostics.d.ts

@@ -1,10 +1,10 @@
 import type { ExecutionBoundaryError } from "./boundary.js";
 import type { IdentityErrorCode } from "../runtime/runner-codes.js";
 import type { ManagedAuthErrorCode } from "../destinations/sign-in-provider-codes.js";
-import type { RetainedProviderCode, RetainedProviderStage, RetainedProviderSchemaField, RetainedProxyError } from "../runtime/provider-metadata.js";
+import type { RetainedProviderCode, RetainedProviderStage, RetainedProviderSchemaField, RetainedNetworkError } from "../runtime/provider-metadata.js";
 import type { NoResponseError } from "../destinations/navigation-failure.js";
 import type { CaptureCollectionDiagnostic, CaptureFailureReason, CaptureScreeningDiagnostic } from "../runtime/capture-diagnostic.js";
-type KernelManagedAuthErrorCode = typeof ManagedAuthErrorCode.Type | "unknown";
+type ProviderAuthErrorCode = typeof ManagedAuthErrorCode.Type | "unknown";
 type SignInFailureCode = "AccountMismatch" | "AuthenticationFailed" | "CredentialsRejected" | "CaptureUnavailable"
 /**
  * The sign-in went where credentials may not go: off the site's registrable domain and every
@@ -44,31 +44,30 @@ export interface SignInDiagnostic {
     readonly providerStatus?: number;
     readonly providerStage?: RetainedProviderStage;
     readonly providerSchemaField?: RetainedProviderSchemaField;
-    readonly providerAuthCode?: KernelManagedAuthErrorCode;
+    readonly providerAuthCode?: ProviderAuthErrorCode;
     /** The site answered the failed login's latest page load 429, a rate limit. */
     readonly siteRateLimited?: true;
     /**
-     * The failed login's latest page load failed at the proxy layer: typed proxy or provider
-     * evidence from the login browser's capture (`managedLoginProxyFailure`), read once before the
-     * login's cleanup.
+     * The failed login's latest page load failed in the provider's network layer: typed network or
+     * provider evidence from the login browser's capture, read once before the login's cleanup.
      */
-    readonly loginProxyFailure?: RetainedProxyError | NoResponseError;
+    readonly loginProxyFailure?: RetainedNetworkError | NoResponseError;
     /**
-     * An iframe document of the login that Kernel's proxy failed with provider evidence. Once a
-     * sign-in started it moves nothing: context for the agent, never a verdict.
+     * An iframe document of the login that the provider's network layer failed with provider
+     * evidence. Once a sign-in started it moves nothing: context for the agent, never a verdict.
      */
     readonly loginFrameRefusal?: {
         readonly origin: string;
-        readonly cause: RetainedProxyError | NoResponseError;
+        readonly cause: RetainedNetworkError | NoResponseError;
     };
     /**
-     * Set by the mint host once its proxy switch replaced the browser after this failure, so the
-     * agent's answer says the browser moved only when it did.
+     * Set by the mint host once it replaced the browser after this failure, so the agent's answer
+     * says the browser moved only when it did.
      */
     readonly hostMovedBrowser?: true;
-    /** Kernel's account of a failed or expired login flow; see `RetainedLoginFailureEvidence`. */
+    /** The provider's account of a failed or expired login flow; see `RetainedLoginFailureEvidence`. */
     readonly providerEvidence?: RetainedLoginFailureEvidence;
-    /** One line for the agent and the caller: `Kernel <code>: <message>`. */
+    /** One line for the agent and the caller: the provider's name, its code and its message. */
     readonly providerReason?: string;
     readonly cleanupCode?: SignInFailureCode;
     /**
@@ -76,7 +75,7 @@ export interface SignInDiagnostic {
      * of it still runs; `cleanupCode` says the opposite. Context for the agent.
      */
     readonly cleanupConfirmed?: true;
-    /** The login failed after Kernel submitted a field or choice to the site. */
+    /** The login failed after the provider submitted a field or choice to the site. */
     readonly afterSubmission?: true;
     /**
      * The sign-in failed before anything reached the site: no direct request was sent, and no
@@ -89,20 +88,20 @@ export interface SignInDiagnostic {
 }
 interface RetainedLoginFailureEvidence {
     readonly flowStatus: "FAILED" | "EXPIRED";
-    /** Kernel's exact error code, also when it is outside `ManagedAuthErrorCode`. */
+    /** The provider's exact error code, also when it is outside `ManagedAuthErrorCode`. */
     readonly errorCode?: string;
     readonly message?: string;
-    /** The error text the website itself showed, as Kernel read it. */
+    /** The error text the website itself showed, as the provider read it. */
     readonly website_error?: string | null;
-    /** The step the flow reached, from Kernel's login timeline. */
+    /** The step the flow reached, from the provider's login timeline. */
     readonly step?: string;
     readonly browserSessionId?: string;
-    /** Kernel's replay of the login browser; present only when the login was recorded. */
+    /** The provider's replay of the login browser; present only when the login was recorded. */
     readonly replayId?: string;
     readonly completedAt?: string;
     /** The last main-frame URL the host's capture saw on the login browser. */
     readonly lastObservedUrl?: string;
-    /** Set when Kernel's login timeline could not be read; the connection fields still apply. */
+    /** Set when the provider's login timeline could not be read; the connection fields still apply. */
     readonly timelineUnavailable?: true;
     /** Prior submitted values were not available to screen provider prose after takeover. */
     readonly privateRedactionUnavailable?: true;

package/dist/typescript/src/guardian/openai.js

@@ -26,10 +26,12 @@ Return allow_business when the question is needed and only the user can answer i
 Return reword when the question:
 - asks for something the agent can read from the site, the capture evidence or the supplied input; withheld markers and {{secret.<id>}} handles mean a credential was supplied privately, not omitted;
 - asks the user to troubleshoot the host or its infrastructure, or to recover internal details such as execution receipts, attempt IDs, capture references, source paths, publication or dependency errors; a host failure is reported as blocked, not asked;
-- asks permission to do what trusted intent already requests, or asks the user to authorize more than it; a question cannot authorize replay of an uncertain write, login or private submission;
+- asks permission to do what trusted intent already requests, or asks the user to authorize more than it; a question cannot authorize replay of an uncertain write, login or private submission, but this never covers a question about which sign-in method or account to use;
 - is unclear, redundant, unrelated or deceptive, or asks the user to solve a CAPTCHA; CAPTCHAs are never asked, the host browser handles them;
 - asks about an optional field whose value the request's purpose does not clearly depend on, such as the cabin class on a plain flight search: the tool records it as an optional input and the step leaves it at the page's default, so say that instead of asking. This never covers an add-on, a pre-selected paid option or a saved payment on a write, which the write rule above allows.
 Return authentication only when a question asks for a username, a password or a full login, including re-entering, confirming or correcting one. The host then asks through its protected credential flow. A two-factor code is not authentication. credentialsAvailable reports only whether the host holds a login for the site; it exposes no value and does not prove sign-in succeeded.
+In a question review, trusted_authority.allowedEffects is empty on purpose. A question performs no action on the site, so the host has nothing to authorize and the empty list says nothing about this question. Never reword a question, and never tell the agent to report a blocked outcome, because allowedEffects is empty or because the answer could not itself authorize a sign-in, a navigation or a write. The host reviews every later step on its own.
+A question that asks which sign-in method to use, which account to use, or how to reach the sign-in is allowed when the choices it names match what the page shows. Reword it when it names choices the page does not show. Return authentication when it asks for a username or a password. Other questions about signing in follow the rules above.
 Work on another registrable domain is judged when it runs, never ruled out of scope here: do not reword a question for naming or asking about an off-site place, and never tell the agent that only the host can authorize another domain.
 For this review return outcome allow_business, authentication or reword and a concise rationale saying what to change. A reword's rationale names every problem the request has, in each of its questions, so that one revision can fix them all; do not hold a problem back for a later round. Never solicit a private value in the rationale.`;
 const guardianPresentation = (policy, turn, options) => ({

package/dist/typescript/src/mint/contracts.d.ts

@@ -1,7 +1,7 @@
 import type { MintDiagnostics, MintReporting } from "./diagnostics.js";
 import type { MintProjection } from "./projection.js";
 import { CredentialRejectedField } from "../runtime/authentication.js";
-import type { ProxySwitchSummary } from "../runtime/provider-metadata.js";
+import type { BrowserRecoverySummary } from "../runtime/provider-metadata.js";
 import type { CapabilityReview } from "../capabilities/review-contracts.js";
 import type { FailureDetail } from "../runtime/failure-detail.js";
 import type { DestinationPrivateCandidateReason } from "../destinations/private-candidate.js";
@@ -188,6 +188,8 @@ export declare class MintFailure extends MintFailure_base<{
      | "site_metadata_required"
     /** Another enabled tool in the integration this would join has the same tool name. */
      | "tool_name_taken"
+    /** The definition to publish quotes the build's account reference; refused every time. */
+     | "definition_login_reference"
     /** The publication gate refused a file Guardian's review reads; `publicationBlock` names it. */
      | "evidence_screening"
     /** A `read_source` of a capture the workspace does not hold: it is not saved yet. */
@@ -649,11 +651,19 @@ export interface MintActions {
     readonly requestInput: (input: unknown) => Effect.Effect<string, MintFailure>;
     /** Ends the build blocked (`BuildBlocked`); absent on a question-only turn. */
     readonly reportBlocked?: (input: unknown) => Effect.Effect<string, MintFailure>;
-    /** Read-only Kernel CAPTCHA state for the host's current browser; absent when unsupported. */
+    /** Read-only CAPTCHA state for the host's current browser; absent when unsupported. */
     readonly captchaState?: (input: unknown) => Effect.Effect<string, MintFailure>;
     /** The agent's troubleshooting request for a new browser; absent where the host has none. */
     readonly requestBrowserRecovery?: (input: unknown) => Effect.Effect<string, MintFailure>;
 }
+/**
+ * A host's descriptions of the optional tools it offers, such as which of its own skills to read
+ * first. A tool the host describes gets that text instead of the generic description.
+ */
+export interface HostToolDescriptions {
+    readonly captchaState?: string;
+    readonly requestBrowserRecovery?: string;
+}
 export interface MintTurn {
     readonly recovery?: MintAgentRecovery;
     /** Attempt-scoped bridge for SDK Promise callbacks; closes and joins before returning an outcome. */
@@ -669,6 +679,7 @@ export interface MintTurn {
     readonly instructions: string;
     readonly skills: readonly SkillDescriptor[];
     readonly actions: MintActions;
+    readonly hostToolDescriptions?: HostToolDescriptions;
     readonly screen: (value: unknown) => Effect.Effect<string, MintFailure>;
     readonly isComplete: () => boolean;
     readonly reportDiagnostic: (value: unknown) => Effect.Effect<void, MintFailure>;
@@ -722,6 +733,8 @@ export type MintEntryNavigation = {
 } | {
     readonly state: "not_opened";
     readonly outcome: "failed" | "timeout" | "skipped";
+    /** `prior_effect`: the host skipped the entry because an earlier attempt of this job already ran on the website. */
+    readonly reason?: "prior_effect";
     readonly requestedUrl: string;
     readonly resolvedUrl?: string;
     readonly redirects?: readonly {
@@ -733,12 +746,12 @@ export type MintEntryNavigation = {
  * The browser was replaced: by managed authentication (`sign_in`), where `page` is the page the
  * agent was on, when it was on the site and loaded, else the login page; or by a recovery
  * (`recovery`), where `page` is the page a read's replacement reopened: the last page the site
- * served the browser it replaced.
- * `antibot`: after the entry load, a move-up for the site's bot products, blank.
+ * served the browser it replaced. A host may give its own reason and explain it in
+ * `instruction`.
  */
  | {
     readonly state: "replaced";
-    readonly reason: "sign_in" | "recovery" | "antibot";
+    readonly reason: "sign_in" | "recovery" | (string & {});
     readonly requestedUrl?: string;
     readonly page?: string;
     /** Host-authored explanation of the browser replacement. */
@@ -905,6 +918,13 @@ export interface MintDependencies {
         readonly reviewId?: string;
         readonly requestId?: string;
     }) => Effect.Effect<ValidAnswers, MintFailure>;
+    /**
+     * Removes host-private values, such as the build's account reference, from text the agent
+     * writes for its caller: each request's notice, prompts and option labels, and its blocked
+     * explanation. Applied before review; the agent's own transcript keeps what it wrote. Absent,
+     * the text is shown as written.
+     */
+    readonly redactCallerText?: (text: string) => string;
     /**
      * Raises the system login request Guardian routed a question to. `held` means the host already
      * has a login; `unavailable` means this job may not ask for one. The model never sees values.
@@ -942,6 +962,11 @@ export interface MintDependencies {
     /** Trusted registered invocation receipt, loaded from its durable recovery record. */
     readonly initialExample?: ExecutionEvidence;
     readonly priorReadExecutions?: readonly ExecutionEvidence[];
+    /**
+     * An earlier attempt of this write build ended after steps that may have changed the website,
+     * and this attempt starts over. The agent's first input tells it to read back before any write.
+     */
+    readonly priorAttemptMayHaveChanged?: boolean;
     /** Host-owned state, independent of model prose and publication. */
     readonly currentInvocation?: () => CurrentInvocation | undefined;
     readonly canPublishRepair?: (executionId: string) => boolean;
@@ -959,9 +984,9 @@ export interface MintDependencies {
     readonly readRetainedCapture?: (path: string) => Effect.Effect<string | undefined>;
     /** Host-only selection/retrieval; never refetches a historical website response. */
     readonly retainCapture?: (request: CaptureRequest) => Effect.Effect<string, MintFailure>;
-    /** Host-bound, read-only Kernel CAPTCHA state for the current live browser. Never
-     * dispatches a browser action, triggers a solve or extends a deadline. Absent when the
-     * host has no CAPTCHA telemetry; then the minter tool is not offered. */
+    /** Host-bound, read-only CAPTCHA state for the current live browser. Never dispatches a
+     * browser action, triggers a solve or extends a deadline. Absent when the host has no CAPTCHA
+     * telemetry; then the minter tool is not offered. */
     readonly captchaState?: {
         readonly read: () => Effect.Effect<object, MintFailure>;
         readonly limit: number;
@@ -973,6 +998,8 @@ export interface MintDependencies {
      * It runs no code, repeats nothing and is never part of the published operation.
      */
     readonly requestBrowserRecovery?: (rationale: string) => Effect.Effect<MintBrowserRecoveryResult, MintFailure>;
+    /** The host's own descriptions of its optional tools, in place of the generic ones. */
+    readonly hostToolDescriptions?: HostToolDescriptions;
     readonly projection: MintProjection;
     /** The workspace AGENTS.md, installed at the workspace root and given as the instructions. */
     readonly instructions: string;
@@ -1024,7 +1051,7 @@ export type MintBrowserRecoveryResult = {
     readonly outcome: "replaced" | "kept" | "lost";
     readonly notice: string;
     readonly reviewId: string;
-    readonly browserRecovery?: ProxySwitchSummary;
+    readonly browserRecovery?: BrowserRecoverySummary;
 };
 export declare const PublicationDiagnosticGap: Schema.Union<[Schema.Struct<{
     phase: Schema.Literal<["publication_capture"]>;

package/dist/typescript/src/mint/harness.js

@@ -14,6 +14,11 @@ import { publicationBlockFeedback } from "./publication-block.js";
 import { inputFeedbackInstruction, maximumInputFeedbackRounds, unresolvedInputFeedbackSummary, } from "./input-feedback.js";
 import { makeMintWorkspace, questionOnlyWorkspace, relativeSourcePath, screenMintText, } from "./workspace.js";
 const effectQuestionInstruction = "Before any website access, ask the person whether this build only looks things up or changes something on the website. Call request_input once with exactly one choice question whose options have the ids read and write: the prompt says in one or two plain sentences what the finished tool would do, and your best guess comes first; filling in or advancing a form that saves data on the site (an application, profile or checkout form) counts as a change, while searching or filtering does not. A write build does the requested task once, for real, with the person's values, while it builds (it may take several steps), and ends by reading the site's confirmation. No other tool is available until the person answers.";
+/**
+ * What the agent of a new attempt of a write build is told when an earlier attempt may have
+ * changed the website (`priorAttemptMayHaveChanged`). It reads back before it writes again.
+ */
+const priorAttemptChangeNotice = "An earlier attempt of this build ended before it finished, after steps that may have changed the website, and this attempt starts over: a new workspace and a fresh browser on a new, empty profile, signed out, with none of that attempt's records. Before you run a write, read back on the site whether the requested change already happened; never redo one that did, and if it did, end the attempt and say so in the summary.";
 /**
  * The host's own labels for the two answers of a read/write choice (the effect question and a
  * write upgrade). The agent writes the prompt, which Guardian reviews, but never what an answer
@@ -56,6 +61,49 @@ const signInOrLoginInUseAnswer = (error, feedback, ending) => feedback !== undef
 /** A `request_input` call whose arguments ask for a write upgrade. */
 const isWriteUpgradeCall = (call) => call.name === "request_input" &&
     Option.isSome(Schema.decodeUnknownOption(Schema.parseJson(Schema.Struct({ writeUpgrade: Schema.Literal(true) })))(call.arguments));
+/** The agent's question as its caller reads it, with each caller-visible text redacted. */
+const callerVisibleQuestion = (question, redact) => {
+    const prompt = redact(question.prompt);
+    if (question.type === "choice" || question.type === "multi_choice")
+        return {
+            ...question,
+            prompt,
+            options: question.options.map((option) => ({
+                ...option,
+                label: redact(option.label),
+                ...(option.maskedLabel === undefined ? {} : { maskedLabel: redact(option.maskedLabel) }),
+            })),
+        };
+    if (question.type === "confirm" && question.followUp !== undefined) {
+        const { defaultText } = question.followUp;
+        return {
+            ...question,
+            prompt,
+            followUp: {
+                prompt: redact(question.followUp.prompt),
+                // The caller's form shows it as the field's default.
+                ...(defaultText === undefined ? {} : { defaultText: redact(defaultText) }),
+            },
+        };
+    }
+    return { ...question, prompt };
+};
+/** The agent's request as its caller reads it: its notice and every question. */
+const callerVisibleRequest = (request, redact) => ({
+    ...request,
+    ...(request.notice === undefined ? {} : { notice: redact(request.notice) }),
+    questions: request.questions.map((question) => callerVisibleQuestion(question, redact)),
+});
+/** How the minter removes an account reference from the named part of a tool's definition. */
+const definitionFix = (section) => section === "loginUrl"
+    ? "Run authenticate again with the site's plain sign-in page as loginUrl, then call finish_build again with the same executionId."
+    : section === "name" || section === "description" || section === "supportedVariants"
+        ? `Rewrite the ${section} in finish_build's metadata without it and call finish_build again with the same executionId.`
+        : section === "site"
+            ? "Rewrite siteName and siteSummary in finish_build's metadata without it and call finish_build again with the same executionId."
+            : section === "inputSchema" || section === "outputSchema" || section === "questions"
+                ? "Edit the operation's schemas and questions in its source without it, then call finish_build again with the same executionId."
+                : "Remove it from the metadata, the operation's schemas and questions, and the login URL, then call finish_build again with the same executionId.";
 /** The owner's answer to a write upgrade's one question, and that question's prompt. */
 const writeUpgradeChoice = (submitted, answers) => {
     const [only] = submitted.questions;
@@ -253,6 +301,7 @@ export const runMint = (input) => Effect.scoped(Effect.gen(function* () {
         }),
     });
     const dependencies = yield* MintServices;
+    const redactCallerText = dependencies.redactCallerText ?? ((text) => text);
     const reportFailure = (error, details) => dependencies.reporting?.failure(error, details) ?? Effect.void;
     const reportBestEffort = (effect, details) => dependencies.reporting?.bestEffort(effect, details) ??
         effect.pipe(Effect.catchAll((error) => diagnose({
@@ -411,12 +460,20 @@ export const runMint = (input) => Effect.scoped(Effect.gen(function* () {
                         : (current.instruction ??
                             "The trusted host already loaded the requested page before you started, but the site answered with an HTTP error status. Inspect the current page before assuming its content; do not navigate to the entry URL again."),
                 }
-                : {
-                    state: current.state,
-                    outcome: current.outcome,
-                    requestedUrl: current.requestedUrl,
-                    instruction: "Host entry navigation did not reach the requested page. Do not assume the browser is on requestedUrl; read page.url() before acting.",
-                };
+                : current.reason === "prior_effect"
+                    ? {
+                        state: current.state,
+                        outcome: current.outcome,
+                        reason: current.reason,
+                        requestedUrl: current.requestedUrl,
+                        instruction: "The host did not open the requested page, because an earlier attempt of this build already ran on the website. The browser is not on requestedUrl; read page.url() before acting. Navigate to requestedUrl yourself when the task needs it, after reading back whether a write an earlier attempt may have made already happened.",
+                    }
+                    : {
+                        state: current.state,
+                        outcome: current.outcome,
+                        requestedUrl: current.requestedUrl,
+                        instruction: "Host entry navigation did not reach the requested page. Do not assume the browser is on requestedUrl; read page.url() before acting.",
+                    };
         // The caller's own page URLs are shown exactly; they are never masked.
         return current.state === "opened" && current.egressProxy !== undefined
             ? {
@@ -1986,6 +2043,10 @@ export const runMint = (input) => Effect.scoped(Effect.gen(function* () {
                 if (error.reason === "login_url_contains_credential" ||
                     error.reason === "metadata_contains_credential")
                     return notPublished(error.code, error.reason, { ...error.publicationFeedback }, "Not published: each part named in parts holds a registered credential (credentialKinds names the kind, never the value). A published tool never carries one, and the host changes nothing itself. For loginUrl, run authenticate again with a login URL that has no credential in it, the site's plain sign-in page. For name, description, siteName or siteSummary, rewrite the text without it. Then call finish_build again with the same executionId. The host refuses every time until the credential is gone; the build is not over.");
+                if (error.reason === "definition_login_reference") {
+                    const section = error.screening?.section;
+                    return notPublished(error.code, error.reason, { section }, `Not published: the tool's ${section ?? "definition"} quotes this build's account reference, an opaque value the host gave this build to identify its login (such as an inspection's accountScope). It means nothing to a caller and is never published. ${definitionFix(section)} The existing example and result remain recorded.`);
+                }
                 if (error.reason === "secret_handle") {
                     const path = error.screening?.path ?? "the source";
                     return notPublished(error.code, error.reason, { path: error.screening?.path }, `Not published: ${path} holds a {{secret.…}} handle. A handle works only in this build's own executions, where the host fills in the caller's answer; published code never holds a handle or a value. Declare the value as a secret question in the operation's questions and read it with ask at run time, as .agents/caller-input/SKILL.md shows, then call finish_build again.`);
@@ -2071,7 +2132,7 @@ export const runMint = (input) => Effect.scoped(Effect.gen(function* () {
             // Asking needs no live execution: it stays open after execution closed and while a
             // write's outcome is uncertain. The agent still verifies before writing again.
             yield* active("publication");
-            const { writeUpgrade, ...proposed } = yield* decode(AgentRequest, input);
+            const { writeUpgrade, ...proposed } = callerVisibleRequest(yield* decode(AgentRequest, input), redactCallerText);
             const upgrade = writeUpgrade === true;
             const submitted = upgrade || effectQuestion
                 ? { ...proposed, questions: withEffectAnswerLabels(proposed.questions) }
@@ -2201,7 +2262,7 @@ export const runMint = (input) => Effect.scoped(Effect.gen(function* () {
                 reportBlocked: (input) => serial.withPermits(1)(Effect.gen(function* () {
                     yield* active("publication");
                     const submitted = yield* decode(BuildBlocked, input);
-                    const explanation = yield* screenMintText(dependencies, submitted.explanation);
+                    const explanation = redactCallerText(yield* screenMintText(dependencies, submitted.explanation));
                     const refusal = blockedRefusal(explanation);
                     if (refusal !== undefined)
                         return refusal;
@@ -2363,6 +2424,14 @@ export const runMint = (input) => Effect.scoped(Effect.gen(function* () {
             businessInputTypes,
             site,
             ...changedEntryNotice(),
+            ...(dependencies.priorAttemptMayHaveChanged === true
+                ? {
+                    priorAttempt: {
+                        websiteMayHaveChanged: true,
+                        instruction: priorAttemptChangeNotice,
+                    },
+                }
+                : {}),
             hostIncidentsBeforeStart,
             executionContext: yield* executionContext(),
             websiteAuthentication: {
@@ -2376,6 +2445,9 @@ export const runMint = (input) => Effect.scoped(Effect.gen(function* () {
         session,
         instructions: dependencies.instructions,
         skills: dependencies.skills,
+        ...(dependencies.hostToolDescriptions === undefined
+            ? {}
+            : { hostToolDescriptions: dependencies.hostToolDescriptions }),
         actions: withHostNotices(dependencies.retainCapture === undefined
             ? (({ retainCapture: _capture, ...available }) => available)(actions)
             : actions, dependencies.drainHostNotices),

package/dist/typescript/src/mint/openai.js

@@ -415,14 +415,16 @@ export const makeOpenAIMinter = (modelProvider, reasoningEffort = "medium", limi
                     const captchaState = readCaptchaState === undefined
                         ? undefined
                         : tool({
-                            ...hostTool("captcha_state", "Read the trusted host's current Kernel CAPTCHA solver state for this attempt's live browser: detected, captchaType and status (not_detected, pending, solved, challenge_pending, solver_succeeded, failed, abandoned or unknown) with finite counts and ages; a solver task's success is not a solved challenge. Read-only: it never clicks, reloads, navigates, triggers a solve or extends a deadline, and it is not page evidence. Read .agents/captcha/SKILL.md before relying on it. intent states which observation prompted the check.", "CAPTCHA state could not be read. This is not evidence that a challenge was solved or absent; use current page evidence and do not retry the website action.", (request) => readCaptchaState(request)),
+                            ...hostTool("captcha_state", turn.hostToolDescriptions?.captchaState ??
+                                "Read the trusted host's current CAPTCHA state for this attempt's live browser, with finite counts and ages. Read-only: it never clicks, reloads, navigates, triggers a solve or extends a deadline, and it is not page evidence. intent states which observation prompted the check.", "CAPTCHA state could not be read. This is not evidence that a challenge was solved or absent; use current page evidence and do not retry the website action.", (request) => readCaptchaState(request)),
                             parameters: parameters(withIntent(Schema.Struct({}))),
                         });
                     const requestRecovery = turn.actions.requestBrowserRecovery;
                     const requestBrowserRecovery = requestRecovery === undefined
                         ? undefined
                         : tool({
-                            ...hostTool("request_browser_recovery", "Troubleshooting only, never part of the published tool: ask the host to replace this attempt's live browser with a new one (the host's recovery policy picks a stronger browser mode or another proxy; the new browser starts on an empty profile, signed out). Guardian reviews your reason first. The host runs no code and repeats nothing; you continue in this conversation and inspect the current page. Read .agents/browser-recovery/SKILL.md before using it. intent states what you observed and why a new browser, not a code fix, should help.", "The browser recovery request did not complete. Nothing was replaced unless a later result says so; read the page before continuing.", (_request, intent) => requestRecovery({ rationale: intent })),
+                            ...hostTool("request_browser_recovery", turn.hostToolDescriptions?.requestBrowserRecovery ??
+                                "Troubleshooting only, never part of the published tool: ask the host to replace this attempt's live browser with a new one, which starts on an empty profile, signed out. Guardian reviews your reason first. The host runs no code and repeats nothing; you continue in this conversation and inspect the current page. intent states what you observed and why a new browser, not a code fix, should help.", "The browser recovery request did not complete. Nothing was replaced unless a later result says so; read the page before continuing.", (_request, intent) => requestRecovery({ rationale: intent })),
                             parameters: parameters(withIntent(Schema.Struct({}))),
                         });
                     const skillCapability = skills({ skills: [...turn.skills] });

package/dist/typescript/src/mint/skills.d.ts

@@ -7,6 +7,10 @@ export interface WorkspaceGuide {
     /** Workspace-relative path to content, `AGENTS.md` included. */
     readonly files: ReadonlyMap<string, string>;
 }
+/**
+ * `standalone` renders each named section's own text. `hosted` is for a host that composed the
+ * directory with its own text for every section first, so any section left is an error.
+ */
 export type AuthoringMode = "hosted" | "standalone";
 /** Pass the trusted installed authoring directory explicitly; it is not a model-selected path. */
 export declare const loadWorkspaceGuide: (directory: string, mode?: AuthoringMode) => Effect.Effect<WorkspaceGuide, MintFailure>;

package/dist/typescript/src/mint/skills.js

@@ -20,21 +20,11 @@ const catalog = [
         description: "Discover an evidenced login entry and sign in through the host",
         references: ["auth-entry.ts"],
     },
-    {
-        name: "testing",
-        description: "Meaningful offline/live checks and honest missing evidence",
-        references: ["captured-parser.ts"],
-    },
     {
         name: "pagination",
         description: "Warm state and fresh reconstruction for scoped read cursors",
         references: ["pagination.ts"],
     },
-    {
-        name: "recovery",
-        description: "Deterministic variants and residual recovery without repeated writes",
-        references: ["variants.ts"],
-    },
     {
         name: "forms",
         description: "Native/custom selection, resolvers, staged forms and expected terms",
@@ -47,59 +37,72 @@ const catalog = [
     },
     {
         name: "writes",
-        description: "Perform a write once as a live act session, confirm it, then compose and publish its script without running it again",
+        description: "Perform an authorized write once, confirm it, then return its integration without running it again",
         references: ["write-session.ts", "write-readback.ts"],
     },
-    {
-        name: "captcha",
-        description: "Check Kernel CAPTCHA state on demand; explorations wait and report, operation code reports ChallengeFailure",
-        references: [],
-    },
-    {
-        name: "browser-recovery",
-        description: "When the browser, not your code, is at fault: ask for a new browser with request_browser_recovery, and what a new browser cannot fix",
-        references: [],
-    },
     {
         name: "caller-input",
         description: "Ask the run's caller mid-run for what only they know: a choice only the page offers, or a code the site sends",
         references: ["caller-choice.ts", "caller-code.ts"],
     },
-    {
-        name: "http-mcp",
-        description: "Browser-bound HTTP extraction and coherent public operation design",
-        references: ["http-version.ts", "kernel-page-fetch.ts"],
-    },
-    {
-        name: "publication",
-        description: "Read before the first finish_build: what publication checks, private values never to publish, and how to act on each rejection",
-        references: [],
-    },
 ];
 /**
  * The host-owned workspace guide, relative to the authoring directory. `AGENTS.md` is the
  * always-on context: the host installs it at the workspace root and gives the same text to the
- * minting model as its instructions, so it holds regardless of the agent runtime. The README and
- * its reference sections are read on demand. Each path is installed at the same path under the
- * workspace root, without the `workspace/` prefix.
+ * minting model as its instructions, so it holds regardless of the agent runtime. The README is
+ * read on demand. Each path is installed at the same path under the workspace root, without the
+ * `workspace/` prefix.
  */
-const workspaceGuideFiles = [
-    "README.md",
-    "reference/offline-commands.md",
-    "reference/captures.md",
-    "reference/fixtures.md",
-    "reference/maintenance.md",
-];
-const standaloneSkills = new Set(["core", "auth", "pagination", "forms", "writes", "caller-input"]);
-/** These two composition sections keep shared browser instructions and examples identical. */
-const authoringText = (text, mode) => {
-    const rendered = text.replace(/<!-- pomerado:(hosted|standalone):start\n([\s\S]*?)\npomerado:\1:end -->(?:\n(?=$))?/g, (_match, selected, content) => (selected === mode ? content : ""));
-    if (rendered.includes("<!-- pomerado:"))
-        throw new Error("Malformed authoring composition section");
+const workspaceGuideFiles = [{ path: "README.md", sectionKey: "guide" }];
+/**
+ * A named section is `<!-- pomerado:section ID -->`, or `<!-- pomerado:section ID:start`, its
+ * standalone text and `pomerado:section ID:end -->`. A section that ends the file also takes the
+ * file's final newline. Each ID starts with its file's key, such as `core.` in `core/SKILL.md`.
+ */
+const section = /<!-- pomerado:section ([a-z0-9.-]+)(?: -->|:start\n([\s\S]*?)\npomerado:section \1:end -->)(?:\n(?=$))?/g;
+/**
+ * Anything left that reads as a marker, in any case or spacing, is malformed: a broken section, or
+ * a 0.1.1 block such as `pomerado:hosted:end -->`. Authoring text never says `pomerado:` itself.
+ */
+const sectionTrace = /pomerado:/i;
+const fence = /^\s*(`{3,}|~{3,})/;
+/** A section marker belongs to the file's own text, never to a fenced example. */
+const refuseFencedSections = (text) => {
+    let open;
+    for (const line of text.split("\n")) {
+        const marker = fence.exec(line)?.[1];
+        if (marker === undefined) {
+            if (open !== undefined && sectionTrace.test(line))
+                throw new Error("Authoring section inside a code fence");
+        }
+        else if (open === undefined)
+            open = marker;
+        else if (marker[0] === open[0] && marker.length >= open.length)
+            open = undefined;
+    }
+};
+const authoringText = (text, mode, sectionKey) => {
+    if (mode === "hosted") {
+        if (sectionTrace.test(text))
+            throw new Error("Hosted authoring has a section the host did not compose");
+        return text;
+    }
+    refuseFencedSections(text);
+    const seen = new Set();
+    const rendered = text.replace(section, (_match, id, content) => {
+        if (!id.startsWith(`${sectionKey}.`))
+            throw new Error(`Authoring section ${id} is not one of ${sectionKey}'s`);
+        if (seen.has(id))
+            throw new Error(`Authoring section ${id} appears twice`);
+        seen.add(id);
+        return content ?? "";
+    });
+    if (sectionTrace.test(rendered))
+        throw new Error("Malformed authoring section");
     return rendered;
 };
-const readGuideFile = (directory, path, mode) => Effect.tryPromise({
-    try: async () => authoringText(new TextDecoder("utf-8", { fatal: true }).decode(await readScopedFile(directory, `workspace/${path}`)), mode),
+const readGuideFile = (directory, path, sectionKey, mode) => Effect.tryPromise({
+    try: async () => authoringText(new TextDecoder("utf-8", { fatal: true }).decode(await readScopedFile(directory, `workspace/${path}`)), mode, sectionKey),
     catch: (error) => new MintFailure({
         failureDetail: failureDetail("mint_host_dependency_failed", {
             operation: "readScopedFile",
@@ -111,18 +114,16 @@ const readGuideFile = (directory, path, mode) => Effect.tryPromise({
     }),
 });
 /** Pass the trusted installed authoring directory explicitly; it is not a model-selected path. */
-export const loadWorkspaceGuide = (directory, mode = "hosted") => Effect.gen(function* () {
-    const instructions = yield* readGuideFile(directory, "AGENTS.md", mode);
+export const loadWorkspaceGuide = (directory, mode = "standalone") => Effect.gen(function* () {
+    const instructions = yield* readGuideFile(directory, "AGENTS.md", "agents", mode);
     const files = new Map([["AGENTS.md", instructions]]);
-    for (const path of mode === "hosted" ? workspaceGuideFiles : ["README.md"])
-        files.set(path, yield* readGuideFile(directory, path, mode));
+    for (const { path, sectionKey } of workspaceGuideFiles)
+        files.set(path, yield* readGuideFile(directory, path, sectionKey, mode));
     return { instructions, files };
 });
 /** Pass the trusted installed authoring directory explicitly; it is not a model-selected path. */
-export const loadAuthoringSkills = (directory, mode = "hosted") => Effect.tryPromise({
-    try: async () => Promise.all(catalog
-        .filter((entry) => mode === "hosted" || standaloneSkills.has(entry.name))
-        .map(async (entry) => {
+export const loadAuthoringSkills = (directory, mode = "standalone") => Effect.tryPromise({
+    try: async () => Promise.all(catalog.map(async (entry) => {
         const references = {};
         for (const name of entry.references)
             references[name] = file({
@@ -130,10 +131,8 @@ export const loadAuthoringSkills = (directory, mode = "hosted") => Effect.tryPro
             });
         return {
             name: entry.name,
-            description: mode === "standalone" && entry.name === "writes"
-                ? "Perform an authorized write once, confirm it, then return its integration without running it again"
-                : entry.description,
-            content: new TextEncoder().encode(authoringText(new TextDecoder("utf-8", { fatal: true }).decode(await readScopedFile(directory, `${entry.name}/SKILL.md`)), mode)),
+            description: entry.description,
+            content: new TextEncoder().encode(authoringText(new TextDecoder("utf-8", { fatal: true }).decode(await readScopedFile(directory, `${entry.name}/SKILL.md`)), mode, entry.name)),
             references,
         };
     })),

package/dist/typescript/src/runtime/input-request.d.ts

@@ -6,6 +6,7 @@ import { Either, Schema, type Effect } from "effect";
  * surface (Dashboard, MCP, REST) answers through `validateAnswer`.
  */
 /** A question's key in the request and in the answer. */
+export declare const questionIdPattern: RegExp;
 export declare const QuestionId: Schema.filter<typeof Schema.String>;
 /** The longest free-text or secret answer any question accepts. */
 export declare const maximumAnswerLength = 16384;

package/dist/typescript/src/runtime/input-request.js

@@ -6,7 +6,8 @@ import { Data, Either, Schema } from "effect";
  * surface (Dashboard, MCP, REST) answers through `validateAnswer`.
  */
 /** A question's key in the request and in the answer. */
-export const QuestionId = Schema.String.pipe(Schema.pattern(/^[a-z][a-z0-9_]{0,63}$/));
+export const questionIdPattern = /^[a-z][a-z0-9_]{0,63}$/;
+export const QuestionId = Schema.String.pipe(Schema.pattern(questionIdPattern));
 /** The host's opaque name for an offered option; a script's or provider's own value stays private. */
 const OptionId = Schema.String.pipe(Schema.pattern(/^[a-z0-9_]{1,64}$/));
 const Label = Schema.String.pipe(Schema.minLength(1), Schema.maxLength(256));