maf-sandbox-codeact 0.9.2__tar.gz → 0.10.0__tar.gz

{maf_sandbox_codeact-0.9.2 → maf_sandbox_codeact-0.10.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: maf-sandbox-codeact
-Version: 0.9.2
+Version: 0.10.0
 Summary: CodeAct as a Microsoft Agent Framework tool — the model writes a short Python program and it runs inside a sandbox — written against maf-sandbox so it runs on any sandbox backend.
 Keywords: codeact,code-execution,sandbox,agent-framework,microsoft-agent-framework
 Author: SOKOLAI BV
@@ -15,7 +15,7 @@ Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
 Classifier: Topic :: Software Development :: Interpreters
-Requires-Dist: maf-sandbox>=0.27.0,<0.30
+Requires-Dist: maf-sandbox>=0.30.0,<0.32
 Requires-Dist: agent-framework-core>=1.13.0,<2
 Requires-Python: >=3.12, <3.15
 Project-URL: Homepage, https://www.sokol.ai
@@ -128,19 +128,17 @@ Naming a host is a real widening, and worth naming as such: this sandbox runs mo
 
 **The host authorises every way in, and initiates only one of them.** With `file_store` wired, caller-selected files are written in before the program runs — deliberately, and constrained to the caller's listing, so the model cannot widen the set. What that content *is* remains the host's to know: a file in the store may itself carry text from somewhere untrusted, and a program that parses it is running on input the sandbox did not vet. An allowlisted host is the other way, and the *program* initiates that one — whatever it fetches is input nobody chose in advance. Wire no store, no allowlist and no registry, and nothing gets in but the source the model wrote.
 
-**The tool declares no `source_integrity`.** The library's default is `"trusted"`, which is right for a workload whose result is a compiler's own diagnostics and wrong for this one: what comes back is whatever a model-written `print(...)` chose to emit. Undeclared, MAF's information-flow tracker applies its untrusted default and the result taints the conversation — the fail-safe direction, and the honest one.
+**The tool declares no `source_integrity`, in either rendering.** The library's default is `"trusted"`, and what has to hold for it is that the result derives from wholly trusted input. It does not here: what comes back is whatever a model-written `print(...)` chose to emit. Undeclared, MAF's information-flow tracker applies its untrusted default — the fail-safe direction, and the honest one. A declaration would not sit under that default as a floor, either: FIDES reads `source_integrity` as an override and drops the input-label join entirely.
 
-**`withhold_guest_output=True` changes that, by changing what comes back.** The result is then the exit code, the size of each stream, which of the declared outputs landed — by the name the model itself declared — and one sentence naming the route. No guest-authored *text* survives into it, so the tool declares `source_integrity="trusted"` and a host doing information-flow control gets a result it can label without either lying about it or tainting the conversation. Content still reaches the model by the road the option leaves open: the program writes it to a declared output, that lands in the sink, and the host's own already-classified file-reading path serves it back.
+**`withhold_guest_output=True` changes what comes back, and not what it claims.** The result is then the exit code, the size of each stream, which of the declared outputs landed — by the name the model itself declared — and one sentence naming the route. No guest-authored *text* survives into it. What does survive is chosen by the program all the same, so the declaration stays absent: withholding removes the guest's text from the result, not the guest from the result's derivation. What it is for is the rendering itself — guest-authored text never reaches the transcript, a host's logs, or anything else downstream of the call, and that holds whether or not a host runs information-flow middleware. Content still reaches the model by the road the option leaves open: the program writes it to a declared output, that lands in the sink, and the host's own already-classified file-reading path serves it back.
 
 The rendering follows the transport. Off the host-tool-call transport you get the exit code and a size for `stdout` and for `stderr` separately. On it, the launcher merges the program's stderr into its stdout, so there is one `output` size — and `stderr` is the host's field there, so its note about the run is surfaced whole under `note:`. Withholding that note would report a run whose output was dropped for its size as one that printed nothing.
 
-Be precise about what that buys. The prose and the shape are this package's, and the artifact names are the model's own — but what fills them is the program's to choose. An exit status is 8 bits. Each stream's size is a few more, chosen by padding. And **each declared output is one further bit**: the program decides whether to write it, and the result says of every declared name whether it landed, so a call declaring the default eight names carries eight more. So the claim is that no guest-authored *text* crosses, not that no guest-chosen *bit* does. That is a narrow, per-call channel rather than the open one a rendered `stdout` is, and it is the honest limit. A host that has to close it should not attach this workload at all.
+Be precise about what that buys. The prose and the shape are this package's, and the artifact names are the model's own — but what fills them is the program's to choose. An exit status is 8 bits. Each stream's size is a few more, chosen by padding. And **each declared output is one further bit**: the program decides whether to write it, and the result says of every declared name whether it landed, so a call declaring the default eight names carries eight more. So what stops crossing is guest-authored *text*, not every guest-chosen *bit*. That is a narrow, per-call channel rather than the open one a rendered `stdout` is, and it is the honest limit. A host that has to close it should not attach this workload at all.
 
 A "size" here is the UTF-8 length of the text the stream decoded to, not the byte count the program wrote. `ExecResult` states no decoding contract ([#465](https://github.com/sokolaidev/maf-extensions/issues/465)), so a backend replacing an undecodable byte changes the number: the same program writing four bytes, `b"ok\xff\xfe"`, reports 8 on Docker and 5 on ACA Sandboxes. Neither is 4, and nothing here can recover it — `ExecResult` carries neither the bytes nor a length.
 
-**The sink's `display` is not rendered in this mode**, and that is why the claim holds. `OutputSink.deliver` is handed an `Artifact` whose `content` is the guest's bytes, and no protocol rule keeps `display` independent of it — a sink that quoted any of that content would put guest-authored text straight into a result labelled trusted. Withheld, the saved files are named by the spelling the model itself declared, which costs the sink's own detail and needs no promise from the host to stay honest.
-
-A wired host-tool registry keeps its say. `HostToolAggregate.result_integrity` is the weakest level over every registered source — an unstamped tool has already failed safe into it — and where it says `untrusted` this tool declares nothing, withheld or not. Withholding is about this kind's own rendering; where a host tool's data came from is core's fold to make.
+**The sink's `display` is not rendered in this mode.** `OutputSink.deliver` is handed an `Artifact` whose `content` is the guest's bytes, and no protocol rule keeps `display` independent of it — a sink that quoted any of that content would put guest-authored text straight back into the result. Withheld, the saved files are named by the spelling the model itself declared, which costs the sink's own detail and needs no promise from the host to stay honest.
 
 The mode is required to be `CodeactOutputs.DECLARED` and both other pairings are refused at construction, each for its own reason. Under `NONE` there is nowhere for content to go, so no call could return anything the model can use. Under `MANIFEST` the *program* names its own files in `outputs.json`, and this kind renders those names back into the result — a guest-chosen string inside a result claiming to hold none, which is the fail-open shape the option exists to close.
 

{maf_sandbox_codeact-0.9.2 → maf_sandbox_codeact-0.10.0}/README.md

@@ -103,19 +103,17 @@ Naming a host is a real widening, and worth naming as such: this sandbox runs mo
 
 **The host authorises every way in, and initiates only one of them.** With `file_store` wired, caller-selected files are written in before the program runs — deliberately, and constrained to the caller's listing, so the model cannot widen the set. What that content *is* remains the host's to know: a file in the store may itself carry text from somewhere untrusted, and a program that parses it is running on input the sandbox did not vet. An allowlisted host is the other way, and the *program* initiates that one — whatever it fetches is input nobody chose in advance. Wire no store, no allowlist and no registry, and nothing gets in but the source the model wrote.
 
-**The tool declares no `source_integrity`.** The library's default is `"trusted"`, which is right for a workload whose result is a compiler's own diagnostics and wrong for this one: what comes back is whatever a model-written `print(...)` chose to emit. Undeclared, MAF's information-flow tracker applies its untrusted default and the result taints the conversation — the fail-safe direction, and the honest one.
+**The tool declares no `source_integrity`, in either rendering.** The library's default is `"trusted"`, and what has to hold for it is that the result derives from wholly trusted input. It does not here: what comes back is whatever a model-written `print(...)` chose to emit. Undeclared, MAF's information-flow tracker applies its untrusted default — the fail-safe direction, and the honest one. A declaration would not sit under that default as a floor, either: FIDES reads `source_integrity` as an override and drops the input-label join entirely.
 
-**`withhold_guest_output=True` changes that, by changing what comes back.** The result is then the exit code, the size of each stream, which of the declared outputs landed — by the name the model itself declared — and one sentence naming the route. No guest-authored *text* survives into it, so the tool declares `source_integrity="trusted"` and a host doing information-flow control gets a result it can label without either lying about it or tainting the conversation. Content still reaches the model by the road the option leaves open: the program writes it to a declared output, that lands in the sink, and the host's own already-classified file-reading path serves it back.
+**`withhold_guest_output=True` changes what comes back, and not what it claims.** The result is then the exit code, the size of each stream, which of the declared outputs landed — by the name the model itself declared — and one sentence naming the route. No guest-authored *text* survives into it. What does survive is chosen by the program all the same, so the declaration stays absent: withholding removes the guest's text from the result, not the guest from the result's derivation. What it is for is the rendering itself — guest-authored text never reaches the transcript, a host's logs, or anything else downstream of the call, and that holds whether or not a host runs information-flow middleware. Content still reaches the model by the road the option leaves open: the program writes it to a declared output, that lands in the sink, and the host's own already-classified file-reading path serves it back.
 
 The rendering follows the transport. Off the host-tool-call transport you get the exit code and a size for `stdout` and for `stderr` separately. On it, the launcher merges the program's stderr into its stdout, so there is one `output` size — and `stderr` is the host's field there, so its note about the run is surfaced whole under `note:`. Withholding that note would report a run whose output was dropped for its size as one that printed nothing.
 
-Be precise about what that buys. The prose and the shape are this package's, and the artifact names are the model's own — but what fills them is the program's to choose. An exit status is 8 bits. Each stream's size is a few more, chosen by padding. And **each declared output is one further bit**: the program decides whether to write it, and the result says of every declared name whether it landed, so a call declaring the default eight names carries eight more. So the claim is that no guest-authored *text* crosses, not that no guest-chosen *bit* does. That is a narrow, per-call channel rather than the open one a rendered `stdout` is, and it is the honest limit. A host that has to close it should not attach this workload at all.
+Be precise about what that buys. The prose and the shape are this package's, and the artifact names are the model's own — but what fills them is the program's to choose. An exit status is 8 bits. Each stream's size is a few more, chosen by padding. And **each declared output is one further bit**: the program decides whether to write it, and the result says of every declared name whether it landed, so a call declaring the default eight names carries eight more. So what stops crossing is guest-authored *text*, not every guest-chosen *bit*. That is a narrow, per-call channel rather than the open one a rendered `stdout` is, and it is the honest limit. A host that has to close it should not attach this workload at all.
 
 A "size" here is the UTF-8 length of the text the stream decoded to, not the byte count the program wrote. `ExecResult` states no decoding contract ([#465](https://github.com/sokolaidev/maf-extensions/issues/465)), so a backend replacing an undecodable byte changes the number: the same program writing four bytes, `b"ok\xff\xfe"`, reports 8 on Docker and 5 on ACA Sandboxes. Neither is 4, and nothing here can recover it — `ExecResult` carries neither the bytes nor a length.
 
-**The sink's `display` is not rendered in this mode**, and that is why the claim holds. `OutputSink.deliver` is handed an `Artifact` whose `content` is the guest's bytes, and no protocol rule keeps `display` independent of it — a sink that quoted any of that content would put guest-authored text straight into a result labelled trusted. Withheld, the saved files are named by the spelling the model itself declared, which costs the sink's own detail and needs no promise from the host to stay honest.
-
-A wired host-tool registry keeps its say. `HostToolAggregate.result_integrity` is the weakest level over every registered source — an unstamped tool has already failed safe into it — and where it says `untrusted` this tool declares nothing, withheld or not. Withholding is about this kind's own rendering; where a host tool's data came from is core's fold to make.
+**The sink's `display` is not rendered in this mode.** `OutputSink.deliver` is handed an `Artifact` whose `content` is the guest's bytes, and no protocol rule keeps `display` independent of it — a sink that quoted any of that content would put guest-authored text straight back into the result. Withheld, the saved files are named by the spelling the model itself declared, which costs the sink's own detail and needs no promise from the host to stay honest.
 
 The mode is required to be `CodeactOutputs.DECLARED` and both other pairings are refused at construction, each for its own reason. Under `NONE` there is nowhere for content to go, so no call could return anything the model can use. Under `MANIFEST` the *program* names its own files in `outputs.json`, and this kind renders those names back into the result — a guest-chosen string inside a result claiming to hold none, which is the fail-open shape the option exists to close.
 

{maf_sandbox_codeact-0.9.2 → maf_sandbox_codeact-0.10.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "maf-sandbox-codeact"
-version = "0.9.2"
+version = "0.10.0"
 description = "CodeAct as a Microsoft Agent Framework tool — the model writes a short Python program and it runs inside a sandbox — written against maf-sandbox so it runs on any sandbox backend."
 readme = "README.md"
 requires-python = ">=3.12,<3.15"
@@ -24,7 +24,7 @@ classifiers = [
     "Topic :: Software Development :: Interpreters",
 ]
 dependencies = [
-    "maf-sandbox>=0.27.0,<0.30",
+    "maf-sandbox>=0.30.0,<0.32",
     "agent-framework-core>=1.13.0,<2",
 ]
 

{maf_sandbox_codeact-0.9.2 → maf_sandbox_codeact-0.10.0}/pyproject.toml.orig

@@ -1,6 +1,6 @@
 [project]
 name = "maf-sandbox-codeact"
-version = "0.9.2"
+version = "0.10.0"
 description = "CodeAct as a Microsoft Agent Framework tool — the model writes a short Python program and it runs inside a sandbox — written against maf-sandbox so it runs on any sandbox backend."
 readme = "README.md"
 requires-python = ">=3.12,<3.15"
@@ -35,7 +35,7 @@ dependencies = [
     # import, and that one fails at the call, where no import check is looking. The number
     # itself is below, and `scripts/set_dependents_range.py` moves it — so this says which
     # release the floor is for, never which release that is.
-    "maf-sandbox>=0.27.0,<0.30",
+    "maf-sandbox>=0.30.0,<0.32",
     # The `@tool` decorator. MAF is a genuine dependency of the tool itself, not of the host
     # application.
     "agent-framework-core>=1.13.0,<2",

{maf_sandbox_codeact-0.9.2 → maf_sandbox_codeact-0.10.0}/src/maf_sandbox_codeact/_tool.py

@@ -50,16 +50,21 @@ from maf_sandbox import (
     SandboxProgramTimeout,
     SandboxRouter,
     SandboxSpec,
-    SourceIntegrity,
     TransferLimits,
     collect_outputs,
+    echoed_name,
     error_detail,
     guest_run_layout,
     host_tool_calls_over_exec,
     host_tool_shim,
     validate_artifact_name,
 )
-from maf_sandbox.maf import SandboxToolSession, sandboxed_tool
+from maf_sandbox.maf import (
+    SandboxToolSession,
+    hidden_content_candidates,
+    positions_holding_hidden_content,
+    sandboxed_tool,
+)
 
 if TYPE_CHECKING:
     from collections.abc import Awaitable, Callable, Mapping, Sequence
@@ -82,10 +87,10 @@ EXECUTE_CODE_TOOL_NAME = "execute_code"
 #: The sandbox kind this workload asks for.
 CODEACT_KIND = "codeact"
 
-#: Where every run's directory is created — a dedicated root rather than the image's own tree.
+#: Where every call's directory is created — a dedicated root rather than the image's own tree.
 _WORK_DIR = "/maf-sandbox/work"
 
-#: One fixed name inside each run's own directory.
+#: One fixed name inside each call's own directory.
 _PROGRAM_FILENAME = "program.py"
 
 #: What this kind needs to reach for ``execute_code`` to work at all — nothing, because the
@@ -93,6 +98,11 @@ _PROGRAM_FILENAME = "program.py"
 #: rather than an omission; :func:`codeact_sandbox_spec` has why it is fixed here.
 _KIND_EGRESS: tuple[str, ...] = ()
 
+#: The arguments a caller names files in, which is what a refusal about one of them points
+#: at and what provenance is asked about.
+_FILES_ARGUMENT = "files"
+_OUTPUTS_ARGUMENT = "outputs"
+
 #: Where a ``MANIFEST``-mode program says what it produced.
 _MANIFEST_FILENAME = "outputs.json"
 _MANIFEST_OUTPUTS_KEY = "outputs"
@@ -250,11 +260,11 @@ def make_codeact_tools(
         outputs: How a program's output files are named. See :class:`CodeactOutputs`.
         withhold_guest_output: Keep what the program printed out of the tool result, and answer
             with sizes and the model's own declared names instead. No guest-authored text
-            survives into the result, so this tool declares
-            :data:`~maf_sandbox.SourceIntegrity.TRUSTED` — unless a wired registry's
-            ``result_integrity`` says otherwise, which is core's fold to make and is honoured
-            here. Requires :data:`CodeactOutputs.DECLARED`: the one mode where content can still
-            reach the model and no guest-chosen name reaches the result.
+            survives into the result — but the values that replace it were still chosen by a
+            program the model wrote, so this changes what the result *holds* and not where it
+            came from: the tool declares no ``source_integrity`` either way. Requires
+            :data:`CodeactOutputs.DECLARED`: the one mode where content can still reach the
+            model and no guest-chosen name reaches the result.
 
             A size here is the UTF-8 length of the text the stream came back as, not the count
             of bytes the program wrote: ``ExecResult`` states no decoding contract, so a
@@ -268,17 +278,16 @@ def make_codeact_tools(
             ``note:``, since withholding it would report a dropped output as a program that
             printed nothing.
 
-            **What "trusted" claims, exactly.** The prose and the shape are this package's, and
-            the artifact names are the model's own — but what fills them is the program's to
-            choose, and it is a channel rather than a leak-free boundary. The exit status is 8
-            bits; each stream's size is a few more, chosen by padding; and **each declared
+            **What withholding gets you, exactly.** The prose and the shape are this package's,
+            and the artifact names are the model's own — but what fills them is the program's
+            to choose, and it is a channel rather than a leak-free boundary. The exit status is
+            8 bits; each stream's size is a few more, chosen by padding; and **each declared
             output is one further bit**, since the program decides whether to write it and the
             result says of every declared name whether it landed — up to ``files_out.max_files``
-            of them. So the claim is that no guest-authored *text* crosses, not that no
-            guest-chosen *bit* does. That is a narrow per-call channel rather than the open one
-            a rendered ``stdout`` is, and a host that must close it should not attach this
-            workload at all. The sink's ``display`` is deliberately *not* rendered here — see
-            :func:`_format_landed`.
+            of them. So what stops crossing is guest-authored *text*, not every guest-chosen
+            *bit* — a narrow per-call channel rather than the open one a rendered ``stdout`` is,
+            and a host that must close it should not attach this workload at all. The sink's
+            ``display`` is deliberately *not* rendered here — see :func:`_format_landed`.
         outbound_max_confidentiality: The host's cap for tools that carry something out, in the
             host's own vocabulary. Off by default and written only when something can actually
             leave: an artifact landing in the sink, a host tool that carries something out, or
@@ -457,31 +466,18 @@ def make_codeact_tools(
         name=EXECUTE_CODE_TOOL_NAME,
         approval_mode="always_require" if approval_gated else "never_require",
         also_carries_out=registry_carries_out,
-        # The library's "trusted" default is right for a compiler's diagnostics and wrong here:
-        # what comes back is whatever a model-written `print(...)` chose to emit. Undeclared,
-        # the tracker's untrusted default applies and the result taints the conversation.
-        # Withholding removes that premise — no guest-authored text survives into the result —
-        # so the declaration becomes available, subject to the registry's own fold below.
-        source_integrity=_withheld_integrity(surface) if withhold_guest_output else None,
+        # Never declared, withheld or not. What comes back is whatever a model-written
+        # `print(...)` chose to emit; withheld it is an exit status, two sizes and a presence
+        # bit per declared output, every one of them chosen by a program the model wrote. A
+        # declaration replaces the framework's input-label join rather than flooring it, so
+        # declaring anything here would tell a host's middleware to disregard the input side.
+        source_integrity=None,
         outbound_max_confidentiality=outbound_max_confidentiality,
         output_sink=output_sink,
         logger=logger,
     )
 
 
-def _withheld_integrity(surface: HostToolAggregate | None) -> SourceIntegrity | None:
-    """What a withholding tool may declare, once the registry has had its say.
-
-    Withholding is about this kind's own rendering, and a registry's sources are core's fold to
-    make: ``result_integrity`` is the weakest level over every registered source, and an
-    unstamped tool has already failed safe into it. A registry with no opinion leaves the
-    workload's own, which withholding has earned; one that says untrusted keeps it.
-    """
-    if surface is not None and surface.result_integrity is SourceIntegrity.UNTRUSTED:
-        return None
-    return SourceIntegrity.TRUSTED
-
-
 def _effective_egress(extra: Sequence[str]) -> tuple[str, ...]:
     """The union of what this kind needs and what the deployment added, in that order.
 
@@ -898,6 +894,10 @@ async def _execute(
     withhold: bool,
 ) -> str:
     """One ``execute_code`` call: share, run, and collect."""
+    # Taken before anything here awaits, and carried to every name check in this call: the
+    # framework's accessor is not scoped to the call, so a lookup made after the run — the
+    # manifest's, above all — may find nothing left to answer with.
+    rewritten = hidden_content_candidates()
     # Scope and thread come from the host's request context, never from model input.
     key = session.key()
     if isinstance(key, str):
@@ -922,16 +922,17 @@ async def _execute(
         )
 
     # Chosen here rather than after `acquire`, so that a declared name can be judged against
-    # the guest path it will actually become — the prefix is 13 bytes of the 255 a name gets.
+    # the guest path it will actually become — the prefix is the id core allocates for the
+    # call, derived below rather than counted.
     call_directory = session.guest_call_path()
-    run_id = call_directory.rsplit("/", 1)[-1]
-    # Where the model's own files live, relative to `work_dir`: the run directory itself, or
+    call_id = call_directory.rsplit("/", 1)[-1]
+    # Where the model's own files live, relative to `work_dir`: the call directory itself, or
     # the work subdirectory of it when the transport owns the run. Everything addressed by a
     # name a model chose is built from this — what is shared in, what the manifest is read
-    # from, and what is collected out — so the three cannot disagree about one run's layout.
+    # from, and what is collected out — so the three cannot disagree about one call's layout.
     # It is longer when calling a host tool, which is why the name checks below take it rather than
-    # `run_id`: five more bytes of the 255 a guest path gets, spent before the name is.
-    guest_prefix = f"{run_id}/{WORK_DIRECTORY}" if host_tool_call is not None else run_id
+    # `call_id`: five more bytes of the 255 a guest path gets, spent before the name is.
+    guest_prefix = f"{call_id}/{WORK_DIRECTORY}" if host_tool_call is not None else call_id
 
     names: list[str] = []
     if outputs is CodeactOutputs.DECLARED:
@@ -941,6 +942,9 @@ async def _execute(
             reserved=reserved,
             guest_prefix=guest_prefix,
             normalization=_normalization(session),
+            named_by=_OUTPUTS_ARGUMENT,
+            argument=_OUTPUTS_ARGUMENT,
+            candidates=rewritten,
         )
         if isinstance(checked, str):
             return checked
@@ -967,7 +971,7 @@ async def _execute(
         return over_cap
     if store is not None:
         resolved = await _resolve_listed_files(
-            session, store, files, reserved=reserved, withhold=withhold
+            session, store, files, reserved=reserved, withhold=withhold, candidates=rewritten
         )
         if isinstance(resolved, str):
             return resolved
@@ -981,9 +985,9 @@ async def _execute(
         return sandbox
 
     # The session owns this path, and `sandboxed_tool` reclaims it when the call returns.
-    # Built before anything is written, because it decides where everything goes. A run that
+    # Built before anything is written, because it decides where everything goes. A call that
     # calls a host tool is two directories — the model's files in `work`, the program and the shim
-    # in the transport's — and one that does not is the run directory flat, which is what a kind
+    # in the transport's — and one that does not is the call directory flat, which is what a kind
     # writing no shim has always been. The program name and the interpreter are passed rather
     # than defaulted, so this kind's constants and the transport's cannot drift apart.
     layout = (
@@ -1095,7 +1099,14 @@ async def _execute(
         # a program that caught its own error and wrote the diagnosis into one.
         return report
     collected = await _collect(
-        session, sandbox, guest_prefix, outputs, names, reserved, withhold=withhold
+        session,
+        sandbox,
+        guest_prefix,
+        outputs,
+        names,
+        reserved,
+        withhold=withhold,
+        candidates=rewritten,
     )
     return f"{report}\n\n{collected}" if collected else report
 
@@ -1110,6 +1121,7 @@ async def _resolve_listed_files(
     *,
     reserved: Mapping[str, str],
     withhold: bool = False,
+    candidates: frozenset[str] | None = None,
 ) -> list[str] | str:
     """Match each requested name against the caller's listing, or answer with the refusal.
 
@@ -1119,6 +1131,12 @@ async def _resolve_listed_files(
     """
     if not files:
         return []
+    # Asked before the first await, not beside the loop that uses it: the framework's accessor
+    # is not scoped to the call, so every suspension before asking is a chance for the answer
+    # to come back empty. See `positions_holding_hidden_content`.
+    rewritten = positions_holding_hidden_content(
+        files, argument=_FILES_ARGUMENT, candidates=candidates
+    )
     listing = await session.list_files(store)
     if isinstance(listing, str):
         # The host's own sentence about its store. Withheld it is dropped for the reason the
@@ -1129,24 +1147,27 @@ async def _resolve_listed_files(
         return listing
     known = set(listing)
     resolved: list[str] = []
-    for name in files:
+    for position, name in enumerate(files):
+        at = f"files[{position}]"
+        hidden = position in rewritten
+        named = echoed_name(name, at=at, hidden=hidden)
         try:
-            validate_artifact_name(name)
+            validate_artifact_name(name, at=at, hidden=hidden)
         except SandboxArtifactNameInvalid as exc:
             # The validator's own sentence, which names the rule that was broken: a fixed
             # message listing two of its rules tells a caller refused for a backslash or a
             # control character that its name satisfies everything the tool asked for. The
             # listing is still not echoed — that would invite a retry with another spelling.
-            return f"Error: {name!r} cannot be shared — {exc}"
+            return f"Error: {named} cannot be shared — {exc}"
         if name in reserved:
-            return f"Error: {name!r} cannot be shared — {reserved[name]}."
-        refusal = _inside_a_reserved_file(name, reserved, action="shared")
+            return f"Error: {named} cannot be shared — {reserved[name]}."
+        refusal = _inside_a_reserved_file(name, reserved, action="shared", at=at, hidden=hidden)
         if refusal is not None:
             return refusal
         if name in resolved:
             # One read and one write per name. Repeating one buys the caller nothing and
             # multiplies both, which is the cheapest way to amplify against the byte ceilings.
-            return f"Error: {name!r} was listed twice."
+            return f"Error: {named} was listed twice."
         if name not in known:
             logger.warning(
                 "execute_code: %r is not in this tool's file store listing (%d file(s) visible) "
@@ -1155,7 +1176,7 @@ async def _resolve_listed_files(
                 len(listing),
             )
             return (
-                f"Error: {name!r} is not in this tool's file listing, so it was not shared. "
+                f"Error: {named} is not in this tool's file listing, so it was not shared. "
                 f"{_listing_hint(name, listing, withhold=withhold)}"
             )
         resolved.append(name)
@@ -1172,8 +1193,8 @@ def _listing_hint(name: str, listing: list[str], *, withhold: bool = False) -> s
     ``withhold`` names none of them. A store's filenames are the host's to supply through
     ``list_files`` and carry no integrity contract of their own — an agent that saved something
     it fetched may have named it from that content — so echoing up to
-    :data:`_LISTING_HINT_MAX` of them would put unclassified text into a result declared
-    :data:`~maf_sandbox.SourceIntegrity.TRUSTED`, for a name the model never asked about.
+    :data:`_LISTING_HINT_MAX` of them would put unclassified text into a result whose whole
+    point is to hold none, for a name the model never asked about.
     """
     if not listing:
         return "This tool's listing is empty — no files were shared with it."
@@ -1221,7 +1242,9 @@ async def _read_listed_files(
     return read
 
 
-def _inside_a_reserved_file(name: str, reserved: Mapping[str, str], *, action: str) -> str | None:
+def _inside_a_reserved_file(
+    name: str, reserved: Mapping[str, str], *, action: str, at: str, hidden: bool
+) -> str | None:
     """Refuse a name that would have to live inside a reserved file, naming which one.
 
     Every shipped backend creates parent directories for a nested write, so
@@ -1235,8 +1258,8 @@ def _inside_a_reserved_file(name: str, reserved: Mapping[str, str], *, action: s
     if above is None:
         return None
     return (
-        f"Error: {name!r} cannot be {action} — {above!r} is a file name this tool reserves in "
-        f"every run's directory, so nothing can live inside it."
+        f"Error: {echoed_name(name, at=at, hidden=hidden)} cannot be {action} — {above!r} is a "
+        f"file name this tool reserves in every run's directory, so nothing can live inside it."
     )
 
 
@@ -1334,6 +1357,9 @@ def _validated_output_names(
     reserved: Mapping[str, str],
     guest_prefix: str,
     normalization: NameNormalization,
+    named_by: str,
+    argument: str | None = None,
+    candidates: frozenset[str] | None = None,
 ) -> list[str] | str:
     """Settle every output name before the program runs, or answer with the refusal.
 
@@ -1341,6 +1367,9 @@ def _validated_output_names(
     with its run prefix, and the delivered name after normalization — so that a refusal cannot
     arrive a whole run late.  That function stays the authority: if the two disagree, this one
     is wrong, and the cost is the late refusal rather than a name reaching a host.
+
+    ``named_by`` says where the names came from — the ``outputs`` argument or the manifest —
+    so a refusal can point at the one it means without quoting a value it should not.
     """
     if len(names) > max_files:
         return (
@@ -1348,8 +1377,15 @@ def _validated_output_names(
             f"{max_files} per call."
         )
     prefix = f"{guest_prefix}/"
-    seen: dict[str, str] = {}
-    for name in names:
+    seen: dict[str, tuple[str, str]] = {}
+    # Asked of manifest names as well as of the model's own `outputs`, and that is not
+    # belt-and-braces: `code` is a rewritten argument too, so a payload can reach the guest
+    # in the program's own source and come back as a name the program chose to write.
+    rewritten = positions_holding_hidden_content(names, argument=argument, candidates=candidates)
+    for position, name in enumerate(names):
+        at = f"{named_by}[{position}]"
+        hidden = position in rewritten
+        named = echoed_name(name, at=at, hidden=hidden)
         # NFC is not length-non-increasing — 43 × U+0958 is 129 bytes declared and 258
         # delivered — so the name to hold to the invariant is the one the sink will receive.
         delivered = (
@@ -1357,25 +1393,25 @@ def _validated_output_names(
         )
         for spelling in (name, delivered, prefix + name):
             try:
-                validate_artifact_name(spelling)
+                validate_artifact_name(spelling, at=at, hidden=hidden)
             except SandboxArtifactNameInvalid as exc:
-                return f"Error: {name!r} cannot be saved — {exc}"
+                return f"Error: {named} cannot be saved — {exc}"
         if name in reserved:
-            return f"Error: {name!r} cannot be saved — {reserved[name]}."
-        refusal = _inside_a_reserved_file(name, reserved, action="saved")
+            return f"Error: {named} cannot be saved — {reserved[name]}."
+        refusal = _inside_a_reserved_file(name, reserved, action="saved", at=at, hidden=hidden)
         if refusal is not None:
             return refusal
         # `collect_outputs`' own key: NFC and case-folded, always, whatever the sink does
         # about rewriting.
         key = unicodedata.normalize("NFC", name).lower()
         if key in seen:
-            earlier = seen[key]
+            earlier, earlier_named = seen[key]
             return (
-                f"Error: {name!r} and {earlier!r} are one file once saved"
+                f"Error: {named} and {earlier_named} are one file once saved"
                 if earlier != name
-                else f"Error: {name!r} was declared twice."
+                else f"Error: {named} was declared twice."
             )
-        seen[key] = name
+        seen[key] = (name, named)
     return list(names)
 
 
@@ -1388,6 +1424,7 @@ async def _collect(
     reserved: Mapping[str, str],
     *,
     withhold: bool = False,
+    candidates: frozenset[str] | None = None,
 ) -> str:
     """Land whatever this run produced, and say what happened — never raising into the model."""
     sink = session.output_sink
@@ -1419,6 +1456,8 @@ async def _collect(
             reserved=reserved,
             guest_prefix=guest_prefix,
             normalization=_normalization(session),
+            named_by=_MANIFEST_FILENAME,
+            candidates=candidates,
         )
         if isinstance(checked, str):
             return checked
@@ -1447,7 +1486,14 @@ async def _collect(
     except Exception as exc:  # noqa: BLE001
         logger.warning("execute_code: saving this run's files failed: %s", error_detail(exc))
         return f"Error: the program ran but its files could not be saved. {_MAY_HAVE_LANDED}"
-    return _format_landed(landed, declared, withhold=withhold)
+    return _format_landed(
+        landed,
+        declared,
+        withhold=withhold,
+        named_by=_MANIFEST_FILENAME if outputs is CodeactOutputs.MANIFEST else _OUTPUTS_ARGUMENT,
+        argument=None if outputs is CodeactOutputs.MANIFEST else _OUTPUTS_ARGUMENT,
+        candidates=candidates,
+    )
 
 
 async def _read_manifest(
@@ -1531,7 +1577,13 @@ async def _read_manifest(
 
 
 def _format_landed(
-    landed: Sequence[LandedArtifact], declared: Sequence[str], *, withhold: bool = False
+    landed: Sequence[LandedArtifact],
+    declared: Sequence[str],
+    *,
+    withhold: bool = False,
+    named_by: str = _OUTPUTS_ARGUMENT,
+    argument: str | None = None,
+    candidates: frozenset[str] | None = None,
 ) -> str:
     """What the model is told about the files: what landed, and what is absent.
 
@@ -1541,24 +1593,59 @@ def _format_landed(
     Normalizing **both** sides is right whichever normalization the sink chose — under
     ``NameNormalization.NONE`` the two are already the same string.
 
+    ``argument`` names the parameter ``declared`` came from, where it came from one — the
+    ``outputs`` argument, never the manifest, which no caller spelled.  It is what makes the
+    provenance answer exact here rather than inferred, and it matters as much after the run as
+    before it: without it a declared name equal to hidden content renders as a position, and a
+    caller watching which way its own spelling comes back learns that the guess was right.
+
     ``withhold`` drops ``display`` in favour of the name the model itself declared. The sink
     composes ``display`` from an :class:`~maf_sandbox.Artifact` whose ``content`` is the guest's
     bytes, and nothing in the protocol requires the two to be independent — so a sink that puts
-    any of that content in the string would be putting guest-authored text into a result this
-    kind has declared :data:`~maf_sandbox.SourceIntegrity.TRUSTED`. Naming the declared spelling
-    costs the sink's own detail and needs no promise from the host to stay honest.
+    any of that content in the string would be putting guest-authored text back into a result
+    rendered to hold none. Naming the declared spelling costs the sink's own detail and needs no
+    promise from the host to stay honest.
     """
     delivered = {unicodedata.normalize("NFC", item.name) for item in landed}
     lines: list[str] = []
+    # Answered once, above the two renderings that need it: a name that landed is reported as
+    # surely as one that did not, and a name the framework substituted must not be repeated
+    # either way. `withhold` makes no difference to that — it is the mode that renders least.
+    rewritten = positions_holding_hidden_content(
+        list(declared), argument=argument, candidates=candidates
+    )
+    position_of = {
+        unicodedata.normalize("NFC", name): position for position, name in enumerate(declared)
+    }
+
     if landed:
         lines.append("Saved:")
         if withhold:
-            lines.extend(
-                f"- {name}" for name in declared if unicodedata.normalize("NFC", name) in delivered
-            )
+            for position, name in enumerate(declared):
+                if unicodedata.normalize("NFC", name) in delivered:
+                    # The name itself unless the framework put it there: this is a list of
+                    # files, not a refusal, so a name of the model's own is what it wants back.
+                    lines.append(
+                        f"- {named_by}[{position}]" if position in rewritten else f"- {name}"
+                    )
         else:
-            lines.extend(f"- {item.display}" for item in landed)
-    missing = [name for name in declared if unicodedata.normalize("NFC", name) not in delivered]
+            for item in landed:
+                # The display carries the name inside it, so a substituted one is reported by
+                # position instead. A name of the model's own keeps the size and the rest of it.
+                position = position_of.get(unicodedata.normalize("NFC", item.name))
+                lines.append(
+                    f"- {named_by}[{position}]"
+                    if position is not None and position in rewritten
+                    else f"- {item.display}"
+                )
+    # A name that produced no file is reported the way a refusal reports one: the caller's
+    # spelling where it is the caller's, and the position where the framework put something
+    # else there. It is the one line here that names a file which does not exist.
+    missing = [
+        echoed_name(name, at=f"{named_by}[{position}]", hidden=position in rewritten)
+        for position, name in enumerate(declared)
+        if unicodedata.normalize("NFC", name) not in delivered
+    ]
     if missing:
         lines.append(
             f"Not written by the program, so not saved: {', '.join(sorted(missing))}. Write "