0.51.0 — a tool call now waits for you

The agent used to lose a tool in the middle of a run and not tell you. This release turns that into a question.

A tool call now waits for you

When a run reads something external — an issue, a docs page, release notes — the taint layer narrows what it may do next, because a page it just read could be telling it what to do. That narrowing was correct and its delivery was not: the setting named ask returned no approver at all, so the tool simply vanished mid-run and the screen said 3 write(s) refused after the fact, with no reason and nothing to do about it.

Measured on one installed copy: 229 silent refusals across 24 of 137 real runs, and those runs ended in a tool loop six times as often as the rest — an agent that lost a capability and kept trying.

Now it becomes a question, on the screen, carrying the ledger's own sentence about why. Answer it with a button in the Code tab, from the Security tab, or with chimera approve in a terminal. Silence still refuses — after five minutes by default, and nothing about that was loosened.

The numbers, per arm, on the red-team corpus: with nobody to ask, attacks blocked go from 85.7% to 100% and honest work is still refused. With the person approving the work they asked for, over-block goes to 0% and the attack rate does not move. Five of eight legitimate tasks become a question — that is where the refusal went, and it is printed beside it rather than averaged into it.

Exfiltration through an allowed tool is closed

http_get is a fetch tool, so the layer that narrows sinks never looked at it — and a GET carries data out in its query string as easily as a POST carries it in a body. That was the one attack getting through every configuration, named honestly in the scoreboard rather than hidden. A tainted run's fetch with a query string is now a review.

It is a heuristic and is measured as one: it cannot tell ?data=SECRET from ?v=2.4, so two legitimate query-string fetches were added to the corpus first, so the rule's cost is a number instead of an assumption.

The Security screen shows what the defence costs

Beside what it blocks. Honest work refused with nobody to ask, the same work with a person approving, how many become a question, how many are waiting right now. A scoreboard that only reports the flattering half is how a defence stops being questioned.

Also

• edit_batch is a write tool. It writes several files in one call and was in neither governance set, so a read-only posture permitted it and a tainted run never narrowed it. It ships off, which is why this was a hole and not an incident.
• A prerelease is no longer promoted to latest. GitHub refuses it — correctly — and the step tried anyway, turning v0.51.0rc1, where all four platforms built, into a red run. A red release run that means nothing is how a red release run that means something gets ignored.
• Two bench directories got their first results document. bench/injection and bench/memory_poison had pre-registrations and failing console dumps and no write-up. Both have one now — including the memory gate that fails its own threshold, published with no code change, because its ruler is a regex and every fix would be tuning to the test.

Honest caveats

• The installers are unsigned. First run shows a SmartScreen or Gatekeeper warning. The updater is signed, which is what matters after install.
• Governance still ships off. This changes what happens when the taint layer narrows a tool — which is armed by default — and does not turn the trust kernel on.
• Cancellation is cooperative. Stopping a run stops it before its next model call; calls in flight finish and are billed.
• The approval wait was verified on a development server, not in the packaged app. A parked call was refused from the button in 132 seconds rather than timing out, and thirteen tests cover the mechanism — but v0.51.0rc1 was published about half an hour before this release was cut, and nobody used it. If five minutes is the wrong wait, this is where you find out.

Arm-by-arm measurement, the gates it had to clear, and what it cannot show: bench/injection/RESULTS.md.