@sema-agent/cli 1.0.111 → 1.0.112

package/npm-shrinkwrap.json

@@ -1,16 +1,16 @@
 {
   "name": "@sema-agent/cli",
-  "version": "1.0.111",
+  "version": "1.0.112",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@sema-agent/cli",
-      "version": "1.0.111",
+      "version": "1.0.112",
       "license": "BUSL-1.1",
       "dependencies": {
         "@sema-agent/sdk": "9.3.0",
-        "@sema-agent/server": "7.75.3"
+        "@sema-agent/server": "7.75.4"
       },
       "bin": {
         "sema": "sema.js"
@@ -620,9 +620,9 @@
       }
     },
     "node_modules/@sema-agent/core": {
-      "version": "7.17.5",
-      "resolved": "https://registry.npmjs.org/@sema-agent/core/-/core-7.17.5.tgz",
-      "integrity": "sha512-SnvyYC4UrU9gDz1zhDxWNkgENfVQxpQygK+UE6kS8fY3Af4RMNMBUeaHjmIpIhz+uiU2OvJosHnIJpoBi1MI2Q==",
+      "version": "7.17.6",
+      "resolved": "https://registry.npmjs.org/@sema-agent/core/-/core-7.17.6.tgz",
+      "integrity": "sha512-ubDEJyOLiB8SkaS+nwVIw/Fh8xP56mpgk0rKcIJyNtWBJNQugW6yw9fHd8a9ZTT+lGJQjD+dGH+ITogXshvIqQ==",
       "license": "BUSL-1.1",
       "dependencies": {
         "@modelcontextprotocol/sdk": "1.30.0",
@@ -645,12 +645,12 @@
       }
     },
     "node_modules/@sema-agent/server": {
-      "version": "7.75.3",
-      "resolved": "https://registry.npmjs.org/@sema-agent/server/-/server-7.75.3.tgz",
-      "integrity": "sha512-desXY8ZY/JrwiumG3rrgovqwJZUIPllNpFojLgbHpz4o44HqPXUWUSxIwhqF+G3PEs+y74vGSgzCibpH11XAyw==",
+      "version": "7.75.4",
+      "resolved": "https://registry.npmjs.org/@sema-agent/server/-/server-7.75.4.tgz",
+      "integrity": "sha512-WLh3T2s1RF4EYr+bKOa8UiVRdJHpQwaRkVDC+UgztpnRvx21Bu8lt21H8/N2K/Ub4SXetprhvtitshTUtMjFJA==",
       "license": "BUSL-1.1",
       "dependencies": {
-        "@sema-agent/core": "7.17.5",
+        "@sema-agent/core": "7.17.6",
         "@sema-agent/settings-schema": "1.10.0",
         "e2b": "^2.28.0",
         "libsodium-wrappers": "^0.8.4",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/cli",
-  "version": "1.0.111",
+  "version": "1.0.112",
   "description": "Sema — your own Claude Code-grade coding agent, in the terminal.",
   "license": "BUSL-1.1",
   "bin": {
@@ -24,13 +24,13 @@
   ],
   "dependencies": {
     "@sema-agent/sdk": "9.3.0",
-    "@sema-agent/server": "7.75.3"
+    "@sema-agent/server": "7.75.4"
   },
   "overrides": {
-    "@sema-agent/core": "7.17.5",
+    "@sema-agent/core": "7.17.6",
     "@sema-agent/settings-schema": "1.10.0"
   },
-  "semaEngineVersion": "server 7.75.3 / core 7.17.5 / settings-schema 1.10.0",
+  "semaEngineVersion": "server 7.75.4 / core 7.17.6 / settings-schema 1.10.0",
   "engines": {
     "node": ">=20.3"
   }

package/sema-main.js

@@ -288762,7 +288762,7 @@ function FileEditToolUseRejectedMessage(t0) {
 }
 var import_compiler_runtime43, import_jsx_runtime53, MAX_LINES_TO_RENDER, init_FileEditToolUseRejectedMessage = __esm({
   "build-src/src/components/FileEditToolUseRejectedMessage.tsx"() {
-    import_compiler_runtime43 = __toESM(require_compiler_runtime());
+    import_compiler_runtime43 = __toESM(require_compiler_runtime(), 1);
     init_useTerminalSize();
     init_cwd();
     init_ink2();
@@ -288770,7 +288770,7 @@ var import_compiler_runtime43, import_jsx_runtime53, MAX_LINES_TO_RENDER, init_F
     init_MessageResponse();
     init_StructuredDiffList();
     init_stringUtils();
-    import_jsx_runtime53 = __toESM(require_jsx_runtime()), MAX_LINES_TO_RENDER = 10;
+    import_jsx_runtime53 = __toESM(require_jsx_runtime(), 1), MAX_LINES_TO_RENDER = 10;
   }
 });
 
@@ -432049,24 +432049,21 @@ var sema_brand_default, init_sema_brand = __esm({
         _doc: "displayName/email \u7559 null = \u8FD0\u884C\u65F6\u56DE\u9000(\u540D\u5B57\u53D6\u672C\u673A OS \u7528\u6237\u540D,\u90AE\u7BB1\u4E0D\u663E\u793A)\u3002\u522B\u70E7\u4E2A\u4EBA\u4FE1\u606F\u8FDB\u54C1\u724C\u6587\u4EF6(F-S1-1:\u65B0\u7528\u6237\u66FE\u770B\u5230 Welcome back Clay!)\u3002"
       },
       whatsNew: {
-        version: "1.0.111",
+        version: "1.0.112",
         notes: [
-          "The bundled engine moves from 7.74.0 to 7.75.3 (core 7.17.5) and the client SDK to 9.3.0. The shared client runtime stays at 0.68.0.",
-          "`sema doctor` and the end of onboarding now state the shell read boundary posture in one line, relayed from the engine's contract: the Bash read boundary is a friction floor at the text level, and the security boundary is the execution lane's sandbox. The shell relays the engine's wording and does not add a judgement of its own.",
-          "Security: engine 7.75.3 fixes a redaction gap in 7.74.0 (bundled with 1.0.110) where a credential-shaped token directly adjacent to other letters or digits could be replayed unredacted through the run events API. Upgrading is recommended.",
-          "Engine notices the shell does not recognise are no longer dropped: they now show as one line with the engine's code and message, in the REPL and on stderr for -p. In -p stream-json output such frames carry `_sema_notice_unlisted_code: true` so automation can tell a relayed message from a shell-rendered one.",
-          "When a -p run ends with a failure code this build does not recognise, stderr gets one line `run ended: <code> \u2014 <message>`; stdout is unchanged.",
-          "A queued message that a deployment prompt hook blocks now gets one line in the transcript saying it was not accepted; the message stays queued and is resubmitted as-is when the turn ends, so press Up to edit it first.",
-          "New `/memory-capture off` asks the engine to stop capturing this session into long-term memory from your next message on (one-way on the engine side; the engine announces when it takes). `/memory-capture on` withdraws the shell-side request; start a new session with /clear to capture again.",
-          "With `SEMA_SEND_SETTINGS=full`, a 400 that rejects the settings you sent now explains which keys were unknown versus unsupported, lists any protective keys that did not apply, and points back to the default `rules` mode instead of deleting keys from settings.json. The default mode sends the same rule subset as before.",
-          "Engine 7.17.3\u20137.17.5: in the default headless configuration, shell commands that read outside the workspace, name sensitive files, or expand variables now ask once (mandated) instead of running unasked; deployments without an approver see those requests denied when they expire. The shell does not relax this.",
-          "Approval cards no longer print `irreversibility: not annotated` when the engine does not carry that axis on the card; the segment is simply omitted, and it is never folded into `reversible`.",
-          "`sema --model <id>` (and `--model=<id>`) now sets the session model for the interactive REPL, the same way it already did for `-p`; before, the value was silently ignored and the session started on the default model. `/model current` and the header show the requested model.",
-          "Every value-taking root option (for example `--debug-file <path>`, `--sdk-url <url>`, `--teammate-mode <mode>`) is now recognised when starting the interactive REPL, so its value is no longer sent as the first prompt."
+          "The bundled engine moves from 7.75.3 to 7.75.4 (core 7.17.5 to 7.17.6). The shell itself is unchanged in this release; the client SDK stays at 9.3.0 and the shared client runtime at 0.68.0.",
+          "Read these next three together with one precondition: the execute-time recheck they describe runs only where the deployment has pinned the read roots (`READ_FACE=roots`, or `engineReadFace` in your settings). With no configuration at all the engine reports an open read face and the recheck does not run, so these three change nothing for a default single-machine setup. `sema doctor` states the engine's read-boundary posture in the engine's own words.",
+          "Security, where read roots are pinned: a shell read that only leaves the roots once the filesystem resolves it is now refused before the command runs. Previously the check was skipped on the lane sema itself uses to run the engine, so reading through a link pointing outside the roots succeeded with no prompt. It now comes back as a failed tool call naming the resolved path and the directories that are allowed. Upgrading is recommended.",
+          "The same refusal now also covers what a glob expands to: `cat vendor/*` is refused when a match resolves outside the roots, as is a pattern the engine cannot enumerate (an unreadable directory, or one matching more than 256 directories). As the engine reports plainly, this also refuses `ls -d .*` and `cat .*`, because `.*` includes the parent of the root.",
+          "A `..` written after a link is now judged where the kernel actually lands: `cat link/../file` is refused when the link's target sits outside the roots, even though the path reads as if it stayed inside. A `..` that stays inside is unchanged.",
+          "These three are refusals, not questions: they happen after the approval step, so a deployment with no approver sees them refused rather than asked. The refusal message states the fix: declare the link's target as a read root. A deployment that declares its execution environment as isolated skips the check entirely.",
+          "Separately, and with no read-face precondition: `sed` is now judged by what its script does, not only by its flags. A script that names a file or runs a command (`r`, `R`, `w`, `W`, `e`, `s///w FILE`, `s///e`) or a script read from a file (`-f FILE`, `--file=`) asks once before the command would run, the request cannot be cleared by an allow rule, and the command does not execute. Plain `sed -i`, `s///` and `sed -n '1,10p'` are unchanged. `env -- <program>` and `coproc <command>` are handled the same way. Widening the read roots does not clear this one.",
+          "For deployments that keep the engine's control directory and its memory directory on two different mounts: a delegated memory hold is no longer quarantined as polluted when the two cannot be renamed across. Single-mount setups are unchanged, and notes already sitting in quarantine are not brought back automatically.",
+          "Known limitation, stated plainly: the shell read boundary is a friction floor at the text level, not containment. It does not model a file read written inside an inline interpreter script (`perl -e`, `ruby -e`, a script piped to `tclsh`), and `time -p` in front of a command can defeat the check for programs invoked through `xargs`. If a task is not trusted, run it in a sandboxed execution environment rather than relying on this floor."
         ]
       },
-      productVersion: "1.0.111",
-      announcement: "sema 1.0.111 \u2014 engine pickup + shell fixes: bundled engine 7.75.3 (core 7.17.5), client SDK 9.3.0, client runtime 0.68.0. Security: engine 7.75.3 closes a redaction gap in 7.74.0 \u2014 upgrading is recommended. `sema --model <id>` now sets the interactive session model; every value-taking root option is recognised at startup. Engine notices the shell does not know are shown instead of dropped; `/doctor` states the shell read boundary posture in the engine's own words.",
+      productVersion: "1.0.112",
+      announcement: "sema 1.0.112 \u2014 engine pickup only: bundled engine 7.75.4 (core 7.17.6); the shell, client SDK 9.3.0 and client runtime 0.68.0 are unchanged. Security, for deployments that pin read roots: shell reads that only escape the roots once resolved (a link target, a glob match, a `..` after a link) are now refused before the command runs, on every lane including the default host lane. `sed` scripts that name a file or run a command are judged as scripts. Known limitation: inline interpreter scripts (perl -e, ruby -e) are not modelled yet.",
       version: "1.0.91"
     };
   }
@@ -436399,24 +436396,21 @@ var require_sema_brand = __commonJS({
         _doc: "displayName/email \u7559 null = \u8FD0\u884C\u65F6\u56DE\u9000(\u540D\u5B57\u53D6\u672C\u673A OS \u7528\u6237\u540D,\u90AE\u7BB1\u4E0D\u663E\u793A)\u3002\u522B\u70E7\u4E2A\u4EBA\u4FE1\u606F\u8FDB\u54C1\u724C\u6587\u4EF6(F-S1-1:\u65B0\u7528\u6237\u66FE\u770B\u5230 Welcome back Clay!)\u3002"
       },
       whatsNew: {
-        version: "1.0.111",
+        version: "1.0.112",
         notes: [
-          "The bundled engine moves from 7.74.0 to 7.75.3 (core 7.17.5) and the client SDK to 9.3.0. The shared client runtime stays at 0.68.0.",
-          "`sema doctor` and the end of onboarding now state the shell read boundary posture in one line, relayed from the engine's contract: the Bash read boundary is a friction floor at the text level, and the security boundary is the execution lane's sandbox. The shell relays the engine's wording and does not add a judgement of its own.",
-          "Security: engine 7.75.3 fixes a redaction gap in 7.74.0 (bundled with 1.0.110) where a credential-shaped token directly adjacent to other letters or digits could be replayed unredacted through the run events API. Upgrading is recommended.",
-          "Engine notices the shell does not recognise are no longer dropped: they now show as one line with the engine's code and message, in the REPL and on stderr for -p. In -p stream-json output such frames carry `_sema_notice_unlisted_code: true` so automation can tell a relayed message from a shell-rendered one.",
-          "When a -p run ends with a failure code this build does not recognise, stderr gets one line `run ended: <code> \u2014 <message>`; stdout is unchanged.",
-          "A queued message that a deployment prompt hook blocks now gets one line in the transcript saying it was not accepted; the message stays queued and is resubmitted as-is when the turn ends, so press Up to edit it first.",
-          "New `/memory-capture off` asks the engine to stop capturing this session into long-term memory from your next message on (one-way on the engine side; the engine announces when it takes). `/memory-capture on` withdraws the shell-side request; start a new session with /clear to capture again.",
-          "With `SEMA_SEND_SETTINGS=full`, a 400 that rejects the settings you sent now explains which keys were unknown versus unsupported, lists any protective keys that did not apply, and points back to the default `rules` mode instead of deleting keys from settings.json. The default mode sends the same rule subset as before.",
-          "Engine 7.17.3\u20137.17.5: in the default headless configuration, shell commands that read outside the workspace, name sensitive files, or expand variables now ask once (mandated) instead of running unasked; deployments without an approver see those requests denied when they expire. The shell does not relax this.",
-          "Approval cards no longer print `irreversibility: not annotated` when the engine does not carry that axis on the card; the segment is simply omitted, and it is never folded into `reversible`.",
-          "`sema --model <id>` (and `--model=<id>`) now sets the session model for the interactive REPL, the same way it already did for `-p`; before, the value was silently ignored and the session started on the default model. `/model current` and the header show the requested model.",
-          "Every value-taking root option (for example `--debug-file <path>`, `--sdk-url <url>`, `--teammate-mode <mode>`) is now recognised when starting the interactive REPL, so its value is no longer sent as the first prompt."
+          "The bundled engine moves from 7.75.3 to 7.75.4 (core 7.17.5 to 7.17.6). The shell itself is unchanged in this release; the client SDK stays at 9.3.0 and the shared client runtime at 0.68.0.",
+          "Read these next three together with one precondition: the execute-time recheck they describe runs only where the deployment has pinned the read roots (`READ_FACE=roots`, or `engineReadFace` in your settings). With no configuration at all the engine reports an open read face and the recheck does not run, so these three change nothing for a default single-machine setup. `sema doctor` states the engine's read-boundary posture in the engine's own words.",
+          "Security, where read roots are pinned: a shell read that only leaves the roots once the filesystem resolves it is now refused before the command runs. Previously the check was skipped on the lane sema itself uses to run the engine, so reading through a link pointing outside the roots succeeded with no prompt. It now comes back as a failed tool call naming the resolved path and the directories that are allowed. Upgrading is recommended.",
+          "The same refusal now also covers what a glob expands to: `cat vendor/*` is refused when a match resolves outside the roots, as is a pattern the engine cannot enumerate (an unreadable directory, or one matching more than 256 directories). As the engine reports plainly, this also refuses `ls -d .*` and `cat .*`, because `.*` includes the parent of the root.",
+          "A `..` written after a link is now judged where the kernel actually lands: `cat link/../file` is refused when the link's target sits outside the roots, even though the path reads as if it stayed inside. A `..` that stays inside is unchanged.",
+          "These three are refusals, not questions: they happen after the approval step, so a deployment with no approver sees them refused rather than asked. The refusal message states the fix: declare the link's target as a read root. A deployment that declares its execution environment as isolated skips the check entirely.",
+          "Separately, and with no read-face precondition: `sed` is now judged by what its script does, not only by its flags. A script that names a file or runs a command (`r`, `R`, `w`, `W`, `e`, `s///w FILE`, `s///e`) or a script read from a file (`-f FILE`, `--file=`) asks once before the command would run, the request cannot be cleared by an allow rule, and the command does not execute. Plain `sed -i`, `s///` and `sed -n '1,10p'` are unchanged. `env -- <program>` and `coproc <command>` are handled the same way. Widening the read roots does not clear this one.",
+          "For deployments that keep the engine's control directory and its memory directory on two different mounts: a delegated memory hold is no longer quarantined as polluted when the two cannot be renamed across. Single-mount setups are unchanged, and notes already sitting in quarantine are not brought back automatically.",
+          "Known limitation, stated plainly: the shell read boundary is a friction floor at the text level, not containment. It does not model a file read written inside an inline interpreter script (`perl -e`, `ruby -e`, a script piped to `tclsh`), and `time -p` in front of a command can defeat the check for programs invoked through `xargs`. If a task is not trusted, run it in a sandboxed execution environment rather than relying on this floor."
         ]
       },
-      productVersion: "1.0.111",
-      announcement: "sema 1.0.111 \u2014 engine pickup + shell fixes: bundled engine 7.75.3 (core 7.17.5), client SDK 9.3.0, client runtime 0.68.0. Security: engine 7.75.3 closes a redaction gap in 7.74.0 \u2014 upgrading is recommended. `sema --model <id>` now sets the interactive session model; every value-taking root option is recognised at startup. Engine notices the shell does not know are shown instead of dropped; `/doctor` states the shell read boundary posture in the engine's own words.",
+      productVersion: "1.0.112",
+      announcement: "sema 1.0.112 \u2014 engine pickup only: bundled engine 7.75.4 (core 7.17.6); the shell, client SDK 9.3.0 and client runtime 0.68.0 are unchanged. Security, for deployments that pin read roots: shell reads that only escape the roots once resolved (a link target, a glob match, a `..` after a link) are now refused before the command runs, on every lane including the default host lane. `sed` scripts that name a file or run a command are judged as scripts. Known limitation: inline interpreter scripts (perl -e, ruby -e) are not modelled yet.",
       version: "1.0.91"
     };
   }
@@ -554134,7 +554128,7 @@ Usage: sema --remote "your task description"`, () => gracefulShutdown(1));
         pendingHookMessages
       }, renderAndRun);
     }
-  }).version("sema 1.0.111", "-v, --version", "Output the version number"), program2.option("-w, --worktree [name]", "Create a new git worktree for this session (optionally specify a name)"), program2.option("--tmux", "Create a tmux session for the worktree (requires --worktree). Uses iTerm2 native panes when available; use --tmux=classic for traditional tmux."), canUserConfigureAdvisor() && program2.addOption(new Option("--advisor <model>", "Enable the server-side advisor tool with the specified model (alias or full ID).").hideHelp()), program2.addOption(new Option("--bg, --background", "Start the session as a background agent and return immediately (manage with `sema agents`)")), program2.command("ps").description("List background sessions").action(async () => {
+  }).version("sema 1.0.112", "-v, --version", "Output the version number"), program2.option("-w, --worktree [name]", "Create a new git worktree for this session (optionally specify a name)"), program2.option("--tmux", "Create a tmux session for the worktree (requires --worktree). Uses iTerm2 native panes when available; use --tmux=classic for traditional tmux."), canUserConfigureAdvisor() && program2.addOption(new Option("--advisor <model>", "Enable the server-side advisor tool with the specified model (alias or full ID).").hideHelp()), program2.addOption(new Option("--bg, --background", "Start the session as a background agent and return immediately (manage with `sema agents`)")), program2.command("ps").description("List background sessions").action(async () => {
     await (await Promise.resolve().then(() => (init_bg2(), bg_exports))).psHandler([]), process.exit(process.exitCode ?? 0);
   }), program2.command("logs [id]").description("Print a background session's recent terminal output").action(async (id) => {
     await (await Promise.resolve().then(() => (init_bg2(), bg_exports))).logsHandler(id, []), process.exit(process.exitCode ?? 0);

package/sema.js

@@ -80,7 +80,7 @@ function installBootSignalTailFrame(argv2 = process.argv.slice(2)) {
 installBootSignalTailFrame();
 
 // build-src/src/sema/preludeEntry.ts
-var versionLine = "sema 1.0.111" ? "sema 1.0.111" : "";
+var versionLine = "sema 1.0.112" ? "sema 1.0.112" : "";
 var argv = process.argv.slice(2);
 var wantsVersionFastPath = argv.length === 1 && (argv[0] === "--version" || argv[0] === "-v");
 var EARLY_INPUT_PRELUDE_SLOT = /* @__PURE__ */ Symbol.for("sema.earlyInputPrelude");