@sema-agent/client-core 0.100.0 → 0.101.0

package/dist/generated/settingsSchemaMcpRequestEntry.js

@@ -1,4 +1,4 @@
-export const SETTINGS_MCP_REQUEST_ENTRY_CLOSURE = (MCP_CONTENT_ORIGINS, startsWithHttpScheme) => {
+export const SETTINGS_MCP_REQUEST_ENTRY_CLOSURE = (MCP_CONTENT_ORIGINS, startsWithHttpScheme, echoCallerText) => {
     function describeValueShape(v) {
         if (v === undefined)
             return "nothing (the key is absent)";
@@ -18,12 +18,6 @@ export const SETTINGS_MCP_REQUEST_ENTRY_CLOSURE = (MCP_CONTENT_ORIGINS, startsWi
     function isStringArray(v) {
         return Array.isArray(v) && v.every((a) => typeof a === "string");
     }
-    const CONTROL_AND_BIDI_STRIP_RE = /[\u0000-\u001f\u007f\u061c\u200e\u200f\u202a-\u202e\u2066-\u2069]/g;
-    const CALLER_TEXT_ECHO_MAX_CHARS = 64;
-    function echoCallerText(text) {
-        const clean = text.replace(CONTROL_AND_BIDI_STRIP_RE, "");
-        return clean.length > CALLER_TEXT_ECHO_MAX_CHARS ? `${clean.slice(0, CALLER_TEXT_ECHO_MAX_CHARS)}…` : clean;
-    }
     function quotedCallerText(text) {
         return `"${echoCallerText(text)}"`;
     }

package/dist/generated/settingsSchemaSafetyMergeSpec.d.ts

@@ -0,0 +1 @@
+export declare const SETTINGS_SAFETY_MERGE_CLOSURE: (MIN_TRUST_WORDS: readonly ["local", "session", "project", "global", "managed", "task"]) => any;

package/dist/generated/settingsSchemaSafetyMergeSpec.js

@@ -0,0 +1,95 @@
+export const SETTINGS_SAFETY_MERGE_CLOSURE = (MIN_TRUST_WORDS) => {
+    function trustRank(layer) {
+        switch (layer) {
+            case "managed": return 6;
+            case "global": return 5;
+            case "project": return 4;
+            case "local": return 3;
+            case "session": return 2;
+            case "task": return 1;
+            default: {
+                const unknown = layer;
+                throw new RangeError(`MinTrust: unknown trust word '${String(unknown)}' (words: ${MIN_TRUST_WORDS.join(", ")})`);
+            }
+        }
+    }
+    function isAtLeast(layer, minTrust) {
+        return trustRank(layer) >= trustRank(minTrust);
+    }
+    const SAFETY_MERGE_SPEC = {
+        permissions: {
+            mergeShape: "denyFirst", minTrust: "global", tighten: { rule: "policyDenyWins" }, enforcement: "gate", fail: "closed",
+            seam: "toolPolicy + deny-narrowing (SessionPolicyStore)", coreAxis: "permissionDecision",
+            members: {
+                allow: { direction: "loosen", minTrust: "global" },
+                deny: { direction: "tighten", minTrust: "local" },
+                ask: { direction: "tighten", minTrust: "local" },
+            },
+        },
+        permissionMode: { mergeShape: "replace", minTrust: "global", tighten: { rule: "enumRank", order: ["bypassPermissions", "auto", "acceptEdits", "default", "dontAsk", "plan"] }, enforcement: "gate", fail: "closed", seam: "derive → toolPolicy / onAsk / handsReadOnly (§6.4); bypass = launch-flag only; the kill-switches are the killSwitches row" },
+        handsReadOnly: { mergeShape: "replace", minTrust: "global", tighten: { rule: "boolStricter", strict: true }, enforcement: "gate", fail: "closed", seam: "handsReadOnly" },
+        shellGate: { mergeShape: "replace", minTrust: "global", tighten: { rule: "enumRank", order: ["always"] }, enforcement: "gate", fail: "closed", seam: "shellGate", coreAxis: "shellGate" },
+        approver: { mergeShape: "replace", minTrust: "global", tighten: { rule: "none" }, enforcement: "gate", fail: "closed", seam: "onAsk (conflict → reject)" },
+        sandboxNetwork: {
+            mergeShape: "denyFirst", minTrust: "global", tighten: { rule: "setNarrower" }, enforcement: "gate", fail: "closed",
+            seam: "ExecutionEnv (fs+net) + sensitive-path", coreAxis: "egress",
+            members: {
+                enabled: { direction: "tighten", minTrust: "global", boolPole: { strict: true, minTrust: "local" } },
+                allowUnsandboxedCommands: { direction: "tighten", minTrust: "global", boolPole: { strict: false, minTrust: "local" } },
+                autoAllowBashIfSandboxed: { direction: "tighten", minTrust: "global", boolPole: { strict: false, minTrust: "local" } },
+                enableWeakerNestedSandbox: { direction: "tighten", minTrust: "global", boolPole: { strict: false, minTrust: "local" } },
+                enableWeakerNetworkIsolation: { direction: "tighten", minTrust: "global", boolPole: { strict: false, minTrust: "local" } },
+                "network.allowManagedDomainsOnly": { direction: "tighten", minTrust: "global", boolPole: { strict: true, minTrust: "local" } },
+                "network.allowAllUnixSockets": { direction: "tighten", minTrust: "global", boolPole: { strict: false, minTrust: "local" } },
+                "network.allowLocalBinding": { direction: "tighten", minTrust: "global", boolPole: { strict: false, minTrust: "local" } },
+                "filesystem.allowManagedReadPathsOnly": { direction: "tighten", minTrust: "global", boolPole: { strict: true, minTrust: "local" } },
+                "filesystem.denyWrite": { direction: "tighten", minTrust: "local" },
+                "filesystem.denyRead": { direction: "tighten", minTrust: "local" },
+            },
+        },
+        hooks: { mergeShape: "runAll", minTrust: "project", tighten: { rule: "none" }, enforcement: "gate", fail: "closed", seam: "hooks (single source or adapter-composed)" },
+        mcpServers: { mergeShape: "overrideByName", minTrust: "project", tighten: { rule: "none" }, enforcement: "resolver", fail: "open", seam: "spec.mcp + allowTools" },
+        rulesInstructions: { mergeShape: "concat", minTrust: "project", tighten: { rule: "none" }, enforcement: "resolver", fail: "open", seam: "appendSystemPrompt / memory (GLOBAL→PROJECT→SESSION)" },
+        model: { mergeShape: "replace", minTrust: "session", tighten: { rule: "none" }, enforcement: "client", fail: "open", seam: "RoleSpec / TaskSpec.{model,thinking}" },
+        env: { mergeShape: "concat", minTrust: "project", tighten: { rule: "none" }, enforcement: "resolver", fail: "open", seam: "NodeExecutionEnv.shellEnv (later layer overrides same name)" },
+        envSecret: { mergeShape: "replace", minTrust: "global", tighten: { rule: "none" }, enforcement: "resolver", fail: "closed", seam: "§7 secret-ref resolution" },
+        memoryScopes: { mergeShape: "concat", minTrust: "global", tighten: { rule: "none" }, enforcement: "client", fail: "open", seam: "MemoryStore" },
+        autoCompaction: { mergeShape: "replace", minTrust: "session", tighten: { rule: "none" }, enforcement: "client", fail: "open", seam: "compaction config" },
+        ui: { mergeShape: "replace", minTrust: "local", tighten: { rule: "none" }, enforcement: "client", fail: "open", seam: "shell-only (theme/keybindings/statusLine) — never touches the engine" },
+        org: { mergeShape: "replace", minTrust: "managed", tighten: { rule: "none" }, enforcement: "server", fail: "closed", seam: "web-admin → governanceBaseline (SSO/SCIM/audit/budget, TOB-only)" },
+        httpHookAllowlists: { mergeShape: "denyFirst", minTrust: "global", tighten: { rule: "setNarrower" }, enforcement: "resolver", fail: "closed", seam: "http hook URL / header-env allowlists (httpHookUrlVerdict / httpHookEnvVarsAllowed)" },
+        killSwitches: {
+            mergeShape: "replace", minTrust: "global", tighten: { rule: "boolStricter", strict: true }, enforcement: "gate", fail: "closed",
+            seam: "permission-mode kill-switches (a switch ON removes bypassPermissions / auto from every layer's mode choice)",
+            members: {
+                disableBypassPermissionsMode: { direction: "tighten", minTrust: "global", boolPole: { strict: true, minTrust: "local" } },
+                disableAutoMode: { direction: "tighten", minTrust: "global", boolPole: { strict: true, minTrust: "local" } },
+            },
+        },
+    };
+    function categorySpec(category) {
+        if (!Object.hasOwn(SAFETY_MERGE_SPEC, category)) {
+            throw new RangeError(`SAFETY_MERGE_SPEC: unknown category '${category}' (categories: ${Object.keys(SAFETY_MERGE_SPEC).join(", ")})`);
+        }
+        return SAFETY_MERGE_SPEC[category];
+    }
+    function resolveMemberAdmission(spec, member, categoryLabel = "(unnamed category)", value) {
+        if (spec.members === undefined) {
+            throw new RangeError(`SAFETY_MERGE_SPEC: category '${categoryLabel}' has no member-level admission — its minTrust applies to the whole key`);
+        }
+        if (!Object.hasOwn(spec.members, member)) {
+            throw new RangeError(`SAFETY_MERGE_SPEC: unknown member '${member}' of category '${categoryLabel}' (members: ${Object.keys(spec.members).join(", ")})`);
+        }
+        const row = spec.members[member];
+        const rowFloor = row.minTrust ?? spec.minTrust;
+        if (row.boolPole !== undefined) {
+            const floor = value === row.boolPole.strict ? row.boolPole.minTrust : rowFloor;
+            return { direction: row.direction, minTrust: floor, boolPole: row.boolPole };
+        }
+        return { direction: row.direction, minTrust: rowFloor };
+    }
+    function memberAdmission(category, member, value) {
+        return resolveMemberAdmission(categorySpec(category), member, category, value);
+    }
+    return { isAtLeast, memberAdmission, SAFETY_MERGE_SPEC };
+};

package/dist/generated/settingsSchemaSettingsSources.d.ts

@@ -0,0 +1 @@
+export declare const SETTINGS_LAYER_SOURCES_CLOSURE: (SAFETY_MERGE_SPEC: object, isAtLeast: (layer: string, minTrust: string) => boolean, memberAdmission: (category: string, member: string) => object) => any;

package/dist/generated/settingsSchemaSettingsSources.js

@@ -0,0 +1,58 @@
+export const SETTINGS_LAYER_SOURCES_CLOSURE = (SAFETY_MERGE_SPEC, isAtLeast, memberAdmission) => {
+    const SETTINGS_SOURCES = ["userSettings", "projectSettings", "localSettings", "flagSettings", "policySettings", "foreignProjectSettings"];
+    const SETTINGS_SOURCE_CONTRACT = {
+        userSettings: { trust: "global", repoControllable: false },
+        projectSettings: { trust: "project", repoControllable: true },
+        localSettings: { trust: "project", repoControllable: true },
+        flagSettings: { trust: "global", repoControllable: false },
+        policySettings: { trust: "managed", repoControllable: false },
+        foreignProjectSettings: { trust: "project", repoControllable: true, tightenOnly: true },
+    };
+    function settingsSourceContract(source) {
+        if (!Object.hasOwn(SETTINGS_SOURCE_CONTRACT, source)) {
+            throw new RangeError(`SETTINGS_SOURCE_CONTRACT: unknown settings source '${String(source)}' (sources: ${SETTINGS_SOURCES.join(", ")})`);
+        }
+        return SETTINGS_SOURCE_CONTRACT[source];
+    }
+    const WORKSPACE_TRUST_STATES = ["accepted", "declined", "no_trust_step"];
+    function layerAdmission(source, workspace, category, member, value) {
+        const layer = settingsSourceContract(source);
+        const tightenOnlyLayer = readsTightenOnly(layer, workspace);
+        let floor;
+        let direction;
+        if (member === undefined) {
+            if (!Object.hasOwn(SAFETY_MERGE_SPEC, category)) {
+                throw new RangeError(`SAFETY_MERGE_SPEC: unknown category '${String(category)}' (categories: ${Object.keys(SAFETY_MERGE_SPEC).join(", ")})`);
+            }
+            floor = SAFETY_MERGE_SPEC[category].minTrust;
+        }
+        else {
+            const resolved = memberAdmission(category, member, value);
+            floor = resolved.minTrust;
+            direction = resolved.direction;
+        }
+        if (!isAtLeast(layer.trust, floor))
+            return "below_trust_floor";
+        if (direction === "tighten" || !tightenOnlyLayer)
+            return "admitted";
+        return layer.tightenOnly === true ? "tighten_only" : "trust_withheld";
+    }
+    function readsTightenOnly(layer, workspace) {
+        const accepted = workspaceAccepted(workspace);
+        return layer.tightenOnly === true || (layer.repoControllable && !accepted);
+    }
+    function workspaceAccepted(workspace) {
+        switch (workspace) {
+            case "accepted":
+                return true;
+            case "declined":
+            case "no_trust_step":
+                return false;
+            default: {
+                const unknown = workspace;
+                throw new RangeError(`WORKSPACE_TRUST_STATES: unknown workspace trust reading '${String(unknown)}' (readings: ${WORKSPACE_TRUST_STATES.join(", ")})`);
+            }
+        }
+    }
+    return { layerAdmission };
+};

package/dist/generated/settingsSchemaTables.d.ts

@@ -11,3 +11,5 @@ export declare const SETTINGS_MODEL_API_WORDS: readonly ["openai-completions", "
 export declare const SETTINGS_TOOL_NAME_MATCHER_EVENTS: readonly ["PreToolUse", "PostToolUse", "PostToolUseFailure"];
 export declare const SETTINGS_UI_LANGUAGE_VALUES: readonly ["en", "zh"];
 export declare const SETTINGS_MCP_CONTENT_ORIGINS: readonly ["local", "execution", "external"];
+export declare const SETTINGS_MIN_TRUST_WORDS: readonly ["local", "session", "project", "global", "managed", "task"];
+export declare const SETTINGS_WORKSPACE_TRUST_STATES: readonly ["accepted", "declined", "no_trust_step"];

package/dist/generated/settingsSchemaTables.js

@@ -50,3 +50,16 @@ export const SETTINGS_MCP_CONTENT_ORIGINS = Object.freeze([
     "execution",
     "external",
 ]);
+export const SETTINGS_MIN_TRUST_WORDS = Object.freeze([
+    "local",
+    "session",
+    "project",
+    "global",
+    "managed",
+    "task",
+]);
+export const SETTINGS_WORKSPACE_TRUST_STATES = Object.freeze([
+    "accepted",
+    "declined",
+    "no_trust_step",
+]);

package/dist/generated/settingsSchemaUrlPattern.d.ts

@@ -0,0 +1 @@
+export declare const SETTINGS_URL_ALLOW_PATTERN_MATCHES_CLOSURE: () => (url: string, pattern: string) => boolean;

package/dist/generated/settingsSchemaUrlPattern.js

@@ -0,0 +1,183 @@
+export const SETTINGS_URL_ALLOW_PATTERN_MATCHES_CLOSURE = () => {
+    const SPECIAL_SCHEMES = new Set(["http:", "https:", "ws:", "wss:", "ftp:", "file:"]);
+    const HOST_ROUTED_SCHEMES = new Set(["http:", "https:", "ws:", "wss:"]);
+    const OTHER_DEFAULT_PORT_SCHEME = { "http:": "https", "https:": "http", "ws:": "wss", "wss:": "ws", "ftp:": "http" };
+    const SOCKET_PATH_SCHEME = "ws+unix:";
+    function parseUrl(s) {
+        try {
+            return new URL(s);
+        }
+        catch {
+            return undefined;
+        }
+    }
+    function occurrences(haystack, needle) {
+        return haystack.split(needle).length - 1;
+    }
+    function parserReadings(s) {
+        const fold = (x) => x.replace(/\p{Default_Ignorable_Code_Point}/gu, "").normalize("NFKC").toLowerCase().normalize("NFKC");
+        const seen = asParserSees(s);
+        const decoded = seen.replace(/(?:%[0-9a-f]{2})+/gi, (run) => {
+            try {
+                return decodeURIComponent(run);
+            }
+            catch {
+                return run;
+            }
+        });
+        return [fold(seen), fold(decoded)];
+    }
+    function freeToken(stem, avoid, build) {
+        const taken = new Set();
+        const shape = new RegExp(`zz${stem}(\\d+)qq`, "g");
+        for (const reading of parserReadings(avoid))
+            for (const m of reading.matchAll(shape))
+                taken.add(m[1]);
+        for (let i = 0;; i++) {
+            if (taken.has(String(i)))
+                continue;
+            const token = `zz${stem}${i}qq`;
+            const { built, inserted } = build(token);
+            if (parserReadings(built).every((r) => occurrences(r, token) === inserted))
+                return { token, built };
+            taken.add(String(i));
+        }
+    }
+    function asParserSees(s) {
+        let start = 0;
+        let end = s.length;
+        while (start < end && s.charCodeAt(start) <= 0x20)
+            start++;
+        while (end > start && s.charCodeAt(end - 1) <= 0x20)
+            end--;
+        return s.slice(start, end).replace(/[\t\n\r]/g, "");
+    }
+    function defaultPortWritten(marked, pat) {
+        if (pat.port !== "")
+            return false;
+        const other = OTHER_DEFAULT_PORT_SCHEME[pat.protocol];
+        if (other === undefined)
+            return false;
+        const seen = asParserSees(marked);
+        const colon = seen.indexOf(":");
+        if (colon === -1)
+            return false;
+        const alt = parseUrl(other + seen.slice(colon));
+        return alt !== undefined && alt.port !== "";
+    }
+    function namesScheme(pattern, protocol) {
+        return asParserSees(pattern).toLowerCase().startsWith(protocol);
+    }
+    function socketPart(path) {
+        const i = path.indexOf(":");
+        return i === -1 ? path : path.slice(0, i);
+    }
+    function globMatches(pattern, value) {
+        const parts = pattern.split("*");
+        const head = parts[0] ?? "";
+        if (parts.length === 1)
+            return head === value;
+        const tail = parts[parts.length - 1] ?? "";
+        const end = value.length - tail.length;
+        if (end < head.length || !value.startsWith(head) || !value.endsWith(tail))
+            return false;
+        let at = head.length;
+        for (const mid of parts.slice(1, -1)) {
+            if (mid === "")
+                continue;
+            const found = value.indexOf(mid, at);
+            if (found === -1 || found + mid.length > end)
+                return false;
+            at = found + mid.length;
+        }
+        return true;
+    }
+    function nextSeparator(s, separators, from) {
+        let i = from;
+        while (i < s.length && !separators.includes(s.charAt(i)))
+            i++;
+        return i;
+    }
+    function segmentedGlobMatches(pattern, value, separators) {
+        let p = 0;
+        let v = 0;
+        for (;;) {
+            const pe = nextSeparator(pattern, separators, p);
+            const ve = nextSeparator(value, separators, v);
+            if (pattern.charAt(pe) !== value.charAt(ve) || !globMatches(pattern.slice(p, pe), value.slice(v, ve)))
+                return false;
+            if (pe === pattern.length)
+                return true;
+            p = pe + 1;
+            v = ve + 1;
+        }
+    }
+    function componentMatches(url, pattern, reading) {
+        if (pattern === "*")
+            return true;
+        const target = parseUrl(url);
+        if (target === undefined)
+            return false;
+        const strict = reading === "allow";
+        if (strict && !HOST_ROUTED_SCHEMES.has(target.protocol) && !namesScheme(pattern, target.protocol))
+            return false;
+        const socketTarget = strict && target.protocol === SOCKET_PATH_SCHEME;
+        if (socketTarget) {
+            const socket = socketPart(target.pathname + target.search);
+            if (socket === "" || socket.split("/").includes(".."))
+                return false;
+        }
+        const { token: WILDCARD, built: starred } = freeToken("wildcard", `${pattern}\n${url}`, (t) => ({ built: pattern.replaceAll("*", t), inserted: occurrences(pattern, "*") }));
+        const { token: SHIELD, built: marked } = freeToken("punycode", `${starred}\n${url}`, (t) => {
+            let inserted = 0;
+            const built = starred.replace(/[a-z0-9-]+/gi, (run) => {
+                if (!/^xn--/i.test(run) || !run.includes(WILDCARD))
+                    return run;
+                inserted++;
+                return t + run;
+            });
+            return { built, inserted };
+        });
+        const unshield = (s) => s.replaceAll(SHIELD, "");
+        let portAny = false;
+        let pat = parseUrl(marked);
+        if (pat === undefined) {
+            const zeroPort = marked.replace(new RegExp(`:${WILDCARD}(?=[/?#]|$)`), ":0");
+            if (zeroPort !== marked) {
+                pat = parseUrl(zeroPort);
+                portAny = pat !== undefined;
+            }
+        }
+        if (pat !== undefined && (occurrences(pat.href, WILDCARD) > occurrences(pattern, "*") || occurrences(pat.href, SHIELD) > occurrences(marked, SHIELD)))
+            pat = undefined;
+        if (pat === undefined || (SPECIAL_SCHEMES.has(pat.protocol) && pat.hostname.split(".").some((l) => l.startsWith("xn--") && l.includes(WILDCARD)))) {
+            return !strict && segmentedGlobMatches(pattern, `${target.protocol}//${target.host}${target.pathname}${target.search}`, "/");
+        }
+        if (pat.protocol !== `${WILDCARD}:` && pat.protocol !== target.protocol)
+            return false;
+        if (strict && unshield(pat.hostname).includes("*"))
+            return false;
+        const host = target.hostname.replace(/\.$/, "").toLowerCase();
+        const hostPattern = unshield(pat.hostname).replace(/\.$/, "").toLowerCase().replaceAll(WILDCARD, "*");
+        if (!globMatches(hostPattern, host))
+            return false;
+        if (pat.port === "" && pat.hostname.includes(WILDCARD) && !(strict && defaultPortWritten(marked, pat)))
+            portAny = true;
+        if (!portAny && pat.port !== target.port)
+            return false;
+        if ((pat.pathname === "/" || pat.pathname === "") && pat.search === "" && !marked.endsWith("/"))
+            return !socketTarget;
+        const pathPattern = unshield(pat.pathname + pat.search).replaceAll(WILDCARD, "*");
+        const targetPath = target.pathname + target.search;
+        if (!globMatches(pathPattern, targetPath))
+            return false;
+        if (!socketTarget)
+            return true;
+        const socketPattern = socketPart(pathPattern);
+        return !socketPattern.includes("*") && socketPattern === socketPart(targetPath);
+    }
+    function urlAllowPatternMatches(url, pattern) {
+        return componentMatches(url, pattern, "allow");
+    }
+    return urlAllowPatternMatches;
+};

package/dist/headlessPermissionModeWire.d.ts

@@ -4,11 +4,27 @@ import { type EnvLike } from './hostEnv.js';
 export declare const HEADLESS_PERMISSION_MODE_ENV = "SEMA_HEADLESS_PERMISSION_MODE";
 export declare const HEADLESS_PERMISSION_WIRE_MODES: readonly PermissionMode[];
 export declare function normalizeShellPermissionModeForWire(mode: string | undefined): string | undefined;
+export interface HeadlessPermissionFlags {
+    readonly flag?: string;
+    readonly missing?: true;
+    readonly dangerouslySkipPermissions?: boolean;
+}
 export type HeadlessPermissionResolution = {
     fields: PermissionModeField;
     source: 'flag' | 'env' | 'default';
     warning?: string;
 };
-export declare function permissionModeFromArgv(argv: readonly string[]): string | undefined;
-export declare function resolveHeadlessPermissionMode(argv: readonly string[], env?: EnvLike, permissionModes?: PermissionModesReading): HeadlessPermissionResolution;
+export declare function resolveHeadlessPermissionMode(flags: HeadlessPermissionFlags | undefined, env?: EnvLike, permissionModes?: PermissionModesReading): HeadlessPermissionResolution;
+export type HeadlessPermissionModeKnob = {
+    readonly kind: 'absent';
+} | {
+    readonly kind: 'word';
+    readonly word: PermissionMode;
+} | {
+    readonly kind: 'invalid';
+    readonly raw: string;
+    readonly warning: string;
+};
+export declare function readHeadlessPermissionModeKnob(env?: EnvLike): HeadlessPermissionModeKnob;
+export declare function headlessDontAskDowngradeWarning(permissionModes?: PermissionModesReading): string;
 export declare function _resetHeadlessPermissionModeWireForTest(): void;

package/dist/headlessPermissionModeWire.js

@@ -1,7 +1,7 @@
 import { permissionModeField } from './permissionWireCaps.js';
 import { permissionModeAdmitted } from './permissionModesCapability.js';
 import { hostEnv } from './hostEnv.js';
-import { lastFlagValue } from './argvFlagValue.js';
+import { flagString, flagTrue } from './flagInput.js';
 import { PERMISSION_MODE_WORDS } from './taskRequestWords.js';
 import { readOwnDataValue } from './ownKey.js';
 export const HEADLESS_PERMISSION_MODE_ENV = 'SEMA_HEADLESS_PERMISSION_MODE';
@@ -12,33 +12,29 @@ export function normalizeShellPermissionModeForWire(mode) {
         return undefined;
     return SHELL_INTERNAL_MODE_TO_WIRE.get(mode) ?? mode;
 }
-export function permissionModeFromArgv(argv) {
-    const flag = lastFlagValue(argv, '--permission-mode', 'latch-previous');
-    if (flag.present && flag.raw !== undefined)
-        return flag.raw;
-    for (let i = 0; i < argv.length; i++) {
-        const a = argv[i];
-        if (a === '--')
-            break;
-        if (a === '--dangerously-skip-permissions')
-            return 'bypassPermissions';
-    }
+function permissionModeOfFlags(flags) {
+    const flag = flagString(flags, 'flag');
+    if (flag !== undefined)
+        return flag;
+    if (flagTrue(flags, 'dangerouslySkipPermissions'))
+        return 'bypassPermissions';
     return undefined;
 }
 let warnedInvalidEnv = false;
-export function resolveHeadlessPermissionMode(argv, env = hostEnv(), permissionModes) {
-    const flagMode = permissionModeFromArgv(argv);
+export function resolveHeadlessPermissionMode(flags, env = hostEnv(), permissionModes) {
+    const flagMode = permissionModeOfFlags(flags);
     if (flagMode !== undefined) {
         const snap = flagMode === 'dontAsk' ? dontAskSnapshot(permissionModes) : undefined;
         const normalized = normalizeShellPermissionModeForWire(flagMode);
         const projected = permissionModeField(normalized, { stampDefault: true, permissionModes: snap });
         return { fields: projected.permissionMode !== undefined ? projected : permissionModeField('default', { stampDefault: true }), source: 'flag' };
     }
-    const raw = env[HEADLESS_PERMISSION_MODE_ENV]?.trim();
-    if (raw === undefined || raw === '') {
+    const knob = readHeadlessPermissionModeKnob(env);
+    if (knob.kind === 'absent') {
         return { fields: permissionModeField('default', { stampDefault: true }), source: 'default' };
     }
-    if (HEADLESS_PERMISSION_WIRE_MODES.includes(raw)) {
+    if (knob.kind === 'word') {
+        const raw = knob.word;
         const snap = raw === 'dontAsk' ? dontAskSnapshot(permissionModes) : undefined;
         const resolution = {
             fields: permissionModeField(raw, { stampDefault: true, permissionModes: snap }),
@@ -46,7 +42,7 @@ export function resolveHeadlessPermissionMode(argv, env = hostEnv(), permissionM
         };
         if (raw === 'dontAsk' && resolution.fields.permissionMode !== 'dontAsk' && !warnedInvalidEnv) {
             warnedInvalidEnv = true;
-            resolution.warning = `sema: ${HEADLESS_PERMISSION_MODE_ENV}="dontAsk" is only sent once this client knows the engine accepts that mode, and ${dontAskWithheldClause(permissionModes)} — this run uses "default"`;
+            resolution.warning = headlessDontAskDowngradeWarning(permissionModes);
         }
         return resolution;
     }
@@ -56,10 +52,25 @@ export function resolveHeadlessPermissionMode(argv, env = hostEnv(), permissionM
     };
     if (!warnedInvalidEnv) {
         warnedInvalidEnv = true;
-        resolution.warning = `sema: ${HEADLESS_PERMISSION_MODE_ENV}="${raw}" is not a recognized permission mode (expected one of: ${HEADLESS_PERMISSION_WIRE_MODES.join(', ')}) — ignoring it, this run keeps the default permission behavior`;
+        resolution.warning = knob.warning;
     }
     return resolution;
 }
+export function readHeadlessPermissionModeKnob(env = hostEnv()) {
+    const raw = env[HEADLESS_PERMISSION_MODE_ENV]?.trim();
+    if (raw === undefined || raw === '')
+        return Object.freeze({ kind: 'absent' });
+    if (HEADLESS_PERMISSION_WIRE_MODES.includes(raw))
+        return Object.freeze({ kind: 'word', word: raw });
+    return Object.freeze({
+        kind: 'invalid',
+        raw,
+        warning: `sema: ${HEADLESS_PERMISSION_MODE_ENV}="${raw}" is not a recognized permission mode (expected one of: ${HEADLESS_PERMISSION_WIRE_MODES.join(', ')}) — ignoring it, this run keeps the default permission behavior`,
+    });
+}
+export function headlessDontAskDowngradeWarning(permissionModes) {
+    return `sema: ${HEADLESS_PERMISSION_MODE_ENV}="dontAsk" is only sent once this client knows the engine accepts that mode, and ${dontAskWithheldClause(permissionModes)} — this run uses "default"`;
+}
 function dontAskSnapshot(reading) {
     return permissionModeAdmitted(reading, 'dontAsk') ? { kind: 'present', modes: Object.freeze(['dontAsk']) } : undefined;
 }

package/dist/hitl/allowRuleShadow.js

@@ -1,3 +1,5 @@
+import { appendOwnElement } from '../ownKey.js';
+import { slotPresenceOf } from '../wireFailureShape.js';
 import { CORE_ALLOW_RULE_MEMBERS } from '../generated/engineFactTables.js';
 import { displayUntrusted, quoteUntrustedForSentence } from '../displayUntrusted.js';
 import { msg, renderMessage } from '../i18n/translate.js';
@@ -25,7 +27,7 @@ function readMemberRecord(r) {
             let ok = true;
             for (let i = 0; i < length; i++) {
                 const d = Object.getOwnPropertyDescriptor(rawEntries, i);
-                if (d === undefined || !('value' in d)) {
+                if (d === undefined || !Object.hasOwn(d, 'value')) {
                     ok = false;
                     break;
                 }
@@ -34,7 +36,7 @@ function readMemberRecord(r) {
                     ok = false;
                     break;
                 }
-                out.push(e);
+                appendOwnElement(out, e);
             }
             if (ok && rawEntries.length === length)
                 entries = Object.freeze(out);
@@ -92,7 +94,7 @@ export function retiredAllowRuleShadowKeyPresent(carrier, leg) {
         const host = leg === 'row' ? keyValue(carrier, 'riskDescriptor') : carrier;
         if (typeof host !== 'object' || host === null)
             return false;
-        return RETIRED_SHADOW_KEY[leg] in host;
+        return slotPresenceOf(host, RETIRED_SHADOW_KEY[leg]) !== 'absent';
     }
     catch {
         return true;
@@ -100,7 +102,7 @@ export function retiredAllowRuleShadowKeyPresent(carrier, leg) {
 }
 function readMemberAt(arr, i) {
     const d = Object.getOwnPropertyDescriptor(arr, i);
-    return d !== undefined && 'value' in d ? readMemberRecord(d.value) : freezeMember({ known: false, malformed: true });
+    return d !== undefined && Object.hasOwn(d, 'value') ? readMemberRecord(d.value) : freezeMember({ known: false, malformed: true });
 }
 export function readAllowRuleShadowFromWire(carrier, leg) {
     try {
@@ -133,7 +135,7 @@ function readStampedValue(raw) {
     for (let i = 0; i < length; i++) {
         const r = readMemberAt(members, i);
         const d = Object.getOwnPropertyDescriptor(members, i);
-        const was = d !== undefined && 'value' in d && typeof d.value === 'object' && d.value !== null && d.value.malformed === true;
+        const was = d !== undefined && Object.hasOwn(d, 'value') && typeof d.value === 'object' && d.value !== null && d.value.malformed === true;
         out.push(was && r.malformed !== true ? freezeMember({ ...r, malformed: true }) : r);
     }
     if (members.length !== length)

package/dist/hitl/approvalCardReading.d.ts

@@ -1,3 +1,4 @@
+import { CORE_TOOL_APPROVAL_CARDS } from '../generated/engineFactTables.js';
 import type { ApprovalCardRequest } from './toolApprovalWire.js';
 export declare function readRequiresRealApproval(carrier: object | null | undefined): boolean;
 export interface ApprovalWindowKeys {
@@ -13,3 +14,5 @@ export interface ApprovalWindowReadOpts {
 }
 export declare function approvalWindowKeysOf(carrier: object | null | undefined, opts?: ApprovalWindowReadOpts | null): Readonly<ApprovalWindowKeys>;
 export declare function probeCauseRowsOf(card: Pick<ApprovalCardRequest, 'probeCause'> | null | undefined): readonly string[] | undefined;
+export type ApprovalCardWord = (typeof CORE_TOOL_APPROVAL_CARDS)[number];
+export declare function readApprovalCardWord(carrier: unknown): ApprovalCardWord | undefined;

package/dist/hitl/approvalCardReading.js

@@ -1,3 +1,4 @@
+import { CORE_TOOL_APPROVAL_CARDS } from '../generated/engineFactTables.js';
 import { displayUntrusted } from '../displayUntrusted.js';
 import { guardedRead, readOwnDataValue } from '../ownKey.js';
 export function readRequiresRealApproval(carrier) {
@@ -152,3 +153,19 @@ export function probeCauseRowsOf(card) {
         return undefined;
     }
 }
+const _approvalCardWordPins = [true, true];
+void _approvalCardWordPins;
+const APPROVAL_CARD_WORD_SET = new Set(CORE_TOOL_APPROVAL_CARDS);
+export function readApprovalCardWord(carrier) {
+    try {
+        if (typeof carrier !== 'object' || carrier === null)
+            return undefined;
+        const d = Object.getOwnPropertyDescriptor(carrier, 'approvalCard');
+        if (d === undefined || !Object.hasOwn(d, 'value'))
+            return undefined;
+        return APPROVAL_CARD_WORD_SET.has(d.value) ? d.value : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/hitl/approvalCompleteParked.js

@@ -1,6 +1,6 @@
 function ownData(o, key) {
     const d = Object.getOwnPropertyDescriptor(o, key);
-    return d !== undefined && 'value' in d ? d.value : undefined;
+    return d !== undefined && Object.hasOwn(d, 'value') ? d.value : undefined;
 }
 export function approvalCompleteParked(frame) {
     try {