@sema-agent/client-core 0.93.1 → 0.95.0

package/dist/panelStateHolder.d.ts

@@ -0,0 +1,17 @@
+import type { EngineAgentPanelAbsence, EngineAgentPanelEvent } from './engineAgentPanelStore.js';
+import { type PanelDelta, type PanelFrame, type PanelReduceState } from './panelReduce.js';
+export declare function panelStateNow(): PanelReduceState;
+export declare function stepEnginePanel(frame: PanelFrame): void;
+export declare function replaceEnginePanelState(fn: (s: PanelReduceState) => PanelReduceState): void;
+export declare function clearEnginePanelIdentity(): void;
+export declare function clearEnginePanelAnchors(): void;
+export declare function resetEnginePanelHolder(): void;
+type Listener = (ev: EngineAgentPanelEvent) => void;
+export declare function subscribeLegacyEvents(fn: Listener): () => void;
+type AbsenceListener = (ev: EngineAgentPanelAbsence) => void;
+export declare function subscribeAbsence(fn: AbsenceListener): () => void;
+export declare function resetAbsenceChannel(): void;
+type RowListener = (d: PanelDelta) => void;
+export declare function subscribeRows(fn: RowListener): () => void;
+export declare function clearEnginePanelRows(): void;
+export {};

package/dist/panelStateHolder.js

@@ -0,0 +1,201 @@
+import { createPanelReduceState, isNewEngineAgentPanelCycle, panelClearAnchors, panelClearIdentity, panelClearRows, panelRowSnapshot, stepPanelFrame, } from './panelReduce.js';
+let state = createPanelReduceState();
+export function panelStateNow() {
+    return state;
+}
+export function stepEnginePanel(frame) {
+    const r = stepPanelFrame(state, frame);
+    state = r.state;
+    if (rowListener !== null)
+        rowQueue.push(...r.deltas);
+    for (const f of r.facts) {
+        if (f.ch === 'event')
+            deliverLegacyEvent(f.ev);
+        else
+            deliverAbsence(f.absence);
+    }
+    drainRows();
+}
+export function replaceEnginePanelState(fn) {
+    state = fn(state);
+}
+export function clearEnginePanelIdentity() {
+    state = panelClearIdentity(state);
+}
+export function clearEnginePanelAnchors() {
+    state = panelClearAnchors(state);
+}
+export function resetEnginePanelHolder() {
+    state = createPanelReduceState();
+    listener = null;
+    buffer.length = 0;
+    absenceListener = null;
+    absenceBuffer.clear();
+    rowListener = null;
+    rowQueue.length = 0;
+}
+const MAX_BUFFER = 200;
+let listener = null;
+const buffer = [];
+function launchAnchorChanged(prev, next) {
+    if (prev.kind !== 'fleet-row' || next.kind !== 'fleet-row')
+        return false;
+    return isNewEngineAgentPanelCycle(prev, next);
+}
+function deliverLegacyEvent(ev) {
+    if (ev.kind !== 'sweep')
+        absenceBuffer.delete(ev.taskId);
+    if (listener) {
+        try {
+            listener(ev);
+        }
+        catch {
+        }
+        return;
+    }
+    if (ev.kind === 'sweep' && buffer.length > 0 && buffer[buffer.length - 1]?.kind === 'sweep')
+        return;
+    const progress = ev.kind === 'tick' || ev.kind === 'fleet-row';
+    if (progress) {
+        const kind = ev.kind;
+        const taskId = ev.taskId;
+        let i = -1;
+        for (let at = buffer.length - 1; at >= 0; at--) {
+            const b = buffer[at];
+            if (b === undefined)
+                continue;
+            if (b.kind === 'sweep')
+                break;
+            if (b.kind === 'end') {
+                if (b.taskId === taskId)
+                    break;
+                continue;
+            }
+            if (b.taskId !== taskId)
+                continue;
+            if (b.kind === kind && !launchAnchorChanged(b, ev))
+                i = at;
+            break;
+        }
+        if (i >= 0) {
+            const merged = { ...buffer[i], ...ev };
+            buffer.splice(i, 1);
+            buffer.push(merged);
+            return;
+        }
+    }
+    if (buffer.length < MAX_BUFFER) {
+        buffer.push(ev);
+        return;
+    }
+    const evictAt = buffer.findIndex(b => b.kind === 'tick' || b.kind === 'fleet-row');
+    if (evictAt >= 0) {
+        buffer.splice(evictAt, 1);
+        buffer.push(ev);
+        return;
+    }
+    buffer.shift();
+    buffer.push(ev);
+}
+export function subscribeLegacyEvents(fn) {
+    listener = fn;
+    if (buffer.length > 0) {
+        const pending = buffer.splice(0, buffer.length);
+        for (const ev of pending) {
+            try {
+                fn(ev);
+            }
+            catch {
+            }
+        }
+    }
+    return () => {
+        if (listener === fn)
+            listener = null;
+    };
+}
+const MAX_ABSENCE_BUFFER = 200;
+let absenceListener = null;
+const absenceBuffer = new Map();
+function deliverAbsence(ev) {
+    if (absenceListener) {
+        try {
+            absenceListener(ev);
+        }
+        catch {
+        }
+        return;
+    }
+    absenceBuffer.delete(ev.taskId);
+    absenceBuffer.set(ev.taskId, ev);
+    if (absenceBuffer.size > MAX_ABSENCE_BUFFER) {
+        const oldest = absenceBuffer.keys().next().value;
+        if (oldest !== undefined)
+            absenceBuffer.delete(oldest);
+    }
+}
+export function subscribeAbsence(fn) {
+    absenceListener = fn;
+    if (absenceBuffer.size > 0) {
+        const pending = [...absenceBuffer.values()];
+        absenceBuffer.clear();
+        for (const ev of pending) {
+            try {
+                fn(ev);
+            }
+            catch {
+            }
+        }
+    }
+    return () => {
+        if (absenceListener === fn)
+            absenceListener = null;
+    };
+}
+export function resetAbsenceChannel() {
+    absenceListener = null;
+    absenceBuffer.clear();
+}
+let rowListener = null;
+const rowQueue = [];
+let rowDraining = false;
+function drainRows() {
+    if (rowListener === null) {
+        rowQueue.length = 0;
+        return;
+    }
+    if (rowDraining)
+        return;
+    rowDraining = true;
+    try {
+        while (rowQueue.length > 0) {
+            const d = rowQueue.shift();
+            const fn = rowListener;
+            if (fn === null) {
+                rowQueue.length = 0;
+                break;
+            }
+            try {
+                fn(d);
+            }
+            catch {
+            }
+        }
+    }
+    finally {
+        rowDraining = false;
+    }
+}
+export function subscribeRows(fn) {
+    rowListener = fn;
+    rowQueue.length = 0;
+    rowQueue.push(...panelRowSnapshot(state));
+    drainRows();
+    return () => {
+        if (rowListener === fn)
+            rowListener = null;
+    };
+}
+export function clearEnginePanelRows() {
+    state = panelClearRows(state);
+}

package/dist/peerLaneCapability.d.ts

@@ -14,5 +14,4 @@ export declare function noteEngineCapsForPeerLane(baseUrl: string, caps: unknown
 export declare function observedPeerLane(baseUrl?: string | undefined): PeerLaneReading;
 export declare function peerLaneAvailable(reading: PeerLaneReading): 'yes' | 'no' | 'unknown';
 export declare function peerLaneDoctorDetail(reading: PeerLaneReading): string;
-export declare function forgetPeerLaneReading(baseUrl: string | undefined): void;
 export declare function __resetPeerLaneReadingsForTests(): void;

package/dist/peerLaneCapability.js

@@ -1,18 +1,22 @@
 import { engineWireTarget } from './engineWireTarget.js';
 import { createEngineCapReader } from './engineCapReader.js';
+import { ownDataField } from './ownKey.js';
 export function projectPeerLaneCapability(caps) {
-    if (caps === null || typeof caps !== 'object')
-        return undefined;
-    if (caps === null || typeof caps !== 'object' || Array.isArray(caps))
-        return undefined;
-    if (!Object.hasOwn(caps, 'peerLane'))
-        return { kind: 'not_reported' };
-    const v = caps.peerLane;
-    if (v === undefined)
-        return { kind: 'not_reported' };
-    if (typeof v !== 'boolean')
+    try {
+        if (caps === null || typeof caps !== 'object')
+            return undefined;
+        if (caps === null || typeof caps !== 'object' || Array.isArray(caps))
+            return undefined;
+        const v = ownDataField(caps, 'peerLane');
+        if (v === undefined)
+            return { kind: 'not_reported' };
+        if (typeof v !== 'boolean')
+            return undefined;
+        return v ? { kind: 'present' } : { kind: 'absent' };
+    }
+    catch {
         return undefined;
-    return v ? { kind: 'present' } : { kind: 'absent' };
+    }
 }
 const reader = createEngineCapReader({
     name: 'peerLane',
@@ -44,9 +48,6 @@ export function peerLaneDoctorDetail(reading) {
             return 'cross-session lane on — this engine can discover and deliver across sessions for the same caller';
     }
 }
-export function forgetPeerLaneReading(baseUrl) {
-    reader.forget(baseUrl);
-}
 export function __resetPeerLaneReadingsForTests() {
     reader.__resetForTests();
 }

package/dist/permissionModesCapability.d.ts

@@ -12,5 +12,4 @@ export declare function noteEngineCapsForPermissionModes(baseUrl: string, caps:
 }): void;
 export declare function observedPermissionModes(baseUrl?: string | undefined): PermissionModesReading;
 export declare function permissionModeAdmitted(reading: PermissionModesReading | undefined, mode: string): boolean;
-export declare function forgetPermissionModesReading(baseUrl: string | undefined): void;
 export declare function __resetPermissionModesReadingsForTests(): void;

package/dist/permissionModesCapability.js

@@ -1,16 +1,16 @@
 import { engineWireTarget } from './engineWireTarget.js';
 import { createEngineCapReader } from './engineCapReader.js';
-import { readOwnDataValue } from './ownKey.js';
+import { ownDataField, readOwnDataValue } from './ownKey.js';
 function readModesStrict(v) {
     try {
         if (!Array.isArray(v))
             return undefined;
-        const length = v.length;
-        if (length === 0)
+        const length = ownDataField(v, 'length');
+        if (typeof length !== 'number' || length === 0)
             return undefined;
         const modes = [];
         for (let i = 0; i < length; i++) {
-            const item = readOwnDataValue(v, String(i));
+            const item = ownDataField(v, String(i));
             if (typeof item !== 'string' || item.length === 0)
                 return undefined;
             modes.push(item);
@@ -25,9 +25,7 @@ export function projectPermissionModesCapability(caps) {
     try {
         if (caps === null || typeof caps !== 'object' || Array.isArray(caps))
             return undefined;
-        if (!Object.hasOwn(caps, 'permissionModes'))
-            return { kind: 'not_reported' };
-        const v = caps.permissionModes;
+        const v = ownDataField(caps, 'permissionModes');
         if (v === undefined)
             return { kind: 'not_reported' };
         const modes = readModesStrict(v);
@@ -63,9 +61,6 @@ export function permissionModeAdmitted(reading, mode) {
         return false;
     }
 }
-export function forgetPermissionModesReading(baseUrl) {
-    reader.forget(baseUrl);
-}
 export function __resetPermissionModesReadingsForTests() {
     reader.__resetForTests();
 }

package/dist/permissionRuleIssue.js

@@ -31,7 +31,7 @@ const ISSUE_SENTENCES = Object.freeze({
     'unsupported.param_unknown': 'this parameter rule is not supported: the tool carries no such parameter, so it could never match',
     'unsupported.param_non_scalar': 'this parameter rule is not supported: that parameter holds an object or an array, so it could never match',
     'unsupported.tool_unknown': "this rule is not supported on this leg: the resolver it supplied does not know the tool, so the rule's face cannot be checked",
-    'unsupported.path_base': 'this path rule is not supported as spelled: it needs a base this policy was not given, so it would reach nothing and is refused rather than compiled',
+    'unsupported.path_base': 'this path rule is not supported as spelled: the base it is relative to is missing or is not a usable absolute path, so it would reach nothing and is refused rather than compiled',
     'unsupported.mcp_paren': 'a parenthesised parameter rule is not supported on an MCP tool name',
     'unsupported.covering_paren': 'a parenthesised parameter rule is not supported on a covering protocol name — the parameter grammar is keyed by an exact tool name, so no mounted tool could ever bear it',
     'invalid.allow_param_rule': 'this rule is invalid: an allow rule cannot carry a parameter pattern — only bare tool rules auto-allow',

package/dist/permissionRulesWriteCapability.d.ts

@@ -14,5 +14,4 @@ export declare function noteEngineCapsForPermissionRulesWrite(baseUrl: string, c
 export declare function observedPermissionRulesWrite(baseUrl?: string | undefined): PermissionRulesWriteReading;
 export declare function permissionRulesWriteAvailable(reading: PermissionRulesWriteReading): boolean;
 export declare function permissionRulesWriteDoctorDetail(reading: PermissionRulesWriteReading): string;
-export declare function forgetPermissionRulesWriteReading(baseUrl: string | undefined): void;
 export declare function __resetPermissionRulesWriteReadingsForTests(): void;

package/dist/permissionRulesWriteCapability.js

@@ -1,18 +1,22 @@
 import { engineWireTarget } from './engineWireTarget.js';
 import { createEngineCapReader } from './engineCapReader.js';
+import { ownDataField } from './ownKey.js';
 export function projectPermissionRulesWriteCapability(caps) {
-    if (caps === null || typeof caps !== 'object')
-        return undefined;
-    if (caps === null || typeof caps !== 'object' || Array.isArray(caps))
-        return undefined;
-    if (!Object.hasOwn(caps, 'permissionRulesWrite'))
-        return { kind: 'not_reported' };
-    const v = caps.permissionRulesWrite;
-    if (v === undefined)
-        return { kind: 'not_reported' };
-    if (typeof v !== 'boolean')
+    try {
+        if (caps === null || typeof caps !== 'object')
+            return undefined;
+        if (caps === null || typeof caps !== 'object' || Array.isArray(caps))
+            return undefined;
+        const v = ownDataField(caps, 'permissionRulesWrite');
+        if (v === undefined)
+            return { kind: 'not_reported' };
+        if (typeof v !== 'boolean')
+            return undefined;
+        return v ? { kind: 'present' } : { kind: 'absent' };
+    }
+    catch {
         return undefined;
-    return v ? { kind: 'present' } : { kind: 'absent' };
+    }
 }
 const reader = createEngineCapReader({
     name: 'permissionRulesWrite',
@@ -40,9 +44,6 @@ export function permissionRulesWriteDoctorDetail(reading) {
             return 'permission-rule write entry reachable for this call — a per-call attempt still answers for itself whether the direction, text, and scope are accepted';
     }
 }
-export function forgetPermissionRulesWriteReading(baseUrl) {
-    reader.forget(baseUrl);
-}
 export function __resetPermissionRulesWriteReadingsForTests() {
     reader.__resetForTests();
 }

package/dist/permissionsAllowGrantCapability.d.ts

@@ -5,6 +5,7 @@ export type PermissionsAllowGrantReading = {
 } | {
     kind: 'present';
     grants: boolean;
+    layer?: boolean;
 };
 export declare function projectPermissionsAllowGrantCapability(caps: unknown): PermissionsAllowGrantReading | undefined;
 export declare function noteEngineCapsForPermissionsAllowGrant(baseUrl: string, caps: unknown, opts?: {
@@ -12,7 +13,7 @@ export declare function noteEngineCapsForPermissionsAllowGrant(baseUrl: string,
 }): void;
 export declare function observedPermissionsAllowGrant(baseUrl?: string | undefined): PermissionsAllowGrantReading;
 export declare function permissionsAllowGrantAvailable(reading: PermissionsAllowGrantReading): boolean;
+export declare function allowWireForm(reading: PermissionsAllowGrantReading): 'layer' | 'grant' | 'off';
 export declare function allowRulesGate(reading: PermissionsAllowGrantReading, settingsRead: 'clean' | 'partial' | 'unreadable' | undefined): 'open' | 'capability_off' | 'settings_read_not_clean';
 export declare function permissionsAllowGrantDoctorDetail(reading: PermissionsAllowGrantReading, settingsRead?: 'clean' | 'partial' | 'unreadable'): string;
-export declare function forgetPermissionsAllowGrantReading(baseUrl: string | undefined): void;
 export declare function __resetPermissionsAllowGrantReadingsForTests(): void;

package/dist/permissionsAllowGrantCapability.js

@@ -1,25 +1,36 @@
 import { engineWireTarget } from './engineWireTarget.js';
 import { createEngineCapReader } from './engineCapReader.js';
+import { ownDataField } from './ownKey.js';
+import { hasCoreValuePort } from './coreValuePorts.js';
 const ALLOW_GRANT_CAP_PATH = ['settings', 'permissions', 'allowGrant'];
+const ALLOW_LAYER_CAP_LEAF = 'allowLayer';
 export function projectPermissionsAllowGrantCapability(caps) {
-    if (caps === null || typeof caps !== 'object' || Array.isArray(caps))
-        return undefined;
-    let node = caps;
-    for (let i = 0; i < ALLOW_GRANT_CAP_PATH.length; i++) {
-        const seg = ALLOW_GRANT_CAP_PATH[i];
-        if (!Object.hasOwn(node, seg))
-            return { kind: 'not_reported' };
-        const v = node[seg];
-        if (v === undefined)
-            return { kind: 'not_reported' };
-        if (i === ALLOW_GRANT_CAP_PATH.length - 1) {
-            return typeof v === 'boolean' ? { kind: 'present', grants: v } : undefined;
-        }
-        if (v === null || typeof v !== 'object' || Array.isArray(v))
+    try {
+        if (caps === null || typeof caps !== 'object' || Array.isArray(caps))
             return undefined;
-        node = v;
+        let node = caps;
+        for (let i = 0; i < ALLOW_GRANT_CAP_PATH.length; i++) {
+            const seg = ALLOW_GRANT_CAP_PATH[i];
+            const v = ownDataField(node, seg);
+            if (v === undefined)
+                return { kind: 'not_reported' };
+            if (i === ALLOW_GRANT_CAP_PATH.length - 1) {
+                if (typeof v !== 'boolean')
+                    return undefined;
+                const layer = ownDataField(node, ALLOW_LAYER_CAP_LEAF);
+                if (layer === undefined)
+                    return { kind: 'present', grants: v };
+                return typeof layer === 'boolean' ? { kind: 'present', grants: v, layer } : undefined;
+            }
+            if (v === null || typeof v !== 'object' || Array.isArray(v))
+                return undefined;
+            node = v;
+        }
+        return undefined;
+    }
+    catch {
+        return undefined;
     }
-    return undefined;
 }
 const reader = createEngineCapReader({
     name: ALLOW_GRANT_CAP_PATH.join('.'),
@@ -44,6 +55,11 @@ export function permissionsAllowGrantAvailable(reading) {
         return false;
     }
 }
+export function allowWireForm(reading) {
+    if (!permissionsAllowGrantAvailable(reading))
+        return 'off';
+    return ownReadingField(reading, 'layer') === true && hasCoreValuePort('compileAllowList') ? 'layer' : 'grant';
+}
 export function allowRulesGate(reading, settingsRead) {
     if (!permissionsAllowGrantAvailable(reading))
         return 'capability_off';
@@ -62,6 +78,9 @@ function ownReadingField(reading, key) {
 export function permissionsAllowGrantDoctorDetail(reading, settingsRead) {
     const gate = allowRulesGate(reading, settingsRead);
     if (gate === 'open') {
+        if (allowWireForm(reading) === 'layer') {
+            return 'allow rules sent to the engine, content forms included — a matching call is not asked, except for the kinds of question the engine always puts to a person, and an entry the engine reads as granting nothing is reported when the run starts';
+        }
         return 'allow rules sent to the engine — it reads them as rules, not as an exclusive list: a matching call counts as answered for, and the engine still raises its own prompts where it requires them';
     }
     if (gate === 'settings_read_not_clean') {
@@ -81,9 +100,6 @@ export function permissionsAllowGrantDoctorDetail(reading, settingsRead) {
     }
     return 'allow rules kept on this side — no usable capabilities reading is cached for this engine (none received, the last one was unreadable, or the last one was discarded when the engine connection was reset; this process cannot tell which), so allow rules are not sent and matching approvals are still answered here';
 }
-export function forgetPermissionsAllowGrantReading(baseUrl) {
-    reader.forget(baseUrl);
-}
 export function __resetPermissionsAllowGrantReadingsForTests() {
     reader.__resetForTests();
 }

package/dist/permissionsDeclaration.d.ts

@@ -1,4 +1,5 @@
 import { type PermissionsAllowGrantReading } from './permissionsAllowGrantCapability.js';
+export declare const WIRE_RULE_TRUST_ORDER: readonly ["policySettings", "cliArg", "flagSettings", "session", "userSettings", "localSettings", "projectSettings"];
 declare const RULE_TRUST_ORDER: readonly ["policySettings", "cliArg", "flagSettings", "session", "userSettings", "localSettings", "projectSettings"];
 export type WireRuleOrigin = (typeof RULE_TRUST_ORDER)[number];
 export interface WireRuleOrigins {
@@ -13,6 +14,7 @@ export interface PermissionsDeclarationInput {
     readonly origins?: WireRuleOrigins;
     readonly cliDeny?: readonly string[];
     readonly settingsRead: 'clean' | 'partial' | 'unreadable';
+    readonly clientOwnedServers?: readonly string[];
 }
 export interface PermissionsDeclarationBuckets {
     deny?: string[];
@@ -22,7 +24,7 @@ export interface PermissionsDeclarationBuckets {
 export interface PermissionsDeclaration {
     permissions?: PermissionsDeclarationBuckets;
 }
-export declare const PERMISSIONS_KEPT_REASONS: readonly ["allow_capability_off", "settings_read_not_clean", "empty_rule", "paren_in_tool_name", "retired_tool_name", "unprefixed_namespaced_name", "incomplete_protocol_name", "unminted_protocol_segment", "home_relative_path", "compile_refused", "content_form_not_grantable", "judge_failed", "duplicate"];
+export declare const PERMISSIONS_KEPT_REASONS: readonly ["allow_capability_off", "settings_read_not_clean", "empty_rule", "paren_in_tool_name", "retired_tool_name", "unprefixed_namespaced_name", "incomplete_protocol_name", "unminted_protocol_segment", "home_relative_path", "compile_refused", "content_form_not_grantable", "judge_failed", "duplicate", "voids_allow_list"];
 export type PermissionsKeptReason = (typeof PERMISSIONS_KEPT_REASONS)[number];
 export interface PermissionsKeptRule {
     rule: string;
@@ -48,7 +50,20 @@ export interface PermissionsDeclarationReport extends PermissionsDeclaration {
     rewritten: PermissionsRewrittenRule[];
     unchecked: PermissionsUncheckedRule[];
     unreachable: PermissionsUnreachableRule[];
+    clientOwned?: PermissionsClientOwnedStatement[];
+}
+export interface PermissionsClientOwnedStatement {
+    server: string;
+    rule?: string;
+    sent: boolean;
+    reason?: PermissionsKeptReason;
 }
 export declare function permissionsDeclaration(input: PermissionsDeclarationInput, caps: PermissionsAllowGrantReading): PermissionsDeclaration;
 export declare function permissionsDeclarationReport(input: PermissionsDeclarationInput, caps: PermissionsAllowGrantReading): PermissionsDeclarationReport;
+export interface PermissionsAllowKeptFacts {
+    readonly problemCount?: number;
+    readonly managedPolicyPending?: true;
+    readonly where?: string;
+}
+export declare function permissionsAllowKeptNotice(report: Pick<PermissionsDeclarationReport, 'kept'>, settingsRead: 'clean' | 'partial' | 'unreadable', facts?: PermissionsAllowKeptFacts): string | undefined;
 export {};