@sema-agent/core 5.17.0 → 5.18.1

package/dist/core/tool-policy.js

@@ -3,7 +3,12 @@ import { isAbsolute, join, normalize as normalizePath, sep } from "node:path";
 import { BASH_READONLY_DEFAULT_ALLOW, parseLeadingCommandName } from "../tools/fs/index.js";
 import { boundInputHashOf } from "./canonical-json.js";
 import { inlineUntrusted } from "./untrusted-text.js";
+import { parsePermissionRule } from "./permission-rules.js";
 import { writeTargetPath } from "../tools/fs/safety.js";
+export const APPROVAL_SETTLED_BY_VALUES = ["human", "timeout", "aborted"];
+export function isApprovalSettledBy(v) {
+    return typeof v === "string" && APPROVAL_SETTLED_BY_VALUES.includes(v);
+}
 export function decisionText(d) {
     return d.message;
 }
@@ -18,6 +23,7 @@ export function refuseOutOfContractDecision(d) {
         return d;
     return { action: "deny", message: RETIRED_TEXT_FIELD_DENY_MESSAGE, decisionReason: "rule" };
 }
+const DEADLINE_ELAPSED = Symbol("approval.deadline_elapsed");
 function withTimeout(p, ms, onTimeout) {
     if (ms === undefined) {
         return p;
@@ -44,6 +50,53 @@ export function toolPolicyNameSets(p) {
     return Array.isArray(sets) ? sets : [];
 }
 export function createAllowDenyPolicy(opts) {
+    const invalid = [];
+    const screen = (entries, list) => {
+        if (entries === undefined)
+            return undefined;
+        const kept = [];
+        for (const entry of entries) {
+            if (entry.startsWith("mcp__")) {
+                const segments = entry.slice("mcp__".length).split("__");
+                if (segments.some((seg) => seg.length === 0)) {
+                    invalid.push({
+                        entry,
+                        list,
+                        message: `"${entry}" is a malformed MCP tool name (empty segment) — it can never match any mounted tool. ` +
+                            `Use \`mcp__<server>\` for every tool of a server, or \`mcp__<server>__<tool>\` for one tool.`,
+                    });
+                    continue;
+                }
+            }
+            if (parsePermissionRule(entry).ruleContent === undefined) {
+                kept.push(entry);
+                continue;
+            }
+            invalid.push({
+                entry,
+                list,
+                message: `"${entry}" is a rule CONTENT form, not a tool name — a name set matches raw tool names, so this entry ` +
+                    `can never match any mounted tool (in an allow list it removes the tool entirely). Use the tool NAME here, ` +
+                    `and route the narrowing through the lane that speaks this grammar: parameter rules via ` +
+                    `createPermissionRulePolicy, Bash command prefixes via the persisted allow-rule lane.`,
+            });
+        }
+        return kept;
+    };
+    const screenedAllow = screen(opts.allow, "allow");
+    const screenedDeny = screen(opts.deny, "deny");
+    if (invalid.length > 0) {
+        if ((opts.onInvalidName ?? "throw") === "throw") {
+            const e = new Error(`createAllowDenyPolicy: ${invalid.length} entr${invalid.length === 1 ? "y is" : "ies are"} not tool name(s):\n` +
+                invalid.map((i) => `  [${i.list}] ${i.message}`).join("\n"));
+            e.code = "config.invalid_tool_name_set";
+            e.issues = invalid;
+            throw e;
+        }
+        for (const issue of invalid)
+            opts.onInvalidNameIssue?.(issue);
+    }
+    opts = { ...opts, ...(screenedAllow ? { allow: screenedAllow } : {}), ...(screenedDeny ? { deny: screenedDeny } : {}) };
     const allow = opts.allow ? new Set(opts.allow) : undefined;
     const deny = new Set(opts.deny ?? []);
     return {
@@ -82,25 +135,37 @@ export function createApprovalPolicy(opts) {
             }
             if (need.has(toolName)) {
                 if (signal?.aborted) {
-                    return { action: "deny", message: `approval aborted for "${req.toolName}" (task ended)` };
+                    return { action: "deny", message: `approval aborted for "${req.toolName}" (task ended)`, settledBy: "aborted" };
                 }
                 let ok;
                 try {
-                    ok = await withTimeout(Promise.resolve(opts.approve(req, signal)), opts.approvalTimeoutMs, () => false);
+                    ok = await withTimeout(Promise.resolve(opts.approve(req, signal)), opts.approvalTimeoutMs, () => DEADLINE_ELAPSED);
                 }
                 catch (err) {
                     return {
                         action: "deny",
                         message: `approval errored for "${req.toolName}": ${describeThrown(err)}`,
+                        settledBy: "aborted",
                     };
                 }
+                if (ok === DEADLINE_ELAPSED) {
+                    return {
+                        action: "deny",
+                        message: `no one answered the approval request for "${req.toolName}" — the approval window elapsed ` +
+                            `(${opts.approvalTimeoutMs}ms) with no answer; denied fail-closed`,
+                        settledBy: "timeout",
+                    };
+                }
+                if (signal?.aborted) {
+                    return { action: "deny", message: `approval aborted for "${req.toolName}" (task ended)`, settledBy: "aborted" };
+                }
                 const okRaw = ok;
                 if (okRaw === true)
-                    return ALLOW;
+                    return { action: "allow", settledBy: "human" };
                 if (okRaw !== false) {
-                    return { action: "deny", message: `approval callback for "${req.toolName}" returned an out-of-contract value (${typeof ok}) — denied fail-closed (this policy's \`approve\` returns a boolean: return true or false)` };
+                    return { action: "deny", message: `approval callback for "${req.toolName}" returned an out-of-contract value (${typeof ok}) — denied fail-closed (this policy's \`approve\` returns a boolean: return true or false)`, settledBy: "aborted" };
                 }
-                return { action: "deny", message: `approval denied for "${req.toolName}"` };
+                return { action: "deny", message: `approval denied for "${req.toolName}"`, settledBy: "human" };
             }
             if (opts.denyByDefault && !auto.has(toolName)) {
                 return { action: "deny", message: `tool "${req.toolName}" requires explicit allow` };
@@ -117,6 +182,7 @@ export function combinePolicies(...policies) {
             let asked;
             let current = req;
             let rewrite;
+            let settled;
             for (const p of policies) {
                 const d = refuseOutOfContractDecision(await p.check(current, signal));
                 if (d.action === "deny") {
@@ -126,6 +192,11 @@ export function combinePolicies(...policies) {
                     current = { ...current, args: d.updatedInput };
                     rewrite = d;
                 }
+                if (d.action === "allow") {
+                    const supplied = d.settledBy;
+                    if (supplied !== undefined)
+                        settled = supplied;
+                }
                 if (d.action === "ask" && (asked === undefined || (d.requiresRealApproval === true && asked.requiresRealApproval !== true))) {
                     asked = d;
                 }
@@ -134,7 +205,8 @@ export function combinePolicies(...policies) {
                 const merged = rewrite?.updatedInput;
                 return merged !== undefined ? { ...asked, updatedInput: merged } : asked;
             }
-            return rewrite ?? ALLOW;
+            const allowed = rewrite ?? ALLOW;
+            return settled !== undefined ? { ...allowed, settledBy: settled } : allowed;
         },
     };
 }
@@ -607,7 +679,7 @@ export async function resolveAsk(req, onAsk, signal) {
         };
     }
     if (signal?.aborted) {
-        return { action: "deny", message: `approval aborted for "${req.toolName}" (task ended)`, decisionReason: "mode" };
+        return { action: "deny", message: `approval aborted for "${req.toolName}" (task ended)`, decisionReason: "mode", settledBy: "aborted" };
     }
     const presented = tryCloneArgs(req.args);
     if (!presented.ok) {
@@ -615,6 +687,7 @@ export async function resolveAsk(req, onAsk, signal) {
             action: "deny",
             message: `approval for "${req.toolName}" could not present the args safely (unclonable value: ${presented.reason}) — denied fail-closed`,
             decisionReason: "mode",
+            settledBy: "aborted",
         };
     }
     let ok;
@@ -625,6 +698,7 @@ export async function resolveAsk(req, onAsk, signal) {
                 action: "deny",
                 message: `approval for "${req.toolName}" could not present the args safely (unclonable value: ${approverView.reason}) — denied fail-closed`,
                 decisionReason: "mode",
+                settledBy: "aborted",
             };
         }
         ok = await onAsk({ ...req, boundInputHash: boundInputHashOf(presented.value), args: approverView.value }, signal);
@@ -634,42 +708,49 @@ export async function resolveAsk(req, onAsk, signal) {
             action: "deny",
             message: `approval errored for "${req.toolName}": ${describeThrown(err)}`,
             decisionReason: "mode",
+            settledBy: "aborted",
         };
     }
+    if (signal?.aborted) {
+        return { action: "deny", message: `approval aborted for "${req.toolName}" (task ended)`, decisionReason: "mode", settledBy: "aborted" };
+    }
     if (ok === "unavailable") {
         return {
             action: "deny",
             message: `approval required for "${req.toolName}" but the approver reported unavailable (no reachable ` +
                 `operator for this ask) and no durable approval gate is armed — denied fail-closed: ${req.message}`,
             decisionReason: "mode",
+            settledBy: "aborted",
             approverUnavailable: true,
         };
     }
     if (typeof ok === "object" && ok !== null) {
         if (ok.allow !== true) {
-            return { action: "deny", message: `approval denied for "${req.toolName}": ${req.message}`, decisionReason: "mode" };
+            return { action: "deny", message: `approval denied for "${req.toolName}": ${req.message}`, decisionReason: "mode", settledBy: "human" };
         }
         if (ok.updatedInput === undefined)
-            return { action: "allow", decisionReason: "mode", presentedInput: presented.value };
+            return { action: "allow", decisionReason: "mode", presentedInput: presented.value, settledBy: "human" };
         const edit = tryCloneArgs(ok.updatedInput);
         if (!edit.ok) {
             return {
                 action: "deny",
                 message: `the approved edit for "${req.toolName}" is not safely clonable (${edit.reason}) — denied fail-closed`,
                 decisionReason: "mode",
+                settledBy: "aborted",
             };
         }
-        return { action: "allow", updatedInput: edit.value, decisionReason: "mode" };
+        return { action: "allow", updatedInput: edit.value, decisionReason: "mode", settledBy: "human" };
     }
     const okRaw = ok;
     if (okRaw === true)
-        return { action: "allow", decisionReason: "mode", presentedInput: presented.value };
+        return { action: "allow", decisionReason: "mode", presentedInput: presented.value, settledBy: "human" };
     if (okRaw !== false) {
         return {
             action: "deny",
             message: `the approver for "${req.toolName}" returned an out-of-contract value (${typeof ok}) — denied fail-closed (return true, false, "unavailable", or the {allow} object)`,
             decisionReason: "mode",
+            settledBy: "aborted",
         };
     }
-    return { action: "deny", message: `approval denied for "${req.toolName}": ${req.message}`, decisionReason: "mode" };
+    return { action: "deny", message: `approval denied for "${req.toolName}": ${req.message}`, decisionReason: "mode", settledBy: "human" };
 }

package/dist/core/tools.js

@@ -45,6 +45,7 @@ export function defineTool(spec, options) {
         executionMode,
         ...(spec.isConcurrencySafe ? { isConcurrencySafe: spec.isConcurrencySafe } : {}),
         ...(spec.effect ? { effect: spec.effect } : {}),
+        ...(spec.contentOrigin ? { contentOrigin: spec.contentOrigin } : {}),
         ...(spec.prepareArguments ? { prepareArguments: spec.prepareArguments } : {}),
         ...(spec.approvalPreview ? { approvalPreview: spec.approvalPreview } : {}),
         execute: async (toolCallId, rawParams, signal) => {

package/dist/core/trace.d.ts

@@ -181,6 +181,20 @@ export type TraceEvent = {
     site: string;
     message: string;
     ts: number;
+} | {
+    kind: "permission.persisted_rule_allowed";
+    version: 1;
+    taskId: string;
+    toolName: string;
+    toolCallId: string;
+    rule: string;
+    ts: number;
+} | {
+    kind: "permission.rule_store_unreadable";
+    version: 1;
+    taskId: string;
+    message: string;
+    ts: number;
 } | {
     kind: "brain.failover";
     version: 1;
@@ -217,6 +231,12 @@ export type TraceEvent = {
     estTokens: number;
     floor: number;
     ts: number;
+} | {
+    kind: "compaction.unevaluable";
+    version: 1;
+    taskId: string;
+    estTokens: number;
+    ts: number;
 } | {
     kind: "compaction.blocked";
     version: 1;

package/dist/core/types.d.ts

@@ -20,6 +20,7 @@ export interface Brain {
     complete?: CompleteSimpleFn;
 }
 export type ToolEffect = "read" | "write" | "idempotent";
+export type ToolContentOrigin = "external" | "execution" | "local";
 export interface ToolSpec<TParams extends TSchema = TSchema> {
     name: string;
     aliases?: string[];
@@ -30,6 +31,17 @@ export interface ToolSpec<TParams extends TSchema = TSchema> {
         name: string;
         description: string;
     }>;
+    agentToolFaces?: ReadonlyArray<{
+        name: string;
+        allowTools?: readonly string[];
+        denyTools?: readonly string[];
+        canRedelegate?: boolean;
+    }>;
+    agentToolPool?: ReadonlyArray<{
+        name: string;
+        aliases?: readonly string[];
+        contentOrigin?: ToolContentOrigin;
+    }>;
     approvalPreview?: (args: unknown) => unknown;
     agentModels?: readonly string[];
     withAgents?: (agents: ReadonlyArray<AgentDefinition>) => ToolSpec;
@@ -42,6 +54,7 @@ export interface ToolSpec<TParams extends TSchema = TSchema> {
     } | Promise<{
         reversible: boolean;
     }>;
+    contentOrigin?: ToolContentOrigin;
     executionMode?: "sequential" | "parallel";
     isConcurrencySafe?: (args: unknown) => boolean;
     parameters: TParams;
@@ -555,6 +568,7 @@ export type TaskEvent = ({
     output?: unknown;
     structured?: unknown;
     errorCode?: string;
+    settledBy?: import("./tool-policy.js").ApprovalSettledBy;
     truncated?: boolean;
     totalChars?: number;
 } & TaskEventIdentity) | ({
@@ -772,6 +786,7 @@ export interface RunnerDeps {
     checkpointStore?: import("./checkpoint-store.js").CheckpointStore;
     fileSnapshotStore?: import("./file-snapshot-store.js").FileSnapshotStore;
     sessionPolicyStore?: import("./session-policy-store.js").SessionPolicyStore;
+    permissionRuleStore?: import("./permission-rule-store.js").PermissionRuleStoreProvider;
     runtimeCapsResolver?: (principal: string | undefined) => RuntimeCaps | undefined | Promise<RuntimeCaps | undefined>;
     lockedConfig?: import("./locked-config.js").LockedConfig;
     compliancePostureResolver?: (principal: string | undefined) => import("./compliance.js").CompliancePosture | undefined | Promise<import("./compliance.js").CompliancePosture | undefined>;

package/dist/core/wiring-manifest.d.ts

@@ -43,6 +43,9 @@ export interface WiringManifest {
         backgroundAgentStore: boolean;
         hostChildEventSink: boolean;
     };
+    permissionRules: {
+        storeWired: boolean;
+    };
     governance: {
         audience: "operator";
         lockedConfig: boolean;
@@ -71,13 +74,14 @@ export interface WiringFacts {
     checkpointDurability?: StoreDurability;
     sessionDurability: StoreDurability;
     backgroundAgentStoreWired: boolean;
+    permissionRuleStoreWired: boolean;
     hostChildEventSinkWired: boolean;
     lockedConfigWired: boolean;
     complianceWired: boolean;
     memoryAdmissionWired: boolean;
     retentionPolicyWired: boolean;
 }
-export type StaticWiringDeps = Pick<RunnerDeps, "onAsk" | "onQuestion" | "interactionPosture" | "onElicit" | "checkpointStore" | "sessionStore" | "backgroundAgentStore" | "onBackgroundChildEvent" | "lockedConfig" | "compliancePostureResolver" | "memoryScopeAdmission" | "retentionPolicy">;
+export type StaticWiringDeps = Pick<RunnerDeps, "onAsk" | "onQuestion" | "interactionPosture" | "onElicit" | "checkpointStore" | "sessionStore" | "backgroundAgentStore" | "onBackgroundChildEvent" | "lockedConfig" | "compliancePostureResolver" | "memoryScopeAdmission" | "retentionPolicy" | "permissionRuleStore">;
 export type StaticWiringSpec = Pick<TaskSpec, "onAsk" | "onQuestion" | "checkpointStore" | "durableApproval" | "mcp" | "interactiveTools" | "interactionPosture">;
 export declare function resolveDeclaredDurability(store: {
     readonly durability?: StoreDurability;

package/dist/core/wiring-manifest.js

@@ -86,6 +86,7 @@ export function deriveWiringManifest(facts) {
         parkLane,
         session: { store: manifestDurabilityOf(facts.sessionDurability) },
         fleet: { backgroundAgentStore: facts.backgroundAgentStoreWired, hostChildEventSink: facts.hostChildEventSinkWired },
+        permissionRules: { storeWired: facts.permissionRuleStoreWired },
         governance: {
             audience: "operator",
             lockedConfig: facts.lockedConfigWired,
@@ -177,6 +178,7 @@ export function describeStaticWiring(deps, spec = {}) {
         ...(capable ? { checkpointDurability: resolveDeclaredDurability(checkpointStore, "checkpointStore") } : {}),
         sessionDurability: resolveDeclaredDurability(deps.sessionStore, "sessionStore"),
         backgroundAgentStoreWired: deps.backgroundAgentStore !== undefined,
+        permissionRuleStoreWired: deps.permissionRuleStore !== undefined,
         hostChildEventSinkWired: deps.onBackgroundChildEvent !== undefined,
         lockedConfigWired: deps.lockedConfig !== undefined,
         complianceWired: deps.compliancePostureResolver !== undefined,

package/dist/index.d.ts

@@ -122,14 +122,18 @@ export type { SchedulerCapability, SchedulerErrorCode, ScheduledIntent, Schedule
 export { createSchedulerTools, type SchedulerToolContext, SCHEDULE_WAKEUP_TOOL_NAME, AUTONOMOUS_LOOP_SENTINEL, AUTONOMOUS_LOOP_DYNAMIC_SENTINEL, } from "./tools/scheduler-tools.js";
 export { resolveAutonomousLoopPrompt, AUTONOMOUS_LOOP_PREAMBLE, AUTONOMOUS_LOOP_PREAMBLE_PERSISTENT, type AutonomousLoopPromptOptions, } from "./tools/loop-tick.js";
 export { tightenTaskSpec, TaskSpecTightenError } from "./core/tighten-task-spec.js";
-export { createAllowDenyPolicy, createApprovalPolicy, COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, findUnverifiableRecursiveDelete, combinePolicies, decisionText, resolveAsk, toolPolicyNameSets, type ToolPolicyNameSets, type NamedToolPolicy, type ToolPolicy, type ToolCallRequest, type PermissionResult, type DecisionReason, type OnAsk, type AskOutcome, type ResolvedAsk, type AskRequest, type AskDelegationProvenance, } from "./core/tool-policy.js";
+export { createAllowDenyPolicy, createApprovalPolicy, COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, findUnverifiableRecursiveDelete, combinePolicies, decisionText, resolveAsk, toolPolicyNameSets, type ToolPolicyNameSets, type NamedToolPolicy, type ToolPolicy, type ToolCallRequest, type PermissionResult, type DecisionReason, type ApprovalSettledBy, APPROVAL_SETTLED_BY_VALUES, isApprovalSettledBy, type OnAsk, type AskOutcome, type ResolvedAsk, type AskRequest, type AskDelegationProvenance, } from "./core/tool-policy.js";
 export { parseAutoModeResponse, createAutoModeDecider, type AutoModeVerdict, type AutoModeDecider, type AutoModeDeciderOptions, type AutoModeClassifyFn, type AutoModeClassifyInput, } from "./core/auto-mode.js";
 export { buildAutoModePrompt, renderAutoModeWindow, renderAutoModeAction, AUTO_MODE_DEFAULTS_SENTINEL, type AutoModeRules, type BuildAutoModePromptOptions, type AutoModeWindowOptions, } from "./core/auto-mode-prompt.js";
 export { AUTO_MODE_BASE_PROMPT, AUTO_MODE_PERMISSIONS_EXTERNAL } from "./core/auto-mode-prompt-assets.js";
 export { createPermissionRulePolicy, validatePermissionRules, parsePermissionRule, wildcardMatch, type PermissionRule, type ParsedPermissionRule, type PermissionRuleIssue, type PermissionRuleCaps, type PermissionRulePolicyOptions, } from "./core/permission-rules.js";
+export { parseAllowRuleText, formatAllowRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, type PersistedAllowRule, type RuleTombstone, type RuleScope, type RuleDot, type RuleAdd, type RuleAddOrigin, type RuleSuggestion, type RuleReject, type RuleRejectCode, type ParsedAllowRule, type PersistedRuleTool, type PersistedRuleMatch, } from "./core/permission-rule-model.js";
+export { removePersistedRule, applyTombstones, sameScope, InMemoryPermissionRuleStore, EMPTY_RULE_STORE, type PermissionRuleStore, type PermissionRuleStoreProvider, type StoredAllowRules, type RemoveResult, type PutResult, } from "./core/permission-rule-store.js";
+export { prepareCardApproval, confirmRuleApproval, type ConfirmResult, type ConfirmRefusalReason, redeemRuleTicket, redeemRuleBatch, prepareCcImport, prepareStarterBatch, mintRuleTicket, STARTER_RULES, InMemoryRuleApprovalRecordStore, type RuleTicket, type RuleCandidate, type RuleApprovalKind, type RuleApprovalRecord, type RuleApprovalRecordStore, type RuleConsentDeps, type RedeemResult, type CcImportLayer, type ImportedSettingsLayer, type ImportPreview, type ImportResult, } from "./core/permission-rule-consent.js";
+export { FilePermissionRuleStoreProvider } from "./stores/file/permission-rule-store.js";
 export { formatHookFeedback, runToolGate, createHookEnvCapabilities, type Hooks, type HookToolContext, type HookEnvCapabilities, type HookToolOutput, type PreToolUseResult, type PostToolUseResult, type UserPromptSubmitResult, type HookToolFailure, type PostToolUseFailureResult, type PostToolBatchCall, type PostToolBatchResult, type PreCompactContext, type PreCompactResult, type PostCompactContext, type StopFailureContext, type PermissionDeniedPayload, type PermissionDeniedSource, } from "./core/hooks.js";
 export { InMemoryMemoryStore, composeMemoryBlock, composeLayeredMemoryBlock, normalizeMemorySpec, type NormalizedMemorySpec, type MemorySpecInput, supportsConsolidation, supportsPeriodicConsolidation, firstSentence, expandLexicalTerms, lexicalSearchMatch, type Embedder, classifyPromotable, enforcePromotableWriteGate, guardedMemoryStore, MemoryGateError, detectSecret, enforceSecretWriteGate, enforceStructuredNoteSecretGate, type UtilityGate, type MemoryStore, type MemoryVectorMode, type ScoredMemory, type MemoryNoteHeader, type MemoryNoteRecord, type MemoryNoteType, type StructuredNoteInput, } from "./core/memory.js";
-export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, type MemoryBackendContractHooks, buildMemoryInstruction, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, type MemoryAnnouncement, type ScanFinding, type MemoryEngineOptions, type MemoryInjection, type MemoryBackend, type MemoryEntry, type MemoryEntryFrontmatter, type MemoryEntryHeader, type ScoredMemoryEntry, type NotePatch, type PatchReport, type MaterializedFile, type MemorySessionHandle, type HarvestReport, type HarvestRejection, type HarvestRejectionCode, type ParsedEntryFile, type ScannedEntryFile, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, type ParsedScopeKey, migrateScope, type MigrateScopeReport, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, type RemoteMemoryFile, type RemoteMemoryBaseline, type RemoteMaterialization, type RemoteHarvestResult, type InboundEntryFinding, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, type MemorySyncCursor, type MemorySyncConflict, type MemorySyncPlan, type RecallSource, syncMemoryScope, type MemorySyncTransport, type MemorySyncRequestBody, type MemorySyncResponseBody, type MemorySyncClientConflict, type SyncMemoryScopeOptions, type MemorySyncClientResult, } from "./core/memory-engine/index.js";
+export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, type MemoryBackendContractHooks, buildMemoryInstruction, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, type MemorySearchDetails, type MemorySearchHit, type MemoryGetDetails, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, type MemoryAnnouncement, type ScanFinding, type MemoryEngineOptions, type MemoryInjection, type MemoryBackend, type MemoryEntry, type MemoryEntryFrontmatter, type MemoryEntryHeader, type ScoredMemoryEntry, type NotePatch, type PatchReport, type MaterializedFile, type MemorySessionHandle, type HarvestReport, type HarvestRejection, type HarvestRejectionCode, type ParsedEntryFile, type ScannedEntryFile, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, type ParsedScopeKey, migrateScope, type MigrateScopeReport, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, type RemoteMemoryFile, type RemoteMemoryBaseline, type RemoteMaterialization, type RemoteHarvestResult, type InboundEntryFinding, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, type MemorySyncCursor, type MemorySyncConflict, type MemorySyncPlan, type RecallSource, syncMemoryScope, type MemorySyncTransport, type MemorySyncRequestBody, type MemorySyncResponseBody, type MemorySyncClientConflict, type SyncMemoryScopeOptions, type MemorySyncClientResult, } from "./core/memory-engine/index.js";
 export { SHARED_MEMORY_READ_CAP_BYTES, SHARED_MEMORY_LIST_PAGE_SIZE, SharedMemoryStoreError, type SharedMemoryStoreProvider, type SharedMemoryStoreReader, type SharedMemoryStoreInfo, type SharedMemoryDocumentEntry, type SharedMemorySnapshot, type SharedMemoryRequestContext, type MemoryListDetails, type MemoryReadDetails, } from "./core/shared-memory/types.js";
 export { sharedMemoryStoreContract, type SharedMemoryFixture, type SharedMemoryStoreContractHooks, } from "./core/shared-memory/contract.js";
 export { termSet, jaccardDistance, cosineDistance } from "./core/memory-vector.js";
@@ -218,7 +222,7 @@ export { retryBackoffMs, parseRetryAfter } from "./brain/retry.js";
 export { type BrainTimeoutConfig } from "./brain/timeout.js";
 export { createAssistantMessageEventStream } from "./internal/llm.js";
 export type { AssistantMessage, AssistantMessageEvent, CompleteSimpleFn, Context, DocumentContent, ImageContent, Message, StopReason, StreamFn, TextContent, ThinkingContent, ToolCall, ToolResultMessage, Usage, UserMessage, } from "./internal/llm.js";
-export type { AgentDefinition, BeforeWriteHook, BeforeWriteRequest, BeforeWriteResult, HandsBandOptions, Brain, BrainStatus, BrainStatusPhase, ImageInput, McpElicitRequest, McpElicitResponse, McpServerSpec, A2aServerSpec, OnElicit, Model, ModelRef, ProjectMemoryLoad, RunnerDeps, RuntimeCaps, BackgroundChildEvent, SkillManifest, SkillSpec, TaskEvent, TaskEventIdentity, ToolActivity, TaskLimits, StaleToolResultOffloadOptions, TaskResult, RemoteEnvFailureNote, TaskSpec, TaskStatus, TaskStream, CompactOutcome, ThinkingLevel, ToolExecuteContext, ToolReturn, ToolSpec, ToolEffect, WorkflowGovernanceBaseline, DelegationTaskType, } from "./core/types.js";
+export type { AgentDefinition, BeforeWriteHook, BeforeWriteRequest, BeforeWriteResult, HandsBandOptions, Brain, BrainStatus, BrainStatusPhase, ImageInput, McpElicitRequest, McpElicitResponse, McpServerSpec, A2aServerSpec, OnElicit, Model, ModelRef, ProjectMemoryLoad, RunnerDeps, RuntimeCaps, BackgroundChildEvent, SkillManifest, SkillSpec, TaskEvent, TaskEventIdentity, ToolActivity, TaskLimits, StaleToolResultOffloadOptions, TaskResult, RemoteEnvFailureNote, TaskSpec, TaskStatus, TaskStream, CompactOutcome, ThinkingLevel, ToolExecuteContext, ToolReturn, ToolSpec, ToolEffect, ToolContentOrigin, WorkflowGovernanceBaseline, DelegationTaskType, } from "./core/types.js";
 export { Type } from "typebox";
 export type { TSchema, Static } from "typebox";
 export { explainPromptAssembly, describeDefaultPack, type DefaultPackDescription, type ExplainInput } from "./prompt-assembly/explain.js";

package/dist/index.js

@@ -107,14 +107,18 @@ export { hasScheduler, isValidCronExpr, SchedulerError } from "./core/scheduler.
 export { createSchedulerTools, SCHEDULE_WAKEUP_TOOL_NAME, AUTONOMOUS_LOOP_SENTINEL, AUTONOMOUS_LOOP_DYNAMIC_SENTINEL, } from "./tools/scheduler-tools.js";
 export { resolveAutonomousLoopPrompt, AUTONOMOUS_LOOP_PREAMBLE, AUTONOMOUS_LOOP_PREAMBLE_PERSISTENT, } from "./tools/loop-tick.js";
 export { tightenTaskSpec, TaskSpecTightenError } from "./core/tighten-task-spec.js";
-export { createAllowDenyPolicy, createApprovalPolicy, COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, findUnverifiableRecursiveDelete, combinePolicies, decisionText, resolveAsk, toolPolicyNameSets, } from "./core/tool-policy.js";
+export { createAllowDenyPolicy, createApprovalPolicy, COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, findUnverifiableRecursiveDelete, combinePolicies, decisionText, resolveAsk, toolPolicyNameSets, APPROVAL_SETTLED_BY_VALUES, isApprovalSettledBy, } from "./core/tool-policy.js";
 export { parseAutoModeResponse, createAutoModeDecider, } from "./core/auto-mode.js";
 export { buildAutoModePrompt, renderAutoModeWindow, renderAutoModeAction, AUTO_MODE_DEFAULTS_SENTINEL, } from "./core/auto-mode-prompt.js";
 export { AUTO_MODE_BASE_PROMPT, AUTO_MODE_PERMISSIONS_EXTERNAL } from "./core/auto-mode-prompt-assets.js";
 export { createPermissionRulePolicy, validatePermissionRules, parsePermissionRule, wildcardMatch, } from "./core/permission-rules.js";
+export { parseAllowRuleText, formatAllowRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, } from "./core/permission-rule-model.js";
+export { removePersistedRule, applyTombstones, sameScope, InMemoryPermissionRuleStore, EMPTY_RULE_STORE, } from "./core/permission-rule-store.js";
+export { prepareCardApproval, confirmRuleApproval, redeemRuleTicket, redeemRuleBatch, prepareCcImport, prepareStarterBatch, mintRuleTicket, STARTER_RULES, InMemoryRuleApprovalRecordStore, } from "./core/permission-rule-consent.js";
+export { FilePermissionRuleStoreProvider } from "./stores/file/permission-rule-store.js";
 export { formatHookFeedback, runToolGate, createHookEnvCapabilities, } from "./core/hooks.js";
 export { InMemoryMemoryStore, composeMemoryBlock, composeLayeredMemoryBlock, normalizeMemorySpec, supportsConsolidation, supportsPeriodicConsolidation, firstSentence, expandLexicalTerms, lexicalSearchMatch, classifyPromotable, enforcePromotableWriteGate, guardedMemoryStore, MemoryGateError, detectSecret, enforceSecretWriteGate, enforceStructuredNoteSecretGate, } from "./core/memory.js";
-export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, buildMemoryInstruction, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, migrateScope, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, syncMemoryScope, } from "./core/memory-engine/index.js";
+export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, buildMemoryInstruction, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, migrateScope, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, syncMemoryScope, } from "./core/memory-engine/index.js";
 export { SHARED_MEMORY_READ_CAP_BYTES, SHARED_MEMORY_LIST_PAGE_SIZE, SharedMemoryStoreError, } from "./core/shared-memory/types.js";
 export { sharedMemoryStoreContract, } from "./core/shared-memory/contract.js";
 export { termSet, jaccardDistance, cosineDistance } from "./core/memory-vector.js";

package/dist/stores/file/permission-rule-store.d.ts

@@ -0,0 +1,32 @@
+import type { PermissionRuleStore, PermissionRuleStoreProvider, PermissionRuleWriter, StoredAllowRules, WritablePermissionRuleStore } from "../../core/permission-rule-store.js";
+import { PERMISSION_RULE_WRITER } from "../../core/permission-rule-store.js";
+import type { StoreDurability, StoreFidelity } from "../../core/checkpoint-store.js";
+declare class FilePermissionRuleStore implements WritablePermissionRuleStore {
+    private readonly dir;
+    private readonly file;
+    private readonly acquireWriteLock;
+    private readonly onError?;
+    readonly durability: StoreDurability;
+    readonly fidelity: StoreFidelity;
+    constructor(dir: string, file: string, acquireWriteLock: () => void, onError?: ((message: string) => void) | undefined);
+    private read;
+    private disclose;
+    private write;
+    list(): Promise<StoredAllowRules>;
+    private current;
+    private writeAndVerify;
+    private writeChain;
+    private serialize;
+    get [PERMISSION_RULE_WRITER](): PermissionRuleWriter;
+    private readonly writer;
+}
+export declare class FilePermissionRuleStoreProvider implements PermissionRuleStoreProvider {
+    private readonly dir;
+    private readonly onError?;
+    private lock;
+    constructor(dir: string, onError?: ((message: string) => void) | undefined);
+    private acquireWriteLock;
+    forPrincipal(principal: string | undefined): PermissionRuleStore;
+    dispose(): void;
+}
+export type { FilePermissionRuleStore };