@sema-agent/core 5.18.1 → 5.19.0

package/CHANGELOG.md

@@ -1,5 +1,60 @@
 # Changelog
 
+## 5.19.0 — 2026-08-10
+
+> Three bundles, each pre-verified two-way by the evaluation line against the 5.18.1 artifact
+> before this release (criteria [3134], green-lit [3146]).
+
+### BREAKING
+
+- **A task's PreToolUse screening face now screens its DELEGATED CHILDREN** (issue #33). The
+  face used to run only in the gate of the task that installed it, so a call it denied executed
+  unrefused one level down — sync, background and workflow legs alike, at any depth. It now
+  folds into a ToolPolicy on the existing ancestor-constraint chain (full-installation identity,
+  four-axis dedup so a deps-level hook is consulted once per call at any depth). A screening
+  `ask` resolves at the installing task's frozen approver; a hook-wired parent with no approver
+  denies its children's screened calls fail-closed.
+  **Operational**: `parentConstraintCount` gains a screening entry for hook-wired trees — a
+  pending approval checkpoint minted before this change and resumed after (or the reverse)
+  fails pre-CAS with `resume.parent_constraint_mismatch`. **Drain pending checkpoints across
+  the upgrade.** A delegated child of a hook-wired parent also sets
+  `requiresParentConstraint`, so its durable resume must re-supply the chain via
+  `resumeStream(..., internals)`.
+- **Write guards judge the call's live cwd** (P1, host-lane proven bypass). A resident shell's
+  `cd` moved what a relative Write/Edit/NotebookEdit target meant, while the guards kept
+  judging the wiring-time root — `cd .git/hooks` + `Write("pre-commit")` landed unrefused.
+  Every path-resolving guard (sensitive-path, fs-write-gate, session-rule allowDirs,
+  active-skill allowPaths, transcript-integrity, run-spec frozen deny) now resolves the target
+  against `ToolCallRequest.cwd`, stamped per call from the same tracked cwd the tools resolve
+  with. **The asymmetry is deliberate**: the target follows the live cwd; each guard's own
+  configured directories stay anchored to the static root, so a `cd` cannot relocate the fence
+  itself. Absent the stamp (direct invocation), every guard falls back to its configured root —
+  byte-identical prior behavior. Also newly asked: a non-read-only Bash whose cwd sits inside
+  the transcript directory, and a POSIX filename containing a backslash (fail-closed).
+  Registered, not fixed: bash builtin writes, hook `touchedPaths`, the shell-operand axis
+  (backlog #108 notes).
+
+### Fixed
+
+- **Read-only shell classification (`shellGate:"classify"`) prompts less and is more accurate
+  in both directions.** The compound splitter carries quote state, so a quoted connector —
+  `grep -E "a|b"`, the ordinary spelling of a read-only monitoring pipeline — is argument text
+  rather than a phantom command boundary; `2>/dev/null` and output-descriptor fd duplication
+  are recognized as moving no data into any file. No widening: every other redirection form
+  still rejects, unbalanced quoting falls back to the stricter blind scan, and phantom segments
+  could only ever add a rejection. Also tightened in the demoting direction: operand counts now
+  match what bash passes, so stdin-reading forms that would hang (`grep "a | b"`,
+  `cut -d , -f1`, `grep -if-`, `grep -f/dev/zero`) no longer auto-allow.
+
+### Guards / tooling (no behavior surface)
+
+- `scripts/ship-post-lint.mjs`: release-post commit references are ancestry-verified against
+  the release, and negative claims get the real two-version dist delta to be written against.
+- A brain silent-recovery-arm ratchet freezes the 26 existing tell-nobody arms so a new one has
+  to be argued for; the delegation carriage surfaces (live chain, constraint entry, checkpoint
+  projection) are exhaustively registered so a new field stops compiling until its travel is
+  recorded.
+
 ## 5.18.1 — 2026-08-10
 
 > The 5.18.0 post-release verification round, folded back in. Every surface below was

package/dist/core/fs-write-gate-policy.js

@@ -15,7 +15,7 @@ export function createFsWriteGatePolicy(opts) {
             if (path === undefined) {
                 return ask(`write tool "${req.toolName}" requires approval: the call has no resolvable path target to confine`);
             }
-            const canon = await canonicalizeTarget(env, path, signal, rootPath);
+            const canon = await canonicalizeTarget(env, path, signal, req.cwd ?? rootPath);
             if (!canon.ok) {
                 return ask(`write to "${path}" requires approval: its real target could not be resolved (${canon.message})`);
             }

package/dist/core/hooks.d.ts

@@ -1,6 +1,6 @@
 import type { DocumentContent, ImageContent, TextContent } from "../internal/llm.js";
 import type { ExecutionEnv, FileError, Result, SessionTreeEntry } from "../internal/harness-types.js";
-import type { PermissionResult, ResolvedAsk, ToolCallRequest } from "./tool-policy.js";
+import type { PermissionResult, ResolvedAsk, ToolCallRequest, ToolPolicy } from "./tool-policy.js";
 export interface Hooks {
     preToolUse?(toolName: string, input: unknown, ctx: HookToolContext): PreToolUseResult | undefined | Promise<PreToolUseResult | undefined>;
     postToolUse?(toolName: string, input: unknown, output: HookToolOutput, ctx: HookToolContext): PostToolUseResult | undefined | Promise<PostToolUseResult | undefined>;
@@ -165,4 +165,5 @@ export interface ToolGateInput {
         }) => void;
     };
 }
+export declare function createPreToolUseConstraintPolicy(preToolUse: NonNullable<Hooks["preToolUse"]>, env?: HookEnvCapabilities, onCrash?: (err: unknown) => void): ToolPolicy;
 export declare function runToolGate(input: ToolGateInput): Promise<ToolGateResult>;

package/dist/core/hooks.js

@@ -98,6 +98,38 @@ function screenPreToolUseResult(r) {
         return undefined;
     return refuseOutOfContractDecision(r);
 }
+export function createPreToolUseConstraintPolicy(preToolUse, env, onCrash) {
+    return {
+        check: async (req) => {
+            let r;
+            try {
+                r = screenPreToolUseResult(await preToolUse(req.toolName, req.args, { toolCallId: req.toolCallId, toolName: req.toolName, ...(env !== undefined ? { env } : {}) }));
+            }
+            catch (err) {
+                try {
+                    onCrash?.(err);
+                }
+                catch {
+                }
+                return { action: "deny", message: preToolUseCrashReason(`this call to "${req.toolName}"`, err), decisionReason: "hook" };
+            }
+            if (r === undefined)
+                return { action: "allow" };
+            if (r.action === "deny") {
+                return { action: "deny", message: decisionText(r) ?? `tool "${req.toolName}" blocked by a PreToolUse hook`, decisionReason: "hook" };
+            }
+            if (r.action === "ask") {
+                return {
+                    action: "ask",
+                    message: decisionText(r) ?? `approval required for "${req.toolName}" (inherited PreToolUse hook)`,
+                    decisionReason: "hook",
+                    ...(r.updatedInput !== undefined ? { updatedInput: r.updatedInput } : {}),
+                };
+            }
+            return r.updatedInput !== undefined ? { action: "allow", updatedInput: r.updatedInput } : { action: "allow" };
+        },
+    };
+}
 function traceHookCrash(input, err, notifier) {
     notifier.notify(() => input.onHookError?.(err), "toolGate.onHookError");
 }

package/dist/core/runner/active-skill-scope.js

@@ -96,7 +96,7 @@ export function createActiveSkillScopePolicy(opts) {
                             decisionReason: "safety",
                         };
                     }
-                    const canon = await canonicalizeTarget(env, path, signal, rootPath);
+                    const canon = await canonicalizeTarget(env, path, signal, req.cwd ?? rootPath);
                     if (!canon.ok) {
                         return {
                             action: "deny",

package/dist/core/runner/prepare-task.d.ts

@@ -10,6 +10,7 @@ import { SubagentRetainLedger } from "../../agents/retain-ledger.js";
 import type { OnAsk, ToolPolicy } from "../tool-policy.js";
 import { type ActiveSkillFrame } from "./active-skill-scope.js";
 import type { SessionPermissionRules } from "../session-policy-store.js";
+import { type Hooks } from "../hooks.js";
 import { type RecoveredOrphan } from "../session-reconcile.js";
 import { CacheBreakDetector, type ToolFingerprintInput } from "../cache-break-detector.js";
 import { type BrainCallGuardrailRef } from "../../brain/timeout.js";
@@ -330,6 +331,8 @@ export interface InheritedGate {
         policy: ToolPolicy;
         onAsk?: OnAsk;
         durableMandate?: boolean;
+        preToolUse?: Hooks["preToolUse"];
+        hookEnv?: unknown;
     }>;
 }
 export declare function isFableFamilyModelId(id: string): boolean;

package/dist/core/runner/prepare-task.js

@@ -28,7 +28,7 @@ import { CHANGED_FILES_MTIME_EPS_MS, fenceMcpServerInstructions, renderAgentList
 import { inlineUntrusted } from "../untrusted-text.js";
 import { emitTrace } from "../trace.js";
 import { createSessionRulePolicy } from "./session-rule-policy.js";
-import { cloneObserverInput, createHookEnvCapabilities, formatHookFeedback, runToolGate } from "../hooks.js";
+import { cloneObserverInput, createHookEnvCapabilities, createPreToolUseConstraintPolicy, formatHookFeedback, runToolGate } from "../hooks.js";
 import { reconcileInterruptedSession } from "../session-reconcile.js";
 import { CacheBreakDetector, toolsToFingerprintInputs } from "../cache-break-detector.js";
 import { reservedCollisions, reservedFor } from "../../brain/request-params.js";
@@ -1057,6 +1057,14 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         const ownOrgVerdictRef = { current: undefined };
         const orgAdmissionCheckpointState = () => inheritedAdmittedOrgScopes !== undefined || ownOrgVerdictRef.current !== undefined || orgGovernedProvenance;
         const frozenOnAsk = spec.onAsk ?? deps.onAsk;
+        const hookEnvSource = (ownedEnv ?? deps.executionEnv) != null ? executionEnv : undefined;
+        const notifyOwnHookCrash = (err) => {
+            try {
+                deps.onError?.(err instanceof Error ? err : new Error(String(err)), { phase: "hook", sessionId });
+            }
+            catch {
+            }
+        };
         const frozenOnQuestion = spec.onQuestion ?? deps.onQuestion;
         const inheritedGateForChildren = () => {
             const ancestorRules = [
@@ -1066,8 +1074,25 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             const ownCallerPolicy = lockedPreflight.toolPolicy;
             const durableMandate = runtimeCaps?.forceDurableGate === true ||
                 (spec.durableApproval !== undefined && !isLiveApproverSeat(frozenOnAsk));
+            const ownPreToolUse = hooks?.preToolUse;
+            const hookConstraint = ownPreToolUse !== undefined &&
+                !(inheritedParentConstraints ?? []).some((pc) => pc.preToolUse === ownPreToolUse &&
+                    askApproverIdentity(pc.onAsk) === askApproverIdentity(frozenOnAsk) &&
+                    (pc.durableMandate === true) === durableMandate &&
+                    pc.hookEnv === hookEnvSource)
+                ? [
+                    {
+                        policy: createPreToolUseConstraintPolicy(ownPreToolUse, hookEnvFace, notifyOwnHookCrash),
+                        preToolUse: ownPreToolUse,
+                        ...(hookEnvSource !== undefined ? { hookEnv: hookEnvSource } : {}),
+                        ...(frozenOnAsk !== undefined ? { onAsk: frozenOnAsk } : {}),
+                        ...(durableMandate ? { durableMandate: true } : {}),
+                    },
+                ]
+                : [];
             const parentConstraints = [
                 ...(inheritedParentConstraints ?? []),
+                ...hookConstraint,
                 ...(ownCallerPolicy !== undefined
                     ? [
                         {
@@ -2920,6 +2945,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             auditPolicyNames(layer);
         const denyNarrowingPolicy = narrowingLayers.length === 0 ? undefined : narrowingLayers.length === 1 ? narrowingLayers[0] : combinePolicies(...narrowingLayers);
         const basePolicyForResumeEdit = lockedPreflight.toolPolicy;
+        const hooks = spec.hooks ?? deps.hooks;
         const sameInstanceAncestorCount = policy === undefined ? 0 : (inheritedParentConstraints ?? []).reduce((n, pc) => (pc.policy === policy ? n + 1 : n), 0);
         const sharedFirstDecision = new Map();
         const SHARED_FIRST_DECISION_CAP = 256;
@@ -3067,125 +3093,133 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 editArgs = rr.updatedInput;
             }
         };
-        const parentConstraintWrappers = (inheritedParentConstraints ?? []).map((pc) => policy !== undefined && pc.policy === policy
-            ? {
-                check: async (creq, csignal) => {
-                    const first = sharedFirstDecision.get(creq.toolCallId);
-                    if (first === undefined) {
-                        return {
-                            action: "deny",
-                            message: `inherited parent policy could not be arbitrated for "${creq.toolName}" ` +
-                                `(shared-instance first decision unavailable); denied fail-closed`,
-                        };
-                    }
-                    if (first.action === "deny")
-                        return first;
-                    if (first.action === "allow")
-                        return { action: "allow" };
-                    if (creq.toolName === ASK_USER_QUESTION_TOOL_NAME && (pc.durableMandate !== true || markInheritedUnavailable(creq.toolCallId))) {
-                        return first;
-                    }
-                    if (pc.durableMandate === true) {
-                        if (resolveCheckpointStore(spec, deps) !== undefined &&
-                            (spec.durableApproval !== undefined || runtimeCaps?.forceDurableGate === true) &&
-                            markInheritedUnavailable(creq.toolCallId)) {
-                            return first;
+        const parentConstraintWrappers = (inheritedParentConstraints ?? []).map((pc) => pc.preToolUse !== undefined &&
+            pc.preToolUse === hooks?.preToolUse &&
+            pc.durableMandate !== true &&
+            askApproverIdentity(pc.onAsk) === askApproverIdentity(frozenOnAsk) &&
+            pc.hookEnv === hookEnvSource
+            ? { check: () => ({ action: "allow" }) }
+            : policy !== undefined && pc.policy === policy
+                ? {
+                    check: async (creq, csignal) => {
+                        const first = sharedFirstDecision.get(creq.toolCallId);
+                        if (first === undefined) {
+                            return {
+                                action: "deny",
+                                message: `inherited parent policy could not be arbitrated for "${creq.toolName}" ` +
+                                    `(shared-instance first decision unavailable); denied fail-closed`,
+                            };
                         }
-                        return {
-                            action: "deny",
-                            message: `inherited parent policy requires durable approval for "${creq.toolName}" — the parent's durable ` +
-                                `ask cannot be reconstructed in a delegated child; denied fail-closed (tighten-only)`,
-                        };
-                    }
-                    const presentedArgs = creq.args;
-                    const askT0 = now();
-                    const resolved = await resolveAsk({
-                        toolName: creq.toolName,
-                        toolCallId: creq.toolCallId,
-                        args: presentedArgs,
-                        ...ruleSuggestionsOf(creq.toolName, presentedArgs),
-                        message: first.message ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
-                        ...askSourceIdentity(),
-                        ...riskAxesOf(creq.toolName),
-                        ...(first.action === "ask" && first.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
-                    }, pc.onAsk, csignal ?? abortController.signal);
-                    const askWaitMs = Math.max(0, now() - askT0);
-                    if (resolved.action === "deny" && resolved.approverUnavailable === true) {
-                        if (markInheritedUnavailable(creq.toolCallId))
+                        if (first.action === "deny")
+                            return first;
+                        if (first.action === "allow")
+                            return { action: "allow" };
+                        if (creq.toolName === ASK_USER_QUESTION_TOOL_NAME && (pc.durableMandate !== true || markInheritedUnavailable(creq.toolCallId))) {
                             return first;
-                        return {
-                            action: "deny",
-                            message: `no approver is reachable for the inherited approval of "${creq.toolName}" and the marker channel is at capacity — denied fail-closed`,
-                        };
-                    }
-                    if (resolved.action !== "allow")
-                        return resolved;
-                    if (resolved.updatedInput !== undefined) {
-                        return recheckApprovedEdit(pc.policy, pc.onAsk, creq, resolved.updatedInput, csignal);
-                    }
-                    recordInheritedAskGrant(creq.toolCallId, pc.onAsk, resolved.presentedInput, askWaitMs);
-                    return { action: "allow" };
-                },
-            }
-            : {
-                check: async (creq, csignal) => {
-                    let decision;
-                    try {
-                        decision = await pc.policy.check(creq, csignal ?? abortController.signal);
-                    }
-                    catch (err) {
-                        return {
-                            action: "deny",
-                            message: `inherited parent policy errored for "${creq.toolName}": ${err instanceof Error ? err.message : String(err)}`,
-                        };
-                    }
-                    if (decision.action !== "ask")
-                        return decision;
-                    if (creq.toolName === ASK_USER_QUESTION_TOOL_NAME && (pc.durableMandate !== true || markInheritedUnavailable(creq.toolCallId))) {
-                        return decision;
-                    }
-                    if (pc.durableMandate === true) {
-                        if (resolveCheckpointStore(spec, deps) !== undefined &&
-                            (spec.durableApproval !== undefined || runtimeCaps?.forceDurableGate === true) &&
-                            markInheritedUnavailable(creq.toolCallId)) {
-                            return decision;
                         }
-                        return {
-                            action: "deny",
-                            message: `inherited parent policy requires durable approval for "${creq.toolName}" — the parent's durable ` +
-                                `ask cannot be reconstructed in a delegated child; denied fail-closed (tighten-only)`,
-                        };
-                    }
-                    const presentedArgs = decision.updatedInput !== undefined ? decision.updatedInput : creq.args;
-                    const askT0 = now();
-                    const resolved = await resolveAsk({
-                        toolName: creq.toolName,
-                        toolCallId: creq.toolCallId,
-                        args: presentedArgs,
-                        ...ruleSuggestionsOf(creq.toolName, presentedArgs),
-                        message: decision.message ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
-                        ...askSourceIdentity(),
-                        ...riskAxesOf(creq.toolName),
-                        ...(decision.action === "ask" && decision.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
-                    }, pc.onAsk, csignal ?? abortController.signal);
-                    const askWaitMs = Math.max(0, now() - askT0);
-                    if (resolved.action === "deny" && resolved.approverUnavailable === true) {
-                        if (markInheritedUnavailable(creq.toolCallId))
+                        if (pc.durableMandate === true) {
+                            if (resolveCheckpointStore(spec, deps) !== undefined &&
+                                (spec.durableApproval !== undefined || runtimeCaps?.forceDurableGate === true) &&
+                                markInheritedUnavailable(creq.toolCallId)) {
+                                return first;
+                            }
+                            return {
+                                action: "deny",
+                                message: `inherited parent policy requires durable approval for "${creq.toolName}" — the parent's durable ` +
+                                    `ask cannot be reconstructed in a delegated child; denied fail-closed (tighten-only)`,
+                            };
+                        }
+                        const presentedArgs = creq.args;
+                        const askT0 = now();
+                        const resolved = await resolveAsk({
+                            toolName: creq.toolName,
+                            toolCallId: creq.toolCallId,
+                            args: presentedArgs,
+                            ...ruleSuggestionsOf(creq.toolName, presentedArgs),
+                            message: first.message ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
+                            ...askSourceIdentity(),
+                            ...riskAxesOf(creq.toolName),
+                            ...(first.action === "ask" && first.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
+                        }, pc.onAsk, csignal ?? abortController.signal);
+                        const askWaitMs = Math.max(0, now() - askT0);
+                        if (resolved.action === "deny" && resolved.approverUnavailable === true) {
+                            if (markInheritedUnavailable(creq.toolCallId))
+                                return first;
+                            return {
+                                action: "deny",
+                                message: `no approver is reachable for the inherited approval of "${creq.toolName}" and the marker channel is at capacity — denied fail-closed`,
+                            };
+                        }
+                        if (resolved.action !== "allow")
+                            return resolved;
+                        if (resolved.updatedInput !== undefined) {
+                            return recheckApprovedEdit(pc.policy, pc.onAsk, creq, resolved.updatedInput, csignal);
+                        }
+                        recordInheritedAskGrant(creq.toolCallId, pc.onAsk, resolved.presentedInput, askWaitMs);
+                        return { action: "allow" };
+                    },
+                }
+                : {
+                    check: async (creq, csignal) => {
+                        let decision;
+                        try {
+                            decision = await pc.policy.check(creq, csignal ?? abortController.signal);
+                        }
+                        catch (err) {
+                            return {
+                                action: "deny",
+                                message: `inherited parent policy errored for "${creq.toolName}": ${err instanceof Error ? err.message : String(err)}`,
+                            };
+                        }
+                        if (decision.action !== "ask")
                             return decision;
-                        return {
-                            action: "deny",
-                            message: `no approver is reachable for the inherited approval of "${creq.toolName}" and the marker channel is at capacity — denied fail-closed`,
-                        };
-                    }
-                    if (resolved.action !== "allow")
-                        return resolved;
-                    if (resolved.updatedInput !== undefined) {
-                        return recheckApprovedEdit(pc.policy, pc.onAsk, creq, resolved.updatedInput, csignal);
-                    }
-                    recordInheritedAskGrant(creq.toolCallId, pc.onAsk, resolved.presentedInput, askWaitMs);
-                    return decision.updatedInput !== undefined ? { ...resolved, updatedInput: decision.updatedInput } : resolved;
-                },
-            });
+                        if (creq.toolName === ASK_USER_QUESTION_TOOL_NAME && (pc.durableMandate !== true || markInheritedUnavailable(creq.toolCallId))) {
+                            return decision;
+                        }
+                        if (pc.durableMandate === true) {
+                            if (resolveCheckpointStore(spec, deps) !== undefined &&
+                                (spec.durableApproval !== undefined || runtimeCaps?.forceDurableGate === true) &&
+                                markInheritedUnavailable(creq.toolCallId)) {
+                                return decision;
+                            }
+                            return {
+                                action: "deny",
+                                message: `inherited parent policy requires durable approval for "${creq.toolName}" — the parent's durable ` +
+                                    `ask cannot be reconstructed in a delegated child; denied fail-closed (tighten-only)`,
+                            };
+                        }
+                        const presentedArgs = decision.updatedInput !== undefined ? decision.updatedInput : creq.args;
+                        const askT0 = now();
+                        const resolved = await resolveAsk({
+                            toolName: creq.toolName,
+                            toolCallId: creq.toolCallId,
+                            args: presentedArgs,
+                            ...ruleSuggestionsOf(creq.toolName, presentedArgs),
+                            message: decision.message ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
+                            ...askSourceIdentity(),
+                            ...riskAxesOf(creq.toolName),
+                            ...(decision.action === "ask" && decision.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
+                        }, pc.onAsk, csignal ?? abortController.signal);
+                        const askWaitMs = Math.max(0, now() - askT0);
+                        if (resolved.action === "deny" && resolved.approverUnavailable === true) {
+                            if (markInheritedUnavailable(creq.toolCallId))
+                                return decision;
+                            return {
+                                action: "deny",
+                                message: `no approver is reachable for the inherited approval of "${creq.toolName}" and the marker channel is at capacity — denied fail-closed`,
+                            };
+                        }
+                        if (resolved.action !== "allow")
+                            return resolved;
+                        if (resolved.updatedInput !== undefined) {
+                            return recheckApprovedEdit(pc.policy, pc.onAsk, creq, resolved.updatedInput, csignal);
+                        }
+                        if (pc.preToolUse === undefined) {
+                            recordInheritedAskGrant(creq.toolCallId, pc.onAsk, resolved.presentedInput, askWaitMs);
+                        }
+                        return decision.updatedInput !== undefined ? { ...resolved, updatedInput: decision.updatedInput } : resolved;
+                    },
+                });
         const rewriteCapableLayers = policy !== undefined || parentConstraintWrappers.length > 0;
         const rewriteEmitterIndex = new Map();
         const rewriteCapableChain = [
@@ -3269,7 +3303,6 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 },
             }
             : foldedPolicy;
-        const hooks = spec.hooks ?? deps.hooks;
         const onAsk = spec.onAsk ?? deps.onAsk;
         const handWriteTools = handsEnabled && spec.handsReadOnly !== true
             ? Object.keys(HAND_TOOL_EFFECTS).filter((name) => {
@@ -3391,7 +3424,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         const hookEnvFace = hookContextConsumerWired && (ownedEnv ?? deps.executionEnv) != null ? createHookEnvCapabilities(executionEnv) : undefined;
         if (effectivePolicy || hooks?.preToolUse || egressTools.size > 0 || irreversibleTools.size > 0 || resourceSuspendEligible || platformSuspendArmed || spec.enablePlanMode === true) {
             const adjudicate = effectivePolicy
-                ? (req) => raceAbort(Promise.resolve(effectivePolicy.check({ ...req, budget: budgetSnapshot }, abortController.signal)), abortController.signal, () => ({
+                ? (req) => raceAbort(Promise.resolve(effectivePolicy.check({ ...req, budget: budgetSnapshot, ...(handsCwdRef !== undefined ? { cwd: handsCwdRef.current } : {}) }, abortController.signal)), abortController.signal, () => ({
                     action: "deny",
                     message: "policy check aborted (task timed out or cancelled)",
                 }))
@@ -3918,7 +3951,12 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             if (!presented.ok) {
                                 throw new ParkRefusal(`the stored form of "${req.toolName}"'s arguments could not be presented for re-adjudication (${describeThrown(presented.cause)})`, { cause: presented.cause });
                             }
-                            const reprojected = refuseOutOfContractDecision(await basePolicyForResumeEdit.check({ toolName: req.toolName, args: presented.value, toolCallId: req.toolCallId }, abortController.signal));
+                            const reprojected = refuseOutOfContractDecision(await basePolicyForResumeEdit.check({
+                                toolName: req.toolName,
+                                args: presented.value,
+                                toolCallId: req.toolCallId,
+                                ...(handsCwdRef !== undefined ? { cwd: handsCwdRef.current } : {}),
+                            }, abortController.signal));
                             const demanded = reprojected.updatedInput !== undefined ? tryCloneArgs(reprojected.updatedInput) : undefined;
                             const rewroteTheFiledValue = reprojected.updatedInput !== undefined &&
                                 !(demanded?.ok === true &&

package/dist/core/runner/runtask.js

@@ -3853,7 +3853,12 @@ export class Runner {
             throw new CheckpointError("checkpoint.invalid_outcome", `pending action reached the resolver with decision "${String(outcome.decision)}" — only "allow" executes and only "deny" injects a denial; refusing to execute`);
         }
         if (outcome.decision === "allow" && outcome.updatedInput !== undefined && prepared.basePolicyForResumeEdit) {
-            const rechecked = refuseOutOfContractDecision(await prepared.basePolicyForResumeEdit.check({ toolName: pendingAction.toolName, args: resolvedArgs, toolCallId: pendingAction.toolCallId }, prepared.abortController.signal));
+            const rechecked = refuseOutOfContractDecision(await prepared.basePolicyForResumeEdit.check({
+                toolName: pendingAction.toolName,
+                args: resolvedArgs,
+                toolCallId: pendingAction.toolCallId,
+                ...(prepared.cwdRef !== undefined ? { cwd: prepared.cwdRef.current } : {}),
+            }, prepared.abortController.signal));
             if (rechecked.action === "deny") {
                 const editedDenial = formatHookFeedback(`The approver EDITED this call's input; the edited call is denied by the deployment's tool policy and was not executed${rechecked.message ? `: ${rechecked.message}` : ""}.`);
                 emitEnd(true, { content: editedDenial });
@@ -3863,7 +3868,12 @@ export class Runner {
             }
         }
         if (prepared.denyNarrowingPolicy) {
-            const narrowed = refuseOutOfContractDecision(await prepared.denyNarrowingPolicy.check({ toolName: pendingAction.toolName, args: resolvedArgs, toolCallId: pendingAction.toolCallId }, prepared.abortController.signal));
+            const narrowed = refuseOutOfContractDecision(await prepared.denyNarrowingPolicy.check({
+                toolName: pendingAction.toolName,
+                args: resolvedArgs,
+                toolCallId: pendingAction.toolCallId,
+                ...(prepared.cwdRef !== undefined ? { cwd: prepared.cwdRef.current } : {}),
+            }, prepared.abortController.signal));
             if (narrowed.action === "deny") {
                 const narrowedDenial = formatHookFeedback(`The approved tool call "${pendingAction.toolName}" is now denied by a session rule and was not executed${narrowed.message ? `: ${narrowed.message}` : ""}.`);
                 emitEnd(true, { content: narrowedDenial });

package/dist/core/runner/session-rule-policy.js

@@ -58,7 +58,7 @@ export function createSessionRulePolicy(rules, opts) {
                     if (typeof path !== "string" || path.length === 0) {
                         return deny(`write tool "${req.toolName}" denied: session rule confines writes to allowDirs but the call has no resolvable path`);
                     }
-                    const canon = await canonicalizeTarget(env, path, signal, rootPath);
+                    const canon = await canonicalizeTarget(env, path, signal, req.cwd ?? rootPath);
                     if (!canon.ok) {
                         return deny(`write to "${path}" denied: its real target could not be resolved against the session-rule allowDirs`);
                     }

package/dist/core/sensitive-path-policy.js

@@ -64,7 +64,7 @@ export function createSensitivePathPolicy(opts) {
             const path = writeTargetPath(canonical, req.args);
             if (typeof path !== "string" || path.length === 0)
                 return { action: "allow" };
-            const canon = await canonicalizeTarget(opts.env, path, signal, opts.rootPath);
+            const canon = await canonicalizeTarget(opts.env, path, signal, req.cwd ?? opts.rootPath);
             if (!canon.ok) {
                 if (canon.unresolvedSymlink) {
                     return {

package/dist/core/tool-policy.d.ts

@@ -2,6 +2,7 @@ export interface ToolCallRequest {
     toolName: string;
     args: unknown;
     toolCallId: string;
+    cwd?: string;
     budget?: {
         resourceRemainingMicroUsd?: number;
         resourceSpentMicroUsd: number;

package/dist/core/tool-policy.js

@@ -1,10 +1,10 @@
 import { homedir } from "node:os";
-import { isAbsolute, join, normalize as normalizePath, sep } from "node:path";
+import { join, normalize as normalizePath, posix as posixPath, sep, win32 as winPath } from "node:path";
 import { BASH_READONLY_DEFAULT_ALLOW, parseLeadingCommandName } from "../tools/fs/index.js";
 import { boundInputHashOf } from "./canonical-json.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 import { parsePermissionRule } from "./permission-rules.js";
-import { writeTargetPath } from "../tools/fs/safety.js";
+import { isAbsolutePathForm, isWinFormPath, writeTargetPath } from "../tools/fs/safety.js";
 export const APPROVAL_SETTLED_BY_VALUES = ["human", "timeout", "aborted"];
 export function isApprovalSettledBy(v) {
     return typeof v === "string" && APPROVAL_SETTLED_BY_VALUES.includes(v);
@@ -526,13 +526,16 @@ export function createTranscriptIntegrityPolicy(opts) {
     const readAllow = new Set(opts?.readAllow ?? BASH_READONLY_DEFAULT_ALLOW);
     const shellTools = canonicalToolNameSet(opts?.tools);
     const dirSegs = dirs.map((d) => pathSegments(d).map(foldPathCase));
-    const inProtectedDir = (p) => {
-        const abs = lexicalPath(p, home);
+    const inProtectedDir = (p, liveCwd) => {
+        const rawRelative = !isAbsolutePathForm(p);
+        const joinInFamily = (base, rel) => isWinFormPath(base) ? winPath.join(base, rel) : posixPath.join(base, rel);
+        const abs = liveCwd !== undefined && rawRelative ? lexicalPath(joinInFamily(liveCwd, p), home) : lexicalPath(p, home);
         const segs = pathSegments(abs).map(foldPathCase);
-        if (isAbsolute(abs)) {
-            return dirSegs.some((d) => d.length <= segs.length && d.every((s, i) => s === segs[i]));
-        }
-        return dirSegs.some((d) => relativeContinuesDirTail(segs, d));
+        if (isAbsolutePathForm(abs) && dirSegs.some((d) => d.length <= segs.length && d.every((s, i) => s === segs[i])))
+            return true;
+        if (!rawRelative)
+            return false;
+        return dirSegs.some((d) => relativeContinuesDirTail(pathSegments(lexicalPath(p, home)).map(foldPathCase), d));
     };
     const referencesProtectedDir = (cmd) => {
         const hay = foldPathCase(cmd);
@@ -571,18 +574,21 @@ export function createTranscriptIntegrityPolicy(opts) {
                 if (typeof command !== "string")
                     return ALLOW;
                 const cmd = command.normalize("NFC");
-                if (!referencesProtectedDir(cmd))
+                const cwdInsideProtected = req.cwd !== undefined && inProtectedDir(req.cwd);
+                if (!referencesProtectedDir(cmd) && !cwdInsideProtected)
                     return ALLOW;
                 const parsed = parseLeadingCommandName(command);
                 if ("name" in parsed && readAllow.has(parsed.name))
                     return ALLOW;
                 return askReason("name" in parsed
-                    ? `\`${parsed.name}\` is not a read-only command`
-                    : "the command references the transcript directory and is not a single read-only command (fail-closed)");
+                    ? `\`${parsed.name}\` is not a read-only command${cwdInsideProtected ? " and the shell's working directory is inside the transcript directory" : ""}`
+                    : cwdInsideProtected
+                        ? "the shell's working directory is inside the transcript directory and this is not a single read-only command (fail-closed)"
+                        : "the command references the transcript directory and is not a single read-only command (fail-closed)");
             }
             if (toolName === "Write" || toolName === "Edit" || toolName === "NotebookEdit") {
                 const p = writeTargetPath(toolName, req.args);
-                if (typeof p === "string" && inProtectedDir(p)) {
+                if (typeof p === "string" && inProtectedDir(p, req.cwd)) {
                     return askReason(`"${p}" is inside the session-transcript directory`);
                 }
             }

package/dist/orchestration/run-spec.js

@@ -26,7 +26,7 @@ function frozenDenyPolicy(rootDir, frozenResolved) {
             if (typeof raw !== "string" || raw.length === 0)
                 return { action: "allow" };
             const absForm = isAbsolutePathForm(raw);
-            const abs = pathKey(absForm ? raw : resolve(rootDir, raw));
+            const abs = pathKey(absForm ? raw : resolve(req.cwd || rootDir, raw));
             if (frozen.has(abs)) {
                 return { action: "deny", message: `${raw} is part of the frozen specification surface (read-only).` };
             }

package/dist/tools/fs/bash-readonly-classifier.d.ts

@@ -1,11 +1,14 @@
 export declare const NOT_AUTO_ALLOWED = "\u2014 not auto-allowed";
 export declare const BASH_READONLY_DEFAULT_ALLOW: readonly string[];
-export declare function parseLeadingCommandName(command: string): {
+export interface LeadingCommandNameOptions {
+    quotedOperatorsAreText?: boolean;
+}
+export declare function parseLeadingCommandName(command: string, options?: LeadingCommandNameOptions): {
     name: string;
 } | {
     reject: string;
 };
-export declare function coarseReadonlyCheck(command: string, allow: ReadonlySet<string>): string | undefined;
+export declare function coarseReadonlyCheck(command: string, allow: ReadonlySet<string>, options?: LeadingCommandNameOptions): string | undefined;
 export interface BashReadonlyRootBoundary {
     roots: readonly string[];
     cwd?: string;

package/dist/tools/fs/bash-readonly-classifier.js

@@ -5,11 +5,41 @@ export const BASH_READONLY_DEFAULT_ALLOW = [
     "grep", "cut", "tr", "basename", "dirname", "stat", "du", "df", "which",
 ];
 const SHELL_OPERATORS = /[;&|<>$()`\n\r\\]/;
-export function parseLeadingCommandName(command) {
+function quoteMask(s) {
+    const quoted = new Array(s.length).fill(false);
+    let open;
+    for (let i = 0; i < s.length; i++) {
+        const ch = s[i];
+        if (open === undefined && (ch === '"' || ch === "'")) {
+            open = ch;
+            quoted[i] = true;
+            continue;
+        }
+        if (open !== undefined) {
+            quoted[i] = true;
+            if (open === ch)
+                open = undefined;
+        }
+    }
+    return { quoted, balanced: open === undefined };
+}
+function hasBareShellOperator(s, quotedOperatorsAreText) {
+    if (!quotedOperatorsAreText)
+        return SHELL_OPERATORS.test(s);
+    const mask = quoteMask(s);
+    if (!mask.balanced)
+        return SHELL_OPERATORS.test(s);
+    for (let i = 0; i < s.length; i++) {
+        if (!mask.quoted[i] && SHELL_OPERATORS.test(s[i]))
+            return true;
+    }
+    return false;
+}
+export function parseLeadingCommandName(command, options) {
     const trimmed = command.trim();
     if (!trimmed)
         return { reject: "empty command" };
-    if (SHELL_OPERATORS.test(trimmed)) {
+    if (hasBareShellOperator(trimmed, options?.quotedOperatorsAreText === true)) {
         return {
             reject: "shell operators (pipes, redirects, ;, &&, command substitution, subshells, variable expansion) are not allowed — run a single simple command",
         };
@@ -23,8 +53,8 @@ export function parseLeadingCommandName(command) {
         return { reject: "the command name must be a bare token (no quotes, braces, globs, or ~)" };
     return { name: first };
 }
-export function coarseReadonlyCheck(command, allow) {
-    const parsed = parseLeadingCommandName(command);
+export function coarseReadonlyCheck(command, allow, options) {
+    const parsed = parseLeadingCommandName(command, options);
     if ("reject" in parsed)
         return parsed.reject;
     if (!allow.has(parsed.name))
@@ -32,6 +62,35 @@ export function coarseReadonlyCheck(command, allow) {
     return undefined;
 }
 const SHELL_SEGMENT_HARD_REJECT = /[<>$()`\n\r\\]/;
+const EXEMPT_REDIRECTION = /^(?:2>\/dev\/null|[12]?>&[12])$/;
+function stripExemptRedirections(command) {
+    if (!command.includes(">"))
+        return command;
+    const mask = quoteMask(command);
+    if (!mask.balanced)
+        return command;
+    let out = "";
+    let word = "";
+    let wordQuoted = false;
+    const flush = () => {
+        out += wordQuoted || !EXEMPT_REDIRECTION.test(word) ? word : "";
+        word = "";
+        wordQuoted = false;
+    };
+    for (let i = 0; i < command.length; i++) {
+        const ch = command[i];
+        if (!mask.quoted[i] && (ch === " " || ch === "\t")) {
+            flush();
+            out += ch;
+            continue;
+        }
+        if (mask.quoted[i])
+            wordQuoted = true;
+        word += ch;
+    }
+    flush();
+    return out;
+}
 function foldQuoteRemovalToken(tok) {
     if (!tok.includes('"') && !tok.includes("'"))
         return tok;
@@ -77,12 +136,30 @@ function resolveOperandLexically(base, operand, homeDir) {
     return normalizeAbsPathLexically(`${base.replace(/[/\\]+$/, "")}/${raw}`);
 }
 function tokenizeSegment(segment) {
-    const raw = segment
-        .trim()
-        .split(/\s+/)
-        .filter((t) => t.length > 0);
+    const raw = splitWordsQuoteAware(segment);
     return { folded: raw.map(foldQuoteRemovalToken), raw };
 }
+function splitWordsQuoteAware(segment) {
+    const s = segment.trim();
+    const mask = quoteMask(s);
+    if (!mask.balanced)
+        return s.split(/\s+/).filter((t) => t.length > 0);
+    const out = [];
+    let cur = "";
+    for (let i = 0; i < s.length; i++) {
+        const ch = s[i];
+        if (!mask.quoted[i] && /\s/.test(ch)) {
+            if (cur.length > 0)
+                out.push(cur);
+            cur = "";
+            continue;
+        }
+        cur += ch;
+    }
+    if (cur.length > 0)
+        out.push(cur);
+    return out;
+}
 function hasUnquotedExpansionMetachar(rawToken) {
     let open;
     for (const ch of rawToken) {
@@ -147,6 +224,26 @@ function isCutDelimiterPayloadLongOption(tok) {
     const name = longOptionNameOf(tok);
     return name !== undefined && (isLongOptionAbbrevOf(name, "delimiter") || isLongOptionAbbrevOf(name, "output-delimiter"));
 }
+function isGrepClusterFileStdin(tok) {
+    if (tok.startsWith("--") || !/^-[A-Za-z0-9]/.test(tok))
+        return false;
+    for (let i = 1; i < tok.length; i++) {
+        const ch = tok[i];
+        if (ch === "e")
+            return false;
+        if (ch === "f")
+            return tok.slice(i + 1) === "-";
+        if (!/[A-Za-z0-9]/.test(ch))
+            return false;
+    }
+    return false;
+}
+function isCutSeparatedDelimiterOption(tok) {
+    if (tok.includes("="))
+        return false;
+    const name = longOptionNameOf(tok);
+    return name !== undefined && (isLongOptionAbbrevOf(name, "delimiter") || isLongOptionAbbrevOf(name, "output-delimiter"));
+}
 function isGrepFileStdinLongOption(tok) {
     const eq = tok.indexOf("=");
     if (eq < 0 || tok.slice(eq + 1) !== "-")
@@ -285,16 +382,22 @@ export function classifyCompoundReadonlyDetailed(command, allow, boundary) {
     const trimmed = command.trim();
     if (!trimmed)
         return { reason: "empty command" };
-    if (SHELL_SEGMENT_HARD_REJECT.test(trimmed)) {
+    const redirectionStripped = stripExemptRedirections(trimmed);
+    if (SHELL_SEGMENT_HARD_REJECT.test(redirectionStripped)) {
         return { reason: "redirection, command/variable substitution, subshells, escapes, and line breaks are not allowed" };
     }
-    const source = trimmed.endsWith(";") ? trimmed.slice(0, -1) : trimmed;
+    const source = redirectionStripped.endsWith(";") ? redirectionStripped.slice(0, -1) : redirectionStripped;
     const segments = [];
     const pipeFed = [false];
+    const mask = quoteMask(source);
+    const quoted = (i) => mask.balanced && mask.quoted[i] === true;
     let cur = "";
     for (let i = 0; i < source.length; i++) {
         const c = source[i];
-        if (c === "&") {
+        if (quoted(i)) {
+            cur += c;
+        }
+        else if (c === "&") {
             if (source[i + 1] === "&") {
                 segments.push(cur);
                 cur = "";
@@ -327,7 +430,7 @@ export function classifyCompoundReadonlyDetailed(command, allow, boundary) {
     }
     segments.push(cur);
     for (const segment of segments) {
-        const reason = coarseReadonlyCheck(segment, allow);
+        const reason = coarseReadonlyCheck(segment, allow, { quotedOperatorsAreText: true });
         if (reason !== undefined)
             return { reason };
     }
@@ -368,21 +471,21 @@ export function classifyCompoundReadonlyDetailed(command, allow, boundary) {
             continue;
         foldedSegments.push(segmentTokens);
         const name = toks[0];
-        const nonOption = toks.slice(1).filter((t) => !t.startsWith("-"));
         if (!(pipeFed[si] ?? false)) {
             const floor = STDIN_FILE_FLOOR[name];
             const restArgs = toks.slice(1);
             const grepPatternSuppliedByFlag = name === "grep" && restArgs.some(isGrepPatternFlagToken);
             let sawNonFlagOperand = false;
             let hasStdinDash = false;
+            let operandCount = 0;
             if (name !== "tr") {
                 for (let k = 0; k < restArgs.length; k++) {
                     const t = restArgs[k];
-                    if (name === "cut" && (t === "-d" || t === "--delimiter")) {
+                    if (name === "cut" && (t === "-d" || isCutSeparatedDelimiterOption(t))) {
                         k++;
                         continue;
                     }
-                    if (name === "grep" && (t === "-f-" || isGrepFileStdinLongOption(t))) {
+                    if (name === "grep" && (isGrepClusterFileStdin(t) || isGrepFileStdinLongOption(t))) {
                         hasStdinDash = true;
                         break;
                     }
@@ -390,6 +493,7 @@ export function classifyCompoundReadonlyDetailed(command, allow, boundary) {
                         continue;
                     const isGrepPatternPosition = name === "grep" && !grepPatternSuppliedByFlag && !sawNonFlagOperand;
                     sawNonFlagOperand = true;
+                    operandCount++;
                     if (isGrepPatternPosition)
                         continue;
                     if (t === "-") {
@@ -401,7 +505,7 @@ export function classifyCompoundReadonlyDetailed(command, allow, boundary) {
             if (floor !== undefined && hasStdinDash) {
                 return { reason: `"${name}" reads stdin via an explicit "-" argument and would block until the tool timeout ${NOT_AUTO_ALLOWED}` };
             }
-            if (floor !== undefined && nonOption.length < floor) {
+            if (floor !== undefined && operandCount < floor) {
                 return { reason: `"${name}" with no file argument reads stdin and would block until the tool timeout ${NOT_AUTO_ALLOWED}` };
             }
         }
@@ -409,7 +513,15 @@ export function classifyCompoundReadonlyDetailed(command, allow, boundary) {
             return { reason: "`tail` in follow mode never terminates " + NOT_AUTO_ALLOWED };
         }
         const GENERATOR_DEVICES = new Set(["/dev/zero", "/dev/random", "/dev/urandom", "/dev/full"]);
-        const deviceArgs = toks.slice(1).filter((t) => !t.startsWith("-")).map(normalizeAbsPathLexically).filter(isBlockedDevicePath);
+        const deviceCandidates = [];
+        for (const t of toks.slice(1)) {
+            if (t.startsWith("-") && t !== "-") {
+                deviceCandidates.push(...attachedOptionPayloads(t));
+                continue;
+            }
+            deviceCandidates.push(t);
+        }
+        const deviceArgs = deviceCandidates.map(normalizeAbsPathLexically).filter(isBlockedDevicePath);
         const rescuedByHead = headBoundIsSmall(name, toks) && deviceArgs.every((d) => GENERATOR_DEVICES.has(d));
         if (!rescuedByHead && deviceArgs.length > 0) {
             return { reason: "reads a device/special file that is either unbounded (/dev/zero, /dev/stdin, /proc/<pid>/fd/0, … — blocks the pipeline until the tool timeout) or process-private (/proc/<pid>/environ, /proc/<pid>/mem, …) " + NOT_AUTO_ALLOWED };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "5.18.1",
+  "version": "5.19.0",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",