@sema-agent/core 5.26.0 → 5.27.0

package/dist/core/memory-engine/file-backend.js

@@ -229,6 +229,29 @@ export class FileMemoryEngineBackend {
     scopeDir(scope) {
         return registerScope(this.directoryRoot, this.controlPlaneRoot, scope);
     }
+    containInboundReject(finding, absPath, text, entryId, committed) {
+        this.inboundFindings.push(finding);
+        const q = quarantineAndTombstone(absPath, text, join(this.controlPlaneRoot, QUARANTINE_DIR), this.now);
+        const shadowText = committed !== undefined ? this.readCommittedShadow(entryId) : undefined;
+        let restoredShadow = false;
+        if (shadowText !== undefined) {
+            try {
+                atomicWriteFileSync(absPath, shadowText);
+                restoredShadow = true;
+            }
+            catch {
+            }
+        }
+        if (q.detail !== undefined || (!q.removed && !restoredShadow)) {
+            const contained = q.removed || restoredShadow;
+            this.inboundFindings.push({
+                path: finding.path,
+                code: "quarantine_failed",
+                reason: `quarantine escalation: ${q.detail ?? "suspect copy not captured"}${contained ? "" : " — rejected content may still be on the model-visible plane"}`,
+            });
+        }
+        return shadowText;
+    }
     inboundGate(relPath, text) {
         const nameFinding = scanMemoryFileName(relPath);
         if (nameFinding !== undefined)
@@ -288,27 +311,7 @@ export class FileMemoryEngineBackend {
                         }
                     }
                     if (finding) {
-                        this.inboundFindings.push(finding);
-                        const q = quarantineAndTombstone(f.path, text, join(this.controlPlaneRoot, QUARANTINE_DIR), this.now);
-                        const shadowText = committed !== undefined ? this.readCommittedShadow(entry.id) : undefined;
-                        let restoredShadow = false;
-                        if (shadowText !== undefined) {
-                            try {
-                                atomicWriteFileSync(f.path, shadowText);
-                                restoredShadow = true;
-                            }
-                            catch {
-                            }
-                            entry = entryFromFile(shadowText, entry.id, f.slug, scope);
-                        }
-                        if (q.detail !== undefined || (!q.removed && !restoredShadow)) {
-                            const contained = q.removed || restoredShadow;
-                            this.inboundFindings.push({
-                                path: finding.path,
-                                code: "quarantine_failed",
-                                reason: `quarantine escalation: ${q.detail ?? "suspect copy not captured"}${contained ? "" : " — rejected content may still be on the model-visible plane"}`,
-                            });
-                        }
+                        const shadowText = this.containInboundReject(finding, f.path, text, entry.id, committed);
                         if (shadowText === undefined) {
                             if (committed !== undefined) {
                                 delete ledger[entry.id];
@@ -316,6 +319,7 @@ export class FileMemoryEngineBackend {
                             }
                             continue;
                         }
+                        entry = entryFromFile(shadowText, entry.id, f.slug, scope);
                     }
                     else {
                         if (committed !== undefined)
@@ -377,10 +381,13 @@ export class FileMemoryEngineBackend {
         return this.listHeadersWith(scopes, true);
     }
     listHeadersWith(scopes, adopt) {
+        return this.listHeadersFrom(scopes, (s) => this.readScope(s, adopt));
+    }
+    listHeadersFrom(scopes, read) {
         const out = [];
         for (const scope of scopes) {
             const dir = this.scopeDir(scope);
-            for (const e of this.readScope(scope, adopt)) {
+            for (const e of read(scope)) {
                 out.push(headerOf(e, join(dir, `${e.slug}.md`)));
             }
         }
@@ -390,10 +397,13 @@ export class FileMemoryEngineBackend {
         return this.getByIdsWith(ids, true);
     }
     getByIdsWith(ids, adopt) {
+        return this.getByIdsFrom(ids, (s) => this.readScope(s, adopt));
+    }
+    getByIdsFrom(ids, read) {
         const want = new Set(ids);
         const out = [];
         for (const scope of Object.keys(registeredScopes(this.controlPlaneRoot))) {
-            for (const e of this.readScope(scope, adopt)) {
+            for (const e of read(scope)) {
                 if (want.has(e.id))
                     out.push(e);
             }
@@ -413,10 +423,226 @@ export class FileMemoryEngineBackend {
             setConsolidationCursor: async () => refuse("setConsolidationCursor"),
         };
     }
+    restrictedFindingKeys = new Set();
+    recordRestrictedFinding(key, finding) {
+        if (this.restrictedFindingKeys.has(key))
+            return;
+        this.restrictedFindingKeys.add(key);
+        this.inboundFindings.push(finding);
+    }
+    readScopeCommitted(scope, audit) {
+        const dir = this.scopeDir(scope);
+        const isRoot = dir === this.directoryRoot;
+        const files = scanEntryFiles(dir, {
+            exclude: isRoot ? this.excludedSubdirNames(scope) : undefined,
+            onSkip: audit
+                ? (p, kind) => {
+                    if (kind !== "unreadable")
+                        return;
+                    const rel = relative(this.directoryRoot, p);
+                    this.recordRestrictedFinding(`unreadable|${rel}`, {
+                        path: rel,
+                        code: "unreadable",
+                        reason: "the path could not be read (lstat/readdir failed) — the restricted-session divergence audit is incomplete under it",
+                    });
+                }
+                : undefined,
+        });
+        this.ledger = undefined;
+        const ledger = this.loadLedger();
+        const entries = [];
+        for (const f of files) {
+            const rel = relative(this.directoryRoot, f.path);
+            let text;
+            try {
+                text = readFileSync(f.path, "utf8");
+            }
+            catch {
+                if (audit) {
+                    this.recordRestrictedFinding(`unreadable|${rel}`, {
+                        path: rel,
+                        code: "unreadable",
+                        reason: "memory entry file could not be read — it is missing from this restricted session's view",
+                    });
+                }
+                continue;
+            }
+            const parsed = parseEntryFile(text);
+            if (parsed.id === undefined)
+                continue;
+            const entry = entryFromFile(text, parsed.id, f.slug, scope);
+            const committed = ledger[entry.id];
+            if (committed === entry.rev) {
+                if (audit && this.readCommittedShadow(entry.id) === undefined) {
+                    try {
+                        atomicWriteFileSync(this.shadowPath(entry.id), text);
+                    }
+                    catch {
+                    }
+                }
+                entries.push(entry);
+                continue;
+            }
+            const shadowText = committed !== undefined ? this.readCommittedShadow(entry.id) : undefined;
+            if (shadowText !== undefined) {
+                const shadowEntry = entryFromFile(shadowText, entry.id, f.slug, scope);
+                if (shadowEntry.rev === entry.rev) {
+                    entries.push(entry);
+                    continue;
+                }
+                const otherProjection = this.idProjectionElsewhere(entry.id, f.path);
+                if (otherProjection !== undefined) {
+                    if (audit) {
+                        const finding = this.inboundGate(rel, text);
+                        if (finding !== undefined) {
+                            this.containInboundReject(finding, f.path, text, entry.id, undefined);
+                        }
+                        else {
+                            this.recordRestrictedFinding(`dupserve|${rel}|${entry.rev}`, {
+                                path: rel,
+                                code: "restricted_divergence",
+                                reason: `this file carries the id of a committed entry that has another projection (${otherProjection}) — the committed copy may only stand in for an entry's unique projection, so this copy is withheld; an unrestricted session's harvest adjudicates it`,
+                            });
+                        }
+                    }
+                    continue;
+                }
+                if (audit) {
+                    const finding = this.inboundGate(rel, text);
+                    if (finding !== undefined) {
+                        this.containInboundReject(finding, f.path, text, entry.id, committed);
+                    }
+                    else {
+                        this.recordRestrictedFinding(`divergence|${rel}|${entry.rev}`, {
+                            path: rel,
+                            code: "restricted_divergence",
+                            reason: "on-disk content diverges from the committed entry with no backend transaction backing it; this adoption-restricted session serves the committed content and leaves the disk state pending — an unrestricted session can adopt it normally",
+                        });
+                    }
+                }
+                entries.push(shadowEntry);
+                continue;
+            }
+            if (committed !== undefined) {
+                if (audit) {
+                    this.recordRestrictedFinding(`legacy|${rel}|${entry.rev}`, {
+                        path: rel,
+                        code: "restricted_divergence",
+                        reason: "on-disk content diverges from a committed entry that has no committed shadow copy; this adoption-restricted session withholds the entry (nothing trustworthy to serve) — an unrestricted session can adjudicate it",
+                    });
+                }
+                continue;
+            }
+            if (audit) {
+                const finding = this.inboundGate(rel, text);
+                if (finding !== undefined) {
+                    this.containInboundReject(finding, f.path, text, entry.id, undefined);
+                }
+                else {
+                    this.recordRestrictedFinding(`uncommitted|${rel}|${entry.rev}`, {
+                        path: rel,
+                        code: "restricted_divergence",
+                        reason: "an id-bearing memory file exists on disk that the committed account has never seen; this adoption-restricted session neither adopts nor serves it — it stays on disk for an unrestricted session to adopt normally",
+                    });
+                }
+            }
+        }
+        return entries;
+    }
+    idProjectionElsewhere(id, excludeAbsPath) {
+        for (const scope of Object.keys(registeredScopes(this.controlPlaneRoot))) {
+            const dir = this.scopeDir(scope);
+            const isRoot = dir === this.directoryRoot;
+            for (const f of scanEntryFiles(dir, { exclude: isRoot ? this.excludedSubdirNames(scope) : undefined })) {
+                if (f.path === excludeAbsPath)
+                    continue;
+                const text = readSafe(f.path);
+                if (text === undefined)
+                    continue;
+                if (parseEntryFile(text).id === id)
+                    return relative(this.directoryRoot, f.path);
+            }
+        }
+        return undefined;
+    }
+    restrictedAdoptionView(opts) {
+        const audit = opts?.audit === true;
+        const refuse = (op) => {
+            throw new Error(`memory adoption-restricted view is read-only — ${op} must go through the backend itself`);
+        };
+        return {
+            listHeaders: async (scopes) => this.listHeadersFrom(scopes, (s) => this.readScopeCommitted(s, audit)),
+            getByIds: async (ids) => this.getByIdsFrom(ids, (s) => this.readScopeCommitted(s, audit)),
+            search: async (query, scopes, o) => this.searchFrom(query, scopes, o, (s) => this.readScopeCommitted(s, audit)),
+            applyPatches: async () => refuse("applyPatches"),
+            getConsolidationCursor: async (scope) => this.getConsolidationCursor(scope),
+            setConsolidationCursor: async () => refuse("setConsolidationCursor"),
+        };
+    }
+    auditRestrictedDivergence(scopes) {
+        for (const scope of scopes)
+            this.readScopeCommitted(scope, true);
+        const ledger = { ...this.loadLedger() };
+        const present = new Map();
+        let complete = true;
+        for (const scope of Object.keys(registeredScopes(this.controlPlaneRoot))) {
+            const dir = this.scopeDir(scope);
+            const isRoot = dir === this.directoryRoot;
+            const files = scanEntryFiles(dir, {
+                exclude: isRoot ? this.excludedSubdirNames(scope) : undefined,
+                onSkip: (_p, kind) => {
+                    if (kind === "unreadable")
+                        complete = false;
+                },
+            });
+            for (const f of files) {
+                const text = readSafe(f.path);
+                if (text === undefined) {
+                    complete = false;
+                    continue;
+                }
+                const id = parseEntryFile(text).id;
+                if (id !== undefined)
+                    present.set(id, [...(present.get(id) ?? []), relative(this.directoryRoot, f.path)]);
+            }
+        }
+        for (const [id, paths] of present) {
+            if (paths.length < 2 || ledger[id] === undefined)
+                continue;
+            this.recordRestrictedFinding(`dup|${id}|${paths.sort().join(",")}`, {
+                path: paths[0] ?? id,
+                code: "restricted_divergence",
+                reason: `committed memory entry ${id} appears at ${paths.length} paths (${paths.join(", ")}) — a filesystem copy is not a rename; this adoption-restricted session flags it and an unrestricted session's harvest adjudicates which projection is real`,
+            });
+        }
+        if (!complete) {
+            this.recordRestrictedFinding(`missing-audit-incomplete`, {
+                path: ".",
+                code: "restricted_divergence",
+                reason: "the divergence audit could not scan every path (unreadable subtree) — missing-entry detection was skipped this pass rather than judged from an incomplete scan",
+            });
+            return;
+        }
+        for (const [id, rev] of Object.entries(ledger)) {
+            if (present.has(id))
+                continue;
+            this.ledger = undefined;
+            if (this.loadLedger()[id] === undefined)
+                continue;
+            this.recordRestrictedFinding(`missing|${id}|${rev}`, {
+                path: `id:${id}`,
+                code: "restricted_divergence",
+                reason: `committed memory entry ${id} is missing from disk with no transaction backing the removal; this adoption-restricted session neither restores nor forgets it — an unrestricted session can restore it from the committed copy`,
+            });
+        }
+    }
     async search(query, scopes, opts) {
         return this.searchWith(query, scopes, opts, true);
     }
     searchWith(query, scopes, opts, adopt) {
+        return this.searchFrom(query, scopes, opts, (s) => this.readScope(s, adopt));
+    }
+    searchFrom(query, scopes, opts, read) {
         const limit = opts?.limit ?? 20;
         const q = termSet(query);
         if (q.size === 0)
@@ -424,7 +650,7 @@ export class FileMemoryEngineBackend {
         const scored = [];
         for (const scope of scopes) {
             const dir = this.scopeDir(scope);
-            for (const e of this.readScope(scope, adopt)) {
+            for (const e of read(scope)) {
                 const haystack = `${e.frontmatter.name ?? e.slug} ${e.frontmatter.description ?? ""} ${e.body}`;
                 const d = jaccardDistance(q, haystack);
                 if (d === null)

package/dist/core/memory-engine/types.d.ts

@@ -223,9 +223,16 @@ export interface MemorySessionHandle {
      *  the gate's whole purpose is keeping those bytes out of the prompt, so a refused clear must not
      *  leave the injection path reading them anyway. Absent ⇒ the normal "live file wins" behavior. */
     indexOnDiskUntrusted?: boolean;
+    /** True ⇔ this session materialized through the ADOPTION-RESTRICTED (committed-view) read face:
+     *  either the plane is a read-only layering (`writeScope === null`) or the caller declared the
+     *  session unable to persist (an explicit verdict — never inferred down here). Restricted sessions
+     *  read committed state only (ledger + control-plane shadow); disk divergence with no transaction
+     *  backing is neither adopted into the committed account nor served, and `inject` reads the
+     *  materialize-time index text instead of the live on-disk file. */
+    adoptionRestricted?: boolean;
 }
 /** Stable rejection codes a harvest gate can produce (model-visible gate events — 镜头 I). */
-export type HarvestRejectionCode = "outside_root" | "symlink" | "secret" | "injection" | "filename" | "too_large" | "file_cap" | "readonly_layer" | "stub_modified" | "nested_too_deep" | "quarantine_failed" | "unreadable" | "polluted" | "invalid";
+export type HarvestRejectionCode = "outside_root" | "symlink" | "secret" | "injection" | "filename" | "too_large" | "file_cap" | "readonly_layer" | "stub_modified" | "nested_too_deep" | "quarantine_failed" | "unreadable" | "polluted" | "restricted_divergence" | "invalid";
 /** One rejected file: path (relative to the memory dir), stable code, and a model-readable reason. */
 export interface HarvestRejection {
     path: string;

package/dist/core/memory-vector.d.ts

@@ -13,7 +13,12 @@
  * MySQL is NOT "can't support vectors" — it is `portable`-capable (JSON column + in-process cosine), just not
  * `native`. A deployment injects an embedder (config-driven); the store then reports the achieved rung.
  */
-/** Lower-cased alphanumeric term set of a string (for the lexical stand-in distance). */
+/** Lower-cased lexical term set: alphanumeric runs PLUS CJK character bigrams (a single-character
+ *  run contributes its unigram). CJK scripts have no `a-z0-9` runs at all, so an alphanumeric-only
+ *  tokenizer made every pure-CJK entry an EMPTY set — never a lexical-rung candidate for any query
+ *  — and a pure-CJK query returned nothing; character bigrams are the standard analyzer unit there
+ *  (word boundaries are not written). Bigrams stay within one run: adjacency across an intervening
+ *  non-CJK character is not real adjacency. */
 export declare function termSet(s: string): Set<string>;
 /** Lexical stand-in distance: `1 - Jaccard(terms)` ∈ [0,1] ⊂ [0,2]; `null` = no overlap (not a candidate). */
 export declare function jaccardDistance(query: Set<string>, text: string): number | null;

package/dist/core/memory-vector.js

@@ -1,8 +1,18 @@
+const CJK_RUN = /[\u3040-\u30FF\u31F0-\u31FF\u3400-\u4DBF\u4E00-\u9FFF\uAC00-\uD7A3\uF900-\uFAFF]+/g;
 export function termSet(s) {
-    return new Set(s
-        .toLowerCase()
-        .split(/[^a-z0-9]+/)
-        .filter(Boolean));
+    const lower = s.toLowerCase();
+    const out = new Set();
+    for (const run of lower.split(/[^a-z0-9]+/))
+        if (run)
+            out.add(run);
+    for (const m of lower.matchAll(CJK_RUN)) {
+        const chars = [...m[0]];
+        for (const c of chars)
+            out.add(c);
+        for (let i = 0; i + 1 < chars.length; i++)
+            out.add(chars[i] + chars[i + 1]);
+    }
+    return out;
 }
 export function jaccardDistance(query, text) {
     const t = termSet(text);

package/dist/core/memory.js

@@ -1,5 +1,6 @@
 import { uuidv7 } from "../internal/harness.js";
 import { parseScopeKey } from "./memory-engine/scope-contract.js";
+import { termSet } from "./memory-vector.js";
 import { sanitizeUntrustedText } from "./untrusted-text.js";
 export function supportsConsolidation(store) {
     return (typeof store.searchScored === "function" &&
@@ -148,12 +149,6 @@ export function guardedMemoryStore(inner, utilityGate) {
 function renderBullet(e) {
     return `- (${e.ts} UTC) ${e.text}`;
 }
-function termSet(s) {
-    return new Set(s
-        .toLowerCase()
-        .split(/[^a-z0-9]+/)
-        .filter(Boolean));
-}
 export class InMemoryMemoryStore {
     byScope = new Map();
     cursorByScope = new Map();

package/dist/core/permission-rule-model.d.ts

@@ -120,6 +120,53 @@ export declare const MAX_RULE_TEXT_CHARS = 512;
  * an EXACT rule naming a whole interpreter command line stays legal, since it authorizes one command.
  */
 export declare const BARE_INTERPRETER_NAMES: ReadonlySet<string>;
+/**
+ * design/185 §1 — the reviewed command/subcommand grammar the PREFIX suggestion is generated from
+ * (exactly the "reviewed command/subcommand grammar" the generator's history note names as the one
+ * thing that would let it produce a prefix).
+ *
+ * A flat set of BODIES — word sequences, each at least two words. A prefix candidate exists for a
+ * command iff some body here is a word-boundary prefix of its folded form, and the LONGEST hit wins:
+ * the deeper body is the narrower rule, so listing (or not listing) a deeper body is how this table
+ * sets suggestion granularity per branch. No groups, no denylist, and no fallback arm: a head outside
+ * the table, an unreviewed subcommand, a runtime-defined name (a git alias, a `git-<x>`/`cargo-<x>`
+ * external subcommand, a gh extension, a kubectl plugin), a flag or operand in a body position and a
+ * quoted token all fail the same way — by not being listed. Closure comes from positive enumeration
+ * itself, never from an exclusion list racing names that only exist at runtime.
+ *
+ * Review criteria — every row must pass BOTH axes (the same principle as the interpreter refusal
+ * above: the rule text must not read narrower than what it grants):
+ *  · "runs what it is told to": a body whose use is fetching or naming a program to execute
+ *    (`npm exec`, `docker run`, `kubectl exec`, `gh extension`, `git submodule foreach`, the install
+ *    family) is refused — one click cannot be read as having granted arbitrary execution. Running the
+ *    WORKSPACE'S OWN pinned content (`npm run`, `npm ci`, `cargo run`, `cargo test`) is inside the
+ *    boundary: the scripts and lockfiles those execute are checked into the repository being worked on.
+ *  · "rewrites what others execute": a body whose main use is writing configuration that changes what
+ *    OTHER commands later run (`git config` — hooksPath/pager/alias; `kubectl config` —
+ *    exec-credential; `npm config`/`npm set` — script-shell; `go env` — persisted GOFLAGS/GOBIN) is
+ *    refused — its readable width and its real width differ by a whole composition surface.
+ * Past both axes there is deliberately NO "dangerousness" axis: `git push:*` and `git rebase:*` are
+ * wide but readable, and a person nodding at that text is granting exactly that.
+ *
+ * Residual width, stated rather than hidden (a reviewed trade, not an oversight): a prefix rule
+ * admits ANY arguments after its body, and some listed bodies carry flags that name a program to
+ * execute (`go build`/`go test`/`go vet -toolexec`, `git fetch --upload-pack`, `git rebase -x`,
+ * `git grep -O`, `git push --receive-pack`). The axes judge a body's MAIN use, not every flag —
+ * per-flag grammar is the road this module's history rejected twice, and applied consistently it
+ * would empty the table. Three standing fences hold that residue: the org deny/ask layer runs ahead
+ * of the rule lane and cannot be silenced by it; a mandated ask (egress/irreversibility marks,
+ * shellGate:"always") is not rule-clearable either; and the narrower exact candidate — plus minting
+ * no rule at all — is always on the same card.
+ *
+ * Maintenance: adding a row is a reviewed change — keep the per-group reasoning beside it current.
+ * The integrity pins (every body ≥ 2 words, lowercase word shape, no interpreter heads, no
+ * duplicates) are enforced by this module's test suite. This table and the read-only classifier's
+ * allowlists are DIFFERENT instruments and must never be merged or cross-referenced: that one is a
+ * machine auto-allow face whose criterion is "provably read-only"; this one is a human suggestion
+ * face whose criterion is "width a person can read off the rule text". One guards against a machine
+ * loosening; the other against a person being misled.
+ */
+export declare const SUGGESTION_LEXICON: readonly string[];
 /**
  * Parse one rule text into its canonical shape, or refuse it with a reason.
  *
@@ -184,11 +231,29 @@ export interface RuleSuggestion {
 /**
  * The 1-2 candidates offered on an approval card for `command`.
  *
- * The exact form (this whole command line) is always offered when the command is matchable at all. A
- * prefix form is offered only when it is a shape a person can read as narrow: the upstream multi-word
- * convention (`git status`, `npm run`) is preferred over a bare program name, and no prefix at all is
- * offered for an interpreter head — that candidate would be refused by the validator anyway, and
- * offering a candidate the store will not accept is worse than offering one fewer.
+ * **Array order is a documented CONTRACT, not an implementation accident**: display order = array
+ * order = narrowest first. The EXACT form (this whole command line) is always index 0 whenever
+ * anything is offered at all; a broader reviewed PREFIX form — at most one — follows at index 1.
+ * Selection indices and redemption tickets are index-keyed against this order (a card's
+ * `selectedCandidate` and its `rt.<index>.` tickets), so consumers may rely on it.
+ *
+ * The prefix candidate comes ONLY from {@link SUGGESTION_LEXICON} — the longest reviewed body that is
+ * a word-boundary prefix of the folded command. History, and why there is no heuristic arm: two
+ * rounds of guessing produced two different wrong answers — a bare program name (`rm -f x` →
+ * `Bash(rm:*)`), then an operand mistaken for a subcommand (`rm harmless.txt` →
+ * `Bash(rm harmless.txt:*)`, which admits a second, unnamed target) — and both failed the same way:
+ * nothing in the command TEXT distinguishes a subcommand from an operand without a per-command
+ * grammar. The lexicon IS that grammar, per reviewed row; anything it does not list (a bare verb, an
+ * interpreter head, an unreviewed subcommand, a runtime-defined name) yields no prefix, with no
+ * fallback. Naive spacing note: `folded` keeps quoted whitespace, so splitting on single spaces can
+ * shear a quoted segment — harmless in this direction, because the sheared pieces carry quote
+ * characters and can never equal a bare lexicon word; every suspicious shape lands on "no prefix".
+ *
+ * Every produced candidate must survive the round trip — parse as a rule AND admit the very command
+ * it was minted from. True by construction (a word-boundary lexicon prefix of a folded simple command
+ * is exactly the matcher's two arms); enforced anyway, fail-closed: a candidate that would not
+ * round-trip is silently not offered, since offering an option redemption would refuse is worse than
+ * offering one fewer.
  *
  * Returns an empty array for anything the rule lane cannot speak for (compounds, redirections,
  * substitutions) — the card then simply carries no "don't ask again" option, which is the honest answer.

package/dist/core/permission-rule-model.js

@@ -6,6 +6,54 @@ export const BARE_INTERPRETER_NAMES = new Set([
     "node", "deno", "bun", "python", "python2", "python3", "perl", "ruby", "php",
     "osascript", "env", "eval", "exec", "xargs", "nohup", "sudo", "doas", "su", "ssh",
 ]);
+export const SUGGESTION_LEXICON = [
+    "git status", "git log", "git diff", "git show", "git branch", "git checkout", "git switch",
+    "git add", "git commit", "git push", "git pull", "git fetch", "git merge", "git rebase",
+    "git tag", "git blame", "git describe", "git cherry-pick", "git restore", "git reset",
+    "git rev-parse", "git ls-files", "git grep",
+    "git stash list", "git stash show", "git stash push", "git stash pop", "git stash drop",
+    "git remote show", "git worktree list", "git submodule update", "git submodule status",
+    "npm run", "npm test", "npm ci", "npm ls", "npm view", "npm outdated", "npm audit",
+    "npm pack", "npm publish", "npm version", "npm why",
+    "pnpm run", "pnpm test", "pnpm ls", "pnpm outdated", "pnpm audit", "pnpm why",
+    "yarn run", "yarn test", "yarn workspaces list",
+    "cargo build", "cargo test", "cargo run", "cargo check", "cargo clippy", "cargo fmt",
+    "cargo doc", "cargo tree", "cargo bench", "cargo update", "cargo metadata",
+    "go build", "go test", "go vet", "go fmt", "go doc",
+    "go mod tidy", "go mod download", "go mod verify", "go mod graph",
+    "docker ps", "docker images", "docker logs", "docker inspect", "docker build", "docker pull",
+    "docker push", "docker stop", "docker start", "docker restart", "docker rm", "docker rmi",
+    "docker compose up", "docker compose down", "docker compose ps", "docker compose logs",
+    "docker compose build", "docker compose pull",
+    "kubectl get", "kubectl describe", "kubectl logs", "kubectl apply", "kubectl delete",
+    "kubectl diff", "kubectl explain", "kubectl top",
+    "kubectl rollout status", "kubectl rollout restart", "kubectl rollout history",
+    "gh pr view", "gh pr list", "gh pr diff", "gh pr checks", "gh pr status", "gh pr create",
+    "gh pr merge", "gh issue view", "gh issue list", "gh issue create", "gh repo view",
+    "gh repo clone", "gh release list", "gh release view", "gh run list", "gh run view",
+    "gh run watch", "gh workflow list", "gh workflow view", "gh auth status",
+    "gh search repos", "gh search issues", "gh search prs", "gh search code",
+];
+const LEXICON_BODIES = SUGGESTION_LEXICON.map((b) => b.split(" "));
+function longestReviewedBody(tokens) {
+    let best;
+    for (const words of LEXICON_BODIES) {
+        if (words.length > tokens.length)
+            continue;
+        if (best !== undefined && words.length <= best.length)
+            continue;
+        let hit = true;
+        for (let i = 0; i < words.length; i++) {
+            if (words[i] !== tokens[i]) {
+                hit = false;
+                break;
+            }
+        }
+        if (hit)
+            best = words;
+    }
+    return best?.join(" ");
+}
 function foldSpacing(s) {
     let out = "";
     let quote;
@@ -131,5 +179,15 @@ export function suggestRulesForCommand(command) {
     const exact = parseAllowRuleText(formatAllowRuleText(folded, "exact"));
     if ("rule" in exact)
         out.push({ rule: exact.rule.rule, match: "exact", command: exact.rule.command });
+    if (out.length === 1) {
+        const body = longestReviewedBody(folded.split(" "));
+        if (body !== undefined) {
+            const text = formatAllowRuleText(body, "prefix");
+            const parsed = parseAllowRuleText(text);
+            if ("rule" in parsed && parsed.rule.match === "prefix" && ruleAdmitsCommand(parsed.rule, command)) {
+                out.push({ rule: parsed.rule.rule, match: "prefix", command: parsed.rule.command });
+            }
+        }
+    }
     return out;
 }

package/dist/core/runner/prepare-memory.js

@@ -126,7 +126,12 @@ export async function prepareMemory(input) {
                 };
             };
             const onEngineIncident = (err) => deps.onError?.(err, { phase: "memory", sessionId });
-            const retrievalBackend = (b) => b.retrievalView?.() ?? b;
+            const adoptionRestricted = input.memoryPersistenceDeclared === false;
+            const retrievalBackend = (b, planeRestricted) => planeRestricted
+                ? (b.restrictedAdoptionView?.({ audit: false }) ??
+                    b.retrievalView?.() ??
+                    b)
+                : (b.retrievalView?.() ?? b);
             const planeScopes = (scopes, write) => [...new Set([...scopes, ...(write !== null ? [write] : [])])];
             const pollutedOpts = (engine) => {
                 const rec = engine.sessionPollution(sessionId);
@@ -173,8 +178,8 @@ export async function prepareMemory(input) {
                 const personal = createPersonalEngine(personalBackendChosen);
                 const personalEngine = personal.engine;
                 const p = planes;
-                const projectHandle = await projectEngine.materialize(p.project, p.writePlane === "project" ? memorySpec.writeScope : null);
-                const personalHandle = await personalEngine.materialize(p.personal, p.writePlane === "personal" ? memorySpec.writeScope : null);
+                const projectHandle = await projectEngine.materialize(p.project, p.writePlane === "project" ? memorySpec.writeScope : null, { adoptionRestricted });
+                const personalHandle = await personalEngine.materialize(p.personal, p.writePlane === "personal" ? memorySpec.writeScope : null, { adoptionRestricted });
                 const writeIsPersonal = p.writePlane === "personal";
                 writeEngine = writeIsPersonal ? personalEngine : projectEngine;
                 writeHandle = writeIsPersonal ? personalHandle : projectHandle;
@@ -183,13 +188,13 @@ export async function prepareMemory(input) {
                 injectFn = () => mergeInjections(projectEngine.inject(projectHandle, { writeToolMounted: input.writeToolsMounted }), personalEngine.inject(personalHandle, { writeToolMounted: input.writeToolsMounted }));
                 toolPlanes = [
                     {
-                        backend: retrievalBackend(backend),
+                        backend: retrievalBackend(backend, adoptionRestricted || p.writePlane !== "project"),
                         scopes: planeScopes(p.project, p.writePlane === "project" ? memorySpec.writeScope : null),
                         recordRetrieved: (ids) => projectEngine.recordRetrieved(ids),
                         challengeExclusions: () => projectEngine.readChallengeExclusions(),
                     },
                     {
-                        backend: retrievalBackend(personal.backend),
+                        backend: retrievalBackend(personal.backend, adoptionRestricted || p.writePlane !== "personal"),
                         scopes: planeScopes(p.personal, p.writePlane === "personal" ? memorySpec.writeScope : null),
                         recordRetrieved: (ids) => personalEngine.recordRetrieved(ids),
                         challengeExclusions: () => personalEngine.readChallengeExclusions(),
@@ -216,14 +221,14 @@ export async function prepareMemory(input) {
             else if (personalOnly) {
                 const personal = createPersonalEngine(choosePersonalBackend());
                 const personalEngine = personal.engine;
-                const handle = await personalEngine.materialize(memorySpec.scopes, memorySpec.writeScope);
+                const handle = await personalEngine.materialize(memorySpec.scopes, memorySpec.writeScope, { adoptionRestricted });
                 writeEngine = personalEngine;
                 writeHandle = handle;
                 injectFn = () => personalEngine.inject(handle, { writeToolMounted: input.writeToolsMounted });
                 harvestBoth = () => personalEngine.harvest(handle, { ...pollutedOpts(personalEngine), sessionId, ...admitNothingOpts });
                 toolPlanes = [
                     {
-                        backend: retrievalBackend(personal.backend),
+                        backend: retrievalBackend(personal.backend, adoptionRestricted || memorySpec.writeScope === null),
                         scopes: planeScopes(memorySpec.scopes, memorySpec.writeScope),
                         recordRetrieved: (ids) => personalEngine.recordRetrieved(ids),
                         challengeExclusions: () => personalEngine.readChallengeExclusions(),
@@ -237,14 +242,14 @@ export async function prepareMemory(input) {
                     controlDir: identityKey !== undefined ? deriveProjectControlDir(engineRoot, identityKey) : deriveRepoControlPlaneDir(engineRoot, repoRoot),
                     onIncident: onEngineIncident,
                 });
-                const handle = await engine.materialize(memorySpec.scopes, memorySpec.writeScope);
+                const handle = await engine.materialize(memorySpec.scopes, memorySpec.writeScope, { adoptionRestricted });
                 writeEngine = engine;
                 writeHandle = handle;
                 injectFn = () => engine.inject(handle, { writeToolMounted: input.writeToolsMounted });
                 harvestBoth = () => engine.harvest(handle, { ...pollutedOpts(engine), sessionId, ...admitNothingOpts });
                 toolPlanes = [
                     {
-                        backend: retrievalBackend(backend),
+                        backend: retrievalBackend(backend, adoptionRestricted || memorySpec.writeScope === null),
                         scopes: planeScopes(memorySpec.scopes, memorySpec.writeScope),
                         recordRetrieved: (ids) => engine.recordRetrieved(ids),
                         challengeExclusions: () => engine.readChallengeExclusions(),