@sema-agent/core 5.29.0 → 5.30.0

package/dist/core/types.d.ts

@@ -650,6 +650,21 @@ export interface ToolExecuteContext {
      * read-only boundary ended at one level. Strictly a capability REMOVAL — it can never widen a child.
      */
     handsReadOnly?: true;
+    /**
+     * design/199 — the READ-face clamp carrier ({@link TaskSpec.readFace}): present (as "roots") ONLY
+     * when this run RESOLVED to the roots face, so a delegation tool pins every child spec to roots —
+     * without it a roots-narrowed parent's children would resolve the shared deployment seat (possibly
+     * "open") and read wider than the parent could. Strictly a tightening carrier: an open parent adds
+     * no key, and nothing in the delegation lane can spell "open". F10 ruling (v1): this seat exists
+     * ONLY as the delegation carrier — no tool adapts its model-facing behavior on it.
+     */
+    readFace?: "roots";
+    /**
+     * design/199 件B — the parent task's OWN deny-set additions ({@link TaskSpec.readDenyPatterns}),
+     * traveling the delegation tree add-only (a child judges at least every entry its parent judged).
+     * Runner-filled trusted seat, never a model argument.
+     */
+    readDenyPatterns?: readonly import("../tools/fs/read-deny.js").ReadDenyEntry[];
     /**
      * The HARD-HEADLESS clamp ({@link TaskSpec.interactiveTools} set to `false` — "never mount a
      * human-facing tool on this run, whatever faces exist"), Runner-filled read-only on the same trusted
@@ -2109,6 +2124,27 @@ export interface TaskSpec {
      * config read.
      */
     additionalReadDirectories?: string[];
+    /**
+     * design/199 件B — TASK-layer ADDITIONS to the built-in sensitive-path READ deny set
+     * ({@link import("../tools/fs/read-deny.js").READ_FACE_DEFAULT_DENY_ENTRIES}). Judged by the
+     * structured read faces (Read/Grep/Glob/RepoMap, their traversals, the classify shell gate's
+     * auto-allow probe and the compaction attachment reader) in BOTH containment modes. Add-only
+     * everywhere (D-4 zero-shrink ruling): entries here UNION with the built-ins and the deployment's
+     * {@link RunnerDeps.readDenyPatterns}; `[]` ≡ absent (union identity); nothing can remove a
+     * built-in. Bad entry shapes refuse loudly at prepare (#123). The write faces are untouched.
+     */
+    readDenyPatterns?: readonly import("../tools/fs/read-deny.js").ReadDenyEntry[];
+    /**
+     * design/199 件A — the TASK layer's read-face containment declaration
+     * ({@link import("../tools/fs/read-face.js").ReadFace}). "roots" pins this task (and, via the
+     * tighten-only clamp, its whole delegation subtree) to the historical containment; "open" lifts
+     * the roots judgment for the structured read faces — refused loudly under org governance (the
+     * task layer only tightens there; the deployment opens via {@link RunnerDeps.readFace}) and
+     * beside `handsReadOnly: true` (the verifier containment is load-bearing). Absent ⇒ the
+     * deployment seat, then the engine default ("roots" — D-1b: an upgrade never opens implicitly).
+     * Bad values refuse loudly (#123). Never affects the write faces.
+     */
+    readFace?: import("../tools/fs/read-face.js").ReadFace;
     /**
      * design/80 D-B — opt in to PLAN MODE: mount the first-party `present_plan` tool (CC `ExitPlanMode` parity).
      * The model calls it to present a plan; the engine then pauses with a durable `plan_review` checkpoint
@@ -4265,6 +4301,25 @@ export interface RunnerDeps {
      * Runner 私有编排字段(taskRegistry/detachHub/execClamp/cwdRef/…)不在此面,永不开放。
      */
     hands?: HandsBandOptions;
+    /**
+     * design/199 件B — DEPLOYMENT-layer ADDITIONS to the built-in sensitive-path READ deny set
+     * ({@link import("../tools/fs/read-deny.js").READ_FACE_DEFAULT_DENY_ENTRIES}); see
+     * {@link TaskSpec.readDenyPatterns} for the judged surfaces. Add-only (D-4 zero-shrink ruling):
+     * unions with the built-ins and any task-layer additions; there is no whole-table replacement
+     * escape hatch, and `[]` ≡ absent. Bad entry shapes refuse loudly at prepare (#123).
+     */
+    readDenyPatterns?: readonly import("../tools/fs/read-deny.js").ReadDenyEntry[];
+    /**
+     * design/199 件A — the DEPLOYMENT's read-face declaration
+     * ({@link import("../tools/fs/read-face.js").ReadFace}; see {@link TaskSpec.readFace} for the
+     * task layer and the resolution order). An interactive single-user product declares
+     * `readFace: "open"` here in one line; the engine default stays "roots" (D-1b). Under org
+     * governance this seat may still open (it is the deployment's own declaration); the task layer
+     * may not. Beside a read-only (verifier) mount this seat's "open" silently CLAMPS to roots (a
+     * deployment default cannot override a load-bearing containment wall) — TaskSpec.readFace's own
+     * "open" there is the genuine per-task contradiction, and that one still refuses loudly (#123).
+     */
+    readFace?: import("../tools/fs/read-face.js").ReadFace;
     /**
      * design/96 §20 (P1a) — DEPLOYMENT-DECLARED training knowledge cutoff per model id (e.g.
      * `{ "qwen-3.5-35b": "2025-01", "deepseek-pro": "2024-07" }`). When the resolved model id is present, the

package/dist/engine/harness/types.d.ts

@@ -349,6 +349,16 @@ export interface ExecutionEnv extends FileSystem, Shell {
      * mechanism exists to prevent.
      */
     readonly lifetimeStartedAt?: number;
+    /**
+     * #211 (design/199 seam) — does this environment's path NAMESPACE live on the CONTROL-PLANE HOST's
+     * filesystem? Declared by the ADAPTER: `false` for a virtual/sandboxed env whose paths never map
+     * onto the host (an in-memory env, a container the host cannot mount) — consumers that record
+     * host-path receipts (the workflow workspace observer's `worktreeDir`) then refuse to present this
+     * env's cwd as a host path. Omitted ⇒ the historical structural inference stays in force
+     * (isRemoteExecutionEnv shape detection; a plain NodeExecutionEnv is host-local). `true` is a
+     * harmless explicit spelling of the local default.
+     */
+    readonly hostLocalPaths?: boolean;
 }
 /** Base fields shared by append-only session tree entries. */
 export interface SessionTreeEntryBase {

package/dist/index.d.ts

@@ -87,6 +87,8 @@ export type { InvariantKind, FunctionContract, Invariant, InvariantViolation, Ch
 export { HAND_TOOL_EFFECTS, bashReversibilityProbe, BASH_READONLY_DEFAULT_ALLOW, parseLeadingCommandName, classifyCompoundReadonly, MAX_EDIT_BYTES } from "./tools/fs/index.js";
 export { classifyCompoundReadonlyDetailed, formatOutOfRootReadApprovalOption, type BashReadonlyRootBoundary, type CompoundReadonlyVerdict, } from "./tools/fs/index.js";
 export { resolveBashTimeoutCaps } from "./tools/fs/index.js";
+export { READ_FACE_DEFAULT_DENY_ENTRIES, compileReadDeny, type ReadDenyEntry, type ReadDenyMatcher, type NormalizedReadDenyEntry, } from "./tools/fs/index.js";
+export { resolveReadFace, type ReadFace, type ReadFaceInputs } from "./tools/fs/index.js";
 export { InMemoryToolResultStore, OFFLOAD_TOOL_NAME, DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, assertSafeToolResultRef, buildToolResultRef, toolResultContentSegment, MAX_MINTED_TOOL_RESULT_REF_CHARS, type ToolResultProvenance, assertToolResultProvenanceMatch, normalizeToolResultProvenance, toolResultProvenanceOf, ToolResultRefConflictError, TOOL_RESULT_REF_CONFLICT_CODE, type ToolResultStore, type ToolResultSlice, type ToolResultDeletionReport, } from "./core/tool-result-store.js";
 export { InMemoryCheckpointStore, CheckpointError, mintCheckpointToken, checkpointVersionOf, CURRENT_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, ORG_ADMISSION_CHECKPOINT_VERSION, F012_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, debitLedger, remainingBudgetMicroUsd, remainingTokens, winnerFromOutcome, validatePendingSteer, readPendingSteerQueue, appendPendingSteer, MAX_PENDING_STEER_CHARS, MAX_PENDING_STEER_ENTRIES, PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES, PENDING_STEER_FROZEN_FIELDS, ACTOR_ASSERTION_FROZEN_FIELDS, MAX_ACTOR_FIELD_CHARS, MAX_STEER_INPUT_ID_CHARS, LEGACY_PENDING_STEER_INPUT_ID, type ActorAssertion, type PendingSteerEntry, type PendingSteerInput, riskSeverity, buildRiskDescriptor, summarizeCheckpoint, type RiskDescriptor, type CheckpointStore, type CheckpointSummary, type Checkpoint, type CheckpointToken, type CheckpointGate, type CheckpointState, type SerializedCheckpointState, type CheckpointFaultMode, type PendingAction, type ResumeOutcome, type ResolvedOutcome, type ReopenReason, type ResolveExpectation, type SafetyAxis, type RealApprovalGateBit, type ResourceLedger, type ResourceLimitReason, type PlatformLimitReason, } from "./core/checkpoint-store.js";
 export { InMemoryUsageWindowStore, GLOBAL_USAGE_KEY, EMPTY_USAGE_WINDOW_RECORD, chargeUsageRecord, readUsageRecord, usageRetryAfterMs, resolveUsageWindows, type UsageWindow, type UsageWindowStore, type UsageWindowReading, type UsageWindowRecord, type UsageSlot, type UsageBucketRow, } from "./core/usage-window-store.js";
@@ -168,7 +170,7 @@ export { encodeSurfacedKey, buildManifestText, validateSelectedIds, composeSelec
 export { runMemoryConsolidation, CONSOLIDATION_SYSTEM_PROMPT, DEFAULT_CONSOLIDATION_BAND, DEFAULT_CONSOLIDATION_SEARCH_LIMIT, DEFAULT_CONSOLIDATION_MAX_NOTES, DEFAULT_CONSOLIDATION_TIMEOUT_SEC, normalizeForExactMatch, type ConsolidationParams, type ConsolidationStats, type ConsolidationNote, type ConsolidationLLM, } from "./core/runner/memory-consolidation.js";
 export { consolidateScope, advanceCursorAfterInline, type ConsolidateScopeDeps, type ConsolidateScopeOptions, } from "./core/consolidate-scope.js";
 export { DEFAULT_COMPACTION_INSTRUCTIONS } from "./core/auto-compaction.js";
-export { DEFAULT_SYSTEM_PROMPT, CODE_AGENT_PROMPT, SUBAGENT_PROMPT, CODE_SYSTEM_PROMPT, MEMORY_GUIDANCE, MEMORY_SAFETY, MEMORY_HYGIENE, NO_PERSISTENT_MEMORY_NOTICE, OUTPUT_EFFICIENCY, CYBER_RISK, HARNESS_SECTION_ANCHOR, URL_SAFETY, SUMMARIZE_TOOL_RESULTS, EXECUTION_ENVIRONMENT, harnessContext, buildEnvironmentContext, buildGitSnapshot, buildScratchpadSection, GIT_STATUS_MAX_CHARS, formatLocalDate, type EnvironmentFacts, defaultPromptProvider, composeSystemPrompt, composeConstitution, constitutionBlocks, type PromptBlock, analyzePromptCacheFriendliness, assertPromptCacheFriendly, type PromptProvider, type StablePromptContext, type PromptCacheReport, type PromptTextDeclaration, } from "./prompts/default.js";
+export { DEFAULT_SYSTEM_PROMPT, CODE_AGENT_PROMPT, SUBAGENT_PROMPT, CODE_SYSTEM_PROMPT, MEMORY_GUIDANCE, MEMORY_SAFETY, MEMORY_HYGIENE, NO_PERSISTENT_MEMORY_NOTICE, OUTPUT_EFFICIENCY, CYBER_RISK, HARNESS_SECTION_ANCHOR, URL_SAFETY, SUMMARIZE_TOOL_RESULTS, EXECUTION_ENVIRONMENT, EXECUTION_ENVIRONMENT_OPEN_READS, harnessContext, buildEnvironmentContext, buildGitSnapshot, buildScratchpadSection, GIT_STATUS_MAX_CHARS, formatLocalDate, type EnvironmentFacts, defaultPromptProvider, composeSystemPrompt, composeConstitution, constitutionBlocks, type PromptBlock, analyzePromptCacheFriendliness, assertPromptCacheFriendly, type PromptProvider, type StablePromptContext, type PromptCacheReport, type PromptTextDeclaration, } from "./prompts/default.js";
 export { SUPERVISOR_PROMPT, ORCHESTRATION_GUIDANCE, ORCHESTRATION_AWARENESS, GOAL_COMPLETION_GUIDANCE } from "./prompts/supervisor.js";
 export { compose, validatePack } from "./prompt-assembly/composer.js";
 export { SEMA_DEFAULT_PACK } from "./prompt-assembly/packs/sema-default.js";

package/dist/index.js

@@ -68,6 +68,8 @@ export { deriveInvariants, checkInvariants } from "./core/property-harness.js";
 export { HAND_TOOL_EFFECTS, bashReversibilityProbe, BASH_READONLY_DEFAULT_ALLOW, parseLeadingCommandName, classifyCompoundReadonly, MAX_EDIT_BYTES } from "./tools/fs/index.js";
 export { classifyCompoundReadonlyDetailed, formatOutOfRootReadApprovalOption, } from "./tools/fs/index.js";
 export { resolveBashTimeoutCaps } from "./tools/fs/index.js";
+export { READ_FACE_DEFAULT_DENY_ENTRIES, compileReadDeny, } from "./tools/fs/index.js";
+export { resolveReadFace } from "./tools/fs/index.js";
 export { InMemoryToolResultStore, OFFLOAD_TOOL_NAME, DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, assertSafeToolResultRef, buildToolResultRef, toolResultContentSegment, MAX_MINTED_TOOL_RESULT_REF_CHARS, assertToolResultProvenanceMatch, normalizeToolResultProvenance, toolResultProvenanceOf, ToolResultRefConflictError, TOOL_RESULT_REF_CONFLICT_CODE, } from "./core/tool-result-store.js";
 export { InMemoryCheckpointStore, CheckpointError, mintCheckpointToken, checkpointVersionOf, CURRENT_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, ORG_ADMISSION_CHECKPOINT_VERSION, F012_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, debitLedger, remainingBudgetMicroUsd, remainingTokens, winnerFromOutcome, validatePendingSteer, readPendingSteerQueue, appendPendingSteer, MAX_PENDING_STEER_CHARS, MAX_PENDING_STEER_ENTRIES, PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES, PENDING_STEER_FROZEN_FIELDS, ACTOR_ASSERTION_FROZEN_FIELDS, MAX_ACTOR_FIELD_CHARS, MAX_STEER_INPUT_ID_CHARS, LEGACY_PENDING_STEER_INPUT_ID, riskSeverity, buildRiskDescriptor, summarizeCheckpoint, } from "./core/checkpoint-store.js";
 export { InMemoryUsageWindowStore, GLOBAL_USAGE_KEY, EMPTY_USAGE_WINDOW_RECORD, chargeUsageRecord, readUsageRecord, usageRetryAfterMs, resolveUsageWindows, } from "./core/usage-window-store.js";
@@ -131,7 +133,7 @@ export { encodeSurfacedKey, buildManifestText, validateSelectedIds, composeSelec
 export { runMemoryConsolidation, CONSOLIDATION_SYSTEM_PROMPT, DEFAULT_CONSOLIDATION_BAND, DEFAULT_CONSOLIDATION_SEARCH_LIMIT, DEFAULT_CONSOLIDATION_MAX_NOTES, DEFAULT_CONSOLIDATION_TIMEOUT_SEC, normalizeForExactMatch, } from "./core/runner/memory-consolidation.js";
 export { consolidateScope, advanceCursorAfterInline, } from "./core/consolidate-scope.js";
 export { DEFAULT_COMPACTION_INSTRUCTIONS } from "./core/auto-compaction.js";
-export { DEFAULT_SYSTEM_PROMPT, CODE_AGENT_PROMPT, SUBAGENT_PROMPT, CODE_SYSTEM_PROMPT, MEMORY_GUIDANCE, MEMORY_SAFETY, MEMORY_HYGIENE, NO_PERSISTENT_MEMORY_NOTICE, OUTPUT_EFFICIENCY, CYBER_RISK, HARNESS_SECTION_ANCHOR, URL_SAFETY, SUMMARIZE_TOOL_RESULTS, EXECUTION_ENVIRONMENT, harnessContext, buildEnvironmentContext, buildGitSnapshot, buildScratchpadSection, GIT_STATUS_MAX_CHARS, formatLocalDate, defaultPromptProvider, composeSystemPrompt, composeConstitution, constitutionBlocks, analyzePromptCacheFriendliness, assertPromptCacheFriendly, } from "./prompts/default.js";
+export { DEFAULT_SYSTEM_PROMPT, CODE_AGENT_PROMPT, SUBAGENT_PROMPT, CODE_SYSTEM_PROMPT, MEMORY_GUIDANCE, MEMORY_SAFETY, MEMORY_HYGIENE, NO_PERSISTENT_MEMORY_NOTICE, OUTPUT_EFFICIENCY, CYBER_RISK, HARNESS_SECTION_ANCHOR, URL_SAFETY, SUMMARIZE_TOOL_RESULTS, EXECUTION_ENVIRONMENT, EXECUTION_ENVIRONMENT_OPEN_READS, harnessContext, buildEnvironmentContext, buildGitSnapshot, buildScratchpadSection, GIT_STATUS_MAX_CHARS, formatLocalDate, defaultPromptProvider, composeSystemPrompt, composeConstitution, constitutionBlocks, analyzePromptCacheFriendliness, assertPromptCacheFriendly, } from "./prompts/default.js";
 export { SUPERVISOR_PROMPT, ORCHESTRATION_GUIDANCE, ORCHESTRATION_AWARENESS, GOAL_COMPLETION_GUIDANCE } from "./prompts/supervisor.js";
 export { compose, validatePack } from "./prompt-assembly/composer.js";
 export { SEMA_DEFAULT_PACK } from "./prompt-assembly/packs/sema-default.js";

package/dist/orchestration/run-workflow-tool.d.ts

@@ -219,6 +219,12 @@ export interface RunWorkflowToolDeps {
     /** Call-time getter for the HOST task's current thinking level — a spawned agent with no explicit
      *  script/baseline `thinking` inherits it (the parentCwd/model-snapshot companion). */
     parentThinking?: () => import("../core/types.js").TaskSpec["thinking"];
+    /** 5.30 merge-rescan (design/199 parity gap) — call-time getter for the HOST task's RESOLVED
+     *  read-face containment; folds stricter-wins into every spawned workflow child (see
+     *  `buildWorkflowPrimitives`'s injection block for the full rationale). */
+    parentReadFace?: () => import("../core/types.js").TaskSpec["readFace"];
+    /** Twin of the above for the deny-set additions (union, not replace). */
+    parentReadDenyPatterns?: () => import("../core/types.js").TaskSpec["readDenyPatterns"];
     /** [1238](A) — call-time getter for the HOST task's RESOLVED Model object: a spawned agent whose
      *  fold chain produced no model inherits the parent's full object (baseUrl/key routing included),
      *  mirroring the subagent lane's ctx.model semantics. */
@@ -254,6 +260,21 @@ export interface RunWorkflowToolDeps {
     autoModeReview?: () => {
         decider: import("../core/auto-mode.js").AutoModeDecider;
     } | undefined;
+    /** 5.30 merge-rescan round 2 — the HOST task's durable OFF SWITCH (`spec.checkpointStore === null`,
+     *  ruled 2026-08-04 to inherit into every spawned agent, see `buildWorkflowPrimitives`'s call
+     *  above). Known at prepare-time (no lazy getter needed — `spec` is available at mount). A dep for
+     *  the same reason as `forwardEvent`/`inheritedGateForChildren`: the auto-mounted tool's execute
+     *  ctx is minimal `{toolCallId, signal}`, so `ctx.checkpointStoreDisabledForChildren` was a DEAD
+     *  read there — the off-switch never actually reached this lane's children. */
+    parentCheckpointStoreDisabled?: boolean;
+    /** Twin of the above for design/148 S1's center-artifact inheritance (see the `ctx.centerArtifactDigest`/
+     *  `ctx.centerSourceRevision` reads at the `startWorkflow` options site) — `centerAdoption` resolves
+     *  LATE in prepare-task.ts (well after this tool's mount point), so this is a call-time getter, not
+     *  a value, mirroring `parentReadFace`. `ctx.centerArtifactDigest` still wins when a wrapping path
+     *  provides it. */
+    parentCenterArtifactDigest?: () => string | undefined;
+    /** Publish-provenance companion of the above. */
+    parentCenterSourceRevision?: () => string | undefined;
 }
 /**
  * Build the `run_workflow` tool. ASSERTS the runner is a hard sandbox (defense in depth — prepare-task only

package/dist/orchestration/run-workflow-tool.js

@@ -380,7 +380,7 @@ export async function createRunWorkflowTool(d) {
                 return structuredError(`workflow script failed to compile: ${err instanceof Error ? err.message : String(err)}`);
             }
             const scriptFn = (wfCtx) => {
-                const primitives = buildWorkflowPrimitives(wfCtx, governance, d.onAgentSpawn, d.parentThinking, principal, ctx.checkpointStoreDisabledForChildren === true);
+                const primitives = buildWorkflowPrimitives(wfCtx, governance, d.onAgentSpawn, d.parentThinking, principal, ctx.checkpointStoreDisabledForChildren === true || d.parentCheckpointStoreDisabled === true, d.parentReadFace, d.parentReadDenyPatterns);
                 return d.scriptRunner.run({ scriptSource: script, primitives, scriptArgs: effectiveArgs, signal: wfCtx.signal }).then((r) => r.result);
             };
             if (ctx.signal?.aborted) {
@@ -389,6 +389,9 @@ export async function createRunWorkflowTool(d) {
             let handle;
             const workflowTaskId = d.taskRegistry?.mintTaskId("workflow");
             const autoModeReview = ctx.autoModeReview ?? d.autoModeReview?.();
+            const centerFromCtx = ctx.centerArtifactDigest !== undefined;
+            const parentCenterArtifactDigest = centerFromCtx ? ctx.centerArtifactDigest : d.parentCenterArtifactDigest?.();
+            const parentCenterSourceRevision = centerFromCtx ? ctx.centerSourceRevision : d.parentCenterSourceRevision?.();
             try {
                 handle = startWorkflow(d.runner, scriptFn, {
                     store: d.store,
@@ -417,8 +420,8 @@ export async function createRunWorkflowTool(d) {
                     ...((ctx.interactionPosture ?? d.parentInteractionPosture) !== undefined ? { interactionPosture: (ctx.interactionPosture ?? d.parentInteractionPosture) } : {}),
                     ...(d.parentModel !== undefined ? { defaultModel: d.parentModel } : {}),
                     ...(d.parentGetApiKeyAndHeaders !== undefined ? { defaultGetApiKeyAndHeaders: d.parentGetApiKeyAndHeaders } : {}),
-                    ...(ctx.centerArtifactDigest !== undefined ? { parentCenterArtifactDigest: ctx.centerArtifactDigest } : {}),
-                    ...(ctx.centerSourceRevision !== undefined ? { parentCenterSourceRevision: ctx.centerSourceRevision } : {}),
+                    ...(parentCenterArtifactDigest !== undefined ? { parentCenterArtifactDigest } : {}),
+                    ...(parentCenterSourceRevision !== undefined ? { parentCenterSourceRevision } : {}),
                     ...((ctx.forwardEvent ?? d.forwardEvent) !== undefined ? { onForwardEvent: (ctx.forwardEvent ?? d.forwardEvent) } : {}),
                     ...((ctx.inheritedGateForChildren ?? d.inheritedGateForChildren) !== undefined
                         ? { inheritedGate: (ctx.inheritedGateForChildren ?? d.inheritedGateForChildren)() }

package/dist/orchestration/workflow-primitives.d.ts

@@ -30,4 +30,13 @@ export interface WorkflowGovernance {
 export declare function buildWorkflowPrimitives(ctx: WorkflowRunContext, governance?: WorkflowGovernance, onAgentSpawn?: (handle: WorkflowAgentHandle) => void, parentThinking?: () => TaskSpec["thinking"], parentPrincipal?: string, 
 /** ruled 2026-08-04 — the host run set `TaskSpec.checkpointStore: null` (the per-run durable off
  *  switch). Every agent this workflow spawns inherits it; see the injection below. */
-parentCheckpointStoreDisabled?: boolean): WorkflowPrimitives;
+parentCheckpointStoreDisabled?: boolean, 
+/** 5.30 merge-rescan (design/199 parity gap) — the host run's RESOLVED read-face containment
+ *  (post deps/org/mount resolution, not the raw spec value). `TaskSpec.readFace`'s own JSDoc
+ *  promises "roots pins this task, and via the tighten-only clamp, its whole delegation subtree" —
+ *  a workflow child is that subtree; the Task/SendMessage delegation lane already carries this,
+ *  the workflow lane was the one gap. Lazy (read at spawn time, after prepare has resolved it). */
+parentReadFace?: () => TaskSpec["readFace"], 
+/** Twin of the above for the deny-set additions (built-ins always apply; these are the extra
+ *  entries the host's own deployment/task layers stacked on). */
+parentReadDenyPatterns?: () => TaskSpec["readDenyPatterns"]): WorkflowPrimitives;

package/dist/orchestration/workflow-primitives.js

@@ -22,7 +22,7 @@ function formatResourceClampNote(notes) {
     const parts = notes.map((n) => `${n.field}: requested ${n.requested === undefined ? "unset" : n.requested} → applied ${n.applied}`);
     return `workflow governance tightened this agent's resource limits (${parts.join("; ")})`;
 }
-export function buildWorkflowPrimitives(ctx, governance, onAgentSpawn, parentThinking, parentPrincipal, parentCheckpointStoreDisabled) {
+export function buildWorkflowPrimitives(ctx, governance, onAgentSpawn, parentThinking, parentPrincipal, parentCheckpointStoreDisabled, parentReadFace, parentReadDenyPatterns) {
     const agent = (spec, opts) => {
         if (typeof spec === "string")
             spec = { objective: spec };
@@ -42,6 +42,17 @@ export function buildWorkflowPrimitives(ctx, governance, onAgentSpawn, parentThi
         if (parentCheckpointStoreDisabled === true) {
             childSpec.checkpointStore = null;
         }
+        if (parentReadFace) {
+            const pf = parentReadFace();
+            if (pf === "roots" && childSpec.readFace !== "roots")
+                childSpec.readFace = "roots";
+        }
+        if (parentReadDenyPatterns) {
+            const pd = parentReadDenyPatterns();
+            if (pd !== undefined && pd.length > 0) {
+                childSpec.readDenyPatterns = childSpec.readDenyPatterns !== undefined ? [...childSpec.readDenyPatterns, ...pd] : [...pd];
+            }
+        }
         if (onAgentSpawn) {
             return ctx.agentStream(childSpec, agentOpts).then((handle) => {
                 onAgentSpawn(handle);

package/dist/prompt-assembly/epoch.js

@@ -22,6 +22,7 @@ const PROBE_FACTS_OFF = {
     isSubagent: false,
     promptProfile: "simple",
     fableMitigations: false,
+    readFaceOpen: false,
 };
 const PROBE_FACTS_ON = {
     policyEnabled: true,
@@ -38,6 +39,7 @@ const PROBE_FACTS_ON = {
     isSubagent: true,
     promptProfile: "classic",
     fableMitigations: true,
+    readFaceOpen: true,
 };
 const PROBE_VECTORS = [
     PROBE_FACTS_OFF,

package/dist/prompt-assembly/packs/sema-default.js

@@ -1,4 +1,4 @@
-import { CYBER_RISK, EXECUTION_ENVIRONMENT, URL_SAFETY, SUMMARIZE_TOOL_RESULTS, WORKTREE_NOTICE, SUBAGENT_CONSENT_NOTICE, SUBAGENT_DELIVERY_NOTES, harnessHeadLines, } from "../../prompts/default.js";
+import { CYBER_RISK, EXECUTION_ENVIRONMENT, EXECUTION_ENVIRONMENT_OPEN_READS, URL_SAFETY, SUMMARIZE_TOOL_RESULTS, WORKTREE_NOTICE, SUBAGENT_CONSENT_NOTICE, SUBAGENT_DELIVERY_NOTES, harnessHeadLines, } from "../../prompts/default.js";
 import { GOAL_COMPLETION_GUIDANCE, ORCHESTRATION_AWARENESS, ORCHESTRATION_GUIDANCE, ORCHESTRATION_GUIDANCE_DEFERRED, SUPERVISOR_PROMPT, } from "../../prompts/supervisor.js";
 import { TEAMMATE_COMMUNICATION_ADDENDUM } from "../../prompts/coordinator.js";
 import { SIMPLE_ACTION_CAUTION, SIMPLE_ACT_DONT_REDERIVE, SIMPLE_AUTONOMY_FABLE, SIMPLE_COMMUNICATING_FABLE, SIMPLE_CORRECTIONS_FABLE, SIMPLE_DELIVERING_WORK_FABLE, SIMPLE_COMMUNICATING_LEAN, SIMPLE_CONTEXT_MANAGEMENT, SIMPLE_PRONOUNS, SIMPLE_TOOL_PARAM_JSON, SEMA_VERIFY_FRESH, SEMA_EVIDENCE_AUDIT, } from "../../prompts/simple-sections.js";
@@ -41,7 +41,7 @@ export const SEMA_DEFAULT_PACK = {
             rank: 240,
             ...CORE,
             admit: (i) => i.facts.policyEnabled || i.facts.isolationEnabled,
-            content: () => EXECUTION_ENVIRONMENT,
+            content: (i) => (i.facts.readFaceOpen === true ? EXECUTION_ENVIRONMENT_OPEN_READS : EXECUTION_ENVIRONMENT),
             legacyBlockId: "harness.context",
         },
         { id: "core/simple.communicating", slot: "harness", rank: 250, ...CORE, admit: (i) => i.facts.promptProfile !== "classic", content: (i) => (i.facts.fableMitigations === true ? SIMPLE_COMMUNICATING_FABLE : SIMPLE_COMMUNICATING_LEAN), legacyBlockId: "harness.context" },

package/dist/prompt-assembly/types.d.ts

@@ -41,6 +41,10 @@ export interface PromptRuntimeFacts {
     policyEnabled: boolean;
     hooksEnabled: boolean;
     isolationEnabled: boolean;
+    /** design/199 F8① — the resolved read face is OPEN (renders the execution-environment block's
+     *  open-reads first bullet). OPTIONAL: absence reads as false (roots wording, byte-identical),
+     *  so existing fact constructors keep compiling. */
+    readFaceOpen?: boolean;
     withinTaskCompactionEnabled: boolean;
     supervisorEnabled: boolean;
     orchestrationEnabled: boolean;

package/dist/prompts/default.d.ts

@@ -161,15 +161,9 @@ export declare const URL_SAFETY = "IMPORTANT: You must NEVER generate or guess U
  * runs before EVERY request, which is a stronger reason to warn than CC's.
  */
 export declare const SUMMARIZE_TOOL_RESULTS = "When working with tool results, write down any important information you might need later in your own response, as the original tool result may be cleared or summarized from the context later.";
-/**
- * Execution-environment / isolation behavior contract (design/64 §16.2 — verbatim, copy-paste-ready). Our
- * adaptation of CC's sandbox prompt: CC's `SandboxManager` (Seatbelt / allowedHosts) is product-specific and
- * we don't run it; this gives the model-visible contract for OUR exec-env (managed container / remote host)
- * + the design/37 policy gate — how to read a restriction (permission/network/policy-deny) vs an ordinary
- * failure, and to not circumvent a genuine restriction. Injected only when isolation OR a policy gate is
- * active (§16.2) — never claim an isolated environment that isn't there.
- */
-export declare const EXECUTION_ENVIRONMENT = "# Execution environment\nCommands run inside an isolated execution environment (a managed container or remote host), not on the operator's machine. Within it:\n- You can read and write within the project working directory. Writes outside it, or to system paths, may be denied by the environment or the permission policy.\n- Network access may be restricted to an allowlist. A blocked request fails at the network layer \u2014 it does not silently succeed.\n- A permission policy may intercept individual tool calls and deny them. A denied call did not run; do not re-issue the identical call. Follow the denial message's own guidance: a policy denial is something to reason about and adjust to, while a rejection by the user means stop and follow their direction rather than working around it. If you cannot tell why a call was denied, ask the user (via the AskUserQuestion tool, if available) rather than guessing.\n\nWhen a command fails, identify the cause before retrying:\n- Evidence of an environment/permission restriction: \"Operation not permitted\", \"Permission denied\" on an unexpected path, a network timeout/refusal to a host, or an explicit policy-deny message.\n- Ordinary failures (missing file, wrong argument, a non-zero exit from the program itself) are unrelated to isolation \u2014 fix the command rather than treating it as a restriction.\n\nIf a restriction genuinely blocks a necessary action, do NOT attempt to circumvent it (no privilege escalation, no disabling of guards, no destructive workarounds). Adjust your approach, or surface the limitation to the user with the specific evidence you saw.";
+export declare const EXECUTION_ENVIRONMENT: string;
+/** design/199 F8① — the open-read-face variant (first bullet tells the truth about reads). */
+export declare const EXECUTION_ENVIRONMENT_OPEN_READS: string;
 /**
  * design/97 CORE-6 (P1b) — worktree-isolation NOTICE. Composed (via {@link StablePromptContext.worktreeIsolated})
  * only when the task runs in an isolated git worktree, so the model treats inherited paths correctly. Generic
@@ -291,6 +285,10 @@ export interface EnvironmentFacts {
     /** Ruled 2026-08-05 (read-boundary whitelist): extra directories the READ faces may access
      *  (canonical) — reads auto-classify inside them, writes are refused exactly as before. */
     additionalReadDirectories?: readonly string[];
+    /** design/199 件A — the RESOLVED read-face containment state ("open" | "roots"; additive
+     *  structured key). Rendered only when "open" (the roots posture is the historical default and
+     *  renders nothing new — byte-compat). */
+    readFace?: "open" | "roots";
     /** OS name (uname -s) — remote = the container's, not the host's. */
     platform?: string;
     /** OS version (uname -r). */
@@ -444,6 +442,13 @@ export interface StablePromptContext {
      * line in {@link harnessContext}. Don't claim a deny mechanism the task doesn't have (§6.3).
      */
     policyEnabled?: boolean;
+    /**
+     * design/199 F8① — the resolved read face is OPEN: the `# Execution environment` block's first
+     * bullet renders its open-reads variant ({@link EXECUTION_ENVIRONMENT_OPEN_READS}) so the prompt
+     * never claims a read fence that is not there. Absent/false ⇒ the historical (roots) wording,
+     * byte-identical.
+     */
+    readFaceOpen?: boolean;
     /**
      * Whether hooks are wired (design/37) — drives the "hook output is user feedback" line in
      * {@link harnessContext}. Omitted/false → that line is left out (§6.3).

package/dist/prompts/default.js

@@ -108,9 +108,13 @@ You have no persistent memory store: what is said in this conversation is not au
 export const CYBER_RISK = `IMPORTANT: Assist with authorized security testing, defensive security, CTF challenges, and educational contexts. Refuse requests for destructive techniques, DoS attacks, mass targeting, supply chain compromise, or detection evasion for malicious purposes. Dual-use security tools (C2 frameworks, credential testing, exploit development) require clear authorization context: pentesting engagements, CTF competitions, security research, or defensive use cases.`;
 export const URL_SAFETY = `IMPORTANT: You must NEVER generate or guess URLs for the user unless you are confident that the URLs are for helping the user with programming. You may use URLs provided by the user in their messages or local files.`;
 export const SUMMARIZE_TOOL_RESULTS = `When working with tool results, write down any important information you might need later in your own response, as the original tool result may be cleared or summarized from the context later.`;
-export const EXECUTION_ENVIRONMENT = `# Execution environment
+function executionEnvironmentBlock(openReads) {
+    const readWriteLine = openReads
+        ? "- You can read files anywhere this environment exposes (a small sensitive-path deny list applies), and write within the project working directory. Writes outside it, or to system paths, may be denied by the environment or the permission policy."
+        : "- You can read and write within the project working directory. Writes outside it, or to system paths, may be denied by the environment or the permission policy.";
+    return `# Execution environment
 Commands run inside an isolated execution environment (a managed container or remote host), not on the operator's machine. Within it:
-- You can read and write within the project working directory. Writes outside it, or to system paths, may be denied by the environment or the permission policy.
+${readWriteLine}
 - Network access may be restricted to an allowlist. A blocked request fails at the network layer — it does not silently succeed.
 - A permission policy may intercept individual tool calls and deny them. A denied call did not run; do not re-issue the identical call. Follow the denial message's own guidance: a policy denial is something to reason about and adjust to, while a rejection by the user means stop and follow their direction rather than working around it. If you cannot tell why a call was denied, ask the user (via the AskUserQuestion tool, if available) rather than guessing.
 
@@ -119,6 +123,9 @@ When a command fails, identify the cause before retrying:
 - Ordinary failures (missing file, wrong argument, a non-zero exit from the program itself) are unrelated to isolation — fix the command rather than treating it as a restriction.
 
 If a restriction genuinely blocks a necessary action, do NOT attempt to circumvent it (no privilege escalation, no disabling of guards, no destructive workarounds). Adjust your approach, or surface the limitation to the user with the specific evidence you saw.`;
+}
+export const EXECUTION_ENVIRONMENT = executionEnvironmentBlock(false);
+export const EXECUTION_ENVIRONMENT_OPEN_READS = executionEnvironmentBlock(true);
 export const WORKTREE_NOTICE = `# Isolated worktree
 This task runs in its own isolated git worktree — a separate working copy whose root is the working directory shown in # Environment, NOT the repository's main checkout. Any absolute path you were given that points at the main checkout (or another worktree) refers to a DIFFERENT copy; translate it to the same relative path under this worktree's root before reading or writing, and operate only within this worktree. A file's content here may differ from the main checkout, so re-read a file in this worktree before editing it rather than assuming an earlier or external view is current.`;
 export const WORKTREE_STASH_WARNING = "The git stash stack is shared with the main checkout and all other worktrees, and other agent sessions may push or pop it concurrently. " +
@@ -151,7 +158,7 @@ export function harnessHeadLines(ctx) {
 export function harnessContext(ctx) {
     const blocks = [harnessHeadLines(ctx), CYBER_RISK, URL_SAFETY, SUMMARIZE_TOOL_RESULTS];
     if (ctx.policyEnabled || ctx.isolationEnabled)
-        blocks.push(EXECUTION_ENVIRONMENT);
+        blocks.push(ctx.readFaceOpen === true ? EXECUTION_ENVIRONMENT_OPEN_READS : EXECUTION_ENVIRONMENT);
     if (ctx.promptProfile !== "classic") {
         blocks.push(ctx.fableMitigations === true ? SIMPLE_COMMUNICATING_FABLE : SIMPLE_COMMUNICATING_LEAN);
         blocks.push(SIMPLE_PRONOUNS);
@@ -243,6 +250,9 @@ export function buildEnvironmentContext(facts) {
     if (facts.additionalReadDirectories && facts.additionalReadDirectories.length > 0) {
         lines.push(`Additional read-only directories: ${facts.additionalReadDirectories.map((d) => inlineUntrusted(d)).join(", ")}`);
     }
+    if (facts.readFace === "open") {
+        lines.push("File reads are not confined to the workspace root. A small sensitive-path deny list applies (see refusals for the exact pattern).");
+    }
     if (facts.isGitRepo !== undefined)
         lines.push(`Is a git repository: ${facts.isGitRepo ? "yes" : "no"}`);
     if (facts.gitBranch)

package/dist/tools/fs/bash-readonly-classifier.d.ts

@@ -91,6 +91,27 @@ export interface BashReadonlyRootBoundary {
      *  out-of-root signal — the classifier does not know where it points, which is a different verdict
      *  from knowing it points outside). */
     homeDir?: string;
+    /** design/199 件B — the sensitive-path read deny judge over LEXICALLY RESOLVED operands: a hit
+     *  demotes the command (ask, never auto-allow), independently of the roots — in-root operands are
+     *  judged too. Returns the matched pattern, or null. TWO named residuals, both inherited from this
+     *  classifier's declared purity (synchronous, zero I/O — RB-448/RB-451 state the same scope for the
+     *  containment half): ① operand TARGET matching only — no ancestor intersection, so `grep -r x ~/`
+     *  whose operand is `~` itself does not demote here (§3.4; the recursive reach residual belongs to
+     *  the full-bash lane's honest scope note); ② LEXICAL only — an in-root symlink whose target is a
+     *  guarded path reads as its innocent spelling here, exactly as it does for the containment half
+     *  (the enforcing/canonicalizing recheck is the bash_readonly leg's job via checkedPaths; the
+     *  classify auto-allow lane has no I/O seat by contract). The structured read faces judge BOTH
+     *  views (canonical + lexical) — this seat is the shell lane's honest-friction floor, not its
+     *  security boundary (§3.0). The `bash_readonly` face deliberately does NOT wire this seat (its
+     *  roots containment + command allowlist double gate is the deployment's own read-safety
+     *  declaration — v1 ruling). */
+    denyMatch?: (resolvedPath: string) => string | null;
+    /** design/199 件A — the resolved read-face containment state. Under "open" the CONTAINMENT half of
+     *  this boundary is structurally satisfied (an out-of-roots operand is not a demotion; it reports
+     *  as a checked candidate instead), while the deny half above keeps judging in both faces (§2.0).
+     *  Absent ⇒ "roots" (byte-compat). The `bash_readonly` face never passes this seat — its
+     *  containment is load-bearing and never opens. */
+    face?: "open" | "roots";
 }
 /**
  * RB-412 — the structured verdict of {@link classifyCompoundReadonlyDetailed}. `reason === undefined`

package/dist/tools/fs/bash-readonly-classifier.js

@@ -588,6 +588,12 @@ function evaluateReadBoundary(foldedSegments, boundary) {
         for (const finding of collectSegmentBoundaryFindings(toks, boundary)) {
             if (finding.kind === "unresolvable")
                 return { reason: finding.reason };
+            const denied = boundary.denyMatch?.(finding.path);
+            if (denied != null) {
+                return {
+                    reason: `a command operand resolves to "${finding.path}", which matches the sensitive-path read deny list (pattern "${denied}") ${NOT_AUTO_ALLOWED}`,
+                };
+            }
             if (finding.kind === "inside") {
                 if (!inside.includes(finding.path))
                     inside.push(finding.path);
@@ -598,6 +604,11 @@ function evaluateReadBoundary(foldedSegments, boundary) {
                     undecided.push(finding.path);
                 continue;
             }
+            if (boundary.face === "open") {
+                if (!inside.includes(finding.path))
+                    inside.push(finding.path);
+                continue;
+            }
             if (!outside.some((o) => o.path === finding.path))
                 outside.push(finding);
         }

package/dist/tools/fs/fs-bash.d.ts

@@ -40,6 +40,13 @@ import { type BashReadonlyRootBoundary } from "./bash-readonly-classifier.js";
 export declare function bashReversibilityProbe(allow?: readonly string[], boundary?: BashReadonlyRootBoundary | (() => BashReadonlyRootBoundary | undefined)): (args: unknown) => {
     reversible: boolean;
 };
+/**
+ * design/199 D-6 — the FULL shell's contract id, single-sourced: both shell faces share the wire
+ * name "Bash", so this id is the ONE structural discriminator between the write-capable shell and
+ * the read-only allowlist face (`core.bash_readonly@1`). Consumed by prepare-task's
+ * fullShellReachable roster assertion (its first load-bearing consumer).
+ */
+export declare const FULL_SHELL_CONTRACT_ID = "core.bash@1";
 /** The CC-verbatim exit-1 interpretation for `command`, or undefined when exit 1 means a real error.
  *  Conservative parse: last `;`/`&&`/`||`/newline statement → last `|` pipeline segment → leading
  *  command name (env-assignments skipped, path prefix stripped); `git grep`/`git diff` special-cased

package/dist/tools/fs/fs-bash.js

@@ -10,7 +10,7 @@ import { imageMagicMatches, withinAnyRoot } from "./safety.js";
 import { isRemoteExecutionEnv, hasDestroy, isIsolated } from "../../core/remote-env.js";
 import { ghRateLimitHint } from "./gh-rate-limit.js";
 import { resolveBashTimeoutCaps, bashTimeoutCapsSec, bashTimeoutArgRefusal, bashTimeoutParamDescription, envErrorDetail, bashMaxOutputChars, clipShellOutput, writeShellOverflowFile, createShellOverflowSpoolFence, shellRecoveryHint, CWD_SENTINEL, BASH_READONLY_CONFINEMENT_NOTE, } from "./fs-shared.js";
-import { BASH_READONLY_DEFAULT_ALLOW, coarseReadonlyCheck, classifyBoundedReadonlyPollLoop, classifyCompoundReadonly, classifySimpleCommandReadBoundary, NOT_AUTO_ALLOWED, } from "./bash-readonly-classifier.js";
+import { BASH_READONLY_DEFAULT_ALLOW, coarseReadonlyCheck, classifyBoundedReadonlyPollLoop, classifyCompoundReadonlyDetailed, classifySimpleCommandReadBoundary, NOT_AUTO_ALLOWED, } from "./bash-readonly-classifier.js";
 export function bashReversibilityProbe(allow, boundary) {
     const allowSet = new Set(allow ?? BASH_READONLY_DEFAULT_ALLOW);
     return (args) => {
@@ -21,11 +21,16 @@ export function bashReversibilityProbe(allow, boundary) {
         if (a?.run_in_background === true)
             return { reversible: false };
         const resolved = typeof boundary === "function" ? boundary() : boundary;
-        if (classifyCompoundReadonly(command, allowSet, resolved) === undefined)
+        const detailed = classifyCompoundReadonlyDetailed(command, allowSet, resolved);
+        if (detailed.reason === undefined) {
+            if (detailed.undecidedPaths !== undefined && detailed.undecidedPaths.length > 0)
+                return { reversible: false };
             return { reversible: true };
+        }
         return { reversible: classifyBoundedReadonlyPollLoop(command, allowSet, resolved) === undefined };
     };
 }
+export const FULL_SHELL_CONTRACT_ID = "core.bash@1";
 const EXIT1_INTERPRETATION = {
     grep: "No matches found",
     rg: "No matches found",
@@ -497,7 +502,7 @@ export function createBashTool(env, rootCanonical, coAuthor = false, cwdRef = {
     const bgEnvIsolatedOwned = hasDestroy(env) && isIsolated(env);
     return defineTool({
         name: "Bash",
-        contract: { contractId: "core.bash@1", implementationRevision: "1" },
+        contract: { contractId: FULL_SHELL_CONTRACT_ID, implementationRevision: "1" },
         description: bashDescription(coAuthor, timeoutCaps, bgNotifies, bgRetained, bgSessionScoped, bgEnvIsolatedOwned),
         parameters: Type.Object({
             command: Type.String({ description: "The command to execute" }),

package/dist/tools/fs/fs-pdf.d.ts

@@ -33,7 +33,7 @@ type ReadPdfReturn = string | {
  * Every degraded return carries `details.fallback = { level, reason }` (telemetry on the structured frame).
  * `caps` absent ⇒ fully capable (byte-compat: native document block; the brain placeholder still guards).
  */
-export declare function readPdfFile(env: ExecutionEnv, path: string, key: string, pages: string | undefined, signal: AbortSignal | undefined, downsamplerOpt: ReadImageDownsamplerOption, cwd: string, preRead?: Uint8Array, caps?: PdfModelCapabilities): Promise<ReadPdfReturn>;
+export declare function readPdfFile(env: ExecutionEnv, path: string, key: string, pages: string | undefined, signal: AbortSignal | undefined, downsamplerOpt: ReadImageDownsamplerOption, cwd: string, preRead?: Uint8Array, caps?: PdfModelCapabilities, readDeny?: import("./read-deny.js").ReadDenyMatcher): Promise<ReadPdfReturn>;
 /** E1: readPdfFile's own return type stays `ReadPdfReturn` (its INTERNAL string-means-error dispatch
  *  contract, shared with pdfPagesToImageBlocks) — the isError flag is applied once, here, at the tool's
  *  actual execute() boundary, not inside the helper. */

package/dist/tools/fs/fs-pdf.js

@@ -30,13 +30,13 @@ function boundPdfExtractedText(text) {
         return { body: text, truncated: false };
     return { body: text.slice(0, MAX_READ_BYTES), truncated: true };
 }
-export async function readPdfFile(env, path, key, pages, signal, downsamplerOpt, cwd, preRead, caps) {
+export async function readPdfFile(env, path, key, pages, signal, downsamplerOpt, cwd, preRead, caps, readDeny) {
     const cap = caps ?? { document: true, vision: true };
     const meta = await env.fileInfo(key, signal);
     if (!meta.ok) {
         const ex = await env.exists(key, signal);
         if (ex.ok && !ex.value)
-            return `Error (Read): ${await enoentMessage(env, key, cwd, signal)}`;
+            return `Error (Read): ${await enoentMessage(env, key, cwd, signal, readDeny)}`;
         return `Error (Read): cannot stat PDF "${path}" to verify its size before reading: ${meta.error.message}`;
     }
     if (meta.value.kind === "directory") {

package/dist/tools/fs/fs-read.d.ts

@@ -5,4 +5,4 @@ import { type ReadImageDownsamplerOption, type CwdRef } from "./fs-shared.js";
 export declare function createReadFileTool(env: ExecutionEnv, state: ReadFileState, rootCanonical: string, cwdRef?: CwdRef, additionalRoots?: readonly string[], imageDownsampler?: ReadImageDownsamplerOption, pdfCapabilities?: PdfModelCapabilities, bgOutputReadExemption?: (canonicalKey: string, ctx: {
     taskId?: string;
     principal?: string;
-}) => boolean, readCyberReminder?: boolean): AgentTool;
+}) => boolean, readCyberReminder?: boolean, readDeny?: import("./read-deny.js").ReadDenyMatcher, readFace?: import("./read-face.js").ReadFace): AgentTool;

package/dist/tools/fs/fs-read.js

@@ -7,14 +7,17 @@ import { MCP_IMAGE_MAX_BASE64, IMAGE_TARGET_RAW_SIZE } from "../../core/mcp.js";
 import { PDF_MAX_PAGES_PER_READ, pdfMagicMatches } from "./pdf.js";
 import { MAX_READ_BYTES, SLICED_READ_MAX_BYTES, MAX_IMAGE_READ_BYTES, MAX_IMAGE_DOWNSAMPLE_INPUT_BYTES, NO_DOWNSAMPLER_IMAGE_CAP_HINT, resolveAutoDownsampler, MAX_READ_OUTPUT_CHARS, READ_CYBER_REMINDER, FILE_PATH_PARAMS, countLines, seededFileUnchangedReminder, enoentMessage, } from "./fs-shared.js";
 import { readPdfFile, pdfResultToToolReturn } from "./fs-pdf.js";
-export function createReadFileTool(env, state, rootCanonical, cwdRef, additionalRoots, imageDownsampler, pdfCapabilities, bgOutputReadExemption, readCyberReminder) {
+export function createReadFileTool(env, state, rootCanonical, cwdRef, additionalRoots, imageDownsampler, pdfCapabilities, bgOutputReadExemption, readCyberReminder, readDeny, readFace) {
     const cyberReminder = readCyberReminder === false ? "" : READ_CYBER_REMINDER;
+    const pathBoundLine = readFace === "open"
+        ? "- `file_path` may be relative (resolved against the tracked working directory) or absolute. Reads are not confined to the workspace roots; a small sensitive-path deny list applies.\n"
+        : "- `file_path` may be relative (resolved against the tracked working directory) or absolute (within the configured roots).\n";
     return defineTool({
         name: "Read",
         contract: { contractId: "core.read@1", implementationRevision: "1" },
         description: "Reads a file from the local filesystem.\n" +
             "\n" +
-            "- `file_path` may be relative (resolved against the tracked working directory) or absolute (within the configured roots).\n" +
+            pathBoundLine +
             "- By default, it reads the whole file (from `offset`, 1-based); a very large file is served as a partial view with an explicit marker and the next-page call.\n" +
             "- You can optionally specify a line offset and limit (especially handy for long files), but it's recommended to read the whole file by not providing these parameters\n" +
             "- Results are returned using cat -n format, with line numbers starting at 1\n" +
@@ -53,7 +56,7 @@ export function createReadFileTool(env, state, rootCanonical, cwdRef, additional
                 content: text,
                 details: { type: "file_unchanged", reason, file: { filePath: path, startLine, endLine, totalLines } },
             });
-            const r = await resolveKey(env, rootCanonical, path, ctx.signal, cwdRef?.current, additionalRoots, bgOutputReadExemption === undefined ? undefined : (key) => bgOutputReadExemption(key, ctx));
+            const r = await resolveKey(env, rootCanonical, path, ctx.signal, cwdRef?.current, additionalRoots, bgOutputReadExemption === undefined ? undefined : (key) => bgOutputReadExemption(key, ctx), readDeny, readFace);
             if (!r.ok)
                 return errorResult(violationText("Read", r.violation), violationDetails(r.violation));
             const isNb = isNotebookPath(r.key);
@@ -63,7 +66,7 @@ export function createReadFileTool(env, state, rootCanonical, cwdRef, additional
                 if (!meta.ok) {
                     const ex = await env.exists(r.key, ctx.signal);
                     if (ex.ok && !ex.value)
-                        return errorResult(`Error (Read): ${await enoentMessage(env, r.key, cwdRef?.current ?? rootCanonical, ctx.signal)}`);
+                        return errorResult(`Error (Read): ${await enoentMessage(env, r.key, cwdRef?.current ?? rootCanonical, ctx.signal, readDeny)}`);
                     return errorResult(`Error (Read): cannot stat image "${path}" to verify its size before reading: ${meta.error.message}`);
                 }
                 if (meta.value.kind === "directory") {
@@ -121,7 +124,7 @@ export function createReadFileTool(env, state, rootCanonical, cwdRef, additional
                 };
             }
             if (r.key.toLowerCase().endsWith(".pdf")) {
-                return pdfResultToToolReturn(await readPdfFile(env, path, r.key, pages, ctx.signal, imageDownsampler, cwdRef?.current ?? rootCanonical, undefined, pdfCapabilities));
+                return pdfResultToToolReturn(await readPdfFile(env, path, r.key, pages, ctx.signal, imageDownsampler, cwdRef?.current ?? rootCanonical, undefined, pdfCapabilities, readDeny));
             }
             const binaryExt = hasBinaryExtension(r.key);
             const binaryExtRefusal = () => errorResult(`Error (Read): "${path}" appears to be a binary file (by extension); this tool reads UTF-8 text only.`);
@@ -146,7 +149,8 @@ export function createReadFileTool(env, state, rootCanonical, cwdRef, additional
             else {
                 const ex = await env.exists(r.key, ctx.signal);
                 if (ex.ok && !ex.value)
-                    return errorResult(`Error (Read): ${await enoentMessage(env, r.key, cwdRef?.current ?? rootCanonical, ctx.signal)}`);
+                    return errorResult(`Error (Read): ${await enoentMessage(env, r.key, cwdRef?.current ?? rootCanonical, ctx.signal, readDeny)}`);
+                return errorResult(`Error (Read): cannot determine the type of "${path.slice(0, 300)}" (stat failed: ${info.error.message.slice(0, 200)}); refusing to open it — if it is a FIFO/socket/device, reading it would hang. Retry if this was transient, or inspect it with Bash (e.g. \`file\`, \`ls -l\`).`);
             }
             const readBin = await env.readBinaryFile(r.key, ctx.signal);
             if (!readBin.ok)
@@ -165,7 +169,7 @@ export function createReadFileTool(env, state, rootCanonical, cwdRef, additional
                 return errorResult(`Error (Read): "${path}" is too large to read in full (${readSize} bytes > ${MAX_READ_BYTES}-byte cap); pass an explicit offset/limit to read a slice, or use grep to search it instead.`);
             }
             if (pdfMagicMatches(readBin.value)) {
-                return pdfResultToToolReturn(await readPdfFile(env, path, r.key, pages, ctx.signal, imageDownsampler, cwdRef?.current ?? rootCanonical, readBin.value, pdfCapabilities));
+                return pdfResultToToolReturn(await readPdfFile(env, path, r.key, pages, ctx.signal, imageDownsampler, cwdRef?.current ?? rootCanonical, readBin.value, pdfCapabilities, readDeny));
             }
             const magicFormat = binaryMagicFormat(readBin.value);
             if (magicFormat !== undefined) {