@sema-agent/core 5.38.0 → 5.39.0

package/CHANGELOG.md

@@ -1,5 +1,89 @@
 # Changelog
 
+## 5.39.0 — 2026-08-17
+
+No BREAKING changes. Two behavioral narrowings disclosed below (write-protection default table;
+peer messages join the permission chain) plus one governance-config narrowing (malformed workflow
+baseline slots refuse at mount instead of silently mounting ungoverned).
+
+### Added
+
+- #286 (#279) — the default-on WRITE-protection table (CC 2.1.233 DANGEROUS_* parity): a Write /
+  Edit / NotebookEdit whose target lands on a named row (shell/profile rc files, VCS hook and config
+  paths, editor/tool trust files — basename, segment and segment-run row kinds; case-folded, win32
+  spellings and trailing-dot/space component aliases included) is DEMOTED TO ASK at the tool gate
+  when it would otherwise auto-allow. **Narrowing**: in 5.38.0 these writes rode a surviving allow
+  silently. The tighten demotes to ask (classifier / blanket `onAsk` / persisted rules can still
+  clear it) and never blocks reads; ONE consumer arm denies instead — an approved edit the
+  restriction chain rewrites onto a table row after the human looked is refused fail-closed, since
+  minting a fresh ask there would hand a pathological rewriter an unbounded approval treadmill.
+  Whole-table replacement seat `RunnerDeps.writeProtectedPaths`
+  (`[]` disables; a non-empty list replaces the default table; garbage rows refuse loudly, including
+  spellings the candidate fold would orphan). New exports (admin face): `WRITE_PROTECTED_DEFAULT_TABLE`,
+  `resolveWriteProtectedTable`, `compileWriteProtection` + entry/row/kind/hit/matcher types.
+- design/276 — peer messages join the permission adjudication chain: in auto mode, `SendMessage` is
+  routed through the classifier (peer-referral tighten, third member of the post-fold tighten
+  family), and the two ancestor sandbox-admission arms stop auto-allowing an inherited
+  `sandbox_local` ask on SendMessage. **Narrowing**: a peer message that previously rode an ambient
+  allow now asks; the referral ask carries no `requiresRealApproval`, so classifier / blanket
+  `onAsk` / persisted rules can clear it.
+- Mailbox pre-delete contract half ([4194] ruling (b)): enqueue against a recipient a deletion
+  cascade has already tombstoned is a CODED refusal — new exports `MAILBOX_TOMBSTONED_RECIPIENT_CODE`
+  (`"mailbox.recipient_tombstoned"`), `MailboxStoreError`, and the `mailboxTombstonedRecipientContract`
+  acceptance-kit leg (optional contract clause: only backends that can see recipient lifecycle carry
+  it; the refusal is per-recipient and enqueue-only).
+- CC settings import — the preview reports `uncovered.denyAskBuckets: { deny, ask }`: how many
+  deny/ask entries the import leaves in place across the layers it reads (only the allow bucket is
+  imported; by-design-not-imported and unnoticed no longer look identical).
+
+### Fixed
+
+- Workflow governance baseline hardening (5.39 rescan window): a non-object `base` slot
+  (null / undefined / primitive / array — the shapes JSON/DB schema drift mints) is a CODED mount
+  refusal (`config.invalid_governance_baseline`) instead of silently mounting every script-spawned
+  child with ZERO inherited governance (5.38.0's raw spread accepted these spellings silently);
+  `worktreeBase: null` folds to its documented absence, any other non-object shape there refuses
+  with the same code. Face-list fields (`excludeTools`/`deferTools`/`alwaysLoadTools`) validate as
+  string arrays at mount (`config.invalid_tool_name_set`), and a null face field reads as absent in
+  BOTH slots (a null overlay field no longer silently remounts what the deployment excluded).
+- **The win32 component alias is closed on every path face, by one uniform rule.** `.bashrc.` and
+  `.bashrc ` name the SAME file as `.bashrc` on the wire (the win32 file namespace strips trailing
+  dots and spaces from every component), and `. ` / `.. ` are that namespace's spellings of `.` and
+  `..`. Pre-fix, `.aws.\credentials` missed the built-in read-deny set entirely on the purely
+  lexical legs — the bash-classify deny probe resolves operands with zero I/O by contract, so
+  nothing collapsed the alias later and the read took the auto-allow lane.
+  Every lexical path face (the write-protection matcher, the read-deny segment engine and its
+  sensitive-path consumer) now judges **two views** — components verbatim, and win32-normalized —
+  and protects if **either** hits. A lexical matcher cannot know the target platform (execution
+  envs may be remote, and win32 accepts forward-slash spellings, so separator gating carries
+  nothing), so picking one interpretation is always wrong for the other; the two errors are not
+  symmetric, since a missed protection is silent while an over-match is one extra question.
+  **The win32 view is skipped on one reported fact**: `canonicalizeTarget`'s realpath arm now returns
+  `aliasResolved`, meaning the real filesystem produced that key, so any component alias in the
+  spelling was already collapsed by the filesystem itself — a genuinely-resolved POSIX target keeps
+  its own reading and a real `.aws.` directory stays readable and writable. The arms that resolve
+  NOTHING do not report it and keep both views: UNC keys (minted with zero probes for liveness) and
+  not-yet-existing targets (whose tail is rejoined verbatim) — which is where the planting vector
+  lives. Unreported is the fail-closed default, so a caller that forgets to pass it loses precision,
+  never protection.
+  **Residual cost**: a target the filesystem has NOT resolved still over-matches — writing a
+  not-yet-created file inside a legal POSIX `.aws.` directory asks (write face) or refuses
+  (sensitive-path policy). Trailing-dot table ROWS stay legal (they match the POSIX file of exactly
+  that name; on win32 that spelling *is* the stripped name, which the ordinary row already covers).
+  **Known gap, ticketed not fixed**: the ripgrep exclusion globs do not fold, so a Grep result can
+  differ by whether ripgrep is installed (#303).
+- The self-orchestration gates ask the mount's question, not just "is the field there".
+  `workflowsCapability` tested `!== undefined` while the mount site tested truthiness, so
+  `workflowGovernanceBaseline: null` announced workflows with `run_workflow` unmounted and
+  suppressed the fail-closed operator warning; and once the mount began refusing an unusable `base`
+  slot, `{ base: null }` / `{}` announced workflows that then hard-failed every opted-in task. One
+  predicate now answers for all of them, and it reads the `base` slot — so an unusable baseline is
+  capability-false, inactive, and named in the operator warning instead of failing at run time.
+- Internal verify/teacher leg spec inheritance stops spreading a bare-string
+  `excludeTools`/`deferTools`/`alwaysLoadTools` into inert single-character names — malformed shapes
+  ride verbatim so the leg's own prepare judges them (coded doors for the three public seats are
+  tracked separately).
+
 ## 5.38.0 — 2026-08-17
 
 No BREAKING changes. One behavioral narrowing (default task-scaffold trim on strong claude models)

package/dist/agents/send-message-tool.d.ts

@@ -144,6 +144,14 @@ export declare const SEND_MESSAGE_SUMMARY_MAX = 200;
  *  four re-derivations into a SINGLE call site, immediately after the gate that makes the argument
  *  non-empty — so this helper now has exactly one caller in the tool body. */
 export declare function clipSendMessageSummary(raw: string): string;
+/**
+ * design/276 (direct-mount guidance): the engine's first-party auto-mount declares this tool's safety
+ * axes itself (`effect:"write"`, explicit `egress:false`). A host mounting this factory's product via
+ * `spec.tools` suppresses that auto-mount, so its own ToolSpec declaration is what the safety scan
+ * reads — declare `effect:"write"` there (a message is repeat-unsafe: replay = second delivery /
+ * second revive). The auto-mode peer-referral tighten keys on the WIRE NAME and applies to a direct
+ * mount all the same.
+ */
 export declare function createSendMessageTool(opts: SendMessageToolOptions): import("../core/types.js").AgentTool<Type.TObject<{
     to: Type.TString;
     message: Type.TString;

package/dist/agents/send-message-tool.js

@@ -2,6 +2,7 @@ import { Type } from "typebox";
 import { defineTool } from "../core/tools.js";
 import { normalizeAgentName, DURABLE_AGENT_HANDLE_RE, DURABLE_AGENT_HEARTBEAT_MS } from "../core/task-registry.js";
 import { canAccessAgentRecord, clearRevivedRowTerminalPayload } from "../core/background-agent-store.js";
+import { MAILBOX_TOMBSTONED_RECIPIENT_CODE } from "../core/mailbox-store.js";
 import { escapeAttributeValue, escapeEnvelopeTag, isObserverTaskId, OBSERVER_SENDMESSAGE_SENDER_REFUSAL, OBSERVER_SENDMESSAGE_TARGET_REFUSAL, } from "./observer.js";
 import { SUBAGENT_RESUME_CAP, SubagentRetainLedger, getSessionRetainLedger } from "./retain-ledger.js";
 import { createSubagentResume } from "./subagent.js";
@@ -404,6 +405,13 @@ export function createSendMessageTool(opts) {
                     }
                     catch (e) {
                         await rollback();
+                        if (e?.code === MAILBOX_TOMBSTONED_RECIPIENT_CODE) {
+                            return {
+                                content: `Message not sent: that agent is being deleted — its mailbox no longer accepts messages, so nothing was parked and it was not revived. Do not retry; launch a new agent with the needed context instead.`,
+                                details: { error: "mailbox_recipient_deleted", to },
+                                isError: true,
+                            };
+                        }
                         return {
                             content: `Message not sent: the durable mailbox refused the message (${e instanceof Error ? e.message : String(e)}) — nothing was parked and the agent was not revived. ${DEDUP_RETRY_NOTE}`,
                             details: { error: "mailbox_failed", to },

package/dist/agents/teacher.js

@@ -183,9 +183,15 @@ async function runTeacherCore(runner, studentSpec, teacher) {
         ...(studentSpec.readFace === "roots" ? { readFace: "roots" } : {}),
         ...(studentSpec.readDenyPatterns !== undefined ? { readDenyPatterns: [...studentSpec.readDenyPatterns] } : {}),
         ...(studentSpec.interactiveTools === false ? { interactiveTools: false } : {}),
-        ...(studentSpec.excludeTools !== undefined ? { excludeTools: [...studentSpec.excludeTools] } : {}),
-        ...(studentSpec.deferTools !== undefined ? { deferTools: [...studentSpec.deferTools] } : {}),
-        ...(studentSpec.alwaysLoadTools !== undefined ? { alwaysLoadTools: [...studentSpec.alwaysLoadTools] } : {}),
+        ...(studentSpec.excludeTools !== undefined
+            ? { excludeTools: Array.isArray(studentSpec.excludeTools) ? [...studentSpec.excludeTools] : studentSpec.excludeTools }
+            : {}),
+        ...(studentSpec.deferTools !== undefined
+            ? { deferTools: Array.isArray(studentSpec.deferTools) ? [...studentSpec.deferTools] : studentSpec.deferTools }
+            : {}),
+        ...(studentSpec.alwaysLoadTools !== undefined
+            ? { alwaysLoadTools: Array.isArray(studentSpec.alwaysLoadTools) ? [...studentSpec.alwaysLoadTools] : studentSpec.alwaysLoadTools }
+            : {}),
         ...(studentSpec.restoreGatedTools !== undefined
             ? { restoreGatedTools: Array.isArray(studentSpec.restoreGatedTools) ? [...studentSpec.restoreGatedTools] : studentSpec.restoreGatedTools }
             : {}),

package/dist/agents/verify.js

@@ -146,9 +146,15 @@ export async function verifyCompleted(runner, result, specBase, objective, confi
             limits: { ...(specBase.limits?.maxWalltimeMs !== undefined ? { maxWalltimeMs: specBase.limits.maxWalltimeMs } : {}) },
             getApiKeyAndHeaders: specBase.getApiKeyAndHeaders,
             ...(specBase.principal !== undefined ? { principal: specBase.principal } : {}),
-            ...(specBase.excludeTools !== undefined ? { excludeTools: [...specBase.excludeTools] } : {}),
-            ...(specBase.deferTools !== undefined ? { deferTools: [...specBase.deferTools] } : {}),
-            ...(specBase.alwaysLoadTools !== undefined ? { alwaysLoadTools: [...specBase.alwaysLoadTools] } : {}),
+            ...(specBase.excludeTools !== undefined
+                ? { excludeTools: Array.isArray(specBase.excludeTools) ? [...specBase.excludeTools] : specBase.excludeTools }
+                : {}),
+            ...(specBase.deferTools !== undefined
+                ? { deferTools: Array.isArray(specBase.deferTools) ? [...specBase.deferTools] : specBase.deferTools }
+                : {}),
+            ...(specBase.alwaysLoadTools !== undefined
+                ? { alwaysLoadTools: Array.isArray(specBase.alwaysLoadTools) ? [...specBase.alwaysLoadTools] : specBase.alwaysLoadTools }
+                : {}),
             ...(specBase.restoreGatedTools !== undefined
                 ? { restoreGatedTools: Array.isArray(specBase.restoreGatedTools) ? [...specBase.restoreGatedTools] : specBase.restoreGatedTools }
                 : {}),

package/dist/core/hooks.d.ts

@@ -938,6 +938,29 @@ export interface ToolGateInput {
      * per-tool mark — attributes a tighten-deny to `source:"shellGate"` instead of `"safety"`.
      */
     shellGated?: boolean;
+    /**
+     * design/276 (CC 2.1.233 P11 arm 4): true when the called tool is the peer-message verb — a message
+     * to another agent (`SendMessage`). ENGINE-FILLED from the wire name at the caller, never a
+     * configuration knob; a caller's same-named shadow tool is keyed too (for a tighten, over-asking is
+     * the fail-safe direction). Under an armed {@link autoMode} the gate tightens a surviving `allow` to
+     * `ask` (the peer-referral tighten below) so the message passes the classifier's eye — its prompt
+     * already carries the Multi-Agent Coordination exemption, so the ordinary teammate message resolves
+     * allow and the injection-shaped one is what this member exists to catch. Absent/false, or with no
+     * armed auto mode, the decision path is byte-identical. Per-run semantic: armed by THIS run's
+     * resolved caps, never inherited down the delegation chain (CC parity — the mode predicate reads the
+     * SENDING session's own mode).
+     */
+    peerMessage?: boolean;
+    /**
+     * backlog #286 (CC 2.1.233 `DANGEROUS_*` parity): the write-protection judge — ENGINE-BUILT from
+     * the deployment's table seat by `createWriteProtectionCheck` (write-protect.ts), never a
+     * deployment callback (the deployment authors table ROWS, which are validated loudly at compile;
+     * the judge itself is pure and synchronous, so it is trusted here like the `egress` mark). Judges
+     * the FINAL args of a path-confinable write tool; a hit demotes a surviving `allow` to `ask`
+     * (the write-protection tighten below). Absent ⇒ the deployment replaced the table with `[]` (or
+     * the caller runs the gate without one) and the decision path is byte-identical.
+     */
+    writeProtectionCheck?: (toolName: string, args: unknown) => import("./write-protect.js").WriteProtectedHit | null;
     /**
      * design/143 批2 ([672]-A, CC 2.1.207 auto mode): when present, a surviving `ask` is routed to the
      * small-model policy CLASSIFIER before any human/durable resolution:

package/dist/core/hooks.js

@@ -398,6 +398,25 @@ export async function runToolGate(input) {
             denySource = input.shellGated === true ? "shellGate" : "safety";
         }
     }
+    if (input.peerMessage === true && decision.action === "allow" && input.autoMode !== undefined && !input.autoMode.decider.breakerOpen()) {
+        decision = {
+            action: "ask",
+            message: `tool "${toolName}" sends a message to another agent — routed for classifier review in auto mode`,
+            decisionReason: "safety",
+        };
+        denySource = "safety";
+    }
+    if (decision.action === "allow" && input.writeProtectionCheck !== undefined) {
+        const writeProtectedHit = input.writeProtectionCheck(toolName, policyRewrite !== undefined ? policyRewrite : currentInput);
+        if (writeProtectedHit !== null) {
+            decision = {
+                action: "ask",
+                message: `tool "${toolName}" writes to a write-protected path (table entry "${writeProtectedHit.name}") — explicit approval required`,
+                decisionReason: "safety",
+            };
+            denySource = "safety";
+        }
+    }
     let orgRealApprovalRequired = false;
     let orgAskOrigin;
     let orgTightenCount = 0;
@@ -573,6 +592,7 @@ export async function runToolGate(input) {
             decision.decisionReason !== "hook" &&
             hookAsk === undefined &&
             input.egress !== true &&
+            input.peerMessage !== true &&
             input.sandboxAdmission.boundaryCapable !== true) {
             const recorded = input.sandboxAdmission.askClassesOf(toolCallId);
             const admissible = recorded !== undefined && recorded.length > 0 && recorded.every((r) => r.cls === "sandbox_local");
@@ -655,6 +675,7 @@ export async function runToolGate(input) {
             if (decision.action === "allow" && decision.updatedInput !== undefined) {
                 let editArgs = decision.updatedInput;
                 let editDenied;
+                let editRewrittenSinceHuman = false;
                 for (let round = 0;; round++) {
                     if (round >= 3) {
                         editDenied = {
@@ -691,8 +712,10 @@ export async function runToolGate(input) {
                                 denySource = "hook";
                                 break;
                             }
-                            if (hr.updatedInput !== undefined)
+                            if (hr.updatedInput !== undefined) {
                                 editArgs = hr.updatedInput;
+                                editRewrittenSinceHuman = true;
+                            }
                         }
                     }
                     if (!adjudicate && input.orgRules === undefined)
@@ -714,8 +737,10 @@ export async function runToolGate(input) {
                         denySource = "policy";
                         break;
                     }
-                    if (recheck.updatedInput !== undefined)
+                    if (recheck.updatedInput !== undefined) {
                         editArgs = recheck.updatedInput;
+                        editRewrittenSinceHuman = true;
+                    }
                     const orgTightensBefore = orgTightenCount;
                     recheck = await applyOrgLayer(recheck, editArgs);
                     const orgRaisedThisRound = orgTightenCount > orgTightensBefore;
@@ -724,12 +749,16 @@ export async function runToolGate(input) {
                         break;
                     }
                     if (recheck.action === "allow") {
-                        if (recheck.updatedInput !== undefined)
+                        if (recheck.updatedInput !== undefined) {
                             editArgs = recheck.updatedInput;
+                            editRewrittenSinceHuman = true;
+                        }
                         break;
                     }
-                    if (recheck.updatedInput !== undefined)
+                    if (recheck.updatedInput !== undefined) {
                         editArgs = recheck.updatedInput;
+                        editRewrittenSinceHuman = true;
+                    }
                     const rr = await resolveAsk({ ...recheck, ruleEvidence: mintRuleEvidence({ dotsAbsent: "not_adjudicated" }) }, { toolName, args: editArgs, toolCallId });
                     resolvedApprover = rr.action !== "ask" ? rr.approver : undefined;
                     if (rr.action !== "allow") {
@@ -741,9 +770,21 @@ export async function runToolGate(input) {
                     if (rr.updatedInput === undefined) {
                         if (rr.presentedInput !== undefined)
                             editArgs = rr.presentedInput;
+                        editRewrittenSinceHuman = false;
                         break;
                     }
                     editArgs = rr.updatedInput;
+                    editRewrittenSinceHuman = false;
+                }
+                if (editDenied === undefined && editRewrittenSinceHuman && input.writeProtectionCheck !== undefined) {
+                    const editHit = input.writeProtectionCheck(toolName, editArgs);
+                    if (editHit !== null) {
+                        editDenied = {
+                            action: "deny",
+                            message: `the approved edit for "${toolName}" was rewritten by the restriction chain onto a write-protected path (table entry "${editHit.name}") that no approval covers — denied fail-closed; re-submit the edited action directly`,
+                        };
+                        denySource = "safety";
+                    }
                 }
                 decision = editDenied ?? { ...decision, updatedInput: editArgs };
             }

package/dist/core/mailbox-store.d.ts

@@ -13,6 +13,28 @@ export interface MailboxMessage {
      *  cross-engine records sit outside the guard's promise domain by ruling. */
     hopChain?: string[];
 }
+/** The enqueue refusal code of the pre-delete clause (see {@link MailboxStore} and
+ *  {@link MailboxStoreError}) — the ONE place it is spelled, so an out-of-repo store twin imports it
+ *  instead of value-copying the string (same posture as `STALE_RUNNING_REAP_ATTRIBUTION`: a shared
+ *  symbol makes drift impossible rather than merely caught). */
+export declare const MAILBOX_TOMBSTONED_RECIPIENT_CODE = "mailbox.recipient_tombstoned";
+/**
+ * Typed store error so callers branch on `code` (mirrors `BackgroundAgentStoreError`).
+ *
+ * `recipient_tombstoned` is the ENQUEUE refusal a backend raises when the recipient it addresses is
+ * in a deployment's PRE-DELETE state — the window a retention/deletion cascade opens when it has
+ * decided a session (and every row hanging off it) is going away but has not finished removing the
+ * rows. An `append` accepted in that window returns a seq to the sender — a durable receipt — for a
+ * message the cascade then deletes before any consumer could ever lease it. The refusal is what
+ * turns that into a fact the sender can act on.
+ *
+ * A backend may raise the same code with a plain `Error` carrying `.code`; consumers branch on the
+ * string, not on this class (a cross-process/out-of-repo store cannot hand back an instance).
+ */
+export declare class MailboxStoreError extends Error {
+    readonly code: typeof MAILBOX_TOMBSTONED_RECIPIENT_CODE;
+    constructor(code: typeof MAILBOX_TOMBSTONED_RECIPIENT_CODE, message: string);
+}
 /** A leased batch: the messages a claim winner owns for delivery, plus the ack cursor. */
 export interface MailboxLease {
     messages: MailboxMessage[];
@@ -55,8 +77,25 @@ export interface MailboxAppendMessage {
  *   is ADVISORY: a drop fault never blocks the reap, and a box orphaned that way still ages out here.
  *   `drop` therefore has a real caller — an implementation that stubs it strands mailboxes until the
  *   age policy catches them.
+ * - PRE-DELETE STATE (optional capability, additive contract extension): a backend that can SEE its
+ *   recipient's lifecycle — one whose rows live alongside the session rows a retention/deletion
+ *   cascade removes — must refuse `append` for a recipient the cascade has already tombstoned,
+ *   CODED: an `Error` whose `code` is `"mailbox.recipient_tombstoned"` ({@link MailboxStoreError} is
+ *   the bundled shape; consumers branch on the string). Accepting is the failure this clause names:
+ *   `append` is durable-first, so the returned seq is a receipt for a message the cascade deletes
+ *   before any consumer can lease it — a delivery promised to the sender and kept to nobody, which
+ *   no other face reports. The refusal is per RECIPIENT and enqueue-only: a tombstone belongs to one
+ *   `(scope, handle)` — the same two-part identity every other method here is keyed by, so it says
+ *   nothing about a sibling handle NOR about the same handle under another scope — and it is not a
+ *   wipe (whatever is already parked stays under the same lease/ack rules until the cascade removes
+ *   the box). A backend with NO view of that
+ *   lifecycle (the two bundled ones, the CC inbox adapter) has nothing to refuse and keeps accepting
+ *   — the clause fixes the SPELLING of the refusal, so a deployment reads one code instead of a
+ *   per-backend dialect. Acceptance kit: `mailboxTombstonedRecipientContract`.
  */
 export interface MailboxStore {
+    /** Durably park one message. Refuses `"mailbox.recipient_tombstoned"` when the backend can see
+     *  that its recipient is in the deployment's pre-delete state (see the interface notes above). */
     append(scope: string, handle: string, msg: MailboxAppendMessage): Promise<number>;
     claimLease(scope: string, handle: string, owner: string, ttlMs: number, now?: number): Promise<MailboxLease | null>;
     ack(scope: string, handle: string, owner: string, upToSeq: number): Promise<void>;

package/dist/core/mailbox-store.js

@@ -1,4 +1,13 @@
 import { assertRetentionPolicy } from "./retention-policy.js";
+export const MAILBOX_TOMBSTONED_RECIPIENT_CODE = "mailbox.recipient_tombstoned";
+export class MailboxStoreError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = "MailboxStoreError";
+    }
+}
 export function newestSentAt(messages) {
     let newest;
     for (const m of messages) {

package/dist/core/permission-rule-consent.d.ts

@@ -285,9 +285,9 @@ export interface CcImportLayer {
 /**
  * What the import WOULD do, shown before anyone confirms.
  *
- * `uncovered` is a two-key record, not a list: the two layers this version does not read are named in the
+ * `uncovered` is a fixed-key record, not a list: everything this version does not import is named in the
  * TYPE, so an empty list, a missing member or a duplicate is not expressible. A preview that reported only
- * the layers it read would be claiming completeness it does not have.
+ * what it read would be claiming completeness it does not have.
  */
 export interface ImportPreview {
     candidates: RuleCandidate[];
@@ -303,6 +303,26 @@ export interface ImportPreview {
     uncovered: {
         flagSettings: "not-imported-v1";
         policySettings: "not-imported-v1";
+        /**
+         * The deny/ask buckets of the layers actually read: how many entries are SITTING THERE, across all
+         * layers, that this import deliberately leaves in place (they are the tightening direction and have
+         * their own channel — importing them through a loosening lane would be the wrong door).
+         *
+         * Always present, zero when the buckets are absent or empty: "this settings file has 14 deny entries
+         * we did not touch" and "there was nothing there" are different facts, and a key that appears only in
+         * the first case makes them indistinguishable for a reader who sees one preview. The count is of
+         * ENTRIES IN PLACE, not of a decision — nothing here is skipped-and-lost; `skipped` stays the list of
+         * allow-bucket entries that did not become candidates.
+         *
+         * A bucket that is PRESENT but not an array cannot be counted; it contributes 0 and is disclosed in
+         * `skipped` under the layer's path, so a zero is never the report for something unreadable. Same for
+         * a layer whose whole `permissions` member is not an object — every bucket in it reads as absent,
+         * which is exactly the shape that would otherwise report two clean zeros.
+         */
+        denyAskBuckets: {
+            deny: number;
+            ask: number;
+        };
     };
 }
 /** What the import ACTUALLY did — a different moment and a different contract from the preview, because
@@ -320,8 +340,11 @@ export interface ImportResult {
  * Read the allow buckets of the user-editable settings layers and produce a preview plus a PENDING
  * approval record. Nothing is stored until someone confirms that record and the batch is redeemed.
  *
- * Only the allow bucket is read. The deny/ask buckets are the tightening direction and have their own
- * channel; importing them through a loosening lane would be the wrong door.
+ * Only the allow bucket is IMPORTED. The deny/ask buckets are the tightening direction and have their own
+ * channel; importing them through a loosening lane would be the wrong door. They are still COUNTED and
+ * reported (`preview.uncovered.denyAskBuckets`): by-design-not-imported and unnoticed look identical to
+ * the person confirming the batch, and only one of them is true here — the same reason the non-Bash allow
+ * entries are disclosed rather than dropped silently.
  */
 export declare function prepareCcImport(opts: {
     layers: CcImportLayer[];

package/dist/core/permission-rule-consent.js

@@ -337,12 +337,13 @@ async function applyRedemption(args) {
 function originOfRecordKind(kind) {
     return kind === "import" ? "imported-cc" : kind === "starter" ? "starter" : "user";
 }
-const IMPORT_UNCOVERED = { flagSettings: "not-imported-v1", policySettings: "not-imported-v1" };
+const IMPORT_UNCOVERED_LAYERS = { flagSettings: "not-imported-v1", policySettings: "not-imported-v1" };
 export async function prepareCcImport(opts) {
     const owner = resolveCallerOwner(opts.principal, opts.owner, "prepareCcImport");
     const candidates = [];
     const skipped = [];
     const layers = [];
+    const denyAskBuckets = { deny: 0, ask: 0 };
     for (const layer of opts.layers) {
         let raw;
         try {
@@ -356,14 +357,38 @@ export async function prepareCcImport(opts) {
             continue;
         }
         layers.push({ path: layer.path, layer: layer.layer, found: true });
-        let allow;
+        let container;
         try {
-            allow = JSON.parse(raw)?.permissions?.allow;
+            container = JSON.parse(raw)?.permissions;
         }
         catch (err) {
             skipped.push({ rule: layer.path, reason: `settings file is not valid JSON (${errText(err)})` });
             continue;
         }
+        let permissions;
+        if (container === undefined || container === null)
+            permissions = undefined;
+        else if (typeof container === "object" && !Array.isArray(container))
+            permissions = container;
+        else {
+            skipped.push({
+                rule: layer.path,
+                reason: `settings "permissions" is not an object — no bucket in this layer could be read, so it is reported as unread rather than as empty (it stays in the settings file either way)`,
+            });
+            continue;
+        }
+        for (const bucket of ["deny", "ask"]) {
+            const entries = permissions?.[bucket];
+            if (Array.isArray(entries))
+                denyAskBuckets[bucket] += entries.length;
+            else if (entries !== undefined && entries !== null) {
+                skipped.push({
+                    rule: layer.path,
+                    reason: `settings ${bucket} bucket is not an array — its entries could not be counted for the not-imported report (it stays in the settings file either way)`,
+                });
+            }
+        }
+        const allow = permissions?.allow;
         if (!Array.isArray(allow))
             continue;
         const scope = layer.layer === "userSettings" ? { kind: "global" } : { kind: "project", root: layer.root };
@@ -401,7 +426,7 @@ export async function prepareCcImport(opts) {
         createdAt: nowIso(opts.deps),
     };
     await opts.deps.approvals.create(record);
-    return { preview: { candidates, skipped, layers, uncovered: IMPORT_UNCOVERED }, approvalId: record.id };
+    return { preview: { candidates, skipped, layers, uncovered: { ...IMPORT_UNCOVERED_LAYERS, denyAskBuckets } }, approvalId: record.id };
 }
 export const STARTER_RULES = [
     "Bash(ls)",

package/dist/core/permission-rule-model.d.ts

@@ -29,7 +29,13 @@
  * here) and no leading-env-assignment stripping (`FOO=1 git status` simply does not match
  * `Bash(git status:*)`) — the last two are strict-side divergences from upstream, registered as such.
  */
-/** The one tool the v1 rule lane speaks for. The field exists on the rule so v2 can widen without a shape change. */
+/** The one tool the v1 rule lane speaks for. The field exists on the rule so v2 can widen without a shape change.
+ *
+ *  design/276 §3.3 (doctrine, for whoever widens this set): a future `SendMessage(…)`-form rule MAY
+ *  clear the peer-referral ask — that ask is classifier hesitation by construction (#144: allow rules
+ *  silence the classifier's questions, never a mandated one), so a recorded human yes is exactly what
+ *  clears it. The org/hook/matchedAskRule immunities stay: those conjuncts live in the gate's
+ *  persisted-rule lane and do not loosen with this set. */
 export type PersistedRuleTool = "Bash";
 /** v1 match forms. `"wildcard"` is reserved for v2 and is not a value this version ever produces. */
 export type PersistedRuleMatch = "exact" | "prefix";

package/dist/core/runner/prepare-task.js

@@ -28,8 +28,9 @@ import { CHANGED_FILES_MTIME_EPS_MS, fenceMcpServerInstructions, renderAgentList
 import { inlineUntrusted } from "../untrusted-text.js";
 import { policyAskClassOf } from "../ask-class.js";
 import { emitTrace } from "../trace.js";
-import { createSessionRulePolicy } from "./session-rule-policy.js";
+import { createSessionRulePolicy, PATH_CONFINABLE_WRITE_TOOLS } from "./session-rule-policy.js";
 import { cloneObserverInput, createHookEnvCapabilities, createPreToolUseConstraintPolicy, formatHookFeedback, mintHookInvocationIdentity, persistedRuleMandateOf, runToolGate } from "../hooks.js";
+import { createWriteProtectionCheck } from "../write-protect.js";
 import { orgRuleVerdictFor } from "../permission-rule-org.js";
 import { CacheBreakDetector, toolsToFingerprintInputs } from "../cache-break-detector.js";
 import { reservedCollisions, reservedFor } from "../../brain/request-params.js";
@@ -1413,6 +1414,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             toolEffects.set("TaskStop", "write");
             tools.push(firstPartyOffload(createTaskOutputTool({ registry: defaultTaskRegistry, owner: hostTaskId, scope: taskScope, sessionId, workflowStore: deps.workflowRunStore, agentStore: deps.backgroundAgentStore, notificationWired: internals?.onTaskNotification !== undefined, oneShot: spec.oneShot, toolResultStore: offloadStore })), firstPartyOffload(createTaskStopTool({ registry: defaultTaskRegistry, owner: hostTaskId, scope: taskScope, sessionId, workflowStore: deps.workflowRunStore, agentStore: deps.backgroundAgentStore })));
             if (runnerSelf && !(spec.tools ?? []).some((t) => t.name === SEND_MESSAGE_TOOL_NAME)) {
+                toolEffects.set(SEND_MESSAGE_TOOL_NAME, "write");
+                axisExplicitNegatives.set(SEND_MESSAGE_TOOL_NAME, { ...axisExplicitNegatives.get(SEND_MESSAGE_TOOL_NAME), egress: false });
                 const delegationForRevive = (spec.tools ?? []).find((t) => t.agentListing !== undefined);
                 const reviveSpawn = delegationForRevive !== undefined && deps.backgroundAgentStore !== undefined && deps.mailboxStore !== undefined
                     ? async (req) => {
@@ -2813,7 +2816,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             list.push({ cls, layer });
             foldAskClasses.set(toolCallId, list);
         };
-        const sandboxBoundaryCapable = (toolName) => egressTools.has(toolName) || toolName.includes("__") || ownToolNames.has(toolName);
+        const sandboxBoundaryCapable = (toolName) => egressTools.has(toolName) || toolName.includes("__") || ownToolNames.has(toolName) || toolName === SEND_MESSAGE_TOOL_NAME;
         const emitSandboxAdmitted = (info) => {
             emitTrace(deps.tracer, () => ({
                 kind: "permission.sandbox_admitted",
@@ -4220,13 +4223,16 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 if (eff !== undefined && !toolEffects.has(t.name))
                     toolEffects.set(t.name, eff);
             }
+            const writeProtectionCheck = createWriteProtectionCheck(deps.writeProtectedPaths);
+            const writeProtectionArmed = writeProtectionCheck !== undefined && tools.some((t) => PATH_CONFINABLE_WRITE_TOOLS.has(t.name));
             toolCallGateArmedRef.armed =
                 effectivePolicy !== undefined ||
                     hooks?.preToolUse !== undefined ||
                     egressTools.size > 0 ||
                     irreversibleTools.size > 0 ||
                     spec.enablePlanMode === true ||
-                    complianceDenies.has("web_fetch");
+                    complianceDenies.has("web_fetch") ||
+                    writeProtectionArmed;
             if (toolCallGateArmedRef.armed) {
                 harness.on("tool_call", async (e) => {
                     blockedToolCalls.delete(e.toolCallId);
@@ -4269,6 +4275,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             suspendAsk,
                             resolveContentAsk,
                             egress: egressTools.has(e.toolName),
+                            peerMessage: e.toolName === SEND_MESSAGE_TOOL_NAME,
+                            ...(writeProtectionCheck !== undefined ? { writeProtectionCheck } : {}),
                             irreversibility: irreversibilityTier.get(e.toolName),
                             reversibilityProbe: reversibilityProbes.get(e.toolName),
                             abortSignal: abortController.signal,

package/dist/core/sensitive-path-policy.js

@@ -39,8 +39,8 @@ function compilePatterns(patterns) {
     }
     return out;
 }
-function matchSensitive(canonicalKey, compiled) {
-    return matchSegmentPatterns(canonicalKey, compiled);
+function matchSensitive(canonicalKey, compiled, aliasResolved) {
+    return matchSegmentPatterns(canonicalKey, compiled, { aliasResolved });
 }
 export function createSensitivePathPolicy(opts) {
     const compiled = compilePatterns(opts.patterns);
@@ -64,7 +64,7 @@ export function createSensitivePathPolicy(opts) {
                 }
                 return { action: "allow" };
             }
-            const hit = matchSensitive(canon.key, compiled);
+            const hit = matchSensitive(canon.key, compiled, canon.aliasResolved === true);
             if (hit) {
                 return {
                     action: "deny",

package/dist/core/store-contracts/mailbox-store-contract.d.ts

@@ -1,4 +1,4 @@
-import type { MailboxStore } from "../mailbox-store.js";
+import { type MailboxStore } from "../mailbox-store.js";
 import { type ContractAssertionRunner } from "./contract-harness.js";
 /**
  * design/159 S1 — the cross-backend {@link MailboxStore} contract, extracted VERBATIM from
@@ -46,3 +46,31 @@ export declare function mailboxAckOwnershipContract(mk: () => MailboxStore, runA
  * 放宽」:核心层没有一条为了任何后端而弱化。第三方后端若有租户轴,应当也挂这一层。
  */
 export declare function mailboxBundledOnlyContract(mk: () => MailboxStore, runAssertion?: ContractAssertionRunner): Promise<void>;
+export interface MailboxTombstonedRecipientContractHooks {
+    /** Put `(scope, handle)` into the deployment's PRE-DELETE state — whatever that is for this
+     *  backend (a cascade marking the session row, a `deleting` column, a tombstone table). Core does
+     *  not name the mechanism, only what `append` must then do. */
+    tombstone: (store: MailboxStore, scope: string, handle: string) => Promise<void>;
+    runAssertion?: ContractAssertionRunner;
+}
+/**
+ * T2 可选能力层(pre-delete 分册)—— 只挂**看得见收件人生命周期**的后端:它的 mailbox 行与某个
+ * 删除级联要清掉的 session 行同生共死(server 的留存删除级联是首个此形消费方)。三个捆绑后端都
+ * 没有这个视角,因此都不挂——**这不是「做不到所以放宽」**:没有预删除态的后端根本没有可拒的对象,
+ * 而有这个态却静默接受的后端,拿到的 seq 是一张级联马上就要撕掉的回执(`append` 是 durable-first,
+ * 回执即承诺),且没有任何其它面会说出这件事。
+ *
+ * 契约不规定态怎么置(那是部署自己的删除协议),只钉「拒」这件事的三条轴 —— **三条一起列在这里,
+ * 是因为逐条补的过程本身证明了单看一条会假绿**(每加一条,都有一个能过掉前面全部用例的错误实现被
+ * 抓出来):
+ *  1. **拒因轴**:必须拒,且每条路径上都带同一个码(空箱与非空箱都算路径);
+ *  2. **副作用轴**:被拒的 append 对箱零改动 —— 不入箱(幽灵投递)、不清箱(删除窗口内静默丢)、
+ *     也不动活租约(动了就撬开 X-1 的单消费者围栏,同一批消息会被二次投递);
+ *  3. **收件人边界轴**:态属于一个 `(scope, handle)` 整体,且这个整体是**单射**的 —— 兄弟 handle
+ *     不受牵连、跨租户同名不受牵连、拼键歧义不得把两个收件人折成一个。
+ * 新增用例请按这三条轴归位;要加第四条轴,先说清它是哪一类假绿。
+ *
+ * 受众前提与 {@link mailboxBundledOnlyContract} 同线:后端有自己的租户轴(生命周期可见的后端就是
+ * 服务端形态的 store),边界轴的两条用例要用两个 scope 构造。
+ */
+export declare function mailboxTombstonedRecipientContract(mk: () => MailboxStore, hooks: MailboxTombstonedRecipientContractHooks): Promise<void>;