@sema-agent/core 5.38.0 → 5.39.0

package/dist/orchestration/workflow-script-runner.js

@@ -1,9 +1,12 @@
+import { governanceBaselineProblem } from "./governance-baseline-validity.js";
 export function isSelfOrchestrationActive(spec, deps) {
     return spec.selfOrchestration === true && workflowsCapability(deps);
 }
 export function workflowsCapability(deps) {
-    return (deps.workflowScriptRunner?.safeForUntrustedScripts === true &&
-        deps.workflowGovernanceBaseline !== undefined);
+    return deps.workflowScriptRunner?.safeForUntrustedScripts === true && hasUsableGovernanceBaseline(deps);
+}
+function hasUsableGovernanceBaseline(deps) {
+    return governanceBaselineProblem(deps.workflowGovernanceBaseline) === null;
 }
 export function selfOrchestrationFailClosedReason(spec, deps) {
     if (spec.selfOrchestration !== true)
@@ -14,8 +17,10 @@ export function selfOrchestrationFailClosedReason(spec, deps) {
     if (deps.workflowScriptRunner?.safeForUntrustedScripts !== true) {
         missing.push("a hard WorkflowScriptRunner (RunnerDeps.workflowScriptRunner.safeForUntrustedScripts === true)");
     }
-    if (deps.workflowGovernanceBaseline === undefined) {
-        missing.push("a governance baseline (RunnerDeps.workflowGovernanceBaseline)");
+    const problem = governanceBaselineProblem(deps.workflowGovernanceBaseline);
+    if (problem !== null) {
+        missing.push(`a usable governance baseline (RunnerDeps.workflowGovernanceBaseline.${problem.where === "workflowGovernanceBaseline" ? "" : `${problem.where} `}` +
+            `is ${problem.found})`);
     }
     return (`self-orchestration (TaskSpec.selfOrchestration) requires ${missing.join(" and ")}; it is DISABLED for ` +
         `this task (fail-closed — the run_workflow tool is not mounted and the orchestration prompt is not injected).`);

package/dist/tools/fs/read-deny.d.ts

@@ -40,10 +40,18 @@ export interface ReadDenyMatcher {
     /** Normalized entries (built-ins first, then additions; exact duplicates folded). The disclosure /
      *  persistence face. */
     readonly entries: readonly NormalizedReadDenyEntry[];
-    /** Judge ONE path view (segment-window semantics). Returns the first matching entry, or null. */
-    matchPath(path: string): ReadDenyHit | null;
-    /** §3.3 target judgment: canonical view + lexical view; EITHER hit decides. */
-    matchTarget(canonicalKey: string, lexicalView?: string): ReadDenyHit | null;
+    /** Judge ONE path view (segment-window semantics). Returns the first matching entry, or null.
+     *  `aliasResolved` = the key's MINTER reports the real filesystem already collapsed any win32
+     *  component alias in it (canonicalizeTarget's realpath arm); unset ⇒ both readings are judged,
+     *  which is the fail-closed default. */
+    matchPath(path: string, opts?: {
+        readonly aliasResolved?: boolean;
+    }): ReadDenyHit | null;
+    /** §3.3 target judgment: canonical view + lexical view; EITHER hit decides. `aliasResolved`
+     *  applies to the CANONICAL arm only — the lexical view is an unresolved spelling. */
+    matchTarget(canonicalKey: string, lexicalView?: string, opts?: {
+        readonly aliasResolved?: boolean;
+    }): ReadDenyHit | null;
     /** Traversal exclusions for the rg legs: `!`-polarity glob pairs — `!**\/<p>` plus `!**\/<p>/…`
      *  (the entry itself and its descendants). */
     readonly rgExclusionGlobs: readonly ReadDenyRgGlob[];
@@ -145,7 +153,9 @@ export declare function compileSegmentPattern(raw: string, fold: "none" | "ascii
  * BOTH separator families — win32 canonical keys are backslash-form. Returns the matched raw pattern
  * or null.
  */
-export declare function matchSegmentPatterns(path: string, compiled: readonly CompiledSegmentPattern[]): string | null;
+export declare function matchSegmentPatterns(path: string, compiled: readonly CompiledSegmentPattern[], opts?: {
+    readonly aliasResolved?: boolean;
+}): string | null;
 /**
  * codex r3 — the PURE validation/canonicality predicate over a PERSISTED deny entry (checkpoint v9
  * face section), for the resume pre-CAS ladder: it must refuse BEFORE the approval CAS everything

package/dist/tools/fs/read-deny.js

@@ -91,15 +91,36 @@ export function compileSegmentPattern(raw, fold) {
     });
     return { raw, segments, foldAscii: fold === "ascii" };
 }
-export function matchSegmentPatterns(path, compiled) {
-    const rawSegs = path.split(/[\\/]/).filter(Boolean);
-    let loweredSegs;
+export function matchSegmentPatterns(path, compiled, opts) {
+    const literalSegs = path.split(/[\\/]/).filter(Boolean);
+    const win32Segs = [];
+    for (const raw of literalSegs) {
+        const dot = /^\.{1,2}$/.test(raw) ? raw : raw.replace(/ +$/, "");
+        if (dot === ".")
+            continue;
+        if (dot === "..") {
+            const last = win32Segs[win32Segs.length - 1];
+            if (win32Segs.length > 0 && last !== "..")
+                win32Segs.pop();
+            else
+                win32Segs.push("..");
+            continue;
+        }
+        const stripped = raw.replace(/[. ]+$/, "");
+        win32Segs.push(stripped.length > 0 ? stripped : raw);
+    }
+    const sameView = opts?.aliasResolved === true ||
+        (win32Segs.length === literalSegs.length && win32Segs.every((s, i) => s === literalSegs[i]));
+    const views = sameView ? [literalSegs] : [literalSegs, win32Segs];
+    const lowered = new Map();
     for (const pat of compiled) {
-        const segs = pat.foldAscii ? (loweredSegs ??= rawSegs.map(asciiLower)) : rawSegs;
-        const n = pat.segments.length;
-        for (let i = 0; i + n <= segs.length; i++) {
-            if (pat.segments.every((re, j) => re.test(segs[i + j] ?? "")))
-                return pat.raw;
+        for (const view of views) {
+            const segs = pat.foldAscii ? (lowered.get(view) ?? lowered.set(view, view.map(asciiLower)).get(view)) : view;
+            const n = pat.segments.length;
+            for (let i = 0; i + n <= segs.length; i++) {
+                if (pat.segments.every((re, j) => re.test(segs[i + j] ?? "")))
+                    return pat.raw;
+            }
         }
     }
     return null;
@@ -171,15 +192,15 @@ export function compileReadDeny(additions = [], layer = "additions", builtin) {
         rgExclusionGlobs.push({ flag, glob: `!**/${g}` }, { flag, glob: `!**/${g}/**` });
         rgProbeGlobs.push({ flag, glob: `**/${g}` }, { flag, glob: `**/${g}/**` });
     }
-    const matchPath = (path) => {
-        const hit = matchSegmentPatterns(path, compiled);
+    const matchPath = (path, opts) => {
+        const hit = matchSegmentPatterns(path, compiled, opts);
         return hit === null ? null : { pattern: hit };
     };
     return {
         entries: normalized,
         matchPath,
-        matchTarget(canonicalKey, lexicalView) {
-            const canonical = matchPath(canonicalKey);
+        matchTarget(canonicalKey, lexicalView, opts) {
+            const canonical = matchPath(canonicalKey, opts);
             if (canonical !== null)
                 return { ...canonical, matchedView: canonicalKey };
             if (lexicalView !== undefined) {

package/dist/tools/fs/safety.d.ts

@@ -268,7 +268,9 @@ export declare function lexicalViewOf(spelled: string, base: string): string;
  * `executionEnv` — see design/44 §5.)
  */
 export declare function resolveKey(env: ExecutionEnv, rootCanonical: string, path: string, signal?: AbortSignal, baseCwd?: string, additionalRootsCanonical?: readonly string[], exactFileReadExemption?: (canonicalKey: string) => boolean, readDeny?: {
-    matchTarget(canonicalKey: string, lexicalView?: string): {
+    matchTarget(canonicalKey: string, lexicalView?: string, opts?: {
+        readonly aliasResolved?: boolean;
+    }): {
         pattern: string;
         matchedView?: string;
     } | null;
@@ -291,6 +293,7 @@ export declare function resolveKey(env: ExecutionEnv, rootCanonical: string, pat
 export declare function canonicalizeTarget(env: ExecutionEnv, path: string, signal?: AbortSignal, baseCwd?: string): Promise<{
     ok: true;
     key: string;
+    aliasResolved?: true;
 } | {
     ok: false;
     message: string;

package/dist/tools/fs/safety.js

@@ -339,7 +339,9 @@ export async function resolveKey(env, rootCanonical, path, signal, baseCwd, addi
         return { ok: false, violation: { code: "invalid", message: `path "${path}" is a blocked device/special file (reading it can hang the process); refused.` } };
     }
     if (readDeny !== undefined) {
-        const hit = readDeny.matchTarget(key, lexicalViewOf(path, baseCwd ?? rootCanonical));
+        const hit = readDeny.matchTarget(key, lexicalViewOf(path, baseCwd ?? rootCanonical), {
+            aliasResolved: canon.aliasResolved === true,
+        });
         if (hit !== null) {
             const lexicalHit = hit.matchedView !== undefined && hit.matchedView !== key;
             const judged = lexicalHit
@@ -419,7 +421,7 @@ export async function canonicalizeTarget(env, path, signal, baseCwd) {
         }
         const canon = await env.canonicalPath(abs, signal);
         if (canon.ok)
-            return { ok: true, key: canon.value };
+            return { ok: true, key: canon.value, aliasResolved: true };
         const info = await env.fileInfo(abs, signal);
         if (!info.ok) {
             return { ok: false, message: `cannot determine whether "${path}" is a symlink: ${info.error.message}`, unresolvedSymlink: true };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "5.38.0",
+  "version": "5.39.0",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",

package/test/export-surface.snapshot.json

@@ -1,6 +1,6 @@
 {
   "_comment": "design/87 L3 — frozen public export surface of src/index.ts (name -> kind). DO NOT edit by hand to silence a red test. A removed/changed entry = a SemVer-BREAKING change; bump MAJOR and update this fixture in the SAME commit (design/87 §4.2 / §5.2). Regenerate via REGEN in test/export-surface.test.ts.",
-  "count": 1585,
+  "count": 1597,
   "exports": {
     "A2ATaskState": "type",
     "A2ATaskStateReversal": "type",
@@ -408,6 +408,7 @@
     "LspToolOptions": "interface",
     "LspTransport": "interface",
     "MAILBOX_CONTRACT_SCOPE": "variable",
+    "MAILBOX_TOMBSTONED_RECIPIENT_CODE": "variable",
     "MASS_DELETION_FUSE_RATIO": "variable",
     "MAX_ACTOR_FIELD_CHARS": "variable",
     "MAX_EDIT_BYTES": "variable",
@@ -445,6 +446,8 @@
     "MailboxLease": "interface",
     "MailboxMessage": "interface",
     "MailboxStore": "interface",
+    "MailboxStoreError": "class",
+    "MailboxTombstonedRecipientContractHooks": "interface",
     "ManagedRetentionCapability": "interface",
     "ManifestDurability": "type",
     "MaterializedA2a": "interface",
@@ -1028,6 +1031,7 @@
     "WORKFLOW_SUBAGENT_PROMPT": "variable",
     "WORKFLOW_SUBAGENT_PROMPT_SCHEMA": "variable",
     "WORKTREE_PARENT": "variable",
+    "WRITE_PROTECTED_DEFAULT_TABLE": "variable",
     "WebFetchConfig": "interface",
     "WebSearchConfig": "interface",
     "WiringFacts": "interface",
@@ -1077,6 +1081,11 @@
     "WorktreeSessionRef": "interface",
     "WorktreeToolsOptions": "interface",
     "WritablePermissionRuleStore": "interface",
+    "WriteProtectedEntry": "type",
+    "WriteProtectedHit": "interface",
+    "WriteProtectedKind": "type",
+    "WriteProtectedRow": "interface",
+    "WriteProtectionMatcher": "interface",
     "ackAdoptionConfig": "function",
     "acquireCcLock": "function",
     "addDotsOf": "function",
@@ -1158,6 +1167,7 @@
     "collectBelowFrontier": "function",
     "combinePolicies": "function",
     "compileReadDeny": "function",
+    "compileWriteProtection": "function",
     "complianceCallDenial": "function",
     "compose": "function",
     "composeConstitution": "function",
@@ -1362,6 +1372,7 @@
     "mailboxAckOwnershipContract": "function",
     "mailboxBundledOnlyContract": "function",
     "mailboxStoreContract": "function",
+    "mailboxTombstonedRecipientContract": "function",
     "markTruncated": "function",
     "materializeA2aTools": "function",
     "materializeEntriesToFiles": "function",
@@ -1477,6 +1488,7 @@
     "resolveTaskLimits": "function",
     "resolveTaskModel": "function",
     "resolveUsageWindows": "function",
+    "resolveWriteProtectedTable": "function",
     "restoreFrozenPaths": "function",
     "resumeWithVerification": "function",
     "retiredWorkflowNameAliases": "function",