@sema-agent/core 5.38.0 → 5.40.0

package/dist/core/runner/prepare-task.js

@@ -28,8 +28,9 @@ import { CHANGED_FILES_MTIME_EPS_MS, fenceMcpServerInstructions, renderAgentList
 import { inlineUntrusted } from "../untrusted-text.js";
 import { policyAskClassOf } from "../ask-class.js";
 import { emitTrace } from "../trace.js";
-import { createSessionRulePolicy } from "./session-rule-policy.js";
+import { createSessionRulePolicy, PATH_CONFINABLE_WRITE_TOOLS } from "./session-rule-policy.js";
 import { cloneObserverInput, createHookEnvCapabilities, createPreToolUseConstraintPolicy, formatHookFeedback, mintHookInvocationIdentity, persistedRuleMandateOf, runToolGate } from "../hooks.js";
+import { createWriteProtectionCheck } from "../write-protect.js";
 import { orgRuleVerdictFor } from "../permission-rule-org.js";
 import { CacheBreakDetector, toolsToFingerprintInputs } from "../cache-break-detector.js";
 import { reservedCollisions, reservedFor } from "../../brain/request-params.js";
@@ -326,6 +327,13 @@ function orgRevisionEvidenceOf(resolution, onDefect) {
 function persistedRuleHitOf(admitting) {
     return admitting === undefined ? undefined : { rule: admitting.rule, dots: admitting.adds.map((a) => ({ actor: a.dot.actor, counter: a.dot.counter })) };
 }
+function cwdConflictsRestoreError(requestedCwd) {
+    const e = new Error(`RunInternals.requestedCwd ("${requestedCwd}") cannot be combined with a checkpoint workspace restore — ` +
+        `the restored workspace's own mount path is authoritative for the task root, so a requested cwd on this leg ` +
+        `would be ignored (or worse, probed against an unrestored environment). Drop requestedCwd on resume legs.`);
+    e.code = "config.cwd_conflicts_restore";
+    return e;
+}
 export async function prepareTask(spec, deps, sessions, resume, internals, runnerSelf) {
     const doors = prepareConfigDoors({ spec, deps, sessions, resume, internals });
     spec = doors.spec;
@@ -420,6 +428,10 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         e.code = "config.cwd_unsupported";
         throw e;
     }
+    if (internals?.requestedCwd !== undefined && resume?.workspaceHandle !== undefined) {
+        await settleTeardownLeg(() => forgetOnThrow(), "forgetOnThrow (cwd-conflicts-restore leg)", (err) => deps.onError?.(err, { phase: "config", sessionId }));
+        throw cwdConflictsRestoreError(internals.requestedCwd);
+    }
     try {
         ownedEnv = deps.executionEnvFactory
             ? await deps.executionEnvFactory({
@@ -1247,6 +1259,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 if (c.ok)
                     additionalRootsCanonical.push(c.value);
             }
+            for (const a of [additionalRootsCanonical, additionalReadRootsCanonical])
+                a.splice(0, a.length, ...new Set(a));
             const readFileState = new Map((resume?.seed.readFileState ?? []).map(([k, v]) => [rebaseRestoredPath(k), v]));
             readFileStateForCheckpoint = readFileState;
             seedContextFiles = async (files) => {
@@ -1413,6 +1427,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             toolEffects.set("TaskStop", "write");
             tools.push(firstPartyOffload(createTaskOutputTool({ registry: defaultTaskRegistry, owner: hostTaskId, scope: taskScope, sessionId, workflowStore: deps.workflowRunStore, agentStore: deps.backgroundAgentStore, notificationWired: internals?.onTaskNotification !== undefined, oneShot: spec.oneShot, toolResultStore: offloadStore })), firstPartyOffload(createTaskStopTool({ registry: defaultTaskRegistry, owner: hostTaskId, scope: taskScope, sessionId, workflowStore: deps.workflowRunStore, agentStore: deps.backgroundAgentStore })));
             if (runnerSelf && !(spec.tools ?? []).some((t) => t.name === SEND_MESSAGE_TOOL_NAME)) {
+                toolEffects.set(SEND_MESSAGE_TOOL_NAME, "write");
+                axisExplicitNegatives.set(SEND_MESSAGE_TOOL_NAME, { ...axisExplicitNegatives.get(SEND_MESSAGE_TOOL_NAME), egress: false });
                 const delegationForRevive = (spec.tools ?? []).find((t) => t.agentListing !== undefined);
                 const reviveSpawn = delegationForRevive !== undefined && deps.backgroundAgentStore !== undefined && deps.mailboxStore !== undefined
                     ? async (req) => {
@@ -2813,7 +2829,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             list.push({ cls, layer });
             foldAskClasses.set(toolCallId, list);
         };
-        const sandboxBoundaryCapable = (toolName) => egressTools.has(toolName) || toolName.includes("__") || ownToolNames.has(toolName);
+        const sandboxBoundaryCapable = (toolName) => egressTools.has(toolName) || toolName.includes("__") || ownToolNames.has(toolName) || toolName === SEND_MESSAGE_TOOL_NAME;
         const emitSandboxAdmitted = (info) => {
             emitTrace(deps.tracer, () => ({
                 kind: "permission.sandbox_admitted",
@@ -4220,13 +4236,16 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 if (eff !== undefined && !toolEffects.has(t.name))
                     toolEffects.set(t.name, eff);
             }
+            const writeProtectionCheck = createWriteProtectionCheck(deps.writeProtectedPaths);
+            const writeProtectionArmed = writeProtectionCheck !== undefined && tools.some((t) => PATH_CONFINABLE_WRITE_TOOLS.has(t.name));
             toolCallGateArmedRef.armed =
                 effectivePolicy !== undefined ||
                     hooks?.preToolUse !== undefined ||
                     egressTools.size > 0 ||
                     irreversibleTools.size > 0 ||
                     spec.enablePlanMode === true ||
-                    complianceDenies.has("web_fetch");
+                    complianceDenies.has("web_fetch") ||
+                    writeProtectionArmed;
             if (toolCallGateArmedRef.armed) {
                 harness.on("tool_call", async (e) => {
                     blockedToolCalls.delete(e.toolCallId);
@@ -4269,6 +4288,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             suspendAsk,
                             resolveContentAsk,
                             egress: egressTools.has(e.toolName),
+                            peerMessage: e.toolName === SEND_MESSAGE_TOOL_NAME,
+                            ...(writeProtectionCheck !== undefined ? { writeProtectionCheck } : {}),
                             irreversibility: irreversibilityTier.get(e.toolName),
                             reversibilityProbe: reversibilityProbes.get(e.toolName),
                             abortSignal: abortController.signal,

package/dist/core/runner/runtask.js

@@ -4126,6 +4126,11 @@ export class Runner {
         if (cp.state.workspaceHandle !== undefined && this.deps.executionEnvFactory === undefined) {
             throw new CheckpointError("checkpoint.unsupported_version", "checkpoint has a remote workspaceHandle but no RunnerDeps.executionEnvFactory is wired to rebuild the env", { reason: "env_factory_missing" });
         }
+        if (cp.state.workspaceHandle !== undefined && internals?.requestedCwd !== undefined) {
+            throw new CheckpointError("checkpoint.cwd_conflicts_restore", `internals.requestedCwd ("${internals.requestedCwd}") cannot be combined with a checkpoint workspace restore — ` +
+                "the restored workspace's own mount path is authoritative for the task root. Drop requestedCwd on resume legs " +
+                "(the checkpoint stays pending and is resumable without it).");
+        }
         if (cp.state.inheritedGate?.requiresParentConstraint === true) {
             const supplied = internals?.inheritedGate?.parentConstraints?.length ?? 0;
             if (supplied === 0) {

package/dist/core/runner/synthetic-tools.js

@@ -196,7 +196,9 @@ export function createSkillTool(skills, scope) {
             const name = String(a.skill ?? "");
             const skill = byName.get(name);
             if (!skill) {
-                throw new Error(`Unknown skill "${name}". Available skills: ${names}.`);
+                throw new Error(`Unknown skill "${name}". Available skills: ${names}. ` +
+                    `(Only skills registered with this deployment are loadable — other products' skills directories are not read. ` +
+                    `If the user wants one of those here, read its source file and recreate its content for this deployment instead.)`);
             }
             if (scope && skill.manifest) {
                 scope.push({ kind: "manifest", manifest: skill.manifest });

package/dist/core/runner/tool-disclosure.js

@@ -45,7 +45,8 @@ export function classifyDeferred(opts) {
         if (!pinned.has(name))
             deferred.add(name);
     if (opts.deferMode === "auto") {
-        const candidates = opts.fullTools.filter((t) => !deferred.has(t.name) && !pinned.has(t.name));
+        const callerNames = new Set(opts.specs.map((s) => s.name));
+        const candidates = opts.fullTools.filter((t) => !deferred.has(t.name) && !pinned.has(t.name) && callerNames.has(t.name));
         const inlineFace = opts.fullTools.filter((t) => !deferred.has(t.name));
         const total = inlineFace.reduce((n, t) => n + inlinedChars(t), 0);
         const window = (opts.model.contextTokens ?? opts.model.contextWindow ?? 0) * CHARS_PER_TOKEN;

package/dist/core/sensitive-path-policy.js

@@ -39,8 +39,8 @@ function compilePatterns(patterns) {
     }
     return out;
 }
-function matchSensitive(canonicalKey, compiled) {
-    return matchSegmentPatterns(canonicalKey, compiled);
+function matchSensitive(canonicalKey, compiled, aliasResolved) {
+    return matchSegmentPatterns(canonicalKey, compiled, { aliasResolved });
 }
 export function createSensitivePathPolicy(opts) {
     const compiled = compilePatterns(opts.patterns);
@@ -64,7 +64,7 @@ export function createSensitivePathPolicy(opts) {
                 }
                 return { action: "allow" };
             }
-            const hit = matchSensitive(canon.key, compiled);
+            const hit = matchSensitive(canon.key, compiled, canon.aliasResolved === true);
             if (hit) {
                 return {
                     action: "deny",

package/dist/core/store-contracts/mailbox-store-contract.d.ts

@@ -1,4 +1,4 @@
-import type { MailboxStore } from "../mailbox-store.js";
+import { type MailboxStore } from "../mailbox-store.js";
 import { type ContractAssertionRunner } from "./contract-harness.js";
 /**
  * design/159 S1 — the cross-backend {@link MailboxStore} contract, extracted VERBATIM from
@@ -46,3 +46,31 @@ export declare function mailboxAckOwnershipContract(mk: () => MailboxStore, runA
  * 放宽」:核心层没有一条为了任何后端而弱化。第三方后端若有租户轴,应当也挂这一层。
  */
 export declare function mailboxBundledOnlyContract(mk: () => MailboxStore, runAssertion?: ContractAssertionRunner): Promise<void>;
+export interface MailboxTombstonedRecipientContractHooks {
+    /** Put `(scope, handle)` into the deployment's PRE-DELETE state — whatever that is for this
+     *  backend (a cascade marking the session row, a `deleting` column, a tombstone table). Core does
+     *  not name the mechanism, only what `append` must then do. */
+    tombstone: (store: MailboxStore, scope: string, handle: string) => Promise<void>;
+    runAssertion?: ContractAssertionRunner;
+}
+/**
+ * T2 可选能力层(pre-delete 分册)—— 只挂**看得见收件人生命周期**的后端:它的 mailbox 行与某个
+ * 删除级联要清掉的 session 行同生共死(server 的留存删除级联是首个此形消费方)。三个捆绑后端都
+ * 没有这个视角,因此都不挂——**这不是「做不到所以放宽」**:没有预删除态的后端根本没有可拒的对象,
+ * 而有这个态却静默接受的后端,拿到的 seq 是一张级联马上就要撕掉的回执(`append` 是 durable-first,
+ * 回执即承诺),且没有任何其它面会说出这件事。
+ *
+ * 契约不规定态怎么置(那是部署自己的删除协议),只钉「拒」这件事的三条轴 —— **三条一起列在这里,
+ * 是因为逐条补的过程本身证明了单看一条会假绿**(每加一条,都有一个能过掉前面全部用例的错误实现被
+ * 抓出来):
+ *  1. **拒因轴**:必须拒,且每条路径上都带同一个码(空箱与非空箱都算路径);
+ *  2. **副作用轴**:被拒的 append 对箱零改动 —— 不入箱(幽灵投递)、不清箱(删除窗口内静默丢)、
+ *     也不动活租约(动了就撬开 X-1 的单消费者围栏,同一批消息会被二次投递);
+ *  3. **收件人边界轴**:态属于一个 `(scope, handle)` 整体,且这个整体是**单射**的 —— 兄弟 handle
+ *     不受牵连、跨租户同名不受牵连、拼键歧义不得把两个收件人折成一个。
+ * 新增用例请按这三条轴归位;要加第四条轴,先说清它是哪一类假绿。
+ *
+ * 受众前提与 {@link mailboxBundledOnlyContract} 同线:后端有自己的租户轴(生命周期可见的后端就是
+ * 服务端形态的 store),边界轴的两条用例要用两个 scope 构造。
+ */
+export declare function mailboxTombstonedRecipientContract(mk: () => MailboxStore, hooks: MailboxTombstonedRecipientContractHooks): Promise<void>;

package/dist/core/store-contracts/mailbox-store-contract.js

@@ -1,4 +1,5 @@
 import { strict as assert } from "node:assert";
+import { MAILBOX_TOMBSTONED_RECIPIENT_CODE } from "../mailbox-store.js";
 import { beginContract } from "./contract-harness.js";
 export const MAILBOX_CONTRACT_SCOPE = "default";
 const msg = (content, sentAt = 1000) => ({ content, sentAt });
@@ -191,3 +192,80 @@ export async function mailboxBundledOnlyContract(mk, runAssertion) {
     });
     await settle();
 }
+export async function mailboxTombstonedRecipientContract(mk, hooks) {
+    const { run: runRaw, settle } = beginContract(hooks.runAssertion);
+    const run = (name, fn) => runRaw(name, () => withStores(mk, fn));
+    const S = MAILBOX_CONTRACT_SCOPE;
+    const codeOf = (e) => e?.code;
+    run("预删除态的收件人:append 响亮拒且带码(既不静默收下级联即将删掉的消息,也不裸抛)", async (make) => {
+        const s = make();
+        await hooks.tombstone(s, S, "a1");
+        let thrown;
+        try {
+            await s.append(S, "a1", msg("m1"));
+        }
+        catch (e) {
+            thrown = e;
+        }
+        assert.notEqual(thrown, undefined, "静默收下 = 给发件人一张级联马上撕掉的回执");
+        assert.equal(codeOf(thrown), MAILBOX_TOMBSTONED_RECIPIENT_CODE, "裸抛与拒同形:消费方要能按码分诊");
+        let again;
+        try {
+            await s.append(S, "a1", msg("m2"));
+        }
+        catch (e) {
+            again = e;
+        }
+        assert.equal(codeOf(again), MAILBOX_TOMBSTONED_RECIPIENT_CODE);
+    });
+    run("拒的粒度是收件人,不是开关:同 scope 下另一个活收件人照常收信", async (make) => {
+        const s = make();
+        await hooks.tombstone(s, S, "a1");
+        assert.equal(await s.append(S, "a2", msg("still-live")), 1, "活收件人不受邻居的删除级联牵连");
+        assert.equal(await s.peekCount(S, "a2"), 1);
+    });
+    run("收件人身份是 (scope, handle) 整体:A 租户的删除级联不得拒掉 B 租户的同名收件人", async (make) => {
+        const s = make();
+        await hooks.tombstone(s, "tenant-a", "a1");
+        assert.equal(await s.append("tenant-b", "a1", msg("other-tenant")), 1, "同名 handle 在另一个租户下是另一个收件人");
+        assert.equal(await s.peekCount("tenant-b", "a1"), 1);
+    });
+    run("两件套还得是单射的:把 (scope, handle) 拼成一个字符串记态,不得让两个不同收件人撞成一个", async (make) => {
+        const s = make();
+        await hooks.tombstone(s, "tenant a", "b");
+        assert.equal(await s.append("tenant", "a b", msg("distinct-recipient")), 1, "拼键歧义不得把另一个收件人一起拒掉");
+        assert.equal(await s.peekCount("tenant", "a b"), 1);
+    });
+    run("副作用轴 · 活租约:被拒的 append 不得动别人手上的租约(单消费者围栏不因删除窗口松开)", async (make) => {
+        const s = make();
+        await s.append(S, "a1", msg("in-flight"));
+        const held = await s.claimLease(S, "a1", "consumer-A", 60_000, 10_000);
+        assert.equal(held?.messages.length, 1);
+        await hooks.tombstone(s, S, "a1");
+        await assert.rejects(s.append(S, "a1", msg("after-tombstone", 2_000)), "预删除态下的 append 必须拒");
+        assert.equal(await s.claimLease(S, "a1", "rival", 60_000, 11_000), null, "A 的活租约必须仍然 fence 住别人");
+        await s.ack(S, "a1", "consumer-A", held.maxSeq);
+        assert.equal(await s.peekCount(S, "a1"), 0);
+    });
+    run("拒的是入口,不是清仓:被拒的 append 零副作用,已入箱的消息按原 seq/内容原封不动", async (make) => {
+        const s = make();
+        const seq = await s.append(S, "a1", msg("parked-before"));
+        await hooks.tombstone(s, S, "a1");
+        let thrown;
+        let refused = false;
+        try {
+            await s.append(S, "a1", msg("after-tombstone", 2_000));
+        }
+        catch (e) {
+            refused = true;
+            thrown = e;
+        }
+        assert.equal(refused, true, "预删除态下的 append 必须拒");
+        assert.equal(codeOf(thrown), MAILBOX_TOMBSTONED_RECIPIENT_CODE, "箱非空时的拒同样要带码");
+        assert.equal(await s.peekCount(S, "a1"), 1, "被拒的 append 不得入箱(幽灵投递),也不得清箱");
+        const lease = await s.claimLease(S, "a1", "w1", 60_000, 10_000);
+        assert.deepEqual(lease?.messages.map((m) => m.seq), [seq]);
+        assert.deepEqual(lease?.messages.map((m) => m.content), ["parked-before"], "取到的仍是拒之前那一条");
+    });
+    await settle();
+}

package/dist/core/types.d.ts

@@ -4785,6 +4785,27 @@ export interface RunnerDeps {
      * ignored). Same deployment-only seat, clamp argument and checkpoint posture as the tiers key.
      */
     readDenyBuiltinExclude?: readonly string[];
+    /**
+     * backlog #286 (#279 — CC 2.1.233 `DANGEROUS_FILES`/`DANGEROUS_DIRECTORIES`/
+     * `DANGEROUS_DIRECTORY_PATHS` parity): the WRITE-protection table. DEFAULT-ON: a path-confinable
+     * write (Write/Edit/NotebookEdit) whose target lands on a table row has a surviving `allow`
+     * demoted to `ask` at the tool gate (`decisionReason: "safety"`; a deny/ask verdict is untouched;
+     * approval flows the ordinary ask-resolution chain — classifier, blanket `onAsk`, durable park —
+     * with no `requiresRealApproval` mandate). Absent =
+     * {@link import("./write-protect.js").WRITE_PROTECTED_DEFAULT_TABLE} (the CC triple verbatim +
+     * the two argued sema rows). This key IS the whole-table escape hatch, deployment seat ONLY (no
+     * TaskSpec twin, no governed-workflow channel): `[]` = no table (explicit and legal); a non-empty
+     * list REPLACES the built-in table whole (compose additions as
+     * `[...WRITE_PROTECTED_DEFAULT_TABLE, …]`; drop rows by filtering the exported table — the
+     * visible/deletable admin face). Bad values refuse loudly at prepare (#123): garbage shapes,
+     * glob metacharacters (the table speaks LITERAL names — glob semantics live in
+     * `createSensitivePathPolicy`), unknown kinds, impossible kind/name combinations. Matching is
+     * lexical over the spelled target with one case fold (ı/ſ included) — a symlink alias evades it
+     * by construction; the canonicalizing opt-in deny policy remains the hard layer. Not frozen into
+     * checkpoints: a resumed task follows the CURRENT deployment table (an approved parked call
+     * bypasses the gate as always — the human already adjudicated it).
+     */
+    writeProtectedPaths?: readonly import("./write-protect.js").WriteProtectedEntry[];
     /**
      * design/199 件A — the DEPLOYMENT's read-face declaration
      * ({@link import("../tools/fs/read-face.js").ReadFace}; see {@link TaskSpec.readFace} for the

package/dist/core/write-protect.d.ts

@@ -0,0 +1,73 @@
+/**
+ * How one table row matches the judged path:
+ *  · `"basename"`     — the target's last segment equals the row name (CC `DANGEROUS_FILES` form);
+ *  · `"segment"`      — ANY path segment equals the row name (CC `DANGEROUS_DIRECTORIES` form);
+ *  · `"segment-run"`  — a CONSECUTIVE run of segments equals the row's `/`-separated segments
+ *                       (CC `DANGEROUS_DIRECTORY_PATHS` form, e.g. `.config/git`).
+ */
+export type WriteProtectedKind = "basename" | "segment" | "segment-run";
+/** One row of the write-protection table: a LITERAL name and how it matches. The `name` is also the
+ *  row's stable identity — the string a refusal/ask message cites. */
+export interface WriteProtectedRow {
+    readonly name: string;
+    readonly kind: WriteProtectedKind;
+}
+/**
+ * One deployment-authored entry for the replacement seat (`RunnerDeps.writeProtectedPaths`).
+ * String shorthand: a bare name ≡ `{ name, kind: "segment" }` (the WIDER single-segment kind —
+ * over-matching is the fail-safe direction for a tighten); a name containing `/` ≡
+ * `{ name, kind: "segment-run" }`. Spell `kind: "basename"` explicitly when last-segment-only
+ * matching is the intent.
+ */
+export type WriteProtectedEntry = string | WriteProtectedRow;
+/** A table hit: which row matched (the row's canonical name + kind). */
+export interface WriteProtectedHit {
+    readonly name: string;
+    readonly kind: WriteProtectedKind;
+}
+export declare const WRITE_PROTECTED_DEFAULT_TABLE: readonly WriteProtectedRow[];
+/**
+ * The ONE case fold of this module, applied to BOTH sides of every comparison (table names at
+ * compile, path segments at match) — `toLowerCase` plus the two confusable letters CC's fold maps
+ * (U+0131 dotless ı → i, U+017F long ſ → s). Deliberately NOT full Unicode confusable folding:
+ * that would be a different, wider claim than the one made (the read deny set's ASCII-contract doc
+ * states the same boundary for its own fold).
+ */
+export declare function foldWriteProtectCase(s: string): string;
+/**
+ * Resolve the ACTIVE table under the deployment seat (validated, loud — #123's bad-value states all
+ * throw and name the knob). `undefined` = the default table; `[]` = NO table (an explicit, legal
+ * posture — the whole-table escape hatch's empty end); a non-empty list REPLACES the default table
+ * whole (compose additions as `[...WRITE_PROTECTED_DEFAULT_TABLE, …]`, drop rows by filtering the
+ * exported table — the visible/deletable admin face). Exact duplicates fold (idempotent, not one of
+ * #123's bad-value states). Exported so an admin face can preview the effective table under a
+ * candidate configuration with the engine's own rules.
+ */
+export declare function resolveWriteProtectedTable(entries?: readonly WriteProtectedEntry[]): readonly WriteProtectedRow[];
+/** The compiled judge over one resolved table. Pure and synchronous — literal folded comparisons,
+ *  no filesystem access (see the module header for the declared lexical scope). */
+export interface WriteProtectionMatcher {
+    /** The resolved rows this judge was compiled from (canonical names — the disclosure face). */
+    readonly rows: readonly WriteProtectedRow[];
+    /** Judge ONE path spelling. Returns the first matching row (basename rows first, then segment,
+     *  then segment-run — deterministic), or null. */
+    matchPath(path: string): WriteProtectedHit | null;
+}
+/**
+ * Compile the write-protection judge for a deployment configuration. Returns `undefined` when the
+ * resolved table is EMPTY (`[]` replacement) — the caller then mounts no tighten at all, keeping an
+ * opted-out deployment's decision path byte-identical to a build without this layer.
+ */
+export declare function compileWriteProtection(entries?: readonly WriteProtectedEntry[]): WriteProtectionMatcher | undefined;
+/**
+ * Build the ENGINE-FILLED gate input (`ToolGateInput.writeProtectionCheck`): covered tools are the
+ * path-confinable write set (Write/Edit/NotebookEdit — the shared spelling), the judged target is
+ * the SAME string the tool itself will resolve (`writeTargetPath`, the shared single source with
+ * the sensitive-path guard and the fs-write gate), and the verdict is the table judge's. A covered
+ * write with NO resolvable target returns null here — this layer is ADDITIVE friction on a named
+ * set of targets, not a containment boundary (a target-less call cannot land on a named row, and
+ * the tool's own schema validation refuses it before any write); the fail-closed treatment of the
+ * unresolvable case belongs to the containment gates (fs-write-gate-policy documents that split).
+ * Returns `undefined` when the resolved table is empty — nothing to judge, mount nothing.
+ */
+export declare function createWriteProtectionCheck(entries?: readonly WriteProtectedEntry[]): ((toolName: string, args: unknown) => WriteProtectedHit | null) | undefined;

package/dist/core/write-protect.js

@@ -0,0 +1,195 @@
+import { writeTargetPath } from "../tools/fs/safety.js";
+import { PATH_CONFINABLE_WRITE_TOOLS } from "./runner/session-rule-policy.js";
+const freezeTable = (rows) => Object.freeze(rows.map((r) => Object.freeze(r)));
+export const WRITE_PROTECTED_DEFAULT_TABLE = freezeTable([
+    { name: ".gitconfig", kind: "basename" },
+    { name: ".gitmodules", kind: "basename" },
+    { name: ".bashrc", kind: "basename" },
+    { name: ".bash_profile", kind: "basename" },
+    { name: ".zshrc", kind: "basename" },
+    { name: ".zprofile", kind: "basename" },
+    { name: ".profile", kind: "basename" },
+    { name: ".zshenv", kind: "basename" },
+    { name: ".zlogin", kind: "basename" },
+    { name: ".zlogout", kind: "basename" },
+    { name: ".bash_login", kind: "basename" },
+    { name: ".bash_aliases", kind: "basename" },
+    { name: ".bash_logout", kind: "basename" },
+    { name: ".envrc", kind: "basename" },
+    { name: ".ripgreprc", kind: "basename" },
+    { name: ".mcp.json", kind: "basename" },
+    { name: ".claude.json", kind: "basename" },
+    { name: ".npmrc", kind: "basename" },
+    { name: ".yarnrc", kind: "basename" },
+    { name: ".yarnrc.yml", kind: "basename" },
+    { name: ".pnp.cjs", kind: "basename" },
+    { name: ".pnp.loader.mjs", kind: "basename" },
+    { name: ".pnpmfile.cjs", kind: "basename" },
+    { name: "bunfig.toml", kind: "basename" },
+    { name: ".bunfig.toml", kind: "basename" },
+    { name: ".bazelrc", kind: "basename" },
+    { name: ".bazelversion", kind: "basename" },
+    { name: ".bazeliskrc", kind: "basename" },
+    { name: ".pre-commit-config.yaml", kind: "basename" },
+    { name: "lefthook.yml", kind: "basename" },
+    { name: ".lefthook.yml", kind: "basename" },
+    { name: "lefthook.yaml", kind: "basename" },
+    { name: ".lefthook.yaml", kind: "basename" },
+    { name: "gradle-wrapper.properties", kind: "basename" },
+    { name: "maven-wrapper.properties", kind: "basename" },
+    { name: ".devcontainer.json", kind: "basename" },
+    { name: "pyrightconfig.json", kind: "basename" },
+    { name: ".git", kind: "segment" },
+    { name: ".vscode", kind: "segment" },
+    { name: ".idea", kind: "segment" },
+    { name: ".claude", kind: "segment" },
+    { name: ".husky", kind: "segment" },
+    { name: ".cargo", kind: "segment" },
+    { name: ".devcontainer", kind: "segment" },
+    { name: ".yarn", kind: "segment" },
+    { name: ".mvn", kind: "segment" },
+    { name: ".config/git", kind: "segment-run" },
+    { name: ".ssh", kind: "segment" },
+    { name: ".gnupg", kind: "segment" },
+]);
+export function foldWriteProtectCase(s) {
+    return s.toLowerCase().replace(/ı/g, "i").replace(/ſ/g, "s");
+}
+const KINDS = ["basename", "segment", "segment-run"];
+function describeEntryValue(v) {
+    try {
+        return JSON.stringify(v) ?? String(v);
+    }
+    catch {
+        return String(v);
+    }
+}
+function normalizeWriteProtectedEntry(entry) {
+    const shape = typeof entry === "string" ? { name: entry, kind: entry.includes("/") ? "segment-run" : "segment" } : entry;
+    if (typeof shape !== "object" || shape === null || typeof shape.name !== "string") {
+        throw new Error(`writeProtectedPaths: entry ${describeEntryValue(entry)} is not a name string or { name, kind } row.`);
+    }
+    const name = shape.name;
+    if (!KINDS.includes(shape.kind)) {
+        throw new Error(`writeProtectedPaths: entry ${describeEntryValue(entry)} has kind ${describeEntryValue(shape.kind)} — known kinds: ${KINDS.join(", ")}.`);
+    }
+    const kind = shape.kind;
+    if (name.includes("*") || name.includes("?")) {
+        throw new Error(`writeProtectedPaths: entry ${describeEntryValue(name)} contains a wildcard metacharacter — this table speaks LITERAL names only (a silently-literal "*" would guard less than it reads); pattern semantics live in createSensitivePathPolicy.`);
+    }
+    if (name.includes("\\")) {
+        throw new Error(`writeProtectedPaths: entry ${describeEntryValue(name)} contains a backslash — names are "/"-separated (both path families are matched); spell the segments with "/".`);
+    }
+    const segments = name.split("/").filter((s) => s.length > 0);
+    if (segments.length === 0) {
+        throw new Error(`writeProtectedPaths: entry ${describeEntryValue(name)} contains no path segments and would protect nothing — remove the entry or spell the name.`);
+    }
+    if (segments.some((s) => s === "." || s === "..")) {
+        throw new Error(`writeProtectedPaths: entry ${describeEntryValue(name)} contains a "." or ".." segment — the judge folds dot segments lexically before matching, so such a row could never match anything; spell the real name.`);
+    }
+    if (segments.length > 1 && kind !== "segment-run") {
+        throw new Error(`writeProtectedPaths: entry ${describeEntryValue(name)} spans ${segments.length} segments but declares kind "${kind}" — multi-segment names match as kind "segment-run".`);
+    }
+    return { name: segments.join("/"), kind };
+}
+export function resolveWriteProtectedTable(entries) {
+    if (entries === undefined)
+        return WRITE_PROTECTED_DEFAULT_TABLE;
+    if (!Array.isArray(entries)) {
+        throw new Error(`writeProtectedPaths: expected an array of entries (whole-table replacement; [] = no write-protection table), got ${describeEntryValue(entries)}.`);
+    }
+    const out = [];
+    const seen = new Set();
+    for (const entry of entries) {
+        const row = normalizeWriteProtectedEntry(entry);
+        const key = `${row.kind}:${foldWriteProtectCase(row.name)}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        out.push(row);
+    }
+    return freezeTable(out);
+}
+export function compileWriteProtection(entries) {
+    const rows = resolveWriteProtectedTable(entries);
+    if (rows.length === 0)
+        return undefined;
+    const basenames = new Map();
+    const segments = new Map();
+    const runs = [];
+    for (const row of rows) {
+        const folded = foldWriteProtectCase(row.name);
+        if (row.kind === "basename") {
+            if (!basenames.has(folded))
+                basenames.set(folded, row.name);
+        }
+        else if (row.kind === "segment") {
+            if (!segments.has(folded))
+                segments.set(folded, row.name);
+        }
+        else {
+            runs.push({ name: row.name, parts: folded.split("/").filter((s) => s.length > 0) });
+        }
+    }
+    return {
+        rows,
+        matchPath(path) {
+            const viewOf = (win32) => {
+                const segs = [];
+                for (const raw of path.split(/[\\/]/)) {
+                    if (raw.length === 0)
+                        continue;
+                    const dot = !win32 || /^\.{1,2}$/.test(raw) ? raw : raw.replace(/ +$/, "");
+                    if (dot === ".")
+                        continue;
+                    if (dot === "..") {
+                        const last = segs[segs.length - 1];
+                        if (segs.length > 0 && last !== "..")
+                            segs.pop();
+                        else
+                            segs.push("..");
+                        continue;
+                    }
+                    const stripped = win32 ? raw.replace(/[. ]+$/, "") : raw;
+                    segs.push(foldWriteProtectCase(stripped.length > 0 ? stripped : raw));
+                }
+                return segs;
+            };
+            const judge = (segs) => {
+                if (segs.length === 0)
+                    return null;
+                const base = basenames.get(segs[segs.length - 1] ?? "");
+                if (base !== undefined)
+                    return { name: base, kind: "basename" };
+                for (const s of segs) {
+                    const hit = segments.get(s);
+                    if (hit !== undefined)
+                        return { name: hit, kind: "segment" };
+                }
+                for (const run of runs) {
+                    const n = run.parts.length;
+                    for (let i = 0; i + n <= segs.length; i++) {
+                        if (run.parts.every((p, j) => segs[i + j] === p))
+                            return { name: run.name, kind: "segment-run" };
+                    }
+                }
+                return null;
+            };
+            const posix = viewOf(false);
+            return judge(posix) ?? judge(viewOf(true));
+        },
+    };
+}
+export function createWriteProtectionCheck(entries) {
+    const matcher = compileWriteProtection(entries);
+    if (matcher === undefined)
+        return undefined;
+    return (toolName, args) => {
+        if (!PATH_CONFINABLE_WRITE_TOOLS.has(toolName))
+            return null;
+        const path = writeTargetPath(toolName, args);
+        if (typeof path !== "string" || path.length === 0)
+            return null;
+        return matcher.matchPath(path);
+    };
+}

package/dist/index.d.ts

@@ -91,6 +91,7 @@ export { classifyCompoundReadonlyDetailed, formatOutOfRootReadApprovalOption, ty
 export { resolveBashTimeoutCaps } from "./tools/fs/index.js";
 export { READ_FACE_DEFAULT_DENY_ENTRIES, READ_FACE_BUILTIN_DENY_TABLE, READ_DENY_BUILTIN_TIERS, READ_DENY_DEFAULT_TIERS, resolveReadDenyBuiltins, compileReadDeny, type ReadDenyEntry, type ReadDenyMatcher, type NormalizedReadDenyEntry, type ReadDenyBuiltinTier, type ReadDenyBuiltinRow, type ReadDenyBuiltinConfig, } from "./tools/fs/index.js";
 export { deploymentReadFaceClampNotice, resolveReadFace, type ReadFace, type ReadFaceInputs } from "./tools/fs/index.js";
+export { WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable, compileWriteProtection, type WriteProtectedEntry, type WriteProtectedRow, type WriteProtectedKind, type WriteProtectedHit, type WriteProtectionMatcher, } from "./core/write-protect.js";
 export { InMemoryToolResultStore, OFFLOAD_TOOL_NAME, DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, assertSafeToolResultRef, buildToolResultRef, toolResultContentSegment, MAX_MINTED_TOOL_RESULT_REF_CHARS, type ToolResultProvenance, assertToolResultProvenanceMatch, normalizeToolResultProvenance, toolResultProvenanceOf, ToolResultRefConflictError, TOOL_RESULT_REF_CONFLICT_CODE, type ToolResultStore, type ToolResultSlice, type ToolResultDeletionReport, } from "./core/tool-result-store.js";
 export { InMemoryCheckpointStore, CheckpointError, mintCheckpointToken, checkpointVersionOf, CURRENT_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, ORG_ADMISSION_CHECKPOINT_VERSION, F012_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, debitLedger, remainingBudgetMicroUsd, remainingTokens, winnerFromOutcome, validatePendingSteer, readPendingSteerQueue, appendPendingSteer, MAX_PENDING_STEER_CHARS, MAX_PENDING_STEER_ENTRIES, PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES, PENDING_STEER_FROZEN_FIELDS, ACTOR_ASSERTION_FROZEN_FIELDS, MAX_ACTOR_FIELD_CHARS, MAX_STEER_INPUT_ID_CHARS, LEGACY_PENDING_STEER_INPUT_ID, type ActorAssertion, type PendingSteerEntry, type PendingSteerInput, riskSeverity, buildRiskDescriptor, summarizeCheckpoint, type RiskDescriptor, type ProbeCause, type ProbeCauseOperands, type CheckpointStore, type CheckpointSummary, type Checkpoint, type CheckpointToken, type CheckpointGate, type CheckpointState, type SerializedCheckpointState, type CheckpointFaultMode, type PendingAction, type ResumeOutcome, type ResolvedOutcome, type ReopenReason, type ResolveExpectation, type SafetyAxis, type RealApprovalGateBit, type ResourceLedger, type ResourceLimitReason, type PlatformLimitReason, } from "./core/checkpoint-store.js";
 export { InMemoryUsageWindowStore, GLOBAL_USAGE_KEY, EMPTY_USAGE_WINDOW_RECORD, chargeUsageRecord, readUsageRecord, usageRetryAfterMs, resolveUsageWindows, type UsageWindow, type UsageWindowStore, type UsageWindowReading, type UsageWindowRecord, type UsageSlot, type UsageBucketRow, } from "./core/usage-window-store.js";
@@ -114,7 +115,7 @@ export { type StoreDurability } from "./core/checkpoint-store.js";
 export { type StoreFidelity } from "./core/checkpoint-store.js";
 export { projectHumanInput, buildHumanInputEvent, type HumanInputSource, type HumanInputFrame, type HumanInputEvent, type HumanInputDelivery, } from "./core/human-input-projection.js";
 export { TaskRegistry, defaultTaskRegistry, createTaskOutputTool, createTaskStopTool, type SemaTaskType, type SemaTaskStatus, type SemaTaskHandle, type ParkedClaimTicket, type TaskAccess, type UnifiedTaskOutput, type TaskRetrievalStatus, type StopSource, type RegisterMonitorInput, type MonitorTimers, MONITOR_BATCH_WINDOW_MS, MONITOR_DEFAULT_TIMEOUT_MS, MONITOR_MAX_TIMEOUT_MS, MONITOR_MAX_BATCHES_PER_MINUTE, canAccessWorkflowRun, DURABLE_AGENT_HANDLE_RE, } from "./core/task-registry.js";
-export { InMemoryMailboxStore, type MailboxStore, type MailboxMessage, type MailboxLease } from "./core/mailbox-store.js";
+export { InMemoryMailboxStore, type MailboxStore, type MailboxMessage, type MailboxLease, MailboxStoreError, MAILBOX_TOMBSTONED_RECIPIENT_CODE, } from "./core/mailbox-store.js";
 export { FileMailboxStore, type FileMailboxStoreOptions } from "./stores/file/mailbox-store.js";
 export { createFileTaskListStore } from "./stores/file/task-list-store.js";
 export { createCcFileTaskListStore } from "./stores/cc/task-list-store.js";
@@ -165,7 +166,7 @@ export { AdoptionError, assertAdoptionBootGate, readRootAdoptionFile, writeRootA
 export { adoptLocalDataRoot, ackAdoptionConfig, witnessAdoptionConfig, listAdoptionQuarantine, readAdoptionStatus, type AdoptionStatus, type AdoptLocalDataRootOptions, type AdoptLocalDataRootResult, type AdoptionCarriageLeg, type AdoptionCarriageLegContext, type AdoptionConfigWitnessReceipt, } from "./stores/file/adoption/adopt.js";
 export { formatHookFeedback, runToolGate, createHookEnvCapabilities, createPreToolUseConstraintPolicy, type PersistedRuleHit, type PersistedRuleUnreadable, type PersistedRuleAnswer, normalizePersistedRuleHit, type Hooks, type HookToolContext, type HookInvocationIdentity, type UserPromptSubmitContext, type PostToolBatchContext, type HookEnvCapabilities, type HookToolOutput, type PreToolUseResult, type PostToolUseResult, type UserPromptSubmitResult, type HookToolFailure, type PostToolUseFailureResult, type PostToolBatchCall, type PostToolBatchResult, type PreCompactContext, type PreCompactResult, type PostCompactContext, type StopFailureContext, type PermissionDeniedPayload, type PermissionDeniedSource, } from "./core/hooks.js";
 export { InMemoryMemoryStore, composeMemoryBlock, composeLayeredMemoryBlock, normalizeMemorySpec, type NormalizedMemorySpec, type MemorySpecInput, supportsConsolidation, supportsPeriodicConsolidation, firstSentence, expandLexicalTerms, lexicalSearchMatch, type Embedder, classifyPromotable, enforcePromotableWriteGate, guardedMemoryStore, MemoryGateError, detectSecret, enforceSecretWriteGate, enforceStructuredNoteSecretGate, type UtilityGate, type MemoryStore, type MemoryVectorMode, type ScoredMemory, type MemoryNoteHeader, type MemoryNoteRecord, type MemoryNoteType, type StructuredNoteInput, } from "./core/memory.js";
-export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, type MemoryBackendContractHooks, buildMemoryInstruction, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, readV2HeaderHints, type V2HeaderHints, LINEAGE_FILE, CHALLENGES_FILE, CHALLENGED_HISTORY_FILE, CHALLENGE_LEDGER_MAX_EVENTS, rebuildStrictControlPlaneLedger, type ControlPlaneRebuildReceipt, type StrictControlPlaneLedger, type ChallengeAssignment, type ChallengeEvent, type ChallengedHistoryRow, type LineagePendingTxn, type LineagePromotion, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, type MemorySearchDetails, type MemorySearchHit, type MemoryGetDetails, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, type MemoryAnnouncement, type ScanFinding, type MemoryEngineOptions, type MemoryInjection, type EntryProvenanceAccount, type TransferEvidence, type CommittedBinding, type CommittedEntrySnapshot, type CommittedScopeSnapshots, type EntryCustodyReport, erasureSelectHash, type EraseMemoryEntriesInput, type ErasureSelect, type ErasedBinding, type MemoryErasureAttestation, type MemoryBackend, type MemoryEntry, type MemoryEntryFrontmatter, type MemoryEntryHeader, type ScoredMemoryEntry, type NotePatch, type PatchReport, type MaterializedFile, type MemorySessionHandle, type HarvestReport, type HarvestRejection, type HarvestRejectionCode, type ParsedEntryFile, type ScannedEntryFile, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, type ParsedScopeKey, migrateScope, type MigrateScopeReport, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, type RemoteMemoryFile, type RemoteMemoryBaseline, type RemoteMaterialization, type RemoteHarvestResult, type InboundEntryFinding, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, type MemorySyncCursor, type MemorySyncConflict, type MemorySyncPlan, type RecallSource, syncMemoryScope, type MemorySyncTransport, type MemorySyncRequestBody, type MemorySyncResponseBody, type MemorySyncClientConflict, type SyncMemoryScopeOptions, type MemorySyncClientResult, } from "./core/memory-engine/index.js";
+export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, type MemoryBackendContractHooks, buildMemoryInstruction, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, readV2HeaderHints, type V2HeaderHints, LINEAGE_FILE, CHALLENGES_FILE, CHALLENGED_HISTORY_FILE, CHALLENGE_LEDGER_MAX_EVENTS, rebuildStrictControlPlaneLedger, type ControlPlaneRebuildReceipt, type StrictControlPlaneLedger, type ChallengeAssignment, type ChallengeEvent, type ChallengedHistoryRow, type LineagePendingTxn, type LineagePromotion, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, type MemorySearchDetails, type MemorySearchHit, type MemoryGetDetails, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, type MemoryAnnouncement, type ScanFinding, type MemoryEngineOptions, type MemoryInjection, type EntryProvenanceAccount, type TransferEvidence, type CommittedBinding, type CommittedEntrySnapshot, type CommittedScopeSnapshots, type EntryCustodyReport, erasureSelectHash, type EraseMemoryEntriesInput, type ErasureSelect, type ErasedBinding, type MemoryErasureAttestation, computeMemoryBundleHash, type MemoryExportBundle, type MemoryImportReport, type MemoryExportSnapshot, type MemoryBundleImportPlan, type BundleChallengeRow, type BundleLineageRow, type BundlePollutedSession, type MemoryBackend, type MemoryEntry, type MemoryEntryFrontmatter, type MemoryEntryHeader, type ScoredMemoryEntry, type NotePatch, type PatchReport, type MaterializedFile, type MemorySessionHandle, type HarvestReport, type HarvestRejection, type HarvestRejectionCode, type ParsedEntryFile, type ScannedEntryFile, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, type ParsedScopeKey, migrateScope, type MigrateScopeReport, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, type RemoteMemoryFile, type RemoteMemoryBaseline, type RemoteMaterialization, type RemoteHarvestResult, type InboundEntryFinding, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, type MemorySyncCursor, type MemorySyncConflict, type MemorySyncPlan, type RecallSource, syncMemoryScope, type MemorySyncTransport, type MemorySyncRequestBody, type MemorySyncResponseBody, type MemorySyncClientConflict, type SyncMemoryScopeOptions, type MemorySyncClientResult, } from "./core/memory-engine/index.js";
 export { SHARED_MEMORY_READ_CAP_BYTES, SHARED_MEMORY_LIST_PAGE_SIZE, SharedMemoryStoreError, type SharedMemoryStoreProvider, type SharedMemoryStoreReader, type SharedMemoryPagedList, type SharedMemoryStoreInfo, type SharedMemoryDocumentEntry, type SharedMemorySnapshot, type SharedMemoryRequestContext, type MemoryListDetails, type MemoryReadDetails, } from "./core/shared-memory/types.js";
 export { sharedMemoryStoreContract, type SharedMemoryFixture, type SharedMemoryStoreContractHooks, } from "./core/shared-memory/contract.js";
 export { termSet, jaccardDistance, cosineDistance } from "./core/memory-vector.js";
@@ -217,7 +218,7 @@ export { sessionRepoContract } from "./core/store-contracts/session-repo-contrac
 export { toolResultStoreContract } from "./core/store-contracts/tool-result-store-contract.js";
 export { fileSnapshotStoreContract } from "./core/store-contracts/file-snapshot-store-contract.js";
 export { permissionRuleSyncContract, type PermissionRuleSyncContractHooks } from "./core/store-contracts/permission-rule-sync-contract.js";
-export { MAILBOX_CONTRACT_SCOPE, mailboxStoreContract, mailboxAckOwnershipContract, mailboxBundledOnlyContract, } from "./core/store-contracts/mailbox-store-contract.js";
+export { MAILBOX_CONTRACT_SCOPE, mailboxStoreContract, mailboxAckOwnershipContract, mailboxBundledOnlyContract, mailboxTombstonedRecipientContract, type MailboxTombstonedRecipientContractHooks, } from "./core/store-contracts/mailbox-store-contract.js";
 export { BACKGROUND_AGENT_CONTRACT_SCOPE, backgroundAgentStoreContract, backgroundAgentStoreScopesContract, } from "./core/store-contracts/background-agent-store-contract.js";
 export { type BackgroundAgentStore, type BackgroundAgentRecord, type BackgroundAgentRowSummary, type BackgroundAgentUsage, canAccessAgentRecord, STALE_RUNNING_REAP_ATTRIBUTION, BackgroundAgentStoreError, InMemoryBackgroundAgentStore, reconcileParkedAgents, queryBackgroundAgents, type BackgroundAgentQuery, } from "./core/background-agent-store.js";
 export { serveDurableAgentRowLane, buildAgentPollDetails, type AgentPollDetailsInput, } from "./core/task-registry-agent.js";