@sema-agent/core 5.38.0 → 5.40.0

package/dist/index.js

@@ -71,6 +71,7 @@ export { classifyCompoundReadonlyDetailed, formatOutOfRootReadApprovalOption, }
 export { resolveBashTimeoutCaps } from "./tools/fs/index.js";
 export { READ_FACE_DEFAULT_DENY_ENTRIES, READ_FACE_BUILTIN_DENY_TABLE, READ_DENY_BUILTIN_TIERS, READ_DENY_DEFAULT_TIERS, resolveReadDenyBuiltins, compileReadDeny, } from "./tools/fs/index.js";
 export { deploymentReadFaceClampNotice, resolveReadFace } from "./tools/fs/index.js";
+export { WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable, compileWriteProtection, } from "./core/write-protect.js";
 export { InMemoryToolResultStore, OFFLOAD_TOOL_NAME, DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, assertSafeToolResultRef, buildToolResultRef, toolResultContentSegment, MAX_MINTED_TOOL_RESULT_REF_CHARS, assertToolResultProvenanceMatch, normalizeToolResultProvenance, toolResultProvenanceOf, ToolResultRefConflictError, TOOL_RESULT_REF_CONFLICT_CODE, } from "./core/tool-result-store.js";
 export { InMemoryCheckpointStore, CheckpointError, mintCheckpointToken, checkpointVersionOf, CURRENT_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, ORG_ADMISSION_CHECKPOINT_VERSION, F012_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, debitLedger, remainingBudgetMicroUsd, remainingTokens, winnerFromOutcome, validatePendingSteer, readPendingSteerQueue, appendPendingSteer, MAX_PENDING_STEER_CHARS, MAX_PENDING_STEER_ENTRIES, PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES, PENDING_STEER_FROZEN_FIELDS, ACTOR_ASSERTION_FROZEN_FIELDS, MAX_ACTOR_FIELD_CHARS, MAX_STEER_INPUT_ID_CHARS, LEGACY_PENDING_STEER_INPUT_ID, riskSeverity, buildRiskDescriptor, summarizeCheckpoint, } from "./core/checkpoint-store.js";
 export { InMemoryUsageWindowStore, GLOBAL_USAGE_KEY, EMPTY_USAGE_WINDOW_RECORD, chargeUsageRecord, readUsageRecord, usageRetryAfterMs, resolveUsageWindows, } from "./core/usage-window-store.js";
@@ -93,7 +94,7 @@ export {} from "./core/checkpoint-store.js";
 export {} from "./core/checkpoint-store.js";
 export { projectHumanInput, buildHumanInputEvent, } from "./core/human-input-projection.js";
 export { TaskRegistry, defaultTaskRegistry, createTaskOutputTool, createTaskStopTool, MONITOR_BATCH_WINDOW_MS, MONITOR_DEFAULT_TIMEOUT_MS, MONITOR_MAX_TIMEOUT_MS, MONITOR_MAX_BATCHES_PER_MINUTE, canAccessWorkflowRun, DURABLE_AGENT_HANDLE_RE, } from "./core/task-registry.js";
-export { InMemoryMailboxStore } from "./core/mailbox-store.js";
+export { InMemoryMailboxStore, MailboxStoreError, MAILBOX_TOMBSTONED_RECIPIENT_CODE, } from "./core/mailbox-store.js";
 export { FileMailboxStore } from "./stores/file/mailbox-store.js";
 export { createFileTaskListStore } from "./stores/file/task-list-store.js";
 export { createCcFileTaskListStore } from "./stores/cc/task-list-store.js";
@@ -127,7 +128,7 @@ export { AdoptionError, assertAdoptionBootGate, readRootAdoptionFile, writeRootA
 export { adoptLocalDataRoot, ackAdoptionConfig, witnessAdoptionConfig, listAdoptionQuarantine, readAdoptionStatus, } from "./stores/file/adoption/adopt.js";
 export { formatHookFeedback, runToolGate, createHookEnvCapabilities, createPreToolUseConstraintPolicy, normalizePersistedRuleHit, } from "./core/hooks.js";
 export { InMemoryMemoryStore, composeMemoryBlock, composeLayeredMemoryBlock, normalizeMemorySpec, supportsConsolidation, supportsPeriodicConsolidation, firstSentence, expandLexicalTerms, lexicalSearchMatch, classifyPromotable, enforcePromotableWriteGate, guardedMemoryStore, MemoryGateError, detectSecret, enforceSecretWriteGate, enforceStructuredNoteSecretGate, } from "./core/memory.js";
-export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, buildMemoryInstruction, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, readV2HeaderHints, LINEAGE_FILE, CHALLENGES_FILE, CHALLENGED_HISTORY_FILE, CHALLENGE_LEDGER_MAX_EVENTS, rebuildStrictControlPlaneLedger, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, erasureSelectHash, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, migrateScope, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, syncMemoryScope, } from "./core/memory-engine/index.js";
+export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, buildMemoryInstruction, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, readV2HeaderHints, LINEAGE_FILE, CHALLENGES_FILE, CHALLENGED_HISTORY_FILE, CHALLENGE_LEDGER_MAX_EVENTS, rebuildStrictControlPlaneLedger, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, erasureSelectHash, computeMemoryBundleHash, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, migrateScope, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, syncMemoryScope, } from "./core/memory-engine/index.js";
 export { SHARED_MEMORY_READ_CAP_BYTES, SHARED_MEMORY_LIST_PAGE_SIZE, SharedMemoryStoreError, } from "./core/shared-memory/types.js";
 export { sharedMemoryStoreContract, } from "./core/shared-memory/contract.js";
 export { termSet, jaccardDistance, cosineDistance } from "./core/memory-vector.js";
@@ -178,7 +179,7 @@ export { sessionRepoContract } from "./core/store-contracts/session-repo-contrac
 export { toolResultStoreContract } from "./core/store-contracts/tool-result-store-contract.js";
 export { fileSnapshotStoreContract } from "./core/store-contracts/file-snapshot-store-contract.js";
 export { permissionRuleSyncContract } from "./core/store-contracts/permission-rule-sync-contract.js";
-export { MAILBOX_CONTRACT_SCOPE, mailboxStoreContract, mailboxAckOwnershipContract, mailboxBundledOnlyContract, } from "./core/store-contracts/mailbox-store-contract.js";
+export { MAILBOX_CONTRACT_SCOPE, mailboxStoreContract, mailboxAckOwnershipContract, mailboxBundledOnlyContract, mailboxTombstonedRecipientContract, } from "./core/store-contracts/mailbox-store-contract.js";
 export { BACKGROUND_AGENT_CONTRACT_SCOPE, backgroundAgentStoreContract, backgroundAgentStoreScopesContract, } from "./core/store-contracts/background-agent-store-contract.js";
 export { canAccessAgentRecord, STALE_RUNNING_REAP_ATTRIBUTION, BackgroundAgentStoreError, InMemoryBackgroundAgentStore, reconcileParkedAgents, queryBackgroundAgents, } from "./core/background-agent-store.js";
 export { serveDurableAgentRowLane, buildAgentPollDetails, } from "./core/task-registry-agent.js";

package/dist/orchestration/governance-baseline-validity.d.ts

@@ -0,0 +1,44 @@
+/**
+ * design/98 §6.3 — the ONE reading of "is this governance baseline usable", shared by the deployment
+ * CAPABILITY predicate (`workflowsCapability`, which drives the surfaced `/workflows` affordance AND
+ * the orchestration-prompt injection) and the MOUNT-time validator (`createRunWorkflowTool`, which
+ * refuses loudly with a code).
+ *
+ * Why one function rather than two agreeing predicates: this seam split three times inside one
+ * release window, each time one level deeper. First the capability tested `!== undefined` while the
+ * mount tested truthiness (a JSON `null` announced workflows the tool never mounted). Then both
+ * tested the container while the mount refused an unusable `base` SLOT (`{ base: null }` announced
+ * workflows that hard-failed every opted-in task). Then the slot readings agreed but the mount
+ * additionally refused a malformed `worktreeBase` and malformed face lists — the same split again,
+ * one field further in. Two predicates that must "stay in agreement" are a standing invitation to
+ * drift; the only shape that cannot drift is a single function both call.
+ *
+ * The contract: {@link governanceBaselineProblem} returns `null` when the mount would SUCCEED, and
+ * a describable problem when the mount would REFUSE. Every mount-time refusal must be reachable
+ * from here, so a deployment is never told it has workflows it cannot actually run.
+ */
+export interface GovernanceBaselineProblem {
+    /** Which slot/field is wrong, in the spelling a deployment configures (`base.excludeTools`). */
+    readonly where: string;
+    /** What was found there, for the operator-facing message (`null`, `a string`, `an array`). */
+    readonly found: string;
+    /** The coded refusal the mount raises for this problem. */
+    readonly code: "config.invalid_governance_baseline" | "config.invalid_tool_name_set";
+}
+/** Name a bad value WITHOUT throwing on it (a bigint / cyclic object / poisoned `toJSON` must not
+ *  crash the describer and cost the refusal its name). */
+export declare function describeBaselineValue(v: unknown): string;
+/**
+ * The single validity reading. `null` ⇒ the mount would succeed ⇒ the capability may be announced.
+ *
+ * `base` is the control plane every script-spawned child inherits, so a non-object there refuses:
+ * ungoverned is spelled by not configuring `workflowGovernanceBaseline` at all, never by an
+ * unusable anchor. `worktreeBase` is the optional overlay whose documented absence means "base
+ * governs every child" — `null`/absent is that absence, any other non-object is garbage and refuses
+ * rather than impersonating either absence or an overlay.
+ */
+export declare function governanceBaselineProblem(baseline: unknown): GovernanceBaselineProblem | null;
+/** The mount's refusal, minted from the shared reading so the message and the code have one home. */
+export declare function governanceBaselineError(p: GovernanceBaselineProblem): Error & {
+    code: string;
+};

package/dist/orchestration/governance-baseline-validity.js

@@ -0,0 +1,55 @@
+const FACE_LIST_FIELDS = ["excludeTools", "deferTools", "alwaysLoadTools"];
+export function describeBaselineValue(v) {
+    return v === null ? "null" : Array.isArray(v) ? "an array" : `a ${typeof v}`;
+}
+function isSpecObject(v) {
+    return v !== null && v !== undefined && typeof v === "object" && !Array.isArray(v);
+}
+function faceListProblem(slot, where) {
+    for (const field of FACE_LIST_FIELDS) {
+        const v = slot[field];
+        if (v === undefined || v === null)
+            continue;
+        if (!Array.isArray(v)) {
+            return { where: `${where}.${field}`, found: describeBaselineValue(v), code: "config.invalid_tool_name_set" };
+        }
+        for (const [i, entry] of v.entries()) {
+            if (typeof entry !== "string") {
+                return {
+                    where: `${where}.${field}`,
+                    found: `entry ${i} is ${describeBaselineValue(entry)}`,
+                    code: "config.invalid_tool_name_set",
+                };
+            }
+        }
+    }
+    return null;
+}
+export function governanceBaselineProblem(baseline) {
+    if (!isSpecObject(baseline)) {
+        return { where: "workflowGovernanceBaseline", found: describeBaselineValue(baseline), code: "config.invalid_governance_baseline" };
+    }
+    const base = baseline.base;
+    if (!isSpecObject(base)) {
+        return { where: "base", found: describeBaselineValue(base), code: "config.invalid_governance_baseline" };
+    }
+    const baseFaces = faceListProblem(base, "base");
+    if (baseFaces !== null)
+        return baseFaces;
+    const wt = baseline.worktreeBase;
+    if (wt === null || wt === undefined)
+        return null;
+    if (!isSpecObject(wt)) {
+        return { where: "worktreeBase", found: describeBaselineValue(wt), code: "config.invalid_governance_baseline" };
+    }
+    return faceListProblem(wt, "worktreeBase");
+}
+export function governanceBaselineError(p) {
+    const detail = p.code === "config.invalid_tool_name_set"
+        ? `must be an array of tool names (got ${p.found}) — refusing to mount rather than govern children with a roster nobody can read.`
+        : `is ${p.found}, not a spec object — refusing to mount rather than launch children under no governance ` +
+            `(to run ungoverned, leave workflowGovernanceBaseline unconfigured).`;
+    const e = new Error(`createRunWorkflowTool: the workflow governance baseline's ${p.where} ${detail}`);
+    e.code = p.code;
+    return e;
+}

package/dist/orchestration/run-workflow-tool.js

@@ -1,5 +1,6 @@
 import { Type } from "typebox";
 import { defineTool, errorResult } from "../core/tools.js";
+import { governanceBaselineError, governanceBaselineProblem } from "./governance-baseline-validity.js";
 import { redactSecrets, redactHostLeaks, boundedRedactedSummary } from "../core/untrusted-egress.js";
 import { startWorkflow } from "./workflow.js";
 import { buildWorkflowPrimitives } from "./workflow-primitives.js";
@@ -167,16 +168,40 @@ export async function createRunWorkflowTool(d) {
         childMaxTokens: lim.childMaxTokens,
         childMaxTurns: lim.childMaxTurns,
     };
+    const problem = governanceBaselineProblem(d.governanceBaseline);
+    if (problem !== null)
+        throw governanceBaselineError(problem);
+    const FACE_LIST_FIELDS = ["excludeTools", "deferTools", "alwaysLoadTools"];
+    const dropNullFaces = (slot) => {
+        let out = slot;
+        for (const field of FACE_LIST_FIELDS) {
+            if (slot[field] !== null)
+                continue;
+            out = { ...out };
+            delete out[field];
+        }
+        return out;
+    };
+    const sanitizedBaseline = (() => {
+        const wt = d.governanceBaseline.worktreeBase;
+        const { worktreeBase: _absentOverlay, ...rest } = d.governanceBaseline;
+        return {
+            ...rest,
+            base: dropNullFaces(d.governanceBaseline.base),
+            ...(wt === null || wt === undefined ? {} : { worktreeBase: dropNullFaces(wt) }),
+        };
+    })();
+    const unionFaceList = (own, parent) => own === undefined ? [...new Set(parent)] : [...new Set([...own, ...parent])];
     const withParentFace = (base, inherit) => ({
         ...base,
         ...(d.parentExcludeTools?.length
-            ? { excludeTools: [...new Set([...(base.excludeTools ?? inherit?.excludeTools ?? []), ...d.parentExcludeTools])] }
+            ? { excludeTools: unionFaceList(base.excludeTools ?? inherit?.excludeTools, d.parentExcludeTools) }
             : {}),
         ...(d.parentDeferTools?.length
-            ? { deferTools: [...new Set([...(base.deferTools ?? inherit?.deferTools ?? []), ...d.parentDeferTools])] }
+            ? { deferTools: unionFaceList(base.deferTools ?? inherit?.deferTools, d.parentDeferTools) }
             : {}),
         ...(d.parentAlwaysLoadTools?.length
-            ? { alwaysLoadTools: [...new Set([...(base.alwaysLoadTools ?? inherit?.alwaysLoadTools ?? []), ...d.parentAlwaysLoadTools])] }
+            ? { alwaysLoadTools: unionFaceList(base.alwaysLoadTools ?? inherit?.alwaysLoadTools, d.parentAlwaysLoadTools) }
             : {}),
         ...(() => {
             const parent = d.parentRestoreGatedTools;
@@ -197,13 +222,13 @@ export async function createRunWorkflowTool(d) {
     const withParentProfile = (base) => d.parentPromptProfile !== undefined && base.promptProfile === undefined ? { ...base, promptProfile: d.parentPromptProfile } : base;
     const baselineWithParentFace = (d.parentExcludeTools?.length ?? 0) > 0 || (d.parentDeferTools?.length ?? 0) > 0 || (d.parentAlwaysLoadTools?.length ?? 0) > 0 || d.parentPromptProfile !== undefined || d.parentRestoreGatedTools !== undefined
         ? {
-            ...d.governanceBaseline,
-            base: withParentProfile(withParentFace(d.governanceBaseline.base)),
-            ...(d.governanceBaseline.worktreeBase !== undefined
-                ? { worktreeBase: withParentFace(d.governanceBaseline.worktreeBase, d.governanceBaseline.base) }
+            ...sanitizedBaseline,
+            base: withParentProfile(withParentFace(sanitizedBaseline.base)),
+            ...(sanitizedBaseline.worktreeBase !== undefined
+                ? { worktreeBase: withParentFace(sanitizedBaseline.worktreeBase, sanitizedBaseline.base) }
                 : {}),
         }
-        : d.governanceBaseline;
+        : sanitizedBaseline;
     const governance = { baseline: baselineWithParentFace, models: d.models, caps: childCaps, onNotice: d.onNotice };
     const builtinsEnabled = d.builtinWorkflows !== false;
     const namedWorkflowSection = renderNamedWorkflowListing(await collectNamedWorkflowListings(d.scriptStore, builtinsEnabled));

package/dist/orchestration/workflow-script-runner.js

@@ -1,9 +1,12 @@
+import { governanceBaselineProblem } from "./governance-baseline-validity.js";
 export function isSelfOrchestrationActive(spec, deps) {
     return spec.selfOrchestration === true && workflowsCapability(deps);
 }
 export function workflowsCapability(deps) {
-    return (deps.workflowScriptRunner?.safeForUntrustedScripts === true &&
-        deps.workflowGovernanceBaseline !== undefined);
+    return deps.workflowScriptRunner?.safeForUntrustedScripts === true && hasUsableGovernanceBaseline(deps);
+}
+function hasUsableGovernanceBaseline(deps) {
+    return governanceBaselineProblem(deps.workflowGovernanceBaseline) === null;
 }
 export function selfOrchestrationFailClosedReason(spec, deps) {
     if (spec.selfOrchestration !== true)
@@ -14,8 +17,10 @@ export function selfOrchestrationFailClosedReason(spec, deps) {
     if (deps.workflowScriptRunner?.safeForUntrustedScripts !== true) {
         missing.push("a hard WorkflowScriptRunner (RunnerDeps.workflowScriptRunner.safeForUntrustedScripts === true)");
     }
-    if (deps.workflowGovernanceBaseline === undefined) {
-        missing.push("a governance baseline (RunnerDeps.workflowGovernanceBaseline)");
+    const problem = governanceBaselineProblem(deps.workflowGovernanceBaseline);
+    if (problem !== null) {
+        missing.push(`a usable governance baseline (RunnerDeps.workflowGovernanceBaseline.${problem.where === "workflowGovernanceBaseline" ? "" : `${problem.where} `}` +
+            `is ${problem.found})`);
     }
     return (`self-orchestration (TaskSpec.selfOrchestration) requires ${missing.join(" and ")}; it is DISABLED for ` +
         `this task (fail-closed — the run_workflow tool is not mounted and the orchestration prompt is not injected).`);

package/dist/tools/fs/read-deny.d.ts

@@ -40,10 +40,18 @@ export interface ReadDenyMatcher {
     /** Normalized entries (built-ins first, then additions; exact duplicates folded). The disclosure /
      *  persistence face. */
     readonly entries: readonly NormalizedReadDenyEntry[];
-    /** Judge ONE path view (segment-window semantics). Returns the first matching entry, or null. */
-    matchPath(path: string): ReadDenyHit | null;
-    /** §3.3 target judgment: canonical view + lexical view; EITHER hit decides. */
-    matchTarget(canonicalKey: string, lexicalView?: string): ReadDenyHit | null;
+    /** Judge ONE path view (segment-window semantics). Returns the first matching entry, or null.
+     *  `aliasResolved` = the key's MINTER reports the real filesystem already collapsed any win32
+     *  component alias in it (canonicalizeTarget's realpath arm); unset ⇒ both readings are judged,
+     *  which is the fail-closed default. */
+    matchPath(path: string, opts?: {
+        readonly aliasResolved?: boolean;
+    }): ReadDenyHit | null;
+    /** §3.3 target judgment: canonical view + lexical view; EITHER hit decides. `aliasResolved`
+     *  applies to the CANONICAL arm only — the lexical view is an unresolved spelling. */
+    matchTarget(canonicalKey: string, lexicalView?: string, opts?: {
+        readonly aliasResolved?: boolean;
+    }): ReadDenyHit | null;
     /** Traversal exclusions for the rg legs: `!`-polarity glob pairs — `!**\/<p>` plus `!**\/<p>/…`
      *  (the entry itself and its descendants). */
     readonly rgExclusionGlobs: readonly ReadDenyRgGlob[];
@@ -145,7 +153,9 @@ export declare function compileSegmentPattern(raw: string, fold: "none" | "ascii
  * BOTH separator families — win32 canonical keys are backslash-form. Returns the matched raw pattern
  * or null.
  */
-export declare function matchSegmentPatterns(path: string, compiled: readonly CompiledSegmentPattern[]): string | null;
+export declare function matchSegmentPatterns(path: string, compiled: readonly CompiledSegmentPattern[], opts?: {
+    readonly aliasResolved?: boolean;
+}): string | null;
 /**
  * codex r3 — the PURE validation/canonicality predicate over a PERSISTED deny entry (checkpoint v9
  * face section), for the resume pre-CAS ladder: it must refuse BEFORE the approval CAS everything

package/dist/tools/fs/read-deny.js

@@ -91,15 +91,36 @@ export function compileSegmentPattern(raw, fold) {
     });
     return { raw, segments, foldAscii: fold === "ascii" };
 }
-export function matchSegmentPatterns(path, compiled) {
-    const rawSegs = path.split(/[\\/]/).filter(Boolean);
-    let loweredSegs;
+export function matchSegmentPatterns(path, compiled, opts) {
+    const literalSegs = path.split(/[\\/]/).filter(Boolean);
+    const win32Segs = [];
+    for (const raw of literalSegs) {
+        const dot = /^\.{1,2}$/.test(raw) ? raw : raw.replace(/ +$/, "");
+        if (dot === ".")
+            continue;
+        if (dot === "..") {
+            const last = win32Segs[win32Segs.length - 1];
+            if (win32Segs.length > 0 && last !== "..")
+                win32Segs.pop();
+            else
+                win32Segs.push("..");
+            continue;
+        }
+        const stripped = raw.replace(/[. ]+$/, "");
+        win32Segs.push(stripped.length > 0 ? stripped : raw);
+    }
+    const sameView = opts?.aliasResolved === true ||
+        (win32Segs.length === literalSegs.length && win32Segs.every((s, i) => s === literalSegs[i]));
+    const views = sameView ? [literalSegs] : [literalSegs, win32Segs];
+    const lowered = new Map();
     for (const pat of compiled) {
-        const segs = pat.foldAscii ? (loweredSegs ??= rawSegs.map(asciiLower)) : rawSegs;
-        const n = pat.segments.length;
-        for (let i = 0; i + n <= segs.length; i++) {
-            if (pat.segments.every((re, j) => re.test(segs[i + j] ?? "")))
-                return pat.raw;
+        for (const view of views) {
+            const segs = pat.foldAscii ? (lowered.get(view) ?? lowered.set(view, view.map(asciiLower)).get(view)) : view;
+            const n = pat.segments.length;
+            for (let i = 0; i + n <= segs.length; i++) {
+                if (pat.segments.every((re, j) => re.test(segs[i + j] ?? "")))
+                    return pat.raw;
+            }
         }
     }
     return null;
@@ -171,15 +192,15 @@ export function compileReadDeny(additions = [], layer = "additions", builtin) {
         rgExclusionGlobs.push({ flag, glob: `!**/${g}` }, { flag, glob: `!**/${g}/**` });
         rgProbeGlobs.push({ flag, glob: `**/${g}` }, { flag, glob: `**/${g}/**` });
     }
-    const matchPath = (path) => {
-        const hit = matchSegmentPatterns(path, compiled);
+    const matchPath = (path, opts) => {
+        const hit = matchSegmentPatterns(path, compiled, opts);
         return hit === null ? null : { pattern: hit };
     };
     return {
         entries: normalized,
         matchPath,
-        matchTarget(canonicalKey, lexicalView) {
-            const canonical = matchPath(canonicalKey);
+        matchTarget(canonicalKey, lexicalView, opts) {
+            const canonical = matchPath(canonicalKey, opts);
             if (canonical !== null)
                 return { ...canonical, matchedView: canonicalKey };
             if (lexicalView !== undefined) {

package/dist/tools/fs/safety.d.ts

@@ -268,7 +268,9 @@ export declare function lexicalViewOf(spelled: string, base: string): string;
  * `executionEnv` — see design/44 §5.)
  */
 export declare function resolveKey(env: ExecutionEnv, rootCanonical: string, path: string, signal?: AbortSignal, baseCwd?: string, additionalRootsCanonical?: readonly string[], exactFileReadExemption?: (canonicalKey: string) => boolean, readDeny?: {
-    matchTarget(canonicalKey: string, lexicalView?: string): {
+    matchTarget(canonicalKey: string, lexicalView?: string, opts?: {
+        readonly aliasResolved?: boolean;
+    }): {
         pattern: string;
         matchedView?: string;
     } | null;
@@ -291,6 +293,7 @@ export declare function resolveKey(env: ExecutionEnv, rootCanonical: string, pat
 export declare function canonicalizeTarget(env: ExecutionEnv, path: string, signal?: AbortSignal, baseCwd?: string): Promise<{
     ok: true;
     key: string;
+    aliasResolved?: true;
 } | {
     ok: false;
     message: string;
@@ -341,7 +344,7 @@ export declare function withinAnyRoot(rootsCanonical: readonly string[], p: stri
  * just let the model discover it by trial), but it is a statement, not a recommendation, and it
  * comes last. Every shell call still passes the deployment's approval policy.
  */
-export declare const PATH_NOT_IN_ROOT_ESCAPE_HINT = "(This boundary applies to the structured file tools. If you genuinely need content outside the allowed root(s), ask for the directory to be added to the deployment's additionalDirectories \u2014 or additionalReadDirectories for read-only access. For completeness: the Bash tool is not confined by this fence, and every Bash call remains subject to the deployment's approval policy.)";
+export declare const PATH_NOT_IN_ROOT_ESCAPE_HINT = "(This boundary applies to the structured file tools. If you genuinely need content outside the allowed root(s), ask for the directory to be added to the deployment's additionalDirectories \u2014 or additionalReadDirectories for read-only access; a deployment that wants reads open everywhere can declare readFace: \"open\" instead of listing directories. For completeness: the Bash tool is not confined by this fence, and every Bash call remains subject to the deployment's approval policy.)";
 /** inv 1 (read-before-edit): a file must have been read this task before it can be edited/overwritten.
  *  Message is CC 2.1.198 live-verbatim (all-tools-live-probe 2026-07-08 §2.1/§3.1/§5.1 — one message for
  *  Edit/Write/NotebookEdit: "before writing to it", not the old sema "before editing").

package/dist/tools/fs/safety.js

@@ -339,7 +339,9 @@ export async function resolveKey(env, rootCanonical, path, signal, baseCwd, addi
         return { ok: false, violation: { code: "invalid", message: `path "${path}" is a blocked device/special file (reading it can hang the process); refused.` } };
     }
     if (readDeny !== undefined) {
-        const hit = readDeny.matchTarget(key, lexicalViewOf(path, baseCwd ?? rootCanonical));
+        const hit = readDeny.matchTarget(key, lexicalViewOf(path, baseCwd ?? rootCanonical), {
+            aliasResolved: canon.aliasResolved === true,
+        });
         if (hit !== null) {
             const lexicalHit = hit.matchedView !== undefined && hit.matchedView !== key;
             const judged = lexicalHit
@@ -419,7 +421,7 @@ export async function canonicalizeTarget(env, path, signal, baseCwd) {
         }
         const canon = await env.canonicalPath(abs, signal);
         if (canon.ok)
-            return { ok: true, key: canon.value };
+            return { ok: true, key: canon.value, aliasResolved: true };
         const info = await env.fileInfo(abs, signal);
         if (!info.ok) {
             return { ok: false, message: `cannot determine whether "${path}" is a symlink: ${info.error.message}`, unresolvedSymlink: true };
@@ -491,7 +493,7 @@ export function violationDetails(v) {
 export function withinAnyRoot(rootsCanonical, p) {
     return rootsCanonical.some((r) => within(r, p));
 }
-export const PATH_NOT_IN_ROOT_ESCAPE_HINT = "(This boundary applies to the structured file tools. If you genuinely need content outside the allowed root(s), ask for the directory to be added to the deployment's additionalDirectories — or additionalReadDirectories for read-only access. For completeness: the Bash tool is not confined by this fence, and every Bash call remains subject to the deployment's approval policy.)";
+export const PATH_NOT_IN_ROOT_ESCAPE_HINT = "(This boundary applies to the structured file tools. If you genuinely need content outside the allowed root(s), ask for the directory to be added to the deployment's additionalDirectories — or additionalReadDirectories for read-only access; a deployment that wants reads open everywhere can declare readFace: \"open\" instead of listing directories. For completeness: the Bash tool is not confined by this fence, and every Bash call remains subject to the deployment's approval policy.)";
 export function requireRead(state, key) {
     const entry = state.get(key);
     if (entry === undefined || entry.isPartialView) {

package/dist/tools/fs/search.d.ts

@@ -208,6 +208,39 @@ export interface GrepRunResult {
      *  withheld / no deny judge in play. */
     withheld?: ReadDenyWithheld;
 }
+/**
+ * backlog #303 (rescan-hardened form) — the rg leg's deny TRIPWIRE. rg's exclusion globs are spelled
+ * from the pattern text and cannot express the win32 component-alias family (`.aws.` / `.aws ` —
+ * trailing dots/spaces the win32 namespace strips), so a directory planted under an alias spelling
+ * slips past the globs while the shared `matchPath` (two-view, read-deny.ts) correctly names it —
+ * the JS leg pruned it, the rg leg returned its contents, and the same tree answered differently
+ * depending on whether ripgrep was installed.
+ *
+ * The first fix FILTERED rg's text output line-by-line. The rescan killed that shape twice over:
+ * ripgrep prints filenames verbatim, so a path component containing a NEWLINE splits one record
+ * across physical lines whose fragments carry no `:line:` boundary — the filter kept them and the
+ * deny-listed content passed (a protection hole, not a precision residual); and pruning every line
+ * of a partial run fabricated a `No matches.` row inside the structured card. Text-splitting rg
+ * records is unsalvageable without structured output (`--json`, backlog #306), so this function no
+ * longer edits anything: it JUDGES. Any deny hit — or any line the format cannot account for —
+ * trips, and the caller abandons the rg run for the JS scanner, whose walk prunes with the
+ * authoritative judge and needs no path parsing at all. rg stays the fast path for the common case
+ * (no guarded entries in the result); the moment a guarded spelling is involved, the engine that
+ * cannot mis-parse it owns the answer.
+ *
+ * Trip conditions by mode — `files_with_matches`: every line IS a path, judged whole; `count`:
+ * `path:N` (a line without the numeric tail is a split record — ambiguous, trip); `content`:
+ * judged at EVERY `:digits:` boundary and every `-digits-` boundary (a candidate cut inside match
+ * text can over-trip — safe: the fallback re-derives the exact answer), and a non-separator line
+ * with NO boundary at all is a split record — trip. `--` separators and empty lines pass.
+ */
+export declare function rgOutputDenyTripwire(stdout: string, mode: "content" | "files_with_matches" | "count", judge: Pick<ReadDenyJudge, "matchPath">): {
+    trip: false;
+} | {
+    trip: true;
+    reason: "deny-hit" | "ambiguous-record";
+    pattern?: string;
+};
 /** ripgrep grep: build flags from params, run, normalize to the same output as {@link jsGrep}.
  *  Result-fidelity contract: output ripgrep DID produce is never silently replaced by a fallback
  *  rescan — partial results ship with a caveat; only a zero-output failure degrades to

package/dist/tools/fs/search.js

@@ -1043,6 +1043,63 @@ function formatRgStdout(stdout, p, caveat = "") {
         (off > 0 ? `\n[offset ${off}]` : "") +
         caveat);
 }
+export function rgOutputDenyTripwire(stdout, mode, judge) {
+    if (stdout.length === 0)
+        return { trip: false };
+    const judgeBoundaries = (line, boundary) => {
+        let sawBoundary = false;
+        for (let m = boundary.exec(line); m !== null; m = boundary.exec(line)) {
+            sawBoundary = true;
+            const prefix = line.slice(0, m.index);
+            if (prefix.length === 0)
+                continue;
+            const hit = judge.matchPath(prefix);
+            if (hit !== null)
+                return hit.pattern;
+        }
+        return sawBoundary ? null : "";
+    };
+    for (const line of stdout.split("\n")) {
+        if (line.length === 0 || line === "--")
+            continue;
+        if (mode === "files_with_matches") {
+            const h = judge.matchPath(line);
+            if (h !== null)
+                return { trip: true, reason: "deny-hit", pattern: h.pattern };
+        }
+        else if (mode === "count") {
+            const m = /^(.*):\d+$/.exec(line);
+            if (m === null)
+                return { trip: true, reason: "ambiguous-record" };
+            const h = judge.matchPath(m[1]);
+            if (h !== null)
+                return { trip: true, reason: "deny-hit", pattern: h.pattern };
+        }
+        else {
+            const colon = judgeBoundaries(line, /:\d+:/g);
+            if (colon !== null && colon !== "")
+                return { trip: true, reason: "deny-hit", pattern: colon };
+            const dash = judgeBoundaries(line, /-\d+-/g);
+            if (dash !== null && dash !== "")
+                return { trip: true, reason: "deny-hit", pattern: dash };
+            if (colon === "" && dash === "")
+                return { trip: true, reason: "ambiguous-record" };
+        }
+    }
+    return { trip: false };
+}
+async function jsGrepDenyTripFallback(env, root, p, signal, trip, deny) {
+    const denyOut = {};
+    const text = await jsGrep(env, root, p, signal, undefined, deny, denyOut);
+    const why = trip.reason === "deny-hit" ? "its output involved sensitive-path deny-listed entries the exclusion globs cannot express" : "its output contained a record the line format cannot account for";
+    return {
+        text: text.startsWith("Error (grep)")
+            ? text
+            : `${text}\n[note: the ripgrep pass was abandoned (${why}); results are from the fallback scanner, which prunes with the authoritative deny judge]`,
+        degraded: { fallback: "js-scan", reason: `ripgrep output tripped the deny tripwire (${trip.reason})` },
+        ...(denyOut.withheld !== undefined ? { withheld: denyOut.withheld } : {}),
+    };
+}
 async function jsGrepFallback(env, root, p, signal, reason, deny) {
     const denyOut = {};
     const text = await jsGrep(env, root, p, signal, undefined, deny, denyOut);
@@ -1097,6 +1154,11 @@ export async function rgGrepDetailed(env, root, p, signal, deny) {
         if (err.code === "timeout") {
             const partial = err.partialStdout ?? "";
             if (partial.trim().length > 0) {
+                if (deny !== undefined) {
+                    const trip = rgOutputDenyTripwire(partial, mode, deny);
+                    if (trip.trip)
+                        return jsGrepDenyTripFallback(env, root, p, signal, trip, deny);
+                }
                 return {
                     text: `${delimitUntrusted("ripgrep partial output", formatRgStdout(partial, p))}\n…[ripgrep timed out after producing partial output — results may be incomplete]`,
                     degraded: { partial: true, reason: "ripgrep timed out" },
@@ -1124,6 +1186,11 @@ export async function rgGrepDetailed(env, root, p, signal, deny) {
     }
     if (exitCode >= 2) {
         if (stdout.trim().length > 0) {
+            if (deny !== undefined) {
+                const trip = rgOutputDenyTripwire(stdout, mode, deny);
+                if (trip.trip)
+                    return jsGrepDenyTripFallback(env, root, p, signal, trip, deny);
+            }
             return {
                 text: `${delimitUntrusted("ripgrep partial output", formatRgStdout(stdout, p))}\n…[ripgrep exited with an error after producing partial output — results may be incomplete]`,
                 degraded: { partial: true, reason: `ripgrep exited with code ${exitCode}` },
@@ -1131,6 +1198,11 @@ export async function rgGrepDetailed(env, root, p, signal, deny) {
         }
         return jsGrepFallback(env, root, p, signal, `exited with code ${exitCode} and produced no output`, deny);
     }
+    if (deny !== undefined) {
+        const trip = rgOutputDenyTripwire(stdout, mode, deny);
+        if (trip.trip)
+            return jsGrepDenyTripFallback(env, root, p, signal, trip, deny);
+    }
     const orderedStdout = mode === "files_with_matches" ? await sortRgFilesByMtime(env, root, stdout, signal) : stdout;
     const d = await denyDisclosure();
     return { text: formatRgStdout(orderedStdout, p) + d.note, ...(d.withheld !== undefined ? { withheld: d.withheld } : {}) };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "5.38.0",
+  "version": "5.40.0",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",