@sema-agent/core 5.39.0 → 5.40.0

package/dist/tools/fs/safety.d.ts

@@ -344,7 +344,7 @@ export declare function withinAnyRoot(rootsCanonical: readonly string[], p: stri
  * just let the model discover it by trial), but it is a statement, not a recommendation, and it
  * comes last. Every shell call still passes the deployment's approval policy.
  */
-export declare const PATH_NOT_IN_ROOT_ESCAPE_HINT = "(This boundary applies to the structured file tools. If you genuinely need content outside the allowed root(s), ask for the directory to be added to the deployment's additionalDirectories \u2014 or additionalReadDirectories for read-only access. For completeness: the Bash tool is not confined by this fence, and every Bash call remains subject to the deployment's approval policy.)";
+export declare const PATH_NOT_IN_ROOT_ESCAPE_HINT = "(This boundary applies to the structured file tools. If you genuinely need content outside the allowed root(s), ask for the directory to be added to the deployment's additionalDirectories \u2014 or additionalReadDirectories for read-only access; a deployment that wants reads open everywhere can declare readFace: \"open\" instead of listing directories. For completeness: the Bash tool is not confined by this fence, and every Bash call remains subject to the deployment's approval policy.)";
 /** inv 1 (read-before-edit): a file must have been read this task before it can be edited/overwritten.
  *  Message is CC 2.1.198 live-verbatim (all-tools-live-probe 2026-07-08 §2.1/§3.1/§5.1 — one message for
  *  Edit/Write/NotebookEdit: "before writing to it", not the old sema "before editing").

package/dist/tools/fs/safety.js

@@ -493,7 +493,7 @@ export function violationDetails(v) {
 export function withinAnyRoot(rootsCanonical, p) {
     return rootsCanonical.some((r) => within(r, p));
 }
-export const PATH_NOT_IN_ROOT_ESCAPE_HINT = "(This boundary applies to the structured file tools. If you genuinely need content outside the allowed root(s), ask for the directory to be added to the deployment's additionalDirectories — or additionalReadDirectories for read-only access. For completeness: the Bash tool is not confined by this fence, and every Bash call remains subject to the deployment's approval policy.)";
+export const PATH_NOT_IN_ROOT_ESCAPE_HINT = "(This boundary applies to the structured file tools. If you genuinely need content outside the allowed root(s), ask for the directory to be added to the deployment's additionalDirectories — or additionalReadDirectories for read-only access; a deployment that wants reads open everywhere can declare readFace: \"open\" instead of listing directories. For completeness: the Bash tool is not confined by this fence, and every Bash call remains subject to the deployment's approval policy.)";
 export function requireRead(state, key) {
     const entry = state.get(key);
     if (entry === undefined || entry.isPartialView) {

package/dist/tools/fs/search.d.ts

@@ -208,6 +208,39 @@ export interface GrepRunResult {
      *  withheld / no deny judge in play. */
     withheld?: ReadDenyWithheld;
 }
+/**
+ * backlog #303 (rescan-hardened form) — the rg leg's deny TRIPWIRE. rg's exclusion globs are spelled
+ * from the pattern text and cannot express the win32 component-alias family (`.aws.` / `.aws ` —
+ * trailing dots/spaces the win32 namespace strips), so a directory planted under an alias spelling
+ * slips past the globs while the shared `matchPath` (two-view, read-deny.ts) correctly names it —
+ * the JS leg pruned it, the rg leg returned its contents, and the same tree answered differently
+ * depending on whether ripgrep was installed.
+ *
+ * The first fix FILTERED rg's text output line-by-line. The rescan killed that shape twice over:
+ * ripgrep prints filenames verbatim, so a path component containing a NEWLINE splits one record
+ * across physical lines whose fragments carry no `:line:` boundary — the filter kept them and the
+ * deny-listed content passed (a protection hole, not a precision residual); and pruning every line
+ * of a partial run fabricated a `No matches.` row inside the structured card. Text-splitting rg
+ * records is unsalvageable without structured output (`--json`, backlog #306), so this function no
+ * longer edits anything: it JUDGES. Any deny hit — or any line the format cannot account for —
+ * trips, and the caller abandons the rg run for the JS scanner, whose walk prunes with the
+ * authoritative judge and needs no path parsing at all. rg stays the fast path for the common case
+ * (no guarded entries in the result); the moment a guarded spelling is involved, the engine that
+ * cannot mis-parse it owns the answer.
+ *
+ * Trip conditions by mode — `files_with_matches`: every line IS a path, judged whole; `count`:
+ * `path:N` (a line without the numeric tail is a split record — ambiguous, trip); `content`:
+ * judged at EVERY `:digits:` boundary and every `-digits-` boundary (a candidate cut inside match
+ * text can over-trip — safe: the fallback re-derives the exact answer), and a non-separator line
+ * with NO boundary at all is a split record — trip. `--` separators and empty lines pass.
+ */
+export declare function rgOutputDenyTripwire(stdout: string, mode: "content" | "files_with_matches" | "count", judge: Pick<ReadDenyJudge, "matchPath">): {
+    trip: false;
+} | {
+    trip: true;
+    reason: "deny-hit" | "ambiguous-record";
+    pattern?: string;
+};
 /** ripgrep grep: build flags from params, run, normalize to the same output as {@link jsGrep}.
  *  Result-fidelity contract: output ripgrep DID produce is never silently replaced by a fallback
  *  rescan — partial results ship with a caveat; only a zero-output failure degrades to

package/dist/tools/fs/search.js

@@ -1043,6 +1043,63 @@ function formatRgStdout(stdout, p, caveat = "") {
         (off > 0 ? `\n[offset ${off}]` : "") +
         caveat);
 }
+export function rgOutputDenyTripwire(stdout, mode, judge) {
+    if (stdout.length === 0)
+        return { trip: false };
+    const judgeBoundaries = (line, boundary) => {
+        let sawBoundary = false;
+        for (let m = boundary.exec(line); m !== null; m = boundary.exec(line)) {
+            sawBoundary = true;
+            const prefix = line.slice(0, m.index);
+            if (prefix.length === 0)
+                continue;
+            const hit = judge.matchPath(prefix);
+            if (hit !== null)
+                return hit.pattern;
+        }
+        return sawBoundary ? null : "";
+    };
+    for (const line of stdout.split("\n")) {
+        if (line.length === 0 || line === "--")
+            continue;
+        if (mode === "files_with_matches") {
+            const h = judge.matchPath(line);
+            if (h !== null)
+                return { trip: true, reason: "deny-hit", pattern: h.pattern };
+        }
+        else if (mode === "count") {
+            const m = /^(.*):\d+$/.exec(line);
+            if (m === null)
+                return { trip: true, reason: "ambiguous-record" };
+            const h = judge.matchPath(m[1]);
+            if (h !== null)
+                return { trip: true, reason: "deny-hit", pattern: h.pattern };
+        }
+        else {
+            const colon = judgeBoundaries(line, /:\d+:/g);
+            if (colon !== null && colon !== "")
+                return { trip: true, reason: "deny-hit", pattern: colon };
+            const dash = judgeBoundaries(line, /-\d+-/g);
+            if (dash !== null && dash !== "")
+                return { trip: true, reason: "deny-hit", pattern: dash };
+            if (colon === "" && dash === "")
+                return { trip: true, reason: "ambiguous-record" };
+        }
+    }
+    return { trip: false };
+}
+async function jsGrepDenyTripFallback(env, root, p, signal, trip, deny) {
+    const denyOut = {};
+    const text = await jsGrep(env, root, p, signal, undefined, deny, denyOut);
+    const why = trip.reason === "deny-hit" ? "its output involved sensitive-path deny-listed entries the exclusion globs cannot express" : "its output contained a record the line format cannot account for";
+    return {
+        text: text.startsWith("Error (grep)")
+            ? text
+            : `${text}\n[note: the ripgrep pass was abandoned (${why}); results are from the fallback scanner, which prunes with the authoritative deny judge]`,
+        degraded: { fallback: "js-scan", reason: `ripgrep output tripped the deny tripwire (${trip.reason})` },
+        ...(denyOut.withheld !== undefined ? { withheld: denyOut.withheld } : {}),
+    };
+}
 async function jsGrepFallback(env, root, p, signal, reason, deny) {
     const denyOut = {};
     const text = await jsGrep(env, root, p, signal, undefined, deny, denyOut);
@@ -1097,6 +1154,11 @@ export async function rgGrepDetailed(env, root, p, signal, deny) {
         if (err.code === "timeout") {
             const partial = err.partialStdout ?? "";
             if (partial.trim().length > 0) {
+                if (deny !== undefined) {
+                    const trip = rgOutputDenyTripwire(partial, mode, deny);
+                    if (trip.trip)
+                        return jsGrepDenyTripFallback(env, root, p, signal, trip, deny);
+                }
                 return {
                     text: `${delimitUntrusted("ripgrep partial output", formatRgStdout(partial, p))}\n…[ripgrep timed out after producing partial output — results may be incomplete]`,
                     degraded: { partial: true, reason: "ripgrep timed out" },
@@ -1124,6 +1186,11 @@ export async function rgGrepDetailed(env, root, p, signal, deny) {
     }
     if (exitCode >= 2) {
         if (stdout.trim().length > 0) {
+            if (deny !== undefined) {
+                const trip = rgOutputDenyTripwire(stdout, mode, deny);
+                if (trip.trip)
+                    return jsGrepDenyTripFallback(env, root, p, signal, trip, deny);
+            }
             return {
                 text: `${delimitUntrusted("ripgrep partial output", formatRgStdout(stdout, p))}\n…[ripgrep exited with an error after producing partial output — results may be incomplete]`,
                 degraded: { partial: true, reason: `ripgrep exited with code ${exitCode}` },
@@ -1131,6 +1198,11 @@ export async function rgGrepDetailed(env, root, p, signal, deny) {
         }
         return jsGrepFallback(env, root, p, signal, `exited with code ${exitCode} and produced no output`, deny);
     }
+    if (deny !== undefined) {
+        const trip = rgOutputDenyTripwire(stdout, mode, deny);
+        if (trip.trip)
+            return jsGrepDenyTripFallback(env, root, p, signal, trip, deny);
+    }
     const orderedStdout = mode === "files_with_matches" ? await sortRgFilesByMtime(env, root, stdout, signal) : stdout;
     const d = await denyDisclosure();
     return { text: formatRgStdout(orderedStdout, p) + d.note, ...(d.withheld !== undefined ? { withheld: d.withheld } : {}) };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "5.39.0",
+  "version": "5.40.0",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",

package/test/export-surface.snapshot.json

@@ -1,6 +1,6 @@
 {
   "_comment": "design/87 L3 — frozen public export surface of src/index.ts (name -> kind). DO NOT edit by hand to silence a red test. A removed/changed entry = a SemVer-BREAKING change; bump MAJOR and update this fixture in the SAME commit (design/87 §4.2 / §5.2). Regenerate via REGEN in test/export-surface.test.ts.",
-  "count": 1597,
+  "count": 1605,
   "exports": {
     "A2ATaskState": "type",
     "A2ATaskStateReversal": "type",
@@ -119,6 +119,9 @@
     "BudgetAxis": "type",
     "BuildAutoModePromptOptions": "interface",
     "BuiltinWorkflowDefinition": "interface",
+    "BundleChallengeRow": "interface",
+    "BundleLineageRow": "interface",
+    "BundlePollutedSession": "interface",
     "CC_MODEL_TIER_ALIASES": "variable",
     "CHALLENGED_HISTORY_FILE": "variable",
     "CHALLENGES_FILE": "variable",
@@ -467,14 +470,18 @@
     "MemoryAnnouncement": "interface",
     "MemoryBackend": "interface",
     "MemoryBackendContractHooks": "interface",
+    "MemoryBundleImportPlan": "interface",
     "MemoryEngine": "class",
     "MemoryEngineOptions": "interface",
     "MemoryEntry": "interface",
     "MemoryEntryFrontmatter": "interface",
     "MemoryEntryHeader": "interface",
     "MemoryErasureAttestation": "interface",
+    "MemoryExportBundle": "interface",
+    "MemoryExportSnapshot": "interface",
     "MemoryGateError": "class",
     "MemoryGetDetails": "interface",
+    "MemoryImportReport": "interface",
     "MemoryInjection": "interface",
     "MemoryListDetails": "type",
     "MemoryNoteHeader": "interface",
@@ -1180,6 +1187,7 @@
     "computeCatalogDigest": "function",
     "computeCostMicroUsd": "function",
     "computeEntryRev": "function",
+    "computeMemoryBundleHash": "function",
     "computeShapeDigest": "function",
     "confirmRuleApproval": "function",
     "consolidateScope": "function",