@sema-agent/core 5.39.0 → 5.41.0

package/dist/core/types.d.ts

@@ -4669,6 +4669,13 @@ export interface EngineNotice {
      *    value IS in force the prepare refuses with the same code as `TaskResult.errorCode` (one
      *    fact, one code, two loudness dialects); `detail: { raw }`.
      *
+     *  - `"task.user_steer_undrained"` (#259) — user steers/follow-ups whose receipts said "queued"
+     *    were still in the queues at agent_end: the run ended before any turn could drain them. They
+     *    are NOT redelivered (a steer aimed at a finished run must not fire at the next one — unlike
+     *    ENGINE notes, which pend per session); the notice is the loud half of the #257 contract's
+     *    "accepted = enqueued, not consumed" sentence; `detail: { steer, followUp, taskId? }`.
+     *    Per-run, at most once (the terminal sweep is a single site).
+     *
      *  Deliberately NOT a notice family: brain retry/reconnect liveness (a rate limit, a 5xx, a
      *  transient network failure being retried). Those are per-attempt liveness frames with their own
      *  frequency semantics and ride the wire `status` channel ({@link BrainStatus}), whose sink the

package/dist/core/write-protect.d.ts

@@ -25,26 +25,6 @@ export interface WriteProtectedHit {
     readonly name: string;
     readonly kind: WriteProtectedKind;
 }
-/**
- * WRITE_PROTECTED_DEFAULT_TABLE — the default-active table (the material basis of the deployment
- * admin face: what an unconfigured deployment demotes to `ask`; visible here, deletable by
- * replacing the seat with a filtered copy). CC 2.1.233 triple VERBATIM first, then the sema rows,
- * each with its argument.
- *
- * NOT listed, deliberately (each a ruled-out candidate, recorded so the next reader does not
- * re-litigate silently):
- *  · `.env` / `.env.*` — CC's own table excludes them too (only `.envrc`, the direnv AUTO-EXECUTION
- *    vector, is in): a plain `.env` is application config and routine workspace material for the
- *    tasks this engine runs (the read deny set rules it out on the same grounds); the opt-in write
- *    DENY (`RECOMMENDED_SENSITIVE_PATTERNS`) covers deployments that want it guarded.
- *  · key-material FILE patterns (`id_rsa*`, `*.pem`, …) — they are glob-shaped, and this table
- *    speaks literals; the opt-in deny policy owns that vocabulary.
- *  · cloud credential dirs (`.aws`, `.kube`, `.azure`, `.config/gcloud`) — writing cloud config IS
- *    the routine "configure this environment" action tasks are asked to perform, so a default ask
- *    on every such write is recurring friction without CC precedent; the opt-in deny policy covers
- *    them, and the READ side already default-refuses them (reading credentials exfiltrates; writing
- *    a fresh config file does not).
- */
 export declare const WRITE_PROTECTED_DEFAULT_TABLE: readonly WriteProtectedRow[];
 /**
  * The ONE case fold of this module, applied to BOTH sides of every comparison (table names at

package/dist/core/write-protect.js

@@ -1,6 +1,7 @@
 import { writeTargetPath } from "../tools/fs/safety.js";
 import { PATH_CONFINABLE_WRITE_TOOLS } from "./runner/session-rule-policy.js";
-export const WRITE_PROTECTED_DEFAULT_TABLE = [
+const freezeTable = (rows) => Object.freeze(rows.map((r) => Object.freeze(r)));
+export const WRITE_PROTECTED_DEFAULT_TABLE = freezeTable([
     { name: ".gitconfig", kind: "basename" },
     { name: ".gitmodules", kind: "basename" },
     { name: ".bashrc", kind: "basename" },
@@ -50,7 +51,7 @@ export const WRITE_PROTECTED_DEFAULT_TABLE = [
     { name: ".config/git", kind: "segment-run" },
     { name: ".ssh", kind: "segment" },
     { name: ".gnupg", kind: "segment" },
-];
+]);
 export function foldWriteProtectCase(s) {
     return s.toLowerCase().replace(/ı/g, "i").replace(/ſ/g, "s");
 }
@@ -107,7 +108,7 @@ export function resolveWriteProtectedTable(entries) {
         seen.add(key);
         out.push(row);
     }
-    return out;
+    return freezeTable(out);
 }
 export function compileWriteProtection(entries) {
     const rows = resolveWriteProtectedTable(entries);

package/dist/engine/harness/agent-harness.d.ts

@@ -80,6 +80,16 @@ export declare class AgentHarness<TSkill extends Skill = Skill, TPromptTemplate
     private thinkingLevel;
     /** RB-30 terminal fix — runner-set sink for engine-note payloads left undrained at agent_end. */
     onUndrainedEngineNotes?: (payloads: unknown[]) => void;
+    /** backlog #259 — USER-authored queue remnants at agent_end: steers/follow-ups whose receipts said
+     *  "queued" but that no turn will ever drain (the run ended first). The engine-note sweep above
+     *  hands ENGINE payloads back for redelivery; user inputs have no redelivery semantics (a steer
+     *  aimed at a finished run must not silently fire at the next one), so their loss is ANNOUNCED
+     *  instead — the runner surfaces it as an operator notice, closing the "accepted then silently
+     *  dropped" window the #257 contract could only document. */
+    onUndrainedUserInputs?: (counts: {
+        steer: number;
+        followUp: number;
+    }) => void;
     /** design/176 — runner-set sink fired at the CONSUMPTION boundary, once per engine-note payload,
      *  in consumption order (steer/followUp drain and the turn-open nextTurn splice — the two points
      *  where a queued frame actually enters the model's input). The runner uses it to record the
@@ -99,6 +109,13 @@ export declare class AgentHarness<TSkill extends Skill = Skill, TPromptTemplate
      *  so a double call is a no-op. */
     recoverUndrainedEngineNotes(): void;
     private sweepUndrainedEngineNotes;
+    /** backlog #259 — what remains in the steer/follow-up queues AFTER the engine-note sweep is USER
+     *  input that was accepted ("queued") and will never be consumed: the run reached agent_end first.
+     *  User inputs have no redelivery semantics (unlike engine notes — a steer aimed at a finished run
+     *  must not fire at the next one), so the loss is ANNOUNCED, never silent. The window is a narrow
+     *  race (an injection landing after the loop's final queue check), which is exactly why it needs a
+     *  loud terminal account rather than an e2e reproduction. Returns the counts for the settled frame. */
+    private announceUndrainedUserInputs;
     private systemPrompt;
     /** S4: physical system blocks (static per leg, additive — see AgentHarnessOptions.systemBlocks). */
     private systemBlocks;

package/dist/engine/harness/agent-harness.js

@@ -158,6 +158,7 @@ export class AgentHarness {
     model;
     thinkingLevel;
     onUndrainedEngineNotes;
+    onUndrainedUserInputs;
     onEngineNoteConsumed;
     recoverUndrainedEngineNotes() {
         this.sweepUndrainedEngineNotes([this.nextTurnQueue, this.steerQueue, this.followUpQueue]);
@@ -182,6 +183,17 @@ export class AgentHarness {
             }
         }
     }
+    announceUndrainedUserInputs() {
+        const counts = { steer: this.steerQueue.length, followUp: this.followUpQueue.length };
+        if ((counts.steer > 0 || counts.followUp > 0) && this.onUndrainedUserInputs) {
+            try {
+                this.onUndrainedUserInputs(counts);
+            }
+            catch {
+            }
+        }
+        return counts;
+    }
     systemPrompt;
     systemBlocks;
     streamOptions;
@@ -620,9 +632,15 @@ export class AgentHarness {
         if (event.type === "agent_end") {
             await this.flushPendingSessionWrites();
             this.sweepUndrainedEngineNotes([this.nextTurnQueue, this.steerQueue, this.followUpQueue]);
+            const undrainedUser = this.announceUndrainedUserInputs();
             this.phase = "idle";
             await this.emitAny(event, signal);
-            await this.emitOwn({ type: "settled", nextTurnCount: this.nextTurnQueue.length }, signal);
+            await this.emitOwn({
+                type: "settled",
+                nextTurnCount: this.nextTurnQueue.length,
+                ...(undrainedUser.steer > 0 ? { undrainedSteerCount: undrainedUser.steer } : {}),
+                ...(undrainedUser.followUp > 0 ? { undrainedFollowUpCount: undrainedUser.followUp } : {}),
+            }, signal);
             return;
         }
         await this.emitAny(event, signal);

package/dist/engine/harness/types.d.ts

@@ -815,6 +815,11 @@ export interface AbortEvent {
 export interface SettledEvent {
     type: "settled";
     nextTurnCount: number;
+    /** backlog #259 (additive) — USER steers accepted ("queued") but never drained before agent_end.
+     *  Present only when > 0; their loss is announced through `onUndrainedUserInputs` too. */
+    undrainedSteerCount?: number;
+    /** backlog #259 (additive) — same for the follow-up queue. */
+    undrainedFollowUpCount?: number;
 }
 export interface BeforeAgentStartEvent<TSkill extends Skill = Skill, TPromptTemplate extends PromptTemplate = PromptTemplate> {
     type: "before_agent_start";

package/dist/index.d.ts

@@ -166,7 +166,7 @@ export { AdoptionError, assertAdoptionBootGate, readRootAdoptionFile, writeRootA
 export { adoptLocalDataRoot, ackAdoptionConfig, witnessAdoptionConfig, listAdoptionQuarantine, readAdoptionStatus, type AdoptionStatus, type AdoptLocalDataRootOptions, type AdoptLocalDataRootResult, type AdoptionCarriageLeg, type AdoptionCarriageLegContext, type AdoptionConfigWitnessReceipt, } from "./stores/file/adoption/adopt.js";
 export { formatHookFeedback, runToolGate, createHookEnvCapabilities, createPreToolUseConstraintPolicy, type PersistedRuleHit, type PersistedRuleUnreadable, type PersistedRuleAnswer, normalizePersistedRuleHit, type Hooks, type HookToolContext, type HookInvocationIdentity, type UserPromptSubmitContext, type PostToolBatchContext, type HookEnvCapabilities, type HookToolOutput, type PreToolUseResult, type PostToolUseResult, type UserPromptSubmitResult, type HookToolFailure, type PostToolUseFailureResult, type PostToolBatchCall, type PostToolBatchResult, type PreCompactContext, type PreCompactResult, type PostCompactContext, type StopFailureContext, type PermissionDeniedPayload, type PermissionDeniedSource, } from "./core/hooks.js";
 export { InMemoryMemoryStore, composeMemoryBlock, composeLayeredMemoryBlock, normalizeMemorySpec, type NormalizedMemorySpec, type MemorySpecInput, supportsConsolidation, supportsPeriodicConsolidation, firstSentence, expandLexicalTerms, lexicalSearchMatch, type Embedder, classifyPromotable, enforcePromotableWriteGate, guardedMemoryStore, MemoryGateError, detectSecret, enforceSecretWriteGate, enforceStructuredNoteSecretGate, type UtilityGate, type MemoryStore, type MemoryVectorMode, type ScoredMemory, type MemoryNoteHeader, type MemoryNoteRecord, type MemoryNoteType, type StructuredNoteInput, } from "./core/memory.js";
-export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, type MemoryBackendContractHooks, buildMemoryInstruction, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, readV2HeaderHints, type V2HeaderHints, LINEAGE_FILE, CHALLENGES_FILE, CHALLENGED_HISTORY_FILE, CHALLENGE_LEDGER_MAX_EVENTS, rebuildStrictControlPlaneLedger, type ControlPlaneRebuildReceipt, type StrictControlPlaneLedger, type ChallengeAssignment, type ChallengeEvent, type ChallengedHistoryRow, type LineagePendingTxn, type LineagePromotion, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, type MemorySearchDetails, type MemorySearchHit, type MemoryGetDetails, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, type MemoryAnnouncement, type ScanFinding, type MemoryEngineOptions, type MemoryInjection, type EntryProvenanceAccount, type TransferEvidence, type CommittedBinding, type CommittedEntrySnapshot, type CommittedScopeSnapshots, type EntryCustodyReport, erasureSelectHash, type EraseMemoryEntriesInput, type ErasureSelect, type ErasedBinding, type MemoryErasureAttestation, type MemoryBackend, type MemoryEntry, type MemoryEntryFrontmatter, type MemoryEntryHeader, type ScoredMemoryEntry, type NotePatch, type PatchReport, type MaterializedFile, type MemorySessionHandle, type HarvestReport, type HarvestRejection, type HarvestRejectionCode, type ParsedEntryFile, type ScannedEntryFile, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, type ParsedScopeKey, migrateScope, type MigrateScopeReport, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, type RemoteMemoryFile, type RemoteMemoryBaseline, type RemoteMaterialization, type RemoteHarvestResult, type InboundEntryFinding, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, type MemorySyncCursor, type MemorySyncConflict, type MemorySyncPlan, type RecallSource, syncMemoryScope, type MemorySyncTransport, type MemorySyncRequestBody, type MemorySyncResponseBody, type MemorySyncClientConflict, type SyncMemoryScopeOptions, type MemorySyncClientResult, } from "./core/memory-engine/index.js";
+export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, type MemoryBackendContractHooks, buildMemoryInstruction, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, readV2HeaderHints, type V2HeaderHints, LINEAGE_FILE, CHALLENGES_FILE, CHALLENGED_HISTORY_FILE, CHALLENGE_LEDGER_MAX_EVENTS, rebuildStrictControlPlaneLedger, type ControlPlaneRebuildReceipt, type StrictControlPlaneLedger, type ChallengeAssignment, type ChallengeEvent, type ChallengedHistoryRow, type LineagePendingTxn, type LineagePromotion, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, type MemorySearchDetails, type MemorySearchHit, type MemoryGetDetails, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, type MemoryAnnouncement, type ScanFinding, type MemoryEngineOptions, type MemoryInjection, type EntryProvenanceAccount, type TransferEvidence, type CommittedBinding, type CommittedEntrySnapshot, type CommittedScopeSnapshots, type EntryCustodyReport, erasureSelectHash, type EraseMemoryEntriesInput, type ErasureSelect, type ErasedBinding, type MemoryErasureAttestation, computeMemoryBundleHash, type MemoryExportBundle, type MemoryImportReport, type MemoryExportSnapshot, type MemoryBundleImportPlan, type BundleChallengeRow, type BundleLineageRow, type BundlePollutedSession, type MemoryBackend, type MemoryEntry, type MemoryEntryFrontmatter, type MemoryEntryHeader, type ScoredMemoryEntry, type NotePatch, type PatchReport, type MaterializedFile, type MemorySessionHandle, type HarvestReport, type HarvestRejection, type HarvestRejectionCode, type ParsedEntryFile, type ScannedEntryFile, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, type ParsedScopeKey, migrateScope, type MigrateScopeReport, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, type RemoteMemoryFile, type RemoteMemoryBaseline, type RemoteMaterialization, type RemoteHarvestResult, type InboundEntryFinding, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, type MemorySyncCursor, type MemorySyncConflict, type MemorySyncPlan, type RecallSource, syncMemoryScope, type MemorySyncTransport, type MemorySyncRequestBody, type MemorySyncResponseBody, type MemorySyncClientConflict, type SyncMemoryScopeOptions, type MemorySyncClientResult, } from "./core/memory-engine/index.js";
 export { SHARED_MEMORY_READ_CAP_BYTES, SHARED_MEMORY_LIST_PAGE_SIZE, SharedMemoryStoreError, type SharedMemoryStoreProvider, type SharedMemoryStoreReader, type SharedMemoryPagedList, type SharedMemoryStoreInfo, type SharedMemoryDocumentEntry, type SharedMemorySnapshot, type SharedMemoryRequestContext, type MemoryListDetails, type MemoryReadDetails, } from "./core/shared-memory/types.js";
 export { sharedMemoryStoreContract, type SharedMemoryFixture, type SharedMemoryStoreContractHooks, } from "./core/shared-memory/contract.js";
 export { termSet, jaccardDistance, cosineDistance } from "./core/memory-vector.js";

package/dist/index.js

@@ -128,7 +128,7 @@ export { AdoptionError, assertAdoptionBootGate, readRootAdoptionFile, writeRootA
 export { adoptLocalDataRoot, ackAdoptionConfig, witnessAdoptionConfig, listAdoptionQuarantine, readAdoptionStatus, } from "./stores/file/adoption/adopt.js";
 export { formatHookFeedback, runToolGate, createHookEnvCapabilities, createPreToolUseConstraintPolicy, normalizePersistedRuleHit, } from "./core/hooks.js";
 export { InMemoryMemoryStore, composeMemoryBlock, composeLayeredMemoryBlock, normalizeMemorySpec, supportsConsolidation, supportsPeriodicConsolidation, firstSentence, expandLexicalTerms, lexicalSearchMatch, classifyPromotable, enforcePromotableWriteGate, guardedMemoryStore, MemoryGateError, detectSecret, enforceSecretWriteGate, enforceStructuredNoteSecretGate, } from "./core/memory.js";
-export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, buildMemoryInstruction, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, readV2HeaderHints, LINEAGE_FILE, CHALLENGES_FILE, CHALLENGED_HISTORY_FILE, CHALLENGE_LEDGER_MAX_EVENTS, rebuildStrictControlPlaneLedger, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, erasureSelectHash, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, migrateScope, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, syncMemoryScope, } from "./core/memory-engine/index.js";
+export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, buildMemoryInstruction, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, readV2HeaderHints, LINEAGE_FILE, CHALLENGES_FILE, CHALLENGED_HISTORY_FILE, CHALLENGE_LEDGER_MAX_EVENTS, rebuildStrictControlPlaneLedger, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, erasureSelectHash, computeMemoryBundleHash, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, migrateScope, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, syncMemoryScope, } from "./core/memory-engine/index.js";
 export { SHARED_MEMORY_READ_CAP_BYTES, SHARED_MEMORY_LIST_PAGE_SIZE, SharedMemoryStoreError, } from "./core/shared-memory/types.js";
 export { sharedMemoryStoreContract, } from "./core/shared-memory/contract.js";
 export { termSet, jaccardDistance, cosineDistance } from "./core/memory-vector.js";

package/dist/tools/fs/safety.d.ts

@@ -344,7 +344,7 @@ export declare function withinAnyRoot(rootsCanonical: readonly string[], p: stri
  * just let the model discover it by trial), but it is a statement, not a recommendation, and it
  * comes last. Every shell call still passes the deployment's approval policy.
  */
-export declare const PATH_NOT_IN_ROOT_ESCAPE_HINT = "(This boundary applies to the structured file tools. If you genuinely need content outside the allowed root(s), ask for the directory to be added to the deployment's additionalDirectories \u2014 or additionalReadDirectories for read-only access. For completeness: the Bash tool is not confined by this fence, and every Bash call remains subject to the deployment's approval policy.)";
+export declare const PATH_NOT_IN_ROOT_ESCAPE_HINT = "(This boundary applies to the structured file tools. If you genuinely need content outside the allowed root(s), ask for the directory to be added to the deployment's additionalDirectories \u2014 or additionalReadDirectories for read-only access; a deployment that wants reads open everywhere can declare readFace: \"open\" instead of listing directories. For completeness: the Bash tool is not confined by this fence, and every Bash call remains subject to the deployment's approval policy.)";
 /** inv 1 (read-before-edit): a file must have been read this task before it can be edited/overwritten.
  *  Message is CC 2.1.198 live-verbatim (all-tools-live-probe 2026-07-08 §2.1/§3.1/§5.1 — one message for
  *  Edit/Write/NotebookEdit: "before writing to it", not the old sema "before editing").

package/dist/tools/fs/safety.js

@@ -493,7 +493,7 @@ export function violationDetails(v) {
 export function withinAnyRoot(rootsCanonical, p) {
     return rootsCanonical.some((r) => within(r, p));
 }
-export const PATH_NOT_IN_ROOT_ESCAPE_HINT = "(This boundary applies to the structured file tools. If you genuinely need content outside the allowed root(s), ask for the directory to be added to the deployment's additionalDirectories — or additionalReadDirectories for read-only access. For completeness: the Bash tool is not confined by this fence, and every Bash call remains subject to the deployment's approval policy.)";
+export const PATH_NOT_IN_ROOT_ESCAPE_HINT = "(This boundary applies to the structured file tools. If you genuinely need content outside the allowed root(s), ask for the directory to be added to the deployment's additionalDirectories — or additionalReadDirectories for read-only access; a deployment that wants reads open everywhere can declare readFace: \"open\" instead of listing directories. For completeness: the Bash tool is not confined by this fence, and every Bash call remains subject to the deployment's approval policy.)";
 export function requireRead(state, key) {
     const entry = state.get(key);
     if (entry === undefined || entry.isPartialView) {

package/dist/tools/fs/search.d.ts

@@ -208,6 +208,39 @@ export interface GrepRunResult {
      *  withheld / no deny judge in play. */
     withheld?: ReadDenyWithheld;
 }
+/**
+ * backlog #303 (rescan-hardened form) — the rg leg's deny TRIPWIRE. rg's exclusion globs are spelled
+ * from the pattern text and cannot express the win32 component-alias family (`.aws.` / `.aws ` —
+ * trailing dots/spaces the win32 namespace strips), so a directory planted under an alias spelling
+ * slips past the globs while the shared `matchPath` (two-view, read-deny.ts) correctly names it —
+ * the JS leg pruned it, the rg leg returned its contents, and the same tree answered differently
+ * depending on whether ripgrep was installed.
+ *
+ * The first fix FILTERED rg's text output line-by-line. The rescan killed that shape twice over:
+ * ripgrep prints filenames verbatim, so a path component containing a NEWLINE splits one record
+ * across physical lines whose fragments carry no `:line:` boundary — the filter kept them and the
+ * deny-listed content passed (a protection hole, not a precision residual); and pruning every line
+ * of a partial run fabricated a `No matches.` row inside the structured card. Text-splitting rg
+ * records is unsalvageable without structured output (`--json`, backlog #306), so this function no
+ * longer edits anything: it JUDGES. Any deny hit — or any line the format cannot account for —
+ * trips, and the caller abandons the rg run for the JS scanner, whose walk prunes with the
+ * authoritative judge and needs no path parsing at all. rg stays the fast path for the common case
+ * (no guarded entries in the result); the moment a guarded spelling is involved, the engine that
+ * cannot mis-parse it owns the answer.
+ *
+ * Trip conditions by mode — `files_with_matches`: every line IS a path, judged whole; `count`:
+ * `path:N` (a line without the numeric tail is a split record — ambiguous, trip); `content`:
+ * judged at EVERY `:digits:` boundary and every `-digits-` boundary (a candidate cut inside match
+ * text can over-trip — safe: the fallback re-derives the exact answer), and a non-separator line
+ * with NO boundary at all is a split record — trip. `--` separators and empty lines pass.
+ */
+export declare function rgOutputDenyTripwire(stdout: string, mode: "content" | "files_with_matches" | "count", judge: Pick<ReadDenyJudge, "matchPath">): {
+    trip: false;
+} | {
+    trip: true;
+    reason: "deny-hit" | "ambiguous-record";
+    pattern?: string;
+};
 /** ripgrep grep: build flags from params, run, normalize to the same output as {@link jsGrep}.
  *  Result-fidelity contract: output ripgrep DID produce is never silently replaced by a fallback
  *  rescan — partial results ship with a caveat; only a zero-output failure degrades to

package/dist/tools/fs/search.js

@@ -1043,6 +1043,63 @@ function formatRgStdout(stdout, p, caveat = "") {
         (off > 0 ? `\n[offset ${off}]` : "") +
         caveat);
 }
+export function rgOutputDenyTripwire(stdout, mode, judge) {
+    if (stdout.length === 0)
+        return { trip: false };
+    const judgeBoundaries = (line, boundary) => {
+        let sawBoundary = false;
+        for (let m = boundary.exec(line); m !== null; m = boundary.exec(line)) {
+            sawBoundary = true;
+            const prefix = line.slice(0, m.index);
+            if (prefix.length === 0)
+                continue;
+            const hit = judge.matchPath(prefix);
+            if (hit !== null)
+                return hit.pattern;
+        }
+        return sawBoundary ? null : "";
+    };
+    for (const line of stdout.split("\n")) {
+        if (line.length === 0 || line === "--")
+            continue;
+        if (mode === "files_with_matches") {
+            const h = judge.matchPath(line);
+            if (h !== null)
+                return { trip: true, reason: "deny-hit", pattern: h.pattern };
+        }
+        else if (mode === "count") {
+            const m = /^(.*):\d+$/.exec(line);
+            if (m === null)
+                return { trip: true, reason: "ambiguous-record" };
+            const h = judge.matchPath(m[1]);
+            if (h !== null)
+                return { trip: true, reason: "deny-hit", pattern: h.pattern };
+        }
+        else {
+            const colon = judgeBoundaries(line, /:\d+:/g);
+            if (colon !== null && colon !== "")
+                return { trip: true, reason: "deny-hit", pattern: colon };
+            const dash = judgeBoundaries(line, /-\d+-/g);
+            if (dash !== null && dash !== "")
+                return { trip: true, reason: "deny-hit", pattern: dash };
+            if (colon === "" && dash === "")
+                return { trip: true, reason: "ambiguous-record" };
+        }
+    }
+    return { trip: false };
+}
+async function jsGrepDenyTripFallback(env, root, p, signal, trip, deny) {
+    const denyOut = {};
+    const text = await jsGrep(env, root, p, signal, undefined, deny, denyOut);
+    const why = trip.reason === "deny-hit" ? "its output involved sensitive-path deny-listed entries the exclusion globs cannot express" : "its output contained a record the line format cannot account for";
+    return {
+        text: text.startsWith("Error (grep)")
+            ? text
+            : `${text}\n[note: the ripgrep pass was abandoned (${why}); results are from the fallback scanner, which prunes with the authoritative deny judge]`,
+        degraded: { fallback: "js-scan", reason: `ripgrep output tripped the deny tripwire (${trip.reason})` },
+        ...(denyOut.withheld !== undefined ? { withheld: denyOut.withheld } : {}),
+    };
+}
 async function jsGrepFallback(env, root, p, signal, reason, deny) {
     const denyOut = {};
     const text = await jsGrep(env, root, p, signal, undefined, deny, denyOut);
@@ -1097,6 +1154,11 @@ export async function rgGrepDetailed(env, root, p, signal, deny) {
         if (err.code === "timeout") {
             const partial = err.partialStdout ?? "";
             if (partial.trim().length > 0) {
+                if (deny !== undefined) {
+                    const trip = rgOutputDenyTripwire(partial, mode, deny);
+                    if (trip.trip)
+                        return jsGrepDenyTripFallback(env, root, p, signal, trip, deny);
+                }
                 return {
                     text: `${delimitUntrusted("ripgrep partial output", formatRgStdout(partial, p))}\n…[ripgrep timed out after producing partial output — results may be incomplete]`,
                     degraded: { partial: true, reason: "ripgrep timed out" },
@@ -1124,6 +1186,11 @@ export async function rgGrepDetailed(env, root, p, signal, deny) {
     }
     if (exitCode >= 2) {
         if (stdout.trim().length > 0) {
+            if (deny !== undefined) {
+                const trip = rgOutputDenyTripwire(stdout, mode, deny);
+                if (trip.trip)
+                    return jsGrepDenyTripFallback(env, root, p, signal, trip, deny);
+            }
             return {
                 text: `${delimitUntrusted("ripgrep partial output", formatRgStdout(stdout, p))}\n…[ripgrep exited with an error after producing partial output — results may be incomplete]`,
                 degraded: { partial: true, reason: `ripgrep exited with code ${exitCode}` },
@@ -1131,6 +1198,11 @@ export async function rgGrepDetailed(env, root, p, signal, deny) {
         }
         return jsGrepFallback(env, root, p, signal, `exited with code ${exitCode} and produced no output`, deny);
     }
+    if (deny !== undefined) {
+        const trip = rgOutputDenyTripwire(stdout, mode, deny);
+        if (trip.trip)
+            return jsGrepDenyTripFallback(env, root, p, signal, trip, deny);
+    }
     const orderedStdout = mode === "files_with_matches" ? await sortRgFilesByMtime(env, root, stdout, signal) : stdout;
     const d = await denyDisclosure();
     return { text: formatRgStdout(orderedStdout, p) + d.note, ...(d.withheld !== undefined ? { withheld: d.withheld } : {}) };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "5.39.0",
+  "version": "5.41.0",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",

package/test/export-surface.snapshot.json

@@ -1,6 +1,6 @@
 {
   "_comment": "design/87 L3 — frozen public export surface of src/index.ts (name -> kind). DO NOT edit by hand to silence a red test. A removed/changed entry = a SemVer-BREAKING change; bump MAJOR and update this fixture in the SAME commit (design/87 §4.2 / §5.2). Regenerate via REGEN in test/export-surface.test.ts.",
-  "count": 1597,
+  "count": 1605,
   "exports": {
     "A2ATaskState": "type",
     "A2ATaskStateReversal": "type",
@@ -119,6 +119,9 @@
     "BudgetAxis": "type",
     "BuildAutoModePromptOptions": "interface",
     "BuiltinWorkflowDefinition": "interface",
+    "BundleChallengeRow": "interface",
+    "BundleLineageRow": "interface",
+    "BundlePollutedSession": "interface",
     "CC_MODEL_TIER_ALIASES": "variable",
     "CHALLENGED_HISTORY_FILE": "variable",
     "CHALLENGES_FILE": "variable",
@@ -467,14 +470,18 @@
     "MemoryAnnouncement": "interface",
     "MemoryBackend": "interface",
     "MemoryBackendContractHooks": "interface",
+    "MemoryBundleImportPlan": "interface",
     "MemoryEngine": "class",
     "MemoryEngineOptions": "interface",
     "MemoryEntry": "interface",
     "MemoryEntryFrontmatter": "interface",
     "MemoryEntryHeader": "interface",
     "MemoryErasureAttestation": "interface",
+    "MemoryExportBundle": "interface",
+    "MemoryExportSnapshot": "interface",
     "MemoryGateError": "class",
     "MemoryGetDetails": "interface",
+    "MemoryImportReport": "interface",
     "MemoryInjection": "interface",
     "MemoryListDetails": "type",
     "MemoryNoteHeader": "interface",
@@ -1180,6 +1187,7 @@
     "computeCatalogDigest": "function",
     "computeCostMicroUsd": "function",
     "computeEntryRev": "function",
+    "computeMemoryBundleHash": "function",
     "computeShapeDigest": "function",
     "confirmRuleApproval": "function",
     "consolidateScope": "function",