@sema-agent/core 5.54.0 → 5.55.0

package/dist/core/memory-engine/tools.js

@@ -1,9 +1,10 @@
 import { Type } from "typebox";
 import { errorResult } from "../tools.js";
-import { defuseFenceMarkers, delimitUntrusted, inlineUntrusted, sanitizeUntrustedText } from "../untrusted-text.js";
+import { defuseFenceMarkers, delimitUntrusted, FENCED_LANE_ENVELOPE_TAGS, inlineUntrusted, sanitizeUntrustedText } from "../untrusted-text.js";
 import { formatMemoryAge } from "../memory-recall.js";
 import { committedOriginOf } from "./frontmatter.js";
 import { MEMORY_EXPOSURE_BANNER, MEMORY_EXPOSURE_HANDLE_TAG, MEMORY_PROVENANCE_SEARCH_SENTENCE, MEMORY_SEARCH_BAND_ORDER_HEADER } from "./provenance-wording.js";
+import { deriveSupersededSet, memorySupersededNote, MEMORY_SEARCH_SUPERSEDED_TAG } from "./consolidation.js";
 export const MEMORY_SEARCH_TOOL_NAME = "memory_search";
 export const MEMORY_GET_TOOL_NAME = "memory_get";
 export const MEMORY_ENGINE_TOOL_NAMES = [MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME];
@@ -122,6 +123,13 @@ export function createMemoryEngineTools(opts) {
         const scopeSet = new Set(plane.scopes);
         return (await plane.backend.getByIds(ids)).filter((e) => scopeSet.has(e.scope) && e.frontmatter.deleted !== true);
     };
+    const supersededOf = async (plane, exclusions) => {
+        if (plane.scopes.length === 0)
+            return new Map();
+        const face = plane.backend.retrievalView?.() ?? plane.backend;
+        const headers = await face.listHeaders(plane.scopes);
+        return deriveSupersededSet(headers, { excluded: (id) => exclusions?.has(id) === true });
+    };
     const searchTool = {
         name: MEMORY_SEARCH_TOOL_NAME,
         description: carry ? `${SEARCH_DESCRIPTION}\n\n${MEMORY_PROVENANCE_SEARCH_SENTENCE}` : SEARCH_DESCRIPTION,
@@ -129,13 +137,16 @@ export function createMemoryEngineTools(opts) {
         defer: true,
         offload: false,
         contentOrigin: "local",
-        contract: { contractId: "core.memory_search@1", implementationRevision: "4" },
+        contract: { contractId: "core.memory_search@1", implementationRevision: "5" },
         parameters: Type.Object({
             query: Type.String({ description: "Keywords to look for (lexical match against entry names, descriptions and bodies)." }),
             limit: Type.Optional(Type.Number({ description: `Maximum hits to return (default ${MEMORY_SEARCH_DEFAULT_LIMIT}, max ${MEMORY_SEARCH_MAX_LIMIT}).` })),
+            includeSuperseded: Type.Optional(Type.Boolean({
+                description: "Also return entries a newer consolidated entry has superseded (kept as evidence; hidden from results by default). Superseded hits are tagged, with the superseding entry's id.",
+            })),
         }, { additionalProperties: false }),
         execute: async (args, ctx) => {
-            const { query, limit: rawLimit } = args;
+            const { query, limit: rawLimit, includeSuperseded } = args;
             const signal = ctx.signal;
             if (query.trim() === "") {
                 return refusedSearch("empty_query", "query must be non-empty — pass the concrete keywords a past memory entry would contain.");
@@ -150,17 +161,32 @@ export function createMemoryEngineTools(opts) {
                     return refusedSearch("challenge_ledger_unavailable", "Memory search is unavailable: the challenge ledger for a mounted memory plane cannot be read (fail-closed). Report this to the operator.", "failed");
                 }
             }
+            const supersededMaps = [];
+            try {
+                for (let i = 0; i < planes.length; i++) {
+                    const plane = planes[i];
+                    supersededMaps.push(plane === undefined ? new Map() : await supersededOf(plane, exclusions[i]));
+                }
+            }
+            catch (err) {
+                if (signal?.aborted === true)
+                    throw err;
+                return refusedSearch("error", "Memory search is unavailable: the header listing behind the superseded-entry filter could not be read. Try again, and report the failure if it persists.", "failed");
+            }
             const merged = [];
             try {
                 for (let i = 0; i < planes.length; i++) {
                     const plane = planes[i];
                     if (plane.scopes.length === 0)
                         continue;
-                    const askFor = carry ? limit + (exclusions[i]?.size ?? 0) : limit;
+                    const supersededSlots = includeSuperseded === true ? 0 : supersededMaps[i]?.size ?? 0;
+                    const askFor = (carry ? limit + (exclusions[i]?.size ?? 0) : limit) + supersededSlots;
                     const hits = await plane.backend.search(query, plane.scopes, { limit: askFor, ...(carry ? { exposureBands: true } : {}) });
                     for (const h of hits) {
                         if (exclusions[i]?.has(h.id))
                             continue;
+                        if (includeSuperseded !== true && supersededMaps[i]?.has(h.id))
+                            continue;
                         merged.push({ ...h, planeIndex: i });
                     }
                 }
@@ -219,10 +245,12 @@ export function createMemoryEngineTools(opts) {
             for (let i = 0; i < live.length; i++) {
                 const h = live[i];
                 const exposed = exposedFlags[i];
+                const supersededBy = supersededMaps[h.planeIndex]?.get(h.id);
+                const supersededSuffix = supersededBy !== undefined ? ` ${MEMORY_SEARCH_SUPERSEDED_TAG}` : "";
                 if (exposed) {
-                    hits.push({ exposure: "external", id: h.id, scope: h.scope, score: h.score, mtimeMs: h.mtimeMs, sizeBytes: h.sizeBytes });
+                    hits.push({ exposure: "external", id: h.id, scope: h.scope, score: h.score, mtimeMs: h.mtimeMs, sizeBytes: h.sizeBytes, ...(supersededBy !== undefined ? { supersededBy } : {}) });
                     lines.push("");
-                    lines.push(`${i + 1}. [mem:${h.id}] ${MEMORY_EXPOSURE_HANDLE_TAG} (scope ${inlineUntrusted(h.scope, 80)}, score ${h.score.toFixed(3)}, ${ageOf(now, h.mtimeMs)}) — read it with ${MEMORY_GET_TOOL_NAME} id ${h.id}`);
+                    lines.push(`${i + 1}. [mem:${h.id}] ${MEMORY_EXPOSURE_HANDLE_TAG}${supersededSuffix} (scope ${inlineUntrusted(h.scope, 80)}, score ${h.score.toFixed(3)}, ${ageOf(now, h.mtimeMs)}) — read it with ${MEMORY_GET_TOOL_NAME} id ${h.id}`);
                     continue;
                 }
                 hits.push({
@@ -234,10 +262,11 @@ export function createMemoryEngineTools(opts) {
                     score: h.score,
                     mtimeMs: h.mtimeMs,
                     sizeBytes: h.sizeBytes,
+                    ...(supersededBy !== undefined ? { supersededBy } : {}),
                 });
                 const hook = h.description ? ` — ${inlineUntrusted(h.description, 200)}` : "";
                 lines.push("");
-                lines.push(`${i + 1}. ${entryPath(h.scope, h.slug)}${hook} (id ${h.id}, score ${h.score.toFixed(3)}, ${ageOf(now, h.mtimeMs)})`);
+                lines.push(`${i + 1}. ${entryPath(h.scope, h.slug)}${supersededSuffix}${hook} (id ${h.id}, score ${h.score.toFixed(3)}, ${ageOf(now, h.mtimeMs)})`);
                 const body = (entryById.get(h.id)?.body ?? "").trim();
                 if (body !== "")
                     lines.push(delimitUntrusted(`memory entry ${h.slug}`, body, MEMORY_SEARCH_SNIPPET_CAP));
@@ -253,7 +282,7 @@ export function createMemoryEngineTools(opts) {
         defer: true,
         offload: false,
         contentOrigin: "local",
-        contract: { contractId: "core.memory_get@1", implementationRevision: "4" },
+        contract: { contractId: "core.memory_get@1", implementationRevision: "5" },
         parameters: Type.Object({
             id: Type.Optional(Type.String({ description: "Entry id (exact lookup). Pass either id or slug, not both." })),
             slug: Type.Optional(Type.String({ description: "Entry slug (its file path without .md). Ambiguous across scopes unless scope is also passed." })),
@@ -352,6 +381,15 @@ export function createMemoryEngineTools(opts) {
                 });
             }
             const exposed = carry && exposedEntry(entry);
+            let supersededBy;
+            if (entryPlane !== undefined) {
+                try {
+                    supersededBy = (await supersededOf(entryPlane, entryPlane.challengeExclusions?.())).get(entry.id);
+                }
+                catch {
+                    supersededBy = undefined;
+                }
+            }
             try {
                 entryPlane?.recordRetrieved([entry.id]);
             }
@@ -365,6 +403,7 @@ export function createMemoryEngineTools(opts) {
             const head = [
                 `Memory entry ${entryPath(entry.scope, entry.slug)} (id ${entry.id}${mtimeMs !== undefined ? `, ${ageOf(now, mtimeMs)}` : ""})`,
                 ...(exposed ? [MEMORY_EXPOSURE_BANNER] : []),
+                ...(supersededBy !== undefined ? [memorySupersededNote(supersededBy)] : []),
                 ...(fm.name !== undefined ? [`name: ${inlineUntrusted(fm.name, 120)}`] : []),
                 ...(fm.description !== undefined ? [`description: ${inlineUntrusted(fm.description, 200)}`] : []),
                 ...(fm.type !== undefined ? [`type: ${inlineUntrusted(fm.type, 40)}`] : []),
@@ -380,8 +419,11 @@ export function createMemoryEngineTools(opts) {
                     return refusedGet("taint_mark_failed", `Memory entry ${entry.id.slice(0, 64)} was not delivered: its external-origin take-up could not be recorded for this session (fail-closed). Report this to the operator and retry.`, "failed", { id: entry.id });
                 }
             }
+            const neutralLines = defuseFenceMarkers(sanitizeUntrustedText(entry.body, [...FENCED_LANE_ENVELOPE_TAGS])).split("\n");
+            if (neutralLines.length > 0 && neutralLines[neutralLines.length - 1] === "")
+                neutralLines.pop();
             if (lineCursor > 0 && totalLines > 0) {
-                const line = defuseFenceMarkers(sanitizeUntrustedText(allLines[offset]));
+                const line = neutralLines[offset];
                 const tail = skipBytes(line, lineCursor);
                 const cut = cutToBytes(tail.text, MEMORY_GET_PAGE_CAP_BYTES);
                 const shown = Buffer.byteLength(cut.text, "utf8");
@@ -405,23 +447,24 @@ export function createMemoryEngineTools(opts) {
                     lineCursor: tail.skippedBytes,
                     ...(nextLineCursor !== undefined ? { nextLineCursor } : {}),
                     ...(exposed ? { exposure: "external" } : {}),
+                    ...(supersededBy !== undefined ? { supersededBy } : {}),
                 };
                 return { content: head.join("\n"), details };
             }
             const page = [];
             let bytes = 0;
-            for (let i = offset; i < Math.min(totalLines, offset + limit); i++) {
-                const lineBytes = Buffer.byteLength(allLines[i], "utf8") + 1;
+            for (const neutralizedLine of neutralLines.slice(offset, offset + limit)) {
+                const lineBytes = Buffer.byteLength(neutralizedLine, "utf8") + 1;
                 if (page.length > 0 && bytes + lineBytes > MEMORY_GET_PAGE_CAP_BYTES)
                     break;
-                page.push(allLines[i]);
+                page.push(neutralizedLine);
                 bytes += lineBytes;
                 if (bytes > MEMORY_GET_PAGE_CAP_BYTES)
                     break;
             }
             const end = offset + page.length;
             head.push(`body lines ${totalLines === 0 ? 0 : offset + 1}-${end} of ${totalLines}:`);
-            const neutralized = defuseFenceMarkers(sanitizeUntrustedText(page.join("\n")));
+            const neutralized = defuseFenceMarkers(sanitizeUntrustedText(page.join("\n"), [...FENCED_LANE_ENVELOPE_TAGS]));
             const cut = cutToBytes(neutralized, MEMORY_GET_PAGE_CAP_BYTES);
             head.push(delimitUntrusted(`memory entry ${entry.slug}`, cut.text));
             let nextLineCursor;
@@ -446,6 +489,7 @@ export function createMemoryEngineTools(opts) {
                 totalLines,
                 ...(nextLineCursor !== undefined ? { nextLineCursor } : {}),
                 ...(exposed ? { exposure: "external" } : {}),
+                ...(supersededBy !== undefined ? { supersededBy } : {}),
             };
             return { content: head.join("\n"), details };
         },

package/dist/core/memory-engine/types.d.ts

@@ -27,6 +27,55 @@ export interface MemoryEntryOrigin {
     cause?: MemoryOriginCause;
     at: number;
 }
+/**
+ * design/339 §1.4 — one input-lineage row of a distilled (consolidation-produced) entry.
+ * `superseded: true` rows are the SUPERSESSION EDGES (this product replaces that input in the
+ * default read face — rev-anchored, see {@link MemoryEntryDistilled}); rows without the flag are
+ * evidence-only inputs (episodic sources, net-new distillation material) that are never suppressed.
+ */
+export interface MemoryEntryDistilledInput {
+    /** The input entry's immutable id. */
+    id: string;
+    /** The input's committed rev AT PLAN FREEZE — the edge's rev anchor (design/339 D-2a): the edge
+     *  is valid only while the target's committed rev still equals this, so a later legitimate edit
+     *  of the superseded entry REVIVES it (new information must never stay suppressed). */
+    rev: string;
+    /** Present ⇔ this row is a supersession edge (the product replaces this input in the active set). */
+    superseded?: true;
+}
+/**
+ * design/339 §1.4 — the ENGINE-MINTED supersession/lineage carrier riding ON the distilled product
+ * entry itself (typed frontmatter member, the `origin` carriage family). The block is authored
+ * exclusively by the consolidation protocol's plan freeze — a harvest never adopts one off the
+ * model-writable plane (stripped with a report warning, same law as `origin`), and once committed
+ * it is immutable: every later op must carry it forward DEEP-EQUAL (strip or member rewrite =
+ * malformed-refusal; the one legal exit is the committed tombstone). Riding on the product makes
+ * the edge publish ATOMIC for free (per-entry atomicity = edge atomicity; a partial apply can never
+ * suppress a target whose replacement is missing — the edge IS the replacement's bytes), and makes
+ * the lineage TRAVEL with the entry across backend/sync/bundle seams (retroactive challenge
+ * propagation stays mechanical on a deployment that never saw the plan file).
+ */
+export interface MemoryEntryDistilled {
+    /** Minting plan (audit anchor; opaque on a deployment the entry traveled to). */
+    planId: string;
+    /** Mint time, ms epoch — fixed at plan freeze (a replay re-adds the exact same bytes). */
+    at: number;
+    /**
+     * The CARRIER-side rev anchor (design/339 r3-2): the product's own committed rev at plan freeze.
+     * NON-CIRCULAR BY CONSTRUCTION: this member is excluded from the rev's canonical tuple
+     * ({@link import("./frontmatter.js").computeEntryRev}), so at freeze it simply EQUALS the entry's
+     * committed rev. An edge is valid only while the carrier's committed rev still equals this —
+     * a legitimate edit of the product (which may rewrite or retract what it integrated) SUSPENDS
+     * its edges and revives the inputs (the only accurate copy must never hide outside the default
+     * read face). Idempotent re-adds / deep-carrying updates don't move the rev, so untouched
+     * carriers keep their edges. Tamper is closed by the immutability law: a rewrite of this member
+     * is a malformed-refusal regardless of the rev arithmetic.
+     */
+    carrierRev: string;
+    /** The product's COMPLETE input lineage (id + freeze-time rev; `superseded` rows are the edges).
+     *  Bounded at freeze by `maxInputsPerProduct` (§6.1). */
+    inputs: MemoryEntryDistilledInput[];
+}
 /**
  * Structured header fields of one memory entry (the CC frontmatter shape: `name`/`description`/
  * `metadata.type`). `extra` preserves any additional frontmatter lines VERBATIM (round-trip safety:
@@ -93,6 +142,19 @@ export interface MemoryEntryFrontmatter {
      * deliberately no `"clean"` spelling to upgrade to (the `trust: "untrusted"` single-value law).
      */
     origin?: MemoryEntryOrigin;
+    /**
+     * design/339 §1.4 — the consolidation lineage/supersession carrier (see
+     * {@link MemoryEntryDistilled}). Engine-minted at plan freeze ONLY; model-written spellings
+     * (typed or suspect `extra` form) are stripped at harvest with a report warning, and a committed
+     * block is immutable under every touching op (deep-equal carry-forward, the `origin` I-2 seat's
+     * third member). Threat direction is the INVERSE of `origin`'s (design/339 §1.4.4): the
+     * dangerous act is ADDING an edge (a forged edge suppresses good memory — the delete-attack
+     * surface add-only exists to close), so only the pristine TYPED seat ever produces edges —
+     * suspect `extra`-form bytes are preserved verbatim but INERT (they mint no edge; fewer edges
+     * is the safe direction), while the immutability law still protects the committed typed block
+     * (stripping it would whitewash the product's lineage out of retroactive challenge reach).
+     */
+    distilled?: MemoryEntryDistilled;
     /** Unknown frontmatter lines preserved verbatim (order kept), re-serialized on projection. */
     extra?: string[];
 }
@@ -134,6 +196,23 @@ export interface MemoryEntryHeader {
      * question. Absent ⇔ no marker (the entry was never judged exposed — not "proven clean").
      */
     exposure?: "external";
+    /**
+     * design/339 §4.1-3 — the committed DISTILLED fact, carried on BOTH header faces (`listHeaders`
+     * and `search`, one projection): present ⇔ the committed entry carries a typed `distilled` block.
+     * `supersedes` is the block's edge PROJECTION (the `superseded: true` input rows — the minimal
+     * set the engine's active-set derivation needs; the full lineage stays off the header, payload
+     * bounded), `carrierRev` the block's carrier-side rev anchor (edge validity needs it beside the
+     * header's own `rev`). A DATA fact, not a mode — the backend reports what is stored; active-set
+     * derivation and every read-face treatment live in the engine/tool layer (same law as
+     * {@link exposure}).
+     */
+    distilled?: {
+        carrierRev: string;
+        supersedes: Array<{
+            id: string;
+            rev: string;
+        }>;
+    };
 }
 /** A scored search hit (FileBackend = lexical floor; PgBackend = design/81 vector rungs, S3). */
 export interface ScoredMemoryEntry extends MemoryEntryHeader {
@@ -254,10 +333,19 @@ export interface MemoryBackend {
      *   earlier delete in the same batch does not blank the baseline). The one legal exit is the
      *   COMMITTED tombstone: after a delete commits, the marker's life ends with the id (a fresh id —
      *   or the same id in a LATER batch — starts an unmarked life; the engine re-judges its session);
+     * - design/339 §4.1-1 `distilled` 不可变律 (the I-2 seat's third member): when the id's PRE-BATCH
+     *   committed state carries a typed `frontmatter.distilled` block, ANY op spelling that touches
+     *   the id (`update`, plain re-`add`, `guard: "absent"` add, same-batch delete-then-re-add) must
+     *   carry it forward DEEP-EQUAL (planId + at + carrierRev + every input row, order included); a
+     *   strip or member rewrite is refused with reason matching /malformed patch refused/. Judged
+     *   against the PRE-BATCH committed state; the one legal exit is the COMMITTED tombstone (the
+     *   block's life ends with the id). Suspect `extra`-form distilled bytes are NOT this law's
+     *   subject (they are inert verbatim leftovers — they mint no edge and carry like any `extra`);
      * - PRECEDENCE (FAM-1 #5, every whitewash spelling): the malformed judgment answers BEFORE
      *   guard/CAS arithmetic — a strip riding a stale `baseRev` (or a guard conflict) still answers
      *   /malformed patch refused/, never the ordinary rev-mismatch conflict (a whitewash is illegal
      *   at ANY rev, and the weaker conflict would tell the caller's ladder to rebase and retry it);
+     *   design/339 c37: the same precedence covers the `distilled` law;
      * - design/336 §4 hold protocol: the backend is hold-UNAWARE — instruction holds live on the
      *   ENGINE's control plane, so a held id keeps serving reads and ordinary add/update patches for
      *   it apply plainly (no queueing, no refusal). The settlement-period write interaction resolves
@@ -460,6 +548,17 @@ export interface HarvestReport {
      * (`memory.hold_opened` / `memory.hold_released` / `memory.hold_disposed`) is derived from the
      * three hold seats.
      */
+    /**
+     * design/339 §2.2 — the consolidation RECOMMENDATION edge (advisory, additive): this harvest's
+     * engine-minted session count crossed the configured thresholds (time gate open ∧ enough
+     * distinct sessions ∧ the once-per-crossing edge armed). Present at most once per crossing;
+     * absent always when consolidation is OFF (the default — zero gate state exists then). The
+     * recommendation NEVER executes anything: the host owns the verbs.
+     */
+    consolidationRecommended?: {
+        scope: string;
+        sessionsSince: number;
+    };
     containment?: {
         /** The derived index (MEMORY.md) was restored to its materialize-time baseline this harvest
          *  (the session's prose additions were captured and dropped). */

package/dist/core/memory-recall.js

@@ -1,3 +1,4 @@
+import { MEMORY_INJECTION_TAGS } from "./memory.js";
 import { sanitizeUntrustedText } from "./untrusted-text.js";
 export const DEFAULT_MAX_SELECTED = 5;
 export const DEFAULT_MAX_LINKED = 3;
@@ -107,8 +108,8 @@ export function composeSelectiveBody(manifestText, selected, nowMs, linked = [],
         const ageMs = nowMs - r.mtimeMs;
         const verify = r.timestampMissing || ageMs > ONE_DAY_MS ? " — verify it's still current" : "";
         const stale = r.timestampMissing ? ` (write time unknown${verify})` : ` (written ${formatMemoryAge(ageMs)}${verify})`;
-        const prefix = label ? `${sanitizeUntrustedText(label, ["user_memory"])} ` : "";
-        return `- ${prefix}${sanitizeUntrustedText(r.text, ["user_memory"])}${stale}`;
+        const prefix = label ? `${sanitizeUntrustedText(label, [...MEMORY_INJECTION_TAGS])} ` : "";
+        return `- ${prefix}${sanitizeUntrustedText(r.text, [...MEMORY_INJECTION_TAGS])}${stale}`;
     };
     let body = selected.map((r) => renderNote(r)).join("\n");
     if (linked.length > 0) {
@@ -126,7 +127,7 @@ export function composeSelectiveBody(manifestText, selected, nowMs, linked = [],
     const selectedSection = selected.length > 0 ? `\n\nRelevant notes:\n${body}` : "\n\n(no notes selected as relevant to this task)";
     const recallCall = recallToolName !== undefined ? `call ${recallToolName}` : `search the memory-recall tool bound to this scope`;
     const manifestSection = recallable
-        ? `Memory index — to load a note in full, ${recallCall} with keywords from its description:\n${sanitizeUntrustedText(manifestText, ["user_memory"])}`
+        ? `Memory index — to load a note in full, ${recallCall} with keywords from its description:\n${sanitizeUntrustedText(manifestText, [...MEMORY_INJECTION_TAGS])}`
         : "";
     return `${manifestSection}${selectedSection}`;
 }

package/dist/core/memory.d.ts

@@ -541,12 +541,42 @@ export declare function normalizeMemorySpec(input: MemorySpecInput | undefined):
  *  Exported so the inject-all de-dup seeding (prepare-task.ts) can detect truncation and NOT seed dropped
  *  (truncated-out) note ids as "already surfaced" — see the MINOR-1 audit fix there. */
 export declare const MAX_MEMORY_BYTES: number;
-/** The wrapper-tag family the memory injection fences neutralize (`<system-reminder>` is ALWAYS
+/** The wrapper-tag family the memory ADMISSION gate rejects on (`<system-reminder>` is ALWAYS
  *  included by {@link sanitizeUntrustedText} itself). Single source (design/138 S2-C, C-F10/O-F11):
  *  the memory write-time scan (`memory-engine/scan.ts`) detects break-out markup by diffing
- *  `sanitizeUntrustedText(text, MEMORY_WRAPPER_TAGS)` against the raw text, so the scan rules and
- *  the ACTUAL injection boundary (this file's compose* fences) can never drift apart. */
+ *  `sanitizeUntrustedText(text, MEMORY_WRAPPER_TAGS)` against the raw text.
+ *
+ *  ADMISSION half — deliberately UNCHANGED at the single outer wrapper. See
+ *  {@link MEMORY_INJECTION_TAGS} for the (wider) containment half and for why the two are allowed to
+ *  differ in exactly one direction. */
 export declare const MEMORY_WRAPPER_TAGS: readonly string[];
+/**
+ * The tag family the memory injection fences actually NEUTRALIZE — the whole authority-envelope
+ * census (untrusted-text.ts `ENGINE_ENVELOPES`), a deliberate SUPERSET of {@link MEMORY_WRAPPER_TAGS}.
+ *
+ * Two reproduced findings drove the widening:
+ *  ① `<scope>` — {@link composeLayeredMemoryBlock} renders a `<scope name="…">` SUB-ENVELOPE per
+ *    layer, but the neutralized list named only the outer wrapper, so a layer payload could close its
+ *    own `</scope>` and open a fresh `<scope name="managed">`: a forged higher-authority layer landing
+ *    at the END of the block, where this function's own contract puts the highest-priority layer.
+ *    Project-scope content is repository-controlled by our own stated posture
+ *    (PROJECT_CONTEXT_FRAMING), i.e. attacker-reachable.
+ *  ② the SIBLING envelopes — nesting a forged `<task-notification>` or `<new-diagnostics>` inside
+ *    `<user_memory>` does not make it inert: the TAG is what a model reads as harness speech, and
+ *    this payload lands in the SYSTEM PROMPT. Widening is safe precisely here because the sanitizer
+ *    runs on the PAYLOAD, before this file assembles the engine's own wrappers around it — it can
+ *    never defuse our own fences.
+ *
+ * WHY THE ADMISSION LIST DID NOT WIDEN WITH IT (the asymmetry is the point). The write scan
+ * (`memory-engine/scan.ts`) diffs against {@link MEMORY_WRAPPER_TAGS} and REFUSES on a difference,
+ * and it runs on re-serialization / sync / import paths as well as on fresh writes. Widening it would
+ * retroactively refuse ALREADY-STORED entries — and `<scope>test</scope>` is a Maven POM element, so
+ * the false-rejection is not hypothetical. The drift therefore runs in the one safe direction:
+ * containment ⊇ admission. A note the gate accepts is neutralized on the way in to the prompt; the
+ * dangerous drift would be the reverse (admission accepting what containment does not defuse), and
+ * that one is structurally impossible while this constant is a superset.
+ */
+export declare const MEMORY_INJECTION_TAGS: readonly string[];
 /**
  * Wrap memory content in a `<user_memory>` block. This is the **variable tail** of the system prompt
  * (per-user, scoped, timestamped) — the default prompt provider places it LAST so the stable base

package/dist/core/memory.js

@@ -1,7 +1,8 @@
 import { uuidv7 } from "../internal/harness.js";
 import { parseScopeKey } from "./memory-engine/scope-contract.js";
 import { termSet } from "./memory-vector.js";
-import { sanitizeUntrustedText } from "./untrusted-text.js";
+import { attrEscape } from "./task-notification.js";
+import { sanitizeUntrustedText, ENGINE_AUTHORITY_ENVELOPE_TAGS } from "./untrusted-text.js";
 export function supportsConsolidation(store) {
     return (typeof store.searchScored === "function" &&
         typeof store.update === "function" &&
@@ -402,6 +403,7 @@ export function normalizeMemorySpec(input) {
 }
 export const MAX_MEMORY_BYTES = 100 * 1024;
 export const MEMORY_WRAPPER_TAGS = ["user_memory"];
+export const MEMORY_INJECTION_TAGS = [...ENGINE_AUTHORITY_ENVELOPE_TAGS];
 export function composeMemoryBlock(content, scope) {
     const trimmed = (content ?? "").trim();
     if (!trimmed) {
@@ -418,7 +420,7 @@ export function composeMemoryBlock(content, scope) {
         const head = buf.subarray(0, cut).toString("utf8");
         payload = `${head}\n<truncated bytes=${bytes - cut}>`;
     }
-    return `<user_memory scope="${scope}">\n${sanitizeUntrustedText(payload, [...MEMORY_WRAPPER_TAGS])}\n</user_memory>`;
+    return `<user_memory scope="${attrEscape(scope)}">\n${sanitizeUntrustedText(payload, [...MEMORY_INJECTION_TAGS])}\n</user_memory>`;
 }
 export function composeLayeredMemoryBlock(layers) {
     const sections = [];
@@ -435,8 +437,8 @@ export function composeLayeredMemoryBlock(layers) {
                 cut--;
             payload = `${buf.subarray(0, cut).toString("utf8")}\n<truncated bytes=${bytes - cut}>`;
         }
-        sections.push(`<scope name="${sanitizeUntrustedText(layer.scope, [...MEMORY_WRAPPER_TAGS])}">\n` +
-            `${sanitizeUntrustedText(payload, [...MEMORY_WRAPPER_TAGS])}\n` +
+        sections.push(`<scope name="${attrEscape(layer.scope)}">\n` +
+            `${sanitizeUntrustedText(payload, [...MEMORY_INJECTION_TAGS])}\n` +
             `</scope>`);
     }
     if (sections.length === 0)

package/dist/core/permission-rules.d.ts

@@ -104,6 +104,28 @@ export declare function parsePermissionRule(rule: string): ParsedPermissionRule;
  * anchored `^…$`+dotAll construction: every non-`*` char is literal, `*` spans anything incl. newlines).
  */
 export declare function wildcardMatch(pattern: string, value: string): boolean;
+/**
+ * Does an MCP-namespaced RULE name cover `toolName`? — the tail branch of CC's rule matcher `VRp`
+ * (:595780), which is UNCONDITIONAL there (its `globMatching` option gates only the whole-name glob
+ * branch, so CC's allow lane — `mVo` :595803, which passes no options — matches MCP segments too).
+ * Three covering forms, matching CC's three disjuncts:
+ *   · `mcp__<server>`           — every tool of that server (rule tool segment absent);
+ *   · `mcp__<server>__*`        — the same set, spelled with the star CC's own settings validator
+ *                                 recommends (`"MCP rules do not support patterns in parentheses …
+ *                                 use mcp__srv__*"`);
+ *   · `mcp__<server>__get_*`    — a glob over the tool segment.
+ * A LITERAL tool segment is deliberately NOT covered here: it is an exact tool name, and the exact
+ * table already answers it — the same split CC makes with its leading `ruleName === toolName`.
+ *
+ * Server segments compare EXACTLY (CC `s.serverName === a.serverName`). A rule must therefore spell
+ * the server the way the mint does; that is the same string an operator reads off any mounted tool
+ * name, and inventing a fuzzier comparison here would let one rule reach a server it does not name.
+ */
+export declare function mcpRuleNameCovers(ruleName: string, toolName: string): boolean;
+/** True ⇔ this rule name is an MCP name whose reach is a SET of tools rather than one exact tool —
+ *  i.e. the shapes {@link mcpRuleNameCovers} answers and an exact name table cannot. Every lane that
+ *  keys rules by exact tool name needs this to know which of its entries it must NOT key that way. */
+export declare function isMcpCoveringRuleName(name: string): boolean;
 /** Exported for the lockstep guard only (see {@link FILE_TOOL_PARAMS}) — not part of the rule DSL. */
 export declare const fileToolParamVocabulary: (canonicalTool: string) => ReadonlySet<string> | undefined;
 /** Dry-run 校验/迁移报告(codex 127 审 B5):不 throw,返回全部 issues(含 `unsupported.*` 分类,

package/dist/core/permission-rules.js

@@ -77,6 +77,33 @@ export function wildcardMatch(pattern, value) {
         p++;
     return p === pattern.length;
 }
+function parseMcpRuleName(name) {
+    if (!name.startsWith(MCP_NAMESPACE.prefix))
+        return undefined;
+    const segments = name.slice(MCP_NAMESPACE.prefix.length).split("__");
+    const server = segments[0];
+    if (server === undefined || server === "")
+        return undefined;
+    const rest = segments.slice(1);
+    return rest.length > 0 ? { server, tool: rest.join("__") } : { server };
+}
+export function mcpRuleNameCovers(ruleName, toolName) {
+    const rule = parseMcpRuleName(ruleName);
+    if (rule === undefined)
+        return false;
+    const target = parseMcpRuleName(toolName);
+    if (target === undefined)
+        return false;
+    if (rule.server !== target.server)
+        return false;
+    if (rule.tool === undefined || rule.tool === "*")
+        return true;
+    return target.tool !== undefined && rule.tool.includes("*") && wildcardMatch(rule.tool, target.tool);
+}
+export function isMcpCoveringRuleName(name) {
+    const parsed = parseMcpRuleName(name);
+    return parsed !== undefined && (parsed.tool === undefined || parsed.tool.includes("*"));
+}
 const PRIMARY_FIELDS = {
     Bash: new Set(["command"]),
     Read: new Set(["file_path", "path"]),
@@ -111,12 +138,13 @@ function countStars(s) {
 }
 function compile(rules, caps, primaryFieldGeneric, bashPrefixLane = "reject") {
     const byTool = new Map();
+    const mcpCovering = { deny: [], ask: [], allow: [] };
     const issues = [];
     const bad = (rule, code, message) => {
         issues.push({ rule, code, message });
     };
     if (rules.length > caps.maxRules) {
-        return { byTool, issues: [{ rule: "", code: "invalid.cap_exceeded", message: `${rules.length} rules > maxRules ${caps.maxRules}` }] };
+        return { byTool, mcpCovering, issues: [{ rule: "", code: "invalid.cap_exceeded", message: `${rules.length} rules > maxRules ${caps.maxRules}` }] };
     }
     for (const r of rules) {
         const text = r.rule;
@@ -149,6 +177,10 @@ function compile(rules, caps, primaryFieldGeneric, bashPrefixLane = "reject") {
         }
         const entry = byTool.get(toolName) ?? { bare: {}, param: { deny: [], ask: [] } };
         if (parsed.ruleContent === undefined) {
+            if (isMcpCoveringRuleName(toolName)) {
+                mcpCovering[r.behavior].push({ ruleName: toolName, ruleText: text, ...(r.source !== undefined ? { source: r.source } : {}) });
+                continue;
+            }
             entry.bare[r.behavior] = { ruleText: text, source: r.source };
             byTool.set(toolName, entry);
             continue;
@@ -206,7 +238,7 @@ function compile(rules, caps, primaryFieldGeneric, bashPrefixLane = "reject") {
         entry.param[r.behavior].push({ param, pattern, behavior: r.behavior, ruleText: text, source: r.source });
         byTool.set(toolName, entry);
     }
-    return { byTool, issues };
+    return { byTool, mcpCovering, issues };
 }
 export function validatePermissionRules(rules, opts) {
     const caps = { ...DEFAULT_CAPS, ...opts?.caps };
@@ -240,7 +272,7 @@ function ruleMessage(kind, ruleText, source) {
 }
 export function createPermissionRulePolicy(rules, opts) {
     const caps = { ...DEFAULT_CAPS, ...opts?.caps };
-    const { byTool, issues } = compile(rules, caps, opts?.primaryFieldGeneric ?? "reject", opts?.bashPrefixLane ?? "reject");
+    const { byTool, mcpCovering, issues } = compile(rules, caps, opts?.primaryFieldGeneric ?? "reject", opts?.bashPrefixLane ?? "reject");
     const setLevelCap = issues.some((i) => i.code === "invalid.cap_exceeded" && i.rule === "");
     if (issues.length > 0 && ((opts?.onInvalidRule ?? "throw") === "throw" || setLevelCap)) {
         const e = new Error(`createPermissionRulePolicy: ${issues.length} invalid/unsupported rule(s):\n` +
@@ -274,14 +306,26 @@ export function createPermissionRulePolicy(rules, opts) {
         if (entry.bare.allow !== undefined)
             nameSets.allow.push(toolName);
     }
+    for (const behavior of ["deny", "ask", "allow"]) {
+        for (const r of mcpCovering[behavior])
+            nameSets[behavior].push(r.ruleName);
+    }
+    const coveringHit = (lane, toolName) => lane.length === 0 ? undefined : lane.find((r) => mcpRuleNameCovers(r.ruleName, toolName));
+    const hasCovering = mcpCovering.deny.length > 0 || mcpCovering.ask.length > 0 || mcpCovering.allow.length > 0;
     return {
         nameSets: [nameSets],
         check(req) {
             const entry = byTool.get(req.toolName);
+            const covering = hasCovering && req.toolName.startsWith(MCP_NAMESPACE.prefix);
+            if (entry?.bare.deny) {
+                return { action: "deny", message: ruleMessage("denied", entry.bare.deny.ruleText, entry.bare.deny.source) };
+            }
+            if (covering) {
+                const mcpDeny = coveringHit(mcpCovering.deny, req.toolName);
+                if (mcpDeny)
+                    return { action: "deny", message: ruleMessage("denied", mcpDeny.ruleText, mcpDeny.source) };
+            }
             if (entry) {
-                if (entry.bare.deny) {
-                    return { action: "deny", message: ruleMessage("denied", entry.bare.deny.ruleText, entry.bare.deny.source) };
-                }
                 const paramDeny = matchParamRules(entry.param.deny, req.args, caps.maxScalarValueChars);
                 if (paramDeny) {
                     return { action: "deny", message: ruleMessage("denied", paramDeny.ruleText, paramDeny.source) };
@@ -289,6 +333,13 @@ export function createPermissionRulePolicy(rules, opts) {
                 if (entry.bare.ask) {
                     return { action: "ask", message: ruleMessage("flagged", entry.bare.ask.ruleText, entry.bare.ask.source), matchedAskRule: entry.bare.ask.ruleText };
                 }
+            }
+            if (covering) {
+                const mcpAsk = coveringHit(mcpCovering.ask, req.toolName);
+                if (mcpAsk)
+                    return { action: "ask", message: ruleMessage("flagged", mcpAsk.ruleText, mcpAsk.source), matchedAskRule: mcpAsk.ruleText };
+            }
+            if (entry) {
                 const paramAsk = matchParamRules(entry.param.ask, req.args, caps.maxScalarValueChars);
                 if (paramAsk) {
                     return { action: "ask", message: ruleMessage("flagged", paramAsk.ruleText, paramAsk.source), matchedAskRule: paramAsk.ruleText };
@@ -297,6 +348,9 @@ export function createPermissionRulePolicy(rules, opts) {
                     return { action: "allow" };
                 }
             }
+            if (covering && coveringHit(mcpCovering.allow, req.toolName)) {
+                return { action: "allow" };
+            }
             if (defaultAction === "allow")
                 return { action: "allow" };
             return { action: defaultAction, message: `no permission rule matched "${req.toolName}" (default-${defaultAction} rule set)` };