@sema-agent/core 5.60.0 → 5.60.1

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## 5.60.1 — 2026-08-25
+
+### Fixed
+- **Resume-leg usage-governance holes (#449, P0/P1)**: a resume no longer burns a full model turn
+  when the usage window is exhausted — an owed row (approval/review decision, wake, parked steer,
+  bg snapshot) refuses PRE-CAS with the new `resume.usage_window_exhausted` CheckpointError
+  (`detail.retryAfterMs`; the row stays pending, zero consumption, the same token redeems after the
+  window); a bare resource_limit continue re-suspends at turn 0 through the same platform-limit leg
+  the turn boundary uses (fresh checkpoint, new `resumeAfterMs`, zero model calls). The resume
+  ledger key now falls back to the checkpoint-pinned principal (`resource_limit` mints stamp
+  `cp.principal`) — a caller that omits principal no longer silently charges the GLOBAL bucket and
+  collects a fresh quota; supplying a DIFFERENT principal refuses loudly
+  (`resume.principal_mismatch`, pre-CAS, row pending). NARROWING, named: mismatched-principal
+  resumes previously proceeded under the wrong identity.
+- **covering-ask audit arm (#450, core half)**: the prepare-time policy-name audit gains ask-slot
+  coverage pins (the exemption for `mcp__<server>__*` spellings now proves it speaks the truth
+  against a live in-engine ask lane); `isNamespacedCoveringRuleName`/`namespacedRuleNameCovers`
+  root-exported (additive) so out-of-engine name-set publishers can self-check the covering grammar
+  (the fifth-publisher fail-open shape stays pinned as-is until the server-side consumer lands its
+  fix). Export surface 1758 → 1760.
+
 ## 5.60.0 — 2026-08-25
 
 ### Added

package/dist/core/checkpoint-store.d.ts

@@ -1263,7 +1263,7 @@ export declare const FACE_CHECKPOINT_VERSION = 9;
  *  (binding human/irreversible_ask), v4 (a pre-164 row, refused only when it carries the retired
  *  wall-clock allocation), v5 (token-allocation-bearing resource/approval), v6 (org-admission freeze
  *  state), v7 (F-012 constraint-chain / delegation-provenance enforcement state), v8 (a
- *  non-budgetable `realApproval` gate bit with its org-origin resume semantics) and v9 (the
+ *  non-budgetable `realApproval` gate bit with its org-origin resume semantics), v9 (the
  *  design/199 read-face section: resolved face + deny-set additions, folded stricter-wins on
  *  resume). */
 export declare const MAX_SUPPORTED_CHECKPOINT_VERSION = 9;
@@ -1551,11 +1551,21 @@ export interface Checkpoint {
     sourceTaskId?: string;
     /**
      * design S1d (source-tag persistence): the issuing task's authenticated end-user {@link
-     * import("./types.js").TaskSpec.principal} (design/62), stamped at the APPROVAL suspend mint so an aggregating
-     * inbox can attribute a paused checkpoint per-user — the durable analog of {@link
-     * import("./tool-policy.js").AskRequest}.principal. Caller-set (never a tool/worker arg), and like
-     * {@link sourceTaskId} it is **ECHO-ONLY triage metadata, NEVER a gate input** (no gate/CAS/winner/resume path
-     * reads it). Absent ⇒ no principal (a non-ask gate, an unauthenticated task, or a legacy checkpoint).
+     * import("./types.js").TaskSpec.principal} (design/62), stamped at the APPROVAL suspend mint — and, since
+     * #449 G2, at the `resource_limit` mint too — so an aggregating inbox can attribute a paused checkpoint
+     * per-user — the durable analog of {@link import("./tool-policy.js").AskRequest}.principal. Caller-set
+     * (never a tool/worker arg), and like {@link sourceTaskId} it is **NEVER a gate input**: no gate / CAS /
+     * winner path reads it. The RESUME ENTRY however does read it as the row's identity record (#449 G2):
+     * a resume config that omits `principal` inherits this value for the resumed leg (usage-ledger bucket,
+     * later mints' scope derivation, ask attribution — a dropped field must not silently move the leg onto
+     * the SHARED usage bucket), and a resume config carrying a DIFFERENT non-empty principal is refused
+     * pre-CAS (`resume.principal_mismatch`). Absent ⇒ no principal (a legacy checkpoint, an unauthenticated
+     * task, or a gate kind that predates the stamp). Rolling-deployment note (#449 G2 residual): the field
+     * is NOT version-gated — an older worker accepts a principal-bearing row and keeps its historic
+     * behavior (no fallback, no mismatch refusal); the identity-continuity guarantee holds once the fleet
+     * is on enforcing workers. Version-gating it is a recorded design candidate: the lattice's newest rung
+     * (design/199) encodes "v>=9 ⟺ face section present", so ANY new version above it must rewrite that
+     * guard's window form and add its own presence invariant — a lattice-wide change, not a stamp.
      */
     principal?: string;
     /**
@@ -1812,6 +1822,23 @@ export declare class CheckpointError extends Error {
      *  thinner (or different) ancestor chain than it suspended with. Rejected pre-CAS (the checkpoint
      *  stays `pending`); re-resume with the full original chain. */
      | "resume.parent_constraint_mismatch"
+    /** #449 G1 (codex r2, pre-CAS entrance): a deployment usage-governance window for this resume's
+     *  ledger key (the config's principal, else the row's recorded one, else the shared bucket) is
+     *  EXHAUSTED, and the row still OWES a delivery a re-mint cannot carry (an approval/review
+     *  decision, a wake, parked steers, a background-task obituary snapshot). Refused BEFORE the CAS,
+     *  so nothing is consumed and nothing is unpinned — the SAME token with the SAME decision is
+     *  redeemable once the window frees (`detail.retryAfterMs` carries the wait). A bare
+     *  `resource_limit` continue with nothing parked does NOT take this refusal: it proceeds and
+     *  re-suspends at turn 0 into a FRESH checkpoint carrying the new wait hint. */
+     | "resume.usage_window_exhausted"
+    /** #449 G2 (identity continuity): the resume config carries a NON-EMPTY `principal` that differs from
+     *  the {@link Checkpoint.principal} recorded at the suspend mint. `ResumeTaskConfig`'s contract is
+     *  "the same TaskSpec the run suspended with", and the principal keys real lanes on the resumed leg
+     *  (the usage-governance ledger bucket, later mints' scope derivation, session-rule reads, ask
+     *  attribution) — silently running the leg under a different identity is the bad-value direction this
+     *  refusal exists to close. Rejected PRE-CAS (the checkpoint stays `pending`); re-resume with the
+     *  original principal, or omit the field to inherit the recorded one. */
+     | "resume.principal_mismatch"
     /** F-012 L3: the resume carried an approver EDIT (`updatedInput`) and a FROZEN inherited ancestor
      *  constraint (the persisted projection chain) — or the deployment's resume-edit policy — DENIES the
      *  edited args. Refused PRE-CAS with fresh-redecision semantics: the checkpoint stays `pending` and
@@ -1839,6 +1866,9 @@ export declare class CheckpointError extends Error {
      *  discriminant. */
     readonly detail?: {
         field?: "boundCallId" | "boundInputHash" | "answer" | "settledBy" | "approver";
+        /** #449 G1 — on `resume.usage_window_exhausted` ONLY: how long until the binding window frees
+         *  (the same wait a suspended row carries as `gate.resumeAfterMs`). Absent on every other code. */
+        retryAfterMs?: number;
         /** WHICH pre-CAS refusal arm fired, where one `code` covers several (requested 2026-08-10: a
          *  deployment retry policy needs to tell "a newer worker can redeem this row" from "this row is
          *  damaged/caller-declared and no worker ever will" — blanket-retriable and gate-shape heuristics were
@@ -1941,6 +1971,23 @@ export declare class CheckpointError extends Error {
      *  thinner (or different) ancestor chain than it suspended with. Rejected pre-CAS (the checkpoint
      *  stays `pending`); re-resume with the full original chain. */
      | "resume.parent_constraint_mismatch"
+    /** #449 G1 (codex r2, pre-CAS entrance): a deployment usage-governance window for this resume's
+     *  ledger key (the config's principal, else the row's recorded one, else the shared bucket) is
+     *  EXHAUSTED, and the row still OWES a delivery a re-mint cannot carry (an approval/review
+     *  decision, a wake, parked steers, a background-task obituary snapshot). Refused BEFORE the CAS,
+     *  so nothing is consumed and nothing is unpinned — the SAME token with the SAME decision is
+     *  redeemable once the window frees (`detail.retryAfterMs` carries the wait). A bare
+     *  `resource_limit` continue with nothing parked does NOT take this refusal: it proceeds and
+     *  re-suspends at turn 0 into a FRESH checkpoint carrying the new wait hint. */
+     | "resume.usage_window_exhausted"
+    /** #449 G2 (identity continuity): the resume config carries a NON-EMPTY `principal` that differs from
+     *  the {@link Checkpoint.principal} recorded at the suspend mint. `ResumeTaskConfig`'s contract is
+     *  "the same TaskSpec the run suspended with", and the principal keys real lanes on the resumed leg
+     *  (the usage-governance ledger bucket, later mints' scope derivation, session-rule reads, ask
+     *  attribution) — silently running the leg under a different identity is the bad-value direction this
+     *  refusal exists to close. Rejected PRE-CAS (the checkpoint stays `pending`); re-resume with the
+     *  original principal, or omit the field to inherit the recorded one. */
+     | "resume.principal_mismatch"
     /** F-012 L3: the resume carried an approver EDIT (`updatedInput`) and a FROZEN inherited ancestor
      *  constraint (the persisted projection chain) — or the deployment's resume-edit policy — DENIES the
      *  edited args. Refused PRE-CAS with fresh-redecision semantics: the checkpoint stays `pending` and
@@ -1968,6 +2015,9 @@ export declare class CheckpointError extends Error {
      *  discriminant. */
     detail?: {
         field?: "boundCallId" | "boundInputHash" | "answer" | "settledBy" | "approver";
+        /** #449 G1 — on `resume.usage_window_exhausted` ONLY: how long until the binding window frees
+         *  (the same wait a suspended row carries as `gate.resumeAfterMs`). Absent on every other code. */
+        retryAfterMs?: number;
         /** WHICH pre-CAS refusal arm fired, where one `code` covers several (requested 2026-08-10: a
          *  deployment retry policy needs to tell "a newer worker can redeem this row" from "this row is
          *  damaged/caller-declared and no worker ever will" — blanket-retriable and gate-shape heuristics were

package/dist/core/mcp.d.ts

@@ -177,11 +177,10 @@ export interface MaterializedMcp {
      * fails the WHOLE model request (provider 400), bricking the task for every healthy tool
      * (CC 2.1.216 ships the same intake prune, `tengu_mcp_drop_invalid_tool_schemas`).
      *
-     * HONEST REACH (pinned in mcp-dropped-tools.test.ts): with the bundled TS MCP SDK, a string-root
-     * schema already fails the SDK client's OWN zod at `listTools` — the whole server is skipped
-     * (warnings face) and this gate never sees the listing, losing healthy sibling tools with it
-     * (SDK-upstream failure mode, recorded). This per-tool gate is DEFENSE IN DEPTH: it binds when a
-     * transport/SDK revision delivers schemas the client does not fully validate.
+     * HONEST REACH (pinned in mcp-dropped-tools.test.ts): listings arrive through the lenient reader
+     * (`listToolsLenient` — raw request, no SDK-client zod pass), so a string-root or otherwise odd
+     * schema DOES reach this gate and is judged per tool; healthy siblings survive. This per-tool gate
+     * is therefore the PRIMARY adjudicator for schema shape, not a fallback behind SDK validation.
      *
      * The drop is NEVER silent, two faces (CC parity — its `mcp_dropped_tools_delta` system reminder):
      * - operator: prepare-task forwards each entry to `onError(phase:"mcp")` alongside `warnings`;

package/dist/core/memory-engine/engine.d.ts

@@ -406,12 +406,11 @@ export declare function memorySessionPollutedNotice(input: {
  * arithmetic would report a clean containment while a known failure sat in the report. Every
  * not-moved file does have an escalation row, so `escalated` is the superset and the honest clause.
  *
- * KNOWN GAP (adversarial-review round 1, P2 — registered, not closed here): the derived index is
- * contained by a different path (`restorePollutedIndex` captures and restores `MEMORY.md`) that mints
- * no rejection row, so a polluted session whose ONLY memory change was an index line produces no
- * `count` and no notice — its containment is disclosed by the harvest report's warnings alone. Closing
- * it needs a structured containment signal on `HarvestReport`, a public type this fix does not touch.
- * The wording therefore says "entry file(s)" rather than implying the whole containment.
+ * The derived index is contained by a different path (`restorePollutedIndex` captures and restores
+ * `MEMORY.md`) that mints no rejection row; that gap was CLOSED by the structured containment signal
+ * on `HarvestReport.containment` (indexRolledBack — see the containment block below), so an
+ * index-only polluted session now signals and notices instead of hiding in warnings prose. The
+ * wording says "entry file(s)" because index containment reports through its own signal.
  *
  * `reason` is optional because the mark record is read separately from the report: a record that cannot
  * be read must not turn a true "N files were withheld" into a lie about why.

package/dist/core/runner/prepare-task.js

@@ -3965,6 +3965,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         : undefined,
                     resourceLedger: resourceLedgerOut,
                     ...(spec.durableApproval !== undefined ? { durableApproval: { ...spec.durableApproval } } : {}),
+                    ...(spec.principal ? { principal: spec.principal } : {}),
                 };
                 if (!(await commitSuspendSaga(token, cp, suspendableEnv, remoteHandle)).ok)
                     return false;

package/dist/core/runner/runtask.js

@@ -1,6 +1,7 @@
 import { persistedReadDenyEntryProblem } from "../../tools/fs/read-deny.js";
 import { createSafeNotifier, observeThenableRejection } from "../safe-notify.js";
 import { mintSystemReminder, openSystemReminder } from "../reminder-mint.js";
+import { GLOBAL_USAGE_KEY, resolveUsageWindows, usageRetryAfterMs } from "../usage-window-store.js";
 import { deliverDelegationLifecycle, deliverEngineNotice, undrainedUserInputNotices } from "../types.js";
 import { planRejectionClears, resolveTriggerWindow } from "../context-edit.js";
 import { AgentHarness, DEFAULT_COMPACTION_SETTINGS, uuidv7 } from "../../internal/harness.js";
@@ -344,9 +345,11 @@ export async function raceUntilDeadline(p, deadline) {
 function platformLimitTerminal(reason, retryAfterMs, moment = "turn_boundary") {
     const message = moment === "entry"
         ? `a deployment usage window is exhausted (RunnerDeps.usageWindows), so the task was refused before its first model call — nothing ran and nothing was spent. There is no checkpoint to suspend into at this point, so the caller re-submits after the window frees, in ${String(retryAfterMs ?? 0)}ms.`
-        : reason === "env_lifetime"
-            ? "the execution environment's declared lifetime is expiring and the run could not be suspended durably (not eligible, or the suspend was refused — see remoteEnvFailures / onError). It was stopped at a clean turn boundary instead of being killed mid-turn when the platform reclaims the environment."
-            : `a deployment usage window is exhausted (RunnerDeps.usageWindows) and the run could not be suspended durably, so it was stopped at a clean turn boundary. The window frees in ${String(retryAfterMs ?? 0)}ms.`;
+        : moment === "resume"
+            ? `a deployment usage window is exhausted (RunnerDeps.usageWindows), so the resumed leg was stopped BEFORE its first model call — nothing was delivered or executed on this leg. The window frees in ${String(retryAfterMs ?? 0)}ms.`
+            : reason === "env_lifetime"
+                ? "the execution environment's declared lifetime is expiring and the run could not be suspended durably (not eligible, or the suspend was refused — see remoteEnvFailures / onError). It was stopped at a clean turn boundary instead of being killed mid-turn when the platform reclaims the environment."
+                : `a deployment usage window is exhausted (RunnerDeps.usageWindows) and the run could not be suspended durably, so it was stopped at a clean turn boundary. The window frees in ${String(retryAfterMs ?? 0)}ms.`;
     const e = new Error(message);
     e.code = reason === "env_lifetime" ? "env.lifetime_expired" : "usage.window_exhausted";
     if (retryAfterMs !== undefined)
@@ -3186,7 +3189,29 @@ export class Runner {
             }
             if (resume) {
                 const walltimeExhaustedResume = effectiveTimeoutMs !== undefined && effectiveTimeoutMs <= 0;
-                if (!walltimeExhaustedResume && resume.outcome.gate !== "wake") {
+                const resumeWindowRetryAfterMs = !walltimeExhaustedResume && prepared.usageGovernance !== undefined ? await prepared.usageGovernance.check(Date.now()) : undefined;
+                if (resumeWindowRetryAfterMs !== undefined) {
+                    const owesNothing = resume.outcome.gate === "resource_limit" &&
+                        readPendingSteerQueue(resume.cp.state).length === 0 &&
+                        (resume.cp.state.runningBackgroundTasks?.length ?? 0) === 0;
+                    const committed = owesNothing &&
+                        prepared.suspendForPlatformLimit !== undefined &&
+                        (await prepared.suspendForPlatformLimit("usage_window", { costMicroUsd: 0, tokens: 0, turns: 0, walltimeMs: Math.round(performance.now() - rs.telemetry.taskStartMonotonic) }, { resumeAfterMs: resumeWindowRetryAfterMs }));
+                    if (committed) {
+                        rs.limits.turnsExceeded = false;
+                        rs.limits.budgetHit = undefined;
+                    }
+                    else {
+                        const terminal = platformLimitTerminal("usage_window", resumeWindowRetryAfterMs, "resume");
+                        rs.limits.platformTerminal = terminal;
+                        try {
+                            this.deps.onError?.(terminal, { phase: "config", sessionId: prepared.sessionId });
+                        }
+                        catch {
+                        }
+                    }
+                }
+                if (resumeWindowRetryAfterMs === undefined && !walltimeExhaustedResume && resume.outcome.gate !== "wake") {
                     await this.applyResumeDecision(prepared, resume, (e) => pushContent({ ...e, ...ident() }), emitCommitted, (toolName, details) => {
                         if (rs.attach.attachState === undefined)
                             return;
@@ -3205,7 +3230,9 @@ export class Runner {
                         resume.decisionDelivered = true;
                     announceWorkspaceMove();
                 }
-                if (walltimeExhaustedResume) {
+                if (resumeWindowRetryAfterMs !== undefined) {
+                }
+                else if (walltimeExhaustedResume) {
                     timeout.fired = true;
                     timeout.clear();
                     void prepared.harness.abort();
@@ -4455,6 +4482,29 @@ export class Runner {
             throw new CheckpointError("checkpoint.invalid_outcome", "TaskSpec.basePolicyForResumeEdit is administratively locked by this deployment (locked key \"toolPolicy\") — a task-supplied " +
                 "resume-edit policy is refused pre-CAS (the checkpoint stays pending); remove the field or change the deployment's lock configuration");
         }
+        {
+            const rowPrincipal = cp.principal || undefined;
+            const suppliedPrincipal = taskConfig.principal || undefined;
+            if (rowPrincipal !== undefined && suppliedPrincipal !== undefined && suppliedPrincipal !== rowPrincipal) {
+                throw new CheckpointError("resume.principal_mismatch", `the resume config carries principal ${JSON.stringify(suppliedPrincipal)} but this checkpoint was suspended under principal ${JSON.stringify(rowPrincipal)} — ` +
+                    "running the resumed leg under a different identity would move its usage-ledger bucket, scope derivation and attribution; " +
+                    "refused pre-CAS (the checkpoint stays pending): re-resume with the original principal, or omit the field to inherit the recorded one");
+            }
+            const owesDelivery = outcomeGate !== "resource_limit" ||
+                readPendingSteerQueue(cp.state).length > 0 ||
+                (cp.state.runningBackgroundTasks?.length ?? 0) > 0;
+            if (owesDelivery && this.deps.usageWindowStore !== undefined) {
+                const preCasWindows = resolveUsageWindows(this.deps.usageWindows);
+                if (preCasWindows !== undefined && preCasWindows.length > 0) {
+                    const ledgerKey = (suppliedPrincipal ?? rowPrincipal) || GLOBAL_USAGE_KEY;
+                    const wait = usageRetryAfterMs(await this.deps.usageWindowStore.read(ledgerKey, preCasWindows, Date.now()));
+                    if (wait !== undefined) {
+                        throw new CheckpointError("resume.usage_window_exhausted", `a deployment usage window for ledger key ${JSON.stringify(ledgerKey)} is exhausted, and this checkpoint still owes a delivery a re-mint cannot carry — ` +
+                            `refused pre-CAS (nothing consumed, nothing unpinned): the same token and the same decision are redeemable once the window frees, in ${String(wait)}ms`, { retryAfterMs: wait });
+                    }
+                }
+            }
+        }
         if (plainPolicyOutcome !== undefined &&
             plainPolicyOutcome.decision === "allow" &&
             plainPolicyOutcome.updatedInput !== undefined &&
@@ -4571,6 +4621,7 @@ export class Runner {
             : undefined;
         const spec = {
             ...taskConfig,
+            ...((taskConfig.principal || undefined) === undefined && (cp.principal || undefined) !== undefined ? { principal: cp.principal } : {}),
             objective: "",
             sessionId: cp.sessionId,
             requireExistingSession: true,

package/dist/core/tool-policy.d.ts

@@ -413,8 +413,14 @@ export interface ToolPolicyProjection {
  *
  * Exported for the OTHER name-keyed lane in this engine — the persisted session/ancestor rules in
  * `session-rule-policy.ts`. Not part of the public API (`src/index.ts` re-exports by name and does not
- * list these): all four publishers of {@link ToolPolicyNameSets} must resolve a covering entry the same
- * way, because the prepare-time audit's exemption for these spellings speaks for all of them at once.
+ * list these two): every publisher of {@link ToolPolicyNameSets} must resolve a covering entry the same
+ * way, because the prepare-time audit's exemption for these spellings speaks for ALL published name sets
+ * at once — the four in-engine lanes do so by sharing this module's matcher. #450: that premise is NOT
+ * structural for an OUT-OF-ENGINE publisher (a host compiling its own settings into an exact-match ask
+ * closure is fail-open on these spellings while the audit stays silent) — which is why the underlying
+ * judgment predicates (`isNamespacedCoveringRuleName` / `namespacedRuleNameCovers`) ARE exported from
+ * the package index: an external lane either compiles through `createPermissionRulePolicy` or
+ * self-checks with those.
  */
 export declare function namespacedCoveringEntries(entries: readonly string[] | undefined): readonly string[];
 /** Does any covering entry reach `toolName`? See {@link namespacedCoveringEntries}. */

package/dist/index.d.ts

@@ -140,7 +140,7 @@ export { createAllowDenyPolicy, createApprovalPolicy, COARSE_SHELL_TOOLS, create
 export { parseAutoModeResponse, createAutoModeDecider, type AutoModeVerdict, type AutoModeDecider, type AutoModeDeciderOptions, type AutoModeClassifyFn, type AutoModeClassifyInput, } from "./core/auto-mode.js";
 export { buildAutoModePrompt, renderAutoModeWindow, renderAutoModeAction, AUTO_MODE_DEFAULTS_SENTINEL, type AutoModeRules, type BuildAutoModePromptOptions, type AutoModeWindowOptions, } from "./core/auto-mode-prompt.js";
 export { AUTO_MODE_BASE_PROMPT, AUTO_MODE_PERMISSIONS_EXTERNAL } from "./core/auto-mode-prompt-assets.js";
-export { createPermissionRulePolicy, validatePermissionRules, parsePermissionRule, wildcardMatch, type PermissionRule, type ParsedPermissionRule, type PermissionRuleIssue, type PermissionRuleCaps, type PermissionRulePolicyOptions, } from "./core/permission-rules.js";
+export { createPermissionRulePolicy, validatePermissionRules, parsePermissionRule, wildcardMatch, isNamespacedCoveringRuleName, namespacedRuleNameCovers, type PermissionRule, type ParsedPermissionRule, type PermissionRuleIssue, type PermissionRuleCaps, type PermissionRulePolicyOptions, } from "./core/permission-rules.js";
 /**
  * design/179 — persisted ALLOW rules: the standing form of approvals a person already gave.
  *

package/dist/index.js

@@ -117,7 +117,7 @@ export { createAllowDenyPolicy, createApprovalPolicy, COARSE_SHELL_TOOLS, create
 export { parseAutoModeResponse, createAutoModeDecider, } from "./core/auto-mode.js";
 export { buildAutoModePrompt, renderAutoModeWindow, renderAutoModeAction, AUTO_MODE_DEFAULTS_SENTINEL, } from "./core/auto-mode-prompt.js";
 export { AUTO_MODE_BASE_PROMPT, AUTO_MODE_PERMISSIONS_EXTERNAL } from "./core/auto-mode-prompt-assets.js";
-export { createPermissionRulePolicy, validatePermissionRules, parsePermissionRule, wildcardMatch, } from "./core/permission-rules.js";
+export { createPermissionRulePolicy, validatePermissionRules, parsePermissionRule, wildcardMatch, isNamespacedCoveringRuleName, namespacedRuleNameCovers, } from "./core/permission-rules.js";
 export { parseAllowRuleText, formatAllowRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, } from "./core/permission-rule-model.js";
 export { removePersistedRule, applyTombstones, sameScope, InMemoryPermissionRuleStore, EMPTY_RULE_STORE, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, PERMISSION_RULE_WRITER, writerOf, foldDelta, addDotsOf, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, } from "./core/permission-rule-store.js";
 export { syncPermissionRules, parseRuleSyncResponse, PERMISSION_RULE_SYNC_PATH, LOCAL_OWNER_UNSYNCABLE_CODE, } from "./core/permission-rule-sync.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "5.60.0",
+  "version": "5.60.1",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",

package/test/export-surface.snapshot.json

@@ -1,7 +1,7 @@
 {
   "_comment": "design/87 L3 — frozen public export surface of src/index.ts (name -> kind). DO NOT edit by hand to silence a red test. A removed/changed entry = a SemVer-BREAKING change; bump MAJOR and update this fixture in the SAME commit (design/87 §4.2 / §5.2). Regenerate via REGEN in test/export-surface.test.ts.",
   "_tierComment": "#435 v1 — machine-readable layering of the public surface: stable = demonstrated by README.md / src/examples; internal = an `Internal`-marked name or a runner/engine deep-subtree declaration (the model seam src/engine/llm is excluded — it is the BYOM contract, not an engine internal); advanced = a supported export the front door does not walk you through. THIS IS AN INITIAL HEURISTIC, derived mechanically and expected to be refined ticket by ticket: no human reviewed these 1700+ entries one by one, and nothing here claims otherwise. Known bias: a short or English-word export name (ok, err, Result, Usage) can match ordinary prose in README.md and land `stable` on a coincidence. Every export MUST carry a tier — a new export with no row fails the gate in export-surface.test.ts.",
-  "count": 1758,
+  "count": 1760,
   "exports": {
     "A2ATaskState": "type",
     "A2ATaskStateReversal": "type",
@@ -1463,6 +1463,7 @@
     "isInstructionEntry": "function",
     "isIsolated": "function",
     "isModelGatedForClass": "function",
+    "isNamespacedCoveringRuleName": "function",
     "isPersonalScope": "function",
     "isQuestionUnavailable": "function",
     "isRemoteExecutionEnv": "function",
@@ -1525,6 +1526,7 @@
     "missingRestoreSurface": "function",
     "modelCostToPricing": "function",
     "mysqlQuery": "function",
+    "namespacedRuleNameCovers": "function",
     "nextSyncBaseline": "function",
     "normalizeAgentName": "function",
     "normalizeBaseUrl": "function",
@@ -3223,6 +3225,7 @@
     "isInstructionEntry": "advanced",
     "isIsolated": "advanced",
     "isModelGatedForClass": "advanced",
+    "isNamespacedCoveringRuleName": "advanced",
     "isPersonalScope": "advanced",
     "isQuestionUnavailable": "advanced",
     "isRemoteExecutionEnv": "advanced",
@@ -3285,6 +3288,7 @@
     "missingRestoreSurface": "advanced",
     "modelCostToPricing": "advanced",
     "mysqlQuery": "advanced",
+    "namespacedRuleNameCovers": "advanced",
     "nextSyncBaseline": "advanced",
     "normalizeAgentName": "advanced",
     "normalizeBaseUrl": "advanced",