npm - @sema-agent/core - Versions diffs - 5.65.0 → 6.0.0 - Mend

@sema-agent/core 5.65.0 → 6.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (159) hide show

package/CHANGELOG.md +46 -0
package/dist/agents/subagent.d.ts +2 -2
package/dist/agents/subagent.js +11 -0
package/dist/agents/verify.d.ts +1 -1
package/dist/brain/anthropic.js +1 -1
package/dist/brain/errors.d.ts +29 -0
package/dist/brain/errors.js +20 -0
package/dist/brain/open-responses.js +2 -2
package/dist/brain/route-adjudicator.d.ts +8 -1
package/dist/brain/route-adjudicator.js +1 -0
package/dist/brain/status-sink.js +12 -1
package/dist/brain/stream-engine.js +17 -6
package/dist/core/auto-compaction.d.ts +26 -0
package/dist/core/auto-compaction.js +7 -2
package/dist/core/auto-mode-arming.d.ts +138 -0
package/dist/core/auto-mode-arming.js +181 -0
package/dist/core/auto-mode-defaults.d.ts +13 -0
package/dist/core/auto-mode-defaults.js +5 -0
package/dist/core/auto-mode-prompt.d.ts +14 -3
package/dist/core/auto-mode-prompt.js +10 -7
package/dist/core/auto-mode-rebuild.d.ts +75 -0
package/dist/core/auto-mode-rebuild.js +41 -0
package/dist/core/auto-mode.d.ts +15 -0
package/dist/core/auto-mode.js +4 -2
package/dist/core/checkpoint-store.d.ts +18 -0
package/dist/core/context-edit.d.ts +47 -5
package/dist/core/context-guard.d.ts +1 -1
package/dist/core/file-history-retention.d.ts +106 -0
package/dist/core/file-history-retention.js +36 -0
package/dist/core/file-history-store.d.ts +768 -0
package/dist/core/file-history-store.js +880 -0
package/dist/core/governance-codes.d.ts +2 -1
package/dist/core/governance-codes.js +14 -0
package/dist/core/hooks.d.ts +39 -7
package/dist/core/hooks.js +38 -21
package/dist/core/lsp.d.ts +2 -2
package/dist/core/mcp.d.ts +29 -7
package/dist/core/memory-engine/consolidation-driver.d.ts +11 -0
package/dist/core/memory-engine/consolidation-driver.js +71 -4
package/dist/core/memory-engine/consolidation.d.ts +25 -2
package/dist/core/memory-engine/consolidation.js +4 -1
package/dist/core/memory-engine/distiller.d.ts +84 -1
package/dist/core/memory-engine/distiller.js +68 -0
package/dist/core/memory-engine/dual-root.js +3 -0
package/dist/core/memory-engine/engine.d.ts +328 -15
package/dist/core/memory-engine/engine.js +355 -29
package/dist/core/memory-engine/file-backend.d.ts +30 -0
package/dist/core/memory-engine/file-backend.js +14 -13
package/dist/core/memory-engine/frontmatter.d.ts +22 -1
package/dist/core/memory-engine/frontmatter.js +3 -0
package/dist/core/memory-engine/header-hints.d.ts +5 -0
package/dist/core/memory-engine/index.d.ts +5 -4
package/dist/core/memory-engine/index.js +5 -4
package/dist/core/memory-engine/layout.d.ts +88 -2
package/dist/core/memory-engine/layout.js +112 -3
package/dist/core/memory-engine/provenance-wording.d.ts +7 -0
package/dist/core/memory-engine/provenance-wording.js +3 -0
package/dist/core/memory-engine/tools.d.ts +89 -8
package/dist/core/memory-engine/tools.js +263 -22
package/dist/core/memory-engine/types.d.ts +64 -1
package/dist/core/memory-recall.d.ts +6 -0
package/dist/core/memory.d.ts +27 -1
package/dist/core/memory.js +16 -2
package/dist/core/permission-rule-consent.d.ts +20 -0
package/dist/core/permission-rule-consent.js +12 -3
package/dist/core/permission-rule-model.d.ts +67 -7
package/dist/core/permission-rule-model.js +53 -7
package/dist/core/permission-rule-store.js +15 -10
package/dist/core/permission-rule-sync.js +15 -11
package/dist/core/retention-policy.d.ts +9 -0
package/dist/core/retention-policy.js +5 -2
package/dist/core/retention.d.ts +13 -2
package/dist/core/runner/assemble-result.d.ts +19 -1
package/dist/core/runner/assemble-result.js +17 -2
package/dist/core/runner/compaction-call-options.d.ts +93 -0
package/dist/core/runner/compaction-call-options.js +3 -0
package/dist/core/runner/memory-capture-optout.d.ts +80 -0
package/dist/core/runner/memory-capture-optout.js +53 -0
package/dist/core/runner/prepare-config-doors.d.ts +5 -0
package/dist/core/runner/prepare-config-doors.js +16 -0
package/dist/core/runner/prepare-hands-readface.d.ts +110 -5
package/dist/core/runner/prepare-hands-readface.js +99 -7
package/dist/core/runner/prepare-memory.d.ts +88 -0
package/dist/core/runner/prepare-memory.js +305 -24
package/dist/core/runner/prepare-task.d.ts +141 -1
package/dist/core/runner/prepare-task.js +443 -79
package/dist/core/runner/runtask.d.ts +9 -20
package/dist/core/runner/runtask.js +133 -96
package/dist/core/runner/session-file-state-replay.d.ts +18 -10
package/dist/core/runner/session-file-state-replay.js +52 -1
package/dist/core/runner/tool-disclosure.js +2 -1
package/dist/core/runner/turn-attachments.d.ts +22 -12
package/dist/core/session-store.d.ts +1 -1
package/dist/core/session-store.js +6 -1
package/dist/core/session.d.ts +34 -1
package/dist/core/store-contracts/file-history-store-contract.d.ts +3 -0
package/dist/core/store-contracts/file-history-store-contract.js +720 -0
package/dist/core/task-registry-shared.js +11 -1
package/dist/core/tool-errors.js +1 -0
package/dist/core/tool-policy.d.ts +172 -1
package/dist/core/tool-policy.js +32 -1
package/dist/core/tool-result-store.js +2 -1
package/dist/core/trace.d.ts +24 -0
package/dist/core/types.d.ts +784 -89
package/dist/core/types.js +4 -3
package/dist/core/untrusted-text.d.ts +1 -1
package/dist/core/untrusted-text.js +8 -0
package/dist/core/workflow-run-store-contract.js +6 -2
package/dist/core/workflow-run-store.d.ts +4 -1
package/dist/engine/compaction/compaction.d.ts +88 -10
package/dist/engine/compaction/compaction.js +109 -30
package/dist/engine/execution-env/node-execution-env.d.ts +9 -1
package/dist/engine/execution-env/node-execution-env.js +28 -0
package/dist/engine/harness/agent-harness.d.ts +52 -1
package/dist/engine/harness/agent-harness.js +36 -1
package/dist/engine/harness/types.d.ts +26 -1
package/dist/engine/llm/types.d.ts +50 -4
package/dist/engine/loop/agent-loop.d.ts +5 -1
package/dist/engine/loop/agent-loop.js +25 -0
package/dist/engine/loop/types.d.ts +19 -0
package/dist/engine/lsp/node-lsp-manager.d.ts +1 -1
package/dist/engine/session/session.js +1 -1
package/dist/index.d.ts +18 -8
package/dist/index.js +14 -6
package/dist/orchestration/run-workflow-tool.d.ts +20 -2
package/dist/orchestration/run-workflow-tool.js +22 -3
package/dist/orchestration/workflow-governance.d.ts +59 -1
package/dist/orchestration/workflow-governance.js +61 -8
package/dist/orchestration/workflow-meta.d.ts +4 -2
package/dist/orchestration/workflow-primitives.js +56 -13
package/dist/orchestration/workflow-types.d.ts +78 -2
package/dist/orchestration/workflow.d.ts +20 -0
package/dist/orchestration/workflow.js +163 -14
package/dist/prompt-assembly/event-registry.js +1 -1
package/dist/prompts/default.d.ts +7 -7
package/dist/stores/file/file-history-store.d.ts +368 -0
package/dist/stores/file/file-history-store.js +1248 -0
package/dist/stores/file/index.d.ts +22 -13
package/dist/stores/file/index.js +4 -4
package/dist/stores/file/permission-rule-store.js +1 -0
package/dist/stores/file/strategy-store.d.ts +3 -3
package/dist/tools/fs/bash-readonly-classifier.d.ts +87 -3
package/dist/tools/fs/bash-readonly-classifier.js +106 -4
package/dist/tools/fs/fs-bash.js +9 -5
package/dist/tools/fs/fs-shared.d.ts +52 -1
package/dist/tools/fs/fs-shared.js +14 -0
package/dist/tools/fs/fs-write.d.ts +5 -5
package/dist/tools/fs/fs-write.js +71 -14
package/dist/tools/fs/index.d.ts +6 -1
package/dist/tools/fs/index.js +1 -1
package/dist/tools/web.js +2 -1
package/package.json +5 -1
package/test/export-surface.snapshot.json +155 -23
package/dist/core/file-snapshot-store.d.ts +0 -165
package/dist/core/file-snapshot-store.js +0 -259
package/dist/core/store-contracts/file-snapshot-store-contract.d.ts +0 -13
package/dist/core/store-contracts/file-snapshot-store-contract.js +0 -134
package/dist/stores/file/file-snapshot-store.d.ts +0 -58
package/dist/stores/file/file-snapshot-store.js +0 -353

package/dist/core/permission-rule-consent.js CHANGED Viewed

@@ -1,5 +1,5 @@
 import { randomBytes } from "node:crypto";
-import { escapeForDisclosure, hasUnrenderableCharacters, parseAllowRuleText, ruleAdmitsCommand, segmentCoverageOf, suggestRulesForCommand, } from "./permission-rule-model.js";
+import { escapeForDisclosure, hasUnrenderableCharacters, parseAllowRuleText, ruleAdmitsCommand, segmentCoverageOf, suggestRulesForCommand, translateImportedWildcardRule, } from "./permission-rule-model.js";
 import { errText, sameRuleOwner, sameScope, writerOf } from "./permission-rule-store.js";
 export class InMemoryRuleApprovalRecordStore {
     rows = new Map();
@@ -538,6 +538,7 @@ export async function prepareCcImport(opts) {
     const owner = resolveCallerOwner(opts.principal, opts.owner, "prepareCcImport");
     const candidates = [];
     const skipped = [];
+    const translated = [];
     const layers = [];
     const denyAskBuckets = { deny: 0, ask: 0 };
     for (const layer of opts.layers) {
@@ -614,17 +615,25 @@ export async function prepareCcImport(opts) {
                 skipped.push({ rule: entry, reason });
                 continue;
             }
-            const parsed = parseAllowRuleText(entry);
+            const wildcard = translateImportedWildcardRule(entry);
+            if (wildcard !== undefined && "skip" in wildcard) {
+                skipped.push({ rule: entry, reason: wildcard.skip });
+                continue;
+            }
+            const text = wildcard?.rule ?? entry;
+            const parsed = parseAllowRuleText(text);
             if ("reject" in parsed) {
                 skipped.push({ rule: entry, reason: `${parsed.reject.code}: ${parsed.reject.message}` });
                 continue;
             }
             if (candidates.some((c) => c.rule === parsed.rule.rule && sameScope(c.scope, scope)))
                 continue;
+            if (wildcard !== undefined)
+                translated.push({ from: entry, to: parsed.rule.rule, scope });
             candidates.push({ rule: parsed.rule.rule, scope });
         }
     }
-    const preview = { candidates, skipped, layers, uncovered: { ...IMPORT_UNCOVERED_LAYERS, denyAskBuckets } };
+    const preview = { candidates, skipped, translated, layers, uncovered: { ...IMPORT_UNCOVERED_LAYERS, denyAskBuckets } };
     if (candidates.length === 0)
         return { preview };
     const record = {

package/dist/core/permission-rule-model.d.ts CHANGED Viewed

@@ -308,7 +308,7 @@ export declare function escapeForDisclosure(value: unknown): string;
  * transform is LOSSY and NOT injective (two distinct commands can render identically — that is the
  * price of a readable line). Correlate, match, store and adjudicate on the RAW bytes, which the
  * carrying seats keep unchanged: this function neither changes what those seats contain nor what any
- * of them means. A caller that must instead tell two hostile texts APART wants
+ * of them means. A caller that must instead tell two adversarial texts APART wants
  * {@link escapeForDisclosure} (which escapes rather than folds, so nothing collides) or
  * {@link hasUnrenderableCharacters} (refuse instead of render).
  *
@@ -348,6 +348,47 @@ export declare function parseAllowRuleText(text: string, opts?: {
 };
 /** The canonical spelling of a rule for a (already folded) command and match form. */
 export declare function formatAllowRuleText(command: string, match: PersistedRuleMatch): string;
+/**
+ * #490 件4 — read ANOTHER product's `Bash(<body> *)` SPACE-STAR spelling as this lane's colon-star
+ * prefix rule, for the IMPORT door only.
+ *
+ * Why a translation is owed at all: the other product mints its prefix suggestions in that spelling
+ * (its own classifier reads `X:*` as its earlier prefix form and anything else containing an unescaped star as
+ * a wildcard), so a person migrating settings had EVERY prefix rule they had ever approved refused as
+ * `unsupported.wildcard` — the import silently emptied out exactly the rules that were the point of it.
+ *
+ * Translated ONLY for the ONE spelling whose semantics this lane can state exactly: content ending in
+ * ` *` with that star the only unescaped one. Upstream compiles a single trailing ` *` into an
+ * OPTIONAL suffix (`^body( .*)?$`), which is precisely "the body, or the body followed by a space and
+ * more" — this lane's prefix predicate. Any other star placement compiles to a real glob with no rule
+ * form here, and a bare `*` is a whole-tool grant that must never become a command rule; both are
+ * refused with a reason of their own so the import can DISCLOSE them rather than drop them.
+ *
+ * WHAT THE TRANSLATED RULE GRANTS, against the source spelling, axis by axis (the direction matters,
+ * and it is one-way with one named exception): identical on the bare body, on body-plus-arguments, on
+ * the word boundary (`npm run` never reaches `npm run-x`) and on compounds (both sides refuse a chain
+ * against a single-command body). NARROWER here on four axes, because upstream normalizes the
+ * CANDIDATE before matching and this lane never does: a candidate carrying a redirection, wrapped in
+ * `timeout`/`nice`/`nohup`-style words, fed through `xargs`, or prefixed with a `VAR=value` assignment
+ * matches there and matches nothing here. WIDER on exactly one: this lane folds runs of whitespace on
+ * both sides, so `npm  run  build` matches the imported rule where upstream's wildcard arm (which does
+ * not fold) would refuse it. That axis is NOT introduced by this translation — whitespace folding is
+ * this lane's universal reading and already applies to every imported EXACT rule, against an upstream
+ * exact arm that is byte-strict — so it is disclosed as a lane property rather than treated as a
+ * translation defect. Every other difference runs toward granting less.
+ *
+ * Returns `undefined` when the text is not a Bash wildcard spelling at all (nothing to translate; the
+ * caller proceeds with the text as written), `{ rule }` with the spelling to parse INSTEAD, or
+ * `{ skip }` with the reason a star spelling has no form here. Never bypasses the validator: the
+ * returned text goes through {@link parseAllowRuleText} exactly like a hand-written one, so the
+ * interpreter-head refusal, the control-character screen and the length bound all still apply — a
+ * translated `Bash(node *)` is refused `invalid.bare_interpreter_prefix` just as a typed one is.
+ */
+export declare function translateImportedWildcardRule(text: string): {
+    rule: string;
+} | {
+    skip: string;
+} | undefined;
 /**
  * Does this rule's command pattern admit `command`?
  *
@@ -477,9 +518,20 @@ export declare function findAdmittingRule(rules: readonly PersistedAllowRule[],
 }): readonly PersistedAllowRule[] | undefined;
 /**
  * design/375 §5.2 — the per-segment coverage table for `command`: which segments an eligible rule
- * already admits, judged with the SAME split, the same MATCH reading and the same eligibility
- * predicates as the gate's conjunction arm — one instrument, so the suggestion face and the consent
- * prepare can never call a segment covered that the gate would ask about (or vice versa).
+ * already admits, judged with the SAME split and the same eligibility predicates as the gate's
+ * conjunction arm — one instrument, so the suggestion face and the consent prepare can never call a
+ * segment covered that the gate would ask about (or vice versa).
+ *
+ * The split is the OFFER reading ({@link OFFER_READING}, #490 修①), which is the MATCH reading on
+ * every axis but where a redirection is refused — this table exists to align, row for row, with
+ * {@link suggestRulesForCommand}'s own segmentation, and a table that stopped one command short of the
+ * face it aligns with is a table that face discards (its positional belt), leaving every segment
+ * reading UNCOVERED. Each ROW's verdict is still the matcher's, unchanged: `covered` is
+ * {@link ruleAdmitsCommand} under the MATCH reading, so a segment carrying a redirection is admitted
+ * by nothing and reports `false`. The gate's own conjunction arm keeps the whole-string floor and is
+ * not consulted here: for a redirection-bearing compound it has no segments at all, and this table
+ * saying "an eligible rule admits `npm test`" is a true statement about that segment either way — it
+ * is read only to keep an already-covered segment out of a batch offer, never as an admission.
  *
  * TWO SOURCES, two predicates, and the seat labels are the contract:
  *  · `persisted` — rules already in the store, judged {@link eligiblePersisted} ∧ admit: a tombstoned
@@ -632,9 +684,17 @@ export type RuleOffer = {
  * over-offering; every offered rule still passes the validator at redemption, so an over-offer widens
  * nothing).
  *
- * Returns an empty array for anything the rule lane cannot speak for (redirections, substitutions,
- * subshells, backgrounding) — the card then simply carries no "don't ask again" option, which is the
- * honest answer.
+ * Returns an empty array for anything the rule lane cannot speak for (substitutions, subshells,
+ * backgrounding, an unreadable segment) — the card then simply carries no "don't ask again" option,
+ * which is the honest answer.
+ *
+ * A REDIRECTION is the one member of that list judged per SEGMENT rather than over the whole string
+ * (#490 修①, {@link OFFER_READING}): `a && b 2>/dev/null && c` offers a batch for `a` and `c` with
+ * `uncoveredSegments: 1`, exactly as the same compound dirtied by a glob always has. A SIMPLE command
+ * carrying one still offers nothing — its only segment is the dirty one — and no offer this function
+ * mints ever admits the redirection-bearing text: the minting grammar and the matcher keep the
+ * whole-string floor, so the compound stays un-admitted and the honest `uncoveredSegments` count says
+ * so (design/382 §3.2: neither a sanitized rule text nor a widened matcher is on the table).
  */
 export declare function suggestRulesForCommand(command: string, ctx?: {
     readonly coverage?: readonly SegmentCoverage[];

package/dist/core/permission-rule-model.js CHANGED Viewed

@@ -1,5 +1,5 @@
 import { parsePermissionRule } from "./permission-rules.js";
-import { parseLeadingCommandName, splitShellCompoundSegments } from "../tools/fs/bash-readonly-classifier.js";
+import { carriesShellRedirection, parseLeadingCommandName, splitShellCompoundSegments } from "../tools/fs/bash-readonly-classifier.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 export const MAX_RULE_TEXT_CHARS = 512;
 export const BARE_INTERPRETER_NAMES = new Set([
@@ -117,17 +117,22 @@ function reject(code, message) {
     return { reject: { code, message } };
 }
 const RULE_LANE_FLOOR = { pathPrefixedNameIsText: true };
-const MATCH_READING = { terminator: "keep", quotedOperatorsAreText: false };
-const PROGRAM_RUNS_READING = { terminator: "strip", quotedOperatorsAreText: true };
+const MATCH_READING = { terminator: "keep", quotedOperatorsAreText: false, redirection: "reject" };
+const PROGRAM_RUNS_READING = { terminator: "strip", quotedOperatorsAreText: true, redirection: "reject" };
+const OFFER_READING = { terminator: "keep", quotedOperatorsAreText: false, redirection: "tolerate" };
 function commandBasename(name) {
     return name.slice(name.lastIndexOf("/") + 1);
 }
 function ruleLaneShapeOf(command, reading) {
-    const split = splitShellCompoundSegments(command, { trailingTerminator: reading.terminator });
+    const split = splitShellCompoundSegments(command, { trailingTerminator: reading.terminator, redirection: reading.redirection });
     if ("reject" in split)
         return { reject: split.reject };
     const names = [];
     for (const segment of split.segments) {
+        if (reading.redirection === "tolerate" && carriesShellRedirection(segment)) {
+            names.push(undefined);
+            continue;
+        }
         const floor = parseLeadingCommandName(segment, { ...RULE_LANE_FLOOR, quotedOperatorsAreText: reading.quotedOperatorsAreText });
         if ("reject" in floor) {
             return {
@@ -219,6 +224,45 @@ export function parseAllowRuleText(text, opts) {
 export function formatAllowRuleText(command, match) {
     return `Bash(${command}${match === "prefix" ? ":*" : ""})`;
 }
+function hasUnescapedStar(s) {
+    for (let i = 0; i < s.length; i++) {
+        if (s[i] !== "*")
+            continue;
+        let backslashes = 0;
+        for (let j = i - 1; j >= 0 && s[j] === "\\"; j--)
+            backslashes++;
+        if (backslashes % 2 === 0)
+            return true;
+    }
+    return false;
+}
+function isImportedWildcardContent(content) {
+    return !content.endsWith(":*") && hasUnescapedStar(content);
+}
+export function translateImportedWildcardRule(text) {
+    const parsed = parsePermissionRule(text);
+    const content = parsed.ruleContent;
+    if (content === undefined || parsed.toolName !== "Bash" || !isImportedWildcardContent(content))
+        return undefined;
+    const body = /^(.+) \*$/.exec(content)?.[1];
+    if (body === undefined || body.trim() === "") {
+        return {
+            skip: "unsupported.wildcard: only the trailing `<command> *` form has a prefix-rule equivalent here — it stays in the settings file, unimported",
+        };
+    }
+    if (hasUnescapedStar(body)) {
+        return {
+            skip: "unsupported.wildcard: a `*` before the end of the pattern matches anything at that position, which has no rule form in this version — it stays in the settings file, unimported",
+        };
+    }
+    const bodyShape = ruleLaneShapeOf(body, MATCH_READING);
+    if (!("reject" in bodyShape) && bodyShape.segments.length > 1) {
+        return {
+            skip: "unsupported.wildcard: a `<chain> *` pattern names more than one command, and the trailing-star form has no equivalent for a chain — it stays in the settings file, unimported",
+        };
+    }
+    return { rule: formatAllowRuleText(body, "prefix") };
+}
 export function ruleAdmitsCommand(rule, command) {
     return admitsUnder(rule, command, MATCH_READING);
 }
@@ -297,7 +341,7 @@ export function segmentCoverageOf(command, rules, call) {
     const folded = foldSpacing(command);
     if (folded === undefined)
         return undefined;
-    const shape = ruleLaneShapeOf(folded, MATCH_READING);
+    const shape = ruleLaneShapeOf(folded, OFFER_READING);
     if ("reject" in shape)
         return undefined;
     const proposed = rules.proposed ?? [];
@@ -308,7 +352,7 @@ export function segmentCoverageOf(command, rules, call) {
     }));
 }
 export function suggestRulesForCommand(command, ctx) {
-    const shape = ruleLaneShapeOf(command, MATCH_READING);
+    const shape = ruleLaneShapeOf(command, OFFER_READING);
     if ("reject" in shape)
         return [];
     const folded = foldSpacing(command);
@@ -333,7 +377,7 @@ export function suggestRulesForCommand(command, ctx) {
         }
         return offers;
     }
-    const foldedShape = ruleLaneShapeOf(folded, MATCH_READING);
+    const foldedShape = ruleLaneShapeOf(folded, OFFER_READING);
     if ("reject" in foldedShape || foldedShape.segments.length !== shape.segments.length)
         return offers;
     const segments = foldedShape.segments.map((s) => s.trim());
@@ -341,6 +385,8 @@ export function suggestRulesForCommand(command, ctx) {
     const alignedTable = table !== undefined && table.length === segments.length && table.every((row, i) => row.segment === segments[i]) ? table : undefined;
     const coveredAt = (i) => alignedTable?.[i]?.covered === true;
     const mintSegmentRule = (segment) => {
+        if (carriesShellRedirection(segment))
+            return undefined;
         const body = bodyOf(tokensOf(segment));
         if (body !== undefined) {
             const parsed = parseAllowRuleText(formatAllowRuleText(body, "prefix"));

package/dist/core/permission-rule-store.js CHANGED Viewed

@@ -312,7 +312,7 @@ export function applySyncJoin(cur, delta, nowMs) {
             quarantined,
             observedVector: delta.observedVector !== undefined ? joinFrontiers(cur.observedVector ?? {}, delta.observedVector) : cur.observedVector,
         },
-        report: { droppedInbound, quarantined: quarantinedNow, collectedTombstones, withheldAdds },
+        report: structuredClone({ droppedInbound, quarantined: quarantinedNow, collectedTombstones, withheldAdds }),
     };
 }
 export function assertRedemptionNotQuarantined(quarantined, delta) {
@@ -327,11 +327,15 @@ export async function ruleStoreChecksum(payload) {
 }
 const REMOVE_MAX_ATTEMPTS = 8;
 export async function removePersistedRule(opts) {
-    const owner = typeof opts.principal === "string" ? { kind: "principal", principal: opts.principal } : opts.principal;
-    if (owner.kind === "local-owner" && opts.provider.forLocalOwner === undefined) {
+    const rule = opts.rule;
+    const scope = structuredClone(opts.scope);
+    const target = opts.principal;
+    const owner = typeof target === "string" ? { kind: "principal", principal: target } : structuredClone(target);
+    const provider = opts.provider;
+    if (owner.kind === "local-owner" && provider.forLocalOwner === undefined) {
         return { status: "failed", error: "this provider has no local-owner bucket (forLocalOwner is not implemented) — a local-owner rule cannot be removed through it" };
     }
-    const store = owner.kind === "local-owner" ? opts.provider.forLocalOwner() : opts.provider.forPrincipal(owner.principal);
+    const store = owner.kind === "local-owner" ? provider.forLocalOwner() : provider.forPrincipal(owner.principal);
     const writer = writerOf(store);
     if (writer === undefined) {
         return { status: "failed", error: "the resolved permission-rule store has no write face — rules cannot be removed through it" };
@@ -343,11 +347,11 @@ export async function removePersistedRule(opts) {
     catch (err) {
         return { status: "failed", error: `could not read the permission-rule store: ${errText(err)}` };
     }
-    const live = snapshot.rules.filter((r) => r.rule === opts.rule && sameScope(r.scope, opts.scope));
+    const live = snapshot.rules.filter((r) => r.rule === rule && sameScope(r.scope, scope));
     const removedDots = live.flatMap((r) => r.adds.map((a) => a.dot));
     if (removedDots.length === 0)
         return { status: "no-op", rev: snapshot.rev };
-    const tombstone = { rule: opts.rule, scope: opts.scope, removedDots, deletedBy: await writer.nextDot() };
+    const tombstone = { rule, scope, removedDots, deletedBy: await writer.nextDot() };
     let expectedRev = snapshot.rev;
     let lastError = "";
     for (let attempt = 0; attempt < REMOVE_MAX_ATTEMPTS; attempt++) {
@@ -357,7 +361,7 @@ export async function removePersistedRule(opts) {
                 let stillLive = false;
                 try {
                     const after = await store.list();
-                    stillLive = after.rules.some((r) => r.rule === opts.rule && sameScope(r.scope, opts.scope) && isRuleLive(r));
+                    stillLive = after.rules.some((r) => r.rule === rule && sameScope(r.scope, scope) && isRuleLive(r));
                 }
                 catch {
                     stillLive = false;
@@ -376,7 +380,7 @@ export async function removePersistedRule(opts) {
         const after = await store.list();
         const landed = after.tombstones.some((t) => t.deletedBy.actor === tombstone.deletedBy.actor && t.deletedBy.counter === tombstone.deletedBy.counter);
         return landed
-            ? { status: "removed", rev: after.rev, stillLive: after.rules.some((r) => r.rule === opts.rule && sameScope(r.scope, opts.scope) && isRuleLive(r)) }
+            ? { status: "removed", rev: after.rev, stillLive: after.rules.some((r) => r.rule === rule && sameScope(r.scope, scope) && isRuleLive(r)) }
             : { status: "failed", error: `${reason} (read-back confirms no tombstone was written)` };
     }
     catch (err) {
@@ -407,8 +411,8 @@ export class InMemoryPermissionRuleStore {
     }
     async list() {
         return {
-            rules: applyTombstones(this.rules, this.tombstones).map((r) => ({ ...r, adds: r.adds.map((a) => ({ ...a })) })),
-            tombstones: this.tombstones.map((t) => ({ ...t })),
+            rules: structuredClone(applyTombstones(this.rules, this.tombstones)),
+            tombstones: structuredClone(this.tombstones),
             rev: this.rev,
         };
     }
@@ -427,6 +431,7 @@ export class InMemoryPermissionRuleStore {
             quarantined: this.quarantinedRows,
         }),
         apply: async (delta, opts) => {
+            delta = structuredClone(delta);
             if (opts.expectedRev !== this.rev)
                 return { conflict: true, rev: this.rev };
             if (delta.kind === "redemption-add") {

package/dist/core/permission-rule-sync.js CHANGED Viewed

@@ -11,14 +11,18 @@ function refuseLocalOwnerSync() {
 const SYNC_MAX_ATTEMPTS = 8;
 const DISCLOSED_REFUSED_TOMBSTONES = 5;
 export async function syncPermissionRules(opts) {
-    if (opts.owner !== undefined) {
-        if (opts.owner.kind === "local-owner")
+    const principal = opts.principal;
+    const owner = opts.owner;
+    const provider = opts.provider;
+    const transport = opts.transport;
+    if (owner !== undefined) {
+        if (owner.kind === "local-owner")
             refuseLocalOwnerSync();
-        if (opts.owner.principal !== opts.principal) {
-            throw new Error(`contradictory identity: principal "${escapeForDisclosure(opts.principal)}" and owner principal "${escapeForDisclosure(opts.owner.principal)}" disagree`);
+        if (owner.principal !== principal) {
+            throw new Error(`contradictory identity: principal "${escapeForDisclosure(principal)}" and owner principal "${escapeForDisclosure(owner.principal)}" disagree`);
         }
     }
-    if (typeof opts.principal !== "string" || opts.principal === "") {
+    if (typeof principal !== "string" || principal === "") {
         throw new Error("syncPermissionRules requires a verified principal — an unauthenticated deployment has no cloud bucket to sync");
     }
     const traceClock = opts.now ?? Date.now;
@@ -30,7 +34,7 @@ export async function syncPermissionRules(opts) {
             emitTrace(tracer, () => ({
                 kind: "permission.rule_sync_resurrected",
                 version: 1,
-                principal: opts.principal,
+                principal,
                 rule: r.rule,
                 scopeKind: r.scope.kind,
                 ts: traceClock(),
@@ -40,7 +44,7 @@ export async function syncPermissionRules(opts) {
             emitTrace(tracer, () => ({
                 kind: "permission.rule_sync_dropped",
                 version: 1,
-                principal: opts.principal,
+                principal,
                 rule: d.rule,
                 scopeKind: d.scope.kind,
                 reason: d.reason,
@@ -49,20 +53,20 @@ export async function syncPermissionRules(opts) {
         }
         return result;
     };
-    const store = opts.provider.forPrincipal(opts.principal);
+    const store = provider.forPrincipal(principal);
     const writer = writerOf(store);
     if (writer === undefined) {
         throw new Error("the resolved permission-rule store has no write face — a sync round cannot land through it");
     }
     const raw = await writer.readRaw();
     const request = {
-        principal: opts.principal,
+        principal,
         replica: raw.actor,
         state: { rules: raw.rules, tombstones: raw.tombstones },
         ...(raw.observedVector !== undefined ? { observedVector: raw.observedVector } : {}),
     };
-    const rawResponse = await opts.transport(PERMISSION_RULE_SYNC_PATH, request);
-    const response = parseRuleSyncResponse(rawResponse, opts.principal);
+    const rawResponse = await transport(PERMISSION_RULE_SYNC_PATH, request);
+    const response = parseRuleSyncResponse(rawResponse, principal);
     const warnings = [...response.warnings];
     const dropped = [];
     const inboundTombstones = [];

package/dist/core/retention-policy.d.ts CHANGED Viewed

@@ -31,6 +31,15 @@ export interface RetentionPolicyKnobs {
     /** Row-count bound, whole rows (roster's write-time cap). */
     maxEntries?: number;
 }
+/**
+ * The family's typed refusal, exported so a seam whose bound has its own ADMISSIBLE RANGE refuses in
+ * the same grammar under the same code instead of minting a second one. The one in-tree case:
+ * file-history's boundary cap requires `>= 1` where the row stores accept `0` ("keep no rows" is a
+ * coherent policy for a ledger; for a history whose every commit mints a boundary it is not — the
+ * cap would reap the boundary its own commit just published), so that door cannot reuse
+ * {@link assertRetentionPolicy}'s "0 or more" wording without telling an operator something false.
+ */
+export declare function refuseRetentionPolicy(label: string, knob: string, value: unknown, requirement: string): never;
 /**
  * Refuse a malformed retention policy at the door. `undefined` on any field keeps its documented
  * meaning — that arm is simply not applied — so a deployment that sets nothing is untouched.

package/dist/core/retention-policy.js CHANGED Viewed

@@ -1,8 +1,11 @@
-function invalidPolicy(label, knob, value, requirement) {
-    const e = new Error(`${label}: ${knob} must be ${requirement} (got ${String(value)}) — a retention bound that cannot be evaluated silently decides what to delete instead of bounding it`);
+export function refuseRetentionPolicy(label, knob, value, requirement) {
+    const e = new Error(`${label}: ${knob} must be ${requirement} (got ${typeof value === "string" ? JSON.stringify(value) : String(value)}) — a retention bound that cannot be evaluated silently decides what to delete instead of bounding it`);
     e.code = "config.retention_policy_invalid";
     throw e;
 }
+function invalidPolicy(label, knob, value, requirement) {
+    refuseRetentionPolicy(label, knob, value, requirement);
+}
 export function assertRetentionPolicy(label, opts) {
     if (opts === undefined)
         return;

package/dist/core/retention.d.ts CHANGED Viewed

@@ -27,7 +27,12 @@ export interface RetentionPolicy {
  *  - **idempotent**: a retried invocation after a crash re-converges (already-deleted rows are
  *    counted, not errors);
  *  - **tombstoned**: deletions leave tombstones so replicas/backups converge instead of resurrecting;
- *  - **audited**: every destructive call returns a receipt the scheduler persists (append-only).
+ *  - **audited**: every destructive call is recorded append-only. The IDENTITY of that record —
+ *    which occurrence, which of the three operations, at what wall clock — belongs to the side that
+ *    WRITES the row, not to the receipt: an implementation records it in the same transaction as the
+ *    deletion (recording after the delete would leave an unwitnessed delete on a crash), and it is
+ *    the only side that knows its own op, sweep round, and policy generation. The receipt below is
+ *    therefore the CALL's three counts, deliberately not an audit row.
  */
 export interface ManagedRetentionCapability {
     /** Enumerate the retention domains (tenant/scope keys) this store holds data for. */
@@ -54,7 +59,13 @@ export interface ManagedRetentionCapability {
         cutoffMs: number;
     }): Promise<RetentionReceipt>;
 }
-/** Audit receipt of one destructive retention call (append-only material for the scheduler). */
+/**
+ * The three counts one destructive retention call produced. NOT an audit row and deliberately
+ * identity-free (see the capability's `audited` clause): a scheduler that needs to tell two
+ * same-shaped calls apart reads its store's audit records, which the implementation writes with its
+ * own occurrence id, operation, and timestamp inside the deleting transaction. Adding those here
+ * would ask a return value to know its own call context.
+ */
 export interface RetentionReceipt {
     domain: string;
     /** Rows destroyed by THIS call (idempotent retries count already-gone rows as 0, not errors). */

package/dist/core/runner/assemble-result.d.ts CHANGED Viewed

@@ -100,6 +100,11 @@ export type BudgetAxis = "tokens" | "cost";
  */
 export interface ResultFlags {
     threw: unknown;
+    /** #499 — the run's ENGINE-minted identity (`Prepared.runId`), echoed verbatim on
+     *  `TaskResult.runId`. Pure pass-through on every terminal: assembly neither mints nor derives it
+     *  (a caller reaching assembly at all has completed prepare, so the value exists), and a
+     *  hand-constructed flags bag without one simply produces a result without one. */
+    runId?: string;
     /** design/99 MF-25: the EFFECTIVE (resolved) model id that served the task — echoed on `TaskResult.model`. */
     model?: string;
     /** RB-368: some spend was accounted while the serving model had NO configured price table
@@ -118,6 +123,15 @@ export interface ResultFlags {
      *  path the terminal is `completed`, and this is what tells that completion apart from a natural
      *  one — the model did not finish; the person stopped it and the run awaits their direction). */
     haltedOnUserRejection?: boolean;
+    /** design/373 (#504) — a `TaskStream.halt` (the bare user interrupt, CC Esc form) was accepted
+     *  while the run was live; echoed on `TaskResult.haltedByUser`. Pure pass-through on every
+     *  terminal (the sibling `haltedOnUserRejection` law: the fact is about the leg that ran) PLUS
+     *  one status decision it owns (slot 9.7 below): a run whose ONLY stop was this halt reads
+     *  `"completed"`, never the `!final` failure and never the aborted terminal — whether the halt
+     *  landed before the model said anything (empty result) or cut a turn whose partial text the
+     *  brain kept (that text IS the result). The person stopped the run, which is the verb working,
+     *  not a defect. A REAL abort/limit that also fired still owns the terminal above it. */
+    userHalted?: boolean;
     /** design/174 final-round: call ids of answered-but-never-collected questions, echoed on
      *  `TaskResult.strandedHumanAnswers`. Pure pass-through; empty/absent ⇒ the field is omitted. The
      *  optional `onError` alert is NOT the disclosure — this mandatory result face is. */
@@ -240,7 +254,11 @@ export declare function errorCodeOf(err: unknown): string | undefined;
  *       discriminant guarantees only one is ever set)
  *   9. `abortedLive` | stopReason aborted → `"limits.max_walltime_exceeded"` | `"limits.max_turns_exceeded"` | undefined
  *       (audit A-1: hoisted ABOVE no-final — the loop exits cleanly on abort, so `final` may be a
- *       normal message or absent; a plain user interrupt carries NO errorCode — switch on `status`)
+ *       normal message or absent; a plain user interrupt carries NO errorCode — switch on `status`),
+ *       EXCEPT when the aborted `final` is the bare halt's OWN cut artifact (`haltOwnsAbortedFinal`)
+ *   9.7 `userHalted` + (no `final` | the halt's own aborted `final`) → status `"completed"` (#504: a
+ *       bare user halt — the verb working, not a defect; below the aborts on purpose, a real
+ *       abort/limit that also fired owns the terminal and the halt rides as the pass-through seat)
  *  10. no `final`        → status `"failed"`
  *  11. stopReason error  → brain `[code]` prefix (or `"conflict"` from the storage-layer flag)
  *  12. else              → `"completed"`

package/dist/core/runner/assemble-result.js CHANGED Viewed

@@ -57,12 +57,18 @@ export function assembleResult(spec, sessionId, final, stats, flags) {
     const result = text;
     let errorMessage;
     let errorCode;
+    let apiFailure;
     let blockedReason;
     let salvagedOutput;
     let checkpointToken;
     let checkpointId;
     let checkpointGate;
     let workspaceRestoreMode;
+    const haltOwnsAbortedFinal = flags.userHalted === true &&
+        final?.stopReason === "aborted" &&
+        !flags.abortedLive &&
+        flags.abortedForTimeout !== true &&
+        flags.abortedForTurns !== true;
     const isDegenerate = final?.stopReason === "error" && isDegenerateCutMessage(final);
     if (flags.outputInvalid) {
         status = "failed";
@@ -127,11 +133,14 @@ export function assembleResult(spec, sessionId, final, stats, flags) {
         checkpointGate = flags.reviewRef.gate;
         workspaceRestoreMode = flags.reviewRef.restoreMode;
     }
-    else if (flags.abortedLive || final?.stopReason === "aborted") {
+    else if ((flags.abortedLive || final?.stopReason === "aborted") && !haltOwnsAbortedFinal) {
         status = "failed";
         errorCode = flags.abortedForTimeout ? "limits.max_walltime_exceeded" : flags.abortedForTurns ? "limits.max_turns_exceeded" : undefined;
         errorMessage = final?.errorMessage ?? (flags.abortedForTurns ? "max turns exceeded" : "run aborted");
     }
+    else if (flags.userHalted === true && (!final || haltOwnsAbortedFinal)) {
+        status = "completed";
+    }
     else if (!final) {
         status = "failed";
         errorMessage = "no assistant message produced";
@@ -139,6 +148,12 @@ export function assembleResult(spec, sessionId, final, stats, flags) {
     else if (final.stopReason === "error") {
         status = "failed";
         errorMessage = final.errorMessage ?? "model error";
+        if (final.isApiErrorMessage === true) {
+            apiFailure = {
+                ...(final.apiErrorStatus !== undefined ? { status: final.apiErrorStatus } : {}),
+                ...(final.requestId !== undefined ? { requestId: final.requestId } : {}),
+            };
+        }
         const lifted = extractErrorCode(errorMessage);
         if (lifted) {
             errorCode = lifted;
@@ -165,5 +180,5 @@ export function assembleResult(spec, sessionId, final, stats, flags) {
     void _internalCompaction;
     if (flags.unpricedSpend)
         delete publicStats.costMicroUsd;
-    return { taskId, sessionId, status, ...(flags.model !== undefined ? { model: flags.model } : {}), result: result.trim(), salvagedOutput, blockedReason, errorMessage, errorCode, ...(retryAfterMs !== undefined ? { retryAfterMs } : {}), checkpointToken, ...(checkpointId !== undefined ? { checkpointId } : {}), checkpointGate, ...(workspaceRestoreMode !== undefined ? { workspaceRestoreMode } : {}), ...(flags.rewindNotes !== undefined && flags.rewindNotes.length > 0 ? { rewindNotes: flags.rewindNotes } : {}), ...(flags.haltedOnUserRejection === true ? { haltedOnUserRejection: true } : {}), ...(flags.remoteEnvFailures !== undefined && flags.remoteEnvFailures.length > 0 ? { remoteEnvFailures: flags.remoteEnvFailures } : {}), ...(flags.strandedHumanAnswers !== undefined && flags.strandedHumanAnswers.length > 0 ? { strandedHumanAnswers: flags.strandedHumanAnswers } : {}), ...(flags.effectiveReadFace !== undefined ? { effectiveReadFace: flags.effectiveReadFace } : {}), ...(flags.effectiveReadDenyPatterns !== undefined && flags.effectiveReadDenyPatterns.length > 0 ? { effectiveReadDenyPatterns: flags.effectiveReadDenyPatterns } : {}), ...(flags.effectiveMemoryScopes !== undefined ? { effectiveMemoryScopes: flags.effectiveMemoryScopes } : {}), ...(flags.effectiveReasoning !== undefined ? { effectiveReasoning: flags.effectiveReasoning } : {}), stats: publicStats };
+    return { taskId, ...(flags.runId !== undefined ? { runId: flags.runId } : {}), sessionId, status, ...(flags.model !== undefined ? { model: flags.model } : {}), result: result.trim(), salvagedOutput, blockedReason, errorMessage, errorCode, ...(apiFailure !== undefined ? { apiFailure } : {}), ...(retryAfterMs !== undefined ? { retryAfterMs } : {}), checkpointToken, ...(checkpointId !== undefined ? { checkpointId } : {}), checkpointGate, ...(workspaceRestoreMode !== undefined ? { workspaceRestoreMode } : {}), ...(flags.rewindNotes !== undefined && flags.rewindNotes.length > 0 ? { rewindNotes: flags.rewindNotes } : {}), ...(flags.haltedOnUserRejection === true ? { haltedOnUserRejection: true } : {}), ...(flags.userHalted === true ? { haltedByUser: true } : {}), ...(flags.remoteEnvFailures !== undefined && flags.remoteEnvFailures.length > 0 ? { remoteEnvFailures: flags.remoteEnvFailures } : {}), ...(flags.strandedHumanAnswers !== undefined && flags.strandedHumanAnswers.length > 0 ? { strandedHumanAnswers: flags.strandedHumanAnswers } : {}), ...(flags.effectiveReadFace !== undefined ? { effectiveReadFace: flags.effectiveReadFace } : {}), ...(flags.effectiveReadDenyPatterns !== undefined && flags.effectiveReadDenyPatterns.length > 0 ? { effectiveReadDenyPatterns: flags.effectiveReadDenyPatterns } : {}), ...(flags.effectiveMemoryScopes !== undefined ? { effectiveMemoryScopes: flags.effectiveMemoryScopes } : {}), ...(flags.effectiveReasoning !== undefined ? { effectiveReasoning: flags.effectiveReasoning } : {}), stats: publicStats };
 }