@sema-agent/core 6.0.0 → 7.0.0

package/dist/stores/file/permission-rule-store.d.ts

@@ -111,6 +111,17 @@ declare class FilePermissionRuleStore implements WritablePermissionRuleStore {
     /** Read and validate. Any refusal answers with an empty set AND says so — never a silent empty store. */
     private read;
     private disclose;
+    /**
+     * design/382 §4.3 — the AT-REST half of the durable two-member scope face: rows carrying a session
+     * scope, read out of persisted bytes (a hand edit or a foreign writer — the engine's own write arms
+     * refuse them loudly), are DROPPED from every read face and DISCLOSED. Never quarantined (the
+     * quarantine area is itself durable), never silently ridden: a session authorization must not gain
+     * an afterlife by being planted where the store cannot legally hold it. The write base
+     * (`current()`) is deliberately NOT screened — foreign bytes are left in place for a person to look
+     * at, exactly like every other damaged-row posture here; they simply never reach a live view, the
+     * sync wire (`readRaw`) or adjudication.
+     */
+    private screenDurableRows;
     private write;
     list(): Promise<StoredAllowRules>;
     /** The quarantine area (design/182 §5.2/§8.3): introspection only — never part of `list()`. */

package/dist/stores/file/permission-rule-store.js

@@ -1,7 +1,7 @@
 import { closeSync, constants as FS, existsSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { createHash, randomBytes } from "node:crypto";
-import { PERMISSION_RULE_WRITER, applySyncJoin, applyTombstones, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, foldDelta, } from "../../core/permission-rule-store.js";
+import { PERMISSION_RULE_WRITER, applySyncJoin, applyTombstones, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, foldDelta, } from "../../core/permission-rule-store.js";
 import { canonicalize } from "../../core/canonical-json.js";
 import { BootLock } from "./fs-atomic.js";
 import { assertAdoptionBootGate } from "./adoption/marker.js";
@@ -158,6 +158,17 @@ class FilePermissionRuleStore {
         catch {
         }
     }
+    screenDurableRows(file) {
+        const isSession = (scope) => scope?.kind === "session";
+        const rules = file.rules.filter((r) => !isSession(r?.scope));
+        const tombstones = file.tombstones.filter((t) => !isSession(t?.scope));
+        const quarantined = (file.quarantined ?? []).filter((q) => !isSession(q?.scope));
+        const dropped = file.rules.length - rules.length + (file.tombstones.length - tombstones.length) + ((file.quarantined ?? []).length - quarantined.length);
+        if (dropped > 0) {
+            this.disclose(`${this.file} carries ${dropped} session-scope row(s) — a session authorization cannot live in the durable store (design/382 §4.3); those rows are ignored on every read face and never ride sync`);
+        }
+        return { rules, tombstones, quarantined };
+    }
     write(next) {
         assertSafeDir(this.dir);
         atomicPublish(this.dir, this.file, JSON.stringify({ ...next, checksum: checksumOf(next) }, null, 2));
@@ -166,16 +177,17 @@ class FilePermissionRuleStore {
         const r = this.read();
         if (!("file" in r))
             return { ...EMPTY_READ };
+        const screened = this.screenDurableRows(r.file);
         return {
-            rules: applyTombstones(r.file.rules, r.file.tombstones),
-            tombstones: r.file.tombstones,
+            rules: applyTombstones(screened.rules, screened.tombstones),
+            tombstones: screened.tombstones,
             rev: r.file.rev,
             checksum: r.file.checksum,
         };
     }
     async quarantined() {
         const r = this.read();
-        return "file" in r ? (r.file.quarantined ?? []) : [];
+        return "file" in r ? this.screenDurableRows(r.file).quarantined : [];
     }
     async readOrgState() {
         const r = this.read();
@@ -245,14 +257,15 @@ class FilePermissionRuleStore {
         }),
         readRaw: async () => this.serialize(() => {
             const cur = this.current();
+            const screened = this.screenDurableRows(cur);
             return {
                 actor: cur.actor,
                 counter: cur.counter,
                 rev: cur.rev,
-                rules: structuredClone(cur.rules),
-                tombstones: structuredClone(cur.tombstones),
+                rules: structuredClone(screened.rules),
+                tombstones: structuredClone(screened.tombstones),
                 ...(cur.sync?.observedVector !== undefined ? { observedVector: structuredClone(cur.sync.observedVector) } : {}),
-                quarantined: structuredClone(cur.quarantined ?? []),
+                quarantined: structuredClone(screened.quarantined),
             };
         }),
         apply: async (delta, opts) => this.serialize(() => {
@@ -287,8 +300,8 @@ class FilePermissionRuleStore {
                 return { rev: cur.rev + 1, sync: report };
             }
             const next = delta.kind === "redemption-add"
-                ? (assertRedemptionNotQuarantined(cur.quarantined ?? [], delta), { ...cur, rev: cur.rev + 1, rules: foldDelta(cur.rules, delta) })
-                : (assertDeleteDeltaCarriesNoAdd(delta), { ...cur, rev: cur.rev + 1, tombstones: [...cur.tombstones, delta.tombstone] });
+                ? (assertWriteDeltaScopeDurable(delta), assertRedemptionNotQuarantined(cur.quarantined ?? [], delta), { ...cur, rev: cur.rev + 1, rules: foldDelta(cur.rules, delta) })
+                : (assertWriteDeltaScopeDurable(delta), assertDeleteDeltaCarriesNoAdd(delta), { ...cur, rev: cur.rev + 1, tombstones: [...cur.tombstones, delta.tombstone] });
             if (!this.writeAndVerify(next)) {
                 throw new Error("the permission-rule store did not survive its own write; the change was not committed");
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "6.0.0",
+  "version": "7.0.0",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",

package/test/export-surface.snapshot.json

@@ -1,7 +1,7 @@
 {
   "_comment": "design/87 L3 — frozen public export surface of src/index.ts (name -> kind). DO NOT edit by hand to silence a red test. A removed/changed entry = a SemVer-BREAKING change; bump MAJOR and update this fixture in the SAME commit (design/87 §4.2 / §5.2). Regenerate via REGEN in test/export-surface.test.ts.",
   "_tierComment": "#435 v1 — machine-readable layering of the public surface: stable = demonstrated by README.md / src/examples; internal = an `Internal`-marked name or a runner/engine deep-subtree declaration (the model seam src/engine/llm is excluded — it is the BYOM contract, not an engine internal); advanced = a supported export the front door does not walk you through. THIS IS AN INITIAL HEURISTIC, derived mechanically and expected to be refined ticket by ticket: no human reviewed these 1700+ entries one by one, and nothing here claims otherwise. Known bias: a short or English-word export name (ok, err, Result, Usage) can match ordinary prose in README.md and land `stable` on a coincidence. Every export MUST carry a tier — a new export with no row fails the gate in export-surface.test.ts.",
-  "count": 1834,
+  "count": 1841,
   "exports": {
     "A2ATaskState": "type",
     "A2ATaskStateReversal": "type",
@@ -439,6 +439,7 @@
     "InMemoryRuleApprovalRecordStore": "class",
     "InMemorySessionPolicyStore": "class",
     "InMemorySessionRepo": "class",
+    "InMemorySessionRuleOverlay": "class",
     "InMemorySessionStorage": "class",
     "InMemoryStrategyStore": "class",
     "InMemoryToolResultStore": "class",
@@ -1002,6 +1003,9 @@
     "SessionPolicyError": "class",
     "SessionPolicyStore": "interface",
     "SessionRepo": "interface",
+    "SessionRuleOverlay": "interface",
+    "SessionRuleOverlayAdd": "interface",
+    "SessionRuleOverlayApplyResult": "type",
     "SessionRulesRecord": "interface",
     "SessionStorage": "interface",
     "SessionStore": "interface",
@@ -1273,6 +1277,7 @@
     "assertWorkflowDeterminism": "function",
     "assertWorkflowPrimitivesWiring": "function",
     "assertWorkflowSandboxConformance": "function",
+    "assertWriteDeltaScopeDurable": "function",
     "atomicWriteFile": "function",
     "attachToolContract": "function",
     "autoModeArmingRecipeOf": "function",
@@ -1537,7 +1542,9 @@
     "isTerminalTaskNotification": "function",
     "isTerminalWorkflowStatus": "function",
     "isThinkingLevel": "function",
+    "isValidConsentScope": "function",
     "isValidCronExpr": "function",
+    "isValidDurableScope": "function",
     "isValidReminderMark": "function",
     "isWslBashLauncher": "function",
     "isolationPermitsAutoAccept": "function",
@@ -2275,6 +2282,7 @@
     "InMemoryRuleApprovalRecordStore": "advanced",
     "InMemorySessionPolicyStore": "advanced",
     "InMemorySessionRepo": "internal",
+    "InMemorySessionRuleOverlay": "advanced",
     "InMemorySessionStorage": "internal",
     "InMemoryStrategyStore": "advanced",
     "InMemoryToolResultStore": "stable",
@@ -2838,6 +2846,9 @@
     "SessionPolicyError": "advanced",
     "SessionPolicyStore": "advanced",
     "SessionRepo": "stable",
+    "SessionRuleOverlay": "advanced",
+    "SessionRuleOverlayAdd": "advanced",
+    "SessionRuleOverlayApplyResult": "advanced",
     "SessionRulesRecord": "advanced",
     "SessionStorage": "internal",
     "SessionStore": "advanced",
@@ -3109,6 +3120,7 @@
     "assertWorkflowDeterminism": "advanced",
     "assertWorkflowPrimitivesWiring": "advanced",
     "assertWorkflowSandboxConformance": "advanced",
+    "assertWriteDeltaScopeDurable": "advanced",
     "atomicWriteFile": "advanced",
     "attachToolContract": "advanced",
     "autoModeArmingRecipeOf": "advanced",
@@ -3373,7 +3385,9 @@
     "isTerminalTaskNotification": "advanced",
     "isTerminalWorkflowStatus": "advanced",
     "isThinkingLevel": "advanced",
+    "isValidConsentScope": "advanced",
     "isValidCronExpr": "advanced",
+    "isValidDurableScope": "advanced",
     "isValidReminderMark": "advanced",
     "isWslBashLauncher": "internal",
     "isolationPermitsAutoAccept": "advanced",