@sema-agent/core 7.1.0 → 7.2.0

package/dist/core/permission-rule-model.js

@@ -1,4 +1,6 @@
+import { homedir } from "node:os";
 import { parsePermissionRule } from "./permission-rules.js";
+import { compileReadDeny } from "../tools/fs/read-deny.js";
 import { carriesShellRedirection, parseLeadingCommandName, splitShellCompoundSegments } from "../tools/fs/bash-readonly-classifier.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 export const MAX_RULE_TEXT_CHARS = 512;
@@ -193,15 +195,53 @@ export function parseAllowRuleText(text, opts) {
     if (parsed.ruleContent === undefined) {
         return reject("invalid.grammar", `"${text}" is not a Tool(content) rule — a bare tool name claims the whole tool and is not a command rule`);
     }
+    if (parsed.toolName === "Read") {
+        const content = parsed.ruleContent;
+        const m = /^\/\/(.+)\/\*\*$/.exec(content);
+        if (m === null) {
+            return reject("invalid.grammar", `only the Read(//abs-dir/**) directory form is a rule this version reads ("${text}") — relative, single-file, single-slash and no-tail spellings have no rule form`);
+        }
+        const bodyR = m[1];
+        if (bodyR.includes("*")) {
+            return reject("unsupported.wildcard", `a \`*\` inside the directory body matches anything at that position, which has no rule form ("${text}")`);
+        }
+        const segments = bodyR.split("/");
+        if (segments.some((s) => s === "" || s.trim() === "")) {
+            return reject("invalid.grammar", `the directory body of "${text}" is not in the canonical spelling (an empty or whitespace-only path segment) — the lexical normal form is the only accepted spelling`);
+        }
+        if (segments.some((s) => s === "." || s === "..")) {
+            return reject("invalid.path_traversal", `the directory body of "${text}" carries a \`.\` or \`..\` segment — the lexical normal form is the only accepted spelling, and a traversal segment is not normalized away`);
+        }
+        const dir = "/" + bodyR;
+        return { rule: { rule: formatAllowRuleText(dir, "subpath"), tool: "Read", match: "subpath", command: dir } };
+    }
     if (parsed.toolName !== "Bash") {
-        return reject("unsupported.tool", `only Bash rules are supported in this version (got "${parsed.toolName}")`);
+        return reject("unsupported.tool", `only Bash and Read rules are supported in this version (got "${parsed.toolName}")`);
     }
     const content = parsed.ruleContent;
     const prefixBody = /^(.+):\*$/.exec(content)?.[1];
-    const match = prefixBody !== undefined ? "prefix" : "exact";
-    const body = prefixBody ?? content;
-    if (body.includes("*")) {
-        return reject("unsupported.wildcard", `wildcard rule forms are not supported in this version ("${text}")`);
+    let match;
+    let body;
+    if (prefixBody !== undefined) {
+        if (prefixBody.includes("*")) {
+            return reject("unsupported.wildcard", `a \`*\` inside a prefix body matches anything at that position, which has no rule form in this version ("${text}")`);
+        }
+        match = "prefix";
+        body = prefixBody;
+    }
+    else {
+        const wildcardBody = /^(.+) \*$/.exec(content)?.[1];
+        if (wildcardBody !== undefined && !hasUnescapedStar(wildcardBody)) {
+            match = "wildcard";
+            body = wildcardBody;
+        }
+        else if (hasUnescapedStar(content)) {
+            return reject("unsupported.wildcard", `a \`*\` before the end of the pattern matches anything at that position, which has no rule form in this version — only the trailing \`<command> *\` form does ("${text}")`);
+        }
+        else {
+            match = "exact";
+            body = content;
+        }
     }
     const shape = ruleLaneShapeOf(body, MATCH_READING);
     if ("reject" in shape) {
@@ -209,8 +249,11 @@ export function parseAllowRuleText(text, opts) {
             ? reject("invalid.empty_command", `rule "${text}" names no command`)
             : reject("invalid.not_simple_command", `rule "${text}" is not a command this lane can name (${shape.reject})`);
     }
+    if (match === "wildcard" && shape.segments.length > 1) {
+        return reject("unsupported.wildcard", `a \`<chain> *\` pattern names more than one command, and the trailing-star form has no chain reading — the compound-prefix form spells one with the \`:*\` marker ("${text}")`);
+    }
     const head = commandBasename(shape.names[shape.names.length - 1] ?? "");
-    if (match === "prefix" && BARE_INTERPRETER_NAMES.has(head) && opts?.direction !== "tighten") {
+    if ((match === "prefix" || match === "wildcard") && BARE_INTERPRETER_NAMES.has(head) && opts?.direction !== "tighten") {
         return reject("invalid.bare_interpreter_prefix", shape.segments.length > 1
             ? `prefix rule "${text}" leaves its final segment open-ended under the interpreter "${head}" — such a rule authorizes running arbitrary programs, which one approval click cannot be read as having granted (an exact rule naming the whole command line is accepted)`
             : `prefix rule "${text}" is headed by the interpreter "${head}" — such a rule authorizes running arbitrary programs, which one approval click cannot be read as having granted (an exact rule naming the whole command line is accepted)`);
@@ -222,7 +265,9 @@ export function parseAllowRuleText(text, opts) {
     return { rule: { rule: formatAllowRuleText(command, match), tool: "Bash", match, command } };
 }
 export function formatAllowRuleText(command, match) {
-    return `Bash(${command}${match === "prefix" ? ":*" : ""})`;
+    if (match === "subpath")
+        return `Read(//${command.startsWith("/") ? command.slice(1) : command}/**)`;
+    return `Bash(${command}${match === "prefix" ? ":*" : match === "wildcard" ? " *" : ""})`;
 }
 function hasUnescapedStar(s) {
     for (let i = 0; i < s.length; i++) {
@@ -236,33 +281,6 @@ function hasUnescapedStar(s) {
     }
     return false;
 }
-function isImportedWildcardContent(content) {
-    return !content.endsWith(":*") && hasUnescapedStar(content);
-}
-export function translateImportedWildcardRule(text) {
-    const parsed = parsePermissionRule(text);
-    const content = parsed.ruleContent;
-    if (content === undefined || parsed.toolName !== "Bash" || !isImportedWildcardContent(content))
-        return undefined;
-    const body = /^(.+) \*$/.exec(content)?.[1];
-    if (body === undefined || body.trim() === "") {
-        return {
-            skip: "unsupported.wildcard: only the trailing `<command> *` form has a prefix-rule equivalent here — it stays in the settings file, unimported",
-        };
-    }
-    if (hasUnescapedStar(body)) {
-        return {
-            skip: "unsupported.wildcard: a `*` before the end of the pattern matches anything at that position, which has no rule form in this version — it stays in the settings file, unimported",
-        };
-    }
-    const bodyShape = ruleLaneShapeOf(body, MATCH_READING);
-    if (!("reject" in bodyShape) && bodyShape.segments.length > 1) {
-        return {
-            skip: "unsupported.wildcard: a `<chain> *` pattern names more than one command, and the trailing-star form has no equivalent for a chain — it stays in the settings file, unimported",
-        };
-    }
-    return { rule: formatAllowRuleText(body, "prefix") };
-}
 export function ruleAdmitsCommand(rule, command) {
     return admitsUnder(rule, command, MATCH_READING);
 }
@@ -270,6 +288,8 @@ export function ruleAdmitsProgramRun(rule, command) {
     return admitsUnder(rule, command, PROGRAM_RUNS_READING);
 }
 function admitsUnder(rule, command, reading) {
+    if (rule.match === "subpath")
+        return false;
     const shape = ruleLaneShapeOf(command, reading);
     if ("reject" in shape)
         return false;
@@ -285,6 +305,30 @@ function admitsUnder(rule, command, reading) {
         return false;
     return folded === rule.command || folded.startsWith(rule.command + " ");
 }
+export function ruleBreadthWarningsOf(rule) {
+    if (rule.match !== "prefix" && rule.match !== "wildcard")
+        return [];
+    const bodyShape = ruleLaneShapeOf(rule.command, MATCH_READING);
+    if ("reject" in bodyShape)
+        return [];
+    if (bodyShape.segments.length > 1) {
+        return [
+            {
+                code: "compound_prefix",
+                message: `this rule's body is a command chain — it admits every run of the whole chain "${rule.command}", with any text extending its final segment`,
+            },
+        ];
+    }
+    if (rule.command.split(/\s+/).filter((t) => t !== "").length === 1) {
+        return [
+            {
+                code: "broad_prefix",
+                message: `this rule admits every argument form of "${rule.command}" — any \`${rule.command} …\` command, not just the one on this card`,
+            },
+        ];
+    }
+    return [];
+}
 export function ruleLaneSegmentsOf(command) {
     const shape = ruleLaneShapeOf(command, PROGRAM_RUNS_READING);
     return "reject" in shape ? undefined : shape.segments;
@@ -295,6 +339,134 @@ export function pathWithinRoot(path, root) {
     const base = root.endsWith("/") ? root : root + "/";
     return path.startsWith(base);
 }
+export function lexicalNormalAbsolutePathOf(path) {
+    if (typeof path !== "string" || !path.startsWith("/"))
+        return undefined;
+    const out = [];
+    for (const seg of path.split("/")) {
+        if (seg === "" || seg === ".")
+            continue;
+        if (seg === "..") {
+            if (out.length === 0)
+                return undefined;
+            out.pop();
+            continue;
+        }
+        out.push(seg);
+    }
+    return out.length === 0 ? "/" : "/" + out.join("/");
+}
+function isLexicalNormalAbsoluteDir(path) {
+    if (typeof path !== "string" || !path.startsWith("/") || path.startsWith("//"))
+        return false;
+    const segments = path.split("/").slice(1);
+    return segments.length > 0 && segments.every((s) => s !== "" && s !== "." && s !== "..");
+}
+export function directoryRuleAdmits(rule, path) {
+    if (rule.tool !== "Read" || rule.match !== "subpath")
+        return false;
+    if (!isLexicalNormalAbsoluteDir(rule.command))
+        return false;
+    if (!isLexicalNormalAbsoluteDir(path))
+        return false;
+    return pathWithinRoot(path, rule.command);
+}
+const CD_TARGET_REJECT_CHARS = /[*?[\]{}$`\\'"<>\n\r]/;
+function cdSegmentDirectoryOf(segment, opts) {
+    if (/[^\S \t]/.test(segment))
+        return undefined;
+    const tokens = segment.split(/[ \t]+/).filter((t) => t !== "");
+    if (tokens.length !== 2 || tokens[0] !== "cd")
+        return undefined;
+    const target = tokens[1];
+    if (CD_TARGET_REJECT_CHARS.test(target))
+        return undefined;
+    if (target.startsWith("-") || target.startsWith("~"))
+        return undefined;
+    let resolved;
+    if (target.startsWith("//"))
+        return undefined;
+    if (target.startsWith("/")) {
+        resolved = target;
+    }
+    else if (target.startsWith("./")) {
+        if (opts.priorCd || opts.cwd === undefined)
+            return undefined;
+        if (!opts.cwd.startsWith("/") || opts.cwd.startsWith("//"))
+            return undefined;
+        resolved = opts.cwd.replace(/\/+$/, "") + target.slice(1);
+    }
+    else {
+        return undefined;
+    }
+    if (!isLexicalNormalAbsoluteDir(resolved))
+        return undefined;
+    if (HOME_TOP_SHAPE.test(resolved))
+        return undefined;
+    if (HOME_ANCESTOR_SHAPE.test(resolved))
+        return undefined;
+    const processHome = userHomeTopLevel();
+    if (processHome !== undefined && (resolved === processHome || isStrictAncestorDir(resolved, processHome))) {
+        return undefined;
+    }
+    return resolved;
+}
+function isStrictAncestorDir(ancestor, path) {
+    return ancestor !== "/" && path.startsWith(`${ancestor}/`);
+}
+const HOME_TOP_SHAPE = /^(?:\/home\/[^/]+|\/Users\/[^/]+|\/root|\/var\/root)$/;
+const HOME_ANCESTOR_SHAPE = /^(?:\/home|\/Users|\/var)$/;
+let HOME_TOP_LEVEL = null;
+function userHomeTopLevel() {
+    if (HOME_TOP_LEVEL === null) {
+        try {
+            const h = homedir();
+            HOME_TOP_LEVEL = typeof h === "string" && h.startsWith("/") && !h.startsWith("//") ? h.replace(/\/+$/, "") : undefined;
+        }
+        catch {
+            HOME_TOP_LEVEL = undefined;
+        }
+    }
+    return HOME_TOP_LEVEL === null ? undefined : HOME_TOP_LEVEL;
+}
+const CURSOR_MOVING_HEADS = new Set(["cd", "pushd", "popd"]);
+const OPAQUE_CURSOR_MOVERS = new Set(["eval", "source", ".", "trap", "enable", "builtin", "command", "time"]);
+function pushdPopdLeavesCursor(head, args) {
+    for (const a of args) {
+        if (a === "--")
+            return false;
+        if (/^-[a-zA-Z]*n[a-zA-Z]*$/.test(a))
+            return true;
+        if (head === "popd" && /^\+0*[1-9]\d*$/.test(a))
+            return true;
+    }
+    return false;
+}
+function movesShellCursor(segment) {
+    if (carriesShellRedirection(segment))
+        return true;
+    const words = segment
+        .split(/[ \t]+/)
+        .map((w) => w.replace(/['"]/g, ""))
+        .filter((t) => t !== "");
+    const head = words[0];
+    if (head === undefined)
+        return false;
+    if (OPAQUE_CURSOR_MOVERS.has(head))
+        return true;
+    if (!CURSOR_MOVING_HEADS.has(head))
+        return false;
+    return !((head === "pushd" || head === "popd") && pushdPopdLeavesCursor(head, words.slice(1)));
+}
+function resolveCdSegmentDirectories(segments, cwd) {
+    let priorCd = false;
+    return segments.map((segment) => {
+        const dir = cdSegmentDirectoryOf(segment, { cwd, priorCd });
+        if (!priorCd && movesShellCursor(segment))
+            priorCd = true;
+        return dir;
+    });
+}
 export function scopeCoversCwd(scope, cwd, sessionId) {
     if (scope.kind === "global")
         return true;
@@ -327,11 +499,16 @@ export function findAdmittingRule(rules, call) {
     const whole = firstEligibleAdmittingRule(rules, call.command, call);
     if (whole !== undefined)
         return [whole];
-    if (shape.segments.length < 2)
-        return undefined;
+    const cdDirs = resolveCdSegmentDirectories(shape.segments, call.execCwd ?? call.cwd);
+    if (shape.segments.length < 2) {
+        const dir = cdDirs[0];
+        const lone = dir !== undefined ? firstEligibleDirectoryRule(rules, dir, call) : undefined;
+        return lone !== undefined ? [lone] : undefined;
+    }
     const covering = [];
-    for (const segment of shape.segments) {
-        const first = firstEligibleAdmittingRule(rules, segment, call);
+    for (const [i, segment] of shape.segments.entries()) {
+        const dir = cdDirs[i];
+        const first = firstEligibleAdmittingRule(rules, segment, call) ?? (dir !== undefined ? firstEligibleDirectoryRule(rules, dir, call) : undefined);
         if (first === undefined)
             return undefined;
         if (!covering.includes(first))
@@ -339,6 +516,15 @@ export function findAdmittingRule(rules, call) {
     }
     return covering;
 }
+function firstEligibleDirectoryRule(rules, directory, call) {
+    for (const rule of rules) {
+        if (!eligiblePersisted(rule, { tool: "Read", cwd: call.cwd, sessionId: call.sessionId }))
+            continue;
+        if (directoryRuleAdmits(rule, directory))
+            return rule;
+    }
+    return undefined;
+}
 export function segmentCoverageOf(command, rules, call) {
     const folded = foldSpacing(command);
     if (folded === undefined)
@@ -347,12 +533,31 @@ export function segmentCoverageOf(command, rules, call) {
     if ("reject" in shape)
         return undefined;
     const proposed = rules.proposed ?? [];
-    return shape.segments.map((segment) => ({
-        segment: segment.trim(),
-        covered: firstEligibleAdmittingRule(rules.persisted, segment, call) !== undefined ||
-            proposed.some((p) => eligibleContext({ tool: p.rule.tool, scope: p.scope }, call) && ruleAdmitsCommand(p.rule, segment)),
-    }));
+    const cdDirs = resolveCdSegmentDirectories(shape.segments, call.execCwd ?? call.cwd);
+    return shape.segments.map((segment, i) => {
+        const dir = cdDirs[i];
+        return {
+            segment: segment.trim(),
+            covered: firstEligibleAdmittingRule(rules.persisted, segment, call) !== undefined ||
+                (dir !== undefined && firstEligibleDirectoryRule(rules.persisted, dir, call) !== undefined) ||
+                proposed.some((p) => p.rule.tool === "Read"
+                    ? dir !== undefined &&
+                        eligibleContext({ tool: p.rule.tool, scope: p.scope }, { tool: "Read", cwd: call.cwd, sessionId: call.sessionId }) &&
+                        directoryRuleAdmits(p.rule, dir)
+                    : eligibleContext({ tool: p.rule.tool, scope: p.scope }, call) && ruleAdmitsCommand(p.rule, segment)),
+        };
+    });
 }
+export const UNCOVERED_SEGMENT_REASON_BASELINE = {
+    redirection: "This part carries a redirection, so it is approved per use — no rule can cover this spelling. If you trust its redirection-free form, a rule can be written for that form (the card's edit row, or settings).",
+    no_rule_form: "No rule form exists for this part; it can be approved per use.",
+    cap_overflow: "This batch does not cover this part; you will be asked again when it comes up.",
+};
+export const RULE_OFFERS_ABSENCE_BASELINE = {
+    mandated: "This approval is required by the deployment's policy each time; a rule cannot waive it.",
+    lane_cannot_speak: "This card has no rule to offer for this exact command; it can be approved per use. A coverable form of what you trust can still get a rule — through a card drawn for that form, or settings.",
+    shadowed: "A rule you already have matches this call and still asks — that standing rule keeps deciding, so a new rule minted here would change nothing; review your existing rules instead.",
+};
 export function suggestRulesForCommand(command, ctx) {
     const shape = ruleLaneShapeOf(command, OFFER_READING);
     if ("reject" in shape)
@@ -367,16 +572,44 @@ export function suggestRulesForCommand(command, ctx) {
     }
     const tokensOf = (s) => s.split(/\s+/).filter((t) => t !== "");
     const bodyOf = (tokens) => longestReviewedBody(tokens) ?? genericPrefixBody(tokens);
+    const directoryGateOpen = (ctx?.scope?.kind === "project" || ctx?.scope?.kind === "session") && scopeCoversCwd(ctx.scope, ctx?.cwd, ctx?.sessionId);
+    const deniesDirectory = ctx?.deniesDirectoryRead ?? defaultDeniesDirectoryRead;
+    const mintDirectoryMember = (directory, segment) => {
+        if (!directoryGateOpen || directory === undefined)
+            return undefined;
+        let denied;
+        try {
+            denied = deniesDirectory(directory) === true;
+        }
+        catch {
+            denied = true;
+        }
+        if (denied)
+            return undefined;
+        const parsed = parseAllowRuleText(formatAllowRuleText(directory, "subpath"));
+        if (!("rule" in parsed) || parsed.rule.match !== "subpath")
+            return undefined;
+        if (!directoryRuleAdmits(parsed.rule, directory))
+            return undefined;
+        return { kind: "directoryRead", rule: parsed.rule.rule, directory: parsed.rule.command, segment };
+    };
     if (shape.segments.length === 1) {
         if (offers.length === 1) {
             const body = bodyOf(tokensOf(folded));
             if (body !== undefined) {
-                const parsed = parseAllowRuleText(formatAllowRuleText(body, "prefix"));
-                if ("rule" in parsed && parsed.rule.match === "prefix" && ruleAdmitsCommand(parsed.rule, command)) {
-                    offers.push({ kind: "single", rule: parsed.rule.rule, match: "prefix", command: parsed.rule.command });
+                const parsed = parseAllowRuleText(formatAllowRuleText(body, "wildcard"));
+                if ("rule" in parsed && parsed.rule.match === "wildcard" && ruleAdmitsCommand(parsed.rule, command)) {
+                    offers.push({ kind: "single", rule: parsed.rule.rule, match: "wildcard", command: parsed.rule.command });
                 }
             }
         }
+        const lone = folded.trim();
+        const loneCovered = ctx?.coverage !== undefined && ctx.coverage.length === 1 && ctx.coverage[0]?.segment === lone && ctx.coverage[0]?.covered === true;
+        if (!loneCovered) {
+            const member = mintDirectoryMember(resolveCdSegmentDirectories([lone], ctx?.execCwd ?? ctx?.cwd)[0], lone);
+            if (member !== undefined)
+                offers.push({ kind: "batch", rules: [member], uncoveredSegments: 0, uncoveredDetail: [] });
+        }
         return offers;
     }
     const foldedShape = ruleLaneShapeOf(folded, OFFER_READING);
@@ -391,9 +624,9 @@ export function suggestRulesForCommand(command, ctx) {
             return undefined;
         const body = bodyOf(tokensOf(segment));
         if (body !== undefined) {
-            const parsed = parseAllowRuleText(formatAllowRuleText(body, "prefix"));
-            if ("rule" in parsed && parsed.rule.match === "prefix" && ruleAdmitsCommand(parsed.rule, segment)) {
-                return { rule: parsed.rule.rule, match: "prefix", command: parsed.rule.command };
+            const parsed = parseAllowRuleText(formatAllowRuleText(body, "wildcard"));
+            if ("rule" in parsed && parsed.rule.match === "wildcard" && ruleAdmitsCommand(parsed.rule, segment)) {
+                return { rule: parsed.rule.rule, match: "wildcard", command: parsed.rule.command };
             }
         }
         const segExact = parseAllowRuleText(formatAllowRuleText(segment, "exact"));
@@ -402,14 +635,19 @@ export function suggestRulesForCommand(command, ctx) {
         }
         return undefined;
     };
+    const cdDirs = resolveCdSegmentDirectories(segments, ctx?.execCwd ?? ctx?.cwd);
     const minted = [];
     for (let i = 0; i < segments.length; i++) {
         if (coveredAt(i))
             continue;
         const segment = segments[i];
-        const rule = mintSegmentRule(segment);
-        if (rule !== undefined && !minted.some((m) => m.rule === rule.rule))
-            minted.push({ ...rule, segment });
+        const dirMember = mintDirectoryMember(cdDirs[i], segment);
+        const member = dirMember ?? (() => {
+            const rule = mintSegmentRule(segment);
+            return rule !== undefined ? { kind: "command", ...rule, segment } : undefined;
+        })();
+        if (member !== undefined && !minted.some((m) => m.rule === member.rule))
+            minted.push(member);
     }
     const batchRules = minted.slice(0, 5);
     if (batchRules.length > 0) {
@@ -417,8 +655,28 @@ export function suggestRulesForCommand(command, ctx) {
             const p = parseAllowRuleText(r.rule);
             return "rule" in p ? [p.rule] : [];
         });
-        const uncoveredSegments = segments.filter((segment, i) => !coveredAt(i) && !parsedBatch.some((p) => ruleAdmitsCommand(p, segment))).length;
-        offers.push({ kind: "batch", rules: batchRules, uncoveredSegments });
+        const uncoveredDetail = [];
+        for (let i = 0; i < segments.length; i++) {
+            const segment = segments[i];
+            if (coveredAt(i))
+                continue;
+            if (parsedBatch.some((p) => p.tool !== "Read" && ruleAdmitsCommand(p, segment)))
+                continue;
+            const dir = cdDirs[i];
+            if (dir !== undefined && parsedBatch.some((p) => directoryRuleAdmits(p, dir)))
+                continue;
+            const reason = carriesShellRedirection(segment) ? "redirection" : mintSegmentRule(segment) === undefined ? "no_rule_form" : "cap_overflow";
+            uncoveredDetail.push({ segment, reason });
+        }
+        offers.push({ kind: "batch", rules: batchRules, uncoveredSegments: uncoveredDetail.length, uncoveredDetail });
     }
     return offers;
 }
+let DEFAULT_DIRECTORY_DENY;
+function defaultDeniesDirectoryRead(directory) {
+    if (DEFAULT_DIRECTORY_DENY === undefined) {
+        const matcher = compileReadDeny([], "directoryRead mint floor");
+        DEFAULT_DIRECTORY_DENY = (d) => matcher.matchPath(d) !== null;
+    }
+    return DEFAULT_DIRECTORY_DENY(directory);
+}

package/dist/core/permission-rule-org.js

@@ -191,8 +191,12 @@ export function unenforceableOrgRules(rules) {
         if (typeof r?.rule !== "string" || r.rule === "")
             continue;
         const parsed = parseAllowRuleText(r.rule, { direction: "tighten" });
-        if ("reject" in parsed)
+        if ("reject" in parsed) {
             out.push({ rule: r.rule, code: parsed.reject.code });
+            continue;
+        }
+        if (parsed.rule.tool !== "Bash")
+            out.push({ rule: r.rule, code: "unsupported.tool" });
     }
     return out;
 }
@@ -259,11 +263,14 @@ export async function effectivePermissionRules(opts) {
     const orgDenies = (opts.orgSnapshot?.rules ?? []).filter((r) => r.behavior === "deny");
     const out = [];
     for (const r of listed.rules) {
-        const segments = ruleLaneSegmentsOf(r.command);
-        const shadowed = orgDenies.some((d) => {
-            const parsed = parseAllowRuleText(d.rule, { direction: "tighten" });
-            return !("reject" in parsed) && parsed.rule.tool === r.tool && orgRuleReaches(parsed.rule, r.command, segments);
-        });
+        const shadowed = r.tool === "Bash" &&
+            (() => {
+                const segments = ruleLaneSegmentsOf(r.command);
+                return orgDenies.some((d) => {
+                    const parsed = parseAllowRuleText(d.rule, { direction: "tighten" });
+                    return !("reject" in parsed) && parsed.rule.tool === r.tool && orgRuleReaches(parsed.rule, r.command, segments);
+                });
+            })();
         out.push({ rule: r.rule, scope: r.scope, status: shadowed ? "shadowed-by-org" : "live" });
     }
     for (const t of listed.tombstones) {

package/dist/core/remote-env.d.ts

@@ -383,8 +383,15 @@ export interface RemoteExecutionEnv extends ExecutionEnv {
      * 🔴 Ordering red line (design/48 §5/#6): at-rest encryption of the memory snapshot must be ensured BEFORE
      * secrets are injected — never let plaintext credentials land in an unencrypted snapshot. That encryption is a
      * service-side property of the snapshot store; this method must fail-and-clean if it cannot be guaranteed.
+     *
+     * `opts.abortSignal` (design/384 slice 2, ADDITIVE — implementations are not forced to change): an
+     * early-release channel for a caller whose wait on this init is bounded (the park fence's paused-VM
+     * compensation). Best-effort exactly like {@link suspendVM}'s — an implementation may ignore it; the
+     * caller bounds its own wait and treats a deaf adapter as failed.
      */
-    postResumeInit(): Promise<{
+    postResumeInit(opts?: {
+        abortSignal?: AbortSignal;
+    }): Promise<{
         ok: true;
         value: void;
     } | {

package/dist/core/runner/assemble-result.js

@@ -180,5 +180,6 @@ export function assembleResult(spec, sessionId, final, stats, flags) {
     void _internalCompaction;
     if (flags.unpricedSpend)
         delete publicStats.costMicroUsd;
-    return { taskId, ...(flags.runId !== undefined ? { runId: flags.runId } : {}), sessionId, status, ...(flags.model !== undefined ? { model: flags.model } : {}), result: result.trim(), salvagedOutput, blockedReason, errorMessage, errorCode, ...(apiFailure !== undefined ? { apiFailure } : {}), ...(retryAfterMs !== undefined ? { retryAfterMs } : {}), checkpointToken, ...(checkpointId !== undefined ? { checkpointId } : {}), checkpointGate, ...(workspaceRestoreMode !== undefined ? { workspaceRestoreMode } : {}), ...(flags.rewindNotes !== undefined && flags.rewindNotes.length > 0 ? { rewindNotes: flags.rewindNotes } : {}), ...(flags.haltedOnUserRejection === true ? { haltedOnUserRejection: true } : {}), ...(flags.userHalted === true ? { haltedByUser: true } : {}), ...(flags.remoteEnvFailures !== undefined && flags.remoteEnvFailures.length > 0 ? { remoteEnvFailures: flags.remoteEnvFailures } : {}), ...(flags.strandedHumanAnswers !== undefined && flags.strandedHumanAnswers.length > 0 ? { strandedHumanAnswers: flags.strandedHumanAnswers } : {}), ...(flags.effectiveReadFace !== undefined ? { effectiveReadFace: flags.effectiveReadFace } : {}), ...(flags.effectiveReadDenyPatterns !== undefined && flags.effectiveReadDenyPatterns.length > 0 ? { effectiveReadDenyPatterns: flags.effectiveReadDenyPatterns } : {}), ...(flags.effectiveMemoryScopes !== undefined ? { effectiveMemoryScopes: flags.effectiveMemoryScopes } : {}), ...(flags.effectiveReasoning !== undefined ? { effectiveReasoning: flags.effectiveReasoning } : {}), stats: publicStats };
+    const stampHaltedByUser = flags.userHalted === true && status !== "suspended" && status !== "needs_review";
+    return { taskId, ...(flags.runId !== undefined ? { runId: flags.runId } : {}), sessionId, status, ...(flags.model !== undefined ? { model: flags.model } : {}), result: result.trim(), salvagedOutput, blockedReason, errorMessage, errorCode, ...(apiFailure !== undefined ? { apiFailure } : {}), ...(retryAfterMs !== undefined ? { retryAfterMs } : {}), checkpointToken, ...(checkpointId !== undefined ? { checkpointId } : {}), checkpointGate, ...(workspaceRestoreMode !== undefined ? { workspaceRestoreMode } : {}), ...(flags.rewindNotes !== undefined && flags.rewindNotes.length > 0 ? { rewindNotes: flags.rewindNotes } : {}), ...(flags.haltedOnUserRejection === true ? { haltedOnUserRejection: true } : {}), ...(stampHaltedByUser ? { haltedByUser: true } : {}), ...(flags.remoteEnvFailures !== undefined && flags.remoteEnvFailures.length > 0 ? { remoteEnvFailures: [...flags.remoteEnvFailures] } : {}), ...(flags.strandedHumanAnswers !== undefined && flags.strandedHumanAnswers.length > 0 ? { strandedHumanAnswers: flags.strandedHumanAnswers } : {}), ...(flags.effectiveReadFace !== undefined ? { effectiveReadFace: flags.effectiveReadFace } : {}), ...(flags.effectiveReadDenyPatterns !== undefined && flags.effectiveReadDenyPatterns.length > 0 ? { effectiveReadDenyPatterns: flags.effectiveReadDenyPatterns } : {}), ...(flags.effectiveMemoryScopes !== undefined ? { effectiveMemoryScopes: flags.effectiveMemoryScopes } : {}), ...(flags.effectiveReasoning !== undefined ? { effectiveReasoning: flags.effectiveReasoning } : {}), stats: publicStats };
 }

package/dist/core/runner/prepare-task.d.ts

@@ -24,13 +24,14 @@ import { type ToolManifestRow } from "../../prompt-assembly/tool-catalog.js";
 import type { ToolDisclosureManifest } from "../trace.js";
 import { type ClearedProjectionLedger, type ContextEditMachine, type OccurrenceIndex } from "../context-edit.js";
 import type { TaskNotificationPayload } from "../task-notification.js";
+import type { RemoteExecutionEnv, SnapshotId } from "../remote-env.js";
 import { type CwdRef, type ReadFace } from "../../tools/fs/index.js";
 import { type WorkflowSizeGuideline } from "../../orchestration/workflow-size-guideline.js";
 import type { Runner } from "./runtask.js";
 import { type CheckpointGate, type CheckpointState, type CheckpointToken, type ResourceLedger, type PlatformLimitReason, type ResourceLimitReason } from "../checkpoint-store.js";
 import { type WiringManifest } from "../wiring-manifest.js";
 import type { ActiveWorktreeSession, AgentMessage, AgentTool, ExecutionEnv } from "../../internal/harness.js";
-import type { NestedUsageAccum, RunnerDeps, TaskEvent, TaskResult, TaskSpec, ToolActivity, ToolEffect } from "../types.js";
+import type { NestedUsageAccum, RemoteEnvFailureNote, RunnerDeps, TaskEvent, TaskResult, TaskSpec, ToolActivity, ToolEffect } from "../types.js";
 import type { RepairBundle } from "../../agents/repair-loop.js";
 /** Test seam (mirrors `__resetToolModelGateAnnouncements`): never called by production code.
  *  Re-arms BOTH arms (a WeakMap has no clear — it is re-minted). */
@@ -1896,6 +1897,43 @@ export declare function batchContextAt(messages: AgentMessage[], currentId: stri
     batchToolCallIds: string[];
     completedCallIds: string[];
 };
+/**
+ * design/384 slice 2 — the ONE compensation for a paused-but-unparked VM, shared by the fence's
+ * post-pause checkpoints (③ in the park closure, ④ in the saga) and the saga's put-failure absent
+ * arm (previously inline there: same two hops, one implementation now, so the three sites cannot
+ * drift). Restores the workspace (bounded transient retry) then re-establishes consistency
+ * (`postResumeInit`), both hops under one INDEPENDENT `AbortSignal.timeout(io.boundMs)` —
+ * deliberately NOT the run/cut signal: the remote contract answers an already-aborted signal
+ * `{ok:false,"aborted"}`, so gating the restore on the very signal whose firing caused the
+ * compensation made it die instantly and strand the paused VM on exactly the run-abort arm that
+ * needs it most. The adapter signal is best-effort (a deaf adapter ignores it), so the caller's
+ * await is ALSO raced against the same bound — bounded decision, three outcomes:
+ *  · settled ok  ⇒ the VM is running again ({ok:true});
+ *  · settled not-ok / threw ⇒ recorded + disclosed, {ok:false} — the caller takes its fatal
+ *    fail-closed arm (abort the run; never continue on a paused VM);
+ *  · bound fires with the adapter still in flight ⇒ {ok:false} NOW, and the in-flight call
+ *    continues DETACHED + swallow-guarded with the late-settlement split:
+ *     – late SUCCESS: a running VM now exists with no run and no committed row to own it — the
+ *       detached continuation compensates the compensation with `destroy()` (the adapter's own
+ *       best-effort contract, swallow-guarded, disclosed);
+ *     – late FAILURE: disclosed; the VM is most likely still paused — provider-side TTL/GC
+ *       territory, and the disclosure is the end of this engine's obligation (a deaf adapter's
+ *       stranded VM is that adapter's own defect surface).
+ * Decide-then-disclose throughout: `io.disclose`/`io.noteFailure` must be swallow-guarded by the
+ * caller's binding, and nothing they do can change the returned verdict. Never throws. Exported for
+ * direct unit pinning (the bounded/deaf/late arms need a small bound; production binds the
+ * `PARK_COMPENSATION_TIMEOUT_MS` constant at the one call-site closure).
+ */
+export declare function compensateUnparkedPause(remoteEnv: RemoteExecutionEnv, snapshotId: SnapshotId, io: {
+    boundMs: number;
+    noteFailure: (note: RemoteEnvFailureNote) => void;
+    disclose: (err: unknown) => void;
+}): Promise<{
+    ok: true;
+} | {
+    ok: false;
+    reason: string;
+}>;
 /**
  * rescan C5 — the ONE spelling of the placement fields' empty-string discipline: `""` is absence
  * wearing clothes (the resume entry's principal-rung posture), and every placement read that must