@sema-agent/core 7.16.0 → 7.17.0

package/dist/core/lsp-session.d.ts

@@ -67,7 +67,7 @@ export declare class TransportLspSession implements LspSession {
      *  it REPORTS failure instead (`{ok:false}`) — an unreadable file no longer looks like a clean sync to the
      *  caller. Concurrent callers share one in-flight sync, each keeping its OWN cancellation (HRD-LSP-12). */
     private syncOne;
-    /** RB-232: structural fallback classification for errors carrying no {@link lspFailureOf} brand (a
+    /** Structural fallback classification for errors carrying no {@link lspFailureOf} brand (a
      *  third-party transport, e.g. the TOB WS lane) — abort signal and transport liveness are the only
      *  transport-neutral facts available; everything else is a server fault. Cannot produce
      *  "unsupported_operation" until that transport brands its JSON-RPC error codes (cross-repo slip). */

package/dist/core/lsp.d.ts

@@ -50,7 +50,7 @@ export interface LspSymbolInfo {
     positionUnknown?: boolean;
 }
 /**
- * RB-232: WHY a "none" result was "none". Absent `reason` = a GENUINE empty answer (the server
+ * WHY a "none" result was "none". Absent `reason` = a GENUINE empty answer (the server
  * answered null/[] — today's behavior byte-for-byte, and what an external manager returning bare
  * `{kind:"none"}` keeps getting). The failure reasons exist because one literal "No results." used to cover
  * both real emptiness and every transport-level fault — a findReferences that TIMED OUT read as "no

package/dist/core/lsp.js

@@ -1,5 +1,5 @@
 import { uriToPath } from "./lsp-protocol.js";
-import { foldRedundantPathSegments, isAbsolutePathForm } from "../tools/fs/safety.js";
+import { foldRedundantPathSegments, isAbsoluteForFamily, joinForFamily, pathFamilyOf } from "../tools/fs/safety.js";
 import { Type } from "typebox";
 import { defineTool, errorResult } from "./tools.js";
 import { toolFace } from "./tool-catalog-entries.js";
@@ -69,10 +69,11 @@ export function settleOnAbort(job, signal, onAbort) {
     });
 }
 export function resolveLspPath(filePath, cwd) {
-    const isAbsForm = isAbsolutePathForm(filePath);
-    if (isAbsForm || !cwd)
+    const family = cwd === undefined ? undefined : pathFamilyOf({ root: cwd });
+    const isAbsForm = family !== undefined && isAbsoluteForFamily(family, filePath);
+    if (isAbsForm || !cwd || family === undefined)
         return foldRedundantPathSegments(filePath);
-    return foldRedundantPathSegments(cwd.replace(/[\\/]+$/, "") + (cwd.includes("\\") ? "\\" : "/") + filePath);
+    return foldRedundantPathSegments(joinForFamily(family, cwd, filePath));
 }
 export const MAX_LSP_FILE_BYTES = 10 * 1000 * 1000;
 function fmt(result, ctx) {

package/dist/core/mcp.d.ts

@@ -168,7 +168,7 @@ export interface MaterializedMcp {
      * A consumer (service) surfacing it as session status must understand that. `toolNames` are the namespaced
      * (`<server>__<tool>`) names exposed.
      *
-     * RB-437-a — READ THIS AS A SNAPSHOT, NOT A HEARTBEAT. `status` is the connect-time verdict and is never
+     * READ THIS AS A SNAPSHOT, NOT A HEARTBEAT. `status` is the connect-time verdict and is never
      * rewritten: a server that dies mid-task still reads `connected` here, because that IS what happened at
      * materialize. The one live bit is {@link McpServerStatus.transportClosed} (set if and when core observes
      * the transport go away — see its own note for the reach). For an authoritative answer about a server's
@@ -231,7 +231,7 @@ export interface McpRefreshResult {
      */
     error?: string;
     /**
-     * #381 — present when this entry's `tools/list` walk did NOT reach the end of pagination. `tools` is
+     * Present when this entry's `tools/list` walk did NOT reach the end of pagination. `tools` is
      * then a MERGE: everything the partial listing did return, plus the previously-mounted entries whose
      * absence it cannot prove (so the consumer's replace-the-whole-prefix swap withdraws nothing, and
      * `removed: []` describes a roster that really lost nothing). Absent on a complete walk and on every
@@ -267,7 +267,7 @@ export interface McpServerStatus {
     delivered?: McpDelivered;
     httpStatus?: number;
     /**
-     * RB-437-a — set to `true` once core OBSERVES this server's transport close during the task; absent
+     * Set to `true` once core OBSERVES this server's transport close during the task; absent
      * otherwise (never `false`: absence means "no close was observed", which is not the same as "alive").
      * It mirrors exactly the flag core's own fail-fast path keys on, so `transportClosed === true` also
      * means every further call to this server's tools/resources is refused without dialing.
@@ -376,7 +376,7 @@ export declare function mcpStartupTimeoutMs(): number | undefined;
  *  (see {@link MCP_SPEC_ERROR_CODE_NAMES}). */
 export declare function describeMcpSpecErrorCode(code: unknown): string | undefined;
 /**
- * RB-437-c — the SDK stamps `MCP error <code>: ` onto an McpError's message IN ITS CONSTRUCTOR, and it
+ * The SDK stamps `MCP error <code>: ` onto an McpError's message IN ITS CONSTRUCTOR, and it
  * does so at BOTH ends of the wire: a server built on an MCP SDK throws an McpError, its already-stamped
  * `.message` goes out as the JSON-RPC `error.message`, and the client constructs its own McpError over
  * that string — so the failure reaches the model as `MCP error -32602: MCP error -32602: …`. Collapse a
@@ -582,7 +582,7 @@ export declare function classifyDirReadInvalidParams(message: string): "not_foun
  */
 export declare function listEntryFingerprint(entry: unknown): string | undefined;
 /**
- * #381 — walk a paginated MCP list method to the END (`{cursor?}` → `{items, nextCursor?}`), bounded.
+ * Walk a paginated MCP list method to the END (`{cursor?}` → `{items, nextCursor?}`), bounded.
  *
  * Every spec-standard MCP list method is paginated the same way: absence of `nextCursor` means "that
  * was the last page". A single request therefore returns the WHOLE list only for servers that choose

package/dist/core/mcp.js

@@ -1,5 +1,6 @@
 import { redactSecrets } from "./untrusted-egress.js";
-import { announceEnvKnob, __resetEnvKnobAnnouncements } from "./env-knob-announce.js";
+import { __resetEnvKnobAnnouncements } from "./env-knob-announce.js";
+import { resolveEnvBudget } from "./env-budget.js";
 import { MCP_NAMESPACE } from "./protocol-table.js";
 import { findNamespacePrefixCollision, mintNamespacePrefix, mintNamespacedToolName, normalizeNameSegment } from "./protocol-naming.js";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
@@ -31,18 +32,7 @@ export function resolveMcpDeclaredResultSize(meta) {
     return Math.min(declared, MCP_META_RESULT_SIZE_CAP);
 }
 function mcpMaxOutputTokens() {
-    const rawEnv = process.env.MAX_MCP_OUTPUT_TOKENS;
-    if (rawEnv === undefined)
-        return MCP_OUTPUT_TOKENS_DEFAULT;
-    const raw = rawEnv.trim();
-    if (raw === "")
-        return MCP_OUTPUT_TOKENS_DEFAULT;
-    const n = parseWholeNumber(raw);
-    if (n === undefined || n <= 0) {
-        announceEnvKnob(`MAX_MCP_OUTPUT_TOKENS=${rawEnv} was ignored — it is not a positive whole number of tokens. Using ${MCP_OUTPUT_TOKENS_DEFAULT} instead.`);
-        return MCP_OUTPUT_TOKENS_DEFAULT;
-    }
-    return n;
+    return resolveEnvBudget(process.env.MAX_MCP_OUTPUT_TOKENS, { name: "MAX_MCP_OUTPUT_TOKENS", unit: "tokens", default: MCP_OUTPUT_TOKENS_DEFAULT });
 }
 function mcpTruncationNote(limitTokens) {
     return (`\n\n[OUTPUT TRUNCATED - exceeded ${limitTokens} token limit]\n\n` +
@@ -114,45 +104,11 @@ export function truncateMcpErrorText(s) {
 export const MCP_TOOL_TIMEOUT_DEFAULT_MS = 100_000_000;
 export const MCP_ENV_MS_MIN = 1_000;
 export const MCP_ENV_MS_MAX = 2_147_483_647;
-const ENV_SCIENTIFIC_RE = /^[+-]?(\d+(\.\d*)?|\.\d+)[eE][+-]?\d+$/;
-const ENV_GROUPED_RE = /^[+-]?\d{1,3}([_,\u00A0\u202F ])\d{3}(?:\1\d{3})*$/;
-const ENV_GROUP_SEPARATORS_RE = /[_,\u00A0\u202F ]/g;
-const ENV_NUMERIC_MAX_LEN = 32;
-function parseWholeNumber(raw) {
-    if (/^[+-]?\d+$/.test(raw)) {
-        const n = Number(raw);
-        return Number.isSafeInteger(n) ? n : undefined;
-    }
-    if (raw.length > ENV_NUMERIC_MAX_LEN)
-        return undefined;
-    if (ENV_SCIENTIFIC_RE.test(raw)) {
-        const n = Number(raw);
-        return Number.isSafeInteger(n) ? n : undefined;
-    }
-    if (ENV_GROUPED_RE.test(raw))
-        return parseInt(raw.replace(ENV_GROUP_SEPARATORS_RE, ""), 10);
-    return undefined;
-}
 export function __resetMcpEnvAnnouncements() {
     __resetEnvKnobAnnouncements();
 }
 function parseEnvMs(name) {
-    const rawEnv = process.env[name];
-    if (rawEnv === undefined)
-        return undefined;
-    const raw = rawEnv.trim();
-    if (raw === "")
-        return undefined;
-    const n = parseWholeNumber(raw);
-    if (n === undefined || n <= 0) {
-        announceEnvKnob(`${name}=${rawEnv} was ignored — it is not a positive whole number of milliseconds. Using the built-in default instead.`);
-        return undefined;
-    }
-    const clamped = Math.min(Math.max(n, MCP_ENV_MS_MIN), MCP_ENV_MS_MAX);
-    if (clamped !== n) {
-        announceEnvKnob(`${name}=${rawEnv} is outside the range this runtime can honor (${MCP_ENV_MS_MIN}..${MCP_ENV_MS_MAX} ms). Using ${clamped}ms instead.`);
-    }
-    return clamped;
+    return resolveEnvBudget(process.env[name], { name, unit: "milliseconds", default: undefined, min: MCP_ENV_MS_MIN, max: MCP_ENV_MS_MAX });
 }
 export function mcpToolTimeoutMs() {
     return parseEnvMs("MCP_TOOL_TIMEOUT") ?? MCP_TOOL_TIMEOUT_DEFAULT_MS;

package/dist/core/memory-recall.d.ts

@@ -177,14 +177,6 @@ export declare function composeSelectiveBody(manifestText: string, selected: Mem
  *  widen the public surface (and invite callers to parse the opaque format) for zero consumer. Treat the key
  *  as an opaque token: persist it, feed it back, compare for equality — never split it. */
 export declare function encodeSurfacedKey(scope: string, id: string): string;
-/** A manifest header tagged with the scope it came from (design/84 Seam A decision 5). */
-export interface ScopedNoteHeader extends MemoryNoteHeader {
-    scope: string;
-}
-/** A full record tagged with its scope (for cross-scope getByIds). */
-export interface ScopedNoteRecord extends MemoryNoteRecord {
-    scope: string;
-}
 export interface LayeredRecallOptions {
     store: MemoryStore;
     /** Ordered scopes (design/84 Seam A): list order = priority; the last is highest. */

package/dist/core/memory.d.ts

@@ -233,7 +233,7 @@ export type ConsolidationCapableStore = MemoryStore & Required<Pick<MemoryStore,
  * (design/41): {@link MemoryStore.searchScored}/{@link MemoryStore.update}/{@link MemoryStore.delete}.
  * When false, the Runner skips consolidation entirely (graceful no-op).
  *
- * RB-436-g: a TYPE PREDICATE, so the guard's conclusion travels to the call sites. A bare boolean left
+ * A TYPE PREDICATE, so the guard's conclusion travels to the call sites. A bare boolean left
  * every post-guard call site writing `store.update!(…)`, and a guard that later forgot one of the three
  * would have been invisible — the `!`s keep compiling. Now dropping a method from the check turns the
  * call sites red.

package/dist/core/oracle-isolation.js

@@ -1,5 +1,5 @@
 import { isRemoteExecutionEnv, isIsolated } from "./remote-env.js";
-import { canonicalizeTarget } from "../tools/fs/safety.js";
+import { canonicalizeTarget, pathFamilyOf } from "../tools/fs/safety.js";
 function probeCommand(canonOraclePath) {
     const q = `'${canonOraclePath.replace(/'/g, `'\\''`)}'`;
     return `touch -- ${q}/.oracle-isolation-probe 2>/dev/null`;
@@ -31,7 +31,7 @@ export async function assertOracleIsolation(workerEnv, grader, opts) {
         }
         let writable;
         try {
-            const canon = await canonicalizeTarget(workerEnv, oraclePath, opts?.signal);
+            const canon = await canonicalizeTarget(workerEnv, oraclePath, opts?.signal, pathFamilyOf({ root: oraclePath }));
             if (!canon.ok) {
                 return { protected: false, isolationClass, reason: `cannot canonicalize oracle path "${oraclePath}": ${canon.message}` };
             }

package/dist/core/parent-spec-seat.d.ts

@@ -0,0 +1,66 @@
+/**
+ * The parent SPEC seat a run hands its children — the projection of the fields of the parent's own REBOUND spec
+ * that inherit copy-at-spawn (identity, process facts, deployment facts, the frozen question face) onto ONE value
+ * both delegation lanes copy onto a child spec: `ToolExecuteContext.parentSpecSeat` on the Task lane,
+ * `RunWorkflowToolDeps.parentSpecSeat` → `RunWorkflowOptions.parentSpecSeat` on the workflow lane. Minted once per
+ * prepare (the inherited-gate phase); applied by ONE function ({@link applyParentSpecSeat}) so the two lanes
+ * cannot drift on which fields travel or on the priority between a child's own value and the parent's.
+ *
+ * The checkpoint seat (`./checkpoint-seat.ts`) is the same shape for one field; this seat carries the rest.
+ */
+import type { OnQuestion } from "./ask-question.js";
+import type { ToolExecuteContext } from "./tool-spec.js";
+import type { TaskSpec } from "./types.js";
+/** The fields of a spec the seat carries — one `Pick`, shared by the mint's input and the apply's target. */
+export type ParentSpecSeatFields = Pick<TaskSpec, "principal" | "oneShot" | "clientContext" | "onQuestion" | "additionalDirectories" | "additionalReadDirectories" | "envFacts" | "memoryPersistenceCapable">;
+/**
+ * The seat a run hands its children. Every member is the parent's own value, frozen at mint (arrays copied and
+ * frozen; the facts object copied). Members present iff the parent carries them — an absent member is "nothing to
+ * inherit", never a value.
+ *  · `principal` — the end-user identity (design/62: inherits verbatim, a worker cannot delegate under another).
+ *  · `oneShot` — the process fact ("no later turn"): only `true` travels; it is a REMOVAL (see the apply law).
+ *  · `clientContext` — the user's TZ/email facts (the child's environment block localizes the same way).
+ *  · `onQuestion` — the parent's FROZEN question face (`spec.onQuestion ?? deps.onQuestion`, the value the parent's
+ *    own AskUserQuestion resolves at): the child's question tool MOUNTS on it, so without it the child has no tool.
+ *  · `additionalDirectories` / `additionalReadDirectories` — the fs-fence widening (deployment property).
+ *  · `envFacts` — the sandbox facts (profile / egress / scratchpad).
+ *  · `memoryPersistenceCapable` — the deployment's DECLARED persistence statement: `false` is a REMOVAL (floor),
+ *    `true` a default a child's own declaration may narrow.
+ */
+export interface ParentSpecSeat {
+    readonly principal?: string;
+    readonly oneShot?: true;
+    readonly clientContext?: TaskSpec["clientContext"];
+    readonly onQuestion?: OnQuestion;
+    readonly additionalDirectories?: readonly string[];
+    readonly additionalReadDirectories?: readonly string[];
+    readonly envFacts?: TaskSpec["envFacts"];
+    readonly memoryPersistenceCapable?: boolean;
+}
+/** Mint the seat off the parent's REBOUND spec and its frozen question face (spec over deps — the caller resolves it once,
+ *  the same value the parent's own question routing reads). Absent fields stay absent; `oneShot` only when `true`. */
+export declare function parentSpecSeatOf(spec: Omit<ParentSpecSeatFields, "onQuestion">, frozenOnQuestion: OnQuestion | undefined): ParentSpecSeat;
+/**
+ * Apply the seat to a child spec — ONE law for every member, both lanes:
+ *   a value the child spec already carries WINS; the seat FILLS an unset one; the two REMOVAL values
+ *   (`oneShot: true`, `memoryPersistenceCapable: false`) land UNCONDITIONALLY.
+ * "Already carries" is the child's own authorship — a deployment baseline, a trusted script, an agent definition's
+ * fold (the Task lane folds the definition's `memoryPersistenceCapable` before applying; the workflow lane applies at
+ * the launch site AFTER the agentType fold) — so a definition may narrow a parent `true` to `false`, a baseline-pinned
+ * principal stands, and nothing a child can author lifts a removal. Arrays and the facts object are copied per child
+ * (a retained child's frozen snapshot must not alias the parent's seat). Returns a NEW object; `child` is not mutated.
+ * No seat (a tool running outside a Runner task) ⇒ the child spec is returned as is.
+ */
+export declare function applyParentSpecSeat<S extends ParentSpecSeatFields>(child: S, seat: ParentSpecSeat | undefined): S;
+/** The ctx keys that restate a seat member as THIS run's own fact (tools read them for scope / receipts / clamps). */
+declare const SEAT_FACTS_ON_CTX: readonly ["principal", "oneShot", "onQuestion", "memoryPersistenceCapable"];
+/**
+ * The seat a delegation boundary reads off a trusted ctx — ONE reader for both delegation tools. A Runner-filled ctx
+ * always carries the seat beside the run's own facts, and the two agree by construction (one mint). A HAND-BUILT ctx
+ * (a caller invoking a delegation tool's `execute` directly) that carries any of those facts WITHOUT the seat, or with
+ * a seat that disagrees with them, is REFUSED (`config.parent_spec_seat_missing`): spawning a principal-less child from a
+ * principal-bearing caller would offload into the shared namespace and re-key its journal — a silent tenant narrowing,
+ * never a fallback. A ctx with neither (a tool running outside a Runner task) hands down no seat.
+ */
+export declare function parentSpecSeatOfCtx(ctx: Pick<ToolExecuteContext, "parentSpecSeat" | (typeof SEAT_FACTS_ON_CTX)[number]>): ParentSpecSeat | undefined;
+export {};

package/dist/core/parent-spec-seat.js

@@ -0,0 +1,47 @@
+export function parentSpecSeatOf(spec, frozenOnQuestion) {
+    return Object.freeze({
+        ...(spec.principal !== undefined ? { principal: spec.principal } : {}),
+        ...(spec.oneShot === true ? { oneShot: true } : {}),
+        ...(spec.clientContext !== undefined ? { clientContext: spec.clientContext } : {}),
+        ...(frozenOnQuestion !== undefined ? { onQuestion: frozenOnQuestion } : {}),
+        ...(spec.additionalDirectories !== undefined ? { additionalDirectories: Object.freeze([...spec.additionalDirectories]) } : {}),
+        ...(spec.additionalReadDirectories !== undefined ? { additionalReadDirectories: Object.freeze([...spec.additionalReadDirectories]) } : {}),
+        ...(spec.envFacts !== undefined ? { envFacts: Object.freeze({ ...spec.envFacts }) } : {}),
+        ...(spec.memoryPersistenceCapable !== undefined ? { memoryPersistenceCapable: spec.memoryPersistenceCapable } : {}),
+    });
+}
+export function applyParentSpecSeat(child, seat) {
+    if (seat === undefined)
+        return child;
+    const fill = (key, value) => child[key] === undefined && value !== undefined ? { [key]: value } : {};
+    return {
+        ...child,
+        ...fill("principal", seat.principal),
+        ...fill("clientContext", seat.clientContext),
+        ...fill("onQuestion", seat.onQuestion),
+        ...fill("additionalDirectories", (seat.additionalDirectories !== undefined ? [...seat.additionalDirectories] : undefined)),
+        ...fill("additionalReadDirectories", (seat.additionalReadDirectories !== undefined ? [...seat.additionalReadDirectories] : undefined)),
+        ...fill("envFacts", (seat.envFacts !== undefined ? { ...seat.envFacts } : undefined)),
+        ...(seat.oneShot === true ? { oneShot: true } : {}),
+        ...(seat.memoryPersistenceCapable === false ? { memoryPersistenceCapable: false } : fill("memoryPersistenceCapable", seat.memoryPersistenceCapable)),
+    };
+}
+const SEAT_FACTS_ON_CTX = ["principal", "oneShot", "onQuestion", "memoryPersistenceCapable"];
+export function parentSpecSeatOfCtx(ctx) {
+    const seat = ctx.parentSpecSeat;
+    const facts = SEAT_FACTS_ON_CTX.filter((k) => ctx[k] !== undefined);
+    if (seat === undefined) {
+        if (facts.length === 0)
+            return undefined;
+        throw seatRefusal(`the tool context carries ${facts.join(" / ")} but no \`parentSpecSeat\` — a delegating caller hands its children the seat it was minted (a Runner-filled ctx always carries it); spawning without it would silently drop the identity`);
+    }
+    const disagree = facts.filter((k) => (k === "oneShot" ? (ctx.oneShot === true) !== (seat.oneShot === true) : ctx[k] !== seat[k]));
+    if (disagree.length > 0)
+        throw seatRefusal(`the tool context's ${disagree.join(" / ")} disagree with its \`parentSpecSeat\` — one mint, one value`);
+    return seat;
+}
+function seatRefusal(message) {
+    const e = new Error(`parentSpecSeat: ${message}`);
+    e.code = "config.parent_spec_seat_missing";
+    return e;
+}

package/dist/core/permission-rule-model.d.ts

@@ -73,6 +73,8 @@
  * `Bash(git status:*)`) — the last two are strict-side divergences from upstream, registered as such.
  */
 import type { AssertAllKeysHandled } from "./ask-origin.js";
+import { type PathFamily, type PathIdentity } from "../tools/fs/safety.js";
+import type { PathTargetReading } from "./effective-path-target.js";
 /**
  * The closed set of rule BEHAVIORS — what a matching rule says about the call. The upstream vocabulary
  * verbatim (`allow` / `deny` / `ask`, the three settings lists), in PRECEDENCE order: when rules of more
@@ -538,7 +540,7 @@ export type PathRuleBaseLabelCoversEveryBase = AssertAllKeysHandled<Exclude<Path
 export declare function ruleBasesNeeded(rule: Pick<PersistedRule, "match" | "command">): readonly PathRuleBase[];
 /** Is this base usable by {@link resolvePathPattern} — an absolute path with a lexical normal form? A rule
  *  compiler asks this at compile time so a pattern is refused rather than compiled inert. */
-export declare function isUsablePathBase(base: string | undefined): boolean;
+export declare function isUsablePathBase(base: string | undefined, family: PathFamily | undefined): boolean;
 /**
  * The PATH family's tightening reach — three-valued like the command family's ({@link programRunReachOf}):
  * does this deny/ask rule reach the call's target path? The target is the caller's ALREADY-RESOLVED
@@ -555,7 +557,7 @@ export declare function isUsablePathBase(base: string | undefined): boolean;
  * defect (a `~/` deny falling back to the engine host's home guarded the wrong directory; a `/…` deny with
  * no root reached nothing at all).
  */
-export declare function pathRuleReachOf(rule: Pick<PersistedRule, "match" | "command" | "behavior">, target: string, bases: PathRuleBases): ProgramRunReachOutcome;
+export declare function pathRuleReachOf(rule: Pick<PersistedRule, "match" | "command" | "behavior">, target: PathIdentity, bases: PathRuleBases): ProgramRunReachOutcome;
 /**
  * Does this rule's command pattern admit `command`?
  *
@@ -692,7 +694,7 @@ export declare function pathWithinRoot(path: string, root: string): boolean;
  * bodies never come through here (their canonical spelling is unique and non-normal spellings are
  * refused at the validator); this is for the comparison INPUT a caller derives from a live call.
  */
-export declare function lexicalNormalAbsolutePathOf(path: string): string | undefined;
+export declare function lexicalNormalAbsolutePathOf(path: string, family: PathFamily | undefined, anchor?: string): PathIdentity | undefined;
 /**
  * design/382 §2.5 — the ONE admission predicate of the Read directory rule family, beside
  * {@link ruleAdmitsCommand} as its path-lane sibling. Four consumers share it (the minting round
@@ -715,7 +717,10 @@ export declare function lexicalNormalAbsolutePathOf(path: string): string | unde
  * there is nothing here for it to clear). As a DENY/ASK the same containment refuses or questions every
  * path under the directory, on whichever path tool the rule names.
  */
-export declare function directoryRuleAdmits(rule: Pick<PersistedRule, "match" | "command">, path: string): boolean;
+export declare function directoryRuleAdmits(rule: Pick<PersistedRule, "match" | "command">, path: PathIdentity, bases: PathRuleBases): boolean;
+/** The identity of a directory SPELLING (the cd resolver's `/`-rooted output) under the call's tree, for the
+ *  consumers that hand {@link directoryRuleAdmits} a spelling; a rule minted from it stores this form. */
+export declare function directoryIdentityOf(spelling: string, bases: PathRuleBases): PathIdentity | undefined;
 /** Does a rule's scope cover a task running in `cwd` (and, for the session dimension, in the session
  *  named by `sessionId`)? A project rule needs a cwd to compare against; without one it covers nothing
  *  (fail-closed). A session rule (design/382 §4.3) covers a call iff the call's `sessionId` equals the
@@ -872,8 +877,8 @@ export declare function adjudicatePersistedPathRules(rules: readonly PersistedRu
     cwd: string | undefined;
     sessionId?: string;
 }, targets: {
-    readonly tighten?: string;
-    readonly allow?: string;
+    readonly tighten?: PathTargetReading;
+    readonly allow?: PathTargetReading;
 }, bases: PathRuleBases): PersistedRuleVerdict | undefined;
 /**
  * design/375 §5.2 — the per-segment coverage table for `command`: which segments an eligible rule

package/dist/core/permission-rule-model.js

@@ -4,6 +4,7 @@ import { compileReadDeny } from "../tools/fs/read-deny.js";
 import { carriesShellRedirection, parseLeadingCommandName, splitShellCompoundSegments } from "../tools/fs/bash-readonly-classifier.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 import { pathTargetOf } from "./tool-registry.js";
+import { carriesDotSegment, isAbsoluteForFamily, isIdentityDir, isPathIdentity, isShellRootedSpellingUnmapped, isUncIdentity, pathFamilyOf, pathIdentityOf } from "../tools/fs/safety.js";
 import { readShellCommand } from "./shell-lexer.js";
 export const RULE_BEHAVIORS = ["deny", "ask", "allow"];
 const RULE_BEHAVIOR_SET = new Set(RULE_BEHAVIORS);
@@ -364,12 +365,18 @@ function baseValueOf(base, bases) {
     }
 }
 function resolvePathPattern(pattern, bases, behavior) {
-    if (pattern.startsWith("//"))
-        return { resolved: "/" + pattern.slice(2) };
+    const family = pathFamilyOf(bases);
+    const tree = bases.root ?? bases.cwd;
+    if (pattern.startsWith("//")) {
+        const abs = pathIdentityOf("/" + pattern.slice(2), family, tree);
+        return abs.ok ? { resolved: abs.identity } : { missingBase: "root" };
+    }
     const needed = ruleBasesNeeded({ match: "path", command: pattern })[0];
-    const normal = lexicalNormalAbsolutePathOf(baseValueOf(needed, bases) ?? "");
-    if (normal === undefined)
+    const baseValue = baseValueOf(needed, bases);
+    const base = baseValue !== undefined && isAbsoluteForFamily(family, baseValue) ? pathIdentityOf(baseValue, family, tree) : undefined;
+    if (base === undefined || !base.ok)
         return { missingBase: needed };
+    const normal = base.identity;
     const rest = pattern.startsWith("~/") ? pattern.slice(2) : pattern.startsWith("/") ? pattern.slice(1) : pattern.startsWith("./") ? pattern.slice(2) : pattern;
     const peeled = rest.endsWith("/**") ? rest.slice(0, -3) : rest;
     const bare = needed === "cwd" && peeled !== "" && !peeled.includes("/");
@@ -377,8 +384,8 @@ function resolvePathPattern(pattern, bases, behavior) {
     const body = anyDepth ? "**/" + peeled : rest;
     return { resolved: (normal === "/" ? "" : normal) + "/" + body };
 }
-export function isUsablePathBase(base) {
-    return base !== undefined && lexicalNormalAbsolutePathOf(base) !== undefined;
+export function isUsablePathBase(base, family) {
+    return base !== undefined && isAbsoluteForFamily(family, base) && pathIdentityOf(base, family, base).ok;
 }
 function segmentGlobMatches(glob, segment) {
     if (!glob.includes("*"))
@@ -422,15 +429,18 @@ function globSegmentsReach(globs, target) {
 }
 export function pathRuleReachOf(rule, target, bases) {
     if (rule.match === "subpath")
-        return directoryRuleAdmits(rule, target) ? REACHED : NOT_REACHED;
+        return directoryRuleAdmits(rule, target, bases) ? REACHED : NOT_REACHED;
     if (rule.match !== "path")
         return NOT_REACHED;
-    if (!isLexicalNormalAbsoluteDir(target) && target !== "/")
+    const family = pathFamilyOf(bases);
+    if (!isPathIdentity(target, family))
         return NOT_REACHED;
     const r = resolvePathPattern(rule.command, bases, rule.behavior);
     if ("missingBase" in r) {
-        return { reach: "unreadable", reason: `the rule is relative to ${PATH_RULE_BASE_LABEL[r.missingBase]} and this call supplies no absolute \`${r.missingBase}\` base to resolve it against` };
+        return { reach: "unreadable", reason: `the rule is relative to ${PATH_RULE_BASE_LABEL[r.missingBase]} and this call supplies no absolute \`${r.missingBase}\` base of this tree's family to resolve it against` };
     }
+    if (isUncIdentity(r.resolved) !== isUncIdentity(target))
+        return NOT_REACHED;
     const globs = r.resolved.split("/").filter((sg) => sg !== "");
     const segments = target.split("/").filter((sg) => sg !== "");
     return globSegmentsReach(globs, segments) ? REACHED : NOT_REACHED;
@@ -587,21 +597,9 @@ export function pathWithinRoot(path, root) {
     const base = root.endsWith("/") ? root : root + "/";
     return path.startsWith(base);
 }
-export function lexicalNormalAbsolutePathOf(path) {
-    if (typeof path !== "string" || !path.startsWith("/"))
-        return undefined;
-    const out = [];
-    for (const seg of path.split("/")) {
-        if (seg === "" || seg === ".")
-            continue;
-        if (seg === "..") {
-            if (out.length > 0)
-                out.pop();
-            continue;
-        }
-        out.push(seg);
-    }
-    return out.length === 0 ? "/" : "/" + out.join("/");
+export function lexicalNormalAbsolutePathOf(path, family, anchor) {
+    const r = pathIdentityOf(path, family, anchor);
+    return r.ok ? r.identity : undefined;
 }
 function isLexicalNormalAbsoluteDir(path) {
     if (typeof path !== "string" || !path.startsWith("/") || path.startsWith("//"))
@@ -609,14 +607,22 @@ function isLexicalNormalAbsoluteDir(path) {
     const segments = path.split("/").slice(1);
     return segments.length > 0 && segments.every((s) => s !== "" && s !== "." && s !== "..");
 }
-export function directoryRuleAdmits(rule, path) {
+export function directoryRuleAdmits(rule, path, bases) {
     if (rule.match !== "subpath")
         return false;
-    if (!isLexicalNormalAbsoluteDir(rule.command))
+    const family = pathFamilyOf(bases);
+    if (carriesDotSegment(rule.command, family))
+        return false;
+    const dir = pathIdentityOf(rule.command, family, bases.root ?? bases.cwd);
+    if (!dir.ok || !isIdentityDir(dir.identity, family))
         return false;
-    if (!isLexicalNormalAbsoluteDir(path))
+    if (!isPathIdentity(path, family) || !isIdentityDir(path, family))
         return false;
-    return pathWithinRoot(path, rule.command);
+    return pathWithinRoot(path, dir.identity);
+}
+export function directoryIdentityOf(spelling, bases) {
+    const r = pathIdentityOf(spelling, pathFamilyOf(bases), bases.root ?? bases.cwd);
+    return r.ok ? r.identity : undefined;
 }
 const CD_TARGET_REJECT_CHARS = /[*?[\]{}$`\\'"<>\n\r]/;
 function cdSegmentDirectoryOf(segment, opts) {
@@ -711,7 +717,8 @@ function resolveCdSegmentDirectories(segments, cwd) {
         const dir = cdSegmentDirectoryOf(segment, { cwd, priorCd });
         if (!priorCd && movesShellCursor(segment))
             priorCd = true;
-        return dir;
+        const bases = basesOfCwd(cwd);
+        return dir === undefined || isShellRootedSpellingUnmapped(pathFamilyOf(bases), dir) ? undefined : directoryIdentityOf(dir, bases);
     });
 }
 export function scopeCoversCwd(scope, cwd, sessionId) {
@@ -767,11 +774,14 @@ function firstEligibleDirectoryRule(rules, directory, call) {
     for (const rule of rules) {
         if (!eligiblePersisted(rule, { tool: "Read", cwd: call.cwd, sessionId: call.sessionId }, "allow"))
             continue;
-        if (directoryRuleAdmits(rule, directory))
+        if (directoryRuleAdmits(rule, directory, basesOfCwd(call.execCwd ?? call.cwd)))
             return rule;
     }
     return undefined;
 }
+function basesOfCwd(cwd) {
+    return cwd === undefined ? {} : { root: cwd };
+}
 export function adjudicatePersistedRules(rules, call) {
     for (const behavior of RULE_BEHAVIORS_BY_PRECEDENCE) {
         if (behavior === "allow") {
@@ -798,23 +808,29 @@ export function adjudicatePersistedRules(rules, call) {
 export function adjudicatePersistedPathRules(rules, call, targets, bases) {
     for (const behavior of RULE_BEHAVIORS_BY_PRECEDENCE) {
         if (behavior === "allow") {
-            if (targets.allow === undefined || call.tool !== READ_RULE_TOOL)
+            if (targets.allow?.kind !== "path" || call.tool !== READ_RULE_TOOL)
                 continue;
             for (const rule of rules) {
                 if (!eligiblePersisted(rule, call, behavior))
                     continue;
-                if (directoryRuleAdmits(rule, targets.allow))
+                if (directoryRuleAdmits(rule, targets.allow.identity, bases))
                     return { behavior, rules: [rule] };
             }
             continue;
         }
-        if (targets.tighten === undefined)
+        const tighten = targets.tighten;
+        if (tighten === undefined || tighten.kind === "refused")
             continue;
         let unreadable;
         for (const rule of rules) {
             if (!eligiblePersisted(rule, call, behavior))
                 continue;
-            const outcome = pathRuleReachOf(rule, targets.tighten, bases);
+            if (tighten.kind === "unreadable") {
+                if (rule.match === "path" || rule.match === "subpath")
+                    unreadable ??= { behavior: "ask", rules: [rule], unreadable: tighten.reason };
+                continue;
+            }
+            const outcome = pathRuleReachOf(rule, tighten.identity, bases);
             if (outcome.reach === "reached")
                 return { behavior, rules: [rule] };
             if (outcome.reach === "unreadable")
@@ -843,7 +859,7 @@ export function segmentCoverageOf(command, rules, call) {
                 proposed.some((p) => p.rule.tool === "Read"
                     ? dir !== undefined &&
                         eligibleContext({ tool: p.rule.tool, scope: p.scope }, { tool: "Read", cwd: call.cwd, sessionId: call.sessionId }) &&
-                        directoryRuleAdmits(p.rule, dir)
+                        directoryRuleAdmits(p.rule, dir, basesOfCwd(call.execCwd ?? call.cwd))
                     : eligibleContext({ tool: p.rule.tool, scope: p.scope }, call) && ruleAdmitsCommand(p.rule, segment)),
         };
     });
@@ -889,7 +905,7 @@ export function suggestRulesForCommand(command, ctx) {
         const parsed = parseRuleText(formatRuleText(directory, "subpath", READ_RULE_TOOL), "allow");
         if (!("rule" in parsed) || parsed.rule.match !== "subpath")
             return undefined;
-        if (!directoryRuleAdmits(parsed.rule, directory))
+        if (!directoryRuleAdmits(parsed.rule, directory, basesOfCwd(ctx?.execCwd ?? ctx?.cwd)))
             return undefined;
         return { kind: "directoryRead", rule: parsed.rule.rule, directory: parsed.rule.command, segment };
     };
@@ -963,7 +979,7 @@ export function suggestRulesForCommand(command, ctx) {
             if (parsedBatch.some((p) => p.tool !== "Read" && ruleAdmitsCommand(p, segment)))
                 continue;
             const dir = cdDirs[i];
-            if (dir !== undefined && parsedBatch.some((p) => directoryRuleAdmits(p, dir)))
+            if (dir !== undefined && parsedBatch.some((p) => directoryRuleAdmits(p, dir, basesOfCwd(ctx?.execCwd ?? ctx?.cwd))))
                 continue;
             const reason = carriesShellRedirection(segment) ? "redirection" : mintSegmentRule(segment) === undefined ? "no_rule_form" : "cap_overflow";
             uncoveredDetail.push({ segment, reason });

package/dist/core/permission-rules.js

@@ -2,6 +2,7 @@ import { MCP_NAMESPACE, protocolOf } from "./protocol-table.js";
 import { catalogRuleFaceOf, pathTargetOf } from "./tool-registry.js";
 import { indexOfUnescaped, lastIndexOfUnescaped, parsePermissionRule } from "./permission-rule-syntax.js";
 import { PATH_RULE_BASE_LABEL, isUsablePathBase, parseRuleText, pathRuleReachOf, programRunReachOf, ruleBasesNeeded } from "./permission-rule-model.js";
+import { pathFamilyOf } from "../tools/fs/safety.js";
 import { effectivePathTargetOf } from "./effective-path-target.js";
 import { protectivePathTargetOf } from "./tool-registry.js";
 export { parsePermissionRule };
@@ -188,7 +189,7 @@ function compile(rules, caps, primaryFieldGeneric, ruleFaces, pathBases = {}) {
                 }
                 for (const base of ruleBasesNeeded(parsedPath.rule)) {
                     const value = base === "cwd" ? (pathBases.cwd ?? pathBases.root) : pathBases[base];
-                    if (!isUsablePathBase(value)) {
+                    if (!isUsablePathBase(value, pathFamilyOf(pathBases))) {
                         bad(text, "unsupported.path_base", `"${text}" is relative to ${PATH_RULE_BASE_LABEL[base]}, and this policy was given no absolute \`pathBases.${base}\`${base === "cwd" ? " (or `root`)" : ""} to resolve it against — the rule could not be judged on any call`);
                     }
                 }
@@ -321,9 +322,13 @@ export function createPermissionRulePolicy(rules, opts) {
         let unreadable;
         for (const r of lane) {
             if (r.parsed.match === "subpath" || r.parsed.match === "path") {
-                if (target === undefined)
+                if (target === undefined || target.kind === "refused")
                     continue;
-                const outcome = pathRuleReachOf(r.parsed, target, pathBases);
+                if (target.kind === "unreadable") {
+                    unreadable ??= { rule: r, unreadable: target.reason };
+                    continue;
+                }
+                const outcome = pathRuleReachOf(r.parsed, target.identity, pathBases);
                 if (outcome.reach === "reached")
                     return { rule: r };
                 if (outcome.reach === "unreadable")

package/dist/core/protocol-naming.d.ts

@@ -18,13 +18,13 @@ export declare const MINTED_TOOL_SEGMENT_MIN_CHARS = 16;
  * live domain key here (the refresh splice). That case is decided by
  * {@link findNamespacePrefixCollision} and refused at the mount, loudly; the mint stays total.
  *
- * RB-83 (2026-07-25, red probe): the pattern this enforces is `{1,64}`, and only the charset half was
+ * The pattern this enforces is `{1,64}`, and only the charset half was
  * enforced. Both other halves matter for the same reason the charset does — an over-long or empty segment
  * produces a name the provider rejects, which 400s the WHOLE model request, the exact failure the intake
  * gate exists to contain ("a single misconfigured server never bricks the whole task").
  */
 export declare function normalizeNameSegment(name: string): string;
-/** RB-83: force a normalized segment into `{1,max}`, keeping long names distinct via a stable digest. */
+/** Force a normalized segment into `{1,max}`, keeping long names distinct via a stable digest. */
 export declare function clampNameSegment(seg: string, max?: number): string;
 /**
  * The registered-name prefix for `peer` in `ns` — i.e. the set `name.startsWith(prefix)` that a consumer