@sema-agent/core 7.17.4 → 7.17.5

package/wire-changes/core@7.17.1.json

@@ -0,0 +1,139 @@
+{
+  "repo": "core",
+  "version": "7.17.1",
+  "from": "e945d463cc3a40f286160ca48789b727f6fa1fee",
+  "to": "v7.17.1",
+  "added": [
+    {
+      "name": "physicalPathOf",
+      "kind": "function",
+      "tier": "advanced",
+      "at": [
+        "src/core/physical-path.ts:22",
+        "src/index.ts:483"
+      ],
+      "criteriaCovered": false,
+      "breaking": false
+    },
+    {
+      "name": "physicalPathOfExisting",
+      "kind": "function",
+      "tier": "advanced",
+      "at": [
+        "src/core/physical-path.ts:50",
+        "src/index.ts:483"
+      ],
+      "criteriaCovered": false,
+      "breaking": false
+    }
+  ],
+  "removed": [],
+  "changed": [],
+  "narrowed": [
+    {
+      "id": "F1",
+      "source": "behaviorFlips.summary",
+      "text": "Narrowing — The shell read boundary never vouches a read it did not judge (#737; test [7074] G12 / G14): a read the boundary could not JUDGE — a syntax-refused command that may read, an unresolved operand, an unreadable command name, a launcher or path-prefixed reader, a control word or launcher in front of a `cd` inside a loop body — is MANDATED (one ask no rule can silence) on BOTH shell seats; a glob with no deny judge stays a plain ask."
+    },
+    {
+      "id": "F2",
+      "source": "behaviorFlips.summary",
+      "text": "Narrowing — The write-side sensitive-path guard refuses what it could not canonicalize (server [7083] ②): a target whose canonicalization was REFUSED (a UNC spelling on a POSIX tree, a symlink escaping the root) is DENIED naming the cause, never allowed by fall-through."
+    }
+  ],
+  "closedSetMembers": [],
+  "typeKeys": [
+    {
+      "type": "CompoundReadonlyVerdict",
+      "at": [
+        "src/tools/fs/bash-readonly-classifier.ts:631"
+      ],
+      "added": [
+        "refusedWhole"
+      ],
+      "removed": [],
+      "breaking": false,
+      "criteriaCovered": false
+    }
+  ],
+  "declarationMoves": [],
+  "mintMoves": [],
+  "criteriaObserves": [
+    {
+      "kind": "engineNoticeCode",
+      "name": "memory.session_polluted",
+      "assertions": [
+        "G6.a"
+      ]
+    },
+    {
+      "kind": "taskEventField",
+      "name": "tool_end.errorCode",
+      "assertions": [
+        "G2.a"
+      ]
+    },
+    {
+      "kind": "taskEventField",
+      "name": "turn_end.usageMissing",
+      "assertions": [
+        "G5.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "AskRequest.ruleOffersAbsence",
+      "assertions": [
+        "G1.a",
+        "G1.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "ExecutionEnv.canonicalPath",
+      "assertions": [
+        "G4.a",
+        "G4.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "MemoryEngine.materialize",
+      "assertions": [
+        "G5.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "RunInternals.workflowParkedResume",
+      "assertions": [
+        "G3.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "RunWorkflowOptions.checkpointStore",
+      "assertions": [
+        "G5.d"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "WorkflowRun.errorCode",
+      "assertions": [
+        "G5.c"
+      ]
+    }
+  ],
+  "consumersHint": {
+    "cli": [],
+    "server": [
+      "CompoundReadonlyVerdict"
+    ],
+    "sdk": [],
+    "note": "scanned cli@66cd44ed server@cfa2405b sdk@557dfdf — a name listed is MENTIONED there today, which is evidence of consumption, not proof of it"
+  },
+  "breakingCount": 0,
+  "breakingItems": [],
+  "toResolvedAt": "1cb20e749ccc4e1e379f991f622424ea20aa4718"
+}

package/wire-changes/core@7.17.2.json

@@ -0,0 +1,65 @@
+{
+  "repo": "core",
+  "version": "7.17.2",
+  "from": "1cb20e749ccc4e1e379f991f622424ea20aa4718",
+  "to": "v7.17.2",
+  "added": [],
+  "removed": [],
+  "changed": [],
+  "narrowed": [
+    {
+      "id": "F1",
+      "source": "behaviorFlips.summary",
+      "text": "Narrowing of the write gate's asks — the directories the prompt advertises as writable feed the write gate's exemption through the request (#749; cli B-102; server S-261): a run whose prompt advertises a memory write home (and a scratchpad) stamps those CANONICAL roots on every policy adjudication as `ToolCallRequest.advertisedWritableRoots`, and `createFsWriteGatePolicy` allows a covered write whose canonical target lies inside one of them — no ask, no second exemption list on the deployment."
+    },
+    {
+      "id": "F2",
+      "source": "behaviorFlips.summary",
+      "text": "Narrowing corrected — a refused shell command is exempt from the read-boundary mandate only when every part of it is a shape the scan fully understands (#751; test [7111] codex track): a here-document or here-string is a reader's stdin, not a file, so `cat <<'EOF' > out.txt` and `wc -l <<< \"x\"` no longer raise a mandated ask under the default doctrine; everything the scan does not understand mandates."
+    }
+  ],
+  "closedSetMembers": [],
+  "typeKeys": [
+    {
+      "type": "ToolCallRequest",
+      "at": [
+        "src/core/tool-policy.ts:33"
+      ],
+      "added": [
+        "advertisedWritableRoots"
+      ],
+      "removed": [],
+      "breaking": false,
+      "criteriaCovered": true
+    }
+  ],
+  "declarationMoves": [],
+  "mintMoves": [],
+  "criteriaObserves": [
+    {
+      "kind": "typeMember",
+      "name": "AskRequest.ruleOffersAbsence",
+      "assertions": [
+        "G2.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "ToolCallRequest.advertisedWritableRoots",
+      "assertions": [
+        "G1.a"
+      ]
+    }
+  ],
+  "consumersHint": {
+    "cli": [],
+    "server": [
+      "ToolCallRequest"
+    ],
+    "sdk": [],
+    "note": "scanned cli@25ce6655 server@b132e73b sdk@f6ae86f — a name listed is MENTIONED there today, which is evidence of consumption, not proof of it"
+  },
+  "breakingCount": 0,
+  "breakingItems": [],
+  "toResolvedAt": "d6ef7ed0985d53ad982b51998a5bd05ae807e719"
+}

package/wire-changes/core@7.17.3.json

@@ -0,0 +1,44 @@
+{
+  "repo": "core",
+  "version": "7.17.3",
+  "from": "d6ef7ed0985d53ad982b51998a5bd05ae807e719",
+  "to": "a135321a2f648ada1a2bd82f930f924831d5cc4a",
+  "added": [],
+  "removed": [],
+  "changed": [],
+  "narrowed": [
+    {
+      "id": "F1",
+      "source": "behaviorFlips.summary",
+      "text": "Narrowing — the read boundary judges EVERY shell segment (#758; test [7138]; B-105 P0): a segment whose program is NOT on the read-only allowlist is judged whole and verb-blind at all three sites — the boundary walk, the standalone containment gate and the refused-command whitelist — so an unlisted program's reads are subject to containment and the sensitive-path deny table exactly as a listed reader's are. The launcher special case is folded into this one rule (named special cases −2; name-table branches 6 → 3)."
+    }
+  ],
+  "closedSetMembers": [],
+  "typeKeys": [],
+  "declarationMoves": [],
+  "mintMoves": [],
+  "criteriaObserves": [
+    {
+      "kind": "typeMember",
+      "name": "AskRequest.ruleOffersAbsence",
+      "assertions": [
+        "G1.a",
+        "G2.a",
+        "G3.a",
+        "G4.a",
+        "G5.a",
+        "G6.a",
+        "G7.a",
+        "G8.a"
+      ]
+    }
+  ],
+  "consumersHint": {
+    "cli": [],
+    "server": [],
+    "sdk": [],
+    "note": "scanned cli@e10eef84 server@feed42cd sdk@f6ae86f — a name listed is MENTIONED there today, which is evidence of consumption, not proof of it"
+  },
+  "breakingCount": 0,
+  "breakingItems": []
+}

package/wire-changes/core@7.17.4.json

@@ -0,0 +1,52 @@
+{
+  "repo": "core",
+  "version": "7.17.4",
+  "from": "a135321a2f648ada1a2bd82f930f924831d5cc4a",
+  "to": "dd51253ac702ab232224dac50de33eb0dd09e40f",
+  "added": [],
+  "removed": [],
+  "changed": [],
+  "narrowed": [
+    {
+      "id": "F1",
+      "source": "behaviorFlips.summary",
+      "text": "Narrowing — an option's ATTACHED payload is a word like any other (#763; the residual 7.17.3 disclosed): the boundary walk judges `-fVALUE` / `-xVALUE`-in-a-cluster / `--flag=VALUE` payloads exactly as positional operands (one lane split, shape filter removed, none added); the short-option cluster is read to its END (digits included); the zero-option reading is offered only where the whole word names a location; a pre-existing win32 hole on the bash_readonly face is closed beside it."
+    }
+  ],
+  "closedSetMembers": [],
+  "typeKeys": [],
+  "declarationMoves": [],
+  "mintMoves": [],
+  "criteriaObserves": [
+    {
+      "kind": "typeMember",
+      "name": "AskRequest.ruleOffersAbsence",
+      "assertions": [
+        "G1.a",
+        "G2.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "CompoundReadonlyVerdict.outOfRootRead",
+      "assertions": [
+        "G4.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "CompoundReadonlyVerdict.readDenied",
+      "assertions": [
+        "G3.a"
+      ]
+    }
+  ],
+  "consumersHint": {
+    "cli": [],
+    "server": [],
+    "sdk": [],
+    "note": "scanned cli@f7b07c33 server@02266e20 sdk@6910789 — a name listed is MENTIONED there today, which is evidence of consumption, not proof of it"
+  },
+  "breakingCount": 0,
+  "breakingItems": []
+}

package/wire-changes/core@7.17.5.json

@@ -0,0 +1,67 @@
+{
+  "repo": "core",
+  "version": "7.17.5",
+  "from": "dd51253ac702ab232224dac50de33eb0dd09e40f",
+  "to": "99b9ef8d61e5b2a67d62ec6a6cdf65e831c4752f",
+  "added": [],
+  "removed": [],
+  "changed": [],
+  "narrowed": [
+    {
+      "id": "F1",
+      "source": "behaviorFlips.summary",
+      "text": "Narrowing — argv re-entry (#766; test [7178] ①; B-107): a program that turns its STDIN into another program's argv (`xargs`, `parallel`) is judged like a shell re-entry — refused whole, so the boundary asks (mandated) instead of vouching; when the wrapped program is a declared no-path verb the pipeline runs unasked."
+    },
+    {
+      "id": "F2",
+      "source": "behaviorFlips.summary",
+      "text": "Narrowing — a base move the walk cannot verify (#767; test [7178] ②; B-107): after `cd X` the relative operands of a later segment are judged against BOTH bases (moved and unmoved) unless every connector between that `cd` and the segment is `&&` (the shell itself verifies the move); `;`, `||`, `|`, `&` and unknown connectors leave the move unverified (fail-closed)."
+    },
+    {
+      "id": "F3",
+      "source": "behaviorFlips.summary",
+      "text": "Narrowing + contract (#768 β/γ; clay C-R37; test [7178] ③): the full Bash face runs the canonical recheck the `bash_readonly` face already had — after the gate allowed and before spawn, every path the lexical verdict accepted (`checkedPaths` + glob patterns) is canonicalized against the READ roots; one that escapes is REFUSED (an error result, `details.type: \"readonly_out_of_root\"`, never an ask — the gate has passed and there is no channel to ask on). The seat's contract is stated as `@contract shell.read_boundary.friction_floor`: the shell read boundary judges what a command TEXT may name (a friction floor); the security boundary is the executionEnv sandbox."
+    }
+  ],
+  "closedSetMembers": [
+    {
+      "set": "ShellSegmentConnector",
+      "at": [
+        "src/tools/fs/bash-readonly-classifier.ts:344"
+      ],
+      "newSet": true,
+      "added": [
+        "&&",
+        ";",
+        "start",
+        "|",
+        "||"
+      ],
+      "removed": [],
+      "breaking": false,
+      "criteriaCovered": false
+    }
+  ],
+  "typeKeys": [],
+  "declarationMoves": [],
+  "mintMoves": [],
+  "criteriaObserves": [
+    {
+      "kind": "typeMember",
+      "name": "AskRequest.ruleOffersAbsence",
+      "assertions": [
+        "G1.a",
+        "G2.a",
+        "G3.a"
+      ]
+    }
+  ],
+  "consumersHint": {
+    "cli": [],
+    "server": [],
+    "sdk": [],
+    "note": "scanned cli@846136de server@82cf402c sdk@6910789 — a name listed is MENTIONED there today, which is evidence of consumption, not proof of it"
+  },
+  "breakingCount": 0,
+  "breakingItems": []
+}