@sema-agent/core 7.17.7 → 7.19.0

package/dist/tools/fs/fs-write.js

@@ -86,7 +86,7 @@ async function gateToolWrite(hook, tool, path, key, content) {
         return `Error (${tool}): write rejected by the write gate (${res.code}): ${clipHookText(res.reason)}`;
     return undefined;
 }
-export function createEditFileTool(env, state, rootCanonical, cwdRef, additionalRoots, beforeWrite, trackEdit, onEdited) {
+export function createEditFileTool(env, state, rootCanonical, cwdRef, additionalRoots, beforeWrite, trackEdit, onEdited, writeFace) {
     return defineTool({
         name: "Edit",
         ...toolFace("edit"),
@@ -111,7 +111,7 @@ export function createEditFileTool(env, state, rootCanonical, cwdRef, additional
             const path = fileArgPath(args);
             if (path === undefined)
                 return { ok: true };
-            const r = await resolveKey(env, rootCanonical, path, ctx.signal, cwdRef?.current, additionalRoots);
+            const r = await resolveKey(env, rootCanonical, path, ctx.signal, cwdRef?.current, additionalRoots, undefined, undefined, writeFace);
             if (!r.ok)
                 return { ok: true };
             if (a.old_string === a.new_string)
@@ -149,7 +149,7 @@ export function createEditFileTool(env, state, rootCanonical, cwdRef, additional
             const path = fileArgPath(args);
             if (path === undefined)
                 return errorResult(`Error (Edit): file_path is required.`);
-            const r = await resolveKey(env, rootCanonical, path, ctx.signal, cwdRef?.current, additionalRoots);
+            const r = await resolveKey(env, rootCanonical, path, ctx.signal, cwdRef?.current, additionalRoots, undefined, undefined, writeFace);
             if (!r.ok)
                 return errorResult(violationText("Edit", r.violation), violationDetails(r.violation));
             if (!batch && a.old_string === a.new_string) {
@@ -324,7 +324,7 @@ export function createEditFileTool(env, state, rootCanonical, cwdRef, additional
         },
     });
 }
-export function createWriteFileTool(env, state, rootCanonical, cwdRef, additionalRoots, beforeWrite, trackEdit, onEdited) {
+export function createWriteFileTool(env, state, rootCanonical, cwdRef, additionalRoots, beforeWrite, trackEdit, onEdited, writeFace) {
     return defineTool({
         name: "Write",
         ...toolFace("write"),
@@ -343,7 +343,7 @@ export function createWriteFileTool(env, state, rootCanonical, cwdRef, additiona
                 return { ok: true };
             if (ipynbRedirect("Write", path))
                 return { ok: true };
-            const r = await resolveKey(env, rootCanonical, path, ctx.signal, cwdRef?.current, additionalRoots);
+            const r = await resolveKey(env, rootCanonical, path, ctx.signal, cwdRef?.current, additionalRoots, undefined, undefined, writeFace);
             if (!r.ok)
                 return { ok: true };
             const exists = await env.exists(r.key, ctx.signal);
@@ -362,7 +362,7 @@ export function createWriteFileTool(env, state, rootCanonical, cwdRef, additiona
             const ipynb = ipynbRedirect("Write", path);
             if (ipynb)
                 return errorResult(ipynb);
-            const r = await resolveKey(env, rootCanonical, path, ctx.signal, cwdRef?.current, additionalRoots);
+            const r = await resolveKey(env, rootCanonical, path, ctx.signal, cwdRef?.current, additionalRoots, undefined, undefined, writeFace);
             if (!r.ok)
                 return errorResult(violationText("Write", r.violation), violationDetails(r.violation));
             const exists = await env.exists(r.key, ctx.signal);
@@ -423,7 +423,7 @@ export function createWriteFileTool(env, state, rootCanonical, cwdRef, additiona
 const notebookNotIpynbMessage = (notebookPath) => `Error (NotebookEdit): "${notebookPath}" is not a .ipynb file; use Edit for other file types.`;
 const NOTEBOOK_CELL_TYPE_REQUIRED_MESSAGE = `Error (NotebookEdit): Cell type is required when using edit_mode=insert.`;
 const NOTEBOOK_CELL_ID_REQUIRED_MESSAGE = `Error (NotebookEdit): cell_id is required for replace/delete.`;
-export function createNotebookEditTool(env, state, rootCanonical, cwdRef, additionalRoots, beforeWrite, trackEdit, onEdited) {
+export function createNotebookEditTool(env, state, rootCanonical, cwdRef, additionalRoots, beforeWrite, trackEdit, onEdited, writeFace) {
     return defineTool({
         name: "NotebookEdit",
         ...toolFace("notebook-edit"),
@@ -457,7 +457,7 @@ export function createNotebookEditTool(env, state, rootCanonical, cwdRef, additi
                 return { ok: false, code: "invalid", message: NOTEBOOK_CELL_TYPE_REQUIRED_MESSAGE };
             if (mode !== "insert" && !a.cell_id)
                 return { ok: false, code: "invalid", message: NOTEBOOK_CELL_ID_REQUIRED_MESSAGE };
-            const r = await resolveKey(env, rootCanonical, a.notebook_path, ctx.signal, cwdRef?.current, additionalRoots);
+            const r = await resolveKey(env, rootCanonical, a.notebook_path, ctx.signal, cwdRef?.current, additionalRoots, undefined, undefined, writeFace);
             if (!r.ok)
                 return { ok: true };
             const notRead = requireRead(state, r.key);
@@ -477,7 +477,7 @@ export function createNotebookEditTool(env, state, rootCanonical, cwdRef, additi
                 return errorResult(NOTEBOOK_CELL_TYPE_REQUIRED_MESSAGE);
             if (mode !== "insert" && !cell_id)
                 return errorResult(NOTEBOOK_CELL_ID_REQUIRED_MESSAGE);
-            const r = await resolveKey(env, rootCanonical, notebook_path, ctx.signal, cwdRef?.current, additionalRoots);
+            const r = await resolveKey(env, rootCanonical, notebook_path, ctx.signal, cwdRef?.current, additionalRoots, undefined, undefined, writeFace);
             if (!r.ok)
                 return errorResult(violationText("NotebookEdit", r.violation), violationDetails(r.violation));
             const notRead = requireRead(state, r.key);

package/dist/tools/fs/index.d.ts

@@ -14,7 +14,8 @@ export * from "./read-deny.js";
 import { type BashReadonlyRootBoundary } from "./bash-readonly-classifier.js";
 export { BASH_CLASSIFY_DEFAULT_ALLOW } from "./bash-readonly-classifier.js";
 import { type ReadDenyEntry } from "./read-deny.js";
-export * from "./read-face.js";
+import { type ContainmentFace } from "./containment-face.js";
+export * from "./containment-face.js";
 import { type CwdRef, type ReadImageDownsamplerOption } from "./fs-shared.js";
 /** Options for {@link createHandsToolkit}. */
 export interface HandsToolkitOptions {
@@ -108,6 +109,14 @@ export interface HandsToolkitOptions {
      *  by the Runner for every task and so cannot double as an opt-in signal. Default undefined ⇒ `false`
      *  downstream. */
     autoBackgroundOnTimeout?: boolean;
+    /** The run's tool-progress sink — see createBashTool's taskOpts field of the same name. Runner-wired
+     *  (a late-bound cell behind the closure), absent for a standalone toolkit build ⇒ the shell's execute
+     *  leg opens no streaming callbacks at all and its `env.exec` options are byte-identical to before. */
+    onToolProgress?: (body: import("../../core/runner/contracts.js").ToolProgressBody) => void;
+    /** Is a PERSON's input waiting for this run's next turn boundary — see createBashTool's taskOpts field
+     *  of the same name. Runner-wired (reads the harness's own accepted-but-unserved account); absent ⇒ the
+     *  shell never auto-backgrounds a running command, exactly as before. */
+    queuedHumanInput?: () => boolean;
     /** Read-image downsampler seam ({@link ReadImageDownsamplerOption}). Default undefined = auto-detect
      *  the optional sharp dependency once per process; `false` disables it (deterministic no-sharp behavior). */
     readImageDownsampler?: ReadImageDownsamplerOption;
@@ -164,16 +173,26 @@ export interface HandsToolkitOptions {
      *  time (never silently ignored). Deployment seat ONLY, same clamp argument as the tiers key. */
     readDenyBuiltinExclude?: readonly string[];
     /** The READ-face containment state for the structured read faces
-     *  ({@link import("./read-face.js").ReadFace}; resolved through the SAME
-     *  {@link import("./read-face.js").resolveReadFace} order prepare-task uses). Absent ⇒ the
+     *  ({@link import("./containment-face.js").ContainmentFace}; resolved through the SAME
+     *  {@link import("./containment-face.js").resolveContainmentFace} order prepare-task uses). Absent ⇒ the
      *  resolution order's default = "roots" (the engine never opens implicitly). "open" skips ONLY the
      *  roots containment judgment — the deny set, the UNC out-of-set refusal and the special-file type
      *  gates run in both faces. Beside `readOnly: true` the mount wins: this seat is deps-shaped (a
      *  deployment default, not a per-call assertion), so its "open" CLAMPS to "roots" and the clamp is
      *  ANNOUNCED (`config.read_face_deployment_clamped`, through `onNotice` / `console.warn`) — the loud
      *  refusal belongs to the TASK seat (`TaskSpec.readFace`), the one genuine per-call contradiction.
-     *  Never affects the write faces. */
-    readFace?: "open" | "roots";
+     *  Never affects the write faces — {@link writeFace} is a separate seat with its own default. */
+    readFace?: ContainmentFace;
+    /** The WRITE-face containment state for the structured write faces (Edit / Write / NotebookEdit)
+     *  ({@link import("./containment-face.js").ContainmentFace}; resolved through the SAME
+     *  {@link import("./containment-face.js").resolveContainmentFace} order — one body, one default,
+     *  per seat). Absent ⇒ "roots" (today's behavior, byte-identical). "open" skips ONLY the roots
+     *  containment judgment on the write band — the write-side sensitive-path policy, the blocked-device
+     *  gate, the UNC out-of-set refusal and the read-before-edit requirement all still run, and the full
+     *  `bash` face is unaffected either way (it was never fenced). Beside `readOnly: true` the mount
+     *  wins the same way the read seat's does (that mount carries no write faces at all), announced as
+     *  `config.write_face_deployment_clamped`. Never affects the read faces. */
+    writeFace?: ContainmentFace;
     /** The session's reminder provenance mark: the band's engine-minted
      *  `<system-reminder>` open tags (the Read cyber/dedup/offset/empty reminders and the gh
      *  rate-limit hint) carry it as `mark="…"`, matching the system-prompt declaration the Runner

package/dist/tools/fs/index.js

@@ -14,8 +14,8 @@ export * from "./read-deny.js";
 import { BASH_READONLY_DEFAULT_ALLOW, } from "./bash-readonly-classifier.js";
 export { BASH_CLASSIFY_DEFAULT_ALLOW } from "./bash-readonly-classifier.js";
 import { compileReadDeny } from "./read-deny.js";
-import { deploymentReadFaceClampNotice, resolveReadFace } from "./read-face.js";
-export * from "./read-face.js";
+import { deploymentFaceClampNotice, resolveContainmentFace } from "./containment-face.js";
+export * from "./containment-face.js";
 import {} from "./fs-shared.js";
 import { createReadFileTool } from "./fs-read.js";
 import { createEditFileTool, createWriteFileTool, createNotebookEditTool } from "./fs-write.js";
@@ -42,18 +42,27 @@ export function createHandsToolkit(env, readFileState, rootCanonical, opts = {})
         ...(opts.readDenyBuiltinTiers !== undefined ? { tiers: opts.readDenyBuiltinTiers } : {}),
         ...(opts.readDenyBuiltinExclude !== undefined ? { exclude: opts.readDenyBuiltinExclude } : {}),
     });
-    const readFace = resolveReadFace({
-        depsReadFace: opts.readFace,
+    const readFace = resolveContainmentFace({
+        kind: "read",
+        depsFace: opts.readFace,
         readOnlyMount: readOnly,
         orgGoverned: false,
         fullShellReachable: includeShell && !readOnly,
-        onDeploymentClamp: () => deliverEngineNotice(opts.onNotice, deploymentReadFaceClampNotice()),
+        onDeploymentClamp: () => deliverEngineNotice(opts.onNotice, deploymentFaceClampNotice("read")),
+    });
+    const writeFace = resolveContainmentFace({
+        kind: "write",
+        depsFace: opts.writeFace,
+        readOnlyMount: readOnly,
+        orgGoverned: false,
+        fullShellReachable: includeShell && !readOnly,
+        onDeploymentClamp: () => deliverEngineNotice(opts.onNotice, deploymentFaceClampNotice("write")),
     });
     const tools = [
         createReadFileTool(env, readFileState, rootCanonical, readOnly ? undefined : cwdRef, readFaceRoots, opts.readImageDownsampler, opts.pdfModelCapabilities, bgOutputReadExemption, opts.readCyberReminder, readDeny, readFace, opts.reminderMark, opts.reminderDisclosureCounts),
     ];
     if (handsWriteHalfMounts({ readOnly })) {
-        tools.push(createEditFileTool(env, readFileState, rootCanonical, cwdRef, additionalRoots, opts.beforeWrite, opts.trackFileEdit, opts.onFileEdited), createWriteFileTool(env, readFileState, rootCanonical, cwdRef, additionalRoots, opts.beforeWrite, opts.trackFileEdit, opts.onFileEdited), createNotebookEditTool(env, readFileState, rootCanonical, cwdRef, additionalRoots, opts.beforeWrite, opts.trackFileEdit, opts.onFileEdited));
+        tools.push(createEditFileTool(env, readFileState, rootCanonical, cwdRef, additionalRoots, opts.beforeWrite, opts.trackFileEdit, opts.onFileEdited, writeFace), createWriteFileTool(env, readFileState, rootCanonical, cwdRef, additionalRoots, opts.beforeWrite, opts.trackFileEdit, opts.onFileEdited, writeFace), createNotebookEditTool(env, readFileState, rootCanonical, cwdRef, additionalRoots, opts.beforeWrite, opts.trackFileEdit, opts.onFileEdited, writeFace));
     }
     tools.push(createGrepTool(env, rootCanonical, readFaceRoots, readDeny, readFace, cwdRef), createGlobTool(env, rootCanonical, readFaceRoots, readDeny, readFace, cwdRef), createRepoMapTool(env, rootCanonical, readFaceRoots, readDeny, readFace));
     if (includeShell) {
@@ -63,6 +72,7 @@ export function createHandsToolkit(env, readFileState, rootCanonical, opts = {})
                 ...(opts.bashMaxTimeoutMs !== undefined ? { bashMaxTimeoutMs: opts.bashMaxTimeoutMs } : {}),
                 ...(opts.onNotice !== undefined ? { onNotice: opts.onNotice } : {}),
                 ...(readFaceRoots !== undefined ? { additionalRoots: readFaceRoots } : {}),
+                ...(opts.onToolProgress !== undefined ? { onToolProgress: opts.onToolProgress } : {}),
             })
             : createBashTool(env, rootCanonical, commitCoAuthor, cwdRef, {
                 taskRegistry: opts.taskRegistry,
@@ -72,6 +82,8 @@ export function createHandsToolkit(env, readFileState, rootCanonical, opts = {})
                 onTaskNotification: opts.taskNotification,
                 detachHub: opts.detachHub,
                 ...(opts.autoBackgroundOnTimeout !== undefined ? { autoBackgroundOnTimeout: opts.autoBackgroundOnTimeout } : {}),
+                ...(opts.onToolProgress !== undefined ? { onToolProgress: opts.onToolProgress } : {}),
+                ...(opts.queuedHumanInput !== undefined ? { queuedHumanInput: opts.queuedHumanInput } : {}),
                 ...(opts.oneShot !== undefined ? { oneShot: opts.oneShot } : {}),
                 ...(additionalRoots !== undefined ? { additionalRoots } : {}),
                 ...(opts.shellReadBoundary !== undefined ? { readBoundary: opts.shellReadBoundary } : {}),

package/dist/tools/fs/read-deny.d.ts

@@ -104,11 +104,12 @@ export interface ReadDenyBuiltinRow {
  * `.sema`/`.claude` also hold agents, skills, hooks and (under the shell's layout,
  * `~/.sema/engine-data`) the engine data root with the memory library — material the model reads
  * and edits as ordinary work, and a directory-wide row would need a data-root passthrough (one more
- * rule) to keep it readable. The write face guards the directories (`sensitive-path-policy.ts`): a
- * write there is self-authorization; a read of a non-credential file there is debugging. Token
+ * rule) to keep it readable. Token
  * STORES of the same tooling (`.credentials.json`, an agent CLI's `auth.json`, …) are credentials rows, not
  * agent-config rows: a deployment that switches this tier off to debug its agent configuration must
- * not also expose the OAuth stores beside it.
+ * not also expose the OAuth stores beside it. These rows are ALSO the opt-in write deny set's
+ * agent-configuration block ({@link import("../../core/sensitive-path-policy.js").agentConfigDenyPatterns},
+ * which reads them from here; contract sentence there), so a row added here is judged by both faces.
  */
 export declare const READ_FACE_BUILTIN_DENY_TABLE: readonly ReadDenyBuiltinRow[];
 /**

package/dist/tools/fs/repo-map.d.ts

@@ -1,7 +1,7 @@
 import type { AgentTool } from "../../internal/harness-types.js";
 import type { ExecutionEnv } from "../../internal/harness-types.js";
 import type { ReadDenyMatcher } from "./read-deny.js";
-import type { ReadFace } from "./read-face.js";
+import type { ContainmentFace } from "./containment-face.js";
 /** Extract top-level symbol names (deduped, in first-seen order) from source text. A lightweight
  *  comment/docstring state machine skips column-0 declaration-like lines that are really inside a
  *  `/* … *​/` block comment or a Python `"""`/`'''` docstring — otherwise e.g. a module docstring
@@ -13,4 +13,4 @@ import type { ReadFace } from "./read-face.js";
  *  (src/core/auto-promote.ts) consumes it in ESCALATE-ONLY mode — a clean scan contributes nothing;
  *  it can only ever raise an escalation, never clear one. */
 export declare function extractSymbols(text: string): string[];
-export declare function createRepoMapTool(env: ExecutionEnv, rootCanonical: string, additionalRoots?: readonly string[], readDeny?: ReadDenyMatcher, readFace?: ReadFace): AgentTool;
+export declare function createRepoMapTool(env: ExecutionEnv, rootCanonical: string, additionalRoots?: readonly string[], readDeny?: ReadDenyMatcher, readFace?: ContainmentFace): AgentTool;

package/dist/tools/fs/safety.d.ts

@@ -258,6 +258,21 @@ export declare function isBinaryContent(sample: string): boolean;
  * test with no verdict of its own.
  */
 export declare function isUncPath(path: string): boolean;
+/**
+ * True when a WIN-FORM spelling carries a component Win32's own normalization would trim — a trailing dot
+ * or space on anything but the `.`/`..` specials (the same client-side strip {@link uncCanonicalKey}
+ * folds, stated once and read here rather than re-derived).
+ *
+ * Such a spelling is an ALIAS: `x. ` and `x` name ONE directory to the OS and two different strings to a
+ * lexical comparator. A caller that must reason about a spelling byte-wise — a directory offered to a
+ * person as the thing to declare, a common-prefix cut between two operands — cannot pick one of the two
+ * readings on the person's behalf, so it withholds. POSIX paths are never aliased this way: a trailing dot
+ * or space there is an ordinary filename character.
+ *
+ * The UNC ANCHOR is exempt for the reason the key minter states: a host's trailing dot is DNS (the FQDN
+ * root) and share-name normalization is the server's business; neither is the client-side strip.
+ */
+export declare function hasWin32AliasedComponent(p: string): boolean;
 /** The two spelling families a tree can be in. Read from the ROOT's spelling (the cwd's when a deployment
  *  supplies no root) — never from `process.platform`: the exec env may be remote and of the other family. */
 export type PathFamily = "win" | "posix";
@@ -392,7 +407,7 @@ export declare function resolveKey(env: ExecutionEnv, rootCanonical: string, pat
         pattern: string;
         matchedView?: string;
     } | null;
-}, readFace?: "open" | "roots"): Promise<{
+}, containmentFace?: "open" | "roots"): Promise<{
     ok: true;
     key: string;
 } | {
@@ -458,7 +473,7 @@ export declare function withinAnyRoot(rootsCanonical: readonly string[], p: stri
  *
  * The card names the SANCTIONED way out and nothing else: widening the declaration
  * (`additionalDirectories` / read-only `additionalReadDirectories`), or the deployment-level
- * `readFace: "open"` for reads.
+ * `readFace: "open"` (reads) / `writeFace: "open"` (writes).
  *
  * It deliberately does NOT name the shell as unconfined by this fence, even though that is a true
  * statement rather than a recommendation. A live retest settled the question: a refused agent read
@@ -469,7 +484,7 @@ export declare function withinAnyRoot(rootsCanonical: readonly string[], p: stri
  * shell is deliberately unconfined by this fence, and every shell call still passes the deployment's
  * approval policy); it is simply not handed to the model inside a denial.
  */
-export declare const PATH_NOT_IN_ROOT_ESCAPE_HINT = "(This boundary applies to the structured file tools. If you genuinely need content outside the allowed root(s), ask for the directory to be added to the deployment's additionalDirectories \u2014 or additionalReadDirectories for read-only access; a deployment that wants reads open everywhere can declare readFace: \"open\" instead of listing directories.)";
+export declare const PATH_NOT_IN_ROOT_ESCAPE_HINT = "(This boundary applies to the structured file tools. If you genuinely need content outside the allowed root(s), ask for the directory to be added to the deployment's additionalDirectories \u2014 or additionalReadDirectories for read-only access; a deployment that wants reads or writes open everywhere can declare readFace / writeFace: \"open\" instead of listing directories.)";
 /** inv 1 (read-before-edit): a file must have been read this task before it can be edited/overwritten.
  *  Message is CC 2.1.198 live-verbatim (all-tools-live-probe 2026-07-08 §2.1/§3.1/§5.1 — one message for
  *  Edit/Write/NotebookEdit: "before writing to it", not the old sema "before editing").

package/dist/tools/fs/safety.js

@@ -314,6 +314,13 @@ function foldUncLexically(p) {
     const anchor = `\\\\${host}${share !== undefined ? `\\${share}` : ""}`;
     return { key: out.length > 0 ? `${anchor}\\${out.join("\\")}` : anchor, climbedAboveShare: climbed };
 }
+export function hasWin32AliasedComponent(p) {
+    if (!isWinFormPath(p))
+        return false;
+    const parts = p.split(/[\\/]+/).filter((seg) => seg.length > 0);
+    const tail = p.startsWith("\\\\") || p.startsWith("//") ? parts.slice(2) : parts;
+    return tail.some((seg) => seg !== "." && seg !== ".." && /[. ]$/.test(seg));
+}
 export function pathFamilyOf(bases) {
     const tree = bases.root ?? bases.cwd;
     return tree === undefined ? undefined : isWinFormPath(tree) ? "win" : "posix";
@@ -443,7 +450,7 @@ function within(rootCanonical, p) {
         return true;
     return pN.identity.startsWith(rootN.identity.endsWith(SEP) ? rootN.identity : rootN.identity + SEP);
 }
-export async function resolveKey(env, rootCanonical, path, signal, baseCwd, additionalRootsCanonical, exactFileReadExemption, readDeny, readFace) {
+export async function resolveKey(env, rootCanonical, path, signal, baseCwd, additionalRootsCanonical, exactFileReadExemption, readDeny, containmentFace) {
     const canon = await canonicalizeTarget(env, path, signal, pathFamilyOf({ root: rootCanonical }), baseCwd);
     if (!canon.ok)
         return { ok: false, violation: { code: "invalid", message: canon.message } };
@@ -471,13 +478,13 @@ export async function resolveKey(env, rootCanonical, path, signal, baseCwd, addi
             };
         }
     }
-    if (readFace === "open") {
+    if (containmentFace === "open") {
         if (isUncPath(key) && isWinFormPath(key) && !within(rootCanonical, key) && !additionalRootsCanonical?.some((r) => within(r, key))) {
             return {
                 ok: false,
                 violation: {
                     code: "invalid",
-                    message: `path "${path}" names a network (UNC) location outside the declared roots; refused even under the open read face — a read against an undeclared share can hang on the SMB mount timeout and offers credentials to the remote host.`,
+                    message: `path "${path}" names a network (UNC) location outside the declared roots; refused even under an open containment face — an access against an undeclared share can hang on the SMB mount timeout and offers credentials to the remote host.`,
                 },
             };
         }
@@ -604,7 +611,7 @@ export function violationDetails(v) {
 export function withinAnyRoot(rootsCanonical, p) {
     return rootsCanonical.some((r) => within(r, p));
 }
-export const PATH_NOT_IN_ROOT_ESCAPE_HINT = "(This boundary applies to the structured file tools. If you genuinely need content outside the allowed root(s), ask for the directory to be added to the deployment's additionalDirectories — or additionalReadDirectories for read-only access; a deployment that wants reads open everywhere can declare readFace: \"open\" instead of listing directories.)";
+export const PATH_NOT_IN_ROOT_ESCAPE_HINT = "(This boundary applies to the structured file tools. If you genuinely need content outside the allowed root(s), ask for the directory to be added to the deployment's additionalDirectories — or additionalReadDirectories for read-only access; a deployment that wants reads or writes open everywhere can declare readFace / writeFace: \"open\" instead of listing directories.)";
 export function requireRead(state, key) {
     const entry = state.get(key);
     if (entry === undefined || entry.isPartialView) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.17.7",
+  "version": "7.19.0",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",