@sema-agent/core 7.17.7 → 7.19.0

package/wire-changes/core@7.19.0.json

@@ -0,0 +1,457 @@
+{
+  "repo": "core",
+  "version": "7.19.0",
+  "from": "a9ed817912e9808ec38a5b4f02231398d5ccc99f",
+  "to": "v7.19.0",
+  "added": [
+    {
+      "name": "AUTO_MODE_PARSE_FAILURES",
+      "kind": "variable",
+      "tier": "advanced",
+      "at": [
+        "src/core/auto-mode.ts:69",
+        "src/index.ts:1376"
+      ],
+      "criteriaCovered": false,
+      "breaking": false
+    },
+    {
+      "name": "AutoModeParseFailure",
+      "kind": "type",
+      "tier": "advanced",
+      "at": [
+        "src/core/auto-mode.ts:70",
+        "src/index.ts:1378"
+      ],
+      "criteriaCovered": false,
+      "breaking": false
+    },
+    {
+      "name": "RECOMMENDED_SENSITIVE_ASK_PATTERNS",
+      "kind": "variable",
+      "tier": "advanced",
+      "at": [
+        "src/core/sensitive-path-policy.ts:196",
+        "src/index.ts:914"
+      ],
+      "criteriaCovered": false,
+      "breaking": false
+    },
+    {
+      "name": "ReadRootGrantCandidate",
+      "kind": "interface",
+      "tier": "advanced",
+      "at": [
+        "src/core/tool-spec.ts:105",
+        "src/core/types.ts:24",
+        "src/index.ts:3300"
+      ],
+      "criteriaCovered": true,
+      "breaking": false
+    },
+    {
+      "name": "classifierParseFailureDenyMessage",
+      "kind": "function",
+      "tier": "advanced",
+      "at": [
+        "src/core/auto-mode.ts:247",
+        "src/index.ts:1375"
+      ],
+      "criteriaCovered": false,
+      "breaking": false
+    },
+    {
+      "name": "isAutoModeParseFailure",
+      "kind": "function",
+      "tier": "advanced",
+      "at": [
+        "src/core/auto-mode.ts:73",
+        "src/index.ts:1377"
+      ],
+      "criteriaCovered": false,
+      "breaking": false
+    },
+    {
+      "name": "thinkingOffSpelled",
+      "kind": "function",
+      "tier": "advanced",
+      "at": [
+        "src/brain/reasoning.ts:184",
+        "src/index.ts:2492"
+      ],
+      "criteriaCovered": false,
+      "breaking": false
+    }
+  ],
+  "removed": [
+    {
+      "name": "CLASSIFIER_PARSE_FAILURE_DENY_MESSAGE",
+      "kind": "variable",
+      "tier": "advanced",
+      "at": [
+        "src/core/auto-mode.ts:222",
+        "src/index.ts:1375"
+      ],
+      "breaking": true
+    },
+    {
+      "name": "thinkingOffExpressible",
+      "kind": "function",
+      "tier": "advanced",
+      "at": [
+        "src/brain/reasoning.ts:184",
+        "src/index.ts:2489"
+      ],
+      "breaking": true
+    }
+  ],
+  "changed": [],
+  "narrowed": [
+    {
+      "id": "F2",
+      "source": "behaviorFlips.summary",
+      "text": "NARROWING (durable-resume path) — a decider's note has ONE mint (#812 / B-123; car-812): `settledByPerson` + `decidersNote` in `gate-outcome.ts`; empty text folds to absence there, once, for the live resolver and the durable decide lane alike, so `reason: \"\"` is a bare refusal on both paths and the issuing batch's not-yet-started siblings halt (`gate.batch_halted`). Whitespace-only text stays a note (pinned current behaviour, not a promise)."
+    },
+    {
+      "id": "F3",
+      "source": "behaviorFlips.summary",
+      "text": "NARROWING + widening — write protection layered by what the file IS (#804; car-804, ruling (d)) and the write-protection judge anchors relative spellings (#815, security; B-124): the deny set's agent-config block derives from `READ_FACE_BUILTIN_DENY_TABLE`'s `agent-config` tier (one table, two judges; `RECOMMENDED_SENSITIVE_PATTERNS` 26 → 39 members: +8 third-party agent config files, +2 write-face-only rows `.claude/hooks` / `.sema/hooks` (host-executed command bodies, like `.git/hooks`; #824), −4 hand rows), the `.claude` / `.sema` DIRECTORIES leave the deny set and sit on an ask tier of the SAME canonical judge (`RECOMMENDED_SENSITIVE_ASK_PATTERNS` = [`.claude`, `.sema`]; `createSensitivePathPolicy({ askPatterns })` absent = that set, `[]` = no ask tier; the `dataRoot` exemption applies to both tiers); the always-on lexical `WriteProtectionMatcher.matchPath(path, cwd?)` joins a relative spelling onto the gate's tracked cwd BEFORE judging, so `cd ~/.ssh` + `Write(\"authorized_keys\")` is judged like the absolute spelling on every `segment` row."
+    }
+  ],
+  "closedSetMembers": [
+    {
+      "set": "AUTO_MODE_PARSE_FAILURES",
+      "at": [
+        "src/core/auto-mode.ts:69"
+      ],
+      "newSet": true,
+      "added": [
+        "conflict",
+        "missing"
+      ],
+      "removed": [],
+      "breaking": false,
+      "criteriaCovered": false
+    },
+    {
+      "set": "CLASSIFIER_ROLE_DEFAULT_REASONS",
+      "at": [
+        "src/core/runner/classifier-ladder.ts:86"
+      ],
+      "newSet": true,
+      "added": [
+        "main_only",
+        "role_fallback",
+        "role_unresolvable",
+        "tier_below_main",
+        "tier_table"
+      ],
+      "removed": [],
+      "breaking": false,
+      "criteriaCovered": false
+    },
+    {
+      "set": "ENGINE_NOTICE_CODES",
+      "at": [
+        "src/core/governance-codes.ts:323"
+      ],
+      "newSet": false,
+      "added": [
+        "classifier.contract_broken",
+        "classifier.role_defaulted",
+        "skills.listing_truncated"
+      ],
+      "removed": [],
+      "breaking": false,
+      "criteriaCovered": true
+    },
+    {
+      "set": "RECOMMENDED_SENSITIVE_ASK_PATTERNS",
+      "at": [
+        "src/core/sensitive-path-policy.ts:196"
+      ],
+      "newSet": true,
+      "added": [
+        ".claude",
+        ".sema"
+      ],
+      "removed": [],
+      "breaking": false,
+      "criteriaCovered": false
+    },
+    {
+      "set": "RECOMMENDED_SENSITIVE_PATTERNS",
+      "at": [
+        "src/core/sensitive-path-policy.ts:102"
+      ],
+      "newSet": false,
+      "added": [
+        ".ai-agent/.env",
+        ".aider.conf.yml",
+        ".claude.*",
+        ".claude/agents",
+        ".claude/hooks",
+        ".claude/settings.json",
+        ".claude/settings.local.json",
+        ".codex/config.toml",
+        ".continue/config.json",
+        ".continue/config.yaml",
+        ".cursor/mcp.json",
+        ".gemini/settings.json",
+        ".sema/agents",
+        ".sema/engine-data/.env",
+        ".sema/hooks",
+        ".sema/settings.json",
+        ".sema/settings.local.json"
+      ],
+      "removed": [
+        ".claude*",
+        ".sema"
+      ],
+      "persistedBy": "none",
+      "breaking": true,
+      "criteriaCovered": false
+    }
+  ],
+  "typeKeys": [
+    {
+      "type": "AskRequest",
+      "at": [
+        "src/core/tool-policy.ts:2571"
+      ],
+      "added": [
+        "readRootCandidate"
+      ],
+      "removed": [],
+      "breaking": false,
+      "criteriaCovered": true
+    },
+    {
+      "type": "AutoModeVerdict",
+      "at": [
+        "src/core/auto-mode.ts:123"
+      ],
+      "added": [
+        "parse_error.form"
+      ],
+      "removed": [],
+      "breaking": false,
+      "criteriaCovered": false
+    },
+    {
+      "type": "CompoundReadonlyVerdict",
+      "at": [
+        "src/tools/fs/bash-readonly-classifier.ts:585"
+      ],
+      "added": [
+        "outOfRootGrantCandidate"
+      ],
+      "removed": [],
+      "breaking": false,
+      "criteriaCovered": false
+    },
+    {
+      "type": "PermissionResult",
+      "at": [
+        "src/core/tool-policy.ts:412"
+      ],
+      "added": [
+        "probeReadRootCandidate"
+      ],
+      "removed": [],
+      "breaking": false,
+      "criteriaCovered": false
+    },
+    {
+      "type": "PreToolUseResult",
+      "at": [
+        "src/core/hooks.ts:1141"
+      ],
+      "added": [
+        "probeReadRootCandidate"
+      ],
+      "removed": [],
+      "breaking": false,
+      "criteriaCovered": false
+    },
+    {
+      "type": "ReversibilityVerdict",
+      "at": [
+        "src/core/tool-spec.ts:50"
+      ],
+      "added": [
+        "readRootCandidate"
+      ],
+      "removed": [],
+      "breaking": false,
+      "criteriaCovered": true
+    },
+    {
+      "type": "TaskSpec",
+      "at": [
+        "src/core/task-spec.ts:49"
+      ],
+      "added": [
+        "skillListingBudgetFraction",
+        "skillListingMaxDescChars"
+      ],
+      "removed": [],
+      "breaking": false,
+      "criteriaCovered": true
+    }
+  ],
+  "declarationMoves": [
+    {
+      "name": "SKILLS_BLOCK_MAX_BYTES",
+      "kind": null,
+      "onSurface": false,
+      "from": [
+        "src/core/runner/synthetic-tools.ts"
+      ],
+      "to": [
+        "src/core/runner/synthetic-tools.ts",
+        "src/core/skill-listing-budget.ts"
+      ]
+    }
+  ],
+  "mintMoves": [],
+  "criteriaObserves": [
+    {
+      "kind": "engineNoticeCode",
+      "name": "classifier.contract_broken",
+      "assertions": [
+        "G1.c"
+      ]
+    },
+    {
+      "kind": "engineNoticeCode",
+      "name": "classifier.role_defaulted",
+      "assertions": [
+        "G1.b"
+      ]
+    },
+    {
+      "kind": "engineNoticeCode",
+      "name": "skills.listing_truncated",
+      "assertions": [
+        "G4.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "AskRequest.readRootCandidate",
+      "assertions": [
+        "G5.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "AskRequest.toolName",
+      "assertions": [
+        "G3.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "AssistantMessage.partialFinalized",
+      "assertions": [
+        "G1.d"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "GateDisposition.classifier",
+      "assertions": [
+        "G1.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "ReadRootGrantCandidate.dir",
+      "assertions": [
+        "G5.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "ReversibilityVerdict.readRootCandidate",
+      "assertions": [
+        "G5.c"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "Settlement.kind",
+      "assertions": [
+        "G2.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "Settlement.note",
+      "assertions": [
+        "G2.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "TaskSpec.skillListingBudgetFraction",
+      "assertions": [
+        "G4.a",
+        "G6.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "TaskSpec.skillListingMaxDescChars",
+      "assertions": [
+        "G4.c"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "WriteProtectionMatcher.matchPath",
+      "assertions": [
+        "G3.a"
+      ]
+    }
+  ],
+  "consumersHint": {
+    "cli": [
+      "AskRequest",
+      "CompoundReadonlyVerdict",
+      "ENGINE_NOTICE_CODES",
+      "PermissionResult",
+      "PreToolUseResult",
+      "RECOMMENDED_SENSITIVE_PATTERNS",
+      "TaskSpec"
+    ],
+    "server": [
+      "AskRequest",
+      "AutoModeVerdict",
+      "CLASSIFIER_PARSE_FAILURE_DENY_MESSAGE",
+      "CompoundReadonlyVerdict",
+      "ENGINE_NOTICE_CODES",
+      "PermissionResult",
+      "PreToolUseResult",
+      "RECOMMENDED_SENSITIVE_PATTERNS",
+      "ReversibilityVerdict",
+      "TaskSpec",
+      "thinkingOffExpressible"
+    ],
+    "sdk": [
+      "AskRequest",
+      "PermissionResult",
+      "PreToolUseResult",
+      "TaskSpec"
+    ],
+    "note": "scanned cli@116d081d server@565d02fc sdk@17a8533 — a name listed is MENTIONED there today, which is evidence of consumption, not proof of it"
+  },
+  "breakingCount": 3,
+  "breakingItems": [
+    "closed set lost members: RECOMMENDED_SENSITIVE_PATTERNS -.claude*,.sema",
+    "export removed: CLASSIFIER_PARSE_FAILURE_DENY_MESSAGE (variable)",
+    "export removed: thinkingOffExpressible (function)"
+  ],
+  "toResolvedAt": "0ef667ab5a0122c0c73b9635de5035dab4a472dc"
+}

package/dist/tools/fs/read-face.d.ts

@@ -1,68 +0,0 @@
-/** The read-face containment state. `"roots"` = the containment judgment runs.
- *  `"open"` = the containment step is skipped (canonicalization, deny set, UNC out-of-set refusal
- *  and the type gates all still run). */
-export type ReadFace = "open" | "roots";
-/** Loud value gate: a `readFace` seat carries exactly "open" | "roots" — anything else (case
- *  variants, truthy garbage) refuses at wiring time, never folds to a default. Exported
- *  module-internally (not on the package surface) so prepare's unconditional config-guard leg can
- *  screen the seats on runs that never mount hands. The resolver itself also runs on every hands-less
- *  leg; this screen still fires first, so a garbage value refuses before any leg-shape branching. */
-export declare function assertReadFaceValue(v: unknown, seat: string): ReadFace | undefined;
-/** Inputs to {@link resolveReadFace} — all structural/declaration facts, never permission modes
- *  (a deliberate axis separation: this shape carries facts, not verdicts). */
-export interface ReadFaceInputs {
-    /** TaskSpec.readFace (raw — validated here). The TASK layer: may only tighten under governance. */
-    specReadFace?: unknown;
-    /** RunnerDeps.readFace / HandsToolkitOptions.readFace (raw) — the DEPLOYMENT's own declaration. */
-    depsReadFace?: unknown;
-    /** The verifier read-only mount (`handsReadOnly` / toolkit `readOnly`): its containment is a
-     *  LOAD-BEARING wall (bash_readonly is genuinely confined by it) — never openable. */
-    readOnlyMount: boolean;
-    /** Org governance declared (`RunnerDeps.permissionRuleStore.partitions.org === true`): default roots; the task layer
-     *  may not open (tighten-only under governance; the deps layer, being the deployment's own
-     *  declaration, still may). */
-    orgGoverned: boolean;
-    /** Is the FULL shell (`core.bash@1`) structurally reachable on this mount? Computed BEFORE
-     *  tool-band assembly from spec-time facts (env kind / handsReadOnly / Bash exclusion — every
-     *  exclusion source is spec-time-frozen, so this is always computable). When false, the roots fence
-     *  is the ONLY read boundary, so no IMPLICIT default may open the face; an EXPLICIT "open" on
-     *  either seat still wins (row 4 of the order is a default, not a clamp). */
-    fullShellReachable: boolean;
-    /** Observation hook for the ONE silent branch of the order: row 1's deployment-seat clamp
-     *  (readOnly mount + deps "open" + NO task seat). Fired exactly when the deps declaration was the
-     *  deciding seat and the mount overrode it — not when a task-level "roots" pinned the same value
-     *  anyway (the mount changed nothing there, and announcing it would claim a false cause), and
-     *  never on the throw rows (those are already loud). The resolver stays the single owner of the
-     *  clamp predicate; stations own delivery/dedup ({@link deploymentReadFaceClampNotice}). */
-    onDeploymentClamp?: () => void;
-}
-/**
- * The ONE resolution order, first hit wins. prepare-task AND createHandsToolkit both call this — a
- * library-direct mount gets identical validation and identical defaults.
- *
- *  1. read-only (verifier) mount → ROOTS; an explicit "open" on the TASK seat is a genuine
- *     per-call CONTRADICTION and refuses loudly (never silently pick a side). An "open" on the
- *     DEPLOYMENT seat alone is a deployment-wide default, not a per-task assertion — it silently
- *     CLAMPS to roots (stricter-wins), the same seat distinction row 2 draws for org governance.
- *  2. org-governed: TaskSpec "open" refuses (task layer only tightens); deps "open" wins;
- *     otherwise ROOTS.
- *  3. explicit seat: spec ?? deps.
- *  4. bash-less mount: ROOTS (the fence is the only read boundary there — "the fence guards
- *     nothing bash reaches anyway" does not hold, so no implicit default may open it).
- *  5. default: ROOTS — the engine never opens implicitly.
- */
-export declare function resolveReadFace(i: ReadFaceInputs): ReadFace;
-/**
- * The ONE text of the deployment-clamp announcement (`config.read_face_deployment_clamped`).
- * Both stations deliver THIS object through their own `deliverEngineNotice` call (prepare-task with
- * the `RunnerDeps.onNotice` seat, once per notice sink — the sink, not the deps object, because the
- * Runner rebuilds its deps; `createHandsToolkit` with its band-local `HandsToolkitOptions.onNotice`
- * seat — toolkit creation is itself the one-per-mount boot moment, and an absent seat prints the
- * same line via `console.warn`). Built here, import-free, so the message can never fork between
- * the stations.
- */
-export declare function deploymentReadFaceClampNotice(): {
-    code: string;
-    message: string;
-    detail: Record<string, unknown>;
-};

package/dist/tools/fs/read-face.js

@@ -1,47 +0,0 @@
-export function assertReadFaceValue(v, seat) {
-    if (v === undefined)
-        return undefined;
-    if (v === "open" || v === "roots")
-        return v;
-    const e = new Error(`${seat}: invalid readFace value ${JSON.stringify(v)} — expected "open" or "roots" (bad values refuse loudly; nothing falls back to a default).`);
-    e.code = "config.read_face_invalid";
-    throw e;
-}
-export function resolveReadFace(i) {
-    const spec = assertReadFaceValue(i.specReadFace, "TaskSpec.readFace");
-    const deps = assertReadFaceValue(i.depsReadFace, "readFace (deployment seat)");
-    if (i.readOnlyMount) {
-        if (spec === "open") {
-            const e = new Error(`readFace: "open" contradicts the read-only (verifier) mount — that mount's containment is load-bearing (its read-only shell face is confined by it) and is never openable. Drop the readFace declaration or the readOnly mount.`);
-            e.code = "config.read_face_readonly_conflict";
-            throw e;
-        }
-        if (deps === "open" && spec === undefined)
-            i.onDeploymentClamp?.();
-        return "roots";
-    }
-    if (i.orgGoverned) {
-        if (spec === "open") {
-            const e = new Error(`TaskSpec.readFace: "open" is refused under organization governance — the task layer may only tighten (set RunnerDeps.readFace: "open" if the DEPLOYMENT declares the open read face).`);
-            e.code = "config.read_face_org_task_escalation";
-            throw e;
-        }
-        if (spec === "roots")
-            return "roots";
-        return deps ?? "roots";
-    }
-    if (spec !== undefined)
-        return spec;
-    if (deps !== undefined)
-        return deps;
-    if (!i.fullShellReachable)
-        return "roots";
-    return "roots";
-}
-export function deploymentReadFaceClampNotice() {
-    return {
-        code: "config.read_face_deployment_clamped",
-        message: `readFace (deployment seat): the deployment-wide "open" declaration is not in force on this read-only (verifier) mount — clamped to "roots" (stricter-wins: the mount's containment is load-bearing and never openable). Other mounts still honor "open".`,
-        detail: { seat: "readFace (deployment seat)", declared: "open", inForce: "roots", cause: "read_only_mount" },
-    };
-}