@sema-agent/core 7.18.0 → 7.19.0

package/dist/index.d.ts

@@ -128,7 +128,7 @@ export { FileStorageBackend, FileSessionRepo, FileCheckpointStore, FileMemorySto
 export { CacheBreakDetector, type CacheBreakFinding, type ToolFingerprintInput } from "./core/cache-break-detector.js";
 export { maybeCompact, type MaybeCompactOptions, type CompactionWindowSafetyInfo } from "./core/auto-compaction.js";
 export { brainToRuntime } from "./core/runtime.js";
-export { createSensitivePathPolicy, RECOMMENDED_SENSITIVE_PATTERNS } from "./core/sensitive-path-policy.js";
+export { createSensitivePathPolicy, RECOMMENDED_SENSITIVE_PATTERNS, RECOMMENDED_SENSITIVE_ASK_PATTERNS } from "./core/sensitive-path-policy.js";
 export { createFsWriteGatePolicy, type FsWriteGatePolicyOptions } from "./core/fs-write-gate-policy.js";
 export { RETIRED_TOOL_NAMES } from "./core/tool-name-aliases.js";
 export { DEFAULT_SUBAGENT_TOOL_NAME } from "./agents/subagent.js";
@@ -177,7 +177,7 @@ export { AUTO_MODE_DENY_SOURCES, isAutoModeDenySource, type AutoModeDenySource }
 export { SETTLEMENT_KINDS, type SettlementKind, isSettlementKind, type Settlement, SETTLEMENT_IS_REFUSAL, DENIED_BY_VALUES, type DeniedBy, isDeniedBy, DENIED_BY_MAY_VETO, CLASSIFIER_DENY_CAUSES, type ClassifierDenyCause, isClassifierDenyCause, DENIED_BY_MAY_CARRY_CAUSE, type GateDisposition, type GateOutcome, screenGateOutcome } from "./core/gate-outcome.js";
 export { type AskCarry } from "./core/hooks.js";
 export { SWAPPABLE_DEP_SEATS, SWAP_SEAT_NOTICE, isSwappableDepSeat, screenSwappableDeps, type SwappableDepSeat, type SwappableDeps } from "./core/swappable-deps.js";
-export { parseAutoModeResponse, createAutoModeDecider, AUTO_MODE_UNAVAILABLE_CAUSES, isAutoModeUnavailableCause, classifierUnavailableDenyMessage, CLASSIFIER_PARSE_FAILURE_DENY_MESSAGE, type AutoModeUnavailableCause, AUTO_MODE_CLASSIFIER_FALLBACKS, isAutoModeClassifierFallback, AUTO_MODE_FALLBACK_CAUSES, isAutoModeFallbackCause, type AutoModeClassifierFallback, type AutoModeFallbackCause, type AutoModeClassifierRound, type AutoModeLadderRung, type AutoModeVerdict, type AutoModeDecider, type AutoModeDeciderOptions, type AutoModeClassified, type AutoModeClassifyFn, type AutoModeClassifyInput, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow, type AutoModeDenialTracker, type AutoModeDenialLimitOptions, type DenialLimitCounts, type DenialLimitFallbackFace, type UnarmedDenialLimitFallback, type DenialLimitFallback, type DenialLimitVerdict, } from "./core/auto-mode.js";
+export { parseAutoModeResponse, createAutoModeDecider, AUTO_MODE_UNAVAILABLE_CAUSES, isAutoModeUnavailableCause, classifierUnavailableDenyMessage, classifierParseFailureDenyMessage, AUTO_MODE_PARSE_FAILURES, isAutoModeParseFailure, type AutoModeParseFailure, type AutoModeUnavailableCause, AUTO_MODE_CLASSIFIER_FALLBACKS, isAutoModeClassifierFallback, AUTO_MODE_FALLBACK_CAUSES, isAutoModeFallbackCause, type AutoModeClassifierFallback, type AutoModeFallbackCause, type AutoModeClassifierRound, type AutoModeLadderRung, type AutoModeVerdict, type AutoModeDecider, type AutoModeDeciderOptions, type AutoModeClassified, type AutoModeClassifyFn, type AutoModeClassifyInput, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow, type AutoModeDenialTracker, type AutoModeDenialLimitOptions, type DenialLimitCounts, type DenialLimitFallbackFace, type UnarmedDenialLimitFallback, type DenialLimitFallback, type DenialLimitVerdict, } from "./core/auto-mode.js";
 export { AUTO_MODE_DENIAL_LIMIT_DEFAULTS, AUTO_MODE_DENIAL_AUTO_DENY_DEFAULT_MS, AUTO_MODE_CLASSIFIER_MAX_TOKENS } from "./core/auto-mode-defaults.js";
 export { buildAutoModePrompt, renderAutoModeWindow, renderAutoModeAction, AUTO_MODE_DEFAULTS_SENTINEL, type AutoModeRules, type BuildAutoModePromptOptions, type AutoModeWindowOptions, } from "./core/auto-mode-prompt.js";
 export { AUTO_MODE_BASE_PROMPT, AUTO_MODE_PERMISSIONS_EXTERNAL } from "./core/auto-mode-prompt-assets.js";
@@ -239,7 +239,7 @@ export { stripEngineMetadata } from "./internal/llm.js";
 export { EVENT_PROMPT_REGISTRY, eventDefaultOn, type CompiledEventPrompt, type EventDedupe, type EventDefaultPolicy } from "./prompt-assembly/event-registry.js";
 export { contextUsageSections, type ContextUsageSection } from "./prompt-assembly/section-usage.js";
 export type { CompiledSection, ComposedPrompt, PackSectionDeclaration, PromptCacheClass, PromptCarrier, PromptMutability, PromptOwner, PromptPack, PromptRenderCadence, PromptRuntimeFacts, PromptSlot, PromptTrust, SectionRenderInputs, } from "./prompt-assembly/types.js";
-export { type ReasoningIntensity, type ReasoningResolution, type ResolvedReasoning, type ReasoningFormat, DEFAULT_EFFORT_LEVELS, REASONING_BUDGET_SHARE, isThinkingLevel, rankOf, resolveEffort, reasoningEffortLevelsOf, resolveBinary, reasoningBudgetShare, resolveReasoning, thinkingOffExpressible, declaredOffSpelling, type OffCapabilityModel, resolveReasoningProfile, type ReasoningTier, type ReasoningProfileFlags, } from "./brain/reasoning.js";
+export { type ReasoningIntensity, type ReasoningResolution, type ResolvedReasoning, type ReasoningFormat, DEFAULT_EFFORT_LEVELS, REASONING_BUDGET_SHARE, isThinkingLevel, rankOf, resolveEffort, reasoningEffortLevelsOf, resolveBinary, reasoningBudgetShare, resolveReasoning, thinkingOffSpelled, declaredOffSpelling, type OffCapabilityModel, resolveReasoningProfile, type ReasoningTier, type ReasoningProfileFlags, } from "./brain/reasoning.js";
 export { DESIGN_REVIEW_PROMPTS, CODE_REVIEW_PROMPT, SCENARIO_REGISTRY, runScenario, type ScenarioId, type CodeReviewMode, type ScenarioProfile, type RunScenarioOptions, type RunScenarioResult, } from "./scenarios/scenario-registry.js";
 export { teacherMode, TEACHER_PROFILE, type TeacherModePair, type TeacherProfile, } from "./scenarios/teacher-quickstart.js";
 export { loadOrchestrationEnv, DEFAULT_REASONING_INTENSITY, type OrchestrationMode, type OrchestrationEnv, } from "./scenarios/env.js";
@@ -329,7 +329,7 @@ export { ROUTE_ADJUDICATION_CONFORMANCE_CORPUS, type RouteAdjudicationVector } f
 export { type BrainTimeoutConfig } from "./brain/timeout.js";
 export { createAssistantMessageEventStream } from "./internal/llm.js";
 export type { AssistantMessage, AssistantMessageEvent, CompleteSimpleFn, Context, DocumentContent, ImageContent, Message, StopReason, StreamFn, TextContent, ThinkingContent, ToolCall, ToolResultMessage, Usage, UserMessage, } from "./internal/llm.js";
-export type { AgentDefinition, BeforeWriteHook, BeforeWriteRequest, BeforeWriteResult, TrackFileEditHook, TrackEditRequest, TrackEditResult, FileEditedHook, FileEditedNotice, HandsBandOptions, Brain, BrainStatus, BrainStatusPhase, BrainRetryErrClass, ImageInput, McpElicitRequest, McpElicitResponse, McpServerSpec, A2aServerSpec, OnElicit, Model, ModelRef, ProjectMemoryLoad, RunnerDeps, ResumePreflightInfo, ResumePreflightVerdict, EngineNotice, RuntimeCaps, BackgroundChildEvent, DelegationLifecycleEvent, SkillManifest, SkillSpec, TaskEvent, TaskEventIdentity, ToolActivity, TaskLimits, StaleToolResultOffloadOptions, TaskResult, TerminalCause, PausedCause, EffectiveMemoryScopes, RemoteEnvFailureNote, TaskSpec, ShellGateDoctrine, TaskStatus, TaskStream, CompactOutcome, ThinkingLevel, ToolExecuteContext, ToolReturn, ToolSpec, ToolInputVerdict, ToolInputValidationContext, ReversibilityVerdict, ToolEffect, ToolContentOrigin, WorkflowGovernanceBaseline, DelegationTaskType, } from "./core/types.js";
+export type { AgentDefinition, BeforeWriteHook, BeforeWriteRequest, BeforeWriteResult, TrackFileEditHook, TrackEditRequest, TrackEditResult, FileEditedHook, FileEditedNotice, HandsBandOptions, Brain, BrainStatus, BrainStatusPhase, BrainRetryErrClass, ImageInput, McpElicitRequest, McpElicitResponse, McpServerSpec, A2aServerSpec, OnElicit, Model, ModelRef, ProjectMemoryLoad, RunnerDeps, ResumePreflightInfo, ResumePreflightVerdict, EngineNotice, RuntimeCaps, BackgroundChildEvent, DelegationLifecycleEvent, SkillManifest, SkillSpec, TaskEvent, TaskEventIdentity, ToolActivity, TaskLimits, StaleToolResultOffloadOptions, TaskResult, TerminalCause, PausedCause, EffectiveMemoryScopes, RemoteEnvFailureNote, TaskSpec, ShellGateDoctrine, TaskStatus, TaskStream, CompactOutcome, ThinkingLevel, ToolExecuteContext, ToolReturn, ToolSpec, ToolInputVerdict, ToolInputValidationContext, ReversibilityVerdict, ReadRootGrantCandidate, ToolEffect, ToolContentOrigin, WorkflowGovernanceBaseline, DelegationTaskType, } from "./core/types.js";
 export { Type } from "typebox";
 export type { TSchema, Static } from "typebox";
 export { explainPromptAssembly, describeDefaultPack, type DefaultPackDescription, type ExplainInput } from "./prompt-assembly/explain.js";

package/dist/index.js

@@ -103,7 +103,7 @@ export { FileStorageBackend, FileSessionRepo, FileCheckpointStore, FileMemorySto
 export { CacheBreakDetector } from "./core/cache-break-detector.js";
 export { maybeCompact } from "./core/auto-compaction.js";
 export { brainToRuntime } from "./core/runtime.js";
-export { createSensitivePathPolicy, RECOMMENDED_SENSITIVE_PATTERNS } from "./core/sensitive-path-policy.js";
+export { createSensitivePathPolicy, RECOMMENDED_SENSITIVE_PATTERNS, RECOMMENDED_SENSITIVE_ASK_PATTERNS } from "./core/sensitive-path-policy.js";
 export { createFsWriteGatePolicy } from "./core/fs-write-gate-policy.js";
 export { RETIRED_TOOL_NAMES } from "./core/tool-name-aliases.js";
 export { DEFAULT_SUBAGENT_TOOL_NAME } from "./agents/subagent.js";
@@ -150,7 +150,7 @@ export { AUTO_MODE_DENY_SOURCES, isAutoModeDenySource } from "./core/runtime-cap
 export { SETTLEMENT_KINDS, isSettlementKind, SETTLEMENT_IS_REFUSAL, DENIED_BY_VALUES, isDeniedBy, DENIED_BY_MAY_VETO, CLASSIFIER_DENY_CAUSES, isClassifierDenyCause, DENIED_BY_MAY_CARRY_CAUSE, screenGateOutcome } from "./core/gate-outcome.js";
 export {} from "./core/hooks.js";
 export { SWAPPABLE_DEP_SEATS, SWAP_SEAT_NOTICE, isSwappableDepSeat, screenSwappableDeps } from "./core/swappable-deps.js";
-export { parseAutoModeResponse, createAutoModeDecider, AUTO_MODE_UNAVAILABLE_CAUSES, isAutoModeUnavailableCause, classifierUnavailableDenyMessage, CLASSIFIER_PARSE_FAILURE_DENY_MESSAGE, AUTO_MODE_CLASSIFIER_FALLBACKS, isAutoModeClassifierFallback, AUTO_MODE_FALLBACK_CAUSES, isAutoModeFallbackCause, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow, } from "./core/auto-mode.js";
+export { parseAutoModeResponse, createAutoModeDecider, AUTO_MODE_UNAVAILABLE_CAUSES, isAutoModeUnavailableCause, classifierUnavailableDenyMessage, classifierParseFailureDenyMessage, AUTO_MODE_PARSE_FAILURES, isAutoModeParseFailure, AUTO_MODE_CLASSIFIER_FALLBACKS, isAutoModeClassifierFallback, AUTO_MODE_FALLBACK_CAUSES, isAutoModeFallbackCause, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow, } from "./core/auto-mode.js";
 export { AUTO_MODE_DENIAL_LIMIT_DEFAULTS, AUTO_MODE_DENIAL_AUTO_DENY_DEFAULT_MS, AUTO_MODE_CLASSIFIER_MAX_TOKENS } from "./core/auto-mode-defaults.js";
 export { buildAutoModePrompt, renderAutoModeWindow, renderAutoModeAction, AUTO_MODE_DEFAULTS_SENTINEL, } from "./core/auto-mode-prompt.js";
 export { AUTO_MODE_BASE_PROMPT, AUTO_MODE_PERMISSIONS_EXTERNAL } from "./core/auto-mode-prompt-assets.js";
@@ -196,7 +196,7 @@ export { CenterPromptSource, FilePromptArtifactStore, FilePromptSourceStateStore
 export { stripEngineMetadata } from "./internal/llm.js";
 export { EVENT_PROMPT_REGISTRY, eventDefaultOn } from "./prompt-assembly/event-registry.js";
 export { contextUsageSections } from "./prompt-assembly/section-usage.js";
-export { DEFAULT_EFFORT_LEVELS, REASONING_BUDGET_SHARE, isThinkingLevel, rankOf, resolveEffort, reasoningEffortLevelsOf, resolveBinary, reasoningBudgetShare, resolveReasoning, thinkingOffExpressible, declaredOffSpelling, resolveReasoningProfile, } from "./brain/reasoning.js";
+export { DEFAULT_EFFORT_LEVELS, REASONING_BUDGET_SHARE, isThinkingLevel, rankOf, resolveEffort, reasoningEffortLevelsOf, resolveBinary, reasoningBudgetShare, resolveReasoning, thinkingOffSpelled, declaredOffSpelling, resolveReasoningProfile, } from "./brain/reasoning.js";
 export { DESIGN_REVIEW_PROMPTS, CODE_REVIEW_PROMPT, SCENARIO_REGISTRY, runScenario, } from "./scenarios/scenario-registry.js";
 export { teacherMode, TEACHER_PROFILE, } from "./scenarios/teacher-quickstart.js";
 export { loadOrchestrationEnv, DEFAULT_REASONING_INTENSITY, } from "./scenarios/env.js";

package/dist/tools/fs/bash-readonly-classifier.d.ts

@@ -413,6 +413,21 @@ export interface CompoundReadonlyVerdict {
      * path is unchanged.
      */
     recursiveReadPaths?: readonly string[];
+    /**
+     * The ONE directory whose addition to the declared roots would make every objection this walk raised go
+     * away. It rides the SAME arm as the containment sentence and is dropped wherever that sentence is (a
+     * SHAPE refusal takes both — `tail -f <out-of-root>` stays refused after any grant), and on that arm the
+     * claim is MEASURED, not argued: the walk runs again with the proposed root in place and the directory is
+     * offered only if that walk has no objection left. `..`-traversing spellings are excluded on their own
+     * account ({@link outOfRootSpellings}): that is a disagreement between the folded text and the kernel,
+     * which no replay of the text can settle. VALUE: the deepest directory PROPERLY
+     * containing every {@link outOfRootPaths} entry, folded lexically — zero I/O, so a path that is itself a
+     * directory contributes its PARENT (`ls /etc/ssl` ⇒ `/etc`) where the reference implementation narrows
+     * with a stat; refused rather than widened when the result would be a family root or would contain the
+     * declared home or a declared {@link BashReadonlyRootBoundary.roots} entry. Meaning and spelling
+     * contract: {@link import("../../core/tool-spec.js").ReadRootGrantCandidate}.
+     */
+    outOfRootGrantCandidate?: string;
 }
 /**
  * The single minting point for the out-of-root-read approval option text, so a gate rendering
@@ -425,6 +440,18 @@ export interface CompoundReadonlyVerdict {
  * uses the host's native separator.
  */
 export declare function formatOutOfRootReadApprovalOption(directory: string): string;
+/**
+ * The deepest directory containing both, or `undefined` when they share none (two path families).
+ *
+ * LINEAR, and that is the point: both paths are already folded, so the answer is their common prefix cut
+ * at a separator. Climbing one directory at a time re-folds the whole remaining path each step — the same
+ * answer at quadratic cost, measured at 4.9 s of synchronous work for one 32 KB command naming a
+ * 16 000-segment operand, on a walk that runs BEFORE the gate arms its probe deadline. The family-aware
+ * comparator keeps the last word: a prefix it cannot confirm contains both paths yields no candidate.
+ * Exported for its unit tests — the family confirmation is reachable from a command only through shapes
+ * the compound grammar refuses first, so a command-level pin cannot tell a live guard from an absent one.
+ */
+export declare function deepestCommonDir(a: string, b: string): string | undefined;
 /** Resolve one operand against the boundary's base, WITHOUT touching the filesystem. Returns undefined
  *  when the token cannot be resolved statically — the fail-closed direction, reported as its own
  *  demotion rather than silently treated as in-root.

package/dist/tools/fs/bash-readonly-classifier.js

@@ -1,4 +1,4 @@
-import { isAbsoluteForFamily, isAbsolutePathForm, isBlockedDevicePath, isShellRootedSpellingUnmapped, joinForFamily, nativeUncSpellingOf, normalizeAbsPathLexically, win32NamespaceScreen, pathFamilyOf, withinAnyRoot } from "./safety.js";
+import { hasWin32AliasedComponent, isAbsoluteForFamily, isAbsolutePathForm, isBlockedDevicePath, isShellRootedSpellingUnmapped, joinForFamily, nativeUncSpellingOf, normalizeAbsPathLexically, win32NamespaceScreen, pathFamilyOf, withinAnyRoot } from "./safety.js";
 import { lexShellText, literalTildeSpelling, quoteMask, substitutionsInHeredocBody, SUBSTITUTION_PLACEHOLDER, wordsOf, } from "./bash-lexer.js";
 import { ASSIGNMENT_WORD, COMMAND_LAUNCHERS, NOT_AUTO_ALLOWED, SHELL_BLOCK_WORDS, argvReentryUnjudged, isBareControlWord, programBasename, programPositionRefusalSentence, readProgramPosition, } from "./bash-program-position.js";
 export { NOT_AUTO_ALLOWED } from "./bash-program-position.js";
@@ -135,6 +135,49 @@ export function formatOutOfRootReadApprovalOption(directory) {
     const leaf = cut >= 0 ? trimmed.slice(cut + 1) : trimmed;
     return `Yes, allow reading from ${leaf || directory}/ from this project`;
 }
+function parentDirLexically(p) {
+    return normalizeAbsPathLexically(`${p}/..`);
+}
+export function deepestCommonDir(a, b) {
+    if (a === b)
+        return a;
+    const shorter = Math.min(a.length, b.length);
+    let end = 0;
+    let i = 0;
+    while (i < shorter && a[i] === b[i]) {
+        if (a[i] === "/" || a[i] === "\\")
+            end = i;
+        i++;
+    }
+    if (i === shorter && (a[shorter] === "/" || a[shorter] === "\\" || b[shorter] === "/" || b[shorter] === "\\"))
+        end = shorter;
+    const cut = a.slice(0, end);
+    const candidate = cut.includes("/") || cut.includes("\\") ? cut : a.slice(0, end + 1);
+    if (candidate.length === 0 || !withinAnyRoot([candidate], a) || !withinAnyRoot([candidate], b))
+        return undefined;
+    return candidate;
+}
+function outOfRootGrantCandidateOf(paths, boundary) {
+    if (paths.length === 0)
+        return undefined;
+    if (paths.some(hasWin32AliasedComponent))
+        return undefined;
+    let candidate = parentDirLexically(paths[0]);
+    for (const path of paths.slice(1)) {
+        if (candidate === undefined)
+            return undefined;
+        candidate = deepestCommonDir(candidate, parentDirLexically(path));
+    }
+    if (candidate === undefined)
+        return undefined;
+    if (parentDirLexically(candidate) === candidate)
+        return undefined;
+    if (boundary.homeDir !== undefined && withinAnyRoot([candidate], boundary.homeDir))
+        return undefined;
+    if (boundary.roots.some((root) => withinAnyRoot([candidate], root)))
+        return undefined;
+    return candidate;
+}
 const NO_PATH_OPERAND_COMMANDS = new Set([
     "pwd", "echo", "whoami", "uname", "which", "tr", "basename", "dirname",
     "cal", "uptime", "id", "groups", "nproc", "locale", "free", "true", "false", "seq", "expr", "type", "sleep",
@@ -1632,10 +1675,10 @@ export function classifyCompoundReadonlyDetailed(command, allow, boundary, opts)
             shapeRefusal ??= `multiple directory changes in one command require approval for clarity ${NOT_AUTO_ALLOWED}`;
     }
     if (boundary !== undefined) {
-        const walk = evaluateReadBoundary(foldedSegments, boundary, foldedReach);
+        const walk = evaluateReadBoundary(foldedSegments, boundary, true, foldedReach);
         if (shapeRefusal === undefined)
             return walk;
-        const { reason: _walkSentence, ...structure } = walk;
+        const { reason: _walkSentence, outOfRootGrantCandidate: _walkGrantCandidate, ...structure } = walk;
         return { ...structure, reason: shapeRefusal };
     }
     if (shapeRefusal !== undefined)
@@ -1646,7 +1689,7 @@ export function classifyCompoundReadonlyDetailed(command, allow, boundary, opts)
     return {};
 }
 const BASE_CANDIDATE_MAX = 256;
-function evaluateReadBoundary(foldedSegments, boundary, reach) {
+function evaluateReadBoundary(foldedSegments, boundary, mintGrantCandidate, reach) {
     const seen = { outside: new Set(), inside: new Set(), undecided: new Set(), recursive: new Set(), unresolved: new Set(), checkedSpelled: new Set(), undecidedSpelled: new Set(), outsideSpelled: new Set() };
     const outside = [];
     const inside = [];
@@ -1804,10 +1847,20 @@ function evaluateReadBoundary(foldedSegments, boundary, reach) {
         return { ...checkedField, ...undecidedField };
     const paths = outside.map((o) => `"${o.path}"`).join(", ");
     const allowed = boundary.roots.length > 0 ? boundary.roots.join(", ") : "(none)";
+    const grantCandidate = (() => {
+        if (!mintGrantCandidate || outOfRootSpellings.length > 0)
+            return undefined;
+        const proposed = outOfRootGrantCandidateOf(outside.map((o) => o.path), boundary);
+        if (proposed === undefined)
+            return undefined;
+        const replay = evaluateReadBoundary(foldedSegments, { ...boundary, roots: [...boundary.roots, proposed] }, false, reach);
+        return replay.reason === undefined && (replay.undecidedPaths ?? []).length === 0 ? proposed : undefined;
+    })();
     return {
         reason: `"${outside[0].command}" reads ${paths}, outside the allowed directories for this session: ${allowed} ${NOT_AUTO_ALLOWED}`,
         outOfRootRead: true,
         outOfRootPaths: outside.map((o) => o.path),
+        ...(grantCandidate !== undefined ? { outOfRootGrantCandidate: grantCandidate } : {}),
         ...outsideField,
         ...checkedField,
         ...undecidedField,
@@ -1825,7 +1878,7 @@ export function classifySimpleCommandReadBoundary(command, boundary) {
         if (familyRefusal !== undefined)
             return { reason: familyRefusal, refusedWhole: true };
     }
-    return evaluateReadBoundary([toks], boundary);
+    return evaluateReadBoundary([toks], boundary, true);
 }
 const NOT_GATED = { gated: false, paths: [] };
 const UNREADABLE_WHITELIST_WORD = /[$`()*?[\]{}~]/;
@@ -1885,7 +1938,7 @@ export function classifyOutOfRootReadGate(command, allow, boundary) {
             return NOT_GATED;
         if (baseMoved)
             return { gated: true, paths: [] };
-        const verdict = evaluateReadBoundary(readers, containmentOnly, readerReach);
+        const verdict = evaluateReadBoundary(readers, containmentOnly, false, readerReach);
         return verdict.outOfRootRead === true ? { gated: true, paths: verdict.outOfRootPaths ?? [] } : NOT_GATED;
     };
     const direct = judge(command);

package/dist/tools/fs/fs-bash.js

@@ -50,13 +50,17 @@ export function bashReversibilityProbe(allow, boundary) {
         if (loop.reason === undefined)
             return { reversible: true };
         if (boundaryDeclared(loop) || unjudgedRead(command, allowSet, resolved, loop))
-            return { reversible: false, mandated: true };
-        return { reversible: false, ...boundaryGate(detailed) };
+            return { reversible: false, mandated: true, ...readRootCandidateOf(loop) };
+        return { reversible: false, ...boundaryGate(detailed), ...readRootCandidateOf(detailed) };
     };
 }
 function boundaryUnread(verdict) {
     return boundaryUndecided(verdict) || boundaryUnjudged(verdict);
 }
+function readRootCandidateOf(verdict) {
+    const dir = verdict.outOfRootGrantCandidate;
+    return dir !== undefined ? { readRootCandidate: { dir, clearsThisAsk: true } } : {};
+}
 function boundaryUndecided(verdict) {
     return verdict.undecidedPaths !== undefined && verdict.undecidedPaths.length > 0;
 }
@@ -134,7 +138,7 @@ export function bashReadBoundaryProbe(boundary) {
         const loopVerdict = seatVerdict(loop);
         const mandated = [compoundVerdict, loopVerdict].find((verdict) => verdict?.mandated === true);
         if (mandated !== undefined)
-            return mandated;
+            return { ...mandated, ...readRootCandidateOf(detailed), ...readRootCandidateOf(loop) };
         if (readBoundaryMandate(command, allowSet, resolved, detailed).mandated === true)
             return { reversible: false, mandated: true };
         return compoundVerdict ?? loopVerdict ?? { reversible: true };

package/dist/tools/fs/read-deny.d.ts

@@ -104,11 +104,12 @@ export interface ReadDenyBuiltinRow {
  * `.sema`/`.claude` also hold agents, skills, hooks and (under the shell's layout,
  * `~/.sema/engine-data`) the engine data root with the memory library — material the model reads
  * and edits as ordinary work, and a directory-wide row would need a data-root passthrough (one more
- * rule) to keep it readable. The write face guards the directories (`sensitive-path-policy.ts`): a
- * write there is self-authorization; a read of a non-credential file there is debugging. Token
+ * rule) to keep it readable. Token
  * STORES of the same tooling (`.credentials.json`, an agent CLI's `auth.json`, …) are credentials rows, not
  * agent-config rows: a deployment that switches this tier off to debug its agent configuration must
- * not also expose the OAuth stores beside it.
+ * not also expose the OAuth stores beside it. These rows are ALSO the opt-in write deny set's
+ * agent-configuration block ({@link import("../../core/sensitive-path-policy.js").agentConfigDenyPatterns},
+ * which reads them from here; contract sentence there), so a row added here is judged by both faces.
  */
 export declare const READ_FACE_BUILTIN_DENY_TABLE: readonly ReadDenyBuiltinRow[];
 /**

package/dist/tools/fs/safety.d.ts

@@ -258,6 +258,21 @@ export declare function isBinaryContent(sample: string): boolean;
  * test with no verdict of its own.
  */
 export declare function isUncPath(path: string): boolean;
+/**
+ * True when a WIN-FORM spelling carries a component Win32's own normalization would trim — a trailing dot
+ * or space on anything but the `.`/`..` specials (the same client-side strip {@link uncCanonicalKey}
+ * folds, stated once and read here rather than re-derived).
+ *
+ * Such a spelling is an ALIAS: `x. ` and `x` name ONE directory to the OS and two different strings to a
+ * lexical comparator. A caller that must reason about a spelling byte-wise — a directory offered to a
+ * person as the thing to declare, a common-prefix cut between two operands — cannot pick one of the two
+ * readings on the person's behalf, so it withholds. POSIX paths are never aliased this way: a trailing dot
+ * or space there is an ordinary filename character.
+ *
+ * The UNC ANCHOR is exempt for the reason the key minter states: a host's trailing dot is DNS (the FQDN
+ * root) and share-name normalization is the server's business; neither is the client-side strip.
+ */
+export declare function hasWin32AliasedComponent(p: string): boolean;
 /** The two spelling families a tree can be in. Read from the ROOT's spelling (the cwd's when a deployment
  *  supplies no root) — never from `process.platform`: the exec env may be remote and of the other family. */
 export type PathFamily = "win" | "posix";

package/dist/tools/fs/safety.js

@@ -314,6 +314,13 @@ function foldUncLexically(p) {
     const anchor = `\\\\${host}${share !== undefined ? `\\${share}` : ""}`;
     return { key: out.length > 0 ? `${anchor}\\${out.join("\\")}` : anchor, climbedAboveShare: climbed };
 }
+export function hasWin32AliasedComponent(p) {
+    if (!isWinFormPath(p))
+        return false;
+    const parts = p.split(/[\\/]+/).filter((seg) => seg.length > 0);
+    const tail = p.startsWith("\\\\") || p.startsWith("//") ? parts.slice(2) : parts;
+    return tail.some((seg) => seg !== "." && seg !== ".." && /[. ]$/.test(seg));
+}
 export function pathFamilyOf(bases) {
     const tree = bases.root ?? bases.cwd;
     return tree === undefined ? undefined : isWinFormPath(tree) ? "win" : "posix";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.18.0",
+  "version": "7.19.0",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",

package/test/export-surface.snapshot.json

@@ -1,7 +1,7 @@
 {
   "_comment": "design/87 L3 — frozen public export surface of src/index.ts (name -> kind). DO NOT edit by hand to silence a red test. A removed/changed entry = a SemVer-BREAKING change; bump MAJOR and update this fixture in the SAME commit (design/87 §4.2 / §5.2). Regenerate via REGEN in test/export-surface.test.ts.",
   "_tierComment": "#435 v1 — machine-readable layering of the public surface: stable = demonstrated by README.md / src/examples; internal = an `Internal`-marked name or a runner/engine deep-subtree declaration (the model seam src/engine/llm is excluded — it is the BYOM contract, not an engine internal); advanced = a supported export the front door does not walk you through. THIS IS AN INITIAL HEURISTIC, derived mechanically and expected to be refined ticket by ticket: no human reviewed these 1700+ entries one by one, and nothing here claims otherwise. Known bias: a short or English-word export name (ok, err, Result, Usage) can match ordinary prose in README.md and land `stable` on a coincidence. Every export MUST carry a tier — a new export with no row fails the gate in export-surface.test.ts.",
-  "count": 2373,
+  "count": 2378,
   "exports": {
     "A2ATaskState": "type",
     "A2ATaskStateReversal": "type",
@@ -54,6 +54,7 @@
     "AUTO_MODE_DENIAL_LIMIT_DEFAULTS": "variable",
     "AUTO_MODE_DENY_SOURCES": "variable",
     "AUTO_MODE_FALLBACK_CAUSES": "variable",
+    "AUTO_MODE_PARSE_FAILURES": "variable",
     "AUTO_MODE_PERMISSIONS_EXTERNAL": "variable",
     "AUTO_MODE_UNAVAILABLE_CAUSES": "variable",
     "AcquiredSession": "interface",
@@ -149,6 +150,7 @@
     "AutoModeDenySource": "type",
     "AutoModeFallbackCause": "type",
     "AutoModeLadderRung": "interface",
+    "AutoModeParseFailure": "type",
     "AutoModeRebuildOptions": "interface",
     "AutoModeRebuildRefusal": "type",
     "AutoModeRebuildResult": "type",
@@ -206,7 +208,6 @@
     "CHALLENGE_LEDGER_MAX_EVENTS": "variable",
     "CIRCUIT_OPEN_MARKER": "variable",
     "CLASSIFIER_DENY_CAUSES": "variable",
-    "CLASSIFIER_PARSE_FAILURE_DENY_MESSAGE": "variable",
     "COARSE_SHELL_TOOLS": "variable",
     "CODE_AGENT_PROMPT": "variable",
     "CODE_REVIEW_PROMPT": "variable",
@@ -1050,6 +1051,7 @@
     "REAL_APPROVAL_CHECKPOINT_VERSION": "variable",
     "REASONING_BUDGET_SHARE": "variable",
     "RECALL_CAVEAT": "variable",
+    "RECOMMENDED_SENSITIVE_ASK_PATTERNS": "variable",
     "RECOMMENDED_SENSITIVE_PATTERNS": "variable",
     "REMOTE_HARVEST_PER_FILE_BYTES": "variable",
     "REMOTE_MASS_DELETION_FUSE_RATIO": "variable",
@@ -1081,6 +1083,7 @@
     "ReadOnlyCommandRow": "interface",
     "ReadOnlyFlagArity": "type",
     "ReadOnlyShellVerdict": "type",
+    "ReadRootGrantCandidate": "interface",
     "RealApprovalGateBit": "interface",
     "ReasoningFormat": "type",
     "ReasoningIntensity": "type",
@@ -1700,6 +1703,7 @@
     "checkpointVersionOf": "function",
     "clampHopChain": "function",
     "classifierMayAnswer": "function",
+    "classifierParseFailureDenyMessage": "function",
     "classifierUnavailableDenyMessage": "function",
     "classifyCompoundReadonly": "function",
     "classifyCompoundReadonlyDetailed": "function",
@@ -1943,6 +1947,7 @@
     "isAutoModeClassifierFallback": "function",
     "isAutoModeDenySource": "function",
     "isAutoModeFallbackCause": "function",
+    "isAutoModeParseFailure": "function",
     "isAutoModeUnavailableCause": "function",
     "isCanonicalPeerAddress": "function",
     "isClassifierDenyCause": "function",
@@ -2328,7 +2333,7 @@
     "termSet": "function",
     "terminalForTier": "function",
     "terminalProjection": "function",
-    "thinkingOffExpressible": "function",
+    "thinkingOffSpelled": "function",
     "tightenTaskSpec": "function",
     "toA2ATaskState": "function",
     "toolCallFaceOf": "function",
@@ -2429,6 +2434,7 @@
     "AUTO_MODE_DENIAL_LIMIT_DEFAULTS": "advanced",
     "AUTO_MODE_DENY_SOURCES": "advanced",
     "AUTO_MODE_FALLBACK_CAUSES": "advanced",
+    "AUTO_MODE_PARSE_FAILURES": "advanced",
     "AUTO_MODE_PERMISSIONS_EXTERNAL": "advanced",
     "AUTO_MODE_UNAVAILABLE_CAUSES": "advanced",
     "AcquiredSession": "advanced",
@@ -2524,6 +2530,7 @@
     "AutoModeDenySource": "advanced",
     "AutoModeFallbackCause": "advanced",
     "AutoModeLadderRung": "advanced",
+    "AutoModeParseFailure": "advanced",
     "AutoModeRebuildOptions": "advanced",
     "AutoModeRebuildRefusal": "advanced",
     "AutoModeRebuildResult": "advanced",
@@ -2581,7 +2588,6 @@
     "CHALLENGE_LEDGER_MAX_EVENTS": "advanced",
     "CIRCUIT_OPEN_MARKER": "advanced",
     "CLASSIFIER_DENY_CAUSES": "advanced",
-    "CLASSIFIER_PARSE_FAILURE_DENY_MESSAGE": "advanced",
     "COARSE_SHELL_TOOLS": "stable",
     "CODE_AGENT_PROMPT": "advanced",
     "CODE_REVIEW_PROMPT": "advanced",
@@ -3425,6 +3431,7 @@
     "REAL_APPROVAL_CHECKPOINT_VERSION": "advanced",
     "REASONING_BUDGET_SHARE": "advanced",
     "RECALL_CAVEAT": "advanced",
+    "RECOMMENDED_SENSITIVE_ASK_PATTERNS": "advanced",
     "RECOMMENDED_SENSITIVE_PATTERNS": "advanced",
     "REMOTE_HARVEST_PER_FILE_BYTES": "advanced",
     "REMOTE_MASS_DELETION_FUSE_RATIO": "advanced",
@@ -3456,6 +3463,7 @@
     "ReadOnlyCommandRow": "advanced",
     "ReadOnlyFlagArity": "advanced",
     "ReadOnlyShellVerdict": "advanced",
+    "ReadRootGrantCandidate": "advanced",
     "RealApprovalGateBit": "advanced",
     "ReasoningFormat": "advanced",
     "ReasoningIntensity": "advanced",
@@ -4075,6 +4083,7 @@
     "checkpointVersionOf": "advanced",
     "clampHopChain": "advanced",
     "classifierMayAnswer": "advanced",
+    "classifierParseFailureDenyMessage": "advanced",
     "classifierUnavailableDenyMessage": "advanced",
     "classifyCompoundReadonly": "advanced",
     "classifyCompoundReadonlyDetailed": "advanced",
@@ -4318,6 +4327,7 @@
     "isAutoModeClassifierFallback": "advanced",
     "isAutoModeDenySource": "advanced",
     "isAutoModeFallbackCause": "advanced",
+    "isAutoModeParseFailure": "advanced",
     "isAutoModeUnavailableCause": "advanced",
     "isCanonicalPeerAddress": "advanced",
     "isClassifierDenyCause": "advanced",
@@ -4703,7 +4713,7 @@
     "termSet": "stable",
     "terminalForTier": "advanced",
     "terminalProjection": "internal",
-    "thinkingOffExpressible": "advanced",
+    "thinkingOffSpelled": "advanced",
     "tightenTaskSpec": "stable",
     "toA2ATaskState": "advanced",
     "toolCallFaceOf": "advanced",