@sema-agent/core 7.18.0 → 7.20.0

package/dist/tools/fs/fs-bash.js

@@ -9,11 +9,11 @@ import { hasBackgroundShell } from "../../core/background-shell.js";
 import { delimitUntrusted } from "../../core/untrusted-text.js";
 import { MCP_IMAGE_MAX_BASE64 } from "../../core/mcp.js";
 import { imageMagicMatches, normalizeAbsPathLexically, withinAnyRoot } from "./safety.js";
-import { boundaryIsTheSandbox, hasDestroy, isIsolated } from "../../core/remote-env.js";
+import { boundaryIsTheSandbox, canonicalPathIsAuthoritative, hasDestroy, isIsolated } from "../../core/remote-env.js";
 import { ghRateLimitHint } from "./gh-rate-limit.js";
-import { resolveBashTimeoutCaps, bashTimeoutCapsSec, bashTimeoutArgRefusal, bashTimeoutParamDescription, envErrorDetail, bashMaxOutputChars, clipShellOutput, writeShellOverflowFile, createShellOverflowSpoolFence, shellRecoveryHint, CWD_SENTINEL, BASH_READONLY_CONFINEMENT_NOTE, } from "./fs-shared.js";
+import { resolveBashTimeoutCaps, bashTimeoutCapsSec, bashTimeoutArgRefusal, bashTimeoutParamDescription, envErrorDetail, bashMaxOutputChars, clipShellOutput, writeShellOverflowFile, createShellOverflowSpoolFence, shellRecoveryHint, CWD_SENTINEL, stripCwdSentinel, BASH_READONLY_CONFINEMENT_NOTE, } from "./fs-shared.js";
 import { PROBE_CAUSE_PATH_MAX, inlineUntrusted } from "../../core/untrusted-text.js";
-import { BASH_CLASSIFY_DEFAULT_ALLOW, BASH_READONLY_DEFAULT_ALLOW, coarseReadonlyCheck, classifyBoundedReadonlyPollLoopDetailed, classifyCompoundReadonlyDetailed, classifyOutOfRootReadGate, refusedCommandMayRead, classifySimpleCommandReadBoundary, NOT_AUTO_ALLOWED, } from "./bash-readonly-classifier.js";
+import { bashClassifyDefaultAllow, BASH_READONLY_DEFAULT_ALLOW, coarseReadonlyCheck, classifyBoundedReadonlyPollLoopDetailed, classifyCompoundReadonlyDetailed, classifyOutOfRootReadGate, refusedCommandMayRead, classifySimpleCommandReadBoundary, NOT_AUTO_ALLOWED, } from "./bash-readonly-classifier.js";
 import { toolFace } from "../../core/tool-catalog-entries.js";
 const RECURSIVE_CAUSE_MAX_PATHS = 3;
 const RECURSIVE_READ_CAUSE_CODE = "shell.recursive_read_unbounded";
@@ -25,7 +25,7 @@ function operandFamily(paths) {
     };
 }
 export function bashReversibilityProbe(allow, boundary) {
-    const allowSet = new Set(allow ?? BASH_CLASSIFY_DEFAULT_ALLOW);
+    const allowSet = new Set(allow ?? bashClassifyDefaultAllow());
     return (args) => {
         const command = shellCommandOf(args);
         if (command === undefined)
@@ -50,13 +50,17 @@ export function bashReversibilityProbe(allow, boundary) {
         if (loop.reason === undefined)
             return { reversible: true };
         if (boundaryDeclared(loop) || unjudgedRead(command, allowSet, resolved, loop))
-            return { reversible: false, mandated: true };
-        return { reversible: false, ...boundaryGate(detailed) };
+            return { reversible: false, mandated: true, ...readRootCandidateOf(loop) };
+        return { reversible: false, ...boundaryGate(detailed), ...readRootCandidateOf(detailed) };
     };
 }
 function boundaryUnread(verdict) {
     return boundaryUndecided(verdict) || boundaryUnjudged(verdict);
 }
+function readRootCandidateOf(verdict) {
+    const dir = verdict.outOfRootGrantCandidate;
+    return dir !== undefined ? { readRootCandidate: { dir, clearsThisAsk: true } } : {};
+}
 function boundaryUndecided(verdict) {
     return verdict.undecidedPaths !== undefined && verdict.undecidedPaths.length > 0;
 }
@@ -105,7 +109,7 @@ function recursiveReadCause(detailed) {
     };
 }
 export function bashReadBoundaryProbe(boundary) {
-    const allowSet = new Set(BASH_CLASSIFY_DEFAULT_ALLOW);
+    const allowSet = new Set(bashClassifyDefaultAllow());
     return (args) => {
         const command = shellCommandOf(args);
         if (command === undefined)
@@ -134,7 +138,7 @@ export function bashReadBoundaryProbe(boundary) {
         const loopVerdict = seatVerdict(loop);
         const mandated = [compoundVerdict, loopVerdict].find((verdict) => verdict?.mandated === true);
         if (mandated !== undefined)
-            return mandated;
+            return { ...mandated, ...readRootCandidateOf(detailed), ...readRootCandidateOf(loop) };
         if (readBoundaryMandate(command, allowSet, resolved, detailed).mandated === true)
             return { reversible: false, mandated: true };
         return compoundVerdict ?? loopVerdict ?? { reversible: true };
@@ -398,23 +402,6 @@ function createEpilogueFilter(marker) {
         return out + buf;
     };
 }
-function readCwdEpilogue(stderr, marker) {
-    let out = "";
-    let rest = stderr;
-    let cwd;
-    for (;;) {
-        const open = rest.indexOf(marker);
-        if (open === -1)
-            break;
-        const close = rest.indexOf(marker, open + marker.length);
-        if (close === -1)
-            break;
-        out += rest.slice(0, open);
-        cwd = rest.slice(open + marker.length, close);
-        rest = rest.slice(close + marker.length);
-    }
-    return { stderr: out + rest, cwd };
-}
 function describeSafely(sink, body) {
     if (sink === undefined)
         return;
@@ -578,7 +565,7 @@ async function runShell(env, cwd, toolName, command, timeoutSec, caps, signal, c
     let { stderr } = res.value;
     const { stdout, exitCode } = res.value;
     if (cwdRef) {
-        const epilogue = readCwdEpilogue(stderr, cwdMarker);
+        const epilogue = stripCwdSentinel(stderr, cwdMarker);
         stderr = epilogue.stderr;
         if (epilogue.cwd !== undefined) {
             const captured = epilogue.cwd.trim();
@@ -732,7 +719,7 @@ export function createBashTool(env, rootCanonical, coAuthor = false, cwdRef = {
     const bgRetained = hasBackgroundShell(env) && env.backgroundCapabilities.retainBackgroundProcesses === true;
     const bgSessionScoped = taskOpts.sessionId !== undefined && taskOpts.taskRegistry !== undefined;
     const bgEnvIsolatedOwned = hasDestroy(env) && isIsolated(env);
-    const recheckReaders = new Set(BASH_CLASSIFY_DEFAULT_ALLOW);
+    const recheckReaders = new Set(bashClassifyDefaultAllow());
     let canonicalForRoots;
     const canonicalBoundaryFor = (roots) => {
         const key = roots.join("\u0000");
@@ -1066,6 +1053,7 @@ function pathSegmentsFrom(p, from) {
 }
 function createCanonicalReadBoundary(env, readRoots) {
     const lexicalOnly = boundaryIsTheSandbox(env);
+    const resolverIsAuthoritative = canonicalPathIsAuthoritative(env);
     let rootsOnce;
     const canonicalRoots = async (signal) => {
         rootsOnce ??= (async () => {
@@ -1225,8 +1213,11 @@ function createCanonicalReadBoundary(env, readRoots) {
             let unresolvable;
             const judge = async (p) => {
                 const real = await resolve(p, signal);
-                if (real === undefined)
+                if (real === undefined) {
+                    if (resolverIsAuthoritative)
+                        unresolvable ??= `"${p}" cannot be resolved to verify where it reads`;
                     return;
+                }
                 if (!real.exact && real.missing !== true) {
                     unresolvable ??= `"${p}" cannot be resolved to verify where it reads`;
                     return;

package/dist/tools/fs/fs-shared.d.ts

@@ -361,6 +361,28 @@ export declare function shellRecoveryHint(path: string, readOnly: boolean | unde
  *  (NOT NotebookEdit — CC ships it without the trailer). */
 export declare const FILE_STATE_TRAILER = " (file state is current in your context \u2014 no need to Read it back)";
 export declare const CWD_SENTINEL = "__cc_cwd_9f2c1b__";
+/**
+ * Take the engine's own cwd epilogue out of a finished stderr, and report the working directory the
+ * command left behind (the payload of the LAST span).
+ *
+ * EVERY span, and the LAST one — not the first, and not just one. A command that turns on shell tracing
+ * produces more than one (the shell echoes the epilogue's own source, marker and all, before running
+ * it), and under a one-pair rule the FIRST pair was that echo, whose payload is the unexpanded
+ * `' "$(pwd)" '`; a `cd` that plainly worked was then dropped while the real record stayed in the stderr
+ * a person reads. An opener with no close is NOT ours to eat — the command's own text is left exactly
+ * as it arrived.
+ *
+ * TWO CALLERS, ONE RULE, which is why the marker is optional. The foreground result path KNOWS the
+ * marker it minted and passes it (exact, unambiguous). A backgrounded command's spool is assembled by a
+ * different lane entirely — the shell row outlives the run that launched it and never had the marker —
+ * so it passes none and the marker is recovered per span from the sentinel plus its hex suffix. Before
+ * this was shared, only the foreground path stripped, and the completion notification handed a person
+ * the raw internal marker with the directory inside it.
+ */
+export declare function stripCwdSentinel(stderr: string, marker?: string): {
+    stderr: string;
+    cwd: string | undefined;
+};
 /** Convert a model-supplied millisecond timeout to our internal seconds, clamped. Exported for the
  *  cc-parity unit (model sees ms, internal stays seconds — no ×1000 error).
  *  ⚠️ This returns the EFFECTIVE budget, not the request — capping at a call site destroys the

package/dist/tools/fs/fs-shared.js

@@ -247,6 +247,36 @@ export function shellRecoveryHint(path, readOnly) {
 }
 export const FILE_STATE_TRAILER = " (file state is current in your context — no need to Read it back)";
 export const CWD_SENTINEL = "__cc_cwd_9f2c1b__";
+const CWD_SENTINEL_SUFFIX_CHARS = 16;
+function cwdMarkerAt(text, open) {
+    const after = open + CWD_SENTINEL.length;
+    const suffix = /^[0-9a-f]{16}/.exec(text.slice(after, after + CWD_SENTINEL_SUFFIX_CHARS));
+    return suffix === null ? undefined : CWD_SENTINEL + suffix[0];
+}
+export function stripCwdSentinel(stderr, marker) {
+    let out = "";
+    let rest = stderr;
+    let cwd;
+    let from = 0;
+    for (;;) {
+        const open = rest.indexOf(marker ?? CWD_SENTINEL, from);
+        if (open === -1)
+            break;
+        const span = marker ?? cwdMarkerAt(rest, open);
+        if (span === undefined) {
+            from = open + CWD_SENTINEL.length;
+            continue;
+        }
+        const close = rest.indexOf(span, open + span.length);
+        if (close === -1)
+            break;
+        out += rest.slice(0, open);
+        cwd = rest.slice(open + span.length, close);
+        rest = rest.slice(close + span.length);
+        from = 0;
+    }
+    return { stderr: out + rest, cwd };
+}
 export function msTimeoutToSec(timeoutMs, caps = resolveBashTimeoutCaps()) {
     const { defaultSec, maxSec } = bashTimeoutCapsSec(caps);
     if (timeoutMs === undefined || !Number.isFinite(timeoutMs))

package/dist/tools/fs/index.d.ts

@@ -12,7 +12,7 @@ export * from "./bash-readonly-classifier.js";
 export * from "./fs-bash.js";
 export * from "./read-deny.js";
 import { type BashReadonlyRootBoundary } from "./bash-readonly-classifier.js";
-export { BASH_CLASSIFY_DEFAULT_ALLOW } from "./bash-readonly-classifier.js";
+export { BASH_CLASSIFY_EXTRA_ALLOW, bashClassifyDefaultAllow } from "./bash-readonly-classifier.js";
 import { type ReadDenyEntry } from "./read-deny.js";
 import { type ContainmentFace } from "./containment-face.js";
 export * from "./containment-face.js";

package/dist/tools/fs/index.js

@@ -12,7 +12,7 @@ export * from "./bash-readonly-classifier.js";
 export * from "./fs-bash.js";
 export * from "./read-deny.js";
 import { BASH_READONLY_DEFAULT_ALLOW, } from "./bash-readonly-classifier.js";
-export { BASH_CLASSIFY_DEFAULT_ALLOW } from "./bash-readonly-classifier.js";
+export { BASH_CLASSIFY_EXTRA_ALLOW, bashClassifyDefaultAllow } from "./bash-readonly-classifier.js";
 import { compileReadDeny } from "./read-deny.js";
 import { deploymentFaceClampNotice, resolveContainmentFace } from "./containment-face.js";
 export * from "./containment-face.js";

package/dist/tools/fs/read-deny.d.ts

@@ -104,11 +104,12 @@ export interface ReadDenyBuiltinRow {
  * `.sema`/`.claude` also hold agents, skills, hooks and (under the shell's layout,
  * `~/.sema/engine-data`) the engine data root with the memory library — material the model reads
  * and edits as ordinary work, and a directory-wide row would need a data-root passthrough (one more
- * rule) to keep it readable. The write face guards the directories (`sensitive-path-policy.ts`): a
- * write there is self-authorization; a read of a non-credential file there is debugging. Token
+ * rule) to keep it readable. Token
  * STORES of the same tooling (`.credentials.json`, an agent CLI's `auth.json`, …) are credentials rows, not
  * agent-config rows: a deployment that switches this tier off to debug its agent configuration must
- * not also expose the OAuth stores beside it.
+ * not also expose the OAuth stores beside it. These rows are ALSO the opt-in write deny set's
+ * agent-configuration block ({@link import("../../core/sensitive-path-policy.js").agentConfigDenyPatterns},
+ * which reads them from here; contract sentence there), so a row added here is judged by both faces.
  */
 export declare const READ_FACE_BUILTIN_DENY_TABLE: readonly ReadDenyBuiltinRow[];
 /**

package/dist/tools/fs/safety.d.ts

@@ -258,6 +258,21 @@ export declare function isBinaryContent(sample: string): boolean;
  * test with no verdict of its own.
  */
 export declare function isUncPath(path: string): boolean;
+/**
+ * True when a WIN-FORM spelling carries a component Win32's own normalization would trim — a trailing dot
+ * or space on anything but the `.`/`..` specials (the same client-side strip {@link uncCanonicalKey}
+ * folds, stated once and read here rather than re-derived).
+ *
+ * Such a spelling is an ALIAS: `x. ` and `x` name ONE directory to the OS and two different strings to a
+ * lexical comparator. A caller that must reason about a spelling byte-wise — a directory offered to a
+ * person as the thing to declare, a common-prefix cut between two operands — cannot pick one of the two
+ * readings on the person's behalf, so it withholds. POSIX paths are never aliased this way: a trailing dot
+ * or space there is an ordinary filename character.
+ *
+ * The UNC ANCHOR is exempt for the reason the key minter states: a host's trailing dot is DNS (the FQDN
+ * root) and share-name normalization is the server's business; neither is the client-side strip.
+ */
+export declare function hasWin32AliasedComponent(p: string): boolean;
 /** The two spelling families a tree can be in. Read from the ROOT's spelling (the cwd's when a deployment
  *  supplies no root) — never from `process.platform`: the exec env may be remote and of the other family. */
 export type PathFamily = "win" | "posix";

package/dist/tools/fs/safety.js

@@ -314,6 +314,13 @@ function foldUncLexically(p) {
     const anchor = `\\\\${host}${share !== undefined ? `\\${share}` : ""}`;
     return { key: out.length > 0 ? `${anchor}\\${out.join("\\")}` : anchor, climbedAboveShare: climbed };
 }
+export function hasWin32AliasedComponent(p) {
+    if (!isWinFormPath(p))
+        return false;
+    const parts = p.split(/[\\/]+/).filter((seg) => seg.length > 0);
+    const tail = p.startsWith("\\\\") || p.startsWith("//") ? parts.slice(2) : parts;
+    return tail.some((seg) => seg !== "." && seg !== ".." && /[. ]$/.test(seg));
+}
 export function pathFamilyOf(bases) {
     const tree = bases.root ?? bases.cwd;
     return tree === undefined ? undefined : isWinFormPath(tree) ? "win" : "posix";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.18.0",
+  "version": "7.20.0",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",
@@ -84,6 +84,7 @@
     "gate:tool-names": "node scripts/verify-tool-name-tables.mjs",
     "gate:tool-docs": "node scripts/gen-tool-spec-fields.mjs --check",
     "gate:backlog-ledger": "node scripts/verify-backlog-ledger.mjs",
+    "gate:child-clamp-seats": "node scripts/verify-child-clamp-seats.mjs",
     "gate:docs-tool-names": "node scripts/verify-docs-tool-names.mjs",
     "gate:comment-ratio": "vitest run test/comment-ratio-ratchet.test.ts",
     "gate:negative-controls": "vitest run test/gate-negative-controls.test.ts",

package/test/export-surface.snapshot.json

@@ -1,7 +1,7 @@
 {
   "_comment": "design/87 L3 — frozen public export surface of src/index.ts (name -> kind). DO NOT edit by hand to silence a red test. A removed/changed entry = a SemVer-BREAKING change; bump MAJOR and update this fixture in the SAME commit (design/87 §4.2 / §5.2). Regenerate via REGEN in test/export-surface.test.ts.",
   "_tierComment": "#435 v1 — machine-readable layering of the public surface: stable = demonstrated by README.md / src/examples; internal = an `Internal`-marked name or a runner/engine deep-subtree declaration (the model seam src/engine/llm is excluded — it is the BYOM contract, not an engine internal); advanced = a supported export the front door does not walk you through. THIS IS AN INITIAL HEURISTIC, derived mechanically and expected to be refined ticket by ticket: no human reviewed these 1700+ entries one by one, and nothing here claims otherwise. Known bias: a short or English-word export name (ok, err, Result, Usage) can match ordinary prose in README.md and land `stable` on a coincidence. Every export MUST carry a tier — a new export with no row fails the gate in export-surface.test.ts.",
-  "count": 2373,
+  "count": 2386,
   "exports": {
     "A2ATaskState": "type",
     "A2ATaskStateReversal": "type",
@@ -54,6 +54,7 @@
     "AUTO_MODE_DENIAL_LIMIT_DEFAULTS": "variable",
     "AUTO_MODE_DENY_SOURCES": "variable",
     "AUTO_MODE_FALLBACK_CAUSES": "variable",
+    "AUTO_MODE_PARSE_FAILURES": "variable",
     "AUTO_MODE_PERMISSIONS_EXTERNAL": "variable",
     "AUTO_MODE_UNAVAILABLE_CAUSES": "variable",
     "AcquiredSession": "interface",
@@ -149,6 +150,7 @@
     "AutoModeDenySource": "type",
     "AutoModeFallbackCause": "type",
     "AutoModeLadderRung": "interface",
+    "AutoModeParseFailure": "type",
     "AutoModeRebuildOptions": "interface",
     "AutoModeRebuildRefusal": "type",
     "AutoModeRebuildResult": "type",
@@ -206,7 +208,6 @@
     "CHALLENGE_LEDGER_MAX_EVENTS": "variable",
     "CIRCUIT_OPEN_MARKER": "variable",
     "CLASSIFIER_DENY_CAUSES": "variable",
-    "CLASSIFIER_PARSE_FAILURE_DENY_MESSAGE": "variable",
     "COARSE_SHELL_TOOLS": "variable",
     "CODE_AGENT_PROMPT": "variable",
     "CODE_REVIEW_PROMPT": "variable",
@@ -269,6 +270,7 @@
     "CheckpointToken": "type",
     "CircuitBreakerOptions": "interface",
     "ClassifierDenyCause": "type",
+    "ClassifierSeat": "type",
     "CleanArmLeakFinding": "interface",
     "CleanArmLeakVerdict": "interface",
     "CleanMemoryIndexRow": "interface",
@@ -747,6 +749,7 @@
     "MemoryNoteRecord": "interface",
     "MemoryNoteType": "type",
     "MemoryOriginCause": "type",
+    "MemoryProjectionError": "class",
     "MemoryPromptArtifactStore": "class",
     "MemoryPromptSourceStateStore": "class",
     "MemoryReadDetails": "type",
@@ -1081,6 +1084,7 @@
     "ReadOnlyCommandRow": "interface",
     "ReadOnlyFlagArity": "type",
     "ReadOnlyShellVerdict": "type",
+    "ReadRootGrantCandidate": "interface",
     "RealApprovalGateBit": "interface",
     "ReasoningFormat": "type",
     "ReasoningIntensity": "type",
@@ -1536,6 +1540,7 @@
     "WORKFLOW_SUBAGENT_PROMPT": "variable",
     "WORKFLOW_SUBAGENT_PROMPT_SCHEMA": "variable",
     "WORKTREE_PARENT": "variable",
+    "WRITE_EXEMPT_DIR_COVERS_ROOT_CODE": "variable",
     "WRITE_PROTECTED_DEFAULT_TABLE": "variable",
     "WebFetchConfig": "interface",
     "WebSearchConfig": "interface",
@@ -1598,7 +1603,11 @@
     "WriteProtectedHit": "interface",
     "WriteProtectedKind": "type",
     "WriteProtectedRow": "interface",
+    "WriteProtectionCheck": "type",
+    "WriteProtectionCompileOptions": "interface",
+    "WriteProtectionJudgeContext": "interface",
     "WriteProtectionMatcher": "interface",
+    "WriteProtectionVerdict": "type",
     "WriteReceipt": "interface",
     "XARGS_READ_ONLY_TARGETS": "variable",
     "ackAdoptionConfig": "function",
@@ -1679,6 +1688,7 @@
     "callKeyOrdinal": "function",
     "canAccessAgentRecord": "function",
     "canAccessWorkflowRun": "function",
+    "canonicalPathIsAuthoritative": "function",
     "canonicalPeerDisplayName": "function",
     "canonicalWorkflowName": "function",
     "capAggregateMediaBytes": "function",
@@ -1700,6 +1710,8 @@
     "checkpointVersionOf": "function",
     "clampHopChain": "function",
     "classifierMayAnswer": "function",
+    "classifierParseFailureDenyMessage": "function",
+    "classifierSeatModel": "function",
     "classifierUnavailableDenyMessage": "function",
     "classifyCompoundReadonly": "function",
     "classifyCompoundReadonlyDetailed": "function",
@@ -1943,6 +1955,7 @@
     "isAutoModeClassifierFallback": "function",
     "isAutoModeDenySource": "function",
     "isAutoModeFallbackCause": "function",
+    "isAutoModeParseFailure": "function",
     "isAutoModeUnavailableCause": "function",
     "isCanonicalPeerAddress": "function",
     "isClassifierDenyCause": "function",
@@ -2328,7 +2341,7 @@
     "termSet": "function",
     "terminalForTier": "function",
     "terminalProjection": "function",
-    "thinkingOffExpressible": "function",
+    "thinkingOffSpelled": "function",
     "tightenTaskSpec": "function",
     "toA2ATaskState": "function",
     "toolCallFaceOf": "function",
@@ -2429,6 +2442,7 @@
     "AUTO_MODE_DENIAL_LIMIT_DEFAULTS": "advanced",
     "AUTO_MODE_DENY_SOURCES": "advanced",
     "AUTO_MODE_FALLBACK_CAUSES": "advanced",
+    "AUTO_MODE_PARSE_FAILURES": "advanced",
     "AUTO_MODE_PERMISSIONS_EXTERNAL": "advanced",
     "AUTO_MODE_UNAVAILABLE_CAUSES": "advanced",
     "AcquiredSession": "advanced",
@@ -2524,6 +2538,7 @@
     "AutoModeDenySource": "advanced",
     "AutoModeFallbackCause": "advanced",
     "AutoModeLadderRung": "advanced",
+    "AutoModeParseFailure": "advanced",
     "AutoModeRebuildOptions": "advanced",
     "AutoModeRebuildRefusal": "advanced",
     "AutoModeRebuildResult": "advanced",
@@ -2581,7 +2596,6 @@
     "CHALLENGE_LEDGER_MAX_EVENTS": "advanced",
     "CIRCUIT_OPEN_MARKER": "advanced",
     "CLASSIFIER_DENY_CAUSES": "advanced",
-    "CLASSIFIER_PARSE_FAILURE_DENY_MESSAGE": "advanced",
     "COARSE_SHELL_TOOLS": "stable",
     "CODE_AGENT_PROMPT": "advanced",
     "CODE_REVIEW_PROMPT": "advanced",
@@ -2644,6 +2658,7 @@
     "CheckpointToken": "stable",
     "CircuitBreakerOptions": "advanced",
     "ClassifierDenyCause": "advanced",
+    "ClassifierSeat": "internal",
     "CleanArmLeakFinding": "advanced",
     "CleanArmLeakVerdict": "advanced",
     "CleanMemoryIndexRow": "advanced",
@@ -3122,6 +3137,7 @@
     "MemoryNoteRecord": "stable",
     "MemoryNoteType": "advanced",
     "MemoryOriginCause": "advanced",
+    "MemoryProjectionError": "advanced",
     "MemoryPromptArtifactStore": "advanced",
     "MemoryPromptSourceStateStore": "advanced",
     "MemoryReadDetails": "advanced",
@@ -3456,6 +3472,7 @@
     "ReadOnlyCommandRow": "advanced",
     "ReadOnlyFlagArity": "advanced",
     "ReadOnlyShellVerdict": "advanced",
+    "ReadRootGrantCandidate": "advanced",
     "RealApprovalGateBit": "advanced",
     "ReasoningFormat": "advanced",
     "ReasoningIntensity": "advanced",
@@ -3911,6 +3928,7 @@
     "WORKFLOW_SUBAGENT_PROMPT": "advanced",
     "WORKFLOW_SUBAGENT_PROMPT_SCHEMA": "advanced",
     "WORKTREE_PARENT": "advanced",
+    "WRITE_EXEMPT_DIR_COVERS_ROOT_CODE": "advanced",
     "WRITE_PROTECTED_DEFAULT_TABLE": "advanced",
     "WebFetchConfig": "advanced",
     "WebSearchConfig": "advanced",
@@ -3973,7 +3991,11 @@
     "WriteProtectedHit": "advanced",
     "WriteProtectedKind": "advanced",
     "WriteProtectedRow": "advanced",
+    "WriteProtectionCheck": "advanced",
+    "WriteProtectionCompileOptions": "advanced",
+    "WriteProtectionJudgeContext": "advanced",
     "WriteProtectionMatcher": "advanced",
+    "WriteProtectionVerdict": "advanced",
     "WriteReceipt": "internal",
     "XARGS_READ_ONLY_TARGETS": "advanced",
     "ackAdoptionConfig": "advanced",
@@ -4054,6 +4076,7 @@
     "callKeyOrdinal": "advanced",
     "canAccessAgentRecord": "advanced",
     "canAccessWorkflowRun": "advanced",
+    "canonicalPathIsAuthoritative": "advanced",
     "canonicalPeerDisplayName": "advanced",
     "canonicalWorkflowName": "advanced",
     "capAggregateMediaBytes": "advanced",
@@ -4075,6 +4098,8 @@
     "checkpointVersionOf": "advanced",
     "clampHopChain": "advanced",
     "classifierMayAnswer": "advanced",
+    "classifierParseFailureDenyMessage": "advanced",
+    "classifierSeatModel": "internal",
     "classifierUnavailableDenyMessage": "advanced",
     "classifyCompoundReadonly": "advanced",
     "classifyCompoundReadonlyDetailed": "advanced",
@@ -4318,6 +4343,7 @@
     "isAutoModeClassifierFallback": "advanced",
     "isAutoModeDenySource": "advanced",
     "isAutoModeFallbackCause": "advanced",
+    "isAutoModeParseFailure": "advanced",
     "isAutoModeUnavailableCause": "advanced",
     "isCanonicalPeerAddress": "advanced",
     "isClassifierDenyCause": "advanced",
@@ -4703,7 +4729,7 @@
     "termSet": "stable",
     "terminalForTier": "advanced",
     "terminalProjection": "internal",
-    "thinkingOffExpressible": "advanced",
+    "thinkingOffSpelled": "advanced",
     "tightenTaskSpec": "stable",
     "toA2ATaskState": "advanced",
     "toolCallFaceOf": "advanced",