@sema-agent/core 7.19.0 → 7.20.0

package/dist/core/runner/turn-attachments.js

@@ -2,7 +2,8 @@ import { PRESENT_PLAN_TOOL_NAME } from "../present-plan-tool.js";
 import { delimitUntrustedWithClip, sanitizeUntrustedText, SHELLED_BODY_ENVELOPE_TAGS } from "../untrusted-text.js";
 import { protocolOf } from "../protocol-table.js";
 import { renderSkillLinesWithin, renderSkillsBlock } from "./synthetic-tools.js";
-import { SKILL_LISTING_DESC_MAX_CHARS_DEFAULT, SKILLS_BLOCK_MAX_BYTES } from "../skill-listing-budget.js";
+import { SKILL_LISTING_DEFAULT_BUDGET } from "../skill-listing-budget.js";
+import { foldListingWithin, foldRemovalArmWithin, removalArmFloor } from "./listing-fold.js";
 import { TOOL_SEARCH_NAME as TOOL_SEARCH_TOOL_NAME } from "./tool-disclosure.js";
 export const TODO_REMINDER_CONFIG = {
     TURNS_SINCE_WRITE: 10,
@@ -24,6 +25,33 @@ export const CHANGED_FILES_MTIME_EPS_MS = 2000;
 export const ATTACHMENT_BYTE_CAP = 8 * 1024;
 const PROJECTION_ITEMS_MAX = 50;
 const PROJECTION_CONTENT_MAX = 80;
+const LISTING_FRAME_FLOOR_BYTES = 768;
+const DATE_CHANGE_MAX_BYTES = 160;
+const WORKFLOW_SIZE_GUIDELINE_CHANGE_MAX_BYTES = 256;
+export const ATTACHMENT_DELIVERY_CLASS = {
+    todo_reminder: { class: "clippable" },
+    task_reminder: { class: "clippable" },
+    tool_search_usage_reminder: { class: "clippable" },
+    changed_files: { class: "clippable" },
+    plan_mode: { class: "clippable" },
+    budget_usd: { class: "clippable" },
+    total_tokens_reminder: { class: "clippable" },
+    background_tasks: { class: "clippable" },
+    tools_delta: { class: "intact", bound: (inp) => toolsDeltaBound(inp) },
+    agent_listing: { class: "intact", bound: (inp) => listingFrameBound(inp.listingBudget) + (inp.agentModels !== undefined ? Buffer.byteLength(modelsAvailableLine(inp.agentModels), "utf8") : 0) },
+    skills_listing: { class: "intact", bound: (inp) => listingFrameBound(inp.listingBudget) },
+    mcp_instructions: { class: "intact", bound: (inp) => mcpInstructionsBound(inp) },
+    mcp_dropped_tools: { class: "intact", bound: (inp) => mcpDroppedToolsBound(inp) },
+    date_change: { class: "intact", bound: () => DATE_CHANGE_MAX_BYTES },
+    instructions_change: { class: "intact", bound: () => INSTRUCTIONS_CHANGE_BYTE_CAP },
+    workflow_size_guideline_change: { class: "intact", bound: () => WORKFLOW_SIZE_GUIDELINE_CHANGE_MAX_BYTES },
+};
+export function isIntactSource(source) {
+    return ATTACHMENT_DELIVERY_CLASS[source].class === "intact";
+}
+function listingFrameBound(budget) {
+    return Math.max((budget ?? SKILL_LISTING_DEFAULT_BUDGET).blockMaxBytes, LISTING_FRAME_FLOOR_BYTES);
+}
 const ATTACHMENT_TAGS_DEFAULT = [...SHELLED_BODY_ENVELOPE_TAGS];
 const ATTACHMENT_TAGS_OWNED = {
     skills_listing: SHELLED_BODY_ENVELOPE_TAGS.filter((t) => t !== "skills"),
@@ -208,23 +236,15 @@ export function collectDueAttachments(state, inp) {
             (out ??= []).push({ source: "tools_delta", body });
     }
     const agentListingBody = inp.config.agentListing && inp.agentListing !== undefined
-        ? renderAgentListingDelta(state, inp.agentListing, inp.agentToolName ?? "Agent", inp.agentModels)
+        ? renderAgentListingDelta(state, inp.agentListing, inp.agentToolName ?? "Agent", inp.agentModels, inp.listingBudget)
         : undefined;
+    if (agentListingBody !== undefined)
+        (out ??= []).push({ source: "agent_listing", body: agentListingBody });
     const skillsListingBody = inp.config.skillsListing && inp.skillsListing !== undefined
-        ? renderSkillsListingDelta(state, inp.skillsListing, inp.skillsListingBudget)
+        ? renderSkillsListingDelta(state, inp.skillsListing, inp.listingBudget)
         : undefined;
-    const listingPair = [];
-    if (agentListingBody !== undefined)
-        listingPair.push({ source: "agent_listing", body: agentListingBody });
-    if (skillsListingBody !== undefined) {
-        const att = { source: "skills_listing", body: skillsListingBody };
-        if (state.skillsListingStarved === true)
-            listingPair.unshift(att);
-        else
-            listingPair.push(att);
-    }
-    for (const att of listingPair)
-        (out ??= []).push(att);
+    if (skillsListingBody !== undefined)
+        (out ??= []).push({ source: "skills_listing", body: skillsListingBody });
     if (inp.config.mcpInstructions && inp.mcpInstructions !== undefined) {
         const body = renderMcpInstructionsDelta(inp.mcpInstructions.added, inp.mcpInstructions.removed);
         if (body !== undefined)
@@ -244,9 +264,6 @@ export function collectDueAttachments(state, inp) {
     if (out === undefined)
         return EMPTY;
     const capped = capAttachments(out);
-    if (skillsListingBody !== undefined) {
-        state.skillsListingStarved = !capped.some((a) => a.source === "skills_listing" && a.body === skillsListingBody);
-    }
     if (pendingSurfaced !== undefined && capped.some((a) => a.source === "changed_files")) {
         for (const c of pendingSurfaced)
             state.surfacedMtime.set(c.path, c.mtimeMs);
@@ -434,15 +451,19 @@ export function renderToolsDelta(input) {
     const added = input.added ?? [];
     if (added.length > 0) {
         const swapped = input.staticFace === true ? (input.swappedUnderStatic ?? []).filter((n) => added.includes(n)) : [];
-        blocks.push((input.staticFace === true
-            ? "The following deferred tools are now active — call them directly. The tools list keeps compact " +
-                'placeholder entries, so re-run ToolSearch ("select:<name>") if you need a parameter schema:\n'
-            : "The following deferred tools are now available. Their full schemas are loaded — call them " +
-                "directly like any other tool:\n") +
-            added.map((n) => `- ${n}`).join("\n") +
-            (swapped.length > 0
-                ? `\nException: ${swapped.join(", ")} — too large to inline, so the full declaration is in the tools list instead.`
-                : ""));
+        const grouped = added.length > TOOLS_DELTA_LIST_MAX;
+        const exception = swapped.length > 0
+            ? grouped
+                ? `\nException: ${swapped.length} of them were too large to inline, so their full declarations are in the tools list instead.`
+                : `\nException: ${swapped.join(", ")} — too large to inline, so the full declaration is in the tools list instead.`
+            : "";
+        blocks.push((grouped ? `${added.length} deferred tools are now ${input.staticFace === true ? "active" : "available"}: ${groupByMcpServer(added)}. ` : "") +
+            (input.staticFace === true
+                ? (grouped ? "Call them directly. " : "The following deferred tools are now active — call them directly. ") +
+                    `The tools list keeps compact placeholder entries, so re-run ToolSearch ("select:<name>") if you need a parameter schema${grouped ? "." : ":\n"}`
+                : (grouped ? "" : "The following deferred tools are now available. ") + `Their full schemas are loaded — call them directly like any other tool${grouped ? "." : ":\n"}`) +
+            (grouped ? "" : added.map((n) => `- ${n}`).join("\n")) +
+            exception);
     }
     const readded = input.readded ?? [];
     if (readded.length > 0) {
@@ -530,22 +551,35 @@ function listingIdentity(name) {
 export function agentListingDeltaHeader(toolName) {
     return `New agent types are now available for the ${sanitizeUntrustedText(toolName, SHELLED_BODY_ENVELOPE_TAGS)} tool:`;
 }
-export function renderAgentListingDelta(state, entries, toolName, models) {
+export function renderAgentListingFrame(state, entries, toolName, models, budget = SKILL_LISTING_DEFAULT_BUDGET) {
     const safe = (t) => sanitizeUntrustedText(t, SHELLED_BODY_ENVELOPE_TAGS);
     const line = (e) => {
         const base = e.description ? `- ${safe(e.name)}: ${safe(e.description)}` : `- ${safe(e.name)}`;
         return `${base} (Tools: ${safe(e.tools ?? AGENT_TOOLS_NOTE_DEFAULT)})`;
     };
+    const bytes = (s) => Buffer.byteLength(s, "utf8");
+    const joiner = bytes(AGENT_DELTA_BLOCK_JOINER);
+    const fold = (items, header, maxBytes) => foldListingWithin(items, {
+        blockMaxBytes: maxBytes,
+        full: line,
+        nameOnly: (e) => `- ${safe(e.name)}`,
+        nameOf: (e) => e.name,
+        capMarker: AGENT_LISTING_CAP_MARKER,
+        overflowLine: (n) => `(… +${n} more agent types not listed)`,
+        frame: (lines) => [header, ...lines].join("\n"),
+    });
     const announced = state.announcedAgentTypes;
     if (announced === undefined) {
         if (entries.length === 0)
             return undefined;
-        const blocks = [`${agentListingInitialHeader(toolName)}\n${entries.map(line).join("\n")}`];
+        const tail = [];
         if (entries.length > 1)
-            blocks.push(AGENT_CONCURRENCY_NOTE);
+            tail.push(AGENT_CONCURRENCY_NOTE);
         if (models !== undefined && models.length > 0)
-            blocks.push(modelsAvailableLine(models));
-        return blocks.join("\n\n");
+            tail.push(modelsAvailableLine(models));
+        const tailCost = tail.reduce((acc, t) => acc + joiner + bytes(t), 0);
+        const roster = fold(entries, agentListingInitialHeader(toolName), budget.blockMaxBytes - tailCost);
+        return { text: [roster.text, ...tail].join(AGENT_DELTA_BLOCK_JOINER), nameOnly: roster.nameOnly, dropped: roster.dropped, listed: entries.length };
     }
     const announcedIds = new Set([...announced.keys()].map(listingIdentity));
     const entryIds = new Set(entries.map((e) => listingIdentity(e.name)));
@@ -557,17 +591,26 @@ export function renderAgentListingDelta(state, entries, toolName, models) {
             state.announcedModels.some((m, i) => listingIdentity(m) !== listingIdentity(models[i])));
     if (added.length === 0 && removed.length === 0 && !modelsDrifted)
         return undefined;
-    const blocks = [];
-    if (added.length > 0)
-        blocks.push(`${agentListingDeltaHeader(toolName)}\n${added.map(line).join("\n")}`);
+    const modelsLine = modelsDrifted ? modelsAvailableLine(models) : undefined;
+    const modelsCost = modelsLine !== undefined ? joiner + bytes(modelsLine) : 0;
+    const ambientCost = removed.length > 0 ? joiner + bytes(AMBIENT_CONTEXT_NOTE) : 0;
+    const removalReserve = removed.length > 0 ? joiner + bytes(removalArmFloor(AGENT_LISTING_REMOVED_HEADER, removed.length)) : 0;
+    const addArm = added.length > 0 ? fold(added, agentListingDeltaHeader(toolName), budget.blockMaxBytes - modelsCost - ambientCost - removalReserve) : undefined;
+    const addCost = addArm === undefined ? 0 : bytes(addArm.text) + joiner;
+    const blocks = addArm === undefined ? [] : [addArm.text];
     if (removed.length > 0) {
-        blocks.push(`${AGENT_LISTING_REMOVED_HEADER}\n${removed.map((n) => `- ${safe(n)}`).join("\n")}`);
+        blocks.push(foldRemovalArmWithin(removed, AGENT_LISTING_REMOVED_HEADER, budget.blockMaxBytes - modelsCost - ambientCost - addCost));
         blocks.push(AMBIENT_CONTEXT_NOTE);
     }
-    if (modelsDrifted)
-        blocks.push(modelsAvailableLine(models));
-    return blocks.join("\n\n");
+    if (modelsLine !== undefined)
+        blocks.push(modelsLine);
+    return { text: blocks.join(AGENT_DELTA_BLOCK_JOINER), nameOnly: addArm?.nameOnly ?? [], dropped: addArm?.dropped ?? [], listed: added.length };
+}
+export function renderAgentListingDelta(state, entries, toolName, models, budget) {
+    return renderAgentListingFrame(state, entries, toolName, models, budget)?.text;
 }
+const AGENT_LISTING_CAP_MARKER = "(listing budget reached — lower-priority agent types are listed name-only)";
+const AGENT_DELTA_BLOCK_JOINER = "\n\n";
 export const MODELS_AVAILABLE_PREFIX = "Models available for the 'model' parameter: ";
 function modelsAvailableLine(models) {
     const named = models.map((m) => sanitizeUntrustedText(m, SHELLED_BODY_ENVELOPE_TAGS));
@@ -597,28 +640,7 @@ export function commitAgentListing(state, entries, models) {
 export const SKILLS_LISTING_DELTA_HEADER = "New skills are now available:";
 export const SKILLS_LISTING_REMOVED_HEADER = "The following skills are no longer available:";
 const SKILLS_DELTA_BLOCK_JOINER = "\n\n";
-function skillsRemovalArmFloor(count) {
-    return [SKILLS_LISTING_REMOVED_HEADER, `(… +${count} more are no longer available)`].join("\n");
-}
-function renderSkillsRemovalArm(removed, maxBytes) {
-    const bytes = (s) => Buffer.byteLength(s, "utf8");
-    const lines = removed.map((n) => `- ${sanitizeUntrustedText(n, SHELLED_BODY_ENVELOPE_TAGS)}`);
-    const head = bytes(SKILLS_LISTING_REMOVED_HEADER);
-    const lineCost = (l) => bytes(l) + 1;
-    const prefix = new Array(lines.length + 1);
-    prefix[0] = 0;
-    for (let i = 0; i < lines.length; i++)
-        prefix[i + 1] = prefix[i] + lineCost(lines[i]);
-    if (head + prefix[lines.length] <= maxBytes)
-        return [SKILLS_LISTING_REMOVED_HEADER, ...lines].join("\n");
-    for (let m = lines.length - 1; m >= 0; m--) {
-        const tail = `(… +${lines.length - m} more are no longer available)`;
-        if (head + prefix[m] + lineCost(tail) <= maxBytes)
-            return [SKILLS_LISTING_REMOVED_HEADER, ...lines.slice(0, m), tail].join("\n");
-    }
-    return skillsRemovalArmFloor(lines.length);
-}
-export function renderSkillsListingFrame(state, entries, budget) {
+export function renderSkillsListingFrame(state, entries, budget = SKILL_LISTING_DEFAULT_BUDGET) {
     const announced = state.announcedSkills;
     if (announced === undefined) {
         if (entries.length === 0)
@@ -634,20 +656,20 @@ export function renderSkillsListingFrame(state, entries, budget) {
         return undefined;
     const bytes = (s) => Buffer.byteLength(s, "utf8");
     const joiner = bytes(SKILLS_DELTA_BLOCK_JOINER);
-    const frameMaxBytes = Math.min(budget?.blockMaxBytes ?? SKILLS_BLOCK_MAX_BYTES, SKILLS_BLOCK_MAX_BYTES);
+    const frameMaxBytes = budget.blockMaxBytes;
     const ambientCost = removed.length > 0 ? joiner + bytes(AMBIENT_CONTEXT_NOTE) : 0;
-    const removalReserve = removed.length > 0 ? joiner + bytes(skillsRemovalArmFloor(removed.length)) : 0;
+    const removalReserve = removed.length > 0 ? joiner + bytes(removalArmFloor(SKILLS_LISTING_REMOVED_HEADER, removed.length)) : 0;
     const addArm = added.length > 0
         ? renderSkillLinesWithin(added, {
             blockMaxBytes: frameMaxBytes - ambientCost - removalReserve,
-            descMaxChars: budget?.descMaxChars ?? SKILL_LISTING_DESC_MAX_CHARS_DEFAULT,
+            descMaxChars: budget.descMaxChars,
             frame: (lines) => [SKILLS_LISTING_DELTA_HEADER, ...lines].join("\n"),
         })
         : undefined;
     const addCost = addArm === undefined ? 0 : bytes(addArm.text) + (removed.length > 0 ? joiner : 0);
     const blocks = addArm === undefined ? [] : [addArm.text];
     if (removed.length > 0) {
-        blocks.push(renderSkillsRemovalArm(removed, frameMaxBytes - ambientCost - addCost), AMBIENT_CONTEXT_NOTE);
+        blocks.push(foldRemovalArmWithin(removed, SKILLS_LISTING_REMOVED_HEADER, frameMaxBytes - ambientCost - addCost), AMBIENT_CONTEXT_NOTE);
     }
     return {
         text: blocks.join(SKILLS_DELTA_BLOCK_JOINER),
@@ -703,6 +725,37 @@ export function selectMcpDroppedBatch(entries) {
     }
     return out;
 }
+const TOOLS_DELTA_FIXED_MAX_BYTES = 2048;
+function toolsDeltaBound(inp) {
+    const bytes = (s) => Buffer.byteLength(s, "utf8");
+    const list = (names) => (names.length > TOOLS_DELTA_LIST_MAX ? bytes(groupByMcpServer(names)) : names.reduce((acc, n) => acc + bytes(n) + 3, 0));
+    const swapped = (names) => names.reduce((acc, n) => acc + bytes(n) + 2, 0);
+    const mcp = inp.mcpToolsDelta;
+    return (TOOLS_DELTA_FIXED_MAX_BYTES +
+        list(inp.newTools ?? []) +
+        swapped(inp.newToolsSwappedUnderStatic ?? []) +
+        bytes(groupByMcpServer(mcp?.readded ?? [])) +
+        swapped(inp.readdedToolsSwappedUnderStatic ?? []) +
+        list(mcp?.removed ?? []) +
+        (mcp?.failedServers ?? []).slice(0, TOOLS_DELTA_LIST_MAX).reduce((acc, f) => acc + bytes(f.name) + bytes(f.error ?? "") + 8, 0));
+}
+const MCP_INSTRUCTIONS_FENCE_MAX_BYTES = 512;
+function mcpInstructionsBound(inp) {
+    const bytes = (s) => Buffer.byteLength(s, "utf8");
+    const m = inp.mcpInstructions;
+    if (m === undefined)
+        return 0;
+    return (512 +
+        m.added.reduce((acc, a) => acc + MCP_INSTRUCTIONS_MAX_CHARS * 4 + bytes(a.server) + MCP_INSTRUCTIONS_FENCE_MAX_BYTES, 0) +
+        m.removed.reduce((acc, n) => acc + bytes(n) + 1, 0));
+}
+const MCP_DROPPED_FIXED_MAX_BYTES = 1024;
+function mcpDroppedToolsBound(inp) {
+    const bytes = (s) => Buffer.byteLength(s, "utf8");
+    const first = inp.mcpDroppedTools?.[0];
+    const single = first === undefined ? 0 : MCP_DROPPED_FIXED_MAX_BYTES + bytes(first.tool) + bytes(first.server) + bytes(first.reason) + 32;
+    return Math.max(MCP_DROPPED_BATCH_MAX_BYTES, single);
+}
 const PLAN_MODE_FULL_BODY = `Plan mode is active. The user indicated that they do not want you to execute yet -- you MUST NOT make any edits, run any non-readonly tools (including changing configs or making commits), or otherwise make any changes to the system. This supercedes any other instructions you have received. Instead, you should: research and analyze with read-only tools, and when you have formed a concrete plan, present it with the ${PRESENT_PLAN_TOOL_NAME} tool for approval. That tool inherently requests plan approval — never ask for approval via plain text.`;
 const PLAN_MODE_SPARSE_BODY = `Plan mode still active (see full instructions earlier in conversation). Read-only: no edits, commits, or config changes. When your plan is ready, present it with the ${PRESENT_PLAN_TOOL_NAME} tool for approval. Never ask about plan approval via plain text.`;
 const TRUNCATION_MARKER = "\n…[truncated]";
@@ -710,12 +763,17 @@ const MIN_KEEP_BYTES = 160;
 function capAttachments(atts) {
     let total = 0;
     for (const a of atts)
-        total += Buffer.byteLength(a.body, "utf8");
+        if (!isIntactSource(a.source))
+            total += Buffer.byteLength(a.body, "utf8");
     if (total <= ATTACHMENT_BYTE_CAP)
         return atts;
     let budget = ATTACHMENT_BYTE_CAP;
     const out = [];
     for (const a of atts) {
+        if (isIntactSource(a.source)) {
+            out.push(a);
+            continue;
+        }
         const len = Buffer.byteLength(a.body, "utf8");
         if (len <= budget) {
             out.push(a);

package/dist/core/safe-notify.d.ts

@@ -56,6 +56,11 @@ export interface SafeNotifierOptions {
      */
     readonly onError?: (failure: SafeNotifyFailure) => void;
 }
+/** The sentence of a contained failure, for a consumer that puts it in front of a person. Total by the
+ *  same rule as {@link containedError}: an error object handed in from elsewhere (a `lastErrorAt`
+ *  reading, a rejection an adapter wrapped) may still carry a hostile `message`, and the disclosure a
+ *  site composes from it must not be the thing that faults. */
+export declare function safeErrorMessage(error: unknown): string;
 export interface SafeNotifier {
     /**
      * Run one host-callback invocation, containing any throw. Returns `true` when it completed, `false` when it

package/dist/core/safe-notify.js

@@ -1,9 +1,30 @@
+function containedError(thrown) {
+    try {
+        if (thrown instanceof Error && typeof thrown.message === "string")
+            return thrown;
+        return new Error(String(thrown));
+    }
+    catch {
+        return new Error(`a thrown value of type ${typeof thrown} that cannot be inspected or converted to text`);
+    }
+}
+export function safeErrorMessage(error) {
+    try {
+        const m = error?.message;
+        if (typeof m === "string")
+            return m;
+        return String(error);
+    }
+    catch {
+        return "a failure whose message could not be read";
+    }
+}
 export function createSafeNotifier(opts) {
     const onError = opts?.onError;
     let sites;
     let total = 0;
     const record = (site, thrown) => {
-        const error = thrown instanceof Error ? thrown : new Error(String(thrown));
+        const error = containedError(thrown);
         total += 1;
         if (sites === undefined)
             sites = new Map();
@@ -60,8 +81,9 @@ export function createSafeNotifier(opts) {
 export function observeThenableRejection(r, notifier, site) {
     if (typeof r?.then === "function") {
         r.then(undefined, (err) => {
+            const error = containedError(err);
             notifier.notify(() => {
-                throw err instanceof Error ? err : new Error(String(err));
+                throw error;
             }, site);
         });
     }

package/dist/core/sensitive-path-policy.d.ts

@@ -54,20 +54,13 @@ export declare function agentConfigDenyPatterns(): readonly string[];
  * hard refusal for every deployment that wires this list.
  *
  * SEVERITY LAYERING for the agent-configuration class: the law is {@link agentConfigDenyPatterns} —
- * configuration FILES here, the DIRECTORY one step down on {@link RECOMMENDED_SENSITIVE_ASK_PATTERNS}
- * (same judge, so the severity drops and the reach does not); a directory also holds the person's own
- * material, and the directory-wide entry turned an explicit instruction to edit `.claude/projects/…`
- * into a refusal nobody could lift (a deny outranks an ask under the fold).
+ * configuration FILES here, the DIRECTORY one step down on the always-on write-protection table
+ * (`WRITE_PROTECTED_DEFAULT_TABLE`'s `.claude` / `.sema` rows — the same reach, since that judge sees the
+ * real target too, {@link import("./write-protect.js").WriteProtectionMatcher.judge}); a directory also
+ * holds the person's own material, and a directory-wide DENY entry turned an explicit instruction to edit
+ * `.claude/projects/…` into a refusal nobody could lift (a deny outranks an ask under the fold).
  */
 export declare const RECOMMENDED_SENSITIVE_PATTERNS: readonly string[];
-/**
- * The ASK-severity half of the same guard: the agent-configuration DIRECTORIES, on the SAME judge
- * ({@link createSensitivePathPolicy}'s `askPatterns` seat, whose ABSENCE reads as this list) — only the
- * directories, since the configuration FILES inside them are deny material above. It lives HERE and not
- * only on `WRITE_PROTECTED_DEFAULT_TABLE`, which names the same segments but judges LEXICALLY: a
- * symlink with an innocent name walks past that one, so demoting to it alone trades severity for REACH.
- */
-export declare const RECOMMENDED_SENSITIVE_ASK_PATTERNS: readonly string[];
 /**
  * HRD-PRM-10 — the engine data root, read from the same knob its two consumers read
  * (`$AGENT_DATA_DIR ?? ~/.ai-agent`, off the HOST at wiring time, NFC-normalized) and returned in
@@ -85,16 +78,53 @@ export declare const RECOMMENDED_SENSITIVE_ASK_PATTERNS: readonly string[];
  */
 export declare function dataRootSpellings(explicit: string | undefined): string[];
 /**
- * Build a composable policy that judges writes (via the guarded fs tools) by their CANONICAL target,
- * at TWO severities from ONE judge. `patterns` is the DENY set — deployment-supplied, no default list
- * is shipped; `askPatterns` is the ASK set, judged the same way and consulted only where the deny set
- * misses, so a path on both denies. Both empty = a no-op allow.
+ * The data root's identity in the SAME namespace a judged key lives in: every declared spelling
+ * ({@link dataRootSpellings}) run through the SAME `canonicalizeTarget` that mints the target key. Not a
+ * second canonicalization — the same one, on the other operand, which is what lets
+ * {@link relativeUnderRoot}'s comparison be exact.
+ *
+ * Resolved PER CALL, deliberately not cached. A cached canonical root is a snapshot of the symlink
+ * topology at first use: with a data root reached through a symlink, retargeting it left the policy
+ * still exempting the OLD target for the life of the run. The module header already accepts paying
+ * `canonicalizeTarget` twice for a guarded write as the price of a decoupled gate; this is the same
+ * bargain on the other operand, and a request-scoped cache is the same note's answer if profiling
+ * ever asks for one. A spelling that cannot be resolved contributes NO exemption (the guard's side wins).
+ *
+ * ONE resolver for both write judges (the deny set here, the always-on table's target view) — an
+ * engine-internal seam, like the two neighbours above.
+ */
+export declare function canonicalDataRootKeys(env: ExecutionEnv, spellings: readonly string[], signal?: AbortSignal): Promise<string[]>;
+/**
+ * Is `targetKey` inside the data root `rootKey`, and if so what is its path relative to it? Returns
+ * the relative sub-path (`""` when the target IS the root), or `null` for everything else.
+ *
+ * 🔴 EXACT, and deliberately nothing else. Both operands are minted by the SAME canonicalizer, so
+ * every transformation this comparison could apply — a case fold, an NFC pass, splitting a foreign
+ * separator family, unioning several readings of the root — can only ADD matches. On the DENY side of
+ * this file that is the safe direction and several of those transforms are applied on purpose (a
+ * spelling filter is not a path filter). Here the direction inverts: this test grants an EXEMPTION, so
+ * an added match is not a wider guard, it is a bypass of one — each of case folding, an NFC pass and a
+ * foreign-family read was measured leaking an unrelated sibling into the exemption (their pins name the
+ * shapes). The rule: compare what the canonicalizer produced, byte for byte, every uncertainty falling
+ * to the deny side.
+ *
+ * The separator family comes from the ROOT key (a backslash is an ordinary filename character on
+ * POSIX, so a root `/x/.sema/data` must not swallow the sibling FILE `/x/.sema/data\evil`), and a root
+ * that reduces to nothing exempts nothing rather than exempting the filesystem.
  *
- * @contract sensitive_paths.two_severities_one_judge — ONE canonicalizing judge answers both
- * severities: a deny is a refusal no approver and no persisted allow rule can lift, an ask is one
- * explicit look that either of them may clear. Lowering a path's severity here never lowers its REACH
- * — both tiers see the real target (symlinks resolved, relative spellings resolved against the call's
- * live cwd), which the synchronous write-protection TABLE deliberately does not.
+ * Exported as an ENGINE-INTERNAL seam (not re-exported from `src/index.ts`), like {@link dataRootSpellings}:
+ * the always-on write-protection judge applies the same exemption on its target view, and a second
+ * containment test would be a second place for the two judges to disagree about what "inside" means.
+ */
+export declare function relativeUnderRoot(targetKey: string, rootKey: string): string | null;
+/**
+ * Build a composable policy that DENIES writes (via the guarded fs tools) whose CANONICAL target lands on
+ * a guarded pattern. `patterns` is deployment-supplied — no default list is shipped; empty = a no-op allow.
+ * A deny is a refusal no approver and no persisted allow rule can lift. The ASK severity of the same class
+ * (the agent-configuration DIRECTORIES) is not a tier here: it is the always-on write-protection table's,
+ * which judges the same real target ({@link import("./write-protect.js").WriteProtectionMatcher.judge} —
+ * its contract sentence `write_protection.judges_the_real_target` says the two differ in vocabulary and
+ * severity, never in reach).
  *
  * `env` is the same ExecutionEnv the hands run against (inject the one you pass to the Runner), so
  * canonicalization sees the task's real filesystem (a remote/E2B task resolves in its container).
@@ -104,17 +134,13 @@ export declare function dataRootSpellings(explicit: string | undefined): string[
  *
  * Fail-open by design: a tool with no string `path` returns `allow` here — this guard adds friction on
  * top of the other gates, it is not the only line of defense, and it must not turn an unrelated tool
- * call into a spurious verdict. The verdicts it owns are narrow and certain: "the real target IS a
- * guarded path → deny / ask". (A target it could not RESOLVE is the one fail-CLOSED arm, below.)
+ * call into a spurious verdict. The verdict it owns is narrow and certain: "the real target IS a
+ * guarded path → deny". (A target it could not RESOLVE is the one fail-CLOSED arm, below.)
  */
 export declare function createSensitivePathPolicy(opts: {
     env: ExecutionEnv;
     /** `readonly` accepted so {@link RECOMMENDED_SENSITIVE_PATTERNS} can be passed as-is (widening, non-breaking). */
     patterns: readonly string[];
-    /** The ASK-severity set, same syntax and same judge as `patterns`, consulted only where the deny set
-     *  misses. ABSENT ⇒ {@link RECOMMENDED_SENSITIVE_ASK_PATTERNS}, so a deployment already wiring this
-     *  guard keeps its reach over those directories without a code change; `[]` = no ask tier. */
-    askPatterns?: readonly string[];
     rootPath?: string;
     /**
      * HRD-PRM-10 — the engine data root this deployment runs on. Default

package/dist/core/sensitive-path-policy.js

@@ -50,7 +50,6 @@ export const RECOMMENDED_SENSITIVE_PATTERNS = [
     ".bash_history",
     ".zsh_history",
 ];
-export const RECOMMENDED_SENSITIVE_ASK_PATTERNS = [".claude", ".sema"];
 const CASE_INSENSITIVE_FS = process.platform === "darwin" || process.platform === "win32";
 export function dataRootSpellings(explicit) {
     const raw = explicit ?? process.env.AGENT_DATA_DIR ?? join(homedir(), ".ai-agent");
@@ -65,7 +64,20 @@ export function dataRootSpellings(explicit) {
     }
     return out;
 }
-function relativeUnderRoot(targetKey, rootKey) {
+export async function canonicalDataRootKeys(env, spellings, signal) {
+    const keys = [];
+    for (const spelling of spellings) {
+        try {
+            const r = await canonicalizeTarget(env, spelling, signal, pathFamilyOf({ root: spelling }));
+            if (r.ok && !keys.includes(r.key))
+                keys.push(r.key);
+        }
+        catch {
+        }
+    }
+    return keys;
+}
+export function relativeUnderRoot(targetKey, rootKey) {
     const seps = isWinFormPath(rootKey) ? ["\\", "/"] : ["/"];
     let root = rootKey;
     while (root.length > 0 && seps.includes(root[root.length - 1]))
@@ -96,25 +108,11 @@ function matchSensitive(canonicalKey, compiled, aliasResolved) {
 }
 export function createSensitivePathPolicy(opts) {
     const compiled = compilePatterns(opts.patterns);
-    const compiledAsk = compilePatterns(opts.askPatterns ?? RECOMMENDED_SENSITIVE_ASK_PATTERNS);
     const dataRootPaths = dataRootSpellings(opts.dataRoot);
-    const dataRootKeys = async (signal) => {
-        const keys = [];
-        for (const spelling of dataRootPaths) {
-            try {
-                const r = await canonicalizeTarget(opts.env, spelling, signal, pathFamilyOf({ root: spelling }));
-                if (r.ok && !keys.includes(r.key))
-                    keys.push(r.key);
-            }
-            catch {
-            }
-        }
-        return keys;
-    };
     const guardedByName = opts.tools !== undefined ? new Set(opts.tools) : undefined;
     return {
         async check(req, signal) {
-            if (compiled.length === 0 && compiledAsk.length === 0)
+            if (compiled.length === 0)
                 return { action: "allow" };
             if (guardedByName !== undefined ? !guardedByName.has(req.toolName) : !isProtectedWrite(req))
                 return { action: "allow" };
@@ -133,7 +131,7 @@ export function createSensitivePathPolicy(opts) {
                 };
             }
             let relative = null;
-            for (const rootKey of await dataRootKeys(signal)) {
+            for (const rootKey of await canonicalDataRootKeys(opts.env, dataRootPaths, signal)) {
                 relative = relativeUnderRoot(canon.key, rootKey);
                 if (relative !== null)
                     break;
@@ -149,14 +147,6 @@ export function createSensitivePathPolicy(opts) {
                     decisionReason: "safety",
                 };
             }
-            const askHit = matchSensitive(judged, compiledAsk, canon.aliasResolved === true);
-            if (askHit) {
-                return {
-                    action: "ask",
-                    message: `this write's real target resolves inside the guarded directory "${askHit}" — explicit approval required`,
-                    decisionReason: "safety",
-                };
-            }
             return { action: "allow" };
         },
     };