@sema-agent/core 7.19.0 → 7.20.1

package/dist/tools/fs/fs-bash.js

@@ -9,11 +9,11 @@ import { hasBackgroundShell } from "../../core/background-shell.js";
 import { delimitUntrusted } from "../../core/untrusted-text.js";
 import { MCP_IMAGE_MAX_BASE64 } from "../../core/mcp.js";
 import { imageMagicMatches, normalizeAbsPathLexically, withinAnyRoot } from "./safety.js";
-import { boundaryIsTheSandbox, hasDestroy, isIsolated } from "../../core/remote-env.js";
+import { boundaryIsTheSandbox, canonicalPathIsAuthoritative, hasDestroy, isIsolated } from "../../core/remote-env.js";
 import { ghRateLimitHint } from "./gh-rate-limit.js";
-import { resolveBashTimeoutCaps, bashTimeoutCapsSec, bashTimeoutArgRefusal, bashTimeoutParamDescription, envErrorDetail, bashMaxOutputChars, clipShellOutput, writeShellOverflowFile, createShellOverflowSpoolFence, shellRecoveryHint, CWD_SENTINEL, BASH_READONLY_CONFINEMENT_NOTE, } from "./fs-shared.js";
+import { resolveBashTimeoutCaps, bashTimeoutCapsSec, bashTimeoutArgRefusal, bashTimeoutParamDescription, envErrorDetail, bashMaxOutputChars, clipShellOutput, writeShellOverflowFile, createShellOverflowSpoolFence, shellRecoveryHint, CWD_SENTINEL, stripCwdSentinel, BASH_READONLY_CONFINEMENT_NOTE, } from "./fs-shared.js";
 import { PROBE_CAUSE_PATH_MAX, inlineUntrusted } from "../../core/untrusted-text.js";
-import { BASH_CLASSIFY_DEFAULT_ALLOW, BASH_READONLY_DEFAULT_ALLOW, coarseReadonlyCheck, classifyBoundedReadonlyPollLoopDetailed, classifyCompoundReadonlyDetailed, classifyOutOfRootReadGate, refusedCommandMayRead, classifySimpleCommandReadBoundary, NOT_AUTO_ALLOWED, } from "./bash-readonly-classifier.js";
+import { bashClassifyDefaultAllow, BASH_READONLY_DEFAULT_ALLOW, coarseReadonlyCheck, classifyBoundedReadonlyPollLoopDetailed, classifyCompoundReadonlyDetailed, classifyOutOfRootReadGate, refusedCommandMayRead, classifySimpleCommandReadBoundary, NOT_AUTO_ALLOWED, } from "./bash-readonly-classifier.js";
 import { toolFace } from "../../core/tool-catalog-entries.js";
 const RECURSIVE_CAUSE_MAX_PATHS = 3;
 const RECURSIVE_READ_CAUSE_CODE = "shell.recursive_read_unbounded";
@@ -25,7 +25,7 @@ function operandFamily(paths) {
     };
 }
 export function bashReversibilityProbe(allow, boundary) {
-    const allowSet = new Set(allow ?? BASH_CLASSIFY_DEFAULT_ALLOW);
+    const allowSet = new Set(allow ?? bashClassifyDefaultAllow());
     return (args) => {
         const command = shellCommandOf(args);
         if (command === undefined)
@@ -109,7 +109,7 @@ function recursiveReadCause(detailed) {
     };
 }
 export function bashReadBoundaryProbe(boundary) {
-    const allowSet = new Set(BASH_CLASSIFY_DEFAULT_ALLOW);
+    const allowSet = new Set(bashClassifyDefaultAllow());
     return (args) => {
         const command = shellCommandOf(args);
         if (command === undefined)
@@ -402,23 +402,6 @@ function createEpilogueFilter(marker) {
         return out + buf;
     };
 }
-function readCwdEpilogue(stderr, marker) {
-    let out = "";
-    let rest = stderr;
-    let cwd;
-    for (;;) {
-        const open = rest.indexOf(marker);
-        if (open === -1)
-            break;
-        const close = rest.indexOf(marker, open + marker.length);
-        if (close === -1)
-            break;
-        out += rest.slice(0, open);
-        cwd = rest.slice(open + marker.length, close);
-        rest = rest.slice(close + marker.length);
-    }
-    return { stderr: out + rest, cwd };
-}
 function describeSafely(sink, body) {
     if (sink === undefined)
         return;
@@ -582,7 +565,7 @@ async function runShell(env, cwd, toolName, command, timeoutSec, caps, signal, c
     let { stderr } = res.value;
     const { stdout, exitCode } = res.value;
     if (cwdRef) {
-        const epilogue = readCwdEpilogue(stderr, cwdMarker);
+        const epilogue = stripCwdSentinel(stderr, cwdMarker);
         stderr = epilogue.stderr;
         if (epilogue.cwd !== undefined) {
             const captured = epilogue.cwd.trim();
@@ -736,7 +719,7 @@ export function createBashTool(env, rootCanonical, coAuthor = false, cwdRef = {
     const bgRetained = hasBackgroundShell(env) && env.backgroundCapabilities.retainBackgroundProcesses === true;
     const bgSessionScoped = taskOpts.sessionId !== undefined && taskOpts.taskRegistry !== undefined;
     const bgEnvIsolatedOwned = hasDestroy(env) && isIsolated(env);
-    const recheckReaders = new Set(BASH_CLASSIFY_DEFAULT_ALLOW);
+    const recheckReaders = new Set(bashClassifyDefaultAllow());
     let canonicalForRoots;
     const canonicalBoundaryFor = (roots) => {
         const key = roots.join("\u0000");
@@ -1070,6 +1053,7 @@ function pathSegmentsFrom(p, from) {
 }
 function createCanonicalReadBoundary(env, readRoots) {
     const lexicalOnly = boundaryIsTheSandbox(env);
+    const resolverIsAuthoritative = canonicalPathIsAuthoritative(env);
     let rootsOnce;
     const canonicalRoots = async (signal) => {
         rootsOnce ??= (async () => {
@@ -1229,8 +1213,11 @@ function createCanonicalReadBoundary(env, readRoots) {
             let unresolvable;
             const judge = async (p) => {
                 const real = await resolve(p, signal);
-                if (real === undefined)
+                if (real === undefined) {
+                    if (resolverIsAuthoritative)
+                        unresolvable ??= `"${p}" cannot be resolved to verify where it reads`;
                     return;
+                }
                 if (!real.exact && real.missing !== true) {
                     unresolvable ??= `"${p}" cannot be resolved to verify where it reads`;
                     return;

package/dist/tools/fs/fs-shared.d.ts

@@ -361,6 +361,28 @@ export declare function shellRecoveryHint(path: string, readOnly: boolean | unde
  *  (NOT NotebookEdit — CC ships it without the trailer). */
 export declare const FILE_STATE_TRAILER = " (file state is current in your context \u2014 no need to Read it back)";
 export declare const CWD_SENTINEL = "__cc_cwd_9f2c1b__";
+/**
+ * Take the engine's own cwd epilogue out of a finished stderr, and report the working directory the
+ * command left behind (the payload of the LAST span).
+ *
+ * EVERY span, and the LAST one — not the first, and not just one. A command that turns on shell tracing
+ * produces more than one (the shell echoes the epilogue's own source, marker and all, before running
+ * it), and under a one-pair rule the FIRST pair was that echo, whose payload is the unexpanded
+ * `' "$(pwd)" '`; a `cd` that plainly worked was then dropped while the real record stayed in the stderr
+ * a person reads. An opener with no close is NOT ours to eat — the command's own text is left exactly
+ * as it arrived.
+ *
+ * TWO CALLERS, ONE RULE, which is why the marker is optional. The foreground result path KNOWS the
+ * marker it minted and passes it (exact, unambiguous). A backgrounded command's spool is assembled by a
+ * different lane entirely — the shell row outlives the run that launched it and never had the marker —
+ * so it passes none and the marker is recovered per span from the sentinel plus its hex suffix. Before
+ * this was shared, only the foreground path stripped, and the completion notification handed a person
+ * the raw internal marker with the directory inside it.
+ */
+export declare function stripCwdSentinel(stderr: string, marker?: string): {
+    stderr: string;
+    cwd: string | undefined;
+};
 /** Convert a model-supplied millisecond timeout to our internal seconds, clamped. Exported for the
  *  cc-parity unit (model sees ms, internal stays seconds — no ×1000 error).
  *  ⚠️ This returns the EFFECTIVE budget, not the request — capping at a call site destroys the

package/dist/tools/fs/fs-shared.js

@@ -247,6 +247,36 @@ export function shellRecoveryHint(path, readOnly) {
 }
 export const FILE_STATE_TRAILER = " (file state is current in your context — no need to Read it back)";
 export const CWD_SENTINEL = "__cc_cwd_9f2c1b__";
+const CWD_SENTINEL_SUFFIX_CHARS = 16;
+function cwdMarkerAt(text, open) {
+    const after = open + CWD_SENTINEL.length;
+    const suffix = /^[0-9a-f]{16}/.exec(text.slice(after, after + CWD_SENTINEL_SUFFIX_CHARS));
+    return suffix === null ? undefined : CWD_SENTINEL + suffix[0];
+}
+export function stripCwdSentinel(stderr, marker) {
+    let out = "";
+    let rest = stderr;
+    let cwd;
+    let from = 0;
+    for (;;) {
+        const open = rest.indexOf(marker ?? CWD_SENTINEL, from);
+        if (open === -1)
+            break;
+        const span = marker ?? cwdMarkerAt(rest, open);
+        if (span === undefined) {
+            from = open + CWD_SENTINEL.length;
+            continue;
+        }
+        const close = rest.indexOf(span, open + span.length);
+        if (close === -1)
+            break;
+        out += rest.slice(0, open);
+        cwd = rest.slice(open + span.length, close);
+        rest = rest.slice(close + span.length);
+        from = 0;
+    }
+    return { stderr: out + rest, cwd };
+}
 export function msTimeoutToSec(timeoutMs, caps = resolveBashTimeoutCaps()) {
     const { defaultSec, maxSec } = bashTimeoutCapsSec(caps);
     if (timeoutMs === undefined || !Number.isFinite(timeoutMs))

package/dist/tools/fs/index.d.ts

@@ -12,7 +12,7 @@ export * from "./bash-readonly-classifier.js";
 export * from "./fs-bash.js";
 export * from "./read-deny.js";
 import { type BashReadonlyRootBoundary } from "./bash-readonly-classifier.js";
-export { BASH_CLASSIFY_DEFAULT_ALLOW } from "./bash-readonly-classifier.js";
+export { BASH_CLASSIFY_EXTRA_ALLOW, bashClassifyDefaultAllow } from "./bash-readonly-classifier.js";
 import { type ReadDenyEntry } from "./read-deny.js";
 import { type ContainmentFace } from "./containment-face.js";
 export * from "./containment-face.js";

package/dist/tools/fs/index.js

@@ -12,7 +12,7 @@ export * from "./bash-readonly-classifier.js";
 export * from "./fs-bash.js";
 export * from "./read-deny.js";
 import { BASH_READONLY_DEFAULT_ALLOW, } from "./bash-readonly-classifier.js";
-export { BASH_CLASSIFY_DEFAULT_ALLOW } from "./bash-readonly-classifier.js";
+export { BASH_CLASSIFY_EXTRA_ALLOW, bashClassifyDefaultAllow } from "./bash-readonly-classifier.js";
 import { compileReadDeny } from "./read-deny.js";
 import { deploymentFaceClampNotice, resolveContainmentFace } from "./containment-face.js";
 export * from "./containment-face.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.19.0",
+  "version": "7.20.1",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",
@@ -84,6 +84,7 @@
     "gate:tool-names": "node scripts/verify-tool-name-tables.mjs",
     "gate:tool-docs": "node scripts/gen-tool-spec-fields.mjs --check",
     "gate:backlog-ledger": "node scripts/verify-backlog-ledger.mjs",
+    "gate:child-clamp-seats": "node scripts/verify-child-clamp-seats.mjs",
     "gate:docs-tool-names": "node scripts/verify-docs-tool-names.mjs",
     "gate:comment-ratio": "vitest run test/comment-ratio-ratchet.test.ts",
     "gate:negative-controls": "vitest run test/gate-negative-controls.test.ts",

package/test/export-surface.snapshot.json

@@ -1,7 +1,7 @@
 {
   "_comment": "design/87 L3 — frozen public export surface of src/index.ts (name -> kind). DO NOT edit by hand to silence a red test. A removed/changed entry = a SemVer-BREAKING change; bump MAJOR and update this fixture in the SAME commit (design/87 §4.2 / §5.2). Regenerate via REGEN in test/export-surface.test.ts.",
   "_tierComment": "#435 v1 — machine-readable layering of the public surface: stable = demonstrated by README.md / src/examples; internal = an `Internal`-marked name or a runner/engine deep-subtree declaration (the model seam src/engine/llm is excluded — it is the BYOM contract, not an engine internal); advanced = a supported export the front door does not walk you through. THIS IS AN INITIAL HEURISTIC, derived mechanically and expected to be refined ticket by ticket: no human reviewed these 1700+ entries one by one, and nothing here claims otherwise. Known bias: a short or English-word export name (ok, err, Result, Usage) can match ordinary prose in README.md and land `stable` on a coincidence. Every export MUST carry a tier — a new export with no row fails the gate in export-surface.test.ts.",
-  "count": 2378,
+  "count": 2389,
   "exports": {
     "A2ATaskState": "type",
     "A2ATaskStateReversal": "type",
@@ -270,6 +270,7 @@
     "CheckpointToken": "type",
     "CircuitBreakerOptions": "interface",
     "ClassifierDenyCause": "type",
+    "ClassifierSeat": "type",
     "CleanArmLeakFinding": "interface",
     "CleanArmLeakVerdict": "interface",
     "CleanMemoryIndexRow": "interface",
@@ -748,6 +749,7 @@
     "MemoryNoteRecord": "interface",
     "MemoryNoteType": "type",
     "MemoryOriginCause": "type",
+    "MemoryProjectionError": "class",
     "MemoryPromptArtifactStore": "class",
     "MemoryPromptSourceStateStore": "class",
     "MemoryReadDetails": "type",
@@ -1051,7 +1053,6 @@
     "REAL_APPROVAL_CHECKPOINT_VERSION": "variable",
     "REASONING_BUDGET_SHARE": "variable",
     "RECALL_CAVEAT": "variable",
-    "RECOMMENDED_SENSITIVE_ASK_PATTERNS": "variable",
     "RECOMMENDED_SENSITIVE_PATTERNS": "variable",
     "REMOTE_HARVEST_PER_FILE_BYTES": "variable",
     "REMOTE_MASS_DELETION_FUSE_RATIO": "variable",
@@ -1539,7 +1540,9 @@
     "WORKFLOW_SUBAGENT_PROMPT": "variable",
     "WORKFLOW_SUBAGENT_PROMPT_SCHEMA": "variable",
     "WORKTREE_PARENT": "variable",
+    "WRITE_EXEMPT_DIR_COVERS_ROOT_CODE": "variable",
     "WRITE_PROTECTED_DEFAULT_TABLE": "variable",
+    "WRITE_PROTECTION_TARGET_VIEWS": "variable",
     "WebFetchConfig": "interface",
     "WebSearchConfig": "interface",
     "Win32NamespaceRefusal": "type",
@@ -1601,7 +1604,13 @@
     "WriteProtectedHit": "interface",
     "WriteProtectedKind": "type",
     "WriteProtectedRow": "interface",
+    "WriteProtectionCheck": "type",
+    "WriteProtectionCompileOptions": "interface",
+    "WriteProtectionJudgeContext": "interface",
     "WriteProtectionMatcher": "interface",
+    "WriteProtectionMount": "interface",
+    "WriteProtectionTargetView": "type",
+    "WriteProtectionVerdict": "type",
     "WriteReceipt": "interface",
     "XARGS_READ_ONLY_TARGETS": "variable",
     "ackAdoptionConfig": "function",
@@ -1682,6 +1691,7 @@
     "callKeyOrdinal": "function",
     "canAccessAgentRecord": "function",
     "canAccessWorkflowRun": "function",
+    "canonicalPathIsAuthoritative": "function",
     "canonicalPeerDisplayName": "function",
     "canonicalWorkflowName": "function",
     "capAggregateMediaBytes": "function",
@@ -1704,6 +1714,7 @@
     "clampHopChain": "function",
     "classifierMayAnswer": "function",
     "classifierParseFailureDenyMessage": "function",
+    "classifierSeatModel": "function",
     "classifierUnavailableDenyMessage": "function",
     "classifyCompoundReadonly": "function",
     "classifyCompoundReadonlyDetailed": "function",
@@ -2650,6 +2661,7 @@
     "CheckpointToken": "stable",
     "CircuitBreakerOptions": "advanced",
     "ClassifierDenyCause": "advanced",
+    "ClassifierSeat": "internal",
     "CleanArmLeakFinding": "advanced",
     "CleanArmLeakVerdict": "advanced",
     "CleanMemoryIndexRow": "advanced",
@@ -3128,6 +3140,7 @@
     "MemoryNoteRecord": "stable",
     "MemoryNoteType": "advanced",
     "MemoryOriginCause": "advanced",
+    "MemoryProjectionError": "advanced",
     "MemoryPromptArtifactStore": "advanced",
     "MemoryPromptSourceStateStore": "advanced",
     "MemoryReadDetails": "advanced",
@@ -3431,7 +3444,6 @@
     "REAL_APPROVAL_CHECKPOINT_VERSION": "advanced",
     "REASONING_BUDGET_SHARE": "advanced",
     "RECALL_CAVEAT": "advanced",
-    "RECOMMENDED_SENSITIVE_ASK_PATTERNS": "advanced",
     "RECOMMENDED_SENSITIVE_PATTERNS": "advanced",
     "REMOTE_HARVEST_PER_FILE_BYTES": "advanced",
     "REMOTE_MASS_DELETION_FUSE_RATIO": "advanced",
@@ -3919,7 +3931,9 @@
     "WORKFLOW_SUBAGENT_PROMPT": "advanced",
     "WORKFLOW_SUBAGENT_PROMPT_SCHEMA": "advanced",
     "WORKTREE_PARENT": "advanced",
+    "WRITE_EXEMPT_DIR_COVERS_ROOT_CODE": "advanced",
     "WRITE_PROTECTED_DEFAULT_TABLE": "advanced",
+    "WRITE_PROTECTION_TARGET_VIEWS": "advanced",
     "WebFetchConfig": "advanced",
     "WebSearchConfig": "advanced",
     "Win32NamespaceRefusal": "advanced",
@@ -3981,7 +3995,13 @@
     "WriteProtectedHit": "advanced",
     "WriteProtectedKind": "advanced",
     "WriteProtectedRow": "advanced",
+    "WriteProtectionCheck": "advanced",
+    "WriteProtectionCompileOptions": "advanced",
+    "WriteProtectionJudgeContext": "advanced",
     "WriteProtectionMatcher": "advanced",
+    "WriteProtectionMount": "advanced",
+    "WriteProtectionTargetView": "advanced",
+    "WriteProtectionVerdict": "advanced",
     "WriteReceipt": "internal",
     "XARGS_READ_ONLY_TARGETS": "advanced",
     "ackAdoptionConfig": "advanced",
@@ -4062,6 +4082,7 @@
     "callKeyOrdinal": "advanced",
     "canAccessAgentRecord": "advanced",
     "canAccessWorkflowRun": "advanced",
+    "canonicalPathIsAuthoritative": "advanced",
     "canonicalPeerDisplayName": "advanced",
     "canonicalWorkflowName": "advanced",
     "capAggregateMediaBytes": "advanced",
@@ -4084,6 +4105,7 @@
     "clampHopChain": "advanced",
     "classifierMayAnswer": "advanced",
     "classifierParseFailureDenyMessage": "advanced",
+    "classifierSeatModel": "internal",
     "classifierUnavailableDenyMessage": "advanced",
     "classifyCompoundReadonly": "advanced",
     "classifyCompoundReadonlyDetailed": "advanced",