@sema-agent/core 7.21.1 → 7.23.0

package/dist/core/write-protect.d.ts

@@ -30,13 +30,26 @@ export interface WriteProtectedHit {
 }
 export declare const WRITE_PROTECTED_DEFAULT_TABLE: readonly WriteProtectedRow[];
 /**
- * The ONE case fold of this module, applied to BOTH sides of every comparison (table names at
- * compile, path segments at match) — `toLowerCase` plus the two confusable letters CC's fold maps
- * (U+0131 dotless ı → i, U+017F long ſ → s). Deliberately NOT full Unicode confusable folding:
- * that would be a different, wider claim than the one made (the read deny set's ASCII-contract doc
- * states the same boundary for its own fold).
+ * The ONE SEGMENT fold of this module, applied to BOTH sides of every comparison (table names at
+ * compile, path segments at match), in the reference implementation's own order:
+ *  · `toLowerCase` plus the two confusable letters its fold maps (U+0131 dotless ı → i, U+017F long ſ → s);
+ *  · the INVISIBLE FORMAT characters it strips — the zero-width joiners/non-joiners, the bidirectional
+ *    overrides and the byte-order mark (U+200C–U+200F, U+202A–U+202E, U+206A–U+206F, U+FEFF), verbatim.
+ *    A segment carrying one of these LOOKS like the row it is not, on both sides of every comparison, so
+ *    the strip is a deception axis rather than a platform one: it applies to every reading below, not to
+ *    the win32 one alone. It can only ADD matches, which on a TIGHTEN costs one extra question — and the
+ *    data-root passthrough, where an added match would be a guard BYPASSED, deliberately does not use this
+ *    fold at all (its comparison is byte-exact; see {@link relativeUnderDataRoot}).
+ *  · …and a strip that would EMPTY the segment keeps the segment instead (the reference fold's own `|| n`):
+ *    an all-invisible component names a real file, and folding it to "" would make it collide with nothing
+ *    or with everything depending on the caller.
+ * Deliberately NOT full Unicode confusable folding: that would be a different, wider claim than the one made
+ * (the read deny set's ASCII-contract doc states the same boundary for its own fold). The NTFS data-stream
+ * suffix the reference fold also strips is a win32 NAMESPACE fact, not a comparison one, and lives with the
+ * other component normalization of those views ({@link ComponentNormalization}) so a POSIX file legally
+ * named `a:b` keeps its own identity on the POSIX reading.
  */
-export declare function foldWriteProtectCase(s: string): string;
+export declare function foldWriteProtectSegment(s: string): string;
 /**
  * Resolve the ACTIVE table under the deployment seat (validated, loud — #123's bad-value states all
  * throw and name the knob). `undefined` = the default table; `[]` = NO table (an explicit, legal
@@ -47,15 +60,32 @@ export declare function foldWriteProtectCase(s: string): string;
  * candidate configuration with the engine's own rules.
  */
 export declare function resolveWriteProtectedTable(entries?: readonly WriteProtectedEntry[]): readonly WriteProtectedRow[];
+/**
+ * WHY the ENVIRONMENT half of one judgment could not contribute — the canonicalizer refused the spelling,
+ * a link the tree could not follow, a namespace spelling it declines, an environment call that threw.
+ * Reported through {@link WriteProtectionCompileOptions.onViewAbsent}; it is a DISCLOSURE, never a verdict
+ * (see the absence law on {@link WriteProtectionMatcher.judge}).
+ */
+export interface WriteProtectionViewAbsence {
+    /** The environment's own sentence, verbatim — what it said when asked to resolve this target. */
+    readonly cause: string;
+    /** The failure was specifically a symlink whose real target is unknowable, as opposed to a spelling the
+     *  tree refuses or a probe that errored. */
+    readonly unresolvedSymlink: boolean;
+}
 /**
  * The judge's answer for ONE covered write ({@link WriteProtectionMatcher.judge}):
- *  · `clear` — no row on either view: the write is not this layer's business;
+ *  · `clear` — no row on any view that could answer: the write is not this layer's business;
  *  · `hit` — a row matched; `via` says which view named it: `"spelling"` (the anchored spelling, no
  *    filesystem consulted), `"chain"` (a spelling the leaf symlink chain passes through, judged as a
  *    spelling) or `"target"` (the resolved real target, the spelling being innocent);
- *  · `unresolvable` — the real target could not be resolved (an unfollowable symlink, an errored probe, a
- *    namespace spelling the tree refuses); `cause` is the canonicalizer's own sentence and the consumer
- *    REFUSES, an unjudged target never being vouched.
+ *  · `unresolvable` — NO half of the judgment answered at all. The judge itself no longer mints this: an
+ *    environment that cannot resolve the target has ANSWERED, and an answer of "I cannot resolve this"
+ *    leaves the lexical half's judgment standing (the absence law below). What is left for this verdict is
+ *    the judgment that never happened — the gate's bounded wait elapsing or the task ending before
+ *    anything came back (`awaitWriteProtectionJudgment`, gate-bounded-await.ts) — where there is no
+ *    lexical answer to stand on either, and the consumer REFUSES. `unresolvedSymlink` is that minter's
+ *    `false`: a wait that produced nothing knows nothing about what it was waiting for.
  */
 export type WriteProtectionVerdict = {
     readonly kind: "clear";
@@ -115,8 +145,8 @@ export interface WriteProtectionMatcher {
      * @contract write_protection.judges_the_real_target — the always-on write-protection table and the
      * opt-in sensitive-path deny set differ in VOCABULARY (literal rows / segment globs) and SEVERITY
      * (ask / deny), never in REACH: both judge the file the tool will write — the spelling anchored at the
-     * live cwd AND its resolved real target, through one canonicalizer — and a target neither can resolve is
-     * refused, never vouched. An environment-less judge has no target view and answers by the spelling alone —
+     * live cwd AND its resolved real target, through one canonicalizer. Where they DO part: a target the write-protection
+     * judge cannot resolve leaves its resolved view ABSENT (the spelling still judges); the deny set still REFUSES whole. An environment-less judge has no target view and answers by the spelling alone —
      * the same absence law the cwd follows (absent ⇒ the spelling is judged exactly as given). REACH is what
      * this sentence promises, not a LOCK: the identity is resolved at judgment time and re-resolved by the
      * tool at execute time (the module header states that window and the seat that would close it).
@@ -136,6 +166,17 @@ export interface WriteProtectionCompileOptions {
      *  path-family source when the call carries no cwd. Omitted ⇒ relative spellings resolve against the
      *  cwd, then the environment's own working directory. */
     readonly rootPath?: string;
+    /**
+     * Called at most ONCE per judgment, at the moment the ENVIRONMENT half is found unable to contribute
+     * ({@link WriteProtectionViewAbsence}) — before the judgment returns, and on the hit arm as well as the
+     * clear one, because the fact is about the ENVIRONMENT rather than about the answer it did not change.
+     * Omitted ⇒ the absence is silent, which is the honest default for a judge compiled outside a leg.
+     * A throwing sink is the caller's bug and is not caught here; the leg that wires one wraps it.
+     *
+     * Deliberately carries no call identity: what it reports is a deployment-level fact (this environment
+     * cannot answer path questions), and its consumer announces once per leg rather than once per write.
+     */
+    readonly onViewAbsent?: (absence: WriteProtectionViewAbsence) => void;
 }
 /**
  * Compile the write-protection judge for a deployment configuration. Returns `undefined` when the
@@ -204,5 +245,16 @@ export interface WriteProtectionMount {
  * environment cannot RESOLVE is the judge's own `unresolvable` verdict, not this null.
  * Returns `undefined` when the resolved table is empty — nothing to judge, mount nothing.
  * `opts` are the judge's own seats, passed straight through ({@link compileWriteProtection}).
+ *
+ * @contract write_protection.membership_is_the_call — WHICH calls the always-on table judges is a
+ * PREDICATE OVER THE CALL and nothing else: the call's own face declares a path target whose access is not
+ * a read, so a custom writer joins this judge by DECLARING what it writes and a tool that declares nothing
+ * is not this layer's business under any name. There is deliberately NO name-list seat beside it, and the
+ * asymmetry with the opt-in deny policy — which does take one (`createSensitivePathPolicy({ tools })`, its
+ * own pre-declaration hatch) — is the intended shape rather than a gap: a name list on a default-ON floor
+ * is a way to narrow that floor silently, one tool name at a time, while the seat this layer gives a
+ * deployment for narrowing is the whole-table replacement, which says what it removes. A deployment that
+ * wants name-list membership composes the deny policy alongside; the two then answer under the shared
+ * `deny > ask > allow` fold, which is what makes the missing seat cost nothing.
  */
 export declare function createWriteProtectionCheck(entries?: readonly WriteProtectedEntry[], opts?: WriteProtectionCompileOptions): WriteProtectionMount | undefined;

package/dist/core/write-protect.js

@@ -57,8 +57,20 @@ export const WRITE_PROTECTED_DEFAULT_TABLE = freezeTable([
     { name: ".sema.json", kind: "basename" },
     { name: ".sema", kind: "segment" },
 ]);
-export function foldWriteProtectCase(s) {
-    return s.toLowerCase().replace(/ı/g, "i").replace(/ſ/g, "s");
+export function foldWriteProtectSegment(s) {
+    const cased = s.toLowerCase().replace(/ı/g, "i").replace(/ſ/g, "s");
+    return stripInvisibleFormat(cased) || cased;
+}
+function stripInvisibleFormat(s) {
+    return s.replace(/[\u200c-\u200f\u202a-\u202e\u206a-\u206f\ufeff]/g, "");
+}
+function stripWin32Component(raw, normalization) {
+    const base = normalization.invisibleFirst ? stripInvisibleFormat(raw) : raw;
+    const colon = normalization.stream ? base.indexOf(":") : -1;
+    return (colon < 0 ? base : base.slice(0, colon)).replace(/[. ]+$/, "");
+}
+function foldWriteProtectName(name) {
+    return name.split("/").map(foldWriteProtectSegment).join("/");
 }
 const KINDS = ["basename", "segment", "segment-run"];
 function describeEntryValue(v) {
@@ -107,7 +119,7 @@ export function resolveWriteProtectedTable(entries) {
     const seen = new Set();
     for (const entry of entries) {
         const row = normalizeWriteProtectedEntry(entry);
-        const key = `${row.kind}:${foldWriteProtectCase(row.name)}`;
+        const key = `${row.kind}:${foldWriteProtectName(row.name)}`;
         if (seen.has(key))
             continue;
         seen.add(key);
@@ -115,8 +127,9 @@ export function resolveWriteProtectedTable(entries) {
     }
     return freezeTable(out);
 }
-function pathViewSegments(path, win32, seps = BOTH_SEPARATOR_FAMILIES, anchorFloor = 0) {
+function pathViewSegments(path, normalization, seps = BOTH_SEPARATOR_FAMILIES, anchorFloor = 0) {
     const segs = [];
+    const win32 = normalization !== "literal";
     for (const raw of path.split(seps)) {
         if (raw.length === 0)
             continue;
@@ -131,11 +144,17 @@ function pathViewSegments(path, win32, seps = BOTH_SEPARATOR_FAMILIES, anchorFlo
                 segs.push("..");
             continue;
         }
-        const stripped = win32 ? raw.replace(/[. ]+$/, "") : raw;
+        const stripped = normalization === "literal" ? raw : stripWin32Component(raw, normalization);
         segs.push(stripped.length > 0 ? stripped : raw);
     }
     return segs;
 }
+const WIN32_NORMALIZATIONS = [
+    { invisibleFirst: false, stream: false },
+    { invisibleFirst: false, stream: true },
+    { invisibleFirst: true, stream: false },
+    { invisibleFirst: true, stream: true },
+];
 const BOTH_SEPARATOR_FAMILIES = /[\\/]/;
 const POSIX_SEPARATOR_FAMILY = /\//;
 function uncAnchorSegments(path) {
@@ -149,7 +168,7 @@ function relativeUnderDataRoot(path, roots) {
         if (root.win ? !isWinFormPath(path) : isWinFormPath(path) || !path.startsWith("/"))
             continue;
         const seps = root.win ? BOTH_SEPARATOR_FAMILIES : POSIX_SEPARATOR_FAMILY;
-        const segs = pathViewSegments(path, false, seps, uncAnchorSegments(path));
+        const segs = pathViewSegments(path, "literal", seps, uncAnchorSegments(path));
         if (segs.length < root.segments.length)
             continue;
         if (root.segments.every((s, i) => segs[i] === s))
@@ -165,13 +184,13 @@ export function compileWriteProtection(entries, opts) {
     const dataRootPaths = dataRootSpellings(opts?.dataRoot);
     const rootViews = dataRootPaths.map((r) => {
         const win = isWinFormPath(r);
-        return { win, segments: pathViewSegments(r, false, win ? BOTH_SEPARATOR_FAMILIES : POSIX_SEPARATOR_FAMILY, uncAnchorSegments(r)) };
+        return { win, segments: pathViewSegments(r, "literal", win ? BOTH_SEPARATOR_FAMILIES : POSIX_SEPARATOR_FAMILY, uncAnchorSegments(r)) };
     });
     const basenames = new Map();
     const segments = new Map();
     const runs = [];
     for (const row of rows) {
-        const folded = foldWriteProtectCase(row.name);
+        const folded = foldWriteProtectName(row.name);
         if (row.kind === "basename") {
             if (!basenames.has(folded))
                 basenames.set(folded, row.name);
@@ -187,7 +206,7 @@ export function compileWriteProtection(entries, opts) {
     const judgeSegments = (raw) => {
         if (raw.length === 0)
             return null;
-        const segs = raw.map(foldWriteProtectCase);
+        const segs = raw.map(foldWriteProtectSegment);
         const base = basenames.get(segs[segs.length - 1] ?? "");
         if (base !== undefined)
             return { name: base, kind: "basename" };
@@ -205,9 +224,20 @@ export function compileWriteProtection(entries, opts) {
         }
         return null;
     };
-    const judgeViews = (spelling) => judgeSegments(pathViewSegments(spelling, false, POSIX_SEPARATOR_FAMILY, uncAnchorSegments(spelling))) ??
-        judgeSegments(pathViewSegments(spelling, false)) ??
-        judgeSegments(pathViewSegments(spelling, true));
+    const judgeViews = (spelling) => {
+        const posix = judgeSegments(pathViewSegments(spelling, "literal", POSIX_SEPARATOR_FAMILY, uncAnchorSegments(spelling)));
+        if (posix !== null)
+            return posix;
+        const bothSeparators = judgeSegments(pathViewSegments(spelling, "literal"));
+        if (bothSeparators !== null)
+            return bothSeparators;
+        for (const normalization of WIN32_NORMALIZATIONS) {
+            const hit = judgeSegments(pathViewSegments(spelling, normalization));
+            if (hit !== null)
+                return hit;
+        }
+        return null;
+    };
     const judgeSpelled = (spelled) => judgeViews(relativeUnderDataRoot(spelled, rootViews) ?? spelled);
     const judgeSpelling = (path, cwd) => {
         const base = typeof cwd === "string" && cwd.length > 0 ? cwd : undefined;
@@ -231,31 +261,55 @@ export function compileWriteProtection(entries, opts) {
                 return { kind: "clear" };
             const family = pathFamilyOf({ root: rootPath, cwd: ctx.cwd ?? env.cwd });
             const base = ctx.base ?? ctx.cwd ?? rootPath;
-            const canon = await canonicalizeTarget(env, path, ctx.signal, family, base);
-            if (!canon.ok)
-                return { kind: "unresolvable", cause: canon.message, unresolvedSymlink: canon.unresolvedSymlink === true };
-            const byTarget = judgeViews(canon.key);
-            if (byTarget !== null) {
-                for (const rootKey of await canonicalDataRootKeys(env, dataRootPaths, ctx.signal)) {
-                    const relative = relativeUnderRoot(canon.key, rootKey);
-                    if (relative === null)
+            let noted = false;
+            const noteAbsence = (cause, unresolvedSymlink) => {
+                if (noted)
+                    return;
+                noted = true;
+                opts?.onViewAbsent?.({ cause, unresolvedSymlink });
+            };
+            let canonKey;
+            try {
+                const canon = await canonicalizeTarget(env, path, ctx.signal, family, base);
+                if (canon.ok)
+                    canonKey = canon.key;
+                else
+                    noteAbsence(canon.message, canon.unresolvedSymlink === true);
+            }
+            catch (err) {
+                noteAbsence(err instanceof Error ? err.message : String(err), false);
+            }
+            try {
+                if (canonKey !== undefined) {
+                    const byTarget = judgeViews(canonKey);
+                    if (byTarget !== null) {
+                        for (const rootKey of await canonicalDataRootKeys(env, dataRootPaths, ctx.signal)) {
+                            const relative = relativeUnderRoot(canonKey, rootKey);
+                            if (relative === null)
+                                continue;
+                            if (relative === "")
+                                return { kind: "clear" };
+                            const remainder = judgeViews(relative);
+                            return remainder === null ? { kind: "clear" } : { kind: "hit", hit: remainder, via: "target" };
+                        }
+                        return { kind: "hit", hit: byTarget, via: "target" };
+                    }
+                }
+                for (const hop of await symlinkChainHops(env, path, ctx.signal, family, base, (cause) => noteAbsence(cause, false))) {
+                    const byHop = judgeSpelled(hop);
+                    if (byHop === null)
                         continue;
-                    if (relative === "")
-                        return { kind: "clear" };
-                    const remainder = judgeViews(relative);
-                    return remainder === null ? { kind: "clear" } : { kind: "hit", hit: remainder, via: "target" };
+                    if (canonKey !== undefined) {
+                        for (const rootKey of await canonicalDataRootKeys(env, dataRootPaths, ctx.signal)) {
+                            if (relativeUnderRoot(canonKey, rootKey) !== null)
+                                return { kind: "clear" };
+                        }
+                    }
+                    return { kind: "hit", hit: byHop, via: "chain" };
                 }
-                return { kind: "hit", hit: byTarget, via: "target" };
             }
-            for (const hop of await symlinkChainHops(env, path, ctx.signal, family, base)) {
-                const byHop = judgeSpelled(hop);
-                if (byHop === null)
-                    continue;
-                for (const rootKey of await canonicalDataRootKeys(env, dataRootPaths, ctx.signal)) {
-                    if (relativeUnderRoot(canon.key, rootKey) !== null)
-                        return { kind: "clear" };
-                }
-                return { kind: "hit", hit: byHop, via: "chain" };
+            catch (err) {
+                noteAbsence(err instanceof Error ? err.message : String(err), false);
             }
             return { kind: "clear" };
         },

package/dist/engine/execution-env/node-execution-env.d.ts

@@ -7,6 +7,21 @@ import type { SchedulerCapability, ScheduledIntent, SchedulerContext, ScheduledT
 import { SchedulerError } from "../../core/scheduler.js";
 /** Convert user-facing timeout seconds into a positive, timer-safe millisecond delay. */
 export declare function resolveExecTimeoutMs(timeoutSeconds: unknown): number | undefined;
+/**
+ * Anchor a RELATIVE symlink target at its link's own directory, UNFOLDED and with exactly one separator
+ * between the two. A directory that IS a root already ends in its own separator (`/`, `C:\`, `C:/`,
+ * `\\host\share\`, all of which `dirname` answers that way), and concatenating a second one mints a
+ * DOUBLE-separator spelling for a path that has one spelling — `/tmp -> private/tmp` came back as
+ * `//private/tmp`, which the judges that walk this chain then match against nothing, because a guarded row
+ * and a containment root are both written with single separators. Joining through `path.resolve`/`path.join`
+ * would fix the separator and fold `..` with it, which is the one thing this walk may not do.
+ *
+ * `separator` is the one the caller's `dirname` writes, passed rather than read from the module so the rule
+ * is a pure function of its inputs. A backslash counts as a terminator only where it IS a separator: on a
+ * POSIX tree a directory whose name ends in one (`/a/b\`) is an ordinary name, and reading it as terminated
+ * would rename `/a/b\/t` to `/a/b\t` — the same class of rewrite as folding `..` lexically.
+ */
+export declare function anchorAtLinkDir(linkDir: string, target: string, separator: string): string;
 /** review finding (win32): `where bash.exe` can resolve to `System32\bash.exe` — the
  *  WSL LAUNCHER, not a native shell. Running it drops into a Linux subsystem where Windows cwd/paths
  *  do not exist; silently adopting it is exactly the "wrong shell, false green" failure D1 forbids.
@@ -171,8 +186,10 @@ export declare class NodeExecutionEnv implements ExecutionEnv, BackgroundShellCa
      * target, until a hop is not a link (`EINVAL`), is absent (`ENOENT` / `ENOTDIR`), repeats, or the bound is
      * reached. A relative target is ANCHORED at its link's directory and never folded — `..` is the filesystem's
      * to resolve during the next `readlink`'s own lookup (a lexical fold reads `bridge/../next` as `next` and misses
-     * every link behind `bridge`). One syscall per hop, no `lstat`. On a win32 host a share-shaped hop is kept and
-     * ends the walk unprobed. Any other errno is an answer nobody can use (`err`), never a shortened chain.
+     * every link behind `bridge`). Anchoring puts EXACTLY ONE separator between the directory and the target
+     * ({@link anchorAtLinkDir}); a root directory already ends in its own. One syscall per hop, no `lstat`. On a
+     * win32 host a share-shaped hop is kept and ends the walk unprobed. Any other errno is an answer nobody can
+     * use (`err`), never a shortened chain.
      */
     canonicalChain(path: string): Promise<Result<SymlinkChain, FileError>>;
     exists(path: string): Promise<Result<boolean, FileError>>;

package/dist/engine/execution-env/node-execution-env.js

@@ -42,6 +42,10 @@ function fileKindFromStats(stats) {
     return undefined;
 }
 const HAS_POSIX_MODE_FACE = process.platform !== "win32";
+export function anchorAtLinkDir(linkDir, target, separator) {
+    const endsInSeparator = linkDir.endsWith(separator) || (separator === "\\" && linkDir.endsWith("/"));
+    return endsInSeparator ? `${linkDir}${target}` : `${linkDir}${separator}${target}`;
+}
 const SYMLINK_CHAIN_HOP_BOUND = 64;
 function fileInfoFromStats(path, stats) {
     const kind = fileKindFromStats(stats);
@@ -1043,7 +1047,7 @@ export class NodeExecutionEnv {
                     return ok({ hops });
                 return err(toFileError(error, cur));
             }
-            const next = isAbsolute(target) ? target : `${dirname(cur)}${sep}${target}`;
+            const next = isAbsolute(target) ? target : anchorAtLinkDir(dirname(cur), target, sep);
             if (seen.has(next))
                 break;
             hops.push(next);

package/dist/index.d.ts

@@ -57,7 +57,7 @@ export { assertOracleIsolation, type GraderEnv, type OracleIsolationVerdict, typ
 export { decideAutoPromote, deriveTripwire, FROZEN_DENYLIST_FLOOR, type AutoPromoteTerminal, type AutoPromoteInputs, type PromotedRecord, type TripwireResult, } from "./core/auto-promote.js";
 export { runCascade, type CascadeRung, type CascadeConfig, type CascadeAttempt, type CascadeRunResult, type GateVerdict, } from "./agents/cascade.js";
 export { pgQuery, mysqlQuery, sqliteQuery } from "./tools/sql-adapters.js";
-export { materializeMcpTools, MCP_PREFIX, type MaterializedMcp, type McpServerStatus, type McpRefreshResult } from "./core/mcp.js";
+export { materializeMcpTools, MCP_PREFIX, type MaterializedMcp, type McpServerStatus, type McpRefreshResult, type McpReconnectResult } from "./core/mcp.js";
 export { MCP_FAILURE_KINDS, MCP_DELIVERY_VERDICTS, classifyMcpFailure, type McpFailure, type McpFailureKind, type McpDelivered } from "./core/mcp-failure.js";
 export { MCP_INJECTION_DROP_REASONS, MCP_INJECTION_DROP_TEXT, mcpInjectionDroppedNotice, type McpInjectionDropReason, type McpInjectionDropFacts } from "./core/mcp-injection-drop.js";
 export { askUnresolvableNotice, type AskUnresolvableFacts } from "./core/ask-unresolvable-notice.js";
@@ -70,7 +70,7 @@ export { createSessionRulePolicy } from "./core/runner/session-rule-policy.js";
 export { LOCKED_KEY_REGISTRY, resolveLockedKeys, type LockedKey, type LockedConfig } from "./core/locked-config.js";
 export { BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, WEB_FETCH_TOOL_NAME, complianceCallDenial, resolveComplianceDenies, type ComplianceCapability, type CompliancePosture, type ComplianceProfile, } from "./core/compliance.js";
 export { admitMemoryScopes, foldAdmissionFreeze, type OwnOrgAdmissionVerdict, type MemoryAdmissionInput, type MemoryAdmissionOutcome, type MemoryAdmissionVerdict, type MemoryScopeAdmission, type MemoryScopeOrigin, type MemoryScopeRequest, } from "./core/memory-admission.js";
-export { assertRetentionCapability, type ManagedRetentionCapability, type RetentionDeclaration, type RetentionDeclaring, type RetentionPolicy, type RetentionReceipt, } from "./core/retention.js";
+export { assertRetentionCapability, RETENTION_CASCADE_DOMAINS, RETENTION_CASCADE_EXEMPT, type ManagedRetentionCapability, type RetentionDeclaration, type RetentionDeclaring, type RetentionPolicy, type RetentionReceipt, } from "./core/retention.js";
 export { GOVERNANCE_CODES, governanceRetryClass, type GovernanceCode, type GovernanceRetryClass } from "./core/governance-codes.js";
 export { NOTICE_AUDIENCE, noticeAudienceOf, ENGINE_NOTICE_CODES, type EngineNoticeCode, type NoticeAudience } from "./core/governance-codes.js";
 export { TtlSessionStore, type TtlSessionStoreOptions, type EvictPolicy } from "./core/session-store.js";
@@ -105,7 +105,7 @@ export { classifyCompoundReadonlyDetailed, formatOutOfRootReadApprovalOption, ty
 export { resolveBashTimeoutCaps } from "./tools/fs/index.js";
 export { READ_FACE_DEFAULT_DENY_ENTRIES, READ_FACE_BUILTIN_DENY_TABLE, READ_DENY_BUILTIN_TIERS, READ_DENY_DEFAULT_TIERS, resolveReadDenyBuiltins, compileReadDeny, type ReadDenyEntry, type ReadDenyMatcher, type NormalizedReadDenyEntry, type ReadDenyBuiltinTier, type ReadDenyBuiltinRow, type ReadDenyBuiltinConfig, } from "./tools/fs/index.js";
 export { deploymentFaceClampNotice, resolveContainmentFace, type ContainmentFace, type ContainmentFaceInputs, type ContainmentFaceKind, type ContainmentFaceLayer, } from "./tools/fs/index.js";
-export { WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable, compileWriteProtection, type WriteProtectedEntry, type WriteProtectedRow, type WriteProtectedKind, type WriteProtectedHit, type WriteProtectionMatcher, type WriteProtectionVerdict, type WriteProtectionJudgeContext, type WriteProtectionCompileOptions, type WriteProtectionCheck, WRITE_PROTECTION_TARGET_VIEWS, type WriteProtectionTargetView, type WriteProtectionMount, } from "./core/write-protect.js";
+export { WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable, compileWriteProtection, type WriteProtectedEntry, type WriteProtectedRow, type WriteProtectedKind, type WriteProtectedHit, type WriteProtectionMatcher, type WriteProtectionVerdict, type WriteProtectionViewAbsence, type WriteProtectionJudgeContext, type WriteProtectionCompileOptions, type WriteProtectionCheck, WRITE_PROTECTION_TARGET_VIEWS, type WriteProtectionTargetView, type WriteProtectionMount, } from "./core/write-protect.js";
 export { InMemoryToolResultStore, OFFLOAD_TOOL_NAME, DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, assertSafeToolResultRef, buildToolResultRef, toolResultContentSegment, MAX_MINTED_TOOL_RESULT_REF_CHARS, type ToolResultProvenance, assertToolResultProvenanceMatch, normalizeToolResultProvenance, toolResultProvenanceOf, ToolResultRefConflictError, TOOL_RESULT_REF_CONFLICT_CODE, type ToolResultStore, type ToolResultSlice, type ToolResultDeletionReport, } from "./core/tool-result-store.js";
 export { InMemoryCheckpointStore, CheckpointError, mintCheckpointId, mintCheckpointToken, checkpointVersionOf, CURRENT_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, ORG_ADMISSION_CHECKPOINT_VERSION, F012_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, debitLedger, remainingBudgetMicroUsd, remainingTokens, winnerFromOutcome, validatePendingSteer, readPendingSteerQueue, appendPendingSteer, MAX_PENDING_STEER_CHARS, MAX_PENDING_STEER_ENTRIES, PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES, PENDING_STEER_FROZEN_FIELDS, ACTOR_ASSERTION_FROZEN_FIELDS, MAX_ACTOR_FIELD_CHARS, MAX_STEER_INPUT_ID_CHARS, type ActorAssertion, type PendingSteerEntry, type PendingSteerInput, riskSeverity, buildRiskDescriptor, summarizeCheckpoint, type RiskDescriptor, type ProbeCause, type ProbeCauseOperands, type CheckpointStore, type CheckpointSummary, type Checkpoint, type CheckpointToken, type CheckpointGate, type CheckpointState, type SerializedCheckpointState, type CheckpointFaultMode, type PendingAction, type ResumeOutcome, type ResolvedOutcome, type ReopenReason, type ResolveExpectation, type TerminalClaimIntent, type TerminalClaimOutcome, type SafetyAxis, type RealApprovalGateBit, type ResourceLedger, type ResourceLimitReason, type PlatformLimitReason, type CheckpointRow, realApprovalOrgFact, resolveCheckpointStore, checkpointStoreExecutionUndeclared, } from "./core/checkpoint-store.js";
 export { EXECUTION_OUTCOME_RECORD_WORDS, EXECUTION_RECORD_LEAVES_ROW_UNRECORDED, type ExecutionOutcomeRecordWord, type ExecutionRecordRowFacts, type ExecutionVerdict, ExecutionOutcomeConflictError, checkpointExecutionRecorded, executionRecordDisposition, sameExecutionRecord, executionVerdict, } from "./core/checkpoint-execution-record.js";
@@ -225,7 +225,8 @@ export { termSet, jaccardDistance, cosineDistance } from "./core/memory-vector.j
 export { encodeSurfacedKey, buildManifestText, validateSelectedIds, composeSelectiveBody, formatMemoryAge, resolveLinkedIds, RECALL_CAVEAT, DEFAULT_MAX_SELECTED, DEFAULT_MAX_LINKED, type MemorySelector, type MemorySelectRequest, type SelectiveRecallOptions, type SelectiveRecallResult, type LayeredRecallOptions, type LayeredRecallResult, } from "./core/memory-recall.js";
 export { runMemoryConsolidation, CONSOLIDATION_SYSTEM_PROMPT, DEFAULT_CONSOLIDATION_BAND, DEFAULT_CONSOLIDATION_SEARCH_LIMIT, DEFAULT_CONSOLIDATION_MAX_NOTES, normalizeForExactMatch, type ConsolidationParams, type ConsolidationStats, type ConsolidationNote, type ConsolidationLLM, } from "./core/runner/memory-consolidation.js";
 export { consolidateScope, advanceCursorAfterInline, type ConsolidateScopeDeps, type ConsolidateScopeOptions, } from "./core/consolidate-scope.js";
-export { resolveMemoryConsolidationDriver, type MemoryConsolidationDriverDeps, } from "./core/runner/memory-consolidation-driver.js";
+export { resolveMemoryConsolidationDriver, autoRunOnRecommendationEffective, // the ONE arming reading (`memory.auto_consolidation.arming_has_one_resolver`) — the seat's absence is not "off"
+type MemoryConsolidationDriverDeps, } from "./core/runner/memory-consolidation-driver.js";
 export { DEFAULT_COMPACTION_INSTRUCTIONS } from "./core/auto-compaction.js";
 export { DEFAULT_SYSTEM_PROMPT, CODE_AGENT_PROMPT, SUBAGENT_PROMPT, CODE_SYSTEM_PROMPT, MEMORY_GUIDANCE, MEMORY_SAFETY, MEMORY_HYGIENE, NO_PERSISTENT_MEMORY_NOTICE, OUTPUT_EFFICIENCY, CYBER_RISK, HARNESS_SECTION_ANCHOR, URL_SAFETY, SUMMARIZE_TOOL_RESULTS, EXECUTION_ENVIRONMENT, EXECUTION_ENVIRONMENT_OPEN_READS, executionEnvironmentBlockFor, harnessContext, buildEnvironmentContext, buildGitSnapshot, buildScratchpadSection, GIT_STATUS_MAX_CHARS, formatLocalDate, type EnvironmentFacts, defaultPromptProvider, composeSystemPrompt, composeConstitution, constitutionBlocks, type PromptBlock, analyzePromptCacheFriendliness, assertPromptCacheFriendly, type PromptProvider, type StablePromptContext, type PromptCacheReport, type PromptTextDeclaration, } from "./prompts/default.js";
 export { SUPERVISOR_PROMPT, ORCHESTRATION_GUIDANCE, ORCHESTRATION_AWARENESS, GOAL_COMPLETION_GUIDANCE } from "./prompts/supervisor.js";

package/dist/index.js

@@ -56,7 +56,7 @@ export { createSessionRulePolicy } from "./core/runner/session-rule-policy.js";
 export { LOCKED_KEY_REGISTRY, resolveLockedKeys } from "./core/locked-config.js";
 export { BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, WEB_FETCH_TOOL_NAME, complianceCallDenial, resolveComplianceDenies, } from "./core/compliance.js";
 export { admitMemoryScopes, foldAdmissionFreeze, } from "./core/memory-admission.js";
-export { assertRetentionCapability, } from "./core/retention.js";
+export { assertRetentionCapability, RETENTION_CASCADE_DOMAINS, RETENTION_CASCADE_EXEMPT, } from "./core/retention.js";
 export { GOVERNANCE_CODES, governanceRetryClass } from "./core/governance-codes.js";
 export { NOTICE_AUDIENCE, noticeAudienceOf, ENGINE_NOTICE_CODES } from "./core/governance-codes.js";
 export { TtlSessionStore } from "./core/session-store.js";
@@ -183,7 +183,7 @@ export { termSet, jaccardDistance, cosineDistance } from "./core/memory-vector.j
 export { encodeSurfacedKey, buildManifestText, validateSelectedIds, composeSelectiveBody, formatMemoryAge, resolveLinkedIds, RECALL_CAVEAT, DEFAULT_MAX_SELECTED, DEFAULT_MAX_LINKED, } from "./core/memory-recall.js";
 export { runMemoryConsolidation, CONSOLIDATION_SYSTEM_PROMPT, DEFAULT_CONSOLIDATION_BAND, DEFAULT_CONSOLIDATION_SEARCH_LIMIT, DEFAULT_CONSOLIDATION_MAX_NOTES, normalizeForExactMatch, } from "./core/runner/memory-consolidation.js";
 export { consolidateScope, advanceCursorAfterInline, } from "./core/consolidate-scope.js";
-export { resolveMemoryConsolidationDriver, } from "./core/runner/memory-consolidation-driver.js";
+export { resolveMemoryConsolidationDriver, autoRunOnRecommendationEffective, } from "./core/runner/memory-consolidation-driver.js";
 export { DEFAULT_COMPACTION_INSTRUCTIONS } from "./core/auto-compaction.js";
 export { DEFAULT_SYSTEM_PROMPT, CODE_AGENT_PROMPT, SUBAGENT_PROMPT, CODE_SYSTEM_PROMPT, MEMORY_GUIDANCE, MEMORY_SAFETY, MEMORY_HYGIENE, NO_PERSISTENT_MEMORY_NOTICE, OUTPUT_EFFICIENCY, CYBER_RISK, HARNESS_SECTION_ANCHOR, URL_SAFETY, SUMMARIZE_TOOL_RESULTS, EXECUTION_ENVIRONMENT, EXECUTION_ENVIRONMENT_OPEN_READS, executionEnvironmentBlockFor, harnessContext, buildEnvironmentContext, buildGitSnapshot, buildScratchpadSection, GIT_STATUS_MAX_CHARS, formatLocalDate, defaultPromptProvider, composeSystemPrompt, composeConstitution, constitutionBlocks, analyzePromptCacheFriendliness, assertPromptCacheFriendly, } from "./prompts/default.js";
 export { SUPERVISOR_PROMPT, ORCHESTRATION_GUIDANCE, ORCHESTRATION_AWARENESS, GOAL_COMPLETION_GUIDANCE } from "./prompts/supervisor.js";

package/dist/orchestration/workflow-governance.js

@@ -297,7 +297,7 @@ function pickWhitelist(scriptSpec) {
         if (!Array.isArray(readDenyPatternsRaw)) {
             throw new WorkflowScriptError('agent(spec): `readDenyPatterns` must be an array of deny entries (a "/"-separated segment run such as ".ssh", or { pattern, caseSensitive? })');
         }
-        const entries = mapUntrustedArray(readDenyPatternsRaw, "agent(spec): `readDenyPatterns`", MAX_SCRIPT_DENY_ENTRIES, "Every entry is judged against every path the child reads, for the child's whole run; the built-in and deployment entries are always in force on top of these.", pickReadDenyEntry);
+        const entries = mapUntrustedArray(readDenyPatternsRaw, "agent(spec): `readDenyPatterns`", MAX_SCRIPT_DENY_ENTRIES, "Every entry is judged against every path the child reads, for the child's whole run; the deployment's own entries, and whichever built-in tiers the deployment switched on (none by default), are in force on top of these.", pickReadDenyEntry);
         try {
             compileReadDeny(entries, "agent(spec).readDenyPatterns");
         }

package/dist/orchestration/workflow-primitives.d.ts

@@ -51,8 +51,8 @@ parentReadFace?: () => TaskSpec["readFace"],
 /** The WRITE seat's twin of the above — the host run's RESOLVED write-face containment, folded
  *  stricter-wins into every spawned child on its own seat (the two seats never read each other). */
 parentWriteFace?: () => TaskSpec["writeFace"], 
-/** Twin of the above for the deny-set additions (built-ins always apply; these are the extra
- *  entries the host's own deployment/task layers stacked on). */
+/** Twin of the above for the deny-set additions (the extra entries the host's own deployment/task
+ *  layers stacked on; the built-in rows the DEPLOYMENT switched on — none by default — apply beside them). */
 parentReadDenyPatterns?: () => TaskSpec["readDenyPatterns"], 
 /** #345 ③ — the HOST task's write-hands clamp is ON (`spec.handsReadOnly === true`). Injected
  *  tighten-only into every spawned child, like the read-face clamp above; see the injection

package/dist/tools/fs/bash-program-position.d.ts

@@ -47,9 +47,16 @@ export declare const ARGV_REENTRY_PROGRAM_RE: RegExp;
 export declare const ARGV_REENTRY_DEFAULT_PROGRAM = "echo";
 /**
  * What a launcher declares about its OWN options: each exact spelling with its ARITY — `0` for a switch, `1` for an
- * option whose value is the next token. A fused `--name=value` and every spelling not in the map fall to the refusal
- * (the conservative side, and the verdict those spellings always had); a `1` with no token left to take is not
- * readable either.
+ * option whose value is the next token. Every spelling not in the map falls to the refusal (the conservative side,
+ * and the verdict those spellings always had); a `1` with no token left to take is not readable either.
+ *
+ * THREE SPELLINGS OF ONE DECLARATION, because getopt has three: an arity-1 entry is honoured separated (`-k 5`),
+ * fused to its long name (`--signal=TERM`) and fused to its short letter (`-k5`), and an arity-0 short entry inside
+ * a cluster of arity-0 letters (`-pv`). Reading only the exact spelling made one program two.
+ *
+ * WHAT A ROW MAY NOT GET WRONG: declaring an arity-1 option as arity 0 steps onto its VALUE and reads the value as
+ * the program — the one direction that turns a refusal into a wrong answer rather than a lost one. A row carries
+ * only options whose arity every supported implementation agrees on; a flag no row declares still refuses.
  */
 export interface LauncherRow {
     /** Consulted ONLY for the launcher the command line itself names — a bare keyword in front of the command
@@ -58,6 +65,19 @@ export interface LauncherRow {
      *  them would turn a whole refusal into an ordinary walked segment — a widening, where every other read of this
      *  table only ever finds MORE program to judge. */
     readonly optionArity: ReadonlyMap<string, 0 | 1>;
+    /** A bare NEGATIVE integer in this launcher's option section is its OWN argument (`nice -5 <cmd>`), not a flag
+     *  the table cannot read. Per row: elsewhere a dash-leading token is an option, and reading one as a number
+     *  would step over a flag whose meaning this table does not know. */
+    readonly negativeIntegerIsOwnArgument?: true;
+    /** Positional operands the launcher takes BEFORE the program, consumed whatever they spell (`timeout DURATION
+     *  COMMAND`); a spelling-based reading under-accepted, and every spelling it missed became the program word. */
+    readonly requiredOperands?: number;
+    /** The launcher reads NAME=VALUE operands with ITS OWN name grammar (`env 1=x …`), wider than the shell's. */
+    readonly assignmentOperands?: true;
+    /** The launcher hands its operands to a SHELL as text (`watch "cat /x"` runs `sh -c`): no program word to read. */
+    readonly shellText?: true;
+    /** With no program word the launcher runs a SHELL: piped text would reach it, so an empty program position refuses. */
+    readonly whenNoProgram?: "shell";
 }
 /**
  * The ONE launcher truth: programs that RUN ANOTHER PROGRAM named in ordinary argv tokens, so a declared reader can
@@ -136,7 +156,8 @@ export interface ProgramPosition {
  */
 export declare function readProgramPosition(toks: SegmentTokens): ProgramPosition;
 /** Does this program position hand a program operands the walk cannot see? True when the chain re-enters through
- *  stdin AND the program it runs is not declared no-path. ONE reading, shared by every consumer. */
-export declare function argvReentryUnjudged(pos: ProgramPosition, noPathPrograms: ReadonlySet<string>): boolean;
+ *  stdin AND the program it runs is not one the caller accepts as a stream target. ONE reading, shared by every
+ *  consumer; WHICH targets are accepted is the caller's declaration, not this reader's. */
+export declare function argvReentryUnjudged(pos: ProgramPosition, acceptedTargets: ReadonlySet<string>): boolean;
 /** ONE sentence per refusal kind, minted here and nowhere else. */
 export declare function programPositionRefusalSentence(refusal: ProgramPositionRefusal): string;