@sema-agent/core 7.22.0 → 7.23.0

package/dist/core/write-protect.js

@@ -57,8 +57,20 @@ export const WRITE_PROTECTED_DEFAULT_TABLE = freezeTable([
     { name: ".sema.json", kind: "basename" },
     { name: ".sema", kind: "segment" },
 ]);
-export function foldWriteProtectCase(s) {
-    return s.toLowerCase().replace(/ı/g, "i").replace(/ſ/g, "s");
+export function foldWriteProtectSegment(s) {
+    const cased = s.toLowerCase().replace(/ı/g, "i").replace(/ſ/g, "s");
+    return stripInvisibleFormat(cased) || cased;
+}
+function stripInvisibleFormat(s) {
+    return s.replace(/[\u200c-\u200f\u202a-\u202e\u206a-\u206f\ufeff]/g, "");
+}
+function stripWin32Component(raw, normalization) {
+    const base = normalization.invisibleFirst ? stripInvisibleFormat(raw) : raw;
+    const colon = normalization.stream ? base.indexOf(":") : -1;
+    return (colon < 0 ? base : base.slice(0, colon)).replace(/[. ]+$/, "");
+}
+function foldWriteProtectName(name) {
+    return name.split("/").map(foldWriteProtectSegment).join("/");
 }
 const KINDS = ["basename", "segment", "segment-run"];
 function describeEntryValue(v) {
@@ -107,7 +119,7 @@ export function resolveWriteProtectedTable(entries) {
     const seen = new Set();
     for (const entry of entries) {
         const row = normalizeWriteProtectedEntry(entry);
-        const key = `${row.kind}:${foldWriteProtectCase(row.name)}`;
+        const key = `${row.kind}:${foldWriteProtectName(row.name)}`;
         if (seen.has(key))
             continue;
         seen.add(key);
@@ -115,8 +127,9 @@ export function resolveWriteProtectedTable(entries) {
     }
     return freezeTable(out);
 }
-function pathViewSegments(path, win32, seps = BOTH_SEPARATOR_FAMILIES, anchorFloor = 0) {
+function pathViewSegments(path, normalization, seps = BOTH_SEPARATOR_FAMILIES, anchorFloor = 0) {
     const segs = [];
+    const win32 = normalization !== "literal";
     for (const raw of path.split(seps)) {
         if (raw.length === 0)
             continue;
@@ -131,11 +144,17 @@ function pathViewSegments(path, win32, seps = BOTH_SEPARATOR_FAMILIES, anchorFlo
                 segs.push("..");
             continue;
         }
-        const stripped = win32 ? raw.replace(/[. ]+$/, "") : raw;
+        const stripped = normalization === "literal" ? raw : stripWin32Component(raw, normalization);
         segs.push(stripped.length > 0 ? stripped : raw);
     }
     return segs;
 }
+const WIN32_NORMALIZATIONS = [
+    { invisibleFirst: false, stream: false },
+    { invisibleFirst: false, stream: true },
+    { invisibleFirst: true, stream: false },
+    { invisibleFirst: true, stream: true },
+];
 const BOTH_SEPARATOR_FAMILIES = /[\\/]/;
 const POSIX_SEPARATOR_FAMILY = /\//;
 function uncAnchorSegments(path) {
@@ -149,7 +168,7 @@ function relativeUnderDataRoot(path, roots) {
         if (root.win ? !isWinFormPath(path) : isWinFormPath(path) || !path.startsWith("/"))
             continue;
         const seps = root.win ? BOTH_SEPARATOR_FAMILIES : POSIX_SEPARATOR_FAMILY;
-        const segs = pathViewSegments(path, false, seps, uncAnchorSegments(path));
+        const segs = pathViewSegments(path, "literal", seps, uncAnchorSegments(path));
         if (segs.length < root.segments.length)
             continue;
         if (root.segments.every((s, i) => segs[i] === s))
@@ -165,13 +184,13 @@ export function compileWriteProtection(entries, opts) {
     const dataRootPaths = dataRootSpellings(opts?.dataRoot);
     const rootViews = dataRootPaths.map((r) => {
         const win = isWinFormPath(r);
-        return { win, segments: pathViewSegments(r, false, win ? BOTH_SEPARATOR_FAMILIES : POSIX_SEPARATOR_FAMILY, uncAnchorSegments(r)) };
+        return { win, segments: pathViewSegments(r, "literal", win ? BOTH_SEPARATOR_FAMILIES : POSIX_SEPARATOR_FAMILY, uncAnchorSegments(r)) };
     });
     const basenames = new Map();
     const segments = new Map();
     const runs = [];
     for (const row of rows) {
-        const folded = foldWriteProtectCase(row.name);
+        const folded = foldWriteProtectName(row.name);
         if (row.kind === "basename") {
             if (!basenames.has(folded))
                 basenames.set(folded, row.name);
@@ -187,7 +206,7 @@ export function compileWriteProtection(entries, opts) {
     const judgeSegments = (raw) => {
         if (raw.length === 0)
             return null;
-        const segs = raw.map(foldWriteProtectCase);
+        const segs = raw.map(foldWriteProtectSegment);
         const base = basenames.get(segs[segs.length - 1] ?? "");
         if (base !== undefined)
             return { name: base, kind: "basename" };
@@ -205,9 +224,20 @@ export function compileWriteProtection(entries, opts) {
         }
         return null;
     };
-    const judgeViews = (spelling) => judgeSegments(pathViewSegments(spelling, false, POSIX_SEPARATOR_FAMILY, uncAnchorSegments(spelling))) ??
-        judgeSegments(pathViewSegments(spelling, false)) ??
-        judgeSegments(pathViewSegments(spelling, true));
+    const judgeViews = (spelling) => {
+        const posix = judgeSegments(pathViewSegments(spelling, "literal", POSIX_SEPARATOR_FAMILY, uncAnchorSegments(spelling)));
+        if (posix !== null)
+            return posix;
+        const bothSeparators = judgeSegments(pathViewSegments(spelling, "literal"));
+        if (bothSeparators !== null)
+            return bothSeparators;
+        for (const normalization of WIN32_NORMALIZATIONS) {
+            const hit = judgeSegments(pathViewSegments(spelling, normalization));
+            if (hit !== null)
+                return hit;
+        }
+        return null;
+    };
     const judgeSpelled = (spelled) => judgeViews(relativeUnderDataRoot(spelled, rootViews) ?? spelled);
     const judgeSpelling = (path, cwd) => {
         const base = typeof cwd === "string" && cwd.length > 0 ? cwd : undefined;
@@ -231,31 +261,55 @@ export function compileWriteProtection(entries, opts) {
                 return { kind: "clear" };
             const family = pathFamilyOf({ root: rootPath, cwd: ctx.cwd ?? env.cwd });
             const base = ctx.base ?? ctx.cwd ?? rootPath;
-            const canon = await canonicalizeTarget(env, path, ctx.signal, family, base);
-            if (!canon.ok)
-                return { kind: "unresolvable", cause: canon.message, unresolvedSymlink: canon.unresolvedSymlink === true };
-            const byTarget = judgeViews(canon.key);
-            if (byTarget !== null) {
-                for (const rootKey of await canonicalDataRootKeys(env, dataRootPaths, ctx.signal)) {
-                    const relative = relativeUnderRoot(canon.key, rootKey);
-                    if (relative === null)
+            let noted = false;
+            const noteAbsence = (cause, unresolvedSymlink) => {
+                if (noted)
+                    return;
+                noted = true;
+                opts?.onViewAbsent?.({ cause, unresolvedSymlink });
+            };
+            let canonKey;
+            try {
+                const canon = await canonicalizeTarget(env, path, ctx.signal, family, base);
+                if (canon.ok)
+                    canonKey = canon.key;
+                else
+                    noteAbsence(canon.message, canon.unresolvedSymlink === true);
+            }
+            catch (err) {
+                noteAbsence(err instanceof Error ? err.message : String(err), false);
+            }
+            try {
+                if (canonKey !== undefined) {
+                    const byTarget = judgeViews(canonKey);
+                    if (byTarget !== null) {
+                        for (const rootKey of await canonicalDataRootKeys(env, dataRootPaths, ctx.signal)) {
+                            const relative = relativeUnderRoot(canonKey, rootKey);
+                            if (relative === null)
+                                continue;
+                            if (relative === "")
+                                return { kind: "clear" };
+                            const remainder = judgeViews(relative);
+                            return remainder === null ? { kind: "clear" } : { kind: "hit", hit: remainder, via: "target" };
+                        }
+                        return { kind: "hit", hit: byTarget, via: "target" };
+                    }
+                }
+                for (const hop of await symlinkChainHops(env, path, ctx.signal, family, base, (cause) => noteAbsence(cause, false))) {
+                    const byHop = judgeSpelled(hop);
+                    if (byHop === null)
                         continue;
-                    if (relative === "")
-                        return { kind: "clear" };
-                    const remainder = judgeViews(relative);
-                    return remainder === null ? { kind: "clear" } : { kind: "hit", hit: remainder, via: "target" };
+                    if (canonKey !== undefined) {
+                        for (const rootKey of await canonicalDataRootKeys(env, dataRootPaths, ctx.signal)) {
+                            if (relativeUnderRoot(canonKey, rootKey) !== null)
+                                return { kind: "clear" };
+                        }
+                    }
+                    return { kind: "hit", hit: byHop, via: "chain" };
                 }
-                return { kind: "hit", hit: byTarget, via: "target" };
             }
-            for (const hop of await symlinkChainHops(env, path, ctx.signal, family, base)) {
-                const byHop = judgeSpelled(hop);
-                if (byHop === null)
-                    continue;
-                for (const rootKey of await canonicalDataRootKeys(env, dataRootPaths, ctx.signal)) {
-                    if (relativeUnderRoot(canon.key, rootKey) !== null)
-                        return { kind: "clear" };
-                }
-                return { kind: "hit", hit: byHop, via: "chain" };
+            catch (err) {
+                noteAbsence(err instanceof Error ? err.message : String(err), false);
             }
             return { kind: "clear" };
         },

package/dist/engine/execution-env/node-execution-env.d.ts

@@ -7,6 +7,21 @@ import type { SchedulerCapability, ScheduledIntent, SchedulerContext, ScheduledT
 import { SchedulerError } from "../../core/scheduler.js";
 /** Convert user-facing timeout seconds into a positive, timer-safe millisecond delay. */
 export declare function resolveExecTimeoutMs(timeoutSeconds: unknown): number | undefined;
+/**
+ * Anchor a RELATIVE symlink target at its link's own directory, UNFOLDED and with exactly one separator
+ * between the two. A directory that IS a root already ends in its own separator (`/`, `C:\`, `C:/`,
+ * `\\host\share\`, all of which `dirname` answers that way), and concatenating a second one mints a
+ * DOUBLE-separator spelling for a path that has one spelling — `/tmp -> private/tmp` came back as
+ * `//private/tmp`, which the judges that walk this chain then match against nothing, because a guarded row
+ * and a containment root are both written with single separators. Joining through `path.resolve`/`path.join`
+ * would fix the separator and fold `..` with it, which is the one thing this walk may not do.
+ *
+ * `separator` is the one the caller's `dirname` writes, passed rather than read from the module so the rule
+ * is a pure function of its inputs. A backslash counts as a terminator only where it IS a separator: on a
+ * POSIX tree a directory whose name ends in one (`/a/b\`) is an ordinary name, and reading it as terminated
+ * would rename `/a/b\/t` to `/a/b\t` — the same class of rewrite as folding `..` lexically.
+ */
+export declare function anchorAtLinkDir(linkDir: string, target: string, separator: string): string;
 /** review finding (win32): `where bash.exe` can resolve to `System32\bash.exe` — the
  *  WSL LAUNCHER, not a native shell. Running it drops into a Linux subsystem where Windows cwd/paths
  *  do not exist; silently adopting it is exactly the "wrong shell, false green" failure D1 forbids.
@@ -171,8 +186,10 @@ export declare class NodeExecutionEnv implements ExecutionEnv, BackgroundShellCa
      * target, until a hop is not a link (`EINVAL`), is absent (`ENOENT` / `ENOTDIR`), repeats, or the bound is
      * reached. A relative target is ANCHORED at its link's directory and never folded — `..` is the filesystem's
      * to resolve during the next `readlink`'s own lookup (a lexical fold reads `bridge/../next` as `next` and misses
-     * every link behind `bridge`). One syscall per hop, no `lstat`. On a win32 host a share-shaped hop is kept and
-     * ends the walk unprobed. Any other errno is an answer nobody can use (`err`), never a shortened chain.
+     * every link behind `bridge`). Anchoring puts EXACTLY ONE separator between the directory and the target
+     * ({@link anchorAtLinkDir}); a root directory already ends in its own. One syscall per hop, no `lstat`. On a
+     * win32 host a share-shaped hop is kept and ends the walk unprobed. Any other errno is an answer nobody can
+     * use (`err`), never a shortened chain.
      */
     canonicalChain(path: string): Promise<Result<SymlinkChain, FileError>>;
     exists(path: string): Promise<Result<boolean, FileError>>;

package/dist/engine/execution-env/node-execution-env.js

@@ -42,6 +42,10 @@ function fileKindFromStats(stats) {
     return undefined;
 }
 const HAS_POSIX_MODE_FACE = process.platform !== "win32";
+export function anchorAtLinkDir(linkDir, target, separator) {
+    const endsInSeparator = linkDir.endsWith(separator) || (separator === "\\" && linkDir.endsWith("/"));
+    return endsInSeparator ? `${linkDir}${target}` : `${linkDir}${separator}${target}`;
+}
 const SYMLINK_CHAIN_HOP_BOUND = 64;
 function fileInfoFromStats(path, stats) {
     const kind = fileKindFromStats(stats);
@@ -1043,7 +1047,7 @@ export class NodeExecutionEnv {
                     return ok({ hops });
                 return err(toFileError(error, cur));
             }
-            const next = isAbsolute(target) ? target : `${dirname(cur)}${sep}${target}`;
+            const next = isAbsolute(target) ? target : anchorAtLinkDir(dirname(cur), target, sep);
             if (seen.has(next))
                 break;
             hops.push(next);

package/dist/index.d.ts

@@ -105,7 +105,7 @@ export { classifyCompoundReadonlyDetailed, formatOutOfRootReadApprovalOption, ty
 export { resolveBashTimeoutCaps } from "./tools/fs/index.js";
 export { READ_FACE_DEFAULT_DENY_ENTRIES, READ_FACE_BUILTIN_DENY_TABLE, READ_DENY_BUILTIN_TIERS, READ_DENY_DEFAULT_TIERS, resolveReadDenyBuiltins, compileReadDeny, type ReadDenyEntry, type ReadDenyMatcher, type NormalizedReadDenyEntry, type ReadDenyBuiltinTier, type ReadDenyBuiltinRow, type ReadDenyBuiltinConfig, } from "./tools/fs/index.js";
 export { deploymentFaceClampNotice, resolveContainmentFace, type ContainmentFace, type ContainmentFaceInputs, type ContainmentFaceKind, type ContainmentFaceLayer, } from "./tools/fs/index.js";
-export { WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable, compileWriteProtection, type WriteProtectedEntry, type WriteProtectedRow, type WriteProtectedKind, type WriteProtectedHit, type WriteProtectionMatcher, type WriteProtectionVerdict, type WriteProtectionJudgeContext, type WriteProtectionCompileOptions, type WriteProtectionCheck, WRITE_PROTECTION_TARGET_VIEWS, type WriteProtectionTargetView, type WriteProtectionMount, } from "./core/write-protect.js";
+export { WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable, compileWriteProtection, type WriteProtectedEntry, type WriteProtectedRow, type WriteProtectedKind, type WriteProtectedHit, type WriteProtectionMatcher, type WriteProtectionVerdict, type WriteProtectionViewAbsence, type WriteProtectionJudgeContext, type WriteProtectionCompileOptions, type WriteProtectionCheck, WRITE_PROTECTION_TARGET_VIEWS, type WriteProtectionTargetView, type WriteProtectionMount, } from "./core/write-protect.js";
 export { InMemoryToolResultStore, OFFLOAD_TOOL_NAME, DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, assertSafeToolResultRef, buildToolResultRef, toolResultContentSegment, MAX_MINTED_TOOL_RESULT_REF_CHARS, type ToolResultProvenance, assertToolResultProvenanceMatch, normalizeToolResultProvenance, toolResultProvenanceOf, ToolResultRefConflictError, TOOL_RESULT_REF_CONFLICT_CODE, type ToolResultStore, type ToolResultSlice, type ToolResultDeletionReport, } from "./core/tool-result-store.js";
 export { InMemoryCheckpointStore, CheckpointError, mintCheckpointId, mintCheckpointToken, checkpointVersionOf, CURRENT_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, ORG_ADMISSION_CHECKPOINT_VERSION, F012_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, debitLedger, remainingBudgetMicroUsd, remainingTokens, winnerFromOutcome, validatePendingSteer, readPendingSteerQueue, appendPendingSteer, MAX_PENDING_STEER_CHARS, MAX_PENDING_STEER_ENTRIES, PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES, PENDING_STEER_FROZEN_FIELDS, ACTOR_ASSERTION_FROZEN_FIELDS, MAX_ACTOR_FIELD_CHARS, MAX_STEER_INPUT_ID_CHARS, type ActorAssertion, type PendingSteerEntry, type PendingSteerInput, riskSeverity, buildRiskDescriptor, summarizeCheckpoint, type RiskDescriptor, type ProbeCause, type ProbeCauseOperands, type CheckpointStore, type CheckpointSummary, type Checkpoint, type CheckpointToken, type CheckpointGate, type CheckpointState, type SerializedCheckpointState, type CheckpointFaultMode, type PendingAction, type ResumeOutcome, type ResolvedOutcome, type ReopenReason, type ResolveExpectation, type TerminalClaimIntent, type TerminalClaimOutcome, type SafetyAxis, type RealApprovalGateBit, type ResourceLedger, type ResourceLimitReason, type PlatformLimitReason, type CheckpointRow, realApprovalOrgFact, resolveCheckpointStore, checkpointStoreExecutionUndeclared, } from "./core/checkpoint-store.js";
 export { EXECUTION_OUTCOME_RECORD_WORDS, EXECUTION_RECORD_LEAVES_ROW_UNRECORDED, type ExecutionOutcomeRecordWord, type ExecutionRecordRowFacts, type ExecutionVerdict, ExecutionOutcomeConflictError, checkpointExecutionRecorded, executionRecordDisposition, sameExecutionRecord, executionVerdict, } from "./core/checkpoint-execution-record.js";

package/dist/tools/fs/fs-read.js

@@ -231,7 +231,7 @@ export function createReadFileTool(env, state, rootCanonical, cwdRef, additional
                     if (prevNb && !prevNb.isPartialView && prevNb.hash === hash && prevNb.view && prevNb.view.start === 1 && prevNb.view.end === total) {
                         return fileUnchangedResult(`[${path}: unchanged since you last read it (lines 1-${total} of ${total}); content omitted to save context]`, "unchanged-since-last-read", 1, total, total);
                     }
-                    state.set(r.key, { hash, totalLines: countLines(content), truncated: false, view: { start: 1, end: total }, lastReadAt: Date.now() });
+                    state.set(r.key, { hash, totalLines: countLines(content), truncated: false, view: { start: 1, end: total }, lastReadAt: Date.now(), transmittedByToolCallId: ctx.toolCallId });
                     const bodyBlocks = rendered.blocks.length > 0 ? rendered.blocks : [{ type: "text", text: "[notebook has 0 cells]" }];
                     const nbDisclosure = discloseReminderShaped({
                         segments: rendered.blocks.filter((b) => b.type === "text").map((b) => b.text),
@@ -307,6 +307,7 @@ export function createReadFileTool(env, state, rootCanonical, cwdRef, additional
                 ...(pageMarker !== undefined ? { isPartialView: true } : {}),
                 view: { start, end },
                 lastReadAt: Date.now(),
+                transmittedByToolCallId: ctx.toolCallId,
             });
             if (total === 0)
                 return `${openSystemReminder(reminderMark)}Warning: the file exists but the contents are empty.</system-reminder>`;

package/dist/tools/fs/fs-shared.d.ts

@@ -375,9 +375,7 @@ export declare const CWD_SENTINEL = "__cc_cwd_9f2c1b__";
  * TWO CALLERS, ONE RULE, which is why the marker is optional. The foreground result path KNOWS the
  * marker it minted and passes it (exact, unambiguous). A backgrounded command's spool is assembled by a
  * different lane entirely — the shell row outlives the run that launched it and never had the marker —
- * so it passes none and the marker is recovered per span from the sentinel plus its hex suffix. Before
- * this was shared, only the foreground path stripped, and the completion notification handed a person
- * the raw internal marker with the directory inside it.
+ * so it passes none and the marker is recovered per span from the sentinel plus its hex suffix.
  */
 export declare function stripCwdSentinel(stderr: string, marker?: string): {
     stderr: string;
@@ -504,10 +502,38 @@ export declare function inheritSessionReadFileState(target: ReadFileState, inher
  * coordinate (canonicalized the same way the Read/Edit/Write tools populate it), so a plain lookup
  * suffices; no re-hash/re-register needed since the entry's content genuinely has not changed.
  */
-export declare function applyCompactionToReadFileState(state: ReadFileState, attachedComplete: ReadonlyArray<{
-    path: string;
-    content: string;
-}>, preserveKeys?: ReadonlyArray<string>): void;
+/**
+ * The SECOND way a transmission leaves the model's view, and why this function is named for context
+ * SHRINK rather than compaction: the request-layer stale-result pass replaces an old tool result's
+ * content with a cleared marker — no summary, no re-attachment, nothing changed in the session — and
+ * for a Read result the effect on the entry is identical: the body its dedup stub points at is no
+ * longer anywhere the model can see, so the entry must retire with it.
+ *
+ * Selection is by the TRANSMISSION, not by path — an entry a LATER Read re-transmitted carries that
+ * later call's id and so survives a clear of the earlier one, which a path-keyed retirement could not
+ * tell apart. KNOWN IMPRECISION: a call id is not unique over a run (the clear ledger keys occurrences
+ * by id + message timestamp + ordinal for that reason) and the finer key is not reachable at the Read
+ * mint, which does not know the timestamp of the message its result will land in. A reused id can
+ * therefore retire one entry too many, costing a re-transmission and a tightened read-before-edit gate
+ * — the same tightening the summarized arm accepts wholesale. The converse is not reachable: an entry
+ * carries the id of the last Read that transmitted it, so if that result was cleared its id is in the list.
+ */
+export type ReadFileStateShrink = 
+/** A landed compaction: `attachedComplete` re-entered the context whole; `preserveKeys` stayed visible in the kept tail. */
+{
+    kind: "summarized";
+    attachedComplete: ReadonlyArray<{
+        path: string;
+        content: string;
+    }>;
+    preserveKeys?: ReadonlyArray<string>;
+}
+/** A request-layer stale-result clear: these tool calls' results are markers now. Nothing re-entered. */
+ | {
+    kind: "tool-results-cleared";
+    clearedToolCallIds: ReadonlyArray<string>;
+};
+export declare function applyContextShrinkToReadFileState(state: ReadFileState, shrink: ReadFileStateShrink): void;
 /** CC 2.1.198 verbatim skeleton: the ENOENT error body for a
  *  missing Read/Edit target — `File does not exist. Note: your current working directory is <cwd>.`
  *  plus a `Did you mean <sibling>?` correction when the parent directory holds a near-name (case

package/dist/tools/fs/fs-shared.js

@@ -318,7 +318,18 @@ export async function inheritSessionReadFileState(target, inherited, judgeKey) {
             target.set(judged, entry);
     }
 }
-export function applyCompactionToReadFileState(state, attachedComplete, preserveKeys = []) {
+export function applyContextShrinkToReadFileState(state, shrink) {
+    if (shrink.kind === "tool-results-cleared") {
+        if (shrink.clearedToolCallIds.length === 0)
+            return;
+        const cleared = new Set(shrink.clearedToolCallIds);
+        for (const [k, v] of [...state]) {
+            if (v.transmittedByToolCallId !== undefined && cleared.has(v.transmittedByToolCallId))
+                state.delete(k);
+        }
+        return;
+    }
+    const { attachedComplete, preserveKeys = [] } = shrink;
     const preserve = new Set(preserveKeys);
     for (const [k, v] of [...state]) {
         if (v.seededFromContext !== true && !preserve.has(k))

package/dist/tools/fs/safety.d.ts

@@ -77,6 +77,13 @@ export interface ReadEntry {
      *  disk (hash mismatch) always serves real content and the dedup disarms permanently.
      *  Optional/additive: absent = normal entry. */
     seededFromContext?: boolean;
+    /** The id of the tool call whose RESULT carried the body this entry dedups against: when the
+     *  request-layer stale-result pass clears THAT transmission, the entry retires with it
+     *  (`applyContextShrinkToReadFileState`, `tool-results-cleared` arm). Recorded only by the Read
+     *  lanes that TRANSMIT a body — a write-back's content is the model's own arguments and a
+     *  seeded/re-attached entry never rode a tool result, so neither carries this and neither is
+     *  retired by a clear. Optional/additive: absent (an older checkpoint) never matches a cleared id. */
+    transmittedByToolCallId?: string;
 }
 /** Per-task record of which files have been read, keyed by canonical path: owned by prepare-task,
  *  closure-captured by the tools, and serialized into the durable checkpoint. */
@@ -385,6 +392,36 @@ export declare function isShellRootedSpellingUnmapped(family: PathFamily | undef
  *  ⇒ `\\\\host\\share\\x`), for a lexical normalizer that recognises the backslash form only; every other spelling is
  *  returned as is. */
 export declare function nativeUncSpellingOf(family: PathFamily | undefined, spelled: string): string;
+/**
+ * Fold a TRAILING separator run off a spelling that is about to become a KEY: `<dir>/adir`, `<dir>/adir/`
+ * and `<dir>/adir//` name one directory and must mint one key. The existing-path arm folds them already,
+ * as a side effect of asking `realpath`; the arm that mints a key for a path that does NOT exist yet
+ * rejoined the model's own tail verbatim, so the same not-yet-created directory arrived under two and
+ * three keys — and a byte-wise reader (the per-file read state, the write gate's per-key ledger) treats
+ * two keys as two files.
+ *
+ * Called on the ANSWER, at the canonicalizer's single exit, and never on a spelling about to be probed.
+ * Two things break if it moves earlier. A trailing separator is an ASSERTION that the target is a
+ * directory and the platform enforces it (`<existing regular file>/` answers `not_directory`, reported
+ * here as a refusal), so folding before the probe spends that refusal and the slash-suffixed spelling of
+ * a file resolves to the file. And the ancestor walk chooses which ancestor to canonicalize by SPLITTING
+ * the spelling it was handed: a leaf stripped of its separator first is skipped as though it had been
+ * resolved, so `<root>/link/` — a link to a directory outside the root — comes back as the in-root
+ * spelling instead of the destination. Folding the answer costs neither.
+ *
+ * A spelling whose remainder is the bare ANCHOR keeps the separator the platform writes on a root — `/`,
+ * `C:\`, `\\host\share\`. That run IS the root's own spelling rather than a tail nobody wrote, and
+ * stripping it renames the spelling to nothing, to a DRIVE-RELATIVE location, or to a share root written
+ * unlike every other root. The question is asked in the module's own vocabulary ({@link pathIdentityOf} +
+ * {@link isIdentityDir}: is anything left BELOW the anchor?), so the three families need no arm each.
+ * Interior runs are NOT touched here: the ancestor walk folds them by probing, and a run in the middle of
+ * a name is the platform's to read.
+ *
+ * Scanned backwards rather than matched: `/[\\/]+$/` against a model-supplied spelling is quadratic when a
+ * long separator run precedes a non-separator (measured: ~5s for 32k leading slashes, on the caller's
+ * thread), and a path spelling is unbounded input.
+ */
+export declare function foldTrailingSeparators(spelled: string, family: PathFamily): string;
 /**
  * Join a RELATIVE-OR-ROOTED spelling to a base under the family, without folding (`..` across a symlinked
  * parent is the env's to resolve). win = `path.win32` semantics: `/x`/`\x` lands on the base's drive or

package/dist/tools/fs/safety.js

@@ -371,11 +371,17 @@ function mintIdentity(anchor, segments, stripTail) {
                 out.pop();
             continue;
         }
-        const stripped = stripTail ? seg.replace(/[. ]+$/, "") : seg;
+        const stripped = stripTail ? seg.slice(0, trailingDotSpaceStart(seg)) : seg;
         out.push(stripped.length > 0 ? stripped : seg);
     }
     return (out.length === 0 ? anchor || "/" : `${anchor}/${out.join("/")}`);
 }
+function trailingDotSpaceStart(seg) {
+    let end = seg.length;
+    while (end > 0 && (seg[end - 1] === "." || seg[end - 1] === " "))
+        end -= 1;
+    return end;
+}
 function identityAnchorOf(identity) {
     return identity.startsWith("//") ? identity.split("/").slice(0, 4).join("/") : identity.slice(0, 2);
 }
@@ -403,6 +409,18 @@ export function isShellRootedSpellingUnmapped(family, spelled) {
 export function nativeUncSpellingOf(family, spelled) {
     return family === "win" && isUncSpelling(spelled) ? `\\\\${spelled.slice(2).replace(/\//g, "\\")}` : spelled;
 }
+export function foldTrailingSeparators(spelled, family) {
+    let end = spelled.length;
+    while (end > 0 && (spelled[end - 1] === "/" || (family === "win" && spelled[end - 1] === "\\")))
+        end -= 1;
+    if (end === spelled.length)
+        return spelled;
+    const stripped = spelled.slice(0, end);
+    const identity = pathIdentityOf(stripped, family);
+    if (!identity.ok || !isIdentityDir(identity.identity, family))
+        return spelled;
+    return stripped;
+}
 export function joinForFamily(family, base, rel) {
     if (family === "posix")
         return `${base.replace(/\/+$/, "")}/${rel}`;
@@ -500,7 +518,8 @@ export async function canonicalizeTarget(env, path, signal, family, baseCwd) {
         throw e;
     });
     try {
-        return await withGateTimeout(probe, DEFAULT_GATE_AWAIT_TIMEOUT_MS, signal, "pathCanonicalization");
+        const answer = await withGateTimeout(probe, DEFAULT_GATE_AWAIT_TIMEOUT_MS, signal, "pathCanonicalization");
+        return answer.ok ? { ...answer, key: foldTrailingSeparators(answer.key, family) } : answer;
     }
     catch (err) {
         if (seenThrow && err === thrownByProbe)
@@ -546,7 +565,16 @@ async function probeRealTarget(env, path, target, family, signal) {
         if (!link.ok) {
             return { ok: false, message: `cannot read symlink "${path}": ${link.error.message}`, unresolvedSymlink: true };
         }
-        const linkTarget = isAbsoluteForFamily(family, link.value) ? link.value : joinForFamily(family, parentDir(abs), link.value);
+        const screenedTarget = win32NamespaceScreen(link.value, family);
+        if (!screenedTarget.ok) {
+            return {
+                ok: false,
+                message: `cannot resolve symlink "${path}": its target "${clipSpelling(link.value)}" ${WIN32_NAMESPACE_REFUSAL_TEXT[screenedTarget.refuse]}; refused (${screenedTarget.refuse}).`,
+                refused: screenedTarget.refuse,
+            };
+        }
+        const hopSpelling = family === "win" ? screenedTarget.spelled : link.value;
+        const linkTarget = isAbsoluteForFamily(family, hopSpelling) ? hopSpelling : joinForFamily(family, parentDir(abs), hopSpelling);
         const reabs = await env.absolutePath(linkTarget, signal);
         if (!reabs.ok) {
             return { ok: false, message: `cannot resolve symlink target "${linkTarget}" for "${path}": ${reabs.error.message}`, unresolvedSymlink: true };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.22.0",
+  "version": "7.23.0",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",
@@ -48,7 +48,7 @@
   },
   "scripts": {
     "build": "rm -rf dist && tsc -p tsconfig.build.json && tsc -p tsconfig.build.json --emitDeclarationOnly --removeComments false",
-    "typecheck": "tsc --noEmit",
+    "typecheck": "tsc --noEmit && echo \"typecheck OK (tsc --noEmit clean)\"",
     "pretest": "npm run gate:debts",
     "test": "vitest run --exclude \"**/*.local.test.ts\"",
     "test:watch": "vitest",

package/test/export-surface.snapshot.json

@@ -1,7 +1,7 @@
 {
   "_comment": "design/87 L3 — frozen public export surface of src/index.ts (name -> kind). DO NOT edit by hand to silence a red test. A removed/changed entry = a SemVer-BREAKING change; bump MAJOR and update this fixture in the SAME commit (design/87 §4.2 / §5.2). Regenerate via REGEN in test/export-surface.test.ts.",
   "_tierComment": "#435 v1 — machine-readable layering of the public surface: stable = demonstrated by README.md / src/examples; internal = an `Internal`-marked name or a runner/engine deep-subtree declaration (the model seam src/engine/llm is excluded — it is the BYOM contract, not an engine internal); advanced = a supported export the front door does not walk you through. THIS IS AN INITIAL HEURISTIC, derived mechanically and expected to be refined ticket by ticket: no human reviewed these 1700+ entries one by one, and nothing here claims otherwise. Known bias: a short or English-word export name (ok, err, Result, Usage) can match ordinary prose in README.md and land `stable` on a coincidence. Every export MUST carry a tier — a new export with no row fails the gate in export-surface.test.ts.",
-  "count": 2394,
+  "count": 2395,
   "exports": {
     "A2ATaskState": "type",
     "A2ATaskStateReversal": "type",
@@ -1615,6 +1615,7 @@
     "WriteProtectionMount": "interface",
     "WriteProtectionTargetView": "type",
     "WriteProtectionVerdict": "type",
+    "WriteProtectionViewAbsence": "interface",
     "WriteReceipt": "interface",
     "XARGS_READ_ONLY_TARGETS": "variable",
     "ackAdoptionConfig": "function",
@@ -4011,6 +4012,7 @@
     "WriteProtectionMount": "advanced",
     "WriteProtectionTargetView": "advanced",
     "WriteProtectionVerdict": "advanced",
+    "WriteProtectionViewAbsence": "advanced",
     "WriteReceipt": "internal",
     "XARGS_READ_ONLY_TARGETS": "advanced",
     "ackAdoptionConfig": "advanced",