@sema-agent/core 7.24.4 → 7.25.1

package/wire-changes/core@7.25.1.json

@@ -0,0 +1,64 @@
+{
+  "repo": "core",
+  "version": "7.25.1",
+  "from": "b205840bf3354e748513a90e5d698b8dd8a639fd",
+  "to": "v7.25.1",
+  "added": [],
+  "removed": [],
+  "changed": [],
+  "narrowed": [
+    {
+      "id": "F1",
+      "source": "behaviorFlips.summary",
+      "text": "NARROWING (#993, P2, read boundary): a deny-listed path spelled through an assignment word or a quote form is REFUSED at zero cards on every shell face — bare `NAME+=value`, `NAME[sub]=value` (subscript may be quoted), a `$'…'` / `$\"…\"` body with no backslash, a tilde outside an expansion slot (`A=.env~`), and a declaration operand (`export`/`declare`/`local` …) of those spellings."
+    },
+    {
+      "id": "F3",
+      "source": "behaviorFlips.summary",
+      "text": "NARROWING (#993 E5): a QUOTED assignment-shaped first word (`'A=x' cmd`, `\"A+=x\" cmd`) is the program name bash runs, so it is judged as an unknown program and its path operands are judged — one bare-prefix question for `=` and `+=` alike; KL-945h closed."
+    },
+    {
+      "id": "F4",
+      "source": "behaviorFlips.summary",
+      "text": "NARROWING (#993 leg B / E7 / F3 / G2, irreversibility): the unverifiable-recursive-delete walk skips leading assignments with the same bare-prefix grammar and applies one state transition to every declaration operand, so `A+=x rm -rf $UNSET` and `export -n D+=$UNKNOWN; rm -rf $D` report a finding where they reported none; `export -n D=/tmp/safe; rm -rf \"$D\"` no longer over-asks."
+    }
+  ],
+  "closedSetMembers": [],
+  "closedSetsUnreadable": [],
+  "typeKeys": [],
+  "declarationMoves": [],
+  "mintMoves": [],
+  "criteriaObserves": [
+    {
+      "kind": "taskEventField",
+      "name": "tool_end.gate",
+      "assertions": [
+        "G1.a",
+        "G1.b"
+      ]
+    },
+    {
+      "kind": "taskEventField",
+      "name": "tool_end.structured",
+      "assertions": [
+        "G1.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "AskRequest.requiresRealApproval",
+      "assertions": [
+        "G2.a"
+      ]
+    }
+  ],
+  "consumersHint": {
+    "cli": [],
+    "server": [],
+    "sdk": [],
+    "note": "NOT SCANNED: sema-cli, sema-server, sema-sdk — an empty list for those repos means \"not checked out\", not \"no consumer\""
+  },
+  "breakingCount": 0,
+  "breakingItems": [],
+  "toResolvedAt": "ce38d4e944d7b23bd648af718325db86e81b57c6"
+}