@sema-agent/core 7.3.1 → 7.4.0

package/dist/core/sensitive-path-policy.js

@@ -1,4 +1,6 @@
-import { canonicalizeTarget, writeTargetPath } from "../tools/fs/safety.js";
+import { homedir } from "node:os";
+import { isAbsolute, join, resolve } from "node:path";
+import { canonicalizeTarget, expandHomeTilde, isAbsolutePathForm, isWinFormPath, writeTargetPath } from "../tools/fs/safety.js";
 import { compileSegmentPattern, matchSegmentPatterns } from "../tools/fs/read-deny.js";
 const DEFAULT_GUARDED_TOOLS = ["Write", "Edit", "MultiEdit", "NotebookEdit"];
 export const RECOMMENDED_SENSITIVE_PATTERNS = [
@@ -17,6 +19,9 @@ export const RECOMMENDED_SENSITIVE_PATTERNS = [
     ".git/modules",
     ".mcp.json",
     ".claude*",
+    ".sema",
+    ".sema.*",
+    ".sema-notifier-build",
     ".aws",
     ".config/gcloud",
     ".azure",
@@ -27,6 +32,33 @@ export const RECOMMENDED_SENSITIVE_PATTERNS = [
     ".zsh_history",
 ];
 const CASE_INSENSITIVE_FS = process.platform === "darwin" || process.platform === "win32";
+function dataRootSpellings(explicit) {
+    const raw = explicit ?? process.env.AGENT_DATA_DIR ?? join(homedir(), ".ai-agent");
+    const home = homedir();
+    const tilde = expandHomeTilde(raw, home);
+    const engineForm = isAbsolute(raw) ? raw : resolve(raw);
+    const out = [];
+    for (const v of [raw, tilde, engineForm]) {
+        const anchored = isAbsolutePathForm(v) ? v : resolve(v);
+        if (!out.includes(anchored))
+            out.push(anchored);
+    }
+    return out;
+}
+function relativeUnderRoot(targetKey, rootKey) {
+    const seps = isWinFormPath(rootKey) ? ["\\", "/"] : ["/"];
+    let root = rootKey;
+    while (root.length > 0 && seps.includes(root[root.length - 1]))
+        root = root.slice(0, -1);
+    if (root.length === 0)
+        return null;
+    if (targetKey === root)
+        return "";
+    for (const sep of seps)
+        if (targetKey.startsWith(root + sep))
+            return targetKey.slice(root.length + 1);
+    return null;
+}
 function compilePatterns(patterns) {
     const out = [];
     for (const raw of patterns) {
@@ -44,6 +76,20 @@ function matchSensitive(canonicalKey, compiled, aliasResolved) {
 }
 export function createSensitivePathPolicy(opts) {
     const compiled = compilePatterns(opts.patterns);
+    const dataRootPaths = dataRootSpellings(opts.dataRoot);
+    const dataRootKeys = async (signal) => {
+        const keys = [];
+        for (const spelling of dataRootPaths) {
+            try {
+                const r = await canonicalizeTarget(opts.env, spelling, signal);
+                if (r.ok && !keys.includes(r.key))
+                    keys.push(r.key);
+            }
+            catch {
+            }
+        }
+        return keys;
+    };
     const guarded = new Set(opts.tools ?? DEFAULT_GUARDED_TOOLS);
     return {
         async check(req, signal) {
@@ -64,7 +110,16 @@ export function createSensitivePathPolicy(opts) {
                 }
                 return { action: "allow" };
             }
-            const hit = matchSensitive(canon.key, compiled, canon.aliasResolved === true);
+            let relative = null;
+            for (const rootKey of await dataRootKeys(signal)) {
+                relative = relativeUnderRoot(canon.key, rootKey);
+                if (relative !== null)
+                    break;
+            }
+            const judged = relative ?? canon.key;
+            if (relative === "")
+                return { action: "allow" };
+            const hit = matchSensitive(judged, compiled, canon.aliasResolved === true);
             if (hit) {
                 return {
                     action: "deny",

package/dist/core/task-notification.d.ts

@@ -167,11 +167,27 @@ export interface TaskNotificationPayload {
     crossSessionMessage?: import("../agents/cross-session-envelope.js").CrossSessionEnvelopeFields & {
         body: string;
     };
+    /**
+     * design/385 §4.4 / §5.2 (slice 4) — the CROSS-SESSION NOTICE carrier: a delivery receipt about one of
+     * THIS session's own outbound messages (held / denied / expired / delivered / refused / dropped) or an
+     * idle notice for a `notify_when_idle` ask (idle / exited / unavailable / expired), drained from this
+     * session's own box as a notice-kind record. Its PRESENCE is the render discriminator: the model reads
+     * the engine-rendered notice line as-is (CC injects `[Cross-session delivery notice] …` /
+     * `[Cross-session idle notice] …` as a plain user-frame line) — never a `<task-notification>` shell,
+     * never the peer-message envelope (a notice is engine speech about a peer, not a peer's words; the
+     * envelope would put it past the parity judgment as a peer's request). `text` is rendered by the
+     * drain from the record's TYPED `peerMeta.notice` (the authority); the record's own `content` mirror is
+     * never what reaches the model. Minted ONLY by the engine's session-box drain.
+     */
+    crossSessionNotice?: {
+        kind: "delivery_notice" | "idle_notice";
+        text: string;
+    };
     /**
      * design/385 §1.4 d1 / §4.1 — the engine-minted PROVENANCE side record of an engine-injected peer
      * frame, a typed key (never model text) so a host can attribute and correlate the injection on the
      * wire. Present exactly when {@link agentMessage} OR {@link crossSessionMessage} is — one record
-     * per carrier, `kind` naming which. Its fields are read per `kind` (see {@link SemaProvenance}):
+     * per carrier (the notice carrier {@link crossSessionNotice} too), `kind` naming which. Its fields are read per `kind` (see {@link SemaProvenance}):
      * on the agent-message lane `from` is the sender label the frame's attribute spells, `taskId` the
      * sender's run/agent id, `seq` the producer's per-frame counter (= this payload's `seq`) and
      * `agentType` the sender's resolved agent type when the producer knows it; on the cross-session
@@ -187,7 +203,7 @@ export interface SemaProvenance {
     /** `agent_message` = the same-process uplink (§1.4 d1); `cross_session_message` = the session-box
      *  drain (§4.1) — `from` is then the sender's ADDRESS, `taskId` the recipient's own box handle,
      *  `seq` the box seq, and the typed peer record rides in `peerMeta`. */
-    kind: "agent_message" | "cross_session_message";
+    kind: "agent_message" | "cross_session_message" | "cross_session_notice";
     from: string;
     taskId: string;
     seq: number;
@@ -307,6 +323,12 @@ export declare function renderAgentMessageFrame(frame: {
  * level, another block — sharing either would blur the classifier's lane judgment.
  */
 export declare function renderCrossSessionMessageFrame(frame: NonNullable<TaskNotificationPayload["crossSessionMessage"]>): string;
+/**
+ * design/385 §4.4 / §5.2 — render a cross-session notice line. The text is engine-authored from typed
+ * fields (every untrusted label inside it already passed the lane's label sanitizer); the reminder-tag
+ * defusal runs once more here so no carrier can smuggle a system-reminder into the model face.
+ */
+export declare function renderCrossSessionNoticeLine(notice: NonNullable<TaskNotificationPayload["crossSessionNotice"]>): string;
 export declare function renderTaskNotificationXml(n: TaskNotificationPayload): string;
 /**
  * The BETWEEN-TURNS pending lane. A task notification born while NO turn is

package/dist/core/task-notification.js

@@ -57,11 +57,16 @@ export function renderCrossSessionMessageFrame(frame) {
     const { body, ...fields } = frame;
     return `${buildCrossSessionEnvelope(fields, body)}\n\n${CROSS_SESSION_MESSAGE_NOTICE}`;
 }
+export function renderCrossSessionNoticeLine(notice) {
+    return sanitizeUntrustedText(notice.text);
+}
 export function renderTaskNotificationXml(n) {
     if (n.agentMessage !== undefined)
         return renderAgentMessageFrame(n.agentMessage);
     if (n.crossSessionMessage !== undefined)
         return renderCrossSessionMessageFrame(n.crossSessionMessage);
+    if (n.crossSessionNotice !== undefined)
+        return renderCrossSessionNoticeLine(n.crossSessionNotice);
     const usage = n.usage === undefined
         ? undefined
         : (() => {
@@ -217,7 +222,7 @@ export function discloseDroppedPending(drained) {
         if (dropped === undefined || disclosed.has(lane))
             return [n];
         disclosed.add(lane);
-        if (n.agentMessage !== undefined || n.crossSessionMessage !== undefined) {
+        if (n.agentMessage !== undefined || n.crossSessionMessage !== undefined || n.crossSessionNotice !== undefined) {
             const line = {
                 task_id: n.task_id,
                 task_type: n.task_type,

package/dist/core/tool-policy.d.ts

@@ -93,14 +93,25 @@ export type DecisionReason = (typeof DECISION_REASONS)[number];
  *
  * **Which windows `"timeout"` speaks for** (#114①, 2026-08-09 — the promise this note used to make was
  * wider than the code): the engine stamps it at the waits IT owns — `createApprovalPolicy`'s
- * `approvalTimeoutMs` window, and the durable park's TTL. The SYNCHRONOUS `onAsk` leg is not one of
- * them: there the deployment owns the window (the engine starts no timer for a callback it does not
- * schedule), so an unanswered card and a refused one arrive as the same `false` and the engine records
+ * `approvalTimeoutMs` window, the durable park's TTL, and (#548) the denial-limit fallback ask's
+ * auto-deny window. The SYNCHRONOUS `onAsk` leg is otherwise not one of them: there the deployment owns
+ * the window (the engine starts no timer for a callback it does not schedule), so an unanswered card and
+ * a refused one arrive as the same `false` and the engine records
  * `"human"` rather than inventing a cause it did not observe. A host that DOES time its own card out
  * can say so — {@link AskOutcome}'s object arm carries an optional `settledBy` for exactly this — but a
  * host that does not is indistinguishable, by construction. Read an absent `"timeout"` as "no window
  * the engine owns elapsed", never as "nobody's window elapsed".
  *
+ * **The one `onAsk` exception** (#548): a classifier DENIAL-LIMIT fallback ask — the ask that carries
+ * `denialLimitFallback`, minted when the auto-mode classifier reaches its consecutive/total bound —
+ * IS timed by the engine over the synchronous leg, because that ask exists to bound a classifier that
+ * would otherwise deny without end, and an unbounded wait would only move the "without end" onto the
+ * person. Its window elapsing produces an engine-stamped `settledBy: "timeout"` with
+ * `resolution: "window_expired"` and `autoDenied: true` on the deny — that last bit is the
+ * discriminator between core's window and a host self-report ({@link AskOutcome}'s object arm has no
+ * `autoDenied` seat, so a host cannot claim the word).
+ * `autoDenyAfterMs: 0` (or an ask with no fallback member) arms nothing, which is every other ask.
+ *
  * The three words are exhaustive and mutually exclusive over the ways an approval can end, and the
  * minimum discrimination a consumer needs — someone refused vs nobody answered — is `"human"` vs the
  * other two.
@@ -197,6 +208,17 @@ export type PermissionResult = {
     message?: string;
     decisionReason?: DecisionReason;
     requiresRealApproval?: boolean;
+    /** #548 (additive): this ask is the classifier DENIAL-LIMIT fallback — the block that reached a
+     *  bound (CC 2.1.250 `FO`, count-then-judge) handed to a person instead of being denied.
+     *  ENGINE-STAMPED beside `requiresRealApproval: true` and `decisionReason: "classifier"` at the
+     *  classifier block sites (the gate's own and the inherited-lane arms); carries the counts and
+     *  THIS ask's auto-deny window — see {@link import("./auto-mode.js").DenialLimitFallback}.
+     *  Consumers: the gate's classifier step refuses to re-judge an ask carrying it (the classifier
+     *  already spoke; rules and classifier stand BEFORE this ask, never after), and the ask resolver
+     *  arms its deadline from `autoDenyAfterMs`. Carried onto the approval request. A policy that
+     *  self-declares it only ever opts its own ask OUT of classifier resolution and INTO a bounded
+     *  wait (tightening — the same safe direction as `matchedAskRule`). */
+    denialLimitFallback?: import("./auto-mode.js").DenialLimitFallback;
     /** #144 disclosure (additive): a persisted allow rule MATCHED this call but could not clear the
      *  ask, because the ask is MANDATED (operator shellGate:"always", or the tool's own
      *  egress/irreversibility marks) rather than a classifier's hesitation — "allow rules silence
@@ -1163,6 +1185,13 @@ export interface AskRequest {
      *  clear this ask (see that field's doc). `readonly`, filled by the gate from the decision, never a
      *  caller/worker-settable field. */
     readonly requiresRealApproval?: boolean;
+    /** #548 (additive) — present ⇔ this ask is the classifier DENIAL-LIMIT fallback (see the
+     *  {@link PermissionResult} ask-arm member of the same name): the counts that tripped the bound and
+     *  this ask's own auto-deny window. Two readers: a card renders it as a countdown; {@link resolveAsk}
+     *  arms its deadline from `autoDenyAfterMs` (> 0 ⇒ an unanswered function approver auto-denies at
+     *  that deadline — `settledBy:"timeout"`, `resolution:"window_expired"`, `autoDenied:true`). Filled
+     *  by the gate from the decision, never a caller/worker-settable field. */
+    readonly denialLimitFallback?: import("./auto-mode.js").DenialLimitFallback;
     /** Engine-judged risk axes of the action awaiting approval, for the human decision surface: a
      *  coarse `requiresRealApproval` cannot tell "cannot be undone" from "data leaves the machine",
      *  and those call for different scrutiny. Filled by the gate from the SAME resolved axes the
@@ -1270,7 +1299,8 @@ export type OnAsk = "deny" | "allow" | ((req: AskRequest, signal?: AbortSignal)
  *
  * #114② (2026-08-09) — `settledBy` on the object arm is the SYNCHRONOUS leg's only channel for saying
  * what ended the wait. This leg's window belongs to the HOST (`onAsk` is a callback the deployment
- * owns; the engine starts no timer for it), so a host that timed its own approval card out could
+ * owns; the engine starts no timer for it — with the ONE #548 exception below), so a host that timed
+ * its own approval card out could
  * previously only report a plain `false`, which the engine correctly recorded as `"human"` — a person
  * refusing. The two words the host may self-report:
  *  - `"human"` — a person answered (identical to omitting the field);
@@ -1282,6 +1312,15 @@ export type OnAsk = "deny" | "allow" | ((req: AskRequest, signal?: AbortSignal)
  * (abort, throw, unavailable, out-of-contract value), each already stamped at its own arm, and a
  * self-reported one would let a host relabel its refusal as an engine failure.
  *
+ * #548 — the ONE ask on this leg the engine DOES time: a classifier denial-limit fallback (the ask
+ * carrying `denialLimitFallback` with a non-zero `autoDenyAfterMs`). Its window is core's, because
+ * the fallback exists to bound a classifier that would otherwise deny without end. When it elapses
+ * the approver's promise is DETACHED (design/384: the wait is released, not cancelled — an approver
+ * that answers afterwards is not consulted, and an `allow` it returns late becomes the
+ * `task.late_approval` notice), and the engine's own deny carries `settledBy: "timeout"`,
+ * `resolution: "window_expired"` and `autoDenied: true`. See {@link ApprovalSettledBy} for how a
+ * consumer tells that window from the host's.
+ *
  * `reason` — the SYNCHRONOUS leg's seat for a model-readable reason attached to a deny, the exact
  * counterpart of the durable leg's `ResumeOutcome` `policy_ask` `reason` ("Model-readable reason
  * attached to a deny"): the words the decider typed with their "no" (an approval card's rejection
@@ -1416,6 +1455,12 @@ export declare const ASK_DENY_RESOLUTION_VALUES: readonly AskDenyResolution[];
  *  files or forwards the word (a policy layer could self-declare the member on its own deny; an
  *  out-of-vocabulary word is dropped by the carriers, never coerced or forwarded). */
 export declare function isAskDenyResolution(v: unknown): v is AskDenyResolution;
+/** #548: the engine-attested auto-deny marker off a funneled decision, bound to the named call like
+ *  {@link coreMintedResolutionOf} (absent ⇒ not an attested auto-deny of THIS call). */
+export declare function coreMintedAutoDeniedOf(d: unknown, call: {
+    toolCallId: string;
+    toolName: string;
+}): boolean;
 /** Read the engine-attested resolution off a funneled decision (the gate's single deny exit is the
  *  one consumer), FOR the named call: an attestation bound to a different toolCallId/toolName is a
  *  replayed object, not this call's settlement — the reader answers absence (the safe direction; the
@@ -1452,6 +1497,12 @@ export type ResolvedAsk = PermissionResult & {
      *  text; stamped only at the composing arm. Not stamped on the timeout deny (nobody answered)
      *  or on any engine-produced fail-closed refusal. */
     humanRefusalNote?: true;
+    /** #548 — present exactly when this deny is the classifier denial-limit fallback's AUTO-DENY: the
+     *  ask's own window (`AskRequest.denialLimitFallback.autoDenyAfterMs`, CC `AKe`) elapsed with no
+     *  answer. Rides beside `settledBy:"timeout"` / `resolution:"window_expired"` (the established approval
+     *  factory's deadline arm speaks the same two words, so a consumer classifying on them needs no new
+     *  branch) and says WHOSE window it was: core's, not the host's. Stamped only at the composing arm. */
+    autoDenied?: true;
     /** The deny-arm classification (see {@link AskDenyResolution}) — present on every deny this
      *  resolver composes, absent on every allow. Carried by the gate to its block exit, the
      *  permission-denied observer payload and the settlement sideband (thence the call's `tool_end`

package/dist/core/tool-policy.js

@@ -382,6 +382,7 @@ export function combinePolicies(...policies) {
             let settled;
             let ruleAskText;
             let probeMandateSeen = false;
+            let fallbackSeen;
             for (const p of policies) {
                 const d = refuseOutOfContractDecision(await p.check(current, signal));
                 if (d.action === "deny") {
@@ -411,12 +412,15 @@ export function combinePolicies(...policies) {
                 }
                 if (d.action === "ask" && d.probeMandated === true)
                     probeMandateSeen = true;
+                if (d.action === "ask" && d.denialLimitFallback !== undefined && fallbackSeen === undefined)
+                    fallbackSeen = d.denialLimitFallback;
             }
             if (asked) {
                 const merged = rewrite?.updatedInput;
                 const withRuleAsk = ruleAskText !== undefined && asked.matchedAskRule === undefined ? { ...asked, matchedAskRule: ruleAskText } : asked;
                 const withMark = probeMandateSeen && withRuleAsk.probeMandated !== true ? { ...withRuleAsk, probeMandated: true } : withRuleAsk;
-                return merged !== undefined ? { ...withMark, updatedInput: merged } : withMark;
+                const withFallback = fallbackSeen !== undefined && withMark.denialLimitFallback === undefined ? { ...withMark, denialLimitFallback: fallbackSeen, requiresRealApproval: true } : withMark;
+                return merged !== undefined ? { ...withFallback, updatedInput: merged } : withFallback;
             }
             const allowed = rewrite ?? ALLOW;
             return settled !== undefined ? { ...allowed, settledBy: settled } : allowed;
@@ -919,10 +923,16 @@ export function isAskDenyResolution(v) {
     return typeof v === "string" && ASK_DENY_RESOLUTION_SET.has(v);
 }
 const coreMintedResolutions = new WeakMap();
-function withCoreMintedResolution(d, resolution, call) {
-    coreMintedResolutions.set(d, { resolution, toolCallId: call.toolCallId, toolName: call.toolName });
+function withCoreMintedResolution(d, resolution, call, autoDenied) {
+    coreMintedResolutions.set(d, { resolution, toolCallId: call.toolCallId, toolName: call.toolName, ...(autoDenied === true ? { autoDenied: true } : {}) });
     return d;
 }
+export function coreMintedAutoDeniedOf(d, call) {
+    if (typeof d !== "object" || d === null)
+        return false;
+    const v = coreMintedResolutions.get(d);
+    return v !== undefined && v.toolCallId === call.toolCallId && v.toolName === call.toolName && v.autoDenied === true;
+}
 export function coreMintedResolutionOf(d, call) {
     if (typeof d !== "object" || d === null)
         return undefined;
@@ -1006,7 +1016,7 @@ export function carriesBidiControls(value, limits) {
 export async function resolveAsk(req, onAsk, signal, onLateSettlement) {
     const r = await resolveAskArms(req, onAsk, signal, onLateSettlement);
     if (r.action === "deny" && isAskDenyResolution(r.resolution))
-        return withCoreMintedResolution(r, r.resolution, req);
+        return withCoreMintedResolution(r, r.resolution, req, r.autoDenied === true ? true : undefined);
     return r;
 }
 function raceAskWaitAgainstSignal(wait, signal) {
@@ -1110,7 +1120,20 @@ async function resolveAskArms(req, onAsk, signal, onLateSettlement) {
             args: approverView.value,
             ...(bidi ? { hasBidiControls: true } : {}),
         }, signal));
-        const raced = await raceAskWaitAgainstSignal(wait, signal);
+        const windowMs = req.denialLimitFallback !== undefined && req.denialLimitFallback.autoDenyAfterMs > 0 ? req.denialLimitFallback.autoDenyAfterMs : undefined;
+        const raced = await withTimeout(raceAskWaitAgainstSignal(wait, signal), windowMs, () => DEADLINE_ELAPSED);
+        if (raced === DEADLINE_ELAPSED) {
+            detachLateAskWait(wait, onLateSettlement);
+            return {
+                action: "deny",
+                message: `no one answered the classifier denial-limit approval for "${req.toolName}" — the ${String(windowMs)}ms window ` +
+                    `elapsed with no answer; auto-denied: ${req.message}`,
+                decisionReason: "mode",
+                resolution: "window_expired",
+                settledBy: "timeout",
+                autoDenied: true,
+            };
+        }
         if (raced.tag === "aborted") {
             detachLateAskWait(wait, onLateSettlement);
             return { action: "deny", message: `approval aborted for "${req.toolName}" (run or turn interrupted)`, decisionReason: "mode",