@sema-agent/core 7.33.8 → 7.34.0

package/dist/core/runner/run-turn-boundary.js

@@ -283,7 +283,7 @@ export function createTurnBoundary(input) {
                     cadenceTurn: rs.counters.cadenceTurns,
                     todoMounted: todoToolMounted,
                     taskListMounted: taskToolsMounted,
-                    planActive: prepared.planModeRef.active,
+                    planActive: prepared.permissionMode.current === "plan",
                     config: {
                         todoReminder: rs.attach.attachmentsCfg?.todoReminder === true,
                         ...(rs.attach.attachmentsCfg?.todoReminderMode !== undefined ? { todoReminderMode: rs.attach.attachmentsCfg.todoReminderMode } : {}),

package/dist/core/runner/runtask.js

@@ -40,6 +40,7 @@ import { streamReap } from "./stream-reap.js";
 import { streamSteerVerb } from "./stream-steer-verb.js";
 import { streamLifecycleVerbs } from "./stream-lifecycle-verbs.js";
 import { streamHaltVerbs } from "./stream-halt-verbs.js";
+import { streamModeVerb } from "./stream-mode-verb.js";
 import { runNotificationLane } from "./run-notification-lane.js";
 import { assertNoRetiredRunnerDeps } from "./retired-runner-deps.js";
 import { runLeg } from "./run-leg.js";
@@ -417,6 +418,7 @@ export class Runner {
         const { steer } = streamSteerVerb({ spec, internals, queue, acceptedSteerInputs, live, ready, orTimeout, readyTimeoutMs: READY_TIMEOUT_MS, steeringError, runner: this.depsSeat });
         const { notify, optOutMemoryCapture, reconnectMcpServer, compact, detach, interrupt } = streamLifecycleVerbs({ live, ready, orTimeout, steeringError, notifyRef, captureOptOutRef, mcpRedialRef, manualCompactRef, detachHub });
         const { halt, destroy } = streamHaltVerbs({ spec, live, ready, orTimeout, readyTimeoutMs: READY_TIMEOUT_MS, run, reapSuspended, runner: this.depsSeat });
+        const { setPermissionMode } = streamModeVerb({ live, ready, orTimeout, steeringError });
         return {
             [Symbol.asyncIterator]: () => queue[Symbol.asyncIterator](),
             result: async () => {
@@ -430,6 +432,7 @@ export class Runner {
             steer,
             notify,
             optOutMemoryCapture,
+            setPermissionMode,
             reconnectMcpServer,
             compact,
             detach,

package/dist/core/runner/stream-mode-verb.d.ts

@@ -0,0 +1,27 @@
+/**
+ * The TaskStream façade's PERMISSION-MODE verb: `setPermissionMode` — the one entrance a running leg's mode changes
+ * through (a shell's mode toggle, a serving layer's `permission_mode` control frame). ONE read of the argument at the
+ * wire boundary, the steer lane's liveness gate, then the leg's live mode seat: the requested word is rewritten, the
+ * fold against the deployment's deny bits and the classifier face is re-judged (a fold is announced by the seat), a
+ * leg that became `auto` arms its classifier, and the same three-member receipt the wiring manifest carries comes
+ * back — EVERY call answers one, whether or not the effective mode moved, so a caller never has to render
+ * optimistically. The next tool call reads the new mode at the gate's arbitration point; a child leg derives its own
+ * effective mode from this seat on its next read (no forwarding frame).
+ */
+import type { TaskStream } from "../types.js";
+import type { LiveHandle, TaskStreamLiveSeat } from "./contracts.js";
+export interface StreamModeVerbInput {
+    /** borrowed-readonly — the stream's live state: `resultValue` (the finished-task refusal) and `handle` (the mode seat rides it). */
+    live: TaskStreamLiveSeat;
+    /** borrowed-readonly — the readiness promise the verb awaits before it touches the handle. */
+    ready: Promise<LiveHandle | undefined>;
+    /** borrowed-readonly — the driver's timeout race: a wedged prepare cannot hang the verb on `ready`. */
+    orTimeout: <T>(p: Promise<T>) => Promise<T | undefined>;
+    /** borrowed-readonly — the driver's refusal factory, the steer verb's own `steeringError` seat. */
+    steeringError: (msg: string, code?: string) => Error;
+}
+export interface StreamModeVerbResult {
+    /** The stream's `setPermissionMode` verb. */
+    setPermissionMode: TaskStream["setPermissionMode"];
+}
+export declare function streamModeVerb(input: StreamModeVerbInput): StreamModeVerbResult;

package/dist/core/runner/stream-mode-verb.js

@@ -0,0 +1,19 @@
+import { isPermissionMode, PERMISSION_MODES } from "../ask-origin.js";
+export function streamModeVerb(input) {
+    const { live, ready, orTimeout, steeringError } = input;
+    const setPermissionMode = async (mode) => {
+        const modeIn = mode;
+        if (!isPermissionMode(modeIn)) {
+            const e = new Error(`cannot set the permission mode: it must be one of ${PERMISSION_MODES.join("/")} (got ${JSON.stringify(modeIn)})`);
+            e.code = "steering.invalid_content";
+            throw e;
+        }
+        if (live.resultValue)
+            throw steeringError("the task has already finished");
+        const h = live.handle ?? (await orTimeout(ready));
+        if (!h)
+            throw steeringError("the task is not running");
+        return h.permissionMode.steer(modeIn);
+    };
+    return { setPermissionMode };
+}

package/dist/core/runner/turn-attachments.d.ts

@@ -419,9 +419,9 @@ export interface AttachmentInputs {
     todoMounted: boolean;
     /** Whether the task-family tools are mounted. Both mounted ⇒ task_reminder wins (CC isTodoV2 branch). */
     taskListMounted: boolean;
-    /** Live plan-mode flag (planModeRef.active). One-way in sema: exit re-prepares the run, so a false
-     *  here simply stops the producer — no re-entry cycle reset is needed (documented deviation from CC's
-     *  countPlanModeAttachmentsSinceLastExit, which sema's lifecycle makes unreachable). */
+    /** Whether the leg's effective permission mode is `plan` right now (the one mode seat, whichever entrance set it:
+     *  the spec's word, a steer, the model's EnterPlanMode). A false here simply stops the producer — no re-entry cycle
+     *  reset (documented deviation from CC's countPlanModeAttachmentsSinceLastExit). */
     planActive: boolean;
     /** SR-3 budget_usd lane (CC 198 `QFm` producer :480424-480428 + renderer :600225; 220 `_Fy` @609096
      *  with the mount at @607474): the run's cost progress against its $ ceiling, in USD. Only passed

package/dist/core/runner/turn-attachments.js

@@ -761,7 +761,7 @@ function mcpDroppedToolsBound(inp) {
     const single = first === undefined ? 0 : MCP_DROPPED_FIXED_MAX_BYTES + bytes(first.tool) + bytes(first.server) + bytes(first.reason) + 32;
     return Math.max(MCP_DROPPED_BATCH_MAX_BYTES, single);
 }
-const PLAN_MODE_FULL_BODY = `Plan mode is active. The user indicated that they do not want you to execute yet -- you MUST NOT make any edits, run any non-readonly tools (including changing configs or making commits), or otherwise make any changes to the system. This supercedes any other instructions you have received. Instead, you should: research and analyze with read-only tools, and when you have formed a concrete plan, present it with the ${PRESENT_PLAN_TOOL_NAME} tool for approval. That tool inherently requests plan approval — never ask for approval via plain text.`;
+const PLAN_MODE_FULL_BODY = `Plan mode is active. The user indicated that they do not want you to execute yet -- you MUST NOT make any edits, run any non-readonly tools (including changing configs or making commits), or otherwise make any changes to the system — every such call asks the user first, and is refused where nobody can answer. This supercedes any other instructions you have received. Instead, you should: research and analyze with read-only tools, and when you have formed a concrete plan, present it with the ${PRESENT_PLAN_TOOL_NAME} tool for approval. That tool inherently requests plan approval — never ask for approval via plain text.`;
 const PLAN_MODE_SPARSE_BODY = `Plan mode still active (see full instructions earlier in conversation). Read-only: no edits, commits, or config changes. When your plan is ready, present it with the ${PRESENT_PLAN_TOOL_NAME} tool for approval. Never ask about plan approval via plain text.`;
 const TRUNCATION_MARKER = "\n…[truncated]";
 const MIN_KEEP_BYTES = 160;

package/dist/core/runner/write-protection-station.d.ts

@@ -24,6 +24,12 @@ import type { ExecutionEnv } from "../../internal/harness.js";
 import type { RunnerDeps } from "../runner-deps.js";
 import type { ToolRoster } from "../tool-roster.js";
 import { type WriteProtectionMount } from "../write-protect.js";
+import type { ShellReadBoundary } from "../../tools/fs/shell-read-judge.js";
+/** The leg's mount plus the same judge over a bare ABSOLUTE target — what the shell station asks about each write target
+ *  a command names (`ShellReadBoundary.writeProtectionJudge`): `true` ⇔ a row covers it. */
+export interface LegWriteProtection extends WriteProtectionMount {
+    readonly judgeTarget: NonNullable<ShellReadBoundary["writeProtectionJudge"]>;
+}
 export declare function mountWriteProtection(input: {
     /** borrowed-readonly — the deployment seats: the table (`writeProtectedPaths`; absent ⇒ the default
      *  table, `[]` ⇒ opted out), the data root the memory library is materialized under
@@ -38,4 +44,4 @@ export declare function mountWriteProtection(input: {
     roster: ToolRoster;
     sessionId: string;
     runId: string;
-}): WriteProtectionMount | undefined;
+}): LegWriteProtection | undefined;

package/dist/core/runner/write-protection-station.js

@@ -1,10 +1,10 @@
 import { deliverEngineNotice } from "../engine-notice.js";
 import { protectivePathTargetOf } from "../tool-registry.js";
-import { createWriteProtectionCheck } from "../write-protect.js";
+import { compileWriteProtection, writeProtectionMountOver } from "../write-protect.js";
 const ABSENCE_REASON = { symlink: "unresolved-symlink", target: "unresolvable-target" };
 export function mountWriteProtection(input) {
     const announced = new Set();
-    const mount = createWriteProtectionCheck(input.deps.writeProtectedPaths, {
+    const matcher = compileWriteProtection(input.deps.writeProtectedPaths, {
         ...(input.deps.memoryEngineDir !== undefined ? { dataRoot: input.deps.memoryEngineDir } : {}),
         ...(input.env !== undefined ? { env: input.env } : {}),
         rootPath: input.rootPath,
@@ -25,7 +25,10 @@ export function mountWriteProtection(input) {
             });
         },
     });
-    if (mount === undefined || mount.targetView !== "spelling-only")
+    if (matcher === undefined)
+        return undefined;
+    const mount = { ...writeProtectionMountOver(matcher, input.rootPath), judgeTarget: async (target, opts) => (await matcher.judge(target, { ...(opts?.signal !== undefined ? { signal: opts.signal } : {}), ...(opts?.canonical === true ? { canonical: true } : {}) })).kind === "hit" };
+    if (mount.targetView !== "spelling-only")
         return mount;
     const covered = input.roster.entries
         .filter((e) => [e.name, ...e.aliases].some((name) => {

package/dist/core/runner-deps.d.ts

@@ -204,12 +204,11 @@ export interface RunnerDeps {
      */
     readDenyPatterns?: readonly import("../tools/fs/read-deny.js").ReadDenyEntry[];
     /**
-     * The deployment's built-in deny-table TIER selection — the ON/OFF switch for the whole built-in
-     * table, OFF unless this seat says otherwise. EXACTLY the listed tiers of
-     * {@link import("../tools/fs/read-deny.js").READ_FACE_BUILTIN_DENY_TABLE} are active (`[]` = none —
-     * explicit and legal); ABSENT = {@link import("../tools/fs/read-deny.js").READ_DENY_DEFAULT_TIERS},
-     * which is EMPTY: an unconfigured deployment activates no built-in row, so nothing from that table
-     * refuses a read or demotes a shell one. A leg's active tiers are REPORTED on its wiring manifest
+     * The deployment's built-in deny-table TIER selection — the switch for the built-in table. EXACTLY the
+     * listed tiers of {@link import("../tools/fs/read-deny.js").READ_FACE_BUILTIN_DENY_TABLE} are active (`[]` =
+     * none — explicit and legal: nothing from that table refuses a read); ABSENT =
+     * {@link import("../tools/fs/read-deny.js").READ_DENY_DEFAULT_TIERS} (`credentials` and the home-anchored
+     * `agent-config`). A leg's active tiers are REPORTED on its wiring manifest
      * ({@link import("./wiring-manifest.js").WiringManifest.readDeny}). Composes with
      * {@link readDenyBuiltinExclude} (tiers first, then row removal); never touches the additions
      * seats or the write faces. Unknown tier names refuse loudly at prepare (#123). DEPLOYMENT seat
@@ -633,9 +632,9 @@ export interface RunnerDeps {
      * `autoMode` (the per-principal deny bit of the user-enabled auto mode), `allowMemoryOptOut` (may this
      * principal declare a capture opt-out), and `forceDurableGate` (forces a run onto the durable-approval
      * path so a policy `ask` suspends to the wire — where a checkpoint store is wired; a store-less leg
-     * announces `config.durable_gate_unavailable`). `allowUltracode` is a shell/UX concern (reasoning-tier,
-     * not a core primitive); `allowBypassPermissions` is enforced at the service settings-resolution layer
-     * (the engine sees only a resolved policy, never a "this allow came from bypass" signal).
+     * announces `config.durable_gate_unavailable`), and `bypassPermissions` (the deny bit of the
+     * `bypassPermissions` mode — a denied request folds to `default`, announced). `allowUltracode` is a shell/UX
+     * concern (reasoning-tier, not a core primitive).
      */
     runtimeCapsResolver?: (principal: string | undefined) => RuntimeCaps | undefined | Promise<RuntimeCaps | undefined>;
     /**
@@ -705,7 +704,7 @@ export interface RunnerDeps {
     /**
      * design/143 批2b — the auto-mode classifier's DEPLOYMENT assembly face. This is the
      * CAPABILITY arm of the three-arm arming: a run arms auto mode only when the task carries the
-     * auto-mode INTENT ({@link TaskSpec.autoModeRequested}, or the same bit inherited on the chain by an
+     * auto-mode INTENT (`TaskSpec.permissionMode: "auto"`, or the mode inherited on the chain by an
      * engine-spawned child) AND this face is present AND the per-principal DENY bit is not set
      * ({@link RuntimeCaps.autoMode}` !== false` — absent is not a denial).
      *
@@ -717,6 +716,14 @@ export interface RunnerDeps {
      * `summarize → default`; tier default `flash`) via the brain's simple-completion pipe — same
      * lane as compaction/consolidation, no tools, no session writes.
      */
+    /**
+     * The deployment's A2A peer switches. `isolatePeers: true` makes every A2A peer skill's egress default an
+     * OPERATOR mandate: its ask is `operator_forced` (kept under `bypassPermissions`, not settled by `dontAsk`)
+     * instead of the releasable `tool_marks_a2a`. Absent ⇒ the default (a permission mode may release it, disclosed).
+     */
+    a2a?: {
+        isolatePeers?: true;
+    };
     autoMode?: {
         /** Rule overrides for the four permissions sections (omitted section = CC defaults verbatim). */
         rules?: import("./auto-mode-prompt.js").AutoModeRules;
@@ -726,9 +733,15 @@ export interface RunnerDeps {
         sessionContext?: readonly string[];
         /** Transcript-window bounds for the classify prompt (defaults: 40 entries / 2000 chars each). */
         window?: import("./auto-mode-prompt.js").AutoModeWindowOptions;
-        /** Classify round-trip cap, ms (default 15_000) — ONE ladder rung (see `classifierFallback`), not the
-         *  whole classification. A rung past the cap did not rule: the walk moves to the next candidate, and with
-         *  none left the call is DENIED with a sentence that says so. The next call is classified afresh. */
+        /** Classify round-trip cap, ms — ONE ladder rung (see `classifierFallback`), not the whole classification;
+         *  default `AUTO_MODE_DEFAULT_TIMEOUT_MS` (180 000, sized for a self-hosted gateway's queue + prefill; worst
+         *  case two rungs = 360 s). A rung past the cap did not rule: the walk moves to the next candidate; with none
+         *  left the classification is `unavailable` — the call goes on to a person where the leg has an approval seat
+         *  (a live approver or a durable park), and is DENIED with a sentence that says so where it has none; the
+         *  user hears it either way (`classifier.unavailable`). The next call is classified afresh. A present value
+         *  that is not a number of milliseconds in [1, 2147483647] is REFUSED loudly at every leg's prepare while this face
+         *  is present, whatever mode the leg starts in (`config.auto_mode_timeout_invalid`) — never clamped, never read as the
+         *  default; there is no OFF. */
         timeoutMs?: number;
         /**
          * What a classification does when the classifier SEAT does not rule (the leg threw / rejected, the cap
@@ -744,8 +757,8 @@ export interface RunnerDeps {
          * (worst case two `timeoutMs` caps); `"none"` buys that back for the deny.
          *
          * A value outside the closed set ({@link import("./auto-mode.js").AUTO_MODE_CLASSIFIER_FALLBACKS}) is
-         * REFUSED loudly at prepare (`config.auto_mode_classifier_fallback_invalid`) — never clamped, never read
-         * as the default.
+         * REFUSED loudly at every leg's prepare while this face is present, whatever mode the leg starts in
+         * (`config.auto_mode_classifier_fallback_invalid`) — never clamped, never read as the default.
          */
         classifierFallback?: import("./auto-mode.js").AutoModeClassifierFallback;
         /**
@@ -764,8 +777,9 @@ export interface RunnerDeps {
          * the run STOPS with `TaskResult.errorCode = "classifier.denial_limit"` (a notice of the same
          * code is minted).
          *
-         * Every member optional (defaults 3 / 20 / 120_000). A present member with a bad value is refused
-         * loudly at prepare — never clamped, never silently read as the default.
+         * Every member optional (defaults 3 / 20 / 120_000). A present member with a bad value, a member that is
+         * not one of the three, or a value that is not a record, is refused loudly at every leg's prepare while this face is present, whatever mode the
+         * leg starts in (`config.auto_mode_denial_limit_invalid`) — never clamped, never silently read as the default.
          * See {@link import("./auto-mode.js").AutoModeDenialLimitOptions}.
          */
         denialLimit?: import("./auto-mode.js").AutoModeDenialLimitOptions;
@@ -1354,23 +1368,6 @@ export interface RunnerDeps {
      * deployment wires the factory.
      */
     executionEnvFactory?: import("./remote-env.js").ExecutionEnvFactory;
-    /**
-     * design/77 §1 Gate-1 (oracleIsolation) — a **DISTINCT** trusted control-plane factory that mints the
-     * ISOLATED grader env an out-of-process oracle grades in (the 4th auto-promote gate). It is a SIBLING of
-     * {@link executionEnvFactory}, never the same env: the worker runs in `executionEnvFactory`'s env, the
-     * grader in `graderEnvFactory`'s — so a worker can't corrupt the env that judges it. It inherits the exact
-     * same trust contract: `TaskSpec` deliberately has NO env field (design/44 §7 Q4), so an untrusted caller
-     * can never inject/swap a grader env and grade itself; only the trusted deployment wires this factory. The
-     * RESERVED SEAM, stated plainly (ruled 2026-08-04, field-liveness review): the engine has NO call
-     * site for this factory today — nothing mints, wraps, or asserts through it yet. The intended wirer
-     * is the hardened-grader path a deployment builds on its remote-env side (the k8s pod-spec-patch
-     * seam is the documented server-side half); when that live runner lands, the env it mints is to be
-     * wrapped in a {@link import("./oracle-isolation.js").GraderEnv} and asserted via
-     * {@link import("./oracle-isolation.js").assertOracleIsolation} before any positive oracle verdict.
-     * **Auto-promote stays mandate-OFF until the four gates are implemented + verified end-to-end** (design/77
-     * §7); this seam only makes auto-accept implementable — it does not turn it on.
-     */
-    graderEnvFactory?: import("./remote-env.js").ExecutionEnvFactory;
     /**
      * Containment root for the file tools (design/44 §4 invariant 7): every path must resolve within it,
      * else the tool rejects (`PathNotInRoot`). Default `process.cwd()`. A defense-in-depth guard rail at the

package/dist/core/runtime-caps.d.ts

@@ -81,8 +81,8 @@ export interface WorkflowGovernanceBaseline {
  *  · GRANT-shaped, `=== true` opts in / absent is OFF: {@link allowObservers};
  *  · FORCE-shaped, `true` mandates / absent is the caller's opt-in default: {@link forceDurableGate}
  *    (binds only where a checkpoint store is wired; announced `config.durable_gate_unavailable` where none is).
- * These six are the caps the ENGINE enforces; `allowUltracode`/`allowBypassPermissions` are shell-UX /
- * service-settings-layer concerns (see {@link RunnerDeps.runtimeCapsResolver}).
+ * These seven are the caps the ENGINE enforces — {@link bypassPermissions} is the seventh, the deny bit of the
+ * `bypassPermissions` mode; `allowUltracode` stays a shell-UX concern (see {@link RunnerDeps.runtimeCapsResolver}).
  */
 /**
  * #692 C-d — WHICH plane's ratchet denied auto mode, when the resolver knows: the three settings sources
@@ -135,7 +135,7 @@ export interface RuntimeCaps {
     /**
      * The per-principal auto-mode DENY bit (CC 2.1.250 polarity — the mirror of the settings-plane
      * `permissions.disableAutoMode` ratchet: an organization may only take auto mode AWAY; it is the
-     * USER who turns it on, at the task's intent seat {@link TaskSpec.autoModeRequested}).
+     * USER who turns it on, by requesting the mode at {@link TaskSpec.permissionMode}).
      *
      * **POLARITY: `=== false` DENIES; ABSENT IS NOT A DENIAL.** This is the family's deny-shaped
      * member (like {@link allowWorkflows} / {@link allowFork}), NOT a grant-shaped one like
@@ -157,6 +157,15 @@ export interface RuntimeCaps {
      * manifest) — a source named for a denial that did not happen is a marshalling error, never a fact.
      */
     autoModeDenySource?: AutoModeDenySource;
+    /**
+     * The per-principal `bypassPermissions` DENY bit — the engine seat of the settings-plane
+     * `permissions.disableBypassPermissionsMode: "disable"` ratchet. **`=== false` DENIES; ABSENT IS NOT A DENIAL**
+     * (the family's deny shape, like {@link autoMode}). A task that requests `bypassPermissions` on a leg whose
+     * caps carry `false` runs in `default` instead, announced once (`config.permission_mode_unavailable`,
+     * `by: "operator_deny"`) and reported on `wiring_manifest.permissionMode` — a mode declaration is folded, never
+     * a 4xx. A steer into `bypassPermissions` on such a leg folds the same way.
+     */
+    bypassPermissions?: boolean;
     /**
      * design/383 §3.1 — may this principal declare a session memory-capture OPT-OUT
      * (`TaskSpec.memory.capture: "off"` / the Runner flip verb)? `false` = the deployment REQUIRES

package/dist/core/safety-axis-vocab.d.ts

@@ -25,8 +25,8 @@ export declare const SAFETY_AXIS_VOCABULARY: {
     readonly safetyAxis: readonly ["egress", "irreversible", "shell"];
     /** `RiskDescriptor.severity` — ToolEmu-style tier (5 = most severe), the inbox triage key (checkpoint-store.ts:85). */
     readonly severity: readonly [1, 2, 3, 4, 5];
-    /** `TaskSpec.shellGate` (declared in core/types.ts) — deployment shell-command gate rank, `off` < `classify` < `always`. */
-    readonly shellGate: readonly ["off", "classify", "always"];
+    /** `TaskSpec.shellGate` (declared in core/types.ts) — the operator's shell floor; one value (`always`). */
+    readonly shellGate: readonly ["always"];
     /** `ToolPolicy` decision — per-tool adjudication; `deny` short-circuits the `deny > ask > allow` fold (tool-policy.ts). */
     readonly permissionDecision: readonly ["allow", "ask", "deny"];
 };

package/dist/core/safety-axis-vocab.js

@@ -4,7 +4,7 @@ export const SAFETY_AXIS_VOCABULARY = {
     irreversibility: ["never", "maybe", "always"],
     safetyAxis: ["egress", "irreversible", "shell"],
     severity: [1, 2, 3, 4, 5],
-    shellGate: ["off", "classify", "always"],
+    shellGate: ["always"],
     permissionDecision: ["allow", "ask", "deny"],
 };
 const _toolEffectExhaustive = true;

package/dist/core/sensitive-path-policy.d.ts

@@ -11,7 +11,9 @@ import type { ToolPolicy } from "./tool-policy.js";
  *
  * @contract sensitive_paths.agent_config_tier_is_shared — the write deny set's agent-configuration
  * block IS the read face's `agent-config` tier, row for row: one table, two judges, and the two faces
- * cannot drift into disagreeing about which files are an agent's own configuration. The CONFIGURATION
+ * cannot drift into disagreeing about which files are an agent's own configuration. The block carries each
+ * row's RUN: the read rows are home-anchored (a project's same-named file reads), while this write set judges
+ * each run anywhere, so a project's own configuration file stays a refused write here. The CONFIGURATION
  * DIRECTORIES (`.claude`, `.sema`) are on neither face's deny side — their write guard is ASK
  * severity, where an approver or a persisted allow rule can clear it. Their `hooks/` and `agents/`
  * sub-directories are the two exceptions and they are NOT part of this mirror: a hook script is an executable
@@ -30,7 +32,7 @@ export declare function agentConfigDenyPatterns(): readonly string[];
  * globs): each pattern is a `/`-separated run of path SEGMENTS; `*` matches any run of non-slash chars
  * within one segment and is the ONLY metacharacter (everything else, `?` included, is literal); the run
  * may match ANYWHERE in the canonical path (so `.ssh` covers `~/.ssh/…` and any other `.ssh` directory —
- * home-anchoring like `~/` is NOT part of the syntax, do not prefix it). A pattern that reduces to zero
+ * home-anchoring like `~/` is NOT part of the syntax: a pattern opening with it is refused at wiring). A pattern that reduces to zero
  * segments is a wiring ERROR (it would guard nothing) and throws rather than being dropped.
  * Remember this policy guards WRITES only; reads are out of scope by design.
  *

package/dist/core/sensitive-path-policy.js

@@ -1,12 +1,12 @@
 import { homedir } from "node:os";
 import { isAbsolute, join, resolve } from "node:path";
 import { canonicalizeTarget, expandHomeTilde, isAbsoluteForFamily, isWinFormPath, pathFamilyOf, writeTargetPath } from "../tools/fs/safety.js";
-import { compileSegmentPattern, matchSegmentPatterns, READ_FACE_BUILTIN_DENY_TABLE } from "../tools/fs/read-deny.js";
+import { compileSegmentPattern, matchSegmentPatterns, READ_FACE_BUILTIN_DENY_TABLE, readDenyPatternRun } from "../tools/fs/read-deny.js";
 import { isProtectedWrite, protectivePathTargetOf } from "./tool-registry.js";
 import { pathTargetBaseOf } from "./effective-path-target.js";
 import { symlinkChainHops } from "./path-identity.js";
 export function agentConfigDenyPatterns() {
-    return READ_FACE_BUILTIN_DENY_TABLE.filter((row) => row.tier === "agent-config").map((row) => row.pattern);
+    return READ_FACE_BUILTIN_DENY_TABLE.filter((row) => row.tier === "agent-config").map((row) => readDenyPatternRun(row.pattern).run);
 }
 export const RECOMMENDED_SENSITIVE_PATTERNS = [
     ".env",
@@ -95,6 +95,11 @@ export function relativeUnderRoot(targetKey, rootKey) {
 function compilePatterns(patterns) {
     const out = [];
     for (const raw of patterns) {
+        const { homeAnchored, run } = readDenyPatternRun(raw);
+        if (homeAnchored) {
+            throw new Error(`createSensitivePathPolicy: pattern ${JSON.stringify(raw)} opens with the home word "~", which this write list does not place — its patterns are judged anywhere in the real target. ` +
+                `Spell the segments without it (${JSON.stringify(run)}), which covers the home's file and every same-named one.`);
+        }
         const compiled = compileSegmentPattern(raw, CASE_INSENSITIVE_FS ? "unicode" : "none");
         if (compiled === null) {
             throw new Error(`createSensitivePathPolicy: pattern ${JSON.stringify(raw)} contains no path segments and would guard nothing. ` +
@@ -111,7 +116,33 @@ export function createSensitivePathPolicy(opts) {
     const compiled = compilePatterns(opts.patterns);
     const dataRootPaths = dataRootSpellings(opts.dataRoot);
     const guardedByName = opts.tools !== undefined ? new Set(opts.tools) : undefined;
+    const family = (cwd) => pathFamilyOf({ root: opts.rootPath, cwd: cwd ?? opts.env.cwd });
+    const judgeTarget = async (path, fam, base, signal) => {
+        const canon = await canonicalizeTarget(opts.env, path, signal, fam, base);
+        if (!canon.ok)
+            return { kind: "unresolved", unresolvedSymlink: canon.unresolvedSymlink === true, cause: canon.refused ?? canon.message };
+        let relative = null;
+        for (const rootKey of await canonicalDataRootKeys(opts.env, dataRootPaths, signal)) {
+            relative = relativeUnderRoot(canon.key, rootKey);
+            if (relative !== null)
+                break;
+        }
+        if (relative === "")
+            return { kind: "clear" };
+        const hit = matchSensitive(relative ?? canon.key, compiled, canon.aliasResolved === true);
+        if (hit)
+            return { kind: "hit", pattern: hit, via: "target" };
+        if (relative === null) {
+            for (const hop of await symlinkChainHops(opts.env, path, signal, fam, base)) {
+                const viaHop = matchSensitive(hop, compiled, false);
+                if (viaHop)
+                    return { kind: "hit", pattern: viaHop, via: "chain" };
+            }
+        }
+        return { kind: "clear" };
+    };
     return {
+        ...(compiled.length > 0 ? { writeTargetGuard: async (target, signal) => (await judgeTarget(target, family(undefined), undefined, signal)).kind !== "clear" } : {}),
         async check(req, signal) {
             if (compiled.length === 0)
                 return { action: "allow" };
@@ -121,45 +152,23 @@ export function createSensitivePathPolicy(opts) {
             const path = writeTargetPath(req, protective);
             if (typeof path !== "string" || path.length === 0)
                 return { action: "allow" };
-            const canon = await canonicalizeTarget(opts.env, path, signal, pathFamilyOf({ root: opts.rootPath, cwd: req.cwd ?? opts.env.cwd }), pathTargetBaseOf(protective, { root: opts.rootPath, cwd: req.cwd }));
-            if (!canon.ok) {
+            const judged = await judgeTarget(path, family(req.cwd), pathTargetBaseOf(protective, { root: opts.rootPath, cwd: req.cwd }), signal);
+            if (judged.kind === "unresolved") {
                 return {
                     action: "deny",
-                    message: canon.unresolvedSymlink
+                    message: judged.unresolvedSymlink
                         ? `write to "${path}" is blocked: it is a symlink whose real target could not be resolved (it could point onto a guarded sensitive path)`
-                        : `write to "${path}" is blocked: its target could not be resolved on this tree (${canon.refused ?? canon.message}), so the sensitive-path guard cannot judge it`,
+                        : `write to "${path}" is blocked: its target could not be resolved on this tree (${judged.cause}), so the sensitive-path guard cannot judge it`,
                     decisionReason: "safety",
                 };
             }
-            let relative = null;
-            for (const rootKey of await canonicalDataRootKeys(opts.env, dataRootPaths, signal)) {
-                relative = relativeUnderRoot(canon.key, rootKey);
-                if (relative !== null)
-                    break;
-            }
-            const judged = relative ?? canon.key;
-            if (relative === "")
-                return { action: "allow" };
-            const hit = matchSensitive(judged, compiled, canon.aliasResolved === true);
-            if (hit) {
+            if (judged.kind === "hit") {
                 return {
                     action: "deny",
-                    message: `write to "${path}" is blocked: its real target resolves onto the guarded sensitive path "${hit}"`,
+                    message: judged.via === "target" ? `write to "${path}" is blocked: its real target resolves onto the guarded sensitive path "${judged.pattern}"` : `write to "${path}" is blocked: its symlink chain passes through the guarded sensitive path "${judged.pattern}"`,
                     decisionReason: "safety",
                 };
             }
-            if (relative === null) {
-                for (const hop of await symlinkChainHops(opts.env, path, signal, pathFamilyOf({ root: opts.rootPath, cwd: req.cwd ?? opts.env.cwd }), pathTargetBaseOf(protective, { root: opts.rootPath, cwd: req.cwd }))) {
-                    const viaHop = matchSensitive(hop, compiled, false);
-                    if (viaHop) {
-                        return {
-                            action: "deny",
-                            message: `write to "${path}" is blocked: its symlink chain passes through the guarded sensitive path "${viaHop}"`,
-                            decisionReason: "safety",
-                        };
-                    }
-                }
-            }
             return { action: "allow" };
         },
     };

package/dist/core/task-event.d.ts

@@ -370,7 +370,7 @@ export type TaskEvent = ({
      * document/worktree/todo/task/task-list/task-output/task-stop/agent/fork/workflow-run/web-fetch/
      * web-search/cron-create/cron-delete/cron-list/tool-search/repo-map/monitor-start/
      * enter-plan-mode/exit-plan-mode/report-findings/schedule-wakeup/send-message/agent-transcript/
-     * a2a/path_not_in_root/readonly_out_of_root), surfaced on the live wire so a CC-faithful shell
+     * a2a/path_not_in_root/readonly_out_of_root/read_unestablished), surfaced on the live wire so a CC-faithful shell
      * renders rich cards (red/green diff, stdout panes, file cards) without re-parsing the
      * model-facing string. Absent when the tool carries no card shape or when the serialized card
      * exceeds the size bound (omitted whole; a consumer falls back to `output`).

package/dist/core/task-result.d.ts

@@ -622,7 +622,7 @@ export interface TaskResult {
      * posture rides every leg that continues this work, not just the delegation subtree.
      *
      * **In-presence condition:** present iff non-empty. Built-in entries are never listed — they are the
-     * DEPLOYMENT's own selection (off by default), re-compiled per leg and reported on its wiring
+     * DEPLOYMENT's own selection (the default tiers unless it says otherwise), re-compiled per leg and reported on its wiring
      * manifest ({@link import("./wiring-manifest.js").WiringManifest.readDeny}). Same terminal coverage as
      * {@link effectiveReadFace}: rides any terminal of a leg that ran; absent on prepare failures.
      *