@sema-agent/core 7.33.8 → 7.35.0

package/dist/core/runner/persisted-path-rows.js

@@ -0,0 +1,89 @@
+import { ownerStoreOf } from "../permission-rule-provider.js";
+import { READ_RULE_TOOL, eligiblePersisted, isUsablePathBase, ruleBasesNeeded } from "../permission-rule-model.js";
+import { isAbsolutePathForm, pathFamilyOf } from "../../tools/fs/safety.js";
+import { PATH_DENY_RULE_FACES, pathRuleDenyRowOf } from "../permission-rules.js";
+import { inlineUntrusted } from "../untrusted-text.js";
+import { DEFAULT_GATE_AWAIT_TIMEOUT_MS, gateWaitFailureOf, withGateTimeout } from "../gate-bounded-await.js";
+import { thrownText } from "../thrown-value.js";
+import { emitTrace } from "../trace.js";
+import { deliverEngineNotice } from "../engine-notice.js";
+export async function persistedPathRowsOf(cfg) {
+    const none = { readDirectories: [], denyRows: [] };
+    const provider = cfg.provider;
+    if (provider === undefined || !readsPersistedPathRows(provider, cfg.principal, cfg.localOwnerDeclared))
+        return none;
+    let view;
+    try {
+        view = await withGateTimeout(ownerStoreOf(provider, cfg.principal, cfg.localOwnerDeclared).effective({ sessionId: cfg.sessionId }), DEFAULT_GATE_AWAIT_TIMEOUT_MS, cfg.signal, "persistedPathRows");
+    }
+    catch (err) {
+        return gateWaitFailureOf(err) === "aborted" ? none : skipped(cfg, thrownText(err));
+    }
+    if (view.unreadable !== undefined)
+        skipped(cfg, view.unreadable, view.unreadableSources);
+    const call = { tool: READ_RULE_TOOL, cwd: cfg.root, sessionId: cfg.sessionId };
+    const bases = { root: cfg.root, ...(cfg.home !== undefined && isAbsolutePathForm(cfg.home) ? { home: cfg.home } : {}) };
+    const family = pathFamilyOf(bases);
+    const readDirectories = [];
+    const denyRows = [];
+    for (const rule of view.rules) {
+        if (rule.status !== "live")
+            continue;
+        if (rule.behavior === "allow" && rule.tool === READ_RULE_TOOL && rule.match === "subpath" && eligiblePersisted(rule, call, "allow")) {
+            if (!readDirectories.includes(rule.command))
+                readDirectories.push(rule.command);
+            continue;
+        }
+        const faces = PATH_DENY_RULE_FACES[rule.tool];
+        if (rule.behavior !== "deny" || faces === undefined || (rule.match !== "path" && rule.match !== "subpath") || !eligiblePersisted(rule, { ...call, tool: rule.tool }, "deny"))
+            continue;
+        const missing = ruleBasesNeeded(rule).filter((b) => !isUsablePathBase(b === "cwd" ? bases.root : bases[b], family));
+        if (missing.length > 0) {
+            cfg.onDisclosure(`the persisted deny rule ${inlineUntrusted(rule.rule, 200)} needs a ${missing.join(" / ")} base this task does not declare — the shell's file commands and the search tools do not judge it on this leg`);
+            continue;
+        }
+        denyRows.push(pathRuleDenyRowOf({ parsed: rule, ruleText: rule.rule, faces }, bases));
+    }
+    return { readDirectories, denyRows };
+}
+function skipped(cfg, why, sources) {
+    cfg.onDisclosure(`the persisted path rules could not be read at prepare, so this run's read directories and read / write deny tables take none of ${sources !== undefined ? `the ${sourcesWord(sources)} rows` : "their rows"} (the next prepare reads again): ${why}`);
+    cfg.onUnread("prepare", sources);
+    return { readDirectories: [], denyRows: [] };
+}
+function sourcesWord(sources) {
+    return sources.length <= 1 ? sources.join("") : `${sources.slice(0, -1).join(", ")} and ${sources[sources.length - 1]}`;
+}
+const SKIPPED_STORE_SENTENCE = {
+    prepare: (which) => `${which} could not be read when this run started, so this run's file and shell checks skip their path rows (Read / Edit deny rows and Read directory rows) — a deny row among them protects nothing on this run. Each call's own rule check reads the rules again (a call whose own read fails too is judged without them), and the next run reads the path rows again.`,
+    call: (which) => `${which} could not be read for a call on this run, so that call's own rule check skipped them: none of their allow, ask or deny rows took part in it, and a deny row among them protected nothing there (path rows the run took when it started still apply to its file and shell checks). Every later call reads them again, and they apply again as soon as a read succeeds.`,
+};
+export function ruleStoreUnreadableNotice(onNotice, ids) {
+    let sent = false;
+    return (at, sources) => {
+        if (sent)
+            return;
+        sent = true;
+        const which = sources !== undefined && sources.length > 0 ? `your persisted permission rules from the ${sourcesWord(sources)} sources` : "your persisted permission rules";
+        deliverEngineNotice(onNotice, { code: "permission.rule_store_unavailable", message: SKIPPED_STORE_SENTENCE[at](which), detail: { at, sessionId: ids.sessionId, runId: ids.runId } });
+    };
+}
+function readsPersistedPathRows(provider, principal, localOwnerDeclared) {
+    return provider.partitions.durable && ((principal !== undefined && principal !== "") || localOwnerDeclared);
+}
+export function persistedPathRowsOfTask(t) {
+    const provider = t.deps.permissionRuleStore;
+    if (!t.handsEnabled || provider === undefined || !readsPersistedPathRows(provider, t.principal, t.deps.localOwnerRules === true))
+        return undefined;
+    return persistedPathRowsOf({
+        provider,
+        localOwnerDeclared: t.deps.localOwnerRules === true,
+        principal: t.principal,
+        sessionId: t.sessionId,
+        root: t.root,
+        home: t.home,
+        onDisclosure: (message) => emitTrace(t.deps.tracer, () => ({ kind: "permission.rule_store_unreadable", version: 1, taskId: t.taskId, message, ts: Date.now() })),
+        onUnread: t.onUnread,
+        signal: AbortSignal.any([...t.signals]),
+    });
+}

package/dist/core/runner/prepare-artifact.d.ts

@@ -12,6 +12,7 @@
  * publishes the declared store into the run's {@link ArtifactStoreRef} for that second point.
  * Synchronous: the stretch has no await (the file read is a closure the tool calls later).
  */
+import type { PermissionModeController } from "../mode-policy.js";
 import type { ExecutionEnv } from "../../internal/harness.js";
 import type { OnAsk } from "../tool-policy.js";
 import { type ArtifactPlane } from "../artifact-host.js";
@@ -22,7 +23,7 @@ import { type ArtifactStoreRef } from "./read-root-grant.js";
 import type { Prepared } from "./contracts.js";
 export interface PrepareArtifactInput {
     /** borrowed-readonly — the deployment's hosting seat and the notice sink the refusal arm announces on. */
-    deps: Pick<RunnerDeps, "artifactHost" | "onNotice">;
+    deps: Pick<RunnerDeps, "artifactHost" | "onNotice" | "tracer">;
     /** borrowed-readonly — the engine-minted run id: the host's `onMount` key and every call context's `runId`. */
     runId: string;
     /** borrowed-readonly — the host task id, the call context's audit attribution. */
@@ -34,6 +35,9 @@ export interface PrepareArtifactInput {
     /** borrowed-readonly — the run's effective approver (`spec.onAsk ?? deps.onAsk`, the seat the tool gate resolves at):
      *  the tool's shared-read consent gate rides it as a mount dep (a core mount's execute ctx is minimal). */
     onAsk: OnAsk | undefined;
+    /** borrowed-readonly — the leg's live permission-mode seat; the tool's shared-read consent gate arbitrates at it before
+     *  the approver is consulted (a released read is delivered, undisclosed to nobody: the gate records it). */
+    permissionMode: PermissionModeController;
     /** borrowed-readonly — the run's resolved env: the byte source of a published local file. */
     executionEnv: ExecutionEnv;
     /** borrowed-readonly — the canonical task root the fs fence contains reads to; undefined ⇒ no local-file publish. */

package/dist/core/runner/prepare-artifact.js

@@ -6,11 +6,12 @@ import { defineTool } from "../tools.js";
 import { inlineUntrusted } from "../untrusted-text.js";
 import { physicalPathOfExisting } from "../physical-path.js";
 import { resolveKey, violationDetails, violationText } from "../../tools/fs/safety.js";
-import { rootAdmittingArtifactStore } from "./read-root-grant.js";
+import { rootAdmittingArtifactStore, withdrawStandingGrantsAdmitting } from "./read-root-grant.js";
+import { emitTrace } from "../trace.js";
 import { createArtifactTool } from "../../tools/artifact/artifact-tool.js";
 import { thrownText } from "../thrown-value.js";
 export function prepareArtifact(input) {
-    const { deps, runId, taskId, sessionId, agentName, onAsk, executionEnv, rootCanonical, additionalRootsCanonical, readDenyMatcher, resolvedReadFace, handsCwdRef, roster, firstPartyOffload, envHandToolNames, artifactStoreRef } = input;
+    const { deps, runId, taskId, sessionId, agentName, onAsk, permissionMode, executionEnv, rootCanonical, additionalRootsCanonical, readDenyMatcher, resolvedReadFace, handsCwdRef, roster, firstPartyOffload, envHandToolNames, artifactStoreRef } = input;
     const host = deps.artifactHost;
     if (host === undefined)
         return { artifactPlane: undefined };
@@ -29,6 +30,11 @@ export function prepareArtifact(input) {
     const storePhysical = storageDir !== undefined && rootCanonical !== undefined ? physicalPathOfExisting(storageDir) : undefined;
     if (artifactStoreRef !== undefined)
         artifactStoreRef.current = storePhysical;
+    if (artifactStoreRef !== undefined && storePhysical !== undefined) {
+        for (const entry of withdrawStandingGrantsAdmitting(storePhysical, artifactStoreRef)) {
+            emitTrace(deps.tracer, () => ({ kind: "config.additional_directory_skipped", version: 1, taskId, entry, field: "persistedReadRule", reason: `admits_artifact_store: the local artifact store ${storageDir} lies inside it or it inside the store — the Artifact tool's ledger and stored files stay outside every root the file tools reach`, ts: Date.now() }));
+        }
+    }
     if (storePhysical !== undefined && rootCanonical !== undefined) {
         const overlapping = rootAdmittingArtifactStore(storePhysical, [rootCanonical, ...additionalRootsCanonical()]);
         if (overlapping !== undefined)
@@ -60,7 +66,7 @@ export function prepareArtifact(input) {
             return { ok: false, reason: "too_large", size: r.value.byteLength, limit: maxBytes, judgedOn: "bytes" };
         return { ok: true, key: rk.key, bytes: r.value };
     };
-    const artifactSpec = createArtifactTool({ host, capabilities: verdict.capabilities, runId, taskId, sessionId, ...(agentName !== undefined ? { agentName } : {}), readLocalFile, ...(onAsk !== undefined ? { onAsk } : {}) });
+    const artifactSpec = createArtifactTool({ host, capabilities: verdict.capabilities, runId, taskId, sessionId, ...(agentName !== undefined ? { agentName } : {}), readLocalFile, ...(onAsk !== undefined ? { onAsk } : {}), permissionMode: () => permissionMode.current, ...(deps.onNotice !== undefined ? { onNotice: deps.onNotice } : {}) });
     roster.mount(firstPartyOffload(defineTool(artifactSpec)), { source: "builtin", mountedBy: "optional" });
     envHandToolNames.add(ARTIFACT_TOOL_NAME);
     return { artifactPlane: verdict.capabilities.plane };

package/dist/core/runner/prepare-ask-lane.d.ts

@@ -77,15 +77,17 @@ export interface PrepareAskLaneInput {
         isDelegatedChild?: true;
     };
     /** borrowed-readonly — the policy-chain phase's per-tool risk-axes projection (`riskAxes` on the ask). */
-    riskAxesOf: (toolName: string) => {
+    riskAxesOf: (call: Pick<ToolCallRequest, "toolName" | "face">) => {
         riskAxes?: {
             irreversible?: boolean;
             egress?: boolean;
         };
     };
-    /** borrowed-mutable — the auto-mode denial tracker, or undefined. Writer here: the carry mint arms the auto-deny
-     *  window on it iff the seat about to be called is live (the tracker's one writer). */
-    autoModeDenialTracking: AutoModeDenialTracker | undefined;
+    /** borrowed-mutable — the auto-mode denial tracker's live seat (undefined until an arming). Writer here: the carry mint
+     *  arms the auto-deny window on it iff the seat about to be called is live (the tracker's one writer). */
+    autoModeDenialTracking: {
+        readonly current: AutoModeDenialTracker | undefined;
+    };
     /** borrowed-readonly — the REBOUND spec; only `taskId` is read (the late-settlement observer's tag). */
     spec: Pick<TaskSpec, "taskId">;
     /** borrowed-readonly — the deployment seats this lane reports on, as a Pick over the SAME `deps` object (receiver

package/dist/core/runner/prepare-ask-lane.js

@@ -96,14 +96,14 @@ export function prepareAskLane(input) {
                 const p = approvalPreviewOf(req.toolName, req.args);
                 return { ...(p.preview !== undefined ? { preview: p.preview } : {}), ...(p.withheld !== undefined ? { previewWithheld: p.withheld } : {}) };
             })(),
-            ...ruleOffersOf(req.toolName, req.args, decision.action === "ask" ? decision : undefined),
+            ...ruleOffersOf(req, req.args, decision.action === "ask" ? decision : undefined),
             message: decision.message ?? `approval required for "${req.toolName}"`,
             ...askSourceIdentity(),
-            ...riskAxesOf(req.toolName),
+            ...riskAxesOf(req),
             ...(decision.action === "ask" && decision.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
             ...(decision.action === "ask" ? askMandateMember(decision) : {}),
             ...(decision.action === "ask" && decision.persistedRuleShadowed !== undefined ? { persistedRuleShadowed: decision.persistedRuleShadowed } : {}),
-            ...(decision.action === "ask" ? gateAskCarry(decision, isLiveApproverSeat(onAsk), autoModeDenialTracking) : {}),
+            ...(decision.action === "ask" ? gateAskCarry(decision, isLiveApproverSeat(onAsk), autoModeDenialTracking.current) : {}),
             ...(decision.action === "ask" && decision.probeReason !== undefined ? { probeReason: decision.probeReason } : {}),
             ...(decision.action === "ask" && decision.probeCause !== undefined ? { probeCause: decision.probeCause } : {}),
             ...(decision.action === "ask" && decision.probeReadRootCandidate !== undefined ? { readRootCandidate: decision.probeReadRootCandidate } : {}),

package/dist/core/runner/prepare-caps-and-workflow.d.ts

@@ -24,6 +24,7 @@ import { forkGovernanceDenial } from "../../agents/subagent.js";
 import type { PromptEpochArtifact } from "../../prompt-assembly/artifact.js";
 import { type WorkflowSizeGuideline } from "../../orchestration/workflow-size-guideline.js";
 import { type AutoModeArmingRecipe } from "../auto-mode-arming.js";
+import type { PermissionModeController } from "../mode-policy.js";
 import { type AutoModeDecider, type AutoModeDenialTracker } from "../auto-mode.js";
 import { type CheckpointSeat } from "../checkpoint-seat.js";
 import { type ComplianceCapability } from "../compliance.js";
@@ -109,10 +110,23 @@ export interface PrepareCapsAndWorkflowInput {
     requestReview: (opts?: {
         reason?: string;
     }) => void;
-    /** borrowed-readonly — the plan-mode primitive the EnterPlanMode tool calls. */
-    enterPlanMode: () => void;
-    /** borrowed-readonly — the auto-mode INTENT (own seat ∨ chain ∨ checkpoint), the arming's first arm. */
-    autoModeIntent: boolean;
+    /** borrowed-readonly — the plan-mode primitive the EnterPlanMode tool calls: a steer of the leg's mode seat into `plan`. */
+    enterPlanMode: () => Promise<void>;
+    /** borrowed-readonly — the leg's live permission-mode seat: the arming's first arm is `declared === "auto"`, and the
+     *  arming facts (the deny bits, the face, the re-entrant arm) are bound onto it here. */
+    permissionMode: PermissionModeController;
+    /** borrowed-readonly — LATE-BOUND: the effective read-deny table the hands phase compiles (the rows the classifier's deny
+     *  paragraph renders); read at ARMING, which the driver runs after that phase — never at this phase's own call. */
+    readDenyEntries: () => {
+        readonly entries: ReadonlyArray<{
+            readonly pattern: string;
+            readonly caseSensitive?: boolean;
+        }>;
+        readonly ruleRows: ReadonlyArray<{
+            readonly tool: string;
+            readonly pattern: string;
+        }>;
+    };
     /** borrowed-readonly — the peer lane's mount verdict (the classifier's cross-session rule fills only while mounted). */
     peerLaneActive: boolean;
     /** borrowed-readonly — whether the BUILT-IN SendMessage is on this face (the lane rule's second term). */
@@ -153,15 +167,26 @@ export interface PrepareCapsAndWorkflowResult {
     agentForkDenial: ReturnType<typeof forkGovernanceDenial>;
     /** owned — the observers grant (`allowObservers === true`, explicit opt-in). */
     observersActive: boolean;
-    /** owned — the arming outcome as a closed reason (the manifest's auto-mode face). */
-    /** The leg's auto-mode arming fact (`armed` ⇔ `reason === "armed"`; `deniedSource` only beside a STATED `denied`). */
-    autoModeArmReason: AutoModeArmFact;
-    /** owned — the armed classifier, or undefined when any arming arm failed. */
-    autoModeDecider: AutoModeDecider | undefined;
-    /** owned — the denial tracker built beside the decider (same face, same arming). */
-    autoModeDenialTracking: AutoModeDenialTracker | undefined;
-    /** owned — the serializable arming recipe (persistArming opt-in only). */
-    autoModeArming: AutoModeArmingRecipe | undefined;
+    /** owned — the arming outcome as a closed reason (the manifest's auto-mode face), read LIVE: a leg steered into `auto`
+     *  after prepare arms then, and the fact follows. */
+    autoModeArmReason: () => AutoModeArmFact;
+    /** owned — the armed classifier's live seat (`current` undefined until an arming succeeds — at prepare for an `auto`
+     *  leg, or at a steer into `auto`); every consumer reads `current` at its own call. */
+    autoModeDeciderRef: {
+        readonly current: AutoModeDecider | undefined;
+    };
+    /** owned — the denial tracker built beside the decider (same face, same arming), same live seat. */
+    autoModeDenialTrackingRef: {
+        readonly current: AutoModeDenialTracker | undefined;
+    };
+    /** owned — the serializable arming recipe (persistArming opt-in only), same live seat. */
+    autoModeArmingRef: {
+        readonly current: AutoModeArmingRecipe | undefined;
+    };
+    /** owned — arm the classifier for THIS leg (idempotent; a no-op unless the effective mode is `auto` and the face and the
+     *  deny bit admit it). The driver calls it once after the hands phase (the deny table must exist first); the mode seat
+     *  calls it again on a steer into `auto`. */
+    armAutoMode: () => Promise<void>;
     /** owned — self-orchestration is ACTIVE for this leg (deployment ready ∧ not entitlement-denied); drives the prompt injection. */
     selfOrchestrationActive: boolean;
     /** owned — the Workflow tool is on the roster (the delegation surface's second door). */
@@ -192,6 +217,7 @@ declare const RUNTIME_CAP_KEYS: {
     readonly forceDurableGate: true;
     readonly autoMode: true;
     readonly autoModeDenySource: true;
+    readonly bypassPermissions: true;
     readonly allowMemoryOptOut: true;
 };
 export type RuntimeCapKeysCoverEveryCap = AssertAllKeysHandled<Exclude<keyof RuntimeCaps, keyof typeof RUNTIME_CAP_KEYS>>;

package/dist/core/runner/prepare-caps-and-workflow.js

@@ -7,8 +7,9 @@ import { createRunWorkflowTool } from "../../orchestration/run-workflow-tool.js"
 import { isSelfOrchestrationActive } from "../../orchestration/workflow-script-runner.js";
 import { resolveWorkflowSizeGuideline } from "../../orchestration/workflow-size-guideline.js";
 import { autoModeArmingRecipeOf } from "../auto-mode-arming.js";
-import { buildAutoModePrompt, renderAutoModeAction, renderAutoModeWindow } from "../auto-mode-prompt.js";
-import { autoModeClassifierFallbackOf, createAutoModeDecider, createAutoModeDenialTracker } from "../auto-mode.js";
+import { AUTO_MODE_CLASSIFIER_MAX_RETRIES } from "../auto-mode-defaults.js";
+import { buildAutoModePrompt, readDenyClassifierRules, renderAutoModeAction, renderAutoModeWindow } from "../auto-mode-prompt.js";
+import { autoModeClassifierFallbackOf, createAutoModeDecider, createAutoModeDenialTracker, screenAutoModeKnobs } from "../auto-mode.js";
 import { checkpointStoreOfSeat } from "../checkpoint-seat.js";
 import { COMPLIANCE_CAPABILITIES, WEB_FETCH_TOOL_NAME, resolveComplianceDenies } from "../compliance.js";
 import { createPresentPlanTool, createEnterPlanModeTool } from "../present-plan-tool.js";
@@ -16,7 +17,7 @@ import { brainToRuntime } from "../runtime.js";
 import { defaultTaskRegistry } from "../task-registry.js";
 import { defineTool, isDefineToolProduct, rebindDefineToolCtx } from "../tools.js";
 const MOUNT_REMEDY = "author it as a plain-object ToolSpec (own `name` and `execute`), hand the defineTool product itself, or wrap a product through the supported wrapper form (a fresh object re-stamped with `stampDefineToolBrand` whose rebind re-wraps the rebound product)";
-import { AUTO_MODE_DENY_SOURCES, isAutoModeDenySource } from "../runtime-caps.js";
+import { isAutoModeDenySource } from "../runtime-caps.js";
 import { derivedRouteFallsBack } from "./derived-route-fallback.js";
 import { CLASSIFIER_ATTEMPT_SUFFIX, CLASSIFIER_THINK_SEAT, announceClassifierRoleDefaulted, classifierLadderRungs, classifierReplyAsksAgain, classifierReplyFailure, classifierReplyVerdictText, classifierRoundObserver, classifierRungSeat, classifierSeatModel } from "./classifier-ladder.js";
 import { REPORT_FINDINGS_TOOL_NAME, createReportBlockedTool, createReportFindingsTool } from "./synthetic-tools.js";
@@ -38,6 +39,7 @@ const RUNTIME_CAP_KEYS = {
     forceDurableGate: true,
     autoMode: true,
     autoModeDenySource: true,
+    bypassPermissions: true,
     allowMemoryOptOut: true,
 };
 function snapshotRuntimeCaps(record) {
@@ -54,7 +56,7 @@ function screenAutoModeCap(caps, onError, sessionId) {
         return { caps, faulted: false };
     if (typeof caps !== "object" || caps === null || Array.isArray(caps)) {
         onError?.(new Error(`runtimeCapsResolver returned a non-record value (${JSON.stringify(caps)}) — read as a resolver fault: every per-principal capability is DENIED for this run (auto mode is not armed; asks flow the original chain). Return a RuntimeCaps object or undefined.`), { phase: "config", sessionId });
-        return { caps: { allowWorkflows: false, allowFork: false, autoMode: false }, faulted: true };
+        return { caps: { allowWorkflows: false, allowFork: false, autoMode: false, bypassPermissions: false }, faulted: true };
     }
     let record;
     try {
@@ -62,22 +64,34 @@ function screenAutoModeCap(caps, onError, sessionId) {
     }
     catch (err) {
         onError?.(new Error(`runtimeCapsResolver's record threw while being read (${thrownText(err)}) — read as a resolver fault: every per-principal capability is DENIED for this run (auto mode is not armed; asks flow the original chain).`), { phase: "config", sessionId });
-        return { caps: { allowWorkflows: false, allowFork: false, autoMode: false }, faulted: true };
+        return { caps: { allowWorkflows: false, allowFork: false, autoMode: false, bypassPermissions: false }, faulted: true };
     }
+    let screened = record;
+    let faulted = false;
+    const fault = (message) => {
+        onError?.(new Error(`runtimeCapsResolver returned ${message}`), { phase: "config", sessionId });
+        faulted = true;
+    };
     const { autoMode, autoModeDenySource } = record;
     if (autoModeDenySource !== undefined && (!isAutoModeDenySource(autoModeDenySource) || autoMode !== false)) {
-        onError?.(new Error(`runtimeCapsResolver returned autoModeDenySource=${JSON.stringify(autoModeDenySource)} beside autoMode=${JSON.stringify(autoMode)} — read as a resolver fault: auto mode is DENIED for this run (the classifier is not armed; asks flow the original chain). Name a source only beside autoMode:false, and only one of ${AUTO_MODE_DENY_SOURCES.join("|")}.`), { phase: "config", sessionId });
-        const { autoModeDenySource: _refused, ...rest } = record;
-        return { caps: { ...rest, autoMode: false }, faulted: true };
+        fault(`autoModeDenySource=${JSON.stringify(autoModeDenySource)} beside autoMode=${JSON.stringify(autoMode)} — read as a resolver fault: auto mode is DENIED for this run (the classifier is not armed; asks flow to the approver / park)`);
+        const { autoModeDenySource: _refused, ...rest } = screened;
+        screened = { ...rest, autoMode: false };
     }
-    if (record.autoMode === undefined || typeof record.autoMode === "boolean")
-        return { caps: record, faulted: false };
-    onError?.(new Error(`runtimeCapsResolver returned a non-boolean autoMode (${JSON.stringify(record.autoMode)}) — read as a resolver fault: auto mode is DENIED for this run (the classifier is not armed; asks flow the original chain). Return true, false, or omit the key.`), { phase: "config", sessionId });
-    return { caps: { ...record, autoMode: false }, faulted: true };
+    else if (autoMode !== undefined && typeof autoMode !== "boolean") {
+        fault(`a non-boolean autoMode (${JSON.stringify(autoMode)}) — read as a resolver fault: auto mode is DENIED for this run (the classifier is not armed; asks flow the same way they do with no auto-mode face)`);
+        screened = { ...screened, autoMode: false };
+    }
+    if (record.bypassPermissions !== undefined && typeof record.bypassPermissions !== "boolean") {
+        fault(`a non-boolean bypassPermissions (${JSON.stringify(record.bypassPermissions)}) — read as a resolver fault: bypassPermissions is DENIED for this run (a requested bypass folds back to default)`);
+        screened = { ...screened, bypassPermissions: false };
+    }
+    return { caps: screened, faulted };
 }
-function mintPersistedArming(am, laneRule, classifierSystemPrompt, onError, sessionId) {
+function mintPersistedArming(am, laneRule, classifierSystemPrompt, derivedDenyRules, onError, sessionId) {
     const arming = autoModeArmingRecipeOf(laneRule ? { ...am, crossSessionMessagesRule: true } : am, {
         promptDigest: `apv1:${createHash("sha256").update(classifierSystemPrompt).digest("hex")}`,
+        derivedDenyRules,
     });
     if (arming === undefined) {
         onError?.(new Error("RunnerDeps.autoMode.persistArming is set but the auto-mode face did not canonicalize into an arming recipe " +
@@ -100,7 +114,7 @@ function autoModeArmReasonOf(intent, facePresent, caps, capsFaulted) {
     return { armed: true, reason: "armed" };
 }
 export async function prepareCapsAndWorkflow(input) {
-    const { spec, deps, parentSpecSeat, checkpointSeat, internals, session, sessionId, runId, hostTaskId, taskScope, taskRootFinal, model, thinking, lockedPreflight, toolEffects, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, harnessRef, frozenOnAsk, carrierReadFace, carrierWriteFace, forwardEvent, inheritedGateForChildren, enrichSpecToolCtx, maybeOffload, requestReview, enterPlanMode, autoModeIntent, peerLaneActive, peerSendMessageBuiltIn, runnerSelf } = input;
+    const { spec, deps, parentSpecSeat, checkpointSeat, internals, session, sessionId, runId, hostTaskId, taskScope, taskRootFinal, model, thinking, lockedPreflight, toolEffects, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, harnessRef, frozenOnAsk, carrierReadFace, carrierWriteFace, forwardEvent, inheritedGateForChildren, enrichSpecToolCtx, maybeOffload, requestReview, enterPlanMode, permissionMode, readDenyEntries, peerLaneActive, peerSendMessageBuiltIn, runnerSelf } = input;
     const roster = new RosterBuilder(toolEffects);
     for (const t of spec.tools ?? []) {
         const mounted = mountCallerTool(t);
@@ -151,7 +165,7 @@ export async function prepareCapsAndWorkflow(input) {
         }
         catch (err) {
             deps.onError?.(asThrownError(err), { phase: "config", sessionId });
-            runtimeCaps = { allowWorkflows: false, allowFork: false, autoMode: false };
+            runtimeCaps = { allowWorkflows: false, allowFork: false, autoMode: false, bypassPermissions: false };
             runtimeCapsFaulted = true;
         }
         const screened = screenAutoModeCap(runtimeCaps, deps.onError, sessionId);
@@ -193,11 +207,17 @@ export async function prepareCapsAndWorkflow(input) {
     }
     const agentForkDenial = forkGovernanceDenial(spec.enableFork, runtimeCaps?.allowFork);
     const observersActive = runtimeCaps?.allowObservers === true;
-    let autoModeDecider;
-    let autoModeDenialTracking;
-    let autoModeArming;
-    const autoModeArmReason = autoModeArmReasonOf(autoModeIntent, deps.autoMode !== undefined, runtimeCaps, runtimeCapsFaulted);
-    if (autoModeIntent && deps.autoMode !== undefined && runtimeCaps?.autoMode !== false) {
+    const autoModeDeciderRef = { current: undefined };
+    const autoModeDenialTrackingRef = { current: undefined };
+    const autoModeArmingRef = { current: undefined };
+    const autoModeArmReason = () => autoModeArmReasonOf(permissionMode.declared === "auto", deps.autoMode !== undefined, runtimeCaps, runtimeCapsFaulted);
+    if (deps.autoMode !== undefined)
+        screenAutoModeKnobs(deps.autoMode);
+    const armAutoMode = async () => {
+        if (autoModeDeciderRef.current !== undefined)
+            return;
+        if (permissionMode.declared !== "auto" || deps.autoMode === undefined || runtimeCaps?.autoMode === false)
+            return;
         const am = deps.autoMode;
         const classifierSeat = classifierSeatModel({ deps, main: model });
         let classifierModel = classifierSeat.model;
@@ -206,11 +226,14 @@ export async function prepareCapsAndWorkflow(input) {
         }
         announceClassifierRoleDefaulted({ onNotice: deps.onNotice, seat: { ...classifierSeat, model: classifierModel }, ...(sessionId !== undefined ? { sessionId } : {}), ...(runId !== undefined ? { runId } : {}) });
         const classifierLaneRule = peerLaneActive && peerSendMessageBuiltIn;
-        const classifierSystemPrompt = buildAutoModePrompt(classifierLaneRule ? { ...am, crossSessionMessagesRule: CROSS_SESSION_CLASSIFIER_RULE } : am);
+        const table = readDenyEntries();
+        const derivedDenyRules = readDenyClassifierRules(table.entries, table.ruleRows);
+        let classifierSystemPromptMemo;
+        const classifierSystemPrompt = () => (classifierSystemPromptMemo ??= buildAutoModePrompt({ ...am, derivedDenyRules, ...(classifierLaneRule ? { crossSessionMessagesRule: CROSS_SESSION_CLASSIFIER_RULE } : {}) }));
         const classifierRuntime = brainToRuntime(deps.brain);
         const classifierRungs = classifierLadderRungs(am.classifierFallback, classifierModel, model);
-        autoModeDenialTracking = createAutoModeDenialTracker(am.denialLimit);
-        autoModeDecider = createAutoModeDecider({
+        const denialTracking = createAutoModeDenialTracker(am.denialLimit);
+        const decider = createAutoModeDecider({
             ...(am.timeoutMs !== undefined ? { timeoutMs: am.timeoutMs } : {}),
             candidates: classifierRungs.map((m) => m.id),
             onClassified: classifierRoundObserver({ tracer: deps.tracer, onNotice: deps.onNotice, taskId: hostTaskId, seatModelId: classifierModel.id, ...(sessionId !== undefined ? { sessionId } : {}), ...(runId !== undefined ? { runId } : {}) }),
@@ -229,8 +252,9 @@ export async function prepareCapsAndWorkflow(input) {
                 }
                 const classifierAuth = await spec.getApiKeyAndHeaders?.(rungModel);
                 const request = async (seat, suffix) => {
-                    const response = await classifierRuntime.completeSimple(rungModel, { systemPrompt: classifierSystemPrompt, messages: [{ role: "user", content: userPrompt + suffix, timestamp: Date.now() }] }, {
+                    const response = await classifierRuntime.completeSimple(rungModel, { systemPrompt: classifierSystemPrompt(), messages: [{ role: "user", content: userPrompt + suffix, timestamp: Date.now() }] }, {
                         signal,
+                        maxRetries: AUTO_MODE_CLASSIFIER_MAX_RETRIES,
                         ...seat,
                         ...(classifierAuth?.apiKey !== undefined ? { apiKey: classifierAuth.apiKey } : {}),
                         ...(classifierAuth?.headers !== undefined ? { headers: classifierAuth.headers } : {}),
@@ -246,9 +270,14 @@ export async function prepareCapsAndWorkflow(input) {
                 return classifierReplyVerdictText(response);
             },
         });
-        if (am.persistArming === true)
-            autoModeArming = mintPersistedArming(am, classifierLaneRule, classifierSystemPrompt, deps.onError, sessionId);
-    }
+        const arming = am.persistArming === true ? mintPersistedArming(am, classifierLaneRule, classifierSystemPrompt(), derivedDenyRules, deps.onError, sessionId) : undefined;
+        if (autoModeDeciderRef.current !== undefined)
+            return;
+        autoModeDeciderRef.current = decider;
+        autoModeDenialTrackingRef.current = denialTracking;
+        autoModeArmingRef.current = arming;
+    };
+    permissionMode.bindArming({ caps: runtimeCaps, autoFacePresent: deps.autoMode !== undefined, armAuto: armAutoMode, onArmFault: (e) => deps.onError?.(asThrownError(e), { phase: "config", sessionId }) });
     const deploymentWorkflowReady = runnerSelf !== undefined && isSelfOrchestrationActive(spec, deps);
     const selfOrchestrationActive = deploymentWorkflowReady && runtimeCaps?.allowWorkflows !== false;
     if (deploymentWorkflowReady && runtimeCaps?.allowWorkflows === false) {
@@ -313,7 +342,7 @@ export async function prepareCapsAndWorkflow(input) {
                 const co = memoryEngineSession?.captureOptOut;
                 return assembleParentCaptureState(co?.optedOut() ?? false, co?.indeterminate() ?? false, ctl, [...(internals?.memoryCaptureAncestors ?? []), { sessionId, ...(ctl !== undefined ? { controlDir: ctl } : {}) }]);
             },
-            autoModeReview: () => (autoModeDecider !== undefined ? { decider: autoModeDecider } : undefined),
+            autoModeReview: () => (autoModeDeciderRef.current !== undefined ? { decider: autoModeDeciderRef.current } : undefined),
             workflowDepth: internals?.workflowDepth,
             parentCwd: taskRootFinal,
             parentThinking: () => childThinkingSeat(undefined, deploymentSubagentThinking(runnerSelf.agentCatalog?.roles), harnessRef.current?.getThinkingLevel() ?? thinking).thinking,
@@ -332,5 +361,5 @@ export async function prepareCapsAndWorkflow(input) {
             inheritedGateForChildren,
         }), { source: "builtin", mountedBy: "workflow" });
     }
-    return { roster, blockedRef, runtimeCaps, runtimeCapsFaulted, complianceDenies, complianceDegraded, agentForkDenial, observersActive, autoModeArmReason, autoModeDecider, autoModeDenialTracking, autoModeArming, selfOrchestrationActive, workflowToolsActive, workflowSizeGuideline };
+    return { roster, blockedRef, runtimeCaps, runtimeCapsFaulted, complianceDenies, complianceDegraded, agentForkDenial, observersActive, autoModeArmReason, autoModeDeciderRef, autoModeDenialTrackingRef, autoModeArmingRef, armAutoMode, selfOrchestrationActive, workflowToolsActive, workflowSizeGuideline };
 }

package/dist/core/runner/prepare-file-history.d.ts

@@ -12,7 +12,9 @@
  * before the move (a minted ownedEnv is destroyed there, the session view forgotten). The phase acquires
  * no resource of its own — the two seats it returns are closures over the store the deployment owns.
  *
- * The module-level helpers below the phase (`restoredAbsPathsOf`, `resolveWiredFileHistoryStore`,
+ * The request door (the bad-value doors and every refusal the request decides alone) lives in
+ * `./file-history-request.ts` and runs BEFORE the session is acquired; this phase receives its resolution.
+ * The module-level helpers below the phase (`restoredAbsPathsOf`,
  * the refusal's epoch-tail wording helper, `adoptForkedFileHistory` with its per-store carry memo,
  * `createFileHistoryBoundarySeat`, `resolveFileHistoryCoordinates` / `resolveFileHistoryScope` /
  * `fileHistoryFilesystemIdentity`, `childScopeRewindRefusal`) moved with it unchanged; the two the test
@@ -22,13 +24,17 @@ import type { ExecutionEnv } from "../../internal/harness.js";
 import type { StoredSession } from "../../engine/session/session.js";
 import type { RunnerDeps, TaskResult, TaskSpec, TrackFileEditHook } from "../types.js";
 import type { FileHistoryBoundarySeat, RunInternals } from "./contracts.js";
+import type { FileHistoryRequest } from "./file-history-request.js";
 export interface PrepareFileHistoryInput {
     /** borrowed-readonly — the deployment seats this phase reads: the first-touch failure policy, the history
      *  store and its capture switch (all validated HERE, once), the incident sink, and the retired-epoch diagnostic probe. */
-    deps: Pick<RunnerDeps, "onTrackFailure" | "fileHistoryStore" | "fileHistoryCapture" | "onError">;
+    deps: Pick<RunnerDeps, "onError">;
     /** borrowed-readonly — the REBOUND spec's rewind request fields and off-switch word (the retired `rewindFiles`
      *  spelling is read off the same object as an unknown key) and the caller's cancel signal for the restore. */
-    spec: Pick<TaskSpec, "resumeAt" | "resumeAtMode" | "restoreFiles" | "rewindFilesTo" | "acceptPartialRestore" | "signal" | "fileHistory">;
+    spec: Pick<TaskSpec, "resumeAt" | "restoreFiles" | "acceptPartialRestore" | "signal">;
+    /** borrowed-readonly — the request door's resolution ({@link resolveFileHistoryRequest}), judged before the session was
+     *  acquired: every refusal the request and the deployment's seats decide on their own has already thrown. */
+    request: FileHistoryRequest;
     /** borrowed-readonly — the trusted lineage a delegating parent handed this run (absent for a root run
      *  and for a host's own fork), read for the recording-scope decision only. */
     internals: Pick<RunInternals, "fileHistoryLineage"> | undefined;

package/dist/core/runner/prepare-file-history.js

@@ -2,45 +2,16 @@ import { NodeExecutionEnv } from "../../engine/execution-env/node-execution-env.
 import { isRemoteExecutionEnv } from "../remote-env.js";
 import { resolveTrackKey } from "../file-history-store.js";
 export async function prepareFileHistory(input) {
-    const { deps, spec, internals, executionEnv, taskRootFinal, handsEnabled, sessionId, session, abortController } = input;
+    const { deps, spec, request, internals, executionEnv, taskRootFinal, handsEnabled, sessionId, session, abortController } = input;
     const rewindNotes = [];
-    const onTrackFailure = deps.onTrackFailure === undefined ? "refuse" : deps.onTrackFailure;
-    if (onTrackFailure !== "refuse" && onTrackFailure !== "proceed-unprotected") {
-        const e = new Error(`RunnerDeps.onTrackFailure must be "refuse" or "proceed-unprotected"; got ${JSON.stringify(deps.onTrackFailure)} — refusing prepare rather than silently defaulting a first-touch-failure policy.`);
-        e.code = "config.invalid_on_track_failure";
-        throw e;
-    }
-    const wiredSeat = resolveWiredFileHistoryStore(deps.fileHistoryStore);
-    const runDeclaredOff = resolveRunFileHistoryWord(spec.fileHistory);
-    const captureOff = resolveFileHistoryCaptureWord(deps.fileHistoryCapture, wiredSeat);
-    const declaredOff = wiredSeat === "disabled" || runDeclaredOff;
-    const fileHistoryStore = declaredOff ? undefined : wiredSeat;
-    const captureStore = captureOff ? undefined : fileHistoryStore;
-    const legacyRewindFiles = spec.rewindFiles;
-    if (legacyRewindFiles === true) {
-        if (spec.resumeAt !== undefined) {
-            const e = new Error(`rewind-files: TaskSpec.rewindFiles is retired (design/381 — rewind now converges the per-edited-file history, not a whole-tree snapshot). This request pairs it with resumeAt, i.e. the RESTORE sense: set restoreFiles: true instead. (The capture sense needs no request anymore — first-touch tracking is on whenever a RunnerDeps.fileHistoryStore is wired and neither RunnerDeps.fileHistoryCapture nor TaskSpec.fileHistory turns it off.)`);
-            e.code = "rewind.rewind_files_retired";
-            throw e;
-        }
+    const { onTrackFailure, captureOff, declaredOff, fileHistoryStore, captureStore, rewindTarget, rewindBefore } = request;
+    if (spec.rewindFiles === true) {
         try {
             deps.onError?.(new Error(`TaskSpec.rewindFiles (capture sense) is retired and was ignored: per-edited-file first-touch tracking is on whenever RunnerDeps.fileHistoryStore is wired and neither RunnerDeps.fileHistoryCapture nor TaskSpec.fileHistory turns it off, so a per-turn capture request has nothing left to ask for. Drop the field; the restore sense moved to TaskSpec.restoreFiles.`), { phase: "config", sessionId });
         }
         catch {
         }
     }
-    if (spec.restoreFiles === true && spec.resumeAt === undefined) {
-        const e = new Error(`rewind-files: restoreFiles: true needs a resumeAt anchor — restoring files means converging them to a specific prior entry's boundary, and this spec names none. Use resumeAt + restoreFiles to move conversation and files together, or rewindFilesTo alone for a code-only restore.`);
-        e.code = "rewind.invalid_spec";
-        throw e;
-    }
-    if (spec.resumeAt !== undefined && spec.rewindFilesTo !== undefined) {
-        const e = new Error(`rewind-files: resumeAt ("${spec.resumeAt}") and rewindFilesTo ("${spec.rewindFilesTo}") were both set — resumeAt already anchors the file restore when restoreFiles is true, so a separate rewindFilesTo target is a conflicting request. Drop one of the two.`);
-        e.code = "rewind.conflicting_targets";
-        throw e;
-    }
-    const rewindTarget = spec.resumeAt !== undefined ? (spec.restoreFiles === true ? spec.resumeAt : undefined) : spec.rewindFilesTo;
-    const rewindBefore = rewindTarget !== undefined && spec.resumeAt !== undefined && spec.resumeAtMode === "before";
     if (spec.resumeAt !== undefined && spec.restoreFiles !== true) {
         rewindNotes.push({
             code: "conversation_only",
@@ -64,18 +35,7 @@ export async function prepareFileHistory(input) {
         await adoptForkedFileHistory(captureStore, session, sessionId, deps.onError);
     if (rewindTarget !== undefined && historyScope !== sessionId)
         throw childScopeRewindRefusal(historyScope, rewindTarget);
-    if (fileHistoryStore === undefined) {
-        if (rewindTarget !== undefined && runDeclaredOff)
-            throw captureDisabledRefusal(rewindTarget);
-        if (rewindTarget !== undefined) {
-            const e = new Error(wiredSeat === "disabled"
-                ? `rewind-files: restoring files to entry "${rewindTarget}" requires a history backend, but this deployment declared file history disabled (RunnerDeps.fileHistoryStore: "disabled"), so there is no history to restore — the files were NOT rewound`
-                : `rewind-files: restoring files to entry "${rewindTarget}" requires a history backend, but this deployment wired no RunnerDeps.fileHistoryStore — no file history was ever recorded, so the files were NOT rewound`);
-            e.code = "rewind.store_unconfigured";
-            throw e;
-        }
-    }
-    else if (!handsEnabled) {
+    if (fileHistoryStore !== undefined && !handsEnabled) {
         if (rewindTarget !== undefined) {
             rewindNotes.push({
                 code: "files_env_unsupported",
@@ -168,52 +128,6 @@ function restoredAbsPathsOf(restored, root) {
     }
     return out;
 }
-function resolveWiredFileHistoryStore(candidate) {
-    if (candidate === undefined || candidate === "disabled")
-        return candidate;
-    const verbs = ["trackEdit", "annulTrack", "snapshot", "restore", "canRestore", "reap", "adoptScope"];
-    const verbOf = (v) => {
-        try {
-            return candidate[v];
-        }
-        catch {
-            return undefined;
-        }
-    };
-    const probeable = (typeof candidate === "object" && candidate !== null) || typeof candidate === "function";
-    const missing = probeable ? verbs.filter((v) => typeof verbOf(v) !== "function") : [...verbs];
-    if (missing.length > 0) {
-        const shape = candidate === null ? "null" : probeable ? "a value that is not a FileHistoryStore" : `a ${typeof candidate}`;
-        const e = new Error(`RunnerDeps.fileHistoryStore was wired with ${shape} — missing contract verbs: ${missing.join(", ")}. Refusing prepare rather than half-wiring the rewind seat (a present-but-unusable store makes every Edit/Write/NotebookEdit fail its first-touch backup while restore requests report "no store wired"). Write "disabled" (or omit the key) to run without file history.`);
-        e.code = "config.invalid_file_history_store";
-        throw e;
-    }
-    return candidate;
-}
-function resolveRunFileHistoryWord(word) {
-    if (word === undefined || word === "disabled")
-        return word === "disabled";
-    const e = new Error(`rewind-files: TaskSpec.fileHistory holds ${shownWord(word)} — the only value is "disabled"; omit the key to leave the deployment's setting in force`);
-    e.code = "rewind.invalid_spec";
-    throw e;
-}
-function resolveFileHistoryCaptureWord(word, wiredSeat) {
-    if (word === undefined || (word === "off" && wiredSeat !== undefined && wiredSeat !== "disabled"))
-        return word === "off";
-    const e = new Error(word === "off"
-        ? `RunnerDeps.fileHistoryCapture: "off" requires a wired RunnerDeps.fileHistoryStore — nothing to switch off; to drop history entirely write fileHistoryStore: "disabled"`
-        : `RunnerDeps.fileHistoryCapture holds ${shownWord(word)} — the only value is "off"; omit the key to record whenever a fileHistoryStore is wired`);
-    e.code = "config.invalid_file_history_capture";
-    throw e;
-}
-function shownWord(word) {
-    return typeof word === "string" ? JSON.stringify(word.slice(0, 40)) : word === null || typeof word === "boolean" || typeof word === "number" ? String(word) : `a ${typeof word}`;
-}
-function captureDisabledRefusal(target) {
-    const e = new Error(`rewind-files: this run set TaskSpec.fileHistory: "disabled", so it neither records nor restores file history — restoring files to entry "${target}" was refused and the files were NOT rewound`);
-    e.code = "rewind.capture_disabled";
-    return e;
-}
 function rewindRefusalTail() {
     return `Boundaries are keyed by a turn's INITIAL entry and exist only for turns that recorded history (a RunnerDeps.fileHistoryStore wired, capture on, and the run's file history not disabled); a boundary from the retired whole-tree snapshot era is not restorable by this seat, and reaped boundaries have none.`;
 }