@sema-agent/core 7.34.0 → 7.35.0

package/dist/core/runner/run-leg.js

@@ -513,6 +513,7 @@ export async function runLeg(input) {
         }
         prepared.abortController.abort();
         prepared.releaseSignal();
+        prepared.endModeCeiling();
         strandedHumanAnswers = prepared.settleContentAskBindings();
         try {
             prepared.harness.recoverUndrainedEngineNotes();
@@ -633,7 +634,7 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
     }
     if (prepared.permissionRuleOrg !== undefined) {
         const orgVerdict = prepared.permissionRuleOrg
-            .adjudicate({ toolName: pendingAction.toolName, args: resolvedArgs, toolCallId: pendingAction.toolCallId })
+            .adjudicate({ toolName: pendingAction.toolName, args: resolvedArgs, toolCallId: pendingAction.toolCallId, ...callFaceSeat(toolCallFaceOf(prepared.toolRosterDeltas.current, pendingAction.toolName)) })
             .catch(() => ({ status: "unavailable", disclosures: ["the org adjudication face threw on resume"] }));
         let orgWaitCancelled = false;
         const org = await settleOrgVerdictWithin(orgVerdict, { status: "unavailable", disclosures: [`the org adjudication face did not answer within ${ORG_ADJUDICATION_TIMEOUT_MS}ms (or the task ended first)`] }, {
@@ -716,7 +717,8 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
     }
     if (prepared.shellReadCheck !== undefined) {
         const edited = outcome.updatedInput !== undefined && !deepJsonEqual(outcome.updatedInput, pendingAction.args);
-        const judged = prepared.shellReadCheck.judge(pendingAction.toolName, resolvedArgs, prepared.cwdRef?.current, prepared.abortController.signal, {
+        const readCall = { toolName: pendingAction.toolName, ...callFaceSeat(toolCallFaceOf(prepared.toolRosterDeltas.current, pendingAction.toolName)) };
+        const judged = prepared.shellReadCheck.judge(readCall, resolvedArgs, prepared.cwdRef?.current, prepared.abortController.signal, {
             toolCallId: pendingAction.toolCallId,
             ...(edited ? { seat: "rejudge" } : {}),
         });
@@ -728,7 +730,7 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
             }
             catch {
                 answered = false;
-                verdict = prepared.shellReadCheck.unanswered(pendingAction.toolName, "the read station could not answer on the resumed leg");
+                verdict = prepared.shellReadCheck.unanswered(readCall, "the read station could not answer on the resumed leg");
             }
             if (!answered || verdict.disposition === "refuse" || (edited && verdict.disposition !== "vouch")) {
                 const readDenial = formatHookFeedback(`The approved tool call "${pendingAction.toolName}" was not executed: ${verdict.sentence ?? "the read boundary does not vouch for what it reads on this leg"} This approval is spent — the call has to be re-issued and approved again.`, prepared.reminderMark);

package/dist/core/runner/run-notification-lane.d.ts

@@ -4,6 +4,7 @@ import type { SessionStore } from "../session.js";
 import { type NotificationInjectionOutcome, type PendingSessionNotifications, type SystemInjectionPriority, type TaskNotificationPayload } from "../task-notification.js";
 import type { RunnerDeps, TaskEvent, TaskSpec } from "../types.js";
 import type { SessionReadFileStates } from "./session-read-file-states.js";
+import type { SessionModeSeats } from "./session-mode-seats.js";
 import type { NotificationLaneBindings, Prepared, PrepareTaskFn, ResumeRun, RunInternals, RunnerDepsSeat, RunnerSelfSeat, TaskIdRef } from "./contracts.js";
 export interface RunNotificationLaneInput<R> {
     /** borrowed-readonly — the task spec: prepare's input, and the principal the peer scope is minted from. */
@@ -26,6 +27,8 @@ export interface RunNotificationLaneInput<R> {
     sessions: SessionStore;
     /** borrowed-mutable — the Runner's own per-session read-state seat, ALWAYS this Runner's (a caller-supplied one is overridden). */
     sessionReadStates: SessionReadFileStates;
+    /** borrowed-mutable — the Runner's per-session permission-mode seats, ALWAYS this Runner's (a caller-supplied one is overridden). */
+    sessionModeSeats: SessionModeSeats;
     /** borrowed-mutable — the Runner's per-session parked-notification store: the torn-down lane and the escalation pend here. */
     pendingSessionNotifications: PendingSessionNotifications;
     /** borrowed-readonly — the orchestrator's entry (a lane may not name the orchestrator; the driver hands it in), as the ONE

package/dist/core/runner/run-notification-lane.js

@@ -8,7 +8,7 @@ export function runNotificationLane(input) {
     return obligations.run(() => runNotificationLaneAs(input, obligations));
 }
 async function runNotificationLaneAs(input, obligations) {
-    const { spec, queue, resume, internals, taskIdRef, runner, self, sessions, sessionReadStates, pendingSessionNotifications, prepareTask, next } = input;
+    const { spec, queue, resume, internals, taskIdRef, runner, self, sessions, sessionReadStates, sessionModeSeats, pendingSessionNotifications, prepareTask, next } = input;
     const prepareResume = resume
         ? {
             leafId: resume.cp.leafId,
@@ -118,6 +118,7 @@ async function runNotificationLaneAs(input, obligations) {
         peerInboundChainRef,
         detachHub,
         sessionReadStates,
+        sessionModeSeats,
         onTaskNotification: (notification, opts) => {
             try {
                 upstreamTaskNotification?.(notification, opts);

package/dist/core/runner/runtask.d.ts

@@ -22,6 +22,7 @@ export declare class Runner implements RunnerSelfSeat {
      *  authority: a durable resume's checkpoint seed wins on its leg, and a miss (cross-process,
      *  evicted) falls back to the transcript-replay rung. See {@link SessionReadFileStates}. */
     private readonly sessionReadStates;
+    private readonly sessionModeSeats;
     /** task notifications born BETWEEN turns (run torn down / harness already idle), parked
      *  per session and drained into the session's next run at its first boundary. Runner-lived (outlives any
      *  single run, like the registry handles that produce into it); bounded + drop-disclosing, see

package/dist/core/runner/runtask.js

@@ -16,9 +16,10 @@ import { TtlSessionStore } from "../session-store.js";
 import { errorCodeOf } from "./assemble-result.js";
 import { effectiveDelegationFacts, prepareTask } from "./prepare-task.js";
 import { SessionReadFileStates } from "./session-read-file-states.js";
+import { SessionModeSeats } from "./session-mode-seats.js";
 import { RunnerSharedToolResultStore } from "../tool-result-store.js";
 import { PAUSE_REGISTRY } from "../pause-registry.js";
-import { toolPolicyNameSets } from "../tool-policy.js";
+import { wrapToolPolicy } from "../tool-policy.js";
 import { PendingSessionNotifications } from "../task-notification.js";
 import { ToolDetachHub } from "../tool-detach.js";
 import { assertContextSettingsValue, assertContextSettingsWords, contextOverlayFor } from "../context-settings.js";
@@ -65,6 +66,7 @@ export class Runner {
     sessions;
     sessionLocks = new Map();
     sessionReadStates = new SessionReadFileStates();
+    sessionModeSeats = new SessionModeSeats();
     pendingSessionNotifications = new PendingSessionNotifications();
     parentConstraintRegistry = new Map();
     suspendedEnvReaps = new Map();
@@ -174,15 +176,7 @@ export class Runner {
         return {
             ...(deps.toolPolicy !== undefined
                 ? {
-                    toolPolicy: (() => {
-                        const sets = toolPolicyNameSets(deps.toolPolicy);
-                        const wrapped = {
-                            check: (req, signal) => deps.toolPolicy.check(req, signal),
-                        };
-                        if (sets.length > 0)
-                            wrapped.nameSets = sets;
-                        return wrapped;
-                    })(),
+                    toolPolicy: wrapToolPolicy(deps.toolPolicy, (req, signal) => deps.toolPolicy.check(req, signal)),
                 }
                 : {}),
             ...(hooks !== undefined ? { hooks } : {}),
@@ -445,7 +439,7 @@ export class Runner {
         const { spec, queue, setResult, onSuggestions, onReady, onSuspend, manualCompactRef, taskIdRef, resume, internals, notifyRef, captureOptOutRef, mcpRedialRef, entryActor, entryTracer } = input;
         return runNotificationLane({
             spec, queue, resume, internals, taskIdRef,
-            runner: this.depsSeat, self: this, sessions: this.sessions, sessionReadStates: this.sessionReadStates, pendingSessionNotifications: this.pendingSessionNotifications,
+            runner: this.depsSeat, self: this, sessions: this.sessions, sessionReadStates: this.sessionReadStates, sessionModeSeats: this.sessionModeSeats, pendingSessionNotifications: this.pendingSessionNotifications,
             prepareTask,
             next: ({ prepared, injectTaskNotification, deliveredAtTurnOpen, peerInboundChainRef, modelCatalog, notificationLane, unsubscribeTaskNotifications }) => {
                 const { runSourceTaskId, parentToolCallId, ident, emitDelegationLifecycle, loopLatch, stats, internalsNotifier, undrainedUserAtEnd, userInputLostAtEnd } = runIdentityWiring({

package/dist/core/runner/session-mode-seats.d.ts

@@ -0,0 +1,48 @@
+/**
+ * The Runner's per-session PERMISSION-MODE seats: the mode a session's CURRENT leg runs under, as the object a
+ * child's ceiling falls back to once the leg that spawned it has ended. A child's ceiling used to be the controller
+ * of the leg that spawned it for the child's whole life, so a session-scoped background child kept that leg's mode
+ * after the leg ended — the next leg of the same session, started in `plan`, did not reach it. The chain now carries
+ * a LEG ceiling: the spawning leg's live mode while that leg runs, and the session's seat after it. Each leg binds
+ * itself to its session's seat when its prepare commits, so the seat answers the most recently committed leg; a leg
+ * that is still running keeps answering its own children, whatever another leg of the session commits meanwhile.
+ */
+import type { PermissionMode } from "../ask-origin.js";
+import type { PermissionModeReceipt } from "../mode-policy.js";
+/** A child leg whose ceiling is a leg ceiling: its receipt is read before a ceiling move and re-judged after it. */
+export interface ModeCeilingHolder {
+    receipt(): PermissionModeReceipt;
+    /** The ceiling's source moved; `before` is this holder's receipt under the previous source. */
+    ceilingRebound(before: PermissionModeReceipt): void;
+}
+/** One leg's ceiling, as the chain carries it (`InheritedGate.permissionModeCeiling`). */
+export interface LegModeCeiling {
+    /** The spawning leg's live mode while it runs; the session's current leg's after it (`default` before any leg of
+     *  the session committed — no child can read it then). */
+    readonly current: PermissionMode;
+    readonly sessionId: string;
+    /** A child leg holds the ceiling until `signal` aborts (its own leg's end): each move of the ceiling re-judges it. */
+    hold(holder: ModeCeilingHolder, signal: AbortSignal): void;
+}
+/**
+ * The seats of one Runner, keyed by session id and held WEAKLY: a seat lives while a leg ceiling holds it, and the
+ * next leg of the session finds the same object as long as any child still reads it. In-process only — a session
+ * continued on another Runner instance or in another process binds that Runner's seat.
+ */
+export declare class SessionModeSeats {
+    private readonly seats;
+    private readonly reaper;
+    private seatOf;
+    /**
+     * A leg's ceiling over its session's seat, the leg's commit (once its prepare succeeded: the leg becomes the
+     * session's current leg) and its end (once the leg has STOPPED — its loop settled, not merely cancelled: a cancelled
+     * leg whose tool is still pending keeps answering its own children).
+     */
+    legCeiling(sessionId: string, leg: {
+        readonly current: PermissionMode;
+    }): {
+        ceiling: LegModeCeiling;
+        commit: () => void;
+        end: () => void;
+    };
+}

package/dist/core/runner/session-mode-seats.js

@@ -0,0 +1,73 @@
+class Seat {
+    sessionId;
+    leg;
+    holders = new Set();
+    constructor(sessionId) {
+        this.sessionId = sessionId;
+    }
+    get current() {
+        return this.leg?.current ?? "default";
+    }
+    addHolder(holder, via, signal) {
+        if (signal.aborted)
+            return;
+        const entry = { holder, via };
+        this.holders.add(entry);
+        signal.addEventListener("abort", () => this.holders.delete(entry), { once: true });
+    }
+    moveCeiling(affected, move) {
+        const before = [...this.holders].filter((e) => affected(e.via)).map((e) => [e.holder, e.holder.receipt()]);
+        move();
+        for (const [holder, receipt] of before)
+            holder.ceilingRebound(receipt);
+    }
+}
+class LegCeiling {
+    leg;
+    seat;
+    live = true;
+    constructor(leg, seat) {
+        this.leg = leg;
+        this.seat = seat;
+    }
+    get sessionId() {
+        return this.seat.sessionId;
+    }
+    get current() {
+        return this.live ? this.leg.current : this.seat.current;
+    }
+    hold(holder, signal) {
+        this.seat.addHolder(holder, this, signal);
+    }
+    commit() {
+        if (this.seat.leg === this.leg)
+            return;
+        this.seat.moveCeiling((via) => !via.live, () => (this.seat.leg = this.leg));
+    }
+    end() {
+        if (!this.live)
+            return;
+        this.seat.moveCeiling((via) => via === this, () => (this.live = false));
+    }
+}
+export class SessionModeSeats {
+    seats = new Map();
+    reaper = new FinalizationRegistry(({ sessionId, ref }) => {
+        if (this.seats.get(sessionId) === ref)
+            this.seats.delete(sessionId);
+    });
+    seatOf(sessionId) {
+        const live = this.seats.get(sessionId)?.deref();
+        if (live !== undefined)
+            return live;
+        const seat = new Seat(sessionId);
+        const ref = new WeakRef(seat);
+        this.seats.set(sessionId, ref);
+        this.reaper.register(seat, { sessionId, ref });
+        return seat;
+    }
+    legCeiling(sessionId, leg) {
+        const ceiling = new LegCeiling(leg, this.seatOf(sessionId));
+        return { ceiling, commit: () => ceiling.commit(), end: () => ceiling.end() };
+    }
+}

package/dist/core/runner/session-rule-policy.js

@@ -2,6 +2,7 @@ import { canonicalizeTarget, isWinFormPath, pathFamilyOf, writeTargetPath } from
 import { createCoarseCommandNamePolicy, namespacedCoveringEntries, namespacedCoveringHit } from "../tool-policy.js";
 import { continuesLineage } from "../session-policy-store.js";
 import { thrownText } from "../thrown-value.js";
+import { toolNameSetHas } from "../tool-roster.js";
 import { ruleDenialSentence } from "../rule-denial-sentence.js";
 import { DEFAULT_GATE_AWAIT_TIMEOUT_MS, gateWaitFailureOf, withGateTimeout } from "../gate-bounded-await.js";
 import { declaredPathTargetOf, isProtectedWrite, pathConfinableWriteToolNames, skillScopeWriteToolNames } from "../tool-registry.js";
@@ -136,9 +137,9 @@ export function createSessionRulePolicy(rules, opts) {
         async check(req, signal) {
             const { toolDeny, toolAllow, toolDenyCovering, toolAllowCovering, cmdPolicy, allowDirs } = compile(await readRules(req.toolCallId, signal));
             const toolName = req.toolName;
-            if (toolDeny.has(toolName) || namespacedCoveringHit(toolDenyCovering, toolName))
+            if (toolNameSetHas(toolDeny, req) || namespacedCoveringHit(toolDenyCovering, toolName))
                 return deny(req.toolName);
-            if (toolAllow && !toolAllow.has(toolName) && !namespacedCoveringHit(toolAllowCovering, toolName)) {
+            if (toolAllow && !toolNameSetHas(toolAllow, req) && !namespacedCoveringHit(toolAllowCovering, toolName)) {
                 return deny(req.toolName, "it is not in the session-rule allowlist");
             }
             if (cmdPolicy) {

package/dist/core/secret-env.d.ts

@@ -1,77 +1,50 @@
 /**
- * Canonical "local-spawn shell secret-env protection" (sema D1) — FIRST-PARTY, vendor-independent.
+ * The environment a spawned child inherits: which of this process's variables it must not see.
  *
- * When the engine (or a downstream host/exec adapter) spawns a local shell whose commands the MODEL chooses (no human at the keyboard), the child's
- * inherited env MUST be fail-closed: a model-chosen `printenv DEEPSEEK_API_KEY` via the `bash` tool would
- * otherwise exfiltrate the orchestrator's brain key / git token / DB creds (the gate authorizes WHICH tool runs,
- * NOT isolation). The `scrub` policy drops secret-pattern keys (keeps PATH/build/locale → low breakage).
- *
- * This lives in `src/core/` — NOT `src/vendor/` — on purpose. It is OUR security invariant (D1 is a first-party
- * edit, not openclaw upstream), shared by the (currently-vendored) {@link NodeExecutionEnv} AND a downstream
- * adapter (service host adapter). Keeping the single source of the secret PATTERN here means:
- *   1. A consumer imports it instead of mirroring a regex that would silently DRIFT when the pattern is extended.
- *   2. The public export points at a STABLE first-party path that SURVIVES the planned de-vendoring refactor —
- *      when NodeExecutionEnv is naturalized out of `src/vendor/`, this module does not move and nothing rebinds.
- *
- * The `inheritEnv` THREE-STATE policy (`"all"` opt-out / `"scrub"` default / `string[]` allowlist) is read ONCE, by
- * {@link inheritedHostEnv}, for every engine spawn site that takes it (the tool shell, a `runSpec` oracle gate). A
- * downstream adapter composes its own child env; only the secret PATTERN is shared with it.
+ * A child the engine spawns may run what the MODEL chose (a tool shell, a gate over model-written code, a language
+ * server). Under the `"scrub"` policy (the default) it inherits every variable but those the judgment below names —
+ * deleted whole, never rewritten; `"all"` and a `string[]` allow list are the caller's explicit alternatives
+ * ({@link inheritedHostEnv}). One judgment per variable ({@link classifySecretEnvEntry}), the first rule that answers:
+ *   1. exempt — git's environment config and the proxy variables, handed on as written ({@link isExemptEnvName});
+ *   2. `exact-name` — a known credential name ({@link CREDENTIAL_ENV_NAMES});
+ *   3. `prefix-rule` — the OpenTelemetry settings ({@link OTEL_ENV_RE});
+ *   4. `namespace-rule` — a credential word as any segment of a name in the engine's own `SEMA_` namespace;
+ *   5. `name-rule` — a credential-shaped name ({@link nameIsCredentialShaped}) off {@link NON_SECRET_ENV_EXACT_NAMES};
+ *   6. `value-rule` — a value that carries a credential ({@link valueCarriesCredential}).
+ * {@link isSecretEnvKey} and {@link scrubSecretEnv} both answer with this one judgment. The exempt families, the
+ * credential names, the name shape and the value predicate follow the reference implementation's subprocess-env scrub
+ * as written, three ways stricter: plural `TOKENS` is a credential word unless a count word touches it, the GitHub
+ * token names are not held back from the name shape, and the name shape always runs.
  */
 import type { RedactionConfidence, RedactionSource } from "./arg-summary.js";
 import { type EngineNotice } from "./engine-notice.js";
-/** One git config entry as git reads it from the environment. A half is undefined when its source lacks it (a member
- *  missing from its index group). */
-interface GitConfigEntry {
-    readonly key?: string;
-    readonly value?: string;
-}
-export declare function readGitConfigParameters(text: string): GitConfigEntry[] | undefined;
-/** Which rule classified a key as secret-shaped — the env arm's `kind` vocabulary. */
-export type SecretEnvFindingKind = "suffix-rule" | "namespace-rule" | "exact-name" | "family-rule";
-/** One env entry the `scrub` policy withheld — dropped, or, for a member of git's config record, handed on holding a
- *  placeholder half: the key (the VALUE is never carried — this record is meant to be loggable), the rule that
- *  classified it, how strong that claim is, and the minting module. */
+/** Which rule withheld an entry. */
+export type SecretEnvFindingKind = "exact-name" | "name-rule" | "namespace-rule" | "prefix-rule" | "value-rule";
+/** One env entry the `"scrub"` policy withheld (deleted): its name — never its value, so the record is loggable —, the
+ *  rule that withheld it, how strong that claim is, and the minting module. */
 export interface SecretEnvFinding {
     key: string;
     kind: SecretEnvFindingKind;
     confidence: RedactionConfidence;
     source: RedactionSource;
 }
-/** What the two exact-name lists say about a name, before any shape rule is consulted. */
-export type ExactEnvNameVerdict = "credential" | "exempt" | "unknown";
-/** The exact-name arm of the classification, taking both lists as arguments. The credential list is read
- *  FIRST: an exemption can never take a name away from it, so a name landing on both lists resolves to the
- *  credential reading — the fail-closed direction (a wrongly-exempted name leaks; a wrongly-dropped one
- *  does not). Module-level export (not part of the package surface): the two real lists are disjoint, so
- *  only a controlled collision can tell this precedence from an inverted one. */
-export declare function classifyExactEnvName(key: string, credentialNames: ReadonlySet<string>, exemptNames: ReadonlySet<string>): ExactEnvNameVerdict;
-/** Is `key` a secret-pattern env var (one the fail-closed `scrub` policy drops before spawning a shell)? Pass the
- *  entry's `value` — and the environment it sits in as `env`, and the child's `platform` — to get exactly the scrub's
- *  answer for that entry: a git config member is judged with its index group, which only the environment holds; without
- *  a value the name alone decides (a `GIT_CONFIG_KEY_<i>` then reads as secret — the name cannot clear itself).
- *  `platform` is as for {@link scrubSecretEnv}. */
-export declare function isSecretEnvKey(key: string, value?: string, env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform): boolean;
-/** Drop every secret-pattern key (see {@link isSecretEnvKey}) from an env object — the fail-closed `scrub`
- *  policy. git's indexed record is withheld entry by entry and never renumbered ({@link readGitEnvConfigRecord}): a
- *  withheld entry git reads keeps its names, each holding its half of the placeholder entry `sema.withheld` (key) / an
- *  empty string (value), so `GIT_CONFIG_COUNT` and every other index reach the child as the host wrote them. `findings`
- *  is an OPTIONAL caller-owned collector: pass an array to learn which entries were withheld (by name) and why, read it
- *  back after the call. A finding's name is absent from the result unless it is such a record member, which is present
- *  holding the placeholder half. `platform` is the platform the child runs on — where git reads this environment:
- *  Windows reads env names case-insensitively, so there any spelling of a record member is that member; elsewhere git
- *  looks up the capitalised names only and every other spelling is judged on its own, apart from the record. It defaults
- *  to this process's own platform, the answer for a child spawned on this host; a host whose child runs elsewhere (a
- *  remote or sandboxed execution environment) passes that environment's platform. */
-export declare function scrubSecretEnv(env: NodeJS.ProcessEnv, findings?: SecretEnvFinding[], platform?: NodeJS.Platform): NodeJS.ProcessEnv;
+/** Does the `"scrub"` policy withhold `key`? With `value`, exactly the answer {@link scrubSecretEnv} gives for that
+ *  entry; without it, the answer for its name alone (the value rule then has nothing to read). */
+export declare function isSecretEnvKey(key: string, value?: string): boolean;
+/** The `"scrub"` policy: `env` without every entry {@link isSecretEnvKey} withholds, the rest as written. `findings` is
+ *  an optional caller-owned collector: each withheld entry is pushed onto it (name, rule, confidence), none of them
+ *  present in the result. `env` itself is not modified. */
+export declare function scrubSecretEnv(env: NodeJS.ProcessEnv, findings?: SecretEnvFinding[]): NodeJS.ProcessEnv;
 /** How much of this process's environment a child spawned on this host inherits — the `inheritEnv` value. */
 export type InheritEnvPolicy = "all" | "scrub" | string[];
 /**
  * The environment a child spawned ON THIS HOST inherits, by an {@link InheritEnvPolicy}: `"scrub"` (and absent) is
- * this process's environment through {@link scrubSecretEnv} for this platform; `"all"` is this process's environment
+ * this process's environment through {@link scrubSecretEnv}; `"all"` is this process's environment
  * verbatim (the explicit opt-out); a `string[]` is exactly the named variables that are set, verbatim — a strict allow
  * list, so a name it leaves out (`PATH` included) is not inherited. `findings` collects what the scrub withheld, and
- * only the `"scrub"` arm adds to it. Any other value reads as `"scrub"`: a spawn site that must refuse a malformed
- * policy asks {@link inheritEnvPolicyProblem} first.
+ * only the `"scrub"` arm adds to it. Any other value reads as `"scrub"`; both spawn sites that take a policy — the
+ * tool shell's `NodeExecutionEnv` (at construction) and the oracle gate (per gate) — refuse a malformed one through
+ * {@link inheritEnvPolicyProblem} before it gets here.
  */
 export declare function inheritedHostEnv(policy: InheritEnvPolicy | undefined, findings?: SecretEnvFinding[]): NodeJS.ProcessEnv;
 /** Why `value` is not an {@link InheritEnvPolicy} (absent counts as one — the scrub), or `undefined` when it is. */
@@ -86,4 +59,3 @@ export declare function __resetSecretEnvScrubNoticeAnnouncement(): void;
  * findings array is a no-op.
  */
 export declare function announceSecretEnvScrub(onNotice: ((notice: EngineNotice) => void) | undefined, findings: readonly SecretEnvFinding[]): void;
-export {};