@sema-agent/core 7.38.0 → 7.38.2

package/dist/tools/fs/safety.d.ts

@@ -1,3 +1,4 @@
+import { type HomeViewSource } from "./read-deny-home.js";
 import type { AssertAllKeysHandled } from "../../core/ask-origin.js";
 import type { ExecutionEnv } from "../../internal/harness-types.js";
 import { protectivePathTargetOf, type ToolCallLike } from "../../core/tool-registry.js";
@@ -449,6 +450,7 @@ export type RootsSeat = readonly string[] | (() => readonly string[] | undefined
  */
 export declare function resolveKey(env: ExecutionEnv, rootCanonical: string, path: string, signal?: AbortSignal, baseCwd?: string, additionalRoots?: RootsSeat, exactFileReadExemption?: (canonicalKey: string) => boolean, readDeny?: {
     readonly face?: "write";
+    readonly homeViews?: HomeViewSource;
     matchTarget(canonicalKey: string, lexicalView?: string, opts?: {
         readonly aliasResolved?: boolean;
     }): {

package/dist/tools/fs/safety.js

@@ -469,7 +469,7 @@ export async function resolveKey(env, rootCanonical, path, signal, baseCwd, addi
         const judged = { aliasResolved: canon.aliasResolved === true };
         let hit = readDeny.matchTarget(key, lexicalViewOf(path, baseCwd ?? rootCanonical), judged);
         if (hit === null) {
-            const homeView = await homeViewsOf(env, signal).of(key);
+            const homeView = await homeViewsOf(env, readDeny, signal).of(key);
             if (homeView !== undefined)
                 hit = readDeny.matchTarget(key, homeView, judged);
         }

package/dist/tools/fs/search.d.ts

@@ -1,4 +1,5 @@
 import type { ExecutionEnv } from "../../internal/harness-types.js";
+import { type HomeViewsCarrier } from "./read-deny-home.js";
 /** The JS scanner's own output ceiling, in bytes of emitted content rows. Pinned to the
  *  ripgrep leg's figure ({@link MAX_EXEC_OUTPUT_BYTES}, the exec pipe's rolling-tail bound) so the two
  *  legs cannot disagree about how much one search may return; see the collection site in {@link jsGrep}
@@ -130,7 +131,7 @@ export declare function walk(env: ExecutionEnv, root: string, start: string, ign
     matchPath(path: string): {
         pattern: string;
     } | null;
-}): Promise<WalkResult>;
+} & HomeViewsCarrier): Promise<WalkResult>;
 /** The JS-leg withholding disclosure: an empty result must stay distinguishable from
  *  searched-and-empty, so this note rides EVERY output shape when something was pruned. Distinct from
  *  {@link walkCaveat}: pruning is deliberate withholding, not incompleteness.
@@ -157,8 +158,8 @@ export interface ReadDenyWithheld {
     count?: number;
     patterns?: readonly string[];
 }
-/** The deny judge seam every search leg shares (structural subset of ReadDenyMatcher). */
-export interface ReadDenyJudge {
+/** The deny judge seam every search leg shares (structural subset of ReadDenyMatcher), with its placement's home views. */
+export interface ReadDenyJudge extends HomeViewsCarrier {
     matchPath(path: string): {
         pattern: string;
     } | null;

package/dist/tools/fs/search.js

@@ -228,7 +228,7 @@ export async function walk(env, root, start, ignore, signal, deny) {
     let aborted = false;
     let denyPruned = 0;
     const denyPatterns = [];
-    const views = deny !== undefined ? homeViewsOf(env, signal) : undefined;
+    const views = deny !== undefined ? homeViewsOf(env, deny, signal) : undefined;
     const denyHit = async (path, leaf) => {
         let hit = deny?.matchPath(path);
         if (!hit && views !== undefined) {
@@ -1156,7 +1156,7 @@ function rgRecordAbsolute(base) {
     return (p) => (base === undefined || family === undefined || isAbsoluteForFamily(family, p) ? p : joinForFamily(family, base, p.replace(/^\.[\\/]/, "")));
 }
 async function rgOutputDenyTripwireAt(env, stdout, mode, deny, opts, signal) {
-    const views = homeViewsOf(env, signal);
+    const views = homeViewsOf(env, deny, signal);
     const absolute = rgRecordAbsolute(opts.base);
     const placed = new Map();
     for (const record of parseRgRecords(stdout, mode, opts.dropIncompleteTail === true)) {
@@ -1343,7 +1343,7 @@ export async function runGrepDetailed(env, root, p, signal, deny) {
             return false;
         if (deny.unexcludableUnder(scope))
             return true;
-        const view = await homeViewsOf(env, signal).of(scope);
+        const view = await homeViewsOf(env, deny, signal).of(scope);
         return view !== undefined && deny.unexcludableUnder(view);
     };
     if (!(await unexcludableUnder()) && (await detectRipgrep(env)))

package/dist/tools/fs/shell-read-check.d.ts

@@ -20,6 +20,7 @@
 import type { ExecutionEnv } from "../../internal/harness-types.js";
 import { violationDetails } from "./safety.js";
 import { type ShellReadPlan } from "./shell-read-plan.js";
+import { type HomeViewSource } from "./read-deny-home.js";
 import { type EstablishedRead, type ShellReadBoundary, type ShellReadDisposition, type ShellReadFinding, type ShellReadSeat } from "./shell-read-judge.js";
 import type { ReadRootGrantCandidate } from "../../core/tool-spec.js";
 import type { ToolCallLike } from "../../core/tool-registry.js";
@@ -145,6 +146,9 @@ export interface ShellReadStationOptions {
     /** `true` ⇔ every root `boundaryOf` returns is already a canonical identity (the Runner's): the station never
      *  re-resolves one, so a root swapped for a link after it was declared or granted cannot bring in the link's target. */
     readonly rootsCanonical?: boolean;
+    /** The home views of the placement the boundary's deny seats were compiled at (read-deny-home.ts) — the Runner's. Absent,
+     *  the declared home alone. */
+    readonly homeViews?: HomeViewSource;
 }
 /** What a consumer hands {@link judgeShellRead}: the command as written, the environment whose filesystem
  *  answers where its words land (symlinks resolved, patterns expanded — a `NodeExecutionEnv` over a real
@@ -191,6 +195,11 @@ export interface ShellReadJudgment {
  * LAXER where only a filesystem sees the escape (an in-root symlink pointing out vouches) and answers a
  * pattern on its spelling alone, so the two diverge in both directions.
  *
+ * A read target is also judged at its HOME VIEW (a path spelled through a firmlink or a bind mount of a home, respelled
+ * at the home): this judgment is its own placement — the views read the environment's declared home and the account
+ * home the account database answers once, for this call (`readDenyHomesOf`'s homes); the account home's probes wait at
+ * most a short bound of their own.
+ *
  * It carries NO deadline. Bounding an environment-facing wait and substituting a fail-closed verdict is the
  * gate FOLD's policy on the gate's one deadline seat; the station has never held one on either entry, and a
  * second default here would decide the same number twice and turn a slow-but-correct filesystem's true

package/dist/tools/fs/shell-read-check.js

@@ -6,6 +6,7 @@ import { NOT_AUTO_ALLOWED, programPositionRefusalSentence, readProgramPosition }
 import { bashClassifyDefaultAllow } from "./bash-readonly-classifier.js";
 import { planShellReads } from "./shell-read-plan.js";
 import { createShellReadEstablisher, establishShellReadsLexically } from "./shell-read-establish.js";
+import { declaredReadDenyHomes, homeViewsAt } from "./read-deny-home.js";
 import { programArgs, spellsOption } from "./shell-read-write-targets.js";
 import { allFindings, decideShellRead, denyRowAtOrBelow, foldShellReadFindings, judgeEstablishedPlan, readRootGrantCandidateOf, } from "./shell-read-judge.js";
 import { seatOf } from "../../core/tool-name-readings.js";
@@ -326,7 +327,7 @@ async function runShellReadStation(tool, command, declared, seat, readers, estab
 }
 export async function judgeShellRead(input) {
     const readers = input.readers ?? new Set(bashClassifyDefaultAllow());
-    const run = await runShellReadStation(input.tool ?? "Bash", input.command, input.boundary, input.seat, readers, createShellReadEstablisher(input.env, input.boundary.roots), input.env, input.signal);
+    const run = await runShellReadStation(input.tool ?? "Bash", input.command, input.boundary, input.seat, readers, createShellReadEstablisher(input.env, input.boundary.roots, { homeViews: homeViewsAt(input.env, declaredReadDenyHomes(input.env)) }), input.env, input.signal);
     const offer = normalizeReadRootCandidate(run.verdict.readRootCandidate);
     return {
         plan: run.plan,
@@ -349,7 +350,7 @@ export function createShellReadStation(opts) {
         const key = roots.join("\0");
         let e = establishers.get(key);
         if (e === undefined) {
-            e = createShellReadEstablisher(opts.env, roots, { rootsCanonical: opts.rootsCanonical === true });
+            e = createShellReadEstablisher(opts.env, roots, { rootsCanonical: opts.rootsCanonical === true, ...(opts.homeViews !== undefined ? { homeViews: opts.homeViews } : {}) });
             establishers.set(key, e);
         }
         return e;

package/dist/tools/fs/shell-read-establish.d.ts

@@ -40,6 +40,7 @@
 import type { ExecutionEnv } from "../../internal/harness-types.js";
 import type { ShellReadPlan, ShellReadSegment } from "./shell-read-plan.js";
 import type { EstablishedRead, ShellReadBoundary } from "./shell-read-judge.js";
+import type { HomeViewSource } from "./read-deny-home.js";
 /**
  * How many directories one glob operand (or one traversal root) may enumerate, and how many names it may
  * match, before the leg gives up and answers `unestablishable`.
@@ -82,7 +83,9 @@ export declare function establishShellReadsLexically(plan: ShellReadPlan, bounda
  * The filesystem-resolving establisher for one environment and one root set. `readRoots` are the roots
  * as declared (canonical by contract); they are resolved once more per instance because the comparison is
  * against `realpath` output on both sides — an aliased root would otherwise refuse every read under itself.
+ * `homeViews`: the home views of the placement the deny seats were compiled at (read-deny-home.ts); absent, the declared home's.
  */
 export declare function createShellReadEstablisher(env: ExecutionEnv, readRoots: readonly string[], opts?: {
     readonly rootsCanonical?: boolean;
+    readonly homeViews?: HomeViewSource;
 }): ShellReadEstablisher;

package/dist/tools/fs/shell-read-establish.js

@@ -534,7 +534,7 @@ export function createShellReadEstablisher(env, readRoots, opts) {
             if (lexicalOnly)
                 return establishShellReadsLexically(plan, boundary);
             const roots = await canonicalRoots(signal);
-            return await withHomeViews(env, await establishPlan(plan, { ...boundary, roots }, roots, signal), signal);
+            return await withHomeViews(env, opts, await establishPlan(plan, { ...boundary, roots }, roots, signal), signal);
         },
         reestablish: async (previous, boundary, signal) => {
             if (lexicalOnly)

package/dist/tools/fs/shell-read-identity.d.ts

@@ -9,12 +9,13 @@
  */
 import type { EstablishedPlan } from "./shell-read-establish.js";
 import type { EstablishedRead } from "./shell-read-judge.js";
-import { type HomeViewEnv } from "./read-deny-home.js";
+import { type HomeViewEnv, type HomeViewsCarrier } from "./read-deny-home.js";
 /** Every read of either establishment whose candidate's settled target set differs between the two. */
 export declare function movedReads(previous: EstablishedPlan, again: EstablishedPlan): EstablishedRead[];
 /**
  * The establishment with every read that landed carrying its HOME VIEW (read-deny-home.ts) among its spellings, nested
  * plans included: the deny judge then places a home-anchored row wherever the target IS below the home, whatever it is
- * spelled through. A read that did not land (lexical, unestablishable) is left as it is.
+ * spelled through. The views are `placed`'s — the home views of the placement the boundary's deny seats were compiled
+ * at. A read that did not land (lexical, unestablishable) is left as it is.
  */
-export declare function withHomeViews(env: HomeViewEnv, established: EstablishedPlan, signal?: AbortSignal): Promise<EstablishedPlan>;
+export declare function withHomeViews(env: HomeViewEnv, placed: HomeViewsCarrier | undefined, established: EstablishedPlan, signal?: AbortSignal): Promise<EstablishedPlan>;

package/dist/tools/fs/shell-read-identity.js

@@ -38,8 +38,8 @@ function targetsByCandidate(e) {
 function sameTargets(a, b) {
     return a.size === b.size && [...a].every((t) => b.has(t));
 }
-export async function withHomeViews(env, established, signal) {
-    const views = homeViewsOf(env, signal);
+export async function withHomeViews(env, placed, established, signal) {
+    const views = homeViewsOf(env, placed, signal);
     const place = async (p) => {
         const reads = new Map();
         for (const [segment, rs] of p.reads) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.38.0",
+  "version": "7.38.2",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",

package/wire-changes/core@7.38.1.json

@@ -0,0 +1,56 @@
+{
+  "repo": "core",
+  "version": "7.38.1",
+  "from": "f195abb9b3764b7d306d30ac7eee0c9ee82719f8",
+  "to": "0ee3363eac0ed4103b2598b72279b80b61f30a94",
+  "added": [],
+  "removed": [],
+  "changed": [],
+  "narrowed": [],
+  "closedSetMembers": [],
+  "closedSetsUnreadable": [],
+  "typeKeys": [],
+  "typeKeysUnreadableArms": [],
+  "typeKeysFlattenedCount": 220,
+  "declarationMoves": [],
+  "mintMoves": [],
+  "criteriaObserves": [
+    {
+      "kind": "taskEventField",
+      "name": "tool_end.errorCode",
+      "assertions": [
+        "G1.a",
+        "G1.b",
+        "G1.d",
+        "G1.e",
+        "G1.f"
+      ]
+    },
+    {
+      "kind": "taskEventField",
+      "name": "tool_end.output",
+      "assertions": [
+        "G1.a",
+        "G1.c",
+        "G1.d",
+        "G1.f"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "ToolCall.id",
+      "assertions": [
+        "G2.a",
+        "G2.b"
+      ]
+    }
+  ],
+  "consumersHint": {
+    "cli": [],
+    "server": [],
+    "sdk": [],
+    "note": "scanned cli@64a76326 server@61d9a1d1 sdk@925ffec — a name listed is MENTIONED there today, which is evidence of consumption, not proof of it"
+  },
+  "breakingCount": 0,
+  "breakingItems": []
+}

package/wire-changes/core@7.38.2.json

@@ -0,0 +1,26 @@
+{
+  "repo": "core",
+  "version": "7.38.2",
+  "from": "a8493dd6305fe6f8b3fea1174b56c30667f3ff1b",
+  "to": "201b3b096bc8086ff09caca61683c69acdc8bcbe",
+  "added": [],
+  "removed": [],
+  "changed": [],
+  "narrowed": [],
+  "closedSetMembers": [],
+  "closedSetsUnreadable": [],
+  "typeKeys": [],
+  "typeKeysUnreadableArms": [],
+  "typeKeysFlattenedCount": 220,
+  "declarationMoves": [],
+  "mintMoves": [],
+  "criteriaObserves": [],
+  "consumersHint": {
+    "cli": [],
+    "server": [],
+    "sdk": [],
+    "note": "scanned cli@64a76326 server@61d9a1d1 sdk@925ffec — a name listed is MENTIONED there today, which is evidence of consumption, not proof of it"
+  },
+  "breakingCount": 0,
+  "breakingItems": []
+}