@sema-agent/core 7.40.0 → 7.41.0

package/dist/core/runner/active-skill-scope.d.ts

@@ -1,58 +0,0 @@
-import type { ExecutionEnv } from "../../internal/harness-types.js";
-import type { SkillManifest, ToolEffect } from "../types.js";
-import type { ToolPolicy } from "../tool-policy.js";
-/** One active skill frame: either a resolved manifest, or a fail-closed marker that the manifest for a
- *  loaded skill could not be resolved (→ DENY-ALL while this frame is active). */
-export type ActiveSkillFrame = {
-    kind: "manifest";
-    manifest: SkillManifest;
-} | {
-    kind: "unresolved";
-    lineageId: string;
-    reason: string;
-};
-/**
- * The per-task LIFO stack of active skill frames. Owned by `prepare-task`'s closure;
- * the injected `skill` tool pushes onto it on a successful load, and a deny-narrowing policy reads it
- * on every tool call. A simple array is the stack — `push` on load, and the policy reads ALL frames
- * currently on it (the intersection). v1 keeps lifetime heuristic (see module header).
- */
-export declare class ActiveSkillScope {
-    private readonly frames;
-    /** Push a resolved manifest frame (skill loaded successfully WITH a manifest). */
-    push(frame: ActiveSkillFrame): void;
-    /** Pop the most-recently-pushed frame (LIFO). Returns it, or undefined when empty. v1 surfaces this
-     *  for the "next-skill-load pops the previous sibling frame" lifetime — see prepare-task wiring. */
-    pop(): ActiveSkillFrame | undefined;
-    /** Snapshot of the live frames (a copy — callers must not mutate the stack through it). */
-    active(): readonly ActiveSkillFrame[];
-    get size(): number;
-}
-/**
- * Build the Gate-3 deny-narrowing policy over a live {@link ActiveSkillScope}. For each
- * tool call, WHILE any skill frame is active:
- *  - DENY any tool not in the INTERSECTION of every active frame's `allowTools`.
- *  - For a WRITE tool with an `allowPaths` constraint on ANY active frame, DENY a write whose
- *    canonicalized target is outside every listed prefix (reuses {@link canonicalizeTarget}, so a
- *    symlink can't carry across a write outside the allowed paths).
- *  - A frame whose manifest could not be resolved (`kind:"unresolved"`) → DENY-ALL (fail-closed: no
- *    allowlist means nothing is allowed — NOT the bare task policy).
- * When NO frame is active, the policy returns `allow` for everything (it only ever subtracts), leaving
- * the task policy unmodified — so a skill WITHOUT a manifest, or a task before any skill load, behaves
- * exactly as before (backward-compatible).
- *
- * This policy must be composed via `combinePolicies(scopePolicy, taskPolicy)` so its `deny`
- * short-circuits the fold and a task-policy `allow` can never widen it.
- *
- * `env`/`rootPath` are the SAME execution env + tracked cwd the hand tools resolve against, so
- * `allowPaths` matching sees the task's real filesystem (a remote/E2B task resolves in its container).
- */
-export declare function createActiveSkillScopePolicy(opts: {
-    scope: ActiveSkillScope;
-    env: ExecutionEnv;
-    rootPath?: string;
-    /** Per-tool side-effect class (the SAME `toolEffects` map prepare-task builds). Lets the scope policy
-     *  fail CLOSED on a mutating tool that `allowPaths` can NOT confine (e.g. `bash` — no parseable path):
-     *  while an `allowPaths` constraint is active, such a tool is DENIED, never allowed to write anywhere. */
-    toolEffects?: ReadonlyMap<string, ToolEffect>;
-}): ToolPolicy;

package/dist/core/runner/active-skill-scope.js

@@ -1,133 +0,0 @@
-import { canonicalizeTarget, pathFamilyOf } from "../../tools/fs/safety.js";
-import { pathTargetValue } from "../tool-registry.js";
-import { pathTargetBaseOf } from "../effective-path-target.js";
-import { PATH_WRITE_TOOLS, isWithin } from "./session-rule-policy.js";
-import { parseSkillToolEntry, skillSpecifierRejection } from "../skill-tool-specifier.js";
-import { heldValues, wireOf } from "../tool-name-readings.js";
-export class ActiveSkillScope {
-    frames = [];
-    push(frame) {
-        this.frames.push(frame);
-    }
-    pop() {
-        return this.frames.pop();
-    }
-    active() {
-        return [...this.frames];
-    }
-    get size() {
-        return this.frames.length;
-    }
-}
-export function createActiveSkillScopePolicy(opts) {
-    const { scope, env, rootPath, toolEffects } = opts;
-    return {
-        async check(req, signal) {
-            const entriesFor = (byName) => heldValues("policy.skillScope", byName, req).flat();
-            const frames = scope.active();
-            if (frames.length === 0)
-                return { action: "allow" };
-            const unresolved = frames.find((f) => f.kind === "unresolved");
-            if (unresolved && unresolved.kind === "unresolved") {
-                return {
-                    action: "deny",
-                    message: `tool "${req.toolName}" denied: active skill artifact "${unresolved.lineageId}" manifest could not be resolved (${unresolved.reason}) — fail-closed deny-all`,
-                    decisionReason: "safety",
-                };
-            }
-            const manifests = frames.flatMap((f) => (f.kind === "manifest" ? [f.manifest] : []));
-            const perFrame = manifests.map((m) => {
-                const byName = new Map();
-                for (const raw of m.allowTools) {
-                    const entry = parseSkillToolEntry(raw);
-                    const bucket = byName.get(entry.name);
-                    if (bucket)
-                        bucket.push(entry);
-                    else
-                        byName.set(entry.name, [entry]);
-                }
-                return { manifest: m, byName };
-            });
-            if (perFrame.length === 0 || perFrame.some((f) => entriesFor(f.byName).length === 0)) {
-                const ids = manifests.map((m) => m.lineageId).join(", ");
-                return {
-                    action: "deny",
-                    message: `tool "${req.toolName}" is not in the active skill manifest allowlist (artifact(s): ${ids})`,
-                    decisionReason: "safety",
-                };
-            }
-            for (const frame of perFrame) {
-                const alternatives = entriesFor(frame.byName);
-                const rejections = [];
-                let admitted = false;
-                for (const entry of alternatives) {
-                    const rejection = skillSpecifierRejection(entry, req.args);
-                    if (rejection === undefined) {
-                        admitted = true;
-                        break;
-                    }
-                    rejections.push(rejection);
-                }
-                if (!admitted) {
-                    return {
-                        action: "deny",
-                        message: `tool "${req.toolName}" is narrowed by skill manifest "${frame.manifest.lineageId}": ${rejections.join("; ")}`,
-                        decisionReason: "safety",
-                    };
-                }
-            }
-            const pathConstrainingActive = manifests.some((m) => m.allowPaths && m.allowPaths.length > 0);
-            const declaredTarget = req.face?.pathTarget;
-            const skillScopeEligible = declaredTarget !== undefined && declaredTarget.skillScopeEligible === true;
-            if (pathConstrainingActive && !skillScopeEligible) {
-                const eff = toolEffects?.get(wireOf("policy.skillScope.effect", req)) ?? "write";
-                if (eff !== "read") {
-                    const ids = manifests.filter((m) => m.allowPaths?.length).map((m) => m.lineageId).join(", ");
-                    return {
-                        action: "deny",
-                        message: `write-capable tool "${req.toolName}" denied: active skill manifest constrains writes to allowPaths but this tool's target cannot be path-confined (only ${[...PATH_WRITE_TOOLS].join("/")} are) — fail-closed (artifact(s): ${ids})`,
-                        decisionReason: "safety",
-                    };
-                }
-            }
-            if (skillScopeEligible) {
-                const constraining = manifests.filter((m) => m.allowPaths && m.allowPaths.length > 0);
-                if (constraining.length > 0) {
-                    const path = pathTargetValue(req.args, declaredTarget);
-                    if (typeof path !== "string" || path.length === 0) {
-                        return {
-                            action: "deny",
-                            message: `write tool "${req.toolName}" denied: active skill manifest constrains writes to allowPaths but the call has no resolvable path`,
-                            decisionReason: "safety",
-                        };
-                    }
-                    const canon = await canonicalizeTarget(env, path, signal, pathFamilyOf({ root: rootPath, cwd: req.cwd ?? env.cwd }), pathTargetBaseOf(declaredTarget, { root: rootPath, cwd: req.cwd }));
-                    if (!canon.ok) {
-                        return {
-                            action: "deny",
-                            message: `write to "${path}" denied: its real target could not be resolved against the active skill manifest allowPaths`,
-                            decisionReason: "safety",
-                        };
-                    }
-                    for (const m of constraining) {
-                        const roots = [];
-                        for (const raw of m.allowPaths ?? []) {
-                            const r = await canonicalizeTarget(env, raw, signal, pathFamilyOf({ root: rootPath ?? env.cwd }), rootPath);
-                            if (r.ok)
-                                roots.push(r.key);
-                        }
-                        const inside = roots.some((root) => isWithin(root, canon.key));
-                        if (!inside) {
-                            return {
-                                action: "deny",
-                                message: `write to "${path}" is outside the paths allowed by skill manifest "${m.lineageId}" (allowPaths: ${(m.allowPaths ?? []).join(", ")})`,
-                                decisionReason: "safety",
-                            };
-                        }
-                    }
-                }
-            }
-            return { action: "allow" };
-        },
-    };
-}

package/dist/core/skill-tool-specifier.d.ts

@@ -1,80 +0,0 @@
-/**
- * Pattern specifiers inside a {@link import("./types.js").SkillManifest}'s `allowTools`.
- *
- * An entry may be a bare tool name (`Bash`) or a name carrying a specifier (`Bash(git:*)`). A bare name
- * claims the whole tool; a specifier claims a NARROWER slice of it. Both directions of that sentence are
- * load-bearing: a specifier is only ever a further restriction on a tool the frame already admits, and
- * every shape this module cannot decide resolves to DENY — never to the bare name (that would turn
- * "only git" into "all of Bash", which is the one thing a narrowing-only structure must never do).
- *
- * ## Upstream semantics (decoded Claude Code 2.1.220 bundle)
- *
- * The rule-string grammar — `Tool(content)`, `\(`/`\)` escapes, `Tool()` and `Tool(*)` collapsing to the
- * bare name — is already mirrored by {@link parsePermissionRule}, so this module REUSES it rather than
- * growing a second parser for the same syntax.
- *
- * A rule content is classified into one of three forms, and each form has its own comparison:
- *  - **prefix** (`git:*`, the trailing `:*` form): matches when the command EQUALS the prefix or starts
- *    with `prefix + " "`. The space is the whole point — a raw string prefix would let `Bash(git:*)`
- *    admit `gitk` and `git-lfs`, two unrelated programs.
- *  - **wildcard** (contains an unescaped `*`, e.g. `git *`): a full-string anchored `*` match, done here
- *    with {@link wildcardMatch} (the existing linear-time, ReDoS-free matcher).
- *  - **exact** (no `*` at all): string equality.
- * Runs of spaces/tabs are collapsed on both sides before comparing, and comparison is case-sensitive —
- * both mirroring the upstream POSIX shell lane.
- *
- * ## Why a fail-closed simple-command floor comes first
- *
- * Upstream, a rule in the ALLOW direction never matches a compound command: its matcher short-circuits
- * on a multi-command string, so `git status && rm -rf /` can never be admitted by `Bash(git:*)`. The
- * same floor is built here out of {@link parseLeadingCommandName} — the single simple-command parser
- * already shared by `bash_readonly`, the `bash` reversibility classifier and the coarse command-name
- * policy. It rejects shell operators, substitution, redirection, backgrounding, a path-prefixed argv[0],
- * a leading env assignment, and an argv[0] carrying quote/brace/glob metacharacters. Nothing it rejects
- * ever reaches pattern matching, so no specifier form — wildcards included — can be talked into
- * admitting a second program smuggled in behind the first.
- *
- * Reusing that parser rather than writing a second tokenizer is deliberate: two argv[0] parsers drift,
- * and the drift shows up as a circumvention rather than as a test failure.
- *
- * ## Scope: the shell-command lane only
- *
- * Specifiers are enforced for the tools whose primary argument IS a shell command string — the shared
- * {@link COARSE_SHELL_TOOLS} set, which the other command-name gates in `tool-policy.ts` already key on
- * (so a shell tool added there is covered here without a second list to remember).
- *
- * A specifier on any other tool is deliberately NOT enforced, and stays denied-and-disclosed:
- *  - upstream does not carry specifiers through this face either — its agent tool-list resolution parses
- *    a `Tool(spec)` entry and then uses only the tool NAME for everything except its delegation tool;
- *  - a path-shaped specifier (`Read(src/**)`) would be a SECOND, weaker path-narrowing face next to
- *    `SkillManifest.allowPaths`, which canonicalizes its target and therefore survives a symlink. A
- *    string-level glob does not, and shipping the weaker one beside the stronger one invites the wrong
- *    choice;
- *  - reads are deliberately never path-narrowed by this gate (it restricts capability, not visibility);
- *    `Read(src/**)` would reverse that settled decision as a side effect of syntax support.
- */
-/** One `allowTools` entry, split into the tool it names and the optional narrowing it claims. */
-export interface SkillToolEntry {
-    /** The raw entry, kept verbatim so a deny reason can quote what the author actually wrote. */
-    readonly raw: string;
-    /** Tool name as parsed, RAW (RB-476-A: legacy-name normalization is retired repo-wide). */
-    readonly name: string;
-    /** The specifier, or `undefined` for a bare entry (including `Tool()` / `Tool(*)`, which claim nothing). */
-    readonly specifier?: string;
-}
-/**
- * Split one `allowTools` entry. Delegates the `Tool(content)` grammar to {@link parsePermissionRule}, so
- * escaping and the `Tool()`/`Tool(*)` collapse behave identically to every other rule-string site.
- */
-export declare function parseSkillToolEntry(entry: string): SkillToolEntry;
-/** Whether a specifier on this (canonical) tool is a shape this lane can actually decide. */
-export declare function isSkillSpecifierEnforced(canonicalName: string): boolean;
-/**
- * Decide one specifier against one tool call. Returns `undefined` when the call is admitted, or a
- * human-readable reason when it is not.
- *
- * Every path that is not a positive match returns a reason: an unenforced tool, an unreadable command,
- * a command the shared simple-command parser refuses, and a command the pattern does not cover. The
- * caller turns a reason into a deny — a specifier never falls back to its bare tool name.
- */
-export declare function skillSpecifierRejection(entry: SkillToolEntry, args: unknown): string | undefined;

package/dist/core/skill-tool-specifier.js

@@ -1,57 +0,0 @@
-import { parsePermissionRule, wildcardMatch } from "./permission-rules.js";
-import { COARSE_SHELL_TOOLS } from "./tool-policy.js";
-import { parseLeadingCommandName } from "../tools/fs/bash-readonly-classifier.js";
-const SPECIFIER_ENFORCED_TOOLS = new Set(COARSE_SHELL_TOOLS);
-export function parseSkillToolEntry(entry) {
-    const parsed = parsePermissionRule(entry);
-    const name = parsed.toolName;
-    return parsed.ruleContent === undefined ? { raw: entry, name } : { raw: entry, name, specifier: parsed.ruleContent };
-}
-export function isSkillSpecifierEnforced(canonicalName) {
-    return SPECIFIER_ENFORCED_TOOLS.has(canonicalName);
-}
-function normalizeSpacing(s) {
-    return s.trim().replace(/[ \t]+/g, " ");
-}
-function hasUnescapedStar(content) {
-    for (let i = 0; i < content.length; i++) {
-        if (content[i] !== "*")
-            continue;
-        let backslashes = 0;
-        for (let j = i - 1; j >= 0 && content[j] === "\\"; j--)
-            backslashes++;
-        if (backslashes % 2 === 0)
-            return true;
-    }
-    return false;
-}
-function specifierMatchesCommand(specifier, command) {
-    const spec = normalizeSpacing(specifier);
-    const prefix = /^(.+):\*$/.exec(spec)?.[1];
-    if (prefix !== undefined) {
-        return command === prefix || command.startsWith(prefix + " ");
-    }
-    if (hasUnescapedStar(spec))
-        return wildcardMatch(spec, command);
-    return command === spec;
-}
-export function skillSpecifierRejection(entry, args) {
-    const { specifier } = entry;
-    if (specifier === undefined)
-        return undefined;
-    if (!isSkillSpecifierEnforced(entry.name)) {
-        return `entry "${entry.raw}" narrows a tool whose calls this gate cannot match against a command pattern — only the shell tools (${[...SPECIFIER_ENFORCED_TOOLS].join(", ")}) carry a command string, so the entry admits nothing`;
-    }
-    const command = args?.command;
-    if (typeof command !== "string") {
-        return `entry "${entry.raw}" requires a command string to match against, and this call has none`;
-    }
-    const parsedCommand = parseLeadingCommandName(command);
-    if ("reject" in parsedCommand) {
-        return `entry "${entry.raw}" only admits a single simple command (${parsedCommand.reject})`;
-    }
-    if (!specifierMatchesCommand(specifier, normalizeSpacing(command))) {
-        return `command "${command.trim()}" is not admitted by entry "${entry.raw}"`;
-    }
-    return undefined;
-}