@sema-agent/core 7.41.0 → 7.41.1

package/CHANGELOG.md

@@ -1,3 +1,23 @@
+## 7.41.1 — 2026-10-05
+
+**Hard-breaking changes:** none. **Closed sets:** none added (two existing sets become reachable from the package root). **Package exports:** +5 / −0 — `SKILL_GRANT_ORIGINS`, `SKILL_ENTRY_INERT_REASONS`, types `SkillGrantOrigin`, `SkillEntryInertReason` (all defined in 7.41.0, re-exported now), and `mintNamespacePrefix` (#1355, defined since the namespace minting landed, re-exported now).
+
+### The two skill-grant vocabularies are on the package root (#1347; surface only; +4 exports) (@client-core @server)
+
+- **Before (v7.41.0).** `SKILL_GRANT_ORIGINS` (`model` / `user` / `inherited`) and `SKILL_ENTRY_INERT_REASONS` (`wildcard_all` / `namespace_wildcard` / `path_pattern` / `domain` / `content_unsupported` / `grammar`) and their two types were declared in `dist/core/skill-grant.d.ts` and not re-exported from `index.d.ts`; the 7.41.0 ship post called them consumable closed sets because the wire manifest scans every `dist/` file, not the package root.
+- **Now.** Both constants and both types are re-exported from the package root beside `RULE_TOOL_NAME_VERDICTS`; the consumer smoke probe asserts their presence.
+- **Who is hurt.** Nobody: additive.
+- **Consumers.** client-core — generate the two mirrors from the package root (CC-338). server — none.
+- Pins: `test/export-surface.snapshot.json` (+4 names); `scripts/consumer-smoke-probe.mjs` (two new object entries, run by `gate:blackbox`).
+
+### The peer-segment minter is on the package root (#1355 part one; surface only; +1 export) (@server)
+
+- **Before (v7.41.0).** A covering-form rule such as `mcp__github.com` (two segments, accepted since #1156) or `mcp__github.com__*` was compiled and stored as written, while the engine mints the peer segment normalized (character set, length clamp with a digest suffix, separator fold: `mcp__github_com__`). The rule's segment and the minted segment are compared byte for byte, so such a rule never matches — a deny that reads protective and is inert. Nothing on the package root let a rule writer ask "is this segment one the engine mints?".
+- **Now.** `mintNamespacePrefix(ns, peer)` (src/core/protocol-naming.ts) is re-exported from the package root beside `PROTOCOL_TABLE` / `MCP_NAMESPACE` / `A2A_NAMESPACE`: a rule writer mints the prefix for the rule's peer and compares it with the rule's own spelling. Part two (7.42.0): `judgeRuleToolName` gains the verdict `unmintable_segment` with the minted spelling as `currentName`, and both rule compilers refuse through that one judge.
+- **Who is hurt.** Nobody: additive.
+- **Consumers.** server — S-1113: judge `permissions.deny` / `APPROVAL_DENY` covering-form rules at the door until the 7.42.0 verdict lands.
+- Pins: `test/export-surface.snapshot.json` (+1 name); `scripts/consumer-smoke-probe.mjs` (one new function entry, run by `gate:blackbox`).
+
 ## 7.41.0 — 2026-10-04
 
 **Hard-breaking changes:** one — #1303. **#1303 — Before:** a skill that declared `allowed-tools` (or a host's `SkillSpec.manifest.allowTools`) narrowed the whole task once activated: every unlisted tool was refused (`allowPaths` fenced writes to directories), the listed ones still asked where they always asked, and activating it asked nobody. **#1303 — Who is hurt:** a deployment that relied on a skill's list to fence the model — an unlisted tool is now judged as usual (asked under an asking mode, run under `bypassPermissions` or a deployment allow) and a listed one runs without asking for the rest of the run; a host that hand-built `SkillSpec.manifest` (now refused by name: `config.spec_retired_key`) or wrote `allowPaths` (the write fence is gone), imported the deleted `SkillManifest` type or `skillScopeWriteToolNames`, passed the retired `deployedTools` option to `createSkillsFromDirectory` (refused: `config.deps_retired_key`) or matched on one of its three removed warning codes, or built an auto-promote record with `manifest` / `gate3Scoped` / `lineageId` or passed a manifest to `deriveTripwire`; an embedder with no approver under an asking mode (activating a skill that declares a list is now a card nobody answers — refused); a deployment policy that returns an unmarked `ask` (class `ordinary`) for a listed tool (the list clears it, as a stored allow rule would); a delegation tool that read `ctx.activeSkillScope()` (renamed `ctx.activeSkillGrants()`). **#1303 — Compensation:** fence tools with deny rules (a deployment deny list, a person's deny row) or a delegated agent definition's `allowTools`; fence write paths with session `allowDirs` / the write face (`createSessionRulePolicy`, the fs-write gate); mark a policy's question `mandated` / `requiresRealApproval` (or write an ask rule) when it must reach a person; with no approver, name `Skill` in an allow list or run `bypassPermissions`; move `manifest.allowTools` to `SkillSpec.allowedTools`; drop `deployedTools` (the loader copies every entry and the run's grant table reads it); give `deriveTripwire` the artifact's `{ allowedTools }` and drop `manifest` / `gate3Scoped` / `lineageId` from the promoted record. Everything else in this version adds, tightens or re-words: #1118 adds optional members and text lines; #1294 changes which hook seats fire for a call approved on a parked checkpoint (a PreToolUse seat now sees that call again on the resumed leg); #1307 / #1308 re-word request-time refusals of the file stores (no on-disk location in the sentence; the location rides the store's disclosure seat); #1309 turns a session's enumeration over its own damaged row from a short list into a refusal; #1310 and #1314 change model-facing text only; #1156 refuses a retired or prefix-less `__` tool name at the session-rules write (it used to fail every later run instead); #1328 refuses a resumed `Skill` call whose final arguments select another skill than the card named. **Closed sets:** `DecisionReason` +1 `skill`; `ASK_CLASSES` / `AskClass` +1 `requires_user_interaction` (`MODE_ARBITRATION` +1 row; `RELEASABLE_ASK_CLASSES` and `PERSISTED_RULE_MANDATES` unchanged); `ENGINE_NOTICE_CODES` +1 `skills.allowed_tool_not_granted` (audience `operator`, minter `engine`); trace kinds +1 `permission.skill_allowed`; config refusal codes +1 `config.user_invoked_skill_unknown`; `CheckpointErrorReason` +1 `skill_grants_damaged` and `CheckpointError.detail.field` +1 `boundGrantDigest` (both on the existing `checkpoint.invalid_outcome`); `SessionPolicyError.code` +1 `legacy_tool_name` (with `detail: { field, name, verdict, currentName? }`); new closed set `RULE_TOOL_NAME_VERDICTS` (`current` / `retired` / `unprefixed_namespace`). **Package exports:** +22 / −2 (the entry's count 2558 → 2578). Added — #1118: `readAgentState`, `agentStateSourceOfRecord`, `agentStateSummary`, types `AgentState`, `AgentApproval`, `AgentApprovalState`, `AgentStateRow`, `AgentStateSource`, `TranscriptStep`; #1303: types `SkillGrantRecord`, `SkillGrantHit`, `SkillGrantLane`, `SkillGateSeats`, `PermissionSeatInputs`, `PermissionSeatReading`; #1308: type `FileUsageWindowStoreOptions`; #1156: `judgeRuleToolName`, `RULE_TOOL_NAME_VERDICTS`, `assertSessionRuleNamesCurrent`, types `RuleToolNameVerdict`, `SessionPolicyStoreOptions`, `SessionRuleNameRefusal`. Removed — #1303: `SkillManifest`, `skillScopeWriteToolNames`. Members — new and optional: `TaskSpec.userInvokedSkills`, `SkillSpec.allowedTools` / `disallowedTools`, `CheckpointState.skillGrants`, the `tool_approval` pending action's `boundGrantDigest`, `ToolGateInput.requiresUserInteraction`, `UnifiedTaskOutput.agentState`, `AgentPollDetailsInput.agentState`, `ListAgentsRow.agentState`, `serveDurableAgentRowLane(row, agentState?)`, `checkpointSeat` on `AgentTranscriptToolOptions` / `ListAgentsToolOptions` / `TaskToolOptions` / `TaskPollOptions`, `TaskRegistry.agentStateSource` (new method), `FileUsageWindowStore`'s constructor options and `createFileTaskListStore`'s `onCorruptRead`, `mountedToolNames` on both session-rules stores (`FileStorageBackendOptions.sessionPolicy` forwards it), `loosenReasons`' third parameter; `AgentTranscriptToolOptions.registry` widens to `Pick<TaskRegistry, "getAccessibleTask"> & Partial<Pick<TaskRegistry, "agentStateSource">>` (a full `TaskRegistry` still fits). Removed (the hard-breaking change above): `SkillSpec.manifest` (a host still passing it is refused by name), `SkillsDirectoryOptions.deployedTools` (refused by name), three `SkillsDirectoryWarningCode` words (`allowed_tool_pattern_unsupported`, `allowed_tool_not_mounted`, `disallowed_tools_unenforced`), `PromotedRecord.manifest` / `gate3Scoped` / `lineageId`; `deriveTripwire`'s second parameter is `Pick<SkillSpec, "allowedTools">` (was `SkillManifest`).

package/dist/index.d.ts

@@ -198,7 +198,9 @@ export { type AskOrigin, ASK_ORIGINS, isAskOrigin, ORIGIN_IMPLIES_REAL_APPROVAL,
 export { PERMISSION_MODES, type PermissionMode, isPermissionMode, PERMISSION_MODE_RANK, clampPermissionMode, ASK_CLASSES, type AskClass, isAskClass, MODE_ARBITRATION, type ModeArbitrationRow, RELEASABLE_ASK_CLASSES, MODE_RELEASE_REASONS, type ModeReleaseReason, isModeReleaseReason, RRA_EXPLAINERS, classifyAsk, foldArbitrationRow, type AskClassification, type AskClassFacts, type ToolMarkSource, arbitrateByMode, type Arbitration, fileCommandOptionsSentence } from "./core/ask-origin.js";
 export { modePolicyOf, type ModePolicy, PERMISSION_MODE_FOLD_REASONS, type PermissionModeFoldReason, type PermissionModeReceipt, ACCEPT_EDITS_FILE_COMMANDS, modeAcceptsFileCommand } from "./core/mode-policy.js";
 export type { PermissionSeatInputs, PermissionSeatReading } from "./core/mode-policy.js";
-export type { SkillGateSeats, SkillGrantHit, SkillGrantLane, SkillGrantRecord } from "./core/skill-grant.js";
+export type { SkillEntryInertReason, SkillGateSeats, SkillGrantHit, SkillGrantLane, SkillGrantOrigin, SkillGrantRecord } from "./core/skill-grant.js";
+export { SKILL_ENTRY_INERT_REASONS, SKILL_GRANT_ORIGINS } from "./core/skill-grant.js";
+export { mintNamespacePrefix } from "./core/protocol-naming.js";
 export { readDenyClassifierRules, renderClassifierDenyRules, type DerivedDenyRule } from "./core/auto-mode-prompt.js";
 export { AUTO_MODE_DENY_SOURCES, isAutoModeDenySource, type AutoModeDenySource } from "./core/runtime-caps.js";
 export { SETTLEMENT_KINDS, type SettlementKind, isSettlementKind, type Settlement, SETTLEMENT_PARTIES, type SettlementParty, isSettlementParty, SETTLEMENT_IS_REFUSAL, DENIED_BY_VALUES, type DeniedBy, isDeniedBy, DENIED_BY_MAY_VETO, CLASSIFIER_DENY_CAUSES, type ClassifierDenyCause, isClassifierDenyCause, DENIED_BY_MAY_CARRY_CAUSE, type GateDisposition, type GateOutcome, type ModeRelease, type ModeRefusal, screenGateOutcome } from "./core/gate-outcome.js";

package/dist/index.js

@@ -162,6 +162,8 @@ export {} from "./core/read-root-grant-screen.js";
 export { ASK_ORIGINS, isAskOrigin, ORIGIN_IMPLIES_REAL_APPROVAL, PERSISTED_RULE_MANDATES, isPersistedRuleMandate, screenAskClassMembers } from "./core/ask-origin.js";
 export { PERMISSION_MODES, isPermissionMode, PERMISSION_MODE_RANK, clampPermissionMode, ASK_CLASSES, isAskClass, MODE_ARBITRATION, RELEASABLE_ASK_CLASSES, MODE_RELEASE_REASONS, isModeReleaseReason, RRA_EXPLAINERS, classifyAsk, foldArbitrationRow, arbitrateByMode, fileCommandOptionsSentence } from "./core/ask-origin.js";
 export { modePolicyOf, PERMISSION_MODE_FOLD_REASONS, ACCEPT_EDITS_FILE_COMMANDS, modeAcceptsFileCommand } from "./core/mode-policy.js";
+export { SKILL_ENTRY_INERT_REASONS, SKILL_GRANT_ORIGINS } from "./core/skill-grant.js";
+export { mintNamespacePrefix } from "./core/protocol-naming.js";
 export { readDenyClassifierRules, renderClassifierDenyRules } from "./core/auto-mode-prompt.js";
 export { AUTO_MODE_DENY_SOURCES, isAutoModeDenySource } from "./core/runtime-caps.js";
 export { SETTLEMENT_KINDS, isSettlementKind, SETTLEMENT_PARTIES, isSettlementParty, SETTLEMENT_IS_REFUSAL, DENIED_BY_VALUES, isDeniedBy, DENIED_BY_MAY_VETO, CLASSIFIER_DENY_CAUSES, isClassifierDenyCause, DENIED_BY_MAY_CARRY_CAUSE, screenGateOutcome } from "./core/gate-outcome.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.41.0",
+  "version": "7.41.1",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",

package/test/export-surface.snapshot.json

@@ -1,7 +1,7 @@
 {
   "_comment": "design/87 L3 — frozen public export surface of src/index.ts (name -> kind). DO NOT edit by hand to silence a red test. A removed/changed entry = a SemVer-BREAKING change; bump MAJOR and update this fixture in the SAME commit (design/87 §4.2 / §5.2). Regenerate via REGEN in test/export-surface.test.ts.",
   "_tierComment": "#435 v1 — machine-readable layering of the public surface: stable = demonstrated by README.md / src/examples; internal = an `Internal`-marked name or a runner/engine deep-subtree declaration (the model seam src/engine/llm is excluded — it is the BYOM contract, not an engine internal); advanced = a supported export the front door does not walk you through. THIS IS AN INITIAL HEURISTIC, derived mechanically and expected to be refined ticket by ticket: no human reviewed these 1700+ entries one by one, and nothing here claims otherwise. Known bias: a short or English-word export name (ok, err, Result, Usage) can match ordinary prose in README.md and land `stable` on a coincidence. Every export MUST carry a tier — a new export with no row fails the gate in export-surface.test.ts.",
-  "count": 2578,
+  "count": 2583,
   "exports": {
     "A2ATaskState": "type",
     "A2ATaskStateReversal": "type",
@@ -1337,6 +1337,8 @@
     "SHELL_READ_FINDING_RANK": "variable",
     "SHELL_READ_SEATS": "variable",
     "SHELL_WRAPPER_TABLE": "variable",
+    "SKILL_ENTRY_INERT_REASONS": "variable",
+    "SKILL_GRANT_ORIGINS": "variable",
     "SKILL_TOOL_NAME": "variable",
     "STALE_RUNNING_REAP_ATTRIBUTION": "variable",
     "STARTER_RULES": "variable",
@@ -1448,9 +1450,11 @@
     "SideQueryResult": "interface",
     "SideQuerySpec": "interface",
     "SideQueryToolDef": "interface",
+    "SkillEntryInertReason": "type",
     "SkillGateSeats": "interface",
     "SkillGrantHit": "interface",
     "SkillGrantLane": "interface",
+    "SkillGrantOrigin": "type",
     "SkillGrantRecord": "interface",
     "SkillSpec": "interface",
     "SkillsDirectoryOptions": "interface",
@@ -2228,6 +2232,7 @@
     "mintCheckpointToken": "function",
     "mintExposurePartitionedPlan": "function",
     "mintLlmConsolidationPlan": "function",
+    "mintNamespacePrefix": "function",
     "mintPeerRef": "function",
     "mintPeerSessionCandidates": "function",
     "mintReminderMark": "function",
@@ -3917,6 +3922,8 @@
     "SHELL_READ_FINDING_RANK": "advanced",
     "SHELL_READ_SEATS": "advanced",
     "SHELL_WRAPPER_TABLE": "advanced",
+    "SKILL_ENTRY_INERT_REASONS": "advanced",
+    "SKILL_GRANT_ORIGINS": "advanced",
     "SKILL_TOOL_NAME": "internal",
     "STALE_RUNNING_REAP_ATTRIBUTION": "advanced",
     "STARTER_RULES": "advanced",
@@ -4028,9 +4035,11 @@
     "SideQueryResult": "advanced",
     "SideQuerySpec": "advanced",
     "SideQueryToolDef": "advanced",
+    "SkillEntryInertReason": "advanced",
     "SkillGateSeats": "advanced",
     "SkillGrantHit": "advanced",
     "SkillGrantLane": "advanced",
+    "SkillGrantOrigin": "advanced",
     "SkillGrantRecord": "advanced",
     "SkillSpec": "stable",
     "SkillsDirectoryOptions": "advanced",
@@ -4808,6 +4817,7 @@
     "mintCheckpointToken": "advanced",
     "mintExposurePartitionedPlan": "advanced",
     "mintLlmConsolidationPlan": "advanced",
+    "mintNamespacePrefix": "advanced",
     "mintPeerRef": "advanced",
     "mintPeerSessionCandidates": "advanced",
     "mintReminderMark": "advanced",

package/wire-changes/core@7.41.1.json

@@ -0,0 +1,159 @@
+{
+  "repo": "core",
+  "version": "7.41.1",
+  "from": "e91ad31a94f1ea1688241d5bb9e5e278986f3d23",
+  "to": "08eee448c5a848592a8c12684867cd423eac5d95",
+  "added": [
+    {
+      "name": "SKILL_ENTRY_INERT_REASONS",
+      "kind": "variable",
+      "tier": "advanced",
+      "at": [
+        "src/core/skill-grant.ts:65",
+        "src/index.ts:1470"
+      ],
+      "criteriaCovered": false,
+      "breaking": false
+    },
+    {
+      "name": "SKILL_GRANT_ORIGINS",
+      "kind": "variable",
+      "tier": "advanced",
+      "at": [
+        "src/core/skill-grant.ts:46",
+        "src/index.ts:1470"
+      ],
+      "criteriaCovered": false,
+      "breaking": false
+    },
+    {
+      "name": "SkillEntryInertReason",
+      "kind": "type",
+      "tier": "advanced",
+      "at": [
+        "src/core/skill-grant.ts:66",
+        "src/index.ts:1469"
+      ],
+      "criteriaCovered": false,
+      "breaking": false
+    },
+    {
+      "name": "SkillGrantOrigin",
+      "kind": "type",
+      "tier": "advanced",
+      "at": [
+        "src/core/skill-grant.ts:47",
+        "src/index.ts:1469"
+      ],
+      "criteriaCovered": false,
+      "breaking": false
+    },
+    {
+      "name": "mintNamespacePrefix",
+      "kind": "function",
+      "tier": "advanced",
+      "at": [
+        "src/core/protocol-naming.ts:114",
+        "src/index.ts:1471"
+      ],
+      "criteriaCovered": false,
+      "breaking": false
+    }
+  ],
+  "removed": [],
+  "changed": [],
+  "narrowed": [],
+  "closedSetMembers": [],
+  "closedSetsUnreadable": [],
+  "typeKeys": [],
+  "typeKeysUnreadableArms": [],
+  "typeKeysFlattenedCount": 225,
+  "signatures": [],
+  "declarationMoves": [
+    {
+      "name": "SKILL_ENTRY_INERT_REASONS",
+      "kind": "variable",
+      "onSurface": true,
+      "from": [
+        "src/core/skill-grant.ts"
+      ],
+      "to": [
+        "src/core/skill-grant.ts",
+        "src/index.ts"
+      ]
+    },
+    {
+      "name": "SKILL_GRANT_ORIGINS",
+      "kind": "variable",
+      "onSurface": true,
+      "from": [
+        "src/core/skill-grant.ts"
+      ],
+      "to": [
+        "src/core/skill-grant.ts",
+        "src/index.ts"
+      ]
+    },
+    {
+      "name": "SkillEntryInertReason",
+      "kind": "type",
+      "onSurface": true,
+      "from": [
+        "src/core/skill-grant.ts"
+      ],
+      "to": [
+        "src/core/skill-grant.ts",
+        "src/index.ts"
+      ]
+    },
+    {
+      "name": "SkillGrantOrigin",
+      "kind": "type",
+      "onSurface": true,
+      "from": [
+        "src/core/skill-grant.ts"
+      ],
+      "to": [
+        "src/core/skill-grant.ts",
+        "src/index.ts"
+      ]
+    },
+    {
+      "name": "mintNamespacePrefix",
+      "kind": "function",
+      "onSurface": true,
+      "from": [
+        "src/core/protocol-naming.ts"
+      ],
+      "to": [
+        "src/core/protocol-naming.ts",
+        "src/index.ts"
+      ]
+    }
+  ],
+  "mintMoves": [],
+  "criteriaObserves": [
+    {
+      "kind": "typeMember",
+      "name": "ProtocolNamespace.makeName",
+      "assertions": [
+        "G1.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "ProtocolNamespace.prefix",
+      "assertions": [
+        "G1.a"
+      ]
+    }
+  ],
+  "consumersHint": {
+    "cli": [],
+    "server": [],
+    "sdk": [],
+    "note": "scanned cli@e790a1ca server@4160110a sdk@ee3b981 — a name listed is MENTIONED there today, which is evidence of consumption, not proof of it"
+  },
+  "breakingCount": 0,
+  "breakingItems": []
+}