@sema-agent/core 7.44.0 → 7.45.0

package/dist/core/tool-policy.js

@@ -21,6 +21,7 @@ import { isNamespacedCoveringRuleName, namespacedRuleNameCovers, parsePermission
 import { protocolOf } from "./protocol-table.js";
 import { isAbsoluteForFamily, isAbsolutePathForm, joinForFamily, normalizeAbsPathLexically, pathFamilyOf, writeTargetPath } from "../tools/fs/safety.js";
 import { ASSIGNMENT_PREFIX, writtenAssignmentPrefix } from "../tools/fs/bash-program-position.js";
+import { removalReadingOf } from "../tools/fs/removal-targets.js";
 const nameListHolds = (set, req) => heldBy("policy.nameLists", set, req);
 const shellToolsListHolds = (set, req) => heldBy("policy.shellToolsList", set, req);
 export function advertisedWritableRootsSeat(seat) {
@@ -920,28 +921,23 @@ function hasRecursiveForce(argvTail) {
 export function createUnverifiableDeletePolicy(opts) {
     const safeVars = new Set([...UNVERIFIABLE_DELETE_SAFE_VARS, ...(opts?.safeVars ?? [])]);
     const shellTools = canonicalToolNameSet(opts?.tools);
+    const unverifiable = (command, finding = findUnverifiableRecursiveDelete(command, safeVars)) => (finding === undefined ? ALLOW : removalAsk("unverifiable_delete", finding));
     return brandPolicyAskClass({
-        check(req) {
+        check(req, signal) {
             if (!shellToolsListHolds(shellTools, req))
                 return ALLOW;
             const command = req.args?.command;
             if (typeof command !== "string")
                 return ALLOW;
-            const finding = findUnverifiableRecursiveDelete(command, safeVars);
-            if (finding === undefined)
-                return ALLOW;
-            return {
-                action: "ask",
-                decisionReason: "safety",
-                requiresRealApproval: true,
-                guard: "unverifiable_delete",
-                message: `Unverifiable recursive delete (fail-closed unless cleared): ${finding}. ` +
-                    `Re-run the delete with the resolved literal path written into the command itself ` +
-                    `(or assign the variable in the same command, e.g. \`DIR=/exact/path; rm -rf "$DIR"\`) so the target can be verified.`,
-            };
+            const removal = removalReadingOf(command, req, opts?.removalSeat);
+            return removal === undefined ? unverifiable(command) : removal.judge(signal).then((found) => (found === undefined ? unverifiable(command) : removalAsk(found.guard, found.text)));
         },
     }, "external_authority");
 }
+function removalAsk(guard, text) {
+    const message = guard === "dangerous_delete" ? `Dangerous removal: ${text}. No permission mode, allow rule or classifier clears this — only a person confirming this call does.` : `Unverifiable recursive delete (fail-closed unless cleared): ${text}. Re-run the delete with the resolved literal path written into the command itself (or assign the variable a literal path in the same command, e.g. \`DIR=/exact/path; rm -rf "$DIR"\`) so the target can be verified.`;
+    return { action: "ask", decisionReason: "safety", requiresRealApproval: true, guard, message };
+}
 function pathSegments(p) {
     return p.split(/[\\/]/).filter(Boolean);
 }

package/dist/core/tool-spec.d.ts

@@ -175,18 +175,36 @@ export interface ToolSpec<TParams extends TSchema = TSchema> {
      * offered pool a child of that type actually mounts. Filled by `createSubagentTool` beside
      * `agentListing`; a type with neither list gets the whole offered pool.
      *
-     * Read by ONE consumer: the memory content-origin face, which classifies a delegation RESULT by the
+     * Read by the memory content-origin face, which classifies a delegation RESULT by the
      * child's tool face. A child that can reach a network or protocol tool returns content from outside
      * the trust boundary just as surely as calling that tool here would, and the parent's transcript is
      * where it lands. Static by construction — the child's face is known from its definition, so no
-     * runtime tracking of what the child actually did is involved (that is the v2 ticket).
+     * runtime tracking of what the child actually did is involved (that is the v2 ticket). `authored`
+     * marks the entries minted from a definition a caller wrote on a tool a deployment mounted (not the
+     * engine's built-ins, the general-purpose alias, fork, or the engine's nested copy of the tool for a
+     * delegated child); prepare's deny-name check judges only those.
      */
     agentToolFaces?: ReadonlyArray<{
         name: string;
         allowTools?: readonly string[];
         denyTools?: readonly string[];
         canRedelegate?: boolean;
+        authored?: true;
     }>;
+    /**
+     * The tool-level `denyTools` list of the delegation tool (`SubagentToolOptions.denyTools`, applied when no agent definition is
+     * selected), exactly as written, filled by `createSubagentTool` beside {@link agentToolFaces}; absent when none was written
+     * and on the engine's nested copy for a delegated child. Read by prepare's deny-name check, which judges it with
+     * the `authored` entries of the faces.
+     */
+    agentToolLevelDenyTools?: readonly string[];
+    /**
+     * The tool-level `allowTools` list of the delegation tool (`SubagentToolOptions.allowTools`, applied when no agent definition is
+     * selected), as the tool copied it, filled by `createSubagentTool` beside {@link agentToolLevelDenyTools}; absent when none was
+     * written and on the engine's nested copy for a delegated child. Read by prepare's allowed-list judgment: a value that is not a
+     * list of strings is refused before the run.
+     */
+    agentToolLevelAllowTools?: readonly string[];
     /**
      * design/178 §3 (ruled 2026-08-08) — the POOL a delegated child draws from, as the delegation tool
      * captured it. Read together with {@link agentToolFaces} by the memory content-origin face: the face

package/dist/core/types.d.ts

@@ -30,5 +30,5 @@ export type { BackgroundChildEvent, DelegationLifecycleEvent } from "./delegatio
 export { __resetMalformedDelegationSeatAnnouncement, deliverDelegationLifecycle } from "./delegation-frames.js";
 export type { ProjectMemoryLoad, ResumePreflightInfo, ResumePreflightVerdict, RunnerDeps } from "./runner-deps.js";
 export type { EngineNotice, OwedUserInputAccount, UserInputUndrainedCause } from "./engine-notice.js";
-export { __resetMalformedNoticeSeatAnnouncement, deliverEngineNotice, owedUserInputCounts, parentLegIds, settleOwedUserInput, undrainedUserInputNotices, USER_INPUT_UNDRAINED_CAUSES } from "./engine-notice.js";
+export { __resetMalformedNoticeSeatAnnouncement, deliverEngineNotice, owedUserInputCounts, parentLegIds, settleOwedUserInput, undrainedUserInputNotices, USER_INPUT_UNDRAINED_CAUSES, USER_INPUT_UNDRAINED_FAMILIES } from "./engine-notice.js";
 export type { AgentTool, Model, StreamFn, ThinkingLevel, ToolInputValidationContext, ToolInputVerdict };

package/dist/core/types.js

@@ -1,4 +1,4 @@
 export { MODEL_ROLES } from "./model-seat.js";
 export { AUTO_MODE_DENY_SOURCES, isAutoModeDenySource } from "./runtime-caps.js";
 export { __resetMalformedDelegationSeatAnnouncement, deliverDelegationLifecycle } from "./delegation-frames.js";
-export { __resetMalformedNoticeSeatAnnouncement, deliverEngineNotice, owedUserInputCounts, parentLegIds, settleOwedUserInput, undrainedUserInputNotices, USER_INPUT_UNDRAINED_CAUSES } from "./engine-notice.js";
+export { __resetMalformedNoticeSeatAnnouncement, deliverEngineNotice, owedUserInputCounts, parentLegIds, settleOwedUserInput, undrainedUserInputNotices, USER_INPUT_UNDRAINED_CAUSES, USER_INPUT_UNDRAINED_FAMILIES } from "./engine-notice.js";

package/dist/index.d.ts

@@ -63,7 +63,7 @@ export { MCP_FAILURE_KINDS, MCP_DELIVERY_VERDICTS, MCP_LIVENESS_STATES, classify
 export { MCP_INJECTION_DROP_REASONS, MCP_INJECTION_DROP_TEXT, mcpInjectionDroppedNotice, type McpInjectionDropReason, type McpInjectionDropFacts } from "./core/mcp-injection-drop.js";
 export { askUnresolvableNotice, type AskUnresolvableFacts } from "./core/ask-unresolvable-notice.js";
 export { ASK_UNRESOLVABLE_CAUSES } from "./core/ask-unresolvable-notice.js";
-export { USER_INPUT_UNDRAINED_CAUSES, type UserInputUndrainedCause } from "./core/engine-notice.js";
+export { USER_INPUT_UNDRAINED_CAUSES, type UserInputUndrainedCause, USER_INPUT_UNDRAINED_FAMILIES } from "./core/engine-notice.js";
 export { STEER_REPLAY_FACETS, type SteerReplayFacet } from "./core/steer-replay.js";
 export { TOOL_TURN_INCOMPLETE_CAUSES, type ToolTurnIncompleteCause } from "./internal/llm.js";
 export { DURABLE_MANDATE_SOURCES } from "./core/tool-policy.js";
@@ -146,7 +146,7 @@ export { judgeRuleToolName, RULE_TOOL_NAME_VERDICTS, type RuleToolNameVerdict }
 export { DEFAULT_SUBAGENT_TOOL_NAME } from "./agents/subagent.js";
 export { renderTaskNotificationXml, RESUPPLIED_FRAME_PREAMBLE, taskNotificationDedupKey, isDelegatedAgentTerminal, isTerminalTaskNotification, SystemInjectionQueue, type TaskNotificationPayload, type TaskNotificationStatus, type ExternalNotificationInput, type SystemInjection, type SystemInjectionPriority, type NotificationInjectionOutcome, // the injector's outcome words (`parked_durably` = the session's durable box took the frame)
 NOTIFICATION_INJECTION_OUTCOMES, // …and their value half + guard, so a host wiring its own uplink validates a reported outcome without duplicating the vocabulary
-isNotificationInjectionOutcome, SYSTEM_INJECTION_PRIORITIES, isSystemInjectionPriority, steerPriorityOf, AGENT_MESSAGE_TAG, renderAgentMessageFrame, type SemaProvenance, HANDBACK_STATES, type HandbackState, COMPACTION_KINDS, type CompactionKind, handbackStateOf, terminalFrameFacets, } from "./core/task-notification.js";
+isNotificationInjectionOutcome, SYSTEM_INJECTION_PRIORITIES, isSystemInjectionPriority, steerPriorityOf, injectionLaneOf, type UserInputLane, AGENT_MESSAGE_TAG, renderAgentMessageFrame, type SemaProvenance, HANDBACK_STATES, type HandbackState, COMPACTION_KINDS, type CompactionKind, handbackStateOf, terminalFrameFacets, } from "./core/task-notification.js";
 export { TOOL_FAMILIES, TOOL_MOUNT_TAGS, TOOL_APPROVAL_CARDS, TOOL_PATH_ACCESSES, TOOL_PATH_BASES, TOOL_PATH_ABSENCES, TOOL_WIRE_NAME_MAX_CHARS, TOOL_CONTRACT_MAX_CHARS, TOOL_CARD_ID_MAX_CHARS, TOOL_KEY_MAX_CHARS, TOOL_KEYS_MAX, RENDER_HINT_MAX_CHARS, RENDER_HINT_ACTIVITY_MAX_CHARS, RENDER_HINT_MAX_LIST, type ToolFamily, type ToolMountTag, type ToolApprovalCard, type ToolPathAccess, type ToolPathBase, type ToolPathAbsence, type ToolPathTarget, type ToolCallPathTarget, type ToolRosterPathTarget, pathTargetSlotOnly, type ToolRuleFace, type ToolRenderHints, type ToolFaceDeclaration, type ToolCatalogEntry, } from "./core/tool-face.js";
 export { describeToolCatalog, catalogEntriesNamed, catalogToolNames, catalogRuleFaceOf, pathTargetOf, pathTargetValue, protectivePathTargetOf, declaredPathTargetOf, BARE_REQUEST_CODE, isProtectedWrite, isDeclaredWrite, fileOpAccessOf, type ToolCallLike, pathConfinableWriteToolNames, pathTargetingToolNames, compactableToolNames, budgetExemptToolNames, handBandEffects, engineCardTypes, predictMountedToolNames, HANDS_BAND_TAGS, MOUNT_TAG_IN_HANDS_BAND, } from "./core/tool-registry.js";
 export { ToolRosterEntry, ToolRoster, ToolRosterDelta, ToolRosterRenderHints, ROSTER_SOURCES, type RosterSource, type ToolIdentity, toolIdentityOf, mintCapabilityId, diffToolRoster, judgeParkedToolIdentity, ruleFacesFromRoster, toolCallFaceOf, rosterToolName, ruleNamesOf, inputKeysOf, ruleFaceOfInstance, rosterMemberBoundProblem, type RosterBoundMembers, type RosterBoundCode, ToolRosterDeltaSeat, } from "./core/tool-roster.js";
@@ -207,7 +207,8 @@ export { ALLOW_RULE_MEMBERS, type AllowRuleMember, type AllowRuleShadow } from "
 export { mintNamespacePrefix } from "./core/protocol-naming.js";
 export { readDenyClassifierRules, renderClassifierDenyRules, type DerivedDenyRule } from "./core/auto-mode-prompt.js";
 export { AUTO_MODE_DENY_SOURCES, isAutoModeDenySource, type AutoModeDenySource } from "./core/runtime-caps.js";
-export { SETTLEMENT_KINDS, type SettlementKind, isSettlementKind, type Settlement, SETTLEMENT_PARTIES, type SettlementParty, isSettlementParty, SETTLEMENT_IS_REFUSAL, DENIED_BY_VALUES, type DeniedBy, isDeniedBy, DENIED_BY_MAY_VETO, CLASSIFIER_DENY_CAUSES, type ClassifierDenyCause, isClassifierDenyCause, DENIED_BY_MAY_CARRY_CAUSE, type GateDisposition, type GateOutcome, type ModeRelease, type ModeRefusal, screenGateOutcome } from "./core/gate-outcome.js";
+export { SETTLEMENT_KINDS, type SettlementKind, isSettlementKind, type Settlement, SETTLEMENT_PARTIES, type SettlementParty, isSettlementParty, HOST_DECIDERS, type HostDecider, isHostDecider, SETTLEMENT_IS_REFUSAL, DENIED_BY_VALUES, type DeniedBy, isDeniedBy, DENIED_BY_MAY_VETO, CLASSIFIER_DENY_CAUSES, type ClassifierDenyCause, isClassifierDenyCause, DENIED_BY_MAY_CARRY_CAUSE, type GateDisposition, type GateOutcome, type ModeRelease, type ModeRefusal, screenGateOutcome } from "./core/gate-outcome.js";
+export { policyCannotAnswer, type HeldQuestion } from "./core/real-approval.js";
 export { type AskCarry } from "./core/hooks.js";
 export { SWAPPABLE_DEP_SEATS, SWAP_SEAT_NOTICE, isSwappableDepSeat, screenSwappableDeps, type SwappableDepSeat, type SwappableDeps } from "./core/swappable-deps.js";
 export { parseAutoModeResponse, createAutoModeDecider, AUTO_MODE_UNAVAILABLE_CAUSES, isAutoModeUnavailableCause, classifierUnavailableDenyMessage, classifierParseFailureDenyMessage, AUTO_MODE_PARSE_FAILURES, isAutoModeParseFailure, type AutoModeParseFailure, type AutoModeUnavailableCause, AUTO_MODE_CLASSIFIER_FALLBACKS, isAutoModeClassifierFallback, AUTO_MODE_FALLBACK_CAUSES, isAutoModeFallbackCause, type AutoModeClassifierFallback, type AutoModeFallbackCause, type AutoModeClassifierRound, type AutoModeLadderRung, type AutoModeVerdict, type AutoModeDecider, type AutoModeDeciderOptions, type AutoModeClassified, type AutoModeClassifyFn, type AutoModeClassifyInput, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow, type AutoModeDenialTracker, type AutoModeDenialLimitOptions, type DenialLimitCounts, type DenialLimitFallbackFace, type UnarmedDenialLimitFallback, type DenialLimitFallback, type DenialLimitVerdict, } from "./core/auto-mode.js";
@@ -253,6 +254,7 @@ export { formatHookFeedback, runToolGate, createHookEnvCapabilities, createPreTo
 export { HOOK_FAMILIES, HOOKS_INVALID_CODE, type HookFamily, type WiringManifestHookEntry } from "./core/hook-seats.js";
 export { InMemoryMemoryStore, composeMemoryBlock, composeLayeredMemoryBlock, normalizeMemorySpec, type NormalizedMemorySpec, type MemorySpecInput, supportsConsolidation, supportsPeriodicConsolidation, firstSentence, expandLexicalTerms, lexicalSearchMatch, type Embedder, classifyPromotable, enforcePromotableWriteGate, guardedMemoryStore, MemoryGateError, MemoryProjectionError, detectSecret, enforceSecretWriteGate, enforceStructuredNoteSecretGate, type UtilityGate, type MemoryStore, type MemoryVectorMode, type ScoredMemory, type MemoryNoteHeader, type MemoryNoteRecord, type MemoryNoteType, type StructuredNoteInput, MEMORY_PROJECT_KEY_ABSENT_REASONS, type MemoryProjectKeyAbsentReason, type MemoryProjectKey, } from "./core/memory.js";
 export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, type MemoryBackendContractHooks, buildMemoryInstruction, writableRootOf, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_ORIGIN_CAUSES, committedOriginOf, originEquals, consolidationExposedFrontmatter, ambiguousOriginRepresentation, type OriginClearanceRow, type OriginClearanceEvent, type OriginClearanceShadow, committedDistilledOf, distilledEquals, type MemoryEntryDistilled, type MemoryEntryDistilledInput, CONSOLIDATION_DEFAULTS, ConsolidationRefusedError, MEMORY_SEARCH_SUPERSEDED_TAG, consolidationTypeEligible, deriveSupersededSet, memorySupersededNote, readIntentCredentials, supersessionFuseCeiling, deriveShadowedSet, memoryConsolidationRecommendedNotice, memoryConsolidationCommittedNotice, memoryConsolidationConflictNotice, memoryConsolidationIncompleteNotice, memoryConsolidationRefusedNotice, memoryConsolidationWithheldNotice, type ConsolidationGateRead, type ConsolidationGateRow, type ConsolidationIntent, type ConsolidationIntentCredentialRow, type ConsolidationLeaseSeat, type ConsolidationProductProposal, type ConsolidationProposal, type MemoryConsolidationOptions, type ConsolidationCommitReceipt, type ConsolidationReconcileReport, type ConsolidationResolveReceipt, type ConsolidationPlanSummary, type ConsolidationPlanFoldEvidence, type SessionMemoryStatus, DISTILLER_DEFAULT_MAX_INPUTS_PER_PRODUCT, LLM_DISTILLER_CONTRACT, LLM_DISTILLER_CONTRACT_DL2, LLM_DISTILLER_CONTRACT_DL3, LLM_DISTILLER_CONTRACTS, MEMORY_DISTILLER_CONTRACT_V1, contractGroupingDiff, driveConsolidationToFixpoint, isAliasModelId, llmPlanDistiller, mintExposurePartitionedPlan, mintLlmConsolidationPlan, MEMORY_DISTILLER_PURITY_CONTRACT_V1, detectCleanArmVerbatimLeak, type CleanArmLeakFinding, type CleanArmLeakVerdict, type MemoryDistillerPurityContract, openAiCompatChatSeat, parseJsonAnswer, planParseRepairs, sanitizeLlmGroups, scheduleUnderFuse, type ConsolidationDistillFn, type ConsolidationDriveCycleRow, type ConsolidationDriveEngine, type ConsolidationDriveResult, type ConsolidationFoldState, type DistillerCandidate, type DistillerChatAnswer, type DistillerChatFn, type DistillerChatRequest, type FuseSchedule, type LlmConsolidationPlan, type LlmConsolidationPlanArm, type LlmConsolidationPlanProduct, type LlmDistillerContract, type MintLlmConsolidationPlanResult, type PlanParseRepairs, type SanitizedLlmGroups, CONSOLIDATION_DRIVER_PLANS_DIR, CONSOLIDATION_DRIVER_RUNS_FILE, CONSOLIDATION_RUN_STOP_REASONS, archiveDistillerPlan, readConsolidationDriverRun, runMemoryConsolidationDriver, type ConsolidationDriverEngine, type ConsolidationDriverRunRow, type ConsolidationRunReceipt, type ConsolidationRunStopReason, type RunMemoryConsolidationOptions, isInstructionEntry, type MemoryEntryOrigin, type MemoryOriginCause, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, MEMORY_CAPTURE_OPTOUT_NOTICE, memoryCaptureOptedOutNotice, memoryCaptureOptOutUnpersistedNotice, SESSION_CAPTURE_OPTOUT_DIR, markSessionCaptureOptOut, readSessionCaptureOptOut, listSessionCaptureOptOut, fileSessionCaptureRecordStore, type SessionCaptureOptOutRecord, type SessionCaptureOptOutMarkOutcome, type SessionCaptureRecordStore, readV2HeaderHints, type V2HeaderHints, LINEAGE_FILE, CHALLENGES_FILE, CHALLENGED_HISTORY_FILE, CHALLENGE_LEDGER_MAX_EVENTS, rebuildStrictControlPlaneLedger, type ControlPlaneRebuildReceipt, type StrictControlPlaneLedger, type ChallengeAssignment, type ChallengeEvent, type ChallengedHistoryRow, type LineagePendingTxn, type LineagePromotion, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_INDEX_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, type MemorySearchDetails, type MemorySearchHit, type CleanMemorySearchHit, type ExposedMemorySearchHit, MEMORY_EXPOSURE_BANNER, MEMORY_EXPOSURE_HANDLE_TAG, memoryExposureIndexRow, type MemoryGetDetails, type MemoryIndexDetails, type MemoryIndexRow, type CleanMemoryIndexRow, type ExposedMemoryIndexRow, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, type MemoryAnnouncement, type ScanFinding, type MemoryEngineOptions, type MemoryInjection, type EntryProvenanceAccount, type TransferEvidence, type CommittedBinding, type CommittedEntrySnapshot, type CommittedScopeSnapshots, type EntryCustodyReport, erasureSelectHash, type EraseMemoryEntriesInput, type ErasureSelect, type ErasedBinding, type MemoryErasureAttestation, computeMemoryBundleHash, type MemoryExportBundle, type MemoryImportReport, type MemoryExportSnapshot, type MemoryBundleImportPlan, type BundleChallengeRow, type BundleLineageRow, type BundlePollutedSession, type MemoryBackend, type MemoryEntry, type MemoryEntryFrontmatter, type MemoryEntryHeader, type MemoryScopeEnumeration, type ScoredMemoryEntry, type NotePatch, type PatchReport, type MaterializedFile, type MemorySessionHandle, type HarvestReport, type HarvestRejection, type HarvestRejectionCode, type ParsedEntryFile, type ScannedEntryFile, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, type ParsedScopeKey, migrateScope, type MigrateScopeReport, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, type RemoteMemoryFile, type RemoteMemoryBaseline, type RemoteMaterialization, type RemoteHarvestResult, type InboundEntryFinding, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, type MemorySyncCursor, type MemorySyncConflict, type MemorySyncPlan, type RecallSource, syncMemoryScope, type MemorySyncTransport, type MemorySyncRequestBody, type MemorySyncResponseBody, type MemorySyncClientConflict, type SyncMemoryScopeOptions, type MemorySyncClientResult, } from "./core/memory-engine/index.js";
+export { STORE_FORM_REFUSAL_CODES, TARGET_OUTSIDE_STORE, SCOPE_HOME_NOT_DIRECTORY, SCOPE_HOME_FORMS, type StoreFormRefusalCode, type StoreFormRefusalDetail, type StoreFormRefusal, type ScopeHomeForm } from "./core/memory-engine/layout.js";
 export { SHARED_MEMORY_READ_CAP_BYTES, SHARED_MEMORY_LIST_PAGE_SIZE, SharedMemoryStoreError, type SharedMemoryStoreProvider, type SharedMemoryStoreReader, type SharedMemoryPagedList, type SharedMemoryStoreInfo, type SharedMemoryDocumentEntry, type SharedMemorySnapshot, type SharedMemoryRequestContext, type MemoryListDetails, type MemoryReadDetails, } from "./core/shared-memory/types.js";
 export { sharedMemoryStoreContract, type SharedMemoryFixture, type SharedMemoryStoreContractHooks, } from "./core/shared-memory/contract.js";
 export { termSet, jaccardDistance, cosineDistance } from "./core/memory-vector.js";

package/dist/index.js

@@ -49,7 +49,7 @@ export { MCP_FAILURE_KINDS, MCP_DELIVERY_VERDICTS, MCP_LIVENESS_STATES, classify
 export { MCP_INJECTION_DROP_REASONS, MCP_INJECTION_DROP_TEXT, mcpInjectionDroppedNotice } from "./core/mcp-injection-drop.js";
 export { askUnresolvableNotice } from "./core/ask-unresolvable-notice.js";
 export { ASK_UNRESOLVABLE_CAUSES } from "./core/ask-unresolvable-notice.js";
-export { USER_INPUT_UNDRAINED_CAUSES } from "./core/engine-notice.js";
+export { USER_INPUT_UNDRAINED_CAUSES, USER_INPUT_UNDRAINED_FAMILIES } from "./core/engine-notice.js";
 export { STEER_REPLAY_FACETS } from "./core/steer-replay.js";
 export { TOOL_TURN_INCOMPLETE_CAUSES } from "./internal/llm.js";
 export { DURABLE_MANDATE_SOURCES } from "./core/tool-policy.js";
@@ -118,7 +118,7 @@ export { createFsWriteGatePolicy, WRITE_EXEMPT_DIR_COVERS_ROOT_CODE } from "./co
 export { RETIRED_TOOL_NAMES } from "./core/tool-name-aliases.js";
 export { judgeRuleToolName, RULE_TOOL_NAME_VERDICTS } from "./core/tool-name-aliases.js";
 export { DEFAULT_SUBAGENT_TOOL_NAME } from "./agents/subagent.js";
-export { renderTaskNotificationXml, RESUPPLIED_FRAME_PREAMBLE, taskNotificationDedupKey, isDelegatedAgentTerminal, isTerminalTaskNotification, SystemInjectionQueue, NOTIFICATION_INJECTION_OUTCOMES, isNotificationInjectionOutcome, SYSTEM_INJECTION_PRIORITIES, isSystemInjectionPriority, steerPriorityOf, AGENT_MESSAGE_TAG, renderAgentMessageFrame, HANDBACK_STATES, COMPACTION_KINDS, handbackStateOf, terminalFrameFacets, } from "./core/task-notification.js";
+export { renderTaskNotificationXml, RESUPPLIED_FRAME_PREAMBLE, taskNotificationDedupKey, isDelegatedAgentTerminal, isTerminalTaskNotification, SystemInjectionQueue, NOTIFICATION_INJECTION_OUTCOMES, isNotificationInjectionOutcome, SYSTEM_INJECTION_PRIORITIES, isSystemInjectionPriority, steerPriorityOf, injectionLaneOf, AGENT_MESSAGE_TAG, renderAgentMessageFrame, HANDBACK_STATES, COMPACTION_KINDS, handbackStateOf, terminalFrameFacets, } from "./core/task-notification.js";
 export { TOOL_FAMILIES, TOOL_MOUNT_TAGS, TOOL_APPROVAL_CARDS, TOOL_PATH_ACCESSES, TOOL_PATH_BASES, TOOL_PATH_ABSENCES, TOOL_WIRE_NAME_MAX_CHARS, TOOL_CONTRACT_MAX_CHARS, TOOL_CARD_ID_MAX_CHARS, TOOL_KEY_MAX_CHARS, TOOL_KEYS_MAX, RENDER_HINT_MAX_CHARS, RENDER_HINT_ACTIVITY_MAX_CHARS, RENDER_HINT_MAX_LIST, pathTargetSlotOnly, } from "./core/tool-face.js";
 export { describeToolCatalog, catalogEntriesNamed, catalogToolNames, catalogRuleFaceOf, pathTargetOf, pathTargetValue, protectivePathTargetOf, declaredPathTargetOf, BARE_REQUEST_CODE, isProtectedWrite, isDeclaredWrite, fileOpAccessOf, pathConfinableWriteToolNames, pathTargetingToolNames, compactableToolNames, budgetExemptToolNames, handBandEffects, engineCardTypes, predictMountedToolNames, HANDS_BAND_TAGS, MOUNT_TAG_IN_HANDS_BAND, } from "./core/tool-registry.js";
 export { ToolRosterEntry, ToolRoster, ToolRosterDelta, ToolRosterRenderHints, ROSTER_SOURCES, toolIdentityOf, mintCapabilityId, diffToolRoster, judgeParkedToolIdentity, ruleFacesFromRoster, toolCallFaceOf, rosterToolName, ruleNamesOf, inputKeysOf, ruleFaceOfInstance, rosterMemberBoundProblem, ToolRosterDeltaSeat, } from "./core/tool-roster.js";
@@ -169,7 +169,8 @@ export { ALLOW_RULE_MEMBERS } from "./core/allow-rule-shadow.js";
 export { mintNamespacePrefix } from "./core/protocol-naming.js";
 export { readDenyClassifierRules, renderClassifierDenyRules } from "./core/auto-mode-prompt.js";
 export { AUTO_MODE_DENY_SOURCES, isAutoModeDenySource } from "./core/runtime-caps.js";
-export { SETTLEMENT_KINDS, isSettlementKind, SETTLEMENT_PARTIES, isSettlementParty, SETTLEMENT_IS_REFUSAL, DENIED_BY_VALUES, isDeniedBy, DENIED_BY_MAY_VETO, CLASSIFIER_DENY_CAUSES, isClassifierDenyCause, DENIED_BY_MAY_CARRY_CAUSE, screenGateOutcome } from "./core/gate-outcome.js";
+export { SETTLEMENT_KINDS, isSettlementKind, SETTLEMENT_PARTIES, isSettlementParty, HOST_DECIDERS, isHostDecider, SETTLEMENT_IS_REFUSAL, DENIED_BY_VALUES, isDeniedBy, DENIED_BY_MAY_VETO, CLASSIFIER_DENY_CAUSES, isClassifierDenyCause, DENIED_BY_MAY_CARRY_CAUSE, screenGateOutcome } from "./core/gate-outcome.js";
+export { policyCannotAnswer } from "./core/real-approval.js";
 export {} from "./core/hooks.js";
 export { SWAPPABLE_DEP_SEATS, SWAP_SEAT_NOTICE, isSwappableDepSeat, screenSwappableDeps } from "./core/swappable-deps.js";
 export { parseAutoModeResponse, createAutoModeDecider, AUTO_MODE_UNAVAILABLE_CAUSES, isAutoModeUnavailableCause, classifierUnavailableDenyMessage, classifierParseFailureDenyMessage, AUTO_MODE_PARSE_FAILURES, isAutoModeParseFailure, AUTO_MODE_CLASSIFIER_FALLBACKS, isAutoModeClassifierFallback, AUTO_MODE_FALLBACK_CAUSES, isAutoModeFallbackCause, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow, } from "./core/auto-mode.js";
@@ -199,6 +200,7 @@ export { formatHookFeedback, runToolGate, createHookEnvCapabilities, createPreTo
 export { HOOK_FAMILIES, HOOKS_INVALID_CODE } from "./core/hook-seats.js";
 export { InMemoryMemoryStore, composeMemoryBlock, composeLayeredMemoryBlock, normalizeMemorySpec, supportsConsolidation, supportsPeriodicConsolidation, firstSentence, expandLexicalTerms, lexicalSearchMatch, classifyPromotable, enforcePromotableWriteGate, guardedMemoryStore, MemoryGateError, MemoryProjectionError, detectSecret, enforceSecretWriteGate, enforceStructuredNoteSecretGate, MEMORY_PROJECT_KEY_ABSENT_REASONS, } from "./core/memory.js";
 export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, buildMemoryInstruction, writableRootOf, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_ORIGIN_CAUSES, committedOriginOf, originEquals, consolidationExposedFrontmatter, ambiguousOriginRepresentation, committedDistilledOf, distilledEquals, CONSOLIDATION_DEFAULTS, ConsolidationRefusedError, MEMORY_SEARCH_SUPERSEDED_TAG, consolidationTypeEligible, deriveSupersededSet, memorySupersededNote, readIntentCredentials, supersessionFuseCeiling, deriveShadowedSet, memoryConsolidationRecommendedNotice, memoryConsolidationCommittedNotice, memoryConsolidationConflictNotice, memoryConsolidationIncompleteNotice, memoryConsolidationRefusedNotice, memoryConsolidationWithheldNotice, DISTILLER_DEFAULT_MAX_INPUTS_PER_PRODUCT, LLM_DISTILLER_CONTRACT, LLM_DISTILLER_CONTRACT_DL2, LLM_DISTILLER_CONTRACT_DL3, LLM_DISTILLER_CONTRACTS, MEMORY_DISTILLER_CONTRACT_V1, contractGroupingDiff, driveConsolidationToFixpoint, isAliasModelId, llmPlanDistiller, mintExposurePartitionedPlan, mintLlmConsolidationPlan, MEMORY_DISTILLER_PURITY_CONTRACT_V1, detectCleanArmVerbatimLeak, openAiCompatChatSeat, parseJsonAnswer, planParseRepairs, sanitizeLlmGroups, scheduleUnderFuse, CONSOLIDATION_DRIVER_PLANS_DIR, CONSOLIDATION_DRIVER_RUNS_FILE, CONSOLIDATION_RUN_STOP_REASONS, archiveDistillerPlan, readConsolidationDriverRun, runMemoryConsolidationDriver, isInstructionEntry, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, MEMORY_CAPTURE_OPTOUT_NOTICE, memoryCaptureOptedOutNotice, memoryCaptureOptOutUnpersistedNotice, SESSION_CAPTURE_OPTOUT_DIR, markSessionCaptureOptOut, readSessionCaptureOptOut, listSessionCaptureOptOut, fileSessionCaptureRecordStore, readV2HeaderHints, LINEAGE_FILE, CHALLENGES_FILE, CHALLENGED_HISTORY_FILE, CHALLENGE_LEDGER_MAX_EVENTS, rebuildStrictControlPlaneLedger, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_INDEX_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, MEMORY_EXPOSURE_BANNER, MEMORY_EXPOSURE_HANDLE_TAG, memoryExposureIndexRow, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, erasureSelectHash, computeMemoryBundleHash, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, migrateScope, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, syncMemoryScope, } from "./core/memory-engine/index.js";
+export { STORE_FORM_REFUSAL_CODES, TARGET_OUTSIDE_STORE, SCOPE_HOME_NOT_DIRECTORY, SCOPE_HOME_FORMS } from "./core/memory-engine/layout.js";
 export { SHARED_MEMORY_READ_CAP_BYTES, SHARED_MEMORY_LIST_PAGE_SIZE, SharedMemoryStoreError, } from "./core/shared-memory/types.js";
 export { sharedMemoryStoreContract, } from "./core/shared-memory/contract.js";
 export { termSet, jaccardDistance, cosineDistance } from "./core/memory-vector.js";

package/dist/orchestration/workflow.js

@@ -19,6 +19,7 @@ import { boundInputHashOf } from "../core/canonical-json.js";
 import { boundedRedactedSummary } from "../core/untrusted-egress.js";
 import { delimitUntrusted } from "../core/untrusted-text.js";
 import { OUTPUT_TOOL_NAME } from "../core/runner/synthetic-tools.js";
+import { deniedToolNamesOf } from "../core/runner/sub-agent-deny-lists.js";
 import { compileOutputSchema } from "../core/runner/strict-output-schema.js";
 import { WorkflowBudgetExceededError, WorkflowNestingError, WorkflowAgentBlockedError, WorkflowAgentParkedError, WorkflowAgentSchemaError, WorkflowAgentStalledError, WorkflowMaxAgentsError, WORKFLOW_SPAWN_BLOCKED_ERROR_CODE } from "./workflow-types.js";
 import { WorkflowScriptError } from "./workflow-meta.js";
@@ -118,7 +119,7 @@ export function applyWorkflowAgentType(spec, agentType, registry) {
     if (out.memoryPersistenceCapable === undefined && def.memoryPersistenceCapable !== undefined)
         out.memoryPersistenceCapable = def.memoryPersistenceCapable;
     if (def.allowTools !== undefined || def.denyTools !== undefined) {
-        const perType = createAllowDenyPolicy({ ...(def.allowTools ? { allow: def.allowTools } : {}), ...(def.denyTools ? { deny: def.denyTools } : {}), scope: "narrowing" });
+        const perType = createAllowDenyPolicy({ ...(def.allowTools ? { allow: def.allowTools } : {}), ...(def.denyTools ? { deny: deniedToolNamesOf(`workflow agentType "${def.name}"`, def.denyTools) } : {}), scope: "narrowing" });
         out.toolPolicy = out.toolPolicy ? combinePolicies(out.toolPolicy, perType) : perType;
     }
     return out;

package/dist/tools/fs/removal-targets.d.ts

@@ -0,0 +1,82 @@
+import { type EstablishedPlan } from "./shell-read-establish.js";
+import type { ExecutionEnv } from "../../internal/harness-types.js";
+import type { ToolCallRequest } from "../../core/tool-policy.js";
+/** The REMOVAL programs — the reference implementation's dangerous-removal arm reads `rm` and `rmdir`, with or without a
+ *  recursive option (removing an empty home or the task root is still removing it). */
+export declare const SHELL_REMOVAL_COMMANDS: readonly ["rm", "rmdir"];
+export type ShellRemovalCommand = (typeof SHELL_REMOVAL_COMMANDS)[number];
+/** What makes a removal target dangerous, in the order a card names it. `runtime_script`: a shell's script text is built
+ *  only when the command runs, and what it may run includes a removal nobody can read before it does. */
+export type DangerousRemovalKind = "filesystem_root" | "home" | "workspace" | "top_level" | "runtime_script";
+/** The protected locations a removal is judged against. `homes`: the environment's declared home and every other spelling
+ *  of it (its canonical one); `workspace`: the task root, the working directory, the additional working directories. */
+export interface RemovalSeat {
+    readonly homes: readonly string[];
+    readonly workspace: readonly string[];
+}
+/** One dangerous removal a command makes: the program (the removal program, or the shell a runtime-built script is handed
+ *  to), the operand as written, the target as established (the script word as written, for `runtime_script`). */
+export interface DangerousRemoval {
+    readonly kind: DangerousRemovalKind;
+    readonly program: string;
+    readonly operand: string;
+    readonly target: string;
+}
+/**
+ * The ONE dangerous-removal predicate: is removing this absolute path removing a protected location? The reference
+ * implementation's set (cli 2.1.291 `dme` / `xW`) — the filesystem root (a drive root, a UNC share root), a home directory
+ * (every spelling the seat holds), a workspace directory or any of its ANCESTORS (the task root, the working directory, an
+ * additional working directory — whether the home lies inside the task root or the task root inside the home), a top-level
+ * directory (one segment below the root). `undefined` for a relative path or any other target.
+ */
+export declare function dangerousRemovalOf(path: string, seat: RemovalSeat): DangerousRemovalKind | undefined;
+/** What one removal finding asks: a protected location (`dangerous_delete`), or a target the command builds from a value
+ *  of its own that the guard cannot read (`unverifiable_delete`). */
+export type RemovalFinding = (DangerousRemoval & {
+    readonly guard: "dangerous_delete";
+}) | {
+    readonly guard: "unverifiable_delete";
+    readonly program: string;
+    readonly operand: string;
+    readonly name: string;
+};
+/**
+ * The removal findings of an established plan — ONE walk, nested plans included (a `bash -c` / `sh -c` text, a substitution
+ * body), two words. For every `rm` / `rmdir` segment, each of its OPERANDS (every write target that is not one of its
+ * option words, read off its argv with {@link REMOVAL_GRAMMAR}) as the plan established it on the WRITE face (the entry the
+ * program unlinks, and the deny-floor shadow of a home word the plan did not place) is judged by {@link dangerousRemovalOf};
+ * an operand the plan could not place that expands a name the command itself binds is judged in every spelling those
+ * bindings give it ({@link boundSpellingsOf}), and one with a binding this reading cannot read is an unverifiable target (a
+ * recursive force `rm`). A shell handed a script built only when the command runs is a dangerous removal of its own
+ * ({@link runtimeScriptOf}). The read-face copy of an operand is not judged: it follows a link the removal does not follow.
+ */
+export declare function removalFindingsOf(established: EstablishedPlan, seat: RemovalSeat): RemovalFinding[];
+/** Does any segment of this plan (nested plans included) run a removal program, or hand a shell a script built when it
+ *  runs? The guard establishes nothing for a command that does neither. */
+export declare function planRunsRemoval(plan: EstablishedPlan["plan"]): boolean;
+/** What the removal guard asks for one command: the guard word and its sentence's account — the first protected location
+ *  (the program, the location, the target), else the first bound value the guard cannot read; `undefined` when neither. */
+export interface RemovalVerdict {
+    readonly guard: RemovalFinding["guard"];
+    readonly text: string;
+}
+/**
+ * The seat the dangerous-removal arm of the removal guard (`createUnverifiableDeletePolicy`, tool-policy.ts) reads, beside the request's own `root` /
+ * `cwd` (the task root and the live working directory): the execution environment (its declared home — the `HOME` the
+ * shell child receives, the same seat the read station folds `~` / `$HOME` with — and its resolver, so a target that
+ * resolves through a link is judged where it lands), and the leg's additional working directories.
+ */
+export interface RemovalGuardSeat {
+    readonly env?: ExecutionEnv;
+    readonly additionalRoots?: () => readonly string[];
+}
+/**
+ * The dangerous-removal READING of one command — undefined when no segment of it (nested shell text included) runs a
+ * removal program, so a command that removes nothing costs the gate no suspension. Otherwise `judge` establishes the plan
+ * the read station plans (the same planner, the same write-target reading) lexically against the request's `cwd` and the
+ * seat's home, and — where an environment is seated — through its resolver too, and returns what either establishment
+ * finds ({@link removalFindingsOf}: the protected-location word first, then the unverifiable one).
+ */
+export declare function removalReadingOf(command: string, req: Pick<ToolCallRequest, "cwd" | "root">, seat: RemovalGuardSeat | undefined): {
+    judge(signal?: AbortSignal): Promise<RemovalVerdict | undefined>;
+} | undefined;

package/dist/tools/fs/removal-targets.js

@@ -0,0 +1,236 @@
+import { planShellReads } from "./shell-read-plan.js";
+import { createShellReadEstablisher, establishShellReadsLexically } from "./shell-read-establish.js";
+import { isAbsolutePathForm, isWinFormPath, normalizeAbsPathLexically } from "./safety.js";
+import { reentryText } from "./shell-reentry-text.js";
+import { bashClassifyDefaultAllow, SHELL_REENTRY_PROGRAM_RE } from "./bash-readonly-classifier.js";
+import { programArgs, readArgv } from "./shell-read-write-targets.js";
+import { inlineUntrusted } from "../../core/untrusted-text.js";
+export const SHELL_REMOVAL_COMMANDS = Object.freeze(["rm", "rmdir"]);
+const REMOVAL_COMMAND_SET = new Set(SHELL_REMOVAL_COMMANDS);
+const REMOVAL_GRAMMAR = { required: "", optional: "", longRequired: [] };
+function removalKey(path) {
+    let k = normalizeAbsPathLexically(path.normalize("NFC")).replace(/\\/g, "/").toLowerCase();
+    k = k.replace(/(?:\/+\*+)+\/*$/, "");
+    const drive = driveOf(path, k);
+    let rest = k.slice(drive.length);
+    if (rest === "")
+        rest = "/";
+    if (rest.length > 1)
+        rest = rest.replace(/\/+$/, "");
+    return drive + rest.replace(/^\/private\/(etc|var|tmp|home)(?=\/|$)/, "/$1");
+}
+function driveOf(path, key) {
+    return isWinFormPath(path) && key.length >= 2 && key[1] === ":" ? key.slice(0, 2) : "";
+}
+export function dangerousRemovalOf(path, seat) {
+    if (!isAbsolutePathForm(path))
+        return undefined;
+    const k = removalKey(path);
+    const rest = k.slice(driveOf(path, k).length);
+    if (rest === "/" || /^\/\/[^/]+\/[^/]+$/.test(k))
+        return "filesystem_root";
+    if (seat.homes.some((h) => isAbsolutePathForm(h) && removalKey(h) === k))
+        return "home";
+    const prefix = k.endsWith("/") ? k : `${k}/`;
+    if (seat.workspace.some((w) => isAbsolutePathForm(w) && (removalKey(w) === k || removalKey(w).startsWith(prefix))))
+        return "workspace";
+    if (/^\/[^/]+$/.test(rest))
+        return "top_level";
+    return undefined;
+}
+function tildeNamesAHome(spelled) {
+    const m = /^~([^/]*)(\/.*)?$/.exec(spelled);
+    if (m === null)
+        return false;
+    const key = removalKey(`/~home${m[2] ?? ""}`);
+    return key === "/~home" || !key.startsWith("/~home/");
+}
+function removalKindOf(read, seat) {
+    const floors = read.established === "unestablishable" && read.candidate.bases === "unmodelled" ? read.spellings : [];
+    for (const view of [read.target, read.origin, ...floors]) {
+        const kind = view === undefined ? undefined : dangerousRemovalOf(view, seat);
+        if (kind !== undefined)
+            return kind;
+    }
+    return read.established === "unestablishable" && tildeNamesAHome(read.candidate.spelled) ? "home" : undefined;
+}
+function literalOf(pieces) {
+    return pieces.every((q) => q.literal !== undefined) ? pieces.map((q) => q.literal).join("") : undefined;
+}
+const NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const NAME_BINDERS = new Set(["unset", "local", "declare", "typeset", "readonly", "export", "read"]);
+function bindingsOf(plan) {
+    const out = new Map();
+    const bind = (name, value) => {
+        out.set(name, [...(out.get(name) ?? []), value]);
+    };
+    for (const segment of plan.segments) {
+        for (const w of segment.argv)
+            if (w.assignment !== undefined)
+                bind(w.assignment.name, w.assignment.settlesWholeName ? literalOf(w.assignment.value.pieces) : undefined);
+        const [head, name] = segment.argv;
+        if ((head?.folded === "for" || head?.folded === "select") && name !== undefined && NAME.test(name.folded)) {
+            const at = segment.argv.findIndex((w, i) => i > 1 && w.folded === "in");
+            const words = at < 0 ? [undefined] : segment.argv.slice(at + 1).map((w) => literalOf(w.pieces));
+            for (const v of words.length > 0 ? words : [undefined])
+                bind(name.folded, v);
+        }
+        if (head !== undefined && NAME_BINDERS.has(head.folded))
+            for (const w of segment.argv.slice(1))
+                if (w.assignment === undefined && NAME.test(w.folded))
+                    bind(w.folded, undefined);
+    }
+    return out;
+}
+const BOUND_SPELLINGS_MAX = 64;
+function boundSpellingsOf(word, bindings) {
+    const named = word.pieces.filter((q) => q.literal === undefined);
+    if (named.length === 0 || !named.some((q) => q.expansion?.kind === "parameter" && q.expansion.name !== undefined && bindings.has(q.expansion.name)))
+        return undefined;
+    let spellings = [""];
+    for (const q of word.pieces) {
+        if (q.literal !== undefined) {
+            spellings = spellings.map((sp) => sp + q.literal);
+            continue;
+        }
+        const name = q.expansion?.kind === "parameter" && (q.expansion.body === undefined || q.expansion.body === q.expansion.name) ? q.expansion.name : undefined;
+        const values = name !== undefined ? bindings.get(name) : undefined;
+        if (name === undefined || values === undefined)
+            return { unreadable: q.expansion?.name ?? word.raw };
+        if (values.some((v) => v === undefined || (q.quotedBy === undefined && /\s/.test(v))))
+            return { unreadable: name };
+        spellings = spellings.flatMap((sp) => values.map((v) => sp + v));
+        if (spellings.length > BOUND_SPELLINGS_MAX)
+            return { unreadable: name };
+    }
+    return { spellings };
+}
+function recursiveForce(args) {
+    const { options } = readArgv(args, REMOVAL_GRAMMAR);
+    const has = (long, short) => options.some((o) => (o.long ? long.startsWith(o.name) : short.test(o.name)));
+    return has("recursive", /^[rR]$/) && has("force", /^f$/);
+}
+export function removalFindingsOf(established, seat) {
+    const out = [];
+    const bindings = bindingsOf(established.plan);
+    for (const segment of established.plan.segments) {
+        const program = segment.verb?.basename;
+        if (program !== undefined && REMOVAL_COMMAND_SET.has(program)) {
+            const args = programArgs(segment);
+            const operands = new Set(readArgv(args, REMOVAL_GRAMMAR).operands);
+            const options = new Set(args.filter((w) => !operands.has(w)).map((w) => w.raw));
+            for (const read of established.reads.get(segment) ?? []) {
+                if (read.candidate.face !== "write" || options.has(read.candidate.raw))
+                    continue;
+                const kind = removalKindOf(read, seat);
+                if (kind !== undefined) {
+                    out.push({ guard: "dangerous_delete", kind, program, operand: read.candidate.raw, target: read.target ?? read.candidate.floorSpelled ?? read.candidate.spelled });
+                    continue;
+                }
+                if (read.established !== "unestablishable")
+                    continue;
+                const word = segment.argv.find((w) => w.raw === read.candidate.raw);
+                const bound = word === undefined ? undefined : boundSpellingsOf(word, bindings);
+                if (bound === undefined)
+                    continue;
+                if ("unreadable" in bound) {
+                    if (program === "rm" && recursiveForce(args))
+                        out.push({ guard: "unverifiable_delete", program, operand: read.candidate.raw, name: bound.unreadable });
+                    continue;
+                }
+                const bases = segment.bases === "unmodelled" ? (read.candidate.floorBases ?? []) : segment.bases;
+                for (const spelled of bound.spellings) {
+                    const views = isAbsolutePathForm(spelled) ? [spelled] : bases.map((base) => `${base}/${spelled}`);
+                    for (const view of views) {
+                        const hit = dangerousRemovalOf(view, seat);
+                        if (hit === undefined)
+                            continue;
+                        out.push({ guard: "dangerous_delete", kind: hit, program, operand: read.candidate.raw, target: normalizeAbsPathLexically(view) });
+                        break;
+                    }
+                }
+            }
+        }
+        const script = runtimeScriptOf(segment);
+        if (script !== undefined && program !== undefined)
+            out.push({ guard: "dangerous_delete", kind: "runtime_script", program, operand: script, target: script });
+        for (const nested of segment.nested) {
+            const sub = established.nested.get(nested);
+            if (sub !== undefined)
+                out.push(...removalFindingsOf(sub, seat));
+        }
+    }
+    return out;
+}
+function runtimeScriptOf(segment) {
+    const program = segment.verb;
+    if (segment.reentry !== "shell" || program === undefined || !SHELL_REENTRY_PROGRAM_RE.test(program.basename))
+        return undefined;
+    const at = segment.argv.findIndex((w) => w.folded === program.name);
+    if (at < 0)
+        return undefined;
+    const MARK = "\u0000";
+    const words = segment.argv.slice(at + 1).map((w) => literalOf(w.pieces) ?? `${MARK}${w.raw}`);
+    const text = reentryText(program.basename, words);
+    return text === undefined || !text.includes(MARK) ? undefined : text.split(MARK).join("");
+}
+export function planRunsRemoval(plan) {
+    return plan.segments.some((s) => (s.verb !== undefined && REMOVAL_COMMAND_SET.has(s.verb.basename)) || runtimeScriptOf(s) !== undefined || s.nested.some(planRunsRemoval));
+}
+const DANGEROUS_REMOVAL_SENTENCE = {
+    filesystem_root: (p, t) => `\`${p}\` would remove the filesystem root (${t})`,
+    home: (p, t) => `\`${p}\` would remove a home directory (${t})`,
+    workspace: (p, t) => `\`${p}\` would remove a workspace directory — the task root, the working directory or an additional working directory — or one of its ancestors (${t})`,
+    top_level: (p, t) => `\`${p}\` would remove a top-level system directory (${t})`,
+    runtime_script: (p, t) => `\`${p}\` runs a script built only when the command runs (${t}), and it may remove the filesystem root, a home directory or the task's directories before anyone can read it`,
+};
+function verdictOf(findings) {
+    for (const f of findings)
+        if (f.guard === "dangerous_delete")
+            return { guard: f.guard, text: DANGEROUS_REMOVAL_SENTENCE[f.kind](f.program, inlineUntrusted(f.target, 200)) };
+    for (const f of findings)
+        if (f.guard === "unverifiable_delete")
+            return { guard: f.guard, text: `\`${f.program}\` recursive+force target ${inlineUntrusted(f.operand, 200)} takes ${f.name}'s value, which this command sets in a form the guard cannot read (an expansion, an unset or bare declaration, a \`read\`, a loop over unread words) — the deleted path cannot be verified from this command` };
+    return undefined;
+}
+const REMOVAL_RESOLVE_TIMEOUT_MS = 10_000;
+export function removalReadingOf(command, req, seat) {
+    const homeDir = seat?.env?.homeDir;
+    const cwd = req.cwd ?? req.root ?? "";
+    const roots = req.root !== undefined ? [req.root] : cwd !== "" ? [cwd] : [];
+    const boundary = { roots, ...(cwd !== "" ? { cwd } : {}), ...(homeDir !== undefined ? { homeDir } : {}) };
+    const plan = planShellReads(command, { readers: new Set(bashClassifyDefaultAllow()), cwd, roots, ...(homeDir !== undefined ? { homeDir } : {}) });
+    if (!planRunsRemoval(plan))
+        return undefined;
+    return {
+        async judge(signal) {
+            const env = seat?.env;
+            const resolved = env !== undefined && homeDir !== undefined ? await resolvedOrUndefined(env.canonicalPath(homeDir, signal), signal) : undefined;
+            const removalSeat = {
+                homes: [...(homeDir !== undefined ? [homeDir] : []), ...(resolved !== undefined && resolved.ok ? [resolved.value] : [])],
+                workspace: [...(req.root !== undefined ? [req.root] : []), ...(req.cwd !== undefined ? [req.cwd] : []), ...(seat?.additionalRoots?.() ?? [])],
+            };
+            const lexical = removalFindingsOf(establishShellReadsLexically(plan, boundary), removalSeat);
+            if (lexical.some((f) => f.guard === "dangerous_delete") || env === undefined || roots.length === 0)
+                return verdictOf(lexical);
+            const established = await resolvedOrUndefined(createShellReadEstablisher(env, roots, { rootsCanonical: true }).establish(plan, boundary, signal), signal);
+            return verdictOf(established === undefined ? lexical : [...removalFindingsOf(established, removalSeat), ...lexical]);
+        },
+    };
+}
+async function resolvedOrUndefined(leg, signal) {
+    let timer;
+    try {
+        return await Promise.race([
+            leg.catch(() => undefined),
+            new Promise((resolve) => {
+                timer = setTimeout(() => resolve(undefined), REMOVAL_RESOLVE_TIMEOUT_MS);
+                signal?.addEventListener("abort", () => resolve(undefined), { once: true });
+            }),
+        ]);
+    }
+    finally {
+        if (timer !== undefined)
+            clearTimeout(timer);
+    }
+}

package/dist/tools/fs/shell-read-write-targets.d.ts

@@ -27,6 +27,32 @@ export interface ArgWord {
 }
 /** The words a segment hands its program — the argv after the program word (a launcher's own words are not the program's). */
 export declare function programArgs(segment: ShellReadSegment): ArgWord[];
+/**
+ * One program's option GRAMMAR, as its getopt reads it: the short letters taking a REQUIRED value (the rest of the word,
+ * or the next word), those taking an OPTIONAL one (the rest of the word only), and the long names taking a required value
+ * (any unambiguous prefix; `=` or the next word) — absent for a program with no long options (a `--name` word is then an
+ * error the program stops on, and names nothing here). The GNU and BSD programs of one name read the same argv
+ * differently (`sed -l` takes a value in GNU and none in BSD; `cp -S` a suffix in GNU and none in BSD), so every question
+ * below reads the argv under BOTH grammars and takes the union of what they name.
+ */
+export interface OptionGrammar {
+    readonly required: string;
+    readonly optional: string;
+    readonly longRequired?: readonly string[];
+}
+/** One option read off an argv: a short letter or a long name as written (a prefix), and its value when it has one. */
+interface OptionRead {
+    readonly name: string;
+    readonly long: boolean;
+    readonly value?: ArgWord;
+}
+/** An argv read under one grammar: its options in order, and its operands (every word after `--` included). Options are
+ *  read anywhere among the operands, as GNU getopt permutes them — for a BSD getopt, which stops at the first operand,
+ *  that is a superset of its options (the tightening direction). */
+export declare function readArgv(words: readonly ArgWord[], grammar: OptionGrammar): {
+    readonly options: readonly OptionRead[];
+    readonly operands: readonly ArgWord[];
+};
 /** What a `sed` invocation's option words say about writing, under either grammar ({@link SED_GRAMMARS}): whether it edits
  *  in place (`-i` / `-I` / `--in-place`), the backup suffixes it is given (their values; an empty value keeps no backup),
  *  and whether GNU `--follow-symlinks` is on. */
@@ -71,3 +97,4 @@ export interface JudgedCandidate {
  *  lists it among the reads), plus its WRITE targets for the write face ({@link writeTargetsOf}), plus the deny-floor
  *  shadow of every unplaced home word ({@link denyFloorShadowsOf}) on both faces. */
 export declare function judgedCandidatesOf(segment: ShellReadSegment): readonly JudgedCandidate[];
+export {};

package/dist/tools/fs/shell-read-write-targets.js

@@ -21,7 +21,7 @@ const COPY_GRAMMARS = [
     { required: "St", optional: "", longRequired: ["target-directory", "suffix", "no-preserve", "sparse"] },
     { required: "", optional: "" },
 ];
-function readArgv(words, grammar) {
+export function readArgv(words, grammar) {
     const options = [];
     const operands = [];
     let endOfOptions = false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.44.0",
+  "version": "7.45.0",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",