@sema-agent/core 7.44.0 → 7.46.0

package/dist/core/task-spec.d.ts

@@ -551,9 +551,11 @@ export interface TaskSpec {
      * upstream): an `allowTools` entry naming a tool that does not exist is ITEM-FILTERED at spawn (the
      * agent stays listed and delegable; the only host disclosure is a prepare-time HEURISTIC advisory
      * via `RunnerDeps.onError` phase `"config"` for entries unknown to the parent's assembled roster —
-     * zero model-facing warning, the verified upstream shape); a `denyTools` entry naming an
-     * unknown tool is REJECTED at task start (`config.agent.unknown_tool` — a deny-typo silently WIDENS,
-     * the opposite failure direction, sema extension with no upstream deny-list to defer to); and
+     * zero model-facing warning, the verified upstream shape); a `denyTools` entry is read as the
+     * reference reads it (`Tool(content)` hides the whole `Tool`, with a host notice) and judged once, here and for the
+     * delegation tool's own lists alike: a spelling that names no tool, or a stale one (another case of a mounted tool, a
+     * retired name), is REJECTED at task start (`config.agent.unknown_tool`), any other name no tool carries is told to the
+     * host and hides nothing; and
      * providing this field with NO delegation tool mounted is rejected too
      * (`config.agents.no_delegation_tool`) — never a silent no-op. POLICY-NEUTRAL: a
      * roster listing only; the 1.294 tighten-only parent-policy inheritance is applied at spawn time,

package/dist/core/tool-catalog-entries.d.ts

@@ -47,3 +47,24 @@ export declare const ENGINE_CARDS: Readonly<Record<string, string>>;
 export declare function toolFace(id: string): ToolFaceDeclaration;
 /** Definition-id → face, for the modules that spread one (`...TOOL_FACES.read`). Frozen: a face is data. */
 export declare const TOOL_FACES: Readonly<Record<string, ToolFaceDeclaration>>;
+/**
+ * The engine's own tool names, once each: every catalog entry the engine mounts itself (`source: "builtin"` — the hands,
+ * the scaffolds, the memory tools, the background-task tools), whatever face or contract it is mounted under. A host that
+ * must hand the engine a tool face with NO built-ins (`TaskSpec.excludeTools`, a shell's `--tools ""`) reads this set
+ * instead of keeping a list of its own: the catalog is the one source, and a name the engine adds later lands here with it.
+ */
+export declare const ENGINE_BUILTIN_TOOL_NAMES: readonly string[];
+/**
+ * The engine's HAND tools, once each, with the other spellings they answer to: the catalog rows mounted by `hands` — what a run
+ * mounts for itself over an execution environment (the file and shell band, the worktree pair, the band's background-shell
+ * pair). A delegated child's tool-name lists govern these beside the tools the delegation tool hands it, so the spawn reads
+ * this set rather than a list of its own.
+ */
+export declare const HAND_TOOLS: ReadonlyArray<{
+    readonly name: string;
+    readonly aliases?: readonly string[];
+}>;
+/** The wire names of {@link HAND_TOOLS}. */
+export declare const HAND_TOOL_NAMES: readonly string[];
+/** Is this name one the engine mounts itself ({@link ENGINE_BUILTIN_TOOL_NAMES})? A caller tool, an MCP tool or a skill tool is not. */
+export declare function isEngineBuiltinToolName(name: string): boolean;

package/dist/core/tool-catalog-entries.js

@@ -180,3 +180,12 @@ function deepFreeze(value) {
 }
 deepFreeze(TOOL_CATALOG_ENTRIES);
 export const TOOL_FACES = Object.freeze(Object.fromEntries(TOOL_CATALOG_ENTRIES.map((e) => [e.id, e.face])));
+export const ENGINE_BUILTIN_TOOL_NAMES = Object.freeze([...new Set(TOOL_CATALOG_ENTRIES.filter((e) => e.source === "builtin").map((e) => e.name))]);
+export const HAND_TOOLS = Object.freeze([...new Set(TOOL_CATALOG_ENTRIES.filter((e) => e.mountedBy.includes("hands")).map((e) => e.name))].map((name) => {
+    const aliases = [...new Set(TOOL_CATALOG_ENTRIES.filter((e) => e.name === name && e.mountedBy.includes("hands")).flatMap((e) => e.face.aliases ?? []))];
+    return Object.freeze(aliases.length > 0 ? { name, aliases: Object.freeze(aliases) } : { name });
+}));
+export const HAND_TOOL_NAMES = Object.freeze(HAND_TOOLS.map((t) => t.name));
+export function isEngineBuiltinToolName(name) {
+    return ENGINE_BUILTIN_TOOL_NAMES.includes(name);
+}

package/dist/core/tool-policy.d.ts

@@ -4,6 +4,7 @@ import { type Settlement } from "./gate-outcome.js";
 export { policyCannotAnswer, rowDemandsAPerson } from "./real-approval.js";
 import { type DecisionReason } from "./decision-receipt.js";
 export { isEngineRefusal } from "./decision-receipt.js";
+import { type RemovalGuardSeat } from "../tools/fs/removal-targets.js";
 /** A tool call presented to a policy before it executes. */
 /** design/388 B6 — the per-call face (see {@link ToolCallRequest.face}). */
 export interface ToolCallFace {
@@ -69,6 +70,26 @@ export interface ToolCallRequest {
      * window — at that declaration, not here.
      */
     cwd?: string;
+    /**
+     * The root this leg's tools resolve a ROOT-relative spelling against (a search tool's relative `path`, a
+     * pattern with no `path`), stamped beside {@link cwd} at every Runner adjudication seat — the same
+     * canonical spelling as `cwd` (the hands' own root, the value `cwd` starts at). Present whenever the leg
+     * mounts file hands, read-only hands included; absent on a hands-less leg and on a bare request. A path
+     * guard whose deployment supplied no base of its own resolves the call's target against `root` / `cwd`.
+     * Read-only, like `cwd`.
+     */
+    root?: string;
+    /** The call's target reading (`readCallTarget`: lexical / canonical / hop views per reading of the path slot), stamped by the Runner on a
+     *  leg whose lanes can hold a path rule; it describes only the `args` object it was taken for (`callTargetReadingOf`). Read-only. */
+    targetReading?: import("./effective-path-target.js").CallTargetReading;
+    /**
+     * An ENGINE-INTERNAL seat, not a fact of the call: the anchors of the policy now judging this request — the leg its
+     * path rules were installed on (`installPolicyAnchors`). Present only on the copy an installed policy hands its own
+     * inner `check` (where `createPermissionRulePolicy` reads it; an inner installation's anchors win over an outer one's);
+     * the request the gate holds, an `AskRequest`, a hook's input and a parked row never carry it. A host neither sets nor
+     * reads it.
+     */
+    pathRuleAnchors?: import("./permission-rule-model.js").PathRuleBases;
     /**
      * The CANONICAL directories THIS RUN'S PROMPT ADVERTISES AS WRITABLE — the admitted list of the root
      * fence's advertised-writable-directory seat (the memory engine's write home, the deployment's
@@ -397,12 +418,12 @@ export type PermissionResult = {
     /** The ask's whole class set, in {@link import("./ask-origin.js").ASK_CLASSES} order (see
      *  {@link AskRequest.classes}). Stamped beside {@link askClass}, under the same rule. */
     classes?: readonly import("./ask-origin.js").AskClass[];
-    /** WHICH integrity guard minted this ask — the unverifiable recursive delete or the session-transcript
-     *  write. ENGINE-STAMPED by the two guard policies; a fold-internal fact the class derivation reads
-     *  ({@link import("./ask-origin.js").classifyAsk}) so the two guards, which mint the same
+    /** WHICH integrity guard minted this ask — a removal of a protected location, an unverifiable recursive delete
+     *  or the session-transcript write. ENGINE-STAMPED by the guard policies; a fold-internal fact the class
+     *  derivation reads ({@link import("./ask-origin.js").classifyAsk}) so the guards, which mint the same
      *  `requiresRealApproval` ask, are told apart by a fact and not by their prose. Never copied onto the
      *  approval request or the park row. */
-    guard?: "unverifiable_delete" | "transcript_write" | "artifact_shared_read";
+    guard?: "dangerous_delete" | "unverifiable_delete" | "transcript_write" | "artifact_shared_read";
     /** The call could not be READ against a rule that may reach it — a content-form deny row, a content-form
      *  ask row, or a persisted-rule row (the lexer's word). ENGINE-STAMPED at the three unreadable mint sites;
      *  the class derivation reads it as `rule_unreadable` (a mode may release it, a person may clear it, no
@@ -527,11 +548,14 @@ export interface ToolPolicy {
      * describes the policy must read that bit, not the field's presence.
      */
     readonly projection?: ToolPolicyProjection;
-    /** The policy's path DENY rules that speak for a face of the engine's deny table (a `Read(<pattern>)` / `Edit(<pattern>)`
-     *  deny compiled by `createPermissionRulePolicy`), as rows the prepared leg joins to its read and write tables — so the
-     *  shell's reads and writes and the traversals meet the rule, not only the tool it names. Carried through
-     *  {@link combinePolicies}; read with {@link toolPolicyPathDenyRules}. Deny-only: a row can only refuse more. */
-    readonly pathDenyRules?: readonly import("../tools/fs/read-deny.js").PathRuleDenyRow[];
+    /** The policy's PATH rules as a function of the ANCHORS of the leg they are installed on (`createPermissionRulePolicy`
+     *  sets it; present exactly when the policy judges a path target): given the leg's root and home, every path rule
+     *  bound there — the face-keyed deny rows the prepared leg joins to its read and write tables (so the shell's reads and
+     *  writes and the traversals meet the rule, not only the tool it names), and the rows its own `check` judges at the
+     *  gate. A policy the Runner already installed answers with its own installation's rows whatever it is given. Carried
+     *  through {@link combinePolicies}; read with {@link toolPolicyPathRules}. Its presence also tells the Runner to read
+     *  each call's target ({@link ToolCallRequest.targetReading}). */
+    readonly pathRules?: (anchors: import("./permission-rule-model.js").PathRuleBases) => readonly import("./path-rule-binding.js").BoundPathRule[];
     /** Does this policy guard a write to this ABSOLUTE target — would it refuse the write if a write tool made it? The
      *  policy's answer for a writer it cannot see as a call (the shell's file commands), read by the shell station's
      *  `writesPlaced` fact alone: a guarded target is not placed, so no permission mode answers the command and its ask
@@ -548,9 +572,15 @@ export interface ToolPolicy {
  * each by name off the wrapped policy, {@link combinePolicies} folds each. The fence makes a new {@link ToolPolicy} member
  * a compile error until the table names it.
  */
-declare const TOOL_POLICY_CARRIED_MEMBERS: readonly ["projection", "pathDenyRules", "writeTargetGuard", "nameSets"];
+declare const TOOL_POLICY_CARRIED_MEMBERS: readonly ["projection", "pathRules", "writeTargetGuard", "nameSets"];
 type ToolPolicyCarriedMember = (typeof TOOL_POLICY_CARRIED_MEMBERS)[number];
 export type ToolPolicyCarriesEveryMember = AssertAllKeysHandled<Exclude<Exclude<keyof ToolPolicy, "check">, ToolPolicyCarriedMember>>;
+/** The carried members that are set on `p`, each read by name — an accessor or a non-enumerable member included. */
+export declare function carriedMembersOf(p: {
+    readonly [K in ToolPolicyCarriedMember]?: ToolPolicy[K];
+}): {
+    -readonly [K in ToolPolicyCarriedMember]?: ToolPolicy[K];
+};
 /**
  * The ONE way to wrap a policy: the wrapper decides through `check`; every member {@link ToolPolicy} declares beside it
  * (projection, name sets, path deny rows, write-target guard — the carried-member table) rides as `inner` holds it, read
@@ -560,8 +590,10 @@ export type ToolPolicyCarriesEveryMember = AssertAllKeysHandled<Exclude<Exclude<
  * The ask-class brand is not carried: it attests the replaced `check`.
  */
 export declare function wrapToolPolicy<P extends ToolPolicy>(inner: P, check: ToolPolicy["check"]): Pick<P, ToolPolicyCarriedMember> & ToolPolicy;
-/** Every path deny row the given policies carry (combined policies included), in order — the deny tables' rule rows. */
-export declare function toolPolicyPathDenyRules(policies: readonly (ToolPolicy | undefined)[]): readonly import("../tools/fs/read-deny.js").PathRuleDenyRow[];
+/** Every path rule the given policies carry (combined policies included), in order, bound at `anchors` — the anchors of
+ *  the leg the policies are installed on (a policy already installed answers with its own installation's rows). The deny
+ *  tables take the rows that guard a face (`faces` non-empty) of a deny rule. */
+export declare function toolPolicyPathRules(policies: readonly (ToolPolicy | undefined)[], anchors: import("./permission-rule-model.js").PathRuleBases): readonly import("./path-rule-binding.js").BoundPathRule[];
 /** The one write-target guard the given policies carry together (combined policies included): `true` when any member
  *  guards the target, a member that throws counting as guarding it. `undefined` when none carries one. */
 export declare function toolPolicyWriteTargetGuard(policies: readonly (ToolPolicy | undefined)[]): ToolPolicy["writeTargetGuard"];
@@ -1082,6 +1114,7 @@ export declare function createUnverifiableDeletePolicy(opts?: {
     safeVars?: readonly string[];
     /** Override the shell tool names this gate parses (default `Bash`). */
     tools?: string[];
+    removalSeat?: RemovalGuardSeat;
 }): ToolPolicy;
 export declare function createTranscriptIntegrityPolicy(opts?: {
     /** Transcript directories to protect. Default: `($AGENT_DATA_DIR ?? ~/.ai-agent)/sessions`. */

package/dist/core/tool-policy.js

@@ -1,5 +1,6 @@
 import { createHash } from "node:crypto";
 import { homedir } from "node:os";
+import { withArgsReading } from "./effective-path-target.js";
 import { brandPolicyAskClass } from "./ask-class.js";
 import { decisionAskClassesOf, headlessDenialMessage } from "./ask-origin.js";
 import { ownReadRootCandidate, readRootGrantSeat } from "./read-root-grant-screen.js";
@@ -21,6 +22,7 @@ import { isNamespacedCoveringRuleName, namespacedRuleNameCovers, parsePermission
 import { protocolOf } from "./protocol-table.js";
 import { isAbsoluteForFamily, isAbsolutePathForm, joinForFamily, normalizeAbsPathLexically, pathFamilyOf, writeTargetPath } from "../tools/fs/safety.js";
 import { ASSIGNMENT_PREFIX, writtenAssignmentPrefix } from "../tools/fs/bash-program-position.js";
+import { removalReadingOf } from "../tools/fs/removal-targets.js";
 const nameListHolds = (set, req) => heldBy("policy.nameLists", set, req);
 const shellToolsListHolds = (set, req) => heldBy("policy.shellToolsList", set, req);
 export function advertisedWritableRootsSeat(seat) {
@@ -136,8 +138,8 @@ export const ASK_EVIDENCE_ABSENCE_VALUES = ["not_wired", "not_adjudicated", "una
 export function decisionText(d) {
     return d.message;
 }
-const TOOL_POLICY_CARRIED_MEMBERS = ["projection", "pathDenyRules", "writeTargetGuard", "nameSets"];
-function carriedMembersOf(p) {
+const TOOL_POLICY_CARRIED_MEMBERS = ["projection", "pathRules", "writeTargetGuard", "nameSets"];
+export function carriedMembersOf(p) {
     const out = {};
     const carry = (k) => {
         const v = p[k];
@@ -151,8 +153,8 @@ function carriedMembersOf(p) {
 export function wrapToolPolicy(inner, check) {
     return { ...carriedMembersOf(inner), check };
 }
-export function toolPolicyPathDenyRules(policies) {
-    return policies.flatMap((p) => (Array.isArray(p?.pathDenyRules) ? p.pathDenyRules : []));
+export function toolPolicyPathRules(policies, anchors) {
+    return policies.flatMap((p) => (typeof p?.pathRules === "function" ? p.pathRules(anchors) : []));
 }
 export function toolPolicyWriteTargetGuard(policies) {
     const guards = policies.flatMap((p) => (typeof p?.writeTargetGuard === "function" ? [p.writeTargetGuard] : []));
@@ -513,7 +515,7 @@ export function createApprovalPolicy(opts) {
 }
 export function combinePolicies(...policies) {
     const nameSets = policies.flatMap(toolPolicyNameSets);
-    const pathDenyRules = toolPolicyPathDenyRules(policies);
+    const pathRuled = policies.filter((p) => typeof p?.pathRules === "function");
     const writeTargetGuard = toolPolicyWriteTargetGuard(policies);
     const childProjections = policies.map((p) => p.projection);
     const projectedComponents = [];
@@ -535,7 +537,7 @@ export function combinePolicies(...policies) {
     const folded = {
         projection: combinedProjection,
         nameSets: nameSets.length > 0 ? nameSets : undefined,
-        pathDenyRules: pathDenyRules.length > 0 ? pathDenyRules : undefined,
+        pathRules: pathRuled.length > 0 ? (anchors) => toolPolicyPathRules(pathRuled, anchors) : undefined,
         writeTargetGuard,
     };
     return {
@@ -575,7 +577,8 @@ export function combinePolicies(...policies) {
                     continue;
                 }
                 if (d.updatedInput !== undefined) {
-                    current = { ...current, args: d.updatedInput };
+                    const reread = withArgsReading(current, d.updatedInput, signal);
+                    current = reread !== undefined ? await reread : { ...current, args: d.updatedInput };
                     rewrite = d;
                     stated = d.action === "allow" ? d.decisionReason : undefined;
                 }
@@ -920,28 +923,23 @@ function hasRecursiveForce(argvTail) {
 export function createUnverifiableDeletePolicy(opts) {
     const safeVars = new Set([...UNVERIFIABLE_DELETE_SAFE_VARS, ...(opts?.safeVars ?? [])]);
     const shellTools = canonicalToolNameSet(opts?.tools);
+    const unverifiable = (command, finding = findUnverifiableRecursiveDelete(command, safeVars)) => (finding === undefined ? ALLOW : removalAsk("unverifiable_delete", finding));
     return brandPolicyAskClass({
-        check(req) {
+        check(req, signal) {
             if (!shellToolsListHolds(shellTools, req))
                 return ALLOW;
             const command = req.args?.command;
             if (typeof command !== "string")
                 return ALLOW;
-            const finding = findUnverifiableRecursiveDelete(command, safeVars);
-            if (finding === undefined)
-                return ALLOW;
-            return {
-                action: "ask",
-                decisionReason: "safety",
-                requiresRealApproval: true,
-                guard: "unverifiable_delete",
-                message: `Unverifiable recursive delete (fail-closed unless cleared): ${finding}. ` +
-                    `Re-run the delete with the resolved literal path written into the command itself ` +
-                    `(or assign the variable in the same command, e.g. \`DIR=/exact/path; rm -rf "$DIR"\`) so the target can be verified.`,
-            };
+            const removal = removalReadingOf(command, req, opts?.removalSeat);
+            return removal === undefined ? unverifiable(command) : removal.judge(signal).then((found) => (found === undefined ? unverifiable(command) : removalAsk(found.guard, found.text)));
         },
     }, "external_authority");
 }
+function removalAsk(guard, text) {
+    const message = guard === "dangerous_delete" ? `Dangerous removal: ${text}. No permission mode, allow rule or classifier clears this — only a person confirming this call does.` : `Unverifiable recursive delete (fail-closed unless cleared): ${text}. Re-run the delete with the resolved literal path written into the command itself (or assign the variable a literal path in the same command, e.g. \`DIR=/exact/path; rm -rf "$DIR"\`) so the target can be verified.`;
+    return { action: "ask", decisionReason: "safety", requiresRealApproval: true, guard, message };
+}
 function pathSegments(p) {
     return p.split(/[\\/]/).filter(Boolean);
 }

package/dist/core/tool-spec.d.ts

@@ -175,18 +175,36 @@ export interface ToolSpec<TParams extends TSchema = TSchema> {
      * offered pool a child of that type actually mounts. Filled by `createSubagentTool` beside
      * `agentListing`; a type with neither list gets the whole offered pool.
      *
-     * Read by ONE consumer: the memory content-origin face, which classifies a delegation RESULT by the
+     * Read by the memory content-origin face, which classifies a delegation RESULT by the
      * child's tool face. A child that can reach a network or protocol tool returns content from outside
      * the trust boundary just as surely as calling that tool here would, and the parent's transcript is
      * where it lands. Static by construction — the child's face is known from its definition, so no
-     * runtime tracking of what the child actually did is involved (that is the v2 ticket).
+     * runtime tracking of what the child actually did is involved (that is the v2 ticket). `authored`
+     * marks the entries minted from a definition a caller wrote on a tool a deployment mounted (not the
+     * engine's built-ins, the general-purpose alias, fork, or the engine's nested copy of the tool for a
+     * delegated child); prepare's deny-name check judges only those.
      */
     agentToolFaces?: ReadonlyArray<{
         name: string;
         allowTools?: readonly string[];
         denyTools?: readonly string[];
         canRedelegate?: boolean;
+        authored?: true;
     }>;
+    /**
+     * The tool-level `denyTools` list of the delegation tool (`SubagentToolOptions.denyTools`, applied when no agent definition is
+     * selected), exactly as written, filled by `createSubagentTool` beside {@link agentToolFaces}; absent when none was written
+     * and on the engine's nested copy for a delegated child. Read by prepare's deny-name check, which judges it with
+     * the `authored` entries of the faces.
+     */
+    agentToolLevelDenyTools?: readonly string[];
+    /**
+     * The tool-level `allowTools` list of the delegation tool (`SubagentToolOptions.allowTools`, applied when no agent definition is
+     * selected), as the tool copied it, filled by `createSubagentTool` beside {@link agentToolLevelDenyTools}; absent when none was
+     * written and on the engine's nested copy for a delegated child. Read by prepare's allowed-list judgment: a value that is not a
+     * list of strings is refused before the run.
+     */
+    agentToolLevelAllowTools?: readonly string[];
     /**
      * design/178 §3 (ruled 2026-08-08) — the POOL a delegated child draws from, as the delegation tool
      * captured it. Read together with {@link agentToolFaces} by the memory content-origin face: the face
@@ -194,8 +212,9 @@ export interface ToolSpec<TParams extends TSchema = TSchema> {
      * carries its own tool set, and a parent that mounts nothing but the delegation tool can still hand
      * its children a network tool, so the parent's roster is the wrong thing to look at.
      *
-     * ABSENT ⇔ the pool is not statically knowable — a spawn-time tool factory can inject tools whose
-     * identity does not exist until the call happens — and the reader fails closed on that.
+     * ABSENT ⇔ the pool is not statically knowable — a spawn-time tool factory with no declared roster
+     * (`SubagentToolOptions.extraToolNames`) can inject tools whose identity does not exist until the call
+     * happens — and the reader fails closed on that. A declared roster's tools are rows of the pool.
      */
     agentToolPool?: ReadonlyArray<{
         name: string;

package/dist/core/types.d.ts

@@ -30,5 +30,5 @@ export type { BackgroundChildEvent, DelegationLifecycleEvent } from "./delegatio
 export { __resetMalformedDelegationSeatAnnouncement, deliverDelegationLifecycle } from "./delegation-frames.js";
 export type { ProjectMemoryLoad, ResumePreflightInfo, ResumePreflightVerdict, RunnerDeps } from "./runner-deps.js";
 export type { EngineNotice, OwedUserInputAccount, UserInputUndrainedCause } from "./engine-notice.js";
-export { __resetMalformedNoticeSeatAnnouncement, deliverEngineNotice, owedUserInputCounts, parentLegIds, settleOwedUserInput, undrainedUserInputNotices, USER_INPUT_UNDRAINED_CAUSES } from "./engine-notice.js";
+export { __resetMalformedNoticeSeatAnnouncement, deliverEngineNotice, owedUserInputCounts, parentLegIds, settleOwedUserInput, undrainedUserInputNotices, USER_INPUT_UNDRAINED_CAUSES, USER_INPUT_UNDRAINED_FAMILIES } from "./engine-notice.js";
 export type { AgentTool, Model, StreamFn, ThinkingLevel, ToolInputValidationContext, ToolInputVerdict };

package/dist/core/types.js

@@ -1,4 +1,4 @@
 export { MODEL_ROLES } from "./model-seat.js";
 export { AUTO_MODE_DENY_SOURCES, isAutoModeDenySource } from "./runtime-caps.js";
 export { __resetMalformedDelegationSeatAnnouncement, deliverDelegationLifecycle } from "./delegation-frames.js";
-export { __resetMalformedNoticeSeatAnnouncement, deliverEngineNotice, owedUserInputCounts, parentLegIds, settleOwedUserInput, undrainedUserInputNotices, USER_INPUT_UNDRAINED_CAUSES } from "./engine-notice.js";
+export { __resetMalformedNoticeSeatAnnouncement, deliverEngineNotice, owedUserInputCounts, parentLegIds, settleOwedUserInput, undrainedUserInputNotices, USER_INPUT_UNDRAINED_CAUSES, USER_INPUT_UNDRAINED_FAMILIES } from "./engine-notice.js";

package/dist/core/write-protect.d.ts

@@ -173,6 +173,10 @@ export interface WriteProtectionCompileOptions {
      *  path-family source when the call carries no cwd. Omitted ⇒ relative spellings resolve against the
      *  cwd, then the environment's own working directory. */
     readonly rootPath?: string;
+    /** The host's configuration root when it keeps the agent's configuration directory somewhere other than the home's
+     *  `.sema` (`RunnerDeps.agentConfigDir`, absolute, already screened): every row that names the `.sema` directory also
+     *  names the same tail below this root, and a hit there cites the row. Omitted ⇒ the table is judged as it stands. */
+    readonly agentConfigDir?: string;
     /**
      * Called at most ONCE per judgment, at the moment the ENVIRONMENT half is found unable to contribute
      * ({@link WriteProtectionViewAbsence}) — before the judgment returns, and on the hit arm as well as the

package/dist/core/write-protect.js

@@ -4,6 +4,7 @@ import { pathTargetBaseOf } from "./effective-path-target.js";
 import { canonicalDataRootKeys, dataRootSpellings, relativeUnderRoot } from "./sensitive-path-policy.js";
 import { symlinkChainHops } from "./path-identity.js";
 import { readDenyPatternRun } from "../tools/fs/read-deny.js";
+import { agentConfigDirSegments, agentConfigDirTail } from "./agent-config-dir.js";
 import { thrownText } from "./thrown-value.js";
 const freezeTable = (rows) => Object.freeze(rows.map((r) => Object.freeze(r)));
 export const WRITE_PROTECTED_DEFAULT_TABLE = freezeTable([
@@ -196,6 +197,7 @@ export function compileWriteProtection(entries, opts) {
     const basenames = new Map();
     const segments = new Map();
     const runs = [];
+    const configTails = [];
     for (const row of rows) {
         const folded = foldWriteProtectName(row.name);
         if (row.kind === "basename") {
@@ -209,8 +211,23 @@ export function compileWriteProtection(entries, opts) {
         else {
             runs.push({ name: row.name, parts: folded.split("/").filter((s) => s.length > 0) });
         }
+        const tail = row.kind === "basename" ? undefined : agentConfigDirTail(row.name);
+        if (tail !== undefined && opts?.agentConfigDir !== undefined)
+            configTails.push({ hit: { name: row.name, kind: row.kind }, tail: foldWriteProtectName(tail).split("/").filter((s) => s.length > 0) });
     }
-    const judgeSegments = (raw) => {
+    const configRootSpelled = opts?.agentConfigDir === undefined ? [] : [agentConfigDirSegments(opts.agentConfigDir)];
+    const judgeAtConfigRoots = (segs, roots) => {
+        for (const root of roots) {
+            const at = root.map(foldWriteProtectSegment);
+            if (segs.length < at.length || !at.every((a, i) => segs[i] === a))
+                continue;
+            for (const { hit, tail } of configTails)
+                if (segs.length >= at.length + tail.length && tail.every((t, i) => segs[at.length + i] === t))
+                    return hit;
+        }
+        return null;
+    };
+    const judgeSegments = (raw, configRoots) => {
         if (raw.length === 0)
             return null;
         const segs = raw.map(foldWriteProtectSegment);
@@ -229,23 +246,26 @@ export function compileWriteProtection(entries, opts) {
                     return { name: run.name, kind: "segment-run" };
             }
         }
-        return null;
+        return configTails.length === 0 ? null : judgeAtConfigRoots(segs, configRoots);
     };
-    const judgeViews = (spelling) => {
-        const posix = judgeSegments(pathViewSegments(spelling, "literal", POSIX_SEPARATOR_FAMILY, uncAnchorSegments(spelling)));
+    const judgeViews = (spelling, configRoots = configRootSpelled) => {
+        const posix = judgeSegments(pathViewSegments(spelling, "literal", POSIX_SEPARATOR_FAMILY, uncAnchorSegments(spelling)), configRoots);
         if (posix !== null)
             return posix;
-        const bothSeparators = judgeSegments(pathViewSegments(spelling, "literal"));
+        const bothSeparators = judgeSegments(pathViewSegments(spelling, "literal"), configRoots);
         if (bothSeparators !== null)
             return bothSeparators;
         for (const normalization of WIN32_NORMALIZATIONS) {
-            const hit = judgeSegments(pathViewSegments(spelling, normalization));
+            const hit = judgeSegments(pathViewSegments(spelling, normalization), configRoots);
             if (hit !== null)
                 return hit;
         }
         return null;
     };
-    const judgeSpelled = (spelled) => judgeViews(relativeUnderDataRoot(spelled, rootViews) ?? spelled);
+    const judgeSpelled = (spelled) => {
+        const remainder = relativeUnderDataRoot(spelled, rootViews);
+        return remainder === null ? judgeViews(spelled) : judgeViews(remainder, []);
+    };
     const judgeSpelling = (path, cwd) => {
         const base = typeof cwd === "string" && cwd.length > 0 ? cwd : undefined;
         const family = pathFamilyOf({ cwd: base });
@@ -291,7 +311,8 @@ export function compileWriteProtection(entries, opts) {
             }
             try {
                 if (canonKey !== undefined) {
-                    const byTarget = judgeViews(canonKey);
+                    const canonicalRoots = configTails.length === 0 || opts?.agentConfigDir === undefined ? [] : (await canonicalDataRootKeys(env, [opts.agentConfigDir], ctx.signal)).map(agentConfigDirSegments);
+                    const byTarget = judgeViews(canonKey, [...configRootSpelled, ...canonicalRoots]);
                     if (byTarget !== null) {
                         for (const rootKey of await canonicalDataRootKeys(env, dataRootPaths, ctx.signal)) {
                             const relative = relativeUnderRoot(canonKey, rootKey);
@@ -299,7 +320,7 @@ export function compileWriteProtection(entries, opts) {
                                 continue;
                             if (relative === "")
                                 return { kind: "clear" };
-                            const remainder = judgeViews(relative);
+                            const remainder = judgeViews(relative, []);
                             return remainder === null ? { kind: "clear" } : { kind: "hit", hit: remainder, via: "target" };
                         }
                         return { kind: "hit", hit: byTarget, via: "target" };

package/dist/index.d.ts

@@ -63,7 +63,7 @@ export { MCP_FAILURE_KINDS, MCP_DELIVERY_VERDICTS, MCP_LIVENESS_STATES, classify
 export { MCP_INJECTION_DROP_REASONS, MCP_INJECTION_DROP_TEXT, mcpInjectionDroppedNotice, type McpInjectionDropReason, type McpInjectionDropFacts } from "./core/mcp-injection-drop.js";
 export { askUnresolvableNotice, type AskUnresolvableFacts } from "./core/ask-unresolvable-notice.js";
 export { ASK_UNRESOLVABLE_CAUSES } from "./core/ask-unresolvable-notice.js";
-export { USER_INPUT_UNDRAINED_CAUSES, type UserInputUndrainedCause } from "./core/engine-notice.js";
+export { USER_INPUT_UNDRAINED_CAUSES, type UserInputUndrainedCause, USER_INPUT_UNDRAINED_FAMILIES } from "./core/engine-notice.js";
 export { STEER_REPLAY_FACETS, type SteerReplayFacet } from "./core/steer-replay.js";
 export { TOOL_TURN_INCOMPLETE_CAUSES, type ToolTurnIncompleteCause } from "./internal/llm.js";
 export { DURABLE_MANDATE_SOURCES } from "./core/tool-policy.js";
@@ -146,12 +146,13 @@ export { judgeRuleToolName, RULE_TOOL_NAME_VERDICTS, type RuleToolNameVerdict }
 export { DEFAULT_SUBAGENT_TOOL_NAME } from "./agents/subagent.js";
 export { renderTaskNotificationXml, RESUPPLIED_FRAME_PREAMBLE, taskNotificationDedupKey, isDelegatedAgentTerminal, isTerminalTaskNotification, SystemInjectionQueue, type TaskNotificationPayload, type TaskNotificationStatus, type ExternalNotificationInput, type SystemInjection, type SystemInjectionPriority, type NotificationInjectionOutcome, // the injector's outcome words (`parked_durably` = the session's durable box took the frame)
 NOTIFICATION_INJECTION_OUTCOMES, // …and their value half + guard, so a host wiring its own uplink validates a reported outcome without duplicating the vocabulary
-isNotificationInjectionOutcome, SYSTEM_INJECTION_PRIORITIES, isSystemInjectionPriority, steerPriorityOf, AGENT_MESSAGE_TAG, renderAgentMessageFrame, type SemaProvenance, HANDBACK_STATES, type HandbackState, COMPACTION_KINDS, type CompactionKind, handbackStateOf, terminalFrameFacets, } from "./core/task-notification.js";
+isNotificationInjectionOutcome, SYSTEM_INJECTION_PRIORITIES, isSystemInjectionPriority, steerPriorityOf, injectionLaneOf, type UserInputLane, AGENT_MESSAGE_TAG, renderAgentMessageFrame, type SemaProvenance, HANDBACK_STATES, type HandbackState, COMPACTION_KINDS, type CompactionKind, handbackStateOf, terminalFrameFacets, } from "./core/task-notification.js";
 export { TOOL_FAMILIES, TOOL_MOUNT_TAGS, TOOL_APPROVAL_CARDS, TOOL_PATH_ACCESSES, TOOL_PATH_BASES, TOOL_PATH_ABSENCES, TOOL_WIRE_NAME_MAX_CHARS, TOOL_CONTRACT_MAX_CHARS, TOOL_CARD_ID_MAX_CHARS, TOOL_KEY_MAX_CHARS, TOOL_KEYS_MAX, RENDER_HINT_MAX_CHARS, RENDER_HINT_ACTIVITY_MAX_CHARS, RENDER_HINT_MAX_LIST, type ToolFamily, type ToolMountTag, type ToolApprovalCard, type ToolPathAccess, type ToolPathBase, type ToolPathAbsence, type ToolPathTarget, type ToolCallPathTarget, type ToolRosterPathTarget, pathTargetSlotOnly, type ToolRuleFace, type ToolRenderHints, type ToolFaceDeclaration, type ToolCatalogEntry, } from "./core/tool-face.js";
 export { describeToolCatalog, catalogEntriesNamed, catalogToolNames, catalogRuleFaceOf, pathTargetOf, pathTargetValue, protectivePathTargetOf, declaredPathTargetOf, BARE_REQUEST_CODE, isProtectedWrite, isDeclaredWrite, fileOpAccessOf, type ToolCallLike, pathConfinableWriteToolNames, pathTargetingToolNames, compactableToolNames, budgetExemptToolNames, handBandEffects, engineCardTypes, predictMountedToolNames, HANDS_BAND_TAGS, MOUNT_TAG_IN_HANDS_BAND, } from "./core/tool-registry.js";
 export { ToolRosterEntry, ToolRoster, ToolRosterDelta, ToolRosterRenderHints, ROSTER_SOURCES, type RosterSource, type ToolIdentity, toolIdentityOf, mintCapabilityId, diffToolRoster, judgeParkedToolIdentity, ruleFacesFromRoster, toolCallFaceOf, rosterToolName, ruleNamesOf, inputKeysOf, ruleFaceOfInstance, rosterMemberBoundProblem, type RosterBoundMembers, type RosterBoundCode, ToolRosterDeltaSeat, } from "./core/tool-roster.js";
 export { type ToolCallFace } from "./core/tool-policy.js";
-export { effectivePathTargetOf, pathTargetBaseOf, type ToolPathBases, type PathTargetReading } from "./core/effective-path-target.js";
+export { effectivePathTargetOf, pathTargetBaseOf, type ToolPathBases, type PathTargetReading, type CallTargetReading, type CallTargetView } from "./core/effective-path-target.js";
+export { type BoundPathRule, type PathRuleSpec } from "./core/path-rule-binding.js";
 export { pathFamilyOf, isAbsoluteForFamily, pathIdentityOf, win32NamespaceScreen, WIN32_NAMESPACE_REFUSALS, type PathFamily, type PathIdentity, type PathIdentityReading, type Win32NamespaceRefusal } from "./tools/fs/safety.js";
 export { judgeShellRead, type ShellReadJudgeInput, type ShellReadJudgment, type ShellReadVerdict, type ShellReadStationSeat, type ShellReadAdmission, } from "./tools/fs/shell-read-check.js";
 export { SHELL_READ_FINDINGS, SHELL_READ_SEATS, SHELL_READ_DECISION, SHELL_READ_FINDING_RANK, type ShellReadFinding, type ShellReadSeat, type ShellReadDisposition, type ShellReadBoundary, type ReadEstablishment, type EstablishedRead, type ReadFinding, } from "./tools/fs/shell-read-judge.js";
@@ -193,7 +194,7 @@ export { createAllowDenyPolicy, createApprovalPolicy,
  *  members that seat has no lane for (`"unavailable"`, a routing answer; `updatedInput`, an operator edit a
  *  policy verdict cannot get re-adjudicated). Exported so a host can NAME it instead of deriving it through
  *  `Parameters<typeof createApprovalPolicy>[0]["approve"]`. */
-type ApprovalSeatOutcome, COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, findUnverifiableRecursiveDelete, combinePolicies, abortedSeatDeny, receiveHookResult, isEngineRefusal, wrapToolPolicy, decisionText, resolveAsk, toolPolicyNameSets, toolPolicyPathDenyRules, type ToolPolicyNameSets, type NamedToolPolicy, type ToolPolicyProjection, type ToolPolicyProjectionComponent, type ConstraintChainEntry, checkToolPolicyProjection, constraintChainEntryOf, constraintChainDigest, type ToolPolicy, type ToolCallRequest, type PermissionResult, type DecisionReason, screenApproverAttribution, APPROVER_ATTRIBUTION_MAX_CHARS, type OnAsk, type AskOutcome, type ResolvedAsk, type AskRequest, type AskDelegationProvenance, type AskRuleEvidence, type AskEvidenceAbsence, ASK_EVIDENCE_ABSENCE_VALUES, } from "./core/tool-policy.js";
+type ApprovalSeatOutcome, COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, findUnverifiableRecursiveDelete, combinePolicies, abortedSeatDeny, receiveHookResult, isEngineRefusal, wrapToolPolicy, decisionText, resolveAsk, toolPolicyNameSets, toolPolicyPathRules, type ToolPolicyNameSets, type NamedToolPolicy, type ToolPolicyProjection, type ToolPolicyProjectionComponent, type ConstraintChainEntry, checkToolPolicyProjection, constraintChainEntryOf, constraintChainDigest, type ToolPolicy, type ToolCallRequest, type PermissionResult, type DecisionReason, screenApproverAttribution, APPROVER_ATTRIBUTION_MAX_CHARS, type OnAsk, type AskOutcome, type ResolvedAsk, type AskRequest, type AskDelegationProvenance, type AskRuleEvidence, type AskEvidenceAbsence, ASK_EVIDENCE_ABSENCE_VALUES, } from "./core/tool-policy.js";
 export { type ReadRootGrantScreen } from "./core/read-root-grant-screen.js";
 export { type AskOrigin, ASK_ORIGINS, isAskOrigin, ORIGIN_IMPLIES_REAL_APPROVAL, PERSISTED_RULE_MANDATES, type PersistedRuleMandate, isPersistedRuleMandate, screenAskClassMembers } from "./core/ask-origin.js";
 export { PERMISSION_MODES, type PermissionMode, isPermissionMode, PERMISSION_MODE_RANK, clampPermissionMode, ASK_CLASSES, type AskClass, isAskClass, MODE_ARBITRATION, type ModeArbitrationRow, RELEASABLE_ASK_CLASSES, MODE_RELEASE_REASONS, type ModeReleaseReason, isModeReleaseReason, RRA_EXPLAINERS, classifyAsk, foldArbitrationRow, type AskClassification, type AskClassFacts, type ToolMarkSource, arbitrateByMode, type Arbitration, fileCommandOptionsSentence } from "./core/ask-origin.js";
@@ -202,12 +203,14 @@ export type { PermissionSeatInputs, PermissionSeatReading } from "./core/mode-po
 export type { SkillGateSeats, SkillGrantHit, SkillGrantLane, SkillGrantOrigin, SkillGrantRecord } from "./core/skill-grant.js";
 export { SKILL_GRANT_ORIGINS } from "./core/skill-grant.js";
 export type { BoundSkillGrants } from "./core/skill-grant-binding.js";
-export { ALLOW_ENTRY_INERT_REASONS, compileAllowEntry, compileAllowList, type AllowEntryInertReason, type CompiledAllowEntry, type AllowEntryGateSeats, type AllowEntryLane, type AllowEntryHit } from "./core/allow-entry.js";
+export { ALLOW_ENTRY_INERT_REASONS, compileAllowEntry, compileAllowList, renderListEntry, type AllowEntryInertReason, type CompiledAllowEntry, type AllowEntryGateSeats, type AllowEntryLane, type AllowEntryHit } from "./core/allow-entry.js";
 export { ALLOW_RULE_MEMBERS, type AllowRuleMember, type AllowRuleShadow } from "./core/allow-rule-shadow.js";
 export { mintNamespacePrefix } from "./core/protocol-naming.js";
 export { readDenyClassifierRules, renderClassifierDenyRules, type DerivedDenyRule } from "./core/auto-mode-prompt.js";
 export { AUTO_MODE_DENY_SOURCES, isAutoModeDenySource, type AutoModeDenySource } from "./core/runtime-caps.js";
-export { SETTLEMENT_KINDS, type SettlementKind, isSettlementKind, type Settlement, SETTLEMENT_PARTIES, type SettlementParty, isSettlementParty, SETTLEMENT_IS_REFUSAL, DENIED_BY_VALUES, type DeniedBy, isDeniedBy, DENIED_BY_MAY_VETO, CLASSIFIER_DENY_CAUSES, type ClassifierDenyCause, isClassifierDenyCause, DENIED_BY_MAY_CARRY_CAUSE, type GateDisposition, type GateOutcome, type ModeRelease, type ModeRefusal, screenGateOutcome } from "./core/gate-outcome.js";
+export { SETTLEMENT_KINDS, type SettlementKind, isSettlementKind, type Settlement, SETTLEMENT_PARTIES, type SettlementParty, isSettlementParty, HOST_DECIDERS, type HostDecider, isHostDecider, SETTLEMENT_IS_REFUSAL, DENIED_BY_VALUES, type DeniedBy, isDeniedBy, DENIED_BY_MAY_VETO, CLASSIFIER_DENY_CAUSES, type ClassifierDenyCause, isClassifierDenyCause, DENIED_BY_MAY_CARRY_CAUSE, type GateDisposition, type GateOutcome, type ModeRelease, type ModeRefusal, screenGateOutcome } from "./core/gate-outcome.js";
+export { ENGINE_BUILTIN_TOOL_NAMES, isEngineBuiltinToolName } from "./core/tool-catalog-entries.js";
+export { policyCannotAnswer, type HeldQuestion } from "./core/real-approval.js";
 export { type AskCarry } from "./core/hooks.js";
 export { SWAPPABLE_DEP_SEATS, SWAP_SEAT_NOTICE, isSwappableDepSeat, screenSwappableDeps, type SwappableDepSeat, type SwappableDeps } from "./core/swappable-deps.js";
 export { parseAutoModeResponse, createAutoModeDecider, AUTO_MODE_UNAVAILABLE_CAUSES, isAutoModeUnavailableCause, classifierUnavailableDenyMessage, classifierParseFailureDenyMessage, AUTO_MODE_PARSE_FAILURES, isAutoModeParseFailure, type AutoModeParseFailure, type AutoModeUnavailableCause, AUTO_MODE_CLASSIFIER_FALLBACKS, isAutoModeClassifierFallback, AUTO_MODE_FALLBACK_CAUSES, isAutoModeFallbackCause, type AutoModeClassifierFallback, type AutoModeFallbackCause, type AutoModeClassifierRound, type AutoModeLadderRung, type AutoModeVerdict, type AutoModeDecider, type AutoModeDeciderOptions, type AutoModeClassified, type AutoModeClassifyFn, type AutoModeClassifyInput, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow, type AutoModeDenialTracker, type AutoModeDenialLimitOptions, type DenialLimitCounts, type DenialLimitFallbackFace, type UnarmedDenialLimitFallback, type DenialLimitFallback, type DenialLimitVerdict, } from "./core/auto-mode.js";
@@ -253,6 +256,7 @@ export { formatHookFeedback, runToolGate, createHookEnvCapabilities, createPreTo
 export { HOOK_FAMILIES, HOOKS_INVALID_CODE, type HookFamily, type WiringManifestHookEntry } from "./core/hook-seats.js";
 export { InMemoryMemoryStore, composeMemoryBlock, composeLayeredMemoryBlock, normalizeMemorySpec, type NormalizedMemorySpec, type MemorySpecInput, supportsConsolidation, supportsPeriodicConsolidation, firstSentence, expandLexicalTerms, lexicalSearchMatch, type Embedder, classifyPromotable, enforcePromotableWriteGate, guardedMemoryStore, MemoryGateError, MemoryProjectionError, detectSecret, enforceSecretWriteGate, enforceStructuredNoteSecretGate, type UtilityGate, type MemoryStore, type MemoryVectorMode, type ScoredMemory, type MemoryNoteHeader, type MemoryNoteRecord, type MemoryNoteType, type StructuredNoteInput, MEMORY_PROJECT_KEY_ABSENT_REASONS, type MemoryProjectKeyAbsentReason, type MemoryProjectKey, } from "./core/memory.js";
 export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, type MemoryBackendContractHooks, buildMemoryInstruction, writableRootOf, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_ORIGIN_CAUSES, committedOriginOf, originEquals, consolidationExposedFrontmatter, ambiguousOriginRepresentation, type OriginClearanceRow, type OriginClearanceEvent, type OriginClearanceShadow, committedDistilledOf, distilledEquals, type MemoryEntryDistilled, type MemoryEntryDistilledInput, CONSOLIDATION_DEFAULTS, ConsolidationRefusedError, MEMORY_SEARCH_SUPERSEDED_TAG, consolidationTypeEligible, deriveSupersededSet, memorySupersededNote, readIntentCredentials, supersessionFuseCeiling, deriveShadowedSet, memoryConsolidationRecommendedNotice, memoryConsolidationCommittedNotice, memoryConsolidationConflictNotice, memoryConsolidationIncompleteNotice, memoryConsolidationRefusedNotice, memoryConsolidationWithheldNotice, type ConsolidationGateRead, type ConsolidationGateRow, type ConsolidationIntent, type ConsolidationIntentCredentialRow, type ConsolidationLeaseSeat, type ConsolidationProductProposal, type ConsolidationProposal, type MemoryConsolidationOptions, type ConsolidationCommitReceipt, type ConsolidationReconcileReport, type ConsolidationResolveReceipt, type ConsolidationPlanSummary, type ConsolidationPlanFoldEvidence, type SessionMemoryStatus, DISTILLER_DEFAULT_MAX_INPUTS_PER_PRODUCT, LLM_DISTILLER_CONTRACT, LLM_DISTILLER_CONTRACT_DL2, LLM_DISTILLER_CONTRACT_DL3, LLM_DISTILLER_CONTRACTS, MEMORY_DISTILLER_CONTRACT_V1, contractGroupingDiff, driveConsolidationToFixpoint, isAliasModelId, llmPlanDistiller, mintExposurePartitionedPlan, mintLlmConsolidationPlan, MEMORY_DISTILLER_PURITY_CONTRACT_V1, detectCleanArmVerbatimLeak, type CleanArmLeakFinding, type CleanArmLeakVerdict, type MemoryDistillerPurityContract, openAiCompatChatSeat, parseJsonAnswer, planParseRepairs, sanitizeLlmGroups, scheduleUnderFuse, type ConsolidationDistillFn, type ConsolidationDriveCycleRow, type ConsolidationDriveEngine, type ConsolidationDriveResult, type ConsolidationFoldState, type DistillerCandidate, type DistillerChatAnswer, type DistillerChatFn, type DistillerChatRequest, type FuseSchedule, type LlmConsolidationPlan, type LlmConsolidationPlanArm, type LlmConsolidationPlanProduct, type LlmDistillerContract, type MintLlmConsolidationPlanResult, type PlanParseRepairs, type SanitizedLlmGroups, CONSOLIDATION_DRIVER_PLANS_DIR, CONSOLIDATION_DRIVER_RUNS_FILE, CONSOLIDATION_RUN_STOP_REASONS, archiveDistillerPlan, readConsolidationDriverRun, runMemoryConsolidationDriver, type ConsolidationDriverEngine, type ConsolidationDriverRunRow, type ConsolidationRunReceipt, type ConsolidationRunStopReason, type RunMemoryConsolidationOptions, isInstructionEntry, type MemoryEntryOrigin, type MemoryOriginCause, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, MEMORY_CAPTURE_OPTOUT_NOTICE, memoryCaptureOptedOutNotice, memoryCaptureOptOutUnpersistedNotice, SESSION_CAPTURE_OPTOUT_DIR, markSessionCaptureOptOut, readSessionCaptureOptOut, listSessionCaptureOptOut, fileSessionCaptureRecordStore, type SessionCaptureOptOutRecord, type SessionCaptureOptOutMarkOutcome, type SessionCaptureRecordStore, readV2HeaderHints, type V2HeaderHints, LINEAGE_FILE, CHALLENGES_FILE, CHALLENGED_HISTORY_FILE, CHALLENGE_LEDGER_MAX_EVENTS, rebuildStrictControlPlaneLedger, type ControlPlaneRebuildReceipt, type StrictControlPlaneLedger, type ChallengeAssignment, type ChallengeEvent, type ChallengedHistoryRow, type LineagePendingTxn, type LineagePromotion, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_INDEX_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, type MemorySearchDetails, type MemorySearchHit, type CleanMemorySearchHit, type ExposedMemorySearchHit, MEMORY_EXPOSURE_BANNER, MEMORY_EXPOSURE_HANDLE_TAG, memoryExposureIndexRow, type MemoryGetDetails, type MemoryIndexDetails, type MemoryIndexRow, type CleanMemoryIndexRow, type ExposedMemoryIndexRow, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, type MemoryAnnouncement, type ScanFinding, type MemoryEngineOptions, type MemoryInjection, type EntryProvenanceAccount, type TransferEvidence, type CommittedBinding, type CommittedEntrySnapshot, type CommittedScopeSnapshots, type EntryCustodyReport, erasureSelectHash, type EraseMemoryEntriesInput, type ErasureSelect, type ErasedBinding, type MemoryErasureAttestation, computeMemoryBundleHash, type MemoryExportBundle, type MemoryImportReport, type MemoryExportSnapshot, type MemoryBundleImportPlan, type BundleChallengeRow, type BundleLineageRow, type BundlePollutedSession, type MemoryBackend, type MemoryEntry, type MemoryEntryFrontmatter, type MemoryEntryHeader, type MemoryScopeEnumeration, type ScoredMemoryEntry, type NotePatch, type PatchReport, type MaterializedFile, type MemorySessionHandle, type HarvestReport, type HarvestRejection, type HarvestRejectionCode, type ParsedEntryFile, type ScannedEntryFile, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, type ParsedScopeKey, migrateScope, type MigrateScopeReport, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, type RemoteMemoryFile, type RemoteMemoryBaseline, type RemoteMaterialization, type RemoteHarvestResult, type InboundEntryFinding, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, type MemorySyncCursor, type MemorySyncConflict, type MemorySyncPlan, type RecallSource, syncMemoryScope, type MemorySyncTransport, type MemorySyncRequestBody, type MemorySyncResponseBody, type MemorySyncClientConflict, type SyncMemoryScopeOptions, type MemorySyncClientResult, } from "./core/memory-engine/index.js";
+export { STORE_FORM_REFUSAL_CODES, TARGET_OUTSIDE_STORE, SCOPE_HOME_NOT_DIRECTORY, SCOPE_HOME_FORMS, type StoreFormRefusalCode, type StoreFormRefusalDetail, type StoreFormRefusal, type ScopeHomeForm } from "./core/memory-engine/layout.js";
 export { SHARED_MEMORY_READ_CAP_BYTES, SHARED_MEMORY_LIST_PAGE_SIZE, SharedMemoryStoreError, type SharedMemoryStoreProvider, type SharedMemoryStoreReader, type SharedMemoryPagedList, type SharedMemoryStoreInfo, type SharedMemoryDocumentEntry, type SharedMemorySnapshot, type SharedMemoryRequestContext, type MemoryListDetails, type MemoryReadDetails, } from "./core/shared-memory/types.js";
 export { sharedMemoryStoreContract, type SharedMemoryFixture, type SharedMemoryStoreContractHooks, } from "./core/shared-memory/contract.js";
 export { termSet, jaccardDistance, cosineDistance } from "./core/memory-vector.js";

package/dist/index.js

@@ -49,7 +49,7 @@ export { MCP_FAILURE_KINDS, MCP_DELIVERY_VERDICTS, MCP_LIVENESS_STATES, classify
 export { MCP_INJECTION_DROP_REASONS, MCP_INJECTION_DROP_TEXT, mcpInjectionDroppedNotice } from "./core/mcp-injection-drop.js";
 export { askUnresolvableNotice } from "./core/ask-unresolvable-notice.js";
 export { ASK_UNRESOLVABLE_CAUSES } from "./core/ask-unresolvable-notice.js";
-export { USER_INPUT_UNDRAINED_CAUSES } from "./core/engine-notice.js";
+export { USER_INPUT_UNDRAINED_CAUSES, USER_INPUT_UNDRAINED_FAMILIES } from "./core/engine-notice.js";
 export { STEER_REPLAY_FACETS } from "./core/steer-replay.js";
 export { TOOL_TURN_INCOMPLETE_CAUSES } from "./internal/llm.js";
 export { DURABLE_MANDATE_SOURCES } from "./core/tool-policy.js";
@@ -118,12 +118,13 @@ export { createFsWriteGatePolicy, WRITE_EXEMPT_DIR_COVERS_ROOT_CODE } from "./co
 export { RETIRED_TOOL_NAMES } from "./core/tool-name-aliases.js";
 export { judgeRuleToolName, RULE_TOOL_NAME_VERDICTS } from "./core/tool-name-aliases.js";
 export { DEFAULT_SUBAGENT_TOOL_NAME } from "./agents/subagent.js";
-export { renderTaskNotificationXml, RESUPPLIED_FRAME_PREAMBLE, taskNotificationDedupKey, isDelegatedAgentTerminal, isTerminalTaskNotification, SystemInjectionQueue, NOTIFICATION_INJECTION_OUTCOMES, isNotificationInjectionOutcome, SYSTEM_INJECTION_PRIORITIES, isSystemInjectionPriority, steerPriorityOf, AGENT_MESSAGE_TAG, renderAgentMessageFrame, HANDBACK_STATES, COMPACTION_KINDS, handbackStateOf, terminalFrameFacets, } from "./core/task-notification.js";
+export { renderTaskNotificationXml, RESUPPLIED_FRAME_PREAMBLE, taskNotificationDedupKey, isDelegatedAgentTerminal, isTerminalTaskNotification, SystemInjectionQueue, NOTIFICATION_INJECTION_OUTCOMES, isNotificationInjectionOutcome, SYSTEM_INJECTION_PRIORITIES, isSystemInjectionPriority, steerPriorityOf, injectionLaneOf, AGENT_MESSAGE_TAG, renderAgentMessageFrame, HANDBACK_STATES, COMPACTION_KINDS, handbackStateOf, terminalFrameFacets, } from "./core/task-notification.js";
 export { TOOL_FAMILIES, TOOL_MOUNT_TAGS, TOOL_APPROVAL_CARDS, TOOL_PATH_ACCESSES, TOOL_PATH_BASES, TOOL_PATH_ABSENCES, TOOL_WIRE_NAME_MAX_CHARS, TOOL_CONTRACT_MAX_CHARS, TOOL_CARD_ID_MAX_CHARS, TOOL_KEY_MAX_CHARS, TOOL_KEYS_MAX, RENDER_HINT_MAX_CHARS, RENDER_HINT_ACTIVITY_MAX_CHARS, RENDER_HINT_MAX_LIST, pathTargetSlotOnly, } from "./core/tool-face.js";
 export { describeToolCatalog, catalogEntriesNamed, catalogToolNames, catalogRuleFaceOf, pathTargetOf, pathTargetValue, protectivePathTargetOf, declaredPathTargetOf, BARE_REQUEST_CODE, isProtectedWrite, isDeclaredWrite, fileOpAccessOf, pathConfinableWriteToolNames, pathTargetingToolNames, compactableToolNames, budgetExemptToolNames, handBandEffects, engineCardTypes, predictMountedToolNames, HANDS_BAND_TAGS, MOUNT_TAG_IN_HANDS_BAND, } from "./core/tool-registry.js";
 export { ToolRosterEntry, ToolRoster, ToolRosterDelta, ToolRosterRenderHints, ROSTER_SOURCES, toolIdentityOf, mintCapabilityId, diffToolRoster, judgeParkedToolIdentity, ruleFacesFromRoster, toolCallFaceOf, rosterToolName, ruleNamesOf, inputKeysOf, ruleFaceOfInstance, rosterMemberBoundProblem, ToolRosterDeltaSeat, } from "./core/tool-roster.js";
 export {} from "./core/tool-policy.js";
 export { effectivePathTargetOf, pathTargetBaseOf } from "./core/effective-path-target.js";
+export {} from "./core/path-rule-binding.js";
 export { pathFamilyOf, isAbsoluteForFamily, pathIdentityOf, win32NamespaceScreen, WIN32_NAMESPACE_REFUSALS } from "./tools/fs/safety.js";
 export { judgeShellRead, } from "./tools/fs/shell-read-check.js";
 export { SHELL_READ_FINDINGS, SHELL_READ_SEATS, SHELL_READ_DECISION, SHELL_READ_FINDING_RANK, } from "./tools/fs/shell-read-judge.js";
@@ -158,18 +159,20 @@ export { hasScheduler, isValidCronExpr, SchedulerError } from "./core/scheduler.
 export { createSchedulerTools, SCHEDULE_WAKEUP_TOOL_NAME, AUTONOMOUS_LOOP_SENTINEL, AUTONOMOUS_LOOP_DYNAMIC_SENTINEL, } from "./tools/scheduler-tools.js";
 export { resolveAutonomousLoopPrompt, AUTONOMOUS_LOOP_PREAMBLE, AUTONOMOUS_LOOP_PREAMBLE_PERSISTENT, } from "./tools/loop-tick.js";
 export { tightenTaskSpec, TaskSpecTightenError } from "./core/tighten-task-spec.js";
-export { createAllowDenyPolicy, createApprovalPolicy, COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, findUnverifiableRecursiveDelete, combinePolicies, abortedSeatDeny, receiveHookResult, isEngineRefusal, wrapToolPolicy, decisionText, resolveAsk, toolPolicyNameSets, toolPolicyPathDenyRules, checkToolPolicyProjection, constraintChainEntryOf, constraintChainDigest, screenApproverAttribution, APPROVER_ATTRIBUTION_MAX_CHARS, ASK_EVIDENCE_ABSENCE_VALUES, } from "./core/tool-policy.js";
+export { createAllowDenyPolicy, createApprovalPolicy, COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, findUnverifiableRecursiveDelete, combinePolicies, abortedSeatDeny, receiveHookResult, isEngineRefusal, wrapToolPolicy, decisionText, resolveAsk, toolPolicyNameSets, toolPolicyPathRules, checkToolPolicyProjection, constraintChainEntryOf, constraintChainDigest, screenApproverAttribution, APPROVER_ATTRIBUTION_MAX_CHARS, ASK_EVIDENCE_ABSENCE_VALUES, } from "./core/tool-policy.js";
 export {} from "./core/read-root-grant-screen.js";
 export { ASK_ORIGINS, isAskOrigin, ORIGIN_IMPLIES_REAL_APPROVAL, PERSISTED_RULE_MANDATES, isPersistedRuleMandate, screenAskClassMembers } from "./core/ask-origin.js";
 export { PERMISSION_MODES, isPermissionMode, PERMISSION_MODE_RANK, clampPermissionMode, ASK_CLASSES, isAskClass, MODE_ARBITRATION, RELEASABLE_ASK_CLASSES, MODE_RELEASE_REASONS, isModeReleaseReason, RRA_EXPLAINERS, classifyAsk, foldArbitrationRow, arbitrateByMode, fileCommandOptionsSentence } from "./core/ask-origin.js";
 export { modePolicyOf, PERMISSION_MODE_FOLD_REASONS, ACCEPT_EDITS_FILE_COMMANDS, modeAcceptsFileCommand } from "./core/mode-policy.js";
 export { SKILL_GRANT_ORIGINS } from "./core/skill-grant.js";
-export { ALLOW_ENTRY_INERT_REASONS, compileAllowEntry, compileAllowList } from "./core/allow-entry.js";
+export { ALLOW_ENTRY_INERT_REASONS, compileAllowEntry, compileAllowList, renderListEntry } from "./core/allow-entry.js";
 export { ALLOW_RULE_MEMBERS } from "./core/allow-rule-shadow.js";
 export { mintNamespacePrefix } from "./core/protocol-naming.js";
 export { readDenyClassifierRules, renderClassifierDenyRules } from "./core/auto-mode-prompt.js";
 export { AUTO_MODE_DENY_SOURCES, isAutoModeDenySource } from "./core/runtime-caps.js";
-export { SETTLEMENT_KINDS, isSettlementKind, SETTLEMENT_PARTIES, isSettlementParty, SETTLEMENT_IS_REFUSAL, DENIED_BY_VALUES, isDeniedBy, DENIED_BY_MAY_VETO, CLASSIFIER_DENY_CAUSES, isClassifierDenyCause, DENIED_BY_MAY_CARRY_CAUSE, screenGateOutcome } from "./core/gate-outcome.js";
+export { SETTLEMENT_KINDS, isSettlementKind, SETTLEMENT_PARTIES, isSettlementParty, HOST_DECIDERS, isHostDecider, SETTLEMENT_IS_REFUSAL, DENIED_BY_VALUES, isDeniedBy, DENIED_BY_MAY_VETO, CLASSIFIER_DENY_CAUSES, isClassifierDenyCause, DENIED_BY_MAY_CARRY_CAUSE, screenGateOutcome } from "./core/gate-outcome.js";
+export { ENGINE_BUILTIN_TOOL_NAMES, isEngineBuiltinToolName } from "./core/tool-catalog-entries.js";
+export { policyCannotAnswer } from "./core/real-approval.js";
 export {} from "./core/hooks.js";
 export { SWAPPABLE_DEP_SEATS, SWAP_SEAT_NOTICE, isSwappableDepSeat, screenSwappableDeps } from "./core/swappable-deps.js";
 export { parseAutoModeResponse, createAutoModeDecider, AUTO_MODE_UNAVAILABLE_CAUSES, isAutoModeUnavailableCause, classifierUnavailableDenyMessage, classifierParseFailureDenyMessage, AUTO_MODE_PARSE_FAILURES, isAutoModeParseFailure, AUTO_MODE_CLASSIFIER_FALLBACKS, isAutoModeClassifierFallback, AUTO_MODE_FALLBACK_CAUSES, isAutoModeFallbackCause, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow, } from "./core/auto-mode.js";
@@ -199,6 +202,7 @@ export { formatHookFeedback, runToolGate, createHookEnvCapabilities, createPreTo
 export { HOOK_FAMILIES, HOOKS_INVALID_CODE } from "./core/hook-seats.js";
 export { InMemoryMemoryStore, composeMemoryBlock, composeLayeredMemoryBlock, normalizeMemorySpec, supportsConsolidation, supportsPeriodicConsolidation, firstSentence, expandLexicalTerms, lexicalSearchMatch, classifyPromotable, enforcePromotableWriteGate, guardedMemoryStore, MemoryGateError, MemoryProjectionError, detectSecret, enforceSecretWriteGate, enforceStructuredNoteSecretGate, MEMORY_PROJECT_KEY_ABSENT_REASONS, } from "./core/memory.js";
 export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, buildMemoryInstruction, writableRootOf, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_ORIGIN_CAUSES, committedOriginOf, originEquals, consolidationExposedFrontmatter, ambiguousOriginRepresentation, committedDistilledOf, distilledEquals, CONSOLIDATION_DEFAULTS, ConsolidationRefusedError, MEMORY_SEARCH_SUPERSEDED_TAG, consolidationTypeEligible, deriveSupersededSet, memorySupersededNote, readIntentCredentials, supersessionFuseCeiling, deriveShadowedSet, memoryConsolidationRecommendedNotice, memoryConsolidationCommittedNotice, memoryConsolidationConflictNotice, memoryConsolidationIncompleteNotice, memoryConsolidationRefusedNotice, memoryConsolidationWithheldNotice, DISTILLER_DEFAULT_MAX_INPUTS_PER_PRODUCT, LLM_DISTILLER_CONTRACT, LLM_DISTILLER_CONTRACT_DL2, LLM_DISTILLER_CONTRACT_DL3, LLM_DISTILLER_CONTRACTS, MEMORY_DISTILLER_CONTRACT_V1, contractGroupingDiff, driveConsolidationToFixpoint, isAliasModelId, llmPlanDistiller, mintExposurePartitionedPlan, mintLlmConsolidationPlan, MEMORY_DISTILLER_PURITY_CONTRACT_V1, detectCleanArmVerbatimLeak, openAiCompatChatSeat, parseJsonAnswer, planParseRepairs, sanitizeLlmGroups, scheduleUnderFuse, CONSOLIDATION_DRIVER_PLANS_DIR, CONSOLIDATION_DRIVER_RUNS_FILE, CONSOLIDATION_RUN_STOP_REASONS, archiveDistillerPlan, readConsolidationDriverRun, runMemoryConsolidationDriver, isInstructionEntry, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, MEMORY_CAPTURE_OPTOUT_NOTICE, memoryCaptureOptedOutNotice, memoryCaptureOptOutUnpersistedNotice, SESSION_CAPTURE_OPTOUT_DIR, markSessionCaptureOptOut, readSessionCaptureOptOut, listSessionCaptureOptOut, fileSessionCaptureRecordStore, readV2HeaderHints, LINEAGE_FILE, CHALLENGES_FILE, CHALLENGED_HISTORY_FILE, CHALLENGE_LEDGER_MAX_EVENTS, rebuildStrictControlPlaneLedger, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_INDEX_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, MEMORY_EXPOSURE_BANNER, MEMORY_EXPOSURE_HANDLE_TAG, memoryExposureIndexRow, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, erasureSelectHash, computeMemoryBundleHash, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, migrateScope, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, syncMemoryScope, } from "./core/memory-engine/index.js";
+export { STORE_FORM_REFUSAL_CODES, TARGET_OUTSIDE_STORE, SCOPE_HOME_NOT_DIRECTORY, SCOPE_HOME_FORMS } from "./core/memory-engine/layout.js";
 export { SHARED_MEMORY_READ_CAP_BYTES, SHARED_MEMORY_LIST_PAGE_SIZE, SharedMemoryStoreError, } from "./core/shared-memory/types.js";
 export { sharedMemoryStoreContract, } from "./core/shared-memory/contract.js";
 export { termSet, jaccardDistance, cosineDistance } from "./core/memory-vector.js";