@sema-agent/core 7.44.0 → 7.46.0

package/dist/agents/tool-filter.js

@@ -1,12 +1,136 @@
+import { parsePermissionRule } from "../core/permission-rule-syntax.js";
+import { HAND_TOOLS } from "../core/tool-catalog-entries.js";
+export function readDeniedEntry(entry) {
+    if (typeof entry !== "string")
+        return { kind: "not_a_string", type: valueTypeLabel(entry) };
+    if (entry !== entry.trim())
+        return { kind: "name", name: entry, content: false };
+    const parsed = parsePermissionRule(entry);
+    return { kind: "name", name: parsed.toolName, content: parsed.ruleContent !== undefined };
+}
+export function valueTypeLabel(value) {
+    if (value === null)
+        return "null";
+    switch (typeof value) {
+        case "string":
+            return "a string";
+        case "undefined":
+            return "undefined";
+        case "number":
+            return "a number";
+        case "boolean":
+            return "a boolean";
+        case "bigint":
+            return "a bigint";
+        case "symbol":
+            return "a symbol";
+        case "function":
+            return "a function";
+        default:
+            try {
+                return Array.isArray(value) ? "an array" : "an object";
+            }
+            catch {
+                return "an object";
+            }
+    }
+}
+const isList = (value) => Array.isArray(value);
+const UNREADABLE_LIST = Object.freeze({});
+export function readToolNameList(value) {
+    if (value === UNREADABLE_LIST)
+        return { kind: "unreadable" };
+    let list;
+    try {
+        list = isList(value) ? value : undefined;
+    }
+    catch {
+        return { kind: "not_a_list", type: "an object" };
+    }
+    if (list === undefined)
+        return { kind: "not_a_list", type: valueTypeLabel(value) };
+    try {
+        const entries = [];
+        for (let i = 0; i < list.length; i++)
+            entries.push(list[i]);
+        return { kind: "entries", entries };
+    }
+    catch {
+        return { kind: "unreadable" };
+    }
+}
+export function snapshotToolNameList(value) {
+    const read = readToolNameList(value);
+    return read.kind === "entries" ? read.entries : read.kind === "unreadable" ? UNREADABLE_LIST : value;
+}
+const LIST_NOUN = { allowed: "allowed tools", denied: "denied tools" };
+const LIST_NAME = { allowed: "an allowed-tools list", denied: "a denied-tools list" };
+export function notAStringSentence(where, side, index, type) {
+    return `${where} declares in its ${LIST_NOUN[side]}, as entry ${index + 1}, a value that is ${type}, not a tool name — ${LIST_NAME[side]} holds tool names, each a string. Fix the entry.`;
+}
+export function notAListSentence(where, side, list) {
+    return list.kind === "not_a_list"
+        ? `${where} declares in its ${LIST_NOUN[side]} a value that is ${list.type}, not a list of tool names. Fix the list.`
+        : `${where} declares in its ${LIST_NOUN[side]} a list whose entries cannot be read (an accessor or a proxy trap threw). Fix the list.`;
+}
+export function toolNameListFlaw(where, side, value) {
+    if (value === undefined || value === null)
+        return undefined;
+    const list = readToolNameList(value);
+    if (list.kind !== "entries")
+        return notAListSentence(where, side, list);
+    for (let i = 0; i < list.entries.length; i++) {
+        const entry = list.entries[i];
+        if (typeof entry !== "string")
+            return notAStringSentence(where, side, i, valueTypeLabel(entry));
+    }
+    return undefined;
+}
+export function snapshotDefinitionLists(def) {
+    const copy = { ...def };
+    if (copy.allowTools !== undefined)
+        copy.allowTools = snapshotToolNameList(copy.allowTools);
+    if (copy.denyTools !== undefined)
+        copy.denyTools = snapshotToolNameList(copy.denyTools);
+    return copy;
+}
+export function allowedToolNames(allowTools) {
+    if (allowTools === undefined || allowTools === null)
+        return undefined;
+    const list = readToolNameList(allowTools);
+    if (list.kind !== "entries")
+        return new Set();
+    if (list.entries.includes("*"))
+        return undefined;
+    const names = new Set();
+    for (const entry of list.entries)
+        if (typeof entry === "string")
+            names.add(entry);
+    return names;
+}
+function deniedNames(denyTools) {
+    const names = new Set();
+    const list = readToolNameList(denyTools);
+    if (list.kind !== "entries")
+        return names;
+    for (const entry of list.entries) {
+        const read = readDeniedEntry(entry);
+        if (read.kind === "name")
+            names.add(read.name);
+    }
+    return names;
+}
 export function toolNameAllowed(name, allowTools, denyTools) {
-    const allow = allowTools !== undefined && !allowTools.includes("*") ? new Set(allowTools) : undefined;
-    const deny = denyTools && denyTools.length > 0 ? new Set(denyTools) : undefined;
+    const allow = allowedToolNames(allowTools);
+    const denied = deniedNames(denyTools);
+    const deny = denied.size > 0 ? denied : undefined;
     const n = name;
     return (!allow || allow.has(n)) && (!deny || !deny.has(n));
 }
 export function resolveToolSubset(pool, allowTools, denyTools) {
-    const allow = allowTools !== undefined && !allowTools.includes("*") ? new Set(allowTools) : undefined;
-    const deny = denyTools && denyTools.length > 0 ? new Set(denyTools) : undefined;
+    const allow = allowedToolNames(allowTools);
+    const denied = deniedNames(denyTools);
+    const deny = denied.size > 0 ? denied : undefined;
     if (!allow && !deny)
         return [...pool];
     return pool.filter((t) => {
@@ -14,3 +138,9 @@ export function resolveToolSubset(pool, allowTools, denyTools) {
         return (!allow || matches(allow)) && (!deny || !matches(deny));
     });
 }
+export function resolveAgentToolSubset(pool, allowTools, denyTools) {
+    const kept = new Set(resolveToolSubset([...pool, ...HAND_TOOLS], allowTools, denyTools));
+    const handed = pool.filter((t) => kept.has(t));
+    const mountedUnder = new Set(handed.map((t) => t.name));
+    return { handed, withheldHands: HAND_TOOLS.filter((t) => !kept.has(t) && !mountedUnder.has(t.name)).map((t) => t.name) };
+}

package/dist/core/agent-config-dir.d.ts

@@ -0,0 +1,20 @@
+/** The configuration directory's name below a home: the one segment the deny tables spell the agent's own settings under. */
+export declare const AGENT_CONFIG_DIR_SEGMENT = ".sema";
+/** The code a declared root that names no directory is refused with, wherever it is declared. */
+export declare const AGENT_CONFIG_DIR_INVALID_CODE = "config.agent_config_dir_invalid";
+/** A run (the `/`-separated segments of a deny row, home word already removed) read below the configuration directory:
+ *  `.sema/settings.json` ⇒ `settings.json`, `.sema` ⇒ `""`, and `undefined` for a run that does not open with the
+ *  directory's name. The first segment is compared as the row compares it (ASCII-case-insensitive unless the row opts out).
+ *
+ *  @contract agent_config_dir.one_reading — which rows a declared configuration root relocates is decided HERE and nowhere
+ *  else: a row that opens with the `.sema` segment names its tail below the root, in the read placement, in the always-on
+ *  write-protection table and in the opt-in deny set alike; the root adds a place and never moves the default one, a row that
+ *  does not open with that segment keeps its place, and a face with a list of its own of "the rows that relocate" is a fork
+ *  of this sentence, not a variant of it. */
+export declare function agentConfigDirTail(run: string, caseSensitive?: boolean): string | undefined;
+/** The segments of a declared root in lexical normal form — what a path's leading segments are compared with. */
+export declare function agentConfigDirSegments(dir: string): string[];
+/** The declared configuration root as given (`undefined` = none declared, the default location), or a refusal naming the
+ *  seat and the shape of the value: not a string, empty, not absolute, no such directory, not a directory, not readable.
+ *  The directory is looked at on the host's own file system — the host that declares the root is the host that keeps it. */
+export declare function checkedAgentConfigDir(value: string | undefined, seat: string): string | undefined;

package/dist/core/agent-config-dir.js

@@ -0,0 +1,49 @@
+import { statSync } from "node:fs";
+import { isAbsolutePathForm, normalizeAbsPathLexically } from "../tools/fs/safety.js";
+export const AGENT_CONFIG_DIR_SEGMENT = ".sema";
+export const AGENT_CONFIG_DIR_INVALID_CODE = "config.agent_config_dir_invalid";
+export function agentConfigDirTail(run, caseSensitive = false) {
+    const [first, ...rest] = run.split("/").filter((segment) => segment.length > 0);
+    if (first === undefined)
+        return undefined;
+    const folded = caseSensitive ? first : first.replace(/[A-Z]/g, (c) => c.toLowerCase());
+    return folded === AGENT_CONFIG_DIR_SEGMENT ? rest.join("/") : undefined;
+}
+export function agentConfigDirSegments(dir) {
+    return normalizeAbsPathLexically(dir).split(/[\\/]/).filter((segment) => segment.length > 0);
+}
+function shown(value) {
+    try {
+        return JSON.stringify(value) ?? String(value);
+    }
+    catch {
+        return typeof value;
+    }
+}
+function invalidAgentConfigDir(seat, value, why) {
+    const e = new Error(`${seat} ${shown(value)} ${why} — it must be the absolute path of an existing directory (the host's own configuration root); ` +
+        `a value that names no directory would guard nothing, so it is refused rather than read as the default \`~/${AGENT_CONFIG_DIR_SEGMENT}\` location.`);
+    e.code = AGENT_CONFIG_DIR_INVALID_CODE;
+    return e;
+}
+export function checkedAgentConfigDir(value, seat) {
+    if (value === undefined)
+        return undefined;
+    if (typeof value !== "string")
+        throw invalidAgentConfigDir(seat, value, `is a ${value === null ? "null" : typeof value}, not a string`);
+    if (value.length === 0)
+        throw invalidAgentConfigDir(seat, value, "is an empty string");
+    if (!isAbsolutePathForm(value))
+        throw invalidAgentConfigDir(seat, value, "is not an absolute path");
+    let isDirectory;
+    try {
+        isDirectory = statSync(value).isDirectory();
+    }
+    catch (e) {
+        const code = typeof e === "object" && e !== null && "code" in e && typeof e.code === "string" ? e.code : "unreadable";
+        throw invalidAgentConfigDir(seat, value, code === "ENOENT" || code === "ENOTDIR" ? "names no existing directory" : `could not be examined (${code})`);
+    }
+    if (!isDirectory)
+        throw invalidAgentConfigDir(seat, value, "names a file, not a directory");
+    return value;
+}

package/dist/core/agent-definition.d.ts

@@ -33,7 +33,7 @@ export interface AgentDefinition {
      *  the delegation tool's name cannot re-delegate (CC Explore/Plan `disallowedTools` include Agent,
      *  pretty.js:409189/486948). */
     allowTools?: string[];
-    /** Tool denylist (a deny always wins). See {@link allowTools} for the per-agent delegation-tool note. */
+    /** Tool denylist (a deny always wins), tool NAMES: `Tool(content)` hides the whole `Tool`. See {@link allowTools} for the per-agent delegation-tool note. */
     denyTools?: string[];
     /**
      * F7 (CC 2.1.198 parity, per-agent `skills` — 锚 pretty.js:422126 `e.skills ?? []`, GA/ungated in 198:
@@ -116,7 +116,7 @@ export interface SkillSpec {
      * either list asks once (`Execute skill: <name>`, the card listing what it releases); a skill the person invoked by
      * name ({@link import("./task-spec.js").TaskSpec.userInvokedSkills}) grants without asking. The grant holds for that
      * run (a steer it takes in does not end it) and the next runTask starts without it. An entry this grammar reads as nothing — `*` (it voids an allow list; on a deny list it is inert and the rest of the
-     * list still refuses), `mcp__*`, a write path, a domain — grants nothing and is announced at the start of the run (`permission.allowed_tool_not_granted`).
+     * list still refuses), `mcp__*`, a write path, a domain — grants nothing and is announced at the start of the run (`permission.allowed_tool_not_granted`). A table whose value is not a list (a string, an object…) reads as one such entry; `null` is no table.
      */
     allowedTools?: string[];
     /** The tools refused for the rest of the run this skill is activated in — the frontmatter `disallowed-tools` list,

package/dist/core/allow-entry.d.ts

@@ -1,19 +1,35 @@
 import { type RuleToolNameVerdict } from "./tool-name-aliases.js";
 import { type ToolCallRequest } from "./tool-policy.js";
 import { type AllowRuleMember, type AllowRuleShadow } from "./allow-rule-shadow.js";
-import { type PersistedRule } from "./permission-rule-model.js";
+import { type PathRuleBases, type PersistedRule } from "./permission-rule-model.js";
 import { type AskClass, type AssertAllKeysHandled, type PermissionMode, type PersistedRuleMandate } from "./ask-origin.js";
+import { type ToolNameListReading } from "../agents/tool-filter.js";
 import { type EngineNotice } from "./engine-notice.js";
 /** Why an entry grants (or refuses) nothing — the closed set the start-of-run notice names, for every list. `tool_name`: the
  *  entry's tool name is one the name judgment reads as stale against the run's roster (`verdict` says which); `near_miss`: the
  *  run mounts no tool of that exact name but mounts one that differs only by case (`currentName` is its spelling). */
 export declare const ALLOW_ENTRY_INERT_REASONS: readonly ["wildcard_all", "namespace_wildcard", "path_pattern", "domain", "content_unsupported", "grammar", "tool_name", "near_miss"];
 export type AllowEntryInertReason = (typeof ALLOW_ENTRY_INERT_REASONS)[number];
-/** The facts beside a `tool_name` / `near_miss` reason: the judgment's word, and the spelling to write instead when there is one. */
+/** The facts beside a reason: for `tool_name` / `near_miss` the judgment's word and the spelling to write instead when there is
+ *  one; for a list member that is not a string (`grammar`) the TYPE of the value (`a number`, `null`, `an object`…) — `entry` then
+ *  holds {@link nonStringMemberLabel}, never the value. */
 export interface AllowEntryInertDetail {
     readonly verdict?: Exclude<RuleToolNameVerdict["kind"], "current">;
     readonly currentName?: string;
+    readonly valueType?: string;
 }
+/**
+ * How a list member that is not a string is named wherever a list's entries are named (the inert record's `entry`, the Skill
+ * card's binding): its TYPE, in a spelling no readable entry can have — a readable entry's name holds no whitespace and a
+ * name-only entry holds no parenthesis, and this label holds a space and none. It can equal only another entry that reads as
+ * nothing, so a binding that holds it never stands for an entry that grants or refuses.
+ */
+export declare function nonStringMemberLabel(value: unknown): string;
+/** How a tool-name list's VALUE that is not a list stands as one entry (the same kind of spelling as {@link nonStringMemberLabel}: it
+ *  reads as `grammar`): its TYPE, or that its entries could not be read — never the value. */
+export declare function nonListValueLabel(read: Exclude<ToolNameListReading, {
+    kind: "entries";
+}>): string;
 /** One entry a list reads as nothing. */
 export type AllowEntryInert = {
     readonly entry: string;
@@ -78,12 +94,14 @@ export interface AllowEntryRow {
     readonly entry: string;
     readonly compiled: CompiledAllowEntry;
 }
-/** The call facts a content row is judged against — the persisted lane's own bases. */
+/** The facts a list's content row is judged under: the leg's root and session (which rows apply), the live working
+ *  directory (where a command's `cd` lands), and the ANCHORS of the list's path rows — the leg the list was installed
+ *  on (its root and environment home): a path row of a list never moves with a `cd`. */
 export interface AllowEntryJudgeContext {
     readonly root: string | undefined;
     readonly sessionId: string | undefined;
     readonly liveCwd: () => string | undefined;
-    readonly home: string | undefined;
+    readonly anchors: PathRuleBases;
 }
 /**
  * The ONE list matcher, both directions — the rows that speak for the call, or undefined. ALLOW: the first name row that
@@ -189,6 +207,7 @@ declare const SHADOW_REASON: {
     readonly content_question: "the call is the engine's own question to a person";
     readonly hook: "a PreToolUse hook asks about this call — the deployment's own screening is answered by a person";
     readonly ancestor: "the task that delegated this one owns this question";
+    readonly dangerous_delete: "this removal targets a protected location (the filesystem root, a top-level directory, a home directory, or a workspace directory or one of its ancestors) — it is cleared by confirming this call, never by an allow rule";
     readonly unverifiable_delete: "this removal could not be verified safe — it is cleared by confirming this call, never by an allow rule";
     readonly transcript_write: "this write targets the session transcript — it is cleared by confirming this call, never by an allow rule";
     readonly org_rule: "an organization policy rule requires approval for this call";
@@ -244,6 +263,13 @@ export type AllowEntryInertNote = ({
 } & AllowEntryInert) | ({
     readonly source: AllowEntrySource;
 } & AllowEntryInert);
+/**
+ * THE ONE WRITER of a list entry into a sentence (the start-of-run notice, a skill's refusal and its decisions, a sub-agent
+ * list's refusals and advisories): the entry as a JSON string — quotes, backslashes and the usual escapes — with every
+ * character that prints as nothing, or as a space, written as `\uXXXX` (`\u{…}` beyond the BMP) and a run of spaces kept
+ * space by space, so what a person reads is what the engine read. Capped on what is printed.
+ */
+export declare function renderListEntry(entry: string): string;
 /**
  * One entry that reads as nothing, as a person reads it: the entry as written (quoted, so a surrounding space shows) and why
  * — the reason word, with the spelling to write when the reading has one. The one phrasing the start-of-run notice and a

package/dist/core/allow-entry.js

@@ -6,15 +6,23 @@ import { COARSE_SHELL_TOOLS } from "./tool-policy.js";
 import { ALLOW_RULE_MEMBERS } from "./allow-rule-shadow.js";
 import { COMMAND_RULE_TOOL, READ_RULE_TOOL, findAdmittingRule, laneToolNamesOf, parseRuleText, programRunReachOf, ruleToolGrammarOf } from "./permission-rule-model.js";
 import { pathRuleLaneAnswer } from "./runner/permission-rule-lanes.js";
+import { callTargetReadingOf } from "./effective-path-target.js";
 import { splitShellCompoundSegments } from "../tools/fs/bash-readonly-classifier.js";
 import { mandateDisclosureOf } from "./ask-origin.js";
 import { inlineUntrusted } from "./untrusted-text.js";
+import { valueTypeLabel } from "../agents/tool-filter.js";
 import { deliverEngineNotice } from "./engine-notice.js";
 export const ALLOW_ENTRY_INERT_REASONS = Object.freeze(["wildcard_all", "namespace_wildcard", "path_pattern", "domain", "content_unsupported", "grammar", "tool_name", "near_miss"]);
+export function nonStringMemberLabel(value) {
+    return `<not a string: ${valueTypeLabel(value)}>`;
+}
+export function nonListValueLabel(read) {
+    return read.kind === "not_a_list" ? `<not a list: ${read.type}>` : "<a list whose entries cannot be read>";
+}
 function ruleRowOf(parsed) {
     return { ...parsed, scope: { kind: "global" }, adds: [{ dot: { actor: "list", counter: 1 }, origin: "user", createdAt: "" }] };
 }
-const TOOL_NAME_SPELLING = /^[^\s()]+$/;
+const TOOL_NAME_SPELLING = /^[^\s()\p{Cc}\p{Cf}]+$/u;
 function mountedSpellingOf(name, roster) {
     const folded = name.toLowerCase();
     for (const mounted of roster)
@@ -36,6 +44,8 @@ function toolNameReading(name, roster) {
 function readAllowEntry(raw, behavior, roster) {
     const inert = (reason) => ({ inert: reason });
     const row = (compiled) => ({ compiled });
+    if (typeof raw !== "string")
+        return { inert: "grammar", detail: { valueType: valueTypeLabel(raw) } };
     if (raw !== raw.trim())
         return inert("grammar");
     const parsed = parsePermissionRule(raw);
@@ -94,11 +104,11 @@ export function compileAllowList(entries, behavior, roster) {
     const rows = [];
     const inert = [];
     for (const entry of entries) {
-        const read = voided ? { inert: "wildcard_all" } : readAllowEntry(entry, behavior, roster);
+        const read = typeof entry !== "string" || !voided ? readAllowEntry(entry, behavior, roster) : { inert: "wildcard_all" };
         if ("compiled" in read)
             rows.push({ entry, compiled: read.compiled });
         else
-            inert.push({ entry, reason: read.inert, ...read.detail });
+            inert.push({ entry: typeof entry === "string" ? entry : nonStringMemberLabel(entry), reason: read.inert, ...read.detail });
     }
     return { rows, inert };
 }
@@ -153,6 +163,7 @@ export function autoStripped(compiled, call) {
 export function autoStrippedRule(rule, call) {
     return rule.behavior === "allow" && rule.tool === COMMAND_RULE_TOOL && autoStripped({ kind: "command", rule }, call);
 }
+const NO_LEADS = new Map();
 function nameRowReaches(compiled, req) {
     const covers = compiled.kind === "namespace" ? (n) => namespacedRuleNameCovers(compiled.pattern, n) : compiled.kind === "tool" || compiled.kind === "shell" ? (n) => n === compiled.name : undefined;
     return covers !== undefined && answersTo(req, covers);
@@ -194,7 +205,7 @@ export function judgeAllowEntries(rows, req, behavior, ctx) {
     if (pathRows.length > 0) {
         const table = pathRows.map((r) => r.compiled.rule);
         for (const name of laneToolNamesOf(req).filter((n) => ruleToolGrammarOf(n) === "path")) {
-            const answer = pathRuleLaneAnswer(table, { ...req, toolName: name }, { root: ctx.root, sessionId: ctx.sessionId, liveCwd, home: ctx.home });
+            const answer = pathRuleLaneAnswer(table, { ...req, toolName: name }, { root: ctx.root, sessionId: ctx.sessionId, anchorsOf: () => ctx.anchors, leads: callTargetReadingOf(req)?.leads ?? NO_LEADS });
             const spoke = answer !== undefined && ("unreadable" in answer ? behavior === "deny" : "behavior" in answer && answer.behavior === behavior);
             if (spoke) {
                 const rule = answer !== undefined && "rules" in answer ? answer.rules[0]?.rule : undefined;
@@ -307,6 +318,7 @@ const SHADOW_REASON = {
     content_question: "the call is the engine's own question to a person",
     hook: "a PreToolUse hook asks about this call — the deployment's own screening is answered by a person",
     ancestor: "the task that delegated this one owns this question",
+    dangerous_delete: "this removal targets a protected location (the filesystem root, a top-level directory, a home directory, or a workspace directory or one of its ancestors) — it is cleared by confirming this call, never by an allow rule",
     unverifiable_delete: "this removal could not be verified safe — it is cleared by confirming this call, never by an allow rule",
     transcript_write: "this write targets the session transcript — it is cleared by confirming this call, never by an allow rule",
     org_rule: "an organization policy rule requires approval for this call",
@@ -366,7 +378,22 @@ export function cardDisclosureOf(decision, fallbackMessage) {
 }
 export const ALLOWED_TOOL_NOT_GRANTED_CODE = "permission.allowed_tool_not_granted";
 const NOTICE_ENTRIES_SHOWN = 5;
+const UNSEEN_IN_ENTRY = /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}\p{Zs}]/gu;
+const ENTRY_RENDER_MAX = 122;
+function escapedCodePoint(ch) {
+    const cp = ch.codePointAt(0) ?? 0;
+    const hex = cp.toString(16).padStart(4, "0");
+    return cp > 0xffff ? `\\u{${hex}}` : `\\u${hex}`;
+}
+export function renderListEntry(entry) {
+    const quoted = JSON.stringify(entry)
+        .replace(/ {2,}/g, (run) => "\\u0020".repeat(run.length))
+        .replace(UNSEEN_IN_ENTRY, (ch) => (ch === " " ? ch : escapedCodePoint(ch)));
+    return inlineUntrusted(quoted, ENTRY_RENDER_MAX);
+}
 export function inertEntryPhrase(e) {
+    if (e.valueType !== undefined)
+        return `a value that is ${e.valueType} (grammar: not a string)`;
     const spelling = e.currentName !== undefined ? inlineUntrusted(e.currentName, 120) : undefined;
     const why = (() => {
         if (e.reason === "near_miss")
@@ -386,7 +413,7 @@ export function inertEntryPhrase(e) {
             }
         }
     })();
-    return `${inlineUntrusted(JSON.stringify(e.entry), 122)} (${why})`;
+    return `${renderListEntry(e.entry)} (${why})`;
 }
 export function allowedToolsNotGrantedNotice(inert, sessionId) {
     const where = (e) => (e.source === "skill" ? `skill ${inlineUntrusted(e.skill, 80)} ${e.list}` : e.source === "request" ? "this run's allowedTools" : "the deployment's allowedTools");

package/dist/core/ask-origin.d.ts

@@ -25,6 +25,7 @@
  * the ask). Both stay where they are and are consumed beside the origin, not folded into it.
  */
 import type { PermissionResult } from "./tool-policy.js";
+import type { ContainmentFace } from "../tools/fs/containment-face.js";
 /**
  * The closed set, in AUTHORITY order — the order {@link askOriginOf} resolves a fold in when several
  * facts hold on one call (a hook ask folded over a policy ask, an org stamp over either). The order
@@ -448,8 +449,12 @@ export type ToolMarkSource = "deployment" | "mcp_annotation" | "a2a_default";
  * `classifier_no_ruling` is a classifier station's question to a person because the auto-mode classification did not rule
  * (`classifierNoRuling` — it could not run, or replied with no verdict): the denial-limit fallback's row (only a person
  * answers it; the classifier is never asked again).
+ * `dangerous_delete` is a removal whose target is a protected location (`dangerousRemovalOf`: the filesystem root, a
+ * top-level directory, a home directory, or a workspace directory — the task root, the working directory, an additional
+ * working directory — or an ancestor of one): the reference implementation's dangerous-removal breaker, which no mode,
+ * allow rule or classifier answers. `unverifiable_delete` is its sibling for a target the command text cannot resolve.
  */
-export declare const ASK_CLASSES: readonly ["content_question", "hook", "ancestor", "unverifiable_delete", "transcript_write", "org_rule", "governance_unavailable", "rule_unreadable", "ask_rule", "denial_limit_fallback", "classifier_no_ruling", "requires_user_interaction", "operator_forced", "shell_floor", "write_protection_unresolved", "probe", "write_protection", "tool_marks_mcp", "tool_marks_a2a", "policy_rra", "artifact_shared_read", "mode", "unstated", "ordinary"];
+export declare const ASK_CLASSES: readonly ["content_question", "hook", "ancestor", "dangerous_delete", "unverifiable_delete", "transcript_write", "org_rule", "governance_unavailable", "rule_unreadable", "ask_rule", "denial_limit_fallback", "classifier_no_ruling", "requires_user_interaction", "operator_forced", "shell_floor", "write_protection_unresolved", "probe", "write_protection", "tool_marks_mcp", "tool_marks_a2a", "policy_rra", "artifact_shared_read", "mode", "unstated", "ordinary"];
 export type AskClass = (typeof ASK_CLASSES)[number];
 /** Membership test for {@link AskClass} — the word crosses the wire on `tool_end.gate.disposition`. */
 export declare function isAskClass(v: unknown): v is AskClass;
@@ -457,7 +462,8 @@ export declare function isAskClass(v: unknown): v is AskClass;
 export interface ModeArbitrationRow {
     /** The ask still reaches a person under `bypassPermissions` (the reference implementation's `bypassImmune`). */
     readonly bypassImmune: boolean;
-    /** The auto-mode classifier may answer it. */
+    /** The auto-mode classifier may answer it — as the class stands on its own: the folded row of an ask
+     *  ({@link foldArbitrationRow}) also takes the read face the ask was raised under. */
     readonly classifierEligible: boolean;
     /** The sandbox-admission leg may admit it (containment holds the effect). */
     readonly sandboxAdmission: boolean;
@@ -473,6 +479,8 @@ export interface ModeArbitrationRow {
  * sandbox columns are the fold of the two former per-word lane tables (only `probe` moved: the classifier may
  * now answer it — the read boundary's unestablishable spelling is fed to it as a deny-table row instead), and
  * `ruleMayClear` restates {@link ruleClearanceOf}'s conclusion per class (a real-approval bit is never rule-clearable).
+ * `probe`'s `classifierEligible` is the OPEN read face's reading: a narrowed (`roots`) face withholds the classifier from the class,
+ * folded where the ask's row is ({@link foldArbitrationRow}).
  * `mode` is the permission mode's OWN question (`plan`'s two sentences, `decisionReason: "mode"`): the reference
  * implementation puts it to a person past every allow rule and never to an automatic lane, and its bypass conversion
  * releases it like any other non-immune ask. `unstated` is the reference implementation's passthrough conversion: an allow
@@ -503,6 +511,13 @@ export declare const MODE_ARBITRATION: {
         readonly ruleMayClear: false;
         readonly hookAskFloor: false;
     };
+    readonly dangerous_delete: {
+        readonly bypassImmune: true;
+        readonly classifierEligible: false;
+        readonly sandboxAdmission: false;
+        readonly ruleMayClear: false;
+        readonly hookAskFloor: true;
+    };
     readonly unverifiable_delete: {
         readonly bypassImmune: true;
         readonly classifierEligible: true;
@@ -683,6 +698,8 @@ export interface AskClassFacts extends AskOriginFacts {
     readonly toolMarkSources?: ReadonlySet<ToolMarkSource>;
     readonly a2aIsolatePeers?: boolean;
     readonly ancestorClasses?: ReadonlySet<AskClass>;
+    /** The read face the leg this ask was raised on resolved ({@link ContainmentFace}); absent ⇒ none resolved (a leg with no hands). */
+    readonly readFace?: ContainmentFace;
 }
 /** The classification the arbitration reads: the whole set, the disclosed word (the set's first member in
  *  {@link ASK_CLASSES} order) and the row folded across the set. */
@@ -718,8 +735,10 @@ export declare function decisionAskClassesOf(d: Extract<PermissionResult, {
 }>): Set<AskClass>;
 /** Fold a class set onto one row: `bypassImmune` and `hookAskFloor` by OR (any immune member keeps the ask; any floored
  *  member floors a hook's ask), the three permissive switches by AND (one refusing member withholds the lane). An empty
- *  set is `ordinary`. */
-export declare function foldArbitrationRow(classes: ReadonlySet<AskClass>): ModeArbitrationRow;
+ *  set is `ordinary`. `readFace` is the face the ask was raised under: `roots` takes the classifier's lane from a set that
+ *  holds a class the narrowed face withholds from it — the one place the face enters, so every reader of `classifierEligible`
+ *  reads it already folded. */
+export declare function foldArbitrationRow(classes: ReadonlySet<AskClass>, readFace?: ContainmentFace): ModeArbitrationRow;
 /**
  * The ONE class derivation: the decision half ({@link decisionAskClassesOf}) joined with the gate's own facts —
  * the question tool, an ancestor's mark, the org layer's two arms, the persisted lane's unreadable call, the tool

package/dist/core/ask-origin.js

@@ -117,7 +117,7 @@ const MANDATE_DISCLOSURE = {
     write_protection_unresolved: "the write-protection judge could not resolve this write's target, so whether it lands on the protected table is unknown — it is cleared by confirming this call: no standing rule and no automatic decider answers for it, though a wired approver seat can",
 };
 export function mandateDisclosureOf(mandate) {
-    return mandate === undefined ? "an explicit ask rule matched this call (a person's ask-me-each-time outranks a standing allow rule)" : MANDATE_DISCLOSURE[mandate];
+    return mandate === undefined ? "an explicit ask rule matched this call (a person's or the deployment's ask-me-each-time outranks a standing allow rule)" : MANDATE_DISCLOSURE[mandate];
 }
 export function persistedRuleMandateOf(marks) {
     const word = irreversibilityMandateOf(marks);
@@ -170,6 +170,7 @@ export const ASK_CLASSES = Object.freeze([
     "content_question",
     "hook",
     "ancestor",
+    "dangerous_delete",
     "unverifiable_delete",
     "transcript_write",
     "org_rule",
@@ -200,6 +201,7 @@ export const MODE_ARBITRATION = {
     content_question: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: true },
     hook: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false },
     ancestor: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false },
+    dangerous_delete: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: true },
     unverifiable_delete: { bypassImmune: true, classifierEligible: true, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: true },
     transcript_write: { bypassImmune: false, classifierEligible: true, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: true },
     org_rule: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false },
@@ -222,7 +224,8 @@ export const MODE_ARBITRATION = {
     unstated: { bypassImmune: false, classifierEligible: true, sandboxAdmission: false, ruleMayClear: true, hookAskFloor: false },
     ordinary: { bypassImmune: false, classifierEligible: true, sandboxAdmission: true, ruleMayClear: true, hookAskFloor: false },
 };
-export const RRA_EXPLAINERS = new Set(["unverifiable_delete", "transcript_write", "org_rule", "governance_unavailable", "rule_unreadable", "denial_limit_fallback", "classifier_no_ruling", "ancestor", "artifact_shared_read", "requires_user_interaction"]);
+const CLASSIFIER_WITHHELD_ON_ROOTS = new Set(["probe"]);
+export const RRA_EXPLAINERS = new Set(["dangerous_delete", "unverifiable_delete", "transcript_write", "org_rule", "governance_unavailable", "rule_unreadable", "denial_limit_fallback", "classifier_no_ruling", "ancestor", "artifact_shared_read", "requires_user_interaction"]);
 export const RELEASABLE_ASK_CLASSES = ASK_CLASSES.filter((c) => !MODE_ARBITRATION[c].bypassImmune);
 export const MODE_RELEASE_REASONS = Object.freeze(["rule_unreadable"]);
 const MODE_RELEASE_REASON_SET = new Set(MODE_RELEASE_REASONS);
@@ -243,6 +246,8 @@ export function screenAskClassMembers(askClass, classes) {
 }
 export function decisionAskClassesOf(d) {
     const out = new Set();
+    if (d.guard === "dangerous_delete")
+        out.add("dangerous_delete");
     if (d.guard === "unverifiable_delete")
         out.add("unverifiable_delete");
     if (d.guard === "transcript_write")
@@ -273,10 +278,11 @@ export function decisionAskClassesOf(d) {
         out.add(c);
     return out;
 }
-export function foldArbitrationRow(classes) {
+export function foldArbitrationRow(classes, readFace) {
     if (classes.size === 0)
         return MODE_ARBITRATION.ordinary;
-    let bypassImmune = false, classifierEligible = true, sandboxAdmission = true, ruleMayClear = true, hookAskFloor = false;
+    const withheld = readFace === "roots" && [...classes].some((c) => CLASSIFIER_WITHHELD_ON_ROOTS.has(c));
+    let bypassImmune = false, classifierEligible = !withheld, sandboxAdmission = true, ruleMayClear = true, hookAskFloor = false;
     for (const c of classes) {
         const row = MODE_ARBITRATION[c];
         bypassImmune ||= row.bypassImmune;
@@ -334,7 +340,7 @@ export function classifyAsk(d, facts) {
     if (classes.size === 0)
         classes.add("ordinary");
     const askClass = ASK_CLASSES.find((c) => classes.has(c));
-    return { classes, askClass, row: foldArbitrationRow(classes) };
+    return { classes, askClass, row: foldArbitrationRow(classes, facts.readFace) };
 }
 export function headlessDenialMessage(toolName, askMessage) {
     return `Permission for this tool use was denied: it requires interactive approval, and permission prompts are not available in this session (nobody can be asked to approve "${toolName}" in this run — headless auto-deny). The action was NOT performed. Do not claim it succeeded, and do not retry it in this session — report the limitation to the user, or suggest an alternative. What was requested: ${askMessage}`;