@sema-agent/core 7.44.0 → 7.46.0

package/dist/core/permission-rule-model.js

@@ -6,6 +6,7 @@ import { inlineUntrusted } from "./untrusted-text.js";
 import { pathTargetOf, protectivePathTargetOf } from "./tool-registry.js";
 import { heldValues } from "./tool-name-readings.js";
 import { carriesDotSegment, isAbsoluteForFamily, isIdentityDir, isPathIdentity, isShellRootedSpellingUnmapped, isUncIdentity, pathFamilyOf, pathIdentityOf } from "../tools/fs/safety.js";
+import { bindPathRules, pathRowsReach, rowsWhereTheyLead } from "./path-rule-binding.js";
 import { readShellCommand } from "./shell-lexer.js";
 import { readOnlyLineObjection, readOnlyShellVerdict } from "./read-only-shell.js";
 export const RULE_BEHAVIORS = Object.freeze(["deny", "ask", "allow"]);
@@ -68,7 +69,7 @@ export const BARE_INTERPRETER_NAMES = new Set([
     "bash", "sh", "zsh", "ksh", "csh", "tcsh", "dash", "fish", "cmd", "powershell", "pwsh", "busybox",
     "source", ".", "trap", "eval", "exec", "command", "builtin",
     "enable", "compgen", "complete", "bind", "mapfile", "readarray",
-    "env", "noglob", "xargs",
+    "env", "noglob", "nocorrect", "xargs",
     "sudo", "doas", "pkexec", "su", "runuser", "ssh", "chroot", "setpriv",
     "nohup", "nice", "ionice", "chrt", "taskset", "stdbuf", "timeout", "time", "watch",
     "setsid", "flock", "unshare", "nsenter", "script", "numactl", "prlimit", "systemd-run", "parallel",
@@ -440,8 +441,8 @@ function baseValueOf(base, bases) {
         }
     }
 }
-function resolvePathPattern(pattern, bases, behavior) {
-    const family = pathFamilyOf(bases);
+function resolvePathPattern(pattern, bases, behavior, treeFamily = pathFamilyOf(bases)) {
+    const family = treeFamily;
     const tree = bases.root ?? bases.cwd;
     if (pattern.startsWith("//")) {
         const abs = pathIdentityOf("/" + pattern.slice(2), family, tree);
@@ -503,15 +504,15 @@ function globSegmentsReach(globs, target) {
     };
     return walk(0, 0);
 }
-export function pathRuleReachOf(rule, target, bases) {
+export function pathRuleReachOf(rule, target, bases, treeFamily = pathFamilyOf(bases)) {
     if (rule.match === "subpath")
-        return directoryRuleAdmits(rule, target, bases) ? REACHED : NOT_REACHED;
+        return directoryRuleAdmits(rule, target, bases, treeFamily) ? REACHED : NOT_REACHED;
     if (rule.match !== "path")
         return NOT_REACHED;
-    const family = pathFamilyOf(bases);
+    const family = treeFamily;
     if (!isPathIdentity(target, family))
         return NOT_REACHED;
-    const r = resolvePathPattern(rule.command, bases, rule.behavior);
+    const r = resolvePathPattern(rule.command, bases, rule.behavior, family);
     if ("missingBase" in r) {
         return { reach: "unreadable", reason: `the rule is relative to ${PATH_RULE_BASE_LABEL[r.missingBase]} and this call supplies no absolute \`${r.missingBase}\` base of this tree's family to resolve it against` };
     }
@@ -706,10 +707,10 @@ function isLexicalNormalAbsoluteDir(path) {
     const segments = path.split("/").slice(1);
     return segments.length > 0 && segments.every((s) => s !== "" && s !== "." && s !== "..");
 }
-export function directoryRuleAdmits(rule, path, bases) {
+export function directoryRuleAdmits(rule, path, bases, treeFamily = pathFamilyOf(bases)) {
     if (rule.match !== "subpath")
         return false;
-    const family = pathFamilyOf(bases);
+    const family = treeFamily;
     if (carriesDotSegment(rule.command, family))
         return false;
     const dir = pathIdentityOf(rule.command, family, bases.root ?? bases.cwd);
@@ -820,21 +821,29 @@ function resolveCdSegmentDirectories(segments, cwd) {
         return dir === undefined || isShellRootedSpellingUnmapped(pathFamilyOf(bases), dir) ? undefined : directoryIdentityOf(dir, bases);
     });
 }
-export function scopeCoversCwd(scope, cwd, sessionId) {
+export function scopeCoversCwd(scope, cwd, sessionId, identity) {
     if (scope.kind === "global")
         return true;
     if (scope.kind === "session")
         return sessionId !== undefined && sessionId === scope.sessionId;
-    return cwd !== undefined && pathWithinRoot(cwd, scope.root);
+    if (cwd === undefined)
+        return false;
+    if (pathWithinRoot(cwd, scope.root))
+        return true;
+    return identity !== undefined && pathWithinRoot(identity.canonicalRoot, identity.canonicalOf(scope.root) ?? scope.root);
 }
 export function isRuleLive(rule) {
     return rule.adds.length > 0;
 }
 export function eligibleContext(rule, call) {
-    return rule.tool === call.tool && scopeCoversCwd(rule.scope, call.cwd, call.sessionId);
+    return rule.tool === call.tool && scopeCoversCwd(rule.scope, call.cwd, call.sessionId, call.scopeIdentity);
 }
 export function eligiblePersisted(rule, call, behavior) {
-    return rule.behavior === behavior && isRuleLive(rule) && eligibleContext(rule, call);
+    return rule.behavior === behavior && isRuleLive(rule) && eligibleContext(rule, behavior === "allow" ? spelledScope(call) : call);
+}
+export function spelledScope(call) {
+    const { scopeIdentity: _identity, ...spelled } = call;
+    return spelled;
 }
 function firstEligibleAdmittingRule(rules, commandText, call) {
     for (const rule of rules) {
@@ -911,41 +920,28 @@ export function adjudicatePersistedRules(rules, call) {
     }
     return undefined;
 }
-export function adjudicatePersistedPathRules(rules, call, targets, bases) {
+export function adjudicatePersistedPathRules(rules, call, views, anchorsOf, leads) {
     const speaks = (rule, behavior) => eligiblePersisted(rule, call, behavior) ||
         (behavior === "ask" && call.face !== undefined && PATH_RULE_FACES[rule.tool]?.ask?.includes(call.face) === true && eligiblePersisted(rule, { ...call, tool: rule.tool }, behavior));
+    const bind = (rows) => bindPathRules(rows.map((rule) => ({ parsed: rule, ruleText: rule.rule, rule })), (s) => anchorsOf(s.rule));
     for (const behavior of RULE_BEHAVIORS_BY_PRECEDENCE) {
         if (behavior === "allow") {
-            if (targets.allow?.kind !== "path" || call.tool !== READ_RULE_TOOL)
+            if (views.allow === undefined || call.tool !== READ_RULE_TOOL)
                 continue;
-            for (const rule of rules) {
-                if (!eligiblePersisted(rule, call, behavior))
-                    continue;
-                if (directoryRuleAdmits(rule, targets.allow.identity, bases))
-                    return { behavior, rules: [rule] };
-            }
+            const hit = pathRowsReach(bind(rules.filter((rule) => rule.match === "subpath" && eligiblePersisted(rule, call, behavior))), views.allow, "allow");
+            if (hit !== undefined)
+                return { behavior, rules: [hit.row.spec.rule] };
             continue;
         }
-        const tighten = targets.tighten;
-        if (tighten === undefined || tighten.kind === "refused")
+        if (views.tighten === undefined)
             continue;
-        let unreadable;
-        for (const rule of rules) {
-            if (!speaks(rule, behavior))
-                continue;
-            if (tighten.kind === "unreadable") {
-                if (rule.match === "path" || rule.match === "subpath")
-                    unreadable ??= { behavior: "ask", rules: [rule], unreadable: tighten.reason };
-                continue;
-            }
-            const outcome = pathRuleReachOf(rule, tighten.identity, bases);
-            if (outcome.reach === "reached")
-                return { behavior, rules: [rule] };
-            if (outcome.reach === "unreadable")
-                unreadable ??= { behavior: "ask", rules: [rule], unreadable: outcome.reason };
-        }
-        if (unreadable !== undefined)
-            return unreadable;
+        const rows = rules.filter((rule) => (rule.match === "path" || rule.match === "subpath") && speaks(rule, behavior));
+        if (rows.length === 0)
+            continue;
+        const hit = pathRowsReach(rowsWhereTheyLead(bind(rows), leads), views.tighten, "tighten");
+        if (hit === undefined)
+            continue;
+        return hit.unreadable !== undefined ? { behavior: "ask", rules: [hit.row.spec.rule], unreadable: hit.unreadable } : { behavior, rules: [hit.row.spec.rule] };
     }
     return undefined;
 }
@@ -987,9 +983,9 @@ export function segmentCoverageOf(command, rules, call) {
                 (dir !== undefined && firstEligibleDirectoryRule(rules.persisted, dir, call) !== undefined) ||
                 proposed.some((p) => p.rule.tool === "Read"
                     ? dir !== undefined &&
-                        eligibleContext({ tool: p.rule.tool, scope: p.scope }, { tool: "Read", cwd: call.cwd, sessionId: call.sessionId }) &&
+                        eligibleContext({ tool: p.rule.tool, scope: p.scope }, { ...spelledScope(call), tool: "Read" }) &&
                         directoryRuleAdmits(p.rule, dir, basesOfCwd(call.execCwd ?? call.cwd))
-                    : eligibleContext({ tool: p.rule.tool, scope: p.scope }, call) && ruleAdmitsCommand(p.rule, segment)),
+                    : eligibleContext({ tool: p.rule.tool, scope: p.scope }, spelledScope(call)) && ruleAdmitsCommand(p.rule, segment)),
         };
     });
 }

package/dist/core/permission-rule-provider.d.ts

@@ -86,6 +86,13 @@ export interface EffectivePermissionRules {
      *  served that are not canonical session rows of this session). The org partition's lines ride
      *  `org.disclosures`. */
     disclosures: string[];
+    /** The durable rows left out because their project scope root is not a complete absolute path (a foreign writer's or a
+     *  hand edit's row): each row's text and its scope root as served (a non-string root as its type). Absent when none. The
+     *  reader tells the person (`permission.rule_row_dropped`). */
+    droppedRows?: ReadonlyArray<{
+        readonly rule: string;
+        readonly scopeRoot: string;
+    }>;
 }
 /**
  * The host-visible store, already anchored to one owner. One read verb, which never throws: each

package/dist/core/permission-rule-provider.js

@@ -1,5 +1,5 @@
 import { escapeForDisclosure } from "./permission-rule-model.js";
-import { PERMISSION_RULE_WRITER, errText, normalizePersistedRule, sameRuleIdentity, writerOf, } from "./permission-rule-store.js";
+import { PERMISSION_RULE_WRITER, errText, isValidDurableScope, normalizePersistedRule, sameRuleIdentity, writerOf, } from "./permission-rule-store.js";
 import { UNGOVERNED_ORG_RESOLUTION, compileOrgShadowPredicate, createOrgRulePartition } from "./permission-rule-org.js";
 export function ruleSourceOf(scope) {
     return scope.kind === "global" ? "user" : scope.kind;
@@ -80,7 +80,11 @@ class UnifiedPermissionRuleStore {
         const sessionRead = "unreadable" in sessionRows ? [] : sessionRows;
         const shadowed = compileOrgShadowPredicate(orgResolution.rules);
         const rules = [];
-        for (const r of [...sessionRead, ...durableRead.rules]) {
+        const illegal = durableRead.rules.filter((r) => !isValidDurableScope(r.scope));
+        const droppedRows = illegal.map((r) => ({ rule: String(r.rule), scopeRoot: scopeRootAsServed(r.scope.root) }));
+        if (illegal.length > 0)
+            disclosures.push(`the persisted rule partition served ${illegal.length} row(s) whose project scope root is not a complete absolute path — dropped, not adjudicated: ${illegal.slice(0, 3).map((r) => `${escapeForDisclosure(r.rule)} (${escapeForDisclosure(r.scope.root)})`).join(", ")}`);
+        for (const r of [...sessionRead, ...durableRead.rules.filter((x) => !illegal.includes(x))]) {
             rules.push({ ...r, source: ruleSourceOf(r.scope), status: r.behavior === "allow" && shadowed(r) ? "shadowed-by-org" : "live" });
         }
         const removed = [];
@@ -93,7 +97,7 @@ class UnifiedPermissionRuleStore {
                 continue;
             removed.push({ behavior: t.behavior, rule: t.rule, scope: t.scope, source: ruleSourceOf(t.scope), status: "removed" });
         }
-        return { rules, removed, org: orgResolution, rev: durableRead.rev, disclosures, ...failed };
+        return { rules, removed, org: orgResolution, rev: durableRead.rev, disclosures, ...failed, ...(droppedRows.length > 0 ? { droppedRows } : {}) };
     }
     async readSessionRows(sessionId, disclosures) {
         if (this.session === undefined || sessionId === undefined)
@@ -116,6 +120,9 @@ class UnifiedPermissionRuleStore {
         }
     }
 }
+function scopeRootAsServed(root) {
+    return typeof root === "string" ? root : `(${root === null ? "null" : typeof root})`;
+}
 function routingWriter(durable, session) {
     return {
         nextDot: () => durable.nextDot(),

package/dist/core/permission-rule-store.d.ts

@@ -457,6 +457,14 @@ export declare function isValidConsentScope(scope: RuleScope): boolean;
  * duty (design/382 §10): every such entrance, present or future, carries this face.
  */
 export declare function isValidDurableScope(scope: RuleScope): boolean;
+/**
+ * A PROJECT scope's root is a complete absolute path — `/…`, a drive-rooted `X:\…` / `X:/…`, a UNC `\host\…` — the one
+ * predicate every scope face reads (the consent face, the durable face, the sync wire's pick). It is what a project row's
+ * path patterns anchor at (its `/x` and relative words), so a root that is not one (`C:`, a relative spelling, empty)
+ * would let the row apply (containment is a prefix test) while its anchor reads nothing: such a row is refused at every
+ * write, dropped at every read, and disclosed.
+ */
+export declare function isProjectScopeRoot(root: unknown): root is string;
 /** Is `dot` at or below the frontier? Absent actor ⇒ not below (a frontier never covers what it never saw). */
 export declare function dotAtOrBelowFrontier(dot: RuleDot, frontier: RuleSyncFrontier): boolean;
 /**

package/dist/core/permission-rule-store.js

@@ -2,6 +2,7 @@ import { randomBytes } from "node:crypto";
 import { canonicalize } from "./canonical-json.js";
 import { escapeForDisclosure, isRuleBehavior, isRuleLive, parseRuleText } from "./permission-rule-model.js";
 import { thrownText } from "./thrown-value.js";
+import { isAbsolutePathForm } from "../tools/fs/safety.js";
 export function sameRuleOwner(a, b) {
     return a.kind === "principal" ? b.kind === "principal" && a.principal === b.principal : b.kind === "local-owner";
 }
@@ -143,12 +144,15 @@ export function assertWriteDeltaScopeDurable(delta) {
 export function isValidConsentScope(scope) {
     const sc = scope;
     return (sc?.kind === "global" ||
-        (sc?.kind === "project" && typeof sc.root === "string" && sc.root !== "") ||
+        (sc?.kind === "project" && isProjectScopeRoot(sc.root)) ||
         (sc?.kind === "session" && typeof sc.sessionId === "string" && sc.sessionId !== ""));
 }
 export function isValidDurableScope(scope) {
     const sc = scope;
-    return sc?.kind === "global" || (sc?.kind === "project" && typeof sc.root === "string" && sc.root !== "");
+    return sc?.kind === "global" || (sc?.kind === "project" && isProjectScopeRoot(sc.root));
+}
+export function isProjectScopeRoot(root) {
+    return typeof root === "string" && isAbsolutePathForm(root);
 }
 function isValidDot(dot) {
     const d = dot;

package/dist/core/permission-rule-sync.js

@@ -1,5 +1,5 @@
 import { escapeForDisclosure, isRuleBehavior, parseRuleText } from "./permission-rule-model.js";
-import { applyTombstones, errText, joinFrontiers, joinRuleStates, normalizePersistedRule, readRuleWriteOutcome, ruleSyncVector, sameRuleIdentity, screenRuleSyncState, writerOf, } from "./permission-rule-store.js";
+import { applyTombstones, errText, isProjectScopeRoot, joinFrontiers, joinRuleStates, normalizePersistedRule, readRuleWriteOutcome, ruleSyncVector, sameRuleIdentity, screenRuleSyncState, writerOf, } from "./permission-rule-store.js";
 import { emitTrace } from "./trace.js";
 export const PERMISSION_RULE_SYNC_PATH = "/v1/permission-rules/sync";
 export const LOCAL_OWNER_UNSYNCABLE_CODE = "permission_rules.local_owner_unsyncable";
@@ -262,7 +262,7 @@ function pickScopeCaptured(v) {
         return { kind, scope: { kind: "global" } };
     if (kind === "project") {
         const root = s?.root;
-        return { kind, scope: typeof root === "string" && root !== "" ? { kind: "project", root } : undefined };
+        return { kind, scope: isProjectScopeRoot(root) ? { kind: "project", root } : undefined };
     }
     if (kind === "session") {
         const sessionId = s?.sessionId;

package/dist/core/permission-rules.d.ts

@@ -30,11 +30,13 @@
  * `Edit(~/.sema/settings.json)` / `Write(src/**)` / `Read(//etc/**)` deny or ask compiles through the same
  * validator (the model's path grammar — the `//abs-dir/**` directory form and upstream's pattern form:
  * `//` absolute, `~/` home, `/` project root, otherwise working-directory relative; `*` within a segment,
- * `**` across) and is judged with `pathRuleReaches` on the call's PROTECTIVE path target (design/388: the
- * object face's declaration, the catalog's for the name as the floor). The bases a pattern resolves
- * against are the deployment's (`pathBases`); a pattern whose base the policy was not given is refused at
- * compile time (`unsupported.path_base`) rather than left to reach nothing at run time — a deny that
- * silently matches nothing is the failure form this module's header calls the most dangerous one.
+ * `**` across) and is judged on the call's PROTECTIVE path target (design/388: the object face's declaration, the
+ * catalog's for the name as the floor), every view of it (`callTargetViewsOf`), by the one judgment every path rule
+ * meets (`pathRowsReach`). A pattern's ANCHORS are the rule's own fact, taken once where the policy is installed: the
+ * declared `pathBases` word by word, else the leg the Runner installs the policy on (`policyAnchors`) — never the
+ * call's live working directory. A declared base that is not a usable absolute path is refused at compile time
+ * (`unsupported.path_base`); a policy called outside a Runner leg with no declared base reads such a rule
+ * `unreadable` (the fail-closed ask).
  * A `Read(...)` / `Edit(...)` deny or ask reaches the calls on its behavior's FACES (`PATH_RULE_FACES`), not only
  * its own tool: a `Read` ask asks for a Grep / Glob rooted in its path, judged on that call's own target.
  *
@@ -53,8 +55,7 @@
  */
 import type { NamedToolPolicy } from "./tool-policy.js";
 import { parsePermissionRule, type ParsedPermissionRule } from "./permission-rule-syntax.js";
-import { type ParsedRule, type PathRuleBases } from "./permission-rule-model.js";
-import type { DenyFace, PathRuleDenyRow } from "../tools/fs/read-deny.js";
+import { type PathRuleBases } from "./permission-rule-model.js";
 export { parsePermissionRule, type ParsedPermissionRule };
 /** [K-PLATFORM-SWEEP] MINOR#11: Bash's REAL non-primary arg names, accepted as generic param rules
  *  (`Bash(timeout:...)`). Exported SOLELY so a lockstep test can assert it against the live Bash tool
@@ -93,9 +94,10 @@ export interface PermissionRuleIssue {
      *  is an object/array (a rule on it can never match); the tool is unknown to the resolver a leg
      *  supplied (absent resolver ⇒ the catalog alone judges and an unknown tool stays permissive). */
      | "unsupported.param_unknown" | "unsupported.param_non_scalar" | "unsupported.tool_unknown"
-    /** A path-form deny/ask whose spelling needs a base this policy was not given (`/x` needs
-     *  `pathBases.root`; a relative pattern needs `pathBases.cwd` or `root`) — refused rather than compiled
-     *  into a rule that reaches nothing. */
+    /** A path-form deny/ask whose spelling needs a base this policy DECLARES as something other than an absolute path
+     *  of its tree's family (`/x` reads `pathBases.root`; a relative pattern `pathBases.cwd`, else `root`; `~/` `home`)
+     *  — a bad declared value, refused rather than compiled into a rule that reaches nothing. An undeclared base is no
+     *  refusal: the rule is anchored where the policy is installed. */
      | "unsupported.path_base" | "unsupported.mcp_paren"
     /** A parenthesised rule whose NAME is a covering spelling in a non-MCP protocol namespace
      *  (`a2a__<peer>__*(x:y)`, `a2a__<peer>(x:y)`). The param DSL is keyed by EXACT tool name, and a
@@ -143,12 +145,17 @@ export interface PermissionRulePolicyOptions {
      */
     ruleFaces?: (toolName: string) => RuleFaceView | undefined;
     /**
-     * The bases a path-form deny/ask pattern resolves against at match time ({@link PathRuleBases}): `root`
-     * for `/…` (the task's project root), `cwd` for a relative pattern (the root stands in when absent — the
-     * word's own meaning), `home` for `~/…` (the EXECUTION ENVIRONMENT's home — never the engine process's
-     * own; #644). Facts of the DEPLOYMENT and the task, never of the rule — a pattern is stored as spelled.
-     * A rule whose base is absent (or not an absolute path) here is refused at compile time
+     * The ANCHORS of this rule set's path patterns ({@link PathRuleBases}), word by word: `root` for `/…`, `cwd` for a
+     * relative pattern (the declared root stands in when absent — the word's own meaning), `home` for `~/…` (an
+     * execution environment's home — never the engine process's own; #644). A word declared here anchors the rules
+     * wherever the policy runs; a word left out is anchored where the Runner installs the policy — the root and the
+     * environment's home of the leg it enters the delegation chain on — and stays there for every child and every `cd`.
+     * A declared value that is not an absolute path of its tree's family is refused at compile time
      * (`unsupported.path_base`, naming the base — {@link ruleBasesNeeded} is the same classification).
+     * These are the RULES' anchors, never the call's: a call's target is read from the call (its target reading, else its
+     * own `root` / `cwd`); only a host calling the policy directly with a request that carries neither has its target
+     * resolved against `root` / `cwd` here. A target nothing locates is unreadable: every path rule able to reach the
+     * call answers it with the fail-closed ask (`ruleUnreadable`).
      */
     pathBases?: PathRuleBases;
 }
@@ -201,28 +208,7 @@ export interface RuleFaceView {
 export declare function catalogRuleFaceView(toolName: string): RuleFaceView | undefined;
 /** Exported for the lockstep guard only (the scalar vocabulary of a catalog tool) — not part of the rule DSL. */
 export declare const fileToolParamVocabulary: (canonicalTool: string) => ReadonlySet<string> | undefined;
-/**
- * The deny-table row of ONE face-keyed path deny rule, resolved against `bases` — the row's reach IS the rule's (the same
- * parsed rule, the same bases). Every source of such rows builds them here: a policy's compiled rules, and the person's
- * persisted store rows. The caller holds the bases the pattern needs (`ruleBasesNeeded`): a row whose base is missing
- * reads `unreadable`, which this row treats as a reach — a deny row that cannot be judged holds.
- */
-export declare function pathRuleDenyRowOf(rule: {
-    readonly parsed: ParsedRule;
-    readonly ruleText: string;
-    readonly faces: readonly DenyFace[];
-}, bases: PathRuleBases): PathRuleDenyRow;
 /** Dry-run 校验/迁移报告:不 throw,返回全部 issues(含 `unsupported.*` 分类,
  *  供从 CC settings 迁移的部署逐条对照)。 */
 export declare function validatePermissionRules(rules: PermissionRule[], opts?: Pick<PermissionRulePolicyOptions, "primaryFieldGeneric" | "caps" | "ruleFaces" | "pathBases">): PermissionRuleIssue[];
-/**
- * Compile declarative permission rules into ONE {@link ToolPolicy} (design/127). Evaluation order
- * inside the policy (CC `G1e` :595272 isomorph): bare deny → command deny → param deny → bare ask →
- * command ask → param ask → bare allow → `defaultAction` (the content-form command tiers are the
- * field-level tiers of upstream's arbiter, beside the generic param tiers). `check()` is idempotent and side-effect-free (combinePolicies 契约);
- * all parsing/validation happens HERE, the hot path never re-parses.
- *
- * ⚠️ This policy states no allow: a call no rule reaches gets `defaultAction`, whose `"allow"` is "no objection" (states
- * nothing, clears nothing). Express default-closed via `defaultAction`, never via a trailing always-ask policy.
- */
 export declare function createPermissionRulePolicy(rules: PermissionRule[], opts?: PermissionRulePolicyOptions): NamedToolPolicy;

package/dist/core/permission-rules.js

@@ -2,10 +2,10 @@ import { MCP_NAMESPACE, protocolOf } from "./protocol-table.js";
 import { splitNamespacedName } from "./tool-name-aliases.js";
 import { catalogRuleFaceOf, pathTargetOf } from "./tool-registry.js";
 import { indexOfUnescaped, lastIndexOfUnescaped, parsePermissionRule } from "./permission-rule-syntax.js";
-import { NAME_RULE_FACES, PATH_RULE_BASE_LABEL, PATH_RULE_FACES, callPathFaceOf, isUsablePathBase, nameRuleAdmits, nameRuleSubjectOf, parseRuleText, pathRuleHeadOf, pathRuleReachOf, programRunReachOf, ruleBasesNeeded, ruleToolGrammarOf } from "./permission-rule-model.js";
-import { pathFamilyOf, pathIdentityOf, spellingOfIdentity } from "../tools/fs/safety.js";
-import { effectivePathTargetOf } from "./effective-path-target.js";
-import { protectivePathTargetOf } from "./tool-registry.js";
+import { NAME_RULE_FACES, PATH_RULE_BASE_LABEL, PATH_RULE_FACES, callPathFaceOf, isUsablePathBase, nameRuleAdmits, nameRuleSubjectOf, parseRuleText, programRunReachOf, ruleBasesNeeded, ruleToolGrammarOf } from "./permission-rule-model.js";
+import { pathFamilyOf } from "../tools/fs/safety.js";
+import { callTargetReadingOf, callTargetViewsOf } from "./effective-path-target.js";
+import { bindPathRules, pathRowsReach, policyAnchors, rowsWhereTheyLead } from "./path-rule-binding.js";
 import { ruleDenialSentence } from "./rule-denial-sentence.js";
 import { heldValues } from "./tool-name-readings.js";
 export { parsePermissionRule };
@@ -93,22 +93,6 @@ export const fileToolParamVocabulary = (canonicalTool) => {
     const face = catalogRuleFaceOf(canonicalTool);
     return face?.params === undefined || pathTargetOf(canonicalTool) === undefined ? undefined : new Set(face.params);
 };
-export function pathRuleDenyRowOf(rule, bases) {
-    const family = pathFamilyOf(bases);
-    const tree = bases.root ?? bases.cwd;
-    const head = pathRuleHeadOf(rule.parsed, bases);
-    return {
-        rule: rule.ruleText,
-        tool: rule.parsed.tool,
-        pattern: parsePermissionRule(rule.ruleText).ruleContent ?? "",
-        faces: rule.faces,
-        reaches: (absolutePath) => {
-            const id = pathIdentityOf(absolutePath, family, tree);
-            return id.ok && pathRuleReachOf(rule.parsed, id.identity, bases).reach !== "not_reached";
-        },
-        ...(head !== undefined ? { head: spellingOfIdentity(head, family) } : {}),
-    };
-}
 function countStars(s) {
     let n = 0;
     for (const c of s)
@@ -233,9 +217,9 @@ function compile(rules, caps, primaryFieldGeneric, ruleFaces, pathBases = {}) {
                     continue;
                 }
                 for (const base of ruleBasesNeeded(parsedPath.rule)) {
-                    const value = base === "cwd" ? (pathBases.cwd ?? pathBases.root) : pathBases[base];
-                    if (!isUsablePathBase(value, pathFamilyOf(pathBases))) {
-                        bad(text, "unsupported.path_base", `"${text}" is relative to ${PATH_RULE_BASE_LABEL[base]}, and this policy was given no absolute \`pathBases.${base}\`${base === "cwd" ? " (or `root`)" : ""} to resolve it against — the rule could not be judged on any call`);
+                    const declared = base === "cwd" ? (pathBases.cwd ?? pathBases.root) : pathBases[base];
+                    if (declared !== undefined && !isUsablePathBase(declared, pathFamilyOf(pathBases))) {
+                        bad(text, "unsupported.path_base", `"${text}" is relative to ${PATH_RULE_BASE_LABEL[base]}, and the \`pathBases.${base === "cwd" && pathBases.cwd === undefined ? "root" : base}\` this policy declares is not an absolute path of its tree's family — the rule could not be judged on any call`);
                     }
                 }
                 if (issues.length > 0 && issues[issues.length - 1].rule === text && issues[issues.length - 1].code === "unsupported.path_base")
@@ -315,6 +299,7 @@ function ruleDenial(req, ruleText, source) {
 function ruleAskMessage(ruleText, source) {
     return `flagged by permission rule "${ruleText}"${source ? ` (${source})` : ""}`;
 }
+const NO_LEADS = new Map();
 export function createPermissionRulePolicy(rules, opts) {
     const caps = { ...DEFAULT_CAPS, ...opts?.caps };
     const pathBases = opts?.pathBases ?? {};
@@ -360,16 +345,55 @@ export function createPermissionRulePolicy(rules, opts) {
         deny: [...byTool.values()].flatMap((e) => e.content.deny.filter((r) => r.faces !== undefined)),
         ask: [...byTool.values()].flatMap((e) => e.content.ask.filter((r) => r.faces !== undefined)),
     };
-    const pathDenyRules = faceRules.deny.map((r) => pathRuleDenyRowOf({ parsed: r.parsed, ruleText: r.ruleText, faces: r.faces }, pathBases));
     const contentLaneOf = (behavior, entry, callFace) => [
         ...(entry?.content[behavior].filter((r) => r.faces === undefined) ?? []),
         ...(callFace !== undefined ? faceRules[behavior].filter((r) => r.faces.includes(callFace)) : []),
     ];
     const commandParam = catalogRuleFaceOf("Bash")?.primaryParams[0] ?? "command";
+    const pathRuleOf = new Map();
+    for (const e of byTool.values()) {
+        for (const behavior of ["deny", "ask"]) {
+            for (const r of e.content[behavior]) {
+                if (r.parsed.match !== "path" && r.parsed.match !== "subpath")
+                    continue;
+                pathRuleOf.set(r, { parsed: r.parsed, ruleText: r.ruleText, ...(behavior === "deny" && r.faces !== undefined ? { faces: r.faces } : {}) });
+            }
+        }
+    }
+    const pathSpecs = [...pathRuleOf.values()];
+    const bound = new Map();
+    const boundAt = (anchors) => {
+        const key = JSON.stringify([anchors.root ?? null, anchors.cwd ?? null, anchors.home ?? null]);
+        const prior = bound.get(key);
+        if (prior !== undefined)
+            return prior;
+        const rows = bindPathRules(pathSpecs, anchors);
+        const of = new Map();
+        [...pathRuleOf.keys()].forEach((r, i) => of.set(r, rows[i]));
+        const out = { rows, of };
+        bound.set(key, out);
+        return out;
+    };
     const contentHit = (lane, req) => {
         if (lane.length === 0)
             return undefined;
-        const target = effectivePathTargetOf(req, protectivePathTargetOf(req), pathBases);
+        const pathLane = lane.filter((r) => pathRuleOf.has(r));
+        if (pathLane.length > 0) {
+            const views = callTargetViewsOf(req, "tighten", { ...(pathBases.root !== undefined ? { root: pathBases.root } : {}), ...(pathBases.cwd !== undefined ? { cwd: pathBases.cwd } : {}) });
+            if (views !== undefined) {
+                const { of } = boundAt(policyAnchors(pathBases, req.pathRuleAnchors));
+                const rows = rowsWhereTheyLead(pathLane.map((r) => of.get(r)), callTargetReadingOf(req)?.leads ?? NO_LEADS);
+                const hit = pathRowsReach(rows, views, "tighten");
+                const rule = hit === undefined ? undefined : pathLane.find((r) => of.get(r).spec === hit.row.spec);
+                if (hit !== undefined && hit.unreadable === undefined)
+                    return { rule: rule };
+                if (hit !== undefined)
+                    return judgeOthers(lane.filter((r) => !pathRuleOf.has(r)), req) ?? { rule: rule, unreadable: hit.unreadable };
+            }
+        }
+        return judgeOthers(lane.filter((r) => !pathRuleOf.has(r)), req);
+    };
+    const judgeOthers = (lane, req) => {
         const command = isPlainObjectArgs(req.args) ? req.args[commandParam] : undefined;
         let unreadable;
         for (const r of lane) {
@@ -379,20 +403,6 @@ export function createPermissionRulePolicy(rules, opts) {
                     return { rule: r };
                 continue;
             }
-            if (r.parsed.match === "subpath" || r.parsed.match === "path") {
-                if (target === undefined || target.kind === "refused")
-                    continue;
-                if (target.kind === "unreadable") {
-                    unreadable ??= { rule: r, unreadable: target.reason };
-                    continue;
-                }
-                const outcome = pathRuleReachOf(r.parsed, target.identity, pathBases);
-                if (outcome.reach === "reached")
-                    return { rule: r };
-                if (outcome.reach === "unreadable")
-                    unreadable ??= { rule: r, unreadable: outcome.reason };
-                continue;
-            }
             if (typeof command !== "string")
                 continue;
             const outcome = programRunReachOf(r.parsed, command);
@@ -427,7 +437,7 @@ export function createPermissionRulePolicy(rules, opts) {
     };
     return {
         nameSets: [nameSets],
-        ...(pathDenyRules.length > 0 ? { pathDenyRules } : {}),
+        ...(pathSpecs.length > 0 ? { pathRules: (anchors) => boundAt(policyAnchors(pathBases, anchors)).rows } : {}),
         check(req) {
             const entry = entryFor(req);
             const covering = hasCovering && protocolOf(req.toolName) !== undefined;

package/dist/core/real-approval.d.ts

@@ -6,6 +6,7 @@
  * may still refuse it.
  */
 import type { Checkpoint } from "./checkpoint-store.js";
+import type { HostDecider } from "./gate-outcome.js";
 import type { OrgGateVerdict } from "./hooks.js";
 import type { AskRequest, PermissionResult, ResolvedAsk } from "./tool-policy.js";
 /** The synchronous seat's refusal of a configuration's allow: one settlement word for both forms
@@ -16,10 +17,12 @@ export declare function unjudgedAllowRefused(req: AskRequest, by: "blanket" | "p
 /** A durable row demands a person when its gate carries the real-approval bit (the gate's own, which every resume
  *  check reads; the pending action's `requiresRealApproval` is its display twin). */
 export declare function rowDemandsAPerson(cp: Checkpoint): boolean;
-/** A question a durable decide is held against, in each form a station holds one: the parked row, a policy's
- *  re-check of an approver's edit, and the organization's CURRENT verdict about the call. */
-export type HeldQuestion = Checkpoint | PermissionResult | OrgGateVerdict;
-/** Whether a durable decide made by `decidedBy` cannot answer the held question: a question demanding a person is not
+/** A question a decide is held against, in each form a station holds one: the parked row, a policy's re-check of an
+ *  approver's edit, the organization's CURRENT verdict about the call, and the request an approver was handed (the card a
+ *  live door answers). */
+export type HeldQuestion = Checkpoint | PermissionResult | OrgGateVerdict | AskRequest;
+/** Whether a decide made by `decidedBy` cannot answer the held question: a question demanding a person is not
  *  the policy's to answer. One predicate for every station that holds a decide against such a question — the resume
- *  entry (the row, an edit's re-check, the org's current verdict) and the execution belt (the last two, re-read). */
-export declare function policyCannotAnswer(question: HeldQuestion, decidedBy: "person" | "sla_timeout" | "policy"): boolean;
+ *  entry (the row, an edit's re-check, the org's current verdict), the execution belt (the last two, re-read) and a live
+ *  door answering the request an approver was handed. */
+export declare function policyCannotAnswer(question: HeldQuestion, decidedBy: HostDecider): boolean;

package/dist/core/real-approval.js

@@ -16,11 +16,11 @@ export function rowDemandsAPerson(cp) {
     return cp.gate.kind === "irreversible_ask" && cp.gate.realApproval !== undefined;
 }
 function demandsAPerson(question) {
-    if ("gate" in question)
-        return rowDemandsAPerson(question);
-    if ("action" in question)
-        return question.action === "ask" && question.requiresRealApproval === true;
-    return question.status === "available" && question.verdict?.behavior === "ask";
+    const gate = Reflect.get(question, "gate");
+    const verdict = Reflect.get(question, "verdict");
+    const row = typeof gate === "object" && gate !== null && rowDemandsAPerson(question);
+    const org = Reflect.get(question, "status") === "available" && typeof verdict === "object" && verdict !== null && Reflect.get(verdict, "behavior") === "ask";
+    return row || Reflect.get(question, "requiresRealApproval") === true || org;
 }
 export function policyCannotAnswer(question, decidedBy) {
     return decidedBy === "policy" && demandsAPerson(question);