@sema-agent/core 7.45.0 → 7.46.0

package/dist/core/permission-rule-model.d.ts

@@ -76,7 +76,7 @@ import { type DenyFace } from "../tools/fs/read-deny.js";
 import type { AssertAllKeysHandled } from "./ask-origin.js";
 import { type ToolCallLike } from "./tool-registry.js";
 import { type PathFamily, type PathIdentity } from "../tools/fs/safety.js";
-import type { PathTargetReading } from "./effective-path-target.js";
+import { type TargetViews } from "./path-rule-binding.js";
 /**
  * The closed set of rule BEHAVIORS — what a matching rule says about the call. The upstream vocabulary
  * verbatim (`allow` / `deny` / `ask`, the three settings lists), in PRECEDENCE order: when rules of more
@@ -144,7 +144,7 @@ export declare const READ_RULE_TOOL = "Read";
  * its tool's name as its reach (`Write(<path>)` is judged on the Write tool, a stricter reading the reference does not make).
  *
  * The two columns are enforced where each behavior can be: a deny row is exported to the engine's deny tables
- * (`ToolPolicy.pathDenyRules`, the person's rows at prepare), which refuse inside the tool, descend into a search's
+ * (`ToolPolicy.pathRules` bound where the policy is installed, the person's rows at prepare), which refuse inside the tool, descend into a search's
  * results and reach the shell's file commands; an ask is a question asked at the gate before the call runs, so it is
  * judged there, on the call's own path target only — it does not descend (a search rooted above the asked path is not
  * asked, and its results are not filtered).
@@ -600,7 +600,7 @@ export declare function isUsablePathBase(base: string | undefined, family: PathF
  * defect (a `~/` deny falling back to the engine host's home guarded the wrong directory; a `/…` deny with
  * no root reached nothing at all).
  */
-export declare function pathRuleReachOf(rule: Pick<PersistedRule, "match" | "command" | "behavior">, target: PathIdentity, bases: PathRuleBases): ProgramRunReachOutcome;
+export declare function pathRuleReachOf(rule: Pick<PersistedRule, "match" | "command" | "behavior">, target: PathIdentity, bases: PathRuleBases, treeFamily?: PathFamily | undefined): ProgramRunReachOutcome;
 /**
  * Where a path rule's reach STARTS under the call's bases — its HEAD: the location the resolved pattern names before
  * its first segment carrying `*` (the whole path when none does), or a directory rule's directory. Everything the rule
@@ -772,7 +772,7 @@ export declare function lexicalNormalAbsolutePathOf(path: string, family: PathFa
  * there is nothing here for it to clear). As a DENY/ASK the same containment refuses or questions every
  * path under the directory, on whichever path tool the rule names.
  */
-export declare function directoryRuleAdmits(rule: Pick<PersistedRule, "match" | "command">, path: PathIdentity, bases: PathRuleBases): boolean;
+export declare function directoryRuleAdmits(rule: Pick<PersistedRule, "match" | "command">, path: PathIdentity, bases: PathRuleBases, treeFamily?: PathFamily | undefined): boolean;
 /** The identity of a directory SPELLING (the cd resolver's `/`-rooted output) under the call's tree, for the
  *  consumers that hand {@link directoryRuleAdmits} a spelling; a rule minted from it stores this form. */
 export declare function directoryIdentityOf(spelling: string, bases: PathRuleBases): PathIdentity | undefined;
@@ -785,7 +785,18 @@ export declare function directoryIdentityOf(spelling: string, bases: PathRuleBas
  *  r3-② cwd posture), never inferred from the process. ONE function on purpose: this is the scope
  *  conjunct of the single eligibility predicate ({@link eligibleContext}), and a sister predicate
  *  would be the second fact source the 375 §5.1 discipline exists to forbid. */
-export declare function scopeCoversCwd(scope: RuleScope, cwd: string | undefined, sessionId?: string): boolean;
+export declare function scopeCoversCwd(scope: RuleScope, cwd: string | undefined, sessionId?: string, identity?: ScopeRootIdentity): boolean;
+/**
+ * A leg's root as an IDENTITY for project coverage: its canonical spelling, and the leg's resolution of a project row's
+ * scope root to the location it leads to. A DENY or ASK project row written under one spelling of a directory (a link the
+ * host spelled, a firmlink) covers a leg rooted at another spelling of the same directory: the row applies by where the two
+ * roots ARE, not only by how they are spelled. An allow row never reads it ({@link spelledScope}). A caller that holds no
+ * resolution (no leg, no environment) compares the spellings alone.
+ */
+export interface ScopeRootIdentity {
+    readonly canonicalRoot: string;
+    readonly canonicalOf: (root: string) => string | undefined;
+}
 /** Is this rule live — i.e. does it still carry at least one add? Deleted adds are removed by the store
  *  when tombstones are applied, so a rule with an empty `adds` is a rule that no longer exists. */
 export declare function isRuleLive(rule: PersistedRule): boolean;
@@ -815,6 +826,7 @@ export declare function eligibleContext(rule: {
     tool: string;
     cwd: string | undefined;
     sessionId?: string;
+    scopeIdentity?: ScopeRootIdentity;
 }): boolean;
 /**
  * design/375 §5.1 — MAY this PERSISTED rule participate in admitting this call at all? The liveness
@@ -834,7 +846,16 @@ export declare function eligiblePersisted(rule: PersistedRule, call: {
     tool: string;
     cwd: string | undefined;
     sessionId?: string;
+    scopeIdentity?: ScopeRootIdentity;
 }, behavior: RuleBehavior): boolean;
+/**
+ * The call context an ALLOW row's scope is judged in: the spellings alone. A deny or ask row applies wherever its project's
+ * directory is (its scope root resolved where it leads — more rows, only ever more protection); an allow row applies only
+ * where its scope root is SPELLED, so a link someone can re-point never carries a standing approval to another directory.
+ */
+export declare function spelledScope<C extends {
+    scopeIdentity?: ScopeRootIdentity;
+}>(call: C): Omit<C, "scopeIdentity">;
 /**
  * Find the rules that admit this command for a task in `cwd`, or `undefined`.
  *
@@ -914,19 +935,23 @@ export declare function adjudicatePersistedRules(rules: readonly PersistedRule[]
     cwd: string | undefined;
     sessionId?: string;
     execCwd?: string;
+    scopeIdentity?: ScopeRootIdentity;
 }): PersistedRuleVerdict | undefined;
 /**
  * The path-family sibling of {@link adjudicatePersistedRules}: the same precedence walk over the rules
- * of one path-targeting tool, judged on the call's resolved target path.
+ * of one path-targeting tool, judged on the call's target views by the one judgment every path rule meets
+ * ({@link pathRowsReach}: rows outer, views inner).
+ *
+ * TWO readings, because the two directions read the call's path slot differently (design/388 B6/B17): the
+ * tightening arms judge the PROTECTIVE reading's views (`views.tighten` — the object face's declaration, the catalog's
+ * for the name as the floor: reading the catalog for an undeclared same-name tool can only tighten a deny), every row
+ * also where its head leads (`leads`, the judging leg's resolution); the allow arm judges the DECLARED reading's views
+ * (`views.allow` — the face's OWN declaration only: a same-name tool that declares no path target is unconfirmable, and
+ * no grant admits it) with the directory rows, for the Read tool ONLY — a directory allow is a standing yes to reads,
+ * never to a write — and admits only when every view lies under the directory. Either reading may be absent (no
+ * resolvable path in that reading); the arm that needs it then speaks for nothing.
  *
- * TWO targets, because the two directions read the call's path slot differently (design/388 B6/B17): the
- * tightening arms judge the PROTECTIVE target (`protectivePathTargetOf` — the object face's declaration,
- * the catalog's for the name as the floor: reading the catalog for an undeclared same-name tool can only
- * tighten a deny) with {@link pathRuleReaches}; the allow arm judges the DECLARED target
- * (`declaredPathTargetOf` — the face's OWN declaration only: a same-name tool that declares no path
- * target is unconfirmable, and no grant admits it) with {@link directoryRuleAdmits}, and for the Read tool
- * ONLY — a directory allow is a standing yes to reads, never to a write. Either target may be absent
- * (no resolvable path in that reading); the arm that needs it then speaks for nothing.
+ * A row is anchored by `anchorsOf` (the person's rows: a project row at its scope root, the rest at the chain's top leg).
  *
  * `call.face` is the face the call's protective target is on (`read` / `write`): an ASK row speaks for the call when it
  * is the call's tool's row, or when {@link PATH_RULE_FACES} puts that face in the row's ask column (a `Read(<path>)` ask
@@ -938,10 +963,11 @@ export declare function adjudicatePersistedPathRules(rules: readonly PersistedRu
     cwd: string | undefined;
     sessionId?: string;
     face?: DenyFace | undefined;
-}, targets: {
-    readonly tighten?: PathTargetReading;
-    readonly allow?: PathTargetReading;
-}, bases: PathRuleBases): PersistedRuleVerdict | undefined;
+    scopeIdentity?: ScopeRootIdentity;
+}, views: {
+    readonly tighten?: TargetViews;
+    readonly allow?: TargetViews;
+}, anchorsOf: (rule: PersistedRule) => PathRuleBases, leads: ReadonlyMap<string, string | undefined>): PersistedRuleVerdict | undefined;
 /**
  * The name-family sibling of {@link adjudicatePersistedRules}: the same precedence walk over the rules of one name tool
  * ({@link NAME_RULE_FACES}), judged on the one string the call names (`nameRuleSubjectOf`). A rule of the tool speaks for the call
@@ -955,6 +981,7 @@ export declare function adjudicatePersistedNameRules(rules: readonly PersistedRu
     name: string | undefined;
     cwd: string | undefined;
     sessionId?: string;
+    scopeIdentity?: ScopeRootIdentity;
 }): PersistedRuleVerdict | undefined;
 /**
  * The ONE offer a name tool's approval card carries: the exact rule for the name the call carries (`Skill(<name>)`, the reference's
@@ -1009,6 +1036,8 @@ export declare function segmentCoverageOf(command: string, rules: {
     /** The relative-cd resolution base (see {@link findAdmittingRule}'s member of the same name) —
      *  defaults to `cwd`; scope/eligibility stays `cwd`. */
     execCwd?: string;
+    /** The leg's root as an identity for project coverage ({@link ScopeRootIdentity}). */
+    scopeIdentity?: ScopeRootIdentity;
 }): readonly SegmentCoverage[] | undefined;
 /** One row of a per-segment coverage table (see {@link segmentCoverageOf}): the FOLDED, trimmed
  *  segment text (a display/correlation seat, never adjudication input) and whether an eligible rule

package/dist/core/permission-rule-model.js

@@ -6,6 +6,7 @@ import { inlineUntrusted } from "./untrusted-text.js";
 import { pathTargetOf, protectivePathTargetOf } from "./tool-registry.js";
 import { heldValues } from "./tool-name-readings.js";
 import { carriesDotSegment, isAbsoluteForFamily, isIdentityDir, isPathIdentity, isShellRootedSpellingUnmapped, isUncIdentity, pathFamilyOf, pathIdentityOf } from "../tools/fs/safety.js";
+import { bindPathRules, pathRowsReach, rowsWhereTheyLead } from "./path-rule-binding.js";
 import { readShellCommand } from "./shell-lexer.js";
 import { readOnlyLineObjection, readOnlyShellVerdict } from "./read-only-shell.js";
 export const RULE_BEHAVIORS = Object.freeze(["deny", "ask", "allow"]);
@@ -68,7 +69,7 @@ export const BARE_INTERPRETER_NAMES = new Set([
     "bash", "sh", "zsh", "ksh", "csh", "tcsh", "dash", "fish", "cmd", "powershell", "pwsh", "busybox",
     "source", ".", "trap", "eval", "exec", "command", "builtin",
     "enable", "compgen", "complete", "bind", "mapfile", "readarray",
-    "env", "noglob", "xargs",
+    "env", "noglob", "nocorrect", "xargs",
     "sudo", "doas", "pkexec", "su", "runuser", "ssh", "chroot", "setpriv",
     "nohup", "nice", "ionice", "chrt", "taskset", "stdbuf", "timeout", "time", "watch",
     "setsid", "flock", "unshare", "nsenter", "script", "numactl", "prlimit", "systemd-run", "parallel",
@@ -440,8 +441,8 @@ function baseValueOf(base, bases) {
         }
     }
 }
-function resolvePathPattern(pattern, bases, behavior) {
-    const family = pathFamilyOf(bases);
+function resolvePathPattern(pattern, bases, behavior, treeFamily = pathFamilyOf(bases)) {
+    const family = treeFamily;
     const tree = bases.root ?? bases.cwd;
     if (pattern.startsWith("//")) {
         const abs = pathIdentityOf("/" + pattern.slice(2), family, tree);
@@ -503,15 +504,15 @@ function globSegmentsReach(globs, target) {
     };
     return walk(0, 0);
 }
-export function pathRuleReachOf(rule, target, bases) {
+export function pathRuleReachOf(rule, target, bases, treeFamily = pathFamilyOf(bases)) {
     if (rule.match === "subpath")
-        return directoryRuleAdmits(rule, target, bases) ? REACHED : NOT_REACHED;
+        return directoryRuleAdmits(rule, target, bases, treeFamily) ? REACHED : NOT_REACHED;
     if (rule.match !== "path")
         return NOT_REACHED;
-    const family = pathFamilyOf(bases);
+    const family = treeFamily;
     if (!isPathIdentity(target, family))
         return NOT_REACHED;
-    const r = resolvePathPattern(rule.command, bases, rule.behavior);
+    const r = resolvePathPattern(rule.command, bases, rule.behavior, family);
     if ("missingBase" in r) {
         return { reach: "unreadable", reason: `the rule is relative to ${PATH_RULE_BASE_LABEL[r.missingBase]} and this call supplies no absolute \`${r.missingBase}\` base of this tree's family to resolve it against` };
     }
@@ -706,10 +707,10 @@ function isLexicalNormalAbsoluteDir(path) {
     const segments = path.split("/").slice(1);
     return segments.length > 0 && segments.every((s) => s !== "" && s !== "." && s !== "..");
 }
-export function directoryRuleAdmits(rule, path, bases) {
+export function directoryRuleAdmits(rule, path, bases, treeFamily = pathFamilyOf(bases)) {
     if (rule.match !== "subpath")
         return false;
-    const family = pathFamilyOf(bases);
+    const family = treeFamily;
     if (carriesDotSegment(rule.command, family))
         return false;
     const dir = pathIdentityOf(rule.command, family, bases.root ?? bases.cwd);
@@ -820,21 +821,29 @@ function resolveCdSegmentDirectories(segments, cwd) {
         return dir === undefined || isShellRootedSpellingUnmapped(pathFamilyOf(bases), dir) ? undefined : directoryIdentityOf(dir, bases);
     });
 }
-export function scopeCoversCwd(scope, cwd, sessionId) {
+export function scopeCoversCwd(scope, cwd, sessionId, identity) {
     if (scope.kind === "global")
         return true;
     if (scope.kind === "session")
         return sessionId !== undefined && sessionId === scope.sessionId;
-    return cwd !== undefined && pathWithinRoot(cwd, scope.root);
+    if (cwd === undefined)
+        return false;
+    if (pathWithinRoot(cwd, scope.root))
+        return true;
+    return identity !== undefined && pathWithinRoot(identity.canonicalRoot, identity.canonicalOf(scope.root) ?? scope.root);
 }
 export function isRuleLive(rule) {
     return rule.adds.length > 0;
 }
 export function eligibleContext(rule, call) {
-    return rule.tool === call.tool && scopeCoversCwd(rule.scope, call.cwd, call.sessionId);
+    return rule.tool === call.tool && scopeCoversCwd(rule.scope, call.cwd, call.sessionId, call.scopeIdentity);
 }
 export function eligiblePersisted(rule, call, behavior) {
-    return rule.behavior === behavior && isRuleLive(rule) && eligibleContext(rule, call);
+    return rule.behavior === behavior && isRuleLive(rule) && eligibleContext(rule, behavior === "allow" ? spelledScope(call) : call);
+}
+export function spelledScope(call) {
+    const { scopeIdentity: _identity, ...spelled } = call;
+    return spelled;
 }
 function firstEligibleAdmittingRule(rules, commandText, call) {
     for (const rule of rules) {
@@ -911,41 +920,28 @@ export function adjudicatePersistedRules(rules, call) {
     }
     return undefined;
 }
-export function adjudicatePersistedPathRules(rules, call, targets, bases) {
+export function adjudicatePersistedPathRules(rules, call, views, anchorsOf, leads) {
     const speaks = (rule, behavior) => eligiblePersisted(rule, call, behavior) ||
         (behavior === "ask" && call.face !== undefined && PATH_RULE_FACES[rule.tool]?.ask?.includes(call.face) === true && eligiblePersisted(rule, { ...call, tool: rule.tool }, behavior));
+    const bind = (rows) => bindPathRules(rows.map((rule) => ({ parsed: rule, ruleText: rule.rule, rule })), (s) => anchorsOf(s.rule));
     for (const behavior of RULE_BEHAVIORS_BY_PRECEDENCE) {
         if (behavior === "allow") {
-            if (targets.allow?.kind !== "path" || call.tool !== READ_RULE_TOOL)
+            if (views.allow === undefined || call.tool !== READ_RULE_TOOL)
                 continue;
-            for (const rule of rules) {
-                if (!eligiblePersisted(rule, call, behavior))
-                    continue;
-                if (directoryRuleAdmits(rule, targets.allow.identity, bases))
-                    return { behavior, rules: [rule] };
-            }
+            const hit = pathRowsReach(bind(rules.filter((rule) => rule.match === "subpath" && eligiblePersisted(rule, call, behavior))), views.allow, "allow");
+            if (hit !== undefined)
+                return { behavior, rules: [hit.row.spec.rule] };
             continue;
         }
-        const tighten = targets.tighten;
-        if (tighten === undefined || tighten.kind === "refused")
+        if (views.tighten === undefined)
             continue;
-        let unreadable;
-        for (const rule of rules) {
-            if (!speaks(rule, behavior))
-                continue;
-            if (tighten.kind === "unreadable") {
-                if (rule.match === "path" || rule.match === "subpath")
-                    unreadable ??= { behavior: "ask", rules: [rule], unreadable: tighten.reason };
-                continue;
-            }
-            const outcome = pathRuleReachOf(rule, tighten.identity, bases);
-            if (outcome.reach === "reached")
-                return { behavior, rules: [rule] };
-            if (outcome.reach === "unreadable")
-                unreadable ??= { behavior: "ask", rules: [rule], unreadable: outcome.reason };
-        }
-        if (unreadable !== undefined)
-            return unreadable;
+        const rows = rules.filter((rule) => (rule.match === "path" || rule.match === "subpath") && speaks(rule, behavior));
+        if (rows.length === 0)
+            continue;
+        const hit = pathRowsReach(rowsWhereTheyLead(bind(rows), leads), views.tighten, "tighten");
+        if (hit === undefined)
+            continue;
+        return hit.unreadable !== undefined ? { behavior: "ask", rules: [hit.row.spec.rule], unreadable: hit.unreadable } : { behavior, rules: [hit.row.spec.rule] };
     }
     return undefined;
 }
@@ -987,9 +983,9 @@ export function segmentCoverageOf(command, rules, call) {
                 (dir !== undefined && firstEligibleDirectoryRule(rules.persisted, dir, call) !== undefined) ||
                 proposed.some((p) => p.rule.tool === "Read"
                     ? dir !== undefined &&
-                        eligibleContext({ tool: p.rule.tool, scope: p.scope }, { tool: "Read", cwd: call.cwd, sessionId: call.sessionId }) &&
+                        eligibleContext({ tool: p.rule.tool, scope: p.scope }, { ...spelledScope(call), tool: "Read" }) &&
                         directoryRuleAdmits(p.rule, dir, basesOfCwd(call.execCwd ?? call.cwd))
-                    : eligibleContext({ tool: p.rule.tool, scope: p.scope }, call) && ruleAdmitsCommand(p.rule, segment)),
+                    : eligibleContext({ tool: p.rule.tool, scope: p.scope }, spelledScope(call)) && ruleAdmitsCommand(p.rule, segment)),
         };
     });
 }

package/dist/core/permission-rule-provider.d.ts

@@ -86,6 +86,13 @@ export interface EffectivePermissionRules {
      *  served that are not canonical session rows of this session). The org partition's lines ride
      *  `org.disclosures`. */
     disclosures: string[];
+    /** The durable rows left out because their project scope root is not a complete absolute path (a foreign writer's or a
+     *  hand edit's row): each row's text and its scope root as served (a non-string root as its type). Absent when none. The
+     *  reader tells the person (`permission.rule_row_dropped`). */
+    droppedRows?: ReadonlyArray<{
+        readonly rule: string;
+        readonly scopeRoot: string;
+    }>;
 }
 /**
  * The host-visible store, already anchored to one owner. One read verb, which never throws: each

package/dist/core/permission-rule-provider.js

@@ -1,5 +1,5 @@
 import { escapeForDisclosure } from "./permission-rule-model.js";
-import { PERMISSION_RULE_WRITER, errText, normalizePersistedRule, sameRuleIdentity, writerOf, } from "./permission-rule-store.js";
+import { PERMISSION_RULE_WRITER, errText, isValidDurableScope, normalizePersistedRule, sameRuleIdentity, writerOf, } from "./permission-rule-store.js";
 import { UNGOVERNED_ORG_RESOLUTION, compileOrgShadowPredicate, createOrgRulePartition } from "./permission-rule-org.js";
 export function ruleSourceOf(scope) {
     return scope.kind === "global" ? "user" : scope.kind;
@@ -80,7 +80,11 @@ class UnifiedPermissionRuleStore {
         const sessionRead = "unreadable" in sessionRows ? [] : sessionRows;
         const shadowed = compileOrgShadowPredicate(orgResolution.rules);
         const rules = [];
-        for (const r of [...sessionRead, ...durableRead.rules]) {
+        const illegal = durableRead.rules.filter((r) => !isValidDurableScope(r.scope));
+        const droppedRows = illegal.map((r) => ({ rule: String(r.rule), scopeRoot: scopeRootAsServed(r.scope.root) }));
+        if (illegal.length > 0)
+            disclosures.push(`the persisted rule partition served ${illegal.length} row(s) whose project scope root is not a complete absolute path — dropped, not adjudicated: ${illegal.slice(0, 3).map((r) => `${escapeForDisclosure(r.rule)} (${escapeForDisclosure(r.scope.root)})`).join(", ")}`);
+        for (const r of [...sessionRead, ...durableRead.rules.filter((x) => !illegal.includes(x))]) {
             rules.push({ ...r, source: ruleSourceOf(r.scope), status: r.behavior === "allow" && shadowed(r) ? "shadowed-by-org" : "live" });
         }
         const removed = [];
@@ -93,7 +97,7 @@ class UnifiedPermissionRuleStore {
                 continue;
             removed.push({ behavior: t.behavior, rule: t.rule, scope: t.scope, source: ruleSourceOf(t.scope), status: "removed" });
         }
-        return { rules, removed, org: orgResolution, rev: durableRead.rev, disclosures, ...failed };
+        return { rules, removed, org: orgResolution, rev: durableRead.rev, disclosures, ...failed, ...(droppedRows.length > 0 ? { droppedRows } : {}) };
     }
     async readSessionRows(sessionId, disclosures) {
         if (this.session === undefined || sessionId === undefined)
@@ -116,6 +120,9 @@ class UnifiedPermissionRuleStore {
         }
     }
 }
+function scopeRootAsServed(root) {
+    return typeof root === "string" ? root : `(${root === null ? "null" : typeof root})`;
+}
 function routingWriter(durable, session) {
     return {
         nextDot: () => durable.nextDot(),

package/dist/core/permission-rule-store.d.ts

@@ -457,6 +457,14 @@ export declare function isValidConsentScope(scope: RuleScope): boolean;
  * duty (design/382 §10): every such entrance, present or future, carries this face.
  */
 export declare function isValidDurableScope(scope: RuleScope): boolean;
+/**
+ * A PROJECT scope's root is a complete absolute path — `/…`, a drive-rooted `X:\…` / `X:/…`, a UNC `\host\…` — the one
+ * predicate every scope face reads (the consent face, the durable face, the sync wire's pick). It is what a project row's
+ * path patterns anchor at (its `/x` and relative words), so a root that is not one (`C:`, a relative spelling, empty)
+ * would let the row apply (containment is a prefix test) while its anchor reads nothing: such a row is refused at every
+ * write, dropped at every read, and disclosed.
+ */
+export declare function isProjectScopeRoot(root: unknown): root is string;
 /** Is `dot` at or below the frontier? Absent actor ⇒ not below (a frontier never covers what it never saw). */
 export declare function dotAtOrBelowFrontier(dot: RuleDot, frontier: RuleSyncFrontier): boolean;
 /**

package/dist/core/permission-rule-store.js

@@ -2,6 +2,7 @@ import { randomBytes } from "node:crypto";
 import { canonicalize } from "./canonical-json.js";
 import { escapeForDisclosure, isRuleBehavior, isRuleLive, parseRuleText } from "./permission-rule-model.js";
 import { thrownText } from "./thrown-value.js";
+import { isAbsolutePathForm } from "../tools/fs/safety.js";
 export function sameRuleOwner(a, b) {
     return a.kind === "principal" ? b.kind === "principal" && a.principal === b.principal : b.kind === "local-owner";
 }
@@ -143,12 +144,15 @@ export function assertWriteDeltaScopeDurable(delta) {
 export function isValidConsentScope(scope) {
     const sc = scope;
     return (sc?.kind === "global" ||
-        (sc?.kind === "project" && typeof sc.root === "string" && sc.root !== "") ||
+        (sc?.kind === "project" && isProjectScopeRoot(sc.root)) ||
         (sc?.kind === "session" && typeof sc.sessionId === "string" && sc.sessionId !== ""));
 }
 export function isValidDurableScope(scope) {
     const sc = scope;
-    return sc?.kind === "global" || (sc?.kind === "project" && typeof sc.root === "string" && sc.root !== "");
+    return sc?.kind === "global" || (sc?.kind === "project" && isProjectScopeRoot(sc.root));
+}
+export function isProjectScopeRoot(root) {
+    return typeof root === "string" && isAbsolutePathForm(root);
 }
 function isValidDot(dot) {
     const d = dot;

package/dist/core/permission-rule-sync.js

@@ -1,5 +1,5 @@
 import { escapeForDisclosure, isRuleBehavior, parseRuleText } from "./permission-rule-model.js";
-import { applyTombstones, errText, joinFrontiers, joinRuleStates, normalizePersistedRule, readRuleWriteOutcome, ruleSyncVector, sameRuleIdentity, screenRuleSyncState, writerOf, } from "./permission-rule-store.js";
+import { applyTombstones, errText, isProjectScopeRoot, joinFrontiers, joinRuleStates, normalizePersistedRule, readRuleWriteOutcome, ruleSyncVector, sameRuleIdentity, screenRuleSyncState, writerOf, } from "./permission-rule-store.js";
 import { emitTrace } from "./trace.js";
 export const PERMISSION_RULE_SYNC_PATH = "/v1/permission-rules/sync";
 export const LOCAL_OWNER_UNSYNCABLE_CODE = "permission_rules.local_owner_unsyncable";
@@ -262,7 +262,7 @@ function pickScopeCaptured(v) {
         return { kind, scope: { kind: "global" } };
     if (kind === "project") {
         const root = s?.root;
-        return { kind, scope: typeof root === "string" && root !== "" ? { kind: "project", root } : undefined };
+        return { kind, scope: isProjectScopeRoot(root) ? { kind: "project", root } : undefined };
     }
     if (kind === "session") {
         const sessionId = s?.sessionId;

package/dist/core/permission-rules.d.ts

@@ -30,11 +30,13 @@
  * `Edit(~/.sema/settings.json)` / `Write(src/**)` / `Read(//etc/**)` deny or ask compiles through the same
  * validator (the model's path grammar — the `//abs-dir/**` directory form and upstream's pattern form:
  * `//` absolute, `~/` home, `/` project root, otherwise working-directory relative; `*` within a segment,
- * `**` across) and is judged with `pathRuleReaches` on the call's PROTECTIVE path target (design/388: the
- * object face's declaration, the catalog's for the name as the floor). The bases a pattern resolves
- * against are the deployment's (`pathBases`); a pattern whose base the policy was not given is refused at
- * compile time (`unsupported.path_base`) rather than left to reach nothing at run time — a deny that
- * silently matches nothing is the failure form this module's header calls the most dangerous one.
+ * `**` across) and is judged on the call's PROTECTIVE path target (design/388: the object face's declaration, the
+ * catalog's for the name as the floor), every view of it (`callTargetViewsOf`), by the one judgment every path rule
+ * meets (`pathRowsReach`). A pattern's ANCHORS are the rule's own fact, taken once where the policy is installed: the
+ * declared `pathBases` word by word, else the leg the Runner installs the policy on (`policyAnchors`) — never the
+ * call's live working directory. A declared base that is not a usable absolute path is refused at compile time
+ * (`unsupported.path_base`); a policy called outside a Runner leg with no declared base reads such a rule
+ * `unreadable` (the fail-closed ask).
  * A `Read(...)` / `Edit(...)` deny or ask reaches the calls on its behavior's FACES (`PATH_RULE_FACES`), not only
  * its own tool: a `Read` ask asks for a Grep / Glob rooted in its path, judged on that call's own target.
  *
@@ -53,8 +55,7 @@
  */
 import type { NamedToolPolicy } from "./tool-policy.js";
 import { parsePermissionRule, type ParsedPermissionRule } from "./permission-rule-syntax.js";
-import { type ParsedRule, type PathRuleBases } from "./permission-rule-model.js";
-import type { DenyFace, PathRuleDenyRow } from "../tools/fs/read-deny.js";
+import { type PathRuleBases } from "./permission-rule-model.js";
 export { parsePermissionRule, type ParsedPermissionRule };
 /** [K-PLATFORM-SWEEP] MINOR#11: Bash's REAL non-primary arg names, accepted as generic param rules
  *  (`Bash(timeout:...)`). Exported SOLELY so a lockstep test can assert it against the live Bash tool
@@ -93,9 +94,10 @@ export interface PermissionRuleIssue {
      *  is an object/array (a rule on it can never match); the tool is unknown to the resolver a leg
      *  supplied (absent resolver ⇒ the catalog alone judges and an unknown tool stays permissive). */
      | "unsupported.param_unknown" | "unsupported.param_non_scalar" | "unsupported.tool_unknown"
-    /** A path-form deny/ask whose spelling needs a base this policy was not given (`/x` needs
-     *  `pathBases.root`; a relative pattern needs `pathBases.cwd` or `root`) — refused rather than compiled
-     *  into a rule that reaches nothing. */
+    /** A path-form deny/ask whose spelling needs a base this policy DECLARES as something other than an absolute path
+     *  of its tree's family (`/x` reads `pathBases.root`; a relative pattern `pathBases.cwd`, else `root`; `~/` `home`)
+     *  — a bad declared value, refused rather than compiled into a rule that reaches nothing. An undeclared base is no
+     *  refusal: the rule is anchored where the policy is installed. */
      | "unsupported.path_base" | "unsupported.mcp_paren"
     /** A parenthesised rule whose NAME is a covering spelling in a non-MCP protocol namespace
      *  (`a2a__<peer>__*(x:y)`, `a2a__<peer>(x:y)`). The param DSL is keyed by EXACT tool name, and a
@@ -143,16 +145,17 @@ export interface PermissionRulePolicyOptions {
      */
     ruleFaces?: (toolName: string) => RuleFaceView | undefined;
     /**
-     * The bases a path-form deny/ask pattern resolves against at match time ({@link PathRuleBases}): `root`
-     * for `/…` (the task's project root), `cwd` for a relative pattern (the root stands in when absent — the
-     * word's own meaning), `home` for `~/…` (the EXECUTION ENVIRONMENT's home — never the engine process's
-     * own; #644). Facts of the DEPLOYMENT and the task, never of the rule — a pattern is stored as spelled.
-     * A rule whose base is absent (or not an absolute path) here is refused at compile time
+     * The ANCHORS of this rule set's path patterns ({@link PathRuleBases}), word by word: `root` for `/…`, `cwd` for a
+     * relative pattern (the declared root stands in when absent — the word's own meaning), `home` for `~/…` (an
+     * execution environment's home — never the engine process's own; #644). A word declared here anchors the rules
+     * wherever the policy runs; a word left out is anchored where the Runner installs the policy — the root and the
+     * environment's home of the leg it enters the delegation chain on — and stays there for every child and every `cd`.
+     * A declared value that is not an absolute path of its tree's family is refused at compile time
      * (`unsupported.path_base`, naming the base — {@link ruleBasesNeeded} is the same classification).
-     * A call's own target resolves against these bases as given; when they hold neither `root` nor `cwd`,
-     * against the request's (`ToolCallRequest.root` / `.cwd`, stamped by the Runner) — never a mix of the two
-     * sources. A target neither supplies the base for is unreadable: every path rule able to reach the call
-     * answers it with the fail-closed ask (`ruleUnreadable`).
+     * These are the RULES' anchors, never the call's: a call's target is read from the call (its target reading, else its
+     * own `root` / `cwd`); only a host calling the policy directly with a request that carries neither has its target
+     * resolved against `root` / `cwd` here. A target nothing locates is unreadable: every path rule able to reach the
+     * call answers it with the fail-closed ask (`ruleUnreadable`).
      */
     pathBases?: PathRuleBases;
 }
@@ -205,28 +208,7 @@ export interface RuleFaceView {
 export declare function catalogRuleFaceView(toolName: string): RuleFaceView | undefined;
 /** Exported for the lockstep guard only (the scalar vocabulary of a catalog tool) — not part of the rule DSL. */
 export declare const fileToolParamVocabulary: (canonicalTool: string) => ReadonlySet<string> | undefined;
-/**
- * The deny-table row of ONE face-keyed path deny rule, resolved against `bases` — the row's reach IS the rule's (the same
- * parsed rule, the same bases). Every source of such rows builds them here: a policy's compiled rules, and the person's
- * persisted store rows. The caller holds the bases the pattern needs (`ruleBasesNeeded`): a row whose base is missing
- * reads `unreadable`, which this row treats as a reach — a deny row that cannot be judged holds.
- */
-export declare function pathRuleDenyRowOf(rule: {
-    readonly parsed: ParsedRule;
-    readonly ruleText: string;
-    readonly faces: readonly DenyFace[];
-}, bases: PathRuleBases): PathRuleDenyRow;
 /** Dry-run 校验/迁移报告:不 throw,返回全部 issues(含 `unsupported.*` 分类,
  *  供从 CC settings 迁移的部署逐条对照)。 */
 export declare function validatePermissionRules(rules: PermissionRule[], opts?: Pick<PermissionRulePolicyOptions, "primaryFieldGeneric" | "caps" | "ruleFaces" | "pathBases">): PermissionRuleIssue[];
-/**
- * Compile declarative permission rules into ONE {@link ToolPolicy} (design/127). Evaluation order
- * inside the policy (CC `G1e` :595272 isomorph): bare deny → command deny → param deny → bare ask →
- * command ask → param ask → bare allow → `defaultAction` (the content-form command tiers are the
- * field-level tiers of upstream's arbiter, beside the generic param tiers). `check()` is idempotent and side-effect-free (combinePolicies 契约);
- * all parsing/validation happens HERE, the hot path never re-parses.
- *
- * ⚠️ This policy states no allow: a call no rule reaches gets `defaultAction`, whose `"allow"` is "no objection" (states
- * nothing, clears nothing). Express default-closed via `defaultAction`, never via a trailing always-ask policy.
- */
 export declare function createPermissionRulePolicy(rules: PermissionRule[], opts?: PermissionRulePolicyOptions): NamedToolPolicy;