@sema-agent/core 7.45.0 → 7.47.0

package/dist/core/permission-rule-model.js

@@ -3,9 +3,10 @@ import { parsePermissionRule } from "./permission-rule-syntax.js";
 import { compileReadDeny } from "../tools/fs/read-deny.js";
 import { carriesShellRedirection, parseLeadingCommandName, splitShellCompoundSegments } from "../tools/fs/bash-readonly-classifier.js";
 import { inlineUntrusted } from "./untrusted-text.js";
-import { pathTargetOf, protectivePathTargetOf } from "./tool-registry.js";
+import { isShellFaceToolName, pathTargetOf, protectivePathTargetOf } from "./tool-registry.js";
 import { heldValues } from "./tool-name-readings.js";
 import { carriesDotSegment, isAbsoluteForFamily, isIdentityDir, isPathIdentity, isShellRootedSpellingUnmapped, isUncIdentity, pathFamilyOf, pathIdentityOf } from "../tools/fs/safety.js";
+import { bindPathRules, pathRowsReach, rowsWhereTheyLead } from "./path-rule-binding.js";
 import { readShellCommand } from "./shell-lexer.js";
 import { readOnlyLineObjection, readOnlyShellVerdict } from "./read-only-shell.js";
 export const RULE_BEHAVIORS = Object.freeze(["deny", "ask", "allow"]);
@@ -25,6 +26,8 @@ export function readRowBehavior(v) {
     return isRuleBehavior(v) ? v : undefined;
 }
 export const COMMAND_RULE_TOOL = "Bash";
+if (!isShellFaceToolName(COMMAND_RULE_TOOL))
+    throw new Error(`permission rules: the command rule word ${JSON.stringify(COMMAND_RULE_TOOL)} names no definition on the catalog's shell face`);
 export const READ_RULE_TOOL = "Read";
 export const PATH_RULE_FACES = Object.freeze({
     [READ_RULE_TOOL]: Object.freeze({ deny: Object.freeze(["read", "write"]), ask: Object.freeze(["read"]) }),
@@ -55,7 +58,13 @@ export function nameRuleSubjectOf(toolName, args) {
     return typeof value === "string" ? value : undefined;
 }
 export function laneToolNamesOf(req) {
-    return heldValues("policy.persistedGrammar", { get: (n) => (ruleToolGrammarOf(n) !== undefined ? n : undefined) }, req);
+    const words = heldValues("policy.persistedGrammar", { get: ruleWordOf }, req);
+    return words.length <= 1 ? words : [...new Set(words)];
+}
+function ruleWordOf(name) {
+    if (isShellFaceToolName(name))
+        return COMMAND_RULE_TOOL;
+    return ruleToolGrammarOf(name) !== undefined ? name : undefined;
 }
 function isCommandMatch(match) {
     return match === "exact" || match === "prefix" || match === "wildcard";
@@ -68,7 +77,7 @@ export const BARE_INTERPRETER_NAMES = new Set([
     "bash", "sh", "zsh", "ksh", "csh", "tcsh", "dash", "fish", "cmd", "powershell", "pwsh", "busybox",
     "source", ".", "trap", "eval", "exec", "command", "builtin",
     "enable", "compgen", "complete", "bind", "mapfile", "readarray",
-    "env", "noglob", "xargs",
+    "env", "noglob", "nocorrect", "xargs",
     "sudo", "doas", "pkexec", "su", "runuser", "ssh", "chroot", "setpriv",
     "nohup", "nice", "ionice", "chrt", "taskset", "stdbuf", "timeout", "time", "watch",
     "setsid", "flock", "unshare", "nsenter", "script", "numactl", "prlimit", "systemd-run", "parallel",
@@ -440,8 +449,8 @@ function baseValueOf(base, bases) {
         }
     }
 }
-function resolvePathPattern(pattern, bases, behavior) {
-    const family = pathFamilyOf(bases);
+function resolvePathPattern(pattern, bases, behavior, treeFamily = pathFamilyOf(bases)) {
+    const family = treeFamily;
     const tree = bases.root ?? bases.cwd;
     if (pattern.startsWith("//")) {
         const abs = pathIdentityOf("/" + pattern.slice(2), family, tree);
@@ -503,15 +512,15 @@ function globSegmentsReach(globs, target) {
     };
     return walk(0, 0);
 }
-export function pathRuleReachOf(rule, target, bases) {
+export function pathRuleReachOf(rule, target, bases, treeFamily = pathFamilyOf(bases)) {
     if (rule.match === "subpath")
-        return directoryRuleAdmits(rule, target, bases) ? REACHED : NOT_REACHED;
+        return directoryRuleAdmits(rule, target, bases, treeFamily) ? REACHED : NOT_REACHED;
     if (rule.match !== "path")
         return NOT_REACHED;
-    const family = pathFamilyOf(bases);
+    const family = treeFamily;
     if (!isPathIdentity(target, family))
         return NOT_REACHED;
-    const r = resolvePathPattern(rule.command, bases, rule.behavior);
+    const r = resolvePathPattern(rule.command, bases, rule.behavior, family);
     if ("missingBase" in r) {
         return { reach: "unreadable", reason: `the rule is relative to ${PATH_RULE_BASE_LABEL[r.missingBase]} and this call supplies no absolute \`${r.missingBase}\` base of this tree's family to resolve it against` };
     }
@@ -706,10 +715,10 @@ function isLexicalNormalAbsoluteDir(path) {
     const segments = path.split("/").slice(1);
     return segments.length > 0 && segments.every((s) => s !== "" && s !== "." && s !== "..");
 }
-export function directoryRuleAdmits(rule, path, bases) {
+export function directoryRuleAdmits(rule, path, bases, treeFamily = pathFamilyOf(bases)) {
     if (rule.match !== "subpath")
         return false;
-    const family = pathFamilyOf(bases);
+    const family = treeFamily;
     if (carriesDotSegment(rule.command, family))
         return false;
     const dir = pathIdentityOf(rule.command, family, bases.root ?? bases.cwd);
@@ -820,21 +829,29 @@ function resolveCdSegmentDirectories(segments, cwd) {
         return dir === undefined || isShellRootedSpellingUnmapped(pathFamilyOf(bases), dir) ? undefined : directoryIdentityOf(dir, bases);
     });
 }
-export function scopeCoversCwd(scope, cwd, sessionId) {
+export function scopeCoversCwd(scope, cwd, sessionId, identity) {
     if (scope.kind === "global")
         return true;
     if (scope.kind === "session")
         return sessionId !== undefined && sessionId === scope.sessionId;
-    return cwd !== undefined && pathWithinRoot(cwd, scope.root);
+    if (cwd === undefined)
+        return false;
+    if (pathWithinRoot(cwd, scope.root))
+        return true;
+    return identity !== undefined && pathWithinRoot(identity.canonicalRoot, identity.canonicalOf(scope.root) ?? scope.root);
 }
 export function isRuleLive(rule) {
     return rule.adds.length > 0;
 }
 export function eligibleContext(rule, call) {
-    return rule.tool === call.tool && scopeCoversCwd(rule.scope, call.cwd, call.sessionId);
+    return rule.tool === call.tool && scopeCoversCwd(rule.scope, call.cwd, call.sessionId, call.scopeIdentity);
 }
 export function eligiblePersisted(rule, call, behavior) {
-    return rule.behavior === behavior && isRuleLive(rule) && eligibleContext(rule, call);
+    return rule.behavior === behavior && isRuleLive(rule) && eligibleContext(rule, behavior === "allow" ? spelledScope(call) : call);
+}
+export function spelledScope(call) {
+    const { scopeIdentity: _identity, ...spelled } = call;
+    return spelled;
 }
 function firstEligibleAdmittingRule(rules, commandText, call) {
     for (const rule of rules) {
@@ -911,41 +928,28 @@ export function adjudicatePersistedRules(rules, call) {
     }
     return undefined;
 }
-export function adjudicatePersistedPathRules(rules, call, targets, bases) {
+export function adjudicatePersistedPathRules(rules, call, views, anchorsOf, leads) {
     const speaks = (rule, behavior) => eligiblePersisted(rule, call, behavior) ||
         (behavior === "ask" && call.face !== undefined && PATH_RULE_FACES[rule.tool]?.ask?.includes(call.face) === true && eligiblePersisted(rule, { ...call, tool: rule.tool }, behavior));
+    const bind = (rows) => bindPathRules(rows.map((rule) => ({ parsed: rule, ruleText: rule.rule, rule })), (s) => anchorsOf(s.rule));
     for (const behavior of RULE_BEHAVIORS_BY_PRECEDENCE) {
         if (behavior === "allow") {
-            if (targets.allow?.kind !== "path" || call.tool !== READ_RULE_TOOL)
+            if (views.allow === undefined || call.tool !== READ_RULE_TOOL)
                 continue;
-            for (const rule of rules) {
-                if (!eligiblePersisted(rule, call, behavior))
-                    continue;
-                if (directoryRuleAdmits(rule, targets.allow.identity, bases))
-                    return { behavior, rules: [rule] };
-            }
+            const hit = pathRowsReach(bind(rules.filter((rule) => rule.match === "subpath" && eligiblePersisted(rule, call, behavior))), views.allow, "allow");
+            if (hit !== undefined)
+                return { behavior, rules: [hit.row.spec.rule] };
             continue;
         }
-        const tighten = targets.tighten;
-        if (tighten === undefined || tighten.kind === "refused")
+        if (views.tighten === undefined)
             continue;
-        let unreadable;
-        for (const rule of rules) {
-            if (!speaks(rule, behavior))
-                continue;
-            if (tighten.kind === "unreadable") {
-                if (rule.match === "path" || rule.match === "subpath")
-                    unreadable ??= { behavior: "ask", rules: [rule], unreadable: tighten.reason };
-                continue;
-            }
-            const outcome = pathRuleReachOf(rule, tighten.identity, bases);
-            if (outcome.reach === "reached")
-                return { behavior, rules: [rule] };
-            if (outcome.reach === "unreadable")
-                unreadable ??= { behavior: "ask", rules: [rule], unreadable: outcome.reason };
-        }
-        if (unreadable !== undefined)
-            return unreadable;
+        const rows = rules.filter((rule) => (rule.match === "path" || rule.match === "subpath") && speaks(rule, behavior));
+        if (rows.length === 0)
+            continue;
+        const hit = pathRowsReach(rowsWhereTheyLead(bind(rows), leads), views.tighten, "tighten");
+        if (hit === undefined)
+            continue;
+        return hit.unreadable !== undefined ? { behavior: "ask", rules: [hit.row.spec.rule], unreadable: hit.unreadable } : { behavior, rules: [hit.row.spec.rule] };
     }
     return undefined;
 }
@@ -987,9 +991,9 @@ export function segmentCoverageOf(command, rules, call) {
                 (dir !== undefined && firstEligibleDirectoryRule(rules.persisted, dir, call) !== undefined) ||
                 proposed.some((p) => p.rule.tool === "Read"
                     ? dir !== undefined &&
-                        eligibleContext({ tool: p.rule.tool, scope: p.scope }, { tool: "Read", cwd: call.cwd, sessionId: call.sessionId }) &&
+                        eligibleContext({ tool: p.rule.tool, scope: p.scope }, { ...spelledScope(call), tool: "Read" }) &&
                         directoryRuleAdmits(p.rule, dir, basesOfCwd(call.execCwd ?? call.cwd))
-                    : eligibleContext({ tool: p.rule.tool, scope: p.scope }, call) && ruleAdmitsCommand(p.rule, segment)),
+                    : eligibleContext({ tool: p.rule.tool, scope: p.scope }, spelledScope(call)) && ruleAdmitsCommand(p.rule, segment)),
         };
     });
 }

package/dist/core/permission-rule-provider.d.ts

@@ -86,6 +86,13 @@ export interface EffectivePermissionRules {
      *  served that are not canonical session rows of this session). The org partition's lines ride
      *  `org.disclosures`. */
     disclosures: string[];
+    /** The durable rows left out because their project scope root is not a complete absolute path (a foreign writer's or a
+     *  hand edit's row): each row's text and its scope root as served (a non-string root as its type). Absent when none. The
+     *  reader tells the person (`permission.rule_row_dropped`). */
+    droppedRows?: ReadonlyArray<{
+        readonly rule: string;
+        readonly scopeRoot: string;
+    }>;
 }
 /**
  * The host-visible store, already anchored to one owner. One read verb, which never throws: each

package/dist/core/permission-rule-provider.js

@@ -1,5 +1,5 @@
 import { escapeForDisclosure } from "./permission-rule-model.js";
-import { PERMISSION_RULE_WRITER, errText, normalizePersistedRule, sameRuleIdentity, writerOf, } from "./permission-rule-store.js";
+import { PERMISSION_RULE_WRITER, errText, isValidDurableScope, normalizePersistedRule, sameRuleIdentity, writerOf, } from "./permission-rule-store.js";
 import { UNGOVERNED_ORG_RESOLUTION, compileOrgShadowPredicate, createOrgRulePartition } from "./permission-rule-org.js";
 export function ruleSourceOf(scope) {
     return scope.kind === "global" ? "user" : scope.kind;
@@ -80,7 +80,11 @@ class UnifiedPermissionRuleStore {
         const sessionRead = "unreadable" in sessionRows ? [] : sessionRows;
         const shadowed = compileOrgShadowPredicate(orgResolution.rules);
         const rules = [];
-        for (const r of [...sessionRead, ...durableRead.rules]) {
+        const illegal = durableRead.rules.filter((r) => !isValidDurableScope(r.scope));
+        const droppedRows = illegal.map((r) => ({ rule: String(r.rule), scopeRoot: scopeRootAsServed(r.scope.root) }));
+        if (illegal.length > 0)
+            disclosures.push(`the persisted rule partition served ${illegal.length} row(s) whose project scope root is not a complete absolute path — dropped, not adjudicated: ${illegal.slice(0, 3).map((r) => `${escapeForDisclosure(r.rule)} (${escapeForDisclosure(r.scope.root)})`).join(", ")}`);
+        for (const r of [...sessionRead, ...durableRead.rules.filter((x) => !illegal.includes(x))]) {
             rules.push({ ...r, source: ruleSourceOf(r.scope), status: r.behavior === "allow" && shadowed(r) ? "shadowed-by-org" : "live" });
         }
         const removed = [];
@@ -93,7 +97,7 @@ class UnifiedPermissionRuleStore {
                 continue;
             removed.push({ behavior: t.behavior, rule: t.rule, scope: t.scope, source: ruleSourceOf(t.scope), status: "removed" });
         }
-        return { rules, removed, org: orgResolution, rev: durableRead.rev, disclosures, ...failed };
+        return { rules, removed, org: orgResolution, rev: durableRead.rev, disclosures, ...failed, ...(droppedRows.length > 0 ? { droppedRows } : {}) };
     }
     async readSessionRows(sessionId, disclosures) {
         if (this.session === undefined || sessionId === undefined)
@@ -116,6 +120,9 @@ class UnifiedPermissionRuleStore {
         }
     }
 }
+function scopeRootAsServed(root) {
+    return typeof root === "string" ? root : `(${root === null ? "null" : typeof root})`;
+}
 function routingWriter(durable, session) {
     return {
         nextDot: () => durable.nextDot(),

package/dist/core/permission-rule-store.d.ts

@@ -457,6 +457,14 @@ export declare function isValidConsentScope(scope: RuleScope): boolean;
  * duty (design/382 §10): every such entrance, present or future, carries this face.
  */
 export declare function isValidDurableScope(scope: RuleScope): boolean;
+/**
+ * A PROJECT scope's root is a complete absolute path — `/…`, a drive-rooted `X:\…` / `X:/…`, a UNC `\host\…` — the one
+ * predicate every scope face reads (the consent face, the durable face, the sync wire's pick). It is what a project row's
+ * path patterns anchor at (its `/x` and relative words), so a root that is not one (`C:`, a relative spelling, empty)
+ * would let the row apply (containment is a prefix test) while its anchor reads nothing: such a row is refused at every
+ * write, dropped at every read, and disclosed.
+ */
+export declare function isProjectScopeRoot(root: unknown): root is string;
 /** Is `dot` at or below the frontier? Absent actor ⇒ not below (a frontier never covers what it never saw). */
 export declare function dotAtOrBelowFrontier(dot: RuleDot, frontier: RuleSyncFrontier): boolean;
 /**

package/dist/core/permission-rule-store.js

@@ -2,6 +2,7 @@ import { randomBytes } from "node:crypto";
 import { canonicalize } from "./canonical-json.js";
 import { escapeForDisclosure, isRuleBehavior, isRuleLive, parseRuleText } from "./permission-rule-model.js";
 import { thrownText } from "./thrown-value.js";
+import { isAbsolutePathForm } from "../tools/fs/safety.js";
 export function sameRuleOwner(a, b) {
     return a.kind === "principal" ? b.kind === "principal" && a.principal === b.principal : b.kind === "local-owner";
 }
@@ -143,12 +144,15 @@ export function assertWriteDeltaScopeDurable(delta) {
 export function isValidConsentScope(scope) {
     const sc = scope;
     return (sc?.kind === "global" ||
-        (sc?.kind === "project" && typeof sc.root === "string" && sc.root !== "") ||
+        (sc?.kind === "project" && isProjectScopeRoot(sc.root)) ||
         (sc?.kind === "session" && typeof sc.sessionId === "string" && sc.sessionId !== ""));
 }
 export function isValidDurableScope(scope) {
     const sc = scope;
-    return sc?.kind === "global" || (sc?.kind === "project" && typeof sc.root === "string" && sc.root !== "");
+    return sc?.kind === "global" || (sc?.kind === "project" && isProjectScopeRoot(sc.root));
+}
+export function isProjectScopeRoot(root) {
+    return typeof root === "string" && isAbsolutePathForm(root);
 }
 function isValidDot(dot) {
     const d = dot;

package/dist/core/permission-rule-sync.js

@@ -1,5 +1,5 @@
 import { escapeForDisclosure, isRuleBehavior, parseRuleText } from "./permission-rule-model.js";
-import { applyTombstones, errText, joinFrontiers, joinRuleStates, normalizePersistedRule, readRuleWriteOutcome, ruleSyncVector, sameRuleIdentity, screenRuleSyncState, writerOf, } from "./permission-rule-store.js";
+import { applyTombstones, errText, isProjectScopeRoot, joinFrontiers, joinRuleStates, normalizePersistedRule, readRuleWriteOutcome, ruleSyncVector, sameRuleIdentity, screenRuleSyncState, writerOf, } from "./permission-rule-store.js";
 import { emitTrace } from "./trace.js";
 export const PERMISSION_RULE_SYNC_PATH = "/v1/permission-rules/sync";
 export const LOCAL_OWNER_UNSYNCABLE_CODE = "permission_rules.local_owner_unsyncable";
@@ -262,7 +262,7 @@ function pickScopeCaptured(v) {
         return { kind, scope: { kind: "global" } };
     if (kind === "project") {
         const root = s?.root;
-        return { kind, scope: typeof root === "string" && root !== "" ? { kind: "project", root } : undefined };
+        return { kind, scope: isProjectScopeRoot(root) ? { kind: "project", root } : undefined };
     }
     if (kind === "session") {
         const sessionId = s?.sessionId;

package/dist/core/permission-rules.d.ts

@@ -22,6 +22,10 @@
  * (`programRunReachOf`: the whole command line or any program run in a connector chain — upstream's
  * per-subcommand deny, the same instrument the org partition and the personal store's deny/ask rows use;
  * a call the lexer cannot read against a rule is a fail-closed ask, never silence).
+ * The rule is written in the command word (`Bash`) and reaches every call on the catalog's SHELL FACE — `Bash`, and
+ * `Monitor`, which runs its `command` through the same execution seam — under any name the call answers to; a command
+ * spelling on another shell-face name (`Monitor(touch:*)`) is refused (`invalid.command_rule`, naming the `Bash(…)` form):
+ * upstream reads no such rule. A bare `Bash` rule is a tool-name rule and reaches the tool of that name only.
  * It sits in the field-level tier of the evaluation order — right after the bare deny (resp. ask) — which
  * is upstream's placement (`bs()` whole-tool deny → `AN(…,"deny")` field-level deny → `ph()` whole-tool
  * ask → `AN(…,"ask")` field-level ask).
@@ -30,11 +34,13 @@
  * `Edit(~/.sema/settings.json)` / `Write(src/**)` / `Read(//etc/**)` deny or ask compiles through the same
  * validator (the model's path grammar — the `//abs-dir/**` directory form and upstream's pattern form:
  * `//` absolute, `~/` home, `/` project root, otherwise working-directory relative; `*` within a segment,
- * `**` across) and is judged with `pathRuleReaches` on the call's PROTECTIVE path target (design/388: the
- * object face's declaration, the catalog's for the name as the floor). The bases a pattern resolves
- * against are the deployment's (`pathBases`); a pattern whose base the policy was not given is refused at
- * compile time (`unsupported.path_base`) rather than left to reach nothing at run time — a deny that
- * silently matches nothing is the failure form this module's header calls the most dangerous one.
+ * `**` across) and is judged on the call's PROTECTIVE path target (design/388: the object face's declaration, the
+ * catalog's for the name as the floor), every view of it (`callTargetViewsOf`), by the one judgment every path rule
+ * meets (`pathRowsReach`). A pattern's ANCHORS are the rule's own fact, taken once where the policy is installed: the
+ * declared `pathBases` word by word, else the leg the Runner installs the policy on (`policyAnchors`) — never the
+ * call's live working directory. A declared base that is not a usable absolute path is refused at compile time
+ * (`unsupported.path_base`); a policy called outside a Runner leg with no declared base reads such a rule
+ * `unreadable` (the fail-closed ask).
  * A `Read(...)` / `Edit(...)` deny or ask reaches the calls on its behavior's FACES (`PATH_RULE_FACES`), not only
  * its own tool: a `Read` ask asks for a Grep / Glob rooted in its path, judged on that call's own target.
  *
@@ -53,14 +59,8 @@
  */
 import type { NamedToolPolicy } from "./tool-policy.js";
 import { parsePermissionRule, type ParsedPermissionRule } from "./permission-rule-syntax.js";
-import { type ParsedRule, type PathRuleBases } from "./permission-rule-model.js";
-import type { DenyFace, PathRuleDenyRow } from "../tools/fs/read-deny.js";
+import { type PathRuleBases } from "./permission-rule-model.js";
 export { parsePermissionRule, type ParsedPermissionRule };
-/** [K-PLATFORM-SWEEP] MINOR#11: Bash's REAL non-primary arg names, accepted as generic param rules
- *  (`Bash(timeout:...)`). Exported SOLELY so a lockstep test can assert it against the live Bash tool
- *  schema — a schema param added without updating this set would compile to silently-never-matching
- *  rules (the exact drift class the Opus 复审 m note warned about). */
-export declare const BASH_GENERIC_PARAMS: ReadonlySet<string>;
 export interface PermissionRule {
     /** CC 语法:`"Tool"` 或 `"Tool(param:pattern)"`。`Tool()`/`Tool(*)` 归一为裸规则;括号可 `\(`/`\)` 转义。 */
     rule: string;
@@ -93,9 +93,10 @@ export interface PermissionRuleIssue {
      *  is an object/array (a rule on it can never match); the tool is unknown to the resolver a leg
      *  supplied (absent resolver ⇒ the catalog alone judges and an unknown tool stays permissive). */
      | "unsupported.param_unknown" | "unsupported.param_non_scalar" | "unsupported.tool_unknown"
-    /** A path-form deny/ask whose spelling needs a base this policy was not given (`/x` needs
-     *  `pathBases.root`; a relative pattern needs `pathBases.cwd` or `root`) — refused rather than compiled
-     *  into a rule that reaches nothing. */
+    /** A path-form deny/ask whose spelling needs a base this policy DECLARES as something other than an absolute path
+     *  of its tree's family (`/x` reads `pathBases.root`; a relative pattern `pathBases.cwd`, else `root`; `~/` `home`)
+     *  — a bad declared value, refused rather than compiled into a rule that reaches nothing. An undeclared base is no
+     *  refusal: the rule is anchored where the policy is installed. */
      | "unsupported.path_base" | "unsupported.mcp_paren"
     /** A parenthesised rule whose NAME is a covering spelling in a non-MCP protocol namespace
      *  (`a2a__<peer>__*(x:y)`, `a2a__<peer>(x:y)`). The param DSL is keyed by EXACT tool name, and a
@@ -143,16 +144,17 @@ export interface PermissionRulePolicyOptions {
      */
     ruleFaces?: (toolName: string) => RuleFaceView | undefined;
     /**
-     * The bases a path-form deny/ask pattern resolves against at match time ({@link PathRuleBases}): `root`
-     * for `/…` (the task's project root), `cwd` for a relative pattern (the root stands in when absent — the
-     * word's own meaning), `home` for `~/…` (the EXECUTION ENVIRONMENT's home — never the engine process's
-     * own; #644). Facts of the DEPLOYMENT and the task, never of the rule — a pattern is stored as spelled.
-     * A rule whose base is absent (or not an absolute path) here is refused at compile time
+     * The ANCHORS of this rule set's path patterns ({@link PathRuleBases}), word by word: `root` for `/…`, `cwd` for a
+     * relative pattern (the declared root stands in when absent — the word's own meaning), `home` for `~/…` (an
+     * execution environment's home — never the engine process's own; #644). A word declared here anchors the rules
+     * wherever the policy runs; a word left out is anchored where the Runner installs the policy — the root and the
+     * environment's home of the leg it enters the delegation chain on — and stays there for every child and every `cd`.
+     * A declared value that is not an absolute path of its tree's family is refused at compile time
      * (`unsupported.path_base`, naming the base — {@link ruleBasesNeeded} is the same classification).
-     * A call's own target resolves against these bases as given; when they hold neither `root` nor `cwd`,
-     * against the request's (`ToolCallRequest.root` / `.cwd`, stamped by the Runner) — never a mix of the two
-     * sources. A target neither supplies the base for is unreadable: every path rule able to reach the call
-     * answers it with the fail-closed ask (`ruleUnreadable`).
+     * These are the RULES' anchors, never the call's: a call's target is read from the call (its target reading, else its
+     * own `root` / `cwd`); only a host calling the policy directly with a request that carries neither has its target
+     * resolved against `root` / `cwd` here. A target nothing locates is unreadable: every path rule able to reach the
+     * call answers it with the fail-closed ask (`ruleUnreadable`).
      */
     pathBases?: PathRuleBases;
 }
@@ -205,28 +207,7 @@ export interface RuleFaceView {
 export declare function catalogRuleFaceView(toolName: string): RuleFaceView | undefined;
 /** Exported for the lockstep guard only (the scalar vocabulary of a catalog tool) — not part of the rule DSL. */
 export declare const fileToolParamVocabulary: (canonicalTool: string) => ReadonlySet<string> | undefined;
-/**
- * The deny-table row of ONE face-keyed path deny rule, resolved against `bases` — the row's reach IS the rule's (the same
- * parsed rule, the same bases). Every source of such rows builds them here: a policy's compiled rules, and the person's
- * persisted store rows. The caller holds the bases the pattern needs (`ruleBasesNeeded`): a row whose base is missing
- * reads `unreadable`, which this row treats as a reach — a deny row that cannot be judged holds.
- */
-export declare function pathRuleDenyRowOf(rule: {
-    readonly parsed: ParsedRule;
-    readonly ruleText: string;
-    readonly faces: readonly DenyFace[];
-}, bases: PathRuleBases): PathRuleDenyRow;
 /** Dry-run 校验/迁移报告:不 throw,返回全部 issues(含 `unsupported.*` 分类,
  *  供从 CC settings 迁移的部署逐条对照)。 */
 export declare function validatePermissionRules(rules: PermissionRule[], opts?: Pick<PermissionRulePolicyOptions, "primaryFieldGeneric" | "caps" | "ruleFaces" | "pathBases">): PermissionRuleIssue[];
-/**
- * Compile declarative permission rules into ONE {@link ToolPolicy} (design/127). Evaluation order
- * inside the policy (CC `G1e` :595272 isomorph): bare deny → command deny → param deny → bare ask →
- * command ask → param ask → bare allow → `defaultAction` (the content-form command tiers are the
- * field-level tiers of upstream's arbiter, beside the generic param tiers). `check()` is idempotent and side-effect-free (combinePolicies 契约);
- * all parsing/validation happens HERE, the hot path never re-parses.
- *
- * ⚠️ This policy states no allow: a call no rule reaches gets `defaultAction`, whose `"allow"` is "no objection" (states
- * nothing, clears nothing). Express default-closed via `defaultAction`, never via a trailing always-ask policy.
- */
 export declare function createPermissionRulePolicy(rules: PermissionRule[], opts?: PermissionRulePolicyOptions): NamedToolPolicy;