@sema-agent/core 7.48.0 → 7.49.0

package/dist/core/pause-registry.d.ts

@@ -20,8 +20,9 @@ import type { Checkpoint, CheckpointGate, CheckpointRow, PendingAction, ResumeOu
  *
  *  - `facet` — the deadline semantic a deployment's reaper applies (see {@link Checkpoint.deadline}):
  *    `A` = approval gates, whose `deadline` is an SLA resolve-deny; `B` = unattended-TTL gates, whose
- *    `deadline` is an abandonment TTL (`expire`/`reap` only — never a resolve-deny; these pauses produce
- *    no `tool_end` and therefore no settlement); `-` = the non-gate park (`task_done`).
+ *    `deadline` is an abandonment TTL (`expire`/`reap` only — never a resolve-deny, so a sweep's word is not a
+ *    decider on these rows; these pauses produce no `tool_end`, and the one that records its decider — the plan
+ *    pause — files the settlement on the resolved row alone); `-` = the non-gate park (`task_done`).
  *  - `taskStatus` — the `TaskResult.status` word a run assembles when it stops at this gate (approvals and
  *    resource slices read `suspended`; the two review pauses read `needs_review`).
  *  - `terminal` — `task_done` is the 1C handle / deployment-park convention, not a run pause core mints.
@@ -79,6 +80,19 @@ export type PendingKind = (typeof PAUSE_REGISTRY)[GateKind]["pending"];
 export type ResumeGate = (typeof PAUSE_REGISTRY)[GateKind]["resume"] | "wake";
 /** Runtime twin of {@link GateKind}. */
 export declare function isGateKind(v: unknown): v is GateKind;
+/** The deadline semantic of a parked row — the registry's `facet` column, read with the gate's card: a question parked
+ *  under an approval gate kind is not an approval, so its deadline voids it (`B`) instead of denying it (`A`). No gate
+ *  kind of its own (the once-only winner, the reaper deadline and the batch stay one family). Only the literal
+ *  `"question"` card marks a question. */
+export declare function facetOf(gate: {
+    readonly kind: GateKind;
+    readonly approvalCard?: unknown;
+}): "A" | "B" | "-";
+/** Is this parked row a question to the user: an approval-kind gate whose card is the reserved `"question"`. */
+export declare function isQuestionGate(gate: {
+    readonly kind: GateKind;
+    readonly approvalCard?: unknown;
+}): boolean;
 /** The one resume-match predicate: does this outcome gate word answer a checkpoint of this kind? `wake`
  *  answers any (it passed its own, stricter, non-gate validation upstream); every other word must be the
  *  row's `resume` column. Replaces a six-arm hand-written disjunction. */

package/dist/core/pause-registry.js

@@ -9,6 +9,12 @@ export const PAUSE_REGISTRY = {
 export function isGateKind(v) {
     return typeof v === "string" && Object.prototype.hasOwnProperty.call(PAUSE_REGISTRY, v);
 }
+export function facetOf(gate) {
+    return isQuestionGate(gate) ? "B" : PAUSE_REGISTRY[gate.kind].facet;
+}
+export function isQuestionGate(gate) {
+    return PAUSE_REGISTRY[gate.kind].pending === "tool_approval" && gate.approvalCard === "question";
+}
 export function resumeGateMatches(gateKind, outcomeGate) {
     return outcomeGate === "wake" || PAUSE_REGISTRY[gateKind].resume === outcomeGate;
 }

package/dist/core/permission-rule-consent.js

@@ -736,13 +736,6 @@ export async function prepareCcImport(opts) {
                     skipped.push({ rule: String(entry), reason: `settings ${behavior} entry is not a string` });
                     continue;
                 }
-                if (behavior === "allow" && entry.startsWith("Read(") && "reject" in parseRuleText(entry, behavior)) {
-                    skipped.push({
-                        rule: entry,
-                        reason: "unsupported.form: only the Read(//abs-dir/**) directory form imports in v1 — this entry stays in the settings file, unimported",
-                    });
-                    continue;
-                }
                 if (!/^[A-Za-z][A-Za-z0-9_]*\(.*\)$/.test(entry)) {
                     const reason = /^[A-Za-z][A-Za-z0-9_-]*$/.test(entry)
                         ? "unsupported.form: a bare tool-name entry is a name-set item, not a command rule — it stays in the settings file, unimported"

package/dist/core/permission-rule-model.d.ts

@@ -118,12 +118,8 @@ export declare const RULE_BEHAVIORS_BY_PRECEDENCE: readonly RuleBehavior[];
  * fabricated tightening is still a fabrication).
  */
 export declare function readRowBehavior(v: unknown): RuleBehavior | undefined;
-/** The tools the rule lane speaks for. `"Bash"` is the historical member; `"Read"` (design/382 §2.2)
- *  speaks EXACTLY ONE grammar — the double-slash directory form `Read(//abs/**)`, the directory
- *  read-authorization a compound card's cd segment mints — and its admission is the CLOSED two-point
- *  one on {@link directoryRuleAdmits}: a Read tool call under the directory, and a compound's cd
- *  segment resolving into it. Nothing else — never a write, never a whole Bash command, never a
- *  non-cd segment.
+/** The tools the rule lane speaks for — derived per grammar ({@link ruleToolGrammarOf}): the command word, every catalog
+ *  path tool, the name tools, the domain tools.
  *
  *  design/276 §3.3 (doctrine, for whoever widens this set): a future `SendMessage(…)`-form rule MAY
  *  clear the peer-referral ask — that ask is classifier hesitation by construction (#144: allow rules
@@ -135,7 +131,7 @@ export type PersistedRuleTool = string;
  *  A rule word, not a tool list: the calls a command rule reaches are the SHELL FACE's — every catalog definition whose
  *  `command` the command grammar judges ({@link laneToolNamesOf}). */
 export declare const COMMAND_RULE_TOOL = "Bash";
-/** The one tool whose path family has an ALLOW form (the `Read(//abs-dir/**)` directory grant). */
+/** The read face's rule word: a `Read(<path>)` rule speaks for every call that reads a path ({@link PATH_RULE_FACES}). */
 export declare const READ_RULE_TOOL = "Read";
 /**
  * The path rules that speak for a FACE rather than for one tool — one table, one column per tightening behavior (the
@@ -150,8 +146,13 @@ export declare const READ_RULE_TOOL = "Read";
  * results and reach the shell's file commands; an ask is a question asked at the gate before the call runs, so it is
  * judged there, on the call's own path target only — it does not descend (a search rooted above the asked path is not
  * asked, and its results are not filtered).
+ *
+ * The ALLOW column is the reference's too: an allow by path is read on these two tools only — a `Read(<path>)` allow speaks
+ * for the read face, an `Edit(<path>)` allow for the write face and the read face (an edit allowed is a read allowed) — and
+ * an allow by path on any other tool has no rule form. It is judged at the gate with the narrow reading
+ * ({@link adjudicatePersistedPathRules}): every view of the call's target must lie where the rule names.
  */
-export declare const PATH_RULE_FACES: Readonly<Record<string, Readonly<Partial<Record<"deny" | "ask", readonly DenyFace[]>>>>>;
+export declare const PATH_RULE_FACES: Readonly<Record<string, Readonly<Partial<Record<RuleBehavior, readonly DenyFace[]>>>>>;
 /** The face a call's protective path target is on: `read` for a read slot, `write` for every other access; none without
  *  one — the face a {@link PATH_RULE_FACES} rule is judged against, in a rule policy and in the persisted rule lane alike. */
 export declare function callPathFaceOf(call: ToolCallLike): DenyFace | undefined;
@@ -168,27 +169,44 @@ export declare const NAME_RULE_FACES: Readonly<Record<string, {
     readonly param: string;
     readonly params: readonly string[];
 }>>;
+/**
+ * The tools whose rule content names the HOST of the URL one parameter carries — the reference's `WebFetch(domain:<host>)`
+ * form, one row per tool: `param` is the URL argument the host is read from ({@link domainRuleSubjectOf}). Read by
+ * {@link parseDomainRuleContent}; an allow only (see there).
+ */
+export declare const DOMAIN_RULE_FACES: Readonly<Record<string, {
+    readonly param: string;
+}>>;
 /**
  * Which tools a rule may name — the model's tool set is DERIVED, never a hand-kept list: the command rule word
  * ({@link COMMAND_RULE_TOOL}) takes the COMMAND grammar — the other shell-face tools take none of their own, their command is
  * judged by the `Bash(…)` rules ({@link laneToolNamesOf}); every tool the catalog declares a path target for (Read / Edit / Write /
- * Glob / NotebookEdit / …, `pathTargetOf`) takes the PATH grammar; the tools of {@link NAME_RULE_FACES} take the NAME grammar.
+ * Glob / NotebookEdit / …, `pathTargetOf`) takes the PATH grammar; the tools of {@link NAME_RULE_FACES} take the NAME grammar;
+ * the tools of {@link DOMAIN_RULE_FACES} the DOMAIN grammar.
  * A rule on any other tool has no content this model can judge and is refused (`unsupported.tool`). The tool set therefore
  * moves with the catalog's declarations, exactly as the protective fences' covered set does.
  */
-export declare function ruleToolGrammarOf(toolName: string): "command" | "path" | "name" | undefined;
+export type RuleGrammar = "command" | "path" | "name" | "domain";
+export declare function ruleToolGrammarOf(toolName: string): RuleGrammar | undefined;
+/**
+ * The HOST a domain-grammar tool's call fetches — the string every DOMAIN rule is read against — or undefined: not a domain
+ * tool; no URL argument, or one that is not a string; a URL that does not parse, is not http(s), or carries credentials (the
+ * fetch tool refuses those itself). The host is the URL parser's (lower case, IDN in its ASCII form, an IPv4 shorthand
+ * expanded — the host the fetch connects to), its trailing dots read off.
+ */
+export declare function domainRuleSubjectOf(toolName: string, args: unknown): string | undefined;
 /** The value a name-grammar tool's call carries in its name argument — the string every NAME rule is read against, the one a
  *  `Skill` call is resolved by — or undefined (not a name-grammar tool; no such argument; not a string). */
 export declare function nameRuleSubjectOf(toolName: string, args: unknown): string | undefined;
 /** The rule WORDS a call is judged under, once each: for every name the call answers to (the model's spelling, the wire
  *  name, the other aliases that resolve to it), the word its rules are written in — a shell-face name's is the command
- *  grammar's {@link COMMAND_RULE_TOOL} (a `Bash(<command>)` rule reaches `Monitor` as it reaches `Bash`), a path or name
- *  tool's its own name — so a stored `Bash(…)` or `Edit(…)` row reaches a tool that answers to that name under another wire
+ *  grammar's {@link COMMAND_RULE_TOOL} (a `Bash(<command>)` rule reaches `Monitor` as it reaches `Bash`), a path, name or
+ *  domain tool's its own name — so a stored `Bash(…)` or `Edit(…)` row reaches a tool that answers to that name under another wire
  *  name, as a policy's rule does. Every lane that judges a call by a rule's word reads it here: the policy compiler, the
  *  person's stored rows, the org partition, the allow lists. Empty ⇒ no grammar speaks for the call. */
 export declare function laneToolNamesOf(req: Pick<import("./tool-policy.js").ToolCallRequest, "toolName" | "face">): readonly string[];
 /**
- * Match forms. Four members, two of them one predicate:
+ * Match forms, one family per grammar (`prefix` and `wildcard` are one predicate):
  *  · `exact` — admits the one string the rule spells.
  *  · `wildcard` — the TRAILING SPACE-STAR spelling (`Bash(npm run *)`): the body, or the body followed
  *    by a space and more, inside the body's own segment count. This is the spelling upstream itself
@@ -202,15 +220,18 @@ export declare function laneToolNamesOf(req: Pick<import("./tool-policy.js").Too
  *    compound and importing/minting one as a chain licence would grant what nobody approved.
  *  · `subpath` — the directory form (design/382 §2.2): `Tool(//abs-dir/**)`, reaching every path under
  *    one absolute directory. Never admits any command; its one predicate is {@link directoryRuleAdmits}.
- *    As an ALLOW it exists for the Read tool only (a standing yes to reads under a directory); as a
- *    deny/ask it is legal on every path-targeting tool.
- *  · `path` — the PATH PATTERN form, deny/ask only: upstream's file-rule spelling over a tool's path
- *    target (`Edit(~/.sema/settings.json)`, `Write(src/**)`, `Read(//etc/*)`), stored AS SPELLED and
+ *    As an ALLOW it exists on the two face tools ({@link PATH_RULE_FACES}); as a deny/ask on every
+ *    path-targeting tool.
+ *  · `path` — the PATH PATTERN form: upstream's file-rule spelling over a tool's path target
+ *    (`Edit(~/.sema/settings.json)`, `Write(src/**)`, `Read(//etc/*)`), stored AS SPELLED and
  *    resolved at match time against the call's bases (`//` absolute, `~/` home, `/` project root,
- *    otherwise the working directory). Its predicate is {@link pathRuleReaches}. Not an allow form: a
- *    standing approval by path pattern would be a wider grant than any card ever shows a person.
+ *    otherwise the working directory). Its predicate is {@link pathRuleReachOf}. As an ALLOW it exists
+ *    on the two face tools, judged with the narrow reading (every view of the target inside the pattern).
+ *  · `name` / `name_prefix` — the NAME grammar ({@link parseNameRuleContent}).
+ *  · `host` / `subdomain` — the DOMAIN grammar ({@link parseDomainRuleContent}): one exact host, or every
+ *    host below one domain.
  */
-export type PersistedRuleMatch = "exact" | "prefix" | "wildcard" | "subpath" | "path" | "name" | "name_prefix";
+export type PersistedRuleMatch = "exact" | "prefix" | "wildcard" | "subpath" | "path" | "name" | "name_prefix" | "host" | "subdomain";
 /**
  * Where a rule applies — design/382 §4.1, the THREE consent dimensions.
  *
@@ -403,6 +424,9 @@ export declare const BARE_INTERPRETER_NAMES: ReadonlySet<string>;
  * `! node -e …` is the `node` licence the interpreter table exists to refuse, wearing one extra token.
  * `{`/`}`/`[[`/`]]` are already refused by the floor's argv[0] metacharacter rule; listed anyway,
  * because that rule belongs to another module and is not this lane's to depend on.
+ *
+ * The words are the shell-word table's `rule_reserved` role (`src/shell/shell-words.ts`): the table is where a word's
+ * grammar is stated once, and this lane only reads the projection.
  */
 export declare const SHELL_RESERVED_WORDS: ReadonlySet<string>;
 /**
@@ -474,6 +498,10 @@ export declare function escapeForDisclosure(value: unknown): string;
  * the scanner while it runs, and the render's own strip would then glue it back together in clear
  * AFTER the scanner missed it. Strip first, scan, then render: the render's strip is idempotent over
  * text this already stripped, so the final bytes are the same as a single render, minus the leak.
+ *
+ * It knows nothing of the engine's envelope defusal and needs to know nothing: a defused tag or
+ * fence sentinel (untrusted-text.ts) is spelled with printable ASCII, so this pass — and any other
+ * format-character cleaning a downstream layer applies to a defused string — leaves it as it was.
  */
 export declare function stripFormatCharacters(text: string): string;
 /**
@@ -547,6 +575,9 @@ export declare function formatRuleText(command: string, match: PersistedRuleMatc
 /** Does a name rule reach this name? `name`: equal; `name_prefix`: begins with it (no boundary — the reference's `startsWith`).
  *  A rule of any other family reaches no name. */
 export declare function nameRuleAdmits(rule: Pick<PersistedRule, "match" | "command">, name: string): boolean;
+/** Does a domain rule reach this host (as {@link domainRuleSubjectOf} reads it)? `host`: equal; `subdomain`: a name ending in
+ *  `.<domain>` with at least one label before it and no empty label. A rule of any other family reaches no host. */
+export declare function domainRuleAdmits(rule: Pick<PersistedRule, "match" | "command">, host: string): boolean;
 /**
  * The closed set of BASES a path-form pattern resolves against — facts of the CALL (its execution
  * environment and its task), never of the rule:
@@ -946,16 +977,17 @@ export declare function adjudicatePersistedRules(rules: readonly PersistedRule[]
 /**
  * The path-family sibling of {@link adjudicatePersistedRules}: the same precedence walk over the rules
  * of one path-targeting tool, judged on the call's target views by the one judgment every path rule meets
- * ({@link pathRowsReach}: rows outer, views inner).
+ * (`judgePathRows`: rows outer, views inner).
  *
  * TWO readings, because the two directions read the call's path slot differently (design/388 B6/B17): the
  * tightening arms judge the PROTECTIVE reading's views (`views.tighten` — the object face's declaration, the catalog's
  * for the name as the floor: reading the catalog for an undeclared same-name tool can only tighten a deny), every row
  * also where its head leads (`leads`, the judging leg's resolution); the allow arm judges the DECLARED reading's views
  * (`views.allow` — the face's OWN declaration only: a same-name tool that declares no path target is unconfirmable, and
- * no grant admits it) with the directory rows, for the Read tool ONLY — a directory allow is a standing yes to reads,
- * never to a write — and admits only when every view lies under the directory. Either reading may be absent (no
- * resolvable path in that reading); the arm that needs it then speaks for nothing.
+ * no grant admits it) — the NARROW reading: a row speaks for a call on a face its {@link PATH_RULE_FACES} allow column
+ * holds, and admits it only when it admits EVERY view (a link out of the named place is not admitted through its
+ * spelling, a case twin is another spelling, no row is judged where its head leads, an unreadable view is admitted by
+ * nothing). Either reading may be absent (no resolvable path in that reading); the arm that needs it then speaks for nothing.
  *
  * A row is anchored by `anchorsOf` (the person's rows: a project row at its scope root, the rest at the chain's top leg).
  *
@@ -989,6 +1021,18 @@ export declare function adjudicatePersistedNameRules(rules: readonly PersistedRu
     sessionId?: string;
     scopeIdentity?: ScopeRootIdentity;
 }): PersistedRuleVerdict | undefined;
+/**
+ * The domain-family sibling of {@link adjudicatePersistedNameRules}: the rules of one domain tool ({@link DOMAIN_RULE_FACES})
+ * judged on the host the call fetches ({@link domainRuleSubjectOf}) by {@link domainRuleAdmits}; the first table-order rule
+ * that is eligible and admits the host is the answer. The grammar has an allow form only, so only an allow can speak.
+ */
+export declare function adjudicatePersistedDomainRules(rules: readonly PersistedRule[], call: {
+    tool: string;
+    host: string | undefined;
+    cwd: string | undefined;
+    sessionId?: string;
+    scopeIdentity?: ScopeRootIdentity;
+}): PersistedRuleVerdict | undefined;
 /**
  * The ONE offer a name tool's approval card carries: the exact rule for the name the call carries (`Skill(<name>)`, the reference's
  * "don't ask again for <skill>" row), or undefined when no rule spells exactly that name (the round-trip law: the canonical text,

package/dist/core/permission-rule-model.js

@@ -1,4 +1,5 @@
 import { homedir } from "node:os";
+import { shellWordsOf } from "../shell/shell-words.js";
 import { parsePermissionRule } from "./permission-rule-syntax.js";
 import { compileReadDeny } from "../tools/fs/read-deny.js";
 import { carriesShellRedirection, parseLeadingCommandName, splitShellCompoundSegments } from "../tools/fs/bash-readonly-classifier.js";
@@ -6,7 +7,7 @@ import { inlineUntrusted } from "./untrusted-text.js";
 import { isShellFaceToolName, pathTargetOf, protectivePathTargetOf } from "./tool-registry.js";
 import { heldValues } from "./tool-name-readings.js";
 import { carriesDotSegment, isAbsoluteForFamily, isIdentityDir, isPathIdentity, isShellRootedSpellingUnmapped, isUncIdentity, pathFamilyOf, pathIdentityOf } from "../tools/fs/safety.js";
-import { bindPathRules, pathRowsReach, rowsWhereTheyLead } from "./path-rule-binding.js";
+import { bindPathRules, judgeRuleRows, rowsWhereTheyLead } from "./path-rule-binding.js";
 import { readShellCommand } from "./shell-lexer.js";
 import { readOnlyLineObjection, readOnlyShellVerdict } from "./read-only-shell.js";
 export const RULE_BEHAVIORS = Object.freeze(["deny", "ask", "allow"]);
@@ -30,8 +31,8 @@ if (!isShellFaceToolName(COMMAND_RULE_TOOL))
     throw new Error(`permission rules: the command rule word ${JSON.stringify(COMMAND_RULE_TOOL)} names no definition on the catalog's shell face`);
 export const READ_RULE_TOOL = "Read";
 export const PATH_RULE_FACES = Object.freeze({
-    [READ_RULE_TOOL]: Object.freeze({ deny: Object.freeze(["read", "write"]), ask: Object.freeze(["read"]) }),
-    Edit: Object.freeze({ deny: Object.freeze(["write"]), ask: Object.freeze(["write"]) }),
+    [READ_RULE_TOOL]: Object.freeze({ deny: Object.freeze(["read", "write"]), ask: Object.freeze(["read"]), allow: Object.freeze(["read"]) }),
+    Edit: Object.freeze({ deny: Object.freeze(["write"]), ask: Object.freeze(["write"]), allow: Object.freeze(["write", "read"]) }),
 });
 export function callPathFaceOf(call) {
     const target = protectivePathTargetOf(call);
@@ -43,13 +44,37 @@ export function faceAskSpeaksFor(face) {
 export const NAME_RULE_FACES = Object.freeze({
     Skill: Object.freeze({ param: "skill", params: Object.freeze(["skill", "args"]) }),
 });
+export const DOMAIN_RULE_FACES = Object.freeze({
+    WebFetch: Object.freeze({ param: "url" }),
+});
 export function ruleToolGrammarOf(toolName) {
     if (toolName === COMMAND_RULE_TOOL)
         return "command";
     if (Object.hasOwn(NAME_RULE_FACES, toolName))
         return "name";
+    if (Object.hasOwn(DOMAIN_RULE_FACES, toolName))
+        return "domain";
     return pathTargetOf(toolName) !== undefined ? "path" : undefined;
 }
+export function domainRuleSubjectOf(toolName, args) {
+    const face = Object.hasOwn(DOMAIN_RULE_FACES, toolName) ? DOMAIN_RULE_FACES[toolName] : undefined;
+    if (face === undefined || typeof args !== "object" || args === null || Array.isArray(args) || !Object.hasOwn(args, face.param))
+        return undefined;
+    const value = args[face.param];
+    if (typeof value !== "string")
+        return undefined;
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        return undefined;
+    }
+    if ((url.protocol !== "http:" && url.protocol !== "https:") || url.username !== "" || url.password !== "")
+        return undefined;
+    const host = url.hostname.replace(/\.+$/, "");
+    return host === "" ? undefined : host;
+}
 export function nameRuleSubjectOf(toolName, args) {
     const face = Object.hasOwn(NAME_RULE_FACES, toolName) ? NAME_RULE_FACES[toolName] : undefined;
     if (face === undefined || typeof args !== "object" || args === null || Array.isArray(args) || !Object.hasOwn(args, face.param))
@@ -83,11 +108,7 @@ export const BARE_INTERPRETER_NAMES = new Set([
     "setsid", "flock", "unshare", "nsenter", "script", "numactl", "prlimit", "systemd-run", "parallel",
     "strace", "ltrace", "valgrind", "gdb", "lldb", "perf", "firejail", "bwrap",
 ]);
-export const SHELL_RESERVED_WORDS = new Set([
-    "!", "[[", "]]", "{", "}", "((", "))",
-    "case", "esac", "coproc", "do", "done", "elif", "else", "fi", "for",
-    "function", "if", "in", "select", "then", "time", "until", "while",
-]);
+export const SHELL_RESERVED_WORDS = shellWordsOf("rule_reserved");
 export const SUGGESTION_LEXICON = [
     "git stash list", "git stash show", "git stash push", "git stash pop", "git stash drop",
     "git remote show", "git worktree list", "git submodule update", "git submodule status",
@@ -274,8 +295,10 @@ export function parseRuleText(text, behavior) {
         const grammar = ruleToolGrammarOf(parsed.toolName);
         if (grammar === "name")
             return parseNameRuleContent(text, parsed.toolName, parsed.ruleContent, behavior);
+        if (grammar === "domain")
+            return parseDomainRuleContent(text, parsed.toolName, parsed.ruleContent, behavior);
         if (grammar !== "path") {
-            return reject("unsupported.tool", `only Bash command rules, rules on path-targeting tools (Read, Edit, Write, …) and Skill name rules have a rule form in this version (got "${parsed.toolName}")`);
+            return reject("unsupported.tool", `only Bash command rules, rules on path-targeting tools (Read, Edit, Write, …), Skill name rules and WebFetch domain rules have a rule form in this version (got "${parsed.toolName}")`);
         }
         return parsePathRuleContent(text, parsed.toolName, parsed.ruleContent, behavior);
     }
@@ -332,6 +355,8 @@ export function formatRuleText(command, match, tool) {
         return `${tool}(//${command.startsWith("/") ? command.slice(1) : command}/**)`;
     if (match === "path" || match === "name")
         return `${tool}(${command})`;
+    if (match === "host" || match === "subdomain")
+        return `${tool}(domain:${match === "subdomain" ? "*." : ""}${command})`;
     return `${tool}(${command}${match === "prefix" || match === "name_prefix" ? ":*" : match === "wildcard" ? " *" : ""})`;
 }
 function parseNameRuleContent(text, tool, content, behavior, verifyCanonical = true) {
@@ -371,7 +396,60 @@ export function nameRuleAdmits(rule, name) {
         return name.startsWith(rule.command);
     return false;
 }
+function parseDomainRuleContent(text, tool, content, behavior) {
+    if (behavior !== "allow") {
+        return reject("unsupported.tool", `a ${tool} rule by host has an allow form only in this version ("${text}") — a ${behavior} by host is not read; write the ${behavior} on the whole ${tool} tool`);
+    }
+    if (!content.startsWith("domain:")) {
+        return reject("invalid.grammar", `a ${tool} rule names a host: ${tool}(domain:<host>) for one, ${tool}(domain:*.<domain>) for every host below a domain ("${text}")`);
+    }
+    const spelled = content.slice("domain:".length);
+    if (spelled === "*")
+        return reject("unsupported.wildcard", `"${text}" names every host — the whole tool is the bare ${tool} entry`);
+    const below = spelled.startsWith("*.");
+    const body = below ? spelled.slice(2) : spelled;
+    if (body.includes("*")) {
+        return reject("unsupported.wildcard", `a \`*\` in "${text}" other than a leading \`*.\` has no rule form — a ${tool} rule names one host, or every host below one domain with \`*.<domain>\``);
+    }
+    const host = hostOfSpelling(body);
+    if (host === undefined || hostOfSpelling(host) !== host) {
+        return reject("invalid.grammar", `"${text}" does not name a host alone — write the host as a URL carries it, with no scheme, path, port or credentials`);
+    }
+    if (below && isAddressHost(host))
+        return reject("invalid.grammar", `"${text}" names hosts below an address, which has none — write the address itself`);
+    const match = below ? "subdomain" : "host";
+    return { rule: { behavior, rule: formatRuleText(host, match, tool), tool, match, command: host } };
+}
+function hostOfSpelling(spelled) {
+    if (spelled === "" || /[\s/\\@?#%]/.test(spelled) || (spelled.includes(":") && !/^\[[^\]]+\]$/.test(spelled)))
+        return undefined;
+    let url;
+    try {
+        url = new URL(`https://${spelled}/`);
+    }
+    catch {
+        return undefined;
+    }
+    if (url.port !== "" || url.username !== "" || url.password !== "" || url.pathname !== "/" || url.search !== "" || url.hash !== "")
+        return undefined;
+    const host = url.hostname.replace(/\.+$/, "");
+    return host === "" ? undefined : host;
+}
+function isAddressHost(host) {
+    return host.startsWith("[") || /^\d+\.\d+\.\d+\.\d+$/.test(host);
+}
+export function domainRuleAdmits(rule, host) {
+    if (rule.match === "host")
+        return host === rule.command;
+    if (rule.match !== "subdomain" || isAddressHost(host) || !host.endsWith(`.${rule.command}`))
+        return false;
+    const labels = host.slice(0, -(rule.command.length + 1));
+    return labels !== "" && !labels.split(".").includes("");
+}
 function parsePathRuleContent(text, tool, content, behavior) {
+    if (behavior === "allow" && PATH_RULE_FACES[tool]?.allow === undefined) {
+        return reject("unsupported.tool", `an allow by path is read on Read and Edit rules only — an Edit rule speaks for every tool that edits a file, a Read rule for every tool that reads one ("${text}"); write Edit(<path>) or Read(<path>)`);
+    }
     const dirForm = /^\/\/(.+)\/\*\*$/.exec(content);
     if (dirForm !== null) {
         const bodyR = dirForm[1];
@@ -385,17 +463,9 @@ function parsePathRuleContent(text, tool, content, behavior) {
         if (segments.some((sg) => sg === "." || sg === "..")) {
             return reject("invalid.path_traversal", `the directory body of "${text}" carries a \`.\` or \`..\` segment — the lexical normal form is the only accepted spelling, and a traversal segment is not normalized away`);
         }
-        if (behavior === "allow" && tool !== READ_RULE_TOOL) {
-            return reject("unsupported.tool", `an allow rule on a path tool speaks for the Read directory form only — a standing approval of a WRITE by directory is not a rule form ("${text}"); write it as a deny or an ask, or approve the call`);
-        }
         const dir = "/" + bodyR;
         return { rule: { behavior, rule: formatRuleText(dir, "subpath", tool), tool, match: "subpath", command: dir } };
     }
-    if (behavior === "allow") {
-        return tool === READ_RULE_TOOL
-            ? reject("invalid.grammar", `only the Read(//abs-dir/**) directory form is a rule this version reads ("${text}") — relative, single-file, single-slash and no-tail spellings have no rule form`)
-            : reject("unsupported.tool", `an allow rule on "${tool}" has no rule form — only the Read directory form is a standing approval by path ("${text}"); write it as a deny or an ask, or approve the call`);
-    }
     if (content.trim() !== content || content === "") {
         return reject("invalid.grammar", `the path pattern of "${text}" is empty or carries surrounding whitespace — the pattern is stored as spelled, so the spelling must be the one meant`);
     }
@@ -458,7 +528,7 @@ function resolvePathPattern(pattern, bases, behavior, treeFamily = pathFamilyOf(
     }
     const needed = ruleBasesNeeded({ match: "path", command: pattern })[0];
     const baseValue = baseValueOf(needed, bases);
-    const base = baseValue !== undefined && isAbsoluteForFamily(family, baseValue) ? pathIdentityOf(baseValue, family, tree) : undefined;
+    const base = baseValue !== undefined && isAbsoluteForFamily(family ?? "own", baseValue) ? pathIdentityOf(baseValue, family, tree) : undefined;
     if (base === undefined || !base.ok)
         return { missingBase: needed };
     const normal = base.identity;
@@ -470,7 +540,7 @@ function resolvePathPattern(pattern, bases, behavior, treeFamily = pathFamilyOf(
     return { resolved: (normal === "/" ? "" : normal) + "/" + body };
 }
 export function isUsablePathBase(base, family) {
-    return base !== undefined && isAbsoluteForFamily(family, base) && pathIdentityOf(base, family, base).ok;
+    return base !== undefined && isAbsoluteForFamily(family ?? "own", base) && pathIdentityOf(base, family, base).ok;
 }
 function segmentGlobMatches(glob, segment) {
     if (!glob.includes("*"))
@@ -790,7 +860,7 @@ function userHomeTopLevel() {
     }
     return HOME_TOP_LEVEL === null ? undefined : HOME_TOP_LEVEL;
 }
-const CURSOR_MOVING_HEADS = new Set(["cd", "pushd", "popd"]);
+const CURSOR_MOVING_HEADS = shellWordsOf("base_mover");
 const OPAQUE_CURSOR_MOVERS = new Set(["eval", "source", ".", "trap", "enable", "builtin", "command", "time"]);
 function pushdPopdLeavesCursor(head, args) {
     for (const a of args) {
@@ -817,7 +887,7 @@ function movesShellCursor(segment) {
         return true;
     if (!CURSOR_MOVING_HEADS.has(head))
         return false;
-    return !((head === "pushd" || head === "popd") && pushdPopdLeavesCursor(head, words.slice(1)));
+    return !(shellWordsOf("stack_mover").has(head) && pushdPopdLeavesCursor(head, words.slice(1)));
 }
 function resolveCdSegmentDirectories(segments, cwd) {
     let priorCd = false;
@@ -934,9 +1004,11 @@ export function adjudicatePersistedPathRules(rules, call, views, anchorsOf, lead
     const bind = (rows) => bindPathRules(rows.map((rule) => ({ parsed: rule, ruleText: rule.rule, rule })), (s) => anchorsOf(s.rule));
     for (const behavior of RULE_BEHAVIORS_BY_PRECEDENCE) {
         if (behavior === "allow") {
-            if (views.allow === undefined || call.tool !== READ_RULE_TOOL)
+            const face = call.face;
+            if (views.allow === undefined || face === undefined)
                 continue;
-            const hit = pathRowsReach(bind(rules.filter((rule) => rule.match === "subpath" && eligiblePersisted(rule, call, behavior))), views.allow, "allow");
+            const allowing = rules.filter((rule) => (rule.match === "path" || rule.match === "subpath") && PATH_RULE_FACES[rule.tool]?.allow?.includes(face) === true && eligiblePersisted(rule, { ...call, tool: rule.tool }, behavior));
+            const hit = judgeRuleRows(bind(allowing), views.allow, "allow");
             if (hit !== undefined)
                 return { behavior, rules: [hit.row.spec.rule] };
             continue;
@@ -946,7 +1018,7 @@ export function adjudicatePersistedPathRules(rules, call, views, anchorsOf, lead
         const rows = rules.filter((rule) => (rule.match === "path" || rule.match === "subpath") && speaks(rule, behavior));
         if (rows.length === 0)
             continue;
-        const hit = pathRowsReach(rowsWhereTheyLead(bind(rows), leads), views.tighten, "tighten");
+        const hit = judgeRuleRows(rowsWhereTheyLead(bind(rows), leads), views.tighten, "tighten");
         if (hit === undefined)
             continue;
         return hit.unreadable !== undefined ? { behavior: "ask", rules: [hit.row.spec.rule], unreadable: hit.unreadable } : { behavior, rules: [hit.row.spec.rule] };
@@ -964,6 +1036,15 @@ export function adjudicatePersistedNameRules(rules, call) {
     }
     return undefined;
 }
+export function adjudicatePersistedDomainRules(rules, call) {
+    if (call.host === undefined)
+        return undefined;
+    for (const rule of rules) {
+        if (eligiblePersisted(rule, call, "allow") && domainRuleAdmits(rule, call.host))
+            return { behavior: "allow", rules: [rule] };
+    }
+    return undefined;
+}
 export function suggestRuleForName(tool, name) {
     if (ruleToolGrammarOf(tool) !== "name")
         return undefined;

package/dist/core/permission-rule-store.js

@@ -2,7 +2,7 @@ import { randomBytes } from "node:crypto";
 import { canonicalize } from "./canonical-json.js";
 import { escapeForDisclosure, isRuleBehavior, isRuleLive, parseRuleText } from "./permission-rule-model.js";
 import { thrownText } from "./thrown-value.js";
-import { isAbsolutePathForm } from "../tools/fs/safety.js";
+import { validatePath } from "./effective-path-target.js";
 export function sameRuleOwner(a, b) {
     return a.kind === "principal" ? b.kind === "principal" && a.principal === b.principal : b.kind === "local-owner";
 }
@@ -152,7 +152,7 @@ export function isValidDurableScope(scope) {
     return sc?.kind === "global" || (sc?.kind === "project" && isProjectScopeRoot(sc.root));
 }
 export function isProjectScopeRoot(root) {
-    return typeof root === "string" && isAbsolutePathForm(root);
+    return validatePath(root, { intent: "validate-coordinate" }) !== undefined;
 }
 function isValidDot(dot) {
     const d = dot;

package/dist/core/permission-rules.d.ts

@@ -36,7 +36,7 @@
  * `//` absolute, `~/` home, `/` project root, otherwise working-directory relative; `*` within a segment,
  * `**` across) and is judged on the call's PROTECTIVE path target (design/388: the object face's declaration, the
  * catalog's for the name as the floor), every view of it (`callTargetViewsOf`), by the one judgment every path rule
- * meets (`pathRowsReach`). A pattern's ANCHORS are the rule's own fact, taken once where the policy is installed: the
+ * meets (`judgePathRows`). A pattern's ANCHORS are the rule's own fact, taken once where the policy is installed: the
  * declared `pathBases` word by word, else the leg the Runner installs the policy on (`policyAnchors`) — never the
  * call's live working directory. A declared base that is not a usable absolute path is refused at compile time
  * (`unsupported.path_base`); a policy called outside a Runner leg with no declared base reads such a rule
@@ -158,35 +158,8 @@ export interface PermissionRulePolicyOptions {
      */
     pathBases?: PathRuleBases;
 }
-/**
- * Linear-time `*` glob match (design/127 M6: NOT a RegExp — patterns may come from tenant-supplied
- * Settings layers; the classic two-pointer walk has zero ReDoS surface and the same semantics as CC's
- * anchored `^…$`+dotAll construction: every non-`*` char is literal, `*` spans anything incl. newlines).
- */
-export declare function wildcardMatch(pattern: string, value: string): boolean;
-/**
- * Does a namespaced RULE name cover `toolName`? — the tail branch of CC's rule matcher `VRp`
- * (:595780), which is UNCONDITIONAL there (its `globMatching` option gates only the whole-name glob
- * branch, so CC's allow lane — `mVo` :595803, which passes no options — matches MCP segments too).
- * Three covering forms, matching CC's three disjuncts (`<ns>` = any protocol-table prefix):
- *   · `<ns>__<peer>`           — every tool of that peer (rule tool segment absent);
- *   · `<ns>__<peer>__*`        — the same set, spelled with the star CC's own settings validator
- *                                recommends (`"MCP rules do not support patterns in parentheses …
- *                                use mcp__srv__*"`);
- *   · `<ns>__<peer>__get_*`    — a glob over the tool segment.
- * A LITERAL tool segment is deliberately NOT covered here: it is an exact tool name, and the exact
- * table already answers it — the same split CC makes with its leading `ruleName === toolName`.
- *
- * Rule and target must be in the SAME namespace, and peer segments compare EXACTLY (CC
- * `s.serverName === a.serverName`). A rule must therefore spell the peer the way the mint does; that
- * is the same string an operator reads off any mounted tool name, and inventing a fuzzier comparison
- * here would let one rule reach a peer — or a protocol — it does not name.
- */
-export declare function namespacedRuleNameCovers(ruleName: string, toolName: string): boolean;
-/** True ⇔ this rule name is a namespaced name whose reach is a SET of tools rather than one exact tool
- *  — i.e. the shapes {@link namespacedRuleNameCovers} answers and an exact name table cannot. Every
- *  lane that keys rules by exact tool name needs this to know which entries it must NOT key that way. */
-export declare function isNamespacedCoveringRuleName(name: string): boolean;
+import { isNamespacedCoveringRuleName, namespacedRuleNameCovers, wildcardMatch } from "./namespaced-rule-name.js";
+export { isNamespacedCoveringRuleName, namespacedRuleNameCovers, wildcardMatch };
 /**
  * design/388 A-6/7/8/9 (D-3): the per-tool RULE FACE — the parameters a `Tool(param:pattern)` rule may name
  * (`params`, the SCALAR top-level keys ∪ the path target's aliases), the ones the generic lexical matcher must