@sema-agent/core 7.48.0 → 7.49.0

package/dist/core/untrusted-text.d.ts

@@ -150,8 +150,9 @@ export declare function scanEnvelopeShaped(text: string): EnvelopeShapedScan;
  *
  * NOTE the two sanctioned escape SHAPES in this tree, and why they are not merged: this one inserts
  * a backslash (`<` → `<\`) because it is a byte-level CC anchor on the observer/teammate lanes;
- * {@link sanitizeUntrustedText} inserts a zero-width space because its lanes are read by humans as
- * well. Both are idempotent and both break the tag; a merge would move bytes on one of the two
+ * {@link sanitizeUntrustedText} writes the entity `&lt;` in the bracket's place, CC's own spelling
+ * for its reminder-tag escapers. Both are idempotent, both break the tag, and both are printable
+ * ASCII that no format-character cleaning can remove; a merge would move bytes on one of the two
  * families for no security gain.
  */
 export declare function escapeEnvelopeTag(tag: string, text: string): string;
@@ -221,10 +222,11 @@ export declare function defuseExactMarkInSegments(segments: readonly string[], m
 /**
  * Neutralize structural break-out sequences in UNTRUSTED text so it can't escape its framing into
  * model-facing instructions. Always neutralizes `<system-reminder>` / `</system-reminder>` (the codebase's
- * elevated-authority wrapper) by inserting a zero-width space after the leading `<`. Pass `extraTags` to also
- * neutralize a CALLER's own data-framing tags — e.g. `team.ts` embeds member output inside `<statement>` /
- * `<discussion>`, so an untrusted member could emit `</statement>` to break out (search [46] BUG2);
- * the caller passes those tag names. Tag names must be literal (alphanumeric/hyphen) — they are code-supplied
+ * elevated-authority wrapper) by writing the entity {@link ESCAPED_LT} in place of the leading `<` (a form no
+ * format-character or whitespace cleaning removes — see there). Pass `extraTags` to also
+ * neutralize a CALLER's own data-framing tags — e.g. memory recall frames note text inside its own injection
+ * tags, so an untrusted note could emit the closing tag to break out; the caller passes those tag names
+ * (`MEMORY_INJECTION_TAGS`). Tag names must be literal (alphanumeric/hyphen) — they are code-supplied
  * wrapper names, never untrusted input. Idempotent for prompt assembly (a defused tag no longer matches).
  *
  * WHY THE ALWAYS-ON SET IS ONE TAG AND NOT THE WHOLE {@link ENGINE_ENVELOPES} AUTHORITY FAMILY: this is a
@@ -344,8 +346,9 @@ export declare function flattenableUserText(content: unknown): string | undefine
  * cannot forge {@link delimitUntrusted}'s own OPEN/CLOSE markers and break out of the fence. A worker (or
  * an external page via `web_fetch`, an MCP resource — the label format is open-source, so the close marker
  * `<<<END UNTRUSTED <label>>>>` is guessable) could otherwise emit the literal close marker followed by
- * top-level injection. Caps any run of 3+ identical brackets at 2 consecutive by inserting a zero-width
- * space — the reader still sees the text, but no `<<<`/`>>>` triple survives. Idempotent: a capped run
+ * top-level injection. Caps any run of 3+ identical brackets at 2 consecutive by writing the entity
+ * ({@link ESCAPED_LT} / {@link ESCAPED_GT}) in place of every third bracket — the reader still sees the text,
+ * no `<<<`/`>>>` triple survives, and no format-character cleaning can put one back. Idempotent: a capped run
  * (≤2) never re-matches `{3,}`. Defusing EITHER bracket breaks the marker; we defuse both for symmetry.
  *
  * Residual (council QUESTION, accepted): only ASCII `<`/`>` (U+003C/003E) are defused. A Unicode lookalike
@@ -440,8 +443,8 @@ export declare function delimitUntrusted(label: string, text: string, maxBody?:
  * the fence really carries instead of re-deriving the transform from its own copy of the tag list.
  *
  * Two copies of that list is precisely what drifted once the fenced lane widened past the reminder tag:
- * a caller pre-counting with the default (reminder-only) set under-measured the wide-set result by one
- * ZWSP per widened-family tag occurrence, so a body got clipped while the truncation disclosure that
+ * a caller pre-counting with the default (reminder-only) set under-measured the wide-set result by the
+ * rewrite's few extra characters per widened-family tag occurrence, so a body got clipped while the truncation disclosure that
  * decision drove was withheld — an externally selectable window just under the cap. Idempotent (both
  * halves are), so a caller may hand the neutralized string straight back to the fence.
  */

package/dist/core/untrusted-text.js

@@ -1,3 +1,5 @@
+const ESCAPED_LT = "<";
+const ESCAPED_GT = ">";
 const ZWSP = String.fromCharCode(0x200b);
 export const ENGINE_ENVELOPES = Object.freeze([
     {
@@ -83,8 +85,8 @@ export const ENGINE_ENVELOPES = Object.freeze([
     {
         tag: "previous-summary",
         kind: "framing",
-        mint: "engine/compaction (update-summarization input) / agents/team.ts",
-        guard: "team.ts neutralizes it via NEUTRALIZED_WRAPPER_TAGS; the compaction side frames engine-held text",
+        mint: "engine/compaction (update-summarization input)",
+        guard: "frames engine-held text (the previous summary the engine itself produced)",
         fenced: false,
         disclosed: false,
     },
@@ -104,46 +106,6 @@ export const ENGINE_ENVELOPES = Object.freeze([
         fenced: false,
         disclosed: false,
     },
-    {
-        tag: "statement",
-        kind: "framing",
-        mint: "agents/team.ts (member statement frame)",
-        guard: "sanitizeUntrustedText(NEUTRALIZED_WRAPPER_TAGS) on every member text",
-        fenced: false,
-        disclosed: false,
-    },
-    {
-        tag: "discussion",
-        kind: "framing",
-        mint: "agents/team.ts",
-        guard: "same NEUTRALIZED_WRAPPER_TAGS family",
-        fenced: false,
-        disclosed: false,
-    },
-    {
-        tag: "discussion-final",
-        kind: "framing",
-        mint: "agents/team.ts",
-        guard: "same NEUTRALIZED_WRAPPER_TAGS family",
-        fenced: false,
-        disclosed: false,
-    },
-    {
-        tag: "earlier-discussion-summary",
-        kind: "framing",
-        mint: "agents/team.ts",
-        guard: "same NEUTRALIZED_WRAPPER_TAGS family",
-        fenced: false,
-        disclosed: false,
-    },
-    {
-        tag: "topic",
-        kind: "framing",
-        mint: "agents/team.ts",
-        guard: "same NEUTRALIZED_WRAPPER_TAGS family",
-        fenced: false,
-        disclosed: false,
-    },
     {
         tag: "observer-report",
         kind: "framing",
@@ -502,7 +464,7 @@ export function defuseExactMarkInSegments(segments, mark) {
     return { segments: out, changed: true };
 }
 export function sanitizeUntrustedText(text, extraTags = []) {
-    return text.replace(breakoutRe(extraTags), (m) => m.replace("<", "<" + ZWSP));
+    return text.replace(breakoutRe(extraTags), (m) => ESCAPED_LT + m.slice(1));
 }
 export function cutEnginePrefix(text, enginePrefixChars) {
     if (typeof enginePrefixChars === "number" &&
@@ -574,7 +536,7 @@ export function flattenableUserText(content) {
     return undefined;
 }
 export function defuseFenceMarkers(body) {
-    return body.replace(/<{3,}|>{3,}/g, (run) => run.match(/.{1,2}/g).join(ZWSP));
+    return body.replace(/<{3,}|>{3,}/g, (run) => run.replace(/(..)./g, (_g, keep) => keep + (run.startsWith("<") ? ESCAPED_LT : ESCAPED_GT)));
 }
 const REPLACEMENT = "�";
 export function defuseControlChars(text) {

package/dist/core/workflow-journal-store.d.ts

@@ -65,7 +65,10 @@ export interface WorkflowJournalStore {
     /** Entries for `runId` IF its recorded scope === `scope`, ASCENDING by ordinal; otherwise EMPTY (cross-scope). */
     load(runId: string, scope: string): Promise<WorkflowJournalEntry[]>;
     /** Record one agent's result under `(runId, scope)`. MUST be idempotent per `(runId, ordinal)` — a resumed run
-     *  re-appends the cached results of its replayed prefix, so a second append for the same ordinal overwrites. */
+     *  re-appends the cached results of its replayed prefix, so a second append for the same ordinal overwrites.
+     *  The engine waits for the returned promise at most `RunWorkflowOptions.journalAppendTimeoutMs` (default 30 s);
+     *  a store that has not answered by then is a store fault (`workflow.journal_append_timeout`), and the write is
+     *  NOT cancelled — it may still land after the engine gave up on it, which idempotence makes harmless. */
     append(runId: string, scope: string, entry: WorkflowJournalEntry): Promise<void>;
     /** (CC diagnostics parity, additive): a HUMAN/MODEL-readable coordinate for this run's journal —
      *  the file store returns the on-disk jsonl path (CC "Read journal.jsonl" local form); a service store

package/dist/core/write-protect.d.ts

@@ -1,6 +1,5 @@
 import type { ExecutionEnv } from "../internal/harness-types.js";
 import type { PermissionResult } from "./tool-policy.js";
-import { type AskFace } from "./ask-origin.js";
 import { type ToolCallLike } from "./tool-registry.js";
 /**
  * How one table row matches the judged path:
@@ -51,6 +50,12 @@ export declare const WRITE_PROTECTED_DEFAULT_TABLE: readonly WriteProtectedRow[]
  * named `a:b` keeps its own identity on the POSIX reading.
  */
 export declare function foldWriteProtectSegment(s: string): string;
+/** One entry's refusal under the table's entry law ({@link normalizeWriteProtectedEntry}), labelled with the seat that
+ *  carried it, or `undefined` when the entry is lawful. */
+export declare function writeProtectedEntryProblem(entry: unknown, owner: string): string | undefined;
+/** The key two LAWFUL entries fold by — the resolved table's own dedupe key (kind + the folded canonical name), so a
+ *  list folded by it and the table resolved from it agree on which entries are one row. */
+export declare function writeProtectedEntryIdentity(entry: WriteProtectedEntry): string;
 /**
  * Resolve the ACTIVE table under the deployment seat (validated, loud — #123's bad-value states all
  * throw and name the knob). `undefined` = the default table; `[]` = NO table (an explicit, legal
@@ -61,6 +66,14 @@ export declare function foldWriteProtectSegment(s: string): string;
  * candidate configuration with the engine's own rules.
  */
 export declare function resolveWriteProtectedTable(entries?: readonly WriteProtectedEntry[]): readonly WriteProtectedRow[];
+/**
+ * THE spelled half of the exemption law (path-guard-rows.ts), for every table whose rows are exemptible: compiled once over
+ * the declared data-root spellings ({@link dataRootSpellings}, each read under ITS OWN path family — a spelling that reduces to
+ * NO segments, a root of `/`, exempts nothing rather than the filesystem), it answers a SPELLED view's remainder below
+ * whichever root contains it (`""` = the root itself, `null` = none) by {@link relativeUnderDataRoot}'s one literal reading.
+ * The identity half compares canonical keys (`relativeUnderRoot`, sensitive-path-policy.ts).
+ */
+export declare function spelledExemptionOf(dataRootPaths: readonly string[]): (spelling: string) => string | null;
 /**
  * WHY the ENVIRONMENT half of one judgment could not contribute — the canonicalizer refused the spelling,
  * a link the tree could not follow, a namespace spelling it declines, an environment call that threw.
@@ -80,13 +93,12 @@ export interface WriteProtectionViewAbsence {
  *  · `hit` — a row matched; `via` says which view named it: `"spelling"` (the anchored spelling, no
  *    filesystem consulted), `"chain"` (a spelling the leaf symlink chain passes through, judged as a
  *    spelling) or `"target"` (the resolved real target, the spelling being innocent);
- *  · `unresolvable` — NO half of the judgment answered at all. The judge itself no longer mints this: an
- *    environment that cannot resolve the target has ANSWERED, and an answer of "I cannot resolve this"
- *    leaves the lexical half's judgment standing (the absence law below). What is left for this verdict is
- *    the judgment that never happened — the gate's bounded wait elapsing or the task ending before
- *    anything came back (`awaitWriteProtectionJudgment`, gate-bounded-await.ts) — where there is no
- *    lexical answer to stand on either, and the consumer REFUSES. `unresolvedSymlink` is that minter's
- *    `false`: a wait that produced nothing knows nothing about what it was waiting for.
+ *  · `unresolvable` — no view that answered met a row, and where the target really lands (its real target, its link chain)
+ *    could not be determined — refused, not asked (`writeProtectionTightenDecision`): a write this table cannot judge is not
+ *    made on its word (the one absence law's second sentence, path-guard-rows.ts). `cause` is the environment's sentence.
+ *
+ * An auxiliary view that did not answer (a root's key) takes no part; every absence is disclosed
+ * ({@link WriteProtectionCompileOptions.onViewAbsent}).
  */
 export type WriteProtectionVerdict = {
     readonly kind: "clear";
@@ -107,7 +119,9 @@ export interface WriteProtectionJudgeContext {
      *  ({@link pathTargetBaseOf}). Absent ⇒ `cwd`, then the compile-time `rootPath`, then the environment's
      *  own working directory: the same fallback chain the write tool itself walks. */
     readonly base?: string;
-    /** Bounds the filesystem probes of the target view. */
+    /** The judgment's deadline (the gate hands its own): each environment lookup — the real target, the link chain, a root's
+     *  key — is bounded by it ON ITS OWN, and one that does not answer in time is absent while every row already met stays met.
+     *  Absent ⇒ each lookup is bounded by the gate's default deadline. */
     readonly signal?: AbortSignal;
     /** The path is a CANONICAL key the caller already resolved at the seat its program writes it (the shell read station's
      *  established write target: where the path lands, or — for a removal or a rename — the entry itself, its canonical
@@ -152,9 +166,11 @@ export interface WriteProtectionMatcher {
      *
      * @contract write_protection.judges_the_real_target — the always-on write-protection table and the
      * opt-in sensitive-path deny set differ in VOCABULARY (literal rows / segment globs) and SEVERITY
-     * (ask / deny), never in REACH: both judge the file the tool will write — the spelling anchored at the
-     * live cwd AND its resolved real target, through one canonicalizer. Where they DO part: a target the write-protection
-     * judge cannot resolve leaves its resolved view ABSENT (the spelling still judges); the deny set still REFUSES whole. An environment-less judge has no target view and answers by the spelling alone —
+     * (ask / deny), never in REACH: both judge the file the tool will write — the spelling anchored at the tool's declared
+     * base AND its resolved real target and the hops of its link chain, through one canonicalizer — and under ONE absence
+     * law: a target whose real
+     * destination (or link chain) cannot be determined is refused by both wherever a row stands (a row a view that did answer
+     * met is still the answer), and an auxiliary view that does not answer (a root's key) votes in neither. An environment-less judge has no target view and answers by the spelling alone —
      * the same absence law the cwd follows (absent ⇒ the spelling is judged exactly as given). REACH is what
      * this sentence promises, not a LOCK: the identity is resolved at judgment time and re-resolved by the
      * tool at execute time (the module header states that window and the seat that would close it).
@@ -202,6 +218,34 @@ export interface WriteProtectionCompileOptions {
  * that replaces the table wholesale gets the same law over its own rows.
  */
 export declare function compileWriteProtection(entries?: readonly WriteProtectedEntry[], opts?: WriteProtectionCompileOptions): WriteProtectionMatcher | undefined;
+/** Which table a shell write target met in the leg's one write judgment: the always-on write-protection table (the command's
+ *  ask carries that table's class) or a deployment's guarded write row (`ToolPolicy.writeGuardRows`: the target is not
+ *  placed). */
+export type WriteTargetCoverage = "protected" | "guarded";
+/** The leg's write judgment, compiled once ({@link compileLegWriteJudgment}). ENGINE-INTERNAL (not re-exported from
+ *  `src/index.ts`). */
+export interface LegWriteJudgment {
+    /** The always-on table's judge — absent when the table is empty (an opted-out deployment mounts no tighten). */
+    readonly matcher: WriteProtectionMatcher | undefined;
+    /** THE one judgment of an ABSOLUTE write target a command names, over the always-on table AND the deployment's guarded
+     *  write rows together — one reading of the target (its spelling, its real target, its symlink chain; a `canonical` key
+     *  judged as a key), one exempt root, one absence law. `undefined` ⇒ no row covers it. Absent when neither table has a
+     *  row. */
+    readonly judgeWriteTarget: ((target: string, opts?: {
+        readonly signal?: AbortSignal;
+        readonly canonical?: true;
+    }) => Promise<WriteTargetCoverage | undefined>) | undefined;
+}
+/**
+ * Compile the leg's ONE write judgment: the always-on table (`entries`, already resolved by the leg) and the deployment's
+ * guarded write rows (`guardRows`, the chain policies' {@link import("./tool-policy.js").ToolPolicy.writeGuardRows}) under
+ * the leg's one exempt root (`exemptRoots`, the leg's single resolution of `RunnerDeps.memoryEngineDir`). The gate's
+ * write-protection tighten reads the table's judge alone; the shell station asks the joint judgment.
+ */
+export declare function compileLegWriteJudgment(entries: readonly WriteProtectedEntry[], opts: Omit<WriteProtectionCompileOptions, "dataRoot"> & {
+    readonly exemptRoots: readonly string[];
+    readonly guardRows?: import("./tool-policy.js").ToolPolicy["writeGuardRows"];
+}): LegWriteJudgment;
 /**
  * The gate tighten's DECISION for one judgment — the words the fold writes on the pass, minted beside the
  * verdict they read so the two cannot drift:
@@ -210,28 +254,20 @@ export declare function compileWriteProtection(entries?: readonly WriteProtected
  *    message (table names are deployment-validated vocabulary); the model-authored target path deliberately
  *    does not — `message` is the classifier's `askMessage`, and the approval card already shows the args. The
  *    spelling form's sentence is the historical one byte for byte; the target form says the target RESOLVED.
- *  · `unresolvable` ⇒ read by the call's FACE (`face`, {@link releasableAskClassesFor}): where no permission mode releases
- *    `write_protection_unresolved` (the file face) — `deny` naming the cause: an unjudged target is never vouched (the rule
- *    the canonicalizing deny set follows for the same reason), so there a standing allow is refused while a standing ask
- *    carrying the record stays a person's question in the modes that ask (dontAsk and bypassPermissions refuse it); where
- *    a mode may release the class (the shell face) — `ask` (`safety`)
- *    naming the cause, which the mode arbitration answers exactly as it answers that record over a standing ask
- *    (bypassPermissions releases it, default puts it to a person, dontAsk refuses): on that face alone a standing allow
- *    reads as a standing ask.
+ *  · `unresolvable` ⇒ `deny` (`safety`; reason word `target_unresolved` on the sentence): where the write lands could not be
+ *    determined, so this table cannot say it is not a protected path — refused in every permission mode (a refusal, not a
+ *    question a mode releases), the reference's write check form ("where it leads on disk could not be determined").
  *  · `clear` ⇒ `undefined`: the surviving decision stands.
  */
-export declare function writeProtectionTightenDecision(toolName: string, verdict: WriteProtectionVerdict, face: AskFace): PermissionResult | undefined;
+export declare function writeProtectionTightenDecision(toolName: string, verdict: WriteProtectionVerdict): PermissionResult | undefined;
 /**
- * @contract write_protection.verdict_is_the_mandate — the judge's two non-clear verdicts are the two facts
- * a standing allow rule may not retire, and `clear` is neither: a MATCHED row is the mandate a live decider
- * may still clear, a target it could not RESOLVE is the mandate no automatic lane may. These two predicates
- * are the ONE reading of a verdict as either fact, beside the decision mint, so the fold records what the
- * judge said and never re-derives "was this write protection?" from the decision it got back.
+ * @contract write_protection.verdict_is_the_mandate — a MATCHED row is the one fact of the judge's verdict a standing
+ * allow rule may not retire (a live decider may still clear it), and `clear` is not it; this predicate is the one reading
+ * of a verdict as that fact, beside the decision mint, so the fold records what the judge said and never re-derives "was
+ * this write protection?" from the decision it got back. A view the judge's reading could not answer is no second fact:
+ * it took no part.
  */
 export declare function writeProtectionMandated(verdict: WriteProtectionVerdict): boolean;
-/** The second half of {@link writeProtectionMandated}'s contract: the judge could not name this target
- *  (the arm that owns the ACTION denies on the same verdict). */
-export declare function writeProtectionUnresolved(verdict: WriteProtectionVerdict): boolean;
 /**
  * The ENGINE-FILLED gate input (`ToolGateInput.writeProtectionCheck`). Returns `null` SYNCHRONOUSLY when the
  * call is not this layer's business — not a covered write, or no resolvable target string — and otherwise