@sema-agent/core 7.48.0 → 7.49.1

package/dist/core/effective-path-target.js

@@ -1,11 +1,13 @@
-import { canonicalizeTarget, isAbsoluteForFamily, joinForFamily, pathFamilyOf, pathIdentityOf, spellingOfIdentity, win32NamespaceScreen } from "../tools/fs/safety.js";
+import { anchorSpelling, canonicalizeTarget, familyFor, hasWin32AliasedComponent, isAbsoluteForFamily, normalizeAbsPathLexically, pathFamilyOf, pathIdentityOf, spellingOfIdentity, win32NamespaceScreen } from "../tools/fs/safety.js";
 import { declaredPathTargetOf, pathTargetValue, protectivePathTargetOf } from "./tool-registry.js";
 import { symlinkChainHops } from "./path-identity.js";
 import { DEFAULT_GATE_AWAIT_TIMEOUT_MS, withGateTimeout } from "./gate-bounded-await.js";
+import { thrownText } from "./thrown-value.js";
 export function pathTargetBaseOf(pt, bases) {
     return (pt?.base ?? "cwd") === "root" ? bases.root : (bases.cwd ?? bases.root);
 }
-export function splitAbsoluteGlobPattern(pattern, family) {
+export function splitAbsoluteGlobPattern(pattern, tree) {
+    const family = tree ?? familyFor("own", pattern);
     const screened = win32NamespaceScreen(pattern, family);
     if (!screened.ok)
         return { refused: screened.refuse };
@@ -31,10 +33,8 @@ export function effectivePathTargetOf(call, pt, bases) {
     if ("refused" in spelling)
         return { kind: "refused", reason: spelling.refused };
     if (spelling.spelled !== undefined)
-        return resolveSpelling(spelling.spelled, spelling.base, bases);
-    const declaredBase = spelling.base;
-    const family = pathFamilyOf(bases);
-    return declaredBase !== undefined && isAbsoluteForFamily(family, declaredBase) ? readingOf(pathIdentityOf(declaredBase, family, bases.root ?? bases.cwd)) : unreadableBase(declaredBase);
+        return placeSpelling(spelling.spelled, spelling.base, bases);
+    return spelling.base !== undefined && isAbsoluteForFamily(readingFamilyOf(bases, spelling.base), spelling.base) ? placeSpelling(spelling.base, undefined, bases) : unreadableBase(spelling.base);
 }
 export function effectivePathSpellingOf(call, pt, bases) {
     if (pt === undefined)
@@ -55,36 +55,58 @@ export function effectivePathSpellingOf(call, pt, bases) {
     }
     return { base: declaredBase };
 }
-function resolveSpelling(spelled, declaredBase, bases) {
-    const family = pathFamilyOf(bases);
+export function placeSpelling(spelled, declaredBase, bases) {
+    const family = readingFamilyOf(bases, spelled);
     const screened = win32NamespaceScreen(spelled, family);
     if (!screened.ok)
         return { kind: "refused", reason: screened.refuse };
     const tree = bases.root ?? bases.cwd;
     if (isAbsoluteForFamily(family, screened.spelled))
-        return readingOf(pathIdentityOf(screened.spelled, family, tree));
-    if (declaredBase === undefined || family === undefined || !isAbsoluteForFamily(family, declaredBase))
+        return readingOf(pathIdentityOf(screened.spelled, family, tree), family);
+    if (declaredBase === undefined || !isAbsoluteForFamily(family, declaredBase))
         return unreadableBase(declaredBase);
-    return readingOf(pathIdentityOf(joinForFamily(family, declaredBase, screened.spelled), family, tree));
+    return readingOf(pathIdentityOf(anchorSpelling(family, declaredBase, screened.spelled), family, tree), family);
+}
+export function readingFamilyOf(bases, spelled) {
+    return pathFamilyOf(bases) ?? familyFor("own", spelled);
 }
-function readingOf(r) {
+function readingOf(r, family) {
     if (r.ok)
-        return { kind: "path", identity: r.identity };
+        return { kind: "path", identity: r.identity, family };
     return r.reason === "relative" || r.reason === "unanchored" ? undefined : { kind: "refused", reason: r.reason };
 }
 function unreadableBase(base) {
     return { kind: "unreadable", reason: base === undefined ? "the call's path is relative to a base that was not supplied" : `the base this call resolves against (${JSON.stringify(base)}) is not a fully-qualified path of this tree's family` };
 }
-export async function readPathViews(env, spelled, base, bases, signal, opts) {
-    const lexical = resolveSpelling(spelled, base, bases);
+export const READ_ROOT_CANDIDATE_DIR_MAX = 1024;
+export function validatePath(value, contract) {
+    if (typeof value !== "string" || !isAbsoluteForFamily("own", value))
+        return undefined;
+    if (contract.intent === "validate-coordinate")
+        return value;
+    if (value.length > READ_ROOT_CANDIDATE_DIR_MAX)
+        return undefined;
+    if (/[\u0000-\u001f\u007f\u2028\u2029]/.test(value))
+        return undefined;
+    const folded = normalizeAbsPathLexically(value);
+    if (folded !== value || normalizeAbsPathLexically(`${value}/..`) === value)
+        return undefined;
+    if (hasWin32AliasedComponent(value))
+        return undefined;
+    return win32NamespaceScreen(value, familyFor("own", value)).ok ? value : undefined;
+}
+export async function readPath(env, spelled, base, bases, contract, signal) {
+    const lexical = placeSpelling(spelled, base, bases);
     const family = pathFamilyOf(bases);
-    if (env === undefined || family === undefined || lexical?.kind === "unreadable")
+    if (contract.views === "lexical" || env === undefined || family === undefined || lexical?.kind === "unreadable")
         return { lexical, hops: [] };
     const canonical = await canonicalizeTarget(env, spelled, signal, family, base);
     const climbs = (s) => s !== undefined && (family === "win" ? /(^|[\\/])\.\.([\\/]|$)/ : /(^|\/)\.\.(\/|$)/).test(s);
     const followsALink = canonical.ok && (climbs(spelled) || climbs(base) || lexical?.kind !== "path" || absoluteTargetIdentityOf(canonical.key, bases) !== lexical.identity);
-    const hops = opts?.hops === true && followsALink ? await withGateTimeout(symlinkChainHops(env, spelled, signal, family, base), DEFAULT_GATE_AWAIT_TIMEOUT_MS, signal, "canonicalChain").catch(() => []) : [];
-    return { lexical, canonical, hops };
+    const chain = contract.views === "chain" && followsALink
+        ? await withGateTimeout(symlinkChainHops(env, spelled, signal, family, base), DEFAULT_GATE_AWAIT_TIMEOUT_MS, signal, "canonicalChain").catch((err) => ({ ok: false, cause: thrownText(err), asked: true }))
+        : { ok: true, hops: [] };
+    return chain.ok ? { lexical, canonical, hops: chain.hops } : { lexical, canonical, hops: [], hopsUnread: true };
 }
 export function absoluteTargetIdentityOf(spelled, bases) {
     const r = pathIdentityOf(spelled, pathFamilyOf(bases), bases.root ?? bases.cwd);
@@ -94,7 +116,6 @@ const READ_FOR = new WeakMap();
 const REREAD = new WeakMap();
 export async function readCallTarget(env, call, signal, leads) {
     const bases = { ...(call.root !== undefined ? { root: call.root } : {}), ...(call.cwd !== undefined ? { cwd: call.cwd } : {}) };
-    const family = pathFamilyOf(bases);
     const views = new Map();
     const viewOf = (pt) => {
         const sel = effectivePathSpellingOf(call, pt, bases);
@@ -102,7 +123,7 @@ export async function readCallTarget(env, call, signal, leads) {
             return Promise.resolve(undefined);
         if ("refused" in sel)
             return Promise.resolve({ kind: "refused", reason: sel.refused });
-        const target = sel.spelled !== undefined ? { spelled: sel.spelled, base: sel.base } : sel.base !== undefined && isAbsoluteForFamily(family, sel.base) ? { spelled: sel.base, base: undefined } : undefined;
+        const target = sel.spelled !== undefined ? { spelled: sel.spelled, base: sel.base } : sel.base !== undefined && isAbsoluteForFamily(readingFamilyOf(bases, sel.base), sel.base) ? { spelled: sel.base, base: undefined } : undefined;
         if (target === undefined)
             return Promise.resolve(unreadableBase(sel.base));
         const { spelled, base } = target;
@@ -110,9 +131,9 @@ export async function readCallTarget(env, call, signal, leads) {
         const prior = views.get(key);
         if (prior !== undefined)
             return prior;
-        const read = readPathViews(env, spelled, base, bases, signal, { hops: true })
-            .catch(() => ({ lexical: resolveSpelling(spelled, base, bases), hops: [] }))
-            .then((v) => viewFrom(v, family));
+        const read = readPath(env, spelled, base, bases, { intent: "resolve", views: "chain" }, signal)
+            .catch((err) => ({ lexical: placeSpelling(spelled, base, bases), canonical: { ok: false, message: `the environment threw resolving the target: ${thrownText(err)}` }, hops: [] }))
+            .then(viewFrom);
         views.set(key, read);
         return read;
     };
@@ -130,13 +151,14 @@ export function withArgsReading(req, args, signal) {
     const reread = reading === undefined ? undefined : REREAD.get(reading);
     return reread === undefined ? undefined : reread(args, signal).then((targetReading) => ({ ...req, args, targetReading }));
 }
-function viewFrom(v, family) {
+function viewFrom(v) {
     if (v.lexical === undefined)
         return undefined;
     if (v.lexical.kind !== "path")
         return Object.freeze({ ...v.lexical });
     const canonical = v.canonical?.ok === true ? v.canonical.key : undefined;
-    return Object.freeze({ kind: "path", lexical: spellingOfIdentity(v.lexical.identity, family), ...(canonical !== undefined ? { canonical } : {}), ...(v.hops.length > 0 ? { hops: Object.freeze([...v.hops]) } : {}) });
+    const unread = (v.canonical !== undefined && !v.canonical.ok) || v.hopsUnread === true;
+    return Object.freeze({ kind: "path", lexical: spellingOfIdentity(v.lexical.identity, v.lexical.family), ...(canonical !== undefined ? { canonical } : {}), ...(v.hops.length > 0 ? { hops: Object.freeze([...v.hops]) } : {}), ...(unread ? { unread: true } : {}) });
 }
 export function callTargetReadingOf(req) {
     const r = req.targetReading;
@@ -149,21 +171,29 @@ export function callTargetViewsOf(req, direction, bare = {}) {
         if (v === undefined || v.kind === "refused")
             return undefined;
         if (v.kind === "unreadable")
-            return { spellings: [], unreadable: v.reason };
-        const spellings = [v.lexical];
-        for (const s of [v.canonical, ...(v.hops ?? [])])
-            if (s !== undefined && !spellings.includes(s))
-                spellings.push(s);
-        return { spellings };
+            return { views: [], unreadable: v.reason };
+        if (direction === "allow" && (v.canonical === undefined || v.unread === true))
+            return { views: [], unreadable: ALLOW_UNRESOLVED };
+        const views = [{ path: v.lexical, kind: "lexical" }];
+        const seen = (p) => views.some((w) => w.path === p);
+        if (v.canonical !== undefined && !seen(v.canonical))
+            views.push({ path: v.canonical, kind: "canonical" });
+        for (const hop of v.hops ?? [])
+            if (!seen(hop))
+                views.push({ path: hop, kind: "hop" });
+        return { views };
     }
     const own = req.root !== undefined || req.cwd !== undefined ? { ...(req.root !== undefined ? { root: req.root } : {}), ...(req.cwd !== undefined ? { cwd: req.cwd } : {}) } : bare;
     const target = effectivePathTargetOf(req, direction === "tighten" ? protectivePathTargetOf(req) : declaredPathTargetOf(req), own);
     if (target === undefined || target.kind === "refused")
         return undefined;
     if (target.kind === "unreadable")
-        return { spellings: [], unreadable: target.reason };
-    return { spellings: [spellingOfIdentity(target.identity, pathFamilyOf(own))] };
+        return { views: [], unreadable: target.reason };
+    if (direction === "allow")
+        return { views: [], unreadable: ALLOW_UNRESOLVED };
+    return { views: [{ path: spellingOfIdentity(target.identity, target.family), kind: "lexical" }] };
 }
+const ALLOW_UNRESOLVED = "where the target resolves was not read, so no allow by path can speak for it";
 export function legCallTargetStamp(leg) {
     const taken = new WeakMap();
     return (req, signal) => {

package/dist/core/engine-notice.d.ts

@@ -34,11 +34,14 @@ export interface EngineNotice {
      *    prepared leg, never per judgment and never re-fired for a mid-run roster delta; absent ⇒ the judge
      *    has its target view, or no covered write tool was mounted AT PREPARE, or there is no judge —
      *    `wiringManifest.writeProtection` reports the judge's reading either way.
-     *  - `"config.write_protection_unresolved"` (#869) — this leg's write-protection judge HAS a target view
-     *    and the environment behind it could not answer: it refused a spelling, could not follow a link, or
-     *    threw. That view then does not vote and the write is judged by its SPELLING alone (the judge's
-     *    absence law), so the disclosure is the only place a deployment learns that its write floor is
-     *    running on half a judgment. Announce, never narrow — no verdict moves because of this notice; the
+     *  - `"config.path_view_unresolved"` (#869; 7.48.0 `config.write_protection_unresolved`) — this leg's write-protection judge HAS a target view
+     *    and one SOURCE of a judgment did not answer: the environment refused a spelling, could not follow a link,
+     *    threw, or did not answer within the gate's deadline — on the target, its link chain or a root's key — or
+     *    a deployment policy's guarded write rows did not come back. A target whose real destination (or chain)
+     *    could not be determined is refused where the table has rows; an auxiliary source is absent on its own (a
+     *    root exempts and places nothing; rows that did not come back are held, so the writes they could guard are
+     *    not placed); every row an answering source met stays met — the judge's absence law. The disclosure is
+     *    where a deployment learns its environment is the reason. Announce, never narrow — no verdict moves because of this notice; the
      *    verdict already moved when the environment failed to answer. Audience `operator`.
      *    `detail: { reason, cause, sessionId, runId }` — `reason` is `"unresolved-symlink"` (a link whose
      *    real target is unknowable) or `"unresolvable-target"` (everything else: a refused spelling, an
@@ -60,11 +63,12 @@ export interface EngineNotice {
      *  - `"permission.allowed_tool_not_granted"` — an allow list holds entries that grant (or refuse) nothing: a loaded skill's
      *    `allowed-tools` / `disallowed-tools`, the request's `TaskSpec.allowedTools`, the deployment's `RunnerDeps.allowedTools`.
      *    `*` (it voids an allow list; on a deny list it reads as nothing and the rest still refuses), `mcp__*` (no server
-     *    named), a write-path or domain entry, a shape the rule grammar does not read. The run goes on and asks for those tools
+     *    named), a rule on a tool with no such rule form (an allow by path on a tool other than `Read` / `Edit`, a deny by host),
+     *    a shape the rule grammar refuses, a tool name stale against the run's roster. The run goes on and asks for those tools
      *    as usual. Audience `user`; once per prepared task for the skill and request lists (`detail.sessionId` present), once
      *    per Runner for the deployment's (at construction, no session). `detail: { sessionId?, entries: [{ source, entry,
      *    reason, skill?, list? }] }` (`source` ∈ `skill` / `request` / `deployment`; `skill` and `list` only on a skill's;
-     *    `reason` ∈ `wildcard_all` / `namespace_wildcard` / `path_pattern` / `domain` / `content_unsupported` / `grammar`).
+     *    `reason` ∈ {@link import("./allow-entry.js").ALLOW_ENTRY_INERT_REASONS}).
      *  - `"skills.listing_truncated"` — the `<skills>` disclosure block did not fit its byte budget, so
      *    at least one skill is listed without its description (`nameOnly`) or, in the pathological case,
      *    not listed at all (`dropped`); the `Skill` tool still serves every one of them. Audience
@@ -269,6 +273,27 @@ export interface EngineNotice {
      *    `"charset"` (a control byte, a space, a non-ASCII unit or `~`), `"length"` (admitted characters, over 128)
      *    or `"duplicate"` (a renamed later call); `rawLength` present for the two shape reasons only; never the raw
      *    bytes. Absent ⇒ no call of the run was folded.
+     *  - `"route.finish_reason_unknown"` (#1457) — the provider ended a response with a stream-end word (an
+     *    OpenAI-family `finish_reason`) the brain does not read. The turn is kept — its text and the stop its content
+     *    implies — and the word rides `AssistantMessage.finishReasonUnknown` (and, when the run completes on that turn,
+     *    `terminal.detail`); the notice is what keeps the keep from being a silent clean stop. ONCE PER LEG PER WORD.
+     *    Audience `user` (the person reading the answer judges whether it is whole); `detail: { finishReason,
+     *    sessionId, runId }` — the word in the provider echo shape, `?` when it had bytes outside it.
+     *  - `"route.stream_end_ignored"` (#1457) — the provider's stream sent more after its first terminal statement, on
+     *    either wire: a later ending (OpenAI-family `finish_reason`, Anthropic `stop_reason`), error frame or content (a
+     *    delta, a block, a new message). The first ending decided the turn and nothing after it was added
+     *    (`AssistantMessage.streamEndIgnored`). ONCE PER LEG PER (statement, word). Audience `user`; `detail: {
+     *    statement: "ending" | "error" | "content", word, frames, sessionId, runId }` — `word` the first such frame's
+     *    (for content, its kind), `frames` how many came.
+     *  - `"route.extra_body_reserved_dropped"` (#1520) — a request's `Model.extraBody` carried keys the wire adapter
+     *    sets itself (`temperature`, `max_tokens`, `stop`, the thinking-enable keys, `messages`, `tools`, …), so the
+     *    adapter stripped them and the request went out with the engine's value (or without the key); core wins, and
+     *    that is said. One reading at the one strip site — the model spec of the task, a model spec a host brain
+     *    rewrote for a single request, and the leg's internal calls (the compaction summary, mid-task or at the end of
+     *    the task, and a side query fired from a tool) are announced alike. Advisory: the turn
+     *    runs. ONCE PER LEG PER (api, key set) — a deployment fact, not a request fact. Audience `operator`;
+     *    `detail: { keys, api, modelId, sessionId, runId }` — `keys` the key NAMES in `extraBody`'s order (never a
+     *    value), `api` the wire the adapter speaks, `modelId` the catalog id the request was sent as.
      *  - `"context.tool_turn_repaired"` (#1224) — a provider request was built from a transcript that breaks the
      *    tool-turn law, and the request view restored it (`engine/llm/tool-turns.ts`; the transcript is never
      *    rewritten): a block after an assistant's tool calls moved ahead of them (`trailing_text`), a result recorded
@@ -284,13 +309,20 @@ export interface EngineNotice {
      *    the run and announced on the first. Absent ⇒ every request of the run already had the structure.
      *  - `"task.tool_turn_incomplete"` (#1230) — the person's line for a tool turn the model was handed incomplete, beside
      *    the note the model itself reads. `detail.cause` (closed `TOOL_TURN_INCOMPLETE_CAUSES`): `truncated` — calls whose
-     *    arguments were cut before they parsed, dropped (they did not run; the model is asked to re-issue them);
-     *    `unnamed` — calls that arrived with no tool name, dropped the same way; `bad_frame` — streamed response frames
+     *    arguments were cut before they parsed, dropped (they did not run); `unnamed` — calls that arrived with no tool
+     *    name, dropped the same way; `bad_frame` — streamed response frames
      *    that could not be read, dropped (the response may be missing content); `missing_result_synthesized` — a
      *    call of this run with no recorded result, which the request view closed as interrupted, outcome unknown (the
      *    `missing_result` repair above; a call that went unanswered before the run began is the transcript's history and
-     *    is on that operator line only). Audience `"user"`; `detail: { cause, count, toolCallIds?, sessionId, runId }` —
-     *    `count` the calls (or frames) of that cause in the turn or request that first showed it; `toolCallIds` on
+     *    is on that operator line only). Audience `"user"`; `detail: { cause, count, outcome?, toolCallIds?, sessionId, runId }` —
+     *    `count` the calls (or frames) of that cause in the turn or request that first showed it; `outcome` (#1640) on
+     *    `truncated` / `unnamed` only, and only where the turn's own message states it: `"terminal"` — the lane failed
+     *    the run on those calls (its dropped-calls account is on the failed turn; the terminal's `detail.kind` is
+     *    `model_output_invalid`), the sentence says the run ended; `"reissued"` — the turn goes on by the loop's turn
+     *    rules (it carries a tool call, or stopped to call a tool, or stopped at the output cap) and the next request
+     *    asks the model to re-issue them. ABSENT is a fact, not missing data: the message does not say what became of the
+     *    run (a refusal, an abort, a completed turn with nothing to run, a torn stream the loop may resume), and the
+     *    sentence then stops at "so they did not run". Once for the cause that first showed it; `toolCallIds` on
      *    `missing_result_synthesized` only, each id in the provider echo shape (a stored id outside it is not shown;
      *    `count` still counts it). Closed-set words, a count and call ids only: never a tool name, an argument or the
      *    note's text. ONCE PER RUN PER CAUSE. Absent ⇒ nothing of that cause reached the model.

package/dist/core/file-history-store.js

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import { thrownText } from "./thrown-value.js";
-import { isAbsoluteForFamily, isAbsolutePathForm, isWinFormPath, pathFamilyOf } from "../tools/fs/safety.js";
+import { isAbsoluteForFamily, isWinFormPath, pathFamilyOf, relativeInEveryFamily } from "../tools/fs/safety.js";
 import { fileHistoryBoundariesToKeep, resolveFileHistoryRetention } from "./file-history-retention.js";
 const normSlash = (p) => p.replace(/\\/g, "/");
 const stripTrailSep = (p) => (isWinFormPath(p) ? p.replace(/[\\/]+$/, "") : p.replace(/\/+$/, ""));
@@ -20,7 +20,7 @@ function joinUnder(root, rel) {
     return stripTrailSep(root) + (win ? "\\" : "/") + (win ? rel.replace(/\//g, "\\") : rel);
 }
 function isUnsafeRelPathLike(relN) {
-    return isAbsolutePathForm(relN) || /^[A-Za-z]:/.test(relN) || relN.split("/").includes("..");
+    return !relativeInEveryFamily(relN) || relN.split("/").includes("..");
 }
 function parentDirOf(absPath) {
     const win = isWinFormPath(absPath);

package/dist/core/fs-write-gate-policy.d.ts

@@ -1,5 +1,9 @@
 import type { ExecutionEnv } from "../internal/harness-types.js";
 import type { PermissionResult, ToolPolicy } from "./tool-policy.js";
+import { type PathGuardRow } from "./path-guard-rows.js";
+/** One write domain SOURCE as an allow row of the one table: it reaches every location at or below one of its admitted keys.
+ *  The write gate's three sources, and a session rule's `allowDirs` (the confinement that admits a write only inside them). */
+export declare function domainRow(source: "advertised" | "configured" | "accepted" | "session", dirs: readonly string[]): PathGuardRow;
 /** design/388 B22 — the identity triple the exemption probe hands the store beside the name. */
 export interface ToolCallIdentity {
     capabilityId: string;

package/dist/core/fs-write-gate-policy.js

@@ -3,6 +3,20 @@ import { isWithin } from "./runner/session-rule-policy.js";
 import { swallowedFenceRoot } from "./runner/advertised-writable-dirs.js";
 import { declaredPathTargetOf, isProtectedWrite } from "./tool-registry.js";
 import { pathTargetBaseOf } from "./effective-path-target.js";
+import { judgePathRows } from "./path-guard-rows.js";
+export function domainRow(source, dirs) {
+    return {
+        name: `write domain (${source})`,
+        grammar: { kind: "domain", dirs, source },
+        polarity: "allow",
+        faces: ["write"],
+        placement: "anywhere",
+        fold: "exact",
+        exemptible: false,
+        origin: source === "advertised" ? "builtin" : "addition",
+        reach: (view) => (dirs.some((dir) => isWithin(dir, view.path)) ? { reach: "reached" } : { reach: "not_reached" }),
+    };
+}
 const ask = (message) => ({ action: "ask", message, decisionReason: "rule" });
 function absoluteRootOf(rootPath, envCwd) {
     return rootPath === undefined ? undefined : lexicalViewOf(rootPath, envCwd);
@@ -56,10 +70,12 @@ export function createFsWriteGatePolicy(opts) {
             if (!canon.ok) {
                 return ask(`write to "${path}" requires approval: its real target could not be resolved (${canon.message})${advisory}`);
             }
-            for (const root of req.advertisedWritableRoots ?? []) {
-                if (isWithin(root, canon.key))
-                    return { action: "allow" };
-            }
+            const advertised = req.advertisedWritableRoots ?? [];
+            const targetViews = { views: [{ path: canon.key, kind: "canonical" }] };
+            const admitted = { configured: [], accepted: [] };
+            const admits = () => judgePathRows([domainRow("advertised", advertised), domainRow("configured", admitted.configured), domainRow("accepted", admitted.accepted)], targetViews, "allow") !== undefined;
+            if (admits())
+                return { action: "allow" };
             let fenceRootsCanonical;
             let refusedDomain;
             for (const [dirs, structural] of [
@@ -87,7 +103,8 @@ export function createFsWriteGatePolicy(opts) {
                             continue;
                         }
                     }
-                    if (isWithin(dir.key, canon.key))
+                    (structural ? admitted.configured : admitted.accepted).push(dir.key);
+                    if (admits())
                         return { action: "allow" };
                 }
             }

package/dist/core/gate-bounded-await.d.ts

@@ -35,19 +35,34 @@ export declare const DEFAULT_GATE_AWAIT_TIMEOUT_MS = 30000;
 export declare function createGateDeadline(input: {
     approvalTimeoutMs?: number;
 }, notifier: Parameters<typeof traceHookCrash>[2]): () => number;
+/** What ONE source of a judgment answered: its value, or its absence and why (it threw — synchronously or not — or did not
+ *  answer before the judgment's signal ended the wait; `gateWaitFailureOf(cause)` says which wait ended it). */
+export type SourceAnswer<T> = {
+    readonly ok: true;
+    readonly value: T;
+} | {
+    readonly ok: false;
+    readonly cause: unknown;
+};
 /**
- * The write-protection judge's wait, at both of its call sites — and the ONE minter of the `unresolvable`
- * verdict. An elapsed or aborted judgment is not "a target the environment could not resolve" (the judge
- * answers that one itself, by dropping the view that could not contribute and letting the lexical half
- * stand); it is NO judgment at all — not even the lexical half's answer came back — and there is nothing
- * for the fold or the approved-edit arm to act on but their own fail-closed arm. A wait that produced
- * nothing knows nothing about what it was waiting for, which is why `unresolvedSymlink` is `false` here
- * and not a guess.
+ * THE one way a source enters a path judgment — an environment lookup (the real target, the link chain, a root's key) or a
+ * provider of rows (a deployment's guarded write rows): asked, bounded by the signal the judgment was handed (the gate's
+ * deadline), and SETTLED — never thrown. A source that fails or does not answer in time is absent on its own (its view does not
+ * vote, its root exempts nothing, its rows are held unplaced), and every other source's answer stands: no source's failure
+ * reaches the judgment as a whole. No signal (a host calling a judge directly) ⇒ bounded by {@link DEFAULT_GATE_AWAIT_TIMEOUT_MS}.
+ */
+export declare function fromSource<T>(ask: () => Promise<T>, signal: AbortSignal | undefined, label: string): Promise<SourceAnswer<T>>;
+/**
+ * The write-protection judgment at both of its gate call sites. The gate's ONE deadline is handed DOWN as the judgment's
+ * signal, so it bounds each of the judgment's sources on its own ({@link fromSource}): a view that did not answer in time takes no
+ * part, an exemption root whose key did not come back exempts nothing, and a row a view already met stays met — the one
+ * absence law of every path table, per lookup. `judge` returns `null` synchronously for a call it does not cover (no deadline
+ * is armed, no seat read); `undefined` is returned then.
  *
- * KNOWN, AND NARROWER THAN IT LOOKS: the lexical half is computed synchronously at the top of `judge`, so
- * a spelling HIT is already on a settled promise before this wait begins and cannot elapse; what this arm
- * refuses is a spelling MISS whose environment half never came back. Closing even that would mean handing
- * the deadline INTO the judge so the missing half could be dropped there too — a seat change on a public
- * type, deliberately not taken here.
+ * The wait here is the LIVENESS net for a judgment that does not observe the signal it was handed, and it ends one turn of the
+ * event loop AFTER the deadline: a judgment whose every lookup races the signal (the engine's) has settled by then with what it
+ * found, so the net never stands in for its answer. A judgment that never came back, or threw, determined nothing about where
+ * the write lands, and the table it judges for has rows: `unresolvable` (the one absence law's target arm — refused), reported
+ * as a deployment callback failing.
  */
-export declare function awaitWriteProtectionJudgment(judged: Promise<WriteProtectionVerdict>, ms: number, signal?: AbortSignal, onFailure?: (err: unknown) => void): Promise<WriteProtectionVerdict>;
+export declare function awaitWriteProtectionJudgment(judge: (signal: AbortSignal) => Promise<WriteProtectionVerdict> | null, deadlineMs: () => number, signal?: AbortSignal, onFailure?: (err: unknown) => void): Promise<WriteProtectionVerdict | undefined>;

package/dist/core/gate-bounded-await.js

@@ -23,7 +23,15 @@ export function withGateTimeout(p, ms, signal, label = "reversibilityProbe") {
             signal?.removeEventListener("abort", onAbort);
             fn(v);
         };
-        const onAbort = () => done(reject, gateWaitError(`${label} aborted (task ended)`, "aborted"));
+        const onAbort = () => {
+            const reason = signal?.reason;
+            const ended = gateWaitFailureOf(reason) !== undefined
+                ? reason
+                : reason?.name === "TimeoutError"
+                    ? gateWaitError(`${label} timed out (its deadline elapsed)`, "timeout")
+                    : gateWaitError(`${label} aborted (task ended)`, "aborted");
+            done(reject, ended);
+        };
         const timer = ms !== undefined
             ? setTimeout(() => done(reject, gateWaitError(`${label} timed out after ${ms}ms`, "timeout")), ms)
             : undefined;
@@ -53,12 +61,41 @@ export function createGateDeadline(input, notifier) {
         return resolved;
     };
 }
-export async function awaitWriteProtectionJudgment(judged, ms, signal, onFailure) {
+export async function fromSource(ask, signal, label) {
     try {
-        return await withGateTimeout(judged, ms, signal, "writeProtectionJudge");
+        return { ok: true, value: await withGateTimeout(Promise.resolve().then(ask), signal === undefined ? DEFAULT_GATE_AWAIT_TIMEOUT_MS : undefined, signal, label) };
+    }
+    catch (cause) {
+        return { ok: false, cause };
+    }
+}
+export async function awaitWriteProtectionJudgment(judge, deadlineMs, signal, onFailure) {
+    const deadline = new AbortController();
+    const judged = judge(deadline.signal);
+    if (judged === null)
+        return undefined;
+    const ms = deadlineMs();
+    const net = new AbortController();
+    const endBoth = (reason) => {
+        if (!deadline.signal.aborted)
+            deadline.abort(reason);
+        setImmediate(() => net.abort(reason));
+    };
+    const timer = setTimeout(() => endBoth(gateWaitError(`writeProtectionJudge timed out after ${ms}ms`, "timeout")), ms);
+    const onTaskAbort = () => endBoth(gateWaitError("writeProtectionJudge aborted (task ended)", "aborted"));
+    if (signal?.aborted === true)
+        onTaskAbort();
+    else
+        signal?.addEventListener("abort", onTaskAbort);
+    try {
+        return await withGateTimeout(judged, undefined, net.signal, "writeProtectionJudge");
     }
     catch (err) {
         onFailure?.(err);
-        return { kind: "unresolvable", cause: thrownText(err), unresolvedSymlink: false };
+        return { kind: "unresolvable", cause: `the write-protection judgment did not answer: ${thrownText(err)}`, unresolvedSymlink: false };
+    }
+    finally {
+        clearTimeout(timer);
+        signal?.removeEventListener("abort", onTaskAbort);
     }
 }

package/dist/core/gate-fold.d.ts

@@ -1,4 +1,4 @@
-import { type GatePass } from "./runner/gate-exit.js";
+import type { GatePass } from "./runner/gate-exit.js";
 import type { ToolGateResult } from "./hooks.js";
 /**
  * Run the fold over the pass: adjudicate, fold the hook-ask, tighten. Writes `req` (re-minted over the FINAL

package/dist/core/gate-fold.js

@@ -2,9 +2,8 @@ import { inlineUntrusted } from "./untrusted-text.js";
 import { markTightenMessage } from "./safety-axis-vocab.js";
 import { PROBE_REASON_MAX, normalizeProbeCause } from "./checkpoint-store.js";
 import { normalizeReadRootCandidate } from "./read-root-candidate.js";
-import { passAskFace } from "./runner/gate-exit.js";
 import { traceHookCrash } from "./gate-crash-trace.js";
-import { writeProtectionMandated, writeProtectionTightenDecision, writeProtectionUnresolved } from "./write-protect.js";
+import { writeProtectionMandated, writeProtectionTightenDecision } from "./write-protect.js";
 import { createGateDeadline, awaitWriteProtectionJudgment, gateWaitFailureOf, withGateTimeout } from "./gate-bounded-await.js";
 import { thrownText } from "./thrown-value.js";
 import { refuseOutOfContractDecision } from "./tool-policy.js";
@@ -18,10 +17,11 @@ export async function runGateFold(pass) {
         pass.req = await stamped;
     pass.decision = adjudicate ? refuseOutOfContractDecision(await (callSignal !== undefined ? adjudicate(pass.req, callSignal) : adjudicate(pass.req))) : { action: "allow" };
     {
-        const refusedBy = ledger.fromDecision(pass.decision);
-        if (refusedBy !== undefined)
-            pass.deniedBy = refusedBy;
-        if (refusedBy !== undefined)
+        const read = ledger.fromDecision(pass.decision);
+        pass.decision = read.decision;
+        if (read.deniedBy !== undefined)
+            pass.deniedBy = read.deniedBy;
+        if (read.deniedBy !== undefined)
             pass.denyCause = ledger.causeOf(pass.decision);
         const attributed = ledger.classifierRoundOf(pass.decision);
         if (attributed !== undefined)
@@ -154,21 +154,18 @@ export async function runGateFold(pass) {
     }
     const writeProtectionStanding = pass.decision.action;
     if ((writeProtectionStanding === "allow" || writeProtectionStanding === "ask") && input.writeProtectionCheck !== undefined) {
-        const judged = input.writeProtectionCheck(toolName, pass.policyRewrite !== undefined ? pass.policyRewrite : pass.currentInput, pass.req.face, input.trackedCwd?.(), pass.callSignal ?? input.abortSignal);
-        const verdict = judged === null
-            ? undefined
-            : await awaitWriteProtectionJudgment(judged, boundedAwaitDeadlineMs(), pass.callSignal ?? input.abortSignal, (err) => {
-                const kind = gateWaitFailureOf(err);
-                if (kind === "aborted" || input.abortSignal?.aborted === true)
-                    return;
-                traceHookCrash(input, new Error(`write-protection judge ${kind === "timeout" ? "timed out" : "threw"} for tool "${toolName}" (toolCallId ${toolCallId}) — this call's write target could not be judged: ${thrownText(err)}`), notifier);
-            });
+        const check = input.writeProtectionCheck;
+        const judgedArgs = pass.policyRewrite !== undefined ? pass.policyRewrite : pass.currentInput;
+        const verdict = await awaitWriteProtectionJudgment((deadline) => check(toolName, judgedArgs, pass.req.face, input.trackedCwd?.(), deadline), boundedAwaitDeadlineMs, pass.callSignal ?? input.abortSignal, (err) => {
+            const kind = gateWaitFailureOf(err);
+            if (kind === "aborted" || input.abortSignal?.aborted === true)
+                return;
+            traceHookCrash(input, new Error(`write-protection judge ${kind === "timeout" ? "timed out" : "threw"} for tool "${toolName}" (toolCallId ${toolCallId}) — this call's write target could not be judged: ${thrownText(err)}`), notifier);
+        });
         if (verdict !== undefined && writeProtectionMandated(verdict))
             pass.writeProtected = true;
-        if (verdict !== undefined && writeProtectionUnresolved(verdict))
-            pass.writeProtectionUnresolved = true;
-        const decision = verdict === undefined ? undefined : writeProtectionTightenDecision(toolName, verdict, passAskFace(pass));
-        if (decision !== undefined && writeProtectionStanding === "allow") {
+        const decision = verdict === undefined ? undefined : writeProtectionTightenDecision(toolName, verdict);
+        if (decision !== undefined && (writeProtectionStanding === "allow" || decision.action === "deny")) {
             pass.decision = decision;
             if (decision.action === "ask")
                 pass.tightenedBy = "safety";
@@ -182,10 +179,10 @@ export async function runGateFold(pass) {
     }
     return await pass.afterFold(pass);
 }
-function shellReadAskMessage(toolName, finding) {
-    return finding === "outside_roots"
-        ? `tool "${toolName}" reads outside the directories allowed for this session — explicit approval required`
-        : `tool "${toolName}" reads where the session's read boundary could not establish what is read — explicit approval required`;
+function shellReadAskMessage(toolName, verdict) {
+    if (verdict.finding !== "outside_roots")
+        return `tool "${toolName}" reads where the session's read boundary could not establish what is read — explicit approval required`;
+    return `tool "${toolName}" ${verdict.face === "write" ? "writes" : "reads"} outside the directories allowed for this session — explicit approval required`;
 }
 function applyShellReadVerdict(pass, verdict, toolName, shellGated) {
     const account = verdict.sentence !== undefined && verdict.sentence.trim().length > 0 ? inlineUntrusted(verdict.sentence, PROBE_REASON_MAX) : undefined;
@@ -193,6 +190,8 @@ function applyShellReadVerdict(pass, verdict, toolName, shellGated) {
         pass.shellWritesPlaced = true;
     if (verdict.writeProtected === true)
         pass.writeProtected = true;
+    if (verdict.targetUnresolved === true)
+        pass.targetUnresolved = true;
     if (verdict.unplacedOptions !== undefined)
         pass.shellUnplacedOptions = verdict.unplacedOptions;
     if (verdict.finding === "unestablishable" || verdict.finding === "declined" || verdict.unestablished === true)
@@ -217,7 +216,7 @@ function applyShellReadVerdict(pass, verdict, toolName, shellGated) {
             const candidate = normalizeReadRootCandidate(verdict.readRootCandidate);
             pass.decision = {
                 action: "ask",
-                message: shellReadAskMessage(toolName, verdict.finding),
+                message: shellReadAskMessage(toolName, verdict),
                 decisionReason: "safety",
                 probeMandated: true,
                 ...(account !== undefined ? { probeReason: account } : {}),
@@ -236,7 +235,7 @@ function applyShellReadVerdict(pass, verdict, toolName, shellGated) {
                 const candidate = normalizeReadRootCandidate(verdict.readRootCandidate);
                 pass.decision = {
                     action: "ask",
-                    message: shellReadAskMessage(toolName, verdict.finding),
+                    message: shellReadAskMessage(toolName, verdict),
                     decisionReason: "safety",
                     ...(account !== undefined ? { probeReason: account } : {}),
                     ...(candidate !== undefined ? { probeReadRootCandidate: candidate } : {}),