@sema-agent/core 7.49.4 → 7.50.0

package/dist/core/runner/persisted-path-rows.d.ts

@@ -1,88 +0,0 @@
-/**
- * The person's persisted PATH rows as a leg's read face takes them at prepare (the gate's rule lanes read the same store
- * per call).
- */
-import { type EffectivePermissionRules, type PermissionRuleStoreProvider } from "../permission-rule-provider.js";
-import { type PathRuleBases } from "../permission-rule-model.js";
-import { type BoundPathRule, type HeadLeads } from "../path-rule-binding.js";
-import type { RunnerDeps } from "../runner-deps.js";
-/** The person's persisted PATH rows a leg's read face takes at prepare ({@link persistedPathRowsOf}). */
-export interface PersistedPathRows {
-    /** Every live `Read(//dir/**)` allow row's directory (lexical, absolute): a standing yes to reads under it. */
-    readonly readDirectories: readonly string[];
-    /** Every live face-keyed path DENY row (`Read(...)`, `Edit(...)`), bound at its anchors (a project row at its scope root,
-     *  the rest at the chain's top leg). */
-    readonly denyRows: readonly BoundPathRule[];
-}
-/**
- * The person's persisted PATH rows, read ONCE at prepare from the same store query the gate's lanes read per call: a
- * `Read(//dir/**)` allow row is a READ DIRECTORY of the run (the Bash read station, Read / Grep / Glob — one set), and a
- * `Read(...)` / `Edit(...)` deny row joins the run's read / write deny tables (every read face, the shell's file commands
- * and traversals). One read, two directions, so a person's allow row never reaches further than their deny rows: a
- * directory it admits still refuses the paths a deny row names. A row the store gains mid-run applies from the next
- * prepare; the in-flight grant (`readRootGrant`) is the mid-run door. The store not armed, or the anonymous floor ⇒ no
- * rows. A read that failed (or did not answer in time) ⇒ no rows, and a partition the read could not read ⇒ none of ITS
- * rows (the partition that was read contributes its own): what could not be read is skipped for this run's tables — its
- * directories widen nothing and its deny rows judge nothing here — disclosed on the trace and announced to the person
- * (`onUnread`); the next prepare reads again, as it would for a row the store gained mid-run. A deny row is anchored by
- * its scope (`persistedRowAnchors`: a project row at its own scope root, a global / session row at the chain's top leg,
- * `~/` at the top leg's home); one whose pattern needs an anchor the chain does not supply (`~/` with no declared home) is
- * left to the per-call lane and disclosed.
- */
-export declare function persistedPathRowsOf(cfg: {
-    provider: PermissionRuleStoreProvider | undefined;
-    localOwnerDeclared: boolean;
-    principal: string | undefined;
-    sessionId: string;
-    /** The leg's own root: which project rows apply to this leg (either spelling of it — {@link projectScopeIdentity}). */
-    root: string;
-    rootCanonical: string | undefined;
-    /** The leg's resolution of locations (a project row's scope root, where it leads). */
-    leads: HeadLeads;
-    /** The anchors of the global / session rows and of `~/`: the chain's top leg's root and home. */
-    chainTop: PathRuleBases;
-    onDisclosure: (message: string) => void;
-    /** The person is told the store (or the named sources of it) was skipped ({@link ruleStoreUnreadableNotice}). */
-    onUnread: (at: "prepare", sources?: EffectivePermissionRules["unreadableSources"]) => void;
-    /** The person is told rows were left out ({@link ruleRowsDroppedNotice}). */
-    onRowsDropped: (rows: EffectivePermissionRules["droppedRows"]) => void;
-    /** The run's cut: a read that has not answered by then (or by the gate's await bound) reads as unreadable. */
-    signal?: AbortSignal;
-}): Promise<PersistedPathRows>;
-/**
- * The run's ONE `permission.rule_store_unavailable` notice (audience user): the person's rules — the whole store, or the
- * sources of it whose partition could not be read — were skipped; minted by whichever read found it first (the prepare
- * read of the path rows, or a call's own read on the rule lane), once per run however many reads fail after it (the
- * prepare sentence says a later call may be judged without them too). The trace keeps every read's line.
- */
-export declare function ruleStoreUnreadableNotice(onNotice: RunnerDeps["onNotice"], ids: {
-    readonly sessionId: string;
-    readonly runId: string;
-}): (at: "prepare" | "call", sources?: EffectivePermissionRules["unreadableSources"]) => void;
-/**
- * The run's ONE `permission.rule_row_dropped` notice (audience user): the person's store served project-scoped rows whose
- * scope root is not a complete absolute path, left out of the checks; minted by whichever read met them first (the
- * prepare read of the path rows, or a call's own read on the rule lane), once per run. The sentence names no path; the
- * rows (bounded) ride the detail. The trace keeps every read's line.
- */
-export declare function ruleRowsDroppedNotice(onNotice: RunnerDeps["onNotice"], ids: {
-    readonly sessionId: string;
-    readonly runId: string;
-}): (rows: EffectivePermissionRules["droppedRows"]) => void;
-/** {@link persistedPathRowsOf} for one task's prepare: only where a read face mounts (hands), disclosed on the run's trace,
- *  cut by the run's own signals. `undefined` = nothing to read, returned synchronously: a run with no person's store (or
- *  no hands) gains no suspension point on its prepare. */
-export declare function persistedPathRowsOfTask(t: {
-    deps: Pick<RunnerDeps, "permissionRuleStore" | "localOwnerRules" | "tracer">;
-    principal: string | undefined;
-    sessionId: string;
-    root: string;
-    rootCanonical: string | undefined;
-    leads: HeadLeads;
-    chainTop: PathRuleBases;
-    taskId: string;
-    handsEnabled: boolean;
-    signals: readonly AbortSignal[];
-    onUnread: (at: "prepare", sources?: EffectivePermissionRules["unreadableSources"]) => void;
-    onRowsDropped: (rows: EffectivePermissionRules["droppedRows"]) => void;
-}): Promise<PersistedPathRows> | undefined;

package/dist/core/runner/persisted-path-rows.js

@@ -1,108 +0,0 @@
-import { ownerStoreOf } from "../permission-rule-provider.js";
-import { PATH_RULE_FACES, READ_RULE_TOOL, eligiblePersisted } from "../permission-rule-model.js";
-import { bindPathRules, persistedRowAnchors, projectScopeIdentity } from "../path-rule-binding.js";
-import { inlineUntrusted } from "../untrusted-text.js";
-import { DEFAULT_GATE_AWAIT_TIMEOUT_MS, gateWaitFailureOf, withGateTimeout } from "../gate-bounded-await.js";
-import { thrownText } from "../thrown-value.js";
-import { emitTrace } from "../trace.js";
-import { deliverEngineNotice } from "../engine-notice.js";
-export async function persistedPathRowsOf(cfg) {
-    const none = { readDirectories: [], denyRows: [] };
-    const provider = cfg.provider;
-    if (provider === undefined || !readsPersistedPathRows(provider, cfg.principal, cfg.localOwnerDeclared))
-        return none;
-    let view;
-    try {
-        view = await withGateTimeout(ownerStoreOf(provider, cfg.principal, cfg.localOwnerDeclared).effective({ sessionId: cfg.sessionId }), DEFAULT_GATE_AWAIT_TIMEOUT_MS, cfg.signal, "persistedPathRows");
-    }
-    catch (err) {
-        return gateWaitFailureOf(err) === "aborted" ? none : skipped(cfg, thrownText(err));
-    }
-    if (view.unreadable !== undefined)
-        skipped(cfg, view.unreadable, view.unreadableSources);
-    cfg.onRowsDropped(view.droppedRows);
-    const scopeIdentity = await projectScopeIdentity(view.rules, cfg.rootCanonical, cfg.leads);
-    const call = { tool: READ_RULE_TOOL, cwd: cfg.root, sessionId: cfg.sessionId, ...(scopeIdentity !== undefined ? { scopeIdentity } : {}) };
-    const readDirectories = [];
-    const denySpecs = [];
-    for (const rule of view.rules) {
-        if (rule.status !== "live")
-            continue;
-        if (rule.behavior === "allow" && rule.tool === READ_RULE_TOOL && rule.match === "subpath" && eligiblePersisted(rule, call, "allow")) {
-            if (!readDirectories.includes(rule.command))
-                readDirectories.push(rule.command);
-            continue;
-        }
-        const faces = PATH_RULE_FACES[rule.tool]?.deny;
-        if (rule.behavior !== "deny" || faces === undefined || (rule.match !== "path" && rule.match !== "subpath") || !eligiblePersisted(rule, { ...call, tool: rule.tool }, "deny"))
-            continue;
-        denySpecs.push({ parsed: rule, ruleText: rule.rule, faces, rule });
-    }
-    const denyRows = [];
-    for (const row of bindPathRules(denySpecs, (spec) => persistedRowAnchors(spec.rule.scope, cfg.chainTop))) {
-        if (row.unanchored !== undefined) {
-            cfg.onDisclosure(`the persisted deny rule ${inlineUntrusted(row.rule, 200)} needs a ${row.unanchored.join(" / ")} base this task does not declare — the shell's file commands and the search tools do not judge it on this leg`);
-            continue;
-        }
-        denyRows.push(row);
-    }
-    return { readDirectories, denyRows };
-}
-function skipped(cfg, why, sources) {
-    cfg.onDisclosure(`the persisted path rules could not be read at prepare, so this run's read directories and read / write deny tables take none of ${sources !== undefined ? `the ${sourcesWord(sources)} rows` : "their rows"} (the next prepare reads again): ${why}`);
-    cfg.onUnread("prepare", sources);
-    return { readDirectories: [], denyRows: [] };
-}
-function sourcesWord(sources) {
-    return sources.length <= 1 ? sources.join("") : `${sources.slice(0, -1).join(", ")} and ${sources[sources.length - 1]}`;
-}
-const SKIPPED_STORE_SENTENCE = {
-    prepare: (which) => `${which} could not be read when this run started, so this run's file and shell checks skip their path rows (Read / Edit deny rows and Read directory rows) — a deny row among them protects nothing on this run. Each call's own rule check reads the rules again (a call whose own read fails too is judged without them), and the next run reads the path rows again.`,
-    call: (which) => `${which} could not be read for a call on this run, so that call's own rule check skipped them: none of their allow, ask or deny rows took part in it, and a deny row among them protected nothing there (path rows the run took when it started still apply to its file and shell checks). Every later call reads them again, and they apply again as soon as a read succeeds.`,
-};
-export function ruleStoreUnreadableNotice(onNotice, ids) {
-    let sent = false;
-    return (at, sources) => {
-        if (sent)
-            return;
-        sent = true;
-        const which = sources !== undefined && sources.length > 0 ? `your persisted permission rules from the ${sourcesWord(sources)} sources` : "your persisted permission rules";
-        deliverEngineNotice(onNotice, { code: "permission.rule_store_unavailable", message: SKIPPED_STORE_SENTENCE[at](which), detail: { at, sessionId: ids.sessionId, runId: ids.runId } });
-    };
-}
-export function ruleRowsDroppedNotice(onNotice, ids) {
-    let sent = false;
-    return (rows) => {
-        if (sent || rows === undefined || rows.length === 0)
-            return;
-        sent = true;
-        const one = rows.length === 1;
-        deliverEngineNotice(onNotice, {
-            code: "permission.rule_row_dropped",
-            message: `${rows.length} of your persisted permission rule rows ${one ? "is" : "are"} scoped to a project directory that is not written as a complete absolute path, so ${one ? "it takes" : "they take"} no part in this run's checks — a deny or ask row among them protects nothing. Rewrite ${one ? "it" : "them"} with the project's full path, or remove ${one ? "it" : "them"} (this notice's detail names ${one ? "it" : "them"}).`,
-            detail: { rows: rows.slice(0, 8).map((r) => ({ rule: inlineUntrusted(r.rule, 200), scopeRoot: inlineUntrusted(r.scopeRoot, 200) })), count: rows.length, sessionId: ids.sessionId, runId: ids.runId },
-        });
-    };
-}
-function readsPersistedPathRows(provider, principal, localOwnerDeclared) {
-    return provider.partitions.durable && ((principal !== undefined && principal !== "") || localOwnerDeclared);
-}
-export function persistedPathRowsOfTask(t) {
-    const provider = t.deps.permissionRuleStore;
-    if (!t.handsEnabled || provider === undefined || !readsPersistedPathRows(provider, t.principal, t.deps.localOwnerRules === true))
-        return undefined;
-    return persistedPathRowsOf({
-        provider,
-        localOwnerDeclared: t.deps.localOwnerRules === true,
-        principal: t.principal,
-        sessionId: t.sessionId,
-        root: t.root,
-        rootCanonical: t.rootCanonical,
-        leads: t.leads,
-        chainTop: t.chainTop,
-        onDisclosure: (message) => emitTrace(t.deps.tracer, () => ({ kind: "permission.rule_store_unreadable", version: 1, taskId: t.taskId, message, ts: Date.now() })),
-        onUnread: t.onUnread,
-        onRowsDropped: t.onRowsDropped,
-        signal: AbortSignal.any([...t.signals]),
-    });
-}