@sema-agent/core 7.49.4 → 7.50.0

package/dist/core/runner/person-path-rows.d.ts

@@ -0,0 +1,244 @@
+/**
+ * The person's persisted rules as ONE run reads them.
+ *
+ * ## One read per adjudicated call
+ *
+ * A call is judged against ONE read of the store, pinned to its `toolCallId` ({@link PersonPathRows.pin}): whichever of the
+ * call's consumers asks first — the read station's judgment, the org layer, the personal rule lane — takes the read, the
+ * others are handed the same answer, and the tables the call's tool judges with when it executes are compiled from it
+ * ({@link PathTablesFacade.forCall}). A call is an attempt the leg's occurrence table holds; the pin is released when the
+ * table no longer holds that attempt. A judgment that is no call of the leg (a visibility probe's fixed id, a gate with no
+ * leg) keeps nothing: its rule lanes take a read of their own, its read station the run's latest tables.
+ *
+ * ## The run's unit, one entry per partition
+ *
+ * Every read's outcome lands in the run's unit, per personal partition (the durable one — its user and project rows — and
+ * the session one), and only where it is newer, by the order the reads STARTED: a read that answers late never replaces
+ * a later one. The prepare read is the unit's first write. A reader that is not a call (the compaction summary's working-file
+ * reader, the user-attachment seat's reader, the Artifact tool's local read, a read root's grant eligibility, the classifier's table, a language server's session read)
+ * reads the unit's newest tables: while the rows the unit last took are compiling it waits for them (within
+ * {@link PATH_TABLES_READY_BOUND_MS}), and a read of tables still compiling, or that could not be compiled, refuses —
+ * never the tables of rows the unit has since replaced.
+ *
+ * ## One failure law, every consumer
+ *
+ * A partition a read could not read (it failed, or the whole read failed or did not answer in time) contributes the deny
+ * and ask rows of the run's last successful read of that partition, and none of its allow rows (a `Read(//dir/**)` read
+ * directory among them): what could not be read widens nothing, and what was read before still protects. A partition the
+ * read did read contributes its rows as read, both directions. The cost: a deny row the person just removed keeps
+ * refusing while its partition cannot be read — the run's one notice says so.
+ *
+ * ## One table facade
+ *
+ * The read deny table, the write deny table and the read directories are compiled from the rows a read stands on, once
+ * per distinct content (row text × scope, which fixes the anchors; the directories), and held behind one facade whose
+ * every reader takes the call's tables or the unit's latest.
+ */
+import type { EffectivePermissionRules, PermissionRuleStoreProvider, PersonRowsRead } from "../permission-rule-provider.js";
+import { type PathRuleBases } from "../permission-rule-model.js";
+import { type BoundPathRule, type HeadLeads } from "../path-rule-binding.js";
+import type { RunnerDeps } from "../runner-deps.js";
+import { type PathRuleDenyRow, type ReadDenyBuiltinConfig, type ReadDenyEntry, type ReadDenySeat, type WriteDenyMatcher } from "../../tools/fs/read-deny.js";
+import { type HomeViewSource, type PlacedReadDenyMatcher } from "../../tools/fs/read-deny-home.js";
+import { type ShellReadCheck } from "../../tools/fs/shell-read-check.js";
+import type { AgentTool, ExecutionEnv } from "../../internal/harness-types.js";
+/**
+ * How long a read waits for the store before its call is judged by the failure law: one second inside the rule lanes' own
+ * wait (`ORG_ADJUDICATION_TIMEOUT_MS`, the gate's bound on each lane), so the law's answer — the deny and ask rows last
+ * read — reaches a lane before the lane's wait ends and reads its absence as no rule at all.
+ */
+export declare const PERSON_READ_BOUND_MS: number;
+/** The one bound on path tables becoming ready: a compile settles or fails within it, and a reader waits for its tables at
+ *  most this long (a call's own, or the unit's newest) before it reads them — and is refused if they are not ready. */
+export declare const PATH_TABLES_READY_BOUND_MS = 30000;
+/** The person's rows a run's path tables take: their face-keyed path deny rows, bound at their anchors, and the
+ *  directories of their `Read(//dir/**)` allow rows (lexical, absolute). */
+export interface PersonTableRows {
+    readonly denyRows: readonly BoundPathRule[];
+    readonly readDirectories: readonly string[];
+}
+/** A run's path tables, compiled over one set of the person's rows beside the leg's own. */
+export interface PathTables {
+    /** The read deny table, placed at its homes. */
+    readonly readDeny: PlacedReadDenyMatcher;
+    /** The write deny table, with the read table's home views. */
+    readonly writeDeny: WriteDenyMatcher & {
+        readonly homeViews: HomeViewSource;
+    };
+    /** The person's read directories, canonical. */
+    readonly readDirectories: readonly string[];
+    /** The rule rows both tables were compiled over (the leg's own and the person's, as bound — before their twins where
+     *  their heads lead): what the tables say they guard. */
+    readonly ruleRows: readonly PathRuleDenyRow[];
+}
+/** A read-root set read per judgment, and the one a call judges with (`forCall`: its pinned read's, or the latest); `ready`
+ *  settles once the set a reader that is no call takes is compiled ({@link PersonPathRows.tablesReady}). */
+export type ReadRootsSeat = (() => readonly string[]) & {
+    forCall(toolCallId: string | undefined): () => readonly string[];
+    ready(signal?: AbortSignal): Promise<void>;
+};
+/** The read-root seat of a leg with no read face: no roots, ready. */
+export declare const EMPTY_READ_ROOTS: ReadRootsSeat;
+/** The tables, a call's or the unit's newest: `forCall(undefined)` and a call holding no pinned read take the newest — a
+ *  read of them while they compile, or after they could not be compiled, throws (the check refuses). */
+export interface PathTablesFacade {
+    /** The tables ONE call judges with: its pinned read's, or the unit's newest (an unknown or released call). */
+    forCall(toolCallId: string | undefined): PathTables;
+    /** The read deny table: each judgment reads the unit's latest; `forCall` hands a call its own. */
+    readonly readDeny: PlacedReadDenyMatcher & {
+        forCall(toolCallId: string | undefined): PlacedReadDenyMatcher;
+    };
+    /** The write deny table, the same way. */
+    readonly writeDeny: WriteDenyMatcher & {
+        readonly homeViews: HomeViewSource;
+        forCall(toolCallId: string | undefined): WriteDenyMatcher & {
+            readonly homeViews: HomeViewSource;
+        };
+    };
+    /** The person's read directories (canonical), a call's or the unit's latest. */
+    readDirectories(toolCallId?: string): readonly string[];
+    /** The rule rows of the unit's latest tables ({@link PathTables.ruleRows}). */
+    ruleRows(): readonly PathRuleDenyRow[];
+}
+/** The one reader of a run's person's store. */
+export interface PersonPathRows {
+    /** Whether the run has a person whose rows a read could carry (a durable partition, and an owner). */
+    readonly holdsPersonRows: boolean;
+    /** The prepare read — the unit's first write. `undefined`, synchronously, when there is no person's rows to read. */
+    prime(): Promise<void> | undefined;
+    /** The rows of a call's one read — a call the leg's occurrence table holds: taken by its first consumer, handed to every
+     *  other until the table no longer holds that attempt; any other judgment (no leg, or an id the table does not hold — a
+     *  visibility probe) takes a read of its own, kept by nobody. Bounded ({@link PERSON_READ_BOUND_MS}); never rejects. */
+    pin(toolCallId: string): Promise<PersonRowsRead>;
+    /** Settles once the tables a reader takes are compiled: a pinned call's own; any other reader's (no id, or a call holding
+     *  no pin), the unit's newest — through every change that lands meanwhile, within {@link PATH_TABLES_READY_BOUND_MS} —
+     *  or at `signal` or the run's cut ({@link PersonPathRowsConfig.signal}). Never rejects: a reader whose wait was cut
+     *  checks its own signal and refuses; tables still compiling, or that could not be compiled, refuse at the read
+     *  ({@link PathTablesFacade.forCall}). */
+    tablesReady(toolCallId?: string, signal?: AbortSignal): Promise<void>;
+    /** Whether `toolCallId` is a call of the leg (an attempt its occurrence table holds): the judgments that read a call's
+     *  one read. A read station's judgment that is no call reads the run's latest tables and takes no read. */
+    holds(toolCallId: string): boolean;
+    /** Whether a partition of the rows a judgment stands on could not be read — a pinned call's read's, or the run's latest
+     *  read of each partition: there "no row forbids this" cannot be told from "a row it cannot see does" (`false` for a run
+     *  with no person's rows). */
+    unreadFor(toolCallId?: string): boolean;
+    /** The tables over the unit's latest and every call's read, compiled by `compile` (the leg's own rows beside the
+     *  person's): compiled now from the unit's latest. */
+    attachTables(compile: (person: PersonTableRows) => Promise<PathTables>): Promise<PathTablesFacade>;
+}
+export interface PersonPathRowsConfig {
+    provider: PermissionRuleStoreProvider | undefined;
+    localOwnerDeclared: boolean;
+    principal: string | undefined;
+    sessionId: string;
+    /** The leg's own root: which project rows apply (either spelling of it — {@link projectScopeIdentity}). */
+    root: string;
+    rootCanonical: string | undefined;
+    /** The leg's resolution of locations (a project row's scope root, where it leads). */
+    leads: HeadLeads;
+    /** The anchors of the global / session rows and of `~/`: the chain's top leg's root and home. */
+    chainTop: PathRuleBases;
+    /** The leg's calls: a call is pinned to its attempt here, and released when the table no longer holds that attempt. */
+    occurrences?: {
+        get(toolCallId: string): unknown;
+    };
+    /** An engine defect the run must hear of beyond its trace (a table that could not be compiled). */
+    onDefect?: (err: Error) => void;
+    /** The operator's line for each read the store could not answer, each disclosure line a read carries, each row a table
+     *  could not anchor. */
+    onDisclosure: (message: string) => void;
+    /** The run's one notice for a store that could not be read ({@link ruleStoreUnreadableNotice}). */
+    onUnread: (at: "prepare" | "call", sources?: EffectivePermissionRules["unreadableSources"]) => void;
+    /** The run's one notice for rows left out ({@link ruleRowsDroppedNotice}). */
+    onRowsDropped: (rows: EffectivePermissionRules["droppedRows"]) => void;
+    /** The run's cut: a read it interrupts is abandoned quietly — a cancelled wait is no fact about the store — and every wait
+     *  on the tables ends at it. */
+    signal?: AbortSignal;
+}
+export declare function createPersonPathRows(cfg: PersonPathRowsConfig): PersonPathRows;
+/** The compile of a run's path tables over the leg's own rows beside one set of the person's: every row also judged where
+ *  its head leads in this environment; the home-anchored and rooted rows placed at their homes and where they lead (the
+ *  host's declared configuration root among them); the write face over the same rows with the read table's home views;
+ *  the person's read directories canonicalized by `canonicalize` (the leg's admission of a declared read root). */
+export declare function pathTablesCompile(seats: {
+    readonly env: ExecutionEnv;
+    readonly additions: readonly ReadDenyEntry[];
+    readonly builtin: ReadDenyBuiltinConfig;
+    readonly legRows: readonly PathRuleDenyRow[];
+    readonly leads: HeadLeads;
+    readonly configRoot: string | undefined;
+    readonly canonicalize: (dirs: readonly string[]) => Promise<readonly string[]>;
+}): (person: PersonTableRows) => Promise<PathTables>;
+/** The read face's root set over the leg's own roots (`own`, read per judgment) and the person's read directories — a
+ *  call's own (`forCall`) or the run's latest. A person's directory that admits any part of the local artifact store
+ *  (`store`, once known) is no read root: the store rule an in-flight grant meets; `onHeld` hears each such directory once. */
+export declare function readRootsOver(seats: {
+    readonly own: () => readonly string[];
+    readonly tables: PathTablesFacade;
+    readonly ready: PersonPathRows["tablesReady"];
+    readonly store: () => string | undefined;
+    readonly onHeld: (dir: string, store: string) => void;
+}): ReadRootsSeat;
+export declare function denySeatsOf(t: PathTables): {
+    readonly read: ReadDenySeat;
+    readonly write: {
+        readonly writeDenyMatch?: (p: string) => string | null;
+    };
+};
+/**
+ * The leg's read stations as ONE gate input, each judgment on its call's pinned read of the person's rules: a station is
+ * a call's first consumer of the person's rows (it sits in the fold, ahead of the rule lanes), so it takes the call's
+ * read before it judges — the read every later consumer of the call is handed — and judges with that read's tables. A
+ * judgment that is no call of the leg (no id, or one the leg does not hold) takes no read and judges with the run's
+ * newest tables once they are ready, as every reader that is no call does; a judged call the station finds nothing to
+ * read in is vouched for, as it would have been. (A partition of those rows that could not be read reaches the station on
+ * the boundary it judges with — {@link PersonPathRows.unreadFor} — where it vouches for nothing.)
+ */
+export declare function onPinnedRead(rows: PersonPathRows, stations: ReadonlyArray<{
+    readonly check: ShellReadCheck;
+    readonly tools: ReadonlySet<string>;
+}>): ShellReadCheck | undefined;
+/** A tool that holds the run's tables, run once the tables it reads are compiled (or the call is cancelled) — the tool
+ *  reads its call's own (`seatForCall`) at the start of its execution; a call no gate consumer pinned reads the run's
+ *  newest. The wait is bounded ({@link PATH_TABLES_READY_BOUND_MS}). */
+export declare function afterCallTables(rows: PersonPathRows, tool: AgentTool): AgentTool;
+/** A reader for one task's prepare: the deployment's store and owner, its notices on the run's one notice seats (`notices`,
+ *  minted once per run: every reader of the run tells through them), its lines on the run's trace, cut by `signals` (the
+ *  run's own; none for the judgment asked after the run has ended), released with the leg's calls. */
+export declare function personPathRowsOfTask(t: {
+    readonly deps: Pick<RunnerDeps, "permissionRuleStore" | "localOwnerRules" | "tracer" | "onError">;
+    readonly notices: Pick<PersonPathRowsConfig, "onUnread" | "onRowsDropped">;
+    readonly principal: string | undefined;
+    readonly ids: {
+        readonly sessionId: string;
+        readonly runId: string;
+        readonly taskId: string;
+    };
+    readonly root: string;
+    readonly rootCanonical: string | undefined;
+    readonly leads: HeadLeads;
+    readonly chainTop: PathRuleBases;
+    readonly occurrences: {
+        get(toolCallId: string): unknown;
+    };
+    readonly signals: readonly AbortSignal[];
+}): PersonPathRows;
+/**
+ * The run's ONE `permission.rule_store_unavailable` notice (audience user): the person's rules — the whole store, or the
+ * sources of it whose partition could not be read — could not be read; minted by whichever read found it first (the
+ * prepare read, or a call's), once per run however many reads fail after it. The trace keeps every read's line.
+ */
+export declare function ruleStoreUnreadableNotice(onNotice: RunnerDeps["onNotice"], ids: {
+    readonly sessionId: string;
+    readonly runId: string;
+}): (at: "prepare" | "call", sources?: EffectivePermissionRules["unreadableSources"]) => void;
+/**
+ * The run's ONE `permission.rule_row_dropped` notice (audience user): the person's store served project-scoped rows whose
+ * scope root is not a complete absolute path, left out of the checks; minted by whichever read met them first, once per
+ * run. The sentence names no path; the rows (bounded) ride the detail. The trace keeps every read's line.
+ */
+export declare function ruleRowsDroppedNotice(onNotice: RunnerDeps["onNotice"], ids: {
+    readonly sessionId: string;
+    readonly runId: string;
+}): (rows: EffectivePermissionRules["droppedRows"]) => void;

package/dist/core/runner/person-path-rows.js

@@ -0,0 +1,387 @@
+import { ownerStoreOf } from "../permission-rule-provider.js";
+import { ORG_ADJUDICATION_TIMEOUT_MS } from "../permission-rule-org.js";
+import { PATH_RULE_FACES, READ_RULE_TOOL, eligiblePersisted } from "../permission-rule-model.js";
+import { bindPathRules, persistedRowAnchors, projectScopeIdentity } from "../path-rule-binding.js";
+import { DEFAULT_GATE_AWAIT_TIMEOUT_MS, gateWaitFailureOf, withGateTimeout } from "../gate-bounded-await.js";
+import { thrownText } from "../thrown-value.js";
+import { inlineUntrusted } from "../untrusted-text.js";
+import { deliverEngineNotice } from "../engine-notice.js";
+import { compileReadDeny, compileWriteDeny, readDenySeat, rowsWhereTheyLead } from "../../tools/fs/read-deny.js";
+import { carryHomeViews, placeReadDenyAtHome, readDenyOver } from "../../tools/fs/read-deny-home.js";
+import { composeReadChecks } from "../../tools/fs/file-read-check.js";
+import { readStationMemberOf } from "../../tools/fs/shell-read-check.js";
+import { rootAdmittingArtifactStore } from "../../tools/fs/safety.js";
+import { emitTrace } from "../trace.js";
+const PARTITIONS = ["session", "durable"];
+const partitionOf = (source) => (source === "session" ? "session" : "durable");
+const tightening = (rule) => rule.behavior === "deny" || rule.behavior === "ask";
+export const PERSON_READ_BOUND_MS = ORG_ADJUDICATION_TIMEOUT_MS - 1_000;
+export const PATH_TABLES_READY_BOUND_MS = DEFAULT_GATE_AWAIT_TIMEOUT_MS;
+const COMPILED_TABLES_KEPT = 8;
+export const EMPTY_READ_ROOTS = Object.assign(() => [], { forCall: () => () => [], ready: () => Promise.resolve() });
+export function createPersonPathRows(cfg) {
+    const provider = cfg.provider;
+    const anonymous = cfg.principal === undefined || cfg.principal === "";
+    const holdsPersonRows = provider !== undefined && provider.partitions.durable && (!anonymous || cfg.localOwnerDeclared);
+    const partitions = PARTITIONS.filter((p) => (p === "durable" ? provider?.partitions.durable === true : provider?.partitions.session === true));
+    const unit = { durable: { failedSeq: 0 }, session: { failedSeq: 0 } };
+    let seqs = 0;
+    const pins = new Map();
+    let compile;
+    const compiled = new Map();
+    let unitTables;
+    const unanchoredSaid = new Set();
+    const land = (o) => {
+        if (o.cut === true)
+            return;
+        let changed = false;
+        for (const p of partitions) {
+            const cell = unit[p];
+            const okSeq = cell.ok?.seq ?? 0;
+            if (o.failed.has(p) || o.view === undefined) {
+                if (o.seq > okSeq && o.seq > cell.failedSeq) {
+                    cell.failedSeq = o.seq;
+                    changed = true;
+                }
+            }
+            else if (o.seq >= cell.failedSeq && o.seq > okSeq) {
+                cell.ok = { seq: o.seq, rows: o.view.rules.filter((r) => partitionOf(r.source) === p) };
+                changed = true;
+            }
+        }
+        if (changed && compile !== undefined)
+            refreshUnitTables();
+    };
+    const lawed = (p, read) => read !== undefined ? read : (unit[p].ok?.rows ?? []).filter(tightening);
+    const latestUnread = () => holdsPersonRows && partitions.some((p) => unit[p].failedSeq > (unit[p].ok?.seq ?? 0));
+    const unitLatestRules = () => partitions.flatMap((p) => {
+        const cell = unit[p];
+        return lawed(p, cell.ok !== undefined && cell.failedSeq <= cell.ok.seq ? cell.ok.rows : undefined);
+    });
+    const readOnce = (at) => {
+        const seq = ++seqs;
+        if (provider === undefined)
+            return Promise.resolve({ rules: [] });
+        let raw;
+        try {
+            raw = ownerStoreOf(provider, cfg.principal, cfg.localOwnerDeclared).effective({ sessionId: cfg.sessionId });
+        }
+        catch (err) {
+            raw = Promise.reject(err);
+        }
+        const outcomeOf = (view) => ({ seq, view: holdsPersonRows ? view : { ...view, rules: [] }, failed: holdsPersonRows ? failedOf(view) : new Set() });
+        void raw.then((view) => {
+            for (const line of view.disclosures)
+                cfg.onDisclosure(line);
+            cfg.onRowsDropped(view.droppedRows);
+            if (holdsPersonRows && view.unreadable !== undefined)
+                announce(at, view.unreadable, view.unreadableSources);
+            land(outcomeOf(view));
+        }, () => undefined);
+        return withGateTimeout(raw, PERSON_READ_BOUND_MS, cfg.signal, "personRules").then((view) => readOf(outcomeOf(view)), (err) => {
+            const cut = gateWaitFailureOf(err) === "aborted";
+            const outcome = { seq, failed: new Set(partitions), why: thrownText(err), ...(cut ? { cut: true } : {}) };
+            land(outcome);
+            if (holdsPersonRows && !cut)
+                announce(at, outcome.why);
+            return readOf(outcome);
+        });
+    };
+    const failedOf = (view) => view.unreadable !== undefined && (view.unreadableSources ?? []).length === 0 ? new Set(partitions) : new Set((view.unreadableSources ?? []).map(partitionOf).filter((p) => partitions.includes(p)));
+    const defect = (message) => {
+        cfg.onDisclosure(message);
+        cfg.onDefect?.(new Error(message));
+    };
+    const readOf = (o) => {
+        const rules = partitions.flatMap((p) => lawed(p, o.view !== undefined && !o.failed.has(p) ? o.view.rules.filter((r) => partitionOf(r.source) === p) : undefined));
+        const unreadable = o.view !== undefined ? o.view.unreadable : (o.why ?? "the store did not answer");
+        return { rules, ...(o.view !== undefined ? { org: o.view.org } : {}), ...(unreadable !== undefined ? { unreadable } : {}) };
+    };
+    const announce = (at, why, sources) => {
+        cfg.onDisclosure(`the person's persisted rules could not be read (${at === "prepare" ? "when the run started" : "for a call"}${sources !== undefined && sources.length > 0 ? `; ${sourcesWord(sources)} rows` : ""}): their allow rows take no part until a read succeeds, the deny and ask rows of the run's last successful read still apply — ${why}`);
+        cfg.onUnread(at, sources);
+    };
+    const tableRowsOf = async (rules) => {
+        if (rules.length === 0)
+            return { denyRows: [], readDirectories: [] };
+        const scopeIdentity = await projectScopeIdentity(rules, cfg.rootCanonical, cfg.leads);
+        const call = { tool: READ_RULE_TOOL, cwd: cfg.root, sessionId: cfg.sessionId, ...(scopeIdentity !== undefined ? { scopeIdentity } : {}) };
+        const readDirectories = [];
+        const denySpecs = [];
+        for (const rule of rules) {
+            if (rule.status !== "live")
+                continue;
+            if (rule.behavior === "allow" && rule.tool === READ_RULE_TOOL && rule.match === "subpath" && eligiblePersisted(rule, call, "allow")) {
+                if (!readDirectories.includes(rule.command))
+                    readDirectories.push(rule.command);
+                continue;
+            }
+            const faces = PATH_RULE_FACES[rule.tool]?.deny;
+            if (rule.behavior !== "deny" || faces === undefined || (rule.match !== "path" && rule.match !== "subpath") || !eligiblePersisted(rule, { ...call, tool: rule.tool }, "deny"))
+                continue;
+            denySpecs.push({ parsed: rule, ruleText: rule.rule, faces, rule });
+        }
+        const denyRows = [];
+        for (const row of bindPathRules(denySpecs, (spec) => persistedRowAnchors(spec.rule.scope, cfg.chainTop))) {
+            if (row.unanchored !== undefined) {
+                if (!unanchoredSaid.has(row.rule)) {
+                    unanchoredSaid.add(row.rule);
+                    cfg.onDisclosure(`the persisted deny rule ${inlineUntrusted(row.rule, 200)} needs a ${row.unanchored.join(" / ")} base this task does not declare — the shell's file commands and the search tools do not judge it on this leg (the gate asks)`);
+                }
+                continue;
+            }
+            denyRows.push(row);
+        }
+        return { denyRows, readDirectories };
+    };
+    const tablesOf = (rules) => {
+        const make = compile;
+        if (make === undefined)
+            return Promise.resolve(undefined);
+        const compiling = (async () => {
+            const person = await tableRowsOf(rules);
+            const key = JSON.stringify([person.denyRows.map((r) => [r.rule, scopeKey(r.spec.rule)]), person.readDirectories]);
+            let tables = compiled.get(key);
+            if (tables === undefined) {
+                tables = withGateTimeout(make(person), PATH_TABLES_READY_BOUND_MS, undefined, "pathTablesCompile");
+                compiled.set(key, tables);
+                if (compiled.size > COMPILED_TABLES_KEPT)
+                    compiled.delete(compiled.keys().next().value);
+                tables.catch(() => compiled.delete(key));
+            }
+            return await tables;
+        })();
+        return withGateTimeout(compiling, PATH_TABLES_READY_BOUND_MS, undefined, "pathTablesCompile");
+    };
+    const contentOf = (rules) => JSON.stringify(rules.map(({ adds: _adds, ...row }) => row));
+    const refreshUnitTables = () => {
+        const rules = unitLatestRules();
+        const key = contentOf(rules);
+        if (unitTables !== undefined && unitTables.key === key && unitTables.state !== "failed")
+            return;
+        const cell = { key, state: "compiling", settled: Promise.resolve() };
+        cell.settled = tablesOf(rules).then((tables) => {
+            cell.tables = tables;
+            cell.state = "ready";
+        }, (err) => {
+            cell.failed = thrownText(err);
+            cell.state = "failed";
+            defect(`the path tables over the person's newest rows could not be compiled; the checks that are no call's refuse until a later read compiles: ${cell.failed}`);
+        });
+        unitTables = cell;
+    };
+    const unitReady = async (signal) => {
+        const deadline = Date.now() + PATH_TABLES_READY_BOUND_MS;
+        for (let cell = unitTables; cell?.state === "compiling" && signal?.aborted !== true; cell = unitTables) {
+            const left = deadline - Date.now();
+            if (left <= 0)
+                return;
+            await withGateTimeout(cell.settled, left, signal, "pathTablesReady").catch(() => undefined);
+        }
+    };
+    const pinOf = (toolCallId) => {
+        const p = toolCallId === undefined ? undefined : pins.get(toolCallId);
+        if (p === undefined || cfg.occurrences?.get(toolCallId) === p.attempt)
+            return p;
+        pins.delete(toolCallId);
+        return undefined;
+    };
+    const enter = (toolCallId, attempt) => {
+        const rows = readOnce("call").then((read) => (entry.read = read));
+        const entry = { attempt, rows, tables: holdsPersonRows ? rows.then((read) => settleTables(entry, read)) : Promise.resolve(), ...(holdsPersonRows ? {} : { settled: {} }) };
+        pins.set(toolCallId, entry);
+        return entry;
+    };
+    const pin = (toolCallId) => {
+        for (const id of [...pins.keys()])
+            pinOf(id);
+        const known = pinOf(toolCallId);
+        if (known !== undefined)
+            return known.rows;
+        const attempt = cfg.occurrences?.get(toolCallId);
+        return attempt === undefined ? readOnce("call") : enter(toolCallId, attempt).rows;
+    };
+    const settleTables = async (entry, read) => {
+        try {
+            const tables = await tablesOf(read.rules);
+            entry.settled = tables !== undefined ? { tables } : {};
+        }
+        catch (err) {
+            entry.settled = { failed: thrownText(err) };
+            defect(`the path tables of a call's read of the person's rows could not be compiled — the call's file and shell checks refuse it rather than judge it with other tables: ${entry.settled.failed}`);
+        }
+    };
+    const tablesFor = (toolCallId) => {
+        const p = pinOf(toolCallId);
+        if (p?.settled?.failed !== undefined)
+            throw new Error(`this call's path tables could not be compiled, so the call is refused: ${p.settled.failed}`);
+        if (p !== undefined && p.settled === undefined)
+            throw new Error("a call's path tables were read before they were compiled (an engine defect: a check ran ahead of its call's read)");
+        if (p?.settled?.tables !== undefined)
+            return p.settled.tables;
+        const u = unitTables;
+        if (u === undefined)
+            throw new Error("the run's path tables were read before they were compiled (an engine defect)");
+        if (u.state === "ready" && u.tables !== undefined)
+            return u.tables;
+        throw new Error(u.state === "failed"
+            ? `the path tables over the person's newest rows could not be compiled, so this check refuses rather than judge with the tables of the rows they replace: ${u.failed}`
+            : "the path tables over the person's newest rows are still being compiled, so this check refuses rather than judge with the tables of the rows they replace");
+    };
+    return {
+        holdsPersonRows,
+        prime: () => holdsPersonRows
+            ? readOnce("prepare").then(() => undefined)
+            : undefined,
+        pin,
+        tablesReady: (toolCallId, signal) => {
+            const p = pinOf(toolCallId);
+            const cut = signal === undefined || cfg.signal === undefined ? (signal ?? cfg.signal) : AbortSignal.any([signal, cfg.signal]);
+            return p !== undefined ? withGateTimeout(p.tables, undefined, cut, "callTables").catch(() => undefined) : unitReady(cut);
+        },
+        holds: (toolCallId) => cfg.occurrences?.get(toolCallId) !== undefined,
+        unreadFor: (toolCallId) => {
+            const read = pinOf(toolCallId)?.read;
+            return read !== undefined ? holdsPersonRows && read.unreadable !== undefined : latestUnread();
+        },
+        attachTables: async (make) => {
+            compile = make;
+            const rules = unitLatestRules();
+            const tables = await tablesOf(rules);
+            unitTables ??= { key: contentOf(rules), state: "ready", tables: tables, settled: Promise.resolve() };
+            const judging = () => {
+                if (latestUnread())
+                    throw new Error("a partition of the person's persisted rules could not be read when the run last read it, so this check refuses rather than judge past rows it cannot see");
+                return tablesFor(undefined);
+            };
+            const readDeny = Object.assign(readDenyOver(() => tablesFor(undefined).readDeny, tables.readDeny.homeViews), {
+                matchPath: (path, opts) => judging().readDeny.matchPath(path, opts),
+                matchTarget: (canonicalKey, lexicalView, opts) => judging().readDeny.matchTarget(canonicalKey, lexicalView, opts),
+                unexcludableUnder: (scope) => judging().readDeny.unexcludableUnder?.(scope) ?? false,
+                rowAtOrBelow: (path) => judging().readDeny.rowAtOrBelow?.(path) ?? null,
+                forCall: (id) => tablesFor(id).readDeny,
+            });
+            const writeDeny = {
+                face: "write",
+                get ruleRows() {
+                    return tablesFor(undefined).writeDeny.ruleRows;
+                },
+                matchPath: (path) => judging().writeDeny.matchPath(path),
+                matchTarget: (canonicalKey, lexicalView, opts) => judging().writeDeny.matchTarget(canonicalKey, lexicalView, opts),
+                homeViews: readDeny.homeViews,
+                forCall: (id) => tablesFor(id).writeDeny,
+            };
+            return { forCall: tablesFor, readDeny, writeDeny, readDirectories: (id) => tablesFor(id).readDirectories, ruleRows: () => tablesFor(undefined).ruleRows };
+        },
+    };
+}
+export function pathTablesCompile(seats) {
+    return async (person) => {
+        const rows = [...seats.legRows, ...person.denyRows];
+        const led = rowsWhereTheyLead(rows, await seats.leads.resolve(rows));
+        const placed = await placeReadDenyAtHome(seats.env, (homes, linked) => compileReadDeny(seats.additions, "readDenyPatterns", seats.builtin, led, homes, linked), undefined, undefined, seats.configRoot);
+        return { readDeny: placed.matcher, writeDeny: carryHomeViews(compileWriteDeny(led), placed.matcher.homeViews), readDirectories: [...new Set(await seats.canonicalize(person.readDirectories))], ruleRows: rows };
+    };
+}
+export function readRootsOver(seats) {
+    const said = new Set();
+    const rootsOf = (personDirs) => {
+        const own = seats.own();
+        const store = seats.store();
+        const held = store === undefined ? [] : personDirs.filter((k) => !own.includes(k) && rootAdmittingArtifactStore(store, [k]) !== undefined);
+        for (const dir of held)
+            if (!said.has(dir))
+                (said.add(dir), seats.onHeld(dir, store));
+        return [...new Set([...own, ...personDirs.filter((k) => !held.includes(k))])];
+    };
+    return Object.assign(() => rootsOf(seats.tables.readDirectories()), { forCall: (toolCallId) => () => rootsOf(seats.tables.readDirectories(toolCallId)), ready: (signal) => seats.ready(undefined, signal) });
+}
+const SEATS = new WeakMap();
+export function denySeatsOf(t) {
+    let seats = SEATS.get(t);
+    if (seats === undefined) {
+        seats = { read: readDenySeat(t.readDeny), write: t.writeDeny.ruleRows.length > 0 ? { writeDenyMatch: (p) => t.writeDeny.matchPath(p)?.pattern ?? null } : {} };
+        SEATS.set(t, seats);
+    }
+    return seats;
+}
+const VOUCHED = { disposition: "vouch", finding: "none" };
+export function onPinnedRead(rows, stations) {
+    const check = composeReadChecks(stations);
+    if (check === undefined || !rows.holdsPersonRows)
+        return check;
+    const members = new Set(stations.flatMap((s) => [...s.tools]));
+    return {
+        judge(call, args, cwd, signal, callOpts) {
+            const id = callOpts.toolCallId;
+            if (readStationMemberOf(call, members) === undefined)
+                return check.judge(call, args, cwd, signal, callOpts);
+            const ready = id !== undefined && rows.holds(id) ? rows.pin(id).then(() => rows.tablesReady(id)) : rows.tablesReady(undefined, signal);
+            return ready.then(() => check.judge(call, args, cwd, signal, callOpts) ?? VOUCHED);
+        },
+        unanswered: (call, cause) => check.unanswered(call, cause),
+    };
+}
+export function afterCallTables(rows, tool) {
+    return {
+        ...tool,
+        execute: async (toolCallId, params, signal, onUpdate) => {
+            await rows.tablesReady(toolCallId, signal);
+            return await tool.execute(toolCallId, params, signal, onUpdate);
+        },
+    };
+}
+export function personPathRowsOfTask(t) {
+    const { sessionId, taskId } = t.ids;
+    return createPersonPathRows({
+        provider: t.deps.permissionRuleStore,
+        localOwnerDeclared: t.deps.localOwnerRules === true,
+        principal: t.principal,
+        sessionId,
+        root: t.root,
+        rootCanonical: t.rootCanonical,
+        leads: t.leads,
+        chainTop: t.chainTop,
+        occurrences: t.occurrences,
+        onDisclosure: (message) => emitTrace(t.deps.tracer, () => ({ kind: "permission.rule_store_unreadable", version: 1, taskId, message, ts: Date.now() })),
+        onUnread: t.notices.onUnread,
+        onRowsDropped: t.notices.onRowsDropped,
+        onDefect: (err) => t.deps.onError?.(err, { phase: "config", sessionId }),
+        signal: AbortSignal.any([...t.signals]),
+    });
+}
+function scopeKey(rule) {
+    const scope = rule?.scope;
+    return scope === undefined ? "" : scope.kind === "project" ? `project:${scope.root}` : scope.kind;
+}
+function sourcesWord(sources) {
+    return sources.length <= 1 ? sources.join("") : `${sources.slice(0, -1).join(", ")} and ${sources[sources.length - 1]}`;
+}
+export function ruleStoreUnreadableNotice(onNotice, ids) {
+    let sent = false;
+    return (at, sources) => {
+        if (sent)
+            return;
+        sent = true;
+        const which = sources !== undefined && sources.length > 0 ? `your persisted permission rules from the ${sourcesWord(sources)} sources` : "your persisted permission rules";
+        deliverEngineNotice(onNotice, {
+            code: "permission.rule_store_unavailable",
+            message: `${which} could not be read ${at === "prepare" ? "when this run started" : "for a call on this run"}. Until a read of them succeeds, none of their allow rows (Read directory rows included) applies, while the deny and ask rows most recently read from them this run still apply — a deny row you removed since that read keeps refusing until then. While they cannot be read, every call your rules judge (a file read, a write, a command) is asked about rather than allowed, until a read of them succeeds. Every later check reads them again.`,
+            detail: { at, sessionId: ids.sessionId, runId: ids.runId },
+        });
+    };
+}
+export function ruleRowsDroppedNotice(onNotice, ids) {
+    let sent = false;
+    return (rows) => {
+        if (sent || rows === undefined || rows.length === 0)
+            return;
+        sent = true;
+        const one = rows.length === 1;
+        deliverEngineNotice(onNotice, {
+            code: "permission.rule_row_dropped",
+            message: `${rows.length} of your persisted permission rule rows ${one ? "is" : "are"} scoped to a project directory that is not written as a complete absolute path, so ${one ? "it takes" : "they take"} no part in this run's checks — a deny or ask row among them protects nothing. Rewrite ${one ? "it" : "them"} with the project's full path, or remove ${one ? "it" : "them"} (this notice's detail names ${one ? "it" : "them"}).`,
+            detail: { rows: rows.slice(0, 8).map((r) => ({ rule: inlineUntrusted(r.rule, 200), scopeRoot: inlineUntrusted(r.scopeRoot, 200) })), count: rows.length, sessionId: ids.sessionId, runId: ids.runId },
+        });
+    };
+}

package/dist/core/runner/prepare-acquire-reconcile.js

@@ -1,4 +1,6 @@
 import { StoredSession, isSessionConflict } from "../session.js";
+import { userAttachmentOf } from "../../internal/llm.js";
+import { lastAttachmentFrameOf } from "../user-attachment.js";
 import { reconcileInterruptedSession } from "../session-reconcile.js";
 import { detectConflicts, settleBranchWriteBack } from "./branch-writeback.js";
 import { settleTeardownLeg } from "./teardown-bounded.js";
@@ -57,6 +59,11 @@ export async function prepareAcquireReconcile(input) {
                         e.code = "resume_at.not_a_message";
                         throw e;
                     }
+                    if (userAttachmentOf(msg) !== undefined) {
+                        const e = new Error(`resumeAt entry "${spec.resumeAt}" is an attachment frame that trails a user message; resume at that user message instead`);
+                        e.code = "resume_at.not_a_message";
+                        throw e;
+                    }
                 }
                 if (spec.resumeAtMode === "before") {
                     const role = entry.type === "message" ? entry.message.role : undefined;
@@ -84,7 +91,7 @@ export async function prepareAcquireReconcile(input) {
                         throw e;
                     }
                 }
-                const storage = session.getStorage(), leafBefore = await storage.getLeafId(), leafSet = spec.resumeAtMode === "before" ? entry.parentId : spec.resumeAt;
+                const storage = session.getStorage(), leafBefore = await storage.getLeafId(), leafSet = spec.resumeAtMode === "before" ? entry.parentId : entry.type === "message" && entry.message.role === "user" ? lastAttachmentFrameOf(await session.getEntries(), spec.resumeAt) : spec.resumeAt;
                 await storage.setLeafId(leafSet);
                 own.ids = new Set();
                 branch = { storage, leafBefore, leafSet, own };