@sema-agent/core 7.49.5 → 7.50.0

package/dist/tools/fs/index.js

@@ -16,11 +16,11 @@ import { BASH_READONLY_DEFAULT_ALLOW } from "./bash-readonly-classifier.js";
 export { BASH_CLASSIFY_EXTRA_ALLOW, bashClassifyDefaultAllow } from "./bash-readonly-classifier.js";
 import { checkedReadDenyHomes, compileReadDeny, compileWriteDeny, isRootedReadDenyPattern, readDenyBuiltinConfigOf, readDenyPatternRun } from "./read-deny.js";
 import { withGateTimeout } from "../../core/gate-bounded-await.js";
-import { carryHomeViews, homeViewsAt, placeReadDenyAtHome, placementViewsOf, readDenyPlacedLater, sayPlacementLost } from "./read-deny-home.js";
+import { carriedReadFaceOf, carryHomeViews, homeViewsAt, placeReadDenyAtHome, placementViewsOf, readDenyPlacedLater, sayPlacementLost } from "./read-deny-home.js";
 import { deploymentFaceClampNotice, resolveContainmentFace } from "./containment-face.js";
 export * from "./containment-face.js";
 import {} from "./fs-shared.js";
-import { createReadFileTool } from "./fs-read.js";
+import { createModelFileReader, createReadFileTool } from "./fs-read.js";
 import { createEditFileTool, createWriteFileTool, createNotebookEditTool } from "./fs-write.js";
 import { createGrepTool, createGlobTool } from "./fs-search-tools.js";
 import { createBashTool, createBashReadonlyTool, createEnvTaskOutputTool, createEnvTaskStopTool } from "./fs-bash.js";
@@ -34,42 +34,15 @@ export function backgroundOutputReadExemption(registry, seat, env) {
 }
 export function createHandsToolkit(env, readFileState, rootCanonical, opts = {}) {
     const { includeShell = false, readOnly = false, bashReadonlyAllow, commitCoAuthor = false, mountBackgroundTaskTools = true, additionalRoots, additionalReadRoots, } = opts;
-    const readFaceRoots = additionalReadRoots === undefined ? additionalRoots : () => (additionalReadRoots.length === 0 ? additionalRoots : [...(additionalRoots ?? []), ...additionalReadRoots]);
+    const carriedFace = opts.readDenyHomes !== undefined ? carriedReadFaceOf(opts.readDenyHomes) : undefined;
+    const readFaceRoots = carriedFace?.readRoots ?? (additionalReadRoots === undefined ? additionalRoots : () => (additionalReadRoots.length === 0 ? additionalRoots : [...(additionalRoots ?? []), ...additionalReadRoots]));
     const cwdRef = opts.cwdRef ?? { current: rootCanonical };
     const bgOutput = backgroundOutputReadExemption(opts.taskRegistry, opts, env);
     const readAdmission = opts.readAdmission;
     const bgOutputReadExemption = bgOutput === undefined && readAdmission === undefined
         ? undefined
         : (canonicalKey, c) => readAdmission?.(c.toolCallId, canonicalKey) === true || (bgOutput?.(canonicalKey, c) ?? false);
-    const readDenyAdditions = (opts.readDenyPatterns ?? []).map((e) => (typeof e === "object" && e !== null ? { ...e } : e));
-    const readDenyRules = opts.pathDenyRules === undefined ? undefined : [...opts.pathDenyRules];
-    const readDenyBuiltinCfg = readDenyBuiltinConfigOf({ tiers: opts.readDenyBuiltinTiers, exclude: opts.readDenyBuiltinExclude });
-    const readDenyHomes = opts.readDenyHomes === undefined ? undefined : [...checkedReadDenyHomes(opts.readDenyHomes)];
-    const compileAt = (homes, linked) => compileReadDeny(readDenyAdditions, "HandsToolkitOptions.readDenyPatterns", readDenyBuiltinCfg, readDenyRules, homes, linked);
-    const unplaced = compileAt([]);
-    const carried = readDenyHomes !== undefined && opts.readDenyHomeLinks !== undefined;
-    const carriedViews = carried ? placementViewsOf(opts.readDenyHomes) : undefined;
-    if (carried && carriedViews === undefined)
-        sayPlacementLost();
-    const placesNothing = !unplaced.entries.some((e) => readDenyPatternRun(e.pattern).homeAnchored || isRootedReadDenyPattern(e.pattern));
-    const late = carried || placesNothing ? undefined : readDenyPlacedLater(carryHomeViews(unplaced, homeViewsAt(env, [])), () => placeReadDenyAtHome(env, compileAt, readDenyHomes));
-    const readDeny = late?.matcher ??
-        (carried
-            ? carriedViews !== undefined
-                ? carryHomeViews(compileAt(readDenyHomes, opts.readDenyHomeLinks), carriedViews)
-                : carryHomeViews(unplaced, homeViewsAt(env, []))
-            : carryHomeViews(unplaced, homeViewsAt(env, readDenyHomes ?? [])));
-    const afterPlacement = (tool) => late === undefined
-        ? tool
-        : {
-            ...tool,
-            execute: async (...args) => {
-                await withGateTimeout(late.ready(), undefined, args[2], "readDenyPlacement").catch(() => undefined);
-                return await tool.execute(...args);
-            },
-        };
-    const writeDenyCompiled = compileWriteDeny(readDenyRules);
-    const writeDeny = writeDenyCompiled.ruleRows.length > 0 ? carryHomeViews(writeDenyCompiled, readDeny.homeViews) : undefined;
+    const { readDeny, writeDeny, afterPlacement } = carriedFace !== undefined ? { readDeny: carriedFace.readDeny, writeDeny: carriedFace.writeDeny, afterPlacement: (tool) => tool } : bandOwnTables(env, opts);
     const readFace = resolveContainmentFace({
         kind: "read",
         depsFace: opts.readFace,
@@ -87,13 +60,30 @@ export function createHandsToolkit(env, readFileState, rootCanonical, opts = {})
         onDeploymentClamp: () => deliverEngineNotice(opts.onNotice, deploymentFaceClampNotice("write")),
     });
     const writeFaceOf = opts.writeFaceLive ?? (() => writeFace);
+    const readCwd = readOnly ? undefined : cwdRef;
+    const reader = createModelFileReader({
+        env,
+        state: readFileState,
+        rootCanonical,
+        ...(readCwd !== undefined ? { cwdRef: readCwd } : {}),
+        ...(readFaceRoots !== undefined ? { additionalRoots: readFaceRoots } : {}),
+        imageDownsampler: opts.readImageDownsampler,
+        ...(opts.pdfModelCapabilities !== undefined ? { pdfCapabilities: opts.pdfModelCapabilities } : {}),
+        ...(bgOutputReadExemption !== undefined ? { bgOutputReadExemption } : {}),
+        ...(readDeny !== undefined ? { readDeny } : {}),
+        ...(readFace !== undefined ? { readFace } : {}),
+        ...(opts.reminderMark !== undefined ? { reminderMark: opts.reminderMark } : {}),
+        ...(opts.reminderDisclosureCounts !== undefined ? { reminderDisclosureCounts: opts.reminderDisclosureCounts } : {}),
+    });
+    if (opts.modelFileReaderSeat !== undefined)
+        opts.modelFileReaderSeat.current = reader;
     const tools = [
-        afterPlacement(createReadFileTool(env, readFileState, rootCanonical, readOnly ? undefined : cwdRef, readFaceRoots, opts.readImageDownsampler, opts.pdfModelCapabilities, bgOutputReadExemption, readDeny, readFace, opts.reminderMark, opts.reminderDisclosureCounts)),
+        afterPlacement(createReadFileTool(env, readFileState, rootCanonical, readCwd, readFaceRoots, opts.readImageDownsampler, opts.pdfModelCapabilities, bgOutputReadExemption, readDeny, readFace, opts.reminderMark, opts.reminderDisclosureCounts, reader)),
     ];
     if (handsWriteHalfMounts({ readOnly })) {
         tools.push(createEditFileTool(env, readFileState, rootCanonical, cwdRef, additionalRoots, opts.beforeWrite, opts.trackFileEdit, opts.onFileEdited, writeFaceOf, writeDeny), createWriteFileTool(env, readFileState, rootCanonical, cwdRef, additionalRoots, opts.beforeWrite, opts.trackFileEdit, opts.onFileEdited, writeFaceOf, writeDeny), createNotebookEditTool(env, readFileState, rootCanonical, cwdRef, additionalRoots, opts.beforeWrite, opts.trackFileEdit, opts.onFileEdited, writeFaceOf, writeDeny));
     }
-    tools.push(afterPlacement(createGrepTool(env, rootCanonical, readFaceRoots, readDeny, readFace, cwdRef, readAdmission)), afterPlacement(createGlobTool(env, rootCanonical, readFaceRoots, readDeny, readFace, cwdRef, readAdmission)), afterPlacement(createRepoMapTool(env, rootCanonical, readFaceRoots, readDeny, readFace)));
+    tools.push(afterPlacement(createGrepTool(env, rootCanonical, readFaceRoots, readDeny, readFace, cwdRef, readAdmission)), afterPlacement(createGlobTool(env, rootCanonical, readFaceRoots, readDeny, readFace, cwdRef, readAdmission)), afterPlacement(createRepoMapTool(env, rootCanonical, readFaceRoots, readDeny, readFace, cwdRef, readAdmission)));
     if (includeShell) {
         tools.push(readOnly
             ? createBashReadonlyTool(env, rootCanonical, new Set(bashReadonlyAllow ?? BASH_READONLY_DEFAULT_ALLOW), {
@@ -141,3 +131,35 @@ export function createHandsToolkit(env, readFileState, rootCanonical, opts = {})
     }
     return tools;
 }
+function bandOwnTables(env, opts) {
+    const readDenyAdditions = (opts.readDenyPatterns ?? []).map((e) => (typeof e === "object" && e !== null ? { ...e } : e));
+    const readDenyRules = opts.pathDenyRules === undefined ? undefined : [...opts.pathDenyRules];
+    const readDenyBuiltinCfg = readDenyBuiltinConfigOf({ tiers: opts.readDenyBuiltinTiers, exclude: opts.readDenyBuiltinExclude });
+    const readDenyHomes = opts.readDenyHomes === undefined ? undefined : [...checkedReadDenyHomes(opts.readDenyHomes)];
+    const compileAt = (homes, linked) => compileReadDeny(readDenyAdditions, "HandsToolkitOptions.readDenyPatterns", readDenyBuiltinCfg, readDenyRules, homes, linked);
+    const unplaced = compileAt([]);
+    const carried = readDenyHomes !== undefined && opts.readDenyHomeLinks !== undefined;
+    const carriedViews = carried ? placementViewsOf(opts.readDenyHomes) : undefined;
+    if (carried && carriedViews === undefined)
+        sayPlacementLost();
+    const placesNothing = !unplaced.entries.some((e) => readDenyPatternRun(e.pattern).homeAnchored || isRootedReadDenyPattern(e.pattern));
+    const late = carried || placesNothing ? undefined : readDenyPlacedLater(carryHomeViews(unplaced, homeViewsAt(env, [])), () => placeReadDenyAtHome(env, compileAt, readDenyHomes));
+    const readDeny = late?.matcher ??
+        (carried
+            ? carriedViews !== undefined
+                ? carryHomeViews(compileAt(readDenyHomes, opts.readDenyHomeLinks), carriedViews)
+                : carryHomeViews(unplaced, homeViewsAt(env, []))
+            : carryHomeViews(unplaced, homeViewsAt(env, readDenyHomes ?? [])));
+    const afterPlacement = (tool) => late === undefined
+        ? tool
+        : {
+            ...tool,
+            execute: async (...args) => {
+                await withGateTimeout(late.ready(), undefined, args[2], "readDenyPlacement").catch(() => undefined);
+                return await tool.execute(...args);
+            },
+        };
+    const writeDenyCompiled = compileWriteDeny(readDenyRules);
+    const writeDeny = writeDenyCompiled.ruleRows.length > 0 ? carryHomeViews(writeDenyCompiled, readDeny.homeViews) : undefined;
+    return { readDeny, writeDeny, afterPlacement };
+}

package/dist/tools/fs/read-deny-home.d.ts

@@ -1,6 +1,6 @@
 import type { ExecutionEnv } from "../../internal/harness-types.js";
 import { type PathFamily } from "./safety.js";
-import { type ReadDenyMatcher } from "./read-deny.js";
+import { type ReadDenyMatcher, type WriteDenyMatcher } from "./read-deny.js";
 /** The one bound every probe of an AUXILIARY home shares within one placement (see the module head): long enough for a
  *  local directory's canonical spelling, its chain of identities and its rows' heads, short enough that a hung home
  *  costs a placement seconds, not the gate's bound. */
@@ -116,11 +116,29 @@ export interface HomeViewsCarrier {
 export type PlacedReadDenyMatcher = ReadDenyMatcher & {
     readonly homeViews: HomeViewSource;
 };
+/** The Runner's read face as its tool band takes it: the run's read and write deny tables — each judgment reads the run's
+ *  latest, `forCall` hands a call its own — and the read face's root set, read per judgment (a call's own through
+ *  `forCall`). A band handed one judges with it and compiles no table of its own. */
+export interface CarriedReadFace {
+    readonly readDeny: PlacedReadDenyMatcher;
+    readonly writeDeny: WriteDenyMatcher & {
+        readonly homeViews: HomeViewSource;
+    };
+    readonly readRoots: () => readonly string[];
+}
 /** The views of the placement that returned `homes` — the very list object, as the engine hands it on (the Runner's
  *  tool band). `undefined` for any other list: a copy, or a host's own. A mount that was handed the engine's placement
  *  and cannot find its views has lost it: an engine defect, which the mount names ({@link sayPlacementLost}) and answers
  *  by holding its home-anchored rows at every location — never by reading the homes a second time. */
 export declare function placementViewsOf(homes: readonly string[]): HomeViewSource | undefined;
+/** The run's read face a home list carries ({@link carryReadFace}); `undefined` for any other list. */
+export declare function carriedReadFaceOf(homes: readonly string[]): CarriedReadFace | undefined;
+/** A home list (a fresh frozen copy of `homes`) that hands the Runner's read face to its band: the band judges with the
+ *  face's tables and roots instead of compiling its own from the rows it is handed. */
+export declare function carryReadFace(homes: readonly string[], face: CarriedReadFace): readonly string[];
+/** A judge that reads `current` at every judgment — the table a placement in flight will replace, or the run's tables of
+ *  which each judgment takes the latest — with the home views `homeViews` (default: the current judge's). */
+export declare function readDenyOver(current: () => PlacedReadDenyMatcher, homeViews?: HomeViewSource): PlacedReadDenyMatcher;
 /** The line a mount says when the engine handed it a home list that is not its placement's (an engine defect, said every
  *  time: no latch). */
 export declare function sayPlacementLost(): void;

package/dist/tools/fs/read-deny-home.js

@@ -348,11 +348,40 @@ function homeViewSourceOver(env, auxiliary) {
 const PLACEMENT_VIEWS = new WeakMap();
 function placementOf(matcher, homes, linked, whole) {
     const list = Object.freeze([...homes]);
-    PLACEMENT_VIEWS.set(list, matcher.homeViews);
+    PLACEMENT_VIEWS.set(list, { views: matcher.homeViews });
     return { matcher, homes: list, linked, whole };
 }
 export function placementViewsOf(homes) {
-    return PLACEMENT_VIEWS.get(homes);
+    return PLACEMENT_VIEWS.get(homes)?.views;
+}
+export function carriedReadFaceOf(homes) {
+    return PLACEMENT_VIEWS.get(homes)?.face;
+}
+export function carryReadFace(homes, face) {
+    const list = Object.freeze([...homes]);
+    PLACEMENT_VIEWS.set(list, { views: face.readDeny.homeViews, face });
+    return list;
+}
+export function readDenyOver(current, homeViews) {
+    return {
+        get entries() {
+            return current().entries;
+        },
+        get ruleRows() {
+            return current().ruleRows;
+        },
+        matchPath: (path, opts) => current().matchPath(path, opts),
+        matchTarget: (canonicalKey, lexicalView, opts) => current().matchTarget(canonicalKey, lexicalView, opts),
+        get rgExclusionGlobs() {
+            return current().rgExclusionGlobs;
+        },
+        get rgProbeGlobs() {
+            return current().rgProbeGlobs;
+        },
+        unexcludableUnder: (scope) => current().unexcludableUnder?.(scope) ?? false,
+        rowAtOrBelow: (path) => current().rowAtOrBelow?.(path) ?? null,
+        homeViews: homeViews ?? { views: (signal) => current().homeViews.views(signal) },
+    };
 }
 export function sayPlacementLost() {
     try {
@@ -447,24 +476,5 @@ export function readDenyPlacedLater(unplaced, place) {
             };
         },
     };
-    const matcher = {
-        get entries() {
-            return current.entries;
-        },
-        get ruleRows() {
-            return current.ruleRows;
-        },
-        matchPath: (path, opts) => current.matchPath(path, opts),
-        matchTarget: (canonicalKey, lexicalView, opts) => current.matchTarget(canonicalKey, lexicalView, opts),
-        get rgExclusionGlobs() {
-            return current.rgExclusionGlobs;
-        },
-        get rgProbeGlobs() {
-            return current.rgProbeGlobs;
-        },
-        unexcludableUnder: (scope) => current.unexcludableUnder?.(scope) ?? false,
-        rowAtOrBelow: (path) => current.rowAtOrBelow?.(path) ?? null,
-        homeViews,
-    };
-    return { matcher, ready };
+    return { matcher: readDenyOver(() => current, homeViews), ready };
 }

package/dist/tools/fs/read-deny.d.ts

@@ -142,6 +142,8 @@ export interface WriteDenyMatcher {
         readonly aliasResolved?: boolean;
         readonly hops?: readonly string[];
     }): ReadDenyHit | null;
+    /** The table ONE call judges with ({@link ReadDenyMatcher.forCall}). */
+    forCall?(toolCallId: string | undefined): WriteDenyMatcher;
 }
 /** Compile the write face over the rule rows (the rows not on it are dropped here, once). */
 export declare function compileWriteDeny(rules?: readonly PathRuleDenyRow[]): WriteDenyMatcher;
@@ -197,7 +199,19 @@ export interface ReadDenyMatcher {
      *  path from its own segments ({@link rowMeetsPath}) — so moving, copying or removing the path changes what the row
      *  covers. A rule row's reach below a path is not enumerable: any rule row answers. */
     rowAtOrBelow?(path: string): ReadDenyHit | null;
+    /** The table ONE call judges with — the Runner's tables are one per read of the person's rules, and a call judges with
+     *  the read it was pinned to (an unknown or released call: the run's latest). Absent on a table compiled once: it is
+     *  every call's ({@link seatForCall}). */
+    forCall?(toolCallId: string | undefined): ReadDenyMatcher;
 }
+/** A seat the run's tables back — a deny table, a read-root set — as ONE call takes it: the call's own where the seat
+ *  carries `forCall`, the seat itself otherwise (a table compiled once, a host's own list) and for a reader that is no
+ *  call (no id: the seat's own reading of the run's latest, with every refusal it carries). Taken once, where the call's
+ *  judgment starts, so every judgment of the call reads one table. */
+export declare function seatForCall<T>(seat: T, toolCallId: string | undefined): T;
+/** Settles once the tables a seat the run's tables back stands on are ready for a reader that is no call (the seat's
+ *  `ready`); any other seat is ready. Never rejects. */
+export declare function seatReady(seat: unknown, signal?: AbortSignal): Promise<void>;
 /** The DENY HALF of a shell read boundary, in the shape `BashReadonlyRootBoundary` declares it (structural:
  *  this module is the leaf every face depends on). `denyMatch` judges one LEXICALLY RESOLVED operand,
  *  returning the matched pattern or null; PRESENT-IFF there is something to judge. */

package/dist/tools/fs/read-deny.js

@@ -153,6 +153,14 @@ export function compileWriteDeny(rules = []) {
     };
     return { face: "write", ruleRows, matchPath, matchTarget: (canonicalKey, lexicalView, opts) => denyTableHit(rows, denyTargetViews(canonicalKey, lexicalView, opts)) };
 }
+export function seatForCall(seat, toolCallId) {
+    const forCall = seat?.forCall;
+    return typeof forCall === "function" && toolCallId !== undefined ? forCall.call(seat, toolCallId) : seat;
+}
+export function seatReady(seat, signal) {
+    const ready = seat?.ready;
+    return typeof ready === "function" ? Promise.resolve(ready.call(seat, signal)) : Promise.resolve();
+}
 export function readDenySeat(matcher) {
     const entries = [...(matcher?.entries ?? []).map((e) => e.pattern), ...(matcher?.ruleRows ?? []).map((r) => r.rule)];
     if (matcher === undefined || entries.length === 0)

package/dist/tools/fs/repo-map.d.ts

@@ -1,8 +1,9 @@
 import type { AgentTool } from "../../internal/harness-types.js";
 import type { ExecutionEnv } from "../../internal/harness-types.js";
 import { type RootsSeat } from "./safety.js";
-import type { ReadDenyMatcher } from "./read-deny.js";
+import { type ReadDenyMatcher } from "./read-deny.js";
 import type { ContainmentFace } from "./containment-face.js";
+import type { CwdRef } from "./fs-shared.js";
 /** Extract top-level symbol names (deduped, in first-seen order) from source text. A lightweight
  *  comment/docstring state machine skips column-0 declaration-like lines that are really inside a
  *  `/* … *​/` block comment or a Python `"""`/`'''` docstring — otherwise e.g. a module docstring
@@ -14,4 +15,4 @@ import type { ContainmentFace } from "./containment-face.js";
  *  (src/core/auto-promote.ts) consumes it in ESCALATE-ONLY mode — a clean scan contributes nothing;
  *  it can only ever raise an escalation, never clear one. */
 export declare function extractSymbols(text: string): string[];
-export declare function createRepoMapTool(env: ExecutionEnv, rootCanonical: string, additionalRoots?: RootsSeat, readDeny?: ReadDenyMatcher, readFace?: ContainmentFace): AgentTool;
+export declare function createRepoMapTool(env: ExecutionEnv, rootCanonical: string, rootsSeat?: RootsSeat, denySeat?: ReadDenyMatcher, readFace?: ContainmentFace, cwdRef?: CwdRef, readAdmission?: (toolCallId: string | undefined, canonicalKey: string) => boolean): AgentTool;

package/dist/tools/fs/repo-map.js

@@ -2,7 +2,10 @@ import { Type } from "typebox";
 import { defineTool, errorResult } from "../../core/tools.js";
 import { resolveKey, violationText, violationDetails } from "./safety.js";
 import { buildIgnore, denyWithheldNote, walk, walkIsPartial } from "./search.js";
+import { seatForCall } from "./read-deny.js";
 import { toolFace } from "../../core/tool-catalog-entries.js";
+import { pathTargetBaseOf } from "../../core/effective-path-target.js";
+import { pathTargetValue } from "../../core/tool-registry.js";
 const DEFAULT_MAX_CHARS = 16_000;
 const DEFAULT_MAX_FILES = 400;
 const FILE_SCAN_MAX_BYTES = 256 * 1024;
@@ -80,7 +83,8 @@ function rankEntries(a, b) {
         return b.symbols.length - a.symbols.length;
     return a.rel < b.rel ? -1 : a.rel > b.rel ? 1 : 0;
 }
-export function createRepoMapTool(env, rootCanonical, additionalRoots, readDeny, readFace) {
+export function createRepoMapTool(env, rootCanonical, rootsSeat, denySeat, readFace, cwdRef, readAdmission) {
+    const declaredTarget = toolFace("repo-map").pathTarget;
     return defineTool({
         name: "RepoMap",
         ...toolFace("repo-map"),
@@ -94,12 +98,16 @@ export function createRepoMapTool(env, rootCanonical, additionalRoots, readDeny,
             max_files: Type.Optional(Type.Number({ description: `Max files to scan (default ${DEFAULT_MAX_FILES}).` })),
         }),
         execute: async (args, ctx) => {
+            const readDeny = seatForCall(denySeat, ctx.toolCallId);
+            const additionalRoots = seatForCall(rootsSeat, ctx.toolCallId);
             const a = args;
             const signal = ctx.signal;
             const rootPrefix = rootCanonical.replace(/[\\/]+$/, "") + (rootCanonical.includes("\\") ? "\\" : "/");
             let start = rootCanonical;
-            if (a.path !== undefined) {
-                const r = await resolveKey(env, rootCanonical, a.path, signal, rootCanonical, additionalRoots, undefined, readDeny, readFace);
+            const scopeSpelling = declaredTarget === undefined ? undefined : pathTargetValue(a, declaredTarget);
+            if (scopeSpelling !== undefined) {
+                const baseCwd = pathTargetBaseOf(declaredTarget, { root: rootCanonical, cwd: cwdRef?.current });
+                const r = await resolveKey(env, rootCanonical, scopeSpelling, signal, baseCwd, additionalRoots, readAdmission && ((key) => readAdmission(ctx.toolCallId, key)), readDeny, readFace);
                 if (!r.ok)
                     return errorResult(violationText("RepoMap", r.violation), violationDetails(r.violation));
                 start = r.key;

package/dist/tools/fs/safety.d.ts

@@ -1,3 +1,4 @@
+import { type DenyFace } from "./read-deny.js";
 import { type HomeViewSource } from "./read-deny-home.js";
 import type { AssertAllKeysHandled } from "../../core/ask-origin.js";
 import type { ExecutionEnv } from "../../internal/harness-types.js";
@@ -520,12 +521,36 @@ export declare function violationDetails(v: FsViolation): {
     code: "path_not_in_root";
     target: string;
     roots: readonly string[];
-} | {
+} | ReadPathDeniedCard | undefined;
+/** The read face's refusal card: which target, which deny pattern. */
+export type ReadPathDeniedCard = {
     type: "read_path_denied";
     code: "read_path_denied";
     target: string;
     pattern: string;
-} | undefined;
+};
+/**
+ * The ONE mint of the `read_path_denied` card. `type` is the CC_DETAIL_TYPES discriminator, so the refusal's
+ * coordinates reach `tool_end.structured`, not just prose; `code` carries the same value for in-process readers.
+ * Every site that refuses a read on a deny row — the tools' own resolution, the shell station, the gate's rule lanes —
+ * mints it here.
+ */
+export declare function readPathDeniedCard(target: string, pattern: string): ReadPathDeniedCard;
+/**
+ * Where one deny row refused a call: the row's text, the view of the target it met, and the face the call is on.
+ * Minted once, by the judge that found the row; every exit of the gate reads it and judges nothing again.
+ */
+export interface PathDenialEvidence {
+    readonly rule: string;
+    readonly view: string;
+    readonly face: DenyFace;
+}
+/**
+ * The card a gate-side path refusal carries: the read face's own ({@link readPathDeniedCard}); the write face has none
+ * (as in the tools' own resolution, where a write refusal's `write_path_denied` code carries no card). The card's
+ * presence follows the FACE, never the station that refused.
+ */
+export declare function pathDenialCardOf(evidence: PathDenialEvidence | undefined): ReadPathDeniedCard | undefined;
 /**
  * Does `p` sit inside ANY of the canonical containment roots? Exposed for the Bash
  * tool's post-`cd` disclosure note (fs-bash.ts): the note reuses the SAME segment-aware `within`
@@ -534,6 +559,20 @@ export declare function violationDetails(v: FsViolation): {
  * design; fs-bash canonical-confirms before claiming "outside").
  */
 export declare function withinAnyRoot(rootsCanonical: readonly string[], p: string): boolean;
+/**
+ * THE store-isolation rule, one judgment for every root admission point (the Artifact mount over the prepare-time
+ * roots, an in-flight read-root grant over the granted root, a person's read directory where a run's read roots are
+ * read): a root that CONTAINS the local artifact store, lies INSIDE it, or IS it hands the file tools the store's ledger
+ * and stored files. Returns the first such root, or undefined.
+ *
+ * `storePhysical` is the store's physical path on THIS process's filesystem (`physicalPathOfExisting`, resolved
+ * once per run by the Artifact phase); a root is the execution env's canonical key. The judgment touches no
+ * filesystem — the grant runs after the approver's wait under the call's cut, and a synchronous lookup on a stalled
+ * store mount would block the event loop past that cut. The two are compared as identities only when both spell the
+ * same family (`within` reads both under the root's family); a root of the other family names a filesystem the store
+ * cannot be on, and no claim is made against it.
+ */
+export declare function rootAdmittingArtifactStore(storePhysical: string, rootsCanonical: readonly string[]): string | undefined;
 /**
  * The escape-hatch tail for the `path_not_in_root` refusal: like its three sibling hints below, it
  * names a sanctioned next step, so the model does not oscillate between "the boundary is hard" and

package/dist/tools/fs/safety.js

@@ -659,16 +659,25 @@ export function violationText(toolName, v) {
     return `Error (${toolName}): ${v.message}`;
 }
 export function violationDetails(v) {
-    if (v.code === "read_path_denied" && v.target !== undefined && v.pattern !== undefined) {
-        return { type: "read_path_denied", code: "read_path_denied", target: v.target, pattern: v.pattern };
-    }
+    if (v.code === "read_path_denied" && v.target !== undefined && v.pattern !== undefined)
+        return readPathDeniedCard(v.target, v.pattern);
     return v.code === "path_not_in_root" && v.target !== undefined
         ? { type: "path_not_in_root", code: "path_not_in_root", target: v.target, roots: v.roots ?? [] }
         : undefined;
 }
+export function readPathDeniedCard(target, pattern) {
+    return { type: "read_path_denied", code: "read_path_denied", target, pattern };
+}
+export function pathDenialCardOf(evidence) {
+    return evidence?.face === "read" ? readPathDeniedCard(evidence.view, evidence.rule) : undefined;
+}
 export function withinAnyRoot(rootsCanonical, p) {
     return rootsCanonical.some((r) => within(r, p));
 }
+export function rootAdmittingArtifactStore(storePhysical, rootsCanonical) {
+    const storeFamily = pathFamilyOf({ root: storePhysical });
+    return rootsCanonical.find((root) => pathFamilyOf({ root }) === storeFamily && (withinAnyRoot([root], storePhysical) || withinAnyRoot([storePhysical], root)));
+}
 export const PATH_NOT_IN_ROOT_ESCAPE_HINT = "(This boundary applies to the structured file tools. If you genuinely need content outside the allowed root(s), ask for the directory to be added to the deployment's additionalDirectories — or additionalReadDirectories for read-only access; a deployment that wants reads or writes open everywhere can declare readFace / writeFace: \"open\" instead of listing directories.)";
 export function requireRead(state, key) {
     const entry = state.get(key);

package/dist/tools/fs/shell-read-check.d.ts

@@ -44,6 +44,14 @@ export type ShellReadRefusalDetails = NonNullable<ReturnType<typeof violationDet
 export interface ShellReadVerdict {
     readonly disposition: ShellReadDisposition;
     readonly finding: ShellReadFinding;
+    /** The environment did not answer the judgment — a resolver, a listing or an identity lookup gave no answer, a bound was
+     *  reached, the judge itself did not answer: present on the `unanswered` finding the fold or the fallback gives. The gate
+     *  classes the question as shell text the engine cannot read. */
+    readonly environmentSilent?: true;
+    /** Rows the station's boundary stands on could not be read (`ShellReadBoundary.unreadPartitions`, or a boundary the seat
+     *  could not hand over): present on ANY verdict judged beside them, whatever its finding. The gate classes the question as
+     *  a rule that could not be read. */
+    readonly rowsUnread?: true;
     /** `write` ⇔ the finding is about where the command WRITES — its witness is a write target (a redirection's, or a word
      *  the program's row writes), judged against the write roots. Absent ⇒ a read's finding (or `vouch`). */
     readonly face?: "write";
@@ -146,9 +154,10 @@ export interface ShellReadStationOptions {
     readonly tools: ReadonlySet<string>;
     /** The trust-policy seat a tool is judged on. */
     readonly seatOf: (toolName: string) => ShellReadStationSeat;
-    /** The boundary for a call, read per call (the tracked working directory moves). `undefined` ⇒ no
-     *  boundary declared, nothing to be outside of — the station vouches. */
-    readonly boundaryOf: (toolName: string, cwd: string | undefined) => ShellReadBoundary | undefined;
+    /** The boundary for a call, read per call (the tracked working directory moves; the call's own tables, by its id —
+     *  `undefined` where no call is judged). `undefined` ⇒ no boundary declared, nothing to be outside of — the station
+     *  vouches. */
+    readonly boundaryOf: (toolName: string, cwd: string | undefined, toolCallId: string | undefined) => ShellReadBoundary | undefined;
     /** The listed read verbs (decides whether a segment is read by verb slots or word by word). */
     readonly readers?: ReadonlySet<string>;
     /** `true` ⇔ every root `boundaryOf` returns is already a canonical identity (the Runner's): the station never

package/dist/tools/fs/shell-read-check.js

@@ -286,15 +286,17 @@ function verdictOf(tool, seat, fold, judged, boundary) {
     const paths = outsidePathsOf(judged);
     const unestablished = fold.unestablished === true ? { unestablished: true } : {};
     const writes = fold.witness?.read.candidate.face === "write" ? { face: "write" } : {};
+    const by = fold.finding === "unanswered" ? { environmentSilent: true } : {};
     if (disposition === "refuse") {
         const r = refusalOf(tool, fold, boundary, paths);
-        return { disposition, finding: fold.finding, ...writes, sentence: r.sentence, ...(r.details !== undefined ? { details: r.details } : {}) };
+        return { disposition, finding: fold.finding, ...by, ...writes, sentence: r.sentence, ...(r.details !== undefined ? { details: r.details } : {}) };
     }
     const grant = fold.finding === "outside_roots" ? readRootGrantCandidateOf(judged, boundary) : undefined;
     const containment = fold.finding === "outside_roots" || fold.finding === "unestablishable" || fold.finding === "unanswered";
     return {
         disposition,
         finding: fold.finding,
+        ...by,
         ...writes,
         ...unestablished,
         sentence: findingAccount(fold, boundary),
@@ -404,6 +406,16 @@ export function createShellReadStation(opts) {
         admissions.set(toolCallId, a);
     };
     const memberOf = (call) => readStationMemberOf(call, opts.tools)?.name;
+    const unansweredOver = (toolName, seat, cause, boundary, silence) => {
+        if (boundary === undefined || (boundary !== "unread" && !(anyFaceGuards(boundary) || boundary.writeTargetJudge !== undefined)))
+            return { disposition: "vouch", finding: "none" };
+        const disposition = decideShellRead("unanswered", seat);
+        const account = `${cause}, so where this command reads could not be established ${NOT_AUTO_ALLOWED}`;
+        const details = unestablishedDetails();
+        if (disposition === "refuse")
+            return { disposition, finding: "unanswered", ...silence, sentence: `Error (${toolName}): ${account}. ${BASH_READONLY_CONFINEMENT_NOTE}`, details };
+        return { disposition, finding: "unanswered", ...silence, sentence: account, details };
+    };
     const check = {
         judge(call, args, cwd, signal, callOpts) {
             const member = memberOf(call);
@@ -412,7 +424,7 @@ export function createShellReadStation(opts) {
             const command = shellCommandOf(args);
             if (command === undefined)
                 return null;
-            const boundary = opts.boundaryOf(member, cwd);
+            const boundary = opts.boundaryOf(member, cwd, callOpts.toolCallId);
             if (boundary === undefined)
                 return null;
             const seat = callOpts.seat ?? opts.seatOf(member);
@@ -420,22 +432,23 @@ export function createShellReadStation(opts) {
                 const run = await runShellReadStation(call.toolName, command, boundary, seat, readers, establisherFor(boundary.roots), opts.env, signal);
                 if (run.verdict.disposition !== "refuse" && callOpts.toolCallId !== undefined)
                     remember(callOpts.toolCallId, { toolName: member, boundary: run.boundary, established: run.established, command });
-                return run.verdict;
+                if (boundary.unreadPartitions !== true)
+                    return run.verdict;
+                return run.verdict.disposition === "vouch" ? unansweredOver(call.toolName, seat, "the rules this check stands on could not all be read", boundary, { rowsUnread: true }) : { ...run.verdict, rowsUnread: true };
             })();
         },
         unanswered(call, cause) {
-            const toolName = call.toolName;
-            const member = memberOf(call) ?? toolName;
-            const seat = opts.seatOf(member);
-            const boundary = opts.boundaryOf(member, undefined);
-            if (boundary === undefined || !(anyFaceGuards(boundary) || boundary.writeTargetJudge !== undefined))
-                return { disposition: "vouch", finding: "none" };
-            const disposition = decideShellRead("unanswered", seat);
-            const account = `${cause}, so where this command reads could not be established ${NOT_AUTO_ALLOWED}`;
-            const details = unestablishedDetails();
-            if (disposition === "refuse")
-                return { disposition, finding: "unanswered", sentence: `Error (${toolName}): ${account}. ${BASH_READONLY_CONFINEMENT_NOTE}`, details };
-            return { disposition, finding: "unanswered", sentence: account, details };
+            const member = memberOf(call) ?? call.toolName;
+            const boundary = (() => {
+                try {
+                    return opts.boundaryOf(member, undefined, undefined);
+                }
+                catch {
+                    return "unread";
+                }
+            })();
+            const rowsUnread = boundary === "unread" || boundary?.unreadPartitions === true ? { rowsUnread: true } : {};
+            return unansweredOver(call.toolName, opts.seatOf(member), cause, boundary, { environmentSilent: true, ...rowsUnread });
         },
     };
     const admit = async (toolName, toolCallId, command, signal) => {

package/dist/tools/fs/shell-read-device.d.ts

@@ -5,7 +5,7 @@
  * operand, the content a program writes through an operand, a `git diff` operand) and the shape tier's two readings of "does
  * this redirection write" (the read-only reader, the classify faces' data-free redirections).
  *
- * The table is the reference implementation's own device predicate (CC 2.1.296 `wwe`, cli296.js @18511591): the null
+ * The table is the reference implementation's own device predicate (CC 2.1.296 `wwe` (cli296.js:249645) @18511591): the null
  * device, the three standard streams, the terminal, any `/dev/fd/<digits>`, and `/proc/self/fd/{0,1,2}`. A word is such a
  * spelling AS WRITTEN (quotes removed, nothing folded: `/dev/./null` is a path, not the null device).
  *

package/dist/tools/fs/shell-read-judge.d.ts

@@ -74,7 +74,7 @@ export declare function dispositionOfCell(cell: ShellReadCell, narrowedReadFace:
  *    ask is MANDATED and no automatic lane answers; on the OPEN face (where the station asks only because a deny list has
  *    rows), and for a written target alone (a narrowed WRITE face fences what is written; it is no request to be asked about
  *    every word the floor cannot place), it is the ORDINARY ask — the reference implementation's plain permission ask (CC
- *    2.1.296 `sR`, cli296.js @13116941, reason `other`), which a whole-tool allow (`$pn` @18717070), bypass (`$pn` @18716980)
+ *    2.1.296 `sR` (cli296.js:242691) @13116941, reason `other`), which a whole-tool allow (`N9` (cli296.js:249675) @18717070), bypass (`$pn` (cli296.js:249675) @18716980)
  *    and the auto-mode classifier release and a prefix allow does not.
  *  · `declined` — the one deliberate fail-open of this table: the scan could not read the program bash
  *    will run, or the operands arrive on a stream. On the full shell it is an ORDINARY ask — an answerer
@@ -159,6 +159,10 @@ export interface ShellReadCellContext {
  */
 export interface ShellReadBoundary extends BashReadonlyRootBoundary {
     readonly alsoInside?: (canonicalTarget: string) => Promise<boolean>;
+    /** A partition of the rules the deny seats are compiled from could not be read: a guard of unknown reach. The station
+     *  guards ({@link stationGuards}) and vouches for nothing against this boundary — what it would vouch for is answered as
+     *  a judgment it could not make. */
+    readonly unreadPartitions?: true;
     /** The deny table's WRITE face (`compileWriteDeny`, read-deny.ts): judges a command's write targets (candidates marked
      *  `face: "write"`) and returns the matched row's rule, or null. PRESENT-IFF there is something to judge. */
     readonly writeDenyMatch?: (resolvedPath: string) => string | null;
@@ -303,12 +307,13 @@ export interface JudgedPlan {
 }
 /**
  * Does the station GUARD anything for this boundary — a closed face (roots: containment is what it guards; an absent
- * face reads as roots, as {@link containmentOf} does), or a deny table with rows (`denyMatch` is present exactly then)?
+ * face reads as roots, as {@link containmentOf} does), or a deny table with rows (`denyMatch` is present exactly then),
+ * or rows it could not read (`unreadPartitions`: a guard of unknown reach)?
  * Where it guards nothing (an open face, no deny row), a read it could not establish has nothing to be confirmed
  * against: no finding. The deny judgment itself is untouched (with no row there is nothing to hit). The READ face's
  * question only: a write target folds by {@link writeFaceGuards}.
  */
-export declare function stationGuards(boundary: Pick<ShellReadBoundary, "face" | "denyMatch">): boolean;
+export declare function stationGuards(boundary: Pick<ShellReadBoundary, "face" | "denyMatch" | "unreadPartitions">): boolean;
 /**
  * Does the station guard anything on the WRITE face — the same shape for the write seats: the write face in force runs
  * the roots-containment step ({@link skipsRootsContainment}, the structured write tools' reading; absent ⇒ roots), or
@@ -319,7 +324,7 @@ export declare function writeFaceGuards(boundary: Pick<ShellReadBoundary, "write
 /** Does the station guard anything on EITHER face? What a finding about the text's own structure folds by — a text the
  *  lexer could not read, a program it cannot name, program text it does not read, a working directory it lost, a text the
  *  shell re-enters — since what such a text reads AND what it writes are both unknown. */
-export declare function anyFaceGuards(boundary: Pick<ShellReadBoundary, "face" | "denyMatch" | "writeFace" | "writeDenyMatch">): boolean;
+export declare function anyFaceGuards(boundary: Pick<ShellReadBoundary, "face" | "denyMatch" | "unreadPartitions" | "writeFace" | "writeDenyMatch">): boolean;
 /** The command-level fold and the finding that produced it. `witness` is absent for `none`; for `declined`
  *  the segment that declined stands in for a candidate. */
 export interface ShellReadFold {

package/dist/tools/fs/shell-read-judge.js

@@ -104,7 +104,7 @@ function judgeWrite(read, boundary) {
     return { read, kind: containment === "outside" && !skipsRootsContainment(boundary.writeFace) ? "outside_roots" : "none", containment };
 }
 export function stationGuards(boundary) {
-    return boundary.face !== "open" || boundary.denyMatch !== undefined;
+    return boundary.face !== "open" || boundary.denyMatch !== undefined || boundary.unreadPartitions === true;
 }
 export function writeFaceGuards(boundary) {
     return !skipsRootsContainment(boundary.writeFace) || boundary.writeDenyMatch !== undefined;