@sema-agent/core 7.49.5 → 7.50.1

package/dist/tools/fs/fs-write.js

@@ -3,6 +3,7 @@ import { Type } from "typebox";
 import { defineTool, errorResult } from "../../core/tools.js";
 import { sha256, resolveKey, violationText, violationDetails, requireRead, checkStale, checkEditMatch, checkNoChange, fileArgPath, resolveQuoteMatch, adaptNewStringQuotes, resolveEscapeMatch, adaptNewStringEscapes, escapeMatchWasAttempted, ESCAPE_MATCH_MISS_NOTE, deletionOldString, countOccurrences, READ_REFUSED_ESCAPE_HINT, } from "./safety.js";
 import { decodeTextBytes, encodeTextForFile, normalizeEditText, normalizeFileText } from "./encoding.js";
+import { seatForCall } from "./read-deny.js";
 import { MAX_EDIT_BYTES, decodeEditBytes, tooLargeToEditMessage, truncatedUtf16BodyMessage, persistedTextOf, notReadRefusalText, enoentMessage, FILE_STATE_TRAILER, FILE_PATH_PARAMS, coerceWriteArguments, ipynbRedirect, countLines, applyRecordedEdit, } from "./fs-shared.js";
 import { toolFace } from "../../core/tool-catalog-entries.js";
 import { thrownText } from "../../core/thrown-value.js";
@@ -112,7 +113,7 @@ export function createEditFileTool(env, state, rootCanonical, cwdRef, additional
             const path = fileArgPath(args);
             if (path === undefined)
                 return { ok: true };
-            const r = await resolveKey(env, rootCanonical, path, ctx.signal, cwdRef?.current, additionalRoots, undefined, writeDeny, writeFace?.());
+            const r = await resolveKey(env, rootCanonical, path, ctx.signal, cwdRef?.current, additionalRoots, undefined, seatForCall(writeDeny, ctx.toolCallId), writeFace?.());
             if (!r.ok)
                 return { ok: true };
             if (a.old_string === a.new_string)
@@ -150,7 +151,7 @@ export function createEditFileTool(env, state, rootCanonical, cwdRef, additional
             const path = fileArgPath(args);
             if (path === undefined)
                 return errorResult(`Error (Edit): file_path is required.`);
-            const r = await resolveKey(env, rootCanonical, path, ctx.signal, cwdRef?.current, additionalRoots, undefined, writeDeny, writeFace?.());
+            const r = await resolveKey(env, rootCanonical, path, ctx.signal, cwdRef?.current, additionalRoots, undefined, seatForCall(writeDeny, ctx.toolCallId), writeFace?.());
             if (!r.ok)
                 return errorResult(violationText("Edit", r.violation), violationDetails(r.violation));
             if (!batch && a.old_string === a.new_string) {
@@ -344,7 +345,7 @@ export function createWriteFileTool(env, state, rootCanonical, cwdRef, additiona
                 return { ok: true };
             if (ipynbRedirect("Write", path))
                 return { ok: true };
-            const r = await resolveKey(env, rootCanonical, path, ctx.signal, cwdRef?.current, additionalRoots, undefined, writeDeny, writeFace?.());
+            const r = await resolveKey(env, rootCanonical, path, ctx.signal, cwdRef?.current, additionalRoots, undefined, seatForCall(writeDeny, ctx.toolCallId), writeFace?.());
             if (!r.ok)
                 return { ok: true };
             const exists = await env.exists(r.key, ctx.signal);
@@ -363,7 +364,7 @@ export function createWriteFileTool(env, state, rootCanonical, cwdRef, additiona
             const ipynb = ipynbRedirect("Write", path);
             if (ipynb)
                 return errorResult(ipynb);
-            const r = await resolveKey(env, rootCanonical, path, ctx.signal, cwdRef?.current, additionalRoots, undefined, writeDeny, writeFace?.());
+            const r = await resolveKey(env, rootCanonical, path, ctx.signal, cwdRef?.current, additionalRoots, undefined, seatForCall(writeDeny, ctx.toolCallId), writeFace?.());
             if (!r.ok)
                 return errorResult(violationText("Write", r.violation), violationDetails(r.violation));
             const exists = await env.exists(r.key, ctx.signal);
@@ -460,7 +461,7 @@ export function createNotebookEditTool(env, state, rootCanonical, cwdRef, additi
                 return { ok: false, code: "invalid", message: NOTEBOOK_CELL_TYPE_REQUIRED_MESSAGE };
             if (mode !== "insert" && !a.cell_id)
                 return { ok: false, code: "invalid", message: NOTEBOOK_CELL_ID_REQUIRED_MESSAGE };
-            const r = await resolveKey(env, rootCanonical, a.notebook_path, ctx.signal, cwdRef?.current, additionalRoots, undefined, writeDeny, writeFace?.());
+            const r = await resolveKey(env, rootCanonical, a.notebook_path, ctx.signal, cwdRef?.current, additionalRoots, undefined, seatForCall(writeDeny, ctx.toolCallId), writeFace?.());
             if (!r.ok)
                 return { ok: true };
             const notRead = requireRead(state, r.key);
@@ -480,7 +481,7 @@ export function createNotebookEditTool(env, state, rootCanonical, cwdRef, additi
                 return errorResult(NOTEBOOK_CELL_TYPE_REQUIRED_MESSAGE);
             if (mode !== "insert" && !cell_id)
                 return errorResult(NOTEBOOK_CELL_ID_REQUIRED_MESSAGE);
-            const r = await resolveKey(env, rootCanonical, notebook_path, ctx.signal, cwdRef?.current, additionalRoots, undefined, writeDeny, writeFace?.());
+            const r = await resolveKey(env, rootCanonical, notebook_path, ctx.signal, cwdRef?.current, additionalRoots, undefined, seatForCall(writeDeny, ctx.toolCallId), writeFace?.());
             if (!r.ok)
                 return errorResult(violationText("NotebookEdit", r.violation), violationDetails(r.violation));
             const notRead = requireRead(state, r.key);

package/dist/tools/fs/index.d.ts

@@ -57,7 +57,7 @@ export interface HandsToolkitOptions {
      *  (`createShellReadStation`). */
     shellReadAdmission?: ShellReadAdmission;
     /** The gate's file read station's ADMISSION (`FileReadStation.admitted`, file-read-check.ts), handed to Read / Grep /
-     *  Glob: an out-of-root target the gate put to a question and then let through is read once, on the canonical key the
+     *  Glob / RepoMap: an out-of-root target the gate put to a question and then let through is read once, on the canonical key the
      *  station judged. ABSENT ⇒ no station (a library-direct toolkit): the tools refuse every out-of-root target. */
     readAdmission?: (toolCallId: string | undefined, canonicalKey: string) => boolean;
     /** Commit-message attribution trailer for the `bash` git protocol. Default NONE — attribution is a
@@ -245,6 +245,12 @@ export interface HandsToolkitOptions {
      *  mount may pass its own object or omit it (counting off — and the whole disclosure pipeline
      *  is off anyway when `reminderMark` is absent). */
     reminderDisclosureCounts?: import("../../core/reminder-disclosure.js").ReminderDisclosureCounts;
+    /** Where the band hands out the leg's ONE file reader — the reader its Read tool reads through, with the same read
+     *  state, throttle windows and counters — for the run's other carriers of a file to the model (a user's attachment).
+     *  Written once at mount; absent ⇒ the reader stays the Read tool's own. */
+    modelFileReaderSeat?: {
+        current?: import("./fs-read.js").ModelFileReader;
+    };
 }
 /** Whether the band's WRITE half (Edit / Write / NotebookEdit, and the full `bash`) mounts for these options — the ONE
  *  predicate {@link createHandsToolkit} branches on and prepare-task plans by (the memory phase must know, before the

package/dist/tools/fs/index.js

@@ -16,11 +16,11 @@ import { BASH_READONLY_DEFAULT_ALLOW } from "./bash-readonly-classifier.js";
 export { BASH_CLASSIFY_EXTRA_ALLOW, bashClassifyDefaultAllow } from "./bash-readonly-classifier.js";
 import { checkedReadDenyHomes, compileReadDeny, compileWriteDeny, isRootedReadDenyPattern, readDenyBuiltinConfigOf, readDenyPatternRun } from "./read-deny.js";
 import { withGateTimeout } from "../../core/gate-bounded-await.js";
-import { carryHomeViews, homeViewsAt, placeReadDenyAtHome, placementViewsOf, readDenyPlacedLater, sayPlacementLost } from "./read-deny-home.js";
+import { carriedReadFaceOf, carryHomeViews, homeViewsAt, placeReadDenyAtHome, placementViewsOf, readDenyPlacedLater, sayPlacementLost } from "./read-deny-home.js";
 import { deploymentFaceClampNotice, resolveContainmentFace } from "./containment-face.js";
 export * from "./containment-face.js";
 import {} from "./fs-shared.js";
-import { createReadFileTool } from "./fs-read.js";
+import { createModelFileReader, createReadFileTool } from "./fs-read.js";
 import { createEditFileTool, createWriteFileTool, createNotebookEditTool } from "./fs-write.js";
 import { createGrepTool, createGlobTool } from "./fs-search-tools.js";
 import { createBashTool, createBashReadonlyTool, createEnvTaskOutputTool, createEnvTaskStopTool } from "./fs-bash.js";
@@ -34,42 +34,15 @@ export function backgroundOutputReadExemption(registry, seat, env) {
 }
 export function createHandsToolkit(env, readFileState, rootCanonical, opts = {}) {
     const { includeShell = false, readOnly = false, bashReadonlyAllow, commitCoAuthor = false, mountBackgroundTaskTools = true, additionalRoots, additionalReadRoots, } = opts;
-    const readFaceRoots = additionalReadRoots === undefined ? additionalRoots : () => (additionalReadRoots.length === 0 ? additionalRoots : [...(additionalRoots ?? []), ...additionalReadRoots]);
+    const carriedFace = opts.readDenyHomes !== undefined ? carriedReadFaceOf(opts.readDenyHomes) : undefined;
+    const readFaceRoots = carriedFace?.readRoots ?? (additionalReadRoots === undefined ? additionalRoots : () => (additionalReadRoots.length === 0 ? additionalRoots : [...(additionalRoots ?? []), ...additionalReadRoots]));
     const cwdRef = opts.cwdRef ?? { current: rootCanonical };
     const bgOutput = backgroundOutputReadExemption(opts.taskRegistry, opts, env);
     const readAdmission = opts.readAdmission;
     const bgOutputReadExemption = bgOutput === undefined && readAdmission === undefined
         ? undefined
         : (canonicalKey, c) => readAdmission?.(c.toolCallId, canonicalKey) === true || (bgOutput?.(canonicalKey, c) ?? false);
-    const readDenyAdditions = (opts.readDenyPatterns ?? []).map((e) => (typeof e === "object" && e !== null ? { ...e } : e));
-    const readDenyRules = opts.pathDenyRules === undefined ? undefined : [...opts.pathDenyRules];
-    const readDenyBuiltinCfg = readDenyBuiltinConfigOf({ tiers: opts.readDenyBuiltinTiers, exclude: opts.readDenyBuiltinExclude });
-    const readDenyHomes = opts.readDenyHomes === undefined ? undefined : [...checkedReadDenyHomes(opts.readDenyHomes)];
-    const compileAt = (homes, linked) => compileReadDeny(readDenyAdditions, "HandsToolkitOptions.readDenyPatterns", readDenyBuiltinCfg, readDenyRules, homes, linked);
-    const unplaced = compileAt([]);
-    const carried = readDenyHomes !== undefined && opts.readDenyHomeLinks !== undefined;
-    const carriedViews = carried ? placementViewsOf(opts.readDenyHomes) : undefined;
-    if (carried && carriedViews === undefined)
-        sayPlacementLost();
-    const placesNothing = !unplaced.entries.some((e) => readDenyPatternRun(e.pattern).homeAnchored || isRootedReadDenyPattern(e.pattern));
-    const late = carried || placesNothing ? undefined : readDenyPlacedLater(carryHomeViews(unplaced, homeViewsAt(env, [])), () => placeReadDenyAtHome(env, compileAt, readDenyHomes));
-    const readDeny = late?.matcher ??
-        (carried
-            ? carriedViews !== undefined
-                ? carryHomeViews(compileAt(readDenyHomes, opts.readDenyHomeLinks), carriedViews)
-                : carryHomeViews(unplaced, homeViewsAt(env, []))
-            : carryHomeViews(unplaced, homeViewsAt(env, readDenyHomes ?? [])));
-    const afterPlacement = (tool) => late === undefined
-        ? tool
-        : {
-            ...tool,
-            execute: async (...args) => {
-                await withGateTimeout(late.ready(), undefined, args[2], "readDenyPlacement").catch(() => undefined);
-                return await tool.execute(...args);
-            },
-        };
-    const writeDenyCompiled = compileWriteDeny(readDenyRules);
-    const writeDeny = writeDenyCompiled.ruleRows.length > 0 ? carryHomeViews(writeDenyCompiled, readDeny.homeViews) : undefined;
+    const { readDeny, writeDeny, afterPlacement } = carriedFace !== undefined ? { readDeny: carriedFace.readDeny, writeDeny: carriedFace.writeDeny, afterPlacement: (tool) => tool } : bandOwnTables(env, opts);
     const readFace = resolveContainmentFace({
         kind: "read",
         depsFace: opts.readFace,
@@ -87,13 +60,30 @@ export function createHandsToolkit(env, readFileState, rootCanonical, opts = {})
         onDeploymentClamp: () => deliverEngineNotice(opts.onNotice, deploymentFaceClampNotice("write")),
     });
     const writeFaceOf = opts.writeFaceLive ?? (() => writeFace);
+    const readCwd = readOnly ? undefined : cwdRef;
+    const reader = createModelFileReader({
+        env,
+        state: readFileState,
+        rootCanonical,
+        ...(readCwd !== undefined ? { cwdRef: readCwd } : {}),
+        ...(readFaceRoots !== undefined ? { additionalRoots: readFaceRoots } : {}),
+        imageDownsampler: opts.readImageDownsampler,
+        ...(opts.pdfModelCapabilities !== undefined ? { pdfCapabilities: opts.pdfModelCapabilities } : {}),
+        ...(bgOutputReadExemption !== undefined ? { bgOutputReadExemption } : {}),
+        ...(readDeny !== undefined ? { readDeny } : {}),
+        ...(readFace !== undefined ? { readFace } : {}),
+        ...(opts.reminderMark !== undefined ? { reminderMark: opts.reminderMark } : {}),
+        ...(opts.reminderDisclosureCounts !== undefined ? { reminderDisclosureCounts: opts.reminderDisclosureCounts } : {}),
+    });
+    if (opts.modelFileReaderSeat !== undefined)
+        opts.modelFileReaderSeat.current = reader;
     const tools = [
-        afterPlacement(createReadFileTool(env, readFileState, rootCanonical, readOnly ? undefined : cwdRef, readFaceRoots, opts.readImageDownsampler, opts.pdfModelCapabilities, bgOutputReadExemption, readDeny, readFace, opts.reminderMark, opts.reminderDisclosureCounts)),
+        afterPlacement(createReadFileTool(env, readFileState, rootCanonical, readCwd, readFaceRoots, opts.readImageDownsampler, opts.pdfModelCapabilities, bgOutputReadExemption, readDeny, readFace, opts.reminderMark, opts.reminderDisclosureCounts, reader)),
     ];
     if (handsWriteHalfMounts({ readOnly })) {
         tools.push(createEditFileTool(env, readFileState, rootCanonical, cwdRef, additionalRoots, opts.beforeWrite, opts.trackFileEdit, opts.onFileEdited, writeFaceOf, writeDeny), createWriteFileTool(env, readFileState, rootCanonical, cwdRef, additionalRoots, opts.beforeWrite, opts.trackFileEdit, opts.onFileEdited, writeFaceOf, writeDeny), createNotebookEditTool(env, readFileState, rootCanonical, cwdRef, additionalRoots, opts.beforeWrite, opts.trackFileEdit, opts.onFileEdited, writeFaceOf, writeDeny));
     }
-    tools.push(afterPlacement(createGrepTool(env, rootCanonical, readFaceRoots, readDeny, readFace, cwdRef, readAdmission)), afterPlacement(createGlobTool(env, rootCanonical, readFaceRoots, readDeny, readFace, cwdRef, readAdmission)), afterPlacement(createRepoMapTool(env, rootCanonical, readFaceRoots, readDeny, readFace)));
+    tools.push(afterPlacement(createGrepTool(env, rootCanonical, readFaceRoots, readDeny, readFace, cwdRef, readAdmission)), afterPlacement(createGlobTool(env, rootCanonical, readFaceRoots, readDeny, readFace, cwdRef, readAdmission)), afterPlacement(createRepoMapTool(env, rootCanonical, readFaceRoots, readDeny, readFace, cwdRef, readAdmission)));
     if (includeShell) {
         tools.push(readOnly
             ? createBashReadonlyTool(env, rootCanonical, new Set(bashReadonlyAllow ?? BASH_READONLY_DEFAULT_ALLOW), {
@@ -141,3 +131,35 @@ export function createHandsToolkit(env, readFileState, rootCanonical, opts = {})
     }
     return tools;
 }
+function bandOwnTables(env, opts) {
+    const readDenyAdditions = (opts.readDenyPatterns ?? []).map((e) => (typeof e === "object" && e !== null ? { ...e } : e));
+    const readDenyRules = opts.pathDenyRules === undefined ? undefined : [...opts.pathDenyRules];
+    const readDenyBuiltinCfg = readDenyBuiltinConfigOf({ tiers: opts.readDenyBuiltinTiers, exclude: opts.readDenyBuiltinExclude });
+    const readDenyHomes = opts.readDenyHomes === undefined ? undefined : [...checkedReadDenyHomes(opts.readDenyHomes)];
+    const compileAt = (homes, linked) => compileReadDeny(readDenyAdditions, "HandsToolkitOptions.readDenyPatterns", readDenyBuiltinCfg, readDenyRules, homes, linked);
+    const unplaced = compileAt([]);
+    const carried = readDenyHomes !== undefined && opts.readDenyHomeLinks !== undefined;
+    const carriedViews = carried ? placementViewsOf(opts.readDenyHomes) : undefined;
+    if (carried && carriedViews === undefined)
+        sayPlacementLost();
+    const placesNothing = !unplaced.entries.some((e) => readDenyPatternRun(e.pattern).homeAnchored || isRootedReadDenyPattern(e.pattern));
+    const late = carried || placesNothing ? undefined : readDenyPlacedLater(carryHomeViews(unplaced, homeViewsAt(env, [])), () => placeReadDenyAtHome(env, compileAt, readDenyHomes));
+    const readDeny = late?.matcher ??
+        (carried
+            ? carriedViews !== undefined
+                ? carryHomeViews(compileAt(readDenyHomes, opts.readDenyHomeLinks), carriedViews)
+                : carryHomeViews(unplaced, homeViewsAt(env, []))
+            : carryHomeViews(unplaced, homeViewsAt(env, readDenyHomes ?? [])));
+    const afterPlacement = (tool) => late === undefined
+        ? tool
+        : {
+            ...tool,
+            execute: async (...args) => {
+                await withGateTimeout(late.ready(), undefined, args[2], "readDenyPlacement").catch(() => undefined);
+                return await tool.execute(...args);
+            },
+        };
+    const writeDenyCompiled = compileWriteDeny(readDenyRules);
+    const writeDeny = writeDenyCompiled.ruleRows.length > 0 ? carryHomeViews(writeDenyCompiled, readDeny.homeViews) : undefined;
+    return { readDeny, writeDeny, afterPlacement };
+}

package/dist/tools/fs/read-deny-home.d.ts

@@ -1,6 +1,6 @@
 import type { ExecutionEnv } from "../../internal/harness-types.js";
 import { type PathFamily } from "./safety.js";
-import { type ReadDenyMatcher } from "./read-deny.js";
+import { type ReadDenyMatcher, type WriteDenyMatcher } from "./read-deny.js";
 /** The one bound every probe of an AUXILIARY home shares within one placement (see the module head): long enough for a
  *  local directory's canonical spelling, its chain of identities and its rows' heads, short enough that a hung home
  *  costs a placement seconds, not the gate's bound. */
@@ -116,11 +116,29 @@ export interface HomeViewsCarrier {
 export type PlacedReadDenyMatcher = ReadDenyMatcher & {
     readonly homeViews: HomeViewSource;
 };
+/** The Runner's read face as its tool band takes it: the run's read and write deny tables — each judgment reads the run's
+ *  latest, `forCall` hands a call its own — and the read face's root set, read per judgment (a call's own through
+ *  `forCall`). A band handed one judges with it and compiles no table of its own. */
+export interface CarriedReadFace {
+    readonly readDeny: PlacedReadDenyMatcher;
+    readonly writeDeny: WriteDenyMatcher & {
+        readonly homeViews: HomeViewSource;
+    };
+    readonly readRoots: () => readonly string[];
+}
 /** The views of the placement that returned `homes` — the very list object, as the engine hands it on (the Runner's
  *  tool band). `undefined` for any other list: a copy, or a host's own. A mount that was handed the engine's placement
  *  and cannot find its views has lost it: an engine defect, which the mount names ({@link sayPlacementLost}) and answers
  *  by holding its home-anchored rows at every location — never by reading the homes a second time. */
 export declare function placementViewsOf(homes: readonly string[]): HomeViewSource | undefined;
+/** The run's read face a home list carries ({@link carryReadFace}); `undefined` for any other list. */
+export declare function carriedReadFaceOf(homes: readonly string[]): CarriedReadFace | undefined;
+/** A home list (a fresh frozen copy of `homes`) that hands the Runner's read face to its band: the band judges with the
+ *  face's tables and roots instead of compiling its own from the rows it is handed. */
+export declare function carryReadFace(homes: readonly string[], face: CarriedReadFace): readonly string[];
+/** A judge that reads `current` at every judgment — the table a placement in flight will replace, or the run's tables of
+ *  which each judgment takes the latest — with the home views `homeViews` (default: the current judge's). */
+export declare function readDenyOver(current: () => PlacedReadDenyMatcher, homeViews?: HomeViewSource): PlacedReadDenyMatcher;
 /** The line a mount says when the engine handed it a home list that is not its placement's (an engine defect, said every
  *  time: no latch). */
 export declare function sayPlacementLost(): void;

package/dist/tools/fs/read-deny-home.js

@@ -348,11 +348,40 @@ function homeViewSourceOver(env, auxiliary) {
 const PLACEMENT_VIEWS = new WeakMap();
 function placementOf(matcher, homes, linked, whole) {
     const list = Object.freeze([...homes]);
-    PLACEMENT_VIEWS.set(list, matcher.homeViews);
+    PLACEMENT_VIEWS.set(list, { views: matcher.homeViews });
     return { matcher, homes: list, linked, whole };
 }
 export function placementViewsOf(homes) {
-    return PLACEMENT_VIEWS.get(homes);
+    return PLACEMENT_VIEWS.get(homes)?.views;
+}
+export function carriedReadFaceOf(homes) {
+    return PLACEMENT_VIEWS.get(homes)?.face;
+}
+export function carryReadFace(homes, face) {
+    const list = Object.freeze([...homes]);
+    PLACEMENT_VIEWS.set(list, { views: face.readDeny.homeViews, face });
+    return list;
+}
+export function readDenyOver(current, homeViews) {
+    return {
+        get entries() {
+            return current().entries;
+        },
+        get ruleRows() {
+            return current().ruleRows;
+        },
+        matchPath: (path, opts) => current().matchPath(path, opts),
+        matchTarget: (canonicalKey, lexicalView, opts) => current().matchTarget(canonicalKey, lexicalView, opts),
+        get rgExclusionGlobs() {
+            return current().rgExclusionGlobs;
+        },
+        get rgProbeGlobs() {
+            return current().rgProbeGlobs;
+        },
+        unexcludableUnder: (scope) => current().unexcludableUnder?.(scope) ?? false,
+        rowAtOrBelow: (path) => current().rowAtOrBelow?.(path) ?? null,
+        homeViews: homeViews ?? { views: (signal) => current().homeViews.views(signal) },
+    };
 }
 export function sayPlacementLost() {
     try {
@@ -447,24 +476,5 @@ export function readDenyPlacedLater(unplaced, place) {
             };
         },
     };
-    const matcher = {
-        get entries() {
-            return current.entries;
-        },
-        get ruleRows() {
-            return current.ruleRows;
-        },
-        matchPath: (path, opts) => current.matchPath(path, opts),
-        matchTarget: (canonicalKey, lexicalView, opts) => current.matchTarget(canonicalKey, lexicalView, opts),
-        get rgExclusionGlobs() {
-            return current.rgExclusionGlobs;
-        },
-        get rgProbeGlobs() {
-            return current.rgProbeGlobs;
-        },
-        unexcludableUnder: (scope) => current.unexcludableUnder?.(scope) ?? false,
-        rowAtOrBelow: (path) => current.rowAtOrBelow?.(path) ?? null,
-        homeViews,
-    };
-    return { matcher, ready };
+    return { matcher: readDenyOver(() => current, homeViews), ready };
 }

package/dist/tools/fs/read-deny.d.ts

@@ -142,6 +142,8 @@ export interface WriteDenyMatcher {
         readonly aliasResolved?: boolean;
         readonly hops?: readonly string[];
     }): ReadDenyHit | null;
+    /** The table ONE call judges with ({@link ReadDenyMatcher.forCall}). */
+    forCall?(toolCallId: string | undefined): WriteDenyMatcher;
 }
 /** Compile the write face over the rule rows (the rows not on it are dropped here, once). */
 export declare function compileWriteDeny(rules?: readonly PathRuleDenyRow[]): WriteDenyMatcher;
@@ -197,7 +199,19 @@ export interface ReadDenyMatcher {
      *  path from its own segments ({@link rowMeetsPath}) — so moving, copying or removing the path changes what the row
      *  covers. A rule row's reach below a path is not enumerable: any rule row answers. */
     rowAtOrBelow?(path: string): ReadDenyHit | null;
+    /** The table ONE call judges with — the Runner's tables are one per read of the person's rules, and a call judges with
+     *  the read it was pinned to (an unknown or released call: the run's latest). Absent on a table compiled once: it is
+     *  every call's ({@link seatForCall}). */
+    forCall?(toolCallId: string | undefined): ReadDenyMatcher;
 }
+/** A seat the run's tables back — a deny table, a read-root set — as ONE call takes it: the call's own where the seat
+ *  carries `forCall`, the seat itself otherwise (a table compiled once, a host's own list) and for a reader that is no
+ *  call (no id: the seat's own reading of the run's latest, with every refusal it carries). Taken once, where the call's
+ *  judgment starts, so every judgment of the call reads one table. */
+export declare function seatForCall<T>(seat: T, toolCallId: string | undefined): T;
+/** Settles once the tables a seat the run's tables back stands on are ready for a reader that is no call (the seat's
+ *  `ready`); any other seat is ready. Never rejects. */
+export declare function seatReady(seat: unknown, signal?: AbortSignal): Promise<void>;
 /** The DENY HALF of a shell read boundary, in the shape `BashReadonlyRootBoundary` declares it (structural:
  *  this module is the leaf every face depends on). `denyMatch` judges one LEXICALLY RESOLVED operand,
  *  returning the matched pattern or null; PRESENT-IFF there is something to judge. */

package/dist/tools/fs/read-deny.js

@@ -153,6 +153,14 @@ export function compileWriteDeny(rules = []) {
     };
     return { face: "write", ruleRows, matchPath, matchTarget: (canonicalKey, lexicalView, opts) => denyTableHit(rows, denyTargetViews(canonicalKey, lexicalView, opts)) };
 }
+export function seatForCall(seat, toolCallId) {
+    const forCall = seat?.forCall;
+    return typeof forCall === "function" && toolCallId !== undefined ? forCall.call(seat, toolCallId) : seat;
+}
+export function seatReady(seat, signal) {
+    const ready = seat?.ready;
+    return typeof ready === "function" ? Promise.resolve(ready.call(seat, signal)) : Promise.resolve();
+}
 export function readDenySeat(matcher) {
     const entries = [...(matcher?.entries ?? []).map((e) => e.pattern), ...(matcher?.ruleRows ?? []).map((r) => r.rule)];
     if (matcher === undefined || entries.length === 0)

package/dist/tools/fs/repo-map.d.ts

@@ -1,8 +1,9 @@
 import type { AgentTool } from "../../internal/harness-types.js";
 import type { ExecutionEnv } from "../../internal/harness-types.js";
 import { type RootsSeat } from "./safety.js";
-import type { ReadDenyMatcher } from "./read-deny.js";
+import { type ReadDenyMatcher } from "./read-deny.js";
 import type { ContainmentFace } from "./containment-face.js";
+import type { CwdRef } from "./fs-shared.js";
 /** Extract top-level symbol names (deduped, in first-seen order) from source text. A lightweight
  *  comment/docstring state machine skips column-0 declaration-like lines that are really inside a
  *  `/* … *​/` block comment or a Python `"""`/`'''` docstring — otherwise e.g. a module docstring
@@ -14,4 +15,4 @@ import type { ContainmentFace } from "./containment-face.js";
  *  (src/core/auto-promote.ts) consumes it in ESCALATE-ONLY mode — a clean scan contributes nothing;
  *  it can only ever raise an escalation, never clear one. */
 export declare function extractSymbols(text: string): string[];
-export declare function createRepoMapTool(env: ExecutionEnv, rootCanonical: string, additionalRoots?: RootsSeat, readDeny?: ReadDenyMatcher, readFace?: ContainmentFace): AgentTool;
+export declare function createRepoMapTool(env: ExecutionEnv, rootCanonical: string, rootsSeat?: RootsSeat, denySeat?: ReadDenyMatcher, readFace?: ContainmentFace, cwdRef?: CwdRef, readAdmission?: (toolCallId: string | undefined, canonicalKey: string) => boolean): AgentTool;

package/dist/tools/fs/repo-map.js

@@ -2,7 +2,10 @@ import { Type } from "typebox";
 import { defineTool, errorResult } from "../../core/tools.js";
 import { resolveKey, violationText, violationDetails } from "./safety.js";
 import { buildIgnore, denyWithheldNote, walk, walkIsPartial } from "./search.js";
+import { seatForCall } from "./read-deny.js";
 import { toolFace } from "../../core/tool-catalog-entries.js";
+import { pathTargetBaseOf } from "../../core/effective-path-target.js";
+import { pathTargetValue } from "../../core/tool-registry.js";
 const DEFAULT_MAX_CHARS = 16_000;
 const DEFAULT_MAX_FILES = 400;
 const FILE_SCAN_MAX_BYTES = 256 * 1024;
@@ -80,7 +83,8 @@ function rankEntries(a, b) {
         return b.symbols.length - a.symbols.length;
     return a.rel < b.rel ? -1 : a.rel > b.rel ? 1 : 0;
 }
-export function createRepoMapTool(env, rootCanonical, additionalRoots, readDeny, readFace) {
+export function createRepoMapTool(env, rootCanonical, rootsSeat, denySeat, readFace, cwdRef, readAdmission) {
+    const declaredTarget = toolFace("repo-map").pathTarget;
     return defineTool({
         name: "RepoMap",
         ...toolFace("repo-map"),
@@ -94,12 +98,16 @@ export function createRepoMapTool(env, rootCanonical, additionalRoots, readDeny,
             max_files: Type.Optional(Type.Number({ description: `Max files to scan (default ${DEFAULT_MAX_FILES}).` })),
         }),
         execute: async (args, ctx) => {
+            const readDeny = seatForCall(denySeat, ctx.toolCallId);
+            const additionalRoots = seatForCall(rootsSeat, ctx.toolCallId);
             const a = args;
             const signal = ctx.signal;
             const rootPrefix = rootCanonical.replace(/[\\/]+$/, "") + (rootCanonical.includes("\\") ? "\\" : "/");
             let start = rootCanonical;
-            if (a.path !== undefined) {
-                const r = await resolveKey(env, rootCanonical, a.path, signal, rootCanonical, additionalRoots, undefined, readDeny, readFace);
+            const scopeSpelling = declaredTarget === undefined ? undefined : pathTargetValue(a, declaredTarget);
+            if (scopeSpelling !== undefined) {
+                const baseCwd = pathTargetBaseOf(declaredTarget, { root: rootCanonical, cwd: cwdRef?.current });
+                const r = await resolveKey(env, rootCanonical, scopeSpelling, signal, baseCwd, additionalRoots, readAdmission && ((key) => readAdmission(ctx.toolCallId, key)), readDeny, readFace);
                 if (!r.ok)
                     return errorResult(violationText("RepoMap", r.violation), violationDetails(r.violation));
                 start = r.key;

package/dist/tools/fs/safety.d.ts

@@ -1,3 +1,4 @@
+import { type DenyFace } from "./read-deny.js";
 import { type HomeViewSource } from "./read-deny-home.js";
 import type { AssertAllKeysHandled } from "../../core/ask-origin.js";
 import type { ExecutionEnv } from "../../internal/harness-types.js";
@@ -520,12 +521,36 @@ export declare function violationDetails(v: FsViolation): {
     code: "path_not_in_root";
     target: string;
     roots: readonly string[];
-} | {
+} | ReadPathDeniedCard | undefined;
+/** The read face's refusal card: which target, which deny pattern. */
+export type ReadPathDeniedCard = {
     type: "read_path_denied";
     code: "read_path_denied";
     target: string;
     pattern: string;
-} | undefined;
+};
+/**
+ * The ONE mint of the `read_path_denied` card. `type` is the CC_DETAIL_TYPES discriminator, so the refusal's
+ * coordinates reach `tool_end.structured`, not just prose; `code` carries the same value for in-process readers.
+ * Every site that refuses a read on a deny row — the tools' own resolution, the shell station, the gate's rule lanes —
+ * mints it here.
+ */
+export declare function readPathDeniedCard(target: string, pattern: string): ReadPathDeniedCard;
+/**
+ * Where one deny row refused a call: the row's text, the view of the target it met, and the face the call is on.
+ * Minted once, by the judge that found the row; every exit of the gate reads it and judges nothing again.
+ */
+export interface PathDenialEvidence {
+    readonly rule: string;
+    readonly view: string;
+    readonly face: DenyFace;
+}
+/**
+ * The card a gate-side path refusal carries: the read face's own ({@link readPathDeniedCard}); the write face has none
+ * (as in the tools' own resolution, where a write refusal's `write_path_denied` code carries no card). The card's
+ * presence follows the FACE, never the station that refused.
+ */
+export declare function pathDenialCardOf(evidence: PathDenialEvidence | undefined): ReadPathDeniedCard | undefined;
 /**
  * Does `p` sit inside ANY of the canonical containment roots? Exposed for the Bash
  * tool's post-`cd` disclosure note (fs-bash.ts): the note reuses the SAME segment-aware `within`
@@ -534,6 +559,20 @@ export declare function violationDetails(v: FsViolation): {
  * design; fs-bash canonical-confirms before claiming "outside").
  */
 export declare function withinAnyRoot(rootsCanonical: readonly string[], p: string): boolean;
+/**
+ * THE store-isolation rule, one judgment for every root admission point (the Artifact mount over the prepare-time
+ * roots, an in-flight read-root grant over the granted root, a person's read directory where a run's read roots are
+ * read): a root that CONTAINS the local artifact store, lies INSIDE it, or IS it hands the file tools the store's ledger
+ * and stored files. Returns the first such root, or undefined.
+ *
+ * `storePhysical` is the store's physical path on THIS process's filesystem (`physicalPathOfExisting`, resolved
+ * once per run by the Artifact phase); a root is the execution env's canonical key. The judgment touches no
+ * filesystem — the grant runs after the approver's wait under the call's cut, and a synchronous lookup on a stalled
+ * store mount would block the event loop past that cut. The two are compared as identities only when both spell the
+ * same family (`within` reads both under the root's family); a root of the other family names a filesystem the store
+ * cannot be on, and no claim is made against it.
+ */
+export declare function rootAdmittingArtifactStore(storePhysical: string, rootsCanonical: readonly string[]): string | undefined;
 /**
  * The escape-hatch tail for the `path_not_in_root` refusal: like its three sibling hints below, it
  * names a sanctioned next step, so the model does not oscillate between "the boundary is hard" and

package/dist/tools/fs/safety.js

@@ -659,16 +659,25 @@ export function violationText(toolName, v) {
     return `Error (${toolName}): ${v.message}`;
 }
 export function violationDetails(v) {
-    if (v.code === "read_path_denied" && v.target !== undefined && v.pattern !== undefined) {
-        return { type: "read_path_denied", code: "read_path_denied", target: v.target, pattern: v.pattern };
-    }
+    if (v.code === "read_path_denied" && v.target !== undefined && v.pattern !== undefined)
+        return readPathDeniedCard(v.target, v.pattern);
     return v.code === "path_not_in_root" && v.target !== undefined
         ? { type: "path_not_in_root", code: "path_not_in_root", target: v.target, roots: v.roots ?? [] }
         : undefined;
 }
+export function readPathDeniedCard(target, pattern) {
+    return { type: "read_path_denied", code: "read_path_denied", target, pattern };
+}
+export function pathDenialCardOf(evidence) {
+    return evidence?.face === "read" ? readPathDeniedCard(evidence.view, evidence.rule) : undefined;
+}
 export function withinAnyRoot(rootsCanonical, p) {
     return rootsCanonical.some((r) => within(r, p));
 }
+export function rootAdmittingArtifactStore(storePhysical, rootsCanonical) {
+    const storeFamily = pathFamilyOf({ root: storePhysical });
+    return rootsCanonical.find((root) => pathFamilyOf({ root }) === storeFamily && (withinAnyRoot([root], storePhysical) || withinAnyRoot([storePhysical], root)));
+}
 export const PATH_NOT_IN_ROOT_ESCAPE_HINT = "(This boundary applies to the structured file tools. If you genuinely need content outside the allowed root(s), ask for the directory to be added to the deployment's additionalDirectories — or additionalReadDirectories for read-only access; a deployment that wants reads or writes open everywhere can declare readFace / writeFace: \"open\" instead of listing directories.)";
 export function requireRead(state, key) {
     const entry = state.get(key);

package/dist/tools/fs/shell-read-check.d.ts

@@ -44,6 +44,14 @@ export type ShellReadRefusalDetails = NonNullable<ReturnType<typeof violationDet
 export interface ShellReadVerdict {
     readonly disposition: ShellReadDisposition;
     readonly finding: ShellReadFinding;
+    /** The environment did not answer the judgment — a resolver, a listing or an identity lookup gave no answer, a bound was
+     *  reached, the judge itself did not answer: present on the `unanswered` finding the fold or the fallback gives. The gate
+     *  classes the question as shell text the engine cannot read. */
+    readonly environmentSilent?: true;
+    /** Rows the station's boundary stands on could not be read (`ShellReadBoundary.unreadPartitions`, or a boundary the seat
+     *  could not hand over): present on ANY verdict judged beside them, whatever its finding. The gate classes the question as
+     *  a rule that could not be read. */
+    readonly rowsUnread?: true;
     /** `write` ⇔ the finding is about where the command WRITES — its witness is a write target (a redirection's, or a word
      *  the program's row writes), judged against the write roots. Absent ⇒ a read's finding (or `vouch`). */
     readonly face?: "write";
@@ -146,9 +154,10 @@ export interface ShellReadStationOptions {
     readonly tools: ReadonlySet<string>;
     /** The trust-policy seat a tool is judged on. */
     readonly seatOf: (toolName: string) => ShellReadStationSeat;
-    /** The boundary for a call, read per call (the tracked working directory moves). `undefined` ⇒ no
-     *  boundary declared, nothing to be outside of — the station vouches. */
-    readonly boundaryOf: (toolName: string, cwd: string | undefined) => ShellReadBoundary | undefined;
+    /** The boundary for a call, read per call (the tracked working directory moves; the call's own tables, by its id —
+     *  `undefined` where no call is judged). `undefined` ⇒ no boundary declared, nothing to be outside of — the station
+     *  vouches. */
+    readonly boundaryOf: (toolName: string, cwd: string | undefined, toolCallId: string | undefined) => ShellReadBoundary | undefined;
     /** The listed read verbs (decides whether a segment is read by verb slots or word by word). */
     readonly readers?: ReadonlySet<string>;
     /** `true` ⇔ every root `boundaryOf` returns is already a canonical identity (the Runner's): the station never