@sema-agent/core 7.49.5 → 7.50.1

package/dist/core/lsp.d.ts

@@ -1,4 +1,8 @@
-import type { AgentTool, ExecutionEnv } from "../internal/harness-types.js";
+import { type RootsSeat } from "../tools/fs/safety.js";
+import { type ReadDenyMatcher } from "../tools/fs/read-deny.js";
+import type { HomeViewsCarrier } from "../tools/fs/read-deny-home.js";
+import type { ContainmentFace } from "../tools/fs/containment-face.js";
+import type { AgentTool, BoundFileObject, ExecutionEnv } from "../internal/harness-types.js";
 /**
  * LSP code-intelligence tool (design/64 §13.1) — the app-dev命门 (go-to-def / find-refs / hover across
  * Dart/Kotlin/TS). A single `lsp` tool with a 9-operation enum, built over a pluggable {@link LspServerManager}.
@@ -147,8 +151,71 @@ export interface LspRequestParams {
 }
 /** An active language-server session for one language, scoped to a workspace. */
 export interface LspSession {
-    request(op: LspOperation, params: LspRequestParams, signal?: AbortSignal): Promise<LspResult>;
+    /** `gate` = the caller's read face at the session's file reads ({@link LspReadGate}); absent ⇒ a caller with none. */
+    request(op: LspOperation, params: LspRequestParams, signal?: AbortSignal, gate?: LspReadGate): Promise<LspResult>;
 }
+/** What a session's read gate answered for one file: the object its judgment named, opened and HELD (the environment's
+ *  `openBound`) under the canonical key it was judged as — the session reads that object, never the name again, and closes
+ *  it — or a refusal with its reason. */
+export type LspReadAdmission = {
+    readonly ok: true;
+    readonly key: string;
+    readonly object: BoundFileObject;
+} | {
+    readonly ok: false;
+    readonly reason: string;
+};
+/** May a session read `filePath` (a path {@link resolveLspPath} minted) for this caller, now — and if so, WHAT: the gate
+ *  admits an object, not a name ({@link LspReadAdmission}). A session reads a file only from the object its caller's gate
+ *  admitted, and closes an opened document the gate does not admit. */
+export type LspReadGate = (filePath: string, signal?: AbortSignal) => Promise<LspReadAdmission>;
+/** The read face one LSP mount reads under: the seats the fs read tools take, so the gate and the tool resolve and judge
+ *  a `filePath` alike (see {@link LspToolOptions.readFace}). */
+export interface LspReadFace {
+    /** The canonical task root: the primary containment root, and the base when no working directory is tracked. */
+    readonly rootCanonical: string;
+    /** The extra read roots (write-capable and read-only), read per call. */
+    readonly roots?: RootsSeat;
+    /** The tracked working directory; `current` is read per call as the base of a relative `filePath`. */
+    readonly cwdRef?: {
+        readonly current: string;
+    };
+    /** The read-deny table in force, with its placement's home views. */
+    readonly readDeny?: ReadDenyMatcher & HomeViewsCarrier;
+    /** The read containment face. Absent ⇒ `roots`. */
+    readonly face?: ContainmentFace;
+    /** The file read station's admission: an out-of-root target the gate asked about and let through, read once. */
+    readonly admitted?: (toolCallId: string | undefined, canonicalKey: string) => boolean;
+    /** Settles once the read-deny table and read roots a judgment takes are ready (a Runner compiles them per read of the
+     *  person's rules): a call's own (`toolCallId`), or — with none — the run's newest; at `signal` too; never rejects;
+     *  absent ⇒ ready. The tool waits for it before it takes its call's; the session's own reads before they judge. */
+    readonly ready?: (toolCallId: string | undefined, signal?: AbortSignal) => Promise<void>;
+}
+/** The base a relative `filePath` resolves against: the catalog declaration through the one selector the fences read it
+ *  with; with no read face the env's working directory is the only base there is. */
+export declare function lspBaseOf(readFace: LspReadFace | undefined, env?: ExecutionEnv): string | undefined;
+/** The session gate over a read face — the bound read a user attachment makes, at the session's read: the name is judged
+ *  as `Read` judges its target (a judgment that throws refuses), the object the judgment named is opened and held
+ *  (`openBound`; an environment without it cannot bind and refuses), and the name, judged again, must still land on the
+ *  held key. The admission carries the held object; the session reads only it. `authorizedKey` = the canonical key this
+ *  call's target was authorized as (the station's one-read admission already spent on it): a spelling that still lands
+ *  there passes outside the roots, nothing else does. */
+export declare function lspReadGateOf(env: ExecutionEnv, face: LspReadFace, authorizedKey?: string): LspReadGate;
+/** Why a file the language server named is withheld: a read-deny row reaches one of its views, or its views could not be
+ *  read (`unreadable` — the judgment's absence word). */
+export type LspListedWithholding = {
+    readonly pattern: string;
+} | {
+    readonly unreadable: true;
+};
+/**
+ * The files a language server named (result locations, symbols, drained diagnostics), judged as ONE bounded batch against
+ * the read face's deny table on every view of each file — the spelling, the canonical target, the home view and the link
+ * hops, through the same `resolveKey` a read target meets (containment is not this question: the face is judged open).
+ * Fail-closed: a file whose views cannot be read, and every file when the batch outlives the gate's deadline, is withheld.
+ * Kept files are absent from the result.
+ */
+export declare function lspListedWithheld(env: ExecutionEnv, face: LspReadFace, uris: readonly string[], signal?: AbortSignal): Promise<ReadonlyMap<string, LspListedWithholding>>;
 /**
  * A JSON-RPC transport to ONE language server, POST-`initialize`. The DEPLOYMENT provides the concrete
  * transport; the protocol logic ({@link buildRequest}/`parseResult`, `TransportLspSession`) drives the LSP
@@ -175,7 +242,8 @@ export interface LspTransport {
      *  a test mock stays minimal. */
     readonly closed?: boolean;
 }
-/** Reads a workspace file's CURRENT text for the session's didOpen/didChange re-sync. TOC = local fs; TOB =
+/** Reads a workspace file's CURRENT text for the session's didOpen/didChange re-sync BY NAME — the read of a caller with no
+ *  gate (no read face) only; a gated read is the admitted held object's ({@link LspReadAdmission}). TOC = local fs; TOB =
  *  the sandbox ExecutionEnv. */
 export type LspReadText = (filePath: string, signal?: AbortSignal) => Promise<string>;
 /** CC 2.1.220's LSP file cap (10MB — `File too large for LSP analysis`, (pretty220.js:474745, historical; not relocated in 250 — see cc-250 anchors)). Single-sourced
@@ -216,6 +284,18 @@ export interface LspToolOptions {
     /** The task's ExecutionEnv, passed through to {@link LspServerManager.sessionFor} (the agent's sandbox —
      *  where an in-env language server must run). The Runner wires this from the per-task env. */
     env?: ExecutionEnv;
+    /**
+     * The read face this mount reads under (needs `env`). PRESENT ⇒ every read the tool causes passes it: the `filePath`
+     * target is resolved against the declared base (the tracked working directory, else the root) and fenced as `Read`
+     * fences its own — containment with the station's one-read admission, the read-deny table, blocked devices; the file
+     * preconditions (exists / a regular file / the size cap) are read from the object that judgment named, held at its key
+     * (the environment's `openBound`), never from the spelling again; the session reads an opened file only from the
+     * object the face admitted and held (an environment without `openBound` reads nothing) and closes one it does not
+     * admit; every location or symbol in a file the deny table reaches is withheld, and the result says how many. ABSENT ⇒
+     * no read face judged this mount (a library-direct tool with no gate): a relative `filePath` resolves against
+     * `env.cwd`, the preconditions and the session's reads go by name, nothing is fenced and nothing is withheld.
+     */
+    readFace?: LspReadFace;
 }
 /** Build the `lsp` tool over a {@link LspServerManager}. Mounted only when a manager is wired (opt-in). */
 export declare function createLspTool(manager: LspServerManager, opts?: LspToolOptions): AgentTool;

package/dist/core/lsp.js

@@ -1,8 +1,13 @@
 import { uriToPath } from "./lsp-protocol.js";
-import { anchorSpelling, foldRedundantPathSegments, pathFamilyOf } from "../tools/fs/safety.js";
+import { anchorSpelling, foldRedundantPathSegments, pathFamilyOf, resolveKey, violationDetails, violationText } from "../tools/fs/safety.js";
+import { seatForCall, sensitivePathDenyList } from "../tools/fs/read-deny.js";
+import { pathTargetBaseOf } from "./effective-path-target.js";
+import { DEFAULT_GATE_AWAIT_TIMEOUT_MS, withGateTimeout } from "./gate-bounded-await.js";
+import { pathTargetOf } from "./tool-registry.js";
 import { Type } from "typebox";
 import { defineTool, errorResult } from "./tools.js";
 import { toolFace } from "./tool-catalog-entries.js";
+import { thrownText } from "./thrown-value.js";
 export const LSP_OPERATIONS = [
     "goToDefinition", "findReferences", "hover", "documentSymbol", "workspaceSymbol",
     "goToImplementation", "prepareCallHierarchy", "incomingCalls", "outgoingCalls",
@@ -73,6 +78,63 @@ export function resolveLspPath(filePath, cwd) {
         return foldRedundantPathSegments(filePath);
     return foldRedundantPathSegments(anchorSpelling(pathFamilyOf({ root: cwd }), cwd, filePath));
 }
+const LSP_PATH_TARGET = pathTargetOf("LSP");
+export function lspBaseOf(readFace, env) {
+    return pathTargetBaseOf(LSP_PATH_TARGET, readFace !== undefined ? { root: readFace.rootCanonical, cwd: readFace.cwdRef?.current } : { cwd: env?.cwd });
+}
+function judgeLspRead(env, face, spelling, signal, admitted) {
+    return resolveKey(env, face.rootCanonical, spelling, signal, lspBaseOf(face), face.roots, admitted, face.readDeny, face.face);
+}
+const LSP_UNBINDABLE = "this environment cannot bind a read to the file that was checked";
+export function lspReadGateOf(env, face, authorizedKey) {
+    const exempt = authorizedKey === undefined ? undefined : (key) => key === authorizedKey;
+    const keyOf = async (filePath, signal) => {
+        const r = await judgeLspRead(env, face, filePath, signal, exempt).catch(() => undefined);
+        return r?.ok === true ? r.key : undefined;
+    };
+    return async (filePath, signal) => {
+        await face.ready?.(undefined, signal);
+        const key = await keyOf(filePath, signal);
+        if (key === undefined)
+            return { ok: false, reason: "the read boundary refuses this file" };
+        if (env.openBound === undefined)
+            return { ok: false, reason: LSP_UNBINDABLE };
+        let held;
+        try {
+            held = await env.openBound(key, signal);
+        }
+        catch (e) {
+            return { ok: false, reason: thrownText(e) };
+        }
+        if (!held.ok)
+            return { ok: false, reason: held.error.message };
+        if ((await keyOf(filePath, signal)) !== key) {
+            await held.value.close();
+            return { ok: false, reason: "it resolved to a different file while it was being checked" };
+        }
+        return { ok: true, key, object: held.value };
+    };
+}
+export async function lspListedWithheld(env, face, uris, signal) {
+    const out = new Map();
+    if (face.readDeny === undefined || uris.length === 0)
+        return out;
+    await face.ready?.(undefined, signal);
+    const distinct = [...new Set(uris)];
+    const unreadable = { unreadable: true };
+    const judgeOne = async (uri) => {
+        const r = await resolveKey(env, face.rootCanonical, uriToPath(uri), signal, undefined, face.roots, undefined, face.readDeny, "open");
+        if (r.ok)
+            return undefined;
+        return r.violation.code === "read_path_denied" && r.violation.pattern !== undefined ? { pattern: r.violation.pattern } : unreadable;
+    };
+    const batch = Promise.all(distinct.map(async (uri) => [uri, await judgeOne(uri).catch(() => unreadable)]));
+    const judged = await withGateTimeout(batch, DEFAULT_GATE_AWAIT_TIMEOUT_MS, signal, "lspListedPaths").catch(() => undefined);
+    for (const [uri, withholding] of judged ?? distinct.map((uri) => [uri, unreadable]))
+        if (withholding !== undefined)
+            out.set(uri, withholding);
+    return out;
+}
 export const MAX_LSP_FILE_BYTES = 10 * 1000 * 1000;
 function fmt(result, ctx) {
     switch (result.kind) {
@@ -139,10 +201,67 @@ async function filterIgnored(result, isIgnored) {
     }
     return result;
 }
+async function withholdDenied(result, withheldOf) {
+    if (result.kind !== "locations" && result.kind !== "symbols")
+        return { result, note: "" };
+    const entries = result.kind === "locations" ? result.locations : result.symbols;
+    const withheld = await withheldOf(entries.map((e) => e.uri));
+    const patterns = [];
+    let denied = 0;
+    let unreadable = 0;
+    const keeps = (uri) => {
+        const w = withheld.get(uri);
+        if (w === undefined)
+            return true;
+        if ("pattern" in w) {
+            denied += 1;
+            if (!patterns.includes(w.pattern))
+                patterns.push(w.pattern);
+        }
+        else
+            unreadable += 1;
+        return false;
+    };
+    const kept = result.kind === "locations" ? { kind: "locations", locations: result.locations.filter((l) => keeps(l.uri)) } : { kind: "symbols", symbols: result.symbols.filter((s) => keeps(s.uri)) };
+    const n = (k) => `${k} result${k === 1 ? "" : "s"}`;
+    const note = (denied > 0 ? `\n[note: ${n(denied)} in files matching ${sensitivePathDenyList(patterns)} ${denied === 1 ? "was" : "were"} withheld]` : "") +
+        (unreadable > 0 ? `\n[note: ${n(unreadable)} withheld: the file${unreadable === 1 ? "" : "s"} could not be resolved to be judged against the read deny list]` : "");
+    return { result: kept, note };
+}
+const factsOfFileError = (code) => (code === "not_found" ? "missing" : code === "invalid" ? "not_a_file" : undefined);
+async function heldTargetFacts(env, key, signal) {
+    if (env.openBound === undefined)
+        return undefined;
+    const held = await env.openBound(key, signal).catch(() => undefined);
+    if (held === undefined)
+        return undefined;
+    if (!held.ok)
+        return factsOfFileError(held.error.code);
+    try {
+        if (held.value.kind === "directory")
+            return "not_a_file";
+        const size = await held.value.size();
+        return size.ok ? { size: size.value } : undefined;
+    }
+    finally {
+        await held.value.close();
+    }
+}
+async function namedTargetFacts(env, target, signal) {
+    const info = await env.fileInfo(target, signal);
+    if (!info.ok)
+        return factsOfFileError(info.error.code);
+    if (info.value.kind === "directory")
+        return "not_a_file";
+    return info.value.kind === "file" ? { size: info.value.size } : undefined;
+}
 const POSITION_OPS = new Set([
     "goToDefinition", "findReferences", "hover", "goToImplementation", "prepareCallHierarchy", "incomingCalls", "outgoingCalls",
 ]);
 export function createLspTool(manager, opts = {}) {
+    const faceSeat = opts.readFace;
+    if (faceSeat !== undefined && opts.env === undefined)
+        throw new TypeError("createLspTool: LspToolOptions.readFace needs the env it reads through (LspToolOptions.env)");
     return defineTool({
         name: "LSP",
         ...toolFace("lsp"),
@@ -173,6 +292,8 @@ export function createLspTool(manager, opts = {}) {
             query: Type.Optional(Type.String({ description: "Symbol query for workspaceSymbol (may be empty to browse broadly)." })),
         }),
         execute: async (args, ctx) => {
+            await faceSeat?.ready?.(ctx.toolCallId, ctx.signal);
+            const readFace = faceSeat === undefined ? undefined : { ...faceSeat, readDeny: seatForCall(faceSeat.readDeny, ctx.toolCallId), roots: seatForCall(faceSeat.roots, ctx.toolCallId), ready: undefined };
             const { operation, filePath, line, character, query } = args;
             if (POSITION_OPS.has(operation) && (line === undefined || character === undefined)) {
                 return errorResult(`Error (LSP): the "${operation}" operation needs both line and character.`);
@@ -184,18 +305,24 @@ export function createLspTool(manager, opts = {}) {
             if (operation === "workspaceSymbol" && wsQuery === undefined) {
                 return errorResult(`Error (LSP): the "workspaceSymbol" operation needs a query.`);
             }
-            const target = resolveLspPath(filePath, opts.env?.cwd);
-            if (opts.env) {
-                const info = await opts.env.fileInfo(target, ctx.signal);
-                if (!info.ok && info.error.code === "not_found")
-                    return errorResult(`Error (LSP): File does not exist: ${filePath}`);
-                if (!info.ok && info.error.code === "invalid")
-                    return errorResult(`Error (LSP): Path is not a file: ${filePath}`);
-                if (info.ok && info.value.kind === "directory")
-                    return errorResult(`Error (LSP): Path is not a file: ${filePath}`);
-                if (info.ok && info.value.kind === "file" && info.value.size > MAX_LSP_FILE_BYTES) {
-                    return `File too large for LSP analysis (${Math.ceil(info.value.size / 1e6)}MB exceeds 10MB limit)`;
-                }
+            const target = resolveLspPath(filePath, lspBaseOf(readFace, opts.env));
+            let gate;
+            let judgedKey;
+            if (readFace !== undefined && opts.env !== undefined) {
+                const admitted = readFace.admitted;
+                const r = await judgeLspRead(opts.env, readFace, filePath, ctx.signal, admitted && ((key) => admitted(ctx.toolCallId, key)));
+                if (!r.ok)
+                    return errorResult(violationText("LSP", r.violation), violationDetails(r.violation));
+                judgedKey = r.key;
+                gate = lspReadGateOf(opts.env, readFace, r.key);
+            }
+            const facts = opts.env === undefined ? undefined : judgedKey !== undefined ? await heldTargetFacts(opts.env, judgedKey, ctx.signal) : await namedTargetFacts(opts.env, target, ctx.signal);
+            if (facts === "missing")
+                return errorResult(`Error (LSP): File does not exist: ${filePath}`);
+            if (facts === "not_a_file")
+                return errorResult(`Error (LSP): Path is not a file: ${filePath}`);
+            if (facts !== undefined && facts.size > MAX_LSP_FILE_BYTES) {
+                return `File too large for LSP analysis (${Math.ceil(facts.size / 1e6)}MB exceeds 10MB limit)`;
             }
             const session = await manager.sessionFor(target, ctx.signal, opts.env);
             if (!session) {
@@ -203,9 +330,12 @@ export function createLspTool(manager, opts = {}) {
                 return `LSP is unavailable for "${filePath}" (${why}). Fall back to Grep/Read for this lookup.`;
             }
             const seamCharacter = character !== undefined ? character - 1 : undefined;
-            const result = await session.request(operation, { filePath: target, line, character: seamCharacter, symbol: wsQuery }, ctx.signal);
-            const final = toModelBase(await filterIgnored(result, opts.isPathIgnored));
-            const text = fmt(final, { operation, filePath });
+            const result = await session.request(operation, { filePath: target, line, character: seamCharacter, symbol: wsQuery }, ctx.signal, gate);
+            const ignored = await filterIgnored(result, opts.isPathIgnored);
+            const env = opts.env;
+            const kept = readFace !== undefined && env !== undefined ? await withholdDenied(ignored, (uris) => lspListedWithheld(env, readFace, uris, ctx.signal)) : { result: ignored, note: "" };
+            const final = toModelBase(kept.result);
+            const text = fmt(final, { operation, filePath }) + kept.note;
             return final.kind === "none" && final.reason !== undefined && LSP_ERROR_REASONS.has(final.reason) ? errorResult(text) : text;
         },
     });

package/dist/core/mcp.js

@@ -19,6 +19,7 @@ import { sliceHeadSafe, sliceTailSafe } from "./surrogate-safe-slice.js";
 import { truncateError } from "./tool-errors.js";
 import { delimitUntrusted, inlineUntrusted, sanitizeUntrustedText } from "./untrusted-text.js";
 import { discloseReminderShaped, observeReminderMarkEcho } from "./reminder-disclosure.js";
+import { MARKED_BLOCK_AFTER_DATA } from "./reminder-mint.js";
 import { resolveMcpDeclaredResultSize, resolveMcpRequiresUserInteraction } from "./mcp-tool-meta.js";
 export { resolveMcpDeclaredResultSize } from "./mcp-tool-meta.js";
 import { withContentOrigin } from "./memory-engine/content-origin.js";
@@ -1797,7 +1798,7 @@ function intakeListedTools(listed, spec, client, health, imageResizer, reminderD
                     if (d.defused)
                         textIdx.forEach((ci, si) => (content[ci] = { type: "text", text: d.segments[si] }));
                     if (d.trailer !== undefined)
-                        content.push({ type: "text", text: d.trailer });
+                        content.push({ type: "text", text: `${MARKED_BLOCK_AFTER_DATA}${d.trailer}` });
                 }
                 if (sc !== undefined)
                     return { content, details: { type: "mcp", structuredContent: sc }, terminate: false };

package/dist/core/media-byte-cap.d.ts

@@ -1,4 +1,5 @@
 import type { AgentMessage } from "../internal/harness-types.js";
+import type { DocumentContent, ImageContent } from "../internal/llm.js";
 /**
  * Aggregate MEDIA (image) byte budget — the multimodal sibling of {@link AGGREGATE_TOOL_RESULT_BUDGET_CHARS}
  * (which only counts TEXT, design/64 §17.2). batch-C added image reads (`Read` → `ImageContent`); each is bounded
@@ -14,6 +15,19 @@ import type { AgentMessage } from "../internal/harness-types.js";
 /** Default aggregate inline-media budget (bytes). Generous — only the pathological "N parallel huge image reads"
  *  case strips. Bounds the request while leaving normal multimodal use untouched. Overridable per-deployment. */
 export declare const AGGREGATE_MEDIA_BUDGET_BYTES: number;
+/** The one reading of a deployment's media budget (`RunnerDeps.mediaByteCapBytes`, screened by {@link checkedMediaByteCap}
+ *  at `new Runner`), for both of its readers — the request strip below and the `tool_end.output` projection: absent ⇒
+ *  {@link AGGREGATE_MEDIA_BUDGET_BYTES}; a finite positive number ⇒ itself; `0` or `Infinity` ⇒ no budget, `Infinity`
+ *  (a direct caller of {@link capAggregateMediaBytes} that passes a negative or `NaN` meets the same no-op). */
+export declare function mediaBudgetBytes(cap: number | undefined): number;
+/** The deployment's media budget, screened once at `new Runner`: absent, a non-negative number of bytes, or `Infinity`
+ *  (`0` and `Infinity` both mean "no budget"). A non-number, `NaN` or a negative is refused (`config.invalid_argument`),
+ *  never read as "no budget". */
+export declare function checkedMediaByteCap(value: unknown, seat: string): void;
+/** Decoded byte size of a base64 media payload (4 base64 chars ≈ 3 bytes). Approximate — fine for a budget.
+ *  PDF read: `document` blocks (base64 PDFs) count against the SAME aggregate budget — same class of inline
+ *  media bytes, same unbounded-accumulation failure mode. */
+export declare function imageBytes(b: ImageContent | DocumentContent): number;
 /** Telemetry for one strip pass (mirrors CC's `tengu_media_byte_cap_stripped` fields). */
 export interface MediaStripInfo {
     totalBytes: number;

package/dist/core/media-byte-cap.js

@@ -1,6 +1,18 @@
+import { describeRejectedValue } from "./tool-search-setting.js";
 export const AGGREGATE_MEDIA_BUDGET_BYTES = 30 * 1024 * 1024;
+export function mediaBudgetBytes(cap) {
+    const limit = cap ?? AGGREGATE_MEDIA_BUDGET_BYTES;
+    return Number.isFinite(limit) && limit > 0 ? limit : Infinity;
+}
+export function checkedMediaByteCap(value, seat) {
+    if (value === undefined || (typeof value === "number" && value >= 0))
+        return;
+    const e = new Error(`${seat} ${describeRejectedValue(value)} is not a media byte budget — expected a non-negative number of bytes (0 or Infinity: no budget), or omit it for the default ${AGGREGATE_MEDIA_BUDGET_BYTES}`);
+    e.code = "config.invalid_argument";
+    throw e;
+}
 const MEDIA_STRIPPED_MARKER = "[media removed to fit the request media budget — re-read the file if you still need to see it]";
-function imageBytes(b) {
+export function imageBytes(b) {
     return typeof b.data === "string" ? Math.floor((b.data.length * 3) / 4) : 0;
 }
 function blocksOf(m) {
@@ -8,8 +20,8 @@ function blocksOf(m) {
     return Array.isArray(content) ? content : undefined;
 }
 export function capAggregateMediaBytes(messages, opts) {
-    const { limitBytes } = opts;
-    if (!Number.isFinite(limitBytes) || limitBytes <= 0)
+    const limitBytes = mediaBudgetBytes(opts.limitBytes);
+    if (limitBytes === Infinity)
         return messages;
     let total = 0;
     for (const m of messages) {

package/dist/core/memory-engine/consolidation-driver.d.ts

@@ -21,8 +21,9 @@
  *    auto lane's task-boundary tick), never on a background schedule of core's own.
  */
 import type { EngineNotice } from "../types.js";
-import { type ConsolidationGateRow, type ConsolidationRunStopReason, type MemoryConsolidationOptions } from "./consolidation.js";
+import { type ConsolidationGateRow, CONSOLIDATION_WRITE_REFUSED_CODE, type ConsolidationRunStopReason, type MemoryConsolidationOptions } from "./consolidation.js";
 import { type ConsolidationPlanFoldEvidence, type ConsolidationPlanSummary } from "./engine.js";
+import type { SyntheticWriteVerdict } from "../synthetic-read-verdict.js";
 import { mintLlmConsolidationPlan, type ConsolidationDriveCycleRow, type ConsolidationDriveEngine, type ConsolidationFoldState, type DistillerChatFn, type LlmConsolidationPlan, type LlmConsolidationPlanProduct, type LlmDistillerContract } from "./distiller.js";
 export declare const CONSOLIDATION_DRIVER_RUNS_FILE = "distiller-runs.json";
 /** §1.6-4 — the mint archive: what was shown to the model and what it answered, verbatim, per run
@@ -142,14 +143,35 @@ export interface ConsolidationDriverEngine extends ConsolidationDriveEngine {
     listConsolidationPlans(): ConsolidationPlanSummary[];
     readConsolidationPlanFoldEvidence(planId: string): ConsolidationPlanFoldEvidence;
     readConsolidationFoldState(scope: string): Promise<ConsolidationFoldState>;
+    /** The canonical directory a commit lands the scope's products in (the write judge's early question). */
+    consolidationWriteHome(scope: string): string;
     readonly controlPlaneRoot: string;
 }
+/** One write the judge is asked about: `path` is a file (or the library directory) of `scope`'s library, absolute and canonical. */
+export interface ConsolidationWriteTarget {
+    scope: string;
+    path: string;
+}
+/** The write judge's seat: one target in, the synthetic-write judge's verdict out (only `no_objection` permits the write). */
+export type ConsolidationWriteJudge = (target: ConsolidationWriteTarget) => Promise<SyntheticWriteVerdict> | SyntheticWriteVerdict;
+export { CONSOLIDATION_WRITE_REFUSED_CODE };
 export interface RunMemoryConsolidationOptions {
     /** The explicit model seat (design/339 §1.1: the ENGINE holds none). Build one with
      *  `openAiCompatChatSeat` or hand any JSON-only completion function. */
     chat: DistillerChatFn;
     /** The explicit model id, recorded into the run and the archive (alias spellings refuse). */
     model: string;
+    /** The write judge — REQUIRED. A run writes the library with nobody watching, so it asks the judgment a foreground write
+     *  into the same library meets: the person's standing path rules and the deployment's policy, read through the ONE judge
+     *  (`createSyntheticWriteJudge`; the Runner's auto lane passes the leg's own). It is asked in two places over the run, with the same
+     *  seat and the same refusal: once for the library directory before any claim, seat or model call (an early refusal that
+     *  spends nothing), and — the authority — where a plan is applied (a commit, a replay of a suspended plan, the drive's
+     *  recovery), at the backend's final spelling of every product before any is written: a refusal there writes nothing and
+     *  discards the plan.
+     *  Anything but `no_objection` — a deny, an ask (nobody is present to answer it), an unreadable rule source, a
+     *  throw — refuses the run with `memory.consolidation_write_refused`, and nothing is written. A host that holds no rules
+     *  says so by passing a judge that answers `no_objection`; an absent seat refuses, it never reads as "no rules". */
+    writeJudge: ConsolidationWriteJudge;
     /** Audit locator recorded into the archive when the seat is endpoint-shaped. */
     baseUrl?: string;
     /** The frozen prompt contract; default = the product v1 (dl-3 byte-identical). A different

package/dist/core/memory-engine/consolidation-driver.js

@@ -3,7 +3,7 @@ import { uuidv7 } from "../../internal/harness.js";
 import { atomicWriteFileSync, ensureDirExists, lockedStrictUpdate, readStrictSidecar, enqueueMemoryAnnouncement, ControlPlaneCorruptError } from "./layout.js";
 import { inlineUntrusted } from "../untrusted-text.js";
 import { deliverEngineNotice } from "../engine-notice.js";
-import { CONSOLIDATION_FORCE_THROTTLE_FLOOR_MS, screenConsolidationOptions, supersessionFuseCeiling, updateConsolidationGate, recommendationUnconsumed, } from "./consolidation.js";
+import { CONSOLIDATION_FORCE_THROTTLE_FLOOR_MS, screenConsolidationOptions, supersessionFuseCeiling, updateConsolidationGate, recommendationUnconsumed, CONSOLIDATION_WRITE_REFUSED_CODE, ConsolidationRefusedError, } from "./consolidation.js";
 import { memoryConsolidationIncompleteNotice, memoryConsolidationWithheldNotice } from "./engine.js";
 import { asThrownError, thrownText } from "../thrown-value.js";
 import { CONSOLIDATION_DRIVE_ABORT, CONSOLIDATION_SNAPSHOT_PARKED, MEMORY_DISTILLER_CONTRACT_V1, detectCleanArmVerbatimLeak, driveConsolidationToFixpoint, isAliasModelId, llmPlanDistiller, mintExposurePartitionedPlan, mintLlmConsolidationPlan, normalizedCandidateRev, } from "./distiller.js";
@@ -61,6 +61,7 @@ export function archiveDistillerPlan(controlDir, runId, plan, attempt = 1) {
     atomicWriteFileSync(join(controlDir, CONSOLIDATION_DRIVER_PLANS_DIR, name), `${JSON.stringify(plan, null, 2)}\n`);
     return name;
 }
+export { CONSOLIDATION_WRITE_REFUSED_CODE };
 function driverConfigRefusal(message) {
     const e = new Error(message);
     e.code = "config.memory_consolidation_driver";
@@ -93,6 +94,33 @@ const codeOf = (err) => {
     const c = err?.code;
     return typeof c === "string" ? c : undefined;
 };
+async function refuseUnlessWriteAllowed(judge, target, consequence) {
+    let verdict;
+    let threw;
+    try {
+        verdict = await judge(target);
+    }
+    catch (err) {
+        threw = thrownText(err);
+    }
+    const answer = typeof verdict === "object" && verdict !== null ? verdict : undefined;
+    if (threw === undefined && answer?.verdict === "no_objection")
+        return;
+    const text = (v) => (typeof v === "string" && v !== "" ? inlineUntrusted(v, 200) : undefined);
+    const where = text(answer?.layer);
+    let why;
+    if (threw !== undefined)
+        why = `the write judge threw (${inlineUntrusted(threw, 200)}), so whether a standing rule forbids this write is unknown`;
+    else if (answer?.verdict === "deny")
+        why = `a standing rule layer${where !== undefined ? ` (${where})` : ""} refuses writes into this library${text(answer.message) !== undefined ? `: ${text(answer.message)}` : ""}`;
+    else if (answer?.verdict === "ask")
+        why = `a standing rule layer${where !== undefined ? ` (${where})` : ""} would ask a person before a write into this library, and a background run has nobody to answer${text(answer.message) !== undefined ? `: ${text(answer.message)}` : ""}`;
+    else if (answer?.verdict === "unanswerable")
+        why = `the write judge could not answer${where !== undefined ? ` at ${where}` : ""}${text(answer.cause) !== undefined ? ` (${text(answer.cause)})` : ""}${text(answer.reason) !== undefined ? `: ${text(answer.reason)}` : ""}, so whether a standing rule forbids this write is unknown`;
+    else
+        why = "the write judge answered something outside its closed set of verdicts";
+    throw new ConsolidationRefusedError(CONSOLIDATION_WRITE_REFUSED_CODE, `memory consolidation refused for scope ${inlineUntrusted(target.scope, 80)} (${inlineUntrusted(target.path, 200)}): ${why}${consequence !== undefined ? ` — ${consequence}` : ""}`);
+}
 const MAX_THROTTLE_WAITS_PER_SNAPSHOT = 4;
 const MAX_BUSY_WAITS = 2;
 export async function runMemoryConsolidationDriver(engine, scope, opts) {
@@ -127,7 +155,24 @@ export async function runMemoryConsolidationDriver(engine, scope, opts) {
     };
     const throttleWindowMs = Math.min(screened.minRunIntervalMs, CONSOLIDATION_FORCE_THROTTLE_FLOOR_MS);
     const controlDir = engine.controlPlaneRoot;
-    const parkedSeat = await recoverSeat(engine, scope, { sleep, windowMs: throttleWindowMs });
+    if (typeof opts.writeJudge !== "function")
+        throw driverConfigRefusal(`runMemoryConsolidationDriver needs an explicit write judge (opts.writeJudge), got ${typeof opts.writeJudge} — a run writes the library with nobody watching, so it asks the judgment a foreground write meets before it starts; an absent seat is refused, never read as "no rules apply" (a host that holds no rules passes a judge that answers no_objection).`);
+    let libraryHome;
+    try {
+        libraryHome = engine.consolidationWriteHome(scope);
+    }
+    catch (err) {
+        throw new ConsolidationRefusedError(CONSOLIDATION_WRITE_REFUSED_CODE, `memory consolidation refused for scope ${inlineUntrusted(scope, 80)}: where this run would write could not be derived (${inlineUntrusted(thrownText(err), 200)}), so whether a standing rule forbids it is unknown — no run was started and nothing was written.`);
+    }
+    await refuseUnlessWriteAllowed(opts.writeJudge, { scope, path: libraryHome }, "no run was started and nothing was written.");
+    const writeGate = (target) => refuseUnlessWriteAllowed(opts.writeJudge, target);
+    let refusedSeat = undefined;
+    const parkedSeat = await recoverSeat(engine, scope, { sleep, windowMs: throttleWindowMs, writeGate }).catch((err) => {
+        if (!(err instanceof ConsolidationRefusedError) || err.code !== CONSOLIDATION_WRITE_REFUSED_CODE)
+            throw err;
+        refusedSeat = err;
+        return undefined;
+    });
     const openFold = await engine.readConsolidationFoldState(scope);
     const { row: run, resumed } = claimDriverRun(controlDir, scope, () => ({
         runId: uuidv7(),
@@ -258,6 +303,8 @@ export async function runMemoryConsolidationDriver(engine, scope, opts) {
     if (parkedSeat !== undefined) {
         return settle("parked", undefined, parkedSeat);
     }
+    if (refusedSeat !== undefined)
+        return settle("refused", undefined, `reconcileConsolidation refused the plan an earlier run left seated: ${refusedSeat.code}: ${refusedSeat.message}`);
     let staleResidue = [];
     let staleResidueMemberIds = new Set();
     const distill = async (candidates, snapshot, s) => {
@@ -425,7 +472,7 @@ export async function runMemoryConsolidationDriver(engine, scope, opts) {
                     if (busyWaits >= MAX_BUSY_WAITS)
                         throw err;
                     busyWaits += 1;
-                    const parked = await recoverSeat(engine, scope, { sleep, windowMs: throttleWindowMs });
+                    const parked = await recoverSeat(engine, scope, { sleep, windowMs: throttleWindowMs, writeGate });
                     if (parked !== undefined) {
                         const e = new Error(parked);
                         e[CONSOLIDATION_SNAPSHOT_PARKED] = true;
@@ -448,6 +495,7 @@ export async function runMemoryConsolidationDriver(engine, scope, opts) {
             requestIdPrefix: run.requestId,
             maxCycles: opts.maxCycles ?? 64,
             takeSnapshot,
+            writeGate,
             onCycle: (row) => {
                 cyclesSeen.push(row);
                 if (row.committed.products > 0 || row.committed.superseded > 0)
@@ -564,8 +612,8 @@ function collectRunFoldEvidence(engine, scope, requestId) {
     }
     return { targets, skipped };
 }
-async function recoverSeat(engine, scope, { sleep, windowMs }) {
-    await engine.reconcileConsolidation(scope);
+async function recoverSeat(engine, scope, { sleep, windowMs, writeGate }) {
+    await engine.reconcileConsolidation(scope, { writeGate });
     let seat = engine.readConsolidationGate(scope)?.openPlanId;
     if (seat === undefined)
         return undefined;
@@ -574,7 +622,7 @@ async function recoverSeat(engine, scope, { sleep, windowMs }) {
         return `plan ${seat} holds the ${JSON.stringify(scope)} seat in a ${summary.corrupt === true ? "corrupt" : "conflict"} state — resolveConsolidationPlan(planId, "retry" | "discard") is the host valve; the run parks rather than stacking a second plan on the seat`;
     }
     await sleep(windowMs);
-    await engine.reconcileConsolidation(scope);
+    await engine.reconcileConsolidation(scope, { writeGate });
     seat = engine.readConsolidationGate(scope)?.openPlanId;
     if (seat === undefined)
         return undefined;

package/dist/core/memory-engine/consolidation-write-gate.d.ts

@@ -0,0 +1,46 @@
+/**
+ * The write gate, asked at the apply for every entry file a plan writes or removes: the backend's FINAL spelling of each (as its
+ * `admit`), or the one the apply knows for a backend that cannot admit. Kept beside the engine rather than in it; everything about
+ * how a refusal is shaped lives here — including what it says was written, which only the apply knows ({@link refusalNamingWritten}).
+ */
+import { ConsolidationRefusedError, type ConsolidationDirectedPatch, type ConsolidationWriteGate } from "./consolidation.js";
+import type { AdmitLandings, PatchLanding } from "./landing-admission.js";
+import type { MemoryBackend, MemoryEntry } from "./types.js";
+/** The refusal of a verb that may apply a plan and was handed no write gate — thrown before the verb claims or changes anything. */
+export declare const CONSOLIDATION_WRITE_GATE_REQUIRED_CODE = "config.memory_consolidation_write_gate";
+/** A verb that may apply a plan carries the write gate; absent, it refuses before it claims or changes anything (a host that holds
+ *  no rules passes a gate that resolves, and so says it). */
+export declare function requireWriteGate(gate: unknown, verb: string): asserts gate is ConsolidationWriteGate;
+/**
+ * Where a plan's pending directed patches write or remove files, as the store holds the entries now: an update's target and, when
+ * it moves the entry, the file it leaves; the file a delete removes. An id the store no longer holds is no write of a delete.
+ */
+export declare function directedLandings(directed: readonly ConsolidationDirectedPatch[], getByIds: (ids: readonly string[]) => Promise<MemoryEntry[]>): Promise<PatchLanding[]>;
+/** What of a plan the store already holds: products it carries (the ids are the plan's own, minted at the freeze, so the store
+ *  holding one means the plan wrote it) and directed patches whose planned state stands. */
+export interface PlanWritten {
+    readonly products: readonly PatchLanding[];
+    readonly directed: readonly string[];
+}
+/**
+ * {@link PlanWritten} for `plan`, read through `committed` once `backend` has replayed every commit it holds (a locked entry that
+ * writes nothing runs its recovery first) — what an earlier pass, which a crash or a failure cut short before its book was written,
+ * or this pass before a refusal, put in the store. Undefined when the store could not be read (a refusal then says so).
+ */
+export declare function planWritten(plan: {
+    readonly products: readonly {
+        readonly id: string;
+    }[];
+    readonly directed: readonly ConsolidationDirectedPatch[];
+}, backend: Pick<MemoryBackend, "applyPatches">, committed: Pick<MemoryBackend, "getByIds">): Promise<PlanWritten | undefined>;
+/**
+ * The write gate's refusal at the apply, completed with what the plan has written: the gate knows why it refused; the apply knows
+ * that nothing further is written and what the store already holds of the plan (`written`; undefined = could not be read).
+ */
+export declare function refusalNamingWritten(err: ConsolidationRefusedError, written: PlanWritten | undefined): ConsolidationRefusedError;
+/**
+ * The write gate as one apply's `admit`: every landing (`<slug>.md` in its scope's library directory) is put to the gate, all of
+ * them before any is written; the first refusal rejects with the gate's own error. A landing admitted once in the apply is not
+ * asked again (the apply asks its directed targets up front, and the backend names them again when it plans their batch).
+ */
+export declare function admitLandingsThrough(gate: ConsolidationWriteGate, homeOf: (scope: string) => string): AdmitLandings;