@sema-agent/core 7.5.0 → 7.5.2

package/dist/core/runner/prepare-workspace-restore.d.ts

@@ -1,60 +1,7 @@
-import type { RemoteExecutionEnv, RemoteExecutionError, SnapshotId, VmLifecycleOptions } from "../remote-env.js";
 import type { ExecutionEnv } from "../../internal/harness.js";
-import type { RemoteEnvFailureNote, RunnerDeps, TaskSpec } from "../types.js";
-import type { PrepareResume, RunInternals } from "./prepare-task.js";
-/**
- * rebase one checkpointed absolute path from the OLD workspace root onto the RESTORED
- * one (divergent `resumeVM`). POSIX-ONLY by contract: every remote lane's `mountPath` is a container
- * path (e2b/k8s/ssh/adb/local-docker are all Linux targets), so a backslash ANYWHERE in the inputs marks
- * the value outside this function's domain and it returns `p` UNCHANGED — an un-rebased path is honestly
- * observable (the divergence observation already fired) while a WRONGLY-rebased one silently corrupts
- * cwd/read-state (r4: drive-root and cross-family recomposition are not implementable without a Windows
- * path model no lane needs). Trailing slashes are tolerated (from="/app/" must not weld the suffix);
- * bare "/" keeps filesystem-root semantics; a path outside `from` (incl. the prefix-sibling
- * "/application" vs "/app") returns unchanged. Exported for direct unit pinning.
- */
-export declare function rebaseWorkspacePath(p: string, fromRaw: string, toRaw: string): string;
-/**
- * RB-439-a — project one failed remote lifecycle call onto the caller-facing note. ONE builder for all
- * three ops so the `retryable` classification can never drift between the lane that reports a `suspendVM`
- * refusal and the lane that reports a failed restore.
- */
-export declare function remoteEnvFailureNote(op: RemoteEnvFailureNote["op"], error: RemoteExecutionError, attempts: number): RemoteEnvFailureNote;
-/**
- * RB-439-a — `resumeVM` with a bounded retry on the TRANSIENT codes, plus the attempt count for the
- * caller-facing note.
- *
- * Why this op and no other: `resumeVM` is the one lifecycle call the seam documents as "idempotent +
- * re-entrant" (a replica that crashed mid-suspend can be superseded by another resuming the SAME
- * snapshot), which is exactly `withRetry`'s red line — retry idempotent establishment, never a
- * side-effecting op. `suspendVM` TAKES a snapshot and `postResumeInit` re-injects secrets under an
- * ordering red line; neither is retried here, they are disclosed with `retryable` instead so the caller
- * decides. A code outside the retryable family (`unsupported`, `auth_failed`) returns on the first
- * attempt — `withRetry` will not spend a second call on a permanent refusal.
- */
-export declare function restoreWorkspaceWithRetry(env: RemoteExecutionEnv, snapshotId: SnapshotId, options: VmLifecycleOptions, 
-/** design/384 slice 2 (additive): observe each attempt AS IT STARTS. The returned `attempts` is
- *  only readable after settlement, and a caller whose wait on this promise is BOUNDED (the park
- *  compensation) must report the live attempt count when its bound fires mid-call — without this
- *  seat a deaf second attempt was reported as `attempts: 1`. */
-onAttempt?: (attempt: number) => void): Promise<{
-    outcome: Awaited<ReturnType<RemoteExecutionEnv["resumeVM"]>>;
-    attempts: number;
-}>;
-/**
- * RB-439-c — {@link rebaseWorkspacePath} over a SET of accepted spellings of the old root: the first
- * prefix that actually matches wins, and a path under none of them is returned unchanged.
- *
- * The set exists because "the old root" has no single spelling. `WorkspaceHandle.mountPath` is whatever the
- * adapter called the mount, while the persisted paths being migrated were spelled by whoever produced them
- * (a `cd` the env canonicalized, a Read key resolved through realpath). On a target where the root has an
- * equivalent alias (`/var` ↔ `/private/var`) those disagree while naming the same directory, and a
- * single-prefix rebase then matched nothing and silently left the resumed shell in the pre-suspend tree —
- * under a disclosure that said the task follows the restored root. Order is caller-chosen (the checkpointed
- * spelling first, its canonical form second) and only matters if one prefix is a prefix of another, in
- * which case the earlier — more specific — spelling is the intended one. Exported for direct unit pinning.
- */
-export declare function rebaseWorkspacePathAcross(p: string, froms: readonly string[], to: string): string;
+import type { RunnerDeps, TaskSpec } from "../types.js";
+import type { PrepareResume, RunInternals } from "./contracts.js";
+export { remoteEnvFailureNote, restoreWorkspaceWithRetry } from "./remote-env-retry.js";
 export interface PrepareWorkspaceRestoreInput {
     /** borrowed-readonly (the ownership-ref PROTOCOL stays with the driver — D-8 案①): the env this
      *  task owns, when the factory minted one. This phase reads and drives it (`resumeVM`,

package/dist/core/runner/prepare-workspace-restore.js

@@ -1,41 +1,7 @@
-import { isRemoteExecutionEnv, isRetryableRemoteErrorCode, missingRestoreSurface, RETRYABLE_REMOTE_ERROR_CODES } from "../remote-env.js";
-import { withRetry } from "../with-retry.js";
-export function rebaseWorkspacePath(p, fromRaw, toRaw) {
-    if (p.includes("\\") || fromRaw.includes("\\") || toRaw.includes("\\"))
-        return p;
-    const stripTrail = (s) => (s.length > 1 && s.endsWith("/") ? stripTrail(s.slice(0, -1)) : s);
-    const from = stripTrail(fromRaw);
-    const to = stripTrail(toRaw);
-    if (p === from || stripTrail(p) === from)
-        return to;
-    const fromPrefix = from === "/" ? from : `${from}/`;
-    if (!p.startsWith(fromPrefix))
-        return p;
-    const suffix = p.slice(fromPrefix.length).replace(/^\/+/, "");
-    return to === "/" ? `${to}${suffix}` : `${to}/${suffix}`;
-}
-export function remoteEnvFailureNote(op, error, attempts) {
-    return { op, code: error.code, retryable: isRetryableRemoteErrorCode(error.code), attempts, message: error.message };
-}
-const REMOTE_RESTORE_MAX_ATTEMPTS = 2;
-const REMOTE_RESTORE_BACKOFF_MS = 200;
-export async function restoreWorkspaceWithRetry(env, snapshotId, options, onAttempt) {
-    let attempts = 0;
-    const outcome = await withRetry(async (attempt) => {
-        attempts = attempt;
-        onAttempt?.(attempt);
-        return env.resumeVM(snapshotId, options);
-    }, { retryableCodes: RETRYABLE_REMOTE_ERROR_CODES, maxAttempts: REMOTE_RESTORE_MAX_ATTEMPTS, backoffMs: () => REMOTE_RESTORE_BACKOFF_MS }, { ...(options.abortSignal !== undefined ? { signal: options.abortSignal } : {}) });
-    return { outcome, attempts };
-}
-export function rebaseWorkspacePathAcross(p, froms, to) {
-    for (const from of froms) {
-        const out = rebaseWorkspacePath(p, from, to);
-        if (out !== p)
-            return out;
-    }
-    return p;
-}
+import { isRemoteExecutionEnv, missingRestoreSurface } from "../remote-env.js";
+import { remoteEnvFailureNote, restoreWorkspaceWithRetry } from "./remote-env-retry.js";
+import { rebaseWorkspacePathAcross } from "./workspace-path.js";
+export { remoteEnvFailureNote, restoreWorkspaceWithRetry } from "./remote-env-retry.js";
 export async function prepareWorkspaceRestore(input) {
     const { ownedEnv, deps, spec, internals, resume, abortController, sessionId } = input;
     let taskRootPath = input.taskRootInitial;

package/dist/core/runner/prompt-hash-salt.d.ts

@@ -0,0 +1 @@
+export declare const PROMPT_HASH_SALT: Buffer<ArrayBufferLike>;

package/dist/core/runner/prompt-hash-salt.js

@@ -0,0 +1,2 @@
+import { randomBytes } from "node:crypto";
+export const PROMPT_HASH_SALT = randomBytes(16);

package/dist/core/runner/remote-env-retry.d.ts

@@ -0,0 +1,29 @@
+import type { RemoteExecutionEnv, RemoteExecutionError, SnapshotId, VmLifecycleOptions } from "../remote-env.js";
+import type { RemoteEnvFailureNote } from "../types.js";
+/**
+ * RB-439-a — project one failed remote lifecycle call onto the caller-facing note. ONE builder for all
+ * three ops so the `retryable` classification can never drift between the lane that reports a `suspendVM`
+ * refusal and the lane that reports a failed restore.
+ */
+export declare function remoteEnvFailureNote(op: RemoteEnvFailureNote["op"], error: RemoteExecutionError, attempts: number): RemoteEnvFailureNote;
+/**
+ * RB-439-a — `resumeVM` with a bounded retry on the TRANSIENT codes, plus the attempt count for the
+ * caller-facing note.
+ *
+ * Why this op and no other: `resumeVM` is the one lifecycle call the seam documents as "idempotent +
+ * re-entrant" (a replica that crashed mid-suspend can be superseded by another resuming the SAME
+ * snapshot), which is exactly `withRetry`'s red line — retry idempotent establishment, never a
+ * side-effecting op. `suspendVM` TAKES a snapshot and `postResumeInit` re-injects secrets under an
+ * ordering red line; neither is retried here, they are disclosed with `retryable` instead so the caller
+ * decides. A code outside the retryable family (`unsupported`, `auth_failed`) returns on the first
+ * attempt — `withRetry` will not spend a second call on a permanent refusal.
+ */
+export declare function restoreWorkspaceWithRetry(env: RemoteExecutionEnv, snapshotId: SnapshotId, options: VmLifecycleOptions, 
+/** design/384 slice 2 (additive): observe each attempt AS IT STARTS. The returned `attempts` is
+ *  only readable after settlement, and a caller whose wait on this promise is BOUNDED (the park
+ *  compensation) must report the live attempt count when its bound fires mid-call — without this
+ *  seat a deaf second attempt was reported as `attempts: 1`. */
+onAttempt?: (attempt: number) => void): Promise<{
+    outcome: Awaited<ReturnType<RemoteExecutionEnv["resumeVM"]>>;
+    attempts: number;
+}>;

package/dist/core/runner/remote-env-retry.js

@@ -0,0 +1,16 @@
+import { isRetryableRemoteErrorCode, RETRYABLE_REMOTE_ERROR_CODES } from "../remote-env.js";
+import { withRetry } from "../with-retry.js";
+export function remoteEnvFailureNote(op, error, attempts) {
+    return { op, code: error.code, retryable: isRetryableRemoteErrorCode(error.code), attempts, message: error.message };
+}
+const REMOTE_RESTORE_MAX_ATTEMPTS = 2;
+const REMOTE_RESTORE_BACKOFF_MS = 200;
+export async function restoreWorkspaceWithRetry(env, snapshotId, options, onAttempt) {
+    let attempts = 0;
+    const outcome = await withRetry(async (attempt) => {
+        attempts = attempt;
+        onAttempt?.(attempt);
+        return env.resumeVM(snapshotId, options);
+    }, { retryableCodes: RETRYABLE_REMOTE_ERROR_CODES, maxAttempts: REMOTE_RESTORE_MAX_ATTEMPTS, backoffMs: () => REMOTE_RESTORE_BACKOFF_MS }, { ...(options.abortSignal !== undefined ? { signal: options.abortSignal } : {}) });
+    return { outcome, attempts };
+}

package/dist/core/runner/rollback-stack.d.ts

@@ -0,0 +1,32 @@
+/**
+ * The prepare-FAILURE rollback stack — the implementation of {@link RollbackStack} (declared beside the
+ * other prepare contracts in ./contracts.ts, whose JSDoc carries the contract this file keeps).
+ *
+ * Why a stack and not a `finally`: prepare acquires resources in sequence (an execution env, MCP
+ * clients, A2A peers) and every one of them belongs to the RUN once prepare succeeds — the Runner's
+ * finish/teardown releases them. Only a prepare that THROWS must release what it already took, in
+ * reverse acquisition order. Today the orchestrator sees those handles because they are hoisted
+ * `let`s at function scope; a phase module that acquires a handle inside its own body has no such
+ * hoist, so it registers the cleanup HERE, immediately after the acquisition, and the driver unwinds
+ * the whole stack from its one catch.
+ *
+ * Posture (identical to the teardown leg the catch already uses — {@link settleTeardownLeg}):
+ *   · reverse order, each cleanup exactly once — the entry is removed before it runs, so a second
+ *     `unwindAll` (or a re-entrant one) finds nothing;
+ *   · no cleanup can stop another — a throw is routed to `report`, a hang is BOUNDED and reported as a
+ *     `TeardownLegTimeoutError` naming the leg; the unwind proceeds either way;
+ *   · `unwindAll` NEVER throws — it runs inside the driver's catch, where a throw would replace the
+ *     prepare error the caller is owed.
+ *
+ * States: `armed` (accepting pushes) → `committed` (prepare succeeded; the stack is emptied and
+ * ownership has passed to `Prepared`) or → `unwinding`/`unwound` (the failure path ran). A `push`
+ * outside `armed` is a PROGRAMMING error and is refused loudly: a resource acquired after commit
+ * would have no owner on the failure path, and one pushed during an unwind would never run.
+ */
+import type { RollbackStack } from "./contracts.js";
+/**
+ * Mint one stack per prepare. `report` is the incident channel for a cleanup that throws or times out
+ * (wire it to `deps.onError`); with none, failures of the failure path are dropped — the same
+ * contract `settleTeardownLeg` states for its own `report`.
+ */
+export declare function createRollbackStack(report?: (err: Error) => void): RollbackStack;

package/dist/core/runner/rollback-stack.js

@@ -0,0 +1,30 @@
+import { settleTeardownLeg } from "./teardown-bounded.js";
+export function createRollbackStack(report) {
+    const cleanups = [];
+    let state = "armed";
+    return {
+        push(cleanup) {
+            if (state !== "armed") {
+                throw new Error(`RollbackStack.push after ${state}: a cleanup registered once prepare has ${state === "committed" ? "succeeded" : "started unwinding"} would ${state === "committed" ? "never be owned by the failure path" : "never run"} — acquire resources only while the stack is armed.`);
+            }
+            cleanups.push(cleanup);
+        },
+        commit() {
+            if (state !== "armed")
+                throw new Error(`RollbackStack.commit after ${state}: commit is the success path's one disarm and cannot follow an unwind or a second commit.`);
+            state = "committed";
+            cleanups.length = 0;
+        },
+        async unwindAll() {
+            if (state !== "armed")
+                return;
+            state = "unwinding";
+            const total = cleanups.length;
+            let leg = total;
+            for (let cleanup = cleanups.pop(); cleanup !== undefined; cleanup = cleanups.pop(), leg--) {
+                await settleTeardownLeg(cleanup, `${cleanup.name !== "" ? cleanup.name : "anonymous cleanup"} (rollback leg ${leg} of ${total}, prepare-throw)`, report);
+            }
+            state = "unwound";
+        },
+    };
+}

package/dist/core/runner/runtask.js

@@ -47,7 +47,7 @@ import { hasBackgroundShell, sweepBackgroundShells } from "../background-shell.j
 import { cloneObserverInput, formatHookFeedback, hookSeatExpiredError, MAX_HOOK_TIMEOUT_MS, mintHookInvocationIdentity, resolveHookTimeoutMs, runHookSeat } from "../hooks.js";
 import { buildHumanInputEvent, frameMidTurnUserInput, projectHumanInput } from "../human-input-projection.js";
 import { delimitUntrusted, inlineUntrusted, REVIEWER_NOTE_MAX_BODY, sanitizeUntrustedText, SHELLED_BODY_ENVELOPE_TAGS } from "../untrusted-text.js";
-import { droppedToolDigest, withAnnounceDigests } from "./prepare-announce-once.js";
+import { droppedToolDigest, withAnnounceDigests } from "./announce-once-ledger.js";
 import { appendInterruptionMarker, reconcileInterruptedSession } from "../session-reconcile.js";
 import { RunnerSharedToolResultStore } from "../tool-result-store.js";
 import { formatDiagnosticsBlock } from "../lsp-diagnostics.js";

package/dist/core/runner/workspace-path.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Pure path arithmetic for a workspace whose ROOT moved: rebase an absolute path from the old root
+ * onto the new one. No I/O, no state, no dependency on anything — which is why it lives here rather
+ * than inside the restore phase that used to own it. The read-face phase needs the same arithmetic,
+ * and a phase reaching sideways into a sibling phase for a helper is the shape the dependency
+ * gate exists to stop; the answer is to put the helper where both can reach DOWN to it.
+ */
+/**
+ * rebase one checkpointed absolute path from the OLD workspace root onto the RESTORED
+ * one (divergent `resumeVM`). POSIX-ONLY by contract: every remote lane's `mountPath` is a container
+ * path (e2b/k8s/ssh/adb/local-docker are all Linux targets), so a backslash ANYWHERE in the inputs marks
+ * the value outside this function's domain and it returns `p` UNCHANGED — an un-rebased path is honestly
+ * observable (the divergence observation already fired) while a WRONGLY-rebased one silently corrupts
+ * cwd/read-state (r4: drive-root and cross-family recomposition are not implementable without a Windows
+ * path model no lane needs). Trailing slashes are tolerated (from="/app/" must not weld the suffix);
+ * bare "/" keeps filesystem-root semantics; a path outside `from` (incl. the prefix-sibling
+ * "/application" vs "/app") returns unchanged. Exported for direct unit pinning.
+ */
+export declare function rebaseWorkspacePath(p: string, fromRaw: string, toRaw: string): string;
+/**
+ * RB-439-c — {@link rebaseWorkspacePath} over a SET of accepted spellings of the old root: the first
+ * prefix that actually matches wins, and a path under none of them is returned unchanged.
+ *
+ * The set exists because "the old root" has no single spelling. `WorkspaceHandle.mountPath` is whatever the
+ * adapter called the mount, while the persisted paths being migrated were spelled by whoever produced them
+ * (a `cd` the env canonicalized, a Read key resolved through realpath). On a target where the root has an
+ * equivalent alias (`/var` ↔ `/private/var`) those disagree while naming the same directory, and a
+ * single-prefix rebase then matched nothing and silently left the resumed shell in the pre-suspend tree —
+ * under a disclosure that said the task follows the restored root. Order is caller-chosen (the checkpointed
+ * spelling first, its canonical form second) and only matters if one prefix is a prefix of another, in
+ * which case the earlier — more specific — spelling is the intended one. Exported for direct unit pinning.
+ */
+export declare function rebaseWorkspacePathAcross(p: string, froms: readonly string[], to: string): string;

package/dist/core/runner/workspace-path.js

@@ -0,0 +1,22 @@
+export function rebaseWorkspacePath(p, fromRaw, toRaw) {
+    if (p.includes("\\") || fromRaw.includes("\\") || toRaw.includes("\\"))
+        return p;
+    const stripTrail = (s) => (s.length > 1 && s.endsWith("/") ? stripTrail(s.slice(0, -1)) : s);
+    const from = stripTrail(fromRaw);
+    const to = stripTrail(toRaw);
+    if (p === from || stripTrail(p) === from)
+        return to;
+    const fromPrefix = from === "/" ? from : `${from}/`;
+    if (!p.startsWith(fromPrefix))
+        return p;
+    const suffix = p.slice(fromPrefix.length).replace(/^\/+/, "");
+    return to === "/" ? `${to}${suffix}` : `${to}/${suffix}`;
+}
+export function rebaseWorkspacePathAcross(p, froms, to) {
+    for (const from of froms) {
+        const out = rebaseWorkspacePath(p, from, to);
+        if (out !== p)
+            return out;
+    }
+    return p;
+}

package/dist/core/session.d.ts

@@ -312,3 +312,15 @@ export declare function boundedTail(pathEntries: readonly SessionTreeEntry[]): {
     tail: SessionTreeEntry[];
     floorEntryId: string | null;
 };
+/**
+ * The ONE "has this session seen conversation?" predicate — the freshness question is asked three
+ * times in one prepare (project-memory phase, design/148 center adoption, the epoch-pin
+ * discriminator), and an entry-COUNT proxy at ANY of them re-creates the same lie: a host may write
+ * session_info / model_change / … rows before the first turn (naming a new chat, recording a model
+ * pick), and none of that is evidence of a prior session (5.29 merge-rescan: the count proxy
+ * survived at the adoption arm after the pin arm was fixed, silently costing a pre-named session
+ * its published center prompt for life). Conversation content — and only that — is the evidence.
+ */
+export declare function hasConversationContent(branch: ReadonlyArray<{
+    type: string;
+}>): boolean;

package/dist/core/session.js

@@ -24,3 +24,6 @@ export function boundedTail(pathEntries) {
     }
     return { tail: pathEntries.slice(floorIdx), floorEntryId };
 }
+export function hasConversationContent(branch) {
+    return branch.some((e) => e.type === "message" || e.type === "custom_message" || e.type === "compaction");
+}

package/dist/core/tool-policy.d.ts

@@ -1415,6 +1415,22 @@ export declare function withDelegationProvenance(onAsk: OnAsk, delegation: AskDe
  * consultation". A non-wrapper value (including `"allow"`/`"deny"`/undefined) is its own identity.
  */
 export declare function askApproverIdentity(onAsk: unknown): unknown;
+/**
+ * Is this `onAsk` seat a LIVE APPROVER — a person the run can actually reach?
+ *
+ * Only a function is. A blanket `"allow"`/`"deny"` string is a policy setting (the same reading the
+ * interaction-posture door gives it), and an absent seat is nobody at all; neither can answer an ask, so
+ * neither may outrank a durable park.
+ *
+ * ONE definition on purpose. Two sites must agree on this — the run's own sync-first decline, and the
+ * mandate frozen into the chain its children inherit — and when they were two hand-written booleans they
+ * drifted: the decline narrowed to the function test while the freeze kept testing mere presence, and
+ * each still read correctly on its own, so nothing pointed at the pair. A blanket seat was therefore not
+ * an approver for the parent's asks and an approver for its children's. Declared here, in the vocabulary
+ * beside {@link askApproverIdentity}, because the two sites are now two prepare phases (the inherited-gate
+ * fold and the wiring station) plus the orchestrator, and each reaches DOWN for the one definition.
+ */
+export declare function isLiveApproverSeat(onAsk: OnAsk | undefined): boolean;
 /** EXACT structural clone for the approval boundary (alias isolation) — fail-closed, never lossy,
  *  never identity: a JSON round-trip would silently DROP unclonable members (presented ≠ executing =
  *  consent misrepresentation) and an identity fallback would hand the approver the live executing

package/dist/core/tool-policy.js

@@ -847,6 +847,9 @@ export function withDelegationProvenance(onAsk, delegation) {
 export function askApproverIdentity(onAsk) {
     return typeof onAsk === "function" ? (delegatedApproverRoot.get(onAsk) ?? onAsk) : onAsk;
 }
+export function isLiveApproverSeat(onAsk) {
+    return typeof onAsk === "function";
+}
 export function tryCloneArgs(v) {
     try {
         const value = structuredClone(v);

package/dist/core/types.d.ts

@@ -662,7 +662,7 @@ export interface ToolExecuteContext {
              * at all; a park under a screening entry announces the requirement on `onError`
              * (classification `screening-constraint-in-durable-chain`) at park time.
              */
-            inheritedGate?: import("./runner/prepare-task.js").InheritedGate;
+            inheritedGate?: import("./runner/contracts.js").InheritedGate;
         };
         /**
          * design/176 — the peer-chain SEED for a message-driven (tier-3) revival: the hop chain of the
@@ -1046,7 +1046,7 @@ export interface ToolExecuteContext {
      * read-only, NEVER a model/tool argument (same posture as {@link activeSkillScope}). Undefined when the
      * tool runs outside a Runner task.
      */
-    inheritedGateForChildren?: () => import("./runner/prepare-task.js").InheritedGate;
+    inheritedGateForChildren?: () => import("./runner/contracts.js").InheritedGate;
     /**
      * design/180 half A — the delegation runtime-provenance ARMING face. Runner-filled; a delegation
      * tool calls it at spawn time: a non-undefined return means this (parent) run is armed (it mounts

package/dist/core/write-protect.js

@@ -1,4 +1,4 @@
-import { isWinFormPath, writeTargetPath } from "../tools/fs/safety.js";
+import { isWinFormPath, writeTargetPath, isUncPath } from "../tools/fs/safety.js";
 import { PATH_CONFINABLE_WRITE_TOOLS } from "./runner/session-rule-policy.js";
 import { dataRootSpellings } from "./sensitive-path-policy.js";
 const freezeTable = (rows) => Object.freeze(rows.map((r) => Object.freeze(r)));
@@ -137,7 +137,8 @@ function pathViewSegments(path, win32, seps = BOTH_SEPARATOR_FAMILIES, anchorFlo
 const BOTH_SEPARATOR_FAMILIES = /[\\/]/;
 const POSIX_SEPARATOR_FAMILY = /\//;
 function uncAnchorSegments(path) {
-    return /^[\\/]{2}[^\\/]/.test(path) ? 2 : 0;
+    const third = path[2];
+    return isUncPath(path) && third !== undefined && third !== "\\" && third !== "/" ? 2 : 0;
 }
 function relativeUnderDataRoot(path, roots) {
     for (const root of roots) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.5.0",
+  "version": "7.5.2",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",
@@ -73,7 +73,11 @@
     "gate:error-surface": "node scripts/verify-error-surface.mjs",
     "gate:criteria": "node scripts/criteria-lint.mjs",
     "gate:reminder-literal": "node scripts/verify-reminder-literal.mjs",
-    "gate:wire": "node scripts/wire-changes.mjs"
+    "gate:wire": "node scripts/wire-changes.mjs",
+    "gate:layering": "node scripts/verify-layering.mjs",
+    "gate:phase-api": "node scripts/verify-phase-api.mjs",
+    "gate:agent-returns": "node scripts/verify-agent-returns.mjs",
+    "gate:all": "node scripts/gate-all.mjs"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "1.30.0",