@sema-agent/core 7.51.0 → 7.51.2

package/dist/core/session-policy-store.js

@@ -1,12 +1,13 @@
 import { posix } from "node:path";
 import { isWinFormPath } from "../tools/fs/safety.js";
 import { NAMESPACED_NAME_SHAPES, carriesNamespaceSeparator } from "./protocol-table.js";
-import { compileAllowList, inertEntryPhrase, readRuleEntry, renderListEntry } from "./allow-entry.js";
+import { compileAllowList, compiledEntryName, inertEntryPhrase, readRuleEntry, renderListEntry } from "./allow-entry.js";
 import { valueTypeLabel } from "./tool-name-list.js";
 const SESSION_RULE_BUCKETS = { toolAllow: "allow", toolDeny: "deny", allowDirs: "dirs" };
 const BUCKETS = Object.keys(SESSION_RULE_BUCKETS);
 const ENTRY_FIELDS = BUCKETS.filter((f) => SESSION_RULE_BUCKETS[f] !== "dirs");
-const STORE_STAMPS = new Set(["rev", "gen"]);
+const STORE_STAMPS = new Set(["rev", "gen", "grammar"]);
+export const SESSION_RULES_GRAMMAR = 1;
 export class SessionPolicyError extends Error {
     code;
     detail;
@@ -49,18 +50,37 @@ function lexWithin(root, p) {
         return true;
     return np === nr || np.startsWith(nr + "/");
 }
+function grammarOf(value) {
+    const stamp = value.grammar;
+    if (stamp === undefined)
+        return { grammar: value.rev !== undefined ? 0 : SESSION_RULES_GRAMMAR };
+    if (typeof stamp !== "number" || !Number.isInteger(stamp) || stamp < 0) {
+        const got = typeof stamp === "number" ? "a number that is not a whole number of 0 or more" : valueTypeLabel(stamp);
+        return { got, sentence: `session rules carry a grammar stamp that is ${got} — the stamp is the whole number of the rule grammar the rules were written in (this engine reads grammar ${SESSION_RULES_GRAMMAR})` };
+    }
+    if (stamp > SESSION_RULES_GRAMMAR) {
+        return {
+            got: `${stamp}, a grammar newer than this engine's (${SESSION_RULES_GRAMMAR})`,
+            sentence: `session rules were written in rule grammar ${stamp}, newer than this engine reads (grammar ${SESSION_RULES_GRAMMAR}) — refusing rather than read their entries in an older grammar; an engine that reads grammar ${stamp} reads them`,
+        };
+    }
+    return { grammar: stamp };
+}
 export function readSessionRulesShape(value) {
     const fault = (field, got, sentence) => ({ fault: { field, got }, sentence });
     if (typeof value !== "object" || value === null || Array.isArray(value)) {
         const got = Array.isArray(value) ? "an array" : valueTypeLabel(value);
         return fault("", got, `session rules must be an object of rule buckets (${BUCKETS.join(", ")}), got ${got}`);
     }
-    const rules = {};
+    const read = grammarOf(value);
+    if ("got" in read)
+        return fault("grammar", read.got, read.sentence);
+    const rules = { grammar: read.grammar };
     for (const [key, v] of Object.entries(value)) {
         if (STORE_STAMPS.has(key) || v === undefined)
             continue;
         if (!Object.hasOwn(SESSION_RULE_BUCKETS, key)) {
-            return fault(key, "not a rule bucket", `session rules hold ${JSON.stringify(key)}, which is not a rule bucket — the buckets are ${BUCKETS.join(", ")}, and a shell command rule is a toolDeny / toolAllow entry written Bash(<command>) (Bash(rm:*) refuses every run of rm)`);
+            return fault(key, "not a rule bucket", `session rules hold ${JSON.stringify(key)}, which is not a rule bucket — the buckets are ${BUCKETS.join(", ")}, and a shell command rule is a toolDeny / toolAllow entry written Bash(<command>) (Bash(rm:*) matches a command whose first word is rm)`);
         }
         const field = key;
         const listed = Array.isArray(v) ? Array.from(v) : undefined;
@@ -78,34 +98,76 @@ export function readSessionRulesShape(value) {
     return { rules };
 }
 export function normalizeRules(rules) {
+    return canonicalRules(shapeOrRefuse(rules));
+}
+function shapeOrRefuse(rules) {
     const read = readSessionRulesShape(rules);
     if ("fault" in read)
         throw new SessionPolicyError("invalid_shape", read.sentence, read.fault);
+    return read.rules;
+}
+function canonicalRules(read) {
     const out = {};
     for (const field of BUCKETS) {
-        const list = read.rules[field];
+        const list = read[field];
         if (list === undefined)
             continue;
         out[field] = SESSION_RULE_BUCKETS[field] === "dirs" ? list.map((d) => posix.normalize(d).replace(/\/+$/, "") || "/") : [...list];
     }
     return out;
 }
-function effectiveEntries(field, list, mountedToolNames) {
-    return compileAllowList(list ?? [], SESSION_RULE_BUCKETS[field], mountedToolNames).rows.map((r) => r.entry);
+function readsAsNothingIn(grammar, field, entry, compiled) {
+    return grammar === 0 && SESSION_RULE_BUCKETS[field] === "allow" && compiledEntryName(compiled) !== entry;
+}
+export function compileSessionRuleBucket(rules, field, roster) {
+    const list = compileAllowList(rules[field] ?? [], SESSION_RULE_BUCKETS[field], roster);
+    const rows = list.rows.filter((r) => !readsAsNothingIn(rules.grammar, field, r.entry, r.compiled));
+    if (rows.length === list.rows.length)
+        return list;
+    const earlier = list.rows.filter((r) => readsAsNothingIn(rules.grammar, field, r.entry, r.compiled)).map((r) => ({ entry: r.entry, reason: "earlier_grammar" }));
+    return { rows, inert: [...list.inert, ...earlier] };
+}
+const ADVISORY_ENTRIES_SHOWN = 5;
+export function earlierGrammarAdvisory(sessionId, entries) {
+    const one = entries.length === 1;
+    const shown = entries.slice(0, ADVISORY_ENTRIES_SHOWN).map(renderListEntry).join(", ");
+    const rest = entries.length > ADVISORY_ENTRIES_SHOWN ? ` and ${entries.length - ADVISORY_ENTRIES_SHOWN} more` : "";
+    return (`session permission rules of session ${JSON.stringify(sessionId)}: toolAllow ${shown}${rest} ${one ? "was" : "were"} stored before the rule grammar stamp, when session rules compared an entry as a tool name as written, so a parenthesized entry named no tool — ` +
+        `${one ? "it admits" : "they admit"} nothing, as when written. To make ${one ? "it an allow rule" : "them allow rules"}, write the session's rules afresh through this engine (an operator write of a value without the stored row's rev; the write stamps grammar ${SESSION_RULES_GRAMMAR}); left as stored, ${one ? "it keeps" : "they keep"} admitting nothing.`);
+}
+export function earlierGrammarAnnouncer(sink) {
+    const announced = new Set();
+    return (entries) => {
+        const key = JSON.stringify(entries);
+        if (sink === undefined || entries.length === 0 || announced.has(key))
+            return;
+        announced.add(key);
+        try {
+            sink(entries);
+        }
+        catch {
+        }
+    };
+}
+function effectiveEntries(rules, field, mountedToolNames) {
+    return compileSessionRuleBucket(rules, field, mountedToolNames).rows.map((r) => r.entry);
 }
 function assertEntriesRead(rules, mountedToolNames) {
     for (const field of ENTRY_FIELDS) {
         for (const entry of rules[field] ?? []) {
-            const read = readRuleEntry(entry, SESSION_RULE_BUCKETS[field], mountedToolNames);
+            const reading = readRuleEntry(entry, SESSION_RULE_BUCKETS[field], mountedToolNames);
+            const read = reading.kind === "row" && readsAsNothingIn(rules.grammar, field, entry, reading.compiled) ? { kind: "inert", reason: "earlier_grammar" } : reading;
             if (read.kind === "row")
                 continue;
             const { kind: _kind, ...why } = read;
             void _kind;
-            const way = why.verdict === "retired"
-                ? ` If this deployment mounts its own tool under ${renderListEntry(entry)}, declare it in the store's mountedToolNames.`
-                : why.currentName === undefined
-                    ? ` An entry is a tool name (Read; a protocol tool is named ${NAMESPACED_NAME_SHAPES}), a protocol namespace (mcp__<server>), or a rule in its tool's own grammar (Bash(<command>), Edit(<path>), Skill(<name>), WebFetch(domain:<host>)).`
-                    : "";
+            const way = why.reason === "earlier_grammar"
+                ? ` These rules are written in grammar ${rules.grammar} (a stored row from before the grammar stamp), in which this entry names no tool. To make it an allow rule, write the rules afresh — a value without the stored row's rev; the write stamps grammar ${SESSION_RULES_GRAMMAR} — or leave the entry out.`
+                : why.verdict === "retired"
+                    ? ` If this deployment mounts its own tool under ${renderListEntry(entry)}, declare it in the store's mountedToolNames.`
+                    : why.currentName === undefined
+                        ? ` An entry is a tool name (Read; a protocol tool is named ${NAMESPACED_NAME_SHAPES}), a protocol namespace (mcp__<server>), or a rule in its tool's own grammar (Bash(<command>), Edit(<path>), Skill(<name>), WebFetch(domain:<host>)).`
+                        : "";
             const sentence = why.guidance !== undefined ? ` — ${why.guidance}` : "";
             throw new SessionPolicyError("inert_entry", `session rules ${field} holds ${inertEntryPhrase({ entry, ...why })}, which ${SESSION_RULE_BUCKETS[field] === "deny" ? "refuses" : "admits"} nothing as written${sentence}; nothing was written.${way}`, { field, entry, ...why });
         }
@@ -115,8 +177,9 @@ export function judgeSessionRulesWrite(prior, rules, opts, mountedToolNames = NO
     if (opts?.expectedRev !== undefined && (prior?.rev ?? 0) !== opts.expectedRev) {
         throw new SessionPolicyError("conflict", `session rules rev mismatch (expected ${opts.expectedRev}, have ${prior?.rev ?? 0})`);
     }
-    const clean = normalizeRules(rules);
-    assertEntriesRead(clean, mountedToolNames);
+    const read = shapeOrRefuse(rules);
+    const clean = canonicalRules(read);
+    assertEntriesRead(read, mountedToolNames);
     if (prior !== null && opts?.operator !== true) {
         const stored = readSessionRulesShape(prior);
         if ("fault" in stored) {
@@ -127,7 +190,7 @@ export function judgeSessionRulesWrite(prior, rules, opts, mountedToolNames = NO
             throw new SessionPolicyError("loosen_forbidden", `a non-operator session-rule write may only tighten; refused: ${loosens.join("; ")}`);
         }
     }
-    return clean;
+    return { ...clean, grammar: SESSION_RULES_GRAMMAR };
 }
 export function loosenReasons(priorValue, nextValue, mountedToolNames = NO_DECLARED_TOOLS) {
     const shapeOf = (side, value) => {
@@ -139,16 +202,16 @@ export function loosenReasons(priorValue, nextValue, mountedToolNames = NO_DECLA
     const prior = shapeOf("prior", priorValue);
     const next = shapeOf("next", nextValue);
     const reasons = [];
-    const keptDeny = new Set(effectiveEntries("toolDeny", next.toolDeny, mountedToolNames));
-    for (const x of effectiveEntries("toolDeny", prior.toolDeny, mountedToolNames))
+    const keptDeny = new Set(effectiveEntries(next, "toolDeny", mountedToolNames));
+    for (const x of effectiveEntries(prior, "toolDeny", mountedToolNames))
         if (!keptDeny.has(x))
             reasons.push(`removed toolDeny ${renderListEntry(x)}`);
     if (prior.toolAllow !== undefined) {
         if (next.toolAllow === undefined)
             reasons.push("removed toolAllow allowlist (all allowed)");
         else {
-            const had = new Set(effectiveEntries("toolAllow", prior.toolAllow, mountedToolNames));
-            for (const x of effectiveEntries("toolAllow", next.toolAllow, mountedToolNames))
+            const had = new Set(effectiveEntries(prior, "toolAllow", mountedToolNames));
+            for (const x of effectiveEntries(next, "toolAllow", mountedToolNames))
                 if (!had.has(x))
                     reasons.push(`widened toolAllow with ${renderListEntry(x)}`);
         }

package/dist/core/spec-contract.d.ts

@@ -7,7 +7,8 @@
  * 任意命令)。它只能来自部署作者/可信代码路径;LLM 生成的 contract 直接喂 runSpec = 不受信输入获得
  * 命令执行权(越红线),禁止。contract 里的 `spec` **文本**才是 DATA-tier(runSpec 恒围栏置入 objective)。
  * 命令可信 ≠ 它跑的代码可信:门跑的测试会加载模型改过的代码,故门子进程的环境缺省经 `scrubSecretEnv`
- * (`OracleGateSpec.inheritEnv`,与 tool shell 同一三态),凭据名只在部署显式列名 / `"all"` 时交给它。
+ * (`OracleGateSpec.inheritEnv`,与 tool shell 同一三态),凭据名只在部署显式列名 / `"all"` 时交给它;
+ * 部署声明的自有凭据名(`declareWithheldEnv`)在任一形下都不交。
  *
  * 🔴 **oracle 三值(fable-M6)**:每门结果 ∈ {green, red, error} —— 判据不满足 = red;基础设施故障
  * (ENOENT/timeout/maxBuffer/parse 解析不出)= **error 非 red**。假红防线:error 绝不冒充"曾经红过"
@@ -56,8 +57,9 @@ export interface OracleGateSpec {
      * way. Absent / `"scrub"`: the environment without its credential-shaped variables (`scrubSecretEnv`); the command
      * runs code the model wrote, so the credentials are not handed to it by default. `"all"`: the whole environment.
      * A list: exactly the named variables that are set (a strict allow list — `PATH` too, when the command is looked
-     * up on it). Names only, never values: the contract is serializable data. A value of any other shape makes the
-     * gate `error`.
+     * up on it). Under every form, the deployment's declared own credentials (`declareWithheldEnv`) are withheld, and a
+     * list naming one makes the gate `error`. Names only, never values: the contract is serializable data. A value of
+     * any other shape makes the gate `error`.
      */
     inheritEnv?: "all" | "scrub" | string[];
 }

package/dist/core/types.d.ts

@@ -18,7 +18,8 @@ export type { PermissionMode } from "./ask-origin.js";
 export type { ToolEffect, ToolContentOrigin, ReversibilityVerdict, ReadRootGrantCandidate, ToolSpec, ToolReturn, NestedUsage, NestedUsageAccum, ToolExecuteContext } from "./tool-spec.js";
 export type { BeforeWriteRequest, BeforeWriteResult, BeforeWriteHook, TrackEditRequest, TrackEditResult, TrackFileEditHook, FileEditedNotice, FileEditedHook, HandsBandOptions } from "./hands-band.js";
 export type { AgentDefinition, SkillSpec } from "./agent-definition.js";
-export type { McpServerSpec, A2aServerSpec, McpElicitRequest, McpElicitResponse, OnElicit, McpRevocationLedger, McpMountIdentity } from "./mcp-server-spec.js";
+export type { McpServerSpec, A2aServerSpec, McpElicitRequest, McpElicitResponse, OnElicit, McpRevocationLedger, McpMountIdentity, McpToolAxesRead } from "./mcp-server-spec.js";
+export { readMcpToolAxes } from "./mcp-server-spec.js";
 export type { TaskLimits } from "./task-limits.js";
 export type { TaskStatus, RemoteEnvFailureNote, EffectiveMemoryScopes, TaskResult, HumanReviewGateRow } from "./task-result.js";
 export type { TerminalCause, PausedCause } from "./terminal-cause.js";

package/dist/core/types.js

@@ -1,4 +1,5 @@
 export { MODEL_ROLES } from "./model-seat.js";
+export { readMcpToolAxes } from "./mcp-server-spec.js";
 export { AUTO_MODE_DENY_SOURCES, isAutoModeDenySource } from "./runtime-caps.js";
 export { __resetMalformedDelegationSeatAnnouncement, backgroundChildTerminal, deliverDelegationLifecycle, emitsChildRowFrames, taskStartedFrame } from "./delegation-frames.js";
 export { __resetMalformedNoticeSeatAnnouncement, deliverEngineNotice, owedUserInputCounts, parentLegIds, settleOwedUserInput, undrainedUserInputNotices, USER_INPUT_UNDRAINED_CAUSES, USER_INPUT_UNDRAINED_FAMILIES } from "./engine-notice.js";

package/dist/engine/execution-env/kill-tree.js

@@ -1,5 +1,5 @@
 import { spawn, spawnSync } from "node:child_process";
-import { scrubSecretEnv } from "../../core/secret-env.js";
+import { inheritedHostEnv } from "../../core/secret-env.js";
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 const DEFAULT_GRACE_MS = 3000;
@@ -145,7 +145,7 @@ function enumerateDescendantsSync(rootPid) {
     let out;
     try {
         const result = spawnSync("ps", ["-A", "-o", "pid=", "-o", "ppid=", "-o", "etime="], {
-            env: scrubSecretEnv(process.env),
+            env: inheritedHostEnv("scrub"),
             timeout: PS_ENUMERATION_TIMEOUT_MS,
             encoding: "utf8",
             windowsHide: true,
@@ -211,7 +211,7 @@ function parseEtimeSeconds(etime) {
 function runTaskkill(args) {
     try {
         const child = spawn("taskkill", args, {
-            env: scrubSecretEnv(process.env),
+            env: inheritedHostEnv("scrub"),
             stdio: "ignore",
             detached: true,
             windowsHide: true,
@@ -271,7 +271,7 @@ function tryMsysGroupKill(bashPath, pid) {
         `[ -n "$g" ] && [ "$g" != "0" ] && kill -9 -"$g" 2>/dev/null; ` +
         `done; exit 0`;
     try {
-        const child = spawn(bashPath, ["-c", script], { env: scrubSecretEnv(process.env), stdio: "ignore", detached: true, windowsHide: true });
+        const child = spawn(bashPath, ["-c", script], { env: inheritedHostEnv("scrub"), stdio: "ignore", detached: true, windowsHide: true });
         child.on("error", () => { });
         return true;
     }

package/dist/engine/execution-env/node-execution-env.d.ts

@@ -88,6 +88,10 @@ export declare class NodeExecutionEnv implements ExecutionEnv, BackgroundShellCa
     /** `ExecutionEnv.cdPath` = the `CDPATH` the shell child receives, read LIVE off the same merge each exec gets (never the
      *  engine process's own environment): its entries, `[]` when the child gets none. Residual: a per-exec `env.CDPATH`. */
     get cdPath(): readonly string[];
+    /** The environment the next shell child would receive, for a READ (the scrub seat is a no-op: a read reports nothing).
+     *  `undefined` when no child would be spawned at all — the policy is refused against the own credentials declared
+     *  since construction, and every spawn throws that reason — so a reader sees "the child gets none", never a throw. */
+    private childEnvForRead;
     private shellPath?;
     private shellEnv?;
     private inheritEnv;
@@ -108,7 +112,9 @@ export declare class NodeExecutionEnv implements ExecutionEnv, BackgroundShellCa
          *  fail-closed (drop secret-pattern keys, keep PATH/build/locale). `"all"` = full inherit (trusted env);
          *  `string[]` = strict allowlist. `shellEnv`/per-exec `env` always pass through. Any other value — an unknown
          *  word, a non-string, a list entry that is not a variable name — throws here (`inheritEnvPolicyProblem`'s
-         *  reason), the same judgment the oracle gate's `inheritEnv` meets. */
+         *  reason), the same judgment the oracle gate's `inheritEnv` meets. Whatever the policy, the deployment's declared
+         *  own credentials (`declareWithheldEnv`) are withheld from the inherited part; a list naming one throws here when
+         *  the declaration came first, and every spawn refuses it (`spawn_error` / `spawn_failed`) whenever it came. */
         inheritEnv?: "all" | "scrub" | string[];
         /** design/105: inject a resident scheduler daemon backend (the shell daemon). Absent ⇒ scheduling INERT. */
         scheduler?: SchedulerCapability;
@@ -125,9 +131,10 @@ export declare class NodeExecutionEnv implements ExecutionEnv, BackgroundShellCa
          * deployments (their pre-suspend dispose becomes a no-op too — do not combine).
          */
         retainBackgroundProcesses?: boolean;
-        /** The D1 scrub decision's observation seat: called with every NON-EMPTY finding set the default
-         *  "scrub" leg withholds from a shell child. Absent ⇒ a once-per-process console summary (loud
-         *  enough to notice, quiet enough not to spam). Never called on the "all"/allowlist legs. */
+        /** The D1 scrub decision's observation seat: called with every NON-EMPTY finding set withheld from a
+         *  shell child — the default "scrub" leg's, and on any leg the declared own credentials the inherited part
+         *  held (kind `own-credential`). Absent ⇒ a once-per-process console summary (loud enough to notice,
+         *  quiet enough not to spam). An allow list withholds nothing else, so it reports nothing. */
         onSecretEnvScrub?: (findings: readonly SecretEnvFinding[]) => void;
         /** #1081 — the structured-notice seat for the SAME withheld-keys disclosure (`EngineNotice`,
          *  `code: "config.secret_env_scrubbed"`, `detail.names`); independent of `onSecretEnvScrub` (a raw

package/dist/engine/execution-env/node-execution-env.js

@@ -7,7 +7,7 @@ import { isAbsolute, join, resolve } from "node:path";
 import { createInterface } from "node:readline";
 import { ExecutionError, err, FileError, ok, toError, } from "../harness/types.js";
 import { killProcessTree, shutdownDebug } from "./kill-tree.js";
-import { __resetSecretEnvScrubNoticeAnnouncement, announceSecretEnvScrub, inheritEnvPolicyProblem, inheritedHostEnv, scrubSecretEnv } from "../../core/secret-env.js";
+import { __resetSecretEnvScrubNoticeAnnouncement, announceSecretEnvScrub, inheritEnvPolicyProblem, inheritedHostEnv } from "../../core/secret-env.js";
 import { physicalPathOfAsync } from "../../core/physical-path.js";
 import { posixModeBitsMeaningful } from "../../core/posix-mode-face.js";
 import { walkSymlinkChain } from "./symlink-chain.js";
@@ -157,7 +157,7 @@ async function runCommand(command, args, timeoutMs) {
             child = spawn(command, args, {
                 stdio: ["ignore", "pipe", "ignore"],
                 windowsHide: true,
-                env: scrubSecretEnv(process.env),
+                env: inheritedHostEnv("scrub"),
             });
         }
         catch {
@@ -315,12 +315,17 @@ export function openSpoolPair(base) {
 export class NodeExecutionEnv {
     cwd;
     get homeDir() {
-        return getShellEnv(this.inheritEnv, this.shellEnv, undefined, () => { }).HOME;
+        return this.childEnvForRead()?.HOME;
     }
     get cdPath() {
-        const value = getShellEnv(this.inheritEnv, this.shellEnv, undefined, () => { }).CDPATH;
+        const value = this.childEnvForRead()?.CDPATH;
         return value === undefined || value === "" ? [] : value.split(":");
     }
+    childEnvForRead() {
+        if (inheritEnvPolicyProblem(this.inheritEnv) !== undefined)
+            return undefined;
+        return getShellEnv(this.inheritEnv, this.shellEnv, undefined, () => { });
+    }
     shellPath;
     shellEnv;
     inheritEnv;

package/dist/engine/lsp/node-lsp-manager.d.ts

@@ -21,7 +21,8 @@ export interface NodeLspManagerOptions {
     /** Injectable spawn (tests supply a fake server; default = {@link defaultLspSpawn} over `child_process.spawn`). */
     spawn?: LspSpawn;
     /** The language server's environment for the default spawn, verbatim. Omitted ⇒ the host environment scrubbed of
-     *  credential-shaped names (`scrubSecretEnv`, a tool child's scrub). Unread when {@link spawn} is supplied. */
+     *  credential-shaped names and of the declared own credentials (`inheritedHostEnv("scrub")`, a tool child's
+     *  reading; `declareWithheldEnv`). Unread when {@link spawn} is supplied. */
     env?: Record<string, string>;
     /** #1081 — the withheld-keys notice sink, SAME shared once-per-process latch/code as the shell-exec
      *  site's `NodeExecutionEnv.onNotice`. Absent ⇒ console only. Unread when {@link spawn} is supplied. */

package/dist/engine/lsp/node-lsp-manager.js

@@ -9,7 +9,7 @@ import { TransportLspSession } from "../../core/lsp-session.js";
 import { StdioLspTransport } from "./stdio-lsp-transport.js";
 import { MAX_LSP_FILE_BYTES, SharedAbortScope, settleOnAbort } from "../../core/lsp.js";
 import { asThrownError, thrownText } from "../../core/thrown-value.js";
-import { announceSecretEnvScrub, scrubSecretEnv } from "../../core/secret-env.js";
+import { announceSecretEnvScrub, inheritedHostEnv } from "../../core/secret-env.js";
 export const DEFAULT_LSP_SERVERS = {
     typescript: "typescript-language-server --stdio",
     javascript: "typescript-language-server --stdio",
@@ -336,7 +336,7 @@ const lspSpawnWithEnv = (env, onNotice) => (command, args, cwd, signal) => new P
         let scrubbedEnv = env;
         if (scrubbedEnv == null) {
             const findings = [];
-            scrubbedEnv = scrubSecretEnv(process.env, findings);
+            scrubbedEnv = inheritedHostEnv("scrub", findings);
             announceSecretEnvScrub(onNotice, findings);
         }
         child = spawn(command, args, { ...lspSpawnOptions(cwd), env: scrubbedEnv });

package/dist/index.d.ts

@@ -11,6 +11,7 @@ export type { RunInternals, ResolvedWorkspace } from "./core/runner/prepare-task
 export type { RunnerSelfSeat } from "./core/runner/contracts.js";
 export type { BudgetAxis } from "./core/runner/assemble-result.js";
 export { terminalProjection } from "./core/runner/terminal-projection.js";
+export { toolOutputBlockChars } from "./core/runner/tool-output-projection.js";
 export { SESSION_LOG_DIGEST_SCHEME, sessionEntryDigest, sessionLogDigest, sessionLogDigestsComparable, } from "./engine/session/log-digest.js";
 export type { ResumeTaskConfig } from "./core/runner/runtask.js";
 export { defineTool } from "./core/tools.js";
@@ -75,7 +76,7 @@ export { WORKFLOW_SIZE_GUIDELINE_AGENT_CAPS } from "./orchestration/workflow-siz
 export { ENGINE_AUTHORITY_ENVELOPE_TAGS } from "./core/untrusted-text.js";
 export { materializeA2aTools, A2aRpcError, type MaterializedA2a, type A2aPeerStatus, type A2aRefreshResult, type A2aToolAxis } from "./core/a2a.js";
 export { PROTOCOL_TABLE, MCP_NAMESPACE, A2A_NAMESPACE, protocolOf, type ProtocolNamespace, type ProtocolId } from "./core/protocol-table.js";
-export { InMemorySessionPolicyStore, SessionPolicyError, loosenReasons, normalizeRules, judgeSessionRulesWrite, readSessionRulesShape, type SessionPolicyStoreOptions, type SessionRuleShapeRefusal, type SessionRuleEntryRefusal, type SessionRuleEntryField, type SessionPolicyStore, type SessionPermissionRules, type StoredSessionRules, type SessionRulesRecord, type PutRulesOptions, } from "./core/session-policy-store.js";
+export { InMemorySessionPolicyStore, SessionPolicyError, loosenReasons, normalizeRules, judgeSessionRulesWrite, readSessionRulesShape, SESSION_RULES_GRAMMAR, compileSessionRuleBucket, type SessionRulesInGrammar, type SessionPolicyStoreOptions, type SessionRuleShapeRefusal, type SessionRuleEntryRefusal, type SessionRuleEntryField, type SessionPolicyStore, type SessionPermissionRules, type StoredSessionRules, type SessionRulesRecord, type PutRulesOptions, } from "./core/session-policy-store.js";
 export { SAFETY_MERGE_CONFORMANCE_CORPUS, type SafetyMergeVector } from "./core/safety-merge-corpus.js";
 export { SAFETY_AXIS_VOCABULARY } from "./core/safety-axis-vocab.js";
 export { createSessionRulePolicy } from "./core/runner/session-rule-policy.js";
@@ -98,6 +99,8 @@ export { getShellConfig, isWslBashLauncher } from "./engine/execution-env/node-e
 export { walkSymlinkChain, SYMLINK_CHAIN_MAX_HOPS, type SymlinkHopReader } from "./engine/execution-env/symlink-chain.js";
 export { isSecretEnvKey, scrubSecretEnv } from "./core/secret-env.js";
 export type { SecretEnvFinding, SecretEnvFindingKind } from "./core/secret-env.js";
+export { declareWithheldEnv, inheritedHostEnv, inheritEnvPolicyProblem, type InheritEnvPolicy } from "./core/secret-env.js";
+export { ENGINE_CAPABILITIES, type EngineCapability } from "./core/engine-capabilities.js";
 export { MAX_EXEC_OUTPUT_BYTES, RollingTailBuffer, markTruncated } from "./core/exec-output-tail.js";
 export { physicalPathOf, physicalPathOfExisting } from "./core/physical-path.js";
 export type { ExecutionEnv, FileInfo, Result, FileErrorCode, ExecutionErrorCode, WriteExpectation, WriteReceipt, SymlinkChain, BoundFileObject } from "./internal/harness.js";
@@ -338,12 +341,15 @@ export { untrustedEgressForHuman, redactHostLeaks, redactSecrets, boundedRedacte
 export type { Egress, EgressTier } from "./core/untrusted-egress.js";
 export type { RedactionFinding, RedactionReport, RedactionConfidence, RedactionSource, SummarizableFinding, } from "./core/untrusted-egress.js";
 export { summarizeRedactions } from "./core/untrusted-egress.js";
+export { headerOwnershipCollision } from "./core/protocol-http-auth.js";
+export type { ProtocolHttpAuth } from "./core/protocol-http-auth.js";
 export { MemoryRosterStore, FileRosterStore, type RosterStore, type RosterEntry, type RosterAccess, type RosterGcOptions } from "./agents/roster-store.js";
 export { CONFIG_CATALOG_VERSION, describeConfigCatalog, resolveEffectiveConfig, type ConfigKnob, type ConfigOverrideDeclaration, type ConfigProvenance, type EffectiveConfigField, } from "./config/catalog.js";
 export { normalizeAgentName } from "./core/task-registry.js";
 export { DELEGATION_MAX_CONCURRENT_DEFAULT, DELEGATION_MAX_PER_SESSION_DEFAULT, SUBAGENT_TRANSCRIPT_RETENTION_DAYS_DEFAULT, } from "./config/defaults.js";
 export { COORDINATOR_ROLE_PROMPT, TEAMMATE_COMMUNICATION_ADDENDUM } from "./prompts/coordinator.js";
-export { createSubagentTool, FORK_SUBAGENT_TYPE, GENERAL_PURPOSE_SUBAGENT_TYPE, agentWhenToUseText, FORK_DIRECTIVE_FRAME, SUBAGENT_SYSTEM_NOTE, type SubagentToolOptions, resolveDelegationEntryCaps, type ResolvedDelegationEntryCaps, type SubagentSpawnContext, type SubagentSteerHandle, type SubagentStep, type SubagentEditedFile, } from "./agents/subagent.js";
+export type { BuiltinSubagentType } from "./agents/subagent.js";
+export { createSubagentTool, FORK_SUBAGENT_TYPE, BUILTIN_SUBAGENT_TYPES, GENERAL_PURPOSE_SUBAGENT_TYPE, agentWhenToUseText, FORK_DIRECTIVE_FRAME, SUBAGENT_SYSTEM_NOTE, type SubagentToolOptions, resolveDelegationEntryCaps, type ResolvedDelegationEntryCaps, type SubagentSpawnContext, type SubagentSteerHandle, type SubagentStep, type SubagentEditedFile, } from "./agents/subagent.js";
 export { getSessionRetainLedger, releaseSessionRetainLedger, } from "./agents/retain-ledger.js";
 export { createSendMessageTool, createAgentContinuationVerb, SEND_MESSAGE_TOOL_NAME, type SendMessageToolOptions, type AgentContinuationReceipt } from "./agents/send-message-tool.js";
 export { createPeerAdmission, peerAdmissionFor, judgePeerAdmission, resolvePeerLaneConfig, PEER_LANE_DEFAULTS, PEER_HOP_CHAIN_WINDOW, PEER_MESSAGE_NOTICE, createPeerSelfRef, createPeerInboundChainRef, peerAxisToken, appendHopToken, type PeerAdmission, type PeerLaneConfig, type PeerAdmissionOptions, type PeerAdmissionRequest, type PeerAdmissionVerdict, type PeerAdmissionRefusal, type PeerRefusalCode, type PeerAxisTag, type PeerIdentity, type PeerSelfRef, type PeerInboundChainRef, } from "./agents/peer-admission.js";
@@ -395,3 +401,5 @@ export { RULE_OFFERS_ABSENCES, type RuleOffersAbsence } from "./core/ask-origin.
 export { BOUND_GRANT_ABSENCES, type BoundGrantAbsence } from "./core/skill-grant-binding.js";
 export { DISPOSABLE_PROMPT_SECTIONS, type DisposablePromptSection, type PromptSectionEntry, type PromptSectionDisposition, type PromptSectionAuthor, type McpInstructionsEntry } from "./core/prompt-section-seat.js";
 export type { McpRevocationLedger, McpMountIdentity } from "./core/mcp-server-spec.js";
+export { readMcpToolAxes } from "./core/mcp-server-spec.js";
+export type { McpToolAxesRead } from "./core/mcp-server-spec.js";

package/dist/index.js

@@ -1,6 +1,7 @@
 export { Runner, runTask } from "./core/runner/runtask.js";
 export { resolveTaskLimits } from "./core/runner/prepare-task.js";
 export { terminalProjection } from "./core/runner/terminal-projection.js";
+export { toolOutputBlockChars } from "./core/runner/tool-output-projection.js";
 export { SESSION_LOG_DIGEST_SCHEME, sessionEntryDigest, sessionLogDigest, sessionLogDigestsComparable, } from "./engine/session/log-digest.js";
 export { defineTool } from "./core/tools.js";
 export { SKILL_TOOL_NAME } from "./core/runner/synthetic-tools.js";
@@ -61,7 +62,7 @@ export { WORKFLOW_SIZE_GUIDELINE_AGENT_CAPS } from "./orchestration/workflow-siz
 export { ENGINE_AUTHORITY_ENVELOPE_TAGS } from "./core/untrusted-text.js";
 export { materializeA2aTools, A2aRpcError } from "./core/a2a.js";
 export { PROTOCOL_TABLE, MCP_NAMESPACE, A2A_NAMESPACE, protocolOf } from "./core/protocol-table.js";
-export { InMemorySessionPolicyStore, SessionPolicyError, loosenReasons, normalizeRules, judgeSessionRulesWrite, readSessionRulesShape, } from "./core/session-policy-store.js";
+export { InMemorySessionPolicyStore, SessionPolicyError, loosenReasons, normalizeRules, judgeSessionRulesWrite, readSessionRulesShape, SESSION_RULES_GRAMMAR, compileSessionRuleBucket, } from "./core/session-policy-store.js";
 export { SAFETY_MERGE_CONFORMANCE_CORPUS } from "./core/safety-merge-corpus.js";
 export { SAFETY_AXIS_VOCABULARY } from "./core/safety-axis-vocab.js";
 export { createSessionRulePolicy } from "./core/runner/session-rule-policy.js";
@@ -82,6 +83,8 @@ export { killProcessTree, signalProcessTree } from "./engine/execution-env/kill-
 export { getShellConfig, isWslBashLauncher } from "./engine/execution-env/node-execution-env.js";
 export { walkSymlinkChain, SYMLINK_CHAIN_MAX_HOPS } from "./engine/execution-env/symlink-chain.js";
 export { isSecretEnvKey, scrubSecretEnv } from "./core/secret-env.js";
+export { declareWithheldEnv, inheritedHostEnv, inheritEnvPolicyProblem } from "./core/secret-env.js";
+export { ENGINE_CAPABILITIES } from "./core/engine-capabilities.js";
 export { MAX_EXEC_OUTPUT_BYTES, RollingTailBuffer, markTruncated } from "./core/exec-output-tail.js";
 export { physicalPathOf, physicalPathOfExisting } from "./core/physical-path.js";
 export { RemoteExecutionError, hasDestroy, isRemoteExecutionEnv, isSuspendable, isIsolated, canonicalPathIsAuthoritative, missingRestoreSurface, isRetryableRemoteErrorCode, RETRYABLE_REMOTE_ERROR_CODES, } from "./core/remote-env.js";
@@ -276,12 +279,13 @@ export { A2A_TASK_STATES, toA2ATaskState, fromA2ATaskState, } from "./core/a2a-t
 export { InMemoryWorkflowJournalStore, callKeyOrdinal, JOURNAL_OVERSIZE_ERROR_CODE, WorkflowJournalOversizeError, assertJournalEntryFits, } from "./core/workflow-journal-store.js";
 export { untrustedEgressForHuman, redactHostLeaks, redactSecrets, boundedRedactedSummary } from "./core/untrusted-egress.js";
 export { summarizeRedactions } from "./core/untrusted-egress.js";
+export { headerOwnershipCollision } from "./core/protocol-http-auth.js";
 export { MemoryRosterStore, FileRosterStore } from "./agents/roster-store.js";
 export { CONFIG_CATALOG_VERSION, describeConfigCatalog, resolveEffectiveConfig, } from "./config/catalog.js";
 export { normalizeAgentName } from "./core/task-registry.js";
 export { DELEGATION_MAX_CONCURRENT_DEFAULT, DELEGATION_MAX_PER_SESSION_DEFAULT, SUBAGENT_TRANSCRIPT_RETENTION_DAYS_DEFAULT, } from "./config/defaults.js";
 export { COORDINATOR_ROLE_PROMPT, TEAMMATE_COMMUNICATION_ADDENDUM } from "./prompts/coordinator.js";
-export { createSubagentTool, FORK_SUBAGENT_TYPE, GENERAL_PURPOSE_SUBAGENT_TYPE, agentWhenToUseText, FORK_DIRECTIVE_FRAME, SUBAGENT_SYSTEM_NOTE, resolveDelegationEntryCaps, } from "./agents/subagent.js";
+export { createSubagentTool, FORK_SUBAGENT_TYPE, BUILTIN_SUBAGENT_TYPES, GENERAL_PURPOSE_SUBAGENT_TYPE, agentWhenToUseText, FORK_DIRECTIVE_FRAME, SUBAGENT_SYSTEM_NOTE, resolveDelegationEntryCaps, } from "./agents/subagent.js";
 export { getSessionRetainLedger, releaseSessionRetainLedger, } from "./agents/retain-ledger.js";
 export { createSendMessageTool, createAgentContinuationVerb, SEND_MESSAGE_TOOL_NAME } from "./agents/send-message-tool.js";
 export { createPeerAdmission, peerAdmissionFor, judgePeerAdmission, resolvePeerLaneConfig, PEER_LANE_DEFAULTS, PEER_HOP_CHAIN_WINDOW, PEER_MESSAGE_NOTICE, createPeerSelfRef, createPeerInboundChainRef, peerAxisToken, appendHopToken, } from "./agents/peer-admission.js";
@@ -328,3 +332,4 @@ export { SHADOW_REASON, allowRuleShadowSentence, cardDisclosureOf } from "./core
 export { RULE_OFFERS_ABSENCES } from "./core/ask-origin.js";
 export { BOUND_GRANT_ABSENCES } from "./core/skill-grant-binding.js";
 export { DISPOSABLE_PROMPT_SECTIONS } from "./core/prompt-section-seat.js";
+export { readMcpToolAxes } from "./core/mcp-server-spec.js";

package/dist/stores/file/fs-atomic.js

@@ -5,7 +5,7 @@ import { hrtime } from "node:process";
 import { basename, dirname, join, resolve as resolvePath } from "node:path";
 import { createHash, randomBytes } from "node:crypto";
 import { execFileSync } from "node:child_process";
-import { scrubSecretEnv } from "../../core/secret-env.js";
+import { inheritedHostEnv } from "../../core/secret-env.js";
 import { physicalPathOf, physicalPathOfExisting } from "../../core/physical-path.js";
 import { thrownText } from "../../core/thrown-value.js";
 const SAFE_COMPONENT = /^[A-Za-z0-9_.-]+$/;
@@ -713,7 +713,7 @@ function probeStartTimesOnce(pid) {
             encoding: "utf8",
             timeout: START_TIME_PROBE_TIMEOUT_MS,
             stdio: ["ignore", "pipe", "ignore"],
-            env: { ...scrubSecretEnv(process.env), LC_ALL: "C", LANG: "C" },
+            env: { ...inheritedHostEnv("scrub"), LC_ALL: "C", LANG: "C" },
         });
     }
     catch (err) {

package/dist/stores/file/session-policy-store.d.ts

@@ -102,9 +102,9 @@ export declare function judgeSessionPolicyRowObject(raw: string): {
  *
  * Required: `rev` >= 1 (a rev-0 row would read as the live reader's SYNTHETIC empty seed); `gen`, when present, a
  * whole number (a STRING `rev` poisons the CAS arithmetic); the rules themselves read by the ONE shape reading
- * (`readSessionRulesShape` — every key a bucket, every bucket a list of strings), so a row this engine cannot read as
- * rules (a key that is no bucket) is refused like any malformed row, never read as fewer rules. The `__sid`/`__principal`
- * metadata is STRIPPED so the value is byte-identical to the in-memory twin's.
+ * (`readSessionRulesShape` — every key a bucket, every bucket a list of strings, a `grammar` this engine reads), so a row it
+ * cannot read as rules (a key that is no bucket, a later grammar) is refused like any malformed row, never read as fewer rules.
+ * The `__sid`/`__principal` metadata is STRIPPED so the value is byte-identical to the in-memory twin's.
  */
 export declare function judgeSessionPolicyRowShape(row: Record<string, unknown>): {
     rules: StoredSessionRules;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.51.0",
+  "version": "7.51.2",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",