@sema-agent/core 7.51.1 → 7.52.0

package/dist/core/skill-grant.js

@@ -1,25 +1,33 @@
 import { wireOf } from "./tool-name-readings.js";
-import { parsePermissionRule } from "./permission-rules.js";
+import { ruleSpellingOf } from "./permission-rule-syntax.js";
 import { mountedToolPermissionSeat } from "./mode-policy.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 import { boundInputHashOf } from "./canonical-json.js";
 import { NOT_BINDABLE } from "./skill-grant-binding.js";
 import { readToolNameList } from "./tool-name-list.js";
-import { allowingRows, autoStripped, compileAllowList, readRuleEntry, inertEntryPhrase, judgeAllowEntries, nonListValueLabel, nonStringMemberLabel, renderListEntry } from "./allow-entry.js";
+import { allowingRows, autoStripped, compileAllowList, readRuleEntry, inertEntryPhrase, judgeAllowEntries, nonListValueLabel, renderListEntry, spelledListEntry } from "./allow-entry.js";
 export const SKILL_GRANT_ORIGINS = Object.freeze(["model", "user", "inherited"]);
 const FROZEN_SKILL_GRANT_ORIGINS = new Set(["model", "inherited"]);
 export function skillNamedBy(args, skills) {
     const named = args?.skill;
     return typeof named === "string" ? skills.find((s) => s.name === named) : undefined;
 }
+function readsAsNothingLabel(inert) {
+    return `<reads as nothing (${inert.reason}): ${spelledListEntry(inert.entry)}>`;
+}
 function skillGrantBinding(skill) {
-    const canonical = (entries) => [...new Set((entries ?? []).map((e) => {
-            if (typeof e !== "string")
-                return nonStringMemberLabel(e);
-            const p = parsePermissionRule(e);
+    const canonical = (entries, behavior) => {
+        const read = compileAllowList((entries ?? []), behavior);
+        const spelled = read.rows.map((r) => {
+            const p = ruleSpellingOf(r.entry);
+            if (p === undefined)
+                return readsAsNothingLabel({ entry: r.entry, reason: "grammar" });
             return p.ruleContent === undefined ? p.toolName : `${p.toolName}(${p.ruleContent})`;
-        }))].sort();
-    const boundGrants = { skill: skill?.name ?? null, allowedTools: canonical(skill?.allowedTools), disallowedTools: canonical(skill?.disallowedTools) };
+        });
+        const unread = read.inert.map((i) => (i.valueType !== undefined ? i.entry : readsAsNothingLabel(i)));
+        return [...new Set([...spelled, ...unread])].sort();
+    };
+    const boundGrants = { skill: skill?.name ?? null, allowedTools: canonical(skill?.allowedTools, "allow"), disallowedTools: canonical(skill?.disallowedTools, "deny") };
     return { boundGrantDigest: boundInputHashOf(boundGrants), boundGrants };
 }
 export function skillGrantDigest(skill) {
@@ -43,7 +51,7 @@ export function parkedSkillApprovalRefusal(row, args, skills, skillToolName, sit
         ? `this parked Skill activation of "${chosen}" carries no digest of the allowed-tools / disallowed-tools it was asked under (it was parked before Skill approvals bound them), so it cannot cover what the activation grants or refuses`
         : nameIn(args) !== nameIn(row.args)
             ? `this Skill approval was given on the card for "${shown(nameIn(row.args))}", and ${site === "claim" ? "this decision selects" : "the call would now activate"} "${chosen}" — not the Skill that card asked about, so the approval does not cover activating it`
-            : `"${chosen}" no longer declares the allowed-tools / disallowed-tools this Skill approval was asked under — as this resume serves it (one it does not load counts as absent), it changed after the approval was given, so the approval does not cover what activating it would now grant or refuse`;
+            : `the allowed-tools / disallowed-tools of "${chosen}", as this resume serves it (one it does not load counts as absent), no longer bind to the digest this Skill approval was asked under — its definition changed, or this engine reads one of its entries differently than the engine that approved it (an entry that reads as nothing) — so the approval does not cover what activating it would now grant or refuse`;
     return site === "claim"
         ? `${why} — refusing pre-CAS (nothing ran; the checkpoint stays pending). Decide this checkpoint as deny and re-activate it: the new card shows the current lists.`
         : `The approved Skill call was not executed: ${why}. This approval is spent — to use "${chosen}", have the model activate it again: the new card shows its lists.`;

package/dist/core/skills-directory.d.ts

@@ -18,25 +18,45 @@
  * directory third parties can write to is the same as pasting their text into the system prompt. The
  * loader validates SHAPE (spec conformance), never intent.
  *
- * **`allowed-tools` / `disallowed-tools` are COPIED, never judged.** Each frontmatter list reaches
+ * **`allowed-tools` / `disallowed-tools` are COPIED, never judged for what they mean.** Each frontmatter list reaches
  * {@link SkillSpec.allowedTools} / {@link SkillSpec.disallowedTools} entry by entry as the author wrote it — no
- * intersection with a roster, no projection onto a tool name, no refusal, no de-duplication. What an entry means
- * (a tool, a namespace, a command rule, a path, a wildcard that grants nothing) is read in ONE place, the run's
- * grant table, which announces what it cannot read; a loader that also judged would be a second reader of the grammar.
+ * intersection with a roster, no projection onto a tool name, no de-duplication. Each entry must be a rule SPELLING — the
+ * rule syntax's own test, `ruleSpellingOf` (a tool name, then at most one parenthesized rule) — or the skill is refused;
+ * what a spelled entry means (a tool, a namespace, a command rule, a path, a wildcard that grants nothing) is read in ONE
+ * place, the run's grant table, which announces what it cannot read. The deny list has a second spelling,
+ * `disallowedTools`, read where `disallowed-tools` is absent or null (YAML's null is the key's absence); a hyphen key with
+ * a value is the list and the alias is not looked at. The allow list has none. **Each list is read whole by ONE scanner,
+ * {@link scanValue} (its JSDoc states the rules), or the skill is refused by name (`no_frontmatter`)** — never installed
+ * shorter: a `disallowed-tools` that lost entries is a looser skill than the one its author wrote. The scanner reads YAML's
+ * structure as YAML does — a comment, a flow's `,` / `]` and a mapping's `: ` are YAML's inside a rule's parentheses too —
+ * and departs from what YAML and the reference's reader give only where the list is cut into entries, on purpose: the cut
+ * counts a rule's parentheses by depth and refuses an entry whose parentheses are not one group closing it — unmatched
+ * either way, or followed by more text (the reference's zone is boolean and installs such an entry); a `*` entry is
+ * copied, the list not collapsed to `*` alone; tab-indented block items are read (the reference's retry reads them too);
+ * and a block scalar's text is cut line by line — each line of a literal one (`|`) as written, a folded one (`>`) after
+ * YAML's folding, so `>` lines that hold one rule read as that rule (YAML keeps the line breaks of `|` in one string, which
+ * the reference installs as one entry no rule reads).
  *
- * Frontmatter is parsed by a deliberately closed subset reader (no YAML dependency — the runtime
- * dependency budget is a standing constraint): top-level `key: value` scalars, optional surrounding
- * quotes, `#` comment lines, block scalars (`|` / `>` with their indentation + chomping indicators),
- * flow sequences (`[a, b]`, including the multi-line form), and indented mapping bodies skipped
- * wholesale. That covers every field the spec defines, and the same posture the memory-engine
- * frontmatter reader already takes.
+ * Frontmatter is read by a deliberately closed subset reader (no YAML dependency — the runtime dependency budget is a
+ * standing constraint): top-level key lines ({@link yamlKeyLineOf}), `#` comment lines, block scalars (`|` / `>` with their
+ * indentation and chomping indicators), the tool lists, and nested blocks (a mapping or a sequence under a key with nothing
+ * on its line) skipped wholesale but for a line that opens a tool-list key (below). A key other than the tool lists keeps its
+ * value as written on its line (a value that is one quoted scalar, the scanner's own judgment, is that scalar decoded, over
+ * every line it runs); a value of it that opens a quote, a `[` or a `{` and does not
+ * close it refuses the skill too — the same scanner, over the same lines, says so. Every value takes its own lines and no
+ * more, and every line no value takes is judged in one place: an indented `key:` line under a value that is not a nested
+ * block — plain, quoted, a flow, a block scalar — refuses the skill naming both keys (YAML reads no key there), and a
+ * flush-left line that is no key line refuses it naming the line (YAML reads no key there either). A tool list is read only
+ * as a key of the frontmatter, written flush left: a tool-list key written in another key's nested block (at any depth), or
+ * after another key's closing quote or `]` on its line, or as a key of a flow mapping (or a pair in a flow sequence) that
+ * value holds, refuses the skill naming both keys — its list would be lost.
  */
 import type { SkillSpec } from "./types.js";
 /** Why one skill directory (or one of its parts) was not taken as-declared. */
 export type SkillsDirectoryWarningCode = 
 /** The directory holds no `SKILL.md`. */
 "no_skill_file"
-/** `SKILL.md` has no well-formed `---` fenced frontmatter block. */
+/** `SKILL.md` has no well-formed `---` fenced frontmatter block: no opening fence, an opening fence never closed by a whole-line `---`, a tool list (`allowed-tools` / `disallowed-tools`) whose value the reader cannot read as a list, a key whose value opens a quote, a `[` or a `{` it does not close, a value that is not a nested block followed by an indented `key:` line, a tool-list key written anywhere but flush left (in a nested block, or after a closing quote or `]` on a key's line), or a flush-left line that is no key line. */
  | "no_frontmatter"
 /** Required `name` absent. */
  | "missing_name"