@sema-agent/core 7.53.0 → 7.54.1

package/dist/core/runner-deps.d.ts

@@ -14,7 +14,7 @@ import type { OnElicit } from "./mcp-server-spec.js";
 import type { Brain, ModelRef, ModelRoles } from "./model-seat.js";
 import type { RuntimeCaps, WorkflowGovernanceBaseline } from "./runtime-caps.js";
 /**
- * parity-204 — structured `RunnerDeps.loadProjectMemory` return (backward-compatible: a bare
+ * parity-204 — structured `RunnerDeps.loadProjectMemory` return (backward-compatible, RL-1336-project-memory-bare: a bare
  * `string | null` keeps its exact historical meaning). Adds the CC 2.1.204 `seededFromContext`
  * seam (cc204-bundle @17917159: CC preloads readFileState for CLAUDE.md/nested-memory files it
  * placed in context, and a DEFAULT whole-file Read of an unchanged seeded file answers with the
@@ -73,8 +73,8 @@ export interface ResumePreflightInfo {
      *  the resume entry's identity-continuity rung already refused a contradicting supplied principal
      *  before this hook runs, so a present value IS the resumed leg's identity. */
     principal?: string;
-    /** provider / deviceId / mountPath — the placement facts. */
-    workspaceHandle?: import("./remote-env.js").WorkspaceHandle;
+    /** provider / deviceId / mountPath — the placement facts: the row handle's one frozen copy (as `resumeWorkspace`, `priorHandle`). */
+    workspaceHandle?: Readonly<import("./remote-env.js").WorkspaceHandle>;
     gateKind: import("./checkpoint-store.js").CheckpointGate["kind"];
 }
 /** design/380 O2 — a {@link RunnerDeps.resumePreflight} answer. */
@@ -141,10 +141,8 @@ export interface RunnerDeps {
      * probe must not brick every MCP call) with a once-per-MATERIALIZATION `mcp.revocation_probe_failed`
      * notice (a resume re-materializes and may announce again — the standing condition is re-news at
      * each fresh mount, never per-call). The notice is a deployment wiring fact: `detail: { message }`
-     * only, no session attribution, `"operator"` audience by its explicit {@link NOTICE_AUDIENCE}
-     * row (#433 made the registry total over the catalog — no engine-minted code is
-     * audience-defaulted any more) — a
-     * wire projector forwards it operator-tier and needs no per-session de-duplication of its own.
+     * only, no session attribution, `"operator"` audience by its explicit {@link NOTICE_AUDIENCE} row — a wire projector
+     * forwards it operator-tier and needs no per-session de-duplication of its own.
      * The probe's second argument, `{ fingerprint }`, is passed exactly when the server's declaration carries one.
      */
     mcpRevocations?: import("./mcp-server-spec.js").McpRevocationLedger;
@@ -160,8 +158,7 @@ export interface RunnerDeps {
     rosterStore?: import("../agents/roster-store.js").RosterStore;
     /**
      * The center prompt-artifact source (artifact v3 only — a v2 body is refused `schema`, INTEGRATION-CORE §12.11).
-     * `current()` supplies the verified
-     * candidate a top-level session adopts at session start and at a compaction; `get(digest)` resolves a PINNED center
+     * `current()` supplies the verified candidate a top-level session adopts at session start and at a compaction; `get(digest)` resolves a PINNED center
      * layer on resume (a miss is fail-loud `prompt.snapshot_unavailable` — core never recomposes a hybrid from newer
      * content; a copy the engine refuses is told apart from a missing one, in the failure's sentence and on `onError`);
      * `sourceState()` is the tri-state every adoption decision keys on. What a source hands a run is re-checked
@@ -343,6 +340,9 @@ export interface RunnerDeps {
      * to CONTINUE instead — zero capture and zero out-of-policy running, availability paid).
      */
     memoryCapturePolicy?: "open" | "governed" | "capture-required";
+    /** The deployment's cross-boundary posture, one of {@link import("./cross-boundary-taint.js").CROSS_BOUNDARY_POSTURES} (who is hurt when a tree that
+     *  executes on a target device reaches past it). Absent reads `"single_user"`; any other value refuses the prepare, and a resume before its claim (`config.cross_boundary_posture`). */
+    crossBoundaryPosture?: "single_user" | "multi_tenant";
     /**
      * design/383 §2.1b — an optional host-supplied carrier for the session capture opt-out record
      * (per memory plane, keyed by that plane's control dir). Absent = the control-plane file trio

package/dist/core/session-store.d.ts

@@ -1,4 +1,4 @@
-import { type SessionRepo } from "../internal/harness.js";
+import { type SessionPlacementRecord, type SessionRepo } from "../internal/harness.js";
 import { type AcquiredSession, type PlacedSessionRow, type SessionPlacement, type SessionStore, type SessionStoreSummary } from "./session.js";
 import type { StoreDurability } from "./checkpoint-store.js";
 import { SESSION_DEFAULT_TTL_DAYS } from "../config/defaults.js";
@@ -52,6 +52,37 @@ export interface TtlSessionStoreOptions {
         };
     };
 }
+/**
+ * The one placement admission of a session store's `acquire` — every backend that declares the placement partition
+ * judges each resolved session through it (this module's {@link TtlSessionStore} on its four resolution paths: cache
+ * hit, pending-promise inherit, open, idempotent re-create), so no backend writes the two directions a second time.
+ *
+ * Placement obligation 6 (claim closure): an EXISTING placed session refuses the claim-form
+ * acquire — no `requireExisting` (the read/revive form, obligation 5) and no creation placement
+ * (the trusted-internals form; the creating call and its dedup/retry re-acquires stay legal, and
+ * placement immutability means the argument can never REWRITE anything — the persisted tuple wins).
+ *
+ * …and the MIRROR direction (the pre-claim SQUAT race): the child session id is
+ * published on the spawn frame BEFORE the child's prepare creates the session, so a concurrent
+ * claim-form acquire could win first creation and hand the trusted placement caller an ORDINARY
+ * session — host-listable, never really-deleted, the declared full tier falsified in silence. On
+ * a store that DECLARES the partition (`capability.subagentPlacement`; an ignoring store legally drops
+ * placements), an acquire carrying a placement must therefore come back with a PERSISTED tuple whose
+ * join identity matches the declaration — a missing or foreign tuple refuses loudly.
+ *
+ * @param persisted the tuple the backend holds for `sessionId` as resolved (`undefined`: an unplaced session).
+ * @param request the `acquire` options the caller passed.
+ * @param capability whether the store declares the subagent placement partition. `subagentPlacement` is read once,
+ *   and only when the mirror direction is judged (a placement request that is not the read form, after `request`'s
+ *   members are read), so a store may pass a getter over its live declaration.
+ * @throws SessionError `placement_refused` on either direction; returns nothing when admitted.
+ */
+export declare function admitSessionPlacement(sessionId: string, persisted: SessionPlacementRecord | undefined, request: {
+    requireExisting?: boolean;
+    placement?: SessionPlacement;
+}, capability: {
+    subagentPlacement: boolean;
+}): void;
 /**
  * TTL-cached {@link SessionStore} over a pluggable {@link SessionRepo}.
  *
@@ -120,21 +151,9 @@ export declare class TtlSessionStore implements SessionStore {
         requireExisting?: boolean;
         placement?: SessionPlacement;
     }): Promise<AcquiredSession>;
-    /**
-     * Placement obligation 6 (claim closure): an EXISTING placed session refuses the claim-form
-     * acquire — no `requireExisting` (the read/revive form, obligation 5) and no creation placement
-     * (the trusted-internals form; the creating call and its dedup/retry re-acquires stay legal, and
-     * placement immutability means the argument can never REWRITE anything — the persisted tuple wins).
-     *
-     * …and the MIRROR direction (the pre-claim SQUAT race): the child session id is
-     * published on the spawn frame BEFORE the child's prepare creates the session, so a concurrent
-     * claim-form acquire could win first creation and hand the trusted placement caller an ORDINARY
-     * session — host-listable, never really-deleted, the declared full tier falsified in silence. On
-     * a store that DECLARES the partition (an ignoring store legally drops placements), an acquire
-     * carrying a placement must therefore come back with a PERSISTED tuple whose join identity
-     * matches the declaration — a missing or foreign tuple refuses loudly, on every resolution path
-     * (cache hit, pending-promise inherit, open, idempotent re-create).
-     */
+    /** The placement admission ({@link admitSessionPlacement}) for this store, judged on every resolution path. The
+     *  partition declaration is a getter over this store's live field, so it is read where the admission judges the
+     *  mirror direction (after the request's own members, and only then) — never captured at construction. */
     private assertPlacementAdmission;
     /** Resume an existing session from the repo, or create it if the backend has no such id (unless
      *  `requireExisting`, in which case a genuinely-missing id fails loud instead — design/114 Phase3). */

package/dist/core/session-store.js

@@ -4,6 +4,20 @@ import { readMember } from "./thrown-value.js";
 const DAY_MS = 24 * 60 * 60 * 1000;
 import { SESSION_DEFAULT_TTL_DAYS } from "../config/defaults.js";
 export { SESSION_DEFAULT_TTL_DAYS };
+export function admitSessionPlacement(sessionId, persisted, request, capability) {
+    if (persisted !== undefined && request.requireExisting !== true && request.placement === undefined) {
+        throw new SessionError("placement_refused", `session ${sessionId} belongs to the ${persisted.kind} placement partition — a claim-form acquire cannot attach to it (read it with requireExisting, or address the agent through its a* handle)`);
+    }
+    if (request.placement !== undefined && request.requireExisting !== true && capability.subagentPlacement) {
+        const want = request.placement;
+        if (persisted === undefined) {
+            throw new SessionError("placement_refused", `session ${sessionId} exists OUTSIDE the ${want.kind} placement partition it was declared into — refusing to run a subagent transcript on it (a concurrent claim-form create won this id, or the repo dropped the tuple)`);
+        }
+        if (persisted.kind !== want.kind || persisted.scope !== want.scope || persisted.handle !== want.handle) {
+            throw new SessionError("placement_refused", `session ${sessionId}'s persisted placement does not match the declared one (persisted ${persisted.kind}/${persisted.scope ?? "-"}/${persisted.handle ?? "-"} vs declared ${want.kind}/${want.scope ?? "-"}/${want.handle ?? "-"}) — refusing a cross-tuple attach`);
+        }
+    }
+}
 export class TtlSessionStore {
     retention = "none";
     durability;
@@ -74,18 +88,12 @@ export class TtlSessionStore {
         return { session, sessionId: meta.id };
     }
     assertPlacementAdmission(sessionId, placement, opts) {
-        if (placement !== undefined && opts?.requireExisting !== true && opts?.placement === undefined) {
-            throw new SessionError("placement_refused", `session ${sessionId} belongs to the ${placement.kind} placement partition — a claim-form acquire cannot attach to it (read it with requireExisting, or address the agent through its a* handle)`);
-        }
-        if (opts?.placement !== undefined && opts.requireExisting !== true && this.placements?.subagent !== undefined) {
-            const want = opts.placement;
-            if (placement === undefined) {
-                throw new SessionError("placement_refused", `session ${sessionId} exists OUTSIDE the ${want.kind} placement partition it was declared into — refusing to run a subagent transcript on it (a concurrent claim-form create won this id, or the repo dropped the tuple)`);
-            }
-            if (placement.kind !== want.kind || placement.scope !== want.scope || placement.handle !== want.handle) {
-                throw new SessionError("placement_refused", `session ${sessionId}'s persisted placement does not match the declared one (persisted ${placement.kind}/${placement.scope ?? "-"}/${placement.handle ?? "-"} vs declared ${want.kind}/${want.scope ?? "-"}/${want.handle ?? "-"}) — refusing a cross-tuple attach`);
-            }
-        }
+        const store = this;
+        admitSessionPlacement(sessionId, placement, opts ?? {}, {
+            get subagentPlacement() {
+                return store.placements?.subagent !== undefined;
+            },
+        });
     }
     async openOrCreate(id, requireExisting = false, placement) {
         try {

package/dist/core/{shell-lexer.d.ts → shell-run-candidates.d.ts}

@@ -1,23 +1,47 @@
-/** One argv word as the lexer read it. */
+/**
+ * The TIGHTENING reader's view of a command line — "which programs could this command line run, and can the text
+ * even be read?" — for the deny/ask direction of the permission-rule lane (`permission-rule-model.ts`
+ * `programRunReachOf`) and the read-only allow member (`read-only-shell.ts`). It reads the ONE shell lexer's result
+ * (`shell/lex.ts`) and adds only this reader's own domain: which pieces of a line are run candidates, the leading
+ * keyword of a control structure, and the additive peel. A segment that carries a command/process substitution
+ * anywhere (an argument, a redirection operand, an unquoted heredoc body) is one whose program runs are not fully
+ * known — the reader answers `unreadable` for every rule such a segment does not otherwise reach, never silence; the
+ * leading assignments and the wrapper programs of {@link SHELL_WRAPPER_TABLE} are peeled ADDITIVELY — a segment keeps
+ * its spelled argv as one run candidate and gains one per peeled layer, so `sudo env X=1 nohup rm -r x` is a run of
+ * `sudo …`, of `env …`, of `nohup …` and of `rm -r x`, and a deny on any of them reaches.
+ *
+ * What it answers is deliberately THREE-valued per segment: the argv words it could read, each marked literal or
+ * expansion-bearing, or an `unreadable` reason where the program runs cannot be known from the text (a command the
+ * lexer cannot delimit, a syntax error, a control structure whose commands need a syntax tree, a wrapper handed its
+ * command as one string or an option of unknown arity). The reader above turns "unreadable" into a fail-closed ask
+ * rather than into silence — reading it as "no match" is how a deny went blind on `rm -r x; echo "$HOME"`. Where the
+ * lexer cannot delimit the text, the segments it read before it stopped stay candidates (bash runs every complete line
+ * before the one it cannot parse) and the segment it stopped in is the unreadable one.
+ *
+ * The ALLOW direction's rule lane never reads this module: a standing yes covers the exact spelling a person read
+ * (`ruleAdmitsCommand`), and its whole-string refusal of every shell construct stays where it is.
+ */
+import { type LexedWord } from "../shell/lex.js";
+/** One argv word as the reader projects it. */
 export interface ShellWord {
     /** The word's value with quotes and escapes removed — meaningful only when `expands` is `false`. */
     readonly text: string;
     /** The unquoted source spelling (assignment and wrapper-flag tests read this, never `text`). */
     readonly raw: string;
     /** `false`: a literal word. `"one"`: carries an expansion but yields exactly ONE word (it was double-quoted).
-     *  `"many"`: an unquoted expansion, glob or brace pattern, or a quoted `"$@"` / array expansion — may
-     *  yield zero, one or several words. */
+     *  `"many"`: an unquoted expansion, glob or brace pattern, an ANSI-C quote, or a quoted `"$@"` / array expansion —
+     *  may yield zero, one or several words. */
     readonly expands: false | "one" | "many";
 }
-/** One redirection of a segment, as read: the operator and its operand word (a heredoc's operand is its
- *  delimiter; the IO number or `{name}` before the operator is folded into the operator's meaning and not
- *  kept). The tightening reader never reads these — a rule speaks about program runs; the read-only
- *  reader does (an output redirection is a write). */
+/** One redirection of a segment, as read: the operator and its operand word (a heredoc's operand is its delimiter;
+ *  a descriptor duplication's is the descriptor; the IO number or `{name}` before the operator is folded into the
+ *  operator's meaning and not kept). The tightening reader never reads these — a rule speaks about program runs; the
+ *  read-only reader does (an output redirection is a write). */
 export interface ShellRedirection {
     readonly op: string;
     readonly target: ShellWord;
 }
-/** One program run the lexer found, after keyword stripping. */
+/** One program run the reader found, after keyword stripping. */
 export interface ShellSegment {
     /** The run as SPELLED (a leading keyword removed): the first candidate a rule is compared against. */
     readonly argv: readonly ShellWord[];
@@ -32,7 +56,7 @@ export interface ShellSegment {
     /** Present when the segment's program runs are NOT fully known although its candidates could be read:
      *  a peel that stopped before the wrapped program could be named (its options carry an expansion, a
      *  command string, an option of unknown arity), or a command/process substitution anywhere in the
-     *  segment (it runs a program the lexer does not read). The candidates stand — a rule they reach is
+     *  segment (it runs a program the reader does not read). The candidates stand — a rule they reach is
      *  reached — and every other rule reads `unreadable`. */
     readonly peelUnreadable?: string;
 }
@@ -54,10 +78,10 @@ export interface ShellCommandShape {
     readonly strayRedirection: boolean;
 }
 export { SHELL_WRAPPER_TABLE, type ShellWrapperName } from "./shell-wrapper-table.js";
-/** Longer than this and the command is not read at all (one unreadable segment): every pass is linear,
- *  but a substitution nested inside quoting re-enters the quote reader once per nesting level, and the
- *  cap is what bounds that on model-supplied text. Upstream's own reader stops at the same size. */
+/** Longer than this and the command is not read at all (one unreadable segment). Upstream's own reader stops at the
+ *  same size. */
 export declare const MAX_SHELL_READ_CHARS = 10000;
+export declare function lexedWordOf(w: ShellWord): LexedWord | undefined;
 /** Read `source` as the tightening reader must: every program run the text could perform, or why it cannot be read. */
 export declare function readShellCommand(source: string): ShellCommandShape;
 /** Every program run of `shape` can be NAMED from the text: no segment is unreadable, no peel stopped,