@sema-agent/core 7.54.0 → 7.55.0

package/dist/stores/file/session-store.js

@@ -1,7 +1,7 @@
-import { existsSync, readdirSync, rmSync, statSync } from "node:fs";
+import { closeSync, existsSync, fstatSync, openSync, readdirSync, rmSync, statSync } from "node:fs";
 import { join } from "node:path";
-import { BaseSessionStorage, StoredSession, SessionError, assertForkTarget, forkRowCells, getEntriesToFork, incarnationCell, uuidv7, validateEntriesForImport, } from "../../internal/harness.js";
-import { canonicalStoreKey, AppendLog, atomicWriteFile, ensureDir, readJsonlRecords, sanitizePathComponent } from "./fs-atomic.js";
+import { BaseSessionStorage, StoredSession, SessionError, assertForkTarget, compareOccupants, forkRowCells, frozenRow, getEntriesToFork, importRowCells, incarnationCell, leafIdAfterEntry, ownerCell, readIncarnationCell, readOwnerCell, uuidv7, validateEntriesForImport, } from "../../internal/harness.js";
+import { canonicalStoreKey, AppendLog, atomicWriteFile, ensureDir, firstJsonlRecord, lastJsonlRecord, readJsonlRecords, sanitizePathComponent, writeThenLink } from "./fs-atomic.js";
 import { guardCorruptSink } from "./corrupt-read-sink.js";
 import { assertAdoptionBootGate } from "./adoption/marker.js";
 import { thrownText } from "../../core/thrown-value.js";
@@ -9,9 +9,14 @@ const SUFFIX = ".jsonl";
 const SESSION_LINE_JUDGE = {
     accepts: (r) => {
         const line = r;
-        return line.kind === "meta" || (line.kind === "entry" && line.entry !== null && typeof line.entry === "object");
+        if (line.kind === "meta")
+            return true;
+        if (line.kind !== "entry" || line.entry === null || typeof line.entry !== "object" || Array.isArray(line.entry))
+            return false;
+        const entry = line.entry;
+        return typeof entry.id === "string" && (entry.type !== "leaf" || entry.targetId === null || typeof entry.targetId === "string");
     },
-    what: "a session line is neither a meta header nor an entry record",
+    what: "a session line is neither a meta header nor an entry record with a string id (and, for a leaf, a string or null target)",
 };
 const sharedSessionStorages = new Map();
 const sessionStorageFinalizer = new FinalizationRegistry(({ canonical, log }) => {
@@ -31,10 +36,12 @@ class FileSessionStorage extends BaseSessionStorage {
     log;
     canonicalPath;
     holders = new Set();
+    occupant;
     constructor(log, meta, entries, canonicalPath) {
         super(meta, entries);
         this.log = log;
         this.canonicalPath = canonicalPath;
+        this.occupant = { incarnation: meta.incarnation };
     }
     addHolder(holder) {
         this.holders.add(holder);
@@ -46,6 +53,9 @@ class FileSessionStorage extends BaseSessionStorage {
     closeLog() {
         this.log.close();
     }
+    isViewOf(row) {
+        return this.log.isFileAtPath() && compareOccupants(this.occupant, row) !== "different";
+    }
     persistSync(entry) {
         this.log.append({ kind: "entry", entry }, true);
     }
@@ -91,45 +101,63 @@ export class FileSessionRepo {
                 tally = info;
             this.onCorruptRead?.({ ...info, sessionId: id });
         }, SESSION_LINE_JUDGE);
-        let meta;
+        const meta = this.headerOf(id, path, lines[0], () => ` (${tally?.dropped ?? 0} of ${tally?.total ?? lines.length} records skipped as corrupt)`);
         const entries = [];
-        for (const line of lines) {
-            if (line.kind === "meta")
-                meta = line;
-            else
+        for (const line of lines)
+            if (line.kind === "entry")
                 entries.push(line.entry);
+        return { meta, entries };
+    }
+    headerOf(id, path, first, skipped = () => "") {
+        if (first === undefined || first.kind !== "meta")
+            throw new SessionError("corrupt_session", `Session ${id} is unreadable: its log has no meta header${skipped()}`);
+        const said = (key) => (detail) => this.disclose(path, `session header ${key}: ${detail}`, id);
+        const incarnation = readIncarnationCell(first.incarnation, said("incarnation"));
+        const forkedFromIncarnation = readIncarnationCell(first.forkedFromIncarnation, said("forkedFromIncarnation"));
+        return {
+            id,
+            createdAt: first.createdAt,
+            ...(first.forkedFrom !== undefined ? { forkedFrom: first.forkedFrom } : {}),
+            ...(first.placement !== undefined ? { placement: first.placement } : {}),
+            ...(incarnation !== undefined ? { incarnation } : {}),
+            ...(forkedFromIncarnation !== undefined ? { forkedFromIncarnation } : {}),
+            owner: readOwnerCell(first.owner, id),
+        };
+    }
+    async headOf(sessionId) {
+        const path = this.pathFor(sessionId);
+        let fd;
+        try {
+            fd = openSync(path, "r");
         }
-        if (meta === undefined) {
-            throw new SessionError("corrupt_session", `Session ${id} is unreadable: its log has no meta header (${tally?.dropped ?? 0} of ${tally?.total ?? lines.length} records skipped as corrupt)`);
+        catch (err) {
+            if (err.code === "ENOENT")
+                return undefined;
+            throw err;
         }
-        const { createdAt, forkedFrom, placement, incarnation, forkedFromIncarnation } = meta;
-        for (const [key, token] of [["incarnation", incarnation], ["forkedFromIncarnation", forkedFromIncarnation]]) {
-            if (token !== undefined && typeof token !== "string")
-                this.disclose(path, `session header carries a non-string ${key} (${typeof token}) — read as an UNKNOWN occupant`, id);
+        try {
+            const size = fstatSync(fd).size;
+            const meta = this.headerOf(sessionId, path, firstJsonlRecord(fd, size, SESSION_LINE_JUDGE));
+            const last = lastJsonlRecord(fd, size, (r) => r.kind === "entry", SESSION_LINE_JUDGE);
+            return { owner: meta.owner ?? null, incarnation: meta.incarnation, leafId: last === undefined ? null : leafIdAfterEntry(last.entry) };
+        }
+        finally {
+            closeSync(fd);
         }
-        return {
-            meta: {
-                id,
-                createdAt,
-                ...(forkedFrom !== undefined ? { forkedFrom } : {}),
-                ...(placement !== undefined ? { placement } : {}),
-                ...(typeof incarnation === "string" ? { incarnation } : {}),
-                ...(typeof forkedFromIncarnation === "string" ? { forkedFromIncarnation } : {}),
-            },
-            entries,
-        };
     }
     storage(meta, entries) {
         const { id } = meta;
         const canonical = canonicalStoreKey(this.pathFor(id));
         const live = sharedSessionStorages.get(canonical)?.deref();
-        if (live !== undefined) {
+        if (live !== undefined && live.isViewOf(meta)) {
             live.addHolder(this);
             this.joined.set(canonical, new WeakRef(live));
             return live;
         }
+        if (live !== undefined)
+            evictSharedSessionStorage(canonical);
         const log = new AppendLog(this.pathFor(id));
-        const created = new FileSessionStorage(log, meta, entries, canonical);
+        const created = new FileSessionStorage(log, frozenRow({ ...meta, ...(meta.placement !== undefined ? { placement: { ...meta.placement } } : {}) }), entries, canonical);
         sharedSessionStorages.set(canonical, new WeakRef(created));
         created.addHolder(this);
         this.joined.set(canonical, new WeakRef(created));
@@ -153,10 +181,17 @@ export class FileSessionRepo {
         const createdAt = new Date().toISOString();
         const path = this.pathFor(id);
         if (!existsSync(path)) {
-            evictSharedSessionStorage(canonicalStoreKey(path));
+            const owner = ownerCell(options.owner);
             const placement = options.placement !== undefined ? { ...options.placement, placedAt: options.placement.placedAt ?? Date.now() } : undefined;
-            const meta = { id, createdAt, ...(placement !== undefined ? { placement } : {}), ...incarnationCell(undefined) };
-            atomicWriteFile(this.tmpDir, path, `${JSON.stringify({ kind: "meta", ...meta })}\n`);
+            const meta = { id, createdAt, ...(placement !== undefined ? { placement } : {}), ...incarnationCell(undefined), ...owner };
+            try {
+                writeThenLink(path, `${JSON.stringify({ kind: "meta", ...meta })}\n`);
+            }
+            catch (err) {
+                if (err.code === "EEXIST")
+                    throw new SessionError("conflict", `session ${id} was created by another writer between this create's existence check and its write — refusing to replace or attach to that row`);
+                throw err;
+            }
             return new StoredSession(this.storage(meta, []));
         }
         const { meta, entries } = this.read(id);
@@ -248,15 +283,19 @@ export class FileSessionRepo {
             return this.read(id).meta;
         }
         catch (err) {
-            return err instanceof SessionError && err.code === "not_found" ? undefined : {};
+            if (err instanceof SessionError && err.code === "not_found")
+                return undefined;
+            throw err;
         }
     }
     async placementOf(sessionId) {
         try {
             return this.read(sessionId).meta.placement;
         }
-        catch {
-            return undefined;
+        catch (err) {
+            if (err instanceof SessionError && err.code === "not_found")
+                return undefined;
+            throw err;
         }
     }
     async delete(metadata) {
@@ -275,7 +314,7 @@ export class FileSessionRepo {
         const id = options.id ?? uuidv7();
         const createdAt = new Date().toISOString();
         const path = this.pathFor(id);
-        const meta = { id, createdAt, ...forkRowCells(await source.getMetadata()) };
+        const meta = { id, createdAt, ...forkRowCells(await source.getMetadata(), options.owner) };
         const lines = [JSON.stringify({ kind: "meta", ...meta })];
         for (const entry of forked) {
             lines.push(JSON.stringify({ kind: "entry", entry }));
@@ -288,12 +327,10 @@ export class FileSessionRepo {
         return this.read(sessionId).entries;
     }
     async importEntries(sessionId, owner, entries, options) {
-        void owner;
         const validated = validateEntriesForImport(entries, options);
-        const prior = this.priorHeader(sessionId);
+        const meta = importRowCells(sessionId, owner, this.priorHeader(sessionId), new Date().toISOString());
         evictSharedSessionStorage(canonicalStoreKey(this.pathFor(sessionId)));
-        const createdAt = new Date().toISOString();
-        const lines = [JSON.stringify({ kind: "meta", id: sessionId, createdAt, ...incarnationCell(prior) })];
+        const lines = [JSON.stringify({ kind: "meta", ...meta })];
         for (const entry of validated) {
             lines.push(JSON.stringify({ kind: "entry", entry }));
         }

package/dist/stores/file/workflow-journal-store.d.ts

@@ -48,9 +48,9 @@ export declare const RESUME_CLAIM_SWEEP_INTERVAL_MS = 60000;
  */
 export declare const RESUME_CLAIM_REAP_GRACE_MS: number;
 export interface FileWorkflowJournalStoreOptions {
-    /** Disclosure seat for a ledger line this store DROPPED on replay (not JSON, not a record, or a record
-     *  with none of this ledger's members) — a resume that silently finds "nothing to replay" re-runs the
-     *  work with no signal. Never fires on a missing ledger; swallow-guarded. */
+    /** Disclosure seat for a ledger line that is not one of the run's records (not JSON, not an object, no `scope` /
+     *  `ordinal`, another scope) and — with the refusal, carrying the ledger's path — for whatever refused a `load`.
+     *  Never fires on a missing ledger or on a crash's unterminated tail; swallow-guarded. */
     onCorruptRead?: (info: CorruptReadInfo) => void;
 }
 export declare class FileWorkflowJournalStore implements WorkflowJournalStore {
@@ -79,9 +79,15 @@ export declare class FileWorkflowJournalStore implements WorkflowJournalStore {
     /** CC local form: the run's on-disk journal path for the notification diagnostics line.
      *  Traversal-shaped ids (LLM-controlled on some paths) degrade to undefined, never throw. */
     locator(runId: string): string | undefined;
-    /** Replay a run's ledger: last-writer-wins per ordinal; a torn/unparsable line is skipped (uncommitted). */
+    /** Replay a run's ledger: last-writer-wins per ordinal, with every line that is not one of the run's records
+     *  (`notRecords`) and the scope the first record fixes. Rows come back as written — which arm each one is, and
+     *  whether anything refuses, is {@link load}'s question, so the scope lookup `append` makes refuses on nothing. */
     private replay;
     append(runId: string, scope: string, entry: WorkflowJournalEntry): Promise<void>;
+    /** The run's entries, ascending by ordinal, each winning line read through {@link readWorkflowJournalEntry}. A
+     *  ledger line that is not one of the run's records, or a corrupt row, REFUSES the whole load: dropped, what it
+     *  held would look never journaled and a resume would run it again. Only the unterminated tail a crash leaves is
+     *  uncommitted. The location goes to `onCorruptRead`, not into the message; a superseded line is not read. */
     load(runId: string, scope: string): Promise<WorkflowJournalEntry[]>;
     /**
      * RB-242 — the claim file for `(sourceRunId, scope)`. Keyed by BOTH: a cross-scope caller already

package/dist/stores/file/workflow-journal-store.js

@@ -1,18 +1,13 @@
 import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, unlinkSync } from "node:fs";
 import { createHash } from "node:crypto";
 import { join } from "node:path";
-import { callKeyOrdinal } from "../../core/workflow-journal-store.js";
+import { callKeyOrdinal, readWorkflowJournalEntry, WorkflowJournalIncompatibleError, } from "../../core/workflow-journal-store.js";
 import { AppendLog, readJsonlRecords } from "./fs-atomic.js";
 import { guardCorruptSink } from "./corrupt-read-sink.js";
 import { canonicalStoreKey, sanitizePathComponent, writeThenLink } from "./fs-atomic.js";
 import { assertAdoptionBootGate } from "./adoption/marker.js";
 import { assertJournalEntryFits } from "../../core/workflow-journal-store.js";
 export { MAX_JOURNAL_RESULT_BYTES, oversizeJournalResult } from "../../core/workflow-journal-store.js";
-function entryOf(rec) {
-    if (rec.parked !== undefined)
-        return { callKey: rec.callKey, parked: rec.parked };
-    return { callKey: rec.callKey, result: rec.result };
-}
 export const RESUME_CLAIM_TTL_MS = 60 * 60 * 1000;
 export const RESUME_CLAIM_RELEASE_GRACE_MS = 5_000;
 export const RESUME_CLAIM_SWEEP_INTERVAL_MS = 60_000;
@@ -21,7 +16,7 @@ const sharedJournalDirs = new Map();
 const MAX_OPEN_JOURNAL_LOGS = 64;
 function isJournalLine(r) {
     const rec = r;
-    return typeof rec.callKey === "string" && typeof rec.scope === "string" && Number.isFinite(rec.ordinal);
+    return typeof rec.scope === "string" && Number.isFinite(rec.ordinal);
 }
 export class FileWorkflowJournalStore {
     fsyncEnabled;
@@ -86,11 +81,17 @@ export class FileWorkflowJournalStore {
                 scope ??= r.scope;
                 return r.scope === scope;
             },
-            what: "a journal line carries no callKey/scope pair, or a scope other than its run's first line",
+            what: "a journal line carries no scope/ordinal pair, or a scope other than its run's first line",
+        };
+        const notRecords = [];
+        const onCorrupt = (info) => {
+            if (info.kind === "record")
+                notRecords.push(info);
+            this.discloseCorrupt?.(info);
         };
-        for (const rec of readJsonlRecords(path, this.discloseCorrupt, judge))
-            byOrdinal.set(rec.ordinal, entryOf(rec));
-        return scope === undefined ? undefined : { scope, byOrdinal };
+        for (const rec of readJsonlRecords(path, onCorrupt, judge))
+            byOrdinal.set(rec.ordinal, rec);
+        return { scope, byOrdinal, notRecords };
     }
     async append(runId, scope, entry) {
         assertJournalEntryFits(entry);
@@ -126,9 +127,23 @@ export class FileWorkflowJournalStore {
     }
     async load(runId, scope) {
         const rec = this.replay(runId);
-        if (!rec || rec.scope !== scope)
+        if (!rec || (rec.scope !== undefined && rec.scope !== scope))
             return [];
-        return [...rec.byOrdinal.entries()].sort((a, b) => a[0] - b[0]).map(([, e]) => e);
+        const lost = rec.notRecords[0];
+        if (lost !== undefined) {
+            this.discloseCorrupt?.({ kind: "file", path: this.pathFor(runId), reason: `${lost.form}: ledger line ${lost.line} is not one of the run's records (the run's journal is refused)` });
+            throw WorkflowJournalIncompatibleError.ledgerLine(runId, lost.line, lost.form);
+        }
+        const out = [];
+        for (const [ordinal, line] of [...rec.byOrdinal.entries()].sort((a, b) => a[0] - b[0])) {
+            const read = readWorkflowJournalEntry(line);
+            if ("corrupt" in read) {
+                this.discloseCorrupt?.({ kind: "file", path: this.pathFor(runId), reason: `${read.corrupt}: journal entry #${ordinal} ${read.why} (the run's journal is refused)` });
+                throw new WorkflowJournalIncompatibleError(runId, ordinal, line);
+            }
+            out.push(read.entry);
+        }
+        return out;
     }
     claimPathFor(sourceRunId, scope) {
         const scopeTag = createHash("sha256").update(scope).digest("hex").slice(0, 16);

package/dist/tools/artifact/artifact-text.d.ts

@@ -1,6 +1,6 @@
 /**
  * The model-facing text of the Artifact tool. Every sentence is the upstream tool's wording, taken
- * byte-for-byte from the reference corpus (Claude Code 2.1.259, `cli259.js`; the line of each constant is
+ * byte-for-byte from the reference corpus (the line of each constant is
  * noted beside it) with one class of edit: a reference to a hosting product this library does not have
  * (`claude.ai`, its terminal/gallery/Slack surfaces, an `out_dir` save) is replaced by the smallest
  * neutral phrase. The replacement list is registered in the divergence register beside this package.

package/dist/tools/artifact/artifact-tool.js

@@ -8,7 +8,7 @@ const ARTIFACT_ACTION_LEGS = {
     hosted: { publish: ["env", "outside_write"], list: ["outside_read"], read: ["outside_read"], list_files: ["outside_read"], read_file: ["outside_read"] },
     "local-stub": { publish: ["env"], list: [], read: [], list_files: [], read_file: [] },
 };
-import { ARTIFACT_TOOL_NAME, toolFace } from "../../core/tool-catalog-entries.js";
+import { ARTIFACT_TOOL_NAME, mountRuleFace, toolFace } from "../../core/tool-catalog-entries.js";
 import { resolveAsk } from "../../core/tool-policy.js";
 import { NOT_BINDABLE } from "../../core/skill-grant-binding.js";
 import { approvalCardOf } from "../../core/tool-roster.js";
@@ -448,6 +448,7 @@ export function createArtifactTool(opts) {
     return {
         name: ARTIFACT_TOOL_NAME,
         ...toolFace("artifact"),
+        ruleFace: mountRuleFace("artifact"),
         contentOrigin: ARTIFACT_PLANE_CONTENT_ORIGIN[caps.plane],
         description: artifactDescription(caps.plane, caps.actions),
         parameters: buildSchema(caps),

package/dist/tools/fs/bash-readonly-classifier.d.ts

@@ -267,9 +267,9 @@ export declare function splitShellCompoundSegments(source: string, options?: {
  *
  * The allowlist vets `argv[0]` only, so until this face existed every listed reader could name ANY
  * path: `ls /etc` and `cat /etc/passwd` classified read-only, and a deployment whose manual-mode shell
- * gate auto-allows the read-only verdict served the whole filesystem with no approval prompt. CC 2.1.220
- * demotes exactly these shapes (its per-command path extractor + working-directory containment check,
- * pretty220 @457568) and renders an approval option naming the directory (@905642 (cli250.js:66007)).
+ * gate auto-allows the read-only verdict served the whole filesystem with no approval prompt. The reference
+ * demotes exactly these shapes (its per-command path extractor + working-directory containment check)
+ * and renders an approval option naming the directory.
  *
  * Supplying this object turns the check ON; omitting it leaves the classifier byte-identical to its
  * name-only behaviour, so a consumer pinned to an older calling convention is unaffected.

package/dist/tools/fs/fs-bash.d.ts

@@ -35,7 +35,7 @@ export declare function bashReversibilityProbe(allow?: readonly string[], bounda
  * fullShellReachable roster assertion (its first load-bearing consumer).
  */
 export { FULL_SHELL_CONTRACT_ID } from "../../core/tool-catalog-entries.js";
-/** The CC-verbatim exit-1 interpretation for `command`, or undefined when exit 1 means a real error.
+/** The exit-1 interpretation for `command`, or undefined when exit 1 means a real error.
  *  Read off the lexer's segments: the last one (the last `;`/`&&`/`||`/newline statement's last `|` piece) → its
  *  written command word past the leading assignments bash strips, path prefix stripped;
  *  `git grep`/`git diff` special-cased (CC `cLp`). Exported for its unit tests. */
@@ -110,7 +110,7 @@ export declare function createBashTool(env: ExecutionEnv, rootCanonical: string,
      * Is a PERSON's input waiting for this run's next turn boundary? Read on each liveness tick of a
      * running foreground command: `true` on an {@link autoBackgroundOnTimeout}-armed command moves that
      * command into the background (through the SAME detach verb ctrl+b fires) so the message is
-     * delivered this turn instead of after the command. CC 2.1.259 `backgroundedToDeliverMessage`.
+     * delivered this turn instead of after the command. Reference field `backgroundedToDeliverMessage` (cli296.js:134207).
      *
      * The predicate is the HARNESS's own accepted-but-unserved account and deliberately counts only what
      * a PERSON sent: an engine-authored reminder is not somebody waiting, and stepping a build aside for

package/dist/tools/fs/fs-bash.js

@@ -17,7 +17,7 @@ import { ghRateLimitHint } from "./gh-rate-limit.js";
 import { backgroundLifetimeNote } from "./fs-bash-background-text.js";
 import { resolveBashTimeoutCaps, bashTimeoutCapsSec, bashTimeoutArgRefusal, bashTimeoutParamDescription, envErrorDetail, bashMaxOutputChars, clipShellOutput, writeShellOverflowFile, shellRecoveryHint, CWD_SENTINEL, stripCwdSentinel, } from "./fs-shared.js";
 import { bashClassifyDefaultAllow, BASH_READONLY_DEFAULT_ALLOW, coarseReadonlyCheck, classifyBoundedReadonlyPollLoopDetailed, classifyCompoundReadonlyDetailed } from "./bash-readonly-classifier.js";
-import { toolFace } from "../../core/tool-catalog-entries.js";
+import { mountRuleFace, toolFace } from "../../core/tool-catalog-entries.js";
 import { argvOf, compoundValueHidesRun, expansionHidesRun, expansionsInHeredocBody, lexShell } from "../../shell/lex.js";
 import { arithmeticAssignedNames } from "./shell-read-bindings.js";
 import { thrownText } from "../../core/thrown-value.js";
@@ -812,6 +812,7 @@ export function createEnvTaskOutputTool(env) {
     return defineTool({
         name: TASK_OUTPUT_TOOL_NAME,
         ...toolFace("task-output-hands"),
+        ruleFace: mountRuleFace("task-output-hands"),
         description: composeTaskOutputDescription(ENV_DIRECT_TASK_TOOL_CAPS),
         parameters: composeTaskOutputParams(ENV_DIRECT_TASK_TOOL_CAPS),
         execute: async (args) => {
@@ -849,6 +850,7 @@ export function createEnvTaskStopTool(env, registry = defaultTaskRegistry) {
     return defineTool({
         name: TASK_STOP_TOOL_NAME,
         ...toolFace("task-stop-hands"),
+        ruleFace: mountRuleFace("task-stop-hands"),
         description: composeTaskStopDescription(ENV_DIRECT_TASK_TOOL_CAPS),
         parameters: TASK_STOP_PARAMS,
         execute: async (args) => {

package/dist/tools/fs/fs-shared.d.ts

@@ -25,14 +25,14 @@ export declare const MAX_READ_BYTES: number;
  *  explicit slice, with guidance to stream a portion via bash (`sed -n` / `head -c`) instead, which
  *  never loads the whole file. */
 export declare const SLICED_READ_MAX_BYTES: number;
-/** The byte cap Edit refuses ABOVE (CC's own constant, verbatim). CC stats the target before touching
+/** The byte cap Edit refuses ABOVE. CC stats the target before touching
  *  it and refuses with a formatted-size message when it exceeds this. Without the gate, Edit goes
  *  straight to a whole-file `readBinaryFile` (twice: the `old_string:""` full-overwrite branch and the
  *  normal find/replace branch), so a multi-GB target is an unguarded OOM lever an ordinary Edit call
  *  can pull. The shape is Read's: a pre-read `env.fileInfo` stat plus a post-read TOCTOU recheck
  *  ({@link SLICED_READ_MAX_BYTES} above). */
 export declare const MAX_EDIT_BYTES: number;
-/** `Edit`'s human-readable byte-count formatter (CC `pl()` verbatim: bytes below 1KB, else
+/** `Edit`'s human-readable byte-count formatter (bytes below 1KB, else
  *  KB/MB/GB with one decimal, trailing ".0" stripped). */
 export declare function formatByteSize(n: number): string;
 /** Node's own string-length ceiling (`buffer.constants.MAX_STRING_LENGTH` — ~512MiB on V8/Node 24)
@@ -103,7 +103,7 @@ export interface RecordedEdit {
 export declare function applyRecordedEdit(text: string, edit: RecordedEdit): string;
 /** Render the read-before-edit refusal, appending the slice/bash escape hatch when the target is over
  *  the Read byte cap — a bare "read it first" is un-followable there (a default whole-file Read
- *  refuses such files). Best-effort: an un-stattable file keeps the bare CC-verbatim refusal.
+ *  refuses such files). Best-effort: an un-stattable file keeps the bare refusal.
  *
  *  `fallbackHint` is a caller-supplied parenthetical for the case NO branch below diagnosed anything
  *  (all three writing tools pass {@link READ_REFUSED_ESCAPE_HINT} — the Read-refuses-this-file
@@ -332,7 +332,7 @@ export declare function createShellOverflowSpoolFence(env: ExecutionEnv): (path:
  * executable. Full `bash` keeps the precise form.
  */
 export declare function shellRecoveryHint(path: string, readOnly: boolean | undefined): string;
-/** CC 2.1.198 live-verbatim Edit/Write success trailer — appended to every Edit/Write success message
+/** Edit/Write success trailer — appended to every Edit/Write success message
  *  (NOT NotebookEdit — CC ships it without the trailer). */
 export declare const FILE_STATE_TRAILER = " (file state is current in your context \u2014 no need to Read it back)";
 export declare const CWD_SENTINEL = "__cc_cwd_9f2c1b__";
@@ -383,11 +383,11 @@ export declare function ipynbRedirect(toolName: string, path: string): string |
  *  ends in "\n". Behavior is identical for content WITHOUT a trailing newline. Shared by read_file's
  *  `total`, edit_file/write_file's "N lines" report, and the persisted ReadFileState.totalLines. */
 export declare function countLines(s: string): number;
-/** CC 2.1.204 VERBATIM: the reminder served when a DEFAULT whole-file Read hits a startup-seeded,
+/** The reminder served when a DEFAULT whole-file Read hits a startup-seeded,
  *  unchanged file. `filePath` is the CANONICAL key (CC passes the resolved full path, matching the
  *  `Contents of <path>` header its context seeding emits — deployments seeding files should title the
  *  injected block the same way so the back-reference lands). Locked verbatim by test: the BODY and
- *  close tag stay CC-verbatim; the open tag alone is rendered by the mint home and carries the session
+ *  close tag stay fixed; the open tag alone is rendered by the mint home and carries the session
  *  mark when one is threaded (the recorded wire-form divergence). */
 export declare function seededFileUnchangedReminder(filePath: string, mark?: string): string;
 /**
@@ -404,7 +404,7 @@ export declare function seededFileUnchangedReminder(filePath: string, mark?: str
  */
 export declare function isReadDedupStubResult(resultText: string): boolean;
 /** Pre-seed the hands' read state for a file whose FULL, disk-verbatim text was injected into the
- *  model's context at startup (CC 2.1.204 `seededFromContext` seeding of the memory preload; sema:
+ *  model's context at startup (`seededFromContext` seeding of the memory preload; sema:
  *  ProjectMemoryLoad.seededFiles → prepare-task).
  *  `content` MUST be the file's exact disk text at load time — the Read tool's seeded dedup treats a
  *  hash match as "unchanged"; a truncated/annotated variant must NOT be seeded (CC exempts those via
@@ -505,7 +505,7 @@ export type ReadFileStateShrink =
     transmissions: ReadonlyArray<string>;
 };
 export declare function applyContextShrinkToReadFileState(state: ReadFileState, shrink: ReadFileStateShrink): void;
-/** CC 2.1.198 verbatim skeleton: the ENOENT error body for a
+/** The ENOENT error body for a
  *  missing Read/Edit target — `File does not exist. Note: your current working directory is <cwd>.`
  *  plus a `Did you mean <sibling>?` correction when the parent directory holds a near-name (case
  *  variant / same stem different extension — the high-frequency self-heal path). Best-effort: a

package/dist/tools/fs/gh-rate-limit.d.ts

@@ -1,5 +1,5 @@
 /**
- * gh rate-limit hint (CC 2.1.198 parity).
+ * gh rate-limit hint.
  *
  * CC appends a one-shot <system-reminder> to a FOREGROUND Bash result when a `gh` invocation hits the
  * GitHub API rate limit, so the model sleeps/schedules instead of hammering retries. The command gate,

package/dist/tools/fs/notebook.d.ts

@@ -1,6 +1,6 @@
 import type { ImageContent } from "../../internal/llm.js";
 /**
- * The Read tool's Jupyter-notebook projection: `.ipynb` is rendered as cells with outputs (CC 2.1.220
+ * The Read tool's Jupyter-notebook projection: `.ipynb` is rendered as cells with outputs (reference
  * parity), never as raw JSON text. Raw-JSON rendering lets a notebook's base64 outputs overflow the
  * Read token cap, auto-paginate into an `isPartialView` entry, and thereby lock NotebookEdit out via
  * the requireRead gate — with the marker's own offset/limit hint pointing at a range that itself
@@ -80,7 +80,7 @@ export interface NotebookRender {
     imageChars: number;
 }
 /**
- * CC `eI_`/`tI_`/`Atd`: render projected cells to content blocks. Tag shape is CC-verbatim, including
+ * Render projected cells to content blocks. Tag shape is the reference's, including
  * the deliberately malformed closing tag `</cell id="X">`; `<cell_type>` only when not code,
  * `<language>` only for code cells whose language !== "python". Output text rides with a leading "\n"
  * and adjacent text blocks merge with "\n", so an all-text notebook collapses to a single text block.

package/dist/tools/fs/read-deny.d.ts

@@ -115,7 +115,7 @@ export declare function ruleHeadParts(rows: readonly Pick<PathRuleDenyRow, "head
  * below that part. Every part, not the head alone: a link inside the rule's literal prefix that is re-pointed after the
  * rows were placed still meets the row through the parts above it. One rule for every row form and every judge (the
  * gate's lanes and the deny tables): the reference compiles the same "physical twin" of every deny / ask rule's literal
- * prefix (cli280.js `ei` 9766583, compiled in `mt` 9767083). `leads` is the leg's resolution of each part (absent or
+ * prefix. `leads` is the leg's resolution of each part (absent or
  * `undefined` = no twin there); a part that only extends its parent's resolution adds no row. A twin is the row's own
  * kind (it keeps every member but the head), so a judgment reports the rule the twin stands for.
  */
@@ -416,12 +416,32 @@ export declare function activeReadDenyBuiltinTiers(config?: ReadDenyBuiltinConfi
  * renders "what COULD be switched on".
  */
 export declare const READ_FACE_DEFAULT_DENY_ENTRIES: readonly ReadDenyEntry[];
+/**
+ * The fold the "unicode" mode applies — the one a RegExp `i` flag without `u` applies, one UTF-16 code unit at a time: the
+ * upper-case mapping when it is a single unit and does not step from a non-ASCII unit down into ASCII (`ı` and `ſ` stay
+ * themselves, `ß` stays `ß`). Both sides of a comparison go through it.
+ */
+export declare function ignoreCaseFold(s: string): string;
+/** How a compiled pattern compares: `none` byte for byte; `ascii` and `unicode` through the fold of that name, both sides —
+ *  the pattern's side at compile, the segments' side by whoever tests (once per path: {@link segmentReadingsOf}). */
+export type SegmentFold = "none" | "ascii" | "unicode";
+/** The function that folds a string as each fold folds — the one place that says which function that is (the pattern at compile,
+ *  a path's segments in the readings, an anchor's segments all read it, at the time they fold). */
+export declare const SEGMENT_FOLDS: Record<SegmentFold, (s: string) => string>;
+/** One compiled segment of a pattern: `*` stands for any run of characters but a separator, every other character for itself. */
+export interface SegmentMatcher {
+    /** Does the whole of `segment` match? The segment is folded as the pattern's fold folds ({@link CompiledSegmentPattern.fold}) —
+     *  by the caller; a segment that holds a separator never matches. */
+    test(segment: string): boolean;
+    /** The pattern is stars only: it matches every one segment. */
+    readonly anything: boolean;
+}
 /** A compiled segment-run pattern (shared engine — the write guard delegates here too). */
 export interface CompiledSegmentPattern {
     raw: string;
-    segments: RegExp[];
-    /** Fold BOTH sides through {@link asciiLower} before testing (compile lowered the pattern side). */
-    foldAscii: boolean;
+    segments: SegmentMatcher[];
+    /** Fold BOTH sides before testing: compile folded the pattern side; the segments tested are folded the same way. */
+    fold: SegmentFold;
     /** The segment lists of the directories the run is ANCHORED at (folded as the pattern folds): the run must start
      *  right after one of them. Absent = the run matches anywhere. */
     anchors?: readonly (readonly string[])[];
@@ -437,12 +457,14 @@ export interface CompiledSegmentPattern {
  * Compile one segment-glob pattern (shared engine). `fold`:
  *  · "none"    — byte-exact segments;
  *  · "ascii"   — ASCII-case-insensitive (deny-set contract);
- *  · "unicode" — RegExp `i` flag (the write guard's historical host-keyed behavior — kept for it
- *    byte-identically; NOT used by the deny set).
+ *  · "unicode" — the fold a RegExp `i` flag applies, {@link ignoreCaseFold} (the write guard's historical host-keyed
+ *    behavior — kept for it answer for answer; NOT used by the deny set).
+ * The pattern is folded here, once; the segments a row is tested on are folded by whoever tests, once per path
+ * ({@link segmentReadingsOf}) — never once per row per test.
  * Returns null when the pattern reduces to zero segments — the CALLER owns its loud path (the two
  * consumers refuse with their own surface-specific texts).
  */
-export declare function compileSegmentPattern(raw: string, fold: "none" | "ascii" | "unicode"): CompiledSegmentPattern | null;
+export declare function compileSegmentPattern(raw: string, fold: SegmentFold): CompiledSegmentPattern | null;
 /**
  * Does the path contain a compiled pattern as a CONTIGUOUS run of full path segments? (Shared engine:
  * `.git/hooks` matches `/repo/.git/hooks/pre-commit`; `.ssh` matches any `.ssh` segment.) An ANCHORED pattern