@sema-agent/core 7.54.1 → 7.55.0

package/dist/tools/fs/read-deny.js

@@ -1,6 +1,7 @@
 import { sliceHeadSafe, sliceTailSafe } from "../../core/surrogate-safe-slice.js";
 import { isAbsoluteForFamily, normalizeAbsPathLexically, pathFamilyOf, pathIdentityOf, spellingOfIdentity } from "./safety.js";
 import { PROBE_REASON_MAX } from "../../core/untrusted-text.js";
+import { wildcardMatch } from "../../core/namespaced-rule-name.js";
 import { validatePath } from "../../core/effective-path-target.js";
 import { judgePathRows } from "../../core/path-guard-rows.js";
 export const READ_DENY_HOME_WORD = "~";
@@ -313,17 +314,54 @@ function asciiLower(s) {
     }
     return out;
 }
+let UNIT_FOLD;
+function foldedUnit(c) {
+    if (c < 0x80)
+        return c >= 0x61 && c <= 0x7a ? c - 0x20 : c;
+    const table = (UNIT_FOLD ??= new Int32Array(0x10000).fill(-1));
+    const known = table[c];
+    if (known >= 0)
+        return known;
+    const upper = String.fromCharCode(c).toUpperCase();
+    const folded = upper.length === 1 && upper.charCodeAt(0) >= 0x80 ? upper.charCodeAt(0) : c;
+    table[c] = folded;
+    return folded;
+}
+export function ignoreCaseFold(s) {
+    let out = "";
+    for (let from = 0; from < s.length; from += 4096) {
+        const codes = [];
+        for (let i = from, to = Math.min(from + 4096, s.length); i < to; i++)
+            codes.push(foldedUnit(s.charCodeAt(i)));
+        out += String.fromCharCode(...codes);
+    }
+    return out;
+}
+export const SEGMENT_FOLDS = { none: (s) => s, ascii: asciiLower, unicode: ignoreCaseFold };
+function foldSegments(fold, segs) {
+    return segs.map((s) => SEGMENT_FOLDS[fold](s));
+}
+function foldedViewsOf(views) {
+    const memo = new Map();
+    return (fold) => {
+        let folded = memo.get(fold);
+        if (folded === undefined)
+            memo.set(fold, (folded = fold === "none" ? views : views.map((segs) => foldSegments(fold, segs))));
+        return folded;
+    };
+}
+function segmentMatcher(pattern) {
+    return {
+        anything: /^\*+$/.test(pattern),
+        test: (segment) => !segment.includes("/") && wildcardMatch(pattern, segment),
+    };
+}
 export function compileSegmentPattern(raw, fold) {
-    const source = fold === "ascii" ? asciiLower(raw) : raw;
+    const source = SEGMENT_FOLDS[fold](raw);
     const parts = source.split("/").filter(Boolean);
     if (parts.length === 0)
         return null;
-    const flags = fold === "unicode" ? "i" : "";
-    const segments = parts.map((segment) => {
-        const escaped = segment.replace(/[.+^${}()|[\]\\?]/g, "\\$&").replace(/\*+/g, "[^/]*");
-        return new RegExp(`^${escaped}$`, flags);
-    });
-    return { raw, segments, foldAscii: fold === "ascii" };
+    return { raw, segments: parts.map(segmentMatcher), fold };
 }
 export function matchSegmentPatterns(path, compiled, opts) {
     const readings = segmentReadingsOf(path, opts?.aliasResolved === true);
@@ -339,7 +377,13 @@ function segmentReadingsOf(path, aliasResolved) {
     if (known !== undefined)
         return known;
     const views = segmentViewsOf(path, aliasResolved ? { aliasResolved } : undefined);
-    const readings = { views, lowered: views.map((v) => v.map(asciiLower)), rooted: isAbsoluteForFamily("own", path) };
+    let folded;
+    const readings = {
+        views,
+        lowered: views.map((v) => foldSegments("ascii", v)),
+        folded: () => (folded ??= views.map((v) => foldSegments("unicode", v))),
+        rooted: isAbsoluteForFamily("own", path),
+    };
     if (SEGMENT_READINGS.size >= 512)
         SEGMENT_READINGS.clear();
     SEGMENT_READINGS.set(key, readings);
@@ -347,7 +391,7 @@ function segmentReadingsOf(path, aliasResolved) {
 }
 function segmentRowMeets(pat, readings) {
     const n = pat.segments.length;
-    const views = pat.foldAscii ? readings.lowered : readings.views;
+    const views = pat.fold === "ascii" ? readings.lowered : pat.fold === "unicode" ? readings.folded() : readings.views;
     for (const segs of views) {
         const runAt = (i) => i + n <= segs.length && pat.segments.every((re, j) => re.test(segs[i + j] ?? ""));
         if (pat.anchors !== undefined && readings.rooted) {
@@ -406,16 +450,13 @@ function rowMeetsPath(pat, segs, rooted) {
     }
     return false;
 }
-function isAnySegment(re) {
-    return /^\^(\[\^\/\]\*)+\$$/.test(re.source);
-}
 function rowNamedByRoot(pat, segs, rooted) {
     if (pat.anchors !== undefined)
         return rooted && rowMeetsPath(pat, segs, rooted) ? "named" : "none";
     if (pat.rootedOnly === true)
         return "none";
     let k = 0;
-    while (k < pat.segments.length && isAnySegment(pat.segments[k]))
+    while (k < pat.segments.length && pat.segments[k].anything)
         k++;
     const run = pat.segments.slice(k);
     for (let i = 0; run.length > 0 && i < segs.length; i++) {
@@ -427,11 +468,11 @@ function rowNamedByRoot(pat, segs, rooted) {
 }
 function rowNamedByRootOf(rows, path) {
     const rooted = isAbsoluteForFamily("own", path);
-    const views = segmentViewsOf(path);
+    const foldedViews = foldedViewsOf(segmentViewsOf(path));
     let unplaced;
     for (const pat of rows) {
-        for (const view of views) {
-            const relation = rowNamedByRoot(pat, pat.foldAscii ? view.map(asciiLower) : view, rooted);
+        for (const view of foldedViews(pat.fold)) {
+            const relation = rowNamedByRoot(pat, view, rooted);
             if (relation === "named")
                 return { pattern: pat.raw };
             if (relation === "unplaced")
@@ -442,10 +483,10 @@ function rowNamedByRootOf(rows, path) {
 }
 function rowAtOrBelowOf(rows, path) {
     const rooted = isAbsoluteForFamily("own", path);
-    const views = segmentViewsOf(path);
+    const foldedViews = foldedViewsOf(segmentViewsOf(path));
     for (const pat of rows) {
-        for (const view of views)
-            if (rowMeetsPath(pat, pat.foldAscii ? view.map(asciiLower) : view, rooted))
+        for (const view of foldedViews(pat.fold))
+            if (rowMeetsPath(pat, view, rooted))
                 return pat.raw;
     }
     return null;
@@ -562,7 +603,7 @@ export function compileReadDeny(additions = [], layer = "additions", builtin, ru
             return { ...c, raw: e.pattern };
         if (homeSegments.length === 0)
             return { ...c, raw: e.pattern, unplacedHome: true };
-        return { ...c, raw: e.pattern, anchors: homeSegments.map((segs) => (fold === "ascii" ? segs.map(asciiLower) : segs)) };
+        return { ...c, raw: e.pattern, anchors: homeSegments.map((segs) => foldSegments(fold, segs)) };
     });
     if (!(linked instanceof Map))
         throw new Error(`readDenyHomeLinks: expected a Map from a row's pattern to its locations, got ${typeof linked}.`);
@@ -576,13 +617,13 @@ export function compileReadDeny(additions = [], layer = "additions", builtin, ru
         const rest = c.segments.slice(readDenyRunHead(run));
         for (const location of new Set(checkedReadDenyHomes(locations, "readDenyHomeLinks"))) {
             const segs = homeAnchorSegments(location);
-            linkedPlacements.push({ raw: e.pattern, segments: rest, foldAscii: c.foldAscii, anchors: [c.foldAscii ? segs.map(asciiLower) : segs], rootedOnly: true });
+            linkedPlacements.push({ raw: e.pattern, segments: rest, fold: c.fold, anchors: [foldSegments(c.fold, segs)], rootedOnly: true });
         }
     });
     const judged = linkedPlacements.length === 0 ? compiled : [...compiled, ...linkedPlacements];
     const segmentRows = judged.map((c) => {
         const col = columns.get(c.raw);
-        return segmentGuardRow(c, { faces: ["read"], polarity: "deny", exemptible: false, fold: c.foldAscii ? "ascii" : "exact", origin: col?.origin ?? "addition", ...(col?.tier !== undefined ? { tier: col.tier } : {}) });
+        return segmentGuardRow(c, { faces: ["read"], polarity: "deny", exemptible: false, fold: c.fold === "ascii" ? "ascii" : "exact", origin: col?.origin ?? "addition", ...(col?.tier !== undefined ? { tier: col.tier } : {}) });
     });
     const tableRows = [...segmentRows, ...ruleRows.map(ruleGuardRow)];
     const rgExclusionGlobs = [];

package/dist/tools/fs/removal-targets.d.ts

@@ -22,7 +22,7 @@ export interface DangerousRemoval {
 }
 /**
  * The ONE dangerous-removal predicate: is removing this absolute path removing a protected location? The reference
- * implementation's set (cli 2.1.291 `dme` / `xW`) — the filesystem root (a drive root, a UNC share root), a home directory
+ * implementation's set — the filesystem root (a drive root, a UNC share root), a home directory
  * (every spelling the seat holds), a workspace directory or any of its ANCESTORS (the task root, the working directory, an
  * additional working directory — whether the home lies inside the task root or the task root inside the home), a top-level
  * directory (one segment below the root). `undefined` for a relative path or any other target.

package/dist/tools/fs/safety.d.ts

@@ -57,7 +57,7 @@ export interface ReadEntry {
      *  attachment picks the most RECENTLY read files, the way CC sorts readFileState by timestamp.
      *  Optional/additive: undefined (an entry seeded from an older checkpoint) sorts last, never breaks. */
     lastReadAt?: number;
-    /** CC 2.1.204 parity: TRUE when the Runner pre-seeded this entry because the file's FULL
+    /** TRUE when the Runner pre-seeded this entry because the file's FULL
      *  disk-verbatim text was injected into the model's context at startup
      *  (ProjectMemoryLoad.seededFiles — CC's own memory preload). A DEFAULT whole-file Read of an
      *  UNCHANGED seeded file
@@ -84,7 +84,7 @@ export declare function sha256(content: string): string;
 export interface FsViolation {
     code: "path_not_in_root" | "not_read" | "stale" | "ambiguous_edit" | "invalid" | "read_path_denied" | "write_path_denied";
     /** Set on the `not_read` violation raised by an AUTO-TRUNCATED read
-     *  ({@link ReadEntry.isPartialView}) rather than by a never-read file. Both carry the same CC-verbatim
+     *  ({@link ReadEntry.isPartialView}) rather than by a never-read file. Both carry the same
      *  message; only this one needs {@link PARTIAL_VIEW_READ_ESCAPE_HINT} appended, because for it a plain
      *  re-read is a fixpoint. */
     partialView?: true;
@@ -238,7 +238,7 @@ export declare function binaryMagicFormat(bytes: Uint8Array): string | undefined
  */
 export declare function isBinaryContent(sample: string): boolean;
 /**
- * CC's own UNC/network-path predicate, verbatim (`n.startsWith("\\\\") || n.startsWith("//")`). Pure.
+ * The UNC/network-path predicate (`n.startsWith("\\\\") || n.startsWith("//")`). Pure.
  *
  * In CC this test is an EARLY ALLOW — it skips the binary-extension and device checks that follow it —
  * and CC applies it to the NORMALIZED path, not the raw argument. See {@link canonicalizeTarget} for
@@ -572,7 +572,7 @@ export declare function rootAdmittingArtifactStore(storePhysical: string, rootsC
  */
 export declare const PATH_NOT_IN_ROOT_ESCAPE_HINT = "(This boundary applies to the structured file tools. If you genuinely need content outside the allowed root(s), ask for the directory to be added to the deployment's additionalDirectories \u2014 or additionalReadDirectories for read-only access; a deployment that wants reads or writes open everywhere can declare readFace / writeFace: \"open\" instead of listing directories.)";
 /** inv 1 (read-before-edit): a file must have been read this task before it can be edited/overwritten.
- *  Message is CC 2.1.198 live-verbatim (all-tools-live-probe 2026-07-08 §2.1/§3.1/§5.1 — one message for
+ *  Message as probed (all-tools-live-probe 2026-07-08 §2.1/§3.1/§5.1 — one message for
  *  Edit/Write/NotebookEdit: "before writing to it", not the old sema "before editing").
  *
  * CC parity (Edit and Write spell the read gate identically, `!p || p.isPartialView`): an
@@ -594,7 +594,7 @@ export declare function requireRead(state: ReadFileState, key: string): FsViolat
  * Escape-hatch parenthetical appended to the read-before-edit refusal when the target file is over
  * the Read tool's whole-file byte cap: a bare "read it first" would be un-followable there (a default
  * whole-file Read refuses such files → refusal loop). Same parenthetical pattern as the Write tool's
- * encoding-deadlock hint; the CC-verbatim sentence stays untouched for the normal-size case.
+ * encoding-deadlock hint; the base sentence stays untouched for the normal-size case.
  */
 export declare const OVERSIZE_READ_ESCAPE_HINT = "(This file is over the Read tool's whole-file byte cap, so a default Read is refused \u2014 read it in slices with explicit offset/limit to satisfy the read-first rule, or inspect/transform it with bash (e.g. `sed -n`, `grep`) instead.)";
 /**
@@ -623,7 +623,7 @@ export declare const READ_REFUSED_ESCAPE_HINT = "(If the Read tool refuses this
 /**
  * Edit "no-op" guard (CC FileEditTool parity): refuse an edit whose `old_string`
  * equals `new_string` — without it the edit passes the match check and writes the file back unchanged (a
- * silent no-op that wastes a turn and dirties mtime). Verbatim CC message so a CC-trained model recognizes it.
+ * silent no-op that wastes a turn and dirties mtime). The message is worded so a CC-trained model recognizes it.
  */
 export declare function checkNoChange(oldString: string, newString: string): FsViolation | undefined;
 /** inv 2 (staleness): the file's current content hash must match what was recorded at read time.
@@ -667,7 +667,7 @@ export declare function resolveQuoteMatch(content: string, oldString: string): s
  */
 export declare function resolveEscapeMatch(content: string, oldString: string): string | undefined;
 /**
- * CC `YZu` verbatim: rewrite `newString` into the SAME spelling the matched
+ * Rewrite `newString` into the SAME spelling the matched
  * span uses. Without this, a match found through {@link resolveEscapeMatch} would replace an escaped
  * span with a literal-character replacement (or vice versa) and silently change the file's encoding
  * convention at that spot. Hex case follows what the file itself used, per-character where known and by
@@ -677,7 +677,7 @@ export declare function adaptNewStringEscapes(oldString: string, matchedOld: str
 /** CC `KZu` (@366558): the old_string shapes for which the escape layers above were even attempted —
  *  gates the explanatory note appended to a no-match refusal so it is never a false claim. */
 export declare function escapeMatchWasAttempted(oldString: string): boolean;
-/** CC `KZu`'s note, verbatim. */
+/** The escape-match miss note. */
 export declare const ESCAPE_MATCH_MISS_NOTE = "\n(note: Edit also tried swapping \\uXXXX escapes and their characters; neither form matched, so the mismatch is likely elsewhere in old_string. Re-read the file and copy the exact surrounding text.)";
 /**
  * When the quote-forgiving match resolved to a curly-quoted file span, convert the straight quotes in
@@ -697,7 +697,7 @@ export declare function deletionOldString(content: string, oldString: string, ne
 /**
  * inv 3 (edit uniqueness): `oldString` must match exactly once unless `replaceAll`. Zero → not found;
  * >1 without replaceAll → ambiguous. `truncated` adds a hint that unseen content may hold more matches (S2).
- * Messages are CC 2.1.198 live-verbatim (all-tools-live-probe 2026-07-08 §2.1): first sentence(s) byte-exact,
+ * Messages as probed (all-tools-live-probe 2026-07-08 §2.1): first sentence(s) byte-exact,
  * then a `String: <needle>` echo line (CC form). The sema truncated-read hint survives as a parenthetical
  * appended to the sentence (probe verdict: "truncated 提示可并入括注保留").
  */

package/dist/tools/fs/search.d.ts

@@ -11,7 +11,7 @@ export declare const JS_GREP_OUTPUT_MAX_BYTES: number;
  *  "any dot-prefixed name is invisible" rule beside it. */
 export declare const DEFAULT_IGNORE_DIRS: ReadonlySet<string>;
 export interface GrepParams {
-    /** Regular expression (ripgrep semantics) — CC 2.1.209 parity: the pattern is ALWAYS a regex; the
+    /** Regular expression (ripgrep semantics) — the pattern is ALWAYS a regex; the
      *  old `regex?: boolean` literal-by-default switch is retired (a legacy `regex` argument sent by an
      *  old caller is tolerated and ignored at the tool layer, never a failure). */
     pattern: string;
@@ -24,7 +24,7 @@ export interface GrepParams {
      *  line (rg -o / --only-matching). content mode only; ignored otherwise (CC parity). With
      *  `multiline` the JS fallback emits the matched SEGMENT's lines (rg -U -o shape). */
     only_matching?: boolean;
-    /** content: `path:line:text`. files_with_matches (default, CC 2.1.209): `path`. count: `path:count`. */
+    /** content: `path:line:text`. files_with_matches (default): `path`. count: `path:count`. */
     output_mode?: "content" | "files_with_matches" | "count";
     /** Lines of context around a match (content mode only) — CC's `-C`. */
     context?: number;
@@ -44,10 +44,10 @@ export interface GrepParams {
     /** Skip the first N output lines — CC's `offset` (pagination partner of head_limit). */
     offset?: number;
 }
-/** CC 2.1.198 Grep parity: split the `glob` param into individual glob
+/** Split the `glob` param into individual glob
  *  tokens — whitespace-separated first; a token WITHOUT braces is further split on commas
  *  (`"*.ts,*.tsx"` → two globs), while a brace token (`*.{ts,tsx}`) is kept whole (its commas are
- *  alternation syntax, not separators). CC-verbatim splitting rules. */
+ *  alternation syntax, not separators). */
 export declare function splitGlobParam(glob: string): string[];
 /**
  * POSIX-safe single-quote so an arbitrary model-supplied string can't break out of the shell command that
@@ -111,7 +111,7 @@ export interface WalkResult {
     skippedUnreadable: number;
     /** The walk was cut short by an abort — the result is a prefix, not a survey. */
     aborted: boolean;
-    /** CC 2.1.209 Glob parity: modification time (ms epoch) per walked path (files AND
+    /** Modification time (ms epoch) per walked path (files AND
      *  name-only entries), captured from the listing that discovered them — so glob can sort by mtime
      *  without a second stat pass. An env whose listings carry no numeric `mtimeMs` simply leaves
      *  entries out of this map (consumers fall back to name order). */
@@ -317,7 +317,7 @@ export declare function runGlob(env: ExecutionEnv, root: string, pattern: string
  *  shell renders (`filenames`/`numFiles`/`truncated`/`durationMs`/`totalMatches`/`countIsComplete`)
  *  without re-parsing the text.
  *
- *  CC207 backlog P2-2 (CC 2.1.206:397761-398004 = 2.1.207:342454-342633, node-sliced verbatim):
+ *  Backlog P2-2:
  *   · `totalMatches` — "Total number of matching files before truncation. A lower bound when
  *     countIsComplete is false." (CC: `totalMatches: g.length`)
  *   · `countIsComplete` — "Whether totalMatches is the exact total (true) or a floor because the

package/dist/tools/fs/shell-read-check.js

@@ -203,6 +203,11 @@ function fitCause(cause) {
 function faceOf(fold) {
     return fold.witness?.read.candidate.face === "write" ? "write" : undefined;
 }
+function reenteredPrograms(fold) {
+    const names = [...new Set((fold.reentered ?? []).flatMap((s) => (s.verb !== undefined ? [s.verb.basename] : [])))];
+    const quoted = names.map((n) => `"${fitMiddle(n, CAUSE_SPELLING_MAX)}"`);
+    return quoted.length === 0 ? "the program it runs" : quoted.length === 1 ? quoted[0] : `${quoted.slice(0, -1).join(", ")} and ${quoted.at(-1)}`;
+}
 function findingAccount(fold, boundary) {
     const w = fold.witness;
     const face = faceOf(fold);
@@ -228,7 +233,7 @@ function findingAccount(fold, boundary) {
             if (fold.declined?.unreadProgramText !== undefined)
                 return `"${fitMiddle(fold.declined.text.trim(), ACCOUNT_PART_MAX)}": ${fold.declined.unreadProgramText}, so where it ${verb} cannot be established ${NOT_AUTO_ALLOWED}`;
             if (fold.declined !== undefined)
-                return `"${fitMiddle(fold.declined.text.trim(), ACCOUNT_PART_MAX)}" runs its argument as shell text this station does not parse ${NOT_AUTO_ALLOWED}`;
+                return `the text given to ${reenteredPrograms(fold)} — as an argument, on standard input, or in the file it names — runs as shell text this station does not parse ${NOT_AUTO_ALLOWED}`;
             return `the command's text could not be read as shell, so where it ${verb} cannot be established ${NOT_AUTO_ALLOWED}`;
         case "declined":
             return fold.declined !== undefined ? declineSentence(fold.declined) : `the station could not read which program runs ${NOT_AUTO_ALLOWED}`;

package/dist/tools/fs/shell-read-judge.d.ts

@@ -358,6 +358,10 @@ export interface ShellReadFold {
     readonly finding: ShellReadFinding;
     readonly witness?: ReadFinding;
     readonly declined?: ShellReadSegment;
+    /** EVERY segment of the text that re-enters a shell (`sh -c S`, `eval S`, a launcher handing text to a shell, a shell fed on its
+     *  standard input) and so is at least `unestablishable`, in text order — `declined` holds only the first finding of the rank, and the
+     *  account of this question names each program, not the first. Present only with an `unestablished` fold. */
+    readonly reentered?: readonly ShellReadSegment[];
     /** What the judge did not finish, for an `unanswered` finding: the first thing the establishment recorded ({@link Incomplete.detail}). */
     readonly cause?: string;
     /** Some read of the text could not be established (an `unestablishable`, `unanswered` or `declined` finding anywhere, winning or not). */

package/dist/tools/fs/shell-read-judge.js

@@ -132,6 +132,7 @@ export function foldShellReadFindings(judged) {
     let best = { finding: "none" };
     let unestablished = false;
     let unplacedRead = false;
+    const reentered = [];
     const raise = (next) => {
         if (next.finding === "unestablishable" || next.finding === "declined" || next.finding === "unanswered") {
             const face = next.witness?.read.candidate.face;
@@ -158,8 +159,10 @@ export function foldShellReadFindings(judged) {
             if (!denyOnly) {
                 if (s.segment.declines.length > 0)
                     raise({ finding: "declined", declined: s.segment });
-                if (s.segment.reentry === "shell")
+                if (s.segment.reentry === "shell") {
                     raise({ finding: "unestablishable", declined: s.segment });
+                    reentered.push(s.segment);
+                }
                 if (s.segment.unreadProgramText !== undefined)
                     raise({ finding: "unestablishable", declined: s.segment });
                 const move = s.segment.baseMove;
@@ -177,7 +180,7 @@ export function foldShellReadFindings(judged) {
         unestablished = true;
         best = { finding: "unanswered", cause: unfinished.detail, ...(best.finding === "unestablishable" ? { ...(best.witness !== undefined ? { witness: best.witness } : {}), ...(best.declined !== undefined ? { declined: best.declined } : {}) } : {}) };
     }
-    return { ...best, ...(unestablished ? { unestablished: true } : {}), ...(unplacedRead ? { unplacedRead: true } : {}) };
+    return { ...best, ...(unestablished ? { unestablished: true } : {}), ...(unplacedRead ? { unplacedRead: true } : {}), ...(unestablished && reentered.length > 0 ? { reentered } : {}) };
 }
 export function judgeEstablishedPlan(plan, established, boundary, nestedOf) {
     return {

package/dist/tools/loop-tick.d.ts

@@ -19,9 +19,9 @@ export interface AutonomousLoopPromptOptions {
      */
     pushNotification?: boolean;
 }
-/** CC 2.1.209 `FFi` (:205310) — first-tick preamble, DEFAULT variant (steward framing). Verbatim through 2.1.259; the reference dropped this preamble from 2.1.278 on. */
+/** First-tick preamble, DEFAULT variant (steward framing). The reference later dropped this preamble. */
 export declare const AUTONOMOUS_LOOP_PREAMBLE = "# Autonomous loop check\n\nYou're being invoked on a timer while the user is away or occupied. The point is to keep work moving forward without the user driving every step \u2014 finishing things they started, maintaining PRs they're building, catching problems before they come back to find them. You're a steward, not an initiator. The user set you loose on their work, and the value you provide comes from reliably advancing things they've already set in motion, not from finding new things to do.\n\nThe key tension to navigate: the user trusts you enough to run autonomously, but that trust is easily lost. Acting on what the conversation already established is safe and valuable. Inventing new work or making irreversible changes without clear authorization erodes trust fast. When you're unsure whether something falls into \"continuing established work\" or \"inventing new work,\" lean toward the former only when the transcript provides clear evidence the user wanted it done. If you find yourself reaching for justifications about why a push is probably fine, that's a signal to wait.\n\n## What to act on\n\nThe current conversation is your highest-signal source \u2014 re-read the transcript above, since everything there is something the user was actively engaged with. The strongest signal is an in-progress PR you've been building together: review comments to address and resolve, failing CI checks to diagnose (and re-enqueue if they're flakes), merge conflicts to fix. The goal is to get the PR into a state where it's ready to merge pending only human review \u2014 the user shouldn't come back to find a PR blocked on things you could have handled. After that, look for unfinished implementation where the last exchange left something half-done, and explicit \"I'll also...\" or \"next I'll...\" commitments the conversation made and didn't honor. Weaker but still real: dangling questions you could now answer, verification steps that were skipped, edge cases that were mentioned but not handled, and natural continuations that don't require new decisions.\n\nIf you find anything in this category, act on it \u2014 actually do the work, don't describe what could be done. Run the tests, don't say \"you could run the tests.\" The whole point of autonomous operation is that work gets done while the user is away.\n\nWhen the conversation transcript has nothing left, the current branch's pull/merge request on the user's SCM is the next-best place to look. This is maintenance work \u2014 valuable, but lower priority than continuing the user's active work. Find the PR/MR for the current branch via the SCM's CLI, then check three things: CI status, unresolved review threads, and whether the branch has fallen behind the base. For failing CI, pull the failing job's logs and diagnose before acting \u2014 flaky-shaped failures (timeout, runner died, transient network) can be re-enqueued; real failures need a reproduction and a minimal fix. For unresolved review threads, fetch the comment, address the feedback, push, and resolve the thread via, for example, the GitHub GraphQL `resolveReviewThread` mutation (or the equivalent for whichever SCM the project uses). Before pushing anything, check whether someone else has pushed to the branch while you were working \u2014 if so, rebase (don't merge) to keep history clean.\n\nWhen CI is green, threads are clear, and there's idle time, sweeping the branch for issues is a good use of that time \u2014 bug-hunt or simplification passes catch problems before reviewers do, saving everyone a round-trip.\n\nIf everything is genuinely quiet \u2014 no conversation work, no PR maintenance \u2014 say so in one sentence and stop. No summary of what you checked, no list of what you might do later. The user will see your message in the transcript when they come back; three consecutive \"nothing to do\" results means you should scale back to a quick CI check and stop, not narrate.\n\n## Repeated invocations\n\nIf you see earlier autonomous checks in this conversation, adjust your scope accordingly. If a previous check left a question the user hasn't answered, the cost of acting depends on reversibility: for reversible actions (local edits, running tests), make your best call and proceed; for irreversible ones (pushing, deleting, sending), keep waiting \u2014 the cost of acting wrongly on something irreversible is much higher than the cost of waiting one more cycle. If three or more consecutive checks have found nothing actionable, things are quiet \u2014 do one quick CI/threads check and stop in a single line. Repeated \"nothing to do\" messages clutter the transcript and waste the user's attention when they come back to review.\n\nRead and analyze freely \u2014 understanding the state of things has no blast radius. Make edits and run tests when you're confident they continue established work. Commit and push only when you're clearly continuing something the user authorized, or when the work pattern makes the intent obvious \u2014 like fixing CI on a PR you've been building together.\n";
-/** CC 2.1.209 `w6c` (:205335) — first-tick preamble, PERSISTENT variant. Verbatim through 2.1.259; dropped from 2.1.278 on. */
+/** First-tick preamble, PERSISTENT variant. Later dropped by the reference. */
 export declare const AUTONOMOUS_LOOP_PREAMBLE_PERSISTENT = "# Autonomous loop check\n\nYou're being invoked on a timer while the user is away or occupied. The point is to keep work moving forward without the user driving every step \u2014 finishing things they started, maintaining PRs they're building, catching problems before they come back to find them, and following through on the *spirit* of the task they gave you, not just its literal scope. The user set you loose on their work, and the value you provide comes from reliably advancing things they've already set in motion.\n\nThe key tension to navigate: the user trusts you enough to run autonomously, but that trust is easily lost. Acting on what the conversation already established is safe and valuable. For irreversible actions (push, delete, send), require clear authorization in the transcript or use a reversible alternative (a draft, a local commit, a queued message). For reversible actions (edits, tests, drafts, exploration), bias toward acting \u2014 the cost of an unneeded local edit is near zero, and the cost of a stalled loop is high. When you're unsure whether something falls into \"continuing established work\" or \"inventing new work,\" lean toward continuing whenever the transcript gives you any reasonable thread to pull on.\n\n## What to act on\n\nThe current conversation is your highest-signal source \u2014 re-read the transcript above, since everything there is something the user was actively engaged with. The strongest signal is an in-progress PR you've been building together: review comments to address and resolve, failing CI checks to diagnose (and re-enqueue if they're flakes), merge conflicts to fix. The goal is to get the PR into a state where it's ready to merge pending only human review \u2014 the user shouldn't come back to find a PR blocked on things you could have handled. After that, look for unfinished implementation where the last exchange left something half-done, and explicit \"I'll also...\" or \"next I'll...\" commitments the conversation made and didn't honor. Weaker but still real: dangling questions you could now answer, verification steps that were skipped, edge cases that were mentioned but not handled, and natural continuations that don't require new decisions.\n\nIf you find anything in this category, act on it \u2014 actually do the work, don't describe what could be done. Run the tests, don't say \"you could run the tests.\" The whole point of autonomous operation is that work gets done while the user is away.\n\nWhen the conversation transcript has nothing left, the current branch's pull/merge request on the user's SCM is the next-best place to look. This is maintenance work \u2014 valuable, but lower priority than continuing the user's active work. Find the PR/MR for the current branch via the SCM's CLI, then check three things: CI status, unresolved review threads, and whether the branch has fallen behind the base. For failing CI, pull the failing job's logs and diagnose before acting \u2014 flaky-shaped failures (timeout, runner died, transient network) can be re-enqueued; real failures need a reproduction and a minimal fix. For unresolved review threads, fetch the comment, address the feedback, push, and resolve the thread via, for example, the GitHub GraphQL `resolveReviewThread` mutation (or the equivalent for whichever SCM the project uses). Before pushing anything, check whether someone else has pushed to the branch while you were working \u2014 if so, rebase (don't merge) to keep history clean.\n\nWhen CI is green, threads are clear, and there's idle time, sweeping the branch for issues is a good use of that time \u2014 bug-hunt or simplification passes catch problems before reviewers do, saving everyone a round-trip.\n\nIf everything is genuinely quiet \u2014 no conversation work, no PR maintenance \u2014 say so in one sentence and keep the loop alive. Before stopping, broaden once: re-read the original task framing, check whether earlier ticks deferred anything (\"I'll wait for X\"), and look at sibling PRs/branches the user owns. Persistence is the point of autonomous mode. Only stop if the original task is provably complete or the user said to stop. (Pacing \u2014 how long to wait before the next tick \u2014 is handled by the per-mode reminder appended to this preamble; don't try to manage delay from here.)\n\n## Repeated invocations\n\nIf you see earlier autonomous checks in this conversation, adjust your scope accordingly. If a previous check left a question the user hasn't answered, the cost of acting depends on reversibility: for reversible actions (local edits, running tests), make your best call and proceed; for irreversible ones (pushing, deleting, sending), keep waiting \u2014 the cost of acting wrongly on something irreversible is much higher than the cost of waiting one more cycle. If three or more consecutive checks have found nothing actionable, broaden scope once before considering stopping \u2014 re-read the original task, check sibling work, look for verification or polish steps that were skipped. A loop that quits the moment work goes quiet is less useful than one that waits.\n\nRead and analyze freely \u2014 understanding the state of things has no blast radius. Make edits and run tests when you're confident they continue established work. Commit and push only when you're clearly continuing something the user authorized, or when the work pattern makes the intent obvious \u2014 like fixing CI on a PR you've been building together.\n";
 /**
  * Resolve a fire-time prompt: if it is one of the two autonomous-loop sentinels, return the tick

package/dist/tools/scheduler-tools.js

@@ -1,7 +1,7 @@
 import { Type } from "typebox";
 import { defineTool, errorResult } from "../core/tools.js";
 import { hasScheduler, isValidCronExpr, } from "../core/scheduler.js";
-import { toolFace } from "../core/tool-catalog-entries.js";
+import { mountRuleFace, toolFace } from "../core/tool-catalog-entries.js";
 export const SCHEDULE_WAKEUP_TOOL_NAME = "ScheduleWakeup";
 export const AUTONOMOUS_LOOP_SENTINEL = "<<autonomous-loop>>";
 export const AUTONOMOUS_LOOP_DYNAMIC_SENTINEL = "<<autonomous-loop-dynamic>>";
@@ -201,6 +201,7 @@ Only use minute 0 or 30 when the user names that exact time and clearly means it
     const cronCreate = defineTool({
         name: "CronCreate",
         ...toolFace("cron-create"),
+        ruleFace: mountRuleFace("cron-create"),
         description: cronCreateDescription,
         parameters: Type.Object({
             prompt: Type.String({ description: "Self-contained instructions for the future task (it runs unattended)." }),
@@ -306,6 +307,7 @@ Only use minute 0 or 30 when the user names that exact time and clearly means it
     const cronCancel = defineTool({
         name: "CronDelete",
         ...toolFace("cron-delete"),
+        ruleFace: mountRuleFace("cron-delete"),
         description: "Cancel a cron job previously scheduled with CronCreate. Idempotent; ids also appear in CronList.",
         parameters: Type.Object({ id: Type.String({ description: "Job ID returned by CronCreate." }) }),
         execute: async (args) => {
@@ -329,6 +331,7 @@ Only use minute 0 or 30 when the user names that exact time and clearly means it
     const cronList = defineTool({
         name: "CronList",
         ...toolFace("cron-list"),
+        ruleFace: mountRuleFace("cron-list"),
         description: "List all cron jobs scheduled via CronCreate (id, when, label).",
         parameters: Type.Object({}),
         execute: async () => {
@@ -408,6 +411,7 @@ MOUNT NOTE: this host does not vouch for session-scoped scheduling, so a wakeup
     const scheduleWakeup = defineTool({
         name: SCHEDULE_WAKEUP_TOOL_NAME,
         ...toolFace("schedule-wakeup"),
+        ruleFace: mountRuleFace("schedule-wakeup"),
         description: `${SCHEDULE_WAKEUP_PROMPT}${wakeupMountNote}`,
         parameters: Type.Object({
             delaySeconds: Type.Optional(Type.Number({

package/dist/tools/task-list.d.ts

@@ -1,19 +1,19 @@
 import type { ToolSpec } from "../core/types.js";
 /**
- * design/119 (CC 2.1.198 parity) — the structured task-list tool family: `TaskCreate` / `TaskGet` /
- * `TaskUpdate` / `TaskList`. CC 198's upgrade path over TodoWrite: individual tasks with stable ids,
+ * design/119 — the structured task-list tool family: `TaskCreate` / `TaskGet` /
+ * `TaskUpdate` / `TaskList`. The upgrade path over TodoWrite: individual tasks with stable ids,
  * status transitions, dependencies (blocks/blockedBy), an optional owner, and free metadata — instead
- * of TodoWrite's replace-the-whole-list. CC209 对齐批B B3: the two families are MUTUALLY EXCLUSIVE and
- * this one is the DEFAULT — TodoWrite mounts only when the task list is explicitly off (the CC 209
+ * of TodoWrite's replace-the-whole-list. The two families are MUTUALLY EXCLUSIVE and
+ * this one is the DEFAULT — TodoWrite mounts only when the task list is explicitly off (the reference
  * shape: TodoWrite isEnabled = !taskList; see `scenarios/full-body.ts`).
  *
  * State default: like TodoWrite, the default store lives in this factory's closure — FRESH per task
  * and torn down with it; nothing durable, no deps, no egress (the model's own scratch, projected to
- * observers only through each call's tool result / `details`). Descriptions follow CC 2.1.198
+ * observers only through each call's tool result / `details`). Descriptions follow the reference
  * (product-specific lines — teammate assignment, spinner/UI wording — trimmed or generalized).
  *
- * design/147 §6 D2 (CC 2.1.216 shared team task list): pass a {@link TaskListStore} to share ONE
- * task list across several agents — CC 216's team coordination artifact ("Check the task list
+ * design/147 §6 D2 (shared team task list): pass a {@link TaskListStore} to share ONE
+ * task list across several agents — the reference's team coordination artifact ("Check the task list
  * periodically. Create new tasks when work should be divided. Mark tasks resolved when complete.")
  * is a task-list file under the team directory; the sema equivalent is this storage seam. A
  * deployment mounts the SAME store instance into each teammate's tool bundle (same session = same

package/dist/tools/task-list.js

@@ -1,5 +1,5 @@
 import { Type } from "typebox";
-import { toolFace } from "../core/tool-catalog-entries.js";
+import { mountRuleFace, toolFace } from "../core/tool-catalog-entries.js";
 const STATUS = Type.Union([
     Type.Literal("pending"),
     Type.Literal("in_progress"),
@@ -98,6 +98,7 @@ export function createTaskListTools(store) {
     const taskCreate = {
         name: "TaskCreate",
         ...toolFace("task-create"),
+        ruleFace: mountRuleFace("task-create"),
         description: "Use this tool to create a structured task list for your current session. This helps you track progress, organize complex tasks, and demonstrate thoroughness.\n" +
             "It also helps the user understand the progress of the task and overall progress of their requests.\n" +
             "\n" +
@@ -170,6 +171,7 @@ export function createTaskListTools(store) {
     const taskGet = {
         name: "TaskGet",
         ...toolFace("task-get"),
+        ruleFace: mountRuleFace("task-get"),
         description: "Use this tool to retrieve a task by its ID from the task list.\n" +
             "\n" +
             "## When to Use This Tool\n" +
@@ -201,6 +203,7 @@ export function createTaskListTools(store) {
     const taskUpdate = {
         name: "TaskUpdate",
         ...toolFace("task-update"),
+        ruleFace: mountRuleFace("task-update"),
         description: "Use this tool to update a task in the task list.\n" +
             "\n" +
             "## When to Use This Tool\n" +
@@ -394,6 +397,7 @@ export function createTaskListTools(store) {
     const taskList = {
         name: "TaskList",
         ...toolFace("task-list"),
+        ruleFace: mountRuleFace("task-list"),
         description: "Use this tool to list all tasks in the task list.\n" +
             "\n" +
             "## When to Use This Tool\n" +

package/dist/tools/todo.js

@@ -1,11 +1,12 @@
 import { Type } from "typebox";
 import { errorResult } from "../core/tools.js";
-import { toolFace } from "../core/tool-catalog-entries.js";
+import { mountRuleFace, toolFace } from "../core/tool-catalog-entries.js";
 export function createTodoWriteTool() {
     const lists = new Map();
     return {
         name: "TodoWrite",
         ...toolFace("todo-write"),
+        ruleFace: mountRuleFace("todo-write"),
         description: "Create and update a task list for the current session. The list is rendered to the user as your working plan.\n" +
             "\n" +
             '- Each todo has `content`, `status` ("pending" | "in_progress" | "completed"), and `activeForm` (present-tense label shown while in progress).\n' +

package/dist/tools/web.d.ts

@@ -103,7 +103,7 @@ export declare const WEBFETCH_SUMMARY_MAX_CONTENT = 100000;
 export declare const WEBFETCH_SUMMARY_GUIDELINES: string;
 /**
  * sema's own grounding clause for the reference summarizer (ruled 2026-08-05), kept OUT of
- * {@link WEBFETCH_SUMMARY_GUIDELINES} so that block stays the byte-verbatim CC anchor it is documented to
+ * {@link WEBFETCH_SUMMARY_GUIDELINES} so that block stays the fixed block it is documented to
  * be. Interpolated BEFORE it, so the CC block remains the prompt's fixed tail.
  *
  * Two failure modes observed in the field, both of which produce a confident, well-formed, wrong answer: