@sema-agent/core 7.54.1 → 7.56.0

package/dist/core/session-policy-store.d.ts

@@ -8,10 +8,12 @@
  * must match this InMemory one byte-for-byte — a cross-backend equivalence test is the contract).
  *
  * Safety model:
- * - **tighten-only by default**: a NORMAL write may only ADD denies / NARROW allowlists / NARROW allowDirs. A
- *   write that LOOSENS (removes a deny, widens an allowlist/allowDirs) is REFUSED unless it is an OPERATOR
- *   write. core has NO role system — `operator` is a boolean the caller FREEZES from a verified principal
- *   (mirrors `steer.trusted`); core never adjudicates operator-ness, it only honors the flag.
+ * - **tighten-only below what an operator wrote**: a NORMAL write may not loosen the row's operator part
+ *   ({@link StoredSessionRules.operatorRules}: what the last operator write set; absent, the whole row) — above it, it
+ *   may take back what normal writes added (a deny, its own allowlist or allowDirs narrowing). The one `putRules` is
+ *   the write port and the delete port alike: a rule leaves every gate that reads the row when the row stops holding it.
+ *   core has NO role system — `operator` is a boolean the caller FREEZES from a verified principal (mirrors
+ *   `steer.trusted`); core never adjudicates operator-ness, it only honors the flag.
  * - **CAS rev** (optimistic concurrency): a `putRules` with a stale `expectedRev` is rejected, so two replicas
  *   can't lose an update (mirrors the checkpoint store's `resolve` OCC).
  * - **one grammar**: the two rule buckets hold rule ENTRIES — the grammar every entry list reads, through its one reader
@@ -19,8 +21,9 @@
  *   path rule, a name or host rule. Entries are stored as written; every station that validates, compares, matches or
  *   names one reads that reader's answer ({@link judgeSessionRulesWrite}, {@link loosenReasons}, the run-time layer).
  * - **a row keeps its grammar**: the write judge stamps the grammar it read the entries in ({@link SESSION_RULES_GRAMMAR}), and
- *   every station reads a row's entries in the grammar the row carries ({@link readSessionRulesShape}) — a row stored before
- *   the stamp keeps the reading it was written under, so an upgrade never turns a stored entry into a grant.
+ *   every station reads a row's entries in the grammar the row carries ({@link readSessionRulesShape}) — an entry keeps the meaning
+ *   its writer's grammar gave it, one that grammar could not read takes this engine's, and a row whose entries the two grammars
+ *   read differently is announced ({@link earlierGrammarReads}).
  * - **rules are read as rules or not at all**: rules whose shape cannot be read, or whose toolDeny holds an entry no grammar
  *   reads ({@link unreadableDenyEntries}), refuse every call until an operator writes them afresh — never read as fewer.
  * - **NOT A SANDBOX**: a shell command rule reads the command line the call carries (every program run in its connector
@@ -60,10 +63,33 @@ export type SessionRuleEntryField = {
  *    `*`, one more name no tool carried, which voided nothing beside it;
  *  - 1, the one entry reader taking its tool name from the lenient rule parser (trimmed before a `(`, any character but a
  *    blank, a parenthesis or a control / format character);
- *  - 2, the rule syntax's tool-name head (`ruleSpellingOf`): a name is read as written, in the characters names are minted in.
- * An entry this grammar reads as no rule in a row an earlier grammar wrote reads as `earlier_grammar` ({@link compileSessionRuleBucket}).
+ *  - 2, the rule syntax's tool-name head (`ruleSpellingOf`): a name is read as written, in the characters names are minted in;
+ *  - 3, the whole-protocol names (`mcp__*`, `mcp__*__*`, see `wholeProtocolOf`) read as a deny rule in `toolDeny` — every tool of the
+ *    protocol — where grammar 2 read them as an entry that names nothing. An engine of grammar 2 given a row written in grammar 3
+ *    refuses it ({@link grammarOf}) rather than read the deny as nothing;
+ *  - 4, the delegation tool's type rules (`Agent(<subagent_type>)`) read as a rule on the agent type the call runs — where grammar 3
+ *    read them as an entry with no rule form (and its write judge refused one) — and a Bash pattern (`Bash(git * main)`, a star
+ *    anywhere but the two trailing markers) reads as the `pattern` match form — where grammar 3 had no form for it — so an engine of
+ *    grammar 3 given a row written in grammar 4 refuses it rather than read an `Agent(…)` or `Bash(<pattern>)` deny as nothing;
+ *  - 5, a `*` in a tool name is the name grammar's pattern: in `toolDeny` anywhere in the name, over the whole name (`Re*d`, `*` —
+ *    every tool), where grammar 4 read `*` and a `*` in a protocol peer as entries that name nothing, `Re*d` as an exact name and a
+ *    name starting with `*` as no rule; in `toolAllow` it grants nothing by itself and the entries beside it keep their reading,
+ *    where grammars 1–4 voided a list holding it. An engine of grammar 4 given a row written in grammar 5 refuses it rather than
+ *    read a `*` deny as nothing. In the same revision a host pattern with an empty label (`WebFetch(domain:.evil.test)`) or a `*`
+ *    the URL parser folds (`＊.`) is no rule, where grammar 4 read the exact host it spelled; an earlier row's such entry reads as no rule.
+ * A row an earlier grammar wrote keeps the meaning that grammar gave its entries, and an entry that grammar could not read takes
+ * this one's ({@link earlierGrammarReads}, over the revisions above as one table); an entry this grammar reads as no rule reads as
+ * `earlier_grammar` ({@link compileSessionRuleBucket}).
+ *
+ * The persisted rule store stamps the same number on each bucket it writes (and the rule-sync wire on each state it sends):
+ * a stored rule's text is a `Tool(content)` entry read by the same parser, so every revision of what such a text means is a
+ * revision counted here. A revision that touches only the entry list (a tool-name head, a protocol name) moves the persisted
+ * stamp too, and an engine before it then refuses a bucket it could have read — the refusing side. The persisted store keeps
+ * no earlier reading: its rows are read in this grammar whatever stamp at or below it they carry, so a revision that changes
+ * what an existing persisted rule text means owes that store a reading of its earlier stamps, as {@link earlierGrammarReads}
+ * is for entries. Every stamp is judged by {@link readRuleGrammarStamp}.
  */
-export declare const SESSION_RULES_GRAMMAR = 2;
+export declare const SESSION_RULES_GRAMMAR = 5;
 /** {@link SessionPermissionRules} plus the monotonic `rev` the store stamps (the OCC key). */
 export interface StoredSessionRules extends SessionPermissionRules {
     rev: number;
@@ -75,18 +101,31 @@ export interface StoredSessionRules extends SessionPermissionRules {
     /** The rule grammar the row's entries are read in ({@link SESSION_RULES_GRAMMAR}), stamped by the write judge. Absent =
      *  a row stored before the stamp: grammar 0. */
     grammar?: number;
+    /** The row's OPERATOR PART: the buckets (and their grammar) the last operator write set — the line a non-operator write
+     *  may not loosen ({@link judgeSessionRulesWrite}). Minted by the write judge alone, and present only once a non-operator
+     *  write stamped the row (it carries the part it was judged against; over no row, the part of the value it wrote when that
+     *  value is a stored row — a rev from 1 — else an empty part). ABSENT = the whole row is the operator's: an operator write, and a row stored before
+     *  the member, read fail-closed. Never enforced itself — the row's buckets are what every gate reads. */
+    operatorRules?: SessionPermissionRules & {
+        grammar: number;
+    };
 }
-/** A rules value as the shape reading hands it on ({@link readSessionRulesShape}): its buckets, and the grammar its entries
- *  are read in — resolved, so a store that serves it on beside its own counters serves the row's grammar with it. */
+/** A rules value as the shape reading hands it on ({@link readSessionRulesShape}): its buckets, the grammar its entries
+ *  are read in — resolved, so a store that serves it on beside its own counters serves the row's grammar with it — and the
+ *  row's operator part when it carries one ({@link StoredSessionRules.operatorRules}). */
 export type SessionRulesInGrammar = SessionPermissionRules & {
     grammar: number;
+    operatorRules?: SessionPermissionRules & {
+        grammar: number;
+    };
 };
 /** Options for {@link SessionPolicyStore.putRules}. */
 export interface PutRulesOptions {
     /** CAS: reject the write if the stored `rev` is not this (optimistic concurrency). Omit to skip the check. */
     expectedRev?: number;
-    /** When true, this write MAY loosen the rules (remove a deny / widen an allowlist or allowDirs). A NORMAL
-     *  (non-operator) write is TIGHTEN-ONLY. core does NOT verify operator-ness — the caller (service) FREEZES
+    /** When true, this write MAY loosen the rules (remove a deny / widen an allowlist or allowDirs), and what it writes is
+     *  the operator's whole. A NORMAL (non-operator) write may not loosen the row's operator part
+     *  ({@link StoredSessionRules.operatorRules}). core does NOT verify operator-ness — the caller (service) FREEZES
      *  this from a verified, role-checked principal (mirrors `steer.trusted`). */
     operator?: boolean;
 }
@@ -105,7 +144,7 @@ export interface SessionRuleEntryRefusal extends AllowEntryInertDetail {
     reason: AllowEntryInertReason;
 }
 /** Typed error from {@link SessionPolicyStore.putRules}. `conflict` = stale `expectedRev`; `loosen_forbidden`
- *  = a non-operator write tried to relax the rules; `corrupt` = a backend could not read what it stored (a row, or the
+ *  = a non-operator write tried to relax what an operator wrote; `corrupt` = a backend could not read what it stored (a row, or the
  *  erase-surviving rev mark of {@link SessionPolicyStore.deleteBySession}) and refuses rather than read it as fewer rules or
  *  stamp an unproven rev; `invalid_shape` = the rules value is not an object of buckets, each a list of strings
  *  ({@link readSessionRulesShape}); `inert_entry` = a bucket holds an entry the entry reader reads as nothing. `detail` is
@@ -142,8 +181,9 @@ export interface SessionRulesRecord {
 export interface SessionPolicyStore {
     getRules(sessionId: string, principal?: string): Promise<StoredSessionRules | null>;
     /** Write the rules for a key through the one write judge ({@link judgeSessionRulesWrite}): CAS on `expectedRev`, the
-     *  shape, every entry's reading (operator writes included), then, for a non-operator write over an existing row, the
-     *  tighten-only check — each refusal a {@link SessionPolicyError}, and nothing is written. */
+     *  shape, every entry's reading (operator writes included), then, for a non-operator write, the check against the row's
+     *  operator part — each refusal a {@link SessionPolicyError}, and nothing is written. The same call is the delete port: a
+     *  value without an entry takes it out of every gate that reads the row. */
     putRules(sessionId: string, principal: string | undefined, rules: SessionPermissionRules, opts?: PutRulesOptions): Promise<StoredSessionRules>;
     /**
      * 2c session-sync: every (principal, rules) record for `sessionId` across ALL principals — `getRules`
@@ -193,13 +233,33 @@ export interface SessionPolicyStore {
  * backend should keep `allowDirs` to real directories; a future symlink-aware write-time canonicalize closes it.
  */
 declare function lexWithin(root: string, p: string): boolean;
+/**
+ * THE ONE JUDGE of a rule grammar stamp, whichever store carries it — a session-rules row ({@link readSessionRulesShape}),
+ * the persisted rule store's bucket and the rule-sync wire: the grammar the stamped rules are read in, or the fault that
+ * makes them unreadable. `absent` is what a missing stamp reads as (each store says what its unstamped rules were written
+ * in). A stamp is a whole number no greater than {@link SESSION_RULES_GRAMMAR}: a later grammar is one this engine cannot
+ * read the rules in, and reading them in an older one could grant what their writer refused or drop a refusal it cannot
+ * name — so they are refused WHOLE (`later`), never read in part. `rules` names the stamped rules in the sentence, `held`
+ * what they hold (`entries`, `rows`).
+ */
+export declare function readRuleGrammarStamp(stamp: unknown, absent: number, words: {
+    readonly rules: string;
+    readonly held: string;
+}): {
+    grammar: number;
+} | {
+    got: string;
+    sentence: string;
+    later?: true;
+};
 /**
  * THE ONE SHAPE READING of a rules value — what every station that takes one reads it through: the write (incoming rules),
  * a store's read-back of its own rows, the tighten comparison's prior, the run-time layer's served row. A rules value is an
  * object whose keys are buckets ({@link SessionPermissionRules}); each bucket present is a list of strings (`allowDirs`: of
  * non-blank strings — a directory is no blank). A bucket's TYPE is all this reads: what an entry means is the entry reader's,
  * in the grammar the value is written in ({@link grammarOf}), handed on as `grammar`. The store's counters (`rev`, `gen`) are
- * passed over, and a key holding `undefined` holds nothing. Anything else is a fault, named by key and by TYPE, never by value —
+ * passed over, the row's operator part is read as rules of its own and handed on ({@link readOperatorPart}), and a key
+ * holding `undefined` holds nothing. Anything else is a fault, named by key and by TYPE, never by value —
  * a bare string is never one rule and never its characters (`"rm"` spread into `["r","m"]`), and a key outside the buckets is
  * never dropped (a dropped deny is a deny nobody enforces).
  */
@@ -227,15 +287,17 @@ export declare function normalizeRules(rules: unknown): SessionPermissionRules;
 export declare function unreadableDenyEntries(rules: SessionRulesInGrammar, roster?: ReadonlySet<string>): AllowEntryInert[];
 /**
  * THE LIST READING of one rule bucket of a rules value the shape reading read — what the run-time layer enforces, the tighten
- * comparison compares and the write judge refuses on: `compileAllowList` over the one entry reader, in the bucket's direction,
- * against `roster` when given, in the grammar the value is written in. An entry its grammar reads as nothing
- * ({@link earlierGrammarReads}) is moved to the entries that read as nothing, reason `earlier_grammar`, before the list is
- * compiled: it is one entry that reads as nothing, and the list beside it is read as written. The move is an ENTRY's reading and
- * never the list's: an allow list a `*` voids (in any spelling the voiding test reads as `*`, `* (*)` included) is voided in
- * every grammar from 1 on, so in such a row the list is read whole, as written — only grammar 0, where `*` was one more name, takes
- * it out alone.
+ * comparison compares and the write judge refuses on: the one entry reader over each entry, in the bucket's direction, against
+ * `roster` when given, in the grammar the value is written in ({@link earlierGrammarReads}: an entry keeps the meaning its
+ * writer's grammar gave it, and one that grammar could not read takes this engine's). The reading is an entry's — save the one
+ * list reading a row keeps: grammars 1–4 voided an allow list holding `*` (in any spelling their voiding test read as `*`, `* (*)`
+ * included), so such a row's allow list grants nothing; from grammar 5 a `*` grants nothing by itself and the list beside it is read
+ * as written. The entries that read as nothing are listed in order, those an earlier grammar reads so (`earlier_grammar`) last.
  */
 export declare function compileSessionRuleBucket(rules: SessionRulesInGrammar, field: SessionRuleEntryField, roster?: ReadonlySet<string>): ReturnType<typeof compileAllowList>;
+/** The entries of one bucket a stored row's earlier grammar announces ({@link earlierGrammarReads}: its writer's meaning and this
+ *  grammar's differ) — what `config.session_rules_earlier_grammar` names, one bucket at a time. */
+export declare function earlierGrammarEntries(rules: SessionRulesInGrammar, field: SessionRuleEntryField): string[];
 /**
  * The advisory for the entries of one bucket a stored row's earlier grammar reads as nothing ({@link compileSessionRuleBucket},
  * `earlier_grammar`; `grammar` = the row's): the session, the bucket, the entries as written, what they do and the way out. An
@@ -245,9 +307,10 @@ export declare function compileSessionRuleBucket(rules: SessionRulesInGrammar, f
  * to make a parenthesized one the rule it now spells, or (`*`, which is no allow rule in any grammar) to leave it out.
  */
 export declare function earlierGrammarAdvisory(sessionId: string, entries: readonly string[], field: SessionRuleEntryField, grammar: number): string;
-/** The reader's word for one entry an earlier grammar reads as nothing: `no_rule` — this engine's rule grammar reads it as no
- *  rule; `named_no_tool` — a grammar-0 allow entry the bare-name comparison of its day read as naming no tool. */
-export type EarlierGrammarReader = "no_rule" | "named_no_tool";
+/** The reader's word for one entry an earlier grammar announces: `no_rule` — this engine's rule grammar reads it as no rule;
+ *  `named_no_tool` — a grammar-0 allow entry the bare-name comparison of its day read as naming no tool; `grammar_revised` — a
+ *  grammar revision after the row's gave the entry another meaning, and the message names both and which one the rules enforce. */
+export type EarlierGrammarReader = "no_rule" | "named_no_tool" | "grammar_revised";
 /**
  * The notice for the entries of one bucket a stored row's earlier grammar reads as nothing (`config.session_rules_earlier_grammar`,
  * audience `user` — the session's rules are what the person's calls are judged by): the message is {@link earlierGrammarAdvisory}
@@ -277,14 +340,18 @@ export declare function earlierGrammarAnnouncer(sink: ((entries: readonly string
  * the rules to stamp, or a {@link SessionPolicyError}, in this order — `conflict` (a stale `expectedRev` against `prior`'s rev),
  * `invalid_shape` ({@link normalizeRules}), `inert_entry` (an entry that reads as nothing in the grammar the rules are written
  * in; operator writes included — a rule that names nothing guards nothing whoever writes it), then, for a non-operator write
- * over an existing row, `loosen_forbidden` ({@link loosenReasons}) — or `corrupt` when that prior cannot be read as rules,
- * which the comparison never reads as fewer. The rules to stamp carry `grammar` = {@link SESSION_RULES_GRAMMAR}: what passed
- * the judge means the same in this engine's grammar, and THIS is the one place the stamp is minted, so every store that
- * stores what the judge returns keeps it. `mountedToolNames` = the store's declaration ({@link SessionPolicyStoreOptions.mountedToolNames}).
+ * over a row, `loosen_forbidden` ({@link loosenReasons}) against the row's OPERATOR PART ({@link StoredSessionRules.operatorRules};
+ * absent, the whole row) — or `corrupt` when that prior cannot be read as rules, which the comparison never reads as fewer.
+ * Over no row there is no rev to compare and no tighten gate, and a judge called with `prior = null` (a host's pre-read of a
+ * value's shape and entries) answers only those two content refusals. Below what an operator wrote nothing moves; above it,
+ * a non-operator takes back what non-operator writes added. The
+ * rules to stamp carry `grammar` = {@link SESSION_RULES_GRAMMAR} — what passed the judge means the same in this engine's
+ * grammar — and, from a non-operator write, the operator part it was judged against: over no row, the value's own when it is a
+ * stored row handed in ({@link isStoredRow}), else an empty one (an operator write's whole value is the operator's, so it
+ * carries none). THIS is the one place both stamps are minted, so every store that stores what the judge
+ * returns keeps them. `mountedToolNames` = the store's declaration ({@link SessionPolicyStoreOptions.mountedToolNames}).
  */
-export declare function judgeSessionRulesWrite(prior: StoredSessionRules | null, rules: unknown, opts: PutRulesOptions | undefined, mountedToolNames?: ReadonlySet<string>): SessionPermissionRules & {
-    grammar: number;
-};
+export declare function judgeSessionRulesWrite(prior: StoredSessionRules | null, rules: unknown, opts: PutRulesOptions | undefined, mountedToolNames?: ReadonlySet<string>): SessionRulesInGrammar;
 /**
  * Pure tighten-only diff: the reasons `next` LOOSENS `prior` (empty ⇒ `next` is a pure tightening or no-op), over the EFFECTIVE
  * entries of each rule bucket — the list as the run-time layer enforces it ({@link effectiveEntries}). Rules whose toolDeny holds
@@ -321,7 +388,7 @@ export declare function continuesLineage(a: {
 }): boolean;
 /**
  * In-process default {@link SessionPolicyStore} (single-replica). A deployment that needs cross-replica
- * durability supplies its own backend with the SAME CAS-rev + tighten-only semantics. Single-threaded JS makes
+ * durability supplies its own backend with the SAME CAS-rev + write-judge semantics. Single-threaded JS makes
  * the read-check-write trivially atomic here; a durable backend folds it into a CAS WHERE clause.
  */
 export declare class InMemorySessionPolicyStore implements SessionPolicyStore {

package/dist/core/session-policy-store.js

@@ -4,12 +4,15 @@ import { NAMESPACED_NAME_SHAPES } from "./protocol-table.js";
 import { callerToolNameProblem } from "./caller-tool-name.js";
 import { compileAllowList, compiledEntryName, inertEntryPhrase, readRuleEntry, renderListEntry, rootFacingToolNames } from "./allow-entry.js";
 import { valueTypeLabel } from "./tool-name-list.js";
-import { noticeRuleText } from "./permission-rule-model.js";
+import { NAME_RULE_FACES, noticeRuleText } from "./permission-rule-model.js";
+import { parsePermissionRule, ruleSpellingOf } from "./permission-rule-syntax.js";
+import { splitNamespacedName } from "./tool-name-aliases.js";
 const SESSION_RULE_BUCKETS = { toolAllow: "allow", toolDeny: "deny", allowDirs: "dirs" };
 const BUCKETS = Object.keys(SESSION_RULE_BUCKETS);
 const ENTRY_FIELDS = BUCKETS.filter((f) => SESSION_RULE_BUCKETS[f] !== "dirs");
 const STORE_STAMPS = new Set(["rev", "gen", "grammar"]);
-export const SESSION_RULES_GRAMMAR = 2;
+const OPERATOR_PART = "operatorRules";
+export const SESSION_RULES_GRAMMAR = 5;
 export class SessionPolicyError extends Error {
     code;
     detail;
@@ -53,18 +56,26 @@ function lexWithin(root, p) {
         return true;
     return np === nr || np.startsWith(nr + "/");
 }
+function isStoredRow(value) {
+    const rev = value.rev;
+    return typeof rev === "number" && Number.isInteger(rev) && rev >= 1;
+}
 function grammarOf(value) {
     const stamp = value.grammar;
+    return readRuleGrammarStamp(stamp, stamp === undefined && isStoredRow(value) ? 0 : SESSION_RULES_GRAMMAR, { rules: "session rules", held: "entries" });
+}
+export function readRuleGrammarStamp(stamp, absent, words) {
     if (stamp === undefined)
-        return { grammar: value.rev !== undefined ? 0 : SESSION_RULES_GRAMMAR };
+        return { grammar: absent };
     if (typeof stamp !== "number" || !Number.isInteger(stamp) || stamp < 0) {
         const got = typeof stamp === "number" ? "a number that is not a whole number of 0 or more" : valueTypeLabel(stamp);
-        return { got, sentence: `session rules carry a grammar stamp that is ${got} — the stamp is the whole number of the rule grammar the rules were written in (this engine reads grammar ${SESSION_RULES_GRAMMAR})` };
+        return { got, sentence: `${words.rules} carry a grammar stamp that is ${got} — the stamp is the whole number of the rule grammar the rules were written in (this engine reads grammar ${SESSION_RULES_GRAMMAR})` };
     }
     if (stamp > SESSION_RULES_GRAMMAR) {
         return {
             got: `${stamp}, a grammar newer than this engine's (${SESSION_RULES_GRAMMAR})`,
-            sentence: `session rules were written in rule grammar ${stamp}, newer than this engine reads (grammar ${SESSION_RULES_GRAMMAR}) — refusing rather than read their entries in an older grammar; an engine that reads grammar ${stamp} reads them`,
+            sentence: `${words.rules} were written in rule grammar ${stamp}, newer than this engine reads (grammar ${SESSION_RULES_GRAMMAR}) — refusing rather than read their ${words.held} in an older grammar; an engine that reads grammar ${stamp} reads them`,
+            later: true,
         };
     }
     return { grammar: stamp };
@@ -82,6 +93,13 @@ export function readSessionRulesShape(value) {
     for (const [key, v] of Object.entries(value)) {
         if (STORE_STAMPS.has(key) || v === undefined)
             continue;
+        if (key === OPERATOR_PART) {
+            const part = readOperatorPart(v);
+            if ("fault" in part)
+                return part;
+            rules.operatorRules = part.rules;
+            continue;
+        }
         if (!Object.hasOwn(SESSION_RULE_BUCKETS, key)) {
             return fault(key, "not a rule bucket", `session rules hold ${JSON.stringify(key)}, which is not a rule bucket — the buckets are ${BUCKETS.join(", ")}, and a shell command rule is a toolDeny / toolAllow entry written Bash(<command>) (Bash(rm:*) matches a command whose first word is rm)`);
         }
@@ -100,6 +118,20 @@ export function readSessionRulesShape(value) {
     }
     return { rules };
 }
+function readOperatorPart(value) {
+    const read = readSessionRulesShape(value);
+    if ("fault" in read) {
+        const field = read.fault.field === "" ? OPERATOR_PART : `${OPERATOR_PART}.${read.fault.field}`;
+        return { fault: { field, got: read.fault.got }, sentence: `the session rules' operator part: ${read.sentence}` };
+    }
+    const { operatorRules: nested, ...part } = read.rules;
+    const unstamped = value.grammar === undefined;
+    if (unstamped || nested !== undefined) {
+        const got = unstamped ? "rules without a grammar stamp" : "an operator part of its own";
+        return { fault: { field: OPERATOR_PART, got }, sentence: `session rules carry an operator part holding ${got} — the part is the rules the last operator write set, stamped with their grammar by the write judge` };
+    }
+    return { rules: part };
+}
 export function normalizeRules(rules) {
     return canonicalRules(shapeOrRefuse(rules));
 }
@@ -119,42 +151,142 @@ function canonicalRules(read) {
     }
     return out;
 }
-function earlierGrammarReads(grammar, field, entry, reading) {
-    if (grammar >= SESSION_RULES_GRAMMAR)
-        return false;
-    if (reading.kind === "inert" && reading.reason === "grammar")
-        return true;
-    if (grammar !== 0 || SESSION_RULE_BUCKETS[field] !== "allow")
-        return false;
-    return reading.kind === "row" ? compiledEntryName(reading.compiled) !== entry : reading.reason === "wildcard_all";
+const NAMES_NO_TOOL = "an entry naming no tool, so it refused nothing";
+const NO_RULE_THEN = (direction) => (direction === "allow" ? "no rule, so it admitted nothing" : "no rule, so the rules could not be read and refused every call");
+const NAME_PATTERN_NOW = "a pattern over the whole tool name, every tool it matches";
+function spellsWholeProtocol(name) {
+    const split = splitNamespacedName(name);
+    return split !== undefined && split.peer === "*" && (split.tool === undefined || split.tool === "*");
 }
-function readsAsNoRule(entry, field) {
-    const reading = readRuleEntry(entry, SESSION_RULE_BUCKETS[field]);
-    return reading.kind === "inert" && reading.reason === "grammar";
+const GRAMMAR_REVISIONS = [
+    {
+        grammar: 1,
+        answer: ({ direction, entry, reading }) => {
+            const otherName = reading.kind === "row" ? compiledEntryName(reading.compiled) !== entry : reading.reason === "wildcard_all";
+            if (!otherName)
+                return undefined;
+            if (direction === "allow")
+                return { was: "a tool name compared as written, naming no tool", now: "the rule it spells", keep: { kind: "inert", reason: "earlier_grammar" }, reader: "named_no_tool" };
+            return reading.kind === "row" ? { was: "a tool name compared as written, naming no tool, so it refused nothing", now: "the rule it spells", reader: "grammar_revised" } : undefined;
+        },
+    },
+    {
+        grammar: 3,
+        answer: ({ direction, reading }) => direction === "deny" && reading.kind === "row" && reading.compiled.kind === "covering" && spellsWholeProtocol(reading.compiled.pattern)
+            ? { was: NAMES_NO_TOOL, now: "a deny of every tool of the protocol", reader: "grammar_revised" }
+            : undefined,
+    },
+    {
+        grammar: 4,
+        answer: ({ direction, reading }) => {
+            if (reading.kind !== "row")
+                return undefined;
+            const { compiled } = reading;
+            if (compiled.kind === "name" && NAME_RULE_FACES[compiled.rule.tool]?.values === "mounted") {
+                return { was: direction === "allow" ? "an entry with no rule form, so it admitted nothing" : "an entry with no rule form, so it refused nothing", now: "a rule on the agent type it names", reader: "grammar_revised" };
+            }
+            return compiled.kind === "command" && compiled.rule.match === "pattern" ? { was: NO_RULE_THEN(direction), now: "the Bash pattern rule it spells", reader: "grammar_revised" } : undefined;
+        },
+    },
+    {
+        grammar: 5,
+        answer: ({ row, direction, entry, reading, list }) => {
+            if (direction === "allow") {
+                if (row >= 1 && list.some(readsAsWildcard))
+                    return { was: "voided by the `*` its list holds", now: "one entry that grants nothing, the entries beside it read as written", keep: { kind: "inert", reason: "wildcard_all" } };
+                const parsed = reading.kind === "inert" ? ruleSpellingOf(entry) : undefined;
+                const name = parsed?.ruleContent === undefined ? parsed?.toolName : undefined;
+                if (name === undefined || name === "*" || !name.includes("*") || name.startsWith("*") || splitNamespacedName(name) !== undefined)
+                    return undefined;
+                return { was: `the exact tool name ${JSON.stringify(name)}`, now: "no rule (an allow reads a `*` only in a protocol name's tool segment)", keep: { kind: "row", compiled: { kind: "tool", name } }, reader: "grammar_revised" };
+            }
+            if (reading.kind !== "row" || reading.compiled.kind !== "covering")
+                return undefined;
+            const { pattern } = reading.compiled;
+            const split = splitNamespacedName(pattern);
+            if (!pattern.includes("*") || spellsWholeProtocol(pattern) || (split !== undefined && !split.peer.includes("*")))
+                return undefined;
+            const answer = { now: NAME_PATTERN_NOW, reader: "grammar_revised" };
+            if (pattern === "*")
+                return { ...answer, was: NAMES_NO_TOOL, keep: { kind: "inert", reason: "wildcard_all" } };
+            if (split !== undefined)
+                return { ...answer, was: NAMES_NO_TOOL, keep: { kind: "inert", reason: "namespace_wildcard" } };
+            if (pattern.startsWith("*"))
+                return { ...answer, was: NO_RULE_THEN(direction) };
+            return { ...answer, was: `the exact tool name ${JSON.stringify(pattern)}, so it refused only a tool of that name`, keep: { kind: "row", compiled: { kind: "tool", name: pattern } } };
+        },
+    },
+];
+function earlierGrammarReads(row, direction, entry, reading, list) {
+    if (row >= SESSION_RULES_GRAMMAR)
+        return { reading };
+    let first;
+    let last;
+    let kept;
+    for (const revision of GRAMMAR_REVISIONS) {
+        if (revision.grammar <= row)
+            continue;
+        const answer = revision.answer({ row, direction, entry, reading, list });
+        if (answer === undefined)
+            continue;
+        first ??= answer;
+        last = answer;
+        if (answer.keep !== undefined) {
+            kept = answer.keep;
+            break;
+        }
+    }
+    const read = kept ?? reading;
+    if (read.kind === "inert" && read.reason === "grammar")
+        return { reading: { kind: "inert", reason: "earlier_grammar" }, reader: "no_rule" };
+    if (first === undefined || last === undefined)
+        return { reading: read };
+    const reader = first.reader === "named_no_tool" ? first.reader : last.reader;
+    if (reader === undefined)
+        return { reading: read };
+    return { reading: read, reader, ...(reader === "grammar_revised" ? { revised: { was: first.was, now: last.now, stands: kept !== undefined } } : {}) };
 }
 const NO_RULE_REASONS = new Set(["grammar", "earlier_grammar"]);
 export function unreadableDenyEntries(rules, roster) {
     return compileSessionRuleBucket(rules, "toolDeny", roster).inert.filter((i) => NO_RULE_REASONS.has(i.reason));
 }
-function readsAsWildcard(entry) {
-    return compileAllowList([entry], "allow").inert.some((i) => i.reason === "wildcard_all");
-}
 const STAR_IS_NO_ALLOW_RULE = "it is no allow rule in any grammar and a write holding it is refused";
 function starWayOut(onlyStars, others, left) {
     return onlyStars
         ? `"*" is no allow rule in any grammar (a write holding it is refused); to drop it, write the session's rules afresh without it ${REWRITE_THROUGH}; ${left}`
         : `${others}, leaving "*" out — ${STAR_IS_NO_ALLOW_RULE}; ${left}`;
 }
-export function compileSessionRuleBucket(rules, field, roster) {
+function readsAsWildcard(entry) {
+    return typeof entry === "string" && entry === entry.trim() && parsePermissionRule(entry).toolName === "*";
+}
+function entryBucketDirection(field) {
     const direction = SESSION_RULE_BUCKETS[field];
+    if (direction === "allow" || direction === "deny")
+        return direction;
+    throw new SessionPolicyError("invalid_shape", `${JSON.stringify(field)} is no rule-entry bucket of the session rules — the entry buckets are ${ENTRY_FIELDS.join(" and ")}`);
+}
+function bucketReadings(rules, field, roster) {
+    const direction = entryBucketDirection(field);
     const entries = rules[field] ?? [];
-    const earlier = new Set(entries.filter((e) => earlierGrammarReads(rules.grammar, field, e, readRuleEntry(e, direction, roster))));
-    const whole = compileAllowList(entries, direction, roster);
-    const voided = direction === "allow" && whole.inert.some((i) => i.reason === "wildcard_all");
-    if (earlier.size === 0 || (voided && rules.grammar > 0))
-        return whole;
-    const list = compileAllowList(entries.filter((e) => !earlier.has(e)), direction, roster);
-    return { rows: list.rows, inert: [...list.inert, ...entries.filter((e) => earlier.has(e)).map((entry) => ({ entry, reason: "earlier_grammar" }))] };
+    return entries.map((entry) => ({ entry, ...earlierGrammarReads(rules.grammar, direction, entry, readRuleEntry(entry, direction, roster), entries) }));
+}
+export function compileSessionRuleBucket(rules, field, roster) {
+    const rows = [];
+    const inert = [];
+    const earlier = [];
+    for (const { entry, reading } of bucketReadings(rules, field, roster)) {
+        if (reading.kind === "row")
+            rows.push({ entry, compiled: reading.compiled });
+        else {
+            const { kind: _kind, ...why } = reading;
+            void _kind;
+            (why.reason === "earlier_grammar" ? earlier : inert).push({ entry, ...why });
+        }
+    }
+    return { rows, inert: [...inert, ...earlier] };
+}
+export function earlierGrammarEntries(rules, field) {
+    return bucketReadings(rules, field).flatMap((r) => (r.reader === undefined ? [] : [r.entry]));
 }
 const ADVISORY_ENTRIES_SHOWN = 5;
 function shownEntries(entries, render) {
@@ -163,14 +295,33 @@ function shownEntries(entries, render) {
 }
 const REWRITE_THROUGH = `through this engine (an operator write of a new value without the stored row's rev; the write stamps grammar ${SESSION_RULES_GRAMMAR})`;
 export function earlierGrammarAdvisory(sessionId, entries, field, grammar) {
-    const read = earlierGrammarReadings(entries, field);
+    const read = earlierGrammarReadings(entries, field, grammar);
     const noRule = read.filter((r) => r.reader === "no_rule").map((r) => r.entry);
     const namedNoTool = read.filter((r) => r.reader === "named_no_tool").map((r) => r.entry);
-    const sentences = [...(namedNoTool.length > 0 ? [namedNoToolInGrammar0(namedNoTool)] : []), ...(noRule.length > 0 ? [noRuleInThisGrammar(noRule, field, grammar)] : [])];
+    const revised = read.flatMap((r) => (r.revised === undefined ? [] : [{ entry: r.entry, ...r.revised }]));
+    const sentences = [
+        ...(namedNoTool.length > 0 ? [namedNoToolInGrammar0(namedNoTool)] : []),
+        ...(noRule.length > 0 ? [noRuleInThisGrammar(noRule, field, grammar)] : []),
+        ...(revised.length > 0 ? [revisedSinceGrammar(revised, field, grammar)] : []),
+    ];
     return `session permission rules of session ${JSON.stringify(sessionId)}: ${sentences.join(" ")}`;
 }
-function earlierGrammarReadings(entries, field) {
-    return entries.map((entry) => ({ entry, reader: readsAsNoRule(entry, field) ? "no_rule" : "named_no_tool" }));
+function earlierGrammarReadings(entries, field, grammar) {
+    const direction = entryBucketDirection(field);
+    return entries.map((entry) => {
+        const read = earlierGrammarReads(grammar, direction, entry, readRuleEntry(entry, direction), entries);
+        return { entry, reader: read.reader ?? "no_rule", ...(read.revised !== undefined ? { revised: read.revised } : {}) };
+    });
+}
+function revisedSinceGrammar(entries, field, grammar) {
+    const one = entries.length === 1;
+    const said = entries
+        .slice(0, ADVISORY_ENTRIES_SHOWN)
+        .map((e) => `${renderListEntry(e.entry)} meant ${e.was} there; this engine's rule grammar (${SESSION_RULES_GRAMMAR}) reads it as ${e.now}, and ${e.stands ? "the stored meaning stands" : "this grammar's reading applies"}`)
+        .join("; ");
+    const rest = entries.length > ADVISORY_ENTRIES_SHOWN ? `; and ${entries.length - ADVISORY_ENTRIES_SHOWN} more` : "";
+    return (`${field} ${one ? "holds an entry" : "holds entries"} stored in rule grammar ${grammar}${grammar === 0 ? " (before the rule grammar stamp)" : ""} whose meaning a later grammar revised — ${said}${rest}. ` +
+        `To give ${one ? "it" : "them"} this grammar's reading, write the session's rules afresh ${REWRITE_THROUGH}; left as stored, ${one ? "it reads" : "they read"} as said.`);
 }
 export function earlierGrammarNotice(input) {
     const { rulesSessionId, sessionId, entries, field, grammar } = input;
@@ -180,7 +331,7 @@ export function earlierGrammarNotice(input) {
         detail: {
             bucket: field,
             storedGrammar: grammar,
-            entries: earlierGrammarReadings(entries, field).map((r) => ({ entry: noticeRuleText(r.entry), reader: r.reader })),
+            entries: earlierGrammarReadings(entries, field, grammar).map((r) => ({ entry: noticeRuleText(r.entry), reader: r.reader })),
             rewrite: { by: "operator_write_without_rev", stampsGrammar: SESSION_RULES_GRAMMAR },
             rulesSessionId,
             sessionId,
@@ -215,8 +366,9 @@ function noRuleInThisGrammar(entries, field, grammar) {
 export function earlierGrammarRefusalClause(entries, grammar) {
     if (entries.length === 0)
         return "";
-    const noRule = entries.filter((e) => readsAsNoRule(e, "toolAllow")).length;
-    const namedNoTool = entries.filter((e) => !readsAsNoRule(e, "toolAllow"));
+    const read = earlierGrammarReadings(entries, "toolAllow", grammar);
+    const noRule = read.filter((r) => r.reader === "no_rule").length;
+    const namedNoTool = read.filter((r) => r.reader !== "no_rule").map((r) => r.entry);
     const stars = namedNoTool.filter(readsAsWildcard).length;
     const others = namedNoTool.length - stars;
     const named = [...(stars > 0 ? ['"*"'] : []), ...(others > 0 ? [`${others} parenthesized ${others === 1 ? "entry" : "entries"}`] : [])];
@@ -246,15 +398,13 @@ function effectiveEntries(rules, field, mountedToolNames) {
 function assertEntriesRead(rules, mountedToolNames) {
     const known = rootFacingToolNames(mountedToolNames);
     for (const field of ENTRY_FIELDS) {
-        for (const entry of rules[field] ?? []) {
-            const reading = readRuleEntry(entry, SESSION_RULE_BUCKETS[field], known);
-            const read = earlierGrammarReads(rules.grammar, field, entry, reading) ? { kind: "inert", reason: "earlier_grammar" } : reading;
+        for (const { entry, reading: read, reader } of bucketReadings(rules, field, known)) {
             if (read.kind === "row")
                 continue;
             const { kind: _kind, ...why } = read;
             void _kind;
             const way = why.reason === "earlier_grammar"
-                ? readsAsNoRule(entry, field)
+                ? reader === "no_rule"
                     ? ` These rules are written in grammar ${rules.grammar} (a stored row), and this engine's grammar (${SESSION_RULES_GRAMMAR}) reads this entry as no rule (grammar) — ` +
                         (field === "toolAllow" && readsAsWildcard(entry) ? `leave the entry out: it spells "*", and ${STAR_IS_NO_ALLOW_RULE}.` : "leave the entry out, or spell the tool's name as a rule spells one.")
                     : ` These rules are written in grammar ${rules.grammar} (a stored row from before the grammar stamp), in which this entry names no tool.` +
@@ -284,17 +434,29 @@ export function judgeSessionRulesWrite(prior, rules, opts, mountedToolNames = NO
     const read = shapeOrRefuse(rules);
     const clean = canonicalRules(read);
     assertEntriesRead(read, mountedToolNames);
-    if (prior !== null && opts?.operator !== true) {
-        const stored = readSessionRulesShape(prior);
-        if ("fault" in stored) {
-            throw new SessionPolicyError("corrupt", `the stored session rules cannot be read as rules (${stored.sentence}) — refusing to judge a non-operator write against them as fewer rules; an operator write replaces them`);
-        }
-        const loosens = loosenReasons(stored.rules, clean, mountedToolNames);
-        if (loosens.length > 0) {
-            throw new SessionPolicyError("loosen_forbidden", `a non-operator session-rule write may only tighten; refused: ${loosens.join("; ")}`);
-        }
+    if (opts?.operator === true)
+        return { ...clean, grammar: SESSION_RULES_GRAMMAR };
+    if (prior === null) {
+        return { ...clean, grammar: SESSION_RULES_GRAMMAR, operatorRules: isStoredRow(rules) ? operatorPartOf(read) : { grammar: SESSION_RULES_GRAMMAR } };
+    }
+    const operatorRules = operatorPartOf(readStoredOrRefuse(prior));
+    const loosens = loosenReasons(operatorRules, clean, mountedToolNames);
+    if (loosens.length > 0) {
+        throw new SessionPolicyError("loosen_forbidden", `a non-operator session-rule write may not loosen what an operator wrote; refused: ${loosens.join("; ")}`);
+    }
+    return { ...clean, grammar: SESSION_RULES_GRAMMAR, operatorRules };
+}
+function operatorPartOf(read) {
+    const { operatorRules, ...whole } = read;
+    const part = operatorRules ?? whole;
+    return { ...canonicalRules(part), grammar: part.grammar };
+}
+function readStoredOrRefuse(prior) {
+    const stored = readSessionRulesShape(prior);
+    if ("fault" in stored) {
+        throw new SessionPolicyError("corrupt", `the stored session rules cannot be read as rules (${stored.sentence}) — refusing to judge a non-operator write against them as fewer rules; an operator write replaces them`);
     }
-    return { ...clean, grammar: SESSION_RULES_GRAMMAR };
+    return stored.rules;
 }
 export function loosenReasons(priorValue, nextValue, mountedToolNames = NO_DECLARED_TOOLS) {
     const shapeOf = (side, value) => {