@sema-agent/core 7.55.0 → 7.56.0

package/dist/core/permission-rule-model.d.ts

@@ -460,6 +460,9 @@ export type RuleRejectCode = "invalid.grammar" | "invalid.empty_command" | "inva
 export interface RuleReject {
     code: RuleRejectCode;
     message: string;
+    /** For a text that is no rule spelling only because of white space (a tab, a no-break space included) around it or before its `(`:
+     *  the rule spelling it is a blank away from ({@link respelledRuleTextOf}) — named in `message`, never read in its place. */
+    respelling?: string;
 }
 /** The parsed, canonical shape of one rule text under one behavior — everything but the scope and the
  *  provenance. The behavior is the parser's INPUT (it decides which validator floor applies), carried
@@ -718,6 +721,13 @@ export declare function ruleContentOf(parsed: ParsedPermissionRule): string | un
  * most wants. The tightening behaviors therefore admit the interpreter-headed prefix form and change
  * nothing else; the allow floor is unchanged.
  */
+/**
+ * The rule spelling a text the rule syntax cannot read is a blank away from: the text with the white space (tabs included) around
+ * it and before its first `(` taken off, when that reads as a rule under `behavior` — its canonical text — else `undefined`. A text
+ * holding an invisible format character never gets here (its one caller refuses it first: `invalid.control_chars`, or `invalid.too_long`). Only what a refusal SAYS: a rule text is read as written ({@link parseRuleText}), so the way out is named, never
+ * taken (a door that reads the respelled text would be a second reading of the same text).
+ */
+export declare function respelledRuleTextOf(text: string, behavior: RuleBehavior): string | undefined;
 export declare function parseRuleText(text: string, behavior: RuleBehavior): {
     rule: ParsedRule;
 } | {
@@ -745,8 +755,8 @@ export type NameRuleReach = "reached" | "not_reached" | "unread";
 export declare function nameRuleReach(rule: Pick<PersistedRule, "tool" | "behavior" | "match" | "command">, name: string, values: readonly string[] | undefined): NameRuleReach;
 /** Why a call is unread against a mounted row's rule ({@link nameRuleReach} `unread`) — the sentence every reader carries. */
 export declare function nameValuesUnreadReason(tool: string): string;
-/** Does a domain rule reach this host (as `hostOfUrl` reads it)? `host`: equal; `subdomain`: a name ending in
- *  `.<domain>` with at least one label before it and no empty label. A rule of any other family reaches no host. */
+/** Does a domain rule reach this host (as `hostOfUrl` reads it)? The pattern's own reach ({@link hostPatternAdmits}); a rule of
+ *  any other family reaches no host. */
 export declare function domainRuleAdmits(rule: Pick<PersistedRule, "match" | "command">, host: string): boolean;
 /**
  * The closed set of BASES a path-form pattern resolves against — facts of the CALL (its execution
@@ -1255,7 +1265,8 @@ export interface CallHosts {
  * that does not parse, is not http(s), carries credentials, or names a host that does not read back as itself) is REFUSED by the
  * tool's first eligible deny row, whatever host that row names, and otherwise ASKED by its first eligible ask row in the
  * fail-closed form (`unreadable`, never a matched ask); no allow row reaches it, and with no deny or ask row it is reached by
- * nothing.
+ * nothing. A stored row whose text the rule reader reads as no rule reaches this walk from the person's rule lane only as a deny
+ * or an ask (its fields still tighten); the lane answers a call none of the rows refuses as one it cannot judge.
  */
 export declare function adjudicatePersistedDomainRules(rules: readonly PersistedRule[], call: {
     tool: string;

package/dist/core/permission-rule-model.js

@@ -2,12 +2,12 @@ import { homedir } from "node:os";
 import { shellWordsOf } from "../shell/shell-words.js";
 import { lexShell } from "../shell/lex.js";
 import { readProgramPosition } from "../tools/fs/bash-program-position.js";
-import { parsePermissionRule } from "./permission-rule-syntax.js";
+import { parsePermissionRule, ruleSpellingOf } from "./permission-rule-syntax.js";
 import { compileReadDeny } from "../tools/fs/read-deny.js";
 import { carriesShellRedirection, parseLeadingCommandName, splitShellCompoundSegments } from "../tools/fs/bash-readonly-classifier.js";
 import { INLINE_TRUNCATION_MARK, inlineUntrusted } from "./untrusted-text.js";
 import { catalogRuleFaceOf, hostTargetOf, isShellFaceToolName, pathTargetOf, protectivePathTargetOf } from "./tool-registry.js";
-import { HOST_UNREADABLE_SENTENCE, hostOfSpelling, isAddressHost } from "./host-target.js";
+import { HOST_UNREADABLE_SENTENCE, hostPatternAdmits, readHostPattern, spelledHostPattern } from "./host-target.js";
 import { heldValues } from "./tool-name-readings.js";
 import { carriesDotSegment, isAbsoluteForFamily, isIdentityDir, isPathIdentity, isShellRootedSpellingUnmapped, isUncIdentity, pathFamilyOf, pathIdentityOf } from "../tools/fs/safety.js";
 import { bindPathRules, judgeRuleRows, rowsWhereTheyLead } from "./path-rule-binding.js";
@@ -406,6 +406,15 @@ export function ruleContentOf(parsed) {
     const content = parsed.ruleContent;
     return content === undefined || (parsed.toolName === COMMAND_RULE_TOOL && foldSpacing(content) === "*") ? undefined : content;
 }
+export function respelledRuleTextOf(text, behavior) {
+    const outer = text.trim();
+    const open = outer.indexOf("(");
+    const candidate = open < 0 ? outer : outer.slice(0, open).replace(/\s+$/u, "") + outer.slice(open);
+    if (candidate === text || ruleSpellingOf(candidate) === undefined)
+        return undefined;
+    const read = parseRuleText(candidate, behavior);
+    return "rule" in read ? read.rule.rule : undefined;
+}
 export function parseRuleText(text, behavior) {
     if (!isRuleBehavior(behavior)) {
         return reject("invalid.grammar", `rule "${text}" was parsed under behavior ${escapeForDisclosure(behavior)}, which is not one of ${RULE_BEHAVIORS.join("/")}`);
@@ -417,7 +426,17 @@ export function parseRuleText(text, behavior) {
     if (CONTROL_CHARS_RE.test(text)) {
         return reject("invalid.control_chars", "rule text contains control characters (C0/C1, tab excepted), which cannot be part of a readable command");
     }
-    const parsed = parsePermissionRule(text);
+    const parsed = ruleSpellingOf(text);
+    if (parsed === undefined) {
+        const respelling = respelledRuleTextOf(text, behavior);
+        return {
+            reject: {
+                code: "invalid.grammar",
+                message: `"${text}" is not a rule spelling — a rule is the tool's name exactly as spelled, then its content in parentheses (no blank, tab or invisible character around the rule or before the "("), and the ")" ends it${respelling !== undefined ? `; spelled as a rule it is "${respelling}"` : ""}`,
+                ...(respelling !== undefined ? { respelling } : {}),
+            },
+        };
+    }
     const ruleContent = ruleContentOf(parsed);
     if (ruleContent === undefined) {
         return reject("invalid.grammar", `"${text}" is not a Tool(content) rule — a bare tool name claims the whole tool and is not a command rule`);
@@ -498,7 +517,7 @@ export function formatRuleText(command, match, tool) {
     if (match === "name")
         return `${tool}(${keyedValueParamOf(tool) !== undefined ? `${keyedValueParamOf(tool)}:` : ""}${command})`;
     if (match === "host" || match === "subdomain")
-        return `${tool}(domain:${match === "subdomain" ? "*." : ""}${command})`;
+        return `${tool}(domain:${spelledHostPattern({ match, host: command })})`;
     return `${tool}(${command}${match === "prefix" || match === "name_prefix" ? ":*" : match === "wildcard" ? " *" : ""})`;
 }
 function parseNameRuleContent(text, tool, content, behavior, verifyCanonical = true) {
@@ -606,30 +625,26 @@ function parseDomainRuleContent(text, tool, content, behavior) {
     if (!content.startsWith(DOMAIN_RULE_MARKER)) {
         return reject("invalid.grammar", `a ${tool} rule names a host: ${tool}(domain:<host>) for one, ${tool}(domain:*.<domain>) for every host below a domain ("${text}")`);
     }
-    const spelled = content.slice(DOMAIN_RULE_MARKER.length);
-    if (spelled === "*")
-        return reject("unsupported.wildcard", `"${text}" names every host — the whole tool is the bare ${tool} entry`);
-    const below = spelled.startsWith("*.");
-    const body = below ? spelled.slice(2) : spelled;
-    if (body.includes("*")) {
-        return reject("unsupported.wildcard", `a \`*\` in "${text}" other than a leading \`*.\` has no rule form — a ${tool} rule names one host, or every host below one domain with \`*.<domain>\``);
-    }
-    const host = hostOfSpelling(body);
-    if (host === undefined || hostOfSpelling(host) !== host) {
-        return reject("invalid.grammar", `"${text}" does not name a host alone — write the host as a URL carries it, with no scheme, path, port or credentials`);
+    const read = readHostPattern(content.slice(DOMAIN_RULE_MARKER.length));
+    if ("problem" in read) {
+        switch (read.problem) {
+            case "every_host":
+                return reject("unsupported.wildcard", `"${text}" names every host — the whole tool is the bare ${tool} entry`);
+            case "inner_wildcard":
+                return reject("unsupported.wildcard", `a \`*\` in "${text}" other than a leading \`*.\` has no rule form — a ${tool} rule names one host, or every host below one domain with \`*.<domain>\``);
+            case "empty_label":
+                return reject("invalid.grammar", `"${text}" names a host with an empty label (a leading or doubled dot) — write the host itself, and every host below a domain as \`*.<domain>\``);
+            case "not_a_host":
+                return reject("invalid.grammar", `"${text}" does not name a host alone — write the host as a URL carries it, with no scheme, path, port or credentials`);
+            case "below_address":
+                return reject("invalid.grammar", `"${text}" names hosts below an address, which has none — write the address itself`);
+        }
     }
-    if (below && isAddressHost(host))
-        return reject("invalid.grammar", `"${text}" names hosts below an address, which has none — write the address itself`);
-    const match = below ? "subdomain" : "host";
+    const { match, host } = read.pattern;
     return { rule: { behavior, rule: formatRuleText(host, match, tool), tool, match, command: host } };
 }
 export function domainRuleAdmits(rule, host) {
-    if (rule.match === "host")
-        return host === rule.command;
-    if (rule.match !== "subdomain" || isAddressHost(host) || !host.endsWith(`.${rule.command}`))
-        return false;
-    const labels = host.slice(0, -(rule.command.length + 1));
-    return labels !== "" && !labels.split(".").includes("");
+    return (rule.match === "host" || rule.match === "subdomain") && hostPatternAdmits({ match: rule.match, host: rule.command }, host);
 }
 function parsePathRuleContent(text, tool, content, behavior) {
     if (behavior === "allow" && PATH_RULE_FACES[tool]?.allow === undefined) {

package/dist/core/permission-rule-org.d.ts

@@ -224,6 +224,9 @@ export interface UnreadableOrgRow {
     readonly rule: string;
     readonly code: RuleRejectCode;
     readonly detail?: string;
+    /** The rule spelling a row that is no rule spelling only because of white space (a tab, a no-break space) is a blank away from — the
+     *  text to republish it as; the row itself is still read as unreadable (one spelling reader, fail-closed). */
+    readonly respelling?: string;
     readonly behavior: "deny" | "ask";
     readonly reach: OrgRowReach;
 }
@@ -327,8 +330,9 @@ export declare function unenforceableOrgRules(rules: readonly OrgPermissionRule[
     rule: string;
     code: RuleRejectCode;
 }>;
-/** The reason an unreadable row's verdict carries — its place in the snapshot, its code, and the repair. */
-export declare function unreadableOrgRowReason(row: Pick<UnreadableOrgRow, "index" | "code" | "detail">): string;
+/** The reason an unreadable row's verdict carries — its place in the snapshot, its code, and the repair: for a row that is no rule
+ *  spelling only because of white space (a tab, a no-break space), its text and the spelling to republish it as. */
+export declare function unreadableOrgRowReason(row: Pick<UnreadableOrgRow, "index" | "code" | "detail" | "rule" | "respelling">): string;
 /** The ONE clause for an org verdict that carries an `unreadable` reason — a rule the call could not be read against, or
  *  a row this layer cannot read — on a refusal and on a question alike. */
 export declare function orgUnreadableClause(reason: string): string;

package/dist/core/permission-rule-org.js

@@ -284,12 +284,13 @@ function orgStateCopyOf(state) {
 function readOrgRow(row, index) {
     const { rule: text, behavior: said } = orgRowPolicyOf(row);
     const behavior = said === "ask" ? "ask" : "deny";
-    const unreadable = (code, detail) => ({
+    const unreadable = (code, detail, respelling) => ({
         kind: "unreadable",
         index,
         rule: typeof text === "string" ? text : text === undefined ? "<unreadable>" : escapeForDisclosure(text),
         code,
         ...(detail !== undefined ? { detail } : {}),
+        ...(respelling !== undefined ? { respelling } : {}),
         behavior,
         reach: reachOfRowHead(text, behavior),
     });
@@ -299,7 +300,7 @@ function readOrgRow(row, index) {
         return unreadable("invalid.grammar", said === undefined ? "no behavior" : `behavior "${escapeForDisclosure(said)}" is not deny or ask`);
     const parsed = parseRuleText(text, said);
     if ("reject" in parsed)
-        return unreadable(parsed.reject.code);
+        return unreadable(parsed.reject.code, undefined, parsed.reject.respelling);
     if (parsed.rule.tool !== COMMAND_RULE_TOOL)
         return unreadable("unsupported.tool");
     return { kind: "read", index, rule: text, behavior: said, parsed: parsed.rule };
@@ -355,6 +356,9 @@ function readListedOrgRules(rules) {
     return reading;
 }
 export function unreadableOrgRowReason(row) {
+    if (row.respelling !== undefined) {
+        return `row ${row.index} of the organization snapshot, "${escapeForDisclosure(row.rule)}", is not a rule spelling (${row.code}); republish it as "${escapeForDisclosure(row.respelling)}"`;
+    }
     return `row ${row.index} of the organization snapshot is not a rule this layer reads (${row.code}${row.detail !== undefined ? `: ${row.detail}` : ""}); republish it in the shell tool's command grammar`;
 }
 export function orgUnreadableClause(reason) {
@@ -365,7 +369,7 @@ export function describeUnreadableOrgRows(unreadable, revision) {
         return undefined;
     const named = unreadable
         .slice(0, DISCLOSED_UNREADABLE_ROWS)
-        .map((u) => `row ${u.index} "${escapeForDisclosure(u.rule)}" (${u.code}${u.detail !== undefined ? `: ${u.detail}` : ""})`)
+        .map((u) => `row ${u.index} "${escapeForDisclosure(u.rule)}" (${u.code}${u.detail !== undefined ? `: ${u.detail}` : ""}${u.respelling !== undefined ? `; republish it as "${escapeForDisclosure(u.respelling)}"` : ""})`)
         .join(", ");
     const more = unreadable.length - DISCLOSED_UNREADABLE_ROWS;
     return (`the org snapshot${revision !== undefined ? ` (revision ${escapeForDisclosure(revision)})` : ""} is served DEGRADED: ${unreadable.length} row(s) this layer cannot read — ${named}${more > 0 ? ` and ${more} more` : ""}; ` +

package/dist/core/permission-rule-provider.d.ts

@@ -36,7 +36,7 @@
  */
 import type { PersistedRule, RuleScope } from "./permission-rule-model.js";
 import { type DurableRulePartitionProvider, type QuarantinedRuleAdd } from "./permission-rule-store.js";
-import type { RuleOwner } from "./rule-owner.js";
+import { type RuleOwner } from "./rule-owner.js";
 import { type OrgRulePartitionConfig, type OrgRuleResolution } from "./permission-rule-org.js";
 import type { SessionRulePartition } from "./permission-rule-session.js";
 import type { StoreDurability, StoreFidelity } from "./checkpoint-store.js";
@@ -146,7 +146,10 @@ export interface PermissionRuleStoreProvider {
  * provider: an absent principal resolves to zero personal rules, and a provider that forgot it would hand one person's
  * standing approvals to an anonymous task. The ONE exception is an explicitly declared LOCAL-OWNER deployment, where "no
  * principal" is the typed absence of identity — the machine owner's own bucket (a provider with no such face resolves
- * the anonymous store; {@link createPermissionRuleLanes} refuses that declaration loudly).
+ * the anonymous store; {@link createPermissionRuleLanes} refuses that declaration loudly). "No principal" is ABSENCE only —
+ * `undefined`, and the empty string the engine has always spelled the same ({@link readPrincipal}). A principal that was provided
+ * and is not a name (white space, an invisible or control character) is a bad value and is refused here: read as absence it
+ * would be the machine owner's bucket on a local-owner deployment.
  */
 export declare function ownerStoreOf(provider: PermissionRuleStoreProvider, principal: string | undefined, localOwnerDeclared: boolean): PermissionRuleStore;
 /** What {@link createPermissionRuleStoreProvider} composes. */

package/dist/core/permission-rule-provider.js

@@ -1,17 +1,39 @@
-import { escapeForDisclosure } from "./permission-rule-model.js";
+import { escapeForDisclosure, isRuleBehavior, parseRuleText } from "./permission-rule-model.js";
 import { PERMISSION_RULE_WRITER, errText, isValidDurableScope, normalizePersistedRule, sameRuleIdentity, writerOf, } from "./permission-rule-store.js";
+import { readRuleOwner } from "./rule-owner.js";
+import { readPrincipal } from "./principal-name.js";
 import { UNGOVERNED_ORG_RESOLUTION, compileOrgShadowPredicate, createOrgRulePartition } from "./permission-rule-org.js";
 export function ruleSourceOf(scope) {
     return scope.kind === "global" ? "user" : scope.kind;
 }
 export function ownerStoreOf(provider, principal, localOwnerDeclared) {
-    const anonymous = principal === undefined || principal === "";
-    return anonymous && localOwnerDeclared && provider.forLocalOwner !== undefined ? provider.forLocalOwner() : provider.forPrincipal(anonymous ? undefined : principal);
+    const reading = readPrincipal(principal);
+    if (reading.kind === "invalid") {
+        throw new Error(`the principal given is not a principal name (got ${reading.fault}) — refusing to resolve a bucket for it; a provided value that names nobody is not "no principal"`);
+    }
+    if (reading.kind === "name")
+        return provider.forPrincipal(reading.name);
+    return localOwnerDeclared && provider.forLocalOwner !== undefined ? provider.forLocalOwner() : provider.forPrincipal(undefined);
 }
 function usableSessionId(sessionId) {
     return typeof sessionId === "string" && sessionId !== "" ? sessionId : undefined;
 }
 const EMPTY_DURABLE = { rules: [], tombstones: [], rev: 0 };
+function durableReadOf(settled) {
+    if (!settled.ok)
+        return settled;
+    for (const [kind, rows] of [["rule", settled.v.rules], ["tombstone", settled.v.tombstones]]) {
+        const at = rows.findIndex((r) => !isRuleBehavior(r?.behavior));
+        if (at < 0)
+            continue;
+        const row = rows[at];
+        return {
+            ok: false,
+            e: new Error(`the persisted rule partition served a ${kind} row (#${at}, ${escapeForDisclosure(row?.rule)}) whose behavior word ${escapeForDisclosure(row?.behavior)} is outside deny/ask/allow — whether it refuses a call is unknown, so the partition is read as one that could not be read`),
+        };
+    }
+    return settled;
+}
 export function createPermissionRuleStoreProvider(cfg) {
     if (cfg === null || typeof cfg !== "object") {
         throw new Error("createPermissionRuleStoreProvider takes a config object naming the partitions to compose");
@@ -61,7 +83,7 @@ class UnifiedPermissionRuleStore {
         const disclosures = [];
         const [orgSettled, durableSettled, sessionRows] = await Promise.all([
             this.org !== undefined ? this.org.resolve() : Promise.resolve({ ...UNGOVERNED_ORG_RESOLUTION, rules: [], disclosures: [] }),
-            this.durable !== undefined ? this.durable.list().then((v) => ({ ok: true, v }), (e) => ({ ok: false, e })) : Promise.resolve({ ok: true, v: EMPTY_DURABLE }),
+            this.durable !== undefined ? this.durable.list().then((v) => durableReadOf({ ok: true, v }), (e) => ({ ok: false, e })) : Promise.resolve({ ok: true, v: EMPTY_DURABLE }),
             this.readSessionRows(usableSessionId(query?.sessionId), disclosures),
         ]);
         const orgResolution = orgSettled;
@@ -106,7 +128,7 @@ class UnifiedPermissionRuleStore {
             const served = structuredClone(await this.session.read(sessionId));
             const rows = served.filter((r) => {
                 const scope = r?.scope;
-                return scope?.kind === "session" && scope.sessionId === sessionId && !("reject" in normalizePersistedRule(r));
+                return scope?.kind === "session" && scope.sessionId === sessionId && (!("reject" in normalizePersistedRule(r)) || ((r.behavior === "deny" || r.behavior === "ask") && "reject" in parseRuleText(r.rule, r.behavior)));
             });
             if (rows.length < served.length) {
                 disclosures.push(`the session rule partition served ${served.length - rows.length} row(s) that are not canonical session rows of this session — dropped, not adjudicated`);
@@ -157,8 +179,17 @@ export async function effectivePermissionRules(opts) {
     return await resolveOwnerStore(opts).effective(opts.sessionId !== undefined ? { sessionId: opts.sessionId } : undefined);
 }
 export function resolveOwnerStore(opts) {
-    if (opts.owner !== undefined && opts.owner.kind === "local-owner") {
-        if (opts.principal !== undefined) {
+    const owner = opts.owner === undefined ? undefined : readRuleOwner(opts.owner);
+    if (opts.owner !== undefined && owner === undefined) {
+        throw new Error("the owner given is neither a principal nor the local owner (a principal owner names a principal name) — refusing to resolve a bucket nobody can name");
+    }
+    const given = readPrincipal(opts.principal);
+    if (given.kind === "invalid") {
+        throw new Error(`the principal given is not a principal name (got ${given.fault}) — pass a verified principal, the local owner, or neither; a provided value that names nobody is not "no principal"`);
+    }
+    const principal = given.kind === "name" ? given.name : undefined;
+    if (owner?.kind === "local-owner") {
+        if (principal !== undefined) {
             throw new Error("pass either a principal or a local-owner, not both — a bucket has one owner");
         }
         const store = opts.provider.forLocalOwner?.();
@@ -167,9 +198,8 @@ export function resolveOwnerStore(opts) {
         }
         return store;
     }
-    if (opts.owner !== undefined && opts.owner.kind === "principal" && opts.principal !== undefined && opts.owner.principal !== opts.principal) {
-        throw new Error(`contradictory identity: principal "${escapeForDisclosure(opts.principal)}" and owner principal "${escapeForDisclosure(opts.owner.principal)}" disagree`);
+    if (owner?.kind === "principal" && principal !== undefined && owner.principal !== principal) {
+        throw new Error(`contradictory identity: principal "${escapeForDisclosure(principal)}" and owner principal "${escapeForDisclosure(owner.principal)}" disagree`);
     }
-    const principal = opts.owner?.kind === "principal" ? opts.owner.principal : opts.principal;
-    return opts.provider.forPrincipal(principal);
+    return opts.provider.forPrincipal(owner?.kind === "principal" ? owner.principal : principal);
 }

package/dist/core/permission-rule-store.d.ts

@@ -45,7 +45,7 @@ import type { PersistedRule, RuleAdd, RuleDot, RuleScope, RuleTombstone } from "
 import { type RuleBehavior } from "./permission-rule-model.js";
 import type { RuleSyncDropReason, RuleQuarantineReason } from "./governance-codes.js";
 import type { StoreDurability, StoreFidelity } from "./checkpoint-store.js";
-import type { RuleOwner } from "./rule-owner.js";
+import { type RuleOwner } from "./rule-owner.js";
 /** One store read: the rules as persisted, their tombstones, and the revision they were read at. */
 export interface StoredRules {
     /** Rules with their FULL add sets — tombstoned dots already removed by the backend on read. */
@@ -93,7 +93,8 @@ export interface DurableRulePartition {
     /** Declared serialization fidelity, same doctrine as the other store families. */
     readonly fidelity?: StoreFidelity;
 }
-/** Resolves one owner's durable partition. `undefined` ⇒ a partition that reports zero rules. This is
+/** Resolves one owner's durable partition. `undefined` — or anything that is not a principal name
+ *  (`principalNameOf`: the empty and the blank string included) ⇒ a partition that reports zero rules. This is
  *  the BACKEND contract (file, in-memory, an out-of-repo SQL twin); the engine never consumes it
  *  directly — `createPermissionRuleStoreProvider({ durable })` composes it into the unified store. */
 export interface DurableRulePartitionProvider {

package/dist/core/permission-rule-store.js

@@ -1,6 +1,7 @@
 import { randomBytes } from "node:crypto";
 import { canonicalize } from "./canonical-json.js";
 import { escapeForDisclosure, isRuleBehavior, isRuleLive, parseRuleText } from "./permission-rule-model.js";
+import { readRuleOwner } from "./rule-owner.js";
 import { thrownText } from "./thrown-value.js";
 import { validatePath } from "./effective-path-target.js";
 export const PERMISSION_RULES_LATER_GRAMMAR_CODE = "permission_rules.later_grammar";
@@ -510,6 +511,10 @@ async function readRuleLiveness(store, identity) {
     }
 }
 const REMOVE_MAX_ATTEMPTS = 8;
+const NO_TARGET_OWNER = "the principal given is neither a principal name (a string with a visible character, no control or separator character, and no format character but a joiner) nor an owner (a principal owner names a principal name; the local owner is { kind: \"local-owner\" })";
+function persistedRuleTargetOwner(target) {
+    return readRuleOwner(typeof target === "string" ? { kind: "principal", principal: target } : target);
+}
 export async function removePersistedRule(opts) {
     const behavior = opts.behavior;
     const rule = opts.rule;
@@ -519,7 +524,9 @@ export async function removePersistedRule(opts) {
         return { status: "failed", error: `removePersistedRule: behavior ${escapeForDisclosure(behavior)} is not one of ${["deny", "ask", "allow"].join("/")} — refusing to name a rule identity nothing can carry`, committed: "no" };
     }
     const identity = { behavior, rule, scope };
-    const owner = typeof target === "string" ? { kind: "principal", principal: target } : structuredClone(target);
+    const owner = persistedRuleTargetOwner(target);
+    if (owner === undefined)
+        return { status: "failed", error: `removePersistedRule: ${NO_TARGET_OWNER} — refusing to remove from a bucket nobody can name`, committed: "no" };
     const provider = opts.provider;
     if (scope?.kind === "session") {
         return {
@@ -686,7 +693,9 @@ export async function addPersistedRule(opts) {
     if ("reject" in parsed)
         return { status: "failed", error: `addPersistedRule: ${parsed.reject.code}: ${parsed.reject.message}`, committed: "no" };
     const identity = { behavior, rule: parsed.rule.rule, scope };
-    const owner = typeof target === "string" ? { kind: "principal", principal: target } : structuredClone(target);
+    const owner = persistedRuleTargetOwner(target);
+    if (owner === undefined)
+        return { status: "failed", error: `addPersistedRule: ${NO_TARGET_OWNER} — refusing to write into a bucket nobody can name`, committed: "no" };
     const provider = opts.provider;
     if (owner.kind === "local-owner" && provider.forLocalOwner === undefined) {
         return { status: "failed", error: "this provider has no local-owner bucket (forLocalOwner is not implemented) — a local-owner rule cannot be added through it", committed: "no" };

package/dist/core/permission-rule-sync.js

@@ -1,4 +1,5 @@
 import { escapeForDisclosure, isRuleBehavior, parseRuleText, RULE_ADD_ORIGINS } from "./permission-rule-model.js";
+import { principalNameOf } from "./principal-name.js";
 import { PERMISSION_RULES_LATER_GRAMMAR_CODE, applyTombstones, errText, isProjectScopeRoot, joinFrontiers, joinRuleStates, normalizePersistedRule, readRuleWriteOutcome, ruleSyncVector, sameRuleIdentity, screenRuleSyncState, writerOf, } from "./permission-rule-store.js";
 import { emitTrace } from "./trace.js";
 import { SESSION_RULES_GRAMMAR, readRuleGrammarStamp } from "./session-policy-store.js";
@@ -23,8 +24,8 @@ export async function syncPermissionRules(opts) {
             throw new Error(`contradictory identity: principal "${escapeForDisclosure(principal)}" and owner principal "${escapeForDisclosure(owner.principal)}" disagree`);
         }
     }
-    if (typeof principal !== "string" || principal === "") {
-        throw new Error("syncPermissionRules requires a verified principal — an unauthenticated deployment has no cloud bucket to sync");
+    if (principalNameOf(principal) === undefined) {
+        throw new Error("syncPermissionRules requires a verified principal — an unauthenticated deployment has no cloud bucket to sync (a blank name, or one holding a control, separator or invisible format character, is not a principal)");
     }
     const traceClock = opts.now ?? Date.now;
     const disclose = (result) => {

package/dist/core/permission-rule-syntax.d.ts

@@ -29,10 +29,11 @@ export declare function lastIndexOfUnescaped(s: string, ch: string): number;
  */
 export declare function parsePermissionRule(rule: string): ParsedPermissionRule;
 /**
- * Can a rule name this tool name — is it the rule syntax's name head ({@link RULE_TOOL_NAME}) and not the lone `*`? The
- * lone `*` is the wildcard (every tool), not a name: a tool called `*` could never be granted or refused on its own. The
- * mount contract for every name a caller tool answers to (its name and each alias), so each one is a name every list can
- * write; a protocol-minted name (`<ns>__<peer>__<tool>`, segments in `[A-Za-z0-9_-]`) is always one.
+ * Can a rule name this tool name — is it the rule syntax's name head ({@link RULE_TOOL_NAME}) with no `*` in it? A `*` makes a
+ * spelling a glob over names, not a name: a tool whose name held one would be reached by every rule whose glob matches it and
+ * could never be named on its own (the reference's mount spelling holds no `*` either). The mount contract for every name a
+ * caller tool answers to (its name and each alias), so each one is a name every list can write; a protocol-minted name
+ * (`<ns>__<peer>__<tool>`, segments in `[A-Za-z0-9_-]`) is always one.
  */
 export declare function isNameableToolName(name: string): boolean;
 /**

package/dist/core/permission-rule-syntax.js

@@ -36,9 +36,9 @@ export function parsePermissionRule(rule) {
         return { toolName: name.trim() };
     return { toolName: name.trim(), ruleContent: unescapeRuleContent(content) };
 }
-const RULE_TOOL_NAME = /^(?:\*|[A-Za-z0-9_](?:[A-Za-z0-9_.:*-]*[A-Za-z0-9_*-])?)$/;
+const RULE_TOOL_NAME = /^[A-Za-z0-9_*](?:[A-Za-z0-9_.:*-]*[A-Za-z0-9_*-])?$/;
 export function isNameableToolName(name) {
-    return typeof name === "string" && name !== "*" && RULE_TOOL_NAME.test(name);
+    return typeof name === "string" && !name.includes("*") && RULE_TOOL_NAME.test(name);
 }
 export function ruleSpellingOf(rule) {
     if (rule !== rule.trim())

package/dist/core/permission-rules.d.ts

@@ -90,8 +90,8 @@ export interface PermissionRuleIssue {
     /** A rule the rule syntax reads no rule in (`ruleSpellingOf`) whose name is the reason: blanks around the rule, a
      *  character outside a tool name's spelling (a variation selector, a filler, a zero-width space), a blank or an invisible
      *  character before the `(`, a leading `-`. Refused — the lenient reading would deny a tool under another spelling, or none.
-     *  Also a rule whose tool name the syntax reads as the wildcard `*` (`*`, `*()`, `*(*)`): a rule reaches the tool it
-     *  names, and `*` names none. */
+     *  (A `*` in a tool name is no such spelling: a deny or ask rule reads it as a glob over the whole name, `*` alone as every
+     *  tool.) */
      | "invalid.tool_name" | "invalid.param_split" | "invalid.primary_field" | "invalid.cap_exceeded"
     /** An ALLOW rule (any spelling): a policy fold says deny / ask only — "this does not need asking" is the allow
      *  layer's (`TaskSpec.allowedTools`, `RunnerDeps.allowedTools`). One issue per allow rule. */
@@ -206,8 +206,8 @@ export interface PermissionRulePolicyOptions {
      */
     pathBases?: PathRuleBases;
 }
-import { isNamespacedCoveringRuleName, namespacedRuleNameCovers, wildcardMatch } from "./namespaced-rule-name.js";
-export { isNamespacedCoveringRuleName, namespacedRuleNameCovers, wildcardMatch };
+import { isCoveringRuleName, ruleNameCovers, wildcardMatch } from "./namespaced-rule-name.js";
+export { isCoveringRuleName, ruleNameCovers, wildcardMatch };
 /**
  * design/388 A-6/7/8/9 (D-3): the per-tool RULE FACE — the parameters a `Tool(param:pattern)` rule may name
  * (`params`, the SCALAR top-level keys ∪ the path target's aliases), the ones the generic lexical matcher must

package/dist/core/permission-rules.js

@@ -1,5 +1,5 @@
 import { attest } from "./tool-policy.js";
-import { MCP_NAMESPACE, protocolOf } from "./protocol-table.js";
+import { MCP_NAMESPACE } from "./protocol-table.js";
 import { catalogRuleFaceOf, isShellFaceToolName, pathTargetOf } from "./tool-registry.js";
 import { HOST_UNREADABLE_SENTENCE, callHostTargetOf } from "./host-target.js";
 import { indexOfUnescaped, lastIndexOfUnescaped, parsePermissionRule, ruleSpellingOf } from "./permission-rule-syntax.js";
@@ -36,9 +36,8 @@ export const DEFAULT_CAPS = {
     maxStars: 16,
     maxScalarValueChars: DEFAULT_MAX_SCALAR_VALUE_CHARS,
 };
-import { isNamespacedCoveringRuleName, namespacedRuleNameCovers, wildcardMatch } from "./namespaced-rule-name.js";
-import { wildcardPeerRefusalOf } from "./tool-name-aliases.js";
-export { isNamespacedCoveringRuleName, namespacedRuleNameCovers, wildcardMatch };
+import { isCoveringRuleName, ruleNameCovers, wildcardMatch } from "./namespaced-rule-name.js";
+export { isCoveringRuleName, ruleNameCovers, wildcardMatch };
 const vocabularyOf = (face) => face.params ?? face.primaryParams;
 const carriedPhrase = (face) => {
     const vocabulary = vocabularyOf(face);
@@ -119,22 +118,13 @@ function compile(rules, caps, primaryFieldGeneric, ruleFaces, pathBases = {}) {
             bad(text, why.code, why.message);
             continue;
         }
-        if (parsed.toolName === "*") {
-            bad(text, "invalid.tool_name", "`*` names no tool — a rule reaches the tool it names, so this one would compile and never match; name the tool", { name: "defaultAction" });
-            continue;
-        }
         const toolName = parsed.toolName;
         const parenthesised = parsed.ruleContent !== undefined || indexOfUnescaped(text, "(") !== -1;
         if (toolName.startsWith(MCP_NAMESPACE.prefix) && parenthesised) {
             bad(text, "unsupported.mcp_paren", "MCP rules do not support patterns in parentheses (CC parity); a rule names a whole tool (`mcp__<server>__<tool>`) or a whole server (`mcp__<server>`), and what a tool does is declared per tool in the MCP server's spec", { name: "toolAxes" });
             continue;
         }
-        const wildPeer = wildcardPeerRefusalOf(toolName, verb);
-        if (wildPeer !== undefined) {
-            bad(text, "invalid.tool_name", wildPeer);
-            continue;
-        }
-        if (parenthesised && isNamespacedCoveringRuleName(toolName, verb)) {
+        if (ruleContentOf(parsed) !== undefined && isCoveringRuleName(toolName, verb)) {
             bad(text, "unsupported.covering_paren", `"${toolName}" reaches a SET of tools, and the generic param DSL is keyed by exact tool name — a parenthesised rule on it can never match. ` +
                 `Write the parenthesised rule against one exact tool name, or drop the parentheses to keep the covering rule.`);
             continue;
@@ -142,7 +132,7 @@ function compile(rules, caps, primaryFieldGeneric, ruleFaces, pathBases = {}) {
         const entry = byTool.get(toolName) ?? { bare: {}, param: { deny: [], ask: [] }, content: { deny: [], ask: [] } };
         const content = ruleContentOf(parsed);
         if (content === undefined) {
-            if (isNamespacedCoveringRuleName(toolName, verb)) {
+            if (isCoveringRuleName(toolName, verb)) {
                 namespacedCovering[verb].push({ ruleName: toolName, ruleText: text, ...(r.source !== undefined ? { source: r.source } : {}) });
                 continue;
             }
@@ -339,7 +329,8 @@ export function createPermissionRulePolicy(rules, opts) {
         for (const r of namespacedCovering[behavior])
             nameSets[behavior].push(r.ruleName);
     }
-    const coveringHit = (lane, toolName) => lane.length === 0 ? undefined : lane.find((r) => namespacedRuleNameCovers(r.ruleName, toolName));
+    const heldFor = (table, req) => heldValues("policy.permissionRules", table, req);
+    const coveringHit = (lane, req) => lane.length === 0 ? undefined : heldFor({ get: (name) => lane.find((r) => ruleNameCovers(r.ruleName, name)) }, req)[0];
     const hasCovering = namespacedCovering.deny.length > 0 || namespacedCovering.ask.length > 0;
     const faceRules = {
         deny: [...byTool.values()].flatMap((e) => e.content.deny.filter((r) => r.faces !== undefined)),
@@ -454,7 +445,7 @@ export function createPermissionRulePolicy(rules, opts) {
         requiresRealApproval: true,
     });
     const entryFor = (req) => {
-        const entries = heldValues("policy.permissionRules", byTool, req);
+        const entries = heldFor(byTool, req);
         if (entries.length <= 1)
             return entries[0];
         const bare = {};
@@ -474,12 +465,12 @@ export function createPermissionRulePolicy(rules, opts) {
         ...(pathSpecs.length > 0 ? { pathRules: (anchors) => boundAt(policyAnchors(pathBases, anchors)).rows } : {}),
         check(req) {
             const entry = entryFor(req);
-            const covering = hasCovering && protocolOf(req.toolName) !== undefined;
+            const covering = hasCovering;
             if (entry?.bare.deny) {
                 return { action: "deny", message: ruleDenial(req, entry.bare.deny.ruleText, entry.bare.deny.source) };
             }
             if (covering) {
-                const coveringDeny = coveringHit(namespacedCovering.deny, req.toolName);
+                const coveringDeny = coveringHit(namespacedCovering.deny, req);
                 if (coveringDeny)
                     return { action: "deny", message: ruleDenial(req, coveringDeny.ruleText, coveringDeny.source) };
             }
@@ -509,7 +500,7 @@ export function createPermissionRulePolicy(rules, opts) {
                 }
             }
             if (covering) {
-                const coveringAsk = coveringHit(namespacedCovering.ask, req.toolName);
+                const coveringAsk = coveringHit(namespacedCovering.ask, req);
                 if (coveringAsk)
                     return { action: "ask", message: ruleAskMessage(coveringAsk.ruleText, coveringAsk.source), matchedAskRule: coveringAsk.ruleText };
             }

package/dist/core/persisted-rule-arms.d.ts

@@ -44,7 +44,7 @@ export declare function disclosedRuleSet(rules: readonly PersistedRuleHitRule[])
  *    lane's allow carries: one authority, one word) and the rule text disclosed through the display
  *    transform; the STATION attributes the refusal (`tightened: "deny"` ⇒ it writes the pass's refusing
  *    layer — the attribution is a station's word and lives in the station file). A path row's hit reports where
- *    it met the call; with `call` given and the face the call's own, the deny carries that as its attested `pathDenial`, so every exit that
+ *    it met the call; with the face the call's own (`call`, the request the lane read), the deny carries that as its attested `pathDenial`, so every exit that
  *    reads the deny (the gate's exit, the approved-edit re-check, a resumed leg's belt) mints the same card from the same fact.
  *  · ASK — on an allow, a fresh ask is minted carrying `matchedAskRule` (the marker an explicit `ask`
  *    permission rule stamps, so the ask's origin derives as `ask_rule`: the classifier never answers
@@ -69,7 +69,7 @@ export declare function disclosedRuleSet(rules: readonly PersistedRuleHitRule[])
  *    resumed-call belt, which vetoes only the call form: a person already answered that call's question.
  * An allow hit (or no hit) returns the decision untouched: the allow arm is the station's.
  */
-export declare function applyPersistedTightening(decision: PermissionResult, read: PersistedRuleRead | undefined, call?: ToolCallRequest): {
+export declare function applyPersistedTightening(decision: PermissionResult, read: PersistedRuleRead | undefined, call: ToolCallRequest): {
     decision: PermissionResult;
     tightened?: "deny" | "ask" | "unreadable" | "store_unreadable";
 };