@sema-agent/core 7.55.0 → 7.57.0

package/dist/core/tool-name-aliases.d.ts

@@ -16,8 +16,8 @@ import type { RuleBehavior } from "./permission-rule-model.js";
  *    with the successor, where any other unknown name stays the generic roster miss.
  *
  * What REMAINS is validation data: {@link RETIRED_TOOL_NAMES} maps every name the engine ever
- * retired to a one-line guidance string, and {@link judgeRuleToolName} is the ONE reading of it a rule's
- * tool name gets. They exist because deleting the mapping flips stale POLICY entries from "silently
+ * retired to a one-line guidance string, and {@link judgeRuleToolName} is the ONE judgment of it a rule's
+ * tool name gets ({@link toolNameFaultOf} adds the near-miss step: the one reading). They exist because deleting the mapping flips stale POLICY entries from "silently
  * matched" to "silently matches nothing" — and for a deny/requireApproval entry that direction WIDENS
  * the surface. `validatePermissionRules` (permission-rules.ts) does NOT classify retired names itself:
  * which names a deployment mounts its OWN tool under is a roster fact, and the judgment takes the roster.
@@ -44,8 +44,8 @@ export declare const RULE_TOOL_NAME_VERDICTS: readonly ["current", "retired", "u
  *    (the server / remote agent) is empty or not a spelling the mint produces for any peer (the name is read as written —
  *    peers compare exactly — and every mounted tool carries the minted spelling, so the name reaches none of them), or the
  *    tool segment is EMPTY (a trailing separator, `mcp__srv__`: no tool is minted under an empty segment), or the peer segment
- *    carries a wildcard the list's behavior does not read (`mcp__git*`, `mcp__*__get_*`; and `mcp__*` / `mcp__*__*` in an
- *    allow list — a deny or ask list reads those two as every tool of the protocol, see {@link wholeProtocolOf}). `guidance`
+ *    carries a wildcard the list's behavior does not read (`mcp__git*`, `mcp__*`, `mcp__*__get_*` in an allow list — a deny or
+ *    ask list reads every `*` as part of a glob over the whole name, see {@link readsNameGlob}). `guidance`
  *    says so in one line; `currentName` is the whole name rewritten with the spelling the mint produces (`mcp__github.com__*` →
  *    `mcp__github_com__*`), absent when a segment is empty or wild and there is nothing to rewrite. A tool segment that is not
  *    empty is never judged: it is a literal tool name or a glob over one, and an unmatched one is the audit's advisory.
@@ -81,25 +81,55 @@ export declare function splitNamespacedName(name: string): {
     readonly tool?: string;
 } | undefined;
 /**
- * The protocol a name spells as a WHOLE — `mcp__*` and `mcp__*__*`, the two spellings that name every tool of every peer of one
- * namespace — or `undefined` for any other name. THE one reading of that spelling: the name judgment, the covering matcher, the
- * entry reader and the tool-name lists all ask it, so none keeps a second list of the spellings.
+ * Does a list of this behavior read a `*` in a tool name as a glob over the WHOLE name — anywhere in it, the lone `*` (every tool)
+ * included? A list that RESTRICTS (`deny`, `ask`) does: it reaches every tool any of whose names the glob matches (the reference's
+ * deny and ask lookups match a rule's tool name with `globMatching` on, and its settings validator says "deny and ask rules accept
+ * wildcards anywhere"). A list that GRANTS (`allow`) does not — an allow names the scope it widens, so it reads a `*` only in the
+ * tool segment after a literal `<ns>__<peer>__` ({@link grantWildcardRefusalOf}) — and neither does a caller that states no behavior.
  */
-export declare function wholeProtocolOf(name: string): ProtocolNamespace | undefined;
+export declare function readsNameGlob(behavior: RuleBehavior | undefined): boolean;
 /**
- * Does a list of this behavior read a whole-protocol spelling ({@link wholeProtocolOf})? A list that RESTRICTS (`deny`, `ask`) does:
- * the spelling reaches every tool of the protocol. A list that GRANTS (`allow`) does not — an allow names the scope it widens,
- * and the reference's allow settings refuse a wildcard in the server position — and neither does a caller that states no
- * behavior: the spelling then names no tool, the reading every list had before it was one.
+ * The sentence for a `*` in a tool name that a GRANTING list does not read — anywhere but the tool segment after a literal, non-empty
+ * `<ns>__<peer>__` — or `undefined` (no `*`, or one in that segment). The one test every allow-side reader asks (a policy's allowlist
+ * constructor, an entry list, a run's allowed list, the name judgment's allow arm), so a spelling an allow cannot read is refused
+ * or read as nothing in one sentence wherever it is written.
  */
-export declare function readsWholeProtocol(behavior: RuleBehavior | undefined): boolean;
-/** The judgment's sentence for a namespaced name whose peer segment carries a wildcard the list's `behavior` does not read, else `undefined`
- *  — only that arm of the judgment, for the stations that ask it with no roster (a rule policy's compile, an allowlist constructor). */
-export declare function wildcardPeerRefusalOf(name: string, behavior: RuleBehavior | undefined): string | undefined;
+export declare function grantWildcardRefusalOf(name: string): string | undefined;
 /** See {@link RuleToolNameVerdict}. Pure; the one answer to "is this rule's tool name a name that reaches no tool".
- *  `behavior` = the behavior of the list the name is written in: a restricting one (`deny`, `ask`) reads the whole-protocol
- *  spelling ({@link wholeProtocolOf}) as `current`; with `allow` or none the spelling names no peer and is `unmintable_segment`. */
+ *  `behavior` = the behavior of the list the name is written in: a restricting one (`deny`, `ask`) reads a `*` anywhere in the name
+ *  as a glob ({@link readsNameGlob}) — such a name outside every namespace, or with a glob in its peer segment, is a pattern and
+ *  `current`; with `allow` or none a wildcard peer names no peer and is `unmintable_segment`. */
 export declare function judgeRuleToolName(name: string, roster: ReadonlySet<string>, behavior?: RuleBehavior): RuleToolNameVerdict;
+/**
+ * THE near-miss reading of a tool name the judgment calls current: the spelling the roster carries when it carries no tool of this
+ * exact name but one that differs from it only by case (`BASH` beside `Bash`), else `undefined`. Two kinds of name are never a near
+ * miss, because the roster they would be read against is not the final one: an engine tool's (the engine mounts some of its tools
+ * after a list is read) and a protocol tool's (a refresh mounts and unmounts them while the run goes on) — in both the exact
+ * spelling can be the right one by the time it matters. Every station that asks "is this name a case twin of a carried tool" reads
+ * this answer: an entry list and the persisted grammar's whole-tool rule through {@link toolNameFaultOf}, and a tool policy's name
+ * lists (the prepare-time policy-name audit, which reads two rosters and skips an inherited layer) directly.
+ */
+export declare function nearMissSpellingOf(name: string, roster: ReadonlySet<string>): string | undefined;
+/** What {@link toolNameFaultOf} finds wrong with a rule's tool name: the judgment's stale words (`tool_name`, with the verdict and
+ *  its facts), or another spelling of a carried tool (`near_miss`, the spelling to write). */
+export type ToolNameFault = {
+    readonly reason: "tool_name";
+    readonly verdict: Exclude<RuleToolNameVerdict["kind"], "current">;
+    readonly guidance?: string;
+    readonly currentName?: string;
+} | {
+    readonly reason: "near_miss";
+    readonly currentName: string;
+};
+/**
+ * THE ONE reading of a rule's tool name against a roster — the name judgment's stale words, then, for a name the judgment calls
+ * current but the roster does not carry exactly, whether the roster carries it under another case ({@link nearMissSpellingOf}).
+ * `undefined` = no fault: the name is carried, or nothing carried is another spelling of it. A name the roster simply does not
+ * carry is silent: a tool of that name may be mounted later, and a list shared across runs is not wrong because one run lacks a
+ * tool. A list entry (`readRuleEntry`) and a stored whole-tool rule (`parseRuleText`) read a name through this and nothing else;
+ * the policy-name audit composes the same two steps itself over two rosters (a candidate to fold in).
+ */
+export declare function toolNameFaultOf(name: string, roster: ReadonlySet<string>, behavior: RuleBehavior | undefined): ToolNameFault | undefined;
 /** The two kinds of tool-name miss — a closed set. `unknown`: the name is none the engine ever mounted (a typo, a
  *  guess). `expected-absent`: the name is one the engine RETIRED ({@link RETIRED_TOOL_NAMES}), so its absence is no
  *  surprise and the table says what replaced it (the reference spells the same two words for its render-time miss). */

package/dist/core/tool-name-aliases.js

@@ -1,5 +1,6 @@
 import { carriesNamespaceSeparator, protocolOf } from "./protocol-table.js";
 import { mintNamespacePrefix } from "./protocol-naming.js";
+import { catalogToolNames } from "./tool-registry.js";
 export const RETIRED_TOOL_NAMES = new Map([
     ["read_file", 'renamed "Read"'],
     ["edit_file", 'renamed "Edit"'],
@@ -53,19 +54,20 @@ export function splitNamespacedName(name) {
     const [peer = "", ...rest] = name.slice(ns.prefix.length).split(NAMESPACE_SEPARATOR);
     return rest.length > 0 ? { ns, peer, tool: rest.join(NAMESPACE_SEPARATOR) } : { ns, peer };
 }
-const WHOLE_PROTOCOL_PEER = "*";
-export function wholeProtocolOf(name) {
-    const split = splitNamespacedName(name);
-    return split !== undefined && spellsWholeProtocol(split) ? split.ns : undefined;
-}
-function spellsWholeProtocol(split) {
-    return split.peer === WHOLE_PROTOCOL_PEER && (split.tool === undefined || split.tool === "*");
-}
-export function readsWholeProtocol(behavior) {
+export function readsNameGlob(behavior) {
     return behavior === "deny" || behavior === "ask";
 }
 function peerWildcardGuidance(ns) {
-    return `a ${ns.id} entry takes no wildcard in its peer segment — write ${ns.prefix}<peer> (every tool of one peer) or ${ns.prefix}<peer>${NAMESPACE_SEPARATOR}<tool> (one tool); a deny or ask entry may also write ${ns.prefix}* or ${ns.prefix}*${NAMESPACE_SEPARATOR}* for every ${ns.id} tool`;
+    return `an allow entry takes no wildcard in a ${ns.id} name's peer segment — write ${ns.prefix}<peer> (every tool of one peer), ${ns.prefix}<peer>${NAMESPACE_SEPARATOR}<tool> (one tool) or ${ns.prefix}<peer>${NAMESPACE_SEPARATOR}<glob> (the tools of one peer the glob matches); a deny or ask entry may put a \`*\` anywhere in a name`;
+}
+const GRANT_WILDCARD_GUIDANCE = "an allow entry names the tools it grants — a `*` in a tool name is read on an allow list only in the tool segment after a literal <ns>__<peer>__ (mcp__<server>__*), so this entry grants nothing; name the tools, or put the wildcard on a deny or ask entry, which reads a `*` anywhere in a name";
+export function grantWildcardRefusalOf(name) {
+    if (!name.includes("*"))
+        return undefined;
+    const split = splitNamespacedName(name);
+    if (split === undefined)
+        return GRANT_WILDCARD_GUIDANCE;
+    return split.peer !== "" && !split.peer.includes("*") && split.tool !== undefined ? undefined : peerWildcardGuidance(split.ns);
 }
 function unmintableSegmentOf(split, behavior) {
     const { ns, peer, tool } = split;
@@ -74,7 +76,7 @@ function unmintableSegmentOf(split, behavior) {
     if (tool === "")
         return { kind: "unmintable_segment", guidance: `the ${ns.id} name has an empty tool segment — no tool is minted under it; write ${ns.prefix}<peer> to cover every tool of a peer, or ${ns.prefix}<peer>${NAMESPACE_SEPARATOR}<tool> for one tool` };
     if (peer.includes("*"))
-        return spellsWholeProtocol(split) && readsWholeProtocol(behavior) ? undefined : { kind: "unmintable_segment", guidance: peerWildcardGuidance(ns) };
+        return readsNameGlob(behavior) ? undefined : { kind: "unmintable_segment", guidance: peerWildcardGuidance(ns) };
     const minted = mintNamespacePrefix(ns, peer).slice(ns.prefix.length, -NAMESPACE_SEPARATOR.length);
     if (minted === peer)
         return undefined;
@@ -84,13 +86,6 @@ function unmintableSegmentOf(split, behavior) {
         currentName: `${ns.prefix}${minted}${tool !== undefined ? `${NAMESPACE_SEPARATOR}${tool}` : ""}`,
     };
 }
-export function wildcardPeerRefusalOf(name, behavior) {
-    const split = splitNamespacedName(name);
-    if (split === undefined || !split.peer.includes("*"))
-        return undefined;
-    const verdict = unmintableSegmentOf(split, behavior);
-    return verdict?.kind === "unmintable_segment" ? verdict.guidance : undefined;
-}
 export function judgeRuleToolName(name, roster, behavior) {
     if (roster.has(name))
         return CURRENT;
@@ -101,9 +96,31 @@ export function judgeRuleToolName(name, roster, behavior) {
     }
     const split = splitNamespacedName(name);
     if (split === undefined)
-        return carriesNamespaceSeparator(name) ? UNPREFIXED : CURRENT;
+        return carriesNamespaceSeparator(name) && !(readsNameGlob(behavior) && name.includes("*")) ? UNPREFIXED : CURRENT;
     return unmintableSegmentOf(split, behavior) ?? CURRENT;
 }
+function mountedSpellingOf(name, roster) {
+    const folded = name.toLowerCase();
+    for (const mounted of roster)
+        if (mounted.toLowerCase() === folded)
+            return mounted;
+    return undefined;
+}
+export function nearMissSpellingOf(name, roster) {
+    if (roster.has(name) || catalogToolNames().has(name) || splitNamespacedName(name) !== undefined)
+        return undefined;
+    return mountedSpellingOf(name, roster);
+}
+export function toolNameFaultOf(name, roster, behavior) {
+    const verdict = judgeRuleToolName(name, roster, behavior);
+    if (verdict.kind === "unprefixed_namespace")
+        return { reason: "tool_name", verdict: verdict.kind };
+    if (verdict.kind !== "current") {
+        return { reason: "tool_name", verdict: verdict.kind, guidance: verdict.guidance, ...(verdict.currentName !== undefined ? { currentName: verdict.currentName } : {}) };
+    }
+    const mounted = nearMissSpellingOf(name, roster);
+    return mounted === undefined ? undefined : { reason: "near_miss", currentName: mounted };
+}
 export const TOOL_MISS_KINDS = Object.freeze(["unknown", "expected-absent"]);
 const [UNKNOWN_MISS, ABSENT_MISS] = TOOL_MISS_KINDS;
 export function judgeToolNameMiss(name, roster) {

package/dist/core/tool-name-readings.d.ts

@@ -8,7 +8,8 @@
  *                 answers to ({@link heldBy}); a set-valued table is read as the union of its entries ({@link heldValues}).
  *  · `seat`     — a multi-key seat keyed on engine names: ONE name is chosen ({@link seatOf}) and every key of the seat is
  *                 read under it. `tier` = the name whose irreversibility tier is strictest (`never < maybe < always`, an
- *                 absent tier lowest, ties to the earlier name of the call); `member` = the first name the table holds.
+ *                 absent tier lowest; a tie goes to the call's wire name — the tool that runs judges its own call with its
+ *                 own probe — then to the earlier name of the call); `member` = the first name the table holds.
  *  · `wire`     — a GRANT or a ROUTING keyed on an engine name: the call's wire name only ({@link wireOf}).
  *  · `spelling` — a record of what the model said (stream frames, transcripts, counters): the harness event's own name;
  *                 no port — listed so the table is complete.
@@ -78,10 +79,6 @@ export declare const NAME_READINGS: {
         readonly rank: "member";
         readonly file: string;
     };
-    readonly "lanes.contentQuestionClass": {
-        readonly kind: "any";
-        readonly file: string;
-    };
     readonly "lanes.readOnlyShellAllow": {
         readonly kind: "wire";
         readonly file: string;
@@ -90,22 +87,10 @@ export declare const NAME_READINGS: {
         readonly kind: "wire";
         readonly file: string;
     };
-    readonly "lanes.contentAskRoute": {
-        readonly kind: "wire";
-        readonly file: string;
-    };
     readonly "lanes.orgContentAskExemption": {
         readonly kind: "wire";
         readonly file: string;
     };
-    readonly "lanes.allowLayerQuestionSkip": {
-        readonly kind: "wire";
-        readonly file: string;
-    };
-    readonly "lanes.sandboxQuestionSkip": {
-        readonly kind: "wire";
-        readonly file: string;
-    };
     readonly "policy.nameLists": {
         readonly kind: "any";
         readonly file: string;
@@ -142,7 +127,7 @@ export declare const NAME_READINGS: {
         readonly kind: "any";
         readonly file: string;
     };
-    readonly "policy.durableQuestion": {
+    readonly "policy.persistedToolRule": {
         readonly kind: "any";
         readonly file: string;
     };
@@ -240,10 +225,6 @@ export declare const NAME_READINGS: {
         readonly kind: "spelling";
         readonly file: string;
     };
-    readonly "inherited.questionFloat": {
-        readonly kind: "wire";
-        readonly file: string;
-    };
     readonly "inherited.askFace": {
         readonly kind: "wire";
         readonly file: string;
@@ -252,14 +233,6 @@ export declare const NAME_READINGS: {
         readonly kind: "wire";
         readonly file: string;
     };
-    readonly "resume.editRecheckQuestionSkip": {
-        readonly kind: "wire";
-        readonly file: string;
-    };
-    readonly "resume.questionArgsShown": {
-        readonly kind: "wire";
-        readonly file: string;
-    };
     readonly "budget.exemptResult": {
         readonly kind: "wire";
         readonly file: string;
@@ -347,8 +320,9 @@ export interface TierSeat extends Seat<IrreversibilityTierWord> {
     }): boolean;
 }
 /**
- * A `seat` site's read. A `tier` seat takes the irreversibility tier table and picks the name whose tier is strictest;
- * a `member` seat takes a table (a map, or a set whose value reads `true`) and picks the first name it holds.
+ * A `seat` site's read. A `tier` seat takes the irreversibility tier table and picks the name whose tier is strictest, a tie
+ * going to the call's wire name, then to its earlier name; a `member` seat takes a table (a map, or a set whose value reads
+ * `true`) and picks the first name it holds.
  */
 export declare function seatOf(site: TierSeatSite, tiers: {
     get(name: string): IrreversibilityTierWord | undefined;

package/dist/core/tool-name-readings.js

@@ -21,13 +21,9 @@ export const NAME_READINGS = {
     "gate.preToolUse": wire("src/core/hooks.ts"),
     "gate.askFace": wire("src/core/runner/gate-exit.ts"),
     "fold.readStation": seat("member", "src/tools/fs/shell-read-check.ts"),
-    "lanes.contentQuestionClass": any(LANES),
     "lanes.readOnlyShellAllow": wire(LANES),
     "lanes.modeFileCommand": wire(LANES),
-    "lanes.contentAskRoute": wire(LANES),
     "lanes.orgContentAskExemption": wire(LANES),
-    "lanes.allowLayerQuestionSkip": wire(LANES),
-    "lanes.sandboxQuestionSkip": wire(LANES),
     "policy.nameLists": any(POLICY),
     "policy.shellToolsList": any(POLICY),
     "policy.projectionReplay": any(POLICY),
@@ -37,7 +33,7 @@ export const NAME_READINGS = {
     "gate.skillActivationSeat": wire(GATE),
     "policy.permissionRules": any("src/core/permission-rules.ts"),
     "policy.persistedGrammar": any("src/core/permission-rule-model.ts"),
-    "policy.durableQuestion": any("src/core/ask-question.ts"),
+    "policy.persistedToolRule": any("src/core/permission-rule-model.ts"),
     "policy.sensitivePathGuardedByName": any("src/core/sensitive-path-policy.ts"),
     "floor.protectivePathTarget": seat("member", "src/core/tool-registry.ts"),
     "floor.protectiveHostTarget": seat("member", "src/core/host-target.ts"),
@@ -60,11 +56,8 @@ export const NAME_READINGS = {
     "stats.subagentToolCounter": spelling("src/agents/subagent.ts"),
     "activity.sink": spelling(HANDLERS),
     "reconcile.orphanEffect": spelling("src/core/session-reconcile.ts"),
-    "inherited.questionFloat": wire(CHAIN),
     "inherited.askFace": wire(CHAIN),
     "card.reserved": wire("src/core/tool-roster.ts"),
-    "resume.editRecheckQuestionSkip": wire("src/core/runner/resume-apply.ts"),
-    "resume.questionArgsShown": wire("src/core/runner/run-leg.ts"),
     "budget.exemptResult": wire("src/core/tool-result-budget.ts"),
     "compaction.compactableResult": wire("src/core/context-edit.ts"),
 };
@@ -112,7 +105,7 @@ export function seatOf(site, table, call) {
     const valueAt = (n) => (typeof table.get === "function" ? table.get(n) : table.has(n) ? true : undefined);
     if (r.kind === "seat" && r.rank === "tier") {
         let best;
-        for (const n of names) {
+        for (const n of [call.toolName, ...names.filter((name) => name !== call.toolName)]) {
             const v = valueAt(n);
             if (v === undefined)
                 continue;