@sema-agent/core 7.8.0 → 7.9.1

package/dist/stores/file/permission-rule-store.d.ts

@@ -2,17 +2,21 @@
  * design/179 §5/§8 / design/389 — the file backend of the permission-rule store's DURABLE partition (one
  * bucket file per owner), plus the file home of the ORG partition's durable state (`org.json`).
  *
- * ## Schema 3 and the one-time migration
+ * ## Schema 4 and the one-time migration
  *
  * Pre-389 files (schema 1/2) kept the org last-known-good snapshot as an `org` block INSIDE each
- * principal's bucket file — deployment-wide policy stored per person. Schema 3 drops that block; the org
- * state lives in one `org.json` beside the buckets. `FileDurableRulePartitionProvider` migrates every
- * legacy bucket file ONCE at construction (under the writer lock: the migration is a write, and a live
- * older writer over the same directory is refused rather than raced), folding each file's `org` block
- * into `org.json` by the anti-rollback rule (the highest high-water wins; an equal revision with
- * different content keeps what is already installed and discloses). After that the reader accepts
- * schema 3 ONLY — a 1/2/4 file is refused whole, loudly (zero rules + disclosure). There is no second
- * read path for the old shapes: the migrator is the only code that reads them, and it runs once.
+ * principal's bucket file — deployment-wide policy stored per person. Schema 3 dropped that block; the org
+ * state lives in one `org.json` beside the buckets. Schema 4 adds the `behavior` member to every rule row,
+ * tombstone and quarantine row (the rule identity is the (behavior, text, scope) triple): a schema-3 row has
+ * none, and every row a schema-3 engine wrote was an allow, so the migration stamps `"allow"` on each — the
+ * ONE reading of the pre-field row (`readRowBehavior`), applied once, here, never at a read face.
+ * `FileDurableRulePartitionProvider` migrates every legacy bucket file (1, 2 or 3) ONCE at construction
+ * (under the writer lock: the migration is a write, and a live older writer over the same directory is
+ * refused rather than raced), folding a 1/2 file's `org` block into `org.json` by the anti-rollback rule
+ * (the highest high-water wins; an equal revision with different content keeps what is already installed
+ * and discloses). After that the reader accepts schema 4 ONLY — a 1/2/3/5 file is refused whole, loudly
+ * (zero rules + disclosure). There is no second read path for the old shapes: the migrator is the only
+ * code that reads them, and it runs once.
  *
  * ## Why this store builds its own symlink refusal
  *
@@ -55,23 +59,23 @@
  * and is not: it detects corruption, and it does not detect an editor, because an editor recomputes it.
  * For this backend the trust is host = user, exactly as for the settings file it mirrors.
  */
-import type { PersistedAllowRule, RuleTombstone } from "../../core/permission-rule-model.js";
-import type { DurableRulePartition, DurableRulePartitionProvider, PermissionRuleWriter, QuarantinedRuleAdd, RuleOwner, RuleSyncFrontier, StoredAllowRules, WritableDurableRulePartition } from "../../core/permission-rule-store.js";
+import type { PersistedRule, RuleTombstone } from "../../core/permission-rule-model.js";
+import type { DurableRulePartition, DurableRulePartitionProvider, PermissionRuleWriter, QuarantinedRuleAdd, RuleOwner, RuleSyncFrontier, StoredRules, WritableDurableRulePartition } from "../../core/permission-rule-store.js";
 import { PERMISSION_RULE_WRITER } from "../../core/permission-rule-store.js";
 import type { OrgRuleStatePersistence, PersistedOrgRuleState } from "../../core/permission-rule-org.js";
 import type { StoreDurability, StoreFidelity } from "../../core/checkpoint-store.js";
 /**
  * The on-disk shape of one bucket. `schemaVersion` is the only field a future reader may rely on before
- * validating. Schema 3 (design/389): the five core fields plus the OPTIONAL `sync` block (observation
- * vector + round timestamp) and `quarantined` area (rows moved out of the live view, bytes preserved).
- * The org state is NOT here — see {@link OrgStateFile}.
+ * validating. Schema 4: the five core fields plus the OPTIONAL `sync` block (observation vector + round
+ * timestamp) and `quarantined` area (rows moved out of the live view, bytes preserved); every rule,
+ * tombstone and quarantine row carries its `behavior`. The org state is NOT here — see {@link OrgStateFile}.
  */
 interface RuleFile {
-    schemaVersion: 3;
+    schemaVersion: 4;
     actor: string;
     counter: number;
     rev: number;
-    rules: PersistedAllowRule[];
+    rules: PersistedRule[];
     tombstones: RuleTombstone[];
     sync?: {
         observedVector?: RuleSyncFrontier;
@@ -88,10 +92,10 @@ interface OrgStateFile {
 }
 /** The org partition's durable home in a rule directory. */
 export declare const ORG_STATE_FILE = "org.json";
-/** Written once the directory is known to hold only schema-3 buckets. Its presence ends the legacy
- *  scan for good: a schema 1/2 bucket that appears AFTERWARDS (an older engine writing after the
+/** Written once the directory is known to hold only schema-4 buckets. Its presence ends the legacy
+ *  scan for good: a schema 1/2/3 bucket that appears AFTERWARDS (an older engine writing after the
  *  cutover) is refused by the reader on every later construction too, never re-admitted by a restart. */
-export declare const SCHEMA3_MARKER_FILE = ".rule-schema-3";
+export declare const SCHEMA_MARKER_FILE = ".rule-schema-4";
 /** The anti-rollback contract's DESIGNED refusal (a lower high-water mark, or different content under
  *  the same revision) — distinguished by class from every other install failure, because the two are
  *  handled in opposite directions by the migration: a refusal means the block is superseded and may be
@@ -148,7 +152,7 @@ declare class FileDurableRulePartition implements WritableDurableRulePartition {
      */
     private screenDurableRows;
     private write;
-    list(): Promise<StoredAllowRules>;
+    list(): Promise<StoredRules>;
     /** The quarantine area (design/182 §5.2/§8.3): introspection only — never part of `list()`. */
     quarantined(): Promise<QuarantinedRuleAdd[]>;
     /**
@@ -209,7 +213,8 @@ export declare class FileDurableRulePartitionProvider implements DurableRulePart
         dataRoot?: string;
     });
     /**
-     * Fold every legacy bucket file in `dir` into schema 3 and its `org` block into `org.json`. A no-op on a
+     * Fold every legacy bucket file in `dir` into schema 4 (stamping `behavior: "allow"` on every pre-field
+     * row — the one pre-field reading) and a 1/2 file's `org` block into `org.json`. A no-op on a
      * directory with no legacy file (zero writes, the lock untouched — the second construction over a
      * migrated directory is byte-silent). A legacy file whose checksum or shape does not hold is NOT
      * migrated: its bytes stay where they are for a person to look at, and the reader keeps refusing it
@@ -220,10 +225,10 @@ export declare class FileDurableRulePartitionProvider implements DurableRulePart
      * shape — the old engine's buckets are refused whole until they are migrated.
      */
     private migrateLegacyBuckets;
-    /** Publish the schema-3 completion marker (idempotent, atomic, no lock: its content never changes and
+    /** Publish the schema-4 completion marker (idempotent, atomic, no lock: its content never changes and
      *  a concurrent writer of the same bytes is harmless). A failure to write it is disclosed, not thrown —
      *  the next construction simply scans again, which is the safe direction. */
-    private writeSchema3Marker;
+    private writeSchemaMarker;
     /** The org partition's durable home in this directory (design/182 §7.4 contract; `org.json`). Shares
      *  this provider's writer lock — an install is a write. */
     orgStatePersistence(): OrgRuleStatePersistence;

package/dist/stores/file/permission-rule-store.js

@@ -1,17 +1,18 @@
 import { closeSync, constants as FS, existsSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { createHash, randomBytes } from "node:crypto";
+import { isRuleBehavior, readRowBehavior } from "../../core/permission-rule-model.js";
 import { PERMISSION_RULE_WRITER, applySyncJoin, applyTombstones, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, foldDelta, } from "../../core/permission-rule-store.js";
 import { canonicalize } from "../../core/canonical-json.js";
 import { BootLock } from "./fs-atomic.js";
 import { assertAdoptionBootGate } from "./adoption/marker.js";
 function isRuleFile(v) {
     const p = v;
-    return typeof p === "object" && p !== null && p.schemaVersion === 3 && Array.isArray(p.rules) && Array.isArray(p.tombstones) && typeof p.rev === "number" && (p.quarantined === undefined || Array.isArray(p.quarantined));
+    return typeof p === "object" && p !== null && p.schemaVersion === 4 && Array.isArray(p.rules) && Array.isArray(p.tombstones) && typeof p.rev === "number" && (p.quarantined === undefined || Array.isArray(p.quarantined));
 }
-function isLegacyRuleFile(v) {
+function isOlderRuleFile(v) {
     const p = v;
-    return typeof p === "object" && p !== null && (p.schemaVersion === 1 || p.schemaVersion === 2) && Array.isArray(p.rules) && Array.isArray(p.tombstones) && typeof p.rev === "number";
+    return typeof p === "object" && p !== null && (p.schemaVersion === 1 || p.schemaVersion === 2 || p.schemaVersion === 3) && Array.isArray(p.rules) && Array.isArray(p.tombstones) && typeof p.rev === "number";
 }
 function isOrgStateFile(v) {
     const p = v;
@@ -24,7 +25,7 @@ function jsonForm(v) {
     return JSON.parse(JSON.stringify(v));
 }
 export const ORG_STATE_FILE = "org.json";
-export const SCHEMA3_MARKER_FILE = ".rule-schema-3";
+export const SCHEMA_MARKER_FILE = ".rule-schema-4";
 export class OrgRevisionRefusal extends Error {
 }
 const LOCAL_OWNER_FILE = "local-owner.json";
@@ -158,8 +159,8 @@ class FileDurableRulePartition {
         }
         if (!isRuleFile(parsed)) {
             const sv = schemaVersionWord(parsed);
-            const why = sv === 1 || sv === 2
-                ? `${this.file} is a schema ${String(sv)} bucket that was not migrated to schema 3 (written by an older engine after this directory was migrated?); refusing the whole file and loading zero rules`
+            const why = sv === 1 || sv === 2 || sv === 3
+                ? `${this.file} is a schema ${String(sv)} bucket that was not migrated to schema 4 (written by an older engine after this directory was migrated?); refusing the whole file and loading zero rules`
                 : `${this.file} does not carry a readable rule-file shape; refusing the whole file and loading zero rules`;
             this.disclose(why);
             return { unreadable: why };
@@ -170,6 +171,19 @@ class FileDurableRulePartition {
             this.disclose(why);
             return { unreadable: why };
         }
+        const rowKinds = [
+            ["rule", parsed.rules],
+            ["tombstone", parsed.tombstones],
+            ["quarantined", parsed.quarantined ?? []],
+        ];
+        for (const [kind, rows] of rowKinds) {
+            const bad = rows.findIndex((r) => !isRuleBehavior(r?.behavior));
+            if (bad !== -1) {
+                const why = `${this.file} carries a ${kind} row (#${bad}) whose behavior word is outside deny/ask/allow — a schema 4 row must name its behavior; refusing the whole file and loading zero rules`;
+                this.disclose(why);
+                return { unreadable: why };
+            }
+        }
         return { file: parsed };
     }
     disclose(message) {
@@ -218,7 +232,7 @@ class FileDurableRulePartition {
             throw new Error(`refusing to write the permission-rule store while it cannot be read: ${r.unreadable}`);
         }
         if ("absent" in r) {
-            return { schemaVersion: 3, actor: `file-${randomBytes(6).toString("hex")}`, counter: 0, rev: 0, rules: [], tombstones: [] };
+            return { schemaVersion: 4, actor: `file-${randomBytes(6).toString("hex")}`, counter: 0, rev: 0, rules: [], tombstones: [] };
         }
         return {
             schemaVersion: r.file.schemaVersion,
@@ -324,7 +338,7 @@ export class FileDurableRulePartitionProvider {
     migrateLegacyBuckets() {
         if (!existsSync(this.dir))
             return;
-        if (existsSync(join(this.dir, SCHEMA3_MARKER_FILE)))
+        if (existsSync(join(this.dir, SCHEMA_MARKER_FILE)))
             return;
         try {
             assertSafeDir(this.dir);
@@ -359,7 +373,7 @@ export class FileDurableRulePartitionProvider {
                     legacy.push({ name, file: read });
             }
             if (legacy.length === 0) {
-                this.writeSchema3Marker();
+                this.writeSchemaMarker();
                 return;
             }
             const orgHome = this.fileOrgPersistence();
@@ -380,12 +394,18 @@ export class FileDurableRulePartitionProvider {
                         }
                     }
                 }
-                const next = { ...rest, schemaVersion: 3 };
+                const stamped = stampRowBehaviors(rest);
+                if (stamped === undefined) {
+                    complete = false;
+                    this.onError?.(`bucket ${name} left untouched: a row carries a behavior word outside deny/ask/allow, which no engine version wrote; the file is not migrated`);
+                    continue;
+                }
+                const next = { ...stamped, schemaVersion: 4 };
                 atomicPublish(this.dir, join(this.dir, name), JSON.stringify({ ...next, checksum: checksumOf(next) }, null, 2));
-                this.onError?.(`migrated ${name} to rule-file schema 3${org !== undefined ? ` (its org block moved to ${ORG_STATE_FILE})` : ""}`);
+                this.onError?.(`migrated ${name} to rule-file schema 4${org !== undefined ? ` (its org block moved to ${ORG_STATE_FILE})` : ""}`);
             }
             if (complete)
-                this.writeSchema3Marker();
+                this.writeSchemaMarker();
         }
         finally {
             if (!held) {
@@ -394,12 +414,12 @@ export class FileDurableRulePartitionProvider {
             }
         }
     }
-    writeSchema3Marker() {
+    writeSchemaMarker() {
         try {
-            atomicPublish(this.dir, join(this.dir, SCHEMA3_MARKER_FILE), JSON.stringify({ schemaVersion: 3 }));
+            atomicPublish(this.dir, join(this.dir, SCHEMA_MARKER_FILE), JSON.stringify({ schemaVersion: 4 }));
         }
         catch (err) {
-            this.onError?.(`could not write ${SCHEMA3_MARKER_FILE}: ${err.message}; the legacy scan will run again next construction`);
+            this.onError?.(`could not write ${SCHEMA_MARKER_FILE}: ${err.message}; the legacy scan will run again next construction`);
         }
     }
     orgStatePersistence() {
@@ -449,6 +469,34 @@ export class FileDurableRulePartitionProvider {
         this.lock = undefined;
     }
 }
+function stampRowBehaviors(body) {
+    const rules = [];
+    for (const r of body.rules) {
+        const behavior = readRowBehavior(r.behavior);
+        if (behavior === undefined)
+            return undefined;
+        rules.push({ ...r, behavior });
+    }
+    const tombstones = [];
+    for (const t of body.tombstones) {
+        const behavior = readRowBehavior(t.behavior);
+        if (behavior === undefined)
+            return undefined;
+        tombstones.push({ ...t, behavior });
+    }
+    let quarantined;
+    if (body.quarantined !== undefined) {
+        quarantined = [];
+        for (const q of body.quarantined) {
+            const behavior = readRowBehavior(q.behavior);
+            if (behavior === undefined)
+                return undefined;
+            quarantined.push({ ...q, behavior });
+        }
+    }
+    const { rules: _r, tombstones: _t, quarantined: _q, ...rest } = body;
+    return { ...rest, rules, tombstones, ...(quarantined !== undefined ? { quarantined } : {}) };
+}
 function readLegacyBucket(file) {
     let raw;
     try {
@@ -467,7 +515,7 @@ function readLegacyBucket(file) {
     catch {
         return undefined;
     }
-    if (!isLegacyRuleFile(parsed))
+    if (!isOlderRuleFile(parsed))
         return undefined;
     const { checksum, ...body } = parsed;
     return checksum === checksumOf(body) ? parsed : undefined;

package/dist/tools/fs/bash-readonly-classifier.d.ts

@@ -80,7 +80,7 @@ export interface LeadingCommandNameOptions {
      * name instead of refusing it.
      *
      * OPT-IN, and used by ONE family of callers: the persisted permission-RULE lane
-     * ({@link import("../../core/permission-rule-model.js").parseAllowRuleText} and its matcher), where
+     * ({@link import("../../core/permission-rule-model.js").parseRuleText} and its matcher), where
      * both sides of the comparison are literal text a person read on an approval card. The refusal this
      * option lifts exists for the argv[0]-NAME filters (the read-only allowlist, the coarse
      * command-name policy, the skill specifier): those compare a bare token against a name set, and a

package/dist/tools/fs/fs-pdf.d.ts

@@ -29,7 +29,7 @@ type ReadPdfReturn = string | {
  *   downsampler seam then applies the same pipeline as the Read image branch). poppler absent → HONEST
  *   degradation with the working alternative, never a fake success.
  * Wire discipline: the base64 payload rides `details.file` only while ≤48K chars (same OMIT rule as the
- * image variant — a bigger card would be dropped whole by the structuredFrom 4×cap and blind the shell).
+ * image variant — a bigger card would be dropped whole by the card projector's 4×cap and blind the shell).
  * structured-card audit item B (2026-08-05): that budget management assumed `"document"` was on `CC_DETAIL_TYPES`, which
  * it was not — every `document` card, sized or not, was dropped at the gate, making the 48K rule dead
  * code and the pages/fallback-level disclosure invisible to a host. The word is registered now.

package/dist/tools/fs/fs-search-tools.d.ts

@@ -1,6 +1,7 @@
 import type { AgentTool, ExecutionEnv } from "../../internal/harness-types.js";
 import type { ReadDenyMatcher } from "./read-deny.js";
 import type { ReadFace } from "./read-face.js";
+import type { CwdRef } from "./fs-shared.js";
 /**
  * The Grep card's details assembly, PURE over the engine text ({mode, offset} from the request) —
  * exported so the text→structured mapping is pinnable with synthetic texts (the byte-truncation and
@@ -10,5 +11,5 @@ import type { ReadFace } from "./read-face.js";
  * this seam the honesty boundary.
  */
 export declare function grepDetailFields(text: string, mode: "files_with_matches" | "content" | "count", offset?: number, structuredRows?: readonly import("./search.js").GrepRow[]): Record<string, unknown>;
-export declare function createGrepTool(env: ExecutionEnv, rootCanonical: string, additionalRoots?: readonly string[], readDeny?: ReadDenyMatcher, readFace?: ReadFace): AgentTool;
-export declare function createGlobTool(env: ExecutionEnv, rootCanonical: string, additionalRoots?: readonly string[], readDeny?: ReadDenyMatcher, readFace?: ReadFace): AgentTool;
+export declare function createGrepTool(env: ExecutionEnv, rootCanonical: string, additionalRoots?: readonly string[], readDeny?: ReadDenyMatcher, readFace?: ReadFace, cwdRef?: CwdRef): AgentTool;
+export declare function createGlobTool(env: ExecutionEnv, rootCanonical: string, additionalRoots?: readonly string[], readDeny?: ReadDenyMatcher, readFace?: ReadFace, cwdRef?: CwdRef): AgentTool;

package/dist/tools/fs/fs-search-tools.js

@@ -1,8 +1,10 @@
 import { Type } from "typebox";
 import { defineTool, errorResult } from "../../core/tools.js";
 import { resolveKey, violationText, violationDetails } from "./safety.js";
-import { runGrepDetailed, runGlobDetailed, splitAbsoluteGlobPattern, invalidGlobTokens } from "./search.js";
+import { runGrepDetailed, runGlobDetailed, invalidGlobTokens } from "./search.js";
 import { toolFace } from "../../core/tool-catalog-entries.js";
+import { pathTargetBaseOf, splitAbsoluteGlobPattern } from "../../core/effective-path-target.js";
+import { pathTargetValue } from "../../core/tool-registry.js";
 export function grepDetailFields(text, mode, offset, structuredRows) {
     const structuredIdentityComplete = structuredRows !== undefined && structuredRows.every((r) => r.path !== undefined || r.text === "--");
     const structuredPaths = structuredIdentityComplete && structuredRows !== undefined ? [...new Set(structuredRows.filter((r) => r.path !== undefined).map((r) => r.path))] : undefined;
@@ -72,7 +74,8 @@ export function grepDetailFields(text, mode, offset, structuredRows) {
     }
     return detailFields;
 }
-export function createGrepTool(env, rootCanonical, additionalRoots, readDeny, readFace) {
+export function createGrepTool(env, rootCanonical, additionalRoots, readDeny, readFace, cwdRef) {
+    const declaredTarget = toolFace("grep").pathTarget;
     return defineTool({
         name: "Grep",
         ...toolFace("grep"),
@@ -136,9 +139,11 @@ export function createGrepTool(env, rootCanonical, additionalRoots, readDeny, re
                         `Close the bracket/brace, or drop \`glob\` and filter with \`path\`/\`type\` instead.`);
                 }
             }
-            let scoped = a.path;
-            if (a.path !== undefined) {
-                const r = await resolveKey(env, rootCanonical, a.path, ctx.signal, rootCanonical, additionalRoots, undefined, readDeny, readFace);
+            const baseCwd = pathTargetBaseOf(declaredTarget, { root: rootCanonical, cwd: cwdRef?.current });
+            const scopeSpelling = declaredTarget === undefined ? undefined : pathTargetValue(a, declaredTarget);
+            let scoped = scopeSpelling;
+            if (scopeSpelling !== undefined) {
+                const r = await resolveKey(env, rootCanonical, scopeSpelling, ctx.signal, baseCwd, additionalRoots, undefined, readDeny, readFace);
                 if (!r.ok)
                     return errorResult(violationText("Grep", r.violation), violationDetails(r.violation));
                 scoped = r.key;
@@ -146,7 +151,7 @@ export function createGrepTool(env, rootCanonical, additionalRoots, readDeny, re
                 if (!info.ok) {
                     const ex = await env.exists(scoped, ctx.signal);
                     if (!(ex.ok && !ex.value)) {
-                        return errorResult(`Error (Grep): cannot determine the type of "${a.path.slice(0, 300)}" (stat failed: ${info.error.message.slice(0, 200)}); refusing to search it — if it is a FIFO/socket/device, reading it would hang. Retry if this was transient.`);
+                        return errorResult(`Error (Grep): cannot determine the type of "${scopeSpelling.slice(0, 300)}" (stat failed: ${info.error.message.slice(0, 200)}); refusing to search it — if it is a FIFO/socket/device, reading it would hang. Retry if this was transient.`);
                     }
                 }
             }
@@ -172,7 +177,8 @@ export function createGrepTool(env, rootCanonical, additionalRoots, readDeny, re
         },
     });
 }
-export function createGlobTool(env, rootCanonical, additionalRoots, readDeny, readFace) {
+export function createGlobTool(env, rootCanonical, additionalRoots, readDeny, readFace, cwdRef) {
+    const declaredTarget = toolFace("glob").pathTarget;
     return defineTool({
         name: "Glob",
         ...toolFace("glob"),
@@ -195,7 +201,8 @@ export function createGlobTool(env, rootCanonical, additionalRoots, readDeny, re
             max_results: Type.Optional(Type.Number({ description: "Cap results (default 500)." })),
         }),
         execute: async (args, ctx) => {
-            let { pattern, path } = args;
+            let pattern = args.pattern;
+            let path = declaredTarget === undefined ? undefined : pathTargetValue(args, declaredTarget);
             const { max_results } = args;
             if (path === undefined) {
                 const split = splitAbsoluteGlobPattern(pattern);
@@ -204,9 +211,10 @@ export function createGlobTool(env, rootCanonical, additionalRoots, readDeny, re
                     pattern = split.relativePattern;
                 }
             }
+            const baseCwd = pathTargetBaseOf(declaredTarget, { root: rootCanonical, cwd: cwdRef?.current });
             let scoped = path;
             if (path !== undefined) {
-                const r = await resolveKey(env, rootCanonical, path, ctx.signal, rootCanonical, additionalRoots, undefined, readDeny, readFace);
+                const r = await resolveKey(env, rootCanonical, path, ctx.signal, baseCwd, additionalRoots, undefined, readDeny, readFace);
                 if (!r.ok)
                     return errorResult(violationText("Glob", r.violation), violationDetails(r.violation));
                 scoped = r.key;

package/dist/tools/fs/index.js

@@ -52,7 +52,7 @@ export function createHandsToolkit(env, readFileState, rootCanonical, opts = {})
     if (!readOnly) {
         tools.push(createEditFileTool(env, readFileState, rootCanonical, cwdRef, additionalRoots, opts.beforeWrite, opts.trackFileEdit, opts.onFileEdited), createWriteFileTool(env, readFileState, rootCanonical, cwdRef, additionalRoots, opts.beforeWrite, opts.trackFileEdit, opts.onFileEdited), createNotebookEditTool(env, readFileState, rootCanonical, cwdRef, additionalRoots, opts.beforeWrite, opts.trackFileEdit, opts.onFileEdited));
     }
-    tools.push(createGrepTool(env, rootCanonical, readFaceRoots, readDeny, readFace), createGlobTool(env, rootCanonical, readFaceRoots, readDeny, readFace), createRepoMapTool(env, rootCanonical, readFaceRoots, readDeny, readFace));
+    tools.push(createGrepTool(env, rootCanonical, readFaceRoots, readDeny, readFace, cwdRef), createGlobTool(env, rootCanonical, readFaceRoots, readDeny, readFace, cwdRef), createRepoMapTool(env, rootCanonical, readFaceRoots, readDeny, readFace));
     if (includeShell) {
         tools.push(readOnly
             ? createBashReadonlyTool(env, rootCanonical, new Set(bashReadonlyAllow ?? BASH_READONLY_DEFAULT_ALLOW), {

package/dist/tools/fs/notebook.d.ts

@@ -92,5 +92,5 @@ export interface NotebookRender {
 export declare function renderNotebookCells(cells: readonly NotebookCell[], imageBase64Budget: number): NotebookRender;
 /** Wire-card projection of a cell: base64 replaced by a length marker so the `details` card never
  *  carries raw image bytes (they ride the model-facing content blocks; an oversized card would be
- *  omitted whole by the structuredFrom 4×cap and blind the shell). */
+ *  omitted whole by the card projector's 4×cap and blind the shell). */
 export declare function stripNotebookImageData(cell: NotebookCell): NotebookCell;

package/dist/tools/fs/safety.d.ts

@@ -321,7 +321,7 @@ export declare function violationText(toolName: string, v: FsViolation): string;
  * every renderer of a {@link resolveKey} violation — `undefined` keeps the pre-existing detail-less
  * shape for all other violation codes, so nothing else changes byte-wise.
  *
- * RB-397-c (回溯复查批): `type` is the WIRE discriminator — `structuredFrom`'s `CC_DETAIL_TYPES` gate
+ * RB-397-c (回溯复查批): `type` is the WIRE discriminator — the leg's card projector (`createStructuredProjector`, design/388 L4)
  * (tool-output-projection.ts) keys on `details.type`, so without it the card never reached
  * `tool_end.structured` and the "count from fields" promise above held for in-process readers only.
  * `code` stays as-is for the existing RB-371 consumers — the new key is strictly additive.

package/dist/tools/fs/search.d.ts

@@ -51,14 +51,6 @@ export interface GrepParams {
  *  (`"*.ts,*.tsx"` → two globs), while a brace token (`*.{ts,tsx}`) is kept whole (its commas are
  *  alternation syntax, not separators). CC-verbatim splitting rules. */
 export declare function splitGlobParam(glob: string): string[];
-/** 批④ #8 (CC 2.1.198 RWp, bundle :332987): decompose an ABSOLUTE glob pattern into a base directory +
- *  relative pattern — cut at the last separator before the first glob metachar (`* ? [ {`); a pattern
- *  with no metachar splits dirname/basename. Returns undefined for a relative pattern (caller keeps it
- *  as-is) or when no usable base can be derived. */
-export declare function splitAbsoluteGlobPattern(pattern: string): {
-    baseDir: string;
-    relativePattern: string;
-} | undefined;
 /**
  * POSIX-safe single-quote so an arbitrary model-supplied string can't break out of the shell command that
  * runs ripgrep. Wraps in single quotes (inside which the shell expands nothing — no `$()`, backtick, `;`, or

package/dist/tools/fs/search.js

@@ -71,29 +71,6 @@ export function splitGlobParam(glob) {
     }
     return out;
 }
-export function splitAbsoluteGlobPattern(pattern) {
-    if (!isAbsolutePathForm(pattern))
-        return undefined;
-    const m = /[*?[{]/.exec(pattern);
-    if (!m) {
-        const i = Math.max(pattern.lastIndexOf("/"), pattern.lastIndexOf("\\"));
-        if (i <= 0)
-            return undefined;
-        return { baseDir: pattern.slice(0, i), relativePattern: pattern.slice(i + 1) };
-    }
-    const prefix = pattern.slice(0, m.index);
-    const cut = Math.max(prefix.lastIndexOf("/"), prefix.lastIndexOf("\\"));
-    if (cut === -1)
-        return undefined;
-    let baseDir = pattern.slice(0, cut);
-    if (baseDir === "" && cut === 0)
-        baseDir = "/";
-    if (/^[A-Za-z]:$/.test(baseDir))
-        baseDir = baseDir + pattern[cut];
-    if (!baseDir)
-        return undefined;
-    return { baseDir, relativePattern: pattern.slice(cut + 1) };
-}
 export function shellQuote(s) {
     return `'${s.replace(/'/g, `'\\''`)}'`;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.8.0",
+  "version": "7.9.1",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",