@sema-agent/core 7.9.0 → 7.9.1

package/dist/core/tool-face.d.ts

@@ -46,18 +46,94 @@ export type ToolApprovalCard = (typeof TOOL_APPROVAL_CARDS)[number];
 export declare const TOOL_PATH_ACCESSES: readonly ["read", "create", "edit"];
 export type ToolPathAccess = (typeof TOOL_PATH_ACCESSES)[number];
 /**
- * The parameter that names this tool's filesystem target, and how the target is touched. Present ⇔ the
- * tool can be confirmed BY PATH (write confinement, sensitive-path guards, edited-file tracking, the
- * transcript-directory gate). `param` outranks every alias (NotebookEdit's `notebook_path` beats a decoy
+ * The BASE a RELATIVE spelling in the target slot resolves against — the tool's OWN resolution base,
+ * DECLARED so every fence resolves the very path the tool will open instead of guessing one:
+ *
+ *  - `cwd` — the live tracked working directory, falling back to the task root when no tracker moved
+ *    (Read / Edit / Write / NotebookEdit: each hands `cwdRef.current` to `canonicalizeTarget` as its base);
+ *  - `root` — the task root, always (Grep / Glob: their `path` describes say "relative to root", and the
+ *    tools hand `rootCanonical` to the same resolver whatever the shell's `cd` did).
+ *
+ * Absent ⇒ `cwd`: the pre-declaration reading every fence took, kept as the floor for a face (a caller's,
+ * an MCP server's) that declares no base. This one word is the whole difference the fences had to model,
+ * and getting it wrong is SILENT — a rule about the path the tool really opens simply never fires.
+ */
+export declare const TOOL_PATH_BASES: readonly ["cwd", "root"];
+export type ToolPathBase = (typeof TOOL_PATH_BASES)[number];
+/**
+ * What the call targets when the target slot carries NO usable spelling:
+ *
+ *  - `none` — nothing. A file tool with no path names no file, so no path rule speaks about the call;
+ *  - `base` — the resolution base ITSELF. A search tool with no `path` searches the WHOLE base, so a rule
+ *    naming the base (or anything containing it) does reach the call.
+ *
+ * Absent ⇒ `none` (the pre-declaration reading: an absent slot was "no resolvable path" for every tool).
+ */
+export declare const TOOL_PATH_ABSENCES: readonly ["none", "base"];
+export type ToolPathAbsence = (typeof TOOL_PATH_ABSENCES)[number];
+/**
+ * The parameter that names a tool's filesystem target, how the target is touched, and how a spelling in that
+ * slot RESOLVES — as a READER sees it, whichever side it came from. Present ⇔ the tool can be confirmed BY
+ * PATH (write confinement, sensitive-path guards, edited-file tracking, the transcript-directory gate, the
+ * permission-rule path family). `param` outranks every alias (NotebookEdit's `notebook_path` beats a decoy
  * `file_path`). `skillScopeEligible` (default false) is the SEPARATE authorization domain of the
  * active-skill `allowPaths` face — a confinable write tool is not automatically eligible there.
+ *
+ * ONE shape, two spellings: a DECLARATION ({@link ToolPathTarget}, what a catalog row / a `ToolSpec` / an
+ * MCP overlay writes) and the roster row's NORMALIZED form (`aliases` always an array, `skillScopeEligible`
+ * always a boolean) that the wire carries and the gate stamps on a call. Both are readable through this
+ * type, which is what every fence reads — the shape used to be re-declared at each of them, and a member
+ * added to one spelling silently never reached the others.
+ *
+ * The three RESOLUTION members are read by one function (`effectivePathTargetOf`, effective-path-target.ts)
+ * that every fence and the tools themselves go through: the declaration is the single source, so a fence
+ * and the tool it fences cannot resolve one call to two different files.
  */
-export interface ToolPathTarget {
+export interface ToolCallPathTarget {
     param: string;
     aliases?: readonly string[];
     access: ToolPathAccess;
+    skillScopeEligible?: boolean;
+    /** How a RELATIVE spelling in `param` (or an alias) resolves. Absent ⇒ `cwd`. */
+    base?: ToolPathBase;
+    /** What the call targets when the slot is absent. Absent ⇒ `none`. */
+    absent?: ToolPathAbsence;
+    /**
+     * A top-level parameter whose ABSOLUTE glob pattern carries its own base directory (Glob's `pattern`:
+     * `/proj/secret/**` searches `/proj/secret` with no `path` at all). Consulted ONLY when the target slot
+     * is absent and `absent` is `base` — the tool's own precedence, in which an explicit `path` wins and a
+     * relative pattern leaves the base alone.
+     */
+    patternParam?: string;
+}
+/** The DECLARATION spelling of {@link ToolCallPathTarget}: what a catalog row, a `ToolSpec` or an MCP
+ *  overlay writes. `skillScopeEligible` is narrowed to `true` — a declaration says "eligible" or says
+ *  nothing; "eligible: false" is the absence, and spelling it would be a second way to say one thing. */
+export interface ToolPathTarget extends ToolCallPathTarget {
     skillScopeEligible?: true;
 }
+/**
+ * The NORMALIZED spelling of {@link ToolCallPathTarget}: what the roster MINTS, what the wire carries, and
+ * what the gate stamps on a call. `aliases` and `skillScopeEligible` are always present because the mint
+ * fills them — a guarantee a consumer reading a stamped face has always had, and one the shared reader type
+ * deliberately does not weaken (an optional member here would break `face.pathTarget.aliases.includes(…)`
+ * at compile time for every downstream that already reads it).
+ */
+export interface ToolRosterPathTarget extends ToolCallPathTarget {
+    aliases: readonly string[];
+    skillScopeEligible: boolean;
+}
+/**
+ * The SLOT half of a target — which argument names the path — with the RESOLUTION half (`base` / `absent` /
+ * `patternParam`) dropped, so the reader falls back to the documented defaults.
+ *
+ * #635, from the adversarial round: the protective floor (design/388 B6 — a face that declares no target of
+ * its own is judged against the CATALOG's declaration for the name) rests on "naming a slot can only TIGHTEN
+ * a deny". Naming a slot does. Claiming how a FOREIGN tool of the same name RESOLVES that slot does not: a
+ * wrong claim moves the judged path to a different file, and the deny the floor exists to keep then misses.
+ * So the floor hands over the slot and keeps its mouth shut about the resolution.
+ */
+export declare function pathTargetSlotOnly(pt: ToolCallPathTarget): ToolCallPathTarget;
 /**
  * The parameter vocabulary a permission rule (`Tool(param:pattern)`) may name. DERIVED by default from
  * the tool's schema: the SCALAR top-level parameters (string/number/integer/boolean and their enum/const/

package/dist/core/tool-face.js

@@ -2,6 +2,16 @@ export const TOOL_FAMILIES = ["shell", "file-read", "file-write", "search", "web
 export const TOOL_MOUNT_TAGS = ["hands", "backgroundTasks", "workflow", "delegation", "hostInternals", "peerLane", "scheduler", "memory", "scenario", "always", "optional"];
 export const TOOL_APPROVAL_CARDS = ["file-edit", "file-write", "notebook-edit", "shell", "fetch", "plan", "question", "generic"];
 export const TOOL_PATH_ACCESSES = ["read", "create", "edit"];
+export const TOOL_PATH_BASES = ["cwd", "root"];
+export const TOOL_PATH_ABSENCES = ["none", "base"];
+export function pathTargetSlotOnly(pt) {
+    return {
+        param: pt.param,
+        access: pt.access,
+        ...(pt.aliases !== undefined ? { aliases: pt.aliases } : {}),
+        ...(pt.skillScopeEligible !== undefined ? { skillScopeEligible: pt.skillScopeEligible } : {}),
+    };
+}
 export const TOOL_WIRE_NAME_MAX_CHARS = 128;
 export const TOOL_CONTRACT_MAX_CHARS = 64;
 export const TOOL_KEY_MAX_CHARS = 256;

package/dist/core/tool-policy.d.ts

@@ -4,12 +4,7 @@ import type { Settlement } from "./gate-outcome.js";
 /** design/388 B6 — the per-call face (see {@link ToolCallRequest.face}). */
 export interface ToolCallFace {
     family: import("./tool-face.js").ToolFamily;
-    pathTarget?: {
-        param: string;
-        aliases: readonly string[];
-        access: "read" | "create" | "edit";
-        skillScopeEligible: boolean;
-    };
+    pathTarget?: import("./tool-face.js").ToolRosterPathTarget;
     capabilityId: string;
     contractId: string;
     shapeDigest: string;

package/dist/core/tool-registry.d.ts

@@ -10,7 +10,7 @@
  *
  * Layer-0 vocabulary: depends on the leaf catalog and the face vocabulary only.
  */
-import { type ToolCatalogEntry, type ToolMountTag, type ToolPathAccess } from "./tool-face.js";
+import { type ToolCallPathTarget, type ToolCatalogEntry, type ToolMountTag, type ToolPathAccess } from "./tool-face.js";
 /** The whole static catalog, one frozen row per definition (design/388 §2.1 `describeToolCatalog()`).
  *  Replaces the retired name-keyed exports `HAND_TOOL_EFFECTS` / `DEFAULT_BUDGET_EXEMPT_TOOLS` /
  *  `COMPACTABLE_TOOLS`: filter this instead (`e.mountedBy.includes("hands")`, `e.face.budgetExempt`,
@@ -45,24 +45,21 @@ export interface ToolCallLike {
     toolName: string;
     args: unknown;
     face?: {
-        pathTarget?: {
-            param: string;
-            aliases?: readonly string[];
-            access: ToolPathAccess;
-        };
+        pathTarget?: ToolCallPathTarget;
     } | undefined;
 }
-type CallPathTarget = {
-    param: string;
-    aliases?: readonly string[];
-    access: ToolPathAccess;
-};
+type CallPathTarget = ToolCallPathTarget;
 /**
  * design/388 B6/B17 — the path target a PROTECTIVE fence reads (a deny-list judging a write's target: sensitive paths,
  * frozen paths, write protection, the transcript gate; edit tracking): the object face's own declaration first, the
  * catalog's declaration for the NAME as the FLOOR — for a bare request (a policy invoked outside a Runner) and for a
  * face that declares none. Reading the catalog for an undeclared same-name tool can only TIGHTEN a deny-list (it adds
  * a slot to judge — the pre-388 posture, never wider), which is exactly why this floor is wrong for a grant.
+ *
+ * #635: "can only tighten" is true of the SLOT and false of the RESOLUTION, so the floor hands over the first and
+ * defaults the second (`pathTargetSlotOnly`). Telling a fence that a FOREIGN tool of the same name resolves its slot
+ * against the project root is a claim about someone else's implementation: get it wrong and the judged path moves to
+ * a different file, and the deny this floor exists to preserve simply misses.
  */
 export declare function protectivePathTargetOf(call: ToolCallLike): CallPathTarget | undefined;
 /**

package/dist/core/tool-registry.js

@@ -1,4 +1,4 @@
-import { TOOL_MOUNT_TAGS } from "./tool-face.js";
+import { TOOL_MOUNT_TAGS, pathTargetSlotOnly } from "./tool-face.js";
 import { ENGINE_CARDS, TOOL_CATALOG_ENTRIES } from "./tool-catalog-entries.js";
 export function describeToolCatalog() {
     return TOOL_CATALOG_ENTRIES;
@@ -49,7 +49,10 @@ export function pathTargetValue(args, pt) {
     return undefined;
 }
 export function protectivePathTargetOf(call) {
-    return call.face?.pathTarget ?? pathTargetOf(call.toolName);
+    if (call.face?.pathTarget !== undefined)
+        return call.face.pathTarget;
+    const floor = pathTargetOf(call.toolName);
+    return floor === undefined || call.face === undefined ? floor : pathTargetSlotOnly(floor);
 }
 export function declaredPathTargetOf(call) {
     return call.face !== undefined ? call.face.pathTarget : pathTargetOf(call.toolName);

package/dist/core/tool-roster.d.ts

@@ -1,6 +1,6 @@
 import { Type, type Static, type TSchema } from "typebox";
 import type { AgentTool } from "../internal/harness-types.js";
-import { type ToolFamily, type ToolMountTag, type ToolPathTarget, type ToolRenderHints, type ToolRuleFace } from "./tool-face.js";
+import { type ToolFamily, type ToolRosterPathTarget, type ToolMountTag, type ToolPathTarget, type ToolRenderHints, type ToolRuleFace } from "./tool-face.js";
 import type { ToolContentOrigin, ToolEffect } from "./tool-spec.js";
 export declare const ROSTER_SOURCES: readonly ["builtin", "caller", "host", "mcp", "a2a", "external", "synthetic"];
 export type RosterSource = (typeof ROSTER_SOURCES)[number];
@@ -55,6 +55,9 @@ export declare const ToolRosterEntry: Type.TObject<{
         aliases: Type.TArray<Type.TString>;
         access: Type.TUnion<[Type.TLiteral<"read">, Type.TLiteral<"create">, Type.TLiteral<"edit">]>;
         skillScopeEligible: Type.TBoolean;
+        base: Type.TOptional<Type.TUnion<[Type.TLiteral<"cwd">, Type.TLiteral<"root">]>>;
+        absent: Type.TOptional<Type.TUnion<[Type.TLiteral<"none">, Type.TLiteral<"base">]>>;
+        patternParam: Type.TOptional<Type.TString>;
     }>>;
     ruleFace: Type.TObject<{
         primaryParams: Type.TArray<Type.TString>;
@@ -126,6 +129,9 @@ export declare const ToolRoster: Type.TObject<{
             aliases: Type.TArray<Type.TString>;
             access: Type.TUnion<[Type.TLiteral<"read">, Type.TLiteral<"create">, Type.TLiteral<"edit">]>;
             skillScopeEligible: Type.TBoolean;
+            base: Type.TOptional<Type.TUnion<[Type.TLiteral<"cwd">, Type.TLiteral<"root">]>>;
+            absent: Type.TOptional<Type.TUnion<[Type.TLiteral<"none">, Type.TLiteral<"base">]>>;
+            patternParam: Type.TOptional<Type.TString>;
         }>>;
         ruleFace: Type.TObject<{
             primaryParams: Type.TArray<Type.TString>;
@@ -205,6 +211,9 @@ export declare const ToolRosterDelta: Type.TObject<{
                 aliases: Type.TArray<Type.TString>;
                 access: Type.TUnion<[Type.TLiteral<"read">, Type.TLiteral<"create">, Type.TLiteral<"edit">]>;
                 skillScopeEligible: Type.TBoolean;
+                base: Type.TOptional<Type.TUnion<[Type.TLiteral<"cwd">, Type.TLiteral<"root">]>>;
+                absent: Type.TOptional<Type.TUnion<[Type.TLiteral<"none">, Type.TLiteral<"base">]>>;
+                patternParam: Type.TOptional<Type.TString>;
             }>>;
             ruleFace: Type.TObject<{
                 primaryParams: Type.TArray<Type.TString>;
@@ -265,7 +274,7 @@ export declare function parkedToolFace(roster: ToolRoster | undefined, toolName:
  *  partial face). This is the face every recheck of the row judges under, roster or no roster. */
 export declare function parkedCallFaceOf(pending: {
     family?: ToolFamily;
-    pathTarget?: ToolRosterEntry["pathTarget"];
+    pathTarget?: ToolRosterPathTarget;
     capabilityId?: string;
     contractId?: string;
     shapeDigest?: string;

package/dist/core/tool-roster.js

@@ -2,7 +2,7 @@ import { createHash } from "node:crypto";
 import { Type } from "typebox";
 import { getToolContract } from "../prompt-assembly/tool-catalog.js";
 import { protocolOf } from "./protocol-table.js";
-import { RENDER_HINT_ACTIVITY_MAX_CHARS, RENDER_HINT_MAX_CHARS, RENDER_HINT_MAX_LIST, TOOL_APPROVAL_CARDS, TOOL_FAMILIES, TOOL_KEYS_MAX, TOOL_KEY_MAX_CHARS, TOOL_MOUNT_TAGS, } from "./tool-face.js";
+import { RENDER_HINT_ACTIVITY_MAX_CHARS, RENDER_HINT_MAX_CHARS, RENDER_HINT_MAX_LIST, TOOL_APPROVAL_CARDS, TOOL_FAMILIES, TOOL_KEYS_MAX, TOOL_KEY_MAX_CHARS, TOOL_MOUNT_TAGS, TOOL_PATH_ABSENCES, TOOL_PATH_BASES, } from "./tool-face.js";
 function lit(values) {
     return Type.Union(values.map((v) => Type.Literal(v)));
 }
@@ -42,7 +42,15 @@ export const ToolRosterEntry = Type.Object({
     contentOrigin: lit(["local", "execution", "external"]),
     contentOriginProvenance: lit(["declared", "server", "exempted", "default"]),
     family: lit(TOOL_FAMILIES),
-    pathTarget: Type.Optional(Type.Object({ param: Key, aliases: Type.Array(Key), access: lit(["read", "create", "edit"]), skillScopeEligible: Type.Boolean() }, { additionalProperties: false })),
+    pathTarget: Type.Optional(Type.Object({
+        param: Key,
+        aliases: Type.Array(Key),
+        access: lit(["read", "create", "edit"]),
+        skillScopeEligible: Type.Boolean(),
+        base: Type.Optional(lit(TOOL_PATH_BASES)),
+        absent: Type.Optional(lit(TOOL_PATH_ABSENCES)),
+        patternParam: Type.Optional(Key),
+    }, { additionalProperties: false })),
     ruleFace: Type.Object({ primaryParams: Type.Array(Key), params: Type.Array(Key) }, { additionalProperties: false }),
     approvalPreview: Type.Boolean(),
     validateInput: Type.Boolean(),
@@ -392,7 +400,17 @@ export function mintRosterEntry(tool, meta, facts) {
         contentOriginProvenance,
         family: face.family !== undefined && TOOL_FAMILIES.includes(face.family) ? face.family : "other",
         ...(pathTarget !== undefined
-            ? { pathTarget: { param: pathTarget.param, aliases: [...(pathTarget.aliases ?? [])], access: pathTarget.access, skillScopeEligible: pathTarget.skillScopeEligible === true } }
+            ? {
+                pathTarget: {
+                    param: pathTarget.param,
+                    aliases: [...(pathTarget.aliases ?? [])],
+                    access: pathTarget.access,
+                    skillScopeEligible: pathTarget.skillScopeEligible === true,
+                    ...(pathTarget.base !== undefined ? { base: pathTarget.base } : {}),
+                    ...(pathTarget.absent !== undefined ? { absent: pathTarget.absent } : {}),
+                    ...(pathTarget.patternParam !== undefined ? { patternParam: pathTarget.patternParam } : {}),
+                },
+            }
             : {}),
         ruleFace: rf,
         approvalPreview: typeof tool.approvalPreview === "function",

package/dist/index.d.ts

@@ -53,6 +53,7 @@ export { runCascade, type CascadeRung, type CascadeConfig, type CascadeAttempt,
 export { pgQuery, mysqlQuery, sqliteQuery } from "./tools/sql-adapters.js";
 export { materializeMcpTools, MCP_PREFIX, type MaterializedMcp, type McpServerStatus, type McpRefreshResult } from "./core/mcp.js";
 export { MCP_FAILURE_KINDS, MCP_DELIVERY_VERDICTS, classifyMcpFailure, type McpFailure, type McpFailureKind, type McpDelivered } from "./core/mcp-failure.js";
+export { MCP_INJECTION_DROP_REASONS, MCP_INJECTION_DROP_TEXT, mcpInjectionDroppedNotice, type McpInjectionDropReason, type McpInjectionDropFacts } from "./core/mcp-injection-drop.js";
 export { materializeA2aTools, A2aRpcError, type MaterializedA2a, type A2aPeerStatus, type A2aRefreshResult, type A2aToolAxis } from "./core/a2a.js";
 export { PROTOCOL_TABLE, MCP_NAMESPACE, A2A_NAMESPACE, protocolOf, type ProtocolNamespace, type ProtocolId } from "./core/protocol-table.js";
 export { InMemorySessionPolicyStore, SessionPolicyError, loosenReasons, normalizeRules, stripRev, type SessionPolicyStore, type SessionPermissionRules, type StoredSessionRules, type SessionRulesRecord, type PutRulesOptions, } from "./core/session-policy-store.js";
@@ -124,10 +125,11 @@ export { createFsWriteGatePolicy, type FsWriteGatePolicyOptions } from "./core/f
 export { RETIRED_TOOL_NAMES } from "./core/tool-name-aliases.js";
 export { DEFAULT_SUBAGENT_TOOL_NAME } from "./agents/subagent.js";
 export { renderTaskNotificationXml, taskNotificationDedupKey, isDelegatedAgentTerminal, isTerminalTaskNotification, SystemInjectionQueue, type TaskNotificationPayload, type TaskNotificationStatus, type ExternalNotificationInput, type SystemInjection, type SystemInjectionPriority, SYSTEM_INJECTION_PRIORITIES, isSystemInjectionPriority, AGENT_MESSAGE_TAG, renderAgentMessageFrame, type SemaProvenance, } from "./core/task-notification.js";
-export { TOOL_FAMILIES, TOOL_MOUNT_TAGS, TOOL_APPROVAL_CARDS, TOOL_PATH_ACCESSES, TOOL_WIRE_NAME_MAX_CHARS, TOOL_CONTRACT_MAX_CHARS, TOOL_KEY_MAX_CHARS, TOOL_KEYS_MAX, RENDER_HINT_MAX_CHARS, RENDER_HINT_ACTIVITY_MAX_CHARS, RENDER_HINT_MAX_LIST, type ToolFamily, type ToolMountTag, type ToolApprovalCard, type ToolPathAccess, type ToolPathTarget, type ToolRuleFace, type ToolRenderHints, type ToolFaceDeclaration, type ToolCatalogEntry, } from "./core/tool-face.js";
+export { TOOL_FAMILIES, TOOL_MOUNT_TAGS, TOOL_APPROVAL_CARDS, TOOL_PATH_ACCESSES, TOOL_PATH_BASES, TOOL_PATH_ABSENCES, TOOL_WIRE_NAME_MAX_CHARS, TOOL_CONTRACT_MAX_CHARS, TOOL_KEY_MAX_CHARS, TOOL_KEYS_MAX, RENDER_HINT_MAX_CHARS, RENDER_HINT_ACTIVITY_MAX_CHARS, RENDER_HINT_MAX_LIST, type ToolFamily, type ToolMountTag, type ToolApprovalCard, type ToolPathAccess, type ToolPathBase, type ToolPathAbsence, type ToolPathTarget, type ToolCallPathTarget, type ToolRosterPathTarget, pathTargetSlotOnly, type ToolRuleFace, type ToolRenderHints, type ToolFaceDeclaration, type ToolCatalogEntry, } from "./core/tool-face.js";
 export { describeToolCatalog, catalogEntriesNamed, catalogToolNames, catalogRuleFaceOf, pathTargetOf, pathTargetValue, protectivePathTargetOf, declaredPathTargetOf, isProtectedWrite, isDeclaredWrite, fileOpAccessOf, type ToolCallLike, pathConfinableWriteToolNames, skillScopeWriteToolNames, pathTargetingToolNames, compactableToolNames, budgetExemptToolNames, handBandEffects, engineCardTypes, predictMountedToolNames, HANDS_BAND_TAGS, MOUNT_TAG_IN_HANDS_BAND, } from "./core/tool-registry.js";
 export { ToolRosterEntry, ToolRoster, ToolRosterDelta, ToolRosterRenderHints, ROSTER_SOURCES, type RosterSource, type ToolIdentity, toolIdentityOf, mintCapabilityId, diffToolRoster, judgeParkedToolIdentity, ruleFacesFromRoster, toolCallFaceOf, inputKeysOf, ruleFaceOfInstance, ToolRosterDeltaSeat, } from "./core/tool-roster.js";
 export { type ToolCallFace } from "./core/tool-policy.js";
+export { effectivePathTargetOf, pathTargetBaseOf, type ToolPathBases } from "./core/effective-path-target.js";
 export { TOOL_CONFORMANCE_VECTORS, describeToolConformanceVectors, type ToolConformanceVector } from "./core/tool-conformance.js";
 export { applyMcpToolFaces, toolFaceProblem, APPROVAL_CARD_REQUIRED_KEYS, type McpToolFace } from "./core/runner/tool-face-overlay.js";
 export { createStructuredProjector } from "./core/runner/tool-output-projection.js";
@@ -186,12 +188,13 @@ export { createPermissionRulePolicy, validatePermissionRules, parsePermissionRul
  * and nothing more. Removal is exported without ceremony, because narrowing on a user's behalf is
  * allowed and widening is not.
  */
-export { RULE_BEHAVIORS, RULE_BEHAVIOR_PRECEDENCE, RULE_BEHAVIORS_BY_PRECEDENCE, isRuleBehavior, readRowBehavior, adjudicatePersistedRules, adjudicatePersistedPathRules, ruleReachesProgramRun, pathRuleReaches, ruleToolGrammarOf, COMMAND_RULE_TOOL, READ_RULE_TOOL, type PathRuleBases, type RuleBehavior, type PersistedRuleVerdict, parseRuleText, formatRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, stripFormatCharacters, UNCOVERED_SEGMENT_REASON_BASELINE, RULE_OFFERS_ABSENCE_BASELINE, type UncoveredSegmentDetail, type EditedRuleBreadthWarning, directoryRuleAdmits, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, type PersistedRule, type RuleTombstone, type RuleScope, type RuleDot, type RuleAdd, type RuleAddOrigin, type RuleOffer, type RuleOfferBatchMember, type SegmentRuleSuggestion, type SegmentCoverage, type RuleReject, type RuleRejectCode, type ParsedRule, type PersistedRuleTool, type PersistedRuleMatch, } from "./core/permission-rule-model.js";
+export { RULE_BEHAVIORS, RULE_BEHAVIOR_PRECEDENCE, RULE_BEHAVIORS_BY_PRECEDENCE, isRuleBehavior, readRowBehavior, adjudicatePersistedRules, adjudicatePersistedPathRules, ruleReachesProgramRun, programRunReachOf, PROGRAM_RUN_REACHES, type ProgramRunReach, type ProgramRunReachOutcome, pathRuleReaches, ruleToolGrammarOf, COMMAND_RULE_TOOL, READ_RULE_TOOL, type PathRuleBases, type RuleBehavior, type PersistedRuleVerdict, parseRuleText, formatRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, stripFormatCharacters, UNCOVERED_SEGMENT_REASON_BASELINE, RULE_OFFERS_ABSENCE_BASELINE, type UncoveredSegmentDetail, type EditedRuleBreadthWarning, directoryRuleAdmits, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, type PersistedRule, type RuleTombstone, type RuleScope, type RuleDot, type RuleAdd, type RuleAddOrigin, type RuleOffer, type RuleOfferBatchMember, type SegmentRuleSuggestion, type SegmentCoverage, type RuleReject, type RuleRejectCode, type ParsedRule, type PersistedRuleTool, type PersistedRuleMatch, } from "./core/permission-rule-model.js";
 export { removePersistedRule, applyTombstones, sameScope, sameRuleIdentity, isValidConsentScope, isValidDurableScope, InMemoryDurableRulePartition, EMPTY_DURABLE_RULE_PARTITION, type DurableRulePartition, type DurableRulePartitionProvider, type RuleWriteOutcome, type StoredRules, type RemoveResult, type PutResult, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, type RuleSyncState, type RuleSyncFrontier, type RuleSyncDrop, type RuleSyncLandingReport, type RuleOwner, type QuarantinedRuleAdd, PERMISSION_RULE_WRITER, writerOf, foldDelta, addDotsOf, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, type PermissionRuleWriter, type WritableDurableRulePartition, type RuleWriteDelta, type RuleAddDelta, type RuleDeleteDelta, type RuleSyncJoinDelta, type RawRuleSyncState, type RedemptionAuthorization, } from "./core/permission-rule-store.js";
 export { syncPermissionRules, parseRuleSyncResponse, PERMISSION_RULE_SYNC_PATH, LOCAL_OWNER_UNSYNCABLE_CODE, type PermissionRuleSyncTransport, type PermissionRuleSyncResult, type RuleSyncRequestBody, type RuleSyncResponseBody, } from "./core/permission-rule-sync.js";
 export { createPermissionRuleStoreProvider, effectivePermissionRules, effectiveOrThrow, ruleSourceOf, type PermissionRuleStore, type PermissionRuleStoreProvider, type PermissionRuleStoreConfig, type EffectivePermissionRules, type EffectivePermissionRule, type RemovedPermissionRule, type RuleSource, } from "./core/permission-rule-provider.js";
 export { InMemorySessionRulePartition, type SessionRulePartition, type SessionRuleAdd, type SessionRuleApplyResult, } from "./core/permission-rule-session.js";
-export { orgRuleVerdictFor, orgRuleShadows, unenforceableOrgRules, ORG_UNAVAILABLE_DECISION_REASON, ORG_RULE_DECISION_REASON, ORG_ADJUDICATION_TIMEOUT_MS, type OrgPermissionRule, type OrgRuleSnapshot, type OrgRuleSnapshotProvider, type OrgRuleStatePersistence, type PersistedOrgRuleState, type OrgRulePartitionConfig, type OrgRuleResolution, type OrgRuleStatus, } from "./core/permission-rule-org.js";
+export { readShellCommand, isFullyReadable, MAX_SHELL_READ_CHARS, SHELL_WRAPPER_TABLE, type ShellCommandShape, type ShellSegment, type ShellWord, type ShellWrapperName, } from "./core/shell-lexer.js";
+export { orgRuleVerdictFor, type OrgRuleVerdict, orgRuleShadows, unenforceableOrgRules, ORG_UNAVAILABLE_DECISION_REASON, ORG_RULE_DECISION_REASON, ORG_ADJUDICATION_TIMEOUT_MS, type OrgPermissionRule, type OrgRuleSnapshot, type OrgRuleSnapshotProvider, type OrgRuleStatePersistence, type PersistedOrgRuleState, type OrgRulePartitionConfig, type OrgRuleResolution, type OrgRuleStatus, } from "./core/permission-rule-org.js";
 export { RULE_SYNC_DROP_CODES, type RuleSyncDropReason, type RuleQuarantineReason } from "./core/governance-codes.js";
 export { prepareCardApproval, confirmRuleApproval, type ConfirmResult, type ConfirmRefusalReason, precheckEditedRuleText, type EditedRuleTextPrecheck, redeemRuleTicket, redeemRuleBatch, prepareCcImport, prepareStarterBatch, mintRuleTicket, STARTER_RULES, InMemoryRuleApprovalRecordStore, ruleOffersOfRecord, type RuleTicket, type RuleCandidate, type RuleApprovalKind, type RuleApprovalRecord, type RuleApprovalRecordStore, type RuleOffer2, type StaleRuleApprovalRecord, type RuleConsentDeps, type RedeemResult, type RedeemedBatchMember, type CcImportLayer, type ImportedSettingsLayer, type ImportPreview, } from "./core/permission-rule-consent.js";
 export { FileDurableRulePartitionProvider, ORG_STATE_FILE } from "./stores/file/permission-rule-store.js";

package/dist/index.js

@@ -40,6 +40,7 @@ export { runCascade, } from "./agents/cascade.js";
 export { pgQuery, mysqlQuery, sqliteQuery } from "./tools/sql-adapters.js";
 export { materializeMcpTools, MCP_PREFIX } from "./core/mcp.js";
 export { MCP_FAILURE_KINDS, MCP_DELIVERY_VERDICTS, classifyMcpFailure } from "./core/mcp-failure.js";
+export { MCP_INJECTION_DROP_REASONS, MCP_INJECTION_DROP_TEXT, mcpInjectionDroppedNotice } from "./core/mcp-injection-drop.js";
 export { materializeA2aTools, A2aRpcError } from "./core/a2a.js";
 export { PROTOCOL_TABLE, MCP_NAMESPACE, A2A_NAMESPACE, protocolOf } from "./core/protocol-table.js";
 export { InMemorySessionPolicyStore, SessionPolicyError, loosenReasons, normalizeRules, stripRev, } from "./core/session-policy-store.js";
@@ -100,10 +101,11 @@ export { createFsWriteGatePolicy } from "./core/fs-write-gate-policy.js";
 export { RETIRED_TOOL_NAMES } from "./core/tool-name-aliases.js";
 export { DEFAULT_SUBAGENT_TOOL_NAME } from "./agents/subagent.js";
 export { renderTaskNotificationXml, taskNotificationDedupKey, isDelegatedAgentTerminal, isTerminalTaskNotification, SystemInjectionQueue, SYSTEM_INJECTION_PRIORITIES, isSystemInjectionPriority, AGENT_MESSAGE_TAG, renderAgentMessageFrame, } from "./core/task-notification.js";
-export { TOOL_FAMILIES, TOOL_MOUNT_TAGS, TOOL_APPROVAL_CARDS, TOOL_PATH_ACCESSES, TOOL_WIRE_NAME_MAX_CHARS, TOOL_CONTRACT_MAX_CHARS, TOOL_KEY_MAX_CHARS, TOOL_KEYS_MAX, RENDER_HINT_MAX_CHARS, RENDER_HINT_ACTIVITY_MAX_CHARS, RENDER_HINT_MAX_LIST, } from "./core/tool-face.js";
+export { TOOL_FAMILIES, TOOL_MOUNT_TAGS, TOOL_APPROVAL_CARDS, TOOL_PATH_ACCESSES, TOOL_PATH_BASES, TOOL_PATH_ABSENCES, TOOL_WIRE_NAME_MAX_CHARS, TOOL_CONTRACT_MAX_CHARS, TOOL_KEY_MAX_CHARS, TOOL_KEYS_MAX, RENDER_HINT_MAX_CHARS, RENDER_HINT_ACTIVITY_MAX_CHARS, RENDER_HINT_MAX_LIST, pathTargetSlotOnly, } from "./core/tool-face.js";
 export { describeToolCatalog, catalogEntriesNamed, catalogToolNames, catalogRuleFaceOf, pathTargetOf, pathTargetValue, protectivePathTargetOf, declaredPathTargetOf, isProtectedWrite, isDeclaredWrite, fileOpAccessOf, pathConfinableWriteToolNames, skillScopeWriteToolNames, pathTargetingToolNames, compactableToolNames, budgetExemptToolNames, handBandEffects, engineCardTypes, predictMountedToolNames, HANDS_BAND_TAGS, MOUNT_TAG_IN_HANDS_BAND, } from "./core/tool-registry.js";
 export { ToolRosterEntry, ToolRoster, ToolRosterDelta, ToolRosterRenderHints, ROSTER_SOURCES, toolIdentityOf, mintCapabilityId, diffToolRoster, judgeParkedToolIdentity, ruleFacesFromRoster, toolCallFaceOf, inputKeysOf, ruleFaceOfInstance, ToolRosterDeltaSeat, } from "./core/tool-roster.js";
 export {} from "./core/tool-policy.js";
+export { effectivePathTargetOf, pathTargetBaseOf } from "./core/effective-path-target.js";
 export { TOOL_CONFORMANCE_VECTORS, describeToolConformanceVectors } from "./core/tool-conformance.js";
 export { applyMcpToolFaces, toolFaceProblem, APPROVAL_CARD_REQUIRED_KEYS } from "./core/runner/tool-face-overlay.js";
 export { createStructuredProjector } from "./core/runner/tool-output-projection.js";
@@ -145,11 +147,12 @@ export { AUTO_MODE_BASE_PROMPT, AUTO_MODE_PERMISSIONS_EXTERNAL } from "./core/au
 export { AUTO_MODE_ARMING_RECIPE_VERSION, autoModeArmingRecipeOf, sanitizeAutoModeArmingRecipe, foldAutoModeArming, } from "./core/auto-mode-arming.js";
 export { rebuildAutoModeDecider, } from "./core/auto-mode-rebuild.js";
 export { createPermissionRulePolicy, validatePermissionRules, parsePermissionRule, wildcardMatch, isNamespacedCoveringRuleName, namespacedRuleNameCovers, } from "./core/permission-rules.js";
-export { RULE_BEHAVIORS, RULE_BEHAVIOR_PRECEDENCE, RULE_BEHAVIORS_BY_PRECEDENCE, isRuleBehavior, readRowBehavior, adjudicatePersistedRules, adjudicatePersistedPathRules, ruleReachesProgramRun, pathRuleReaches, ruleToolGrammarOf, COMMAND_RULE_TOOL, READ_RULE_TOOL, parseRuleText, formatRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, stripFormatCharacters, UNCOVERED_SEGMENT_REASON_BASELINE, RULE_OFFERS_ABSENCE_BASELINE, directoryRuleAdmits, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, } from "./core/permission-rule-model.js";
+export { RULE_BEHAVIORS, RULE_BEHAVIOR_PRECEDENCE, RULE_BEHAVIORS_BY_PRECEDENCE, isRuleBehavior, readRowBehavior, adjudicatePersistedRules, adjudicatePersistedPathRules, ruleReachesProgramRun, programRunReachOf, PROGRAM_RUN_REACHES, pathRuleReaches, ruleToolGrammarOf, COMMAND_RULE_TOOL, READ_RULE_TOOL, parseRuleText, formatRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, stripFormatCharacters, UNCOVERED_SEGMENT_REASON_BASELINE, RULE_OFFERS_ABSENCE_BASELINE, directoryRuleAdmits, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, } from "./core/permission-rule-model.js";
 export { removePersistedRule, applyTombstones, sameScope, sameRuleIdentity, isValidConsentScope, isValidDurableScope, InMemoryDurableRulePartition, EMPTY_DURABLE_RULE_PARTITION, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, PERMISSION_RULE_WRITER, writerOf, foldDelta, addDotsOf, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, } from "./core/permission-rule-store.js";
 export { syncPermissionRules, parseRuleSyncResponse, PERMISSION_RULE_SYNC_PATH, LOCAL_OWNER_UNSYNCABLE_CODE, } from "./core/permission-rule-sync.js";
 export { createPermissionRuleStoreProvider, effectivePermissionRules, effectiveOrThrow, ruleSourceOf, } from "./core/permission-rule-provider.js";
 export { InMemorySessionRulePartition, } from "./core/permission-rule-session.js";
+export { readShellCommand, isFullyReadable, MAX_SHELL_READ_CHARS, SHELL_WRAPPER_TABLE, } from "./core/shell-lexer.js";
 export { orgRuleVerdictFor, orgRuleShadows, unenforceableOrgRules, ORG_UNAVAILABLE_DECISION_REASON, ORG_RULE_DECISION_REASON, ORG_ADJUDICATION_TIMEOUT_MS, } from "./core/permission-rule-org.js";
 export { RULE_SYNC_DROP_CODES } from "./core/governance-codes.js";
 export { prepareCardApproval, confirmRuleApproval, precheckEditedRuleText, redeemRuleTicket, redeemRuleBatch, prepareCcImport, prepareStarterBatch, mintRuleTicket, STARTER_RULES, InMemoryRuleApprovalRecordStore, ruleOffersOfRecord, } from "./core/permission-rule-consent.js";

package/dist/tools/fs/fs-search-tools.d.ts

@@ -1,6 +1,7 @@
 import type { AgentTool, ExecutionEnv } from "../../internal/harness-types.js";
 import type { ReadDenyMatcher } from "./read-deny.js";
 import type { ReadFace } from "./read-face.js";
+import type { CwdRef } from "./fs-shared.js";
 /**
  * The Grep card's details assembly, PURE over the engine text ({mode, offset} from the request) —
  * exported so the text→structured mapping is pinnable with synthetic texts (the byte-truncation and
@@ -10,5 +11,5 @@ import type { ReadFace } from "./read-face.js";
  * this seam the honesty boundary.
  */
 export declare function grepDetailFields(text: string, mode: "files_with_matches" | "content" | "count", offset?: number, structuredRows?: readonly import("./search.js").GrepRow[]): Record<string, unknown>;
-export declare function createGrepTool(env: ExecutionEnv, rootCanonical: string, additionalRoots?: readonly string[], readDeny?: ReadDenyMatcher, readFace?: ReadFace): AgentTool;
-export declare function createGlobTool(env: ExecutionEnv, rootCanonical: string, additionalRoots?: readonly string[], readDeny?: ReadDenyMatcher, readFace?: ReadFace): AgentTool;
+export declare function createGrepTool(env: ExecutionEnv, rootCanonical: string, additionalRoots?: readonly string[], readDeny?: ReadDenyMatcher, readFace?: ReadFace, cwdRef?: CwdRef): AgentTool;
+export declare function createGlobTool(env: ExecutionEnv, rootCanonical: string, additionalRoots?: readonly string[], readDeny?: ReadDenyMatcher, readFace?: ReadFace, cwdRef?: CwdRef): AgentTool;

package/dist/tools/fs/fs-search-tools.js

@@ -1,8 +1,10 @@
 import { Type } from "typebox";
 import { defineTool, errorResult } from "../../core/tools.js";
 import { resolveKey, violationText, violationDetails } from "./safety.js";
-import { runGrepDetailed, runGlobDetailed, splitAbsoluteGlobPattern, invalidGlobTokens } from "./search.js";
+import { runGrepDetailed, runGlobDetailed, invalidGlobTokens } from "./search.js";
 import { toolFace } from "../../core/tool-catalog-entries.js";
+import { pathTargetBaseOf, splitAbsoluteGlobPattern } from "../../core/effective-path-target.js";
+import { pathTargetValue } from "../../core/tool-registry.js";
 export function grepDetailFields(text, mode, offset, structuredRows) {
     const structuredIdentityComplete = structuredRows !== undefined && structuredRows.every((r) => r.path !== undefined || r.text === "--");
     const structuredPaths = structuredIdentityComplete && structuredRows !== undefined ? [...new Set(structuredRows.filter((r) => r.path !== undefined).map((r) => r.path))] : undefined;
@@ -72,7 +74,8 @@ export function grepDetailFields(text, mode, offset, structuredRows) {
     }
     return detailFields;
 }
-export function createGrepTool(env, rootCanonical, additionalRoots, readDeny, readFace) {
+export function createGrepTool(env, rootCanonical, additionalRoots, readDeny, readFace, cwdRef) {
+    const declaredTarget = toolFace("grep").pathTarget;
     return defineTool({
         name: "Grep",
         ...toolFace("grep"),
@@ -136,9 +139,11 @@ export function createGrepTool(env, rootCanonical, additionalRoots, readDeny, re
                         `Close the bracket/brace, or drop \`glob\` and filter with \`path\`/\`type\` instead.`);
                 }
             }
-            let scoped = a.path;
-            if (a.path !== undefined) {
-                const r = await resolveKey(env, rootCanonical, a.path, ctx.signal, rootCanonical, additionalRoots, undefined, readDeny, readFace);
+            const baseCwd = pathTargetBaseOf(declaredTarget, { root: rootCanonical, cwd: cwdRef?.current });
+            const scopeSpelling = declaredTarget === undefined ? undefined : pathTargetValue(a, declaredTarget);
+            let scoped = scopeSpelling;
+            if (scopeSpelling !== undefined) {
+                const r = await resolveKey(env, rootCanonical, scopeSpelling, ctx.signal, baseCwd, additionalRoots, undefined, readDeny, readFace);
                 if (!r.ok)
                     return errorResult(violationText("Grep", r.violation), violationDetails(r.violation));
                 scoped = r.key;
@@ -146,7 +151,7 @@ export function createGrepTool(env, rootCanonical, additionalRoots, readDeny, re
                 if (!info.ok) {
                     const ex = await env.exists(scoped, ctx.signal);
                     if (!(ex.ok && !ex.value)) {
-                        return errorResult(`Error (Grep): cannot determine the type of "${a.path.slice(0, 300)}" (stat failed: ${info.error.message.slice(0, 200)}); refusing to search it — if it is a FIFO/socket/device, reading it would hang. Retry if this was transient.`);
+                        return errorResult(`Error (Grep): cannot determine the type of "${scopeSpelling.slice(0, 300)}" (stat failed: ${info.error.message.slice(0, 200)}); refusing to search it — if it is a FIFO/socket/device, reading it would hang. Retry if this was transient.`);
                     }
                 }
             }
@@ -172,7 +177,8 @@ export function createGrepTool(env, rootCanonical, additionalRoots, readDeny, re
         },
     });
 }
-export function createGlobTool(env, rootCanonical, additionalRoots, readDeny, readFace) {
+export function createGlobTool(env, rootCanonical, additionalRoots, readDeny, readFace, cwdRef) {
+    const declaredTarget = toolFace("glob").pathTarget;
     return defineTool({
         name: "Glob",
         ...toolFace("glob"),
@@ -195,7 +201,8 @@ export function createGlobTool(env, rootCanonical, additionalRoots, readDeny, re
             max_results: Type.Optional(Type.Number({ description: "Cap results (default 500)." })),
         }),
         execute: async (args, ctx) => {
-            let { pattern, path } = args;
+            let pattern = args.pattern;
+            let path = declaredTarget === undefined ? undefined : pathTargetValue(args, declaredTarget);
             const { max_results } = args;
             if (path === undefined) {
                 const split = splitAbsoluteGlobPattern(pattern);
@@ -204,9 +211,10 @@ export function createGlobTool(env, rootCanonical, additionalRoots, readDeny, re
                     pattern = split.relativePattern;
                 }
             }
+            const baseCwd = pathTargetBaseOf(declaredTarget, { root: rootCanonical, cwd: cwdRef?.current });
             let scoped = path;
             if (path !== undefined) {
-                const r = await resolveKey(env, rootCanonical, path, ctx.signal, rootCanonical, additionalRoots, undefined, readDeny, readFace);
+                const r = await resolveKey(env, rootCanonical, path, ctx.signal, baseCwd, additionalRoots, undefined, readDeny, readFace);
                 if (!r.ok)
                     return errorResult(violationText("Glob", r.violation), violationDetails(r.violation));
                 scoped = r.key;

package/dist/tools/fs/index.js

@@ -52,7 +52,7 @@ export function createHandsToolkit(env, readFileState, rootCanonical, opts = {})
     if (!readOnly) {
         tools.push(createEditFileTool(env, readFileState, rootCanonical, cwdRef, additionalRoots, opts.beforeWrite, opts.trackFileEdit, opts.onFileEdited), createWriteFileTool(env, readFileState, rootCanonical, cwdRef, additionalRoots, opts.beforeWrite, opts.trackFileEdit, opts.onFileEdited), createNotebookEditTool(env, readFileState, rootCanonical, cwdRef, additionalRoots, opts.beforeWrite, opts.trackFileEdit, opts.onFileEdited));
     }
-    tools.push(createGrepTool(env, rootCanonical, readFaceRoots, readDeny, readFace), createGlobTool(env, rootCanonical, readFaceRoots, readDeny, readFace), createRepoMapTool(env, rootCanonical, readFaceRoots, readDeny, readFace));
+    tools.push(createGrepTool(env, rootCanonical, readFaceRoots, readDeny, readFace, cwdRef), createGlobTool(env, rootCanonical, readFaceRoots, readDeny, readFace, cwdRef), createRepoMapTool(env, rootCanonical, readFaceRoots, readDeny, readFace));
     if (includeShell) {
         tools.push(readOnly
             ? createBashReadonlyTool(env, rootCanonical, new Set(bashReadonlyAllow ?? BASH_READONLY_DEFAULT_ALLOW), {

package/dist/tools/fs/search.d.ts

@@ -51,14 +51,6 @@ export interface GrepParams {
  *  (`"*.ts,*.tsx"` → two globs), while a brace token (`*.{ts,tsx}`) is kept whole (its commas are
  *  alternation syntax, not separators). CC-verbatim splitting rules. */
 export declare function splitGlobParam(glob: string): string[];
-/** 批④ #8 (CC 2.1.198 RWp, bundle :332987): decompose an ABSOLUTE glob pattern into a base directory +
- *  relative pattern — cut at the last separator before the first glob metachar (`* ? [ {`); a pattern
- *  with no metachar splits dirname/basename. Returns undefined for a relative pattern (caller keeps it
- *  as-is) or when no usable base can be derived. */
-export declare function splitAbsoluteGlobPattern(pattern: string): {
-    baseDir: string;
-    relativePattern: string;
-} | undefined;
 /**
  * POSIX-safe single-quote so an arbitrary model-supplied string can't break out of the shell command that
  * runs ripgrep. Wraps in single quotes (inside which the shell expands nothing — no `$()`, backtick, `;`, or

package/dist/tools/fs/search.js

@@ -71,29 +71,6 @@ export function splitGlobParam(glob) {
     }
     return out;
 }
-export function splitAbsoluteGlobPattern(pattern) {
-    if (!isAbsolutePathForm(pattern))
-        return undefined;
-    const m = /[*?[{]/.exec(pattern);
-    if (!m) {
-        const i = Math.max(pattern.lastIndexOf("/"), pattern.lastIndexOf("\\"));
-        if (i <= 0)
-            return undefined;
-        return { baseDir: pattern.slice(0, i), relativePattern: pattern.slice(i + 1) };
-    }
-    const prefix = pattern.slice(0, m.index);
-    const cut = Math.max(prefix.lastIndexOf("/"), prefix.lastIndexOf("\\"));
-    if (cut === -1)
-        return undefined;
-    let baseDir = pattern.slice(0, cut);
-    if (baseDir === "" && cut === 0)
-        baseDir = "/";
-    if (/^[A-Za-z]:$/.test(baseDir))
-        baseDir = baseDir + pattern[cut];
-    if (!baseDir)
-        return undefined;
-    return { baseDir, relativePattern: pattern.slice(cut + 1) };
-}
 export function shellQuote(s) {
     return `'${s.replace(/'/g, `'\\''`)}'`;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.9.0",
+  "version": "7.9.1",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",