@sema-agent/core/dist/core/runner/write-protection-station.d.ts

Stateless, task-oriented AI agent core

/**
 * The leg's write-protection MOUNT — one compile, and the loud outlet for the reading it could not get.
 *
 * The always-on write-protection judge re-judges a table-missing spelling on its RESOLVED real target,
 * which needs a filesystem to resolve in. A deployment that wires no execution environment (a tool-only
 * or MCP-only host) hands it none, so the spelling becomes the whole judgment and a covered write that
 * reaches a protected row only through an alias is cleared. That verdict is the judge's documented
 * absence law and is deliberately unchanged here: the announcement dialect applies (announce, do not
 * refuse) — refusing every covered write instead would break exactly the deployments this shape exists
 * for, and the reference implementation falls back to the same spelling-only set when resolution is
 * unavailable. What this seat removes is the SILENCE.
 *
 * Two readers, one compile: the gate station mounts `check`, and the leg's wiring manifest reports
 * `targetView`. Compiling twice would be two judges free to disagree about the seats they were handed.
 *
 * The SECOND absence this seat carries is the per-judgment one: a judge that HAS its target view but
 * whose environment could not answer a particular target drops that view and judges by the spelling alone.
 * That is a run-time fact, so it cannot be announced at compile like the one above — but it is a fact about
 * the ENVIRONMENT rather than about any one write, so it is announced from here, once per leg per reason,
 * and carries no call identity. This is the leg-scoped home the dedupe needs: the judge is compiled once
 * per leg and every judgment of the leg goes through the check minted here.
 */
import type { ExecutionEnv } from "../../internal/harness.js";
import type { RunnerDeps } from "../runner-deps.js";
import type { ToolRoster } from "../tool-roster.js";
import { type WriteProtectionMount } from "../write-protect.js";
import type { ShellReadBoundary } from "../../tools/fs/shell-read-judge.js";
/** The leg's mount plus the same judge over a bare ABSOLUTE target — what the shell station asks about each write target
 *  a command names (`ShellReadBoundary.writeProtectionJudge`): `true` ⇔ a row covers it. */
export interface LegWriteProtection extends WriteProtectionMount {
    readonly judgeTarget: NonNullable<ShellReadBoundary["writeProtectionJudge"]>;
}
export declare function mountWriteProtection(input: {
    /** borrowed-readonly — the deployment seats: the table (`writeProtectedPaths`; absent ⇒ the default
     *  table, `[]` ⇒ opted out), the data root the memory library is materialized under
     *  (`memoryEngineDir`; absent ⇒ the resolver's env/default chain) and the operator sink. */
    deps: Pick<RunnerDeps, "writeProtectedPaths" | "memoryEngineDir" | "onNotice">;
    /** The HANDS' environment, or `undefined` with no hands — the driver's own predicate, not a second
     *  reading of the env seats, so the judge sees exactly the environment the write tools do. */
    env: ExecutionEnv | undefined;
    /** The base a `base: "root"` write tool's relative spelling resolves against. */
    rootPath: string;
    /** The leg's minted roster — what actually MOUNTED. */
    roster: ToolRoster;
    sessionId: string;
    runId: string;
}): LegWriteProtection | undefined;