@sema-agent/core/dist/core/runner/write-protection-station.d.ts

Stateless, task-oriented AI agent core

/**
 * The leg's write-protection MOUNT — one compile, and the loud outlet for the reading it could not get.
 *
 * The always-on write-protection judge re-judges a table-missing spelling on its RESOLVED real target,
 * which needs a filesystem to resolve in. A deployment that wires no execution environment (a tool-only
 * or MCP-only host) hands it none, so the spelling becomes the whole judgment and a covered write that
 * reaches a protected row only through an alias is cleared. That verdict is the judge's documented
 * absence law and is deliberately unchanged here: the announcement dialect applies (announce, do not
 * refuse) — refusing every covered write instead would break exactly the deployments this shape exists
 * for, and the reference implementation falls back to the same spelling-only set when resolution is
 * unavailable. What this seat removes is the SILENCE.
 *
 * Two readers, one compile: the gate station mounts `check`, and the leg's wiring manifest reports
 * `targetView`. Compiling twice would be two judges free to disagree about the seats they were handed.
 *
 * The SECOND absence this seat carries is the per-judgment one: a judge that HAS its target view but
 * whose environment could not answer a particular target drops that view and judges by the spelling alone.
 * That is a run-time fact, so it cannot be announced at compile like the one above — but it is a fact about
 * the ENVIRONMENT rather than about any one write, so it is announced from here, once per leg per reason,
 * and carries no call identity. This is the leg-scoped home the dedupe needs: the judge is compiled once
 * per leg and every judgment of the leg goes through the check minted here.
 */
import type { ExecutionEnv } from "../../internal/harness.js";
import type { RunnerDeps } from "../runner-deps.js";
import type { TaskSpec } from "../task-spec.js";
import type { ToolRoster } from "../tool-roster.js";
import type { ToolPolicy } from "../tool-policy.js";
import { type WriteProtectionMount } from "../write-protect.js";
import type { ShellReadBoundary } from "../../tools/fs/shell-read-judge.js";
/** The leg's write judgment, read by its two readers: the gate's tighten over the always-on table (`mount`, absent when that
 *  table is empty) and the shell station's ONE question about each write target a command names (`judgeWriteTarget`, over
 *  the table and the chain's guarded write rows together; absent when neither has a row). */
export interface LegWriteProtection {
    readonly mount: WriteProtectionMount | undefined;
    readonly judgeWriteTarget: ShellReadBoundary["writeTargetJudge"];
}
/** The leg's write-guard seats: its one exempt root (the leg's single resolution of `RunnerDeps.memoryEngineDir`, the same
 *  list every policy adjudication of the leg is stamped with) and the chain policies' guarded write rows. */
export interface LegWriteGuard {
    readonly exemptRoots: readonly string[];
    readonly rows: ToolPolicy["writeGuardRows"];
}
export declare function mountWriteProtection(input: {
    /** borrowed-readonly — the deployment seats: the table (`writeProtectedPaths`; absent ⇒ the default
     *  table, `[]` ⇒ opted out), the configuration root the host declared (`agentConfigDir`) and the operator sink. */
    deps: Pick<RunnerDeps, "writeProtectedPaths" | "agentConfigDir" | "onNotice">;
    /** borrowed-readonly — the leg's one exempt root and the chain's guarded write rows ({@link LegWriteGuard}). */
    guard: LegWriteGuard;
    /** borrowed-readonly — the request's own rows (already judged at the task layer's door). */
    spec: Pick<TaskSpec, "writeProtectedAdditions">;
    /** The HANDS' environment, or `undefined` with no hands — the driver's own predicate, not a second
     *  reading of the env seats, so the judge sees exactly the environment the write tools do. */
    env: ExecutionEnv | undefined;
    /** The base a `base: "root"` write tool's relative spelling resolves against. */
    rootPath: string;
    /** The leg's minted roster — what actually MOUNTED. */
    roster: ToolRoster;
    sessionId: string;
    runId: string;
}): LegWriteProtection;