{ "repo": "core", "version": "7.42.0", "from": "b8c8666207a044498ac37fb36d14304a66ea5a92", "to": "bb9acc0d77da51b9c1430a05e630c0265da9a513", "added": [ { "name": "ALLOW_ENTRY_INERT_REASONS", "kind": "variable", "tier": "advanced", "at": [ "src/core/allow-entry.ts:36", "src/index.ts:1471" ], "criteriaCovered": false, "breaking": false }, { "name": "ALLOW_RULE_MEMBERS", "kind": "variable", "tier": "advanced", "at": [ "src/core/allow-rule-shadow.ts:9", "src/index.ts:1472" ], "criteriaCovered": false, "breaking": false }, { "name": "AllowEntryGateSeats", "kind": "interface", "tier": "advanced", "at": [ "src/core/allow-entry.ts:280", "src/index.ts:1471" ], "criteriaCovered": false, "breaking": false }, { "name": "AllowEntryHit", "kind": "interface", "tier": "advanced", "at": [ "src/core/allow-entry.ts:266", "src/index.ts:1471" ], "criteriaCovered": false, "breaking": false }, { "name": "AllowEntryInertReason", "kind": "type", "tier": "advanced", "at": [ "src/core/allow-entry.ts:37", "src/index.ts:1471" ], "criteriaCovered": false, "breaking": false }, { "name": "AllowEntryLane", "kind": "interface", "tier": "advanced", "at": [ "src/core/allow-entry.ts:271", "src/index.ts:1471" ], "criteriaCovered": false, "breaking": false }, { "name": "AllowRuleMember", "kind": "type", "tier": "advanced", "at": [ "src/core/allow-rule-shadow.ts:10", "src/index.ts:1472" ], "criteriaCovered": false, "breaking": false }, { "name": "AllowRuleShadow", "kind": "interface", "tier": "advanced", "at": [ "src/core/allow-rule-shadow.ts:14", "src/index.ts:1472" ], "criteriaCovered": true, "breaking": false }, { "name": "CompiledAllowEntry", "kind": "type", "tier": "advanced", "at": [ "src/core/allow-entry.ts:41", "src/index.ts:1471" ], "criteriaCovered": false, "breaking": false }, { "name": "compileAllowEntry", "kind": "function", "tier": "advanced", "at": [ "src/core/allow-entry.ts:61", "src/index.ts:1471" ], "criteriaCovered": false, "breaking": false }, { "name": "compileAllowList", "kind": "function", "tier": "advanced", "at": [ "src/core/allow-entry.ts:107", "src/index.ts:1471" ], "criteriaCovered": false, "breaking": false } ], "removed": [ { "name": "SKILL_ENTRY_INERT_REASONS", "kind": "variable", "tier": "advanced", "at": [ "src/core/skill-grant.ts:65", "src/index.ts:1470" ], "breaking": true }, { "name": "SkillEntryInertReason", "kind": "type", "tier": "advanced", "at": [ "src/core/skill-grant.ts:66", "src/index.ts:1469" ], "breaking": true } ], "changed": [], "narrowed": [], "closedSetMembers": [ { "set": "ADMITTED_IMAGE_MIME_TYPES", "at": [ "src/tools/fs/image-admission.ts:25" ], "newSet": true, "added": [ "image/gif", "image/jpeg", "image/png", "image/webp" ], "removed": [], "breaking": false, "criteriaCovered": false }, { "set": "ALLOW_ENTRY_INERT_REASONS", "at": [ "src/core/allow-entry.ts:36" ], "newSet": true, "added": [ "content_unsupported", "domain", "grammar", "namespace_wildcard", "path_pattern", "wildcard_all" ], "removed": [], "breaking": false, "criteriaCovered": false }, { "set": "ALLOW_RULE_MEMBERS", "at": [ "src/core/allow-rule-shadow.ts:9" ], "newSet": true, "added": [ "deployment", "hook", "persisted", "request", "skill" ], "removed": [], "breaking": false, "criteriaCovered": false }, { "set": "AUTO_STRIPPED_PROGRAMS", "at": [ "src/core/allow-entry.ts:126" ], "newSet": true, "added": [ "bash", "bun run", "bunx", "deno", "env", "eval", "exec", "fish", "lua", "node", "npm run", "npx", "perl", "php", "pnpm run", "python", "python2", "python3", "ruby", "sh", "ssh", "sudo", "tsx", "xargs", "yarn run", "zsh" ], "removed": [], "breaking": false, "criteriaCovered": false }, { "set": "AllowEntryInertReason", "at": [ "src/core/allow-entry.ts:37", "src/index.ts:1471" ], "newSet": true, "added": [ "content_unsupported", "domain", "grammar", "namespace_wildcard", "path_pattern", "wildcard_all" ], "removed": [], "breaking": false, "criteriaCovered": false }, { "set": "AllowEntrySource", "at": [ "src/core/allow-entry.ts:263" ], "newSet": true, "added": [ "deployment", "request" ], "removed": [], "breaking": false, "criteriaCovered": false }, { "set": "AllowRuleMember", "at": [ "src/core/allow-rule-shadow.ts:10", "src/index.ts:1472" ], "newSet": true, "added": [ "deployment", "hook", "persisted", "request", "skill" ], "removed": [], "breaking": false, "criteriaCovered": false }, { "set": "DecisionReason", "at": [ "src/core/decision-receipt.ts:29", "src/core/tool-policy.ts:189", "src/index.ts:1429" ], "newSet": false, "added": [ "deployment_rule", "request_rule" ], "removed": [], "breaking": false, "criteriaCovered": false }, { "set": "ENGINE_NOTICE_CODES", "at": [ "src/core/governance-codes.ts:348" ], "newSet": false, "added": [ "permission.allowed_tool_not_granted" ], "removed": [ "skills.allowed_tool_not_granted" ], "persistedBy": "none", "breaking": true, "criteriaCovered": true }, { "set": "PermissionRule.behavior", "at": [ "src/core/permission-rules.ts:79" ], "newSet": false, "added": [], "removed": [ "allow" ], "persistedBy": "none", "breaking": true, "criteriaCovered": false }, { "set": "PermissionRuleIssue.code", "at": [ "src/core/permission-rules.ts:103" ], "newSet": false, "added": [ "invalid.behavior", "invalid.entry_type", "unsupported.allow" ], "removed": [ "invalid.allow_param_rule", "unsupported.bash_prefix", "unsupported.file_glob" ], "breaking": true, "criteriaCovered": false }, { "set": "READ_OUTCOMES", "at": [ "src/tools/fs/fs-read.ts:83" ], "newSet": true, "added": [ "attached", "not_attached", "partial", "unchanged" ], "removed": [], "breaking": false, "criteriaCovered": false }, { "set": "ReadKind", "at": [ "src/tools/fs/fs-read.ts:88" ], "newSet": true, "added": [ "image", "notebook", "pdf", "text" ], "removed": [], "breaking": false, "criteriaCovered": false }, { "set": "ReadOutcome", "at": [ "src/tools/fs/fs-read.ts:84" ], "newSet": true, "added": [ "attached", "not_attached", "partial", "unchanged" ], "removed": [], "breaking": false, "criteriaCovered": false }, { "set": "SYNTHETIC_READ_LAYERS", "at": [ "src/core/synthetic-read-verdict.ts:61" ], "newSet": true, "added": [ "caller_policy", "inherited_constraint", "narrowing", "org_rules", "persisted_rules", "skill_rows" ], "removed": [], "breaking": false, "criteriaCovered": false }, { "set": "SYNTHETIC_READ_UNANSWERABLE_CAUSES", "at": [ "src/core/synthetic-read-verdict.ts:65" ], "newSet": true, "added": [ "approval_seat", "call_unreadable", "org_unavailable", "threw", "timed_out" ], "removed": [], "breaking": false, "criteriaCovered": false }, { "set": "SyntheticReadLayer", "at": [ "src/core/synthetic-read-verdict.ts:62" ], "newSet": true, "added": [ "caller_policy", "inherited_constraint", "narrowing", "org_rules", "persisted_rules", "skill_rows" ], "removed": [], "breaking": false, "criteriaCovered": false }, { "set": "SyntheticReadUnanswerableCause", "at": [ "src/core/synthetic-read-verdict.ts:66" ], "newSet": true, "added": [ "approval_seat", "call_unreadable", "org_unavailable", "threw", "timed_out" ], "removed": [], "breaking": false, "criteriaCovered": false }, { "set": "TraceEvent.kind", "at": [ "src/core/trace.ts:62", "src/core/trace.ts:96", "src/core/trace.ts:137", "src/core/trace.ts:167", "src/core/trace.ts:208", "src/core/trace.ts:226", "src/core/trace.ts:241", "src/core/trace.ts:276", "src/core/trace.ts:278", "src/core/trace.ts:321", "src/core/trace.ts:350", "src/core/trace.ts:368", "src/core/trace.ts:382", "src/core/trace.ts:399", "src/core/trace.ts:415", "src/core/trace.ts:430", "src/core/trace.ts:447", "src/core/trace.ts:462", "src/core/trace.ts:476", "src/core/trace.ts:494", "src/core/trace.ts:513", "src/core/trace.ts:531", "src/core/trace.ts:556", "src/core/trace.ts:584", "src/core/trace.ts:598", "src/core/trace.ts:612", "src/core/trace.ts:633", "src/core/trace.ts:644", "src/core/trace.ts:659", "src/core/trace.ts:671", "src/core/trace.ts:685", "src/core/trace.ts:704", "src/core/trace.ts:714", "src/core/trace.ts:722", "src/core/trace.ts:732", "src/core/trace.ts:748", "src/core/trace.ts:765", "src/core/trace.ts:777", "src/core/trace.ts:787", "src/core/trace.ts:809", "src/core/trace.ts:831", "src/core/trace.ts:839", "src/core/trace.ts:859", "src/core/trace.ts:875", "src/core/trace.ts:885", "src/core/trace.ts:898", "src/core/trace.ts:912", "src/core/trace.ts:921", "src/core/trace.ts:932", "src/core/trace.ts:942" ], "newSet": false, "added": [ "permission.allowed_tools_allowed" ], "removed": [], "breaking": false, "criteriaCovered": false }, { "set": "TraceEvent.source", "at": [ "src/core/trace.ts:452" ], "newSet": true, "added": [ "deployment", "request" ], "removed": [], "breaking": false, "criteriaCovered": false } ], "closedSetsUnreadable": [], "typeKeys": [ { "type": "AskRequest", "at": [ "src/core/tool-policy.ts:2820" ], "added": [ "allowRuleShadowed" ], "addedDetail": [ { "key": "allowRuleShadowed", "optional": true } ], "addedRequired": [], "removed": [ "persistedRuleShadowed" ], "breaking": true, "criteriaCovered": true }, { "type": "PermissionResult", "at": [ "src/core/tool-policy.ts:474" ], "added": [ "ask.allowRuleShadowed" ], "addedDetail": [ { "key": "ask.allowRuleShadowed", "optional": true } ], "addedRequired": [], "removed": [ "ask.persistedRuleShadowed" ], "breaking": true, "criteriaCovered": false }, { "type": "PreToolUseResult", "at": [ "src/core/hooks.ts:1180" ], "added": [ "ask.allowRuleShadowed" ], "addedDetail": [ { "key": "ask.allowRuleShadowed", "optional": true } ], "addedRequired": [], "removed": [ "ask.persistedRuleShadowed" ], "breaking": true, "criteriaCovered": false }, { "type": "RiskDescriptor", "at": [ "src/core/checkpoint-store.ts:146" ], "added": [ "allowRuleShadowed" ], "addedDetail": [ { "key": "allowRuleShadowed", "optional": true } ], "addedRequired": [], "removed": [ "shadowedRule" ], "breaking": true, "criteriaCovered": false }, { "type": "RunInternals", "at": [ "src/core/runner/contracts.ts:1415" ], "added": [ "inheritedAllowedTools" ], "addedDetail": [ { "key": "inheritedAllowedTools", "optional": true } ], "addedRequired": [], "removed": [], "breaking": false, "criteriaCovered": false }, { "type": "RunnerDeps", "at": [ "src/core/runner-deps.ts:105" ], "added": [ "allowedTools" ], "addedDetail": [ { "key": "allowedTools", "optional": true } ], "addedRequired": [], "removed": [], "breaking": false, "criteriaCovered": true }, { "type": "TaskSpec", "at": [ "src/core/task-spec.ts:52" ], "added": [ "allowedTools" ], "addedDetail": [ { "key": "allowedTools", "optional": true } ], "addedRequired": [], "removed": [], "breaking": false, "criteriaCovered": true }, { "type": "ToolExecuteContext", "at": [ "src/core/tool-spec.ts:613" ], "added": [ "activeRequestAllowedTools" ], "addedDetail": [ { "key": "activeRequestAllowedTools", "optional": true } ], "addedRequired": [], "removed": [], "breaking": false, "criteriaCovered": false }, { "type": "ToolGateInput", "at": [ "src/core/hooks.ts:1470" ], "via": "runToolGate.ToolGateInput", "added": [ "deploymentAllows", "deploymentAllows.onAllowed", "requestAllows", "requestAllows.onAllowed" ], "addedDetail": [ { "key": "deploymentAllows", "optional": true }, { "key": "deploymentAllows.onAllowed", "optional": true }, { "key": "requestAllows", "optional": true }, { "key": "requestAllows.onAllowed", "optional": true } ], "addedRequired": [], "removed": [], "breaking": false, "criteriaCovered": false }, { "type": "TraceEvent", "at": [ "src/core/trace.ts:60" ], "added": [ "permission.allowed_tools_allowed.entries", "permission.allowed_tools_allowed.kind", "permission.allowed_tools_allowed.source", "permission.allowed_tools_allowed.taskId", "permission.allowed_tools_allowed.toolCallId", "permission.allowed_tools_allowed.toolName", "permission.allowed_tools_allowed.ts", "permission.allowed_tools_allowed.version" ], "addedDetail": [ { "key": "permission.allowed_tools_allowed.entries", "optional": false }, { "key": "permission.allowed_tools_allowed.kind", "optional": false }, { "key": "permission.allowed_tools_allowed.source", "optional": false }, { "key": "permission.allowed_tools_allowed.taskId", "optional": false }, { "key": "permission.allowed_tools_allowed.toolCallId", "optional": false }, { "key": "permission.allowed_tools_allowed.toolName", "optional": false }, { "key": "permission.allowed_tools_allowed.ts", "optional": false }, { "key": "permission.allowed_tools_allowed.version", "optional": false } ], "addedRequired": [], "removed": [], "breaking": false, "criteriaCovered": false } ], "typeKeysUnreadableArms": [], "typeKeysFlattenedCount": 225, "signatures": [ { "name": "ToolGateInput.suspendAsk", "at": [ "src/core/hooks.ts:1564" ], "from": [ "(req: ToolCallRequest, postHookArgs: unknown, safety?: import(\"./checkpoint-store.js\").SafetyAxis, liveFaceUnavailable?: boolean, realApproval?: import(\"./checkpoint-store.js\").RealApprovalGateBit, shadowedRule?: string, askDecisionReason?: DecisionReason, probeReason?: string, probeCause?: import(\"./checkpoint-store.js\").ProbeCause, segmentCoverage?: readonly import(\"./permission-rule-model.js\").SegmentCoverage[], matchedAskRule?: string, probeMandated?: boolean, carry?: AskCarry): Promise" ], "to": [ "(req: ToolCallRequest, postHookArgs: unknown, safety?: import(\"./checkpoint-store.js\").SafetyAxis, liveFaceUnavailable?: boolean, realApproval?: import(\"./checkpoint-store.js\").RealApprovalGateBit, allowRuleShadowed?: readonly import(\"./allow-rule-shadow.js\").AllowRuleShadow[], askDecisionReason?: DecisionReason, probeReason?: string, probeCause?: import(\"./checkpoint-store.js\").ProbeCause, segmentCoverage?: readonly import(\"./permission-rule-model.js\").SegmentCoverage[], matchedAskRule?: string, probeMandated?: boolean, carry?: AskCarry): Promise" ], "changes": [ { "aspect": "param", "detail": "param 6 `allowRuleShadowed` type changed, direction not read: [string -> readonly import(\"./allow-rule-shadow.js\").AllowRuleShadow[]]", "breaking": true, "uncertain": true } ], "uncertain": "param 6 `allowRuleShadowed` type changed, direction not read: [string -> readonly import(\"./allow-rule-shadow.js\").AllowRuleShadow[]] — the direction of a type change is not read syntactically, so it is reported breaking: check whether existing call sites still type-check before writing the BREAKING line", "breaking": true, "criteriaCovered": false }, { "name": "buildRiskDescriptor", "at": [ "src/core/checkpoint-store.ts:554" ], "from": [ "(input: { toolName: string; args: unknown; safety?: SafetyAxis; shellGated?: boolean; shellGateDoctrine?: ShellGateDoctrine; shadowedRule?: string; probeReason?: string; probeCause?: unknown; }): RiskDescriptor" ], "to": [ "(input: { toolName: string; args: unknown; safety?: SafetyAxis; shellGated?: boolean; shellGateDoctrine?: ShellGateDoctrine; allowRuleShadowed?: readonly import(\"./allow-rule-shadow.js\").AllowRuleShadow[]; probeReason?: string; probeCause?: unknown; }): RiskDescriptor" ], "changes": [ { "aspect": "param", "detail": "param 1 `input` type changed, direction not read: …ne?: ShellGateDoctrine; [shadowedRule?: string -> allowRuleShadowed?: readonly import(\"./allow-rule-shadow.js\").AllowRu…]; probeReason?: string; …", "breaking": true, "uncertain": true } ], "uncertain": "param 1 `input` type changed, direction not read: …ne?: ShellGateDoctrine; [shadowedRule?: string -> allowRuleShadowed?: readonly import(\"./allow-rule-shadow.js\").AllowRu…]; probeReason?: string; … — the direction of a type change is not read syntactically, so it is reported breaking: check whether existing call sites still type-check before writing the BREAKING line", "breaking": true, "criteriaCovered": false } ], "declarationMoves": [ { "name": "FileKind", "kind": null, "onSurface": false, "from": [ "src/engine/harness/types.ts" ], "to": [ "src/engine/harness/types.ts", "src/internal/harness-types.ts" ] }, { "name": "normalizeOrgGateVerdict", "kind": null, "onSurface": false, "from": [ "src/core/gate-lanes.ts", "src/core/hooks.ts" ], "to": [ "src/core/hooks.ts", "src/core/rule-lane-reads.ts" ] }, { "name": "normalizePersistedRuleHit", "kind": "function", "onSurface": true, "from": [ "src/core/gate-lanes.ts", "src/core/hooks.ts", "src/index.ts" ], "to": [ "src/core/hooks.ts", "src/core/rule-lane-reads.ts", "src/index.ts" ] } ], "mintMoves": [], "criteriaObserves": [ { "kind": "engineNoticeCode", "name": "permission.allowed_tool_not_granted", "assertions": [ "G11.a", "G14.a" ] }, { "kind": "taskEventField", "name": "steering_injected.source", "assertions": [ "G2.a", "G2.b" ] }, { "kind": "taskEventField", "name": "tool_end.gate", "assertions": [ "G5.a", "G5.b", "G7.a", "G13.a", "G15.c" ] }, { "kind": "taskEventField", "name": "tool_end.structured", "assertions": [ "G4.a" ] }, { "kind": "typeMember", "name": "AllowRuleShadow.entries", "assertions": [ "G9.a" ] }, { "kind": "typeMember", "name": "AllowRuleShadow.member", "assertions": [ "G9.a" ] }, { "kind": "typeMember", "name": "AskRequest.allowRuleShadowed", "assertions": [ "G7.b", "G9.a" ] }, { "kind": "typeMember", "name": "AskRequest.askClass", "assertions": [ "G7.b", "G15.c" ] }, { "kind": "typeMember", "name": "AskRequest.denialLimitFallback", "assertions": [ "G10.a" ] }, { "kind": "typeMember", "name": "AskRequest.message", "assertions": [ "G9.b" ] }, { "kind": "typeMember", "name": "PermissionRule.behavior", "assertions": [ "G15.b", "G16.b" ] }, { "kind": "typeMember", "name": "PermissionRuleIssue.code", "assertions": [ "G15.a", "G15.b", "G16.a" ] }, { "kind": "typeMember", "name": "RunnerDeps.allowedTools", "assertions": [ "G6.a", "G12.a" ] }, { "kind": "typeMember", "name": "TaskResult.terminal", "assertions": [ "G1.a", "G1.b", "G1.c" ] }, { "kind": "typeMember", "name": "TaskSpec.allowedTools", "assertions": [ "G6.a", "G6.b", "G8.a" ] }, { "kind": "typeMember", "name": "TaskSpec.images", "assertions": [ "G1.a", "G1.c" ] }, { "kind": "typeMember", "name": "TaskSpec.toolPolicy", "assertions": [ "G2.a", "G2.c" ] }, { "kind": "typeMember", "name": "ToolPolicy.check", "assertions": [ "G3.a", "G3.b" ] } ], "consumersHint": { "cli": [ "AskRequest", "DecisionReason", "ENGINE_NOTICE_CODES", "PermissionResult", "PermissionRule", "PermissionRuleIssue", "PreToolUseResult", "RiskDescriptor", "RunInternals", "RunnerDeps", "TaskSpec", "ToolExecuteContext", "ToolGateInput", "TraceEvent" ], "server": [ "AskRequest", "DecisionReason", "ENGINE_NOTICE_CODES", "PermissionResult", "PermissionRuleIssue", "PreToolUseResult", "RiskDescriptor", "RunInternals", "RunnerDeps", "TaskSpec", "ToolExecuteContext", "ToolGateInput", "TraceEvent", "buildRiskDescriptor" ], "sdk": [ "AskRequest", "DecisionReason", "ENGINE_NOTICE_CODES", "PermissionResult", "PermissionRuleIssue", "PreToolUseResult", "RiskDescriptor", "RunnerDeps", "TaskSpec", "TraceEvent" ], "note": "scanned cli@e790a1ca server@4160110a sdk@bc45b50 — a name listed is MENTIONED there today, which is evidence of consumption, not proof of it. Ledger files (**/docs/core-consumption/**, **/docs/wire-consumption/**, **/*LEDGER*.json) are not evidence of use — server: 1 name(s) matched ONLY in bookkeeping files and were set aside (PermissionRule)" }, "breakingCount": 11, "breakingItems": [ "closed set lost members: ENGINE_NOTICE_CODES -skills.allowed_tool_not_granted", "closed set lost members: PermissionRule.behavior -allow", "closed set lost members: PermissionRuleIssue.code -invalid.allow_param_rule,unsupported.bash_prefix,unsupported.file_glob", "export removed: SKILL_ENTRY_INERT_REASONS (variable)", "export removed: SkillEntryInertReason (type)", "signature changed: ToolGateInput.suspendAsk — param 6 `allowRuleShadowed` type changed, direction not read: [string -> readonly import(\"./allow-rule-shadow.js\").AllowRuleShadow[]]", "signature changed: buildRiskDescriptor — param 1 `input` type changed, direction not read: …ne?: ShellGateDoctrine; [shadowedRule?: string -> allowRuleShadowed?: readonly import(\"./allow-rule-shadow.js\").AllowRu…]; probeReason?: string; …", "type lost keys: AskRequest -persistedRuleShadowed", "type lost keys: PermissionResult -ask.persistedRuleShadowed", "type lost keys: PreToolUseResult -ask.persistedRuleShadowed", "type lost keys: RiskDescriptor -shadowedRule" ] }