@sema-agent/core 1.292.0 → 1.294.0

package/dist/core/runner/prepare-task.js

@@ -30,7 +30,7 @@ import { reservedCollisions, reservedFor } from "../../brain/request-params.js";
 import { defineTool } from "../tools.js";
 import { pathToUri } from "../lsp-protocol.js";
 import { DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, firstPartyOffloadPolicy, InMemoryToolResultStore, RunnerSharedToolResultStore, ScopedToolResultStore, isVolatileOffloadStore, OFFLOAD_TOOL_NAME, makeReadToolResultTool, withToolResultOffload, } from "../tool-result-store.js";
-import { OUTPUT_TOOL_NAME, REPORT_FINDINGS_TOOL_NAME, SKILL_TOOL_NAME, buildSkillsBlock, makeOutputTool, makeReportBlockedTool, makeReportFindingsTool, makeSkillTool, normalizeSkills } from "./synthetic-tools.js";
+import { OUTPUT_TOOL_NAME, REPORT_FINDINGS_TOOL_NAME, SKILL_CONTENT_MAX_CHARS, SKILL_TOOL_NAME, buildSkillsBlock, makeOutputTool, makeReportBlockedTool, makeReportFindingsTool, makeSkillTool, normalizeSkills } from "./synthetic-tools.js";
 import { compileOutputSchema } from "./strict-output-schema.js";
 import { TOOL_SEARCH_NAME, buildDeferredRegistry, classifyDeferred, extractDiscoveredToolNames, makePlaceholderTool, makeToolSearchTool, } from "./tool-disclosure.js";
 import { composeMemoryBlock, normalizeMemorySpec } from "../memory.js";
@@ -524,6 +524,62 @@ export async function prepareTask(spec, deps, sessions, resume, _memorySelector,
         };
         const subagentRetain = spec.retainSubagentSessions ? new SubagentRetainLedger(spec.retainSubagentSessions) : undefined;
         const worktreeIsolation = spec.handsReadOnly !== true ? createSubagentWorktreeHelper(executionEnv, taskRootPath) : undefined;
+        const liveInheritedGate = internals?.inheritedGate;
+        const seedInheritedGate = resume?.seed.inheritedGate;
+        const inheritedAncestorRules = (() => {
+            const seedRules = seedInheritedGate?.ancestorRules;
+            const liveRules = liveInheritedGate?.ancestorRules;
+            if (seedRules === undefined || seedRules.length === 0)
+                return liveRules ?? seedRules;
+            if (liveRules === undefined || liveRules.length === 0)
+                return seedRules;
+            const merged = seedRules.map((s) => {
+                const live = liveRules.find((l) => l.sessionId === s.sessionId && l.principal === s.principal);
+                return live !== undefined && live.rev >= s.rev ? live : s;
+            });
+            const extras = liveRules.filter((l) => !seedRules.some((s) => s.sessionId === l.sessionId && s.principal === l.principal));
+            return [...merged, ...extras];
+        })();
+        const shellGateRank = { off: 0, classify: 1, always: 2 };
+        const liveShellGate = liveInheritedGate?.shellGate;
+        const seedShellGate = seedInheritedGate?.shellGate;
+        const inheritedShellGate = liveShellGate === undefined
+            ? seedShellGate
+            : seedShellGate === undefined
+                ? liveShellGate
+                : shellGateRank[liveShellGate] >= shellGateRank[seedShellGate]
+                    ? liveShellGate
+                    : seedShellGate;
+        const inheritedParentConstraints = liveInheritedGate?.parentConstraints;
+        const specShellGate = spec.shellGate ?? "off";
+        const effectiveShellGate = inheritedShellGate !== undefined && shellGateRank[inheritedShellGate] > shellGateRank[specShellGate] ? inheritedShellGate : specShellGate;
+        const ownSessionRulesRef = {};
+        const frozenOnAsk = spec.onAsk ?? deps.onAsk;
+        const inheritedGateForChildren = () => {
+            const ancestorRules = [
+                ...(inheritedAncestorRules ?? []),
+                ...(ownSessionRulesRef.current !== undefined ? [ownSessionRulesRef.current] : []),
+            ];
+            const ownCallerPolicy = spec.toolPolicy ?? deps.toolPolicy;
+            const durableMandate = runtimeCaps?.forceDurableGate === true || (spec.durableApproval !== undefined && frozenOnAsk === undefined);
+            const parentConstraints = [
+                ...(inheritedParentConstraints ?? []),
+                ...(ownCallerPolicy !== undefined
+                    ? [
+                        {
+                            policy: ownCallerPolicy,
+                            ...(frozenOnAsk !== undefined ? { onAsk: frozenOnAsk } : {}),
+                            ...(durableMandate ? { durableMandate: true } : {}),
+                        },
+                    ]
+                    : []),
+            ];
+            return {
+                ...(ancestorRules.length > 0 ? { ancestorRules } : {}),
+                ...(effectiveShellGate !== "off" ? { shellGate: effectiveShellGate } : {}),
+                ...(parentConstraints.length > 0 ? { parentConstraints } : {}),
+            };
+        };
         let agentForkDenial;
         let observersActive = false;
         let autoModeDecider;
@@ -538,6 +594,7 @@ export async function prepareTask(spec, deps, sessions, resume, _memorySelector,
                 clientContext: spec.clientContext,
                 parentCwd: taskRootPath,
                 activeSkillScope: () => skillScope.active(),
+                inheritedGateForChildren,
                 taskId: hostTaskId,
                 sessionId,
                 ...(spec.backgroundScope !== undefined ? { backgroundScope: spec.backgroundScope } : {}),
@@ -641,6 +698,8 @@ export async function prepareTask(spec, deps, sessions, resume, _memorySelector,
                 workflowDepth: internals?.workflowDepth,
                 parentCwd: taskRootPath,
                 parentThinking: () => harnessRef.current?.getThinkingLevel() ?? thinking,
+                ...(forwardEvent ? { forwardEvent } : {}),
+                inheritedGateForChildren,
             }));
         }
         const suspendRef = {};
@@ -829,7 +888,7 @@ export async function prepareTask(spec, deps, sessions, resume, _memorySelector,
                 }
             }
             tools.push(...band.map((t) => firstPartyOffload(t)));
-            const shellGate = spec.shellGate ?? "off";
+            const shellGate = effectiveShellGate;
             if (shellGate !== "off" && !(executionEnv instanceof StubExecutionEnv) && spec.handsReadOnly !== true) {
                 shellGatedBash = !egressTools.has("Bash") && !irreversibilityTier.has("Bash");
                 irreversibilityTier.set("Bash", shellGate === "always" ? "always" : "maybe");
@@ -1163,7 +1222,12 @@ export async function prepareTask(spec, deps, sessions, resume, _memorySelector,
                 memoryBlock = memoryBlock ? `${memoryBlock}\n\n${projectBlock}` : projectBlock;
             }
         }
-        const skillSpecs = normalizeSkills(spec.skills);
+        const skillSpecs = normalizeSkills(spec.skills ?? []).filter((s) => {
+            if (s.content.length <= SKILL_CONTENT_MAX_CHARS)
+                return true;
+            deps.onError?.(new Error(`Skill "${s.name}" content is ${s.content.length} chars, over the ${SKILL_CONTENT_MAX_CHARS}-char load limit — skill not loaded (skills are never truncated; shrink the body or move material to attachments/files).`), { phase: "config", sessionId });
+            return false;
+        });
         const inheritedFrames = internals?.inheritedManifestScope ?? [];
         for (const frame of inheritedFrames) {
             skillScope.push(frame);
@@ -1516,8 +1580,28 @@ export async function prepareTask(spec, deps, sessions, resume, _memorySelector,
             const rules = await deps.sessionPolicyStore.getRules(spec.sessionId, spec.principal);
             if (rules) {
                 sessionRulePolicy = createSessionRulePolicy(rules, { env: executionEnv, rootPath: taskRootPath, toolEffects });
+                ownSessionRulesRef.current = {
+                    sessionId: spec.sessionId,
+                    ...(spec.principal !== undefined ? { principal: spec.principal } : {}),
+                    rev: rules.rev,
+                    rules,
+                };
             }
         }
+        const ancestorRulePolicies = [];
+        for (const snap of inheritedAncestorRules ?? []) {
+            let ancestorRules = snap.rules;
+            if (deps.sessionPolicyStore) {
+                try {
+                    const live = await deps.sessionPolicyStore.getRules(snap.sessionId, snap.principal);
+                    if (live !== null && live.rev >= snap.rev)
+                        ancestorRules = live;
+                }
+                catch {
+                }
+            }
+            ancestorRulePolicies.push(createSessionRulePolicy(ancestorRules, { env: executionEnv, rootPath: taskRootPath, toolEffects }));
+        }
         const skillScopePolicy = hasSkillManifest
             ? createActiveSkillScopePolicy({
                 scope: skillScope,
@@ -1526,12 +1610,177 @@ export async function prepareTask(spec, deps, sessions, resume, _memorySelector,
                 toolEffects,
             })
             : undefined;
-        const narrowingLayers = [sessionRulePolicy, skillScopePolicy].filter((p) => p !== undefined);
+        const narrowingLayers = [sessionRulePolicy, ...ancestorRulePolicies, skillScopePolicy].filter((p) => p !== undefined);
         const denyNarrowingPolicy = narrowingLayers.length === 0 ? undefined : narrowingLayers.length === 1 ? narrowingLayers[0] : combinePolicies(...narrowingLayers);
-        const policyLayers = policy !== undefined ? [...narrowingLayers, policy, ...narrowingLayers] : narrowingLayers;
+        const sameInstanceAncestorCount = policy === undefined ? 0 : (inheritedParentConstraints ?? []).reduce((n, pc) => (pc.policy === policy ? n + 1 : n), 0);
+        const sharedFirstDecision = new Map();
+        const SHARED_FIRST_DECISION_CAP = 256;
+        const callerPolicyLayer = policy !== undefined && sameInstanceAncestorCount > 0
+            ? {
+                check: async (creq, csignal) => {
+                    const decision = await policy.check(creq, csignal ?? abortController.signal);
+                    sharedFirstDecision.set(creq.toolCallId, decision);
+                    if (sharedFirstDecision.size > SHARED_FIRST_DECISION_CAP) {
+                        const oldest = sharedFirstDecision.keys().next().value;
+                        if (oldest !== undefined)
+                            sharedFirstDecision.delete(oldest);
+                    }
+                    return decision;
+                },
+            }
+            : policy;
+        const parentConstraintWrappers = (inheritedParentConstraints ?? []).map((pc) => policy !== undefined && pc.policy === policy
+            ? {
+                check: async (creq, csignal) => {
+                    const first = sharedFirstDecision.get(creq.toolCallId);
+                    if (first === undefined) {
+                        return {
+                            action: "deny",
+                            reason: `inherited parent policy could not be arbitrated for "${creq.toolName}" ` +
+                                `(shared-instance first decision unavailable); denied fail-closed`,
+                        };
+                    }
+                    if (first.action === "deny")
+                        return first;
+                    if (first.action === "allow")
+                        return { action: "allow" };
+                    if (pc.durableMandate === true) {
+                        return {
+                            action: "deny",
+                            reason: `inherited parent policy requires durable approval for "${creq.toolName}" — the parent's durable ` +
+                                `ask cannot be reconstructed in a delegated child; denied fail-closed (tighten-only)`,
+                        };
+                    }
+                    const presentedArgs = creq.args;
+                    const resolved = await resolveAsk({
+                        toolName: creq.toolName,
+                        toolCallId: creq.toolCallId,
+                        args: presentedArgs,
+                        message: first.message ?? first.reason ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
+                        principal: spec.principal,
+                        sourceTaskId: sessionId,
+                    }, pc.onAsk, csignal ?? abortController.signal);
+                    return resolved.action === "allow" ? { action: "allow" } : resolved;
+                },
+            }
+            : {
+                check: async (creq, csignal) => {
+                    let decision;
+                    try {
+                        decision = await pc.policy.check(creq, csignal ?? abortController.signal);
+                    }
+                    catch (err) {
+                        return {
+                            action: "deny",
+                            reason: `inherited parent policy errored for "${creq.toolName}": ${err instanceof Error ? err.message : String(err)}`,
+                        };
+                    }
+                    if (decision.action !== "ask")
+                        return decision;
+                    if (pc.durableMandate === true) {
+                        return {
+                            action: "deny",
+                            reason: `inherited parent policy requires durable approval for "${creq.toolName}" — the parent's durable ` +
+                                `ask cannot be reconstructed in a delegated child; denied fail-closed (tighten-only)`,
+                        };
+                    }
+                    const presentedArgs = decision.updatedInput !== undefined ? decision.updatedInput : creq.args;
+                    const resolved = await resolveAsk({
+                        toolName: creq.toolName,
+                        toolCallId: creq.toolCallId,
+                        args: presentedArgs,
+                        message: decision.message ?? decision.reason ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
+                        principal: spec.principal,
+                        sourceTaskId: sessionId,
+                    }, pc.onAsk, csignal ?? abortController.signal);
+                    return resolved.action === "allow" && decision.updatedInput !== undefined
+                        ? { ...resolved, updatedInput: decision.updatedInput }
+                        : resolved;
+                },
+            });
+        const rewriteCapableLayers = policy !== undefined || parentConstraintWrappers.length > 0;
+        const rewriteEmitterIndex = new Map();
+        const rewriteCapableChain = [
+            ...(callerPolicyLayer !== undefined ? [callerPolicyLayer] : []),
+            ...parentConstraintWrappers,
+        ];
+        const callerSlotOffset = callerPolicyLayer !== undefined ? 1 : 0;
+        const sameInstanceAdapterIndices = new Set();
+        (inheritedParentConstraints ?? []).forEach((pc, j) => {
+            if (policy !== undefined && pc.policy === policy)
+                sameInstanceAdapterIndices.add(j + callerSlotOffset);
+        });
+        const instrumentedChain = rewriteCapableChain.map((layer, idx) => ({
+            check: async (creq, csignal) => {
+                const d = await layer.check(creq, csignal);
+                if (d.updatedInput !== undefined)
+                    rewriteEmitterIndex.set(creq.toolCallId, idx);
+                return d;
+            },
+        }));
+        const policyLayers = [
+            ...narrowingLayers,
+            ...instrumentedChain,
+            ...(rewriteCapableLayers ? narrowingLayers : []),
+        ];
         const integrityGuardLayers = [createTranscriptIntegrityPolicy(), createUnverifiableDeletePolicy()];
-        const guardedPolicyLayers = policy !== undefined ? [...integrityGuardLayers, ...policyLayers, ...integrityGuardLayers] : [...integrityGuardLayers, ...policyLayers];
-        const effectivePolicy = guardedPolicyLayers.length === 1 ? guardedPolicyLayers[0] : combinePolicies(...guardedPolicyLayers);
+        const guardedPolicyLayers = rewriteCapableLayers
+            ? [...integrityGuardLayers, ...policyLayers, ...integrityGuardLayers]
+            : [...integrityGuardLayers, ...policyLayers];
+        const foldedPolicy = guardedPolicyLayers.length === 1 ? guardedPolicyLayers[0] : combinePolicies(...guardedPolicyLayers);
+        const effectivePolicy = foldedPolicy !== undefined && rewriteCapableLayers
+            ? {
+                check: async (req, signal) => {
+                    let decision;
+                    try {
+                        decision = await foldedPolicy.check(req, signal);
+                    }
+                    catch (err) {
+                        rewriteEmitterIndex.delete(req.toolCallId);
+                        throw err;
+                    }
+                    const emitterIdx = rewriteEmitterIndex.get(req.toolCallId);
+                    rewriteEmitterIndex.delete(req.toolCallId);
+                    if (decision.action === "deny" || decision.updatedInput === undefined)
+                        return decision;
+                    const recheckPrefix = rewriteCapableChain.slice(0, emitterIdx ?? rewriteCapableChain.length);
+                    const postEmitterSameInstanceAdapters = [];
+                    if (emitterIdx !== undefined && emitterIdx > 0) {
+                        for (let i = emitterIdx + 1; i < rewriteCapableChain.length; i++) {
+                            if (sameInstanceAdapterIndices.has(i))
+                                postEmitterSameInstanceAdapters.push(rewriteCapableChain[i]);
+                        }
+                    }
+                    const recheckLayers = [...recheckPrefix, ...postEmitterSameInstanceAdapters];
+                    const finalReq = { ...req, args: decision.updatedInput };
+                    let asked;
+                    try {
+                        for (const layer of recheckLayers) {
+                            const d = await layer.check(finalReq, signal);
+                            if (d.action === "deny") {
+                                return { ...d, updatedInput: decision.updatedInput };
+                            }
+                            if (d.updatedInput !== undefined) {
+                                return {
+                                    action: "deny",
+                                    message: "policy required a rewrite during final-form re-check — the arguments that would execute were not accepted as-is (fail-closed; rewrite chains are not iterated to a fixpoint)",
+                                    updatedInput: decision.updatedInput,
+                                };
+                            }
+                            if (d.action === "ask" && asked === undefined)
+                                asked = d;
+                        }
+                    }
+                    finally {
+                        rewriteEmitterIndex.delete(req.toolCallId);
+                    }
+                    if (asked !== undefined && decision.action === "allow") {
+                        return { ...asked, updatedInput: decision.updatedInput };
+                    }
+                    return decision;
+                },
+            }
+            : foldedPolicy;
         const hooks = spec.hooks ?? deps.hooks;
         const onAsk = spec.onAsk ?? deps.onAsk;
         const handWriteTools = handsEnabled
@@ -1653,6 +1902,18 @@ export async function prepareTask(spec, deps, sessions, resume, _memorySelector,
                     return live.length > 0 ? live : undefined;
                 })(),
                 pendingSteer: undefined,
+                inheritedGate: (() => {
+                    const requiresParentConstraint = (inheritedParentConstraints?.length ?? 0) > 0 || seedInheritedGate?.requiresParentConstraint === true;
+                    const parentConstraintCount = (inheritedParentConstraints?.length ?? 0) > 0 ? inheritedParentConstraints.length : seedInheritedGate?.parentConstraintCount;
+                    return inheritedAncestorRules !== undefined || inheritedShellGate !== undefined || requiresParentConstraint
+                        ? {
+                            ...(inheritedAncestorRules !== undefined ? { ancestorRules: structuredClone(inheritedAncestorRules) } : {}),
+                            ...(inheritedShellGate !== undefined ? { shellGate: inheritedShellGate } : {}),
+                            requiresParentConstraint,
+                            ...(requiresParentConstraint && parentConstraintCount !== undefined ? { parentConstraintCount } : {}),
+                        }
+                        : undefined;
+                })(),
             });
             const commitSuspendSaga = async (token, cp, remoteEnv, remoteHandle) => {
                 if (!checkpointStore)
@@ -1846,7 +2107,7 @@ export async function prepareTask(spec, deps, sessions, resume, _memorySelector,
                 : undefined;
             const suspendAsk = checkpointStore && (durableApproval || irreversibleTools.size > 0 || egressTools.size > 0)
                 ? async (req, postHookArgs, safety) => {
-                    if (safety === undefined && durableApproval === undefined && onAsk !== undefined) {
+                    if (safety === undefined && onAsk !== undefined && runtimeCaps?.forceDurableGate !== true) {
                         return undefined;
                     }
                     let token;