@sema-agent/core 1.293.0 → 1.295.0

package/dist/core/runner/prepare-task.js

@@ -28,6 +28,7 @@ import { reconcileInterruptedSession } from "../session-reconcile.js";
 import { CacheBreakDetector, toolsToFingerprintInputs } from "../cache-break-detector.js";
 import { reservedCollisions, reservedFor } from "../../brain/request-params.js";
 import { defineTool } from "../tools.js";
+import { canonicalToolName } from "../tool-name-aliases.js";
 import { pathToUri } from "../lsp-protocol.js";
 import { DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, firstPartyOffloadPolicy, InMemoryToolResultStore, RunnerSharedToolResultStore, ScopedToolResultStore, isVolatileOffloadStore, OFFLOAD_TOOL_NAME, makeReadToolResultTool, withToolResultOffload, } from "../tool-result-store.js";
 import { OUTPUT_TOOL_NAME, REPORT_FINDINGS_TOOL_NAME, SKILL_CONTENT_MAX_CHARS, SKILL_TOOL_NAME, buildSkillsBlock, makeOutputTool, makeReportBlockedTool, makeReportFindingsTool, makeSkillTool, normalizeSkills } from "./synthetic-tools.js";
@@ -153,6 +154,16 @@ export async function prepareTask(spec, deps, sessions, resume, _memorySelector,
             throw e;
         }
     }
+    if (spec.agents !== undefined && spec.agents.length > 0) {
+        const pool = spec.tools ?? [];
+        if (!pool.some((t) => typeof t.withAgents === "function")) {
+            const e = new Error(`TaskSpec.agents was provided but no delegation tool (createSubagentTool) is mounted in spec.tools — the per-task agents could never be offered. Mount the delegation tool, or drop spec.agents.`);
+            e.code = "config.agents.no_delegation_tool";
+            throw e;
+        }
+        const perTask = spec.agents;
+        spec = { ...spec, tools: pool.map((t) => (typeof t.withAgents === "function" ? t.withAgents(perTask) : t)) };
+    }
     const resolvedRole = resolveTaskModel(spec, deps);
     const model = resolvedRole.model;
     const thinking = spec.thinking ?? resolvedRole.thinking ?? model.defaultThinking;
@@ -524,6 +535,62 @@ export async function prepareTask(spec, deps, sessions, resume, _memorySelector,
         };
         const subagentRetain = spec.retainSubagentSessions ? new SubagentRetainLedger(spec.retainSubagentSessions) : undefined;
         const worktreeIsolation = spec.handsReadOnly !== true ? createSubagentWorktreeHelper(executionEnv, taskRootPath) : undefined;
+        const liveInheritedGate = internals?.inheritedGate;
+        const seedInheritedGate = resume?.seed.inheritedGate;
+        const inheritedAncestorRules = (() => {
+            const seedRules = seedInheritedGate?.ancestorRules;
+            const liveRules = liveInheritedGate?.ancestorRules;
+            if (seedRules === undefined || seedRules.length === 0)
+                return liveRules ?? seedRules;
+            if (liveRules === undefined || liveRules.length === 0)
+                return seedRules;
+            const merged = seedRules.map((s) => {
+                const live = liveRules.find((l) => l.sessionId === s.sessionId && l.principal === s.principal);
+                return live !== undefined && live.rev >= s.rev ? live : s;
+            });
+            const extras = liveRules.filter((l) => !seedRules.some((s) => s.sessionId === l.sessionId && s.principal === l.principal));
+            return [...merged, ...extras];
+        })();
+        const shellGateRank = { off: 0, classify: 1, always: 2 };
+        const liveShellGate = liveInheritedGate?.shellGate;
+        const seedShellGate = seedInheritedGate?.shellGate;
+        const inheritedShellGate = liveShellGate === undefined
+            ? seedShellGate
+            : seedShellGate === undefined
+                ? liveShellGate
+                : shellGateRank[liveShellGate] >= shellGateRank[seedShellGate]
+                    ? liveShellGate
+                    : seedShellGate;
+        const inheritedParentConstraints = liveInheritedGate?.parentConstraints;
+        const specShellGate = spec.shellGate ?? "off";
+        const effectiveShellGate = inheritedShellGate !== undefined && shellGateRank[inheritedShellGate] > shellGateRank[specShellGate] ? inheritedShellGate : specShellGate;
+        const ownSessionRulesRef = {};
+        const frozenOnAsk = spec.onAsk ?? deps.onAsk;
+        const inheritedGateForChildren = () => {
+            const ancestorRules = [
+                ...(inheritedAncestorRules ?? []),
+                ...(ownSessionRulesRef.current !== undefined ? [ownSessionRulesRef.current] : []),
+            ];
+            const ownCallerPolicy = spec.toolPolicy ?? deps.toolPolicy;
+            const durableMandate = runtimeCaps?.forceDurableGate === true || (spec.durableApproval !== undefined && frozenOnAsk === undefined);
+            const parentConstraints = [
+                ...(inheritedParentConstraints ?? []),
+                ...(ownCallerPolicy !== undefined
+                    ? [
+                        {
+                            policy: ownCallerPolicy,
+                            ...(frozenOnAsk !== undefined ? { onAsk: frozenOnAsk } : {}),
+                            ...(durableMandate ? { durableMandate: true } : {}),
+                        },
+                    ]
+                    : []),
+            ];
+            return {
+                ...(ancestorRules.length > 0 ? { ancestorRules } : {}),
+                ...(effectiveShellGate !== "off" ? { shellGate: effectiveShellGate } : {}),
+                ...(parentConstraints.length > 0 ? { parentConstraints } : {}),
+            };
+        };
         let agentForkDenial;
         let observersActive = false;
         let autoModeDecider;
@@ -538,6 +605,7 @@ export async function prepareTask(spec, deps, sessions, resume, _memorySelector,
                 clientContext: spec.clientContext,
                 parentCwd: taskRootPath,
                 activeSkillScope: () => skillScope.active(),
+                inheritedGateForChildren,
                 taskId: hostTaskId,
                 sessionId,
                 ...(spec.backgroundScope !== undefined ? { backgroundScope: spec.backgroundScope } : {}),
@@ -642,6 +710,7 @@ export async function prepareTask(spec, deps, sessions, resume, _memorySelector,
                 parentCwd: taskRootPath,
                 parentThinking: () => harnessRef.current?.getThinkingLevel() ?? thinking,
                 ...(forwardEvent ? { forwardEvent } : {}),
+                inheritedGateForChildren,
             }));
         }
         const suspendRef = {};
@@ -830,7 +899,7 @@ export async function prepareTask(spec, deps, sessions, resume, _memorySelector,
                 }
             }
             tools.push(...band.map((t) => firstPartyOffload(t)));
-            const shellGate = spec.shellGate ?? "off";
+            const shellGate = effectiveShellGate;
             if (shellGate !== "off" && !(executionEnv instanceof StubExecutionEnv) && spec.handsReadOnly !== true) {
                 shellGatedBash = !egressTools.has("Bash") && !irreversibilityTier.has("Bash");
                 irreversibilityTier.set("Bash", shellGate === "always" ? "always" : "maybe");
@@ -1424,6 +1493,20 @@ export async function prepareTask(spec, deps, sessions, resume, _memorySelector,
             toolSearch = makeToolSearchTool({ registry, active: activeTools, rematerialize });
             harnessTools = buildToolList(activeTools);
         }
+        if (spec.agents !== undefined && spec.agents.length > 0) {
+            const known = new Set(tools.flatMap((t) => [canonicalToolName(t.name), ...(t.aliases ?? []).map((a) => canonicalToolName(a))]));
+            for (const def of spec.agents) {
+                for (const n of def.allowTools ?? []) {
+                    if (n === "*")
+                        continue;
+                    if (!known.has(canonicalToolName(n))) {
+                        const e = new Error(`TaskSpec.agents: agent "${def.name}" declares tool "${n}" in its allowed tools, but no such tool exists in this deployment — fix the agent's tools list or mount the tool.`);
+                        e.code = "config.agent.unknown_tool";
+                        throw e;
+                    }
+                }
+            }
+        }
         const agentListingSpec = (spec.tools ?? []).find((t) => t.agentListing !== undefined && t.agentListing.length > 0);
         const agentListing = agentListingSpec
             ? { entries: agentListingSpec.agentListing, toolName: agentListingSpec.name, seedAnnounced: resume !== undefined }
@@ -1522,8 +1605,28 @@ export async function prepareTask(spec, deps, sessions, resume, _memorySelector,
             const rules = await deps.sessionPolicyStore.getRules(spec.sessionId, spec.principal);
             if (rules) {
                 sessionRulePolicy = createSessionRulePolicy(rules, { env: executionEnv, rootPath: taskRootPath, toolEffects });
+                ownSessionRulesRef.current = {
+                    sessionId: spec.sessionId,
+                    ...(spec.principal !== undefined ? { principal: spec.principal } : {}),
+                    rev: rules.rev,
+                    rules,
+                };
             }
         }
+        const ancestorRulePolicies = [];
+        for (const snap of inheritedAncestorRules ?? []) {
+            let ancestorRules = snap.rules;
+            if (deps.sessionPolicyStore) {
+                try {
+                    const live = await deps.sessionPolicyStore.getRules(snap.sessionId, snap.principal);
+                    if (live !== null && live.rev >= snap.rev)
+                        ancestorRules = live;
+                }
+                catch {
+                }
+            }
+            ancestorRulePolicies.push(createSessionRulePolicy(ancestorRules, { env: executionEnv, rootPath: taskRootPath, toolEffects }));
+        }
         const skillScopePolicy = hasSkillManifest
             ? createActiveSkillScopePolicy({
                 scope: skillScope,
@@ -1532,12 +1635,177 @@ export async function prepareTask(spec, deps, sessions, resume, _memorySelector,
                 toolEffects,
             })
             : undefined;
-        const narrowingLayers = [sessionRulePolicy, skillScopePolicy].filter((p) => p !== undefined);
+        const narrowingLayers = [sessionRulePolicy, ...ancestorRulePolicies, skillScopePolicy].filter((p) => p !== undefined);
         const denyNarrowingPolicy = narrowingLayers.length === 0 ? undefined : narrowingLayers.length === 1 ? narrowingLayers[0] : combinePolicies(...narrowingLayers);
-        const policyLayers = policy !== undefined ? [...narrowingLayers, policy, ...narrowingLayers] : narrowingLayers;
+        const sameInstanceAncestorCount = policy === undefined ? 0 : (inheritedParentConstraints ?? []).reduce((n, pc) => (pc.policy === policy ? n + 1 : n), 0);
+        const sharedFirstDecision = new Map();
+        const SHARED_FIRST_DECISION_CAP = 256;
+        const callerPolicyLayer = policy !== undefined && sameInstanceAncestorCount > 0
+            ? {
+                check: async (creq, csignal) => {
+                    const decision = await policy.check(creq, csignal ?? abortController.signal);
+                    sharedFirstDecision.set(creq.toolCallId, decision);
+                    if (sharedFirstDecision.size > SHARED_FIRST_DECISION_CAP) {
+                        const oldest = sharedFirstDecision.keys().next().value;
+                        if (oldest !== undefined)
+                            sharedFirstDecision.delete(oldest);
+                    }
+                    return decision;
+                },
+            }
+            : policy;
+        const parentConstraintWrappers = (inheritedParentConstraints ?? []).map((pc) => policy !== undefined && pc.policy === policy
+            ? {
+                check: async (creq, csignal) => {
+                    const first = sharedFirstDecision.get(creq.toolCallId);
+                    if (first === undefined) {
+                        return {
+                            action: "deny",
+                            reason: `inherited parent policy could not be arbitrated for "${creq.toolName}" ` +
+                                `(shared-instance first decision unavailable); denied fail-closed`,
+                        };
+                    }
+                    if (first.action === "deny")
+                        return first;
+                    if (first.action === "allow")
+                        return { action: "allow" };
+                    if (pc.durableMandate === true) {
+                        return {
+                            action: "deny",
+                            reason: `inherited parent policy requires durable approval for "${creq.toolName}" — the parent's durable ` +
+                                `ask cannot be reconstructed in a delegated child; denied fail-closed (tighten-only)`,
+                        };
+                    }
+                    const presentedArgs = creq.args;
+                    const resolved = await resolveAsk({
+                        toolName: creq.toolName,
+                        toolCallId: creq.toolCallId,
+                        args: presentedArgs,
+                        message: first.message ?? first.reason ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
+                        principal: spec.principal,
+                        sourceTaskId: sessionId,
+                    }, pc.onAsk, csignal ?? abortController.signal);
+                    return resolved.action === "allow" ? { action: "allow" } : resolved;
+                },
+            }
+            : {
+                check: async (creq, csignal) => {
+                    let decision;
+                    try {
+                        decision = await pc.policy.check(creq, csignal ?? abortController.signal);
+                    }
+                    catch (err) {
+                        return {
+                            action: "deny",
+                            reason: `inherited parent policy errored for "${creq.toolName}": ${err instanceof Error ? err.message : String(err)}`,
+                        };
+                    }
+                    if (decision.action !== "ask")
+                        return decision;
+                    if (pc.durableMandate === true) {
+                        return {
+                            action: "deny",
+                            reason: `inherited parent policy requires durable approval for "${creq.toolName}" — the parent's durable ` +
+                                `ask cannot be reconstructed in a delegated child; denied fail-closed (tighten-only)`,
+                        };
+                    }
+                    const presentedArgs = decision.updatedInput !== undefined ? decision.updatedInput : creq.args;
+                    const resolved = await resolveAsk({
+                        toolName: creq.toolName,
+                        toolCallId: creq.toolCallId,
+                        args: presentedArgs,
+                        message: decision.message ?? decision.reason ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
+                        principal: spec.principal,
+                        sourceTaskId: sessionId,
+                    }, pc.onAsk, csignal ?? abortController.signal);
+                    return resolved.action === "allow" && decision.updatedInput !== undefined
+                        ? { ...resolved, updatedInput: decision.updatedInput }
+                        : resolved;
+                },
+            });
+        const rewriteCapableLayers = policy !== undefined || parentConstraintWrappers.length > 0;
+        const rewriteEmitterIndex = new Map();
+        const rewriteCapableChain = [
+            ...(callerPolicyLayer !== undefined ? [callerPolicyLayer] : []),
+            ...parentConstraintWrappers,
+        ];
+        const callerSlotOffset = callerPolicyLayer !== undefined ? 1 : 0;
+        const sameInstanceAdapterIndices = new Set();
+        (inheritedParentConstraints ?? []).forEach((pc, j) => {
+            if (policy !== undefined && pc.policy === policy)
+                sameInstanceAdapterIndices.add(j + callerSlotOffset);
+        });
+        const instrumentedChain = rewriteCapableChain.map((layer, idx) => ({
+            check: async (creq, csignal) => {
+                const d = await layer.check(creq, csignal);
+                if (d.updatedInput !== undefined)
+                    rewriteEmitterIndex.set(creq.toolCallId, idx);
+                return d;
+            },
+        }));
+        const policyLayers = [
+            ...narrowingLayers,
+            ...instrumentedChain,
+            ...(rewriteCapableLayers ? narrowingLayers : []),
+        ];
         const integrityGuardLayers = [createTranscriptIntegrityPolicy(), createUnverifiableDeletePolicy()];
-        const guardedPolicyLayers = policy !== undefined ? [...integrityGuardLayers, ...policyLayers, ...integrityGuardLayers] : [...integrityGuardLayers, ...policyLayers];
-        const effectivePolicy = guardedPolicyLayers.length === 1 ? guardedPolicyLayers[0] : combinePolicies(...guardedPolicyLayers);
+        const guardedPolicyLayers = rewriteCapableLayers
+            ? [...integrityGuardLayers, ...policyLayers, ...integrityGuardLayers]
+            : [...integrityGuardLayers, ...policyLayers];
+        const foldedPolicy = guardedPolicyLayers.length === 1 ? guardedPolicyLayers[0] : combinePolicies(...guardedPolicyLayers);
+        const effectivePolicy = foldedPolicy !== undefined && rewriteCapableLayers
+            ? {
+                check: async (req, signal) => {
+                    let decision;
+                    try {
+                        decision = await foldedPolicy.check(req, signal);
+                    }
+                    catch (err) {
+                        rewriteEmitterIndex.delete(req.toolCallId);
+                        throw err;
+                    }
+                    const emitterIdx = rewriteEmitterIndex.get(req.toolCallId);
+                    rewriteEmitterIndex.delete(req.toolCallId);
+                    if (decision.action === "deny" || decision.updatedInput === undefined)
+                        return decision;
+                    const recheckPrefix = rewriteCapableChain.slice(0, emitterIdx ?? rewriteCapableChain.length);
+                    const postEmitterSameInstanceAdapters = [];
+                    if (emitterIdx !== undefined && emitterIdx > 0) {
+                        for (let i = emitterIdx + 1; i < rewriteCapableChain.length; i++) {
+                            if (sameInstanceAdapterIndices.has(i))
+                                postEmitterSameInstanceAdapters.push(rewriteCapableChain[i]);
+                        }
+                    }
+                    const recheckLayers = [...recheckPrefix, ...postEmitterSameInstanceAdapters];
+                    const finalReq = { ...req, args: decision.updatedInput };
+                    let asked;
+                    try {
+                        for (const layer of recheckLayers) {
+                            const d = await layer.check(finalReq, signal);
+                            if (d.action === "deny") {
+                                return { ...d, updatedInput: decision.updatedInput };
+                            }
+                            if (d.updatedInput !== undefined) {
+                                return {
+                                    action: "deny",
+                                    message: "policy required a rewrite during final-form re-check — the arguments that would execute were not accepted as-is (fail-closed; rewrite chains are not iterated to a fixpoint)",
+                                    updatedInput: decision.updatedInput,
+                                };
+                            }
+                            if (d.action === "ask" && asked === undefined)
+                                asked = d;
+                        }
+                    }
+                    finally {
+                        rewriteEmitterIndex.delete(req.toolCallId);
+                    }
+                    if (asked !== undefined && decision.action === "allow") {
+                        return { ...asked, updatedInput: decision.updatedInput };
+                    }
+                    return decision;
+                },
+            }
+            : foldedPolicy;
         const hooks = spec.hooks ?? deps.hooks;
         const onAsk = spec.onAsk ?? deps.onAsk;
         const handWriteTools = handsEnabled
@@ -1607,16 +1875,18 @@ export async function prepareTask(spec, deps, sessions, resume, _memorySelector,
                     sourceTaskId: sessionId,
                 }, onAsk, abortController.signal);
                 const waitMs = Math.max(0, now() - t0);
-                humanReviewRef.count += 1;
-                humanReviewRef.totalWaitMs += waitMs;
-                const toolArg = primaryActivityArg(req.args);
-                humanReviewRef.gates.push({
-                    kind: "human",
-                    waitMs,
-                    decision: resolved.action === "allow" ? "allow" : "deny",
-                    toolName: req.toolName,
-                    ...(toolArg !== undefined ? { toolArg } : {}),
-                });
+                if (resolved.approverUnavailable !== true) {
+                    humanReviewRef.count += 1;
+                    humanReviewRef.totalWaitMs += waitMs;
+                    const toolArg = primaryActivityArg(req.args);
+                    humanReviewRef.gates.push({
+                        kind: "human",
+                        waitMs,
+                        decision: resolved.action === "allow" ? "allow" : "deny",
+                        toolName: req.toolName,
+                        ...(toolArg !== undefined ? { toolArg } : {}),
+                    });
+                }
                 return resolved;
             };
             const hooksWithPermissionDenied = hooks?.permissionDenied ? hooks : undefined;
@@ -1659,6 +1929,18 @@ export async function prepareTask(spec, deps, sessions, resume, _memorySelector,
                     return live.length > 0 ? live : undefined;
                 })(),
                 pendingSteer: undefined,
+                inheritedGate: (() => {
+                    const requiresParentConstraint = (inheritedParentConstraints?.length ?? 0) > 0 || seedInheritedGate?.requiresParentConstraint === true;
+                    const parentConstraintCount = (inheritedParentConstraints?.length ?? 0) > 0 ? inheritedParentConstraints.length : seedInheritedGate?.parentConstraintCount;
+                    return inheritedAncestorRules !== undefined || inheritedShellGate !== undefined || requiresParentConstraint
+                        ? {
+                            ...(inheritedAncestorRules !== undefined ? { ancestorRules: structuredClone(inheritedAncestorRules) } : {}),
+                            ...(inheritedShellGate !== undefined ? { shellGate: inheritedShellGate } : {}),
+                            requiresParentConstraint,
+                            ...(requiresParentConstraint && parentConstraintCount !== undefined ? { parentConstraintCount } : {}),
+                        }
+                        : undefined;
+                })(),
             });
             const commitSuspendSaga = async (token, cp, remoteEnv, remoteHandle) => {
                 if (!checkpointStore)
@@ -1740,7 +2022,7 @@ export async function prepareTask(spec, deps, sessions, resume, _memorySelector,
                         remoteHandle = { ...suspendableEnv.workspaceHandle(), snapshotId: snap.value };
                     }
                     else if (parkOnlyRemoteEnv !== undefined) {
-                        if (hasBackgroundShell(parkOnlyRemoteEnv))
+                        if (hasBackgroundShell(parkOnlyRemoteEnv) && spec.retainBackgroundProcesses !== true)
                             await parkOnlyRemoteEnv.disposeBackgroundShells();
                         remoteHandle = parkOnlyHandle(parkOnlyRemoteEnv);
                     }
@@ -1808,7 +2090,7 @@ export async function prepareTask(spec, deps, sessions, resume, _memorySelector,
                         remoteHandle = { ...suspendableEnv.workspaceHandle(), snapshotId: snap.value };
                     }
                     else if (parkOnlyRemoteEnv !== undefined) {
-                        if (hasBackgroundShell(parkOnlyRemoteEnv))
+                        if (hasBackgroundShell(parkOnlyRemoteEnv) && spec.retainBackgroundProcesses !== true)
                             await parkOnlyRemoteEnv.disposeBackgroundShells();
                         remoteHandle = parkOnlyHandle(parkOnlyRemoteEnv);
                     }
@@ -1851,8 +2133,8 @@ export async function prepareTask(spec, deps, sessions, resume, _memorySelector,
                 }
                 : undefined;
             const suspendAsk = checkpointStore && (durableApproval || irreversibleTools.size > 0 || egressTools.size > 0)
-                ? async (req, postHookArgs, safety) => {
-                    if (safety === undefined && durableApproval === undefined && onAsk !== undefined) {
+                ? async (req, postHookArgs, safety, approverUnavailable) => {
+                    if (safety === undefined && onAsk !== undefined && runtimeCaps?.forceDurableGate !== true && approverUnavailable !== true) {
                         return undefined;
                     }
                     let token;
@@ -1893,7 +2175,7 @@ export async function prepareTask(spec, deps, sessions, resume, _memorySelector,
                             remoteHandle = { ...remoteEnv.workspaceHandle(), snapshotId: snap.value };
                         }
                         else if (parkOnlyRemoteEnv !== undefined) {
-                            if (hasBackgroundShell(parkOnlyRemoteEnv))
+                            if (hasBackgroundShell(parkOnlyRemoteEnv) && spec.retainBackgroundProcesses !== true)
                                 await parkOnlyRemoteEnv.disposeBackgroundShells();
                             remoteHandle = parkOnlyHandle(parkOnlyRemoteEnv);
                         }