@sema-agent/core 1.299.1 → 1.301.0

package/dist/core/runner/prepare-task.js

@@ -17,7 +17,7 @@ import { classifyScopePlanes, derivePersonalControlDir, derivePersonalMemoryDir,
 import { FileMemoryEngineBackend } from "../memory-engine/file-backend.js";
 import { Session, isSessionConflict, hasSessionFork } from "../session.js";
 import { createAgentTranscriptTool, createSendMessageTool, createSubagentWorktreeHelper, forkGovernanceDenial, AGENT_TRANSCRIPT_TOOL_NAME, SEND_MESSAGE_TOOL_NAME, SubagentRetainLedger } from "../../agents/subagent.js";
-import { combinePolicies, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, resolveAsk } from "../tool-policy.js";
+import { combinePolicies, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, resolveAsk, toolPolicyNameSets } from "../tool-policy.js";
 import { ActiveSkillScope, createActiveSkillScopePolicy } from "./active-skill-scope.js";
 import { computeCallCap, createCallCapRef, softExecDeadlineMs, toolCutDeadlineMs, WALLTIME_STALL_CONNECT_MS, WALLTIME_STALL_FIRST_TOKEN_MS, WALLTIME_STALL_IDLE_MS } from "./call-cap.js";
 import { createCutKillRegistry } from "./cut-kill.js";
@@ -32,7 +32,7 @@ import { defineTool } from "../tools.js";
 import { canonicalToolName } from "../tool-name-aliases.js";
 import { pathToUri } from "../lsp-protocol.js";
 import { DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, firstPartyOffloadPolicy, InMemoryToolResultStore, RunnerSharedToolResultStore, ScopedToolResultStore, isVolatileOffloadStore, OFFLOAD_TOOL_NAME, makeReadToolResultTool, withToolResultOffload, } from "../tool-result-store.js";
-import { OUTPUT_TOOL_NAME, REPORT_FINDINGS_TOOL_NAME, SKILL_CONTENT_MAX_CHARS, SKILL_TOOL_NAME, buildSkillsBlock, makeOutputTool, makeReportBlockedTool, makeReportFindingsTool, makeSkillTool, normalizeSkills } from "./synthetic-tools.js";
+import { OUTPUT_TOOL_NAME, REPORT_FINDINGS_TOOL_NAME, SKILL_CONTENT_MAX_CHARS, SKILL_TOOL_NAME, makeOutputTool, makeReportBlockedTool, makeReportFindingsTool, makeSkillTool, normalizeSkills } from "./synthetic-tools.js";
 import { compileOutputSchema } from "./strict-output-schema.js";
 import { TOOL_SEARCH_NAME, buildDeferredRegistry, classifyDeferred, extractDiscoveredToolNames, makePlaceholderTool, makeToolSearchTool, } from "./tool-disclosure.js";
 import { composeMemoryBlock, normalizeMemorySpec } from "../memory.js";
@@ -66,6 +66,8 @@ const ULTRA_REASONING_TIERS = new Set(["xhigh", "max"]);
 const DEFAULT_RESOURCE_TTL_MS = 30 * 24 * 60 * 60 * 1000;
 const DEFAULT_UNATTENDED_APPROVAL_TTL_MS = 30 * 24 * 60 * 60 * 1000;
 const ungatedWarnedShapes = new WeakMap();
+const advisedPolicyNames = new WeakMap();
+const ADVISED_KEYS_CAP = 64;
 export const DEFAULT_IRREVERSIBLE_SCOPE = "irreversible";
 function batchContextAt(messages, currentId) {
     let batch = [];
@@ -380,6 +382,12 @@ export async function prepareTask(spec, deps, sessions, resume, _memorySelector,
     }
     let ownedEnv;
     let mcp;
+    if (internals?.requestedCwd !== undefined && deps.executionEnvFactory === undefined) {
+        await forgetOnThrow();
+        const e = new Error(`Agent cwd "${internals.requestedCwd}" cannot take effect: this deployment has no executionEnvFactory (a static execution environment cannot be re-rooted per agent). Drop the cwd parameter or deploy a factory.`);
+        e.code = "config.cwd_unsupported";
+        throw e;
+    }
     try {
         ownedEnv = deps.executionEnvFactory
             ? await deps.executionEnvFactory({
@@ -395,8 +403,39 @@ export async function prepareTask(spec, deps, sessions, resume, _memorySelector,
         throw factoryErr;
     }
     const executionEnv = ownedEnv ?? deps.executionEnv ?? new StubExecutionEnv();
+    if (internals?.requestedCwd !== undefined) {
+        const canon = async (p) => {
+            const r = await executionEnv.canonicalPath(p);
+            return r.ok ? r.value : p;
+        };
+        const want = await canon(internals.requestedCwd);
+        const rejectCwd = async (message, code) => {
+            await forgetOnThrow();
+            try {
+                if (ownedEnv && hasDestroy(ownedEnv))
+                    await ownedEnv.destroy();
+            }
+            catch {
+            }
+            const e = new Error(message);
+            e.code = code;
+            throw e;
+        };
+        if (deps.rootPath !== undefined) {
+            const root = await canon(deps.rootPath);
+            const sep = root.includes("\\") && !root.includes("/") ? "\\" : "/";
+            const rootPrefix = root.endsWith(sep) ? root : root + sep;
+            if (want !== root && !want.startsWith(rootPrefix)) {
+                await rejectCwd(`Agent cwd "${internals.requestedCwd}" is outside this deployment's declared root "${deps.rootPath}" — the cwd must be located within the deployment root.`, "config.cwd_outside_root");
+            }
+        }
+        const got = await canon(executionEnv.cwd);
+        if (want !== got) {
+            await rejectCwd(`Agent cwd "${internals.requestedCwd}" was not honored by the execution environment (it rooted at "${executionEnv.cwd}") — failing loud instead of running the agent in the wrong tree.`, "config.cwd_not_honored");
+        }
+    }
     const handsEnabled = ownedEnv !== undefined || deps.executionEnv !== undefined;
-    const taskRootPath = internals?.isolation === "worktree" || !deps.rootPath ? executionEnv.cwd : deps.rootPath;
+    const taskRootPath = internals?.isolation === "worktree" || internals?.requestedCwd !== undefined || !deps.rootPath ? executionEnv.cwd : deps.rootPath;
     const abortController = new AbortController();
     if (spec.signal?.aborted)
         abortController.abort();
@@ -1267,7 +1306,19 @@ export async function prepareTask(spec, deps, sessions, resume, _memorySelector,
             }
             tools.push(makeSkillTool(skillSpecs, skillScope));
         }
-        const skillsBlock = buildSkillsBlock(skillSpecs);
+        const skillsListing = skillSpecs.length > 0
+            ? {
+                entries: skillSpecs.map((s) => ({
+                    name: s.name,
+                    description: s.description,
+                    ...(s.files !== undefined ? { files: s.files.map((f) => ({ path: f.path })) } : {}),
+                })),
+                seedAnnounced: resume !== undefined,
+            }
+            :
+                (resume?.seed.announcedListings?.skills?.length ?? 0) > 0
+                    ? { entries: [], seedAnnounced: true }
+                    : undefined;
         const provider = spec.promptProvider ?? deps.promptProvider ?? defaultPromptProvider;
         const promptPolicyEnabled = Boolean(spec.toolPolicy ?? deps.toolPolicy);
         const promptHooks = spec.hooks ?? deps.hooks;
@@ -1386,9 +1437,7 @@ export async function prepareTask(spec, deps, sessions, resume, _memorySelector,
         let promptConstitution = "core";
         let promptBlocks = [];
         const finishStable = (stableCore) => {
-            const stable = composeSystemPrompt(composeSystemPrompt(stableCore, skillsBlock), mcpInstructionsBlock);
-            if (skillsBlock?.trim())
-                promptBlocks.push({ id: "skills.block", text: skillsBlock });
+            const stable = composeSystemPrompt(stableCore, mcpInstructionsBlock);
             if (mcpInstructionsBlock?.trim())
                 promptBlocks.push({ id: "mcp.instructions", text: mcpInstructionsBlock });
             renderWithDate = (date) => composeSystemPrompt(composeSystemPrompt(stable, buildEnvironmentContext({ ...envFacts, date }) || undefined), memoryBlock);
@@ -1532,8 +1581,27 @@ export async function prepareTask(spec, deps, sessions, resume, _memorySelector,
         }
         const agentListingSpec = (spec.tools ?? []).find((t) => t.agentListing !== undefined && t.agentListing.length > 0);
         const agentListing = agentListingSpec
-            ? { entries: agentListingSpec.agentListing, toolName: agentListingSpec.name, seedAnnounced: resume !== undefined }
-            : undefined;
+            ? {
+                entries: agentListingSpec.agentListing,
+                toolName: agentListingSpec.name,
+                seedAnnounced: resume !== undefined,
+                ...(agentListingSpec.agentModels !== undefined ? { models: agentListingSpec.agentModels } : {}),
+            }
+            :
+                (resume?.seed.announcedListings?.agents?.length ?? 0) > 0
+                    ? {
+                        entries: [],
+                        toolName: (spec.tools ?? []).find((t) => t.agentListing !== undefined)?.name ?? "Agent",
+                        seedAnnounced: true,
+                    }
+                    : undefined;
+        if (spec.attachments?.agentListing === false && agentListing !== undefined && agentListing.entries.length > 0) {
+            deps.onError?.(new Error(`attachments.agentListing is explicitly false but the "${agentListing.toolName}" delegation tool mounts a ${agentListing.entries.length}-type roster — the model will never see the agent-type listing its tool description points to.`), { phase: "config", sessionId });
+        }
+        if (spec.attachments?.skillsListing === false && skillsListing !== undefined && skillsListing.entries.length > 0) {
+            deps.onError?.(new Error(`attachments.skillsListing is explicitly false but ${skillsListing.entries.length} skill(s) are mounted — the model will never see the skills listing the ${SKILL_TOOL_NAME} tool description points to.`), { phase: "config", sessionId });
+        }
+        const announcedListingsRef = {};
         const dateChange = renderWithDate
             ? { legDate: envFacts.date, today: () => formatLocalDate(new Date(), tzValid ? userTz : undefined) }
             : undefined;
@@ -1623,6 +1691,41 @@ export async function prepareTask(spec, deps, sessions, resume, _memorySelector,
             }
         }
         const policy = spec.toolPolicy ?? deps.toolPolicy;
+        {
+            const nameGroups = toolPolicyNameSets(policy);
+            if (nameGroups.length > 0) {
+                const known = new Set(tools.flatMap((t) => [canonicalToolName(t.name), ...(t.aliases ?? []).map((a) => canonicalToolName(a))]));
+                for (const t of harnessTools)
+                    known.add(canonicalToolName(t.name));
+                const unmatched = new Set();
+                for (const g of nameGroups) {
+                    for (const [kind, list] of [["deny", g.deny], ["ask", g.ask], ["allow", g.allow]]) {
+                        for (const n of list ?? []) {
+                            if (!known.has(canonicalToolName(n)))
+                                unmatched.add(`"${n}" (${kind})`);
+                        }
+                    }
+                }
+                const dedupeKey = [...unmatched].sort().join("|");
+                const advised = advisedPolicyNames.get(deps) ?? new Set();
+                if (unmatched.size > 0 && !advised.has(dedupeKey)) {
+                    advised.add(dedupeKey);
+                    if (advised.size > ADVISED_KEYS_CAP) {
+                        const oldest = advised.values().next().value;
+                        if (oldest !== undefined)
+                            advised.delete(oldest);
+                    }
+                    advisedPolicyNames.set(deps, advised);
+                    try {
+                        const e = new Error(`toolPolicy name audit: ${[...unmatched].join(", ")} match(es) no tool mounted this run (primary or alias) — the rule cannot fire here. Often a typo or a self-report/wire name skew (e.g. TodoWrite vs the mounted TaskCreate family; "*" has no wildcard meaning in a name-keyed policy). Advisory only: enforcement is unchanged, and a name can be legitimate for another scenario or a per-spawn tool.`);
+                        e.code = "config.toolpolicy.unmatched_names";
+                        deps.onError?.(e, { phase: "config", sessionId });
+                    }
+                    catch {
+                    }
+                }
+            }
+        }
         let sessionRulePolicy;
         if (deps.sessionPolicyStore && spec.sessionId) {
             const rules = await deps.sessionPolicyStore.getRules(spec.sessionId, spec.principal);
@@ -1964,6 +2067,13 @@ export async function prepareTask(spec, deps, sessions, resume, _memorySelector,
                         }
                         : undefined;
                 })(),
+                announcedListings: announcedListingsRef.agents !== undefined || announcedListingsRef.skills !== undefined || announcedListingsRef.models !== undefined
+                    ? {
+                        ...(announcedListingsRef.agents !== undefined ? { agents: [...announcedListingsRef.agents] } : {}),
+                        ...(announcedListingsRef.skills !== undefined ? { skills: [...announcedListingsRef.skills] } : {}),
+                        ...(announcedListingsRef.models !== undefined ? { models: [...announcedListingsRef.models] } : {}),
+                    }
+                    : undefined,
             });
             const commitSuspendSaga = async (token, cp, remoteEnv, remoteHandle) => {
                 if (!checkpointStore)
@@ -2509,7 +2619,7 @@ export async function prepareTask(spec, deps, sessions, resume, _memorySelector,
             .list({ owner: hostTaskId, scope: taskScope, sessionId })
             .filter((t) => t.status === "pending" || t.status === "running")
             .map((t) => ({ id: t.task_id, ...(t.description !== undefined ? { description: t.description } : {}), status: t.status }));
-        return { harness, session, sessionId, taskRootPath, model, thinking, compModel, mcp, blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, nestedStats, cwdRef: handsCwdRef, denyNarrowingPolicy, releaseSignal, cacheBreakDetector, cacheFingerprint, promptManifest, activeTools, ownedEnv, suspendRef, reviewRef, reviewRequestRef, suspendLoopRef, suspendForResource, ...(callCapRef ? { callCapRef } : {}), ...(cutKills ? { cutKills } : {}), ...(callCapRef ? { callIssuedAtRef } : {}), suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolEffects, promptOverheadTokens, readTaskFile, recentlyReadFiles, compactionReuseRef, trimPressureRef, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit } } : {}), planModeRef, ...(dateChange ? { dateChange } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), listBackgroundTasks };
+        return { harness, session, sessionId, taskRootPath, model, thinking, compModel, mcp, blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, nestedStats, cwdRef: handsCwdRef, denyNarrowingPolicy, releaseSignal, cacheBreakDetector, cacheFingerprint, promptManifest, activeTools, ownedEnv, suspendRef, reviewRef, reviewRequestRef, suspendLoopRef, suspendForResource, ...(callCapRef ? { callCapRef } : {}), ...(cutKills ? { cutKills } : {}), ...(callCapRef ? { callIssuedAtRef } : {}), suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolEffects, promptOverheadTokens, readTaskFile, recentlyReadFiles, compactionReuseRef, trimPressureRef, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit } } : {}), planModeRef, ...(dateChange ? { dateChange } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, listBackgroundTasks };
     }
     catch (prepareErr) {
         if (mcp) {