@sema-agent/core 2.12.0 → 3.0.0

package/dist/core/memory-engine/data-plane.js

@@ -2,6 +2,7 @@ import { uuidv7 } from "../../internal/harness.js";
 import { firstSentence } from "../memory.js";
 import { computeEntryRev, parseEntryFile, serializeEntryFile } from "./frontmatter.js";
 import { scanMemoryFileName, scanMemoryWrite } from "./scan.js";
+import { MEMORY_INDEX_FILENAME } from "./file-backend.js";
 import { scopeDirName } from "./layout.js";
 export const REMOTE_HARVEST_PER_FILE_BYTES = 100 * 1024;
 export const REMOTE_MASS_DELETION_FUSE_RATIO = 0.5;
@@ -97,6 +98,9 @@ export function harvestFilesToPatches(baseline, files, opts = {}) {
             out.rejections.push({ path: f.relPath, code: "outside_root", reason: "file path escapes the memory root (containment gate, fail-closed)" });
             continue;
         }
+        const baseName = f.relPath.split("/").pop() ?? f.relPath;
+        if (baseName === MEMORY_INDEX_FILENAME || !baseName.endsWith(".md") || baseName.startsWith("."))
+            continue;
         if (inReadonlyDir(f.relPath)) {
             if (base === undefined) {
                 out.rejections.push({ path: f.relPath, code: "readonly_layer", reason: "a file inside a read-only inherited layer's directory is not writable from this session" });

package/dist/core/memory-engine/engine.d.ts

@@ -56,9 +56,10 @@ export declare class MemoryEngine {
     };
     harvest(handle: MemorySessionHandle): Promise<HarvestReport>;
     private harvestCore;
-    rebaseline(handle: MemorySessionHandle): Promise<void>;
+    rebaseline(handle: MemorySessionHandle, keepBaseline?: ReadonlySet<string>): Promise<void>;
     private rebuildIndex;
     private committedContentFor;
+    private gateDerivedIndex;
     private quarantineFile;
     private readonlyDirNamesUnderRoot;
     private writeIfChanged;

package/dist/core/memory-engine/engine.js

@@ -147,6 +147,18 @@ export class MemoryEngine {
                 handle.baseIds.set(path, entry.id);
             }
         }
+        const indexGate = this.gateDerivedIndex(handle);
+        if (indexGate !== undefined) {
+            try {
+                enqueueMemoryAnnouncement(this.controlDir, {
+                    kind: "gate",
+                    at: this.now(),
+                    items: [`memory index rejected and rebuilt: ${inlineUntrusted(indexGate.reason)}`],
+                });
+            }
+            catch {
+            }
+        }
         const indexText = this.rebuildIndex(handle, headers, { write: writeScope !== null });
         handle.indexBaselineLines = countIndexLines(indexText);
         handle.indexText = indexText;
@@ -364,6 +376,7 @@ export class MemoryEngine {
                 basePathById.set(id, p);
         const patches = [];
         const pendingProjections = [];
+        const idsAddedThisHarvest = new Set();
         let processed = 0;
         for (let i = 0; i < kept.length; i++) {
             const f = kept[i];
@@ -465,7 +478,28 @@ export class MemoryEngine {
                 patches.push({ op: "update", id: parsed.id, entry: { ...entry, id: parsed.id, rev: computeEntryRev({ id: parsed.id, frontmatter: fm, body: parsed.body }) }, ...(revByBasePath.get(renamedFrom) !== undefined ? { baseRev: revByBasePath.get(renamedFrom) } : {}) });
                 continue;
             }
-            pendingProjections.push({ path: f.canonical, entry, needed: minted || needsCompletion(parsed, fm) });
+            let reboundId;
+            if (parsed.id !== undefined && (renamedFrom !== undefined || idsAddedThisHarvest.has(parsed.id))) {
+                reboundId = parsed.id;
+                const idless = serializeEntryFile({ id: "", frontmatter: fm, body: parsed.body }).replace(/^id:[ \t]*$\r?\n/m, "");
+                try {
+                    writeFileSync(f.canonical, idless, "utf8");
+                }
+                catch (err) {
+                    report.rejections.push({
+                        path: rel,
+                        code: "filename",
+                        reason: `memory write blocked: this file carries the entry id of another memory file (a copy is not a rename) and its frontmatter could not be rewritten (${err instanceof Error ? err.message : String(err)}) — remove the "id:" line so it can be committed as a new entry`,
+                    });
+                    continue;
+                }
+                id = uuidv7();
+                entry.id = id;
+                entry.rev = computeEntryRev(entry);
+                report.warnings.push(`${rel}: frontmatter id ${reboundId} already has a projection (${renamedFrom !== undefined ? relative(handle.memoryDir, renamedFrom) : "another new file in this harvest"}) — a copy is not a rename, so this file was committed as a NEW entry with a fresh id; the existing entry was left untouched`);
+            }
+            pendingProjections.push({ path: f.canonical, entry, needed: minted || reboundId !== undefined || needsCompletion(parsed, fm) });
+            idsAddedThisHarvest.add(entry.id);
             patches.push({ op: "add", id: entry.id, entry });
         }
         let patchReport;
@@ -503,12 +537,15 @@ export class MemoryEngine {
         const drained = this.backend.drainInboundFindings?.();
         if (drained !== undefined && drained.length > 0)
             report.inboundFindings = drained;
+        const indexRejection = this.gateDerivedIndex(handle);
+        if (indexRejection !== undefined)
+            report.rejections.push(indexRejection);
         const headers = await this.backend.listHeaders([...new Set([...handle.scopes, writeScope])]);
         handle.indexText = this.rebuildIndex(handle, headers, { write: true }, report.warnings);
-        await this.rebaseline(handle);
+        await this.rebaseline(handle, new Set(report.degraded?.pending ?? []));
         return report;
     }
-    async rebaseline(handle) {
+    async rebaseline(handle, keepBaseline = new Set()) {
         const writeScope = handle.writeScope;
         if (writeScope === null)
             return;
@@ -535,12 +572,17 @@ export class MemoryEngine {
             if (id === undefined)
                 continue;
             const stub = stubs.get(path);
-            const rev = revOfText(text, id);
+            const relPath = relative(handle.memoryDir, path);
+            const deferred = keepBaseline.has(relPath);
+            const priorRev = deferred ? handle.baseRevs.get(path) : undefined;
+            const priorId = deferred ? handle.baseIds.get(path) : undefined;
+            const rev = priorRev ?? revOfText(text, priorId ?? id);
+            const baselineId = priorId ?? id;
             next.push({
                 path,
-                relPath: relative(handle.memoryDir, path),
+                relPath,
                 scope: writeScope,
-                id,
+                id: baselineId,
                 slug: f.slug,
                 rev,
                 stub: stub !== undefined && stub.rev === rev,
@@ -548,7 +590,7 @@ export class MemoryEngine {
             });
             fileToScope.set(path, writeScope);
             baseRevs.set(path, rev);
-            baseIds.set(path, id);
+            baseIds.set(path, baselineId);
         }
         handle.materialized = next;
         handle.fileToScope = fileToScope;
@@ -650,6 +692,39 @@ export class MemoryEngine {
             return viaBackend;
         return readSafe(join(this.controlDir, "shadow", `${id}.md`));
     }
+    gateDerivedIndex(handle) {
+        if (handle.writeScope === null)
+            return undefined;
+        const indexPath = join(handle.writableRoot, MEMORY_INDEX_FILENAME);
+        const text = readSafe(indexPath);
+        if (text === undefined || text === "")
+            return undefined;
+        const finding = scanMemoryWrite(text).find((f) => f.code === "secret");
+        if (finding === undefined)
+            return undefined;
+        let detail = "";
+        try {
+            const dest = join(this.controlDir, "quarantine", `${this.now()}-${MEMORY_INDEX_FILENAME}`);
+            mkdirSync(dirname(dest), { recursive: true });
+            writeFileSync(dest, text, "utf8");
+        }
+        catch (err) {
+            detail = `; quarantine capture failed: ${err instanceof Error ? err.message : String(err)}`;
+        }
+        let cleared = false;
+        try {
+            writeFileSync(indexPath, "", "utf8");
+            cleared = true;
+        }
+        catch (err) {
+            detail = `${detail}; the derived index could NOT be cleared: ${err instanceof Error ? err.message : String(err)}`;
+        }
+        return {
+            path: MEMORY_INDEX_FILENAME,
+            code: finding.code,
+            reason: `memory index blocked: ${finding.reason} (${cleared ? "index cleared and rebuilt from entry frontmatter; the offending prose was captured to quarantine" : "index still carries the offending content"})${detail}`,
+        };
+    }
     quarantineFile(path, content) {
         const dest = join(this.controlDir, "quarantine", `${this.now()}-${basename(path)}`);
         let captured;

package/dist/core/memory-engine/file-backend.d.ts

@@ -30,6 +30,7 @@ export declare class FileMemoryEngineBackend implements MemoryBackend {
     private loadLedger;
     private saveLedger;
     private recoverJournal;
+    private txnInFlight;
     private sweepStagedFiles;
     private excludedSubdirNames;
     private scopeDir;

package/dist/core/memory-engine/file-backend.js

@@ -79,10 +79,10 @@ export class FileMemoryEngineBackend {
         this.controlPlaneRoot = opts.controlDir ?? deriveControlPlaneDir(resolveMemoryEngineRoot(), dir);
         ensureDirExists(dir);
         ensureDirExists(this.controlPlaneRoot);
-        this.recoverJournal();
+        this.recoverJournal({ unlocked: true });
     }
     checkControlPlane() {
-        this.recoverJournal();
+        this.recoverJournal({ unlocked: true });
         this.ledger = undefined;
         this.loadLedger();
         registeredScopes(this.controlPlaneRoot);
@@ -164,8 +164,10 @@ export class FileMemoryEngineBackend {
             return;
         atomicWriteFileSync(join(this.controlPlaneRoot, LEDGER_FILE), `${JSON.stringify(this.ledger, null, 2)}\n`);
     }
-    recoverJournal() {
+    recoverJournal(opts = {}) {
         const jp = join(this.controlPlaneRoot, JOURNAL_FILE);
+        if (opts.unlocked && this.txnInFlight())
+            return;
         const raw = readSafe(jp);
         if (raw !== undefined) {
             let journal;
@@ -205,6 +207,14 @@ export class FileMemoryEngineBackend {
         }
         this.sweepStagedFiles();
     }
+    txnInFlight() {
+        try {
+            return this.now() - statSync(this.txnLockDir()).mtimeMs < TXN_LOCK_STALE_MS;
+        }
+        catch {
+            return false;
+        }
+    }
     sweepStagedFiles() {
         const walk = (d, depth) => {
             let names;

package/dist/core/memory-engine/layout.js

@@ -216,11 +216,22 @@ function acquireSidecarLock(lockDir, opts = {}) {
         try {
             mkdirSync(lockDir);
             const token = `${process.pid}-${Math.random().toString(36).slice(2, 10)}`;
+            let fd;
             try {
-                writeSync(openSync(join(lockDir, "owner"), "w"), token);
+                fd = openSync(join(lockDir, "owner"), "w");
+                writeSync(fd, token);
             }
             catch {
             }
+            finally {
+                if (fd !== undefined) {
+                    try {
+                        closeSync(fd);
+                    }
+                    catch {
+                    }
+                }
+            }
             return token;
         }
         catch {

package/dist/core/memory.js

@@ -32,6 +32,9 @@ const SECRET_PATTERNS = [
     { label: "slack_token", re: /\bxox[baprs]-(?:[A-Za-z0-9]+-){1,3}[A-Za-z0-9]{16,}\b/ },
     { label: "google_api_key", re: /\bAIza[0-9A-Za-z_-]{35}\b/ },
     { label: "private_key", re: /-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?-----/ },
+    { label: "jwt", re: /\beyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]{16,}\b/ },
+    { label: "azure_storage_account_key", re: /AccountKey=[A-Za-z0-9+/]{40,}={0,2}/ },
+    { label: "bearer_token", re: /\bAuthorization:\s*Bearer\s+(?=[A-Za-z0-9._~+/-]*[0-9])[A-Za-z0-9._~+/-]{20,}=*/ },
 ];
 export function detectSecret(text) {
     if (!text)

package/dist/core/permission-rules.d.ts

@@ -11,7 +11,7 @@ export interface ParsedPermissionRule {
 }
 export interface PermissionRuleIssue {
     rule: string;
-    code: "invalid.empty_tool" | "invalid.paren" | "invalid.param_split" | "invalid.allow_param_rule" | "invalid.primary_field" | "invalid.cap_exceeded" | "unsupported.bash_prefix" | "unsupported.file_glob" | "unsupported.mcp_paren";
+    code: "invalid.empty_tool" | "invalid.paren" | "invalid.param_split" | "invalid.allow_param_rule" | "invalid.primary_field" | "invalid.cap_exceeded" | "unsupported.bash_prefix" | "unsupported.file_glob" | "unsupported.mcp_paren" | "unsupported.unknown_param";
     message: string;
 }
 export interface PermissionRuleCaps {
@@ -30,5 +30,6 @@ export interface PermissionRulePolicyOptions {
 }
 export declare function parsePermissionRule(rule: string): ParsedPermissionRule;
 export declare function wildcardMatch(pattern: string, value: string): boolean;
+export declare const fileToolParamVocabulary: (canonicalTool: string) => ReadonlySet<string> | undefined;
 export declare function validatePermissionRules(rules: PermissionRule[], opts?: Pick<PermissionRulePolicyOptions, "primaryFieldGeneric" | "caps">): PermissionRuleIssue[];
 export declare function createPermissionRulePolicy(rules: PermissionRule[], opts?: PermissionRulePolicyOptions): ToolPolicy;

package/dist/core/permission-rules.js

@@ -90,6 +90,18 @@ const PRIMARY_FIELDS = {
     WebSearch: new Set(["query"]),
 };
 const FILE_TOOLS = new Set(["Read", "Edit", "Write", "MultiEdit", "NotebookEdit", "Grep", "Glob"]);
+const FILE_TOOL_PARAMS = {
+    Read: new Set(["file_path", "path", "offset", "limit", "pages"]),
+    Edit: new Set(["file_path", "path", "old_string", "new_string", "replace_all"]),
+    Write: new Set(["file_path", "path", "content"]),
+    NotebookEdit: new Set(["notebook_path", "path", "cell_id", "cell_type", "edit_mode", "new_source"]),
+    Grep: new Set([
+        "pattern", "path", "glob", "type", "output_mode", "head_limit", "max_results", "offset",
+        "multiline", "context", "ignore_case", "-i", "-n", "-o", "-A", "-B", "-C",
+    ]),
+    Glob: new Set(["pattern", "path", "max_results"]),
+};
+export const fileToolParamVocabulary = (canonicalTool) => FILE_TOOL_PARAMS[canonicalTool];
 function countStars(s) {
     let n = 0;
     for (const c of s)
@@ -151,9 +163,18 @@ function compile(rules, caps, primaryFieldGeneric) {
                 continue;
             }
         }
-        else if (FILE_TOOLS.has(toolName) && colon <= 0) {
-            bad(text, "unsupported.file_glob", "file-tool glob rules (`Edit(src/**)`) are the tool-specific lane — not supported by the generic param DSL");
-            continue;
+        else if (FILE_TOOLS.has(toolName)) {
+            if (colon <= 0) {
+                bad(text, "unsupported.file_glob", "file-tool glob rules (`Edit(src/**)`) are the tool-specific lane — not supported by the generic param DSL");
+                continue;
+            }
+            const paramPart = content.slice(0, colon).trim();
+            const vocabulary = FILE_TOOL_PARAMS[toolName];
+            if (vocabulary !== undefined && !vocabulary.has(paramPart)) {
+                bad(text, "unsupported.unknown_param", `"${paramPart}" is not a parameter of ${toolName} (it carries ${[...vocabulary].sort().join(", ")}) — the rule would compile and never match. ` +
+                    `For a path glob use the tool-specific lane (\`${toolName}(src/**)\` is not the generic param DSL); a Windows path such as \`${toolName}(C:/foo)\` parses as the param "C".`);
+                continue;
+            }
         }
         if (colon <= 0) {
             bad(text, "invalid.param_split", "param-level ruleContent must be `param:pattern`");

package/dist/core/runner/active-skill-scope.js

@@ -1,5 +1,6 @@
 import { canonicalizeTarget, fileArgPath } from "../../tools/fs/safety.js";
 import { canonicalToolName } from "../tool-name-aliases.js";
+import { parseSkillToolEntry, skillSpecifierRejection } from "../skill-tool-specifier.js";
 export class ActiveSkillScope {
     frames = [];
     push(frame) {
@@ -47,12 +48,19 @@ export function createActiveSkillScopePolicy(opts) {
                 };
             }
             const manifests = frames.flatMap((f) => (f.kind === "manifest" ? [f.manifest] : []));
-            let allowed;
-            for (const m of manifests) {
-                const here = new Set(m.allowTools.map(canonicalToolName));
-                allowed = allowed === undefined ? here : new Set([...allowed].filter((t) => here.has(t)));
-            }
-            if (!allowed || !allowed.has(toolName)) {
+            const perFrame = manifests.map((m) => {
+                const byName = new Map();
+                for (const raw of m.allowTools) {
+                    const entry = parseSkillToolEntry(raw);
+                    const bucket = byName.get(entry.name);
+                    if (bucket)
+                        bucket.push(entry);
+                    else
+                        byName.set(entry.name, [entry]);
+                }
+                return { manifest: m, byName };
+            });
+            if (perFrame.length === 0 || perFrame.some((f) => !f.byName.has(toolName))) {
                 const ids = manifests.map((m) => m.lineageId).join(", ");
                 return {
                     action: "deny",
@@ -60,6 +68,26 @@ export function createActiveSkillScopePolicy(opts) {
                     decisionReason: "safety",
                 };
             }
+            for (const frame of perFrame) {
+                const alternatives = frame.byName.get(toolName) ?? [];
+                const rejections = [];
+                let admitted = false;
+                for (const entry of alternatives) {
+                    const rejection = skillSpecifierRejection(entry, req.args);
+                    if (rejection === undefined) {
+                        admitted = true;
+                        break;
+                    }
+                    rejections.push(rejection);
+                }
+                if (!admitted) {
+                    return {
+                        action: "deny",
+                        reason: `tool "${req.toolName}" is narrowed by skill manifest "${frame.manifest.lineageId}": ${rejections.join("; ")}`,
+                        decisionReason: "safety",
+                    };
+                }
+            }
             const pathConstrainingActive = manifests.some((m) => m.allowPaths && m.allowPaths.length > 0);
             if (pathConstrainingActive && !PATH_WRITE_TOOLS.has(toolName)) {
                 const eff = toolEffects?.get(toolName) ?? "write";

package/dist/core/runner/assemble-result.d.ts

@@ -10,7 +10,7 @@ export interface Stats {
     cacheWriteTokensLong: number;
     outputTokens: number;
     cacheHitRate?: number;
-    totalInputTokens?: number;
+    totalInputTokens: number;
     costMicroUsd: number;
     nested?: {
         tokens: number;

package/dist/core/runner/assemble-result.js

@@ -35,7 +35,6 @@ function assistantText(msg) {
 export function assembleResult(spec, sessionId, final, stats, flags) {
     const taskId = spec.taskId ?? sessionId;
     const text = final ? assistantText(final) : "";
-    stats.totalInputTokens = stats.promptTokens;
     if (!flags.unpricedSpend) {
         const compactionMicroUsd = stats.compactionMicroUsd ?? 0;
         const nestedSubagentMicroUsd = stats.nested?.costMicroUsd ?? 0;

package/dist/core/runner/prepare-task.js

@@ -432,6 +432,10 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         }
     }
     const taskScope = internals?.registryScope ?? spec.principal ?? "default";
+    const offloadScope = spec.principal ?? "default";
+    if (internals?.registryScope !== undefined && internals.registryScope !== offloadScope) {
+        deps.onError?.(new Error(`offload/tool-result namespace note: this run mounts in registry domain "${internals.registryScope}" but its offloaded tool results live under the TRUST identity "${offloadScope}" (principal${spec.principal === undefined ? " absent → default" : ""}). Before 2.13.0 the registry domain named this namespace too; if a deployment used registryScope as its ref-tenancy boundary, that boundary is now the principal — pass one, or read refs under "${offloadScope}".`), { phase: "config", sessionId });
+    }
     defaultTaskRegistry.maybeGc();
     const forgetOnThrow = () => forgetQuietly(sessions, sessionId);
     const extraBodyCollisions = reservedCollisions(model.extraBody, reservedFor(model.api));
@@ -456,7 +460,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
     const offloadEnabled = Number.isFinite(offloadThreshold) && offloadThreshold > 0;
     const rawOffloadStore = offloadEnabled ? (deps.toolResultStore ?? new InMemoryToolResultStore()) : undefined;
     const offloadStore = rawOffloadStore instanceof RunnerSharedToolResultStore
-        ? new ScopedToolResultStore(rawOffloadStore, taskScope)
+        ? new ScopedToolResultStore(rawOffloadStore, offloadScope)
         : rawOffloadStore;
     const offloadReachableToolsRef = {};
     const maybeOffload = (tool, perTool) => {
@@ -1384,6 +1388,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         owner: hostTaskId,
                         scope: taskScope,
                         ...(sessionId !== undefined ? { sessionId } : {}),
+                        enrichCtx: enrichSpecToolCtx,
                     })));
                 }
             }
@@ -1915,6 +1920,12 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 throw e;
             }
             const registry = buildDeferredRegistry(deferred, tools);
+            let activationChain = Promise.resolve();
+            const serializeActivation = (section) => {
+                const p = activationChain.then(section);
+                activationChain = p.then(() => undefined, () => undefined);
+                return p;
+            };
             const directCallFor = (name) => {
                 if (spec.deferSelfResolve === false)
                     return undefined;
@@ -1930,7 +1941,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         };
                     },
                     ...(executionMode !== undefined ? { executionMode } : {}),
-                    activate: async () => {
+                    activate: async () => serializeActivation(async () => {
                         if (activeTools.has(name))
                             return undefined;
                         activeTools.add(name);
@@ -1942,7 +1953,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             throw e;
                         }
                         return listingRideRef.current?.([name]);
-                    },
+                    }),
                 };
             };
             const placeholders = new Map([...registry.values()].map((i) => [i.name, createPlaceholderTool(i, directCallFor(i.name))]));
@@ -2016,6 +2027,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 listingRide: (newly) => listingRideRef.current?.(newly),
                 mountedNames: callableToolNames,
                 directCallEnabled: spec.deferSelfResolve !== false,
+                serializeActivation,
             });
             harnessTools = buildToolList(activeTools);
         }
@@ -2734,6 +2746,13 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     }
                 }
                 : undefined;
+            const notifyHookError = (err) => {
+                try {
+                    deps.onError?.(err instanceof Error ? err : new Error(String(err)), { phase: "hook", sessionId });
+                }
+                catch {
+                }
+            };
             const checkpointStore = spec.checkpointStore ?? deps.checkpointStore;
             const durableApproval = spec.durableApproval ??
                 (runtimeCaps?.forceDurableGate ? { scope: spec.principal || DEFAULT_IRREVERSIBLE_SCOPE } : undefined);
@@ -3174,6 +3193,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             reversibilityProbe: reversibilityProbes.get(e.toolName),
                             abortSignal: abortController.signal,
                             ...(notifyPermissionDenied ? { permissionDenied: notifyPermissionDenied } : {}),
+                            onHookError: notifyHookError,
                             shellGated: (e.toolName === "Bash" && shellGatedBash) || (e.toolName === "Monitor" && shellGatedMonitor),
                             ...(autoModeDecider ? { autoMode: { decider: autoModeDecider } } : {}),
                             isMarkedUnresolvable: (toolCallId) => inheritedUnavailableAsks.has(toolCallId),