@sema-agent/core 2.12.0 → 3.0.0

package/dist/core/runner/runtask.js

@@ -222,6 +222,7 @@ function resumeContinuation(resume) {
 }
 function makeTurnBoundary(prepared, stats, rs, deps) {
     const { spec, queue, manualCompactRef, todoToolMounted, taskToolsMounted, turnToolSpan, walltimeDeadlineMs, walltimeMonotonicDeadline, nudgeSchedule, buildFinalizeText, timeout, ident, postToolBatchHook, batchArgs, compactionBrain, withinTaskCompaction, compactionBreaker, windowSafetyOptions, rapidRefill, drainManualCompact, runnerHooks } = deps;
+    let finalVerifySeenAtLastBoundary = 0;
     const onTurnBoundary = async (event) => {
         if (prepared.callCapRef && turnToolSpan.startMin !== undefined && turnToolSpan.endMax !== undefined) {
             recordToolCycleSample(prepared.callCapRef.state, turnToolSpan.endMax - turnToolSpan.startMin);
@@ -340,8 +341,7 @@ function makeTurnBoundary(prepared, stats, rs, deps) {
                     const scan = await Promise.race([
                         prepared.detectExternalChanges(maxFiles),
                         new Promise((resolve) => {
-                            const t = setTimeout(() => resolve({ changed: [], evicted: [] }), SCAN_CEILING_MS);
-                            t.unref?.();
+                            setTimeout(() => resolve({ changed: [], evicted: [] }), SCAN_CEILING_MS);
                         }),
                     ]);
                     for (const p of scan.evicted)
@@ -474,8 +474,7 @@ function makeTurnBoundary(prepared, stats, rs, deps) {
                     probed = await Promise.race([
                         rs.attach.instrProbe(prepared.instructionSources),
                         new Promise((resolve) => {
-                            const t = setTimeout(() => resolve(null), PROBE_CEILING_MS);
-                            t.unref?.();
+                            setTimeout(() => resolve(null), PROBE_CEILING_MS);
                         }),
                     ]);
                 }
@@ -499,11 +498,13 @@ function makeTurnBoundary(prepared, stats, rs, deps) {
             }
         }
         let batchContextBlock;
+        const finalVerifyInjectedThisTurn = rs.counters.finalVerifyInjections !== finalVerifySeenAtLastBoundary;
+        finalVerifySeenAtLastBoundary = rs.counters.finalVerifyInjections;
         if (postToolBatchHook !== undefined && rs.turn.toolBatch.length > 0) {
             const batch = rs.turn.toolBatch;
             rs.turn.toolBatch = [];
             batchArgs?.clear();
-            if (!boundarySteered && !rs.counters.finalizeInjected && rs.counters.finalVerifyInjections === 0 && !prepared.abortController.signal.aborted) {
+            if (!boundarySteered && !rs.counters.finalizeInjected && !finalVerifyInjectedThisTurn && !prepared.abortController.signal.aborted) {
                 try {
                     const r = await postToolBatchHook(batch);
                     if (r?.additionalContext) {
@@ -808,16 +809,18 @@ function makeHarnessHandlers(prepared, stats, rs, deps) {
                 rs.turn.turnUsageMissing = true;
             const u = m.usage;
             stats.tokens += u.totalTokens || 0;
-            const { totalInputTokens: turnInput, costMicroUsd: turnCostMicroUsd } = usageCostMicroUsd(rs.telemetry.cacheFamily, u, rs.telemetry.pricing);
+            const { totalInputTokens: turnTotal, uncachedInputTokens: turnUncached, costMicroUsd: turnCostMicroUsd, } = usageCostMicroUsd(rs.telemetry.cacheFamily, u, rs.telemetry.pricing);
             if (!rs.telemetry.pricingConfigured)
                 rs.telemetry.unpricedSpend = true;
-            stats.promptTokens += turnInput;
+            stats.promptTokens += turnUncached;
+            stats.totalInputTokens += turnTotal;
             stats.cachedTokens += u.cacheRead || 0;
             stats.cacheWriteTokens += u.cacheWrite || 0;
             stats.outputTokens += u.output || 0;
             stats.costMicroUsd += turnCostMicroUsd;
-            rs.turn.turnUsage ??= { inputTokens: 0, outputTokens: 0, cacheReadTokens: 0, cacheWriteTokens: 0, costMicroUsd: 0 };
-            rs.turn.turnUsage.inputTokens += turnInput;
+            rs.turn.turnUsage ??= { inputTokens: 0, totalInputTokens: 0, outputTokens: 0, cacheReadTokens: 0, cacheWriteTokens: 0, costMicroUsd: 0 };
+            rs.turn.turnUsage.inputTokens += turnUncached;
+            rs.turn.turnUsage.totalInputTokens += turnTotal;
             rs.turn.turnUsage.outputTokens += u.output || 0;
             rs.turn.turnUsage.cacheReadTokens += u.cacheRead || 0;
             rs.turn.turnUsage.cacheWriteTokens += u.cacheWrite || 0;
@@ -843,7 +846,8 @@ function makeHarnessHandlers(prepared, stats, rs, deps) {
                 model: m.model,
                 provider: m.provider,
                 turn: stats.turns + 1,
-                promptTokens: turnInput,
+                promptTokens: turnUncached,
+                totalInputTokens: turnTotal,
                 completionTokens: u.output || 0,
                 cacheRead: u.cacheRead || 0,
                 cacheWrite: u.cacheWrite || 0,
@@ -1259,7 +1263,6 @@ export class Runner {
             let t;
             const timeout = new Promise((res2) => {
                 t = setTimeout(() => res2(undefined), READY_TIMEOUT_MS);
-                t.unref?.();
             });
             return Promise.race([p, timeout]).finally(() => clearTimeout(t));
         };
@@ -1647,7 +1650,7 @@ export class Runner {
             }
         }
         onReady({ harness: prepared.harness, abortController: prepared.abortController });
-        const stats = { turns: 0, tokens: 0, toolCalls: 0, promptTokens: 0, cachedTokens: 0, cacheWriteTokens: 0, cacheWriteTokensLong: 0, outputTokens: 0, costMicroUsd: 0 };
+        const stats = { turns: 0, tokens: 0, toolCalls: 0, promptTokens: 0, totalInputTokens: 0, cachedTokens: 0, cacheWriteTokens: 0, cacheWriteTokensLong: 0, outputTokens: 0, costMicroUsd: 0 };
         prepared.liveSpendRef.get = () => ({ costMicroUsd: stats.costMicroUsd, tokens: stats.tokens, turns: stats.turns, walltimeMs: Math.round(performance.now() - rs.telemetry.taskStartMonotonic) });
         if (resume &&
             resume.cp.suspendedAt !== undefined &&
@@ -1662,6 +1665,9 @@ export class Runner {
             const gateToolName = "toolName" in resume.cp.gate ? resume.cp.gate.toolName : undefined;
             prepared.humanReviewRef.gates.push({ kind: resume.cp.gate.kind, waitMs, ...(decision !== undefined ? { decision } : {}), ...(gateToolName !== undefined ? { toolName: gateToolName } : {}) });
         }
+        if (resume !== undefined && resume.outcome.gate === "plan_review" && resume.outcome.decision === "reject") {
+            prepared.planModeRef.active = true;
+        }
         const rs = createRunState();
         rs.telemetry.cacheFamily = cacheFamilyOf(prepared.model);
         rs.telemetry.pricing = this.deps.pricing?.[prepared.model.id] ?? modelCostToPricing(prepared.model.cost);
@@ -2126,9 +2132,10 @@ export class Runner {
             const priced = this.deps.pricing?.[m.id] !== undefined || m.cost !== undefined;
             if (!priced)
                 rs.telemetry.unpricedSpend = true;
-            const { totalInputTokens, costMicroUsd } = usageCostMicroUsd(fam, u, price);
+            const { totalInputTokens, uncachedInputTokens, costMicroUsd } = usageCostMicroUsd(fam, u, price);
             stats.tokens += u.totalTokens || 0;
-            stats.promptTokens += totalInputTokens;
+            stats.promptTokens += uncachedInputTokens;
+            stats.totalInputTokens += totalInputTokens;
             stats.cachedTokens += u.cacheRead || 0;
             stats.cacheWriteTokens += u.cacheWrite || 0;
             stats.outputTokens += u.output || 0;
@@ -2136,7 +2143,7 @@ export class Runner {
             stats.compactionMicroUsd = (stats.compactionMicroUsd ?? 0) + costMicroUsd;
             emitTrace(rs.telemetry.tracer, () => ({
                 kind: "brain.call", version: 1, taskId: rs.telemetry.taskId, model: m.id, provider: m.provider,
-                promptTokens: totalInputTokens, completionTokens: u.output || 0,
+                promptTokens: uncachedInputTokens, totalInputTokens, completionTokens: u.output || 0,
                 cacheRead: u.cacheRead || 0, cacheWrite: u.cacheWrite || 0,
                 latencyMs: 0, ...(priced ? { costMicroUsd } : {}), ...(typeof msg?.stopReason === "string" ? { stopReason: msg.stopReason } : {}), ts: Date.now(),
             }));
@@ -2531,13 +2538,26 @@ export class Runner {
                 let promptBlocked = false;
                 const userPromptSubmit = (spec.hooks ?? this.deps.hooks)?.userPromptSubmit;
                 if (userPromptSubmit) {
-                    const decision = await userPromptSubmit(spec.objective);
-                    if (decision?.block) {
-                        prepared.blockedRef.reason = formatHookFeedback(decision.block);
-                        promptBlocked = true;
+                    try {
+                        const decision = await userPromptSubmit(spec.objective);
+                        if (decision?.block) {
+                            prepared.blockedRef.reason = formatHookFeedback(decision.block);
+                            promptBlocked = true;
+                        }
+                        else if (decision?.additionalContext) {
+                            effectiveObjective = `${formatHookFeedback(decision.additionalContext)}\n\n${spec.objective}`;
+                        }
                     }
-                    else if (decision?.additionalContext) {
-                        effectiveObjective = `${formatHookFeedback(decision.additionalContext)}\n\n${spec.objective}`;
+                    catch (hookErr) {
+                        const err = hookErr instanceof Error ? hookErr : new Error(String(hookErr));
+                        try {
+                            this.deps.onError?.(err, { phase: "hook", sessionId: prepared.sessionId });
+                        }
+                        catch {
+                        }
+                        prepared.blockedRef.reason = formatHookFeedback(`the deployment's userPromptSubmit hook crashed while screening this prompt (${err.message}); ` +
+                            `the prompt was NOT submitted (fail-closed)`);
+                        promptBlocked = true;
                     }
                 }
                 const firstFrames = [];
@@ -2722,17 +2742,17 @@ export class Runner {
                     costMicroUsd: prepared.nestedStats.costMicroUsd || undefined,
                 };
             }
-            if (stats.promptTokens > 0) {
-                const rawHit = stats.cachedTokens / stats.promptTokens;
-                if (stats.cachedTokens > stats.promptTokens) {
-                    this.deps.onError?.(new Error(`prompt-cache: usage/api mismatch — cachedTokens (${stats.cachedTokens}) > promptTokens (${stats.promptTokens}); the cache family is likely wrong. Does model.api match the brain serving it? Override with model.params.promptCacheFamily = "input-includes-cached" | "input-excludes-cached".`), { phase: "prompt-cache", sessionId: prepared.sessionId });
+            if (stats.totalInputTokens > 0) {
+                const rawHit = stats.cachedTokens / stats.totalInputTokens;
+                if (stats.cachedTokens > stats.totalInputTokens) {
+                    this.deps.onError?.(new Error(`prompt-cache: usage/api mismatch — cachedTokens (${stats.cachedTokens}) > totalInputTokens (${stats.totalInputTokens}); the cache family is likely wrong. Does model.api match the brain serving it? Override with model.params.promptCacheFamily = "input-includes-cached" | "input-excludes-cached".`), { phase: "prompt-cache", sessionId: prepared.sessionId });
                 }
                 stats.cacheHitRate = Math.min(1, rawHit);
-                if (!rs.telemetry.cacheBreakReported && stats.turns >= 2 && stats.promptTokens >= 8000 && stats.cacheHitRate < 0.15) {
+                if (!rs.telemetry.cacheBreakReported && stats.turns >= 2 && stats.totalInputTokens >= 8000 && stats.cacheHitRate < 0.15) {
                     const cause = rs.degrade.degraded
                         ? `a mid-task model switch (${rs.degrade.degraded.from} → ${rs.degrade.degraded.to}, degradation) reset the prefix cache — this is the likely cause`
                         : `the cacheable prefix looks unstable. Keep volatile content (memory/timestamps/ids) out of the prompt prefix and tool order stable, or it's a server-side/TTL miss`;
-                    this.deps.onError?.(new Error(`prompt-cache: low prefix-cache hit rate ${(stats.cacheHitRate * 100).toFixed(0)}% over ${stats.turns} turns (${stats.promptTokens} prompt tokens) — ${cause}. See design/09.`), { phase: "prompt-cache", sessionId: prepared.sessionId });
+                    this.deps.onError?.(new Error(`prompt-cache: low prefix-cache hit rate ${(stats.cacheHitRate * 100).toFixed(0)}% over ${stats.turns} turns (${stats.totalInputTokens} prompt tokens) — ${cause}. See design/09.`), { phase: "prompt-cache", sessionId: prepared.sessionId });
                 }
             }
             if (prepared.resourceLedger &&
@@ -3016,7 +3036,6 @@ export class Runner {
                 ac.abort();
                 resolve([]);
             }, SUGGESTIONS_TIMEOUT_MS);
-            timer.unref?.();
         });
         const work = (async () => {
             let model = prepared.model;
@@ -3088,7 +3107,6 @@ export class Runner {
                     ac.abort();
                     resolve({ ok: false, error: { code: "aborted", message: "snapshot timed out" } });
                 }, SNAPSHOT_TIMEOUT_MS);
-                timer.unref?.();
             });
             const work = store.snapshot(prepared.sessionId, leafId, env, root, ac.signal);
             work.catch(() => { });
@@ -3102,7 +3120,7 @@ export class Runner {
             if (!r.ok) {
                 const tooLarge = r.error.code === "too_large";
                 const refusedAt = Date.now();
-                if (tooLarge)
+                if (tooLarge && !this.snapshotTooLargeRoots.has(root))
                     this.snapshotTooLargeRoots.set(root, { refusedAt, skipAnnounced: false });
                 try {
                     this.deps.onError?.(new Error(`rewind-files snapshot failed (${r.error.code}): ${r.error.message}` +

package/dist/core/runner/tool-disclosure.d.ts

@@ -57,4 +57,5 @@ export declare function createToolSearchTool(opts: {
     listingRide?: (newlyActivated: readonly string[]) => string | undefined;
     mountedNames?: () => ReadonlySet<string>;
     directCallEnabled?: boolean;
+    serializeActivation?: <T>(section: () => Promise<T>) => Promise<T>;
 }): AgentTool;

package/dist/core/runner/tool-disclosure.js

@@ -172,11 +172,22 @@ export function resolveToolSearch(args, registry) {
 export function extractDiscoveredToolNames(messages, registry) {
     const names = new Set();
     const pendingDirect = new Map();
+    const pendingSearch = new Map();
     for (const m of messages) {
         if (m.role === "toolResult") {
             const name = pendingDirect.get(m.toolCallId);
-            if (name !== undefined && m.isError !== true)
-                names.add(name);
+            if (name !== undefined) {
+                pendingDirect.delete(m.toolCallId);
+                if (m.isError !== true)
+                    names.add(name);
+            }
+            const searched = pendingSearch.get(m.toolCallId);
+            if (searched !== undefined) {
+                pendingSearch.delete(m.toolCallId);
+                if (m.isError !== true)
+                    for (const n of searched)
+                        names.add(n);
+            }
             continue;
         }
         if (m.role !== "assistant")
@@ -185,15 +196,18 @@ export function extractDiscoveredToolNames(messages, registry) {
             if (part.type !== "toolCall")
                 continue;
             if (part.name === TOOL_SEARCH_NAME) {
-                for (const n of resolveToolSearch(part.arguments, registry)) {
-                    names.add(n);
-                }
+                const prior = pendingSearch.get(part.id);
+                const resolved = resolveToolSearch(part.arguments, registry);
+                pendingSearch.set(part.id, prior === undefined ? resolved : [...prior, ...resolved]);
             }
             else if (registry.has(part.name)) {
                 pendingDirect.set(part.id, part.name);
             }
         }
     }
+    for (const list of pendingSearch.values())
+        for (const n of list)
+            names.add(n);
     return [...names];
 }
 export function createToolSearchTool(opts) {
@@ -209,6 +223,12 @@ export function createToolSearchTool(opts) {
             "first. When any instruction, reminder, or another tool's description names a deferred tool, activate it " +
             'with query "select:<name>" before calling it. ';
     let activationChain = Promise.resolve();
+    const serializeActivation = opts.serializeActivation ??
+        ((section) => {
+            const p = activationChain.then(section);
+            activationChain = p.then(() => undefined, () => undefined);
+            return p;
+        });
     return defineTool({
         name: TOOL_SEARCH_NAME,
         contract: { contractId: "core.tool_search@1", implementationRevision: "1" },
@@ -259,7 +279,7 @@ export function createToolSearchTool(opts) {
                     },
                 };
             }
-            const section = activationChain.then(async () => {
+            const section = serializeActivation(async () => {
                 const newly = matched.filter((n) => !active.has(n));
                 if (newly.length > 0) {
                     for (const n of newly)
@@ -275,7 +295,6 @@ export function createToolSearchTool(opts) {
                 }
                 return { newly, ride: newly.length > 0 ? listingRide?.(newly) : undefined };
             });
-            activationChain = section.then(() => undefined, () => undefined);
             const { newly, ride } = await section;
             const lines = matched.map((n) => {
                 const info = registry.get(n);

package/dist/core/runner/usage-accounting.d.ts

@@ -7,6 +7,11 @@ export declare function promptTokensOf(family: CacheFamily, u: {
     cacheRead: number;
     cacheWrite: number;
 }): number;
+export declare function uncachedInputTokensOf(family: CacheFamily, u: {
+    input: number;
+    cacheRead: number;
+    cacheWrite: number;
+}): number;
 export declare function usageCostMicroUsd(family: CacheFamily, u: {
     input?: number;
     output?: number;
@@ -14,5 +19,6 @@ export declare function usageCostMicroUsd(family: CacheFamily, u: {
     cacheWrite?: number;
 }, pricing: ModelPricing): {
     totalInputTokens: number;
+    uncachedInputTokens: number;
     costMicroUsd: number;
 };

package/dist/core/runner/usage-accounting.js

@@ -12,18 +12,19 @@ export function cacheFamilyOf(model) {
 export function promptTokensOf(family, u) {
     return family === "input-excludes-cached" ? u.input + u.cacheRead + u.cacheWrite : u.input;
 }
+export function uncachedInputTokensOf(family, u) {
+    return Math.max(0, promptTokensOf(family, u) - u.cacheRead - u.cacheWrite);
+}
 export function usageCostMicroUsd(family, u, pricing) {
-    const totalInputTokens = promptTokensOf(family, {
-        input: u.input || 0,
-        cacheRead: u.cacheRead || 0,
-        cacheWrite: u.cacheWrite || 0,
-    });
+    const normalized = { input: u.input || 0, cacheRead: u.cacheRead || 0, cacheWrite: u.cacheWrite || 0 };
+    const totalInputTokens = promptTokensOf(family, normalized);
+    const uncachedInputTokens = uncachedInputTokensOf(family, normalized);
     const costMicroUsd = computeCostMicroUsd({
         totalInputTokens,
-        cacheReadTokens: u.cacheRead || 0,
-        cacheWriteTokens: u.cacheWrite || 0,
+        cacheReadTokens: normalized.cacheRead,
+        cacheWriteTokens: normalized.cacheWrite,
         cacheWriteTokensLong: 0,
         outputTokens: u.output || 0,
     }, pricing);
-    return { totalInputTokens, costMicroUsd };
+    return { totalInputTokens, uncachedInputTokens, costMicroUsd };
 }

package/dist/core/secret-env.js

@@ -1,5 +1,9 @@
 const SECRET_ENV_RE = /(^|_)(KEY|TOKEN|SECRET|SECRETS|PASSWORD|PASSWD|CREDENTIAL|CREDENTIALS|PRIVATEKEY|APIKEY|ACCESS_KEY|SESSION_TOKEN)(?:_(?:\d+|ID))?$/i;
-const SECRET_ENV_EXACT_NAMES = new Set(["DATABASE_URL", "CONNECTION_STRING", "DSN", "NPM_AUTH"]);
+const SECRET_ENV_EXACT_NAMES = new Set([
+    "DATABASE_URL", "CONNECTION_STRING", "DSN", "NPM_AUTH",
+    "PGPASSWORD", "MYSQL_PWD", "SSHPASS", "GPG_PASSPHRASE", "GH_PAT", "GITHUB_PAT",
+    "NPM_CONFIG__AUTH", "NPM_CONFIG__AUTHTOKEN",
+]);
 export function isSecretEnvKey(key) {
     return SECRET_ENV_RE.test(key) || SECRET_ENV_EXACT_NAMES.has(key.toUpperCase());
 }

package/dist/core/sensitive-path-policy.js

@@ -14,6 +14,9 @@ export const RECOMMENDED_SENSITIVE_PATTERNS = [
     ".ssh",
     ".git/hooks",
     ".git/config",
+    ".git/modules",
+    ".mcp.json",
+    ".claude*",
     ".aws",
     ".config/gcloud",
     ".azure",
@@ -24,15 +27,18 @@ export const RECOMMENDED_SENSITIVE_PATTERNS = [
     ".zsh_history",
 ];
 function segmentGlobToRegExp(segment) {
-    const escaped = segment.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, "[^/]*");
+    const escaped = segment.replace(/[.+^${}()|[\]\\?]/g, "\\$&").replace(/\*/g, "[^/]*");
     return new RegExp(`^${escaped}$`);
 }
 function compilePatterns(patterns) {
     const out = [];
     for (const raw of patterns) {
         const segments = raw.split("/").filter(Boolean).map(segmentGlobToRegExp);
-        if (segments.length > 0)
-            out.push({ raw, segments });
+        if (segments.length === 0) {
+            throw new Error(`createSensitivePathPolicy: pattern ${JSON.stringify(raw)} contains no path segments and would guard nothing. ` +
+                `Patterns are "/"-separated runs of path SEGMENTS (e.g. ".ssh", ".git/hooks", "*.pem"); remove the entry or spell the segments.`);
+        }
+        out.push({ raw, segments });
     }
     return out;
 }

package/dist/core/session-store.js

@@ -114,6 +114,11 @@ export class TtlSessionStore {
         }
         const forked = await this.repo.fork(await source.getMetadata(), forkParams);
         const meta = await forked.getMetadata();
+        const inherited = this.owners.has(sourceId) ? this.owners.get(sourceId) : undefined;
+        const forkOwner = owner ?? inherited;
+        if (forkOwner !== undefined && !this.owners.has(meta.id)) {
+            this.owners.set(meta.id, forkOwner);
+        }
         this.entries.set(meta.id, {
             session: forked,
             lastActiveAt: Date.now(),
@@ -149,8 +154,13 @@ export class TtlSessionStore {
         return this.owners.has(sessionId) ? this.owners.get(sessionId) : undefined;
     }
     async register(sessionId, owner) {
-        if (!this.owners.has(sessionId))
-            this.owners.set(sessionId, owner);
+        if (this.owners.has(sessionId)) {
+            return;
+        }
+        if (owner !== null && typeof owner !== "string") {
+            throw new TypeError(`SessionStore.register: owner must be a string (owned) or null (anonymous), got ${owner === undefined ? "undefined" : typeof owner}`);
+        }
+        this.owners.set(sessionId, owner);
     }
     sweep(now = Date.now()) {
         for (const [id, e] of this.entries) {
@@ -160,8 +170,9 @@ export class TtlSessionStore {
             if (now - e.lastActiveAt > this.defaultTtlMs) {
                 this.entries.delete(id);
                 if (this.evictPolicy === "delete") {
-                    void this.repo.delete({ id, createdAt: "" });
-                    this.owners.delete(id);
+                    void this.repo.delete({ id, createdAt: "" }).then(() => {
+                        this.owners.delete(id);
+                    }, () => { });
                 }
             }
         }

package/dist/core/skill-tool-specifier.d.ts

@@ -0,0 +1,8 @@
+export interface SkillToolEntry {
+    readonly raw: string;
+    readonly name: string;
+    readonly specifier?: string;
+}
+export declare function parseSkillToolEntry(entry: string): SkillToolEntry;
+export declare function isSkillSpecifierEnforced(canonicalName: string): boolean;
+export declare function skillSpecifierRejection(entry: SkillToolEntry, args: unknown): string | undefined;

package/dist/core/skill-tool-specifier.js

@@ -0,0 +1,58 @@
+import { parsePermissionRule, wildcardMatch } from "./permission-rules.js";
+import { canonicalToolName } from "./tool-name-aliases.js";
+import { COARSE_SHELL_TOOLS } from "./tool-policy.js";
+import { parseLeadingCommandName } from "../tools/fs/bash-readonly-classifier.js";
+const SPECIFIER_ENFORCED_TOOLS = new Set(COARSE_SHELL_TOOLS.map(canonicalToolName));
+export function parseSkillToolEntry(entry) {
+    const parsed = parsePermissionRule(entry);
+    const name = canonicalToolName(parsed.toolName);
+    return parsed.ruleContent === undefined ? { raw: entry, name } : { raw: entry, name, specifier: parsed.ruleContent };
+}
+export function isSkillSpecifierEnforced(canonicalName) {
+    return SPECIFIER_ENFORCED_TOOLS.has(canonicalName);
+}
+function normalizeSpacing(s) {
+    return s.trim().replace(/[ \t]+/g, " ");
+}
+function hasUnescapedStar(content) {
+    for (let i = 0; i < content.length; i++) {
+        if (content[i] !== "*")
+            continue;
+        let backslashes = 0;
+        for (let j = i - 1; j >= 0 && content[j] === "\\"; j--)
+            backslashes++;
+        if (backslashes % 2 === 0)
+            return true;
+    }
+    return false;
+}
+function specifierMatchesCommand(specifier, command) {
+    const spec = normalizeSpacing(specifier);
+    const prefix = /^(.+):\*$/.exec(spec)?.[1];
+    if (prefix !== undefined) {
+        return command === prefix || command.startsWith(prefix + " ");
+    }
+    if (hasUnescapedStar(spec))
+        return wildcardMatch(spec, command);
+    return command === spec;
+}
+export function skillSpecifierRejection(entry, args) {
+    const { specifier } = entry;
+    if (specifier === undefined)
+        return undefined;
+    if (!isSkillSpecifierEnforced(entry.name)) {
+        return `entry "${entry.raw}" narrows a tool whose calls this gate cannot match against a command pattern — only the shell tools (${[...SPECIFIER_ENFORCED_TOOLS].join(", ")}) carry a command string, so the entry admits nothing`;
+    }
+    const command = args?.command;
+    if (typeof command !== "string") {
+        return `entry "${entry.raw}" requires a command string to match against, and this call has none`;
+    }
+    const parsedCommand = parseLeadingCommandName(command);
+    if ("reject" in parsedCommand) {
+        return `entry "${entry.raw}" only admits a single simple command (${parsedCommand.reject})`;
+    }
+    if (!specifierMatchesCommand(specifier, normalizeSpacing(command))) {
+        return `command "${command.trim()}" is not admitted by entry "${entry.raw}"`;
+    }
+    return undefined;
+}

package/dist/core/skills-directory.d.ts

@@ -1,5 +1,5 @@
 import type { SkillSpec } from "./types.js";
-export type SkillsDirectoryWarningCode = "no_skill_file" | "no_frontmatter" | "missing_name" | "invalid_name" | "name_mismatch" | "missing_description" | "description_too_long" | "allowed_tool_not_mounted" | "disallowed_tools_unenforced" | "attachment_skipped" | "read_failed";
+export type SkillsDirectoryWarningCode = "no_skill_file" | "no_frontmatter" | "missing_name" | "invalid_name" | "name_mismatch" | "missing_description" | "allowed_tool_pattern_unsupported" | "description_too_long" | "allowed_tool_not_mounted" | "disallowed_tools_unenforced" | "attachment_skipped" | "read_failed";
 export interface SkillsDirectoryWarning {
     code: SkillsDirectoryWarningCode;
     skill: string;

package/dist/core/skills-directory.js

@@ -1,6 +1,7 @@
 import { readFileSync, readdirSync, realpathSync, statSync } from "node:fs";
 import { isAbsolute, join, relative } from "node:path";
 import { canonicalToolName } from "./tool-name-aliases.js";
+import { isSkillSpecifierEnforced, parseSkillToolEntry } from "./skill-tool-specifier.js";
 const SKILL_FILE = "SKILL.md";
 const RESOURCE_DIRS = ["assets", "references", "scripts"];
 const NAME_MAX_CHARS = 64;
@@ -316,12 +317,23 @@ function manifestFromAllowedTools(declared, disallowed, skillName, deployedTools
     const names = [];
     const seen = new Set();
     for (const n of splitToolNames(declared)) {
-        const key = canonicalToolName(n);
+        const entry = parseSkillToolEntry(n);
+        const key = entry.specifier === undefined ? entry.name : `${entry.name}(${entry.specifier})`;
         if (seen.has(key))
             continue;
         seen.add(key);
         names.push(n);
     }
+    for (const n of names) {
+        const entry = parseSkillToolEntry(n);
+        if (entry.specifier !== undefined && !isSkillSpecifierEnforced(entry.name)) {
+            warn({
+                code: "allowed_tool_pattern_unsupported",
+                skill: skillName,
+                detail: `allowed-tools entry "${n}" narrows a tool whose calls cannot be matched against a command pattern — only shell tools carry one, so the entry is not enforced and the tool is DISABLED inside this skill frame. Use the bare tool name to allow it fully.`,
+            });
+        }
+    }
     if (names.length === 0)
         return undefined;
     if (names.some((n) => n === ALL_TOOLS_WILDCARD))
@@ -329,9 +341,9 @@ function manifestFromAllowedTools(declared, disallowed, skillName, deployedTools
     let allowTools = names;
     if (deployedTools !== undefined) {
         const mounted = new Set(deployedTools.map(canonicalToolName));
-        allowTools = names.filter((n) => mounted.has(canonicalToolName(n)));
+        allowTools = names.filter((n) => mounted.has(parseSkillToolEntry(n).name));
         for (const n of names) {
-            if (!mounted.has(canonicalToolName(n))) {
+            if (!mounted.has(parseSkillToolEntry(n).name)) {
                 warn({
                     code: "allowed_tool_not_mounted",
                     skill: skillName,
@@ -342,7 +354,7 @@ function manifestFromAllowedTools(declared, disallowed, skillName, deployedTools
     }
     if (disallowed.length > 0) {
         const denied = new Set(disallowed.map(canonicalToolName));
-        allowTools = allowTools.filter((n) => !denied.has(canonicalToolName(n)));
+        allowTools = allowTools.filter((n) => !denied.has(parseSkillToolEntry(n).name));
     }
     return { allowTools, lineageId: `skill:${skillName}` };
 }

package/dist/core/store-contracts/session-repo-contract.js

@@ -32,5 +32,45 @@ export async function sessionRepoContract(make, runAssertion) {
         const repo = make();
         await assert.rejects(repo.open({ id: "0198fa00-0000-7000-8000-0000000000ff", createdAt: "" }), /not.?found/i);
     });
+    run("delete() makes the id not_found — the history is gone, not merely hidden from open()", async () => {
+        const repo = make();
+        const sess = await repo.create({ id: A });
+        await sess.getStorage().appendEntry(SESSION_ENTRY("e1", null));
+        await repo.delete({ id: A, createdAt: "" });
+        await assert.rejects(repo.open({ id: A, createdAt: "" }), /not.?found/i);
+        const fresh = await repo.create({ id: A });
+        assert.deepEqual((await fresh.getStorage().getEntries()).map((e) => e.id), []);
+    });
+    run("fork() copies the log, stamps forkedFrom, and leaves the SOURCE untouched", async () => {
+        const repo = make();
+        const src = await repo.create({ id: A });
+        await src.getStorage().appendEntry(SESSION_ENTRY("e1", null));
+        await src.getStorage().appendEntry(SESSION_ENTRY("e2", "e1"));
+        const B = "0198fa00-0000-7000-8000-00000000000b";
+        const forked = await repo.fork({ id: A, createdAt: "" }, { id: B });
+        assert.deepEqual((await forked.getStorage().getEntries()).map((e) => e.id), ["e1", "e2"]);
+        assert.equal((await forked.getMetadata()).forkedFrom, A, "fork lineage must be stamped (a reap walks it)");
+        await src.getStorage().appendEntry(SESSION_ENTRY("e3", "e2"));
+        assert.deepEqual((await (await repo.open({ id: A, createdAt: "" })).getStorage().getEntries()).map((e) => e.id), ["e1", "e2", "e3"]);
+        assert.deepEqual((await (await repo.open({ id: B, createdAt: "" })).getStorage().getEntries()).map((e) => e.id), ["e1", "e2"]);
+    });
+    run("exportEntries → importEntries round-trips the log verbatim, and the imported session REPLACES what was there", async () => {
+        const repo = make();
+        if (repo.exportEntries === undefined || repo.importEntries === undefined)
+            return;
+        const src = await repo.create({ id: A });
+        await src.getStorage().appendEntry(SESSION_ENTRY("e1", null));
+        await src.getStorage().appendEntry(SESSION_ENTRY("e2", "e1"));
+        const donor = await repo.exportEntries(A);
+        assert.deepEqual(donor.map((e) => e.id), ["e1", "e2"]);
+        const C = "0198fa00-0000-7000-8000-00000000000c";
+        const target = await repo.create({ id: C });
+        await target.getStorage().appendEntry(SESSION_ENTRY("old", null));
+        await repo.importEntries(C, undefined, donor);
+        const after = await repo.exportEntries(C);
+        assert.deepEqual(after.map((e) => e.id), ["e1", "e2"]);
+        assert.deepEqual(after.map((e) => e.parentId), [null, "e1"]);
+        assert.equal((await repo.exportEntries(A)).length, 2, "importing into C must not disturb the donor session");
+    });
     await settle();
 }

package/dist/core/task-registry-monitor.js

@@ -42,7 +42,13 @@ export function registerMonitorLane(core, input) {
         ...(input.sessionId !== undefined ? { spillSessionId: input.sessionId } : {}),
     };
     core.handles.set(id, handle);
-    startMonitorWatcherLane(core, id);
+    try {
+        startMonitorWatcherLane(core, id);
+    }
+    catch (e) {
+        core.handles.delete(id);
+        throw e;
+    }
     return id;
 }
 function spillRolledMonitorChunk(handle, stream, dropped) {