@sema-agent/core 2.13.0 → 3.0.0

package/dist/core/memory-engine/engine.js

@@ -147,6 +147,18 @@ export class MemoryEngine {
                 handle.baseIds.set(path, entry.id);
             }
         }
+        const indexGate = this.gateDerivedIndex(handle);
+        if (indexGate !== undefined) {
+            try {
+                enqueueMemoryAnnouncement(this.controlDir, {
+                    kind: "gate",
+                    at: this.now(),
+                    items: [`memory index rejected and rebuilt: ${inlineUntrusted(indexGate.reason)}`],
+                });
+            }
+            catch {
+            }
+        }
         const indexText = this.rebuildIndex(handle, headers, { write: writeScope !== null });
         handle.indexBaselineLines = countIndexLines(indexText);
         handle.indexText = indexText;
@@ -364,6 +376,7 @@ export class MemoryEngine {
                 basePathById.set(id, p);
         const patches = [];
         const pendingProjections = [];
+        const idsAddedThisHarvest = new Set();
         let processed = 0;
         for (let i = 0; i < kept.length; i++) {
             const f = kept[i];
@@ -465,7 +478,28 @@ export class MemoryEngine {
                 patches.push({ op: "update", id: parsed.id, entry: { ...entry, id: parsed.id, rev: computeEntryRev({ id: parsed.id, frontmatter: fm, body: parsed.body }) }, ...(revByBasePath.get(renamedFrom) !== undefined ? { baseRev: revByBasePath.get(renamedFrom) } : {}) });
                 continue;
             }
-            pendingProjections.push({ path: f.canonical, entry, needed: minted || needsCompletion(parsed, fm) });
+            let reboundId;
+            if (parsed.id !== undefined && (renamedFrom !== undefined || idsAddedThisHarvest.has(parsed.id))) {
+                reboundId = parsed.id;
+                const idless = serializeEntryFile({ id: "", frontmatter: fm, body: parsed.body }).replace(/^id:[ \t]*$\r?\n/m, "");
+                try {
+                    writeFileSync(f.canonical, idless, "utf8");
+                }
+                catch (err) {
+                    report.rejections.push({
+                        path: rel,
+                        code: "filename",
+                        reason: `memory write blocked: this file carries the entry id of another memory file (a copy is not a rename) and its frontmatter could not be rewritten (${err instanceof Error ? err.message : String(err)}) — remove the "id:" line so it can be committed as a new entry`,
+                    });
+                    continue;
+                }
+                id = uuidv7();
+                entry.id = id;
+                entry.rev = computeEntryRev(entry);
+                report.warnings.push(`${rel}: frontmatter id ${reboundId} already has a projection (${renamedFrom !== undefined ? relative(handle.memoryDir, renamedFrom) : "another new file in this harvest"}) — a copy is not a rename, so this file was committed as a NEW entry with a fresh id; the existing entry was left untouched`);
+            }
+            pendingProjections.push({ path: f.canonical, entry, needed: minted || reboundId !== undefined || needsCompletion(parsed, fm) });
+            idsAddedThisHarvest.add(entry.id);
             patches.push({ op: "add", id: entry.id, entry });
         }
         let patchReport;
@@ -503,12 +537,15 @@ export class MemoryEngine {
         const drained = this.backend.drainInboundFindings?.();
         if (drained !== undefined && drained.length > 0)
             report.inboundFindings = drained;
+        const indexRejection = this.gateDerivedIndex(handle);
+        if (indexRejection !== undefined)
+            report.rejections.push(indexRejection);
         const headers = await this.backend.listHeaders([...new Set([...handle.scopes, writeScope])]);
         handle.indexText = this.rebuildIndex(handle, headers, { write: true }, report.warnings);
-        await this.rebaseline(handle);
+        await this.rebaseline(handle, new Set(report.degraded?.pending ?? []));
         return report;
     }
-    async rebaseline(handle) {
+    async rebaseline(handle, keepBaseline = new Set()) {
         const writeScope = handle.writeScope;
         if (writeScope === null)
             return;
@@ -535,12 +572,17 @@ export class MemoryEngine {
             if (id === undefined)
                 continue;
             const stub = stubs.get(path);
-            const rev = revOfText(text, id);
+            const relPath = relative(handle.memoryDir, path);
+            const deferred = keepBaseline.has(relPath);
+            const priorRev = deferred ? handle.baseRevs.get(path) : undefined;
+            const priorId = deferred ? handle.baseIds.get(path) : undefined;
+            const rev = priorRev ?? revOfText(text, priorId ?? id);
+            const baselineId = priorId ?? id;
             next.push({
                 path,
-                relPath: relative(handle.memoryDir, path),
+                relPath,
                 scope: writeScope,
-                id,
+                id: baselineId,
                 slug: f.slug,
                 rev,
                 stub: stub !== undefined && stub.rev === rev,
@@ -548,7 +590,7 @@ export class MemoryEngine {
             });
             fileToScope.set(path, writeScope);
             baseRevs.set(path, rev);
-            baseIds.set(path, id);
+            baseIds.set(path, baselineId);
         }
         handle.materialized = next;
         handle.fileToScope = fileToScope;
@@ -650,6 +692,39 @@ export class MemoryEngine {
             return viaBackend;
         return readSafe(join(this.controlDir, "shadow", `${id}.md`));
     }
+    gateDerivedIndex(handle) {
+        if (handle.writeScope === null)
+            return undefined;
+        const indexPath = join(handle.writableRoot, MEMORY_INDEX_FILENAME);
+        const text = readSafe(indexPath);
+        if (text === undefined || text === "")
+            return undefined;
+        const finding = scanMemoryWrite(text).find((f) => f.code === "secret");
+        if (finding === undefined)
+            return undefined;
+        let detail = "";
+        try {
+            const dest = join(this.controlDir, "quarantine", `${this.now()}-${MEMORY_INDEX_FILENAME}`);
+            mkdirSync(dirname(dest), { recursive: true });
+            writeFileSync(dest, text, "utf8");
+        }
+        catch (err) {
+            detail = `; quarantine capture failed: ${err instanceof Error ? err.message : String(err)}`;
+        }
+        let cleared = false;
+        try {
+            writeFileSync(indexPath, "", "utf8");
+            cleared = true;
+        }
+        catch (err) {
+            detail = `${detail}; the derived index could NOT be cleared: ${err instanceof Error ? err.message : String(err)}`;
+        }
+        return {
+            path: MEMORY_INDEX_FILENAME,
+            code: finding.code,
+            reason: `memory index blocked: ${finding.reason} (${cleared ? "index cleared and rebuilt from entry frontmatter; the offending prose was captured to quarantine" : "index still carries the offending content"})${detail}`,
+        };
+    }
     quarantineFile(path, content) {
         const dest = join(this.controlDir, "quarantine", `${this.now()}-${basename(path)}`);
         let captured;

package/dist/core/memory-engine/file-backend.d.ts

@@ -30,6 +30,7 @@ export declare class FileMemoryEngineBackend implements MemoryBackend {
     private loadLedger;
     private saveLedger;
     private recoverJournal;
+    private txnInFlight;
     private sweepStagedFiles;
     private excludedSubdirNames;
     private scopeDir;

package/dist/core/memory-engine/file-backend.js

@@ -79,10 +79,10 @@ export class FileMemoryEngineBackend {
         this.controlPlaneRoot = opts.controlDir ?? deriveControlPlaneDir(resolveMemoryEngineRoot(), dir);
         ensureDirExists(dir);
         ensureDirExists(this.controlPlaneRoot);
-        this.recoverJournal();
+        this.recoverJournal({ unlocked: true });
     }
     checkControlPlane() {
-        this.recoverJournal();
+        this.recoverJournal({ unlocked: true });
         this.ledger = undefined;
         this.loadLedger();
         registeredScopes(this.controlPlaneRoot);
@@ -164,8 +164,10 @@ export class FileMemoryEngineBackend {
             return;
         atomicWriteFileSync(join(this.controlPlaneRoot, LEDGER_FILE), `${JSON.stringify(this.ledger, null, 2)}\n`);
     }
-    recoverJournal() {
+    recoverJournal(opts = {}) {
         const jp = join(this.controlPlaneRoot, JOURNAL_FILE);
+        if (opts.unlocked && this.txnInFlight())
+            return;
         const raw = readSafe(jp);
         if (raw !== undefined) {
             let journal;
@@ -205,6 +207,14 @@ export class FileMemoryEngineBackend {
         }
         this.sweepStagedFiles();
     }
+    txnInFlight() {
+        try {
+            return this.now() - statSync(this.txnLockDir()).mtimeMs < TXN_LOCK_STALE_MS;
+        }
+        catch {
+            return false;
+        }
+    }
     sweepStagedFiles() {
         const walk = (d, depth) => {
             let names;

package/dist/core/memory-engine/layout.js

@@ -216,11 +216,22 @@ function acquireSidecarLock(lockDir, opts = {}) {
         try {
             mkdirSync(lockDir);
             const token = `${process.pid}-${Math.random().toString(36).slice(2, 10)}`;
+            let fd;
             try {
-                writeSync(openSync(join(lockDir, "owner"), "w"), token);
+                fd = openSync(join(lockDir, "owner"), "w");
+                writeSync(fd, token);
             }
             catch {
             }
+            finally {
+                if (fd !== undefined) {
+                    try {
+                        closeSync(fd);
+                    }
+                    catch {
+                    }
+                }
+            }
             return token;
         }
         catch {

package/dist/core/memory.js

@@ -32,6 +32,9 @@ const SECRET_PATTERNS = [
     { label: "slack_token", re: /\bxox[baprs]-(?:[A-Za-z0-9]+-){1,3}[A-Za-z0-9]{16,}\b/ },
     { label: "google_api_key", re: /\bAIza[0-9A-Za-z_-]{35}\b/ },
     { label: "private_key", re: /-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?-----/ },
+    { label: "jwt", re: /\beyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]{16,}\b/ },
+    { label: "azure_storage_account_key", re: /AccountKey=[A-Za-z0-9+/]{40,}={0,2}/ },
+    { label: "bearer_token", re: /\bAuthorization:\s*Bearer\s+(?=[A-Za-z0-9._~+/-]*[0-9])[A-Za-z0-9._~+/-]{20,}=*/ },
 ];
 export function detectSecret(text) {
     if (!text)

package/dist/core/permission-rules.d.ts

@@ -11,7 +11,7 @@ export interface ParsedPermissionRule {
 }
 export interface PermissionRuleIssue {
     rule: string;
-    code: "invalid.empty_tool" | "invalid.paren" | "invalid.param_split" | "invalid.allow_param_rule" | "invalid.primary_field" | "invalid.cap_exceeded" | "unsupported.bash_prefix" | "unsupported.file_glob" | "unsupported.mcp_paren";
+    code: "invalid.empty_tool" | "invalid.paren" | "invalid.param_split" | "invalid.allow_param_rule" | "invalid.primary_field" | "invalid.cap_exceeded" | "unsupported.bash_prefix" | "unsupported.file_glob" | "unsupported.mcp_paren" | "unsupported.unknown_param";
     message: string;
 }
 export interface PermissionRuleCaps {
@@ -30,5 +30,6 @@ export interface PermissionRulePolicyOptions {
 }
 export declare function parsePermissionRule(rule: string): ParsedPermissionRule;
 export declare function wildcardMatch(pattern: string, value: string): boolean;
+export declare const fileToolParamVocabulary: (canonicalTool: string) => ReadonlySet<string> | undefined;
 export declare function validatePermissionRules(rules: PermissionRule[], opts?: Pick<PermissionRulePolicyOptions, "primaryFieldGeneric" | "caps">): PermissionRuleIssue[];
 export declare function createPermissionRulePolicy(rules: PermissionRule[], opts?: PermissionRulePolicyOptions): ToolPolicy;

package/dist/core/permission-rules.js

@@ -90,6 +90,18 @@ const PRIMARY_FIELDS = {
     WebSearch: new Set(["query"]),
 };
 const FILE_TOOLS = new Set(["Read", "Edit", "Write", "MultiEdit", "NotebookEdit", "Grep", "Glob"]);
+const FILE_TOOL_PARAMS = {
+    Read: new Set(["file_path", "path", "offset", "limit", "pages"]),
+    Edit: new Set(["file_path", "path", "old_string", "new_string", "replace_all"]),
+    Write: new Set(["file_path", "path", "content"]),
+    NotebookEdit: new Set(["notebook_path", "path", "cell_id", "cell_type", "edit_mode", "new_source"]),
+    Grep: new Set([
+        "pattern", "path", "glob", "type", "output_mode", "head_limit", "max_results", "offset",
+        "multiline", "context", "ignore_case", "-i", "-n", "-o", "-A", "-B", "-C",
+    ]),
+    Glob: new Set(["pattern", "path", "max_results"]),
+};
+export const fileToolParamVocabulary = (canonicalTool) => FILE_TOOL_PARAMS[canonicalTool];
 function countStars(s) {
     let n = 0;
     for (const c of s)
@@ -151,9 +163,18 @@ function compile(rules, caps, primaryFieldGeneric) {
                 continue;
             }
         }
-        else if (FILE_TOOLS.has(toolName) && colon <= 0) {
-            bad(text, "unsupported.file_glob", "file-tool glob rules (`Edit(src/**)`) are the tool-specific lane — not supported by the generic param DSL");
-            continue;
+        else if (FILE_TOOLS.has(toolName)) {
+            if (colon <= 0) {
+                bad(text, "unsupported.file_glob", "file-tool glob rules (`Edit(src/**)`) are the tool-specific lane — not supported by the generic param DSL");
+                continue;
+            }
+            const paramPart = content.slice(0, colon).trim();
+            const vocabulary = FILE_TOOL_PARAMS[toolName];
+            if (vocabulary !== undefined && !vocabulary.has(paramPart)) {
+                bad(text, "unsupported.unknown_param", `"${paramPart}" is not a parameter of ${toolName} (it carries ${[...vocabulary].sort().join(", ")}) — the rule would compile and never match. ` +
+                    `For a path glob use the tool-specific lane (\`${toolName}(src/**)\` is not the generic param DSL); a Windows path such as \`${toolName}(C:/foo)\` parses as the param "C".`);
+                continue;
+            }
         }
         if (colon <= 0) {
             bad(text, "invalid.param_split", "param-level ruleContent must be `param:pattern`");

package/dist/core/runner/assemble-result.d.ts

@@ -10,7 +10,7 @@ export interface Stats {
     cacheWriteTokensLong: number;
     outputTokens: number;
     cacheHitRate?: number;
-    totalInputTokens?: number;
+    totalInputTokens: number;
     costMicroUsd: number;
     nested?: {
         tokens: number;

package/dist/core/runner/assemble-result.js

@@ -35,7 +35,6 @@ function assistantText(msg) {
 export function assembleResult(spec, sessionId, final, stats, flags) {
     const taskId = spec.taskId ?? sessionId;
     const text = final ? assistantText(final) : "";
-    stats.totalInputTokens = stats.promptTokens;
     if (!flags.unpricedSpend) {
         const compactionMicroUsd = stats.compactionMicroUsd ?? 0;
         const nestedSubagentMicroUsd = stats.nested?.costMicroUsd ?? 0;

package/dist/core/runner/prepare-task.js

@@ -433,6 +433,9 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
     }
     const taskScope = internals?.registryScope ?? spec.principal ?? "default";
     const offloadScope = spec.principal ?? "default";
+    if (internals?.registryScope !== undefined && internals.registryScope !== offloadScope) {
+        deps.onError?.(new Error(`offload/tool-result namespace note: this run mounts in registry domain "${internals.registryScope}" but its offloaded tool results live under the TRUST identity "${offloadScope}" (principal${spec.principal === undefined ? " absent → default" : ""}). Before 2.13.0 the registry domain named this namespace too; if a deployment used registryScope as its ref-tenancy boundary, that boundary is now the principal — pass one, or read refs under "${offloadScope}".`), { phase: "config", sessionId });
+    }
     defaultTaskRegistry.maybeGc();
     const forgetOnThrow = () => forgetQuietly(sessions, sessionId);
     const extraBodyCollisions = reservedCollisions(model.extraBody, reservedFor(model.api));
@@ -2743,6 +2746,13 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     }
                 }
                 : undefined;
+            const notifyHookError = (err) => {
+                try {
+                    deps.onError?.(err instanceof Error ? err : new Error(String(err)), { phase: "hook", sessionId });
+                }
+                catch {
+                }
+            };
             const checkpointStore = spec.checkpointStore ?? deps.checkpointStore;
             const durableApproval = spec.durableApproval ??
                 (runtimeCaps?.forceDurableGate ? { scope: spec.principal || DEFAULT_IRREVERSIBLE_SCOPE } : undefined);
@@ -3183,6 +3193,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             reversibilityProbe: reversibilityProbes.get(e.toolName),
                             abortSignal: abortController.signal,
                             ...(notifyPermissionDenied ? { permissionDenied: notifyPermissionDenied } : {}),
+                            onHookError: notifyHookError,
                             shellGated: (e.toolName === "Bash" && shellGatedBash) || (e.toolName === "Monitor" && shellGatedMonitor),
                             ...(autoModeDecider ? { autoMode: { decider: autoModeDecider } } : {}),
                             isMarkedUnresolvable: (toolCallId) => inheritedUnavailableAsks.has(toolCallId),

package/dist/core/runner/runtask.js

@@ -341,8 +341,7 @@ function makeTurnBoundary(prepared, stats, rs, deps) {
                     const scan = await Promise.race([
                         prepared.detectExternalChanges(maxFiles),
                         new Promise((resolve) => {
-                            const t = setTimeout(() => resolve({ changed: [], evicted: [] }), SCAN_CEILING_MS);
-                            t.unref?.();
+                            setTimeout(() => resolve({ changed: [], evicted: [] }), SCAN_CEILING_MS);
                         }),
                     ]);
                     for (const p of scan.evicted)
@@ -475,8 +474,7 @@ function makeTurnBoundary(prepared, stats, rs, deps) {
                     probed = await Promise.race([
                         rs.attach.instrProbe(prepared.instructionSources),
                         new Promise((resolve) => {
-                            const t = setTimeout(() => resolve(null), PROBE_CEILING_MS);
-                            t.unref?.();
+                            setTimeout(() => resolve(null), PROBE_CEILING_MS);
                         }),
                     ]);
                 }
@@ -811,16 +809,18 @@ function makeHarnessHandlers(prepared, stats, rs, deps) {
                 rs.turn.turnUsageMissing = true;
             const u = m.usage;
             stats.tokens += u.totalTokens || 0;
-            const { totalInputTokens: turnInput, costMicroUsd: turnCostMicroUsd } = usageCostMicroUsd(rs.telemetry.cacheFamily, u, rs.telemetry.pricing);
+            const { totalInputTokens: turnTotal, uncachedInputTokens: turnUncached, costMicroUsd: turnCostMicroUsd, } = usageCostMicroUsd(rs.telemetry.cacheFamily, u, rs.telemetry.pricing);
             if (!rs.telemetry.pricingConfigured)
                 rs.telemetry.unpricedSpend = true;
-            stats.promptTokens += turnInput;
+            stats.promptTokens += turnUncached;
+            stats.totalInputTokens += turnTotal;
             stats.cachedTokens += u.cacheRead || 0;
             stats.cacheWriteTokens += u.cacheWrite || 0;
             stats.outputTokens += u.output || 0;
             stats.costMicroUsd += turnCostMicroUsd;
-            rs.turn.turnUsage ??= { inputTokens: 0, outputTokens: 0, cacheReadTokens: 0, cacheWriteTokens: 0, costMicroUsd: 0 };
-            rs.turn.turnUsage.inputTokens += turnInput;
+            rs.turn.turnUsage ??= { inputTokens: 0, totalInputTokens: 0, outputTokens: 0, cacheReadTokens: 0, cacheWriteTokens: 0, costMicroUsd: 0 };
+            rs.turn.turnUsage.inputTokens += turnUncached;
+            rs.turn.turnUsage.totalInputTokens += turnTotal;
             rs.turn.turnUsage.outputTokens += u.output || 0;
             rs.turn.turnUsage.cacheReadTokens += u.cacheRead || 0;
             rs.turn.turnUsage.cacheWriteTokens += u.cacheWrite || 0;
@@ -846,7 +846,8 @@ function makeHarnessHandlers(prepared, stats, rs, deps) {
                 model: m.model,
                 provider: m.provider,
                 turn: stats.turns + 1,
-                promptTokens: turnInput,
+                promptTokens: turnUncached,
+                totalInputTokens: turnTotal,
                 completionTokens: u.output || 0,
                 cacheRead: u.cacheRead || 0,
                 cacheWrite: u.cacheWrite || 0,
@@ -1262,7 +1263,6 @@ export class Runner {
             let t;
             const timeout = new Promise((res2) => {
                 t = setTimeout(() => res2(undefined), READY_TIMEOUT_MS);
-                t.unref?.();
             });
             return Promise.race([p, timeout]).finally(() => clearTimeout(t));
         };
@@ -1650,7 +1650,7 @@ export class Runner {
             }
         }
         onReady({ harness: prepared.harness, abortController: prepared.abortController });
-        const stats = { turns: 0, tokens: 0, toolCalls: 0, promptTokens: 0, cachedTokens: 0, cacheWriteTokens: 0, cacheWriteTokensLong: 0, outputTokens: 0, costMicroUsd: 0 };
+        const stats = { turns: 0, tokens: 0, toolCalls: 0, promptTokens: 0, totalInputTokens: 0, cachedTokens: 0, cacheWriteTokens: 0, cacheWriteTokensLong: 0, outputTokens: 0, costMicroUsd: 0 };
         prepared.liveSpendRef.get = () => ({ costMicroUsd: stats.costMicroUsd, tokens: stats.tokens, turns: stats.turns, walltimeMs: Math.round(performance.now() - rs.telemetry.taskStartMonotonic) });
         if (resume &&
             resume.cp.suspendedAt !== undefined &&
@@ -2132,9 +2132,10 @@ export class Runner {
             const priced = this.deps.pricing?.[m.id] !== undefined || m.cost !== undefined;
             if (!priced)
                 rs.telemetry.unpricedSpend = true;
-            const { totalInputTokens, costMicroUsd } = usageCostMicroUsd(fam, u, price);
+            const { totalInputTokens, uncachedInputTokens, costMicroUsd } = usageCostMicroUsd(fam, u, price);
             stats.tokens += u.totalTokens || 0;
-            stats.promptTokens += totalInputTokens;
+            stats.promptTokens += uncachedInputTokens;
+            stats.totalInputTokens += totalInputTokens;
             stats.cachedTokens += u.cacheRead || 0;
             stats.cacheWriteTokens += u.cacheWrite || 0;
             stats.outputTokens += u.output || 0;
@@ -2142,7 +2143,7 @@ export class Runner {
             stats.compactionMicroUsd = (stats.compactionMicroUsd ?? 0) + costMicroUsd;
             emitTrace(rs.telemetry.tracer, () => ({
                 kind: "brain.call", version: 1, taskId: rs.telemetry.taskId, model: m.id, provider: m.provider,
-                promptTokens: totalInputTokens, completionTokens: u.output || 0,
+                promptTokens: uncachedInputTokens, totalInputTokens, completionTokens: u.output || 0,
                 cacheRead: u.cacheRead || 0, cacheWrite: u.cacheWrite || 0,
                 latencyMs: 0, ...(priced ? { costMicroUsd } : {}), ...(typeof msg?.stopReason === "string" ? { stopReason: msg.stopReason } : {}), ts: Date.now(),
             }));
@@ -2741,17 +2742,17 @@ export class Runner {
                     costMicroUsd: prepared.nestedStats.costMicroUsd || undefined,
                 };
             }
-            if (stats.promptTokens > 0) {
-                const rawHit = stats.cachedTokens / stats.promptTokens;
-                if (stats.cachedTokens > stats.promptTokens) {
-                    this.deps.onError?.(new Error(`prompt-cache: usage/api mismatch — cachedTokens (${stats.cachedTokens}) > promptTokens (${stats.promptTokens}); the cache family is likely wrong. Does model.api match the brain serving it? Override with model.params.promptCacheFamily = "input-includes-cached" | "input-excludes-cached".`), { phase: "prompt-cache", sessionId: prepared.sessionId });
+            if (stats.totalInputTokens > 0) {
+                const rawHit = stats.cachedTokens / stats.totalInputTokens;
+                if (stats.cachedTokens > stats.totalInputTokens) {
+                    this.deps.onError?.(new Error(`prompt-cache: usage/api mismatch — cachedTokens (${stats.cachedTokens}) > totalInputTokens (${stats.totalInputTokens}); the cache family is likely wrong. Does model.api match the brain serving it? Override with model.params.promptCacheFamily = "input-includes-cached" | "input-excludes-cached".`), { phase: "prompt-cache", sessionId: prepared.sessionId });
                 }
                 stats.cacheHitRate = Math.min(1, rawHit);
-                if (!rs.telemetry.cacheBreakReported && stats.turns >= 2 && stats.promptTokens >= 8000 && stats.cacheHitRate < 0.15) {
+                if (!rs.telemetry.cacheBreakReported && stats.turns >= 2 && stats.totalInputTokens >= 8000 && stats.cacheHitRate < 0.15) {
                     const cause = rs.degrade.degraded
                         ? `a mid-task model switch (${rs.degrade.degraded.from} → ${rs.degrade.degraded.to}, degradation) reset the prefix cache — this is the likely cause`
                         : `the cacheable prefix looks unstable. Keep volatile content (memory/timestamps/ids) out of the prompt prefix and tool order stable, or it's a server-side/TTL miss`;
-                    this.deps.onError?.(new Error(`prompt-cache: low prefix-cache hit rate ${(stats.cacheHitRate * 100).toFixed(0)}% over ${stats.turns} turns (${stats.promptTokens} prompt tokens) — ${cause}. See design/09.`), { phase: "prompt-cache", sessionId: prepared.sessionId });
+                    this.deps.onError?.(new Error(`prompt-cache: low prefix-cache hit rate ${(stats.cacheHitRate * 100).toFixed(0)}% over ${stats.turns} turns (${stats.totalInputTokens} prompt tokens) — ${cause}. See design/09.`), { phase: "prompt-cache", sessionId: prepared.sessionId });
                 }
             }
             if (prepared.resourceLedger &&
@@ -3035,7 +3036,6 @@ export class Runner {
                 ac.abort();
                 resolve([]);
             }, SUGGESTIONS_TIMEOUT_MS);
-            timer.unref?.();
         });
         const work = (async () => {
             let model = prepared.model;
@@ -3107,7 +3107,6 @@ export class Runner {
                     ac.abort();
                     resolve({ ok: false, error: { code: "aborted", message: "snapshot timed out" } });
                 }, SNAPSHOT_TIMEOUT_MS);
-                timer.unref?.();
             });
             const work = store.snapshot(prepared.sessionId, leafId, env, root, ac.signal);
             work.catch(() => { });

package/dist/core/runner/usage-accounting.d.ts

@@ -7,6 +7,11 @@ export declare function promptTokensOf(family: CacheFamily, u: {
     cacheRead: number;
     cacheWrite: number;
 }): number;
+export declare function uncachedInputTokensOf(family: CacheFamily, u: {
+    input: number;
+    cacheRead: number;
+    cacheWrite: number;
+}): number;
 export declare function usageCostMicroUsd(family: CacheFamily, u: {
     input?: number;
     output?: number;
@@ -14,5 +19,6 @@ export declare function usageCostMicroUsd(family: CacheFamily, u: {
     cacheWrite?: number;
 }, pricing: ModelPricing): {
     totalInputTokens: number;
+    uncachedInputTokens: number;
     costMicroUsd: number;
 };

package/dist/core/runner/usage-accounting.js

@@ -12,18 +12,19 @@ export function cacheFamilyOf(model) {
 export function promptTokensOf(family, u) {
     return family === "input-excludes-cached" ? u.input + u.cacheRead + u.cacheWrite : u.input;
 }
+export function uncachedInputTokensOf(family, u) {
+    return Math.max(0, promptTokensOf(family, u) - u.cacheRead - u.cacheWrite);
+}
 export function usageCostMicroUsd(family, u, pricing) {
-    const totalInputTokens = promptTokensOf(family, {
-        input: u.input || 0,
-        cacheRead: u.cacheRead || 0,
-        cacheWrite: u.cacheWrite || 0,
-    });
+    const normalized = { input: u.input || 0, cacheRead: u.cacheRead || 0, cacheWrite: u.cacheWrite || 0 };
+    const totalInputTokens = promptTokensOf(family, normalized);
+    const uncachedInputTokens = uncachedInputTokensOf(family, normalized);
     const costMicroUsd = computeCostMicroUsd({
         totalInputTokens,
-        cacheReadTokens: u.cacheRead || 0,
-        cacheWriteTokens: u.cacheWrite || 0,
+        cacheReadTokens: normalized.cacheRead,
+        cacheWriteTokens: normalized.cacheWrite,
         cacheWriteTokensLong: 0,
         outputTokens: u.output || 0,
     }, pricing);
-    return { totalInputTokens, costMicroUsd };
+    return { totalInputTokens, uncachedInputTokens, costMicroUsd };
 }

package/dist/core/secret-env.js

@@ -1,5 +1,9 @@
 const SECRET_ENV_RE = /(^|_)(KEY|TOKEN|SECRET|SECRETS|PASSWORD|PASSWD|CREDENTIAL|CREDENTIALS|PRIVATEKEY|APIKEY|ACCESS_KEY|SESSION_TOKEN)(?:_(?:\d+|ID))?$/i;
-const SECRET_ENV_EXACT_NAMES = new Set(["DATABASE_URL", "CONNECTION_STRING", "DSN", "NPM_AUTH"]);
+const SECRET_ENV_EXACT_NAMES = new Set([
+    "DATABASE_URL", "CONNECTION_STRING", "DSN", "NPM_AUTH",
+    "PGPASSWORD", "MYSQL_PWD", "SSHPASS", "GPG_PASSPHRASE", "GH_PAT", "GITHUB_PAT",
+    "NPM_CONFIG__AUTH", "NPM_CONFIG__AUTHTOKEN",
+]);
 export function isSecretEnvKey(key) {
     return SECRET_ENV_RE.test(key) || SECRET_ENV_EXACT_NAMES.has(key.toUpperCase());
 }

package/dist/core/sensitive-path-policy.js

@@ -14,6 +14,9 @@ export const RECOMMENDED_SENSITIVE_PATTERNS = [
     ".ssh",
     ".git/hooks",
     ".git/config",
+    ".git/modules",
+    ".mcp.json",
+    ".claude*",
     ".aws",
     ".config/gcloud",
     ".azure",
@@ -24,15 +27,18 @@ export const RECOMMENDED_SENSITIVE_PATTERNS = [
     ".zsh_history",
 ];
 function segmentGlobToRegExp(segment) {
-    const escaped = segment.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, "[^/]*");
+    const escaped = segment.replace(/[.+^${}()|[\]\\?]/g, "\\$&").replace(/\*/g, "[^/]*");
     return new RegExp(`^${escaped}$`);
 }
 function compilePatterns(patterns) {
     const out = [];
     for (const raw of patterns) {
         const segments = raw.split("/").filter(Boolean).map(segmentGlobToRegExp);
-        if (segments.length > 0)
-            out.push({ raw, segments });
+        if (segments.length === 0) {
+            throw new Error(`createSensitivePathPolicy: pattern ${JSON.stringify(raw)} contains no path segments and would guard nothing. ` +
+                `Patterns are "/"-separated runs of path SEGMENTS (e.g. ".ssh", ".git/hooks", "*.pem"); remove the entry or spell the segments.`);
+        }
+        out.push({ raw, segments });
     }
     return out;
 }

package/dist/core/store-contracts/session-repo-contract.js

@@ -32,5 +32,45 @@ export async function sessionRepoContract(make, runAssertion) {
         const repo = make();
         await assert.rejects(repo.open({ id: "0198fa00-0000-7000-8000-0000000000ff", createdAt: "" }), /not.?found/i);
     });
+    run("delete() makes the id not_found — the history is gone, not merely hidden from open()", async () => {
+        const repo = make();
+        const sess = await repo.create({ id: A });
+        await sess.getStorage().appendEntry(SESSION_ENTRY("e1", null));
+        await repo.delete({ id: A, createdAt: "" });
+        await assert.rejects(repo.open({ id: A, createdAt: "" }), /not.?found/i);
+        const fresh = await repo.create({ id: A });
+        assert.deepEqual((await fresh.getStorage().getEntries()).map((e) => e.id), []);
+    });
+    run("fork() copies the log, stamps forkedFrom, and leaves the SOURCE untouched", async () => {
+        const repo = make();
+        const src = await repo.create({ id: A });
+        await src.getStorage().appendEntry(SESSION_ENTRY("e1", null));
+        await src.getStorage().appendEntry(SESSION_ENTRY("e2", "e1"));
+        const B = "0198fa00-0000-7000-8000-00000000000b";
+        const forked = await repo.fork({ id: A, createdAt: "" }, { id: B });
+        assert.deepEqual((await forked.getStorage().getEntries()).map((e) => e.id), ["e1", "e2"]);
+        assert.equal((await forked.getMetadata()).forkedFrom, A, "fork lineage must be stamped (a reap walks it)");
+        await src.getStorage().appendEntry(SESSION_ENTRY("e3", "e2"));
+        assert.deepEqual((await (await repo.open({ id: A, createdAt: "" })).getStorage().getEntries()).map((e) => e.id), ["e1", "e2", "e3"]);
+        assert.deepEqual((await (await repo.open({ id: B, createdAt: "" })).getStorage().getEntries()).map((e) => e.id), ["e1", "e2"]);
+    });
+    run("exportEntries → importEntries round-trips the log verbatim, and the imported session REPLACES what was there", async () => {
+        const repo = make();
+        if (repo.exportEntries === undefined || repo.importEntries === undefined)
+            return;
+        const src = await repo.create({ id: A });
+        await src.getStorage().appendEntry(SESSION_ENTRY("e1", null));
+        await src.getStorage().appendEntry(SESSION_ENTRY("e2", "e1"));
+        const donor = await repo.exportEntries(A);
+        assert.deepEqual(donor.map((e) => e.id), ["e1", "e2"]);
+        const C = "0198fa00-0000-7000-8000-00000000000c";
+        const target = await repo.create({ id: C });
+        await target.getStorage().appendEntry(SESSION_ENTRY("old", null));
+        await repo.importEntries(C, undefined, donor);
+        const after = await repo.exportEntries(C);
+        assert.deepEqual(after.map((e) => e.id), ["e1", "e2"]);
+        assert.deepEqual(after.map((e) => e.parentId), [null, "e1"]);
+        assert.equal((await repo.exportEntries(A)).length, 2, "importing into C must not disturb the donor session");
+    });
     await settle();
 }

package/dist/core/task-registry-monitor.js

@@ -42,7 +42,13 @@ export function registerMonitorLane(core, input) {
         ...(input.sessionId !== undefined ? { spillSessionId: input.sessionId } : {}),
     };
     core.handles.set(id, handle);
-    startMonitorWatcherLane(core, id);
+    try {
+        startMonitorWatcherLane(core, id);
+    }
+    catch (e) {
+        core.handles.delete(id);
+        throw e;
+    }
     return id;
 }
 function spillRolledMonitorChunk(handle, stream, dropped) {