@sema-agent/core 2.13.0 → 4.0.0

package/dist/engine/lsp/stdio-lsp-transport.js

@@ -16,7 +16,17 @@ export class StdioLspTransport {
             for (const frame of this.decode(chunk))
                 this.onMessage(frame);
         });
-        child.stdin.on("error", () => { });
+        child.stdin.on("error", (e) => this.failAll(toError(e)));
+        const stdout = child.stdout;
+        if (typeof stdout.removeListener === "function" && typeof stdout.once === "function") {
+            for (const event of ["end", "close", "error"]) {
+                stdout.on(event, (arg) => {
+                    if (Buffer.isBuffer(arg))
+                        return;
+                    this.failAll(new Error(`LSP server stdout ${event}`));
+                });
+            }
+        }
         child.on("exit", () => this.failAll(new Error("LSP server exited")));
         child.on("error", (e) => this.failAll(toError(e)));
     }
@@ -36,7 +46,8 @@ export class StdioLspTransport {
                 try {
                     this.send({ jsonrpc: "2.0", id: msg.id, error: { code: -32601, message: `Method not found: ${String(msg.method)}` } });
                 }
-                catch {
+                catch (e) {
+                    this.failAll(toError(e));
                 }
             }
             return;
@@ -121,10 +132,7 @@ export class StdioLspTransport {
                 this.send({ jsonrpc: "2.0", id, method, params });
             }
             catch (e) {
-                if (this.pending.delete(id)) {
-                    cleanup();
-                    reject(brandLspFailure(e instanceof Error ? e : new Error(String(e)), "server_terminated"));
-                }
+                this.failAll(brandLspFailure(e instanceof Error ? e : new Error(String(e)), "server_terminated"));
             }
         });
     }
@@ -134,7 +142,8 @@ export class StdioLspTransport {
         try {
             this.send({ jsonrpc: "2.0", method, params });
         }
-        catch {
+        catch (e) {
+            this.failAll(toError(e));
         }
     }
     async close() {

package/dist/engine/session/memory-repo.d.ts

@@ -1,4 +1,4 @@
-import { type Session, type SessionMetadata, type SessionRepo, type SessionTreeEntry } from "../harness/types.js";
+import { type Session, type SessionForkOptions, type SessionMetadata, type SessionRepo, type SessionTreeEntry } from "../harness/types.js";
 export declare class InMemorySessionRepo implements SessionRepo<SessionMetadata, {
     id?: string;
 }> {
@@ -9,11 +9,7 @@ export declare class InMemorySessionRepo implements SessionRepo<SessionMetadata,
     open(metadata: SessionMetadata): Promise<Session>;
     list(): Promise<SessionMetadata[]>;
     delete(metadata: SessionMetadata): Promise<void>;
-    fork(sourceMetadata: SessionMetadata, options: {
-        entryId?: string;
-        position?: "before" | "at";
-        id?: string;
-    }): Promise<Session>;
+    fork(sourceMetadata: SessionMetadata, options: SessionForkOptions): Promise<Session>;
     exportEntries(sessionId: string): Promise<SessionTreeEntry[]>;
     importEntries(sessionId: string, owner: string | undefined, entries: SessionTreeEntry[]): Promise<void>;
 }

package/dist/engine/session/session.d.ts

@@ -1,7 +1,8 @@
 import type { ImageContent, TextContent } from "../llm/index.js";
 import type { AgentMessage } from "../loop/types.js";
-import type { Session, SessionContext, SessionMetadata, SessionStorage, SessionTreeEntry } from "../harness/types.js";
+import type { Session, SessionContext, SessionMetadata, SessionStorage, SessionTreeEntry, WorkspaceState } from "../harness/types.js";
 import type { BuildContextOptions } from "../harness/types.js";
+import type { PromptEpochDescriptor } from "../../prompt-assembly/epoch.js";
 export declare function buildSessionContext(pathEntries: SessionTreeEntry[], opts?: BuildContextOptions): SessionContext;
 export declare class StoredSession<TMetadata extends SessionMetadata = SessionMetadata> implements Session<TMetadata> {
     private storage;
@@ -19,40 +20,14 @@ export declare class StoredSession<TMetadata extends SessionMetadata = SessionMe
     appendMessage(message: AgentMessage): Promise<string>;
     appendThinkingLevelChange(thinkingLevel: string): Promise<string>;
     appendModelChange(provider: string, modelId: string): Promise<string>;
-    appendPromptEpoch(descriptor: {
-        epoch: number;
-        artifactDigest: string;
-        packId: string;
-        assemblyApi: number;
-        activatedBy: "session_start" | "compaction" | "legacy_migration";
-        centerArtifactDigest?: string;
-        sourceRevision?: string;
-    }): Promise<string>;
+    appendPromptEpoch(descriptor: PromptEpochDescriptor): Promise<string>;
     appendAnnouncedListing(snapshot: {
         agents?: readonly string[];
         skills?: readonly string[];
         models?: readonly string[];
     }): Promise<string>;
-    appendWorkspaceState(state: {
-        taskRoot: string;
-        handsCwd?: string;
-        activeWorktree?: {
-            worktreeDir: string;
-            originalCwd: string;
-            baseSha: string;
-            entered?: boolean;
-        };
-    }): Promise<string>;
-    getWorkspaceState(): Promise<{
-        taskRoot: string;
-        handsCwd?: string;
-        activeWorktree?: {
-            worktreeDir: string;
-            originalCwd: string;
-            baseSha: string;
-            entered?: boolean;
-        };
-    } | undefined>;
+    appendWorkspaceState(state: WorkspaceState): Promise<string>;
+    getWorkspaceState(): Promise<WorkspaceState | undefined>;
     getAnnouncedListing(): Promise<{
         agents?: string[];
         skills?: string[];

package/dist/index.d.ts

@@ -14,7 +14,7 @@ export { assembleCodeTools, type CodeToolsConfig, CODE_ROLE } from "./scenarios/
 export { capAggregateToolResults, AGGREGATE_TOOL_RESULT_BUDGET_CHARS, DEFAULT_BUDGET_EXEMPT_TOOLS, type AggregateBudgetOptions, } from "./core/tool-result-budget.js";
 export { capAggregateMediaBytes, AGGREGATE_MEDIA_BUDGET_BYTES, type MediaStripInfo } from "./core/media-byte-cap.js";
 export { createAskUserQuestionTool, createDurableQuestionPolicy, QUESTION_AWAITS_RESUME, type OnQuestion, type AskQuestion, type AskQuestionOption, type AskQuestionRequest, type QuestionAnswer, type QuestionAnswerItem, } from "./core/ask-question.js";
-export { createLspTool, gitCheckIgnoreFilter, LSP_OPERATIONS, LSP_FAILURE_BRAND, brandLspFailure, lspFailureOf, type LspNoneReason, type LspOperation, type LspServerManager, type LspSession, type LspResult, type LspLocation, type LspSymbolInfo, type LspRequestParams, type LspToolOptions, type LspTransport, type LspReadText, } from "./core/lsp.js";
+export { createLspTool, gitCheckIgnoreFilter, LSP_OPERATIONS, LSP_FAILURE_BRAND, brandLspFailure, lspFailureOf, SharedAbortScope, settleOnAbort, type LspNoneReason, type LspOperation, type LspServerManager, type LspSession, type LspResult, type LspLocation, type LspSymbolInfo, type LspRequestParams, type LspToolOptions, type LspTransport, type LspReadText, } from "./core/lsp.js";
 export { buildRequest, parseResult, callHierarchyMethod, pathToUri } from "./core/lsp-protocol.js";
 export { TransportLspSession, type SessionWarmup } from "./core/lsp-session.js";
 export { LspDiagnosticsRegistry, formatDiagnosticsBlock, formatDiagnosticsSummary, type LspDiagnostic, type LspFileDiagnostics, } from "./core/lsp-diagnostics.js";
@@ -27,6 +27,7 @@ export { BrainError, classifyHttp, type BrainErrorCode } from "./brain/errors.js
 export { looksDegenerate, inspectDegenerate, trimDegenerateTail } from "./brain/repetition.js";
 export type { RepetitionEvent, RepetitionInspection } from "./brain/repetition.js";
 export { computeCostMicroUsd, modelCostToPricing, type ModelPricing, type TokenCounts, } from "./core/pricing.js";
+export { cacheFamilyOf, promptTokensOf, uncachedInputTokensOf, type CacheFamily } from "./core/runner/usage-accounting.js";
 export { emitTrace, type TraceEvent, type TracerHook } from "./core/trace.js";
 export { InMemoryStrategyStore, type StrategyStore, type StoredStrategy } from "./core/strategy-store.js";
 export { createSqlTool, validateReadOnlySql, type SqlToolOptions } from "./tools/sql.js";
@@ -56,6 +57,7 @@ export { getShellConfig, isWslBashLauncher } from "./engine/execution-env/node-e
 export { isSecretEnvKey, scrubSecretEnv } from "./core/secret-env.js";
 export { MAX_EXEC_OUTPUT_BYTES, RollingTailBuffer, markTruncated } from "./core/exec-output-tail.js";
 export type { ExecutionEnv, FileInfo, Result, FileErrorCode, ExecutionErrorCode } from "./internal/harness.js";
+export type { ExecResult } from "./internal/harness.js";
 export { RemoteExecutionError, hasDestroy, isRemoteExecutionEnv, isSuspendable, isIsolated, missingRestoreSurface, isRetryableRemoteErrorCode, RETRYABLE_REMOTE_ERROR_CODES, } from "./core/remote-env.js";
 export { withRetry } from "./core/with-retry.js";
 export type { RetryPolicy, RetryResult } from "./core/with-retry.js";

package/dist/index.js

@@ -12,7 +12,7 @@ export { assembleCodeTools, CODE_ROLE } from "./scenarios/full-body.js";
 export { capAggregateToolResults, AGGREGATE_TOOL_RESULT_BUDGET_CHARS, DEFAULT_BUDGET_EXEMPT_TOOLS, } from "./core/tool-result-budget.js";
 export { capAggregateMediaBytes, AGGREGATE_MEDIA_BUDGET_BYTES } from "./core/media-byte-cap.js";
 export { createAskUserQuestionTool, createDurableQuestionPolicy, QUESTION_AWAITS_RESUME, } from "./core/ask-question.js";
-export { createLspTool, gitCheckIgnoreFilter, LSP_OPERATIONS, LSP_FAILURE_BRAND, brandLspFailure, lspFailureOf, } from "./core/lsp.js";
+export { createLspTool, gitCheckIgnoreFilter, LSP_OPERATIONS, LSP_FAILURE_BRAND, brandLspFailure, lspFailureOf, SharedAbortScope, settleOnAbort, } from "./core/lsp.js";
 export { buildRequest, parseResult, callHierarchyMethod, pathToUri } from "./core/lsp-protocol.js";
 export { TransportLspSession } from "./core/lsp-session.js";
 export { LspDiagnosticsRegistry, formatDiagnosticsBlock, formatDiagnosticsSummary, } from "./core/lsp-diagnostics.js";
@@ -24,6 +24,7 @@ export { selectModel, selectModelOrThrow } from "./core/select-model.js";
 export { BrainError, classifyHttp } from "./brain/errors.js";
 export { looksDegenerate, inspectDegenerate, trimDegenerateTail } from "./brain/repetition.js";
 export { computeCostMicroUsd, modelCostToPricing, } from "./core/pricing.js";
+export { cacheFamilyOf, promptTokensOf, uncachedInputTokensOf } from "./core/runner/usage-accounting.js";
 export { emitTrace } from "./core/trace.js";
 export { InMemoryStrategyStore } from "./core/strategy-store.js";
 export { createSqlTool, validateReadOnlySql } from "./tools/sql.js";

package/dist/internal/harness-types.d.ts

@@ -3,5 +3,7 @@ export type { InvokedSkillRetention } from "../engine/compaction/utils.js";
 export type { AgentCoreRuntimeDeps } from "../engine/loop/runtime-deps.js";
 export type { AgentMessage, AgentTool, AgentToolResult, AgentToolUpdateCallback, ThinkingLevel, ToolExecutionMode, } from "../engine/loop/types.js";
 export type { AgentHarnessEvent, CompactionSettings, ExecutionEnv, ExecutionErrorCode, FileErrorCode, FileInfo, Result, Session, SessionMetadata, SessionRepo, SessionStorage, SessionTreeEntry, Skill, } from "../engine/harness/types.js";
-export type { ExecutionEnvExecOptions } from "../engine/harness/types.js";
+export type { ExecutionEnvExecOptions, ExecResult } from "../engine/harness/types.js";
 export type { SessionWriteOptions, CompactionEntry } from "../engine/harness/types.js";
+export type { ActiveWorktreeSession, WorkspaceState } from "../engine/harness/types.js";
+export type { SessionForkOptions } from "../engine/harness/types.js";

package/dist/internal/harness.d.ts

@@ -2,7 +2,7 @@ export * from "./harness-types.js";
 export { AgentHarness } from "../engine/harness/agent-harness.js";
 export { CompactionError, ExecutionError, FileError, ok, err } from "../engine/harness/types.js";
 export { DEFAULT_CHARS_PER_TOKEN, DEFAULT_CLAMP_TOLERANCE, DEFAULT_COMPACTION_SETTINGS, compact, computeFileLists, dryRunSummarizationClamp, estimateContextTokens, estimateTokens, prepareCompaction, shouldCompact, summaryOutputBudgetTokens, } from "../engine/compaction/compaction.js";
-export { SKILL_RETENTION_PER_SKILL_MAX_CHARS, SKILL_RETENTION_TOTAL_MAX_CHARS, SKILL_RETENTION_TRUNCATION_MARKER, formatPersistedOutputRefs, readCompactionActiveTools, readRetainedInvokedSkills, renderInvokedSkillsRetention, } from "../engine/compaction/utils.js";
+export { SKILL_RETENTION_PER_SKILL_MAX_CHARS, SKILL_RETENTION_TOTAL_MAX_CHARS, SKILL_RETENTION_TRUNCATION_MARKER, formatFileOperations, formatPersistedOutputRefs, readCompactionActiveTools, readRetainedInvokedSkills, renderInvokedSkillsRetention, } from "../engine/compaction/utils.js";
 export { NodeExecutionEnv } from "../engine/execution-env/node-execution-env.js";
 export { StoredSession, buildSessionContext } from "../engine/session/session.js";
 export { getEntriesToFork } from "../engine/session/repo-utils.js";

package/dist/internal/harness.js

@@ -2,7 +2,7 @@ export * from "./harness-types.js";
 export { AgentHarness } from "../engine/harness/agent-harness.js";
 export { CompactionError, ExecutionError, FileError, ok, err } from "../engine/harness/types.js";
 export { DEFAULT_CHARS_PER_TOKEN, DEFAULT_CLAMP_TOLERANCE, DEFAULT_COMPACTION_SETTINGS, compact, computeFileLists, dryRunSummarizationClamp, estimateContextTokens, estimateTokens, prepareCompaction, shouldCompact, summaryOutputBudgetTokens, } from "../engine/compaction/compaction.js";
-export { SKILL_RETENTION_PER_SKILL_MAX_CHARS, SKILL_RETENTION_TOTAL_MAX_CHARS, SKILL_RETENTION_TRUNCATION_MARKER, formatPersistedOutputRefs, readCompactionActiveTools, readRetainedInvokedSkills, renderInvokedSkillsRetention, } from "../engine/compaction/utils.js";
+export { SKILL_RETENTION_PER_SKILL_MAX_CHARS, SKILL_RETENTION_TOTAL_MAX_CHARS, SKILL_RETENTION_TRUNCATION_MARKER, formatFileOperations, formatPersistedOutputRefs, readCompactionActiveTools, readRetainedInvokedSkills, renderInvokedSkillsRetention, } from "../engine/compaction/utils.js";
 export { NodeExecutionEnv } from "../engine/execution-env/node-execution-env.js";
 export { StoredSession, buildSessionContext } from "../engine/session/session.js";
 export { getEntriesToFork } from "../engine/session/repo-utils.js";

package/dist/orchestration/run-spec.js

@@ -4,8 +4,10 @@ import { isAbsolute, resolve, sep } from "node:path";
 import { combinePolicies } from "../core/tool-policy.js";
 import { delimitUntrusted } from "../core/untrusted-text.js";
 import { isDurablePause } from "../agents/suspend-guard.js";
+import { isAbsolutePathForm, writeTargetPath } from "../tools/fs/safety.js";
+import { canonicalToolName } from "../core/tool-name-aliases.js";
 import { captureBaseline, resolveFrozenPaths, restoreFrozenPaths, runOracle, snapshotFrozenPaths, specError, } from "../core/spec-contract.js";
-const WRITE_TOOLS = new Set(["Write", "Edit", "MultiEdit", "NotebookEdit"]);
+const WRITE_TOOLS = new Set(["Write", "Edit", "MultiEdit", "NotebookEdit"].map(canonicalToolName));
 const CASE_INSENSITIVE_FS = process.platform === "darwin" || process.platform === "win32";
 const pathKey = (p) => {
     let n = p.replace(/\\/g, "/");
@@ -17,13 +19,14 @@ function frozenDenyPolicy(rootDir, frozenResolved) {
     const frozen = new Set(frozenResolved.map(pathKey));
     return {
         check(req) {
-            if (!WRITE_TOOLS.has(req.toolName))
+            const toolName = canonicalToolName(req.toolName);
+            if (!WRITE_TOOLS.has(toolName))
                 return { action: "allow" };
             const args = req.args;
-            const raw = args?.file_path ?? args?.path ?? args?.notebook_path;
+            const raw = writeTargetPath(toolName, args);
             if (typeof raw !== "string" || raw.length === 0)
                 return { action: "allow" };
-            const absForm = raw.startsWith("/") || /^[A-Za-z]:[\\/]/.test(raw);
+            const absForm = isAbsolutePathForm(raw);
             const abs = pathKey(absForm ? raw : resolve(rootDir, raw));
             if (frozen.has(abs)) {
                 return { action: "deny", reason: `${raw} is part of the frozen specification surface (read-only).` };

package/dist/orchestration/run-workflow-tool.js

@@ -456,7 +456,7 @@ export async function createRunWorkflowTool(d) {
                     },
                 });
             }
-            if (d.notifier) {
+            {
                 let notified = false;
                 const fire = (notification) => {
                     if (notified)
@@ -467,6 +467,8 @@ export async function createRunWorkflowTool(d) {
                     }
                     catch {
                     }
+                    if (!d.notifier)
+                        return;
                     void Promise.resolve()
                         .then(() => d.notifier.notify({
                         runId,
@@ -507,40 +509,6 @@ export async function createRunWorkflowTool(d) {
                 }))
                     .catch(() => { });
             }
-            else {
-                let notified = false;
-                const fire = (notification) => {
-                    if (notified)
-                        return;
-                    notified = true;
-                    try {
-                        d.taskNotification?.(notification);
-                    }
-                    catch {
-                    }
-                };
-                handle.done
-                    .then((res) => fire({
-                    task_id: runId,
-                    task_type: "workflow",
-                    ...(ctx.toolCallId !== undefined ? { toolUseId: ctx.toolCallId } : {}),
-                    status: "completed",
-                    summary: completionSummary(meta.name, res.run),
-                    result: boundedRedactedSummary(res.result, 4000),
-                    usage: workflowUsageBlock(res.run),
-                    diagnostics: workflowDiagnostics(runId, d.journalStore?.locator?.(runId, res.run.scope), res.run.resume?.journalEntries === 0),
-                    completionId: res.run.completionId,
-                }), (err) => fire({
-                    task_id: runId,
-                    task_type: "workflow",
-                    ...(ctx.toolCallId !== undefined ? { toolUseId: ctx.toolCallId } : {}),
-                    status: "failed",
-                    summary: failureSummary(err, runId),
-                    diagnostics: workflowDiagnostics(runId, undefined),
-                    ...(completionIdFromRejection(err) !== undefined ? { completionId: completionIdFromRejection(err) } : {}),
-                }))
-                    .catch(() => { });
-            }
             return {
                 details: { type: "workflow-run", status: "backgrounded", workflowRunId: runId },
                 content: JSON.stringify({

package/dist/orchestration/workflow-governance.js

@@ -37,6 +37,32 @@ function minDefined(...vals) {
     const xs = vals.filter((v) => typeof v === "number" && Number.isFinite(v));
     return xs.length ? Math.min(...xs) : undefined;
 }
+function minPositiveDefined(...vals) {
+    const xs = vals.filter((v) => typeof v === "number" && Number.isFinite(v) && v > 0);
+    return xs.length ? Math.min(...xs) : undefined;
+}
+const NON_POSITIVE_LIMIT_MSG = (field, what) => `agent(spec): \`limits.${field}\` must be a POSITIVE number — a value of 0 or less DISABLES the ${what} ` +
+    `downstream (it is a sentinel, not a tighter ceiling), and a workflow script may only tighten a limit, never remove it`;
+function pickImageInput(el, i) {
+    const at = `agent(spec): \`images[${i}]\``;
+    if (typeof el !== "object" || el === null || Array.isArray(el)) {
+        throw new WorkflowScriptError(`${at} must be an object — either { url } or { data, mimeType }`);
+    }
+    const o = el;
+    if ("url" in o) {
+        if (typeof o.url !== "string" || o.url.length === 0) {
+            throw new WorkflowScriptError(`${at}.url must be a non-empty string`);
+        }
+        return { url: o.url };
+    }
+    if (typeof o.data !== "string") {
+        throw new WorkflowScriptError(`${at}.data must be a base64 string (or supply { url } instead)`);
+    }
+    if (typeof o.mimeType !== "string" || o.mimeType.length === 0) {
+        throw new WorkflowScriptError(`${at}.mimeType must be a non-empty string, e.g. "image/png"`);
+    }
+    return { data: o.data, mimeType: o.mimeType };
+}
 function pickWhitelist(scriptSpec) {
     if (typeof scriptSpec !== "object" || scriptSpec === null || Array.isArray(scriptSpec)) {
         throw new WorkflowScriptError("agent(spec): spec must be an object with at least an `objective` string");
@@ -60,7 +86,7 @@ function pickWhitelist(scriptSpec) {
     if (s.images !== undefined) {
         if (!Array.isArray(s.images))
             throw new WorkflowScriptError("agent(spec): `images` must be an array");
-        safe.images = s.images;
+        safe.images = s.images.map(pickImageInput);
     }
     if (s.limits !== undefined) {
         if (typeof s.limits !== "object" || s.limits === null || Array.isArray(s.limits)) {
@@ -71,11 +97,15 @@ function pickWhitelist(scriptSpec) {
         if (l.maxTurns !== undefined) {
             if (typeof l.maxTurns !== "number" || !Number.isFinite(l.maxTurns))
                 throw new WorkflowScriptError("agent(spec): `limits.maxTurns` must be a number");
+            if (l.maxTurns <= 0)
+                throw new WorkflowScriptError(NON_POSITIVE_LIMIT_MSG("maxTurns", "turn cap"));
             limits.maxTurns = l.maxTurns;
         }
         if (l.timeoutSec !== undefined) {
             if (typeof l.timeoutSec !== "number" || !Number.isFinite(l.timeoutSec))
                 throw new WorkflowScriptError("agent(spec): `limits.timeoutSec` must be a number");
+            if (l.timeoutSec <= 0)
+                throw new WorkflowScriptError(NON_POSITIVE_LIMIT_MSG("timeoutSec", "wall-clock window"));
             limits.timeoutSec = l.timeoutSec;
         }
         safe.limits = limits;
@@ -116,20 +146,24 @@ function clampResourceLimits(safe, base, caps) {
     }
     const requestedTimeoutSec = safe.limits?.timeoutSec;
     const requestedMaxTurns = safe.limits?.maxTurns;
-    const timeoutSec = minDefined(safe.limits?.timeoutSec, base.limits?.timeoutSec, caps?.perAgentTimeoutSec);
-    const maxTurns = minDefined(safe.limits?.maxTurns, base.limits?.maxTurns, caps?.childMaxTurns);
+    const timeoutSec = minPositiveDefined(safe.limits?.timeoutSec, base.limits?.timeoutSec, caps?.perAgentTimeoutSec);
+    const maxTurns = minPositiveDefined(safe.limits?.maxTurns, base.limits?.maxTurns, caps?.childMaxTurns);
     if (timeoutSec !== undefined && timeoutSec !== requestedTimeoutSec) {
         notes.push({ field: "timeoutSec", requested: requestedTimeoutSec, applied: timeoutSec });
     }
     if (maxTurns !== undefined && maxTurns !== requestedMaxTurns) {
         notes.push({ field: "maxTurns", requested: requestedMaxTurns, applied: maxTurns });
     }
-    if (timeoutSec !== undefined || maxTurns !== undefined) {
-        safe.limits = {
-            ...(maxTurns !== undefined ? { maxTurns } : {}),
-            ...(timeoutSec !== undefined ? { timeoutSec } : {}),
-        };
-    }
+    const baseOtherLimits = { ...base.limits };
+    delete baseOtherLimits.maxTurns;
+    delete baseOtherLimits.timeoutSec;
+    const rebuilt = {
+        ...baseOtherLimits,
+        ...(maxTurns !== undefined ? { maxTurns } : {}),
+        ...(timeoutSec !== undefined ? { timeoutSec } : {}),
+    };
+    if (base.limits !== undefined || Object.keys(rebuilt).length > 0)
+        safe.limits = rebuilt;
     return notes;
 }
 export function buildGovernedChildSpec(scriptSpec, baseline, models, caps, onResourceClamp) {

package/dist/orchestration/workflow-sandbox-conformance.js

@@ -1,20 +1,31 @@
 import assert from "node:assert/strict";
 const META = "export const meta = { name: 'conformance', description: 'sandbox escape probes' }\n";
+const WITNESS_FN = "__probeWitness";
+const WITNESS_PRELUDE = `function ${WITNESS_FN}(v) {\n` +
+    `  if (v === null || v === undefined) return null\n` +
+    `  var t = typeof v\n` +
+    `  if (t === 'function') return { hostCapabilityReached: true, via: 'function' }\n` +
+    `  if (t !== 'object') return null\n` +
+    `  var names = ['pid', 'env', 'version', 'mainModule', 'binding']\n` +
+    `  var hit = []\n` +
+    `  for (var i = 0; i < names.length; i++) { try { if (names[i] in v) hit.push(names[i]) } catch (err) { } }\n` +
+    `  return hit.length > 0 ? { hostCapabilityReached: true, via: 'object', keys: hit } : null\n` +
+    `}\n`;
 const ESCAPE_BODIES = [
-    `return agent.constructor.constructor("return typeof process !== 'undefined' ? process : null")()`,
-    `return log.constructor.constructor("return typeof process !== 'undefined' ? process : null")()`,
-    `return budget.constructor.constructor("return typeof process !== 'undefined' ? process : null")()`,
-    `return ({}).constructor.constructor("return typeof process !== 'undefined' ? process : null")()`,
-    `return args.constructor.constructor("return typeof require !== 'undefined' ? require : null")()`,
-    `const r = await agent({ objective: 'x' }); return (r ?? {}).constructor.constructor("return typeof require !== 'undefined' ? require : null")()`,
-    `return (typeof process !== 'undefined' ? process : null)`,
-    `return (typeof require !== 'undefined' ? require : null)`,
-    `return (typeof globalThis !== 'undefined' && globalThis.process) ? globalThis.process : null`,
+    `return ${WITNESS_FN}(agent.constructor.constructor("return typeof process !== 'undefined' ? process : null")())`,
+    `return ${WITNESS_FN}(log.constructor.constructor("return typeof process !== 'undefined' ? process : null")())`,
+    `return ${WITNESS_FN}(budget.constructor.constructor("return typeof process !== 'undefined' ? process : null")())`,
+    `return ${WITNESS_FN}(({}).constructor.constructor("return typeof process !== 'undefined' ? process : null")())`,
+    `return ${WITNESS_FN}(args.constructor.constructor("return typeof require !== 'undefined' ? require : null")())`,
+    `const r = await agent({ objective: 'x' }); return ${WITNESS_FN}((r ?? {}).constructor.constructor("return typeof require !== 'undefined' ? require : null")())`,
+    `return ${WITNESS_FN}(typeof process !== 'undefined' ? process : null)`,
+    `return ${WITNESS_FN}(typeof require !== 'undefined' ? require : null)`,
+    `return ${WITNESS_FN}((typeof globalThis !== 'undefined' && globalThis.process) ? globalThis.process : null)`,
 ];
 const ERROR_PATH_BODIES = [
-    `try { await agent({ objective: 'x' }); return null } catch (e) { return e.constructor.constructor("return typeof process !== 'undefined' ? process : null")() }`,
-    `try { await parallel([]); return null } catch (e) { return e.constructor.constructor("return typeof require !== 'undefined' ? require : null")() }`,
-    `try { await agent({}); return null } catch (e) { return (e && e.constructor && e.constructor.constructor) ? e.constructor.constructor("return (typeof globalThis !== 'undefined' && globalThis.process) ? globalThis.process : null")() : null }`,
+    `try { await agent({ objective: 'x' }); return null } catch (e) { return ${WITNESS_FN}(e.constructor.constructor("return typeof process !== 'undefined' ? process : null")()) }`,
+    `try { await parallel([]); return null } catch (e) { return ${WITNESS_FN}(e.constructor.constructor("return typeof require !== 'undefined' ? require : null")()) }`,
+    `try { await agent({}); return null } catch (e) { return ${WITNESS_FN}((e && e.constructor && e.constructor.constructor) ? e.constructor.constructor("return (typeof globalThis !== 'undefined' && globalThis.process) ? globalThis.process : null")() : null) }`,
 ];
 const POLLUTION_BODIES = [
     `return JSON.parse('{"__proto__":{"polluted":1}}')`,
@@ -24,9 +35,9 @@ const POLLUTION_BODIES = [
     `return [JSON.parse('{"__proto__":{"polluted":1}}')]`,
 ];
 const SIGNAL_BODIES = [
-    `return (typeof signal !== 'undefined' && signal) ? signal.constructor.constructor("return typeof process !== 'undefined' ? process : null")() : null`,
-    `return (typeof input !== 'undefined' && input && input.signal) ? input.signal.constructor.constructor("return typeof process !== 'undefined' ? process : null")() : null`,
-    `try { return (typeof signal !== 'undefined' && signal) ? (signal.addEventListener ? signal.addEventListener.constructor("return typeof process !== 'undefined' ? process : null")() : null) : null } catch (e) { return null }`,
+    `return ${WITNESS_FN}((typeof signal !== 'undefined' && signal) ? signal.constructor.constructor("return typeof process !== 'undefined' ? process : null")() : null)`,
+    `return ${WITNESS_FN}((typeof input !== 'undefined' && input && input.signal) ? input.signal.constructor.constructor("return typeof process !== 'undefined' ? process : null")() : null)`,
+    `try { return ${WITNESS_FN}((typeof signal !== 'undefined' && signal) ? (signal.addEventListener ? signal.addEventListener.constructor("return typeof process !== 'undefined' ? process : null")() : null) : null) } catch (e) { return null }`,
 ];
 function benignPrimitives() {
     return {
@@ -84,6 +95,49 @@ function looksLikeHostCapability(v) {
     }
     return false;
 }
+function witnessReportsHostCapability(v) {
+    return typeof v === "object" && v !== null && v.hostCapabilityReached === true;
+}
+function reachedHostCapability(v) {
+    return looksLikeHostCapability(v) || witnessReportsHostCapability(v);
+}
+const CANARY_MARKER = "workflow-conformance-canary";
+let canarySeq = 0;
+const CANARY_BODY = `const c = args.canary\n` +
+    `return { marker: '${CANARY_MARKER}', nonce: c.nonce, sum: c.x + c.y, joined: ['${CANARY_MARKER}', c.nonce].join(':') }`;
+async function runLivenessCanary(runner) {
+    const nonce = `n${++canarySeq}`;
+    const scriptArgs = { canary: { nonce, x: 17, y: 25 } };
+    let result;
+    try {
+        const out = await runner.run({ scriptSource: META + CANARY_BODY, primitives: benignPrimitives(), scriptArgs });
+        result = out.result;
+    }
+    catch (err) {
+        return { ok: false, detail: `run() REJECTED with: ${err instanceof Error ? err.message : String(err)}` };
+    }
+    const expected = { marker: CANARY_MARKER, nonce, sum: 42, joined: `${CANARY_MARKER}:${nonce}` };
+    try {
+        assert.deepEqual(result, expected);
+    }
+    catch {
+        return { ok: false, detail: `run() returned ${JSON.stringify(result)} — expected ${JSON.stringify(expected)}` };
+    }
+    return { ok: true, detail: "" };
+}
+async function runProbeBody(runner, scriptSource, primitives, family, signal) {
+    try {
+        const out = await runner.run({ scriptSource, primitives, scriptArgs: { probe: true }, signal });
+        return { executed: true, result: out.result };
+    }
+    catch (err) {
+        const live = await runLivenessCanary(runner);
+        assert.ok(live.ok, `${family}: the probe threw AND the runner then failed the liveness canary — this runner is BROKEN, ` +
+            `not blocking, so nothing about its membrane was proven. probe: ${scriptSource.slice(META.length)} | ` +
+            `probe threw: ${err instanceof Error ? err.message : String(err)} | canary: ${live.detail}`);
+        return { executed: false };
+    }
+}
 export async function assertWorkflowPrimitivesWiring(runner) {
     assert.equal(runner.safeForUntrustedScripts, true, "wiring conformance targets a HARD runner (safeForUntrustedScripts must be true)");
     const hostSeen = { phaseCalls: [], scopedBodyRan: false, logs: [] };
@@ -144,54 +198,34 @@ export async function assertWorkflowPrimitivesWiring(runner) {
 }
 export async function assertWorkflowSandboxConformance(runner) {
     assert.equal(runner.safeForUntrustedScripts, true, "conformance is only meaningful for a HARD runner (safeForUntrustedScripts must be true)");
+    const live = await runLivenessCanary(runner);
+    assert.ok(live.ok, `POSITIVE CONTROL FAILED — this runner did not execute the canary script and return its value, so the ` +
+        `escape battery below cannot certify anything about it (a runner that runs nothing produces the same ` +
+        `"nothing leaked" results as a perfect sandbox). ${live.detail}`);
     for (const escBody of ESCAPE_BODIES) {
-        const scriptSource = META + escBody;
-        let result;
-        try {
-            const out = await runner.run({ scriptSource, primitives: benignPrimitives(), scriptArgs: { probe: true } });
-            result = out.result;
-        }
-        catch {
+        const out = await runProbeBody(runner, META + WITNESS_PRELUDE + escBody, benignPrimitives(), "sandbox escape");
+        if (!out.executed)
             continue;
-        }
-        assert.equal(looksLikeHostCapability(result), false, `sandbox escape REACHED a host capability via: ${escBody}`);
+        assert.equal(reachedHostCapability(out.result), false, `sandbox escape REACHED a host capability via: ${escBody}`);
     }
     for (const errBody of ERROR_PATH_BODIES) {
-        const scriptSource = META + errBody;
-        let result;
-        try {
-            const out = await runner.run({ scriptSource, primitives: throwingPrimitives(), scriptArgs: { probe: true } });
-            result = out.result;
-        }
-        catch {
+        const out = await runProbeBody(runner, META + WITNESS_PRELUDE + errBody, throwingPrimitives(), "error-path");
+        if (!out.executed)
             continue;
-        }
-        assert.equal(looksLikeHostCapability(result), false, `error-path: a host-side primitive error leaked a host capability via: ${errBody}`);
+        assert.equal(reachedHostCapability(out.result), false, `error-path: a host-side primitive error leaked a host capability via: ${errBody}`);
     }
     for (const polBody of POLLUTION_BODIES) {
-        const scriptSource = META + polBody;
-        let result;
-        try {
-            const out = await runner.run({ scriptSource, primitives: benignPrimitives(), scriptArgs: { probe: true } });
-            result = out.result;
-        }
-        catch {
+        const out = await runProbeBody(runner, META + polBody, benignPrimitives(), "prototype pollution");
+        if (!out.executed)
             continue;
-        }
-        assert.equal(graphHasInjectedProtoKey(result), false, `prototype pollution: the marshalled result carries an injected __proto__/constructor/prototype own key via: ${polBody}`);
+        assert.equal(graphHasInjectedProtoKey(out.result), false, `prototype pollution: the marshalled result carries an injected __proto__/constructor/prototype own key via: ${polBody}`);
     }
     const hostSignal = new AbortController().signal;
     for (const sigBody of SIGNAL_BODIES) {
-        const scriptSource = META + sigBody;
-        let result;
-        try {
-            const out = await runner.run({ scriptSource, primitives: benignPrimitives(), scriptArgs: { probe: true }, signal: hostSignal });
-            result = out.result;
-        }
-        catch {
+        const out = await runProbeBody(runner, META + WITNESS_PRELUDE + sigBody, benignPrimitives(), "signal-path", hostSignal);
+        if (!out.executed)
             continue;
-        }
-        assert.equal(looksLikeHostCapability(result), false, `signal-path: the host AbortSignal leaked a host capability via: ${sigBody}`);
+        assert.equal(reachedHostCapability(out.result), false, `signal-path: the host AbortSignal leaked a host capability via: ${sigBody}`);
     }
 }
 const DETERMINISM_FORBIDDEN_BODIES = [

package/dist/orchestration/workflow-script-store.js

@@ -1,5 +1,5 @@
-import { mkdirSync, readFileSync, writeFileSync, existsSync } from "node:fs";
-import { join, resolve, sep } from "node:path";
+import { mkdirSync, readFileSync, realpathSync, writeFileSync, existsSync } from "node:fs";
+import { basename, dirname, join, resolve, sep } from "node:path";
 import { sanitizeScope } from "../stores/file/fs-atomic.js";
 function isPlainObject(v) {
     return typeof v === "object" && v !== null && !Array.isArray(v);
@@ -30,6 +30,26 @@ export function normalizeStringArg(callArgs, defaultArgs, key = "topic") {
 function safeFileStem(id) {
     return /^[A-Za-z0-9._-]{1,120}$/.test(id) && !id.startsWith(".") ? id : undefined;
 }
+function containedBy(root, p) {
+    return p === root || p.startsWith(root + sep);
+}
+function canonicalizeDeepestExisting(p) {
+    let cur = p;
+    const missingTail = [];
+    for (;;) {
+        try {
+            const real = realpathSync(cur);
+            return missingTail.length === 0 ? real : join(real, ...[...missingTail].reverse());
+        }
+        catch {
+            const parent = dirname(cur);
+            if (parent === cur)
+                return undefined;
+            missingTail.push(basename(cur));
+            cur = parent;
+        }
+    }
+}
 export function createFileWorkflowScriptStore(dir) {
     const root = resolve(dir);
     const scopeDir = (scope) => join(root, sanitizeScope(scope));
@@ -48,10 +68,20 @@ export function createFileWorkflowScriptStore(dir) {
         load(scriptPath, scope) {
             const base = scopeDir(scope);
             const full = resolve(scriptPath);
-            if (full !== base && !full.startsWith(base + sep)) {
+            if (!containedBy(base, full)) {
                 throw new Error(`workflow script store: scriptPath is outside this scope's script partition`);
             }
-            return readFileSync(full, "utf-8");
+            const physRoot = canonicalizeDeepestExisting(root);
+            const physBase = canonicalizeDeepestExisting(base);
+            const physFull = canonicalizeDeepestExisting(full);
+            const refusePhysical = () => {
+                throw new Error(`workflow script store: scriptPath is outside this scope's script partition after symlink resolution`);
+            };
+            if (physRoot !== undefined && physBase !== undefined && !containedBy(physRoot, physBase))
+                refusePhysical();
+            if (physBase !== undefined && physFull !== undefined && !containedBy(physBase, physFull))
+                refusePhysical();
+            return readFileSync(physFull ?? full, "utf-8");
         },
         resolveName(name) {
             if (/^wf_/i.test(name))