@sema-agent/core 4.0.0 → 5.0.1

package/CHANGELOG.md

@@ -1,5 +1,58 @@
 # Changelog
 
+## 5.0.1 (2026-08-02)
+
+_Post-release review patch: the 5.0.0 review wave (five domain reviewers + two independent codex legs) surfaced silent-widening gaps in the new audit surfaces plus wiring/anchoring stragglers. All fixes are loud-direction; no new API._
+
+**Fixed**
+
+- **Persisted session/ancestor rules join the retired-name audit (review G-2).** Session-rule policies were composed after the only policy-name audit pass and exposed no name metadata — a stored `{toolDeny: ["bash"]}` compiled clean and silently widened. The audit is now a reusable pass run over every narrowing layer, and `createSessionRulePolicy` returns a `NamedToolPolicy`.
+- **Pre-prefix MCP names reach the hard arm (review G-3).** The `config.legacy_tool_name` check only consulted the static `RETIRED_TOOL_NAMES` map, which cannot enumerate dynamic MCP names — a v4-era policy entry like `github__delete_repository` (auto-prefixed by the retired canonicalizer) degraded to an advisory and the destructive call ran. An unmatched `__`-shaped name without the `mcp__` prefix now hard-fails prepare with prefix guidance; an `mcp__*` miss stays advisory (the server may not be mounted this run).
+- **Repair-loop accounts stay live across an in-flight attempt (review G-4, time half).** A checkpoint minted mid-attempt clones the threaded bundle at that instant, and only a pre-dispatch stamp existed — an attempt that ran 900ms and parked persisted ~zero elapsed time, so the resume re-granted the washed budget. An unref'd 1s interval keeps the stamp current. (The money half — mid-flight partial spend — is tracked separately: it has a double-count design question against the resumed attempt's own stats.)
+- **Permission-rule policies join the retired-name audit (review F-6).** `createPermissionRulePolicy` now returns a `NamedToolPolicy` exposing its compiled tool names as `nameSets`, so the prepare-time policy-name audit covers rule policies: a rule written with a RETIRED name (e.g. `{rule: "bash", behavior: "deny"}`) that matches nothing in the run's roster is now the same HARD `config.legacy_tool_name` prepare failure as a list policy — previously it compiled with zero issues and the deny silently guarded nothing. A deployment mounting its own tool under a retired name is unaffected (roster hit). Behavior note: configs carrying such stale rules now fail loudly at prepare instead of running silently widened.
+- **Name-addressed revives anchor correctly (review F-1).** The SendMessage by-name resolution hand-copy dropped `createdAt`, so a `{to: NAME}` revive's spawn frame fell back to the wake instant for `startedAt` — the exact-id rung was fixed in 5.0.0, the name rung is now too.
+- **Two more revive legs chain `root ?? parent` (review F-8).** The revived child's own spec internals and the re-minted registry row now derive the same root anchor as the roster/observer legs — a pre-floor row no longer yields an internally inconsistent agent (fleet view anchored, `canAccess` root arm blind).
+- **The disclosure channel reaches both remaining composition roots (review F-2/F-3).** The runner's SendMessage mount wires `onNotifyError` to the `observer.notify_failed` trace lane, and the delegation tool's steer-lane resume threads `opts.onObserverError` — a throwing deployment sink on either revive path is now disclosed instead of counted on an unread notifier.
+- **Checkpoint mints read the clock once.** All three checkpoint mint points stamped `createdAt` and `deadline` from separate `Date.now()` reads; a mint straddling a ms tick violated `deadline = createdAt + ttl` by 1ms.
+- Comment-truth sweep: 14 sites still narrating the deleted OLD_TO_NEW/tombstone machinery rewritten to post-5.0.0 behavior; `markStopSourceByShellId`'s orphaned docstring relocated and corrected (env is REQUIRED for effect — an env-less call is a no-op).
+
+## 5.0.0 (2026-08-02)
+
+_The baggage-unload major: the compatibility faces RB-476 cleared for tool NAMES are now cleared for id arguments, adapters and indexes too (RB-479), plus the revive-frame anchoring fix a downstream consumer was blocked on (RB-478). Everything that used to resolve silently under an old spelling now refuses loudly with the current spelling named._
+
+**BREAKING — old tool names no longer resolve (RB-476, both stages)**
+
+1. Callable aliases are cleared: `BashOutput`, `KillShell`, `KillBash`, `AgentOutput`, `WorkflowStatus`, `Fork`, `Sleep`, `Remember`, `recall` (and the rest of the rename table) are LOUD roster misses listing the live roster. A deployment's own same-named custom tool still wins (roster hit first).
+2. The durable rename machinery is retired: `canonicalToolName` and `TOMBSTONED_TOOLS` root exports are REMOVED; `tool-name-aliases.ts` now exports only `RETIRED_TOOL_NAMES` (old name → guidance). A persisted pre-rename checkpoint action misses loudly on resume (`resume.tool_unavailable` + reopen) instead of silently folding onto the new tool.
+3. A RETIRED name in a policy deny/ask/allow list that matches nothing in the run's roster is a HARD prepare failure (`config.legacy_tool_name`) — silent deny-widening is not a migration strategy.
+4. The roster miss carries structured details for UI rendering: `{code: "tool.not_found", toolName, availableTools}`.
+
+**BREAKING — undeclared id-argument pass-throughs cleared (RB-479-A①/②)**
+
+- `TaskOutput` resolves ONLY `task_id`; `TaskStop` resolves ONLY `task_id`/`shell_id` (`shell_id` is the CC-declared surface and stays). The formerly smuggled `bash_id`/`runId` keys land on the loud missing-parameter refusal. The workflow-run poll capability is unchanged — address it as `task_id` (the value is the run id).
+- The registry's internal `legacyToTaskId` shellId index is deleted: the minted `b*` task id is the ONLY registry address; a raw shellId as `task_id` is a loud not_found. `markStopSourceByShellId`/`clearPendingStopSourceByShellId` resolve by the (shellId, env) scan alone (this also removes a single-value index collision defect); calling them without `env` is a no-op.
+- The env-direct background launch receipt drops its `Legacy bash_id=` sentence and the TaskOutput description drops the compatibility-acceptance sentence.
+
+**BREAKING — legacy adapters retired (RB-479-A③/④)**
+
+- The standalone-Fork `{directive}` argument adapter is deleted: a `{directive}`-shaped Agent call refuses loudly (empty prompt) instead of silently rerouting to the fork lane. `{prompt, subagent_type: "fork"}` is the (unchanged) explicit route; the `general-purpose` alias fold stays (live CC parity).
+- `BackgroundAgentTaskHandle.notify` requires a disposition (`"queued" | "parked" | "dropped_duplicate"`, sync or Promise) — the `void` arm is removed from the type. Run-time behavior is unchanged (a non-conforming undefined still reads as queued).
+
+**Fixed — revive frames anchor the row (RB-478, unblocks server residual-arm deletion)**
+
+- All three revive-emission legs (SendMessage resume face, revive-claim spawn, roster record) now chain `rootSessionId ?? parentSessionId` UNCONDITIONALLY — a pre-floor row without a persisted root anchor still lands its host mark downstream.
+- A revive frame's `startedAt` is the ROW's original spawn instant (durable `spawnedAt` / registry registration time), not the wake call's `Date.now()`. `AccessibleTaskRow` gains `createdAt` (additive).
+
+**Added**
+
+- `observer.notify_failed` trace event (additive union member): a host observer callback that throws inside a safe-notify isolation scope is disclosed (bounded, first failure per site). RB-473: the disclosure channel now reaches every deployment-reachable owner — `onNotifyError` options on auto-compaction/cascade/verify/roster-store/workflow/SendMessage, `TaskRegistry.notifierFailureCounts()`, the delegation tool's `onObserverError` (site attached), and the tool gate via the new trace event.
+- Behavior changes declared from the ruling batch: the simple prompt profile's roster shrinks two sections (RB-322, CC-220 alignment); workflow-script-authored child personas carry a provenance head line (RB-461); the default background command budget is 60 minutes, was 30 (RB-366).
+- `test/legacy-residue-gate.test.ts`: a both-ways ratchet freezing the residual compatibility lexicon per file — new compatibility machinery reds the gate until explicitly registered.
+
+**Migration**
+
+- Old tool names → current names (the refusal text lists the live roster). `bash_id`/`runId` → `task_id`. `{directive}` → `{prompt, subagent_type: "fork"}`. Void notify injectors → return `"queued"`. Policy lists naming retired tools → rename or remove the entry (prepare fails loudly otherwise).
+
 ## 4.0.0 (2026-08-02)
 
 _Refactor campaign (50 candidates, three new discipline gates) + a test-discriminance pass + a three-class defect sweep + the closing four-lens review (22 findings, all dispositioned). Major because four config sentinels change MEANING under unchanged types — ENGINEERING-CODE §J2: same name, same type, new behavior is the semver case that compiles clean and computes wrong._

package/dist/agents/cascade.d.ts

@@ -9,6 +9,7 @@ export interface CascadeRung {
     overrides?: Partial<Pick<TaskSpec, "limits" | "degrade" | "systemPrompt">>;
 }
 export interface CascadeConfig {
+    onNotifyError?: (failure: import("../core/safe-notify.js").SafeNotifyFailure) => void;
     ladder: CascadeRung[];
     gate?: (result: TaskResult, rung: {
         index: number;

package/dist/agents/cascade.js

@@ -17,7 +17,7 @@ export async function runCascade(runner, spec, config) {
     const gate = config.gate ?? createDefaultGate(spec);
     const startedAt = Date.now();
     const deadlineAt = config.totalTimeoutMs != null ? startedAt + config.totalTimeoutMs : undefined;
-    const notifier = createSafeNotifier();
+    const notifier = createSafeNotifier(config.onNotifyError !== undefined ? { onError: config.onNotifyError } : undefined);
     const attempts = [];
     let totalCost = 0;
     let ceilingCostKnown = true;

package/dist/agents/repair-loop.d.ts

@@ -21,6 +21,8 @@ export interface RepairBundle {
     rejectedHypotheses: string[];
     attemptCount: number;
     oracleTier: OracleTier;
+    spentMicroUsd?: number;
+    activeElapsedMs?: number;
 }
 export interface RepairLoopConfig {
     oracle: RepairOracle;

package/dist/agents/repair-loop.js

@@ -87,7 +87,14 @@ export async function runRepairLoop(runner, implSpec, config) {
         ? { ...config.resumeBundle, diagnostics: [...config.resumeBundle.diagnostics], rejectedHypotheses: [...config.resumeBundle.rejectedHypotheses] }
         : freshBundle();
     const startedAt = Date.now();
-    let spend = 0;
+    const seededSpend = config.resumeBundle?.spentMicroUsd;
+    const seededActiveMs = config.resumeBundle?.activeElapsedMs;
+    const priorActiveMs = typeof seededActiveMs === "number" && Number.isFinite(seededActiveMs) ? Math.max(0, seededActiveMs) : 0;
+    let spend = typeof seededSpend === "number" && Number.isFinite(seededSpend) ? Math.max(0, seededSpend) : 0;
+    const stampAccount = () => {
+        bundle.spentMicroUsd = spend;
+        bundle.activeElapsedMs = priorActiveMs + (Date.now() - startedAt);
+    };
     let lastResult;
     let lastOracle;
     let ownTokens = 0, ownTurns = 0, ownPrompt = 0, ownTotalInput = 0, ownCached = 0, ownOutput = 0;
@@ -148,11 +155,11 @@ export async function runRepairLoop(runner, implSpec, config) {
         const { sessionId: _drop, ...rest } = implSpec;
         return { ...rest, objective: `${implSpec.objective}\n\n${repairObjective(bundle)}` };
     };
-    const exhaustedBeforeDispatch = () => ({
+    const exhaustedBeforeDispatch = (message, errorCode) => ({
         taskId: implSpec.taskId ?? "",
         status: "failed",
-        result: `repair loop: attempt budget already spent (attemptCount ${bundle.attemptCount} >= maxAttempts ${maxAttempts}) — no attempt dispatched`,
-        errorCode: "repair.attempts_exhausted",
+        result: message ?? `repair loop: attempt budget already spent (attemptCount ${bundle.attemptCount} >= maxAttempts ${maxAttempts}) — no attempt dispatched`,
+        errorCode: errorCode ?? "repair.attempts_exhausted",
         sessionId: implSpec.sessionId ?? "",
         stats: { tokens: 0, turns: 0, costMicroUsd: 0 },
         terminal: "gave_up",
@@ -164,6 +171,13 @@ export async function runRepairLoop(runner, implSpec, config) {
     while (true) {
         if (!restartedOnce && bundle.attemptCount >= maxAttempts)
             return exhaustedBeforeDispatch();
+        if (config.costCeilingMicroUsd != null && spend >= config.costCeilingMicroUsd) {
+            return exhaustedBeforeDispatch(`repair loop: cost ceiling already spent (carried ${spend} >= ceiling ${config.costCeilingMicroUsd} micro-USD) — no attempt dispatched`, "repair.budget_exhausted");
+        }
+        if (config.totalTimeoutMs != null && priorActiveMs + (Date.now() - startedAt) >= config.totalTimeoutMs) {
+            return exhaustedBeforeDispatch(`repair loop: active time budget already spent (carried ${priorActiveMs + (Date.now() - startedAt)}ms >= ${config.totalTimeoutMs}ms) — no attempt dispatched`, "repair.budget_exhausted");
+        }
+        stampAccount();
         const isRepair = bundle.attemptCount > 0 && lastResult !== undefined && !restartedOnce;
         const isSeededResume = !restartedOnce &&
             lastResult === undefined &&
@@ -180,8 +194,17 @@ export async function runRepairLoop(runner, implSpec, config) {
                     }
                     : implSpec;
         restartedOnce = false;
-        const result = await runner.runTask(spec, { repairBundle: bundle });
+        const liveStamp = setInterval(stampAccount, 1_000);
+        liveStamp.unref?.();
+        let result;
+        try {
+            result = await runner.runTask(spec, { repairBundle: bundle });
+        }
+        finally {
+            clearInterval(liveStamp);
+        }
         spend += (result.stats.costMicroUsd ?? 0) + (result.stats.nested?.costMicroUsd ?? 0);
+        stampAccount();
         accumulate(result.stats);
         lastResult = result;
         bundle.attemptCount += 1;
@@ -210,6 +233,7 @@ export async function runRepairLoop(runner, implSpec, config) {
         const oracle = await config.oracle(config.graderEnv, result.result);
         oracleCostMicroUsd += oracle.costMicroUsd ?? 0;
         spend += oracle.costMicroUsd ?? 0;
+        stampAccount();
         lastOracle = oracle;
         bundle.oracleTier = oracle.tier;
         const projected = terminalForTier(oracle);
@@ -230,7 +254,7 @@ export async function runRepairLoop(runner, implSpec, config) {
             if (bundle.diagnostics.length < 3)
                 bundle.diagnostics.push(oracle.trace);
         }
-        const overTime = config.totalTimeoutMs != null && Date.now() - startedAt >= config.totalTimeoutMs;
+        const overTime = config.totalTimeoutMs != null && priorActiveMs + (Date.now() - startedAt) >= config.totalTimeoutMs;
         const overCost = config.costCeilingMicroUsd != null && spend >= config.costCeilingMicroUsd;
         if (bundle.attemptCount >= maxAttempts || overTime || overCost) {
             if (bundle.attemptCount >= maxAttempts && !overTime && !overCost && lastResult !== undefined && !restartUsed) {

package/dist/agents/roster-store.d.ts

@@ -23,6 +23,7 @@ export interface RosterStore {
     releaseAgent(agentId: string): void | Promise<void>;
 }
 export interface RosterGcOptions {
+    onNotifyError?: (failure: import("../core/safe-notify.js").SafeNotifyFailure) => void;
     maxAgeMs?: number;
     maxEntries?: number;
     onEvicted?: (entry: RosterEntry) => void;

package/dist/agents/roster-store.js

@@ -36,7 +36,7 @@ function capped(entries, opts) {
     const max = opts?.maxEntries;
     if (max === undefined || entries.length <= max)
         return entries;
-    const notifier = createSafeNotifier();
+    const notifier = createSafeNotifier(opts?.onNotifyError !== undefined ? { onError: opts.onNotifyError } : undefined);
     const byAge = [...entries].sort((a, b) => a.createdAt - b.createdAt);
     const dropCount = Math.max(0, entries.length - Math.max(0, max));
     const dropped = new Set(byAge.slice(0, dropCount));

package/dist/agents/send-message-tool.d.ts

@@ -36,6 +36,7 @@ export interface SendMessageToolOptions {
         content: string;
         details?: unknown;
     }>;
+    onNotifyError?: (failure: import("../core/safe-notify.js").SafeNotifyFailure) => void;
     enrichCtx?: ToolCtxEnricher;
 }
 export declare const SEND_MESSAGE_SUMMARY_MAX = 200;

package/dist/agents/send-message-tool.js

@@ -369,7 +369,7 @@ export function createSendMessageTool(opts) {
                 }
                 if (byName.status === "found") {
                     const h = byName.handle;
-                    target = { task_id: h.id, type: h.type, status: h.status, ...(h.toolUseId !== undefined ? { toolUseId: h.toolUseId } : {}), ...(h.sessionScoped ? { sessionScoped: true } : {}), ...(h.description !== undefined ? { description: h.description } : {}), ...(h.name !== undefined ? { name: h.name } : {}), ...(h.agentType !== undefined ? { agentType: h.agentType } : {}), ...(h.owner !== undefined ? { owner: h.owner } : {}), ...(h.scope !== undefined ? { scope: h.scope } : {}), ...(h.parentTaskId !== undefined ? { parentTaskId: h.parentTaskId } : {}), ...(h.parentSessionId !== undefined ? { parentSessionId: h.parentSessionId } : {}), ...(h.rootSessionId !== undefined ? { rootSessionId: h.rootSessionId } : {}) };
+                    target = { task_id: h.id, type: h.type, status: h.status, createdAt: h.createdAt, ...(h.toolUseId !== undefined ? { toolUseId: h.toolUseId } : {}), ...(h.sessionScoped ? { sessionScoped: true } : {}), ...(h.description !== undefined ? { description: h.description } : {}), ...(h.name !== undefined ? { name: h.name } : {}), ...(h.agentType !== undefined ? { agentType: h.agentType } : {}), ...(h.owner !== undefined ? { owner: h.owner } : {}), ...(h.scope !== undefined ? { scope: h.scope } : {}), ...(h.parentTaskId !== undefined ? { parentTaskId: h.parentTaskId } : {}), ...(h.parentSessionId !== undefined ? { parentSessionId: h.parentSessionId } : {}), ...(h.rootSessionId !== undefined ? { rootSessionId: h.rootSessionId } : {}) };
                 }
                 else {
                     let rosterHit;
@@ -525,6 +525,8 @@ export function createSendMessageTool(opts) {
                     ...(row.parentTaskId !== undefined ? { rowParentTaskId: row.parentTaskId } : {}),
                     ...(row.parentSessionId !== undefined ? { rowParentSessionId: row.parentSessionId } : {}),
                     ...(row.rootSessionId !== undefined ? { rowRootSessionId: row.rootSessionId } : {}),
+                    ...(row.createdAt !== undefined ? { rowSpawnedAt: row.createdAt } : {}),
+                    ...(opts.onNotifyError !== undefined ? { onNotifyError: opts.onNotifyError } : {}),
                     ...(opts.notify ? { currentParentNotify: opts.notify } : {}),
                 });
                 const fromPrefix = senderIsChild ? `(message from teammate "${senderLabel}")\n` : "";

package/dist/agents/subagent.d.ts

@@ -10,7 +10,6 @@ export type { SubagentStep, SubagentEditedFile } from "./subagent-steps.js";
 export declare function notifyResultField(result: string | undefined): string | undefined;
 export declare function inheritedManifestScopeFor(snapshot: readonly unknown[] | undefined): RunInternals["inheritedManifestScope"];
 export declare const DEFAULT_SUBAGENT_TOOL_NAME = "Agent";
-export declare const LEGACY_SUBAGENT_TOOL_NAME = "Task";
 export declare const EXTRA_TOOLS_MAX_FACTORY_CALLS_PER_TREE = 64;
 export declare const DEFAULT_SUBAGENT_MAX_DEPTH = 3;
 export declare const EXTRA_TOOLS_FAILED_NOTE = "note: extraTools evaluation failed \u2014 the injected tool set was skipped for this spawn.";
@@ -76,6 +75,8 @@ export declare function createSubagentResume(deps: {
     rowParentTaskId?: string;
     rowParentSessionId?: string;
     rowRootSessionId?: string;
+    rowSpawnedAt?: number;
+    onNotifyError?: (failure: import("../core/safe-notify.js").SafeNotifyFailure) => void;
 }): (content: string) => Promise<string>;
 export interface SubagentToolOptions {
     runner: Runner;
@@ -109,6 +110,7 @@ export interface SubagentToolOptions {
     onObserverError?: (err: unknown, info: {
         observedAgent?: string;
         observerAgent?: string;
+        site?: string;
     }) => void;
     extraTools?: (ctx: SubagentSpawnContext) => ToolSpec[] | Promise<ToolSpec[]>;
     onExtraToolsError?: (err: unknown, info: {

package/dist/agents/subagent.js

@@ -5,7 +5,6 @@ import { OUTPUT_TOOL_NAME, REPORT_BLOCKED_TOOL_NAME } from "../core/runner/synth
 import { TOOL_SEARCH_NAME } from "../core/runner/tool-disclosure.js";
 import { OFFLOAD_TOOL_NAME } from "../core/tool-result-store.js";
 import { resolveToolSubset, toolNameAllowed } from "./tool-filter.js";
-import { canonicalToolName } from "../core/tool-name-aliases.js";
 import { builtinAgentDefinitions } from "./builtin-agents.js";
 import { SUBAGENT_PROMPT } from "../prompts/default.js";
 import { hasSessionFork } from "../core/session.js";
@@ -75,7 +74,6 @@ export function inheritedManifestScopeFor(snapshot) {
     return frames;
 }
 export const DEFAULT_SUBAGENT_TOOL_NAME = "Agent";
-export const LEGACY_SUBAGENT_TOOL_NAME = "Task";
 export const EXTRA_TOOLS_MAX_FACTORY_CALLS_PER_TREE = 64;
 export const DEFAULT_SUBAGENT_MAX_DEPTH = 3;
 export const EXTRA_TOOLS_FAILED_NOTE = "note: extraTools evaluation failed — the injected tool set was skipped for this spawn.";
@@ -85,7 +83,7 @@ function countArgLines(v) {
 }
 function createToolStatsCounter(delegationToolName) {
     const t = { readCount: 0, searchCount: 0, bashCount: 0, editFileCount: 0, linesAdded: 0, linesRemoved: 0, otherToolCount: 0 };
-    const excluded = new Set([delegationToolName, DEFAULT_SUBAGENT_TOOL_NAME, LEGACY_SUBAGENT_TOOL_NAME]);
+    const excluded = new Set([delegationToolName, DEFAULT_SUBAGENT_TOOL_NAME]);
     const recordEditLines = (args) => {
         if (args === null || typeof args !== "object")
             return;
@@ -210,7 +208,7 @@ const ccElapsedTag = (ms) => {
 };
 const ccCompletionText = (desc, settled, rawStatus, elapsedMs) => `Agent "${desc}" ${settled === "killed" ? "stopped" : settled === "completed" ? "finished" : rawStatus}${ccElapsedTag(elapsedMs)}`;
 const BG_AGENT_COLLATERAL_REAP_REASON = "its parent run ended";
-const RESERVED_AGENT_NAMES = new Set([OUTPUT_TOOL_NAME, TOOL_SEARCH_NAME, OFFLOAD_TOOL_NAME, REPORT_BLOCKED_TOOL_NAME, DEFAULT_SUBAGENT_TOOL_NAME, LEGACY_SUBAGENT_TOOL_NAME]);
+const RESERVED_AGENT_NAMES = new Set([OUTPUT_TOOL_NAME, TOOL_SEARCH_NAME, OFFLOAD_TOOL_NAME, REPORT_BLOCKED_TOOL_NAME, DEFAULT_SUBAGENT_TOOL_NAME]);
 export const REPORT_FIELD_MAX = 300;
 function configError(message, code) {
     const e = new Error(message);
@@ -276,7 +274,7 @@ function createSteerHandle(stream, parentToolCallId, agentName, settled, retain)
     };
 }
 export function createSubagentResume(deps) {
-    const notifier = createSafeNotifier();
+    const notifier = createSafeNotifier(deps.onNotifyError !== undefined ? { onError: deps.onNotifyError } : undefined);
     const resume = async (content) => {
         const ledger = deps.ledger;
         if (!ledger) {
@@ -373,8 +371,8 @@ export function createSubagentResume(deps) {
                         ...(deps.parentToolCallId !== undefined ? { parentToolCallId: deps.parentToolCallId } : {}),
                         ...(deps.rowParentTaskId !== undefined ? { parentTaskId: deps.rowParentTaskId } : {}),
                         ...(deps.rowParentSessionId !== undefined ? { parentSessionId: deps.rowParentSessionId } : {}),
-                        ...(deps.rowRootSessionId !== undefined ? { rootSessionId: deps.rowRootSessionId } : {}),
-                        startedAt: Date.now(),
+                        ...((deps.rowRootSessionId ?? deps.rowParentSessionId) !== undefined ? { rootSessionId: deps.rowRootSessionId ?? deps.rowParentSessionId } : {}),
+                        startedAt: deps.rowSpawnedAt ?? Date.now(),
                     });
                 }
             }
@@ -643,18 +641,6 @@ function parkCompletionNotify(deps) {
     };
     entry.deferredNotify = { ...(payload.seq !== undefined ? { seq: payload.seq } : {}), cancel, flush: () => deliver(false) };
 }
-function adaptLegacyForkArgs(args) {
-    const raw = args;
-    if (raw !== null && typeof raw === "object" && raw.prompt === undefined && typeof raw.directive === "string") {
-        return {
-            ...args,
-            prompt: raw.directive,
-            subagent_type: FORK_SUBAGENT_TYPE,
-            description: typeof raw.description === "string" ? raw.description : "forked agent (legacy Fork call)",
-        };
-    }
-    return args;
-}
 export function normalizeSubagentType(value) {
     return value.normalize("NFKC").toLowerCase().replace(/[\p{White_Space}\p{Pd}_]+/gu, "");
 }
@@ -788,7 +774,7 @@ export function agentWhenToUseText(def, lean = true) {
 function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
     const maxDepth = opts.maxDepth ?? DEFAULT_SUBAGENT_MAX_DEPTH;
     const toolName = opts.name ?? DEFAULT_SUBAGENT_TOOL_NAME;
-    const notifier = createSafeNotifier();
+    const notifier = createSafeNotifier(opts.onObserverError !== undefined ? { onError: (f) => opts.onObserverError?.(f.error, { site: f.site }) } : undefined);
     const deploymentNames = new Set((opts.agents ?? []).map((a) => a.name));
     const builtins = opts.builtinAgents === false ? [] : builtinAgentDefinitions(toolName).filter((d) => !deploymentNames.has(d.name));
     const available = [...(opts.agents ?? []), ...builtins].filter((a) => !excluded.has(a.name));
@@ -825,7 +811,6 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
         agentListing,
         ...(rosterNames !== undefined ? { agentModels: rosterNames } : {}),
         executionMode: "parallel",
-        ...(!opts.name ? { aliases: [LEGACY_SUBAGENT_TOOL_NAME] } : {}),
         contract: { contractId: "core.agent@1", implementationRevision: "1" },
         description: `Launch a new agent to handle complex, multi-step tasks. Each agent type has specific capabilities and tools available to it.\n` +
             (opts.purpose ? `\nThis sub-agent is for: ${opts.purpose}.\n` : "") +
@@ -909,9 +894,9 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                 }
                 : {}),
         }),
-        prepareArguments: (args) => foldGeneralPurposeAlias(adaptLegacyForkArgs(args), generalPurposeShadowed),
+        prepareArguments: (args) => foldGeneralPurposeAlias(args, generalPurposeShadowed),
         execute: async (args, ctx) => {
-            const a = foldGeneralPurposeAlias(adaptLegacyForkArgs(args), generalPurposeShadowed);
+            const a = foldGeneralPurposeAlias(args, generalPurposeShadowed);
             const wantsBackground = opts.background !== undefined && a.run_in_background !== false;
             const reviveClaim = ctx.reviveClaim;
             if (reviveClaim !== undefined && opts.background === undefined) {
@@ -1137,18 +1122,16 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
             if (injectedTools.length > 0) {
                 const taken = new Set();
                 const reserve = (t) => {
-                    taken.add(canonicalToolName(t.name));
+                    taken.add(t.name);
                     for (const alias of t.aliases ?? [])
-                        taken.add(canonicalToolName(alias));
+                        taken.add(alias);
                 };
                 for (const t of opts.tools ?? [])
                     reserve(t);
-                taken.add(canonicalToolName(toolName));
-                if (!opts.name)
-                    taken.add(canonicalToolName(LEGACY_SUBAGENT_TOOL_NAME));
+                taken.add(toolName);
                 const merged = [...(opts.tools ?? [])];
                 for (const t of injectedTools) {
-                    const names = [canonicalToolName(t.name), ...(t.aliases ?? []).map((alias) => canonicalToolName(alias))];
+                    const names = [t.name, ...(t.aliases ?? [])];
                     if (names.some((n) => taken.has(n)))
                         continue;
                     for (const n of names)
@@ -1398,7 +1381,9 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                     ? {
                         ...(reviveClaim.row.parentTaskId !== undefined ? { parentTaskId: reviveClaim.row.parentTaskId } : {}),
                         ...(reviveClaim.row.parentSessionId !== undefined ? { parentSessionId: reviveClaim.row.parentSessionId } : {}),
-                        ...(reviveClaim.row.rootSessionId !== undefined ? { rootSessionId: reviveClaim.row.rootSessionId } : {}),
+                        ...((reviveClaim.row.rootSessionId ?? reviveClaim.row.parentSessionId) !== undefined
+                            ? { rootSessionId: reviveClaim.row.rootSessionId ?? reviveClaim.row.parentSessionId }
+                            : {}),
                     }
                     : {
                         ...(ctx.taskId !== undefined ? { parentTaskId: ctx.taskId } : {}),
@@ -2062,7 +2047,9 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                             ...(reviveRow.name !== undefined ? { name: reviveRow.name } : {}),
                             ...(reviveRow.parentTaskId !== undefined ? { parentTaskId: reviveRow.parentTaskId } : {}),
                             ...(reviveRow.parentSessionId !== undefined ? { parentSessionId: reviveRow.parentSessionId } : {}),
-                            ...(reviveRow.rootSessionId !== undefined ? { rootSessionId: reviveRow.rootSessionId } : {}),
+                            ...((reviveRow.rootSessionId ?? reviveRow.parentSessionId) !== undefined
+                                ? { rootSessionId: reviveRow.rootSessionId ?? reviveRow.parentSessionId }
+                                : {}),
                             ...(reviveRow.model !== undefined ? { model: reviveRow.model } : {}),
                             ...(reviveRow.teamName !== undefined ? { teamName: reviveRow.teamName } : {}),
                             deliveryChannel: "attaching",
@@ -2109,7 +2096,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                     return { isError: true, content: `Sub-agent not started in background: ${e instanceof Error ? e.message : String(e)}${wt ? `\n${wt}` : ""}`, details: { error: "register_failed" } };
                 }
                 if (agentName !== undefined) {
-                    recordRosterSpawn(ctx.roster, { name: agentName, agentId: taskId, toolUseId: ctx.toolCallId, owner: bgOwner, scope: bgScope, ...((typeof childModel === "string" ? resolveModelDisplayLabel(childModel) : childModel?.id) !== undefined ? { model: typeof childModel === "string" ? childModel : childModel?.id } : {}), ...(reviveRow !== undefined ? (reviveRow.rootSessionId !== undefined ? { rootSessionId: reviveRow.rootSessionId } : {}) : (ctx.rootSessionId ?? ctx.sessionId) !== undefined ? { rootSessionId: ctx.rootSessionId ?? ctx.sessionId } : {}), ...(sessionScopedBg ? { sessionScoped: true } : {}), createdAt: reviveRow?.spawnedAt ?? Date.now() });
+                    recordRosterSpawn(ctx.roster, { name: agentName, agentId: taskId, toolUseId: ctx.toolCallId, owner: bgOwner, scope: bgScope, ...((typeof childModel === "string" ? resolveModelDisplayLabel(childModel) : childModel?.id) !== undefined ? { model: typeof childModel === "string" ? childModel : childModel?.id } : {}), ...(reviveRow !== undefined ? ((reviveRow.rootSessionId ?? reviveRow.parentSessionId) !== undefined ? { rootSessionId: reviveRow.rootSessionId ?? reviveRow.parentSessionId } : {}) : (ctx.rootSessionId ?? ctx.sessionId) !== undefined ? { rootSessionId: ctx.rootSessionId ?? ctx.sessionId } : {}), ...(sessionScopedBg ? { sessionScoped: true } : {}), createdAt: reviveRow?.spawnedAt ?? Date.now() });
                 }
                 const bgSink = ctx.onBackgroundChildEvent;
                 const sinkEmit = (event) => {
@@ -2170,14 +2157,14 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                         ? {
                             ...(reviveRow.parentTaskId !== undefined ? { parentTaskId: reviveRow.parentTaskId } : {}),
                             ...(reviveRow.parentSessionId !== undefined ? { parentSessionId: reviveRow.parentSessionId } : {}),
-                            ...(reviveRow.rootSessionId !== undefined ? { rootSessionId: reviveRow.rootSessionId } : {}),
+                            ...((reviveRow.rootSessionId ?? reviveRow.parentSessionId) !== undefined ? { rootSessionId: reviveRow.rootSessionId ?? reviveRow.parentSessionId } : {}),
                         }
                         : {
                             ...(ctx.taskId !== undefined && ctx.taskId !== ctx.sessionId ? { parentTaskId: ctx.taskId } : {}),
                             ...(ctx.sessionId !== undefined ? { parentSessionId: ctx.sessionId } : {}),
                             ...((ctx.rootSessionId ?? ctx.sessionId) !== undefined ? { rootSessionId: ctx.rootSessionId ?? ctx.sessionId } : {}),
                         }),
-                    startedAt: Date.now(),
+                    startedAt: reviveRow?.spawnedAt ?? Date.now(),
                 });
                 const bgRetainLedger = reviveRow !== undefined
                     ? undefined
@@ -2690,6 +2677,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                         ...(opts.background?.notify ? { notify: opts.background.notify } : {}),
                         sink: ctx.onSubagentSpawn,
                         ...(opts.background ? { registry: opts.background.registry } : {}),
+                        ...(opts.onObserverError !== undefined ? { onNotifyError: (f) => opts.onObserverError?.(f.error, { site: f.site }) } : {}),
                     });
                     notifier.notify(() => ctx.onSubagentSpawn?.(createSteerHandle(stream, ctx.toolCallId, childAgentName, settled, {
                         resume,

package/dist/agents/tool-filter.js

@@ -1,17 +1,16 @@
-import { canonicalToolName } from "../core/tool-name-aliases.js";
 export function toolNameAllowed(name, allowTools, denyTools) {
-    const allow = allowTools !== undefined && !allowTools.includes("*") ? new Set(allowTools.map(canonicalToolName)) : undefined;
-    const deny = denyTools && denyTools.length > 0 ? new Set(denyTools.map(canonicalToolName)) : undefined;
-    const n = canonicalToolName(name);
+    const allow = allowTools !== undefined && !allowTools.includes("*") ? new Set(allowTools) : undefined;
+    const deny = denyTools && denyTools.length > 0 ? new Set(denyTools) : undefined;
+    const n = name;
     return (!allow || allow.has(n)) && (!deny || !deny.has(n));
 }
 export function resolveToolSubset(pool, allowTools, denyTools) {
-    const allow = allowTools !== undefined && !allowTools.includes("*") ? new Set(allowTools.map(canonicalToolName)) : undefined;
-    const deny = denyTools && denyTools.length > 0 ? new Set(denyTools.map(canonicalToolName)) : undefined;
+    const allow = allowTools !== undefined && !allowTools.includes("*") ? new Set(allowTools) : undefined;
+    const deny = denyTools && denyTools.length > 0 ? new Set(denyTools) : undefined;
     if (!allow && !deny)
         return [...pool];
     return pool.filter((t) => {
-        const matches = (set) => set.has(canonicalToolName(t.name)) || (t.aliases ?? []).some((a) => set.has(canonicalToolName(a)));
+        const matches = (set) => set.has(t.name) || (t.aliases ?? []).some((a) => set.has(a));
         return (!allow || matches(allow)) && (!deny || !matches(deny));
     });
 }

package/dist/agents/verify.d.ts

@@ -11,6 +11,7 @@ export declare const VerdictSchema: Type.TObject<{
 }>;
 export type Verdict = Static<typeof VerdictSchema>;
 export interface VerifyConfig {
+    onNotifyError?: (failure: import("../core/safe-notify.js").SafeNotifyFailure) => void;
     verifierModel?: ModelRef;
     verifierTools?: ToolSpec[];
     maxRounds?: number;

package/dist/agents/verify.js

@@ -86,7 +86,7 @@ export async function verifyCompleted(runner, result, specBase, objective, confi
         return { ...result, verification: { verdict: "unverified", unverifiedReason: "impl_incomplete", rounds: 0, findings: [] } };
     }
     const maxRounds = Number.isFinite(config.maxRounds) ? Math.max(1, Math.floor(config.maxRounds)) : 2;
-    const notifier = createSafeNotifier();
+    const notifier = createSafeNotifier(config.onNotifyError !== undefined ? { onError: config.onNotifyError } : undefined);
     const verifierTools = config.verifierTools ?? (specBase.tools ?? []).filter((t) => t.effect === "read");
     const evidenceMode = config.evidence != null && config.evidence.trim() !== "";
     const verifierPrompt = config.verifierPrompt ?? (evidenceMode ? STATIC_VERIFICATION_PROMPT : VERIFICATION_PROMPT);

package/dist/core/arg-summary.d.ts

@@ -1,2 +1,22 @@
-export declare function scrubSecrets(s: string): string;
+export type RedactionConfidence = "high" | "medium" | "low";
+export interface RedactionFinding {
+    kind: string;
+    span: readonly [number, number];
+    confidence: RedactionConfidence;
+    marker: string;
+}
+export interface RedactionReport {
+    findings: RedactionFinding[];
+    preexistingMarkers?: number;
+}
+export interface RedactionPass {
+    kind: string;
+    confidence: RedactionConfidence;
+    marker: string;
+    re: RegExp;
+    replace: string | ((match: string, ...groups: string[]) => string);
+}
+export declare function runRedactionPasses(input: string, passes: readonly RedactionPass[], report?: RedactionReport): string;
+export declare const SECRET_PASSES: readonly RedactionPass[];
+export declare function scrubSecrets(s: string, report?: RedactionReport): string;
 export declare function primaryActivityArg(args: unknown): string | undefined;

package/dist/core/arg-summary.js

@@ -1,24 +1,71 @@
 const ACTIVITY_ARG_MAX = 80;
 const SENSITIVE_KEY = /token|secret|key|password|passwd|credential|auth/i;
-const SECRET_PATTERNS = [
-    { re: /(?<![A-Za-z0-9])(?:sk|pk|rk|gh[opsur])[-_][A-Za-z0-9_-]{8,}/g, replace: "[redacted]" },
-    { re: /(?<![A-Za-z0-9])AIza[A-Za-z0-9_-]{20,}/g, replace: "[redacted]" },
-    { re: /(?<![A-Za-z0-9])xox[baprs]-[A-Za-z0-9-]{10,}/g, replace: "[redacted]" },
-    { re: /(?<![A-Za-z0-9])AKIA[0-9A-Z]{12,}/g, replace: "[redacted]" },
-    { re: /(?<![A-Za-z0-9])hf_[A-Za-z0-9]{20,}/g, replace: "[redacted]" },
-    { re: /(?<![A-Za-z0-9])eyJ[A-Za-z0-9._-]{20,}/g, replace: "[redacted]" },
-    { re: /-----BEGIN[ A-Z]*PRIVATE KEY-----[\s\S]*?(?:-----END[ A-Z]*PRIVATE KEY-----|$)/g, replace: "[redacted]" },
-    { re: /(?<![A-Za-z0-9])Bearer\s+[A-Za-z0-9._~+/-]{8,}=*/gi, replace: "[redacted]" },
+function mapBackOnePass(edits, pos) {
+    let delta = 0;
+    for (const e of edits) {
+        const outStart = e.at + delta;
+        if (pos < outStart)
+            return pos - delta;
+        const outEnd = outStart + e.insertedLen;
+        if (pos < outEnd)
+            return e.at;
+        delta += e.insertedLen - e.removedLen;
+    }
+    return pos - delta;
+}
+const PREEXISTING_MARKER_RE = /\[redacted(?:-[a-z]+)?\]/g;
+export function runRedactionPasses(input, passes, report) {
+    if (report !== undefined && report.preexistingMarkers === undefined) {
+        report.preexistingMarkers = input.match(PREEXISTING_MARKER_RE)?.length ?? 0;
+    }
+    const batches = [];
+    let cur = input;
+    for (const pass of passes) {
+        const edits = [];
+        cur = cur.replace(pass.re, (...args) => {
+            const match = args[0];
+            const offset = args[args.length - 2];
+            const groups = args.slice(1, -2);
+            const inserted = typeof pass.replace === "string"
+                ? pass.replace.replace(/\$(\d)/g, (_m, d) => groups[Number(d) - 1] ?? "")
+                : pass.replace(match, ...groups);
+            if (inserted !== match) {
+                if (report !== undefined) {
+                    let s0 = offset;
+                    let e0 = offset + match.length;
+                    for (let i = batches.length - 1; i >= 0; i--) {
+                        s0 = mapBackOnePass(batches[i], s0);
+                        e0 = mapBackOnePass(batches[i], e0);
+                    }
+                    report.findings.push({ kind: pass.kind, confidence: pass.confidence, span: [s0, e0], marker: pass.marker });
+                }
+                edits.push({ at: offset, removedLen: match.length, insertedLen: inserted.length });
+            }
+            return inserted;
+        });
+        batches.push(edits);
+    }
+    return cur;
+}
+export const SECRET_PASSES = [
+    { kind: "prefixed-token", confidence: "high", marker: "[redacted]", re: /(?<![A-Za-z0-9])(?:sk|pk|rk|gh[opsur])[-_][A-Za-z0-9_-]{8,}/g, replace: "[redacted]" },
+    { kind: "prefixed-token", confidence: "high", marker: "[redacted]", re: /(?<![A-Za-z0-9])AIza[A-Za-z0-9_-]{20,}/g, replace: "[redacted]" },
+    { kind: "prefixed-token", confidence: "high", marker: "[redacted]", re: /(?<![A-Za-z0-9])xox[baprs]-[A-Za-z0-9-]{10,}/g, replace: "[redacted]" },
+    { kind: "prefixed-token", confidence: "high", marker: "[redacted]", re: /(?<![A-Za-z0-9])AKIA[0-9A-Z]{12,}/g, replace: "[redacted]" },
+    { kind: "prefixed-token", confidence: "high", marker: "[redacted]", re: /(?<![A-Za-z0-9])hf_[A-Za-z0-9]{20,}/g, replace: "[redacted]" },
+    { kind: "jwt", confidence: "high", marker: "[redacted]", re: /(?<![A-Za-z0-9])eyJ[A-Za-z0-9._-]{20,}/g, replace: "[redacted]" },
+    { kind: "private-key-block", confidence: "high", marker: "[redacted]", re: /-----BEGIN[ A-Z]*PRIVATE KEY-----[\s\S]*?(?:-----END[ A-Z]*PRIVATE KEY-----|$)/g, replace: "[redacted]" },
+    { kind: "bearer-token", confidence: "high", marker: "[redacted]", re: /(?<![A-Za-z0-9])Bearer\s+[A-Za-z0-9._~+/-]{8,}=*/gi, replace: "[redacted]" },
     {
+        kind: "keyword-value",
+        confidence: "medium",
+        marker: "[redacted]",
         re: /(?<![A-Za-z0-9])((?:token|secret|key|password|passwd|credential|authorization)["']?\s*[=:]\s*["']?)[^\s"';|&]{4,}/gi,
         replace: "$1[redacted]",
     },
 ];
-export function scrubSecrets(s) {
-    let out = s;
-    for (const { re, replace } of SECRET_PATTERNS)
-        out = out.replace(re, replace);
-    return out;
+export function scrubSecrets(s, report) {
+    return runRedactionPasses(s, SECRET_PASSES, report);
 }
 function truncCodePoints(s) {
     const cp = Array.from(s);

package/dist/core/auto-compaction.d.ts

@@ -23,6 +23,7 @@ export interface CompactionWindowSafetyInfo {
 export declare const STALE_ANCHOR_STRUCTURAL_MARGIN = 2;
 export declare function sanitizeCompactionSettings(settings: CompactionSettings, contextWindow: number | undefined): CompactionSettings;
 export interface MaybeCompactOptions {
+    onNotifyError?: (failure: import("./safe-notify.js").SafeNotifyFailure) => void;
     session: Session;
     epochDeclaredSections?: import("../prompt-assembly/epoch.js").EpochDeclaredSections;
     centerAdoption?: {

package/dist/core/auto-compaction.js

@@ -97,7 +97,7 @@ export async function maybeCompact(opts) {
         return { contextUsage, compacted: false, noop: true };
     }
     const trigger = opts.trigger ?? "auto";
-    const notifier = createSafeNotifier();
+    const notifier = createSafeNotifier(opts.onNotifyError !== undefined ? { onError: opts.onNotifyError } : undefined);
     let hookInstructions;
     if (opts.preCompact) {
         let pre;

package/dist/core/fs-write-gate-policy.js

@@ -1,15 +1,14 @@
 import { canonicalizeTarget, writeTargetPath } from "../tools/fs/safety.js";
-import { canonicalToolName } from "./tool-name-aliases.js";
 import { PATH_WRITE_TOOLS, isWithin } from "./runner/session-rule-policy.js";
 const ask = (message) => ({ action: "ask", message, decisionReason: "rule" });
 export function createFsWriteGatePolicy(opts) {
     const { env, rootPath, defaultWrite } = opts;
-    const gated = new Set([...PATH_WRITE_TOOLS, "NotebookEdit"].map(canonicalToolName));
+    const gated = new Set([...PATH_WRITE_TOOLS, "NotebookEdit"]);
     const acceptDirs = opts.acceptDirs && opts.acceptDirs.length > 0 ? opts.acceptDirs : undefined;
     const exemptDirs = opts.exemptDirs && opts.exemptDirs.length > 0 ? opts.exemptDirs : undefined;
     return {
         async check(req, signal) {
-            const canonical = canonicalToolName(req.toolName);
+            const canonical = req.toolName;
             if (!gated.has(canonical))
                 return { action: "allow" };
             const path = writeTargetPath(canonical, req.args);