@sema-agent/core 4.0.0 → 5.0.1

package/dist/core/hooks.d.ts

@@ -104,6 +104,7 @@ export interface ToolGateResult {
     preToolContext: string[];
 }
 export interface ToolGateInput {
+    onNotifyError?: (failure: import("./safe-notify.js").SafeNotifyFailure) => void;
     event: {
         toolCallId: string;
         toolName: string;

package/dist/core/hooks.js

@@ -59,7 +59,7 @@ export async function runToolGate(input) {
     let currentInput = event.input;
     const preToolContext = [];
     let hookAsk;
-    const notifier = createSafeNotifier();
+    const notifier = createSafeNotifier(input.onNotifyError !== undefined ? { onError: input.onNotifyError } : undefined);
     if (preToolUse) {
         let r;
         try {

package/dist/core/mcp.js

@@ -756,9 +756,6 @@ function applyCallerAxisOverride(name, hint, override) {
 const LIST_MCP_RESOURCES = "ListMcpResourcesTool";
 const READ_MCP_RESOURCE = "ReadMcpResourceTool";
 const READ_MCP_RESOURCE_DIR = "ReadMcpResourceDirTool";
-const LEGACY_LIST_MCP_RESOURCES = "ListMcpResources";
-const LEGACY_READ_MCP_RESOURCE = "ReadMcpResource";
-const LEGACY_READ_MCP_RESOURCE_DIR = "ReadMcpResourceDir";
 const MCP_SKILLS_EXTENSION = "io.modelcontextprotocol/skills";
 const MAX_DIR_READ_PAGES = 20;
 const DIR_READ_NOT_A_DIRECTORY_RE = /not a directory|isn'?t a directory|not a folder/i;
@@ -843,7 +840,6 @@ function buildResourceTools(resourceServers) {
     if (listable.length > 0) {
         tools.push({
             name: LIST_MCP_RESOURCES,
-            aliases: [LEGACY_LIST_MCP_RESOURCES],
             description: "List the resources available from connected MCP servers (uri / name / description). Pass `server` to limit " +
                 "to one server, or omit it to list across all. Resource metadata is external/untrusted data.",
             label: LIST_MCP_RESOURCES,
@@ -903,7 +899,6 @@ function buildResourceTools(resourceServers) {
     if (readable.length > 0) {
         tools.push({
             name: READ_MCP_RESOURCE,
-            aliases: [LEGACY_READ_MCP_RESOURCE],
             description: "Read a specific MCP resource by `server` + `uri` (from ListMcpResourcesTool). Its content is external/untrusted data.",
             label: READ_MCP_RESOURCE,
             executionMode: "parallel",
@@ -953,7 +948,6 @@ function buildResourceTools(resourceServers) {
     if (listable.length > 0) {
         tools.push({
             name: READ_MCP_RESOURCE_DIR,
-            aliases: [LEGACY_READ_MCP_RESOURCE_DIR],
             description: "List the MCP resources UNDER a directory `uri` on `server` — its child resources (those whose uri is " +
                 "nested below it; subdirectories carry mimeType \"inode/directory\"). Use it to browse a hierarchical " +
                 "resource namespace after ListMcpResourcesTool. Resource metadata is external/untrusted data.",

package/dist/core/permission-rules.d.ts

@@ -1,4 +1,4 @@
-import type { ToolPolicy } from "./tool-policy.js";
+import type { NamedToolPolicy } from "./tool-policy.js";
 export declare const BASH_GENERIC_PARAMS: ReadonlySet<string>;
 export interface PermissionRule {
     rule: string;
@@ -32,4 +32,4 @@ export declare function parsePermissionRule(rule: string): ParsedPermissionRule;
 export declare function wildcardMatch(pattern: string, value: string): boolean;
 export declare const fileToolParamVocabulary: (canonicalTool: string) => ReadonlySet<string> | undefined;
 export declare function validatePermissionRules(rules: PermissionRule[], opts?: Pick<PermissionRulePolicyOptions, "primaryFieldGeneric" | "caps">): PermissionRuleIssue[];
-export declare function createPermissionRulePolicy(rules: PermissionRule[], opts?: PermissionRulePolicyOptions): ToolPolicy;
+export declare function createPermissionRulePolicy(rules: PermissionRule[], opts?: PermissionRulePolicyOptions): NamedToolPolicy;

package/dist/core/permission-rules.js

@@ -1,4 +1,3 @@
-import { canonicalToolName } from "./tool-name-aliases.js";
 export const BASH_GENERIC_PARAMS = new Set(["command", "timeout", "description", "run_in_background"]);
 const DEFAULT_CAPS = {
     maxRules: 256,
@@ -142,7 +141,7 @@ function compile(rules, caps, primaryFieldGeneric) {
                 continue;
             }
         }
-        const toolName = canonicalToolName(parsed.toolName);
+        const toolName = parsed.toolName;
         if (toolName.startsWith("mcp__") && (parsed.ruleContent !== undefined || indexOfUnescaped(text, "(") !== -1)) {
             bad(text, "unsupported.mcp_paren", "MCP rules do not support patterns in parentheses (CC parity); use the toolAxes system");
             continue;
@@ -260,9 +259,19 @@ export function createPermissionRulePolicy(rules, opts) {
         }
     }
     const defaultAction = opts?.defaultAction ?? "allow";
+    const nameSets = { deny: [], ask: [], allow: [] };
+    for (const [toolName, entry] of byTool) {
+        if (entry.bare.deny !== undefined || entry.param.deny.length > 0)
+            nameSets.deny.push(toolName);
+        if (entry.bare.ask !== undefined || entry.param.ask.length > 0)
+            nameSets.ask.push(toolName);
+        if (entry.bare.allow !== undefined)
+            nameSets.allow.push(toolName);
+    }
     return {
+        nameSets: [nameSets],
         check(req) {
-            const entry = byTool.get(canonicalToolName(req.toolName));
+            const entry = byTool.get(req.toolName);
             if (entry) {
                 if (entry.bare.deny) {
                     return { action: "deny", reason: ruleMessage("denied", entry.bare.deny.ruleText, entry.bare.deny.source) };

package/dist/core/runner/active-skill-scope.js

@@ -1,6 +1,5 @@
 import { canonicalizeTarget, fileArgPath } from "../../tools/fs/safety.js";
 import { PATH_WRITE_TOOLS, isWithin } from "./session-rule-policy.js";
-import { canonicalToolName } from "../tool-name-aliases.js";
 import { parseSkillToolEntry, skillSpecifierRejection } from "../skill-tool-specifier.js";
 export class ActiveSkillScope {
     frames = [];
@@ -21,7 +20,7 @@ export function createActiveSkillScopePolicy(opts) {
     const { scope, env, rootPath, toolEffects } = opts;
     return {
         async check(req, signal) {
-            const toolName = canonicalToolName(req.toolName);
+            const toolName = req.toolName;
             const frames = scope.active();
             if (frames.length === 0)
                 return { action: "allow" };

package/dist/core/runner/prepare-task.js

@@ -29,7 +29,7 @@ import { reconcileInterruptedSession } from "../session-reconcile.js";
 import { CacheBreakDetector, toolsToFingerprintInputs } from "../cache-break-detector.js";
 import { reservedCollisions, reservedFor } from "../../brain/request-params.js";
 import { defineTool, isDefineToolProduct } from "../tools.js";
-import { canonicalToolName } from "../tool-name-aliases.js";
+import { RETIRED_TOOL_NAMES } from "../tool-name-aliases.js";
 import { pathToUri } from "../lsp-protocol.js";
 import { DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, createOffloadPersist, firstPartyOffloadPolicy, InMemoryToolResultStore, RunnerSharedToolResultStore, ScopedToolResultStore, isVolatileOffloadStore, OFFLOAD_TOOL_NAME, createReadToolResultTool, withToolResultOffload, } from "../tool-result-store.js";
 import { OUTPUT_TOOL_NAME, REPORT_FINDINGS_TOOL_NAME, SKILL_CONTENT_MAX_CHARS, SKILL_TOOL_NAME, createOutputTool, createReportBlockedTool, createReportFindingsTool, createSkillTool, normalizeSkills } from "./synthetic-tools.js";
@@ -1378,6 +1378,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     ...(deps.backgroundAgentStore !== undefined ? { agentStore: deps.backgroundAgentStore } : {}),
                     ...(deps.mailboxStore !== undefined ? { mailbox: deps.mailboxStore } : {}),
                     ...(reviveSpawn !== undefined ? { reviveSpawn } : {}),
+                    onNotifyError: (f) => emitTrace(deps.tracer, () => ({ kind: "observer.notify_failed", version: 1, taskId: hostTaskId, site: f.site, message: f.error.message, ts: Date.now() })),
                 })));
                 if (!(spec.tools ?? []).some((t) => t.name === AGENT_TRANSCRIPT_TOOL_NAME)) {
                     tools.push(firstPartyOffload(createAgentTranscriptTool({
@@ -2018,9 +2019,9 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             };
         }
         if (spec.agents !== undefined && spec.agents.length > 0) {
-            const known = new Set(tools.flatMap((t) => [canonicalToolName(t.name), ...(t.aliases ?? []).map((a) => canonicalToolName(a))]));
+            const known = new Set(tools.flatMap((t) => [t.name, ...(t.aliases ?? [])]));
             for (const def of spec.agents) {
-                const unknownAllow = (def.allowTools ?? []).filter((n) => n !== "*" && !known.has(canonicalToolName(n)));
+                const unknownAllow = (def.allowTools ?? []).filter((n) => n !== "*" && !known.has(n));
                 if (unknownAllow.length > 0) {
                     try {
                         deps.onError?.(new Error(`TaskSpec.agents: agent "${def.name}" allows tool(s) ${unknownAllow.join(", ")} not present in this task's assembled roster — likely a typo (the entry would be item-filtered at spawn; the agent stays usable). Advisory only: the delegation pool can differ from this roster, so a tool mounted only on the delegation tool or produced by per-spawn extraTools makes this spurious.`), { phase: "config", sessionId });
@@ -2031,7 +2032,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 for (const n of def.denyTools ?? []) {
                     if (n === "*")
                         continue;
-                    if (!known.has(canonicalToolName(n))) {
+                    if (!known.has(n)) {
                         const e = new Error(`TaskSpec.agents: agent "${def.name}" declares tool "${n}" in its denied tools, but no such tool exists in this deployment — fix the agent's tools list or mount the tool.`);
                         e.code = "config.agent.unknown_tool";
                         throw e;
@@ -2190,18 +2191,30 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             }
         }
         const policy = spec.toolPolicy ?? deps.toolPolicy;
-        {
-            const nameGroups = toolPolicyNameSets(policy);
+        const auditPolicyNames = (auditee) => {
+            const nameGroups = toolPolicyNameSets(auditee);
             if (nameGroups.length > 0) {
-                const known = new Set(tools.flatMap((t) => [canonicalToolName(t.name), ...(t.aliases ?? []).map((a) => canonicalToolName(a))]));
+                const known = new Set(tools.flatMap((t) => [t.name, ...(t.aliases ?? [])]));
                 for (const t of harnessTools)
-                    known.add(canonicalToolName(t.name));
+                    known.add(t.name);
                 const unmatched = new Set();
                 for (const g of nameGroups) {
                     for (const [kind, list] of [["deny", g.deny], ["ask", g.ask], ["allow", g.allow]]) {
                         for (const n of list ?? []) {
-                            if (!known.has(canonicalToolName(n)))
-                                unmatched.add(`"${n}" (${kind})`);
+                            if (known.has(n))
+                                continue;
+                            const retired = RETIRED_TOOL_NAMES.get(n);
+                            if (retired !== undefined) {
+                                const err = new Error(`tool policy ${kind}-list entry "${n}" is a RETIRED tool name (${retired}) and matches nothing in this run's roster — legacy-name normalization was removed (RB-476-A), so this entry would silently guard nothing. Update the deployment's rule to the current name.`);
+                                err.code = "config.legacy_tool_name";
+                                throw err;
+                            }
+                            if (n.includes("__") && !n.startsWith("mcp__")) {
+                                const err = new Error(`tool policy ${kind}-list entry "${n}" is a pre-prefix MCP tool name and matches nothing in this run's roster — MCP tools are named "mcp__<server>__<tool>" and legacy-name normalization was removed (RB-476-A), so this entry would silently guard nothing. Prefix the entry with "mcp__".`);
+                                err.code = "config.legacy_tool_name";
+                                throw err;
+                            }
+                            unmatched.add(`"${n}" (${kind})`);
                         }
                     }
                 }
@@ -2224,7 +2237,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     }
                 }
             }
-        }
+        };
+        auditPolicyNames(policy);
         let sessionRulePolicy;
         if (deps.sessionPolicyStore && spec.sessionId) {
             const rules = await deps.sessionPolicyStore.getRules(spec.sessionId, spec.principal);
@@ -2261,6 +2275,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             })
             : undefined;
         const narrowingLayers = [sessionRulePolicy, ...ancestorRulePolicies, skillScopePolicy].filter((p) => p !== undefined);
+        for (const layer of narrowingLayers)
+            auditPolicyNames(layer);
         const denyNarrowingPolicy = narrowingLayers.length === 0 ? undefined : narrowingLayers.length === 1 ? narrowingLayers[0] : combinePolicies(...narrowingLayers);
         const basePolicyForResumeEdit = spec.toolPolicy ?? deps.toolPolicy;
         const sameInstanceAncestorCount = policy === undefined ? 0 : (inheritedParentConstraints ?? []).reduce((n, pc) => (pc.policy === policy ? n + 1 : n), 0);
@@ -2871,6 +2887,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     const token = mintCheckpointToken();
                     const gate = { kind: "resource_limit", reason };
                     const resourceLedgerOut = debitLedger(priorLedger, sliceSpend, resourceTotal);
+                    const mintedAt = Date.now();
                     const cp = {
                         token,
                         version: resourceLedgerOut.totalWalltimeSec !== undefined ? WALLTIME_CHECKPOINT_VERSION : RESOURCE_CHECKPOINT_VERSION,
@@ -2881,8 +2898,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         pendingAction: { kind: "resource_limit", reason },
                         state: serializeCheckpointState(remoteHandle),
                         status: "pending",
-                        createdAt: Date.now(),
-                        deadline: Date.now() + (sanitizedTtlMs(rs.ttlMs) ?? DEFAULT_RESOURCE_TTL_MS),
+                        createdAt: mintedAt,
+                        deadline: mintedAt + (sanitizedTtlMs(rs.ttlMs) ?? DEFAULT_RESOURCE_TTL_MS),
                         suspendCount: priorSuspendCount,
                         humanReview: humanReviewRef.count > 0
                             ? { count: humanReviewRef.count, totalWaitMs: humanReviewRef.totalWaitMs, gates: [...humanReviewRef.gates] }
@@ -2951,6 +2968,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     const scope = checkpointScopeOf(spec);
                     const gate = { kind: "plan_review", reason: reason ?? `plan review requested` };
                     const reviewLedger = debitLedger(priorLedger, liveSpendRef.get?.() ?? { costMicroUsd: 0, tokens: 0, turns: 0, walltimeMs: 0 }, resourceTotal, { countSlice: false });
+                    const mintedAt = Date.now();
                     const cp = {
                         token,
                         version: reviewLedger.totalWalltimeSec !== undefined ? WALLTIME_CHECKPOINT_VERSION : BINDING_CHECKPOINT_VERSION,
@@ -2961,9 +2979,9 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         pendingAction: { kind: "plan_review" },
                         state: serializeCheckpointState(remoteHandle),
                         status: "pending",
-                        createdAt: Date.now(),
+                        createdAt: mintedAt,
                         suspendedAt: now(),
-                        deadline: Date.now() + (sanitizedTtlMs(spec.durableApproval?.ttlMs) ?? DEFAULT_RESOURCE_TTL_MS),
+                        deadline: mintedAt + (sanitizedTtlMs(spec.durableApproval?.ttlMs) ?? DEFAULT_RESOURCE_TTL_MS),
                         suspendCount: priorSuspendCount + 1,
                         humanReview: humanReviewRef.count > 0
                             ? { count: humanReviewRef.count, totalWaitMs: humanReviewRef.totalWaitMs, gates: [...humanReviewRef.gates] }
@@ -3075,6 +3093,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         const ttlMs = sanitizedTtlMs(durableApproval?.ttlMs);
                         const checkpointState = serializeCheckpointState(remoteHandle);
                         const approvalLedger = debitLedger(priorLedger, liveSpendRef.get?.() ?? { costMicroUsd: 0, tokens: 0, turns: 0, walltimeMs: 0 }, resourceTotal, { countSlice: false });
+                        const mintedAt = Date.now();
                         cp = {
                             token,
                             version: approvalLedger.totalWalltimeSec !== undefined ? WALLTIME_CHECKPOINT_VERSION : BINDING_CHECKPOINT_VERSION,
@@ -3097,12 +3116,12 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             },
                             state: checkpointState,
                             deadline: ttlMs !== undefined
-                                ? Date.now() + ttlMs
+                                ? mintedAt + ttlMs
                                 : durableApproval !== undefined
                                     ? undefined
-                                    : Date.now() + DEFAULT_UNATTENDED_APPROVAL_TTL_MS,
+                                    : mintedAt + DEFAULT_UNATTENDED_APPROVAL_TTL_MS,
                             status: "pending",
-                            createdAt: Date.now(),
+                            createdAt: mintedAt,
                             suspendedAt: now(),
                             humanReview: humanReviewRef.count > 0
                                 ? { count: humanReviewRef.count, totalWaitMs: humanReviewRef.totalWaitMs, gates: [...humanReviewRef.gates] }
@@ -3160,6 +3179,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     let result;
                     try {
                         result = await runToolGate({
+                            onNotifyError: (f) => emitTrace(deps.tracer, () => ({ kind: "observer.notify_failed", version: 1, taskId: spec.taskId ?? sessionId, site: f.site, message: f.error.message, ts: Date.now() })),
                             event: e,
                             preToolUse: hooks?.preToolUse,
                             adjudicate,

package/dist/core/runner/runtask.js

@@ -36,7 +36,6 @@ import { delimitUntrusted, inlineUntrusted, sanitizeUntrustedText } from "../unt
 import { reconcileInterruptedSession } from "../session-reconcile.js";
 import { RunnerSharedToolResultStore } from "../tool-result-store.js";
 import { formatDiagnosticsBlock } from "../lsp-diagnostics.js";
-import { canonicalToolName } from "../tool-name-aliases.js";
 import { toolPolicyNameSets } from "../tool-policy.js";
 import { defaultTaskRegistry } from "../task-registry.js";
 import { discloseDroppedPending, PendingSessionNotifications, renderTaskNotificationXml, SystemInjectionQueue, taskNotificationDedupKey } from "../task-notification.js";
@@ -748,6 +747,13 @@ function makeTurnBoundary(prepared, stats, rs, deps) {
 function makeHarnessHandlers(prepared, stats, rs, deps) {
     const { spec, queue, internals, buildFinalizeText, ident, nudgeSchedule, parentToolCallId, subagentName, pushContent, emitCommitted, startedToolCallIds, toolStartAt, turnToolSpan, writeFamilyOf, toolLabels, postToolBatchHook, batchArgs } = deps;
     let lastWorkspaceCwd = prepared.cwdRef?.current;
+    const announceWorkspaceMove = () => {
+        const cwdNow = prepared.cwdRef?.current;
+        if (cwdNow !== undefined && cwdNow !== lastWorkspaceCwd) {
+            lastWorkspaceCwd = cwdNow;
+            queue.push({ type: "workspace_changed", cwd: cwdNow, ...ident() });
+        }
+    };
     const onMessageUpdate = (event) => {
         const ev = event.assistantMessageEvent;
         if (rs.turn.callStartAt === undefined)
@@ -1000,7 +1006,7 @@ function makeHarnessHandlers(prepared, stats, rs, deps) {
         }));
         internals?.onActivity?.({ phase: "end", toolCallId: event.toolCallId, toolName: event.toolName, isError: event.isError, at: toolNow });
         if (prepared.lspDiagnostics && !event.isError) {
-            const name = canonicalToolName(event.toolName);
+            const name = event.toolName;
             if (name === "Edit" || name === "Write" || name === "NotebookEdit") {
                 const d = event.result?.details;
                 const p = typeof d?.filePath === "string" ? d.filePath : typeof d?.notebookPath === "string" ? d.notebookPath : undefined;
@@ -1026,11 +1032,7 @@ function makeHarnessHandlers(prepared, stats, rs, deps) {
             })(),
             ...ident(),
         });
-        const cwdNow = prepared.cwdRef?.current;
-        if (cwdNow !== undefined && cwdNow !== lastWorkspaceCwd) {
-            lastWorkspaceCwd = cwdNow;
-            queue.push({ type: "workspace_changed", cwd: cwdNow, ...ident() });
-        }
+        announceWorkspaceMove();
         if (spec.outputSchema && event.toolName === OUTPUT_TOOL_NAME) {
             if (event.isError) {
                 rs.degrade.outputErrorStreak += 1;
@@ -1108,7 +1110,7 @@ function makeHarnessHandlers(prepared, stats, rs, deps) {
             }
         }
     };
-    return { onMessageUpdate, onMessageEnd, onToolStart, onToolEnd, onTurnEnd };
+    return { onMessageUpdate, onMessageEnd, onToolStart, onToolEnd, onTurnEnd, announceWorkspaceMove };
 }
 export class Runner {
     deps;
@@ -1914,18 +1916,18 @@ export class Runner {
             }
         }
         rs.attach.attachmentsInjected = 0;
-        const todoToolMounted = rs.attach.attachState !== undefined && prepared.tools.some((t) => canonicalToolName(t.name) === "TodoWrite");
-        const taskToolsMounted = rs.attach.attachState !== undefined && prepared.tools.some((t) => canonicalToolName(t.name) === "TaskCreate");
+        const todoToolMounted = rs.attach.attachState !== undefined && prepared.tools.some((t) => t.name === "TodoWrite");
+        const taskToolsMounted = rs.attach.attachState !== undefined && prepared.tools.some((t) => t.name === "TaskCreate");
         const writeFamilyByName = new Map();
         if (rs.attach.attachState !== undefined) {
             for (const t of prepared.tools) {
-                const family = writeFamilyOfCanonical(canonicalToolName(t.name));
+                const family = writeFamilyOfCanonical(t.name);
                 if (family !== undefined)
                     for (const n of [t.name, ...(t.aliases ?? [])])
                         writeFamilyByName.set(n, family);
             }
         }
-        const writeFamilyOf = (name) => writeFamilyByName.get(name) ?? writeFamilyOfCanonical(canonicalToolName(name));
+        const writeFamilyOf = (name) => writeFamilyByName.get(name) ?? writeFamilyOfCanonical(name);
         const toolStartAt = new Map();
         const turnToolSpan = {};
         const startedToolCallIds = new Set();
@@ -2091,7 +2093,7 @@ export class Runner {
         const postToolBatchHook = (spec.hooks ?? this.deps.hooks)?.postToolBatch;
         const batchArgs = postToolBatchHook ? new Map() : undefined;
         rs.turn.toolBatch = [];
-        const { onMessageUpdate, onMessageEnd, onToolStart, onToolEnd, onTurnEnd } = makeHarnessHandlers(prepared, stats, rs, {
+        const { onMessageUpdate, onMessageEnd, onToolStart, onToolEnd, onTurnEnd, announceWorkspaceMove } = makeHarnessHandlers(prepared, stats, rs, {
             spec, queue, internals, buildFinalizeText, ident, nudgeSchedule, parentToolCallId, subagentName,
             pushContent, emitCommitted, startedToolCallIds, toolStartAt, turnToolSpan, writeFamilyOf,
             toolLabels, postToolBatchHook, batchArgs,
@@ -2461,6 +2463,7 @@ export class Runner {
                     });
                     if (resume.outcome.gate === "policy_ask")
                         resume.decisionDelivered = true;
+                    announceWorkspaceMove();
                 }
                 if (walltimeExhaustedResume) {
                     timeout.fired = true;
@@ -3290,7 +3293,7 @@ export class Runner {
             return;
         if (resume.outcome.gate === "policy_ask" &&
             resume.outcome.decision === "allow" &&
-            !prepared.tools.some((t) => t.name === canonicalToolName(pendingAction.toolName))) {
+            !prepared.tools.some((t) => t.name === pendingAction.toolName)) {
             const e = new Error(`the approved tool "${pendingAction.toolName}" is no longer available on resume — refusing to continue as if it ran; the checkpoint is reopened for a retry with the tool present`);
             e.code = "resume.tool_unavailable";
             throw e;
@@ -3355,7 +3358,7 @@ export class Runner {
                 return;
             }
         }
-        const tool = prepared.tools.find((t) => t.name === canonicalToolName(pendingAction.toolName));
+        const tool = prepared.tools.find((t) => t.name === pendingAction.toolName);
         if (!tool) {
             const e = new Error(`the approved tool "${pendingAction.toolName}" is no longer available on resume`);
             e.code = "resume.tool_unavailable";
@@ -3375,7 +3378,7 @@ export class Runner {
         }
         const executedIsError = res.isError === true;
         emitEnd(executedIsError);
-        onResolvedToolSuccess?.(canonicalToolName(pendingAction.toolName), executedIsError ? undefined : res.details);
+        onResolvedToolSuccess?.(pendingAction.toolName, executedIsError ? undefined : res.details);
         const eid = await prepared.session.appendMessage({
             role: "toolResult",
             toolCallId: pendingAction.toolCallId,

package/dist/core/runner/session-rule-policy.d.ts

@@ -1,6 +1,6 @@
 import type { ExecutionEnv } from "../../internal/harness-types.js";
 import type { ToolEffect } from "../types.js";
-import { type ToolPolicy } from "../tool-policy.js";
+import { type NamedToolPolicy } from "../tool-policy.js";
 import type { SessionPermissionRules } from "../session-policy-store.js";
 export declare const PATH_WRITE_TOOLS: ReadonlySet<string>;
 export declare function isWithin(root: string, p: string): boolean;
@@ -8,4 +8,4 @@ export declare function createSessionRulePolicy(rules: SessionPermissionRules, o
     env: ExecutionEnv;
     rootPath?: string;
     toolEffects?: ReadonlyMap<string, ToolEffect>;
-}): ToolPolicy;
+}): NamedToolPolicy;

package/dist/core/runner/session-rule-policy.js

@@ -1,7 +1,6 @@
 import { canonicalizeTarget, fileArgPath } from "../../tools/fs/safety.js";
 import { isWinFormPath } from "../../tools/fs/safety.js";
 import { createCoarseCommandNamePolicy } from "../tool-policy.js";
-import { canonicalToolName } from "../tool-name-aliases.js";
 export const PATH_WRITE_TOOLS = new Set(["Write", "Edit", "MultiEdit"]);
 export function isWithin(root, p) {
     if (!root)
@@ -22,8 +21,8 @@ export function isWithin(root, p) {
 const deny = (reason) => ({ action: "deny", reason, decisionReason: "rule" });
 export function createSessionRulePolicy(rules, opts) {
     const { env, rootPath, toolEffects } = opts;
-    const toolDeny = new Set((rules.toolDeny ?? []).map(canonicalToolName));
-    const toolAllow = rules.toolAllow ? new Set(rules.toolAllow.map(canonicalToolName)) : undefined;
+    const toolDeny = new Set(rules.toolDeny ?? []);
+    const toolAllow = rules.toolAllow ? new Set(rules.toolAllow) : undefined;
     const cmdPolicy = rules.commandAllow || rules.commandDeny
         ? createCoarseCommandNamePolicy({
             ...(rules.commandAllow ? { allow: rules.commandAllow } : {}),
@@ -33,8 +32,9 @@ export function createSessionRulePolicy(rules, opts) {
         : undefined;
     const allowDirs = rules.allowDirs && rules.allowDirs.length > 0 ? rules.allowDirs : undefined;
     return {
+        nameSets: [{ ...(rules.toolDeny?.length ? { deny: [...rules.toolDeny] } : {}), ...(rules.toolAllow?.length ? { allow: [...rules.toolAllow] } : {}) }],
         async check(req, signal) {
-            const toolName = canonicalToolName(req.toolName);
+            const toolName = req.toolName;
             if (toolDeny.has(toolName))
                 return deny(`tool "${req.toolName}" is denied by a session rule`);
             if (toolAllow && !toolAllow.has(toolName)) {

package/dist/core/sensitive-path-policy.js

@@ -1,5 +1,4 @@
 import { canonicalizeTarget, writeTargetPath } from "../tools/fs/safety.js";
-import { canonicalToolName } from "./tool-name-aliases.js";
 const DEFAULT_GUARDED_TOOLS = ["Write", "Edit", "MultiEdit", "NotebookEdit"];
 export const RECOMMENDED_SENSITIVE_PATTERNS = [
     ".env",
@@ -56,10 +55,10 @@ function matchSensitive(canonicalKey, compiled) {
 }
 export function createSensitivePathPolicy(opts) {
     const compiled = compilePatterns(opts.patterns);
-    const guarded = new Set((opts.tools ?? DEFAULT_GUARDED_TOOLS).map(canonicalToolName));
+    const guarded = new Set(opts.tools ?? DEFAULT_GUARDED_TOOLS);
     return {
         async check(req, signal) {
-            const canonical = canonicalToolName(req.toolName);
+            const canonical = req.toolName;
             if (compiled.length === 0 || !guarded.has(canonical))
                 return { action: "allow" };
             const path = writeTargetPath(canonical, req.args);

package/dist/core/session-reconcile.js

@@ -1,4 +1,3 @@
-import { canonicalToolName } from "./tool-name-aliases.js";
 const INTERRUPTED_UNKNOWN = "[INTERRUPTED] The previous run ended before this tool call's result was recorded. Its outcome " +
     "is UNKNOWN — the action may have completed, partially completed, or never run. Do not assume " +
     "success or failure. Before relying on it: if it is safe to read, query the current state to " +
@@ -72,7 +71,7 @@ export async function reconcileInterruptedSession(session, toolEffects, suspende
     const orphans = findOrphanToolCalls(messages, suspendedBatch).filter((o) => o.kind !== "result");
     const recovered = [];
     for (const orphan of orphans) {
-        const effect = toolEffects?.get(canonicalToolName(orphan.toolName)) ?? "write";
+        const effect = toolEffects?.get(orphan.toolName) ?? "write";
         const effectText = effect === "read" ? INTERRUPTED_SAFE : effect === "idempotent" ? INTERRUPTED_IDEMPOTENT : INTERRUPTED_UNKNOWN;
         const neverStarted = startedToolCallIds !== undefined && !startedToolCallIds.has(orphan.toolCallId);
         const text = neverStarted ? INTERRUPTED_NEVER_STARTED : effectText;

package/dist/core/skill-tool-specifier.js

@@ -1,11 +1,10 @@
 import { parsePermissionRule, wildcardMatch } from "./permission-rules.js";
-import { canonicalToolName } from "./tool-name-aliases.js";
 import { COARSE_SHELL_TOOLS } from "./tool-policy.js";
 import { parseLeadingCommandName } from "../tools/fs/bash-readonly-classifier.js";
-const SPECIFIER_ENFORCED_TOOLS = new Set(COARSE_SHELL_TOOLS.map(canonicalToolName));
+const SPECIFIER_ENFORCED_TOOLS = new Set(COARSE_SHELL_TOOLS);
 export function parseSkillToolEntry(entry) {
     const parsed = parsePermissionRule(entry);
-    const name = canonicalToolName(parsed.toolName);
+    const name = parsed.toolName;
     return parsed.ruleContent === undefined ? { raw: entry, name } : { raw: entry, name, specifier: parsed.ruleContent };
 }
 export function isSkillSpecifierEnforced(canonicalName) {

package/dist/core/skills-directory.js

@@ -1,6 +1,5 @@
 import { readFileSync, readdirSync, realpathSync, statSync } from "node:fs";
 import { isAbsolute, join, relative } from "node:path";
-import { canonicalToolName } from "./tool-name-aliases.js";
 import { isSkillSpecifierEnforced, parseSkillToolEntry } from "./skill-tool-specifier.js";
 const SKILL_FILE = "SKILL.md";
 const RESOURCE_DIRS = ["assets", "references", "scripts"];
@@ -340,7 +339,7 @@ function manifestFromAllowedTools(declared, disallowed, skillName, deployedTools
         return undefined;
     let allowTools = names;
     if (deployedTools !== undefined) {
-        const mounted = new Set(deployedTools.map(canonicalToolName));
+        const mounted = new Set(deployedTools);
         allowTools = names.filter((n) => mounted.has(parseSkillToolEntry(n).name));
         for (const n of names) {
             if (!mounted.has(parseSkillToolEntry(n).name)) {
@@ -353,7 +352,7 @@ function manifestFromAllowedTools(declared, disallowed, skillName, deployedTools
         }
     }
     if (disallowed.length > 0) {
-        const denied = new Set(disallowed.map(canonicalToolName));
+        const denied = new Set(disallowed);
         allowTools = allowTools.filter((n) => !denied.has(parseSkillToolEntry(n).name));
     }
     return { allowTools, lineageId: `skill:${skillName}` };

package/dist/core/task-registry-shared.d.ts

@@ -104,7 +104,7 @@ export interface BackgroundAgentTaskHandle extends SemaTaskHandle {
     durable?: DurableAgentLane;
     notify?: (notification: import("./task-notification.js").TaskNotificationPayload, opts?: {
         priority?: import("./task-notification.js").SystemInjectionPriority;
-    }) => void | "queued" | "parked" | "dropped_duplicate" | Promise<"queued" | "parked" | "dropped_duplicate">;
+    }) => "queued" | "parked" | "dropped_duplicate" | Promise<"queued" | "parked" | "dropped_duplicate">;
     retainedContinuation?: boolean;
     reviveCycle?: number;
     cycleSeq?: number;

package/dist/core/task-registry.d.ts

@@ -63,13 +63,17 @@ export interface AccessibleTaskRow {
     parentTaskId?: string;
     parentSessionId?: string;
     rootSessionId?: string;
+    createdAt?: number;
 }
 export declare class TaskRegistry {
     private handles;
     private sessionReapHooks;
     private bgQuiescenceWatchers;
-    private legacyToTaskId;
     private readonly notifier;
+    notifierFailureCounts(): ReadonlyArray<{
+        site: string;
+        count: number;
+    }>;
     private readonly core;
     durableAgentArmed(id: string): boolean;
     durableAgentRowProbe(id: string): (() => Promise<boolean>) | undefined;