@sema-agent/core 4.0.0 → 5.0.1

package/dist/core/task-registry.js

@@ -9,7 +9,7 @@ import { registerMonitorLane, pollMonitorLane, stopMonitorLane } from "./task-re
 import { registerWorkflowLane, pollWorkflowLane, stopWorkflowLane } from "./task-registry-workflow.js";
 import { mintCompletionId, canAccessWorkflowRun, formatWorkflowRun, clipTaskOutput, assertOwnership, sleepPollStep, statusFromBackground, rollSpoolText, accountDroppedBytes, renderSpoolBody, spoolDropNote, droppedGapNote, alreadyTerminalStopNote, terminalTaskSummary, TASK_OUTPUT_MAX_CHARS, MONITOR_BATCH_WINDOW_MS, MONITOR_DEFAULT_TIMEOUT_MS, MONITOR_MAX_TIMEOUT_MS, MONITOR_MAX_BATCHES_PER_MINUTE, canAccess, DURABLE_AGENT_HANDLE_RE, } from "./task-registry-shared.js";
 export { normalizeAgentName, DURABLE_AGENT_HEARTBEAT_MS, DURABLE_AGENT_HANDLE_RE, BG_AGENT_REAP_STOP_ERROR } from "./task-registry-shared.js";
-import { TASK_OUTPUT_TOOL_NAME, TASK_STOP_TOOL_NAME, TASK_OUTPUT_ALIASES, TASK_STOP_ALIASES, TASK_OUTPUT_CONTRACT, TASK_STOP_CONTRACT, TASK_OUTPUT_MISSING_ID_MESSAGE, TASK_STOP_MISSING_ID_MESSAGE, TASK_STOP_PARAMS, resolveTaskIdArg, REGISTRY_TASK_TOOL_CAPS, composeTaskOutputDescription, composeTaskOutputParams, composeTaskStopDescription, } from "./task-tool-shape.js";
+import { TASK_OUTPUT_TOOL_NAME, TASK_STOP_TOOL_NAME, TASK_OUTPUT_CONTRACT, TASK_STOP_CONTRACT, TASK_OUTPUT_MISSING_ID_MESSAGE, TASK_STOP_MISSING_ID_MESSAGE, TASK_STOP_PARAMS, resolveTaskIdArg, REGISTRY_TASK_TOOL_CAPS, composeTaskOutputDescription, composeTaskOutputParams, composeTaskStopDescription, } from "./task-tool-shape.js";
 import { durableAgentArmedLane, durableAgentRowProbeLane, beginDurableClaimLane, endDurableClaimLane, reapDurableAgentsLane, releaseDurableTranscriptAnchorLane, bindBackgroundAgentSessionLane, registerBackgroundAgentLane, parkBackgroundAgentLane, reconcileParkedAgentsLane, claimParkedAgentLane, rollbackParkedClaimLane, consumeParkedFlipLane, finalizeParkedResumeLane, settleBackgroundAgentLane, abortBackgroundAgentsForOwnerLane, serveDurableAgentRowLane, resolveBackgroundAgentByNameLane, markRetainedContinuationLane, reviveBackgroundAgentLane, settleRevivedAgentLane, unmarkRetainedContinuationLane, attachAgentNotifyLane, deliverToRunningAgentLane, runningBackgroundAgentLabelsLane, runningAgentFooterLane, notFoundRunningAgentsTail, pollBackgroundAgentLane, stopBackgroundAgentLane, } from "./task-registry-agent.js";
 export { canAccessWorkflowRun, clipTaskOutput, MONITOR_BATCH_WINDOW_MS, MONITOR_DEFAULT_TIMEOUT_MS, MONITOR_MAX_TIMEOUT_MS, MONITOR_MAX_BATCHES_PER_MINUTE };
 const BLOCK_DEFAULT_TIMEOUT_MS = 30_000;
@@ -102,8 +102,10 @@ export class TaskRegistry {
     handles = new Map();
     sessionReapHooks = new Set();
     bgQuiescenceWatchers = new Map();
-    legacyToTaskId = new Map();
     notifier = createSafeNotifier();
+    notifierFailureCounts() {
+        return this.notifier.failedSites().map((site) => ({ site, count: this.notifier.failuresAt(site) }));
+    }
     core = (() => {
         const self = this;
         return {
@@ -226,7 +228,7 @@ export class TaskRegistry {
         const prefix = TASK_PREFIX[type];
         for (let i = 0; i < 32; i++) {
             const id = `${prefix}${randomBytes(8).toString("hex")}`;
-            if (!this.handles.has(id) && !this.legacyToTaskId.has(id))
+            if (!this.handles.has(id))
                 return id;
         }
         throw new Error(`TaskRegistry: exhausted task id mint retries for ${type}`);
@@ -253,7 +255,6 @@ export class TaskRegistry {
             ...(input.onTerminal !== undefined ? { onTerminal: input.onTerminal } : {}),
             ...(input.outputFile !== undefined ? { outputFile: input.outputFile } : {}),
         });
-        this.legacyToTaskId.set(String(input.shellId), id);
         if (input.onTerminal)
             this.startBashWatcher(id, input.onTerminal);
         return id;
@@ -290,6 +291,7 @@ export class TaskRegistry {
             ...(hb.parentTaskId !== undefined ? { parentTaskId: hb.parentTaskId } : {}),
             ...(hb.parentSessionId !== undefined ? { parentSessionId: hb.parentSessionId } : {}),
             ...(hb.rootSessionId !== undefined ? { rootSessionId: hb.rootSessionId } : {}),
+            createdAt: h.createdAt,
         };
     }
     markStopSource(id, source) {
@@ -318,17 +320,9 @@ export class TaskRegistry {
         return marked;
     }
     markStopSourceByShellId(shellId, source, env) {
-        const sid = String(shellId);
-        const taskId = this.legacyToTaskId.get(sid);
-        if (taskId !== undefined) {
-            const handle = this.handles.get(taskId);
-            if (handle && handle.type === "background_bash" && (env === undefined || handle.env === env)) {
-                this.markStopSource(taskId, source);
-                return;
-            }
-        }
         if (env === undefined)
             return;
+        const sid = String(shellId);
         for (const [id, handle] of this.handles) {
             if (handle.type === "background_bash" && String(handle.shellId) === sid && handle.env === env) {
                 this.markStopSource(id, source);
@@ -349,9 +343,6 @@ export class TaskRegistry {
             }
             return true;
         };
-        const taskId = this.legacyToTaskId.get(sid);
-        if (taskId !== undefined && clear(taskId))
-            return;
         if (env === undefined)
             return;
         for (const [id, handle] of this.handles) {
@@ -958,11 +949,8 @@ The durable record is still marked running (last update ${new Date(row.updatedAt
             if (now - handle.updatedAt < terminalTtlMs)
                 continue;
             this.handles.delete(id);
-            if (handle.type === "background_bash") {
-                this.legacyToTaskId.delete(String(handle.shellId));
-                if (handle.watcher !== undefined)
-                    clearInterval(handle.watcher);
-            }
+            if (handle.type === "background_bash" && handle.watcher !== undefined)
+                clearInterval(handle.watcher);
             if (handle.type === "monitor" && handle.watcher !== undefined) {
                 handle.timers.clearInterval(handle.watcher);
                 handle.watcher = undefined;
@@ -999,7 +987,6 @@ The durable record is still marked running (last update ${new Date(row.updatedAt
             this.handles.delete(id);
             if (handle.status === "running" && handle.owner !== undefined)
                 evictedRunningOwners.add(handle.owner);
-            this.legacyToTaskId.delete(String(handle.shellId));
             if (handle.watcher !== undefined)
                 clearInterval(handle.watcher);
             deleted++;
@@ -1009,10 +996,7 @@ The durable record is still marked running (last update ${new Date(row.updatedAt
         return deleted;
     }
     resolveInternal(id, access) {
-        const taskId = this.handles.has(id) ? id : this.legacyToTaskId.get(id);
-        if (!taskId)
-            return undefined;
-        const handle = this.handles.get(taskId);
+        const handle = this.handles.get(id);
         if (!handle || !canAccess(handle, access))
             return undefined;
         return handle;
@@ -1216,14 +1200,13 @@ export function createTaskOutputTool(opts) {
     const caps = { ...REGISTRY_TASK_TOOL_CAPS, notification: opts.notificationWired !== false };
     return defineTool({
         name: TASK_OUTPUT_TOOL_NAME,
-        aliases: [...TASK_OUTPUT_ALIASES],
         contract: TASK_OUTPUT_CONTRACT,
         description: composeTaskOutputDescription(caps),
         parameters: composeTaskOutputParams(caps),
         effect: "read",
         execute: async (rawArgs, ctx) => {
             const args = rawArgs;
-            const id = resolveTaskIdArg(args.task_id, args.bash_id, args.runId);
+            const id = resolveTaskIdArg(args.task_id);
             if (!id)
                 return errorResult(TASK_OUTPUT_MISSING_ID_MESSAGE);
             const requestedMs = typeof args.timeout === "number" ? args.timeout : undefined;
@@ -1266,14 +1249,13 @@ export function createTaskOutputTool(opts) {
 export function createTaskStopTool(opts) {
     return defineTool({
         name: TASK_STOP_TOOL_NAME,
-        aliases: [...TASK_STOP_ALIASES],
         contract: TASK_STOP_CONTRACT,
         description: composeTaskStopDescription(REGISTRY_TASK_TOOL_CAPS),
         parameters: TASK_STOP_PARAMS,
         effect: "write",
         execute: async (rawArgs, ctx) => {
             const args = rawArgs;
-            const id = resolveTaskIdArg(args.task_id, args.shell_id, args.runId);
+            const id = resolveTaskIdArg(args.task_id, args.shell_id);
             if (!id)
                 return errorResult(TASK_STOP_MISSING_ID_MESSAGE);
             const r = await opts.registry.stopTask(id, { owner: ctx.taskId ?? opts.owner, scope: ctx.principal ?? opts.scope, ...((ctx.sessionId ?? opts.sessionId) !== undefined ? { sessionId: ctx.sessionId ?? opts.sessionId } : {}) }, { workflowStore: opts.workflowStore, agentStore: opts.agentStore });

package/dist/core/task-tool-shape.d.ts

@@ -1,8 +1,6 @@
 import { Type } from "typebox";
 export declare const TASK_OUTPUT_TOOL_NAME = "TaskOutput";
 export declare const TASK_STOP_TOOL_NAME = "TaskStop";
-export declare const TASK_OUTPUT_ALIASES: readonly ["BashOutput", "AgentOutputTool", "BashOutputTool", "AgentOutput", "WorkflowStatus"];
-export declare const TASK_STOP_ALIASES: readonly ["KillShell", "KillBash"];
 export declare const TASK_OUTPUT_CONTRACT: {
     readonly contractId: "core.task_output@1";
     readonly implementationRevision: "1";

package/dist/core/task-tool-shape.js

@@ -1,8 +1,6 @@
 import { Type } from "typebox";
 export const TASK_OUTPUT_TOOL_NAME = "TaskOutput";
 export const TASK_STOP_TOOL_NAME = "TaskStop";
-export const TASK_OUTPUT_ALIASES = ["BashOutput", "AgentOutputTool", "BashOutputTool", "AgentOutput", "WorkflowStatus"];
-export const TASK_STOP_ALIASES = ["KillShell", "KillBash"];
 export const TASK_OUTPUT_CONTRACT = { contractId: "core.task_output@1", implementationRevision: "1" };
 export const TASK_STOP_CONTRACT = { contractId: "core.task_stop@1", implementationRevision: "1" };
 export const TASK_OUTPUT_MISSING_ID_MESSAGE = "Error (TaskOutput): Missing required parameter: task_id";
@@ -50,9 +48,8 @@ export function composeTaskOutputDescription(caps) {
             "poll captures any final output. ");
     }
     if (!caps.lanes)
-        parts.push("Optional `filter` is a regex keeping only matching lines. ");
-    parts.push("Legacy bash_id and runId arguments are accepted for compatibility.");
-    return parts.join("");
+        parts.push("Optional `filter` is a regex keeping only matching lines.");
+    return parts.join("").trimEnd();
 }
 export function composeTaskStopDescription(caps) {
     return [

package/dist/core/tool-name-aliases.d.ts

@@ -1,2 +1 @@
-export declare const TOMBSTONED_TOOLS: Readonly<Record<string, string>>;
-export declare function canonicalToolName(name: string): string;
+export declare const RETIRED_TOOL_NAMES: ReadonlyMap<string, string>;

package/dist/core/tool-name-aliases.js

@@ -1,60 +1,42 @@
-const OLD_TO_NEW = {
-    recall: "Recall",
-    remember: "Remember",
-    read_file: "Read",
-    edit_file: "Edit",
-    write_file: "Write",
-    bash: "Bash",
-    bash_readonly: "Bash",
-    glob: "Glob",
-    grep: "Grep",
-    web_fetch: "WebFetch",
-    tool_search: "ToolSearch",
-    skill: "Skill",
-    present_plan: "ExitPlanMode",
-    enter_plan_mode: "EnterPlanMode",
-    spawn_subagent: "Agent",
-    CronCancel: "CronDelete",
-    lsp: "LSP",
-    submit_output: "StructuredOutput",
-    repo_map: "RepoMap",
-    read_tool_result: "ReadToolResult",
-    report_blocked: "ReportBlocked",
-    declare_done: "DeclareDone",
-    run_workflow: "Workflow",
-    RunWorkflow: "Workflow",
-    Task: "Agent",
-    BashOutput: "TaskOutput",
-    AgentOutputTool: "TaskOutput",
-    BashOutputTool: "TaskOutput",
-    AgentOutput: "TaskOutput",
-    KillShell: "TaskStop",
-    KillBash: "TaskStop",
-    ListMcpResources: "ListMcpResourcesTool",
-    ReadMcpResource: "ReadMcpResourceTool",
-    ReadMcpResourceDir: "ReadMcpResourceDirTool",
-    MultiEdit: "Edit",
-    Fork: "Agent",
-    WorkflowStatus: "TaskOutput",
-};
-const MEMORY_TOOLS_TOMBSTONE = "The Remember/Recall memory tools were removed (design/138): long-term memory is now file-based. " +
-    "Durable notes live in the memory directory shown in your # Memory instruction (MEMORY.md index + topic files) — " +
-    "use your ordinary file tools (Read/Write/Edit) on those files to record or look up memories. " +
-    "If no # Memory section is present, memory is not enabled for this task; do not retry this tool.";
-export const TOMBSTONED_TOOLS = {
-    Sleep: 'Sleep was removed. To pause and resume later, schedule a self-contained re-wake with CronCreate({ schedule: { kind: "delay", delaySec: … }, prompt: "<what to do on wake>" }) and then end your turn. To wait for an external condition or a long-running command, use Monitor. Do not poll in a loop.',
-    Fork: 'Fork was removed as a standalone tool. Use Agent with subagent_type: "fork" instead — it spawns the same context-inheriting child (pass your directive as \'prompt\'; run_in_background is supported).',
-    Remember: MEMORY_TOOLS_TOMBSTONE,
-    remember: MEMORY_TOOLS_TOMBSTONE,
-    Recall: MEMORY_TOOLS_TOMBSTONE,
-    recall: MEMORY_TOOLS_TOMBSTONE,
-};
-const MCP_PREFIX = "mcp__";
-const MCP_NAME_SEP = "__";
-export function canonicalToolName(name) {
-    const mapped = Object.hasOwn(OLD_TO_NEW, name) ? OLD_TO_NEW[name] : undefined;
-    const renamed = typeof mapped === "string" ? mapped : name;
-    if (renamed.includes(MCP_NAME_SEP) && !renamed.startsWith(MCP_PREFIX))
-        return MCP_PREFIX + renamed;
-    return renamed;
-}
+export const RETIRED_TOOL_NAMES = new Map([
+    ["read_file", 'renamed "Read"'],
+    ["edit_file", 'renamed "Edit"'],
+    ["write_file", 'renamed "Write"'],
+    ["bash", 'renamed "Bash"'],
+    ["bash_readonly", 'folded into "Bash" (read-only posture rides handsReadOnly/shellGate, not a tool name)'],
+    ["glob", 'renamed "Glob"'],
+    ["grep", 'renamed "Grep"'],
+    ["web_fetch", 'renamed "WebFetch"'],
+    ["tool_search", 'renamed "ToolSearch"'],
+    ["skill", 'renamed "Skill"'],
+    ["present_plan", 'renamed "ExitPlanMode"'],
+    ["enter_plan_mode", 'renamed "EnterPlanMode"'],
+    ["spawn_subagent", 'renamed "Agent"'],
+    ["CronCancel", 'renamed "CronDelete"'],
+    ["lsp", 'renamed "LSP"'],
+    ["submit_output", 'renamed "StructuredOutput"'],
+    ["repo_map", 'renamed "RepoMap"'],
+    ["read_tool_result", 'renamed "ReadToolResult"'],
+    ["report_blocked", 'renamed "ReportBlocked"'],
+    ["declare_done", 'renamed "DeclareDone"'],
+    ["run_workflow", 'renamed "Workflow"'],
+    ["RunWorkflow", 'renamed "Workflow"'],
+    ["Task", 'renamed "Agent" (a deployment-defined tool named "Task" is fine — this fires only when the name matches nothing in the roster)'],
+    ["BashOutput", 'renamed "TaskOutput"'],
+    ["AgentOutputTool", 'renamed "TaskOutput"'],
+    ["BashOutputTool", 'renamed "TaskOutput"'],
+    ["AgentOutput", 'renamed "TaskOutput"'],
+    ["WorkflowStatus", 'folded into "TaskOutput" (poll by runId)'],
+    ["KillShell", 'renamed "TaskStop"'],
+    ["KillBash", 'renamed "TaskStop"'],
+    ["ListMcpResources", 'renamed "ListMcpResourcesTool"'],
+    ["ReadMcpResource", 'renamed "ReadMcpResourceTool"'],
+    ["ReadMcpResourceDir", 'renamed "ReadMcpResourceDirTool"'],
+    ["MultiEdit", 'removed — "Edit" accepts the edits[] shape'],
+    ["Fork", 'removed — use Agent with subagent_type: "fork"'],
+    ["Sleep", "removed — schedule a re-wake with CronCreate({schedule:{kind:\"delay\"}}) or wait with Monitor"],
+    ["Remember", "removed — memory is file-based; write the memory directory with the ordinary file tools"],
+    ["remember", "removed — memory is file-based; write the memory directory with the ordinary file tools"],
+    ["Recall", "removed — memory is file-based; read the memory directory with the ordinary file tools"],
+    ["recall", "removed — memory is file-based; read the memory directory with the ordinary file tools"],
+]);

package/dist/core/tool-policy.js

@@ -2,7 +2,6 @@ import { homedir } from "node:os";
 import { isAbsolute, join, normalize as normalizePath, sep } from "node:path";
 import { BASH_READONLY_DEFAULT_ALLOW, parseLeadingCommandName } from "../tools/fs/index.js";
 import { writeTargetPath } from "../tools/fs/safety.js";
-import { canonicalToolName } from "./tool-name-aliases.js";
 export function decisionText(d) {
     return d.message ?? d.reason;
 }
@@ -33,12 +32,12 @@ export function toolPolicyNameSets(p) {
     return Array.isArray(sets) ? sets : [];
 }
 export function createAllowDenyPolicy(opts) {
-    const allow = opts.allow ? new Set(opts.allow.map(canonicalToolName)) : undefined;
-    const deny = new Set((opts.deny ?? []).map(canonicalToolName));
+    const allow = opts.allow ? new Set(opts.allow) : undefined;
+    const deny = new Set(opts.deny ?? []);
     return {
         nameSets: [{ ...(opts.allow ? { allow: [...opts.allow] } : {}), ...(opts.deny ? { deny: [...opts.deny] } : {}) }],
         check(req) {
-            const toolName = canonicalToolName(req.toolName);
+            const toolName = req.toolName;
             if (deny.has(toolName)) {
                 return { action: "deny", reason: `tool "${req.toolName}" is denied by policy` };
             }
@@ -53,9 +52,9 @@ export function createApprovalPolicy(opts) {
     if (opts.approvalTimeoutMs !== undefined && !Number.isFinite(opts.approvalTimeoutMs)) {
         throw new Error(`createApprovalPolicy: approvalTimeoutMs must be a finite number of ms (got ${opts.approvalTimeoutMs}) — omit it to wait indefinitely`);
     }
-    const need = new Set(opts.requireApproval.map(canonicalToolName));
-    const deny = new Set((opts.deny ?? []).map(canonicalToolName));
-    const auto = new Set((opts.autoAllow ?? []).map(canonicalToolName));
+    const need = new Set(opts.requireApproval);
+    const deny = new Set(opts.deny ?? []);
+    const auto = new Set(opts.autoAllow ?? []);
     return {
         nameSets: [
             {
@@ -65,7 +64,7 @@ export function createApprovalPolicy(opts) {
             },
         ],
         async check(req, signal) {
-            const toolName = canonicalToolName(req.toolName);
+            const toolName = req.toolName;
             if (deny.has(toolName)) {
                 return { action: "deny", reason: `tool "${req.toolName}" is denied by policy` };
             }
@@ -123,7 +122,7 @@ export function combinePolicies(...policies) {
 }
 export const COARSE_SHELL_TOOLS = ["Bash", "Monitor"];
 function canonicalToolNameSet(tools) {
-    return new Set((tools ?? COARSE_SHELL_TOOLS).map(canonicalToolName));
+    return new Set(tools ?? COARSE_SHELL_TOOLS);
 }
 export function createCoarseCommandNamePolicy(opts) {
     const allow = opts.allow ? new Set(opts.allow) : undefined;
@@ -135,7 +134,7 @@ export function createCoarseCommandNamePolicy(opts) {
         : { action: "ask", message: reason, decisionReason: "rule" };
     return {
         check(req) {
-            if (!shellTools.has(canonicalToolName(req.toolName)))
+            if (!shellTools.has(req.toolName))
                 return ALLOW;
             const command = req.args?.command;
             if (typeof command !== "string") {
@@ -383,7 +382,7 @@ export function createUnverifiableDeletePolicy(opts) {
     const shellTools = canonicalToolNameSet(opts?.tools);
     return {
         check(req) {
-            if (!shellTools.has(canonicalToolName(req.toolName)))
+            if (!shellTools.has(req.toolName))
                 return ALLOW;
             const command = req.args?.command;
             if (typeof command !== "string")
@@ -476,7 +475,7 @@ export function createTranscriptIntegrityPolicy(opts) {
     });
     return {
         check(req) {
-            const toolName = canonicalToolName(req.toolName);
+            const toolName = req.toolName;
             if (shellTools.has(toolName)) {
                 const command = req.args?.command;
                 if (typeof command !== "string")

package/dist/core/trace.d.ts

@@ -176,6 +176,13 @@ export type TraceEvent = {
     reason: "breaker_open" | "rate_limit" | "budget" | "server_error" | "last_resort";
     atTurn: number;
     ts: number;
+} | {
+    kind: "observer.notify_failed";
+    version: 1;
+    taskId: string;
+    site: string;
+    message: string;
+    ts: number;
 } | {
     kind: "brain.failover";
     version: 1;

package/dist/core/untrusted-egress.d.ts

@@ -1,5 +1,7 @@
-export declare function redactSecrets(s: string): string;
-export declare function redactHostLeaks(s: string): string;
+import { type RedactionReport } from "./arg-summary.js";
+export type { RedactionFinding, RedactionReport, RedactionConfidence } from "./arg-summary.js";
+export declare function redactSecrets(s: string, report?: RedactionReport): string;
+export declare function redactHostLeaks(s: string, report?: RedactionReport): string;
 export declare function boundedRedactedSummary(value: unknown, max: number): string;
 export declare function untrustedEgressForHuman(value: unknown, opts: {
     label: string;

package/dist/core/untrusted-egress.js

@@ -1,5 +1,5 @@
 import { delimitUntrusted } from "./untrusted-text.js";
-import { scrubSecrets } from "./arg-summary.js";
+import { scrubSecrets, SECRET_PASSES, runRedactionPasses } from "./arg-summary.js";
 import { sliceHeadSafe } from "./surrogate-safe-slice.js";
 const URI_SCHEME = String.raw `[A-Za-z][A-Za-z0-9+.\-_]{0,63}`;
 const CREDENTIALS_IN_AUTHORITY = new RegExp(String.raw `(${URI_SCHEME}:\/\/)((?:[^/\s"'@]*@)+)`, "gi");
@@ -15,15 +15,27 @@ function redactUserinfo(scheme, userinfoWithAt) {
     }
     return `${scheme}${userinfo.slice(0, colonIdx)}:[redacted-credentials]@`;
 }
-export function redactSecrets(s) {
-    return scrubSecrets(s)
-        .replace(CREDENTIALS_IN_AUTHORITY, (_m, scheme, userinfo) => redactUserinfo(scheme, userinfo))
-        .replace(/([?&#](?:sig|signature|sas|code)=)[^&\s"'#]+/gi, "$1[redacted]");
+const SECRET_TIER_PASSES = [
+    ...SECRET_PASSES,
+    {
+        kind: "url-credentials",
+        confidence: "medium",
+        marker: "[redacted-credentials]",
+        re: CREDENTIALS_IN_AUTHORITY,
+        replace: (_m, scheme, userinfo) => redactUserinfo(scheme, userinfo),
+    },
+    { kind: "signed-url-param", confidence: "high", marker: "[redacted]", re: /([?&#](?:sig|signature|sas|code)=)[^&\s"'#]+/gi, replace: "$1[redacted]" },
+];
+export function redactSecrets(s, report) {
+    return runRedactionPasses(s, SECRET_TIER_PASSES, report);
 }
-export function redactHostLeaks(s) {
-    return redactSecrets(s)
-        .replace(URL_OF_ANY_PROTOCOL, "[redacted-url]")
-        .replace(/(?:\/[A-Za-z0-9_.-]+){2,}/g, "[redacted-path]");
+const HOST_LEAK_PASSES = [
+    ...SECRET_TIER_PASSES,
+    { kind: "url", confidence: "medium", marker: "[redacted-url]", re: URL_OF_ANY_PROTOCOL, replace: "[redacted-url]" },
+    { kind: "fs-path", confidence: "low", marker: "[redacted-path]", re: /(?:\/[A-Za-z0-9_.-]+){2,}/g, replace: "[redacted-path]" },
+];
+export function redactHostLeaks(s, report) {
+    return runRedactionPasses(s, HOST_LEAK_PASSES, report);
 }
 const REDACTION_MARKER_RE = /\[redacted(?:-[a-z]+)?\]/g;
 function countRedactionMarkers(s) {

package/dist/engine/execution-env/node-execution-env.js

@@ -270,7 +270,7 @@ export class NodeExecutionEnv {
         this.backgroundCapabilities = {
             supported: true,
             maxConcurrent: 8,
-            defaultBgTimeoutSec: 30 * 60,
+            defaultBgTimeoutSec: 60 * 60,
             maxBgTimeoutSec: 2 * 60 * 60,
             supportsDetach: true,
             retainBackgroundProcesses: this.retainBackgroundProcesses,

package/dist/engine/loop/agent-loop.js

@@ -1,5 +1,4 @@
 import { findToolByName, validateToolArguments } from "../llm/index.js";
-import { TOMBSTONED_TOOLS } from "../../core/tool-name-aliases.js";
 import { resolveAgentCoreStreamFn } from "./runtime-deps.js";
 function appendTextDeltaToAssistantMessage(message, contentIndex, delta) {
     const content = [...message.content];
@@ -933,19 +932,11 @@ function prepareToolCallArguments(tool, toolCall) {
 async function prepareToolCall(currentContext, assistantMessage, toolCall, config, signal) {
     const tool = findToolByName(currentContext.tools, toolCall.name);
     if (!tool) {
-        const tombstoneEntry = Object.hasOwn(TOMBSTONED_TOOLS, toolCall.name) ? TOMBSTONED_TOOLS[toolCall.name] : undefined;
-        const tombstone = typeof tombstoneEntry === "string" ? tombstoneEntry : undefined;
-        if (tombstone !== undefined) {
-            return {
-                kind: "immediate",
-                result: createErrorToolResult(tombstone),
-                isError: true,
-            };
-        }
-        const available = (currentContext.tools ?? []).map((t) => t.name).join(", ");
+        const availableTools = (currentContext.tools ?? []).map((t) => t.name);
+        const available = availableTools.join(", ");
         return {
             kind: "immediate",
-            result: createErrorToolResult(`Tool ${toolCall.name} not found.${available ? ` Available tools: ${available}` : ""}`),
+            result: createErrorToolResult(`Tool ${toolCall.name} not found.${available ? ` Available tools: ${available}` : ""}`, { details: { code: "tool.not_found", toolName: toolCall.name, availableTools } }),
             isError: true,
         };
     }

package/dist/index.d.ts

@@ -82,8 +82,8 @@ export { maybeCompact, type MaybeCompactOptions, type CompactionWindowSafetyInfo
 export { brainToRuntime } from "./core/runtime.js";
 export { createSensitivePathPolicy, RECOMMENDED_SENSITIVE_PATTERNS } from "./core/sensitive-path-policy.js";
 export { createFsWriteGatePolicy, type FsWriteGatePolicyOptions } from "./core/fs-write-gate-policy.js";
-export { canonicalToolName, TOMBSTONED_TOOLS } from "./core/tool-name-aliases.js";
-export { DEFAULT_SUBAGENT_TOOL_NAME, LEGACY_SUBAGENT_TOOL_NAME, SESSION_BG_DEFAULT_TIMEOUT_SEC } from "./agents/subagent.js";
+export { RETIRED_TOOL_NAMES } from "./core/tool-name-aliases.js";
+export { DEFAULT_SUBAGENT_TOOL_NAME, SESSION_BG_DEFAULT_TIMEOUT_SEC } from "./agents/subagent.js";
 export { renderTaskNotificationXml, taskNotificationDedupKey, SystemInjectionQueue, type TaskNotificationPayload, type TaskNotificationStatus, type ExternalNotificationInput, type SystemInjection, type SystemInjectionPriority, } from "./core/task-notification.js";
 export { TaskRegistry, defaultTaskRegistry, createTaskOutputTool, createTaskStopTool, type SemaTaskType, type SemaTaskStatus, type SemaTaskHandle, type ParkedClaimTicket, type TaskAccess, type UnifiedTaskOutput, type TaskRetrievalStatus, type StopSource, type RegisterMonitorInput, type MonitorTimers, MONITOR_BATCH_WINDOW_MS, MONITOR_DEFAULT_TIMEOUT_MS, MONITOR_MAX_TIMEOUT_MS, MONITOR_MAX_BATCHES_PER_MINUTE, canAccessWorkflowRun, DURABLE_AGENT_HANDLE_RE, } from "./core/task-registry.js";
 export { InMemoryMailboxStore, type MailboxStore, type MailboxMessage, type MailboxLease } from "./core/mailbox-store.js";
@@ -166,6 +166,7 @@ export { type BackgroundAgentStore, type BackgroundAgentRecord, type BackgroundA
 export { FileBackgroundAgentStore, type FileBackgroundAgentStoreOptions } from "./stores/file/background-agent-store.js";
 export { type WorkflowJournalStore, type WorkflowJournalEntry, InMemoryWorkflowJournalStore, callKeyOrdinal, JOURNAL_OVERSIZE_ERROR_CODE, } from "./core/workflow-journal-store.js";
 export { untrustedEgressForHuman, redactHostLeaks, redactSecrets, boundedRedactedSummary } from "./core/untrusted-egress.js";
+export type { RedactionFinding, RedactionReport, RedactionConfidence } from "./core/untrusted-egress.js";
 export { MemoryRosterStore, FileRosterStore, type RosterStore, type RosterEntry, type RosterAccess, type RosterGcOptions } from "./agents/roster-store.js";
 export { CONFIG_CATALOG_VERSION, describeConfigCatalog, resolveEffectiveConfig, type ConfigKnob, type ConfigOverrideDeclaration, type ConfigProvenance, type EffectiveConfigField, } from "./config/catalog.js";
 export { normalizeAgentName } from "./core/task-registry.js";

package/dist/index.js

@@ -71,8 +71,8 @@ export { maybeCompact } from "./core/auto-compaction.js";
 export { brainToRuntime } from "./core/runtime.js";
 export { createSensitivePathPolicy, RECOMMENDED_SENSITIVE_PATTERNS } from "./core/sensitive-path-policy.js";
 export { createFsWriteGatePolicy } from "./core/fs-write-gate-policy.js";
-export { canonicalToolName, TOMBSTONED_TOOLS } from "./core/tool-name-aliases.js";
-export { DEFAULT_SUBAGENT_TOOL_NAME, LEGACY_SUBAGENT_TOOL_NAME, SESSION_BG_DEFAULT_TIMEOUT_SEC } from "./agents/subagent.js";
+export { RETIRED_TOOL_NAMES } from "./core/tool-name-aliases.js";
+export { DEFAULT_SUBAGENT_TOOL_NAME, SESSION_BG_DEFAULT_TIMEOUT_SEC } from "./agents/subagent.js";
 export { renderTaskNotificationXml, taskNotificationDedupKey, SystemInjectionQueue, } from "./core/task-notification.js";
 export { TaskRegistry, defaultTaskRegistry, createTaskOutputTool, createTaskStopTool, MONITOR_BATCH_WINDOW_MS, MONITOR_DEFAULT_TIMEOUT_MS, MONITOR_MAX_TIMEOUT_MS, MONITOR_MAX_BATCHES_PER_MINUTE, canAccessWorkflowRun, DURABLE_AGENT_HANDLE_RE, } from "./core/task-registry.js";
 export { InMemoryMailboxStore } from "./core/mailbox-store.js";

package/dist/orchestration/run-spec.js

@@ -5,9 +5,8 @@ import { combinePolicies } from "../core/tool-policy.js";
 import { delimitUntrusted } from "../core/untrusted-text.js";
 import { isDurablePause } from "../agents/suspend-guard.js";
 import { isAbsolutePathForm, writeTargetPath } from "../tools/fs/safety.js";
-import { canonicalToolName } from "../core/tool-name-aliases.js";
 import { captureBaseline, resolveFrozenPaths, restoreFrozenPaths, runOracle, snapshotFrozenPaths, specError, } from "../core/spec-contract.js";
-const WRITE_TOOLS = new Set(["Write", "Edit", "MultiEdit", "NotebookEdit"].map(canonicalToolName));
+const WRITE_TOOLS = new Set(["Write", "Edit", "NotebookEdit"]);
 const CASE_INSENSITIVE_FS = process.platform === "darwin" || process.platform === "win32";
 const pathKey = (p) => {
     let n = p.replace(/\\/g, "/");
@@ -19,7 +18,7 @@ function frozenDenyPolicy(rootDir, frozenResolved) {
     const frozen = new Set(frozenResolved.map(pathKey));
     return {
         check(req) {
-            const toolName = canonicalToolName(req.toolName);
+            const toolName = req.toolName;
             if (!WRITE_TOOLS.has(toolName))
                 return { action: "allow" };
             const args = req.args;

package/dist/orchestration/run-workflow-tool.js

@@ -175,7 +175,6 @@ export async function createRunWorkflowTool(d) {
     const structuredError = (message) => errorResult(JSON.stringify({ error: message }));
     return defineTool({
         name: RUN_WORKFLOW_TOOL_NAME,
-        aliases: ["RunWorkflow", "run_workflow"],
         contract: { contractId: "core.workflow@1", implementationRevision: "1" },
         approvalPreview: (raw) => {
             const a = (raw ?? {});

package/dist/orchestration/workflow-governance.js

@@ -1,4 +1,5 @@
 import { tightenTaskSpec } from "../core/tighten-task-spec.js";
+import { sanitizeUntrustedText } from "../core/untrusted-text.js";
 import { WorkflowScriptError } from "./workflow-meta.js";
 export class WorkflowModelNotAllowedError extends Error {
     modelName;
@@ -81,7 +82,7 @@ function pickWhitelist(scriptSpec) {
     if (s.systemPrompt !== undefined) {
         if (typeof s.systemPrompt !== "string")
             throw new WorkflowScriptError("agent(spec): `systemPrompt` must be a string");
-        safe.systemPrompt = s.systemPrompt;
+        safe.systemPrompt = `[workflow-script-authored persona — task guidance, not engine authority]\n${sanitizeUntrustedText(s.systemPrompt)}`;
     }
     if (s.images !== undefined) {
         if (!Array.isArray(s.images))

package/dist/orchestration/workflow.d.ts

@@ -89,6 +89,7 @@ export interface RunWorkflowOptions {
     maxLogChars?: number;
     maxResultChars?: number;
     onEvent?: (e: WorkflowEvent) => void;
+    onNotifyError?: (failure: import("../core/safe-notify.js").SafeNotifyFailure) => void;
     now?: () => number;
     journalStore?: WorkflowJournalStore;
     resumeFromRunId?: string;

package/dist/orchestration/workflow.js

@@ -321,7 +321,7 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
     const workflowSignal = signalSources.length === 1 ? signalSources[0] : AbortSignal.any(signalSources);
     let timeoutTimer;
     let storeRev = 0;
-    const notifier = createSafeNotifier();
+    const notifier = createSafeNotifier(opts.onNotifyError !== undefined ? { onError: opts.onNotifyError } : undefined);
     const emit = (e) => {
         publishWorkflowEvent(runId, e);
         notifier.notify(() => opts.onEvent?.(e), "workflow.onEvent");

package/dist/prompt-assembly/packs/sema-default.js

@@ -1,7 +1,7 @@
 import { CYBER_RISK, EXECUTION_ENVIRONMENT, URL_SAFETY, SUMMARIZE_TOOL_RESULTS, WORKTREE_NOTICE, SUBAGENT_CONSENT_NOTICE, SUBAGENT_DELIVERY_NOTES, harnessHeadLines, } from "../../prompts/default.js";
 import { GOAL_COMPLETION_GUIDANCE, ORCHESTRATION_AWARENESS, ORCHESTRATION_GUIDANCE, ORCHESTRATION_GUIDANCE_DEFERRED, SUPERVISOR_PROMPT, } from "../../prompts/supervisor.js";
 import { TEAMMATE_COMMUNICATION_ADDENDUM } from "../../prompts/coordinator.js";
-import { SIMPLE_ACTION_CAUTION, SIMPLE_ACT_DONT_REDERIVE, SIMPLE_AUTONOMY_FABLE, SIMPLE_COMMUNICATING_FABLE, SIMPLE_CORRECTIONS_FABLE, SIMPLE_DELIVERING_WORK_FABLE, SIMPLE_COMMUNICATING_LEAN, SIMPLE_CONTEXT_MANAGEMENT, SIMPLE_INVESTIGATE_FIRST, SIMPLE_PRONOUNS, SIMPLE_TASK_CONTINUITY, SIMPLE_TOOL_PARAM_JSON, SEMA_VERIFY_FRESH, SEMA_EVIDENCE_AUDIT, } from "../../prompts/simple-sections.js";
+import { SIMPLE_ACTION_CAUTION, SIMPLE_ACT_DONT_REDERIVE, SIMPLE_AUTONOMY_FABLE, SIMPLE_COMMUNICATING_FABLE, SIMPLE_CORRECTIONS_FABLE, SIMPLE_DELIVERING_WORK_FABLE, SIMPLE_COMMUNICATING_LEAN, SIMPLE_CONTEXT_MANAGEMENT, SIMPLE_PRONOUNS, SIMPLE_TOOL_PARAM_JSON, SEMA_VERIFY_FRESH, SEMA_EVIDENCE_AUDIT, } from "../../prompts/simple-sections.js";
 function harnessHeadText(inputs) {
     return harnessHeadLines(inputs.facts);
 }
@@ -47,9 +47,7 @@ export const SEMA_DEFAULT_PACK = {
         { id: "core/simple.communicating", slot: "harness", rank: 250, ...CORE, admit: (i) => i.facts.promptProfile !== "classic", content: (i) => (i.facts.fableMitigations === true ? SIMPLE_COMMUNICATING_FABLE : SIMPLE_COMMUNICATING_LEAN), legacyBlockId: "harness.context" },
         { id: "core/simple.pronouns", slot: "harness", rank: 252, ...CORE, admit: (i) => i.facts.promptProfile !== "classic", content: () => SIMPLE_PRONOUNS, legacyBlockId: "harness.context" },
         { id: "core/simple.action-caution", slot: "harness", rank: 254, ...CORE, admit: (i) => i.facts.promptProfile !== "classic", content: () => SIMPLE_ACTION_CAUTION, legacyBlockId: "harness.context" },
-        { id: "core/simple.task-continuity", slot: "harness", rank: 256, ...CORE, admit: (i) => i.facts.promptProfile !== "classic", content: () => SIMPLE_TASK_CONTINUITY, legacyBlockId: "harness.context" },
         { id: "core/simple.tool-param-json", slot: "harness", rank: 258, ...CORE, admit: (i) => i.facts.promptProfile !== "classic", content: () => SIMPLE_TOOL_PARAM_JSON, legacyBlockId: "harness.context" },
-        { id: "core/simple.investigate-first", slot: "harness", rank: 260, ...CORE, admit: (i) => i.facts.promptProfile !== "classic", content: () => SIMPLE_INVESTIGATE_FIRST, legacyBlockId: "harness.context" },
         { id: "core/simple.context-management", slot: "harness", rank: 262, ...CORE, admit: (i) => i.facts.promptProfile !== "classic" && i.facts.withinTaskCompactionEnabled, content: () => SIMPLE_CONTEXT_MANAGEMENT, legacyBlockId: "harness.context" },
         { id: "core/simple.act-dont-rederive", slot: "harness", rank: 264, ...CORE, admit: (i) => i.facts.promptProfile !== "classic", content: () => SIMPLE_ACT_DONT_REDERIVE, legacyBlockId: "harness.context" },
         { id: "core/simple.delivering-work", slot: "harness", rank: 265, ...CORE, admit: (i) => i.facts.promptProfile !== "classic" && i.facts.fableMitigations === true, content: () => SIMPLE_DELIVERING_WORK_FABLE, legacyBlockId: "harness.context" },

package/dist/prompts/default.js

@@ -1,6 +1,6 @@
 import { inlineUntrusted, sanitizeUntrustedText } from "../core/untrusted-text.js";
 import { GOAL_COMPLETION_GUIDANCE, ORCHESTRATION_AWARENESS, ORCHESTRATION_GUIDANCE, ORCHESTRATION_GUIDANCE_DEFERRED, SUPERVISOR_PROMPT } from "./supervisor.js";
-import { SIMPLE_ACTION_CAUTION, SIMPLE_ACT_DONT_REDERIVE, SIMPLE_AUTONOMY_FABLE, SIMPLE_COMMUNICATING_FABLE, SIMPLE_COMMUNICATING_LEAN, SIMPLE_CONTEXT_MANAGEMENT, SIMPLE_CORRECTIONS_FABLE, SIMPLE_DELIVERING_WORK_FABLE, SIMPLE_INVESTIGATE_FIRST, SIMPLE_PRONOUNS, SIMPLE_TASK_CONTINUITY, SIMPLE_TOOL_PARAM_JSON, SEMA_VERIFY_FRESH, SEMA_EVIDENCE_AUDIT, } from "./simple-sections.js";
+import { SIMPLE_ACTION_CAUTION, SIMPLE_ACT_DONT_REDERIVE, SIMPLE_AUTONOMY_FABLE, SIMPLE_COMMUNICATING_FABLE, SIMPLE_COMMUNICATING_LEAN, SIMPLE_CONTEXT_MANAGEMENT, SIMPLE_CORRECTIONS_FABLE, SIMPLE_DELIVERING_WORK_FABLE, SIMPLE_PRONOUNS, SIMPLE_TOOL_PARAM_JSON, SEMA_VERIFY_FRESH, SEMA_EVIDENCE_AUDIT, } from "./simple-sections.js";
 export const OUTPUT_EFFICIENCY = "If you can say it in one sentence, don't use three. Go straight to the point, don't go in circles, " +
     "don't overdo it. (This does not apply to code or tool calls.)";
 export const DEFAULT_SYSTEM_PROMPT = `You are a capable AI agent that acts through tools.
@@ -153,9 +153,7 @@ export function harnessContext(ctx) {
         blocks.push(ctx.fableMitigations === true ? SIMPLE_COMMUNICATING_FABLE : SIMPLE_COMMUNICATING_LEAN);
         blocks.push(SIMPLE_PRONOUNS);
         blocks.push(SIMPLE_ACTION_CAUTION);
-        blocks.push(SIMPLE_TASK_CONTINUITY);
         blocks.push(SIMPLE_TOOL_PARAM_JSON);
-        blocks.push(SIMPLE_INVESTIGATE_FIRST);
         if (ctx.withinTaskCompactionEnabled)
             blocks.push(SIMPLE_CONTEXT_MANAGEMENT);
         blocks.push(SIMPLE_ACT_DONT_REDERIVE);