@sema-agent/core 5.0.0 → 5.0.1

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 5.0.1 (2026-08-02)
+
+_Post-release review patch: the 5.0.0 review wave (five domain reviewers + two independent codex legs) surfaced silent-widening gaps in the new audit surfaces plus wiring/anchoring stragglers. All fixes are loud-direction; no new API._
+
+**Fixed**
+
+- **Persisted session/ancestor rules join the retired-name audit (review G-2).** Session-rule policies were composed after the only policy-name audit pass and exposed no name metadata — a stored `{toolDeny: ["bash"]}` compiled clean and silently widened. The audit is now a reusable pass run over every narrowing layer, and `createSessionRulePolicy` returns a `NamedToolPolicy`.
+- **Pre-prefix MCP names reach the hard arm (review G-3).** The `config.legacy_tool_name` check only consulted the static `RETIRED_TOOL_NAMES` map, which cannot enumerate dynamic MCP names — a v4-era policy entry like `github__delete_repository` (auto-prefixed by the retired canonicalizer) degraded to an advisory and the destructive call ran. An unmatched `__`-shaped name without the `mcp__` prefix now hard-fails prepare with prefix guidance; an `mcp__*` miss stays advisory (the server may not be mounted this run).
+- **Repair-loop accounts stay live across an in-flight attempt (review G-4, time half).** A checkpoint minted mid-attempt clones the threaded bundle at that instant, and only a pre-dispatch stamp existed — an attempt that ran 900ms and parked persisted ~zero elapsed time, so the resume re-granted the washed budget. An unref'd 1s interval keeps the stamp current. (The money half — mid-flight partial spend — is tracked separately: it has a double-count design question against the resumed attempt's own stats.)
+- **Permission-rule policies join the retired-name audit (review F-6).** `createPermissionRulePolicy` now returns a `NamedToolPolicy` exposing its compiled tool names as `nameSets`, so the prepare-time policy-name audit covers rule policies: a rule written with a RETIRED name (e.g. `{rule: "bash", behavior: "deny"}`) that matches nothing in the run's roster is now the same HARD `config.legacy_tool_name` prepare failure as a list policy — previously it compiled with zero issues and the deny silently guarded nothing. A deployment mounting its own tool under a retired name is unaffected (roster hit). Behavior note: configs carrying such stale rules now fail loudly at prepare instead of running silently widened.
+- **Name-addressed revives anchor correctly (review F-1).** The SendMessage by-name resolution hand-copy dropped `createdAt`, so a `{to: NAME}` revive's spawn frame fell back to the wake instant for `startedAt` — the exact-id rung was fixed in 5.0.0, the name rung is now too.
+- **Two more revive legs chain `root ?? parent` (review F-8).** The revived child's own spec internals and the re-minted registry row now derive the same root anchor as the roster/observer legs — a pre-floor row no longer yields an internally inconsistent agent (fleet view anchored, `canAccess` root arm blind).
+- **The disclosure channel reaches both remaining composition roots (review F-2/F-3).** The runner's SendMessage mount wires `onNotifyError` to the `observer.notify_failed` trace lane, and the delegation tool's steer-lane resume threads `opts.onObserverError` — a throwing deployment sink on either revive path is now disclosed instead of counted on an unread notifier.
+- **Checkpoint mints read the clock once.** All three checkpoint mint points stamped `createdAt` and `deadline` from separate `Date.now()` reads; a mint straddling a ms tick violated `deadline = createdAt + ttl` by 1ms.
+- Comment-truth sweep: 14 sites still narrating the deleted OLD_TO_NEW/tombstone machinery rewritten to post-5.0.0 behavior; `markStopSourceByShellId`'s orphaned docstring relocated and corrected (env is REQUIRED for effect — an env-less call is a no-op).
+
 ## 5.0.0 (2026-08-02)
 
 _The baggage-unload major: the compatibility faces RB-476 cleared for tool NAMES are now cleared for id arguments, adapters and indexes too (RB-479), plus the revive-frame anchoring fix a downstream consumer was blocked on (RB-478). Everything that used to resolve silently under an old spelling now refuses loudly with the current spelling named._

package/dist/agents/repair-loop.js

@@ -194,7 +194,15 @@ export async function runRepairLoop(runner, implSpec, config) {
                     }
                     : implSpec;
         restartedOnce = false;
-        const result = await runner.runTask(spec, { repairBundle: bundle });
+        const liveStamp = setInterval(stampAccount, 1_000);
+        liveStamp.unref?.();
+        let result;
+        try {
+            result = await runner.runTask(spec, { repairBundle: bundle });
+        }
+        finally {
+            clearInterval(liveStamp);
+        }
         spend += (result.stats.costMicroUsd ?? 0) + (result.stats.nested?.costMicroUsd ?? 0);
         stampAccount();
         accumulate(result.stats);

package/dist/agents/send-message-tool.js

@@ -369,7 +369,7 @@ export function createSendMessageTool(opts) {
                 }
                 if (byName.status === "found") {
                     const h = byName.handle;
-                    target = { task_id: h.id, type: h.type, status: h.status, ...(h.toolUseId !== undefined ? { toolUseId: h.toolUseId } : {}), ...(h.sessionScoped ? { sessionScoped: true } : {}), ...(h.description !== undefined ? { description: h.description } : {}), ...(h.name !== undefined ? { name: h.name } : {}), ...(h.agentType !== undefined ? { agentType: h.agentType } : {}), ...(h.owner !== undefined ? { owner: h.owner } : {}), ...(h.scope !== undefined ? { scope: h.scope } : {}), ...(h.parentTaskId !== undefined ? { parentTaskId: h.parentTaskId } : {}), ...(h.parentSessionId !== undefined ? { parentSessionId: h.parentSessionId } : {}), ...(h.rootSessionId !== undefined ? { rootSessionId: h.rootSessionId } : {}) };
+                    target = { task_id: h.id, type: h.type, status: h.status, createdAt: h.createdAt, ...(h.toolUseId !== undefined ? { toolUseId: h.toolUseId } : {}), ...(h.sessionScoped ? { sessionScoped: true } : {}), ...(h.description !== undefined ? { description: h.description } : {}), ...(h.name !== undefined ? { name: h.name } : {}), ...(h.agentType !== undefined ? { agentType: h.agentType } : {}), ...(h.owner !== undefined ? { owner: h.owner } : {}), ...(h.scope !== undefined ? { scope: h.scope } : {}), ...(h.parentTaskId !== undefined ? { parentTaskId: h.parentTaskId } : {}), ...(h.parentSessionId !== undefined ? { parentSessionId: h.parentSessionId } : {}), ...(h.rootSessionId !== undefined ? { rootSessionId: h.rootSessionId } : {}) };
                 }
                 else {
                     let rosterHit;

package/dist/agents/subagent.js

@@ -1381,7 +1381,9 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                     ? {
                         ...(reviveClaim.row.parentTaskId !== undefined ? { parentTaskId: reviveClaim.row.parentTaskId } : {}),
                         ...(reviveClaim.row.parentSessionId !== undefined ? { parentSessionId: reviveClaim.row.parentSessionId } : {}),
-                        ...(reviveClaim.row.rootSessionId !== undefined ? { rootSessionId: reviveClaim.row.rootSessionId } : {}),
+                        ...((reviveClaim.row.rootSessionId ?? reviveClaim.row.parentSessionId) !== undefined
+                            ? { rootSessionId: reviveClaim.row.rootSessionId ?? reviveClaim.row.parentSessionId }
+                            : {}),
                     }
                     : {
                         ...(ctx.taskId !== undefined ? { parentTaskId: ctx.taskId } : {}),
@@ -2045,7 +2047,9 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                             ...(reviveRow.name !== undefined ? { name: reviveRow.name } : {}),
                             ...(reviveRow.parentTaskId !== undefined ? { parentTaskId: reviveRow.parentTaskId } : {}),
                             ...(reviveRow.parentSessionId !== undefined ? { parentSessionId: reviveRow.parentSessionId } : {}),
-                            ...(reviveRow.rootSessionId !== undefined ? { rootSessionId: reviveRow.rootSessionId } : {}),
+                            ...((reviveRow.rootSessionId ?? reviveRow.parentSessionId) !== undefined
+                                ? { rootSessionId: reviveRow.rootSessionId ?? reviveRow.parentSessionId }
+                                : {}),
                             ...(reviveRow.model !== undefined ? { model: reviveRow.model } : {}),
                             ...(reviveRow.teamName !== undefined ? { teamName: reviveRow.teamName } : {}),
                             deliveryChannel: "attaching",
@@ -2673,6 +2677,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                         ...(opts.background?.notify ? { notify: opts.background.notify } : {}),
                         sink: ctx.onSubagentSpawn,
                         ...(opts.background ? { registry: opts.background.registry } : {}),
+                        ...(opts.onObserverError !== undefined ? { onNotifyError: (f) => opts.onObserverError?.(f.error, { site: f.site }) } : {}),
                     });
                     notifier.notify(() => ctx.onSubagentSpawn?.(createSteerHandle(stream, ctx.toolCallId, childAgentName, settled, {
                         resume,

package/dist/core/permission-rules.d.ts

@@ -1,4 +1,4 @@
-import type { ToolPolicy } from "./tool-policy.js";
+import type { NamedToolPolicy } from "./tool-policy.js";
 export declare const BASH_GENERIC_PARAMS: ReadonlySet<string>;
 export interface PermissionRule {
     rule: string;
@@ -32,4 +32,4 @@ export declare function parsePermissionRule(rule: string): ParsedPermissionRule;
 export declare function wildcardMatch(pattern: string, value: string): boolean;
 export declare const fileToolParamVocabulary: (canonicalTool: string) => ReadonlySet<string> | undefined;
 export declare function validatePermissionRules(rules: PermissionRule[], opts?: Pick<PermissionRulePolicyOptions, "primaryFieldGeneric" | "caps">): PermissionRuleIssue[];
-export declare function createPermissionRulePolicy(rules: PermissionRule[], opts?: PermissionRulePolicyOptions): ToolPolicy;
+export declare function createPermissionRulePolicy(rules: PermissionRule[], opts?: PermissionRulePolicyOptions): NamedToolPolicy;

package/dist/core/permission-rules.js

@@ -259,7 +259,17 @@ export function createPermissionRulePolicy(rules, opts) {
         }
     }
     const defaultAction = opts?.defaultAction ?? "allow";
+    const nameSets = { deny: [], ask: [], allow: [] };
+    for (const [toolName, entry] of byTool) {
+        if (entry.bare.deny !== undefined || entry.param.deny.length > 0)
+            nameSets.deny.push(toolName);
+        if (entry.bare.ask !== undefined || entry.param.ask.length > 0)
+            nameSets.ask.push(toolName);
+        if (entry.bare.allow !== undefined)
+            nameSets.allow.push(toolName);
+    }
     return {
+        nameSets: [nameSets],
         check(req) {
             const entry = byTool.get(req.toolName);
             if (entry) {

package/dist/core/runner/prepare-task.js

@@ -1378,6 +1378,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     ...(deps.backgroundAgentStore !== undefined ? { agentStore: deps.backgroundAgentStore } : {}),
                     ...(deps.mailboxStore !== undefined ? { mailbox: deps.mailboxStore } : {}),
                     ...(reviveSpawn !== undefined ? { reviveSpawn } : {}),
+                    onNotifyError: (f) => emitTrace(deps.tracer, () => ({ kind: "observer.notify_failed", version: 1, taskId: hostTaskId, site: f.site, message: f.error.message, ts: Date.now() })),
                 })));
                 if (!(spec.tools ?? []).some((t) => t.name === AGENT_TRANSCRIPT_TOOL_NAME)) {
                     tools.push(firstPartyOffload(createAgentTranscriptTool({
@@ -2190,8 +2191,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             }
         }
         const policy = spec.toolPolicy ?? deps.toolPolicy;
-        {
-            const nameGroups = toolPolicyNameSets(policy);
+        const auditPolicyNames = (auditee) => {
+            const nameGroups = toolPolicyNameSets(auditee);
             if (nameGroups.length > 0) {
                 const known = new Set(tools.flatMap((t) => [t.name, ...(t.aliases ?? [])]));
                 for (const t of harnessTools)
@@ -2208,6 +2209,11 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                                 err.code = "config.legacy_tool_name";
                                 throw err;
                             }
+                            if (n.includes("__") && !n.startsWith("mcp__")) {
+                                const err = new Error(`tool policy ${kind}-list entry "${n}" is a pre-prefix MCP tool name and matches nothing in this run's roster — MCP tools are named "mcp__<server>__<tool>" and legacy-name normalization was removed (RB-476-A), so this entry would silently guard nothing. Prefix the entry with "mcp__".`);
+                                err.code = "config.legacy_tool_name";
+                                throw err;
+                            }
                             unmatched.add(`"${n}" (${kind})`);
                         }
                     }
@@ -2231,7 +2237,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     }
                 }
             }
-        }
+        };
+        auditPolicyNames(policy);
         let sessionRulePolicy;
         if (deps.sessionPolicyStore && spec.sessionId) {
             const rules = await deps.sessionPolicyStore.getRules(spec.sessionId, spec.principal);
@@ -2268,6 +2275,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             })
             : undefined;
         const narrowingLayers = [sessionRulePolicy, ...ancestorRulePolicies, skillScopePolicy].filter((p) => p !== undefined);
+        for (const layer of narrowingLayers)
+            auditPolicyNames(layer);
         const denyNarrowingPolicy = narrowingLayers.length === 0 ? undefined : narrowingLayers.length === 1 ? narrowingLayers[0] : combinePolicies(...narrowingLayers);
         const basePolicyForResumeEdit = spec.toolPolicy ?? deps.toolPolicy;
         const sameInstanceAncestorCount = policy === undefined ? 0 : (inheritedParentConstraints ?? []).reduce((n, pc) => (pc.policy === policy ? n + 1 : n), 0);
@@ -2878,6 +2887,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     const token = mintCheckpointToken();
                     const gate = { kind: "resource_limit", reason };
                     const resourceLedgerOut = debitLedger(priorLedger, sliceSpend, resourceTotal);
+                    const mintedAt = Date.now();
                     const cp = {
                         token,
                         version: resourceLedgerOut.totalWalltimeSec !== undefined ? WALLTIME_CHECKPOINT_VERSION : RESOURCE_CHECKPOINT_VERSION,
@@ -2888,8 +2898,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         pendingAction: { kind: "resource_limit", reason },
                         state: serializeCheckpointState(remoteHandle),
                         status: "pending",
-                        createdAt: Date.now(),
-                        deadline: Date.now() + (sanitizedTtlMs(rs.ttlMs) ?? DEFAULT_RESOURCE_TTL_MS),
+                        createdAt: mintedAt,
+                        deadline: mintedAt + (sanitizedTtlMs(rs.ttlMs) ?? DEFAULT_RESOURCE_TTL_MS),
                         suspendCount: priorSuspendCount,
                         humanReview: humanReviewRef.count > 0
                             ? { count: humanReviewRef.count, totalWaitMs: humanReviewRef.totalWaitMs, gates: [...humanReviewRef.gates] }
@@ -2958,6 +2968,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     const scope = checkpointScopeOf(spec);
                     const gate = { kind: "plan_review", reason: reason ?? `plan review requested` };
                     const reviewLedger = debitLedger(priorLedger, liveSpendRef.get?.() ?? { costMicroUsd: 0, tokens: 0, turns: 0, walltimeMs: 0 }, resourceTotal, { countSlice: false });
+                    const mintedAt = Date.now();
                     const cp = {
                         token,
                         version: reviewLedger.totalWalltimeSec !== undefined ? WALLTIME_CHECKPOINT_VERSION : BINDING_CHECKPOINT_VERSION,
@@ -2968,9 +2979,9 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         pendingAction: { kind: "plan_review" },
                         state: serializeCheckpointState(remoteHandle),
                         status: "pending",
-                        createdAt: Date.now(),
+                        createdAt: mintedAt,
                         suspendedAt: now(),
-                        deadline: Date.now() + (sanitizedTtlMs(spec.durableApproval?.ttlMs) ?? DEFAULT_RESOURCE_TTL_MS),
+                        deadline: mintedAt + (sanitizedTtlMs(spec.durableApproval?.ttlMs) ?? DEFAULT_RESOURCE_TTL_MS),
                         suspendCount: priorSuspendCount + 1,
                         humanReview: humanReviewRef.count > 0
                             ? { count: humanReviewRef.count, totalWaitMs: humanReviewRef.totalWaitMs, gates: [...humanReviewRef.gates] }
@@ -3082,6 +3093,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         const ttlMs = sanitizedTtlMs(durableApproval?.ttlMs);
                         const checkpointState = serializeCheckpointState(remoteHandle);
                         const approvalLedger = debitLedger(priorLedger, liveSpendRef.get?.() ?? { costMicroUsd: 0, tokens: 0, turns: 0, walltimeMs: 0 }, resourceTotal, { countSlice: false });
+                        const mintedAt = Date.now();
                         cp = {
                             token,
                             version: approvalLedger.totalWalltimeSec !== undefined ? WALLTIME_CHECKPOINT_VERSION : BINDING_CHECKPOINT_VERSION,
@@ -3104,12 +3116,12 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             },
                             state: checkpointState,
                             deadline: ttlMs !== undefined
-                                ? Date.now() + ttlMs
+                                ? mintedAt + ttlMs
                                 : durableApproval !== undefined
                                     ? undefined
-                                    : Date.now() + DEFAULT_UNATTENDED_APPROVAL_TTL_MS,
+                                    : mintedAt + DEFAULT_UNATTENDED_APPROVAL_TTL_MS,
                             status: "pending",
-                            createdAt: Date.now(),
+                            createdAt: mintedAt,
                             suspendedAt: now(),
                             humanReview: humanReviewRef.count > 0
                                 ? { count: humanReviewRef.count, totalWaitMs: humanReviewRef.totalWaitMs, gates: [...humanReviewRef.gates] }

package/dist/core/runner/session-rule-policy.d.ts

@@ -1,6 +1,6 @@
 import type { ExecutionEnv } from "../../internal/harness-types.js";
 import type { ToolEffect } from "../types.js";
-import { type ToolPolicy } from "../tool-policy.js";
+import { type NamedToolPolicy } from "../tool-policy.js";
 import type { SessionPermissionRules } from "../session-policy-store.js";
 export declare const PATH_WRITE_TOOLS: ReadonlySet<string>;
 export declare function isWithin(root: string, p: string): boolean;
@@ -8,4 +8,4 @@ export declare function createSessionRulePolicy(rules: SessionPermissionRules, o
     env: ExecutionEnv;
     rootPath?: string;
     toolEffects?: ReadonlyMap<string, ToolEffect>;
-}): ToolPolicy;
+}): NamedToolPolicy;

package/dist/core/runner/session-rule-policy.js

@@ -32,6 +32,7 @@ export function createSessionRulePolicy(rules, opts) {
         : undefined;
     const allowDirs = rules.allowDirs && rules.allowDirs.length > 0 ? rules.allowDirs : undefined;
     return {
+        nameSets: [{ ...(rules.toolDeny?.length ? { deny: [...rules.toolDeny] } : {}), ...(rules.toolAllow?.length ? { allow: [...rules.toolAllow] } : {}) }],
         async check(req, signal) {
             const toolName = req.toolName;
             if (toolDeny.has(toolName))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "5.0.0",
+  "version": "5.0.1",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",