@sema-agent/core 5.0.0 → 5.1.0

package/dist/core/tool-policy.js

@@ -3,7 +3,7 @@ import { isAbsolute, join, normalize as normalizePath, sep } from "node:path";
 import { BASH_READONLY_DEFAULT_ALLOW, parseLeadingCommandName } from "../tools/fs/index.js";
 import { writeTargetPath } from "../tools/fs/safety.js";
 export function decisionText(d) {
-    return d.message ?? d.reason;
+    return d.message;
 }
 const ALLOW = { action: "allow" };
 function withTimeout(p, ms, onTimeout) {
@@ -39,10 +39,10 @@ export function createAllowDenyPolicy(opts) {
         check(req) {
             const toolName = req.toolName;
             if (deny.has(toolName)) {
-                return { action: "deny", reason: `tool "${req.toolName}" is denied by policy` };
+                return { action: "deny", message: `tool "${req.toolName}" is denied by policy` };
             }
             if (allow && !allow.has(toolName)) {
-                return { action: "deny", reason: `tool "${req.toolName}" is not in the allowlist` };
+                return { action: "deny", message: `tool "${req.toolName}" is not in the allowlist` };
             }
             return ALLOW;
         },
@@ -66,11 +66,11 @@ export function createApprovalPolicy(opts) {
         async check(req, signal) {
             const toolName = req.toolName;
             if (deny.has(toolName)) {
-                return { action: "deny", reason: `tool "${req.toolName}" is denied by policy` };
+                return { action: "deny", message: `tool "${req.toolName}" is denied by policy` };
             }
             if (need.has(toolName)) {
                 if (signal?.aborted) {
-                    return { action: "deny", reason: `approval aborted for "${req.toolName}" (task ended)` };
+                    return { action: "deny", message: `approval aborted for "${req.toolName}" (task ended)` };
                 }
                 let ok;
                 try {
@@ -79,13 +79,19 @@ export function createApprovalPolicy(opts) {
                 catch (err) {
                     return {
                         action: "deny",
-                        reason: `approval errored for "${req.toolName}": ${err instanceof Error ? err.message : String(err)}`,
+                        message: `approval errored for "${req.toolName}": ${err instanceof Error ? err.message : String(err)}`,
                     };
                 }
-                return ok ? ALLOW : { action: "deny", reason: `approval denied for "${req.toolName}"` };
+                const okRaw = ok;
+                if (okRaw === true)
+                    return ALLOW;
+                if (okRaw !== false) {
+                    return { action: "deny", message: `approval callback for "${req.toolName}" returned an out-of-contract value (${typeof ok}) — denied fail-closed (return true, false, or the {allow} object)` };
+                }
+                return { action: "deny", message: `approval denied for "${req.toolName}"` };
             }
             if (opts.denyByDefault && !auto.has(toolName)) {
-                return { action: "deny", reason: `tool "${req.toolName}" requires explicit allow` };
+                return { action: "deny", message: `tool "${req.toolName}" requires explicit allow` };
             }
             return ALLOW;
         },
@@ -130,7 +136,7 @@ export function createCoarseCommandNamePolicy(opts) {
     const shellTools = canonicalToolNameSet(opts.tools);
     const defaultAction = opts.defaultAction ?? "ask";
     const fallback = (reason) => defaultAction === "deny"
-        ? { action: "deny", reason, decisionReason: "rule" }
+        ? { action: "deny", message: reason, decisionReason: "rule" }
         : { action: "ask", message: reason, decisionReason: "rule" };
     return {
         check(req) {
@@ -145,7 +151,7 @@ export function createCoarseCommandNamePolicy(opts) {
                 return fallback(`command is not a single simple command (${parsed.reject})`);
             }
             if (deny.has(parsed.name)) {
-                return { action: "deny", reason: `command "${parsed.name}" is denied by policy`, decisionReason: "rule" };
+                return { action: "deny", message: `command "${parsed.name}" is denied by policy`, decisionReason: "rule" };
             }
             if (allow && !allow.has(parsed.name)) {
                 return fallback(`command "${parsed.name}" is not in the allowlist`);
@@ -394,7 +400,7 @@ export function createUnverifiableDeletePolicy(opts) {
                 action: "ask",
                 decisionReason: "safety",
                 requiresRealApproval: true,
-                reason: `Unverifiable recursive delete (fail-closed unless cleared): ${finding}. ` +
+                message: `Unverifiable recursive delete (fail-closed unless cleared): ${finding}. ` +
                     `Re-run the delete with the resolved literal path written into the command itself ` +
                     `(or assign the variable in the same command, e.g. \`DIR=/exact/path; rm -rf "$DIR"\`) so the target can be verified.`,
             };
@@ -468,7 +474,7 @@ export function createTranscriptIntegrityPolicy(opts) {
         action: "ask",
         decisionReason: "safety",
         requiresRealApproval: true,
-        reason: `Session-transcript write (fail-closed unless cleared): ${what}. Session transcripts (the .jsonl files ` +
+        message: `Session-transcript write (fail-closed unless cleared): ${what}. Session transcripts (the .jsonl files ` +
             `under the agent data dir's sessions/ directory) are harness-written session state, not agent working ` +
             `files — modifying or deleting them tampers with the run's own audit trail. Reading them (ls/cat/grep ` +
             `as a single simple command) is fine.`,
@@ -613,7 +619,15 @@ export async function resolveAsk(req, onAsk, signal) {
         }
         return { action: "allow", updatedInput: edit.value, decisionReason: "mode" };
     }
-    return ok
-        ? { action: "allow", decisionReason: "mode", presentedInput: presented.value }
-        : { action: "deny", message: `approval denied for "${req.toolName}": ${req.message}`, decisionReason: "mode" };
+    const okRaw = ok;
+    if (okRaw === true)
+        return { action: "allow", decisionReason: "mode", presentedInput: presented.value };
+    if (okRaw !== false) {
+        return {
+            action: "deny",
+            message: `the approver for "${req.toolName}" returned an out-of-contract value (${typeof ok}) — denied fail-closed (return true, false, "unavailable", or the {allow} object)`,
+            decisionReason: "mode",
+        };
+    }
+    return { action: "deny", message: `approval denied for "${req.toolName}": ${req.message}`, decisionReason: "mode" };
 }

package/dist/index.d.ts

@@ -40,6 +40,7 @@ export { decideAutoPromote, deriveTripwire, FROZEN_DENYLIST_FLOOR, type AutoProm
 export { runCascade, type CascadeRung, type CascadeConfig, type CascadeAttempt, type CascadeRunResult, type GateVerdict, } from "./agents/cascade.js";
 export { pgQuery, mysqlQuery, sqliteQuery } from "./tools/sql-adapters.js";
 export { materializeMcpTools, MCP_PREFIX, type MaterializedMcp, type McpServerStatus, type McpRefreshResult } from "./core/mcp.js";
+export { PROTOCOL_TABLE, MCP_NAMESPACE, protocolOf, type ProtocolNamespace, type ProtocolId } from "./core/protocol-table.js";
 export { InMemorySessionPolicyStore, SessionPolicyError, loosenReasons, normalizeRules, stripRev, type SessionPolicyStore, type SessionPermissionRules, type StoredSessionRules, type SessionRulesRecord, type PutRulesOptions, } from "./core/session-policy-store.js";
 export { SAFETY_MERGE_CONFORMANCE_CORPUS, type SafetyMergeVector } from "./core/safety-merge-corpus.js";
 export { SAFETY_AXIS_VOCABULARY } from "./core/safety-axis-vocab.js";

package/dist/index.js

@@ -37,6 +37,7 @@ export { decideAutoPromote, deriveTripwire, FROZEN_DENYLIST_FLOOR, } from "./cor
 export { runCascade, } from "./agents/cascade.js";
 export { pgQuery, mysqlQuery, sqliteQuery } from "./tools/sql-adapters.js";
 export { materializeMcpTools, MCP_PREFIX } from "./core/mcp.js";
+export { PROTOCOL_TABLE, MCP_NAMESPACE, protocolOf } from "./core/protocol-table.js";
 export { InMemorySessionPolicyStore, SessionPolicyError, loosenReasons, normalizeRules, stripRev, } from "./core/session-policy-store.js";
 export { SAFETY_MERGE_CONFORMANCE_CORPUS } from "./core/safety-merge-corpus.js";
 export { SAFETY_AXIS_VOCABULARY } from "./core/safety-axis-vocab.js";

package/dist/orchestration/run-spec.js

@@ -28,7 +28,7 @@ function frozenDenyPolicy(rootDir, frozenResolved) {
             const absForm = isAbsolutePathForm(raw);
             const abs = pathKey(absForm ? raw : resolve(rootDir, raw));
             if (frozen.has(abs)) {
-                return { action: "deny", reason: `${raw} is part of the frozen specification surface (read-only).` };
+                return { action: "deny", message: `${raw} is part of the frozen specification surface (read-only).` };
             }
             return { action: "allow" };
         },

package/dist/orchestration/run-workflow-tool.js

@@ -344,8 +344,8 @@ export async function createRunWorkflowTool(d) {
                 }
                 if (resolved === undefined)
                     return structuredError(`unknown workflow name: ${JSON.stringify(rawName)}`);
-                script = typeof resolved === "string" ? resolved : resolved.script;
-                if (typeof resolved !== "string" && "defaultArgs" in resolved)
+                script = resolved.script;
+                if ("defaultArgs" in resolved)
                     registeredDefaultArgs = resolved.defaultArgs;
                 if (typeof resolved !== "string" && typeof resolved.stringArgKey === "string" && resolved.stringArgKey.length > 0) {
                     registeredStringArgKey = resolved.stringArgKey;

package/dist/orchestration/workflow-script-store.d.ts

@@ -12,7 +12,7 @@ export interface WorkflowScriptStore {
     readonly scopePartitioned: true;
     persist(runId: string, script: string, scope: string): Promise<string> | string;
     load(scriptPath: string, scope: string): Promise<string> | string;
-    resolveName?(name: string): Promise<string | NamedWorkflowResolution | undefined> | string | NamedWorkflowResolution | undefined;
+    resolveName?(name: string): Promise<NamedWorkflowResolution | undefined> | NamedWorkflowResolution | undefined;
     list?(): NamedWorkflowListing[] | Promise<NamedWorkflowListing[]>;
 }
 export declare function mergeWorkflowArgs(callArgs: unknown, defaultArgs: unknown): unknown;

package/dist/orchestration/workflow-script-store.js

@@ -95,7 +95,7 @@ export function createFileWorkflowScriptStore(dir) {
             const script = readFileSync(path, "utf-8");
             const argsPath = join(root, `${stem}.args.json`);
             if (!existsSync(argsPath))
-                return script;
+                return { script };
             let defaultArgs;
             try {
                 defaultArgs = JSON.parse(readFileSync(argsPath, "utf-8"));

package/dist/prompt-assembly/assemble.js

@@ -101,7 +101,6 @@ export function assemblePrompt(inputs) {
         userSystemPrompt: inputs.userSystemPrompt,
         userAppendSystemPrompt: inputs.userAppendSystemPrompt,
         tools: inputs.tools,
-        memoryEnabled: false,
         consolidationEnabled: false,
         ...facts,
     };

package/dist/prompt-assembly/tool-catalog.d.ts

@@ -1,6 +1,7 @@
 import type { TSchema } from "typebox";
 import type { AgentTool } from "../internal/harness-types.js";
-export type ToolOrigin = "core" | "caller" | "mcp" | "synthetic";
+import type { ProtocolId } from "../core/protocol-table.js";
+export type ToolOrigin = "core" | "caller" | "synthetic" | ProtocolId;
 export interface ToolContractDescriptor {
     contractId: string;
     implementationRevision: string;

package/dist/prompts/default.d.ts

@@ -64,8 +64,6 @@ export interface StablePromptContext {
     userSystemPrompt?: string;
     userAppendSystemPrompt?: string;
     tools: AgentTool[];
-    memoryEnabled: boolean;
-    consolidationEnabled?: boolean;
     policyEnabled?: boolean;
     hooksEnabled?: boolean;
     isolationEnabled?: boolean;

package/dist/prompts/default.js

@@ -365,10 +365,6 @@ export function constitutionBlocks(ctx) {
         blocks.push({ id: "mode.worktree", text: WORKTREE_NOTICE });
     if (ctx.goalEnabled)
         blocks.push({ id: "mode.goal", text: GOAL_COMPLETION_GUIDANCE });
-    if (ctx.memoryEnabled)
-        blocks.push({ id: "memory.safety", text: MEMORY_SAFETY });
-    if (ctx.memoryEnabled && !ctx.consolidationEnabled)
-        blocks.push({ id: "memory.hygiene", text: MEMORY_HYGIENE });
     return blocks;
 }
 export function composeConstitution(roleBase, ctx) {
@@ -393,7 +389,7 @@ export function analyzePromptCacheFriendliness(provider, opts = {}) {
     const build = (memoryBlock) => {
         if (!provider.stableSystem)
             throw new Error("PromptProvider does not implement stableSystem");
-        return composeSystemPrompt(provider.stableSystem({ userSystemPrompt: opts.userSystemPrompt, tools, memoryEnabled: true }), memoryBlock);
+        return composeSystemPrompt(provider.stableSystem({ userSystemPrompt: opts.userSystemPrompt, tools }), memoryBlock);
     };
     const a = build(PROBE_MEMORY_A);
     const b = build(PROBE_MEMORY_B);

package/dist/stores/cc/mailbox-store.d.ts

@@ -4,5 +4,9 @@ export interface CcFileMailboxStoreOptions {
     teamDir: string;
     agentNameOf?: (handle: string) => string | undefined;
     now?: () => number;
+    onCorruptRead?: (info: {
+        path: string;
+        reason: string;
+    }) => void;
 }
 export declare function createCcFileMailboxStore(opts: CcFileMailboxStoreOptions): MailboxStore;

package/dist/stores/cc/mailbox-store.js

@@ -27,19 +27,33 @@ export function createCcFileMailboxStore(opts) {
         const name = opts.agentNameOf?.(handle) ?? handle;
         return join(inboxDir, `${sanitizeCcAgentName(name)}.json`);
     };
+    const discloseCorrupt = (path, reason) => {
+        try {
+            opts.onCorruptRead?.({ path, reason });
+        }
+        catch {
+        }
+    };
     const loadBox = (path) => {
         let raw;
         try {
             raw = readFileSync(path, "utf8");
         }
-        catch {
+        catch (err) {
+            if (err.code !== "ENOENT")
+                discloseCorrupt(path, `read failed (non-ENOENT): ${err.message}`);
             return [];
         }
         try {
             const parsed = JSON.parse(raw);
-            return Array.isArray(parsed) ? parsed : [];
+            if (!Array.isArray(parsed)) {
+                discloseCorrupt(path, "inbox document is not an array");
+                return [];
+            }
+            return parsed;
         }
         catch {
+            discloseCorrupt(path, "unparseable inbox JSON (torn write?)");
             return [];
         }
     };

package/dist/stores/file/session-policy-store.d.ts

@@ -1,7 +1,16 @@
 import { type PutRulesOptions, type SessionPermissionRules, type SessionPolicyStore, type SessionRulesRecord, type StoredSessionRules } from "../../core/session-policy-store.js";
 export declare class FileSessionPolicyStore implements SessionPolicyStore {
     private readonly dir;
-    constructor(root: string);
+    private readonly onCorruptRead;
+    constructor(root: string, opts?: {
+        onCorruptRead?: (info: {
+            sessionId: string;
+            principal?: string;
+            path: string;
+            reason: string;
+        }) => void;
+    });
+    private discloseCorrupt;
     private pathFor;
     private read;
     getRules(sessionId: string, principal?: string): Promise<StoredSessionRules | null>;

package/dist/stores/file/session-policy-store.js

@@ -4,9 +4,18 @@ import { loosenReasons, normalizeRules, stripRev, SessionPolicyError, } from "..
 import { atomicWriteFile, ensureDir, sanitizeScope } from "./fs-atomic.js";
 export class FileSessionPolicyStore {
     dir;
-    constructor(root) {
+    onCorruptRead;
+    constructor(root, opts) {
         this.dir = join(root, "session-policy");
         ensureDir(this.dir);
+        this.onCorruptRead = opts?.onCorruptRead;
+    }
+    discloseCorrupt(sessionId, principal, reason) {
+        try {
+            this.onCorruptRead?.({ sessionId, ...(principal !== undefined ? { principal } : {}), path: this.pathFor(sessionId, principal), reason });
+        }
+        catch {
+        }
     }
     pathFor(sessionId, principal) {
         const composite = JSON.stringify([sessionId, principal ?? null]);
@@ -24,20 +33,27 @@ export class FileSessionPolicyStore {
         }
         try {
             const parsed = JSON.parse(raw);
-            if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed))
+            if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+                this.discloseCorrupt(sessionId, principal, "not a JSON object");
                 return null;
+            }
             const r = parsed;
-            if (r.rev !== undefined && (typeof r.rev !== "number" || !Number.isFinite(r.rev)))
+            if (r.rev !== undefined && (typeof r.rev !== "number" || !Number.isFinite(r.rev))) {
+                this.discloseCorrupt(sessionId, principal, "non-numeric rev");
                 return null;
+            }
             const strArr = (x) => x === undefined || (Array.isArray(x) && x.every((e) => typeof e === "string"));
-            if (!strArr(r.toolAllow) || !strArr(r.toolDeny) || !strArr(r.commandAllow) || !strArr(r.commandDeny) || !strArr(r.allowDirs))
+            if (!strArr(r.toolAllow) || !strArr(r.toolDeny) || !strArr(r.commandAllow) || !strArr(r.commandDeny) || !strArr(r.allowDirs)) {
+                this.discloseCorrupt(sessionId, principal, "malformed rule field");
                 return null;
+            }
             const { __sid: _sid, __principal: _principal, ...clean } = r;
             void _sid;
             void _principal;
             return clean;
         }
         catch {
+            this.discloseCorrupt(sessionId, principal, "unparseable JSON (torn/zero-byte write?)");
             return null;
         }
     }

package/dist/tools/fs/fs-search-tools.js

@@ -37,7 +37,6 @@ export function createGrepTool(env, rootCanonical, additionalRoots) {
                 description: 'Limit output to first N lines/entries, equivalent to "| head -N". Works across all output modes: content (limits output lines), files_with_matches (limits file paths), count (limits count entries). Defaults to 250 when unspecified. Pass 0 for unlimited (use sparingly — large result sets waste context).',
             })),
             offset: Type.Optional(Type.Number({ description: "Skip the first N output lines (pagination partner of head_limit)." })),
-            max_results: Type.Optional(Type.Number({ description: "Deprecated alias for head_limit." })),
         }),
         effect: "read",
         execute: async (args, ctx) => {
@@ -69,7 +68,7 @@ export function createGrepTool(env, rootCanonical, additionalRoots) {
             const grepRun = await runGrepDetailed(env, rootCanonical, {
                 ...a,
                 path: scoped,
-                head_limit: a.head_limit ?? a.max_results,
+                head_limit: a.head_limit,
                 context: a.context ?? a["-C"],
                 context_after: a.context_after ?? a["-A"],
                 context_before: a.context_before ?? a["-B"],

package/dist/tools/fs/fs-shared.d.ts

@@ -43,7 +43,6 @@ export declare function bashTimeoutCapsSec(caps: {
 export declare function bashMaxOutputChars(): number;
 export declare const FILE_PATH_PARAMS: {
     file_path: Type.TOptional<Type.TString>;
-    path: Type.TOptional<Type.TString>;
 };
 export declare function clipShellOutput(s: string): string;
 export declare function writeShellOverflowFile(env: ExecutionEnv, stdout: string, stderr: string): Promise<string | undefined>;

package/dist/tools/fs/fs-shared.js

@@ -77,7 +77,6 @@ export function bashMaxOutputChars() {
 }
 export const FILE_PATH_PARAMS = {
     file_path: Type.Optional(Type.String({ description: "File path (within the configured root)." })),
-    path: Type.Optional(Type.String({ description: "Deprecated alias for `file_path` (back-compat; prefer file_path)." })),
 };
 export function clipShellOutput(s) {
     return clipWithFilePointer(s, bashMaxOutputChars());

package/dist/tools/todo.js

@@ -76,7 +76,7 @@ export function createTodoWriteTool() {
             todos: Type.Array(Type.Object({
                 content: Type.String({ description: "The task, in imperative form (e.g. \"Run the tests\")." }),
                 status: Type.Union([Type.Literal("pending"), Type.Literal("in_progress"), Type.Literal("completed")]),
-                activeForm: Type.Optional(Type.String({ description: "Present-continuous form shown while in progress (e.g. \"Running the tests\")." })),
+                activeForm: Type.String({ minLength: 1, description: "Present-continuous form shown while in progress (e.g. \"Running the tests\")." }),
             })),
         }),
         effect: "idempotent",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "5.0.0",
+  "version": "5.1.0",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",