@sema-agent/core 5.12.0 → 5.14.0

package/dist/orchestration/run-workflow-tool.d.ts

@@ -81,6 +81,7 @@ export interface RunWorkflowToolDeps {
     sourceTaskId?: string;
     principal?: string;
     oneShot?: boolean;
+    parentInteractionPosture?: "interactive" | "headless";
     workflowDepth?: number;
     parentCwd?: string;
     parentThinking?: () => import("../core/types.js").TaskSpec["thinking"];
@@ -88,5 +89,8 @@ export interface RunWorkflowToolDeps {
     parentGetApiKeyAndHeaders?: import("../core/types.js").TaskSpec["getApiKeyAndHeaders"];
     forwardEvent?: (event: import("../core/types.js").TaskEvent) => void;
     inheritedGateForChildren?: () => import("../core/runner/prepare-task.js").InheritedGate;
+    autoModeReview?: () => {
+        decider: import("../core/auto-mode.js").AutoModeDecider;
+    } | undefined;
 }
 export declare function createRunWorkflowTool(d: RunWorkflowToolDeps): Promise<AgentTool>;

package/dist/orchestration/run-workflow-tool.js

@@ -388,6 +388,7 @@ export async function createRunWorkflowTool(d) {
             }
             let handle;
             const workflowTaskId = d.taskRegistry?.mintTaskId("workflow");
+            const autoModeReview = ctx.autoModeReview ?? d.autoModeReview?.();
             try {
                 handle = startWorkflow(d.runner, scriptFn, {
                     store: d.store,
@@ -413,6 +414,7 @@ export async function createRunWorkflowTool(d) {
                     ...(d.parentCwd !== undefined ? { parentCwd: d.parentCwd } : {}),
                     parentToolCallId: ctx.toolCallId,
                     ...(sourceTaskId !== undefined ? { parentTaskId: sourceTaskId } : {}),
+                    ...((ctx.interactionPosture ?? d.parentInteractionPosture) !== undefined ? { interactionPosture: (ctx.interactionPosture ?? d.parentInteractionPosture) } : {}),
                     ...(d.parentModel !== undefined ? { defaultModel: d.parentModel } : {}),
                     ...(d.parentGetApiKeyAndHeaders !== undefined ? { defaultGetApiKeyAndHeaders: d.parentGetApiKeyAndHeaders } : {}),
                     ...(ctx.centerArtifactDigest !== undefined ? { parentCenterArtifactDigest: ctx.centerArtifactDigest } : {}),
@@ -421,6 +423,7 @@ export async function createRunWorkflowTool(d) {
                     ...((ctx.inheritedGateForChildren ?? d.inheritedGateForChildren) !== undefined
                         ? { inheritedGate: (ctx.inheritedGateForChildren ?? d.inheritedGateForChildren)() }
                         : {}),
+                    ...(autoModeReview !== undefined ? { autoModeReview } : {}),
                 }, { workflowDepth: d.workflowDepth });
             }
             catch (err) {

package/dist/orchestration/workflow-types.d.ts

@@ -187,6 +187,14 @@ export declare class WorkflowAgentStalledError extends Error {
     readonly code = "workflow.agent_stalled";
     constructor(attempts: number, stallMs: number, lastResult?: TaskResult | undefined);
 }
+export declare const WORKFLOW_SPAWN_BLOCKED_ERROR_CODE = "autoMode.spawn_blocked";
+export declare class WorkflowAgentBlockedError extends Error {
+    readonly label: string;
+    readonly category: string;
+    readonly reason: string;
+    readonly code = "workflow.agent_blocked";
+    constructor(label: string, category: string, reason: string);
+}
 export declare class WorkflowMaxAgentsError extends Error {
     readonly max: number;
     readonly code = "workflow.max_agents";

package/dist/orchestration/workflow-types.js

@@ -41,6 +41,20 @@ export class WorkflowAgentStalledError extends Error {
         this.name = "WorkflowAgentStalledError";
     }
 }
+export const WORKFLOW_SPAWN_BLOCKED_ERROR_CODE = "autoMode.spawn_blocked";
+export class WorkflowAgentBlockedError extends Error {
+    label;
+    category;
+    reason;
+    code = "workflow.agent_blocked";
+    constructor(label, category, reason) {
+        super(`workflow agent "${label}" was not started: blocked by the pre-spawn review${reason ? `: ${reason}` : ""}`);
+        this.label = label;
+        this.category = category;
+        this.reason = reason;
+        this.name = "WorkflowAgentBlockedError";
+    }
+}
 export class WorkflowMaxAgentsError extends Error {
     max;
     code = "workflow.max_agents";

package/dist/orchestration/workflow.d.ts

@@ -96,12 +96,16 @@ export interface RunWorkflowOptions {
     parentCwd?: string;
     parentToolCallId?: string;
     parentTaskId?: string;
+    interactionPosture?: "interactive" | "headless";
     defaultModel?: () => import("../internal/llm.js").Model | undefined;
     defaultGetApiKeyAndHeaders?: TaskSpec["getApiKeyAndHeaders"];
     parentCenterArtifactDigest?: string;
     parentCenterSourceRevision?: string;
     onForwardEvent?: (event: TaskEvent) => void;
     inheritedGate?: import("../core/runner/prepare-task.js").InheritedGate;
+    autoModeReview?: {
+        decider: import("../core/auto-mode.js").AutoModeDecider;
+    };
     phases?: ReadonlyArray<{
         title: string;
         detail?: string;

package/dist/orchestration/workflow.js

@@ -16,12 +16,43 @@ import { boundedRedactedSummary } from "../core/untrusted-egress.js";
 import { delimitUntrusted } from "../core/untrusted-text.js";
 import { OUTPUT_TOOL_NAME } from "../core/runner/synthetic-tools.js";
 import { compileOutputSchema } from "../core/runner/strict-output-schema.js";
-import { WorkflowBudgetExceededError, WorkflowNestingError, WorkflowAgentSchemaError, WorkflowAgentStalledError, WorkflowMaxAgentsError } from "./workflow-types.js";
+import { WorkflowBudgetExceededError, WorkflowNestingError, WorkflowAgentBlockedError, WorkflowAgentSchemaError, WorkflowAgentStalledError, WorkflowMaxAgentsError, WORKFLOW_SPAWN_BLOCKED_ERROR_CODE } from "./workflow-types.js";
 export * from "./workflow-types.js";
 const MAX_TRANSCRIPT_CHARS = 4000;
 const WORKFLOW_RESULT_MAX = 4000;
 const WORKFLOW_RESULT_FULL_MAX = 200_000;
 const MAX_ACTIVITY = 30;
+const MAX_REVIEWED_SCHEMA_BYTES = 4096;
+const MAX_REVIEW_REASON_CHARS = 500;
+const MAX_REVIEWED_PROMPT_CHARS = 2_000;
+const MAX_SCHEMA_WALK_DEPTH = 32;
+function isUsableSchema(v) {
+    if (v === true)
+        return true;
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function isSingleFaced(v, depth = 0) {
+    if (typeof v !== "object" || v === null)
+        return true;
+    if (depth > MAX_SCHEMA_WALK_DEPTH)
+        return false;
+    if (typeof v.toJSON === "function")
+        return false;
+    for (const key of Object.keys(v)) {
+        if (typeof Object.getOwnPropertyDescriptor(v, key)?.get === "function")
+            return false;
+    }
+    for (const child of Object.values(v)) {
+        if (!isSingleFaced(child, depth + 1))
+            return false;
+    }
+    return true;
+}
+function forReview(text) {
+    if (text.length <= MAX_REVIEWED_PROMPT_CHARS)
+        return text;
+    return `${text.slice(0, MAX_REVIEWED_PROMPT_CHARS)}\n[…TRUNCATED FOR REVIEW: ${text.length - MAX_REVIEWED_PROMPT_CHARS} further characters follow that the child WILL receive and this review did NOT see]`;
+}
 function workflowModelLabel(spec) {
     const model = spec.model;
     if (model === undefined)
@@ -473,6 +504,7 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
     const sem = createSemaphore(concurrency);
     const spawnAttribution = {
         isDelegatedChild: true,
+        ...(opts.interactionPosture !== undefined ? { parentInteractionPosture: opts.interactionPosture } : {}),
         ...(opts.parentToolCallId !== undefined ? { parentToolCallId: opts.parentToolCallId } : {}),
         ...(opts.parentTaskId !== undefined ? { parentTaskId: opts.parentTaskId } : {}),
         ...(opts.parentCenterArtifactDigest !== undefined ? { parentCenterArtifactDigest: opts.parentCenterArtifactDigest } : {}),
@@ -782,6 +814,83 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
         const model = workflowModelLabel(specForIdentity);
         return { label, phase, phaseInstance, groupId, inheritedModelSnap, callKey, prompt, model };
     };
+    const reviewSpawnBeforeLaunch = async (lane, label, callKey, runSpec, effectiveSignal) => {
+        const review = opts.autoModeReview;
+        if (review === undefined)
+            return runSpec;
+        const schema = runSpec.outputSchema;
+        let schemaText;
+        let specToLaunch = runSpec;
+        if (schema !== undefined) {
+            try {
+                schemaText = JSON.stringify(schema);
+            }
+            catch {
+                schemaText = undefined;
+            }
+            if (schemaText === undefined) {
+                throw new WorkflowAgentBlockedError(label, "", "the child's output schema could not be serialized for review");
+            }
+            const schemaBytes = Buffer.byteLength(schemaText, "utf8");
+            if (schemaBytes > MAX_REVIEWED_SCHEMA_BYTES) {
+                throw new WorkflowAgentBlockedError(label, "", `output schema too large to classify safely (${schemaBytes} bytes, cap ${MAX_REVIEWED_SCHEMA_BYTES})`);
+            }
+            if (!isSingleFaced(schema)) {
+                throw new WorkflowAgentBlockedError(label, "", "the child's output schema cannot be read as one unambiguous value (it overrides its own serialization, or nests deeper than the review can walk)");
+            }
+            const normalized = JSON.parse(schemaText);
+            if (!isUsableSchema(normalized)) {
+                throw new WorkflowAgentBlockedError(label, "", "the child's output schema does not normalize to a JSON Schema object");
+            }
+            specToLaunch = { ...runSpec, outputSchema: normalized };
+        }
+        const toolNames = (runSpec.tools ?? []).map((t) => t.name);
+        const toolsNote = `${toolNames.length > 0 ? toolNames.join(", ") : "(none explicitly listed)"}` +
+            ` — this is the EXPLICIT roster only. If this deployment gave the child a real execution environment,` +
+            ` its own prepare additionally mounts the standard file/shell toolkit (Read/Edit/Write/Bash/Grep/Glob)` +
+            ` on top of this list. Treat the absence of a tool here as unknown, not as denied.`;
+        const remoteSources = [
+            ...(runSpec.mcp ?? []).map((m) => `mcp:${m.name}`),
+            ...(runSpec.a2a ?? []).map((p) => `a2a:${p.name}`),
+        ];
+        const shownSources = remoteSources.slice(0, 20).map((s) => s.slice(0, 80));
+        const remoteNote = remoteSources.length > 0
+            ? `\nThis child also mounts tools from ${remoteSources.length} external capability source(s) — ${shownSources.join(", ")}${remoteSources.length > shownSources.length ? `, +${remoteSources.length - shownSources.length} more` : ""}. Each mounts its own tools under a "<source>__*" namespace; those tool names are not resolved yet and are NOT in the roster above. Treat this child as able to reach outside this process.`
+            : "";
+        const objective = forReview(runSpec.objective ?? "");
+        const systemPrompt = runSpec.systemPrompt !== undefined ? forReview(runSpec.systemPrompt) : undefined;
+        const imageCount = runSpec.images?.length ?? 0;
+        const imagesNote = imageCount > 0
+            ? `\n${imageCount} image attachment(s) ride with this child. Their CONTENT was NOT inspected by this review — the classifier leg is text-only. Treat any instruction that defers to attached or embedded content as unreviewed.`
+            : "";
+        const labelForReview = label.slice(0, 80);
+        const verdict = await review.decider
+            .decide({
+            req: {
+                toolName: "Workflow(agent)",
+                args: {
+                    objective,
+                    tools: toolNames,
+                    ...(systemPrompt !== undefined ? { systemPrompt } : {}),
+                    ...(schemaText !== undefined ? { outputSchema: schemaText } : {}),
+                    ...(imageCount > 0 ? { uninspectedImageAttachments: imageCount } : {}),
+                    ...(remoteSources.length > 0 ? { externalCapabilitySources: shownSources } : {}),
+                },
+                toolCallId: `${runId}:${callKey}`,
+            },
+            askMessage: `Reviewing a workflow-spawned sub-agent ("${labelForReview}", ${lane}) about to be started. ` +
+                `Objective: ${objective}\nTools available to it: ${toolsNote}${remoteNote}${imagesNote}`,
+        }, effectiveSignal)
+            .catch(() => ({ kind: "unavailable", cause: "error" }));
+        if (effectiveSignal?.aborted)
+            throw new Error("workflow aborted");
+        if (finalized)
+            throw new Error(`workflow run already finalized — ${lane} cannot spawn after the run ended`);
+        if (verdict.kind === "block") {
+            throw new WorkflowAgentBlockedError(label, verdict.category, boundedRedactedSummary(verdict.reason, MAX_REVIEW_REASON_CHARS));
+        }
+        return specToLaunch;
+    };
     const createUsageBeat = (rec) => {
         let beatTokens = 0;
         let beatTurns = 0;
@@ -931,15 +1040,16 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
                 const typedSpec = typedSpec0.model === undefined && inheritedModelSnap !== undefined ? { ...typedSpec0, model: inheritedModelSnap } : typedSpec0;
                 const framedSpec = withWorkflowChildPersona(typedSpec, agentOpts.schema ?? typedSpec.outputSchema);
                 const authInherit = framedSpec.getApiKeyAndHeaders === undefined && opts.defaultGetApiKeyAndHeaders !== undefined ? { getApiKeyAndHeaders: opts.defaultGetApiKeyAndHeaders } : {};
-                const runSpec = agentOpts.schema
+                const preReviewSpec = agentOpts.schema
                     ? { ...framedSpec, ...authInherit, signal: effectiveSignal, outputSchema: agentOpts.schema }
                     : { ...framedSpec, ...authInherit, signal: effectiveSignal };
+                const runSpec = await reviewSpawnBeforeLaunch("ctx.agent", label, callKey, preReviewSpec, effectiveSignal);
                 const enrichedForward = opts.onForwardEvent !== undefined
                     ? (e) => {
                         opts.onForwardEvent(e.type === "task_progress" ? { ...e, workflowRunId: runId, workflowAgentLabel: label } : e);
                     }
                     : undefined;
-                const baseInternals = { ...(agentOpts.isolation ? { isolation: agentOpts.isolation } : {}), ...(opts.parentCwd !== undefined ? { parentCwd: opts.parentCwd } : {}), ...spawnAttribution, ...(enrichedForward !== undefined ? { onForwardEvent: enrichedForward } : {}), agentName: label, onWorkspaceResolved: createWorkspaceObserver(rec) };
+                const baseInternals = { ...(agentOpts.isolation ? { isolation: agentOpts.isolation } : {}), ...(opts.parentCwd !== undefined ? { parentCwd: opts.parentCwd } : {}), ...spawnAttribution, ...(enrichedForward !== undefined ? { onForwardEvent: enrichedForward } : {}), delegationTaskType: "workflow", agentName: label, onWorkspaceResolved: createWorkspaceObserver(rec) };
                 let attempts = 0;
                 let throttleRetried = false;
                 let lastAttemptReason;
@@ -1128,6 +1238,10 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
                         rec.output = boundedRedactedSummary(salvaged.structuredOutput ?? salvaged.result, MAX_TRANSCRIPT_CHARS) || (rec.errorMessage ?? "");
                         rec.stats = { tokens: salvaged.stats.tokens ?? 0, turns: salvaged.stats.turns ?? 0, costMicroUsd: salvaged.stats.costMicroUsd };
                     }
+                    if (err instanceof WorkflowAgentBlockedError) {
+                        rec.errorCode = WORKFLOW_SPAWN_BLOCKED_ERROR_CODE;
+                        rec.errorMessage = boundedRedactedSummary(err.message, MAX_TRANSCRIPT_CHARS);
+                    }
                     if (err instanceof WorkflowAgentStalledError && err.attempts > 1) {
                         rec.attempts = err.attempts;
                         rec.lastAttemptReason = "stalled";
@@ -1139,6 +1253,7 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
                         sessionId: "",
                         status: "failed",
                         result: boundedRedactedSummary(err instanceof Error ? err.message : String(err), 500),
+                        ...(err instanceof WorkflowAgentBlockedError ? { errorCode: WORKFLOW_SPAWN_BLOCKED_ERROR_CODE } : {}),
                         stats: { turns: 0, tokens: 0, costMicroUsd: 0 },
                     }, label).catch(() => undefined);
                     bceTerminal(callKey, "failed", rec.output ?? (err instanceof Error ? err.message : String(err)), rec.sessionId, rec.stats);
@@ -1184,7 +1299,7 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
                 if (!finalized) {
                     rec.status = "failed";
                     rec.endedAt = now();
-                    emit({ type: "agent_end", runId, label, phase, ...(groupId !== undefined ? { groupId } : {}), status: "failed", ts: rec.endedAt });
+                    emit({ type: "agent_end", runId, label, phase, ...(groupId !== undefined ? { groupId } : {}), status: "failed", ...(rec.errorCode !== undefined ? { errorCode: rec.errorCode } : {}), ts: rec.endedAt });
                     void persist("update");
                 }
             };
@@ -1205,7 +1320,8 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
                 const baseRunSpec = agentOpts.schema
                     ? { ...framedSpec, ...authInherit, signal: effectiveSignal, outputSchema: agentOpts.schema }
                     : { ...framedSpec, ...authInherit, signal: effectiveSignal };
-                const runSpec = childSessionId !== undefined ? { ...baseRunSpec, sessionId: childSessionId } : baseRunSpec;
+                const preReviewSpec = childSessionId !== undefined ? { ...baseRunSpec, sessionId: childSessionId } : baseRunSpec;
+                const runSpec = await reviewSpawnBeforeLaunch("ctx.agentStream", label, callKey, preReviewSpec, effectiveSignal);
                 const enrichedForwardS = opts.onForwardEvent !== undefined
                     ? (e) => {
                         opts.onForwardEvent(e.type === "task_progress" ? { ...e, workflowRunId: runId, workflowAgentLabel: label } : e);
@@ -1216,6 +1332,7 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
                     ...(opts.parentCwd !== undefined ? { parentCwd: opts.parentCwd } : {}),
                     ...spawnAttribution,
                     ...(enrichedForwardS !== undefined ? { onForwardEvent: enrichedForwardS } : {}),
+                    delegationTaskType: "workflow",
                     agentName: label,
                     onActivity,
                     onWorkspaceResolved: createWorkspaceObserver(rec),
@@ -1236,6 +1353,18 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
                 stream = workflowDepthStore.run({ depth: depth + 1 }, () => runner.runTaskStream(runSpec, undefined, runInternals));
             }
             catch (err) {
+                if (!finalized && err instanceof WorkflowAgentBlockedError) {
+                    rec.errorCode = WORKFLOW_SPAWN_BLOCKED_ERROR_CODE;
+                    rec.errorMessage = boundedRedactedSummary(err.message, MAX_TRANSCRIPT_CHARS);
+                    void journalAppend(callKey, {
+                        taskId: callKey,
+                        sessionId: "",
+                        status: "failed",
+                        result: boundedRedactedSummary(err.message, 500),
+                        errorCode: WORKFLOW_SPAWN_BLOCKED_ERROR_CODE,
+                        stats: { turns: 0, tokens: 0, costMicroUsd: 0 },
+                    }).catch(() => undefined);
+                }
                 recordFailed();
                 releaseOnce();
                 bceTerminal(callKey, "failed", err instanceof Error ? err.message : String(err), undefined, undefined);

package/dist/prompts/default.js

@@ -183,7 +183,7 @@ Use this directory for ALL temporary file needs:
 
 Only use \`/tmp\` if the user explicitly requests it.
 
-The scratchpad directory is session-specific, isolated from the user's project, and can generally be used without permission prompts.`;
+The scratchpad directory is session-specific, isolated from the user's project, and can generally be used without permission prompts. Treat it as ephemeral — it may not survive a long suspension or a resume on a different worker; keep durable outputs in the working directory.`;
 }
 export const GIT_STATUS_MAX_CHARS = 2000;
 export function buildGitSnapshot(p) {

package/dist/stores/file/checkpoint-store.d.ts

@@ -1,9 +1,10 @@
-import { type Checkpoint, type CheckpointFaultMode, type CheckpointStore, type CheckpointSummary, type CheckpointToken, type ReopenReason, type ResolveExpectation, type ResumeOutcome } from "../../core/checkpoint-store.js";
+import { type Checkpoint, type PendingSteerInput, type CheckpointFaultMode, type CheckpointStore, type CheckpointSummary, type CheckpointToken, type ReopenReason, type ResolveExpectation, type ResumeOutcome } from "../../core/checkpoint-store.js";
 export interface FileCheckpointStoreOptions {
     fsync?: boolean;
     compactEvery?: number;
 }
 export declare class FileCheckpointStore implements CheckpointStore {
+    readonly durability: "durable";
     private readonly fsyncEnabled;
     private readonly compactEvery;
     private readonly ledger;
@@ -17,10 +18,7 @@ export declare class FileCheckpointStore implements CheckpointStore {
     get(token: CheckpointToken): Promise<Checkpoint | null>;
     resolve(token: CheckpointToken, scope: string, outcome: ResumeOutcome, expect?: ResolveExpectation): Promise<boolean>;
     reopen(token: CheckpointToken, scope: string, reason: ReopenReason): Promise<boolean>;
-    setPendingSteer(token: CheckpointToken, scope: string, steer: {
-        text: string;
-        trusted: boolean;
-    }): Promise<boolean>;
+    setPendingSteer(token: CheckpointToken, scope: string, steer: PendingSteerInput): Promise<boolean>;
     expire(token: CheckpointToken, scope: string): Promise<boolean>;
     reap(scope: string, cutoff: number): Promise<number>;
     listByScope(scope: string): Promise<CheckpointSummary[]>;

package/dist/stores/file/checkpoint-store.js

@@ -1,7 +1,20 @@
 import { join } from "node:path";
-import { CheckpointError, checkpointOccMatches, checkpointRowMatches, summarizeCheckpoint, validatePendingSteer, winnerFromOutcome, } from "../../core/checkpoint-store.js";
+import { appendPendingSteer, CheckpointError, checkpointOccMatches, checkpointRowMatches, summarizeCheckpoint, validatePendingSteer, winnerFromOutcome, } from "../../core/checkpoint-store.js";
 import { SharedLedgerTable } from "./shared-ledger.js";
+const CHECKPOINT_LEDGER_EVENT_REGISTRY = {
+    put: true,
+    resolve: true,
+    reopen: true,
+    expire: true,
+    steer: true,
+    steer_append: true,
+};
+const KNOWN_CHECKPOINT_LEDGER_EVENTS = new Set(Object.keys(CHECKPOINT_LEDGER_EVENT_REGISTRY));
 function applyCheckpointEvent(cps, ev) {
+    if (!KNOWN_CHECKPOINT_LEDGER_EVENTS.has(ev.t)) {
+        throw new CheckpointError("checkpoint.unsupported_version", `file checkpoint ledger: unrecognised event kind "${String(ev.t)}" — ` +
+            `it was written by a newer worker; refusing the replay rather than serving an incomplete authority`);
+    }
     if (ev.t === "put") {
         cps.set(ev.token, ev.cp);
         return;
@@ -28,6 +41,17 @@ function applyCheckpointEvent(cps, ev) {
         case "steer":
             cp.state.pendingSteer = ev.steer;
             break;
+        case "steer_append": {
+            const queue = cp.state.pendingSteerQueue ?? [];
+            if (!queue.some((e) => e.inputId === ev.entry.inputId))
+                cp.state.pendingSteerQueue = [...queue, ev.entry];
+            break;
+        }
+        default: {
+            const _exhaustive = ev;
+            void _exhaustive;
+            break;
+        }
     }
 }
 const checkpointLedgers = new SharedLedgerTable({
@@ -35,6 +59,7 @@ const checkpointLedgers = new SharedLedgerTable({
     apply: applyCheckpointEvent,
 });
 export class FileCheckpointStore {
+    durability = "durable";
     fsyncEnabled;
     compactEvery;
     ledger;
@@ -114,7 +139,11 @@ export class FileCheckpointStore {
             if (!checkpointRowMatches(cp, scope, "pending")) {
                 return false;
             }
-            this.commit({ t: "steer", token, steer: clean }, this.fsyncEnabled);
+            const next = appendPendingSteer(cp.state, clean);
+            const appended = next[next.length - 1];
+            if (appended === undefined || appended.inputId !== clean.inputId)
+                return true;
+            this.commit({ t: "steer_append", token, entry: appended }, this.fsyncEnabled);
             return true;
         });
     }

package/dist/stores/file/index.js

@@ -45,7 +45,7 @@ export class FileStorageBackend {
             const corruptRead = opts.onCorruptRead !== undefined ? { onCorruptRead: opts.onCorruptRead } : undefined;
             const repo = new FileSessionRepo(this.root, corruptRead);
             this.fileSessions = repo;
-            this.ttl = new TtlSessionStore({ repo, evict: opts.evict ?? "forget" });
+            this.ttl = new TtlSessionStore({ repo, evict: opts.evict ?? "forget", durability: "durable" });
             this.sessionStore = this.ttl;
             this.fileCheckpoints = new FileCheckpointStore(this.root, opts.checkpoint);
             this.checkpointStore = this.fileCheckpoints;

package/dist/stores/file/session-store.d.ts

@@ -24,5 +24,7 @@ export declare class FileSessionRepo implements SessionRepo {
     delete(metadata: SessionMetadata): Promise<void>;
     fork(sourceMetadata: SessionMetadata, options?: SessionForkOptions): Promise<Session>;
     exportEntries(sessionId: string): Promise<SessionTreeEntry[]>;
-    importEntries(sessionId: string, owner: string | undefined, entries: SessionTreeEntry[]): Promise<void>;
+    importEntries(sessionId: string, owner: string | undefined, entries: SessionTreeEntry[], options?: {
+        preserveActorAssertions?: boolean;
+    }): Promise<void>;
 }

package/dist/stores/file/session-store.js

@@ -191,9 +191,9 @@ export class FileSessionRepo {
     async exportEntries(sessionId) {
         return this.read(sessionId).entries;
     }
-    async importEntries(sessionId, owner, entries) {
+    async importEntries(sessionId, owner, entries, options) {
         void owner;
-        const validated = validateEntriesForImport(entries);
+        const validated = validateEntriesForImport(entries, options);
         evictSharedSessionStorage(canonicalStoreKey(this.pathFor(sessionId)));
         const createdAt = new Date().toISOString();
         const lines = [JSON.stringify({ kind: "meta", id: sessionId, createdAt })];

package/dist/stores/file/shared-ledger.js

@@ -88,7 +88,14 @@ export class SharedLedgerTable {
         }
         const core = new LedgerCore(key, paths, this.model, this.live);
         this.live.set(key, core);
-        core.bootstrap();
+        try {
+            core.bootstrap();
+        }
+        catch (e) {
+            if (this.live.get(key) === core)
+                this.live.delete(key);
+            throw e;
+        }
         return core;
     }
 }

package/dist/tools/fs/bash-readonly-classifier.d.ts

@@ -21,3 +21,6 @@ export declare function formatOutOfRootReadApprovalOption(directory: string): st
 export declare function classifyCompoundReadonlyDetailed(command: string, allow: ReadonlySet<string>, boundary?: BashReadonlyRootBoundary): CompoundReadonlyVerdict;
 export declare function classifySimpleCommandReadBoundary(command: string, boundary: BashReadonlyRootBoundary): CompoundReadonlyVerdict;
 export declare function classifyCompoundReadonly(command: string, allow: ReadonlySet<string>, boundary?: BashReadonlyRootBoundary): string | undefined;
+export declare const POLL_LOOP_MAX_BEATS = 120;
+export declare const POLL_LOOP_MAX_SLEEP_SECONDS = 600;
+export declare function classifyBoundedReadonlyPollLoop(command: string, allow: ReadonlySet<string>, boundary?: BashReadonlyRootBoundary): string | undefined;

package/dist/tools/fs/bash-readonly-classifier.js

@@ -462,3 +462,97 @@ export function classifySimpleCommandReadBoundary(command, boundary) {
 export function classifyCompoundReadonly(command, allow, boundary) {
     return classifyCompoundReadonlyDetailed(command, allow, boundary).reason;
 }
+export const POLL_LOOP_MAX_BEATS = 120;
+export const POLL_LOOP_MAX_SLEEP_SECONDS = 600;
+const POLL_BODY_HARD_REJECT = /[<>$()`|&{}\n\r\\]/;
+const NON_ASCII_WHITESPACE = /[^\S \t]/;
+const POLL_LOOP_SHAPE = /^for[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+in[ \t]+(.+?)[ \t]*;[ \t]*do[ \t]+(.+?)[ \t]*;[ \t]*done[ \t]*;?$/;
+function pollLoopQuotesBalanced(s) {
+    let open;
+    for (const ch of s) {
+        if (open === undefined && (ch === '"' || ch === "'"))
+            open = ch;
+        else if (open === ch)
+            open = undefined;
+    }
+    return open === undefined;
+}
+function pollLoopBeatsOf(iterable) {
+    const seq = /^\$\(seq[ \t]+(\d{1,7})[ \t]+(\d{1,7})\)$/.exec(iterable);
+    const brace = seq === null ? /^\{(\d{1,7})\.\.(\d{1,7})\}$/.exec(iterable) : null;
+    const range = seq ?? brace;
+    if (range !== null) {
+        const lo = Number(range[1]);
+        const hi = Number(range[2]);
+        return hi >= lo ? hi - lo + 1 : undefined;
+    }
+    const items = iterable.split(/[ \t]+/);
+    return items.every((t) => /^[A-Za-z0-9_.-]{1,64}$/.test(t)) ? items.length : undefined;
+}
+function pollLoopSleepReason(segment) {
+    const toks = segment.split(/[ \t]+/);
+    if (toks.length !== 2)
+        return "`sleep` in a poll loop must take exactly one literal numeric argument";
+    const v = toks[1];
+    if (!/^\d+(\.\d+)?$/.test(v) || v.length > 8 || Number(v) > POLL_LOOP_MAX_SLEEP_SECONDS) {
+        return `\`sleep ${v}\` is not a literal duration within the ${POLL_LOOP_MAX_SLEEP_SECONDS}s per-beat cap — not auto-allowed`;
+    }
+    return undefined;
+}
+export function classifyBoundedReadonlyPollLoop(command, allow, boundary) {
+    if (NON_ASCII_WHITESPACE.test(command)) {
+        return "the command contains a non-ASCII or control whitespace character (only space and tab are allowed) — its word boundaries cannot be read the way bash would split them, so it is not auto-allowed";
+    }
+    const trimmed = command.trim();
+    if (!trimmed)
+        return "empty command";
+    if (!pollLoopQuotesBalanced(trimmed)) {
+        return "unbalanced quote — the command's structure cannot be read reliably, so it is not auto-allowed";
+    }
+    const m = POLL_LOOP_SHAPE.exec(trimmed);
+    if (m === null) {
+        return "not a bounded read-only poll loop (`for <v> in <literal bound>; do <read commands>; done` is the only accepted control structure)";
+    }
+    const varName = m[1];
+    const iterable = m[2];
+    const body = m[3];
+    if (!/^[a-z]$/.test(varName)) {
+        return `the loop variable "${varName}" must be a single lowercase letter — a name like PATH/IFS/LD_PRELOAD would change how the body's commands resolve`;
+    }
+    const beats = pollLoopBeatsOf(iterable);
+    if (beats === undefined) {
+        return `the loop bound "${iterable}" is not a recognized literal — only \`$(seq <int> <int>)\`, \`{<int>..<int>}\` (ascending) or a literal word list is accepted`;
+    }
+    if (beats > POLL_LOOP_MAX_BEATS) {
+        return `the loop runs ${beats} iterations, above the ${POLL_LOOP_MAX_BEATS}-iteration cap for auto-allow`;
+    }
+    if (POLL_BODY_HARD_REJECT.test(body)) {
+        return "the loop body may not contain redirection, pipes, backgrounding, substitution, subshells, braces, escapes, or line breaks";
+    }
+    const readSegments = [];
+    for (const rawSegment of body.split(";")) {
+        const segment = rawSegment.trim();
+        if (segment.length === 0)
+            return "empty command in the loop body";
+        const parsed = parseLeadingCommandName(segment);
+        if ("reject" in parsed)
+            return parsed.reject;
+        if (parsed.name === "sleep") {
+            const sleepReason = pollLoopSleepReason(segment);
+            if (sleepReason !== undefined)
+                return sleepReason;
+            continue;
+        }
+        readSegments.push(segment);
+    }
+    if (readSegments.length === 0) {
+        return "the loop body has no read command — a sleep-only loop observes nothing and is not auto-allowed";
+    }
+    const verdict = classifyCompoundReadonlyDetailed(readSegments.join("; "), allow, boundary);
+    if (verdict.reason !== undefined)
+        return verdict.reason;
+    if (verdict.undecidedPaths !== undefined) {
+        return `the loop body carries an unexpanded glob (${verdict.undecidedPaths.join(", ")}) — what a REPEATED read touches is decided at run time, so it is not auto-allowed`;
+    }
+    return undefined;
+}