@sema-agent/core 5.27.0 → 5.29.0

package/dist/stores/file/tool-result-store.d.ts

@@ -1,4 +1,4 @@
-import type { ToolResultProvenance, ToolResultSlice, ToolResultStore } from "../../core/tool-result-store.js";
+import type { ToolResultDeletionReport, ToolResultProvenance, ToolResultSlice, ToolResultStore } from "../../core/tool-result-store.js";
 /**
  * design/80 §2.5 — file {@link ToolResultStore}: write-once-idempotent, ONE file per ref.
  *
@@ -16,7 +16,7 @@ import type { ToolResultProvenance, ToolResultSlice, ToolResultStore } from "../
  * char slice identical to every other backend's and what keeps files written by older versions readable
  * with no format migration.
  *
- * That is TWO published objects, so the window is stated rather than hidden (adversarial review): the
+ * That is TWO published objects, so the window is stated rather than hidden (falsification review): the
  * content link is the write-once election and the sidecar follows it, so a crash in between leaves an
  * entry content-complete and momentarily UNOWNED. Publishing the sidecar FIRST would close that window
  * and open a worse one — an ownerless writer's row could then be claimed by whoever raced it — so the
@@ -45,7 +45,7 @@ export declare class FileToolResultStore implements ToolResultStore {
      * already applies to ref safety: a READ (`ownerOf`, an authorization question) degrades an
      * unreadable or malformed sidecar to "unowned" so a corrupt file cannot crash a page-back, while a
      * WRITE refuses to proceed over one it cannot read — silently treating damage as "no owner" is how a
-     * write reports success and leaves the entry unclaimable forever (adversarial review round 4).
+     * write reports success and leaves the entry unclaimable forever (falsification review round 4).
      * A MISSING sidecar is not damage in either face: it is the honest "unowned".
      */
     private readOwnerFile;
@@ -55,4 +55,44 @@ export declare class FileToolResultStore implements ToolResultStore {
         offset?: number;
         limit?: number;
     }): ToolResultSlice | undefined;
+    /**
+     * Erase every entry owned by `sessionId` (interface: {@link ToolResultStore.deleteBySession}). Without
+     * it a session deletion leaves this store's files on disk for the lifetime of the data root.
+     *
+     * Selection matches on the SIDECAR's `sessionId`, never on the filename. That is not a preference, it
+     * is the only thing available: the mint separates segments with `~`, which is outside this backend's
+     * filename charset, so every engine-minted ref folds to `<base>-<sha256 of the raw ref>` and the
+     * session segment is gone from the name (and the readable base is a lossy, many-to-one prefix, so
+     * matching on it would reach a neighbouring session's files). `taskId`, where an older write site
+     * stamped one, is ignored — it narrows the same session.
+     *
+     * Both namespaces are swept: identity-named files in the store dir (refs a caller minted inside the
+     * filename charset, and everything written before the injective mint) and {@link FOLDED_SUBDIR}.
+     *
+     * Removal order is CONTENT then SIDECAR, and it is load-bearing. Interrupted after the content unlink,
+     * the next sweep still finds the sidecar, matches the same session and converges; interrupted after a
+     * sidecar-first unlink, the content file would be left owner-less — readable, attributable to nobody,
+     * and beyond the reach of every future session sweep. Same reasoning as `put`'s publication order, in
+     * the opposite direction. The pair is then re-examined ONCE after both unlinks, which is what keeps
+     * a `put` racing the two from leaving bytes whose owner this sweep removed — and what keeps that
+     * re-examination from deleting a row a DIFFERENT session claimed in the same window (see the body).
+     *
+     * What the re-examination is NOT is atomic: it reads the owner and then acts, so a writer landing
+     * inside THAT gap is narrowed, not excluded. Stated rather than locked away, because the locking that
+     * would close it is ruled out one layer down — `fs-atomic.ts` §2.4 admits exactly one file lock, the
+     * boot lock, on the premise that a data root has a single writing process (`FileStorageBackend`
+     * acquires it before constructing this store; cross-process correctness is a database backend's job,
+     * as everywhere else in this family). Under that premise there is no gap at all: both `put` and this
+     * sweep are wholly synchronous, so nothing can interleave with either. The narrowing above is what
+     * remains worth doing for a root someone shares anyway, and it costs one `readFileSync`.
+     *
+     * Failure posture: an entry that vanished between `readdir` and the unlink is honest absence (ENOENT
+     * ok, the concurrent sweeper's row). Any OTHER unlink error throws — a deletion face that cannot
+     * delete has to be loud — and because the sweep is idempotent, the retry after the operator clears
+     * the cause resumes where it stopped. A sidecar that cannot be READ (EACCES, torn JSON, a shape that
+     * is not the whole record) is counted `unattributable` and its content is left alone: a file we could
+     * not read carries no evidence about whose it is, and this store's rows stay readable through `get`
+     * even with a damaged owner record, so removing one on a guess would destroy another session's output.
+     */
+    deleteBySession(sessionId: string): ToolResultDeletionReport;
 }

package/dist/stores/file/tool-result-store.js

@@ -1,7 +1,7 @@
 import { createHash } from "node:crypto";
-import { readFileSync } from "node:fs";
+import { readFileSync, readdirSync, unlinkSync } from "node:fs";
 import { join } from "node:path";
-import { assertSafeToolResultRef, assertToolResultProvenanceMatch, normalizeToolResultProvenance, } from "../../core/tool-result-store.js";
+import { assertSafeToolResultRef, assertToolResultProvenanceMatch, normalizeToolResultProvenance, ToolResultRefConflictError, } from "../../core/tool-result-store.js";
 import { ensureDir, sanitizePathComponent, writeThenLink } from "./fs-atomic.js";
 import { assertAdoptionBootGate } from "./adoption/marker.js";
 export class FileToolResultStore {
@@ -21,11 +21,11 @@ export class FileToolResultStore {
     }
     pathFor(ref) {
         const { dir, stem } = this.locate(ref);
-        return join(dir, `${stem}.txt`);
+        return join(dir, `${stem}${CONTENT_SUFFIX}`);
     }
     ownerPathFor(ref) {
         const { dir, stem } = this.locate(ref);
-        return join(dir, `${stem}.owner.json`);
+        return join(dir, `${stem}${OWNER_SUFFIX}`);
     }
     put(ref, content, provenance) {
         assertSafeToolResultRef(ref);
@@ -46,7 +46,14 @@ export class FileToolResultStore {
         }
         if (provenance === undefined)
             return;
-        this.writeOwnerFile(ref, provenance);
+        try {
+            this.writeOwnerFile(ref, provenance);
+        }
+        catch (err) {
+            if (err instanceof ToolResultRefConflictError)
+                unlinkIfAbsentOk(this.pathFor(ref));
+            throw err;
+        }
     }
     ownerOf(ref) {
         return this.readOwnerFile(ref, { loud: false });
@@ -63,20 +70,9 @@ export class FileToolResultStore {
                 throw err;
             return undefined;
         }
-        const parsed = (() => {
-            try {
-                return JSON.parse(raw);
-            }
-            catch {
-                return undefined;
-            }
-        })();
-        if (typeof parsed === "object" && parsed !== null) {
-            const { sessionId, taskId } = parsed;
-            if (typeof sessionId === "string" && (taskId === undefined || typeof taskId === "string")) {
-                return taskId === undefined ? { sessionId } : { sessionId, taskId };
-            }
-        }
+        const parsed = parseOwnerRecord(raw);
+        if (parsed !== undefined)
+            return parsed;
         if (opts.loud) {
             throw new Error(`tool-result store: owner record for ref ${JSON.stringify(ref)} is present but unreadable — refusing to write over it`);
         }
@@ -111,6 +107,98 @@ export class FileToolResultStore {
         const content = limit != null ? full.slice(offset, offset + limit) : full.slice(offset);
         return { content, offset, totalChars: full.length };
     }
+    deleteBySession(sessionId) {
+        let deleted = 0;
+        let unattributable = 0;
+        for (const dir of [this.dir, join(this.dir, FOLDED_SUBDIR)]) {
+            let names;
+            try {
+                names = readdirSync(dir);
+            }
+            catch (err) {
+                if (err.code === "ENOENT")
+                    continue;
+                throw err;
+            }
+            const listed = new Set(names);
+            for (const name of names) {
+                if (!name.endsWith(OWNER_SUFFIX))
+                    continue;
+                const owner = readOwnerAt(join(dir, name));
+                if (owner === "gone")
+                    continue;
+                if (owner === "damaged") {
+                    unattributable++;
+                    continue;
+                }
+                if (owner.sessionId !== sessionId)
+                    continue;
+                const stem = name.slice(0, -OWNER_SUFFIX.length);
+                const sidecarPath = join(dir, name);
+                const contentPath = join(dir, `${stem}${CONTENT_SUFFIX}`);
+                unlinkIfAbsentOk(contentPath);
+                unlinkIfAbsentOk(sidecarPath);
+                const republished = readOwnerAt(sidecarPath);
+                if (republished === "gone") {
+                    unlinkIfAbsentOk(contentPath);
+                }
+                else if (republished === "damaged") {
+                    unattributable++;
+                }
+                else if (republished.sessionId === sessionId) {
+                    unlinkIfAbsentOk(contentPath);
+                    unlinkIfAbsentOk(sidecarPath);
+                }
+                deleted++;
+            }
+            for (const name of names) {
+                if (!name.endsWith(CONTENT_SUFFIX))
+                    continue;
+                if (listed.has(`${name.slice(0, -CONTENT_SUFFIX.length)}${OWNER_SUFFIX}`))
+                    continue;
+                unattributable++;
+            }
+        }
+        return { deleted, unattributable };
+    }
+}
+const CONTENT_SUFFIX = ".txt";
+const OWNER_SUFFIX = ".owner.json";
+function parseOwnerRecord(raw) {
+    const parsed = (() => {
+        try {
+            return JSON.parse(raw);
+        }
+        catch {
+            return undefined;
+        }
+    })();
+    if (typeof parsed === "object" && parsed !== null) {
+        const { sessionId, taskId } = parsed;
+        if (typeof sessionId === "string" && (taskId === undefined || typeof taskId === "string")) {
+            return taskId === undefined ? { sessionId } : { sessionId, taskId };
+        }
+    }
+    return undefined;
+}
+function readOwnerAt(path) {
+    let raw;
+    try {
+        raw = readFileSync(path, "utf8");
+    }
+    catch (err) {
+        return err.code === "ENOENT" ? "gone" : "damaged";
+    }
+    return parseOwnerRecord(raw) ?? "damaged";
+}
+function unlinkIfAbsentOk(path) {
+    try {
+        unlinkSync(path);
+    }
+    catch (err) {
+        if (err.code !== "ENOENT")
+            throw err;
+    }
 }
 const NATIVE_FILENAME_CHARSET = /^[A-Za-z0-9_.-]+$/;
 const FOLDED_SUBDIR = "folded-v2";

package/dist/tools/fs/bash-readonly-classifier.d.ts

@@ -52,7 +52,7 @@ export interface LeadingCommandNameOptions {
  * Returns `{ name }` for a parseable single bare command, or `{ reject }` with a human reason otherwise. It
  * does NOT inspect ARGUMENTS for write flags or consult any allowlist — that is the caller's job (the
  * allowlist for `bash_readonly`, the allow/deny lists for the coarse policy). Keeping ONE parser is the whole
- * point: a second argv[0] parser would drift from this one and silently open a bypass.
+ * point: a second argv[0] parser would drift from this one and silently open a circumvention.
  */
 export declare function parseLeadingCommandName(command: string, options?: LeadingCommandNameOptions): {
     name: string;
@@ -289,7 +289,7 @@ export declare const POLL_LOOP_MAX_SLEEP_SECONDS = 600;
  *    no-egress envelope — every beat still runs allowlisted readers + literal `sleep`), and the
  *    walltime axis cascades a hard kill regardless. A deployment wanting NO command-substitution at
  *    all can prefer `{<lo>..<hi>}` or a literal list, which bash expands internally with no command
- *    run. (Codex adversarial review flagged the substitution as [high] and recommended dropping it;
+ *    run. (Codex falsification review flagged the substitution as [high] and recommended dropping it;
  *    kept per the ruling that names `$(seq <int> <int>)` as the one exemption — recorded for a
  *    tightening decision, since the brace form is a drop-in equivalent.)
  *  · STDIN-BLOCKING BODY (an availability residual, not a safety one). CLOSED for the shape this note

package/dist/tools/fs/fs-bash.d.ts

@@ -110,6 +110,10 @@ export declare function createBashTool(env: ExecutionEnv, rootCanonical: string,
     /** RB-370 ② (cli [2088]): override of the `timeout` parameter's engine CEILING, in ms — only-widen
      *  vs the resolved default; see {@link import("./index.js").HandsToolkitOptions.bashMaxTimeoutMs}. */
     bashMaxTimeoutMs?: number;
+    /** Structured sink for this leg's timeout-cap discard announcements — consumed by
+     *  {@link import("./fs-shared.js").resolveBashTimeoutCaps} at mount (see
+     *  {@link import("./index.js").HandsToolkitOptions.onNotice} for the replace-vs-warn contract). */
+    onNotice?: (n: import("../../core/types.js").EngineNotice) => void;
     /**
      * #181-F6 — whether the Monitor tool is on THIS run's roster (the Runner's own mount predicate is
      * `backgroundTaskToolsActive`; it, not this tool, mounts Monitor). Read by the SR-2 gh rate-limit
@@ -122,7 +126,7 @@ export declare function createBashTool(env: ExecutionEnv, rootCanonical: string,
 /**
  * `bash_readonly` (effect:read) — a restricted shell for the verifier read-only boundary (design/44 M2):
  * a single allowlisted, bare command with no shell operators. effect:read lets it survive the verifier's
- * read-only filter, but it is NOT a policy bypass — it still goes through the design/37 gate (council #7:
+ * read-only filter, but it is NOT a policy circumvention — it still goes through the design/37 gate (council #7:
  * a read can still be a side channel, e.g. dumping a secret file). The allowlist is a coarse pre-filter;
  * the policy gate is the authoritative control.
  *
@@ -142,6 +146,9 @@ export declare function createBashReadonlyTool(env: ExecutionEnv, rootCanonical:
      *  legs share runShell's clamp, so both must share the configurable resolution). */
     bashDefaultTimeoutMs?: number;
     bashMaxTimeoutMs?: number;
+    /** Structured sink for the timeout-cap discard announcements — same seat the full `bash` leg
+     *  takes (both foreground legs share the resolver, so both must share the sink). */
+    onNotice?: (n: import("../../core/types.js").EngineNotice) => void;
     /** RB-413: the extra containment roots the structured file tools got (design/119 `--add-dir`,
      *  canonical). A read this deployment already sanctions for Read/Grep/Glob is equally sanctioned
      *  here — the two faces must not disagree about which directories exist for this session. */

package/dist/tools/fs/fs-search-tools.d.ts

@@ -6,5 +6,5 @@ export declare function createGlobTool(env: ExecutionEnv, rootCanonical: string,
  *  wake/resume reconciliation and (b) drive the verifier read-only boundary. Every mutating hand tool is
  *  `write` (RB-264 ⑥W1 folded `Write` back in — see below); `bash` is `write` (a command can do anything);
  *  `bash_readonly` is `read` (so it survives the verifier boundary — but still goes through the policy
- *  gate, council #7: effect:read is a redo-safety class, never a policy bypass). */
+ *  gate, council #7: effect:read is a redo-safety class, never a policy circumvention). */
 export declare const HAND_TOOL_EFFECTS: Readonly<Record<string, ToolEffect>>;

package/dist/tools/fs/fs-shared.d.ts

@@ -3,6 +3,7 @@ import type { ExecutionEnv } from "../../internal/harness-types.js";
 import { type FsViolation, type ReadFileState } from "./safety.js";
 import { type DecodedTextFile } from "./encoding.js";
 import { type ImageDownsampler } from "../../core/mcp.js";
+import { type EngineNotice } from "../../core/types.js";
 /**
  * The "hand" tool band (design/44 §3) — built per task over an injected {@link ExecutionEnv} and a
  * per-task {@link ReadFileState}, closure-captured (design/44 §11 ruling A: the codebase tool idiom; no
@@ -223,6 +224,10 @@ export declare function bashTimeoutArgRefusal(timeoutMs: number | undefined, cap
 export declare function resolveBashTimeoutCaps(opts?: {
     bashDefaultTimeoutMs?: number;
     bashMaxTimeoutMs?: number;
+    /** Structured seat for the discard announcements below — wired, it REPLACES their `console.warn`
+     *  (same ledger, same lines as `message`); absent, the console line prints verbatim. Threaded from
+     *  the toolkit assembly (ultimately `RunnerDeps.onNotice`); never a global. */
+    onNotice?: (n: EngineNotice) => void;
 }): {
     defaultMs: number;
     maxMs: number;
@@ -440,7 +445,7 @@ export declare function enoentMessage(env: ExecutionEnv, key: string, cwd: strin
 /** Per-task mutable working directory shared by the shell and the path-taking fs tools (design/64 §16.3).
  *  Holds the RAW path (never canonicalized): bash `cd` updates `current`, and the fs tools resolve relative
  *  paths against it. Containment is still enforced per-op by resolveKey (canonicalize + within), so a `cd`
- *  through a symlink out of root cannot smuggle a relative fs path outside. */
+ *  through a symlink out of root cannot carry across a relative fs path outside. */
 export interface CwdRef {
     current: string;
 }

package/dist/tools/fs/fs-shared.js

@@ -5,6 +5,7 @@ import { decodeTextBytes, normalizeFileText } from "./encoding.js";
 import { shellQuote } from "./search.js";
 import { isNotebookPath } from "./notebook.js";
 import { sharpImageDownsampler } from "../../core/mcp.js";
+import { deliverEngineNotice } from "../../core/types.js";
 export const MAX_READ_BYTES = 256 * 1024;
 export const SLICED_READ_MAX_BYTES = 64 * 1024 * 1024;
 export const MAX_EDIT_BYTES = 1024 * 1024 * 1024;
@@ -88,7 +89,10 @@ export function envErrorDetail(message) {
     return trimmed === "" ? "the execution environment reported no reason" : trimmed;
 }
 const announcedTimeoutConfig = new Set();
-function announceDiscardedTimeout(knob, raw, usedMs) {
+function emitTimeoutDiscardNotice(message, detail, onNotice) {
+    deliverEngineNotice(onNotice, { code: "config.env_timeout_discarded", message, detail });
+}
+function announceDiscardedTimeout(knob, raw, usedMs, onNotice) {
     if (typeof raw === "string" && raw === "")
         return;
     const n = typeof raw === "number" ? raw : Number(raw);
@@ -105,7 +109,7 @@ function announceDiscardedTimeout(knob, raw, usedMs) {
     if (announcedTimeoutConfig.has(line))
         return;
     announcedTimeoutConfig.add(line);
-    console.warn(line);
+    emitTimeoutDiscardNotice(line, { knob, raw, usedMs }, onNotice);
 }
 export function bashTimeoutParamDescription(caps, withDefault) {
     const bounds = `${withDefault ? `default ${caps.defaultMs}, ` : ""}min ${MIN_BASH_TIMEOUT_MS}, max ${caps.maxMs}`;
@@ -131,13 +135,13 @@ export function resolveBashTimeoutCaps(opts) {
         BASH_DEFAULT_TIMEOUT_MS;
     const maxMs = Math.max(validTimeoutMs(opts?.bashMaxTimeoutMs) ?? validTimeoutMs(Number(process.env.BASH_MAX_TIMEOUT_MS)) ?? BASH_MAX_TIMEOUT_MS, defaultMs);
     if (opts?.bashDefaultTimeoutMs !== undefined)
-        announceDiscardedTimeout("bashDefaultTimeoutMs", opts.bashDefaultTimeoutMs, defaultMs);
+        announceDiscardedTimeout("bashDefaultTimeoutMs", opts.bashDefaultTimeoutMs, defaultMs, opts?.onNotice);
     if (process.env.BASH_DEFAULT_TIMEOUT_MS !== undefined)
-        announceDiscardedTimeout("BASH_DEFAULT_TIMEOUT_MS", process.env.BASH_DEFAULT_TIMEOUT_MS, defaultMs);
+        announceDiscardedTimeout("BASH_DEFAULT_TIMEOUT_MS", process.env.BASH_DEFAULT_TIMEOUT_MS, defaultMs, opts?.onNotice);
     if (opts?.bashMaxTimeoutMs !== undefined)
-        announceDiscardedTimeout("bashMaxTimeoutMs", opts.bashMaxTimeoutMs, maxMs);
+        announceDiscardedTimeout("bashMaxTimeoutMs", opts.bashMaxTimeoutMs, maxMs, opts?.onNotice);
     if (process.env.BASH_MAX_TIMEOUT_MS !== undefined)
-        announceDiscardedTimeout("BASH_MAX_TIMEOUT_MS", process.env.BASH_MAX_TIMEOUT_MS, maxMs);
+        announceDiscardedTimeout("BASH_MAX_TIMEOUT_MS", process.env.BASH_MAX_TIMEOUT_MS, maxMs, opts?.onNotice);
     const optsCap = validTimeoutMs(opts?.bashMaxTimeoutMs);
     const requestedCap = optsCap ?? validTimeoutMs(Number(process.env.BASH_MAX_TIMEOUT_MS));
     if (requestedCap !== undefined && requestedCap < defaultMs) {
@@ -145,7 +149,7 @@ export function resolveBashTimeoutCaps(opts) {
         const line = `${knob}=${requestedCap} is below the resolved default budget (${defaultMs}ms) — the ceiling was raised to ${maxMs}ms (the default always fits under the cap).`;
         if (!announcedTimeoutConfig.has(line)) {
             announcedTimeoutConfig.add(line);
-            console.warn(line);
+            emitTimeoutDiscardNotice(line, { knob, raw: requestedCap, usedMs: maxMs }, opts?.onNotice);
         }
     }
     return { defaultMs, maxMs };

package/dist/tools/fs/index.d.ts

@@ -74,6 +74,12 @@ export interface HandsToolkitOptions {
      *  only-widen semantic: a ceiling below the default is a narrowing intent = invalid, ignored in
      *  favor of the default. Additive: absent ⇒ byte-compat 600s. */
     bashMaxTimeoutMs?: number;
+    /** Structured sink for the timeout-cap discard announcements both shell legs emit at mount (see
+     *  {@link import("../../core/types.js").EngineNotice} / `RunnerDeps.onNotice`). Wired, it REPLACES
+     *  their `console.warn` line (a forwarding host must not show every fact twice); absent, the
+     *  console line prints verbatim (byte-compat loudness). Threaded per toolkit build — never a
+     *  global. */
+    onNotice?: (n: import("../../core/types.js").EngineNotice) => void;
     /** RB-220 — see createBashTool's taskOpts.oneShot / createTaskOutputTool's TaskToolOptions.oneShot for
      *  the full contract: this run has no later turn for an async background notification to land in.
      *  Threaded to both the Bash background-launch receipt and (when this band mounts TaskOutput itself,

package/dist/tools/fs/index.js

@@ -41,6 +41,7 @@ export function createHandsToolkit(env, readFileState, rootCanonical, opts = {})
             ? createBashReadonlyTool(env, rootCanonical, new Set(bashReadonlyAllow ?? BASH_READONLY_DEFAULT_ALLOW), {
                 ...(opts.bashDefaultTimeoutMs !== undefined ? { bashDefaultTimeoutMs: opts.bashDefaultTimeoutMs } : {}),
                 ...(opts.bashMaxTimeoutMs !== undefined ? { bashMaxTimeoutMs: opts.bashMaxTimeoutMs } : {}),
+                ...(opts.onNotice !== undefined ? { onNotice: opts.onNotice } : {}),
                 ...(readFaceRoots !== undefined ? { additionalRoots: readFaceRoots } : {}),
             })
             : createBashTool(env, rootCanonical, commitCoAuthor, cwdRef, {
@@ -55,6 +56,7 @@ export function createHandsToolkit(env, readFileState, rootCanonical, opts = {})
                 ...(additionalRoots !== undefined ? { additionalRoots } : {}),
                 ...(opts.bashDefaultTimeoutMs !== undefined ? { bashDefaultTimeoutMs: opts.bashDefaultTimeoutMs } : {}),
                 ...(opts.bashMaxTimeoutMs !== undefined ? { bashMaxTimeoutMs: opts.bashMaxTimeoutMs } : {}),
+                ...(opts.onNotice !== undefined ? { onNotice: opts.onNotice } : {}),
                 ...(opts.monitorToolActive !== undefined ? { monitorToolActive: opts.monitorToolActive } : {}),
             }));
         if (!readOnly && mountBackgroundTaskTools && hasBackgroundShell(env)) {

package/dist/tools/fs/safety.d.ts

@@ -3,7 +3,7 @@ import type { ExecutionEnv } from "../../internal/harness-types.js";
  * batch-B (CC 2.1.187 parity): Read/Edit/Write take the file path as `file_path`. Read the target the same way
  * EVERYWHERE the path is consumed from a tool-call's args — not just the tool body but ALSO every gate that
  * extracts the write target to confine it (sensitive-path, skill allowPaths, session allowDirs). A gate that only
- * read `args.path` would see `undefined` for a `file_path` call and either fail-OPEN (bypass the guard — a real
+ * read `args.path` would see `undefined` for a `file_path` call and either fail-OPEN (circumvent the guard — a real
  * hole) or fail-closed (deny a legitimate write). Single source.
  *
  * The `path` arm is deliberately BROADER than what Read/Edit/Write accept (ruled 2026-08-03): their schema requires

package/dist/tools/scheduler-tools.d.ts

@@ -27,7 +27,7 @@ export declare const AUTONOMOUS_LOOP_DYNAMIC_SENTINEL = "<<autonomous-loop-dynam
 /** Runner-held 上下文 + run-stop 出口，工具工厂闭包捕获（模型触不到）。 */
 export interface SchedulerToolContext {
     /**
-     * **会话腿**的越权隔离键（Runner 填 sessionId ?? principal ?? taskId）。durable 腿不用这条链——它的键由
+     * **会话腿**的越界隔离键（Runner 填 sessionId ?? principal ?? taskId）。durable 腿不用这条链——它的键由
      * {@link durableScopeOf} 从 principal 独立铸（ruled 2026-08-03，见该函数注释）。
      */
     scope: string;

package/dist/tools/task-list.d.ts

@@ -74,7 +74,7 @@ export interface TaskListStore {
  *
  * The in-memory store rejected such a row incidentally: its snapshot helper spreads `t.blocks`, so a
  * missing array threw "blocks is not iterable" at write. The file store had no such accident and wrote the
- * row to disk, where it survived until `TaskUpdate` reached `t.blocks.includes(...)` — a poisoned row that
+ * row to disk, where it survived until `TaskUpdate` reached `t.blocks.includes(...)` — a contaminated row that
  * passes the write and detonates at an unrelated later call, in a different session, with no trace of where
  * it came from. Two backends disagreeing about what a valid row is means a test written against one has
  * different semantics on the other.

package/dist/tools/web.d.ts

@@ -21,7 +21,7 @@ export interface WebFetchConfig {
      *
      *  Pre-2.13 review F1 (additive): the object return form lets a summarizer report that its own OUTPUT
      *  was cut (`truncated: true` — e.g. the sub-model hit max_tokens) as structured fact. The tool then
-     *  renders the disclosure OUTSIDE the untrusted fence (a page must not be able to forge it) and stamps
+     *  renders the disclosure OUTSIDE the untrusted fence (a page must not be able to self-declare it) and stamps
      *  `details.truncated`. A plain-string return still works and claims a complete summary.
      *
      *  ruled 2026-08-05 (grounding contract): the object form additionally carries `inputTruncated` — the
@@ -126,7 +126,7 @@ export declare const WEBFETCH_SUMMARY_INPUT_HEADROOM = 0.8;
  * reservation still gets a small excerpt rather than a computation that lands at or below zero and feeds
  * the summarizer an empty page — a call that cannot possibly answer is strictly worse than one that might.
  *
- * Honest scope (adversarial review round 1): this is a FLOOR, not a proof of fit. With the output
+ * Honest scope (falsification review round 1): this is a FLOOR, not a proof of fit. With the output
  * reservation bounded at window/4 (see `resolveSummaryInputChars`), the floor now fires only on genuinely
  * tiny windows (roughly under 3k tokens at the default chars-per-token) — a model whose declared
  * dimensions leave no room gets a small excerpt whose attempt often succeeds anyway, and a failure is
@@ -139,7 +139,7 @@ export declare const WEBFETCH_SUMMARY_MIN_CONTENT = 4000;
  * Resolve the page-content budget for {@link createWebFetchSummarizer} against `model`'s window.
  * An explicit `override` wins outright (a deployment that measured its own model beats an estimate).
  *
- * Fail-loud on every non-finite input, same posture as {@link resolveWebMaxBytes} (adversarial review
+ * Fail-loud on every non-finite input, same posture as {@link resolveWebMaxBytes} (falsification review
  * round 1): a `NaN` anywhere in the model's declared dimensions propagates through the arithmetic and out
  * through `Math.min`/`Math.max` unchanged, and a `NaN` budget makes `content.length > budget` false — so
  * the clip silently stops happening and the whole oversize page is fed to the model, which is the failure

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "5.27.0",
+  "version": "5.29.0",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",