@sema-agent/core 5.37.0 → 5.39.0

package/dist/scenarios/full-body.d.ts

@@ -28,6 +28,8 @@ export interface CodeToolsConfig {
      * parity: TodoWrite is enabled only when the task list is off). With `taskList` on (the default),
      * TodoWrite is NOT mounted even when `todoWrite: true` is set explicitly — the exclusion gate wins;
      * pass `taskList: false` to get TodoWrite back. `todoWrite: false` always drops it.
+     * design/277: the DEFAULT arm (undefined) is model-gated (`modelGate: "task-scaffold"` — trimmed
+     * at prepare for gate-table models); an EXPLICIT `true` mounts unstamped (never gated).
      */
     todoWrite?: boolean;
     /**
@@ -36,6 +38,9 @@ export interface CodeToolsConfig {
      * list is on unless explicitly disabled, and TodoWrite is its off-state fallback — the two families
      * are mutually exclusive, never co-mounted). Only an explicit `taskList: false` reverts to the
      * TodoWrite shape.
+     * design/277: the DEFAULT arm (undefined) is model-gated (`modelGate: "task-scaffold"`); an
+     * EXPLICIT `true` mounts the family unstamped (never gated). `taskList: false` only selects the
+     * TodoWrite family shape — it is NOT an explicit demand for TodoWrite (see `todoWrite`).
      */
     taskList?: boolean;
     /**

package/dist/scenarios/full-body.js

@@ -10,11 +10,15 @@ export function assembleCodeTools(cfg = {}) {
         tools.push(createWebSearchTool(cfg.webSearch));
     if (cfg.subagent)
         tools.push(createSubagentTool({ ...cfg.subagent, systemPrompt: cfg.subagent.systemPrompt ?? CODE_SYSTEM_PROMPT }));
+    const stamp = (t) => ({ ...t, modelGate: "task-scaffold" });
     const taskListOn = cfg.taskList !== false;
-    if (cfg.todoWrite !== false && !taskListOn)
-        tools.push(createTodoWriteTool());
-    if (taskListOn)
-        tools.push(...createTaskListTools(cfg.taskListStore));
+    if (cfg.todoWrite !== false && !taskListOn) {
+        tools.push(cfg.todoWrite === true ? createTodoWriteTool() : stamp(createTodoWriteTool()));
+    }
+    if (taskListOn) {
+        const family = createTaskListTools(cfg.taskListStore);
+        tools.push(...(cfg.taskList === true ? family : family.map(stamp)));
+    }
     return tools;
 }
 export const CODE_ROLE = { systemPrompt: CODE_SYSTEM_PROMPT, thinking: "high" };

package/dist/tools/fs/fs-shared.d.ts

@@ -232,8 +232,9 @@ export declare function resolveBashTimeoutCaps(opts?: {
     defaultMs: number;
     maxMs: number;
 };
-/** Test seam: the announcement de-dupes per process, so a test that asserts the line must be able to
- *  clear the ledger. Never called by production code. */
+/** Test seam: the announcement de-dupes per sink (console arm per process), so a test that asserts
+ *  the line must be able to re-arm the ledger. Re-arms BOTH arms (a WeakMap has no clear — it is
+ *  re-minted). Never called by production code. */
 export declare function __resetBashTimeoutAnnouncements(): void;
 /** RB-370 ②: the seconds view of a resolved {@link resolveBashTimeoutCaps} pair — the shell's INTERNAL
  *  unit stays seconds while every model-facing surface stays ms (design/64 §8.1C posture). One rounding

package/dist/tools/fs/fs-shared.js

@@ -88,8 +88,23 @@ export function envErrorDetail(message) {
     const trimmed = (message ?? "").trim();
     return trimmed === "" ? "the execution environment reported no reason" : trimmed;
 }
-const announcedTimeoutConfig = new Set();
+let announcedTimeoutConfigBySink = new WeakMap();
+const announcedTimeoutConfigConsole = new Set();
+function timeoutConfigLedger(onNotice) {
+    if (typeof onNotice !== "function")
+        return announcedTimeoutConfigConsole;
+    let lines = announcedTimeoutConfigBySink.get(onNotice);
+    if (lines === undefined) {
+        lines = new Set();
+        announcedTimeoutConfigBySink.set(onNotice, lines);
+    }
+    return lines;
+}
 function emitTimeoutDiscardNotice(message, detail, onNotice) {
+    const ledger = timeoutConfigLedger(onNotice);
+    if (ledger.has(message))
+        return;
+    ledger.add(message);
     deliverEngineNotice(onNotice, { code: "config.env_timeout_discarded", message, detail });
 }
 function announceDiscardedTimeout(knob, raw, usedMs, onNotice) {
@@ -106,9 +121,6 @@ function announceDiscardedTimeout(knob, raw, usedMs, onNotice) {
             return;
         line = `${knob}=${String(raw)} was ignored — it ${defect}. Using ${usedMs}ms instead.`;
     }
-    if (announcedTimeoutConfig.has(line))
-        return;
-    announcedTimeoutConfig.add(line);
     emitTimeoutDiscardNotice(line, { knob, raw, usedMs }, onNotice);
 }
 export function bashTimeoutParamDescription(caps, withDefault) {
@@ -147,15 +159,13 @@ export function resolveBashTimeoutCaps(opts) {
     if (requestedCap !== undefined && requestedCap < defaultMs) {
         const knob = optsCap !== undefined ? "bashMaxTimeoutMs" : "BASH_MAX_TIMEOUT_MS";
         const line = `${knob}=${requestedCap} is below the resolved default budget (${defaultMs}ms) — the ceiling was raised to ${maxMs}ms (the default always fits under the cap).`;
-        if (!announcedTimeoutConfig.has(line)) {
-            announcedTimeoutConfig.add(line);
-            emitTimeoutDiscardNotice(line, { knob, raw: requestedCap, usedMs: maxMs }, opts?.onNotice);
-        }
+        emitTimeoutDiscardNotice(line, { knob, raw: requestedCap, usedMs: maxMs }, opts?.onNotice);
     }
     return { defaultMs, maxMs };
 }
 export function __resetBashTimeoutAnnouncements() {
-    announcedTimeoutConfig.clear();
+    announcedTimeoutConfigBySink = new WeakMap();
+    announcedTimeoutConfigConsole.clear();
 }
 export function bashTimeoutCapsSec(caps) {
     return { defaultSec: Math.max(1, Math.round(caps.defaultMs / 1000)), maxSec: Math.max(1, Math.round(caps.maxMs / 1000)) };

package/dist/tools/fs/read-deny.d.ts

@@ -40,10 +40,18 @@ export interface ReadDenyMatcher {
     /** Normalized entries (built-ins first, then additions; exact duplicates folded). The disclosure /
      *  persistence face. */
     readonly entries: readonly NormalizedReadDenyEntry[];
-    /** Judge ONE path view (segment-window semantics). Returns the first matching entry, or null. */
-    matchPath(path: string): ReadDenyHit | null;
-    /** §3.3 target judgment: canonical view + lexical view; EITHER hit decides. */
-    matchTarget(canonicalKey: string, lexicalView?: string): ReadDenyHit | null;
+    /** Judge ONE path view (segment-window semantics). Returns the first matching entry, or null.
+     *  `aliasResolved` = the key's MINTER reports the real filesystem already collapsed any win32
+     *  component alias in it (canonicalizeTarget's realpath arm); unset ⇒ both readings are judged,
+     *  which is the fail-closed default. */
+    matchPath(path: string, opts?: {
+        readonly aliasResolved?: boolean;
+    }): ReadDenyHit | null;
+    /** §3.3 target judgment: canonical view + lexical view; EITHER hit decides. `aliasResolved`
+     *  applies to the CANONICAL arm only — the lexical view is an unresolved spelling. */
+    matchTarget(canonicalKey: string, lexicalView?: string, opts?: {
+        readonly aliasResolved?: boolean;
+    }): ReadDenyHit | null;
     /** Traversal exclusions for the rg legs: `!`-polarity glob pairs — `!**\/<p>` plus `!**\/<p>/…`
      *  (the entry itself and its descendants). */
     readonly rgExclusionGlobs: readonly ReadDenyRgGlob[];
@@ -145,7 +153,9 @@ export declare function compileSegmentPattern(raw: string, fold: "none" | "ascii
  * BOTH separator families — win32 canonical keys are backslash-form. Returns the matched raw pattern
  * or null.
  */
-export declare function matchSegmentPatterns(path: string, compiled: readonly CompiledSegmentPattern[]): string | null;
+export declare function matchSegmentPatterns(path: string, compiled: readonly CompiledSegmentPattern[], opts?: {
+    readonly aliasResolved?: boolean;
+}): string | null;
 /**
  * codex r3 — the PURE validation/canonicality predicate over a PERSISTED deny entry (checkpoint v9
  * face section), for the resume pre-CAS ladder: it must refuse BEFORE the approval CAS everything

package/dist/tools/fs/read-deny.js

@@ -91,15 +91,36 @@ export function compileSegmentPattern(raw, fold) {
     });
     return { raw, segments, foldAscii: fold === "ascii" };
 }
-export function matchSegmentPatterns(path, compiled) {
-    const rawSegs = path.split(/[\\/]/).filter(Boolean);
-    let loweredSegs;
+export function matchSegmentPatterns(path, compiled, opts) {
+    const literalSegs = path.split(/[\\/]/).filter(Boolean);
+    const win32Segs = [];
+    for (const raw of literalSegs) {
+        const dot = /^\.{1,2}$/.test(raw) ? raw : raw.replace(/ +$/, "");
+        if (dot === ".")
+            continue;
+        if (dot === "..") {
+            const last = win32Segs[win32Segs.length - 1];
+            if (win32Segs.length > 0 && last !== "..")
+                win32Segs.pop();
+            else
+                win32Segs.push("..");
+            continue;
+        }
+        const stripped = raw.replace(/[. ]+$/, "");
+        win32Segs.push(stripped.length > 0 ? stripped : raw);
+    }
+    const sameView = opts?.aliasResolved === true ||
+        (win32Segs.length === literalSegs.length && win32Segs.every((s, i) => s === literalSegs[i]));
+    const views = sameView ? [literalSegs] : [literalSegs, win32Segs];
+    const lowered = new Map();
     for (const pat of compiled) {
-        const segs = pat.foldAscii ? (loweredSegs ??= rawSegs.map(asciiLower)) : rawSegs;
-        const n = pat.segments.length;
-        for (let i = 0; i + n <= segs.length; i++) {
-            if (pat.segments.every((re, j) => re.test(segs[i + j] ?? "")))
-                return pat.raw;
+        for (const view of views) {
+            const segs = pat.foldAscii ? (lowered.get(view) ?? lowered.set(view, view.map(asciiLower)).get(view)) : view;
+            const n = pat.segments.length;
+            for (let i = 0; i + n <= segs.length; i++) {
+                if (pat.segments.every((re, j) => re.test(segs[i + j] ?? "")))
+                    return pat.raw;
+            }
         }
     }
     return null;
@@ -171,15 +192,15 @@ export function compileReadDeny(additions = [], layer = "additions", builtin) {
         rgExclusionGlobs.push({ flag, glob: `!**/${g}` }, { flag, glob: `!**/${g}/**` });
         rgProbeGlobs.push({ flag, glob: `**/${g}` }, { flag, glob: `**/${g}/**` });
     }
-    const matchPath = (path) => {
-        const hit = matchSegmentPatterns(path, compiled);
+    const matchPath = (path, opts) => {
+        const hit = matchSegmentPatterns(path, compiled, opts);
         return hit === null ? null : { pattern: hit };
     };
     return {
         entries: normalized,
         matchPath,
-        matchTarget(canonicalKey, lexicalView) {
-            const canonical = matchPath(canonicalKey);
+        matchTarget(canonicalKey, lexicalView, opts) {
+            const canonical = matchPath(canonicalKey, opts);
             if (canonical !== null)
                 return { ...canonical, matchedView: canonicalKey };
             if (lexicalView !== undefined) {

package/dist/tools/fs/safety.d.ts

@@ -268,7 +268,9 @@ export declare function lexicalViewOf(spelled: string, base: string): string;
  * `executionEnv` — see design/44 §5.)
  */
 export declare function resolveKey(env: ExecutionEnv, rootCanonical: string, path: string, signal?: AbortSignal, baseCwd?: string, additionalRootsCanonical?: readonly string[], exactFileReadExemption?: (canonicalKey: string) => boolean, readDeny?: {
-    matchTarget(canonicalKey: string, lexicalView?: string): {
+    matchTarget(canonicalKey: string, lexicalView?: string, opts?: {
+        readonly aliasResolved?: boolean;
+    }): {
         pattern: string;
         matchedView?: string;
     } | null;
@@ -291,6 +293,7 @@ export declare function resolveKey(env: ExecutionEnv, rootCanonical: string, pat
 export declare function canonicalizeTarget(env: ExecutionEnv, path: string, signal?: AbortSignal, baseCwd?: string): Promise<{
     ok: true;
     key: string;
+    aliasResolved?: true;
 } | {
     ok: false;
     message: string;

package/dist/tools/fs/safety.js

@@ -339,7 +339,9 @@ export async function resolveKey(env, rootCanonical, path, signal, baseCwd, addi
         return { ok: false, violation: { code: "invalid", message: `path "${path}" is a blocked device/special file (reading it can hang the process); refused.` } };
     }
     if (readDeny !== undefined) {
-        const hit = readDeny.matchTarget(key, lexicalViewOf(path, baseCwd ?? rootCanonical));
+        const hit = readDeny.matchTarget(key, lexicalViewOf(path, baseCwd ?? rootCanonical), {
+            aliasResolved: canon.aliasResolved === true,
+        });
         if (hit !== null) {
             const lexicalHit = hit.matchedView !== undefined && hit.matchedView !== key;
             const judged = lexicalHit
@@ -419,7 +421,7 @@ export async function canonicalizeTarget(env, path, signal, baseCwd) {
         }
         const canon = await env.canonicalPath(abs, signal);
         if (canon.ok)
-            return { ok: true, key: canon.value };
+            return { ok: true, key: canon.value, aliasResolved: true };
         const info = await env.fileInfo(abs, signal);
         if (!info.ok) {
             return { ok: false, message: `cannot determine whether "${path}" is a symlink: ${info.error.message}`, unresolvedSymlink: true };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "5.37.0",
+  "version": "5.39.0",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",

package/test/export-surface.snapshot.json

@@ -1,6 +1,6 @@
 {
   "_comment": "design/87 L3 — frozen public export surface of src/index.ts (name -> kind). DO NOT edit by hand to silence a red test. A removed/changed entry = a SemVer-BREAKING change; bump MAJOR and update this fixture in the SAME commit (design/87 §4.2 / §5.2). Regenerate via REGEN in test/export-surface.test.ts.",
-  "count": 1574,
+  "count": 1597,
   "exports": {
     "A2ATaskState": "type",
     "A2ATaskStateReversal": "type",
@@ -226,12 +226,15 @@
     "DEFAULT_TOOL_RESULT_THRESHOLD_CHARS": "variable",
     "DEGRADED_DIAGNOSTIC_TYPE": "variable",
     "DESIGN_REVIEW_PROMPTS": "variable",
+    "DISCUSSION_SCRIPT": "variable",
+    "DISCUSSION_WORKFLOW_NAME": "variable",
     "DURABLE_AGENT_HANDLE_RE": "variable",
     "DecisionReason": "type",
     "DefaultPackDescription": "interface",
     "DegradationInfo": "interface",
     "DegradeReason": "type",
     "DegradingBrainOptions": "type",
+    "DelegationLifecycleEvent": "type",
     "DelegationTaskType": "type",
     "DeveloperTaskConfig": "interface",
     "DocumentContent": "interface",
@@ -336,6 +339,7 @@
     "HarvestRejectionCode": "type",
     "HarvestReport": "interface",
     "HookEnvCapabilities": "interface",
+    "HookInvocationIdentity": "interface",
     "HookToolContext": "interface",
     "HookToolFailure": "interface",
     "HookToolOutput": "interface",
@@ -404,6 +408,7 @@
     "LspToolOptions": "interface",
     "LspTransport": "interface",
     "MAILBOX_CONTRACT_SCOPE": "variable",
+    "MAILBOX_TOMBSTONED_RECIPIENT_CODE": "variable",
     "MASS_DELETION_FUSE_RATIO": "variable",
     "MAX_ACTOR_FIELD_CHARS": "variable",
     "MAX_EDIT_BYTES": "variable",
@@ -441,6 +446,8 @@
     "MailboxLease": "interface",
     "MailboxMessage": "interface",
     "MailboxStore": "interface",
+    "MailboxStoreError": "class",
+    "MailboxTombstonedRecipientContractHooks": "interface",
     "ManagedRetentionCapability": "interface",
     "ManifestDurability": "type",
     "MaterializedA2a": "interface",
@@ -617,6 +624,7 @@
     "PlatformLimitReason": "type",
     "PostCompactContext": "interface",
     "PostToolBatchCall": "interface",
+    "PostToolBatchContext": "interface",
     "PostToolBatchResult": "interface",
     "PostToolUseFailureResult": "interface",
     "PostToolUseResult": "interface",
@@ -920,6 +928,7 @@
     "TEAM_DISCUSSION_SCRIPT": "variable",
     "TEAM_DISCUSSION_WORKFLOW_NAME": "variable",
     "TOKEN_CHECKPOINT_VERSION": "variable",
+    "TOOL_MODEL_GATE_CLASSES": "variable",
     "TOOL_RESULT_REF_CONFLICT_CODE": "variable",
     "TSchema": "interface",
     "TaskAccess": "interface",
@@ -963,6 +972,7 @@
     "ToolEffect": "type",
     "ToolExecuteContext": "interface",
     "ToolFingerprintInput": "interface",
+    "ToolModelGateRule": "interface",
     "ToolOrigin": "type",
     "ToolPolicy": "interface",
     "ToolPolicyNameSets": "interface",
@@ -998,6 +1008,7 @@
     "UsageWindowRecord": "interface",
     "UsageWindowStore": "interface",
     "UserMessage": "interface",
+    "UserPromptSubmitContext": "interface",
     "UserPromptSubmitResult": "interface",
     "UtilityGate": "type",
     "V2HeaderHints": "interface",
@@ -1020,6 +1031,7 @@
     "WORKFLOW_SUBAGENT_PROMPT": "variable",
     "WORKFLOW_SUBAGENT_PROMPT_SCHEMA": "variable",
     "WORKTREE_PARENT": "variable",
+    "WRITE_PROTECTED_DEFAULT_TABLE": "variable",
     "WebFetchConfig": "interface",
     "WebSearchConfig": "interface",
     "WiringFacts": "interface",
@@ -1069,6 +1081,11 @@
     "WorktreeSessionRef": "interface",
     "WorktreeToolsOptions": "interface",
     "WritablePermissionRuleStore": "interface",
+    "WriteProtectedEntry": "type",
+    "WriteProtectedHit": "interface",
+    "WriteProtectedKind": "type",
+    "WriteProtectedRow": "interface",
+    "WriteProtectionMatcher": "interface",
     "ackAdoptionConfig": "function",
     "acquireCcLock": "function",
     "addDotsOf": "function",
@@ -1130,6 +1147,7 @@
     "callKeyOrdinal": "function",
     "canAccessAgentRecord": "function",
     "canAccessWorkflowRun": "function",
+    "canonicalWorkflowName": "function",
     "capAggregateMediaBytes": "function",
     "capAggregateToolResults": "function",
     "captureBaseline": "function",
@@ -1149,6 +1167,7 @@
     "collectBelowFrontier": "function",
     "combinePolicies": "function",
     "compileReadDeny": "function",
+    "compileWriteProtection": "function",
     "complianceCallDenial": "function",
     "compose": "function",
     "composeConstitution": "function",
@@ -1318,6 +1337,7 @@
     "isApprovalSettledBy": "function",
     "isDelegatedAgentTerminal": "function",
     "isIsolated": "function",
+    "isModelGatedForClass": "function",
     "isPersonalScope": "function",
     "isQuestionUnavailable": "function",
     "isRemoteExecutionEnv": "function",
@@ -1352,6 +1372,7 @@
     "mailboxAckOwnershipContract": "function",
     "mailboxBundledOnlyContract": "function",
     "mailboxStoreContract": "function",
+    "mailboxTombstonedRecipientContract": "function",
     "markTruncated": "function",
     "materializeA2aTools": "function",
     "materializeEntriesToFiles": "function",
@@ -1467,8 +1488,10 @@
     "resolveTaskLimits": "function",
     "resolveTaskModel": "function",
     "resolveUsageWindows": "function",
+    "resolveWriteProtectedTable": "function",
     "restoreFrozenPaths": "function",
     "resumeWithVerification": "function",
+    "retiredWorkflowNameAliases": "function",
     "retryBackoffMs": "function",
     "riskSeverity": "function",
     "ruleAdmitsCommand": "function",