@sema-agent/core 5.4.0 → 5.5.0

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 5.5.0 (2026-08-03)
+
+_Three follow-through items: the deferred-placeholder wrong-guess round trip halves, durable cron jobs survive their creating session, and the redaction findings channel closes its last three audit gaps._
+
+### Fixed
+
+- Deferred-tool placeholders answer a wrong guess with the real schema. A placeholder card carries a name and one hint line, so a model that has to guess a shape copies the local pattern of the sibling tools it can see — and a wrong guess used to cost four rounds (call → a rejection teaching a `ToolSearch` round trip → search → real call). A shape-invalid direct call now comes back as structured invalid-arguments **with the real declared parameter schema inlined**, and activates the tool on the spot — the same activation the `ToolSearch` `select:` lane performs (full schema materialized into the next request, fingerprint/boundary-announce refresh, listing ride), because both lanes run one activation closure. Wrong guess: four rounds → two. Right guess: still zero — the schema-valid direct lane is untouched, the shape gate still refuses to run the real tool body on a call it never declared, and adjudication is unchanged (policy/approval decide before execute, so a denied call activates nothing). Two consequences stated plainly: the rejection is flagged as an error, so a later leg's transcript replay does not credit that activation (the name reverts to a placeholder and the corrected call re-activates it — self-healing, never a widening); and a withdrawn name, or a declaration that cannot be serialized, keeps the previous "activate it first" rejection.
+- Scheduler isolation keys fork by lifetime. A durable cron job was filed under the same key as a session-scoped one — minted `sessionId ?? principal ?? taskId ?? "default"` — so on any host with sessions a durable job belonged to the session that created it: it kept firing, but every later session got `not_found` from `CronList`/`CronDelete` and could not even learn it existed. Durable jobs are now isolated by the stable cross-session identity (`principal`, or a single `"default"` bucket where the deployment carries no principal); session-scoped jobs keep the session chain unchanged. `CronList` reads both lanes (deduplicated, and a lane whose listing fails surfaces the error instead of a half-empty list), `CronDelete` acts on the lane that actually holds the id, and `ScheduleWakeup` stays on the session lane (one session's `stop: true` never touches another's pending wakeup). The cross-tenant refusal is unchanged: another principal's durable job answers `not_found`, never an existence leak. **Deployment note**: durable rows written by earlier versions are still keyed by their originating session — a one-time re-key of existing rows belongs to the scheduler backend; the engine does no migration.
+
+### Added
+
+- The redaction findings channel completes (external-audit architecture item): findings now carry `source` (a closed provenance vocabulary — `arg-summary` / `untrusted-egress` / `secret-env` — stamped by the minting rule table, with no public finding constructor to forge); `summarizeRedactions(findings)` renders the one-line disclosure a host can announce ("3 redactions: prefixed-token (high) x1, …" — pure function, never auto-injected); and the env arm joins the channel (`scrubSecretEnv(env, findings?)` reports each deleted entry as a `SecretEnvFinding {key, kind, confidence, source}` — deletion, not replacement, so it is its own shape; one summarizer renders both). Absent the optional collector every path is byte-identical to before.
+
 ## 5.4.0 (2026-08-03)
 
 _The external-audit dunning batch closes end-to-end (small cases + all three cleared A-group debts), and the engine grows its outer brain-call guardrail. All additive or louder; major stays locked at 5._

package/dist/core/arg-summary.d.ts

@@ -1,10 +1,17 @@
 export type RedactionConfidence = "high" | "medium" | "low";
+export type RedactionSource = "arg-summary" | "untrusted-egress" | "secret-env";
 export interface RedactionFinding {
     kind: string;
     span: readonly [number, number];
     confidence: RedactionConfidence;
     marker: string;
+    source: RedactionSource;
 }
+export interface SummarizableFinding {
+    kind: string;
+    confidence: RedactionConfidence;
+}
+export declare function summarizeRedactions(findings: readonly SummarizableFinding[]): string;
 export interface RedactionReport {
     findings: RedactionFinding[];
     preexistingMarkers?: number;
@@ -13,6 +20,7 @@ export interface RedactionPass {
     kind: string;
     confidence: RedactionConfidence;
     marker: string;
+    source: RedactionSource;
     re: RegExp;
     replace: string | ((match: string, ...groups: string[]) => string);
 }

package/dist/core/arg-summary.js

@@ -1,5 +1,16 @@
 const ACTIVITY_ARG_MAX = 80;
 const SENSITIVE_KEY = /token|secret|key|password|passwd|credential|auth/i;
+export function summarizeRedactions(findings) {
+    if (findings.length === 0)
+        return "no redactions";
+    const counts = new Map();
+    for (const f of findings) {
+        const label = `${f.kind} (${f.confidence})`;
+        counts.set(label, (counts.get(label) ?? 0) + 1);
+    }
+    const parts = [...counts].map(([label, n]) => `${label} x${n}`);
+    return `${findings.length} redaction${findings.length === 1 ? "" : "s"}: ${parts.join(", ")}`;
+}
 function mapBackOnePass(edits, pos) {
     let delta = 0;
     for (const e of edits) {
@@ -37,7 +48,13 @@ export function runRedactionPasses(input, passes, report) {
                         s0 = mapBackOnePass(batches[i], s0);
                         e0 = mapBackOnePass(batches[i], e0);
                     }
-                    report.findings.push({ kind: pass.kind, confidence: pass.confidence, span: [s0, e0], marker: pass.marker });
+                    report.findings.push({
+                        kind: pass.kind,
+                        confidence: pass.confidence,
+                        span: [s0, e0],
+                        marker: pass.marker,
+                        source: pass.source,
+                    });
                 }
                 edits.push({ at: offset, removedLen: match.length, insertedLen: inserted.length });
             }
@@ -48,18 +65,19 @@ export function runRedactionPasses(input, passes, report) {
     return cur;
 }
 export const SECRET_PASSES = [
-    { kind: "prefixed-token", confidence: "high", marker: "[redacted]", re: /(?<![A-Za-z0-9])(?:sk|pk|rk|gh[opsur])[-_][A-Za-z0-9_-]{8,}/g, replace: "[redacted]" },
-    { kind: "prefixed-token", confidence: "high", marker: "[redacted]", re: /(?<![A-Za-z0-9])AIza[A-Za-z0-9_-]{20,}/g, replace: "[redacted]" },
-    { kind: "prefixed-token", confidence: "high", marker: "[redacted]", re: /(?<![A-Za-z0-9])xox[baprs]-[A-Za-z0-9-]{10,}/g, replace: "[redacted]" },
-    { kind: "prefixed-token", confidence: "high", marker: "[redacted]", re: /(?<![A-Za-z0-9])AKIA[0-9A-Z]{12,}/g, replace: "[redacted]" },
-    { kind: "prefixed-token", confidence: "high", marker: "[redacted]", re: /(?<![A-Za-z0-9])hf_[A-Za-z0-9]{20,}/g, replace: "[redacted]" },
-    { kind: "jwt", confidence: "high", marker: "[redacted]", re: /(?<![A-Za-z0-9])eyJ[A-Za-z0-9._-]{20,}/g, replace: "[redacted]" },
-    { kind: "private-key-block", confidence: "high", marker: "[redacted]", re: /-----BEGIN[ A-Z]*PRIVATE KEY-----[\s\S]*?(?:-----END[ A-Z]*PRIVATE KEY-----|$)/g, replace: "[redacted]" },
-    { kind: "bearer-token", confidence: "high", marker: "[redacted]", re: /(?<![A-Za-z0-9])Bearer\s+[A-Za-z0-9._~+/-]{8,}=*/gi, replace: "[redacted]" },
+    { kind: "prefixed-token", confidence: "high", marker: "[redacted]", source: "arg-summary", re: /(?<![A-Za-z0-9])(?:sk|pk|rk|gh[opsur])[-_][A-Za-z0-9_-]{8,}/g, replace: "[redacted]" },
+    { kind: "prefixed-token", confidence: "high", marker: "[redacted]", source: "arg-summary", re: /(?<![A-Za-z0-9])AIza[A-Za-z0-9_-]{20,}/g, replace: "[redacted]" },
+    { kind: "prefixed-token", confidence: "high", marker: "[redacted]", source: "arg-summary", re: /(?<![A-Za-z0-9])xox[baprs]-[A-Za-z0-9-]{10,}/g, replace: "[redacted]" },
+    { kind: "prefixed-token", confidence: "high", marker: "[redacted]", source: "arg-summary", re: /(?<![A-Za-z0-9])AKIA[0-9A-Z]{12,}/g, replace: "[redacted]" },
+    { kind: "prefixed-token", confidence: "high", marker: "[redacted]", source: "arg-summary", re: /(?<![A-Za-z0-9])hf_[A-Za-z0-9]{20,}/g, replace: "[redacted]" },
+    { kind: "jwt", confidence: "high", marker: "[redacted]", source: "arg-summary", re: /(?<![A-Za-z0-9])eyJ[A-Za-z0-9._-]{20,}/g, replace: "[redacted]" },
+    { kind: "private-key-block", confidence: "high", marker: "[redacted]", source: "arg-summary", re: /-----BEGIN[ A-Z]*PRIVATE KEY-----[\s\S]*?(?:-----END[ A-Z]*PRIVATE KEY-----|$)/g, replace: "[redacted]" },
+    { kind: "bearer-token", confidence: "high", marker: "[redacted]", source: "arg-summary", re: /(?<![A-Za-z0-9])Bearer\s+[A-Za-z0-9._~+/-]{8,}=*/gi, replace: "[redacted]" },
     {
         kind: "keyword-value",
         confidence: "medium",
         marker: "[redacted]",
+        source: "arg-summary",
         re: /(?<![A-Za-z0-9])((?:token|secret|key|password|passwd|credential|authorization)["']?\s*[=:]\s*["']?)[^\s"';|&]{4,}/gi,
         replace: "$1[redacted]",
     },

package/dist/core/runner/prepare-task.js

@@ -1469,9 +1469,9 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         if (spec.interactiveTools === true || (spec.interactiveTools !== false && (onQuestion !== undefined || durableQuestionFace)))
             tools.push(createAskUserQuestionTool(onQuestion, { principal: spec.principal, sourceTaskId: sessionId }));
         if (spec.handsReadOnly !== true) {
-            const schedScope = sessionId ?? spec.principal ?? spec.taskId ?? "default";
+            const sessionScope = sessionId ?? spec.principal ?? spec.taskId ?? "default";
             tools.push(...createSchedulerTools(executionEnv, {
-                scope: schedScope,
+                scope: sessionScope,
                 ...(spec.principal !== undefined ? { principal: spec.principal } : {}),
                 ...(sessionId !== undefined ? { sessionId } : {}),
                 requestStopAfterTurn,

package/dist/core/runner/tool-disclosure.js

@@ -1,6 +1,7 @@
 import { Type } from "typebox";
 import { Value } from "typebox/value";
 import { defineTool, errorResult } from "../tools.js";
+import { formatZodValidationError, truncateError } from "../tool-errors.js";
 export const TOOL_SEARCH_NAME = "ToolSearch";
 const DEFER_AUTO_FRACTION = 0.1;
 const CHARS_PER_TOKEN = 4;
@@ -61,12 +62,32 @@ export function buildDeferredRegistry(deferred, tools) {
     }
     return reg;
 }
+function renderSchemaForModel(schema) {
+    let json;
+    try {
+        json = JSON.stringify(schema);
+    }
+    catch {
+        return undefined;
+    }
+    return json === undefined ? undefined : truncateError(json);
+}
 export function createPlaceholderTool(info, direct) {
     const sn = safeName(info.name);
     const teachingRejection = () => {
         throw new Error(`Tool "${sn}" is not active yet. Call ${TOOL_SEARCH_NAME} with {"query":"select:${sn}"} ` +
             `(or a keyword \`query\`) to load its full schema, then call ${sn} with the proper arguments.`);
     };
+    const invalidArgumentsRejection = (target, params, schemaJson, ride) => {
+        const text = `Invalid arguments for \`${sn}\`: ${formatZodValidationError(target.parameters, params)} ` +
+            `\`${sn}\` is now active — its full parameter schema is below (and rides the next request). ` +
+            `Call \`${sn}\` again with arguments matching it.\nParameter schema: ${schemaJson}`;
+        return {
+            content: ride === undefined || ride === "" ? [{ type: "text", text }] : [{ type: "text", text }, { type: "text", text: ride }],
+            details: { invalidArguments: true },
+            isError: true,
+        };
+    };
     if (direct !== undefined) {
         return {
             name: info.name,
@@ -78,14 +99,20 @@ export function createPlaceholderTool(info, direct) {
             ...(direct.executionMode !== undefined ? { executionMode: direct.executionMode } : {}),
             execute: async (toolCallId, params, signal, onUpdate) => {
                 const real = direct.resolveReal();
-                if (real !== undefined && Value.Check(real.parameters, params)) {
+                if (real === undefined)
+                    return teachingRejection();
+                if (Value.Check(real.parameters, params)) {
                     const ride = await direct.activate();
                     const result = await real.invoke(toolCallId, params, signal, onUpdate);
                     if (ride === undefined || ride === "")
                         return result;
                     return { ...result, content: [...result.content, { type: "text", text: ride }] };
                 }
-                return teachingRejection();
+                const schemaJson = renderSchemaForModel(real.parameters);
+                if (schemaJson === undefined)
+                    return teachingRejection();
+                const ride = await direct.activate();
+                return invalidArgumentsRejection(real, params, schemaJson, ride);
             },
         };
     }

package/dist/core/secret-env.d.ts

@@ -1,2 +1,10 @@
+import type { RedactionConfidence, RedactionSource } from "./arg-summary.js";
+export type SecretEnvFindingKind = "suffix-rule" | "exact-name";
+export interface SecretEnvFinding {
+    key: string;
+    kind: SecretEnvFindingKind;
+    confidence: RedactionConfidence;
+    source: RedactionSource;
+}
 export declare function isSecretEnvKey(key: string): boolean;
-export declare function scrubSecretEnv(env: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+export declare function scrubSecretEnv(env: NodeJS.ProcessEnv, findings?: SecretEnvFinding[]): NodeJS.ProcessEnv;

package/dist/core/secret-env.js

@@ -4,14 +4,31 @@ const SECRET_ENV_EXACT_NAMES = new Set([
     "PGPASSWORD", "MYSQL_PWD", "SSHPASS", "GPG_PASSPHRASE", "GH_PAT", "GITHUB_PAT",
     "NPM_CONFIG__AUTH", "NPM_CONFIG__AUTHTOKEN",
 ]);
+const SECRET_ENV_KIND_CONFIDENCE = {
+    "exact-name": "high",
+    "suffix-rule": "medium",
+};
+function classifySecretEnvKey(key) {
+    if (SECRET_ENV_RE.test(key))
+        return "suffix-rule";
+    if (SECRET_ENV_EXACT_NAMES.has(key.toUpperCase()))
+        return "exact-name";
+    return undefined;
+}
 export function isSecretEnvKey(key) {
-    return SECRET_ENV_RE.test(key) || SECRET_ENV_EXACT_NAMES.has(key.toUpperCase());
+    return classifySecretEnvKey(key) !== undefined;
 }
-export function scrubSecretEnv(env) {
+export function scrubSecretEnv(env, findings) {
     const out = {};
     for (const k of Object.keys(env)) {
-        if (!isSecretEnvKey(k))
+        const kind = classifySecretEnvKey(k);
+        if (kind === undefined) {
             out[k] = env[k];
+            continue;
+        }
+        if (findings !== undefined) {
+            findings.push({ key: k, kind, confidence: SECRET_ENV_KIND_CONFIDENCE[kind], source: "secret-env" });
+        }
     }
     return out;
 }

package/dist/core/untrusted-egress.d.ts

@@ -1,5 +1,6 @@
 import { type RedactionReport } from "./arg-summary.js";
-export type { RedactionFinding, RedactionReport, RedactionConfidence } from "./arg-summary.js";
+export type { RedactionFinding, RedactionReport, RedactionConfidence, RedactionSource, SummarizableFinding, } from "./arg-summary.js";
+export { summarizeRedactions } from "./arg-summary.js";
 export declare function redactSecrets(s: string, report?: RedactionReport): string;
 export declare function redactHostLeaks(s: string, report?: RedactionReport): string;
 export declare function boundedRedactedSummary(value: unknown, max: number): string;

package/dist/core/untrusted-egress.js

@@ -1,6 +1,7 @@
 import { delimitUntrusted } from "./untrusted-text.js";
 import { scrubSecrets, SECRET_PASSES, runRedactionPasses } from "./arg-summary.js";
 import { sliceHeadSafe } from "./surrogate-safe-slice.js";
+export { summarizeRedactions } from "./arg-summary.js";
 const URI_SCHEME = String.raw `[A-Za-z][A-Za-z0-9+.\-_]{0,63}`;
 const CREDENTIALS_IN_AUTHORITY = new RegExp(String.raw `(${URI_SCHEME}:\/\/)((?:[^/\s"'@]*@)+)`, "gi");
 const URL_OF_ANY_PROTOCOL = new RegExp(String.raw `${URI_SCHEME}:\/\/[^\s"'\`]+`, "gi");
@@ -21,18 +22,19 @@ const SECRET_TIER_PASSES = [
         kind: "url-credentials",
         confidence: "medium",
         marker: "[redacted-credentials]",
+        source: "untrusted-egress",
         re: CREDENTIALS_IN_AUTHORITY,
         replace: (_m, scheme, userinfo) => redactUserinfo(scheme, userinfo),
     },
-    { kind: "signed-url-param", confidence: "high", marker: "[redacted]", re: /([?&#](?:sig|signature|sas|code)=)[^&\s"'#]+/gi, replace: "$1[redacted]" },
+    { kind: "signed-url-param", confidence: "high", marker: "[redacted]", source: "untrusted-egress", re: /([?&#](?:sig|signature|sas|code)=)[^&\s"'#]+/gi, replace: "$1[redacted]" },
 ];
 export function redactSecrets(s, report) {
     return runRedactionPasses(s, SECRET_TIER_PASSES, report);
 }
 const HOST_LEAK_PASSES = [
     ...SECRET_TIER_PASSES,
-    { kind: "url", confidence: "medium", marker: "[redacted-url]", re: URL_OF_ANY_PROTOCOL, replace: "[redacted-url]" },
-    { kind: "fs-path", confidence: "low", marker: "[redacted-path]", re: /(?:\/[A-Za-z0-9_.-]+){2,}/g, replace: "[redacted-path]" },
+    { kind: "url", confidence: "medium", marker: "[redacted-url]", source: "untrusted-egress", re: URL_OF_ANY_PROTOCOL, replace: "[redacted-url]" },
+    { kind: "fs-path", confidence: "low", marker: "[redacted-path]", source: "untrusted-egress", re: /(?:\/[A-Za-z0-9_.-]+){2,}/g, replace: "[redacted-path]" },
 ];
 export function redactHostLeaks(s, report) {
     return runRedactionPasses(s, HOST_LEAK_PASSES, report);

package/dist/index.d.ts

@@ -57,6 +57,7 @@ export { killProcessTree, signalProcessTree } from "./engine/execution-env/kill-
 export type { KillProcessTreeOptions } from "./engine/execution-env/kill-tree.js";
 export { getShellConfig, isWslBashLauncher } from "./engine/execution-env/node-execution-env.js";
 export { isSecretEnvKey, scrubSecretEnv } from "./core/secret-env.js";
+export type { SecretEnvFinding, SecretEnvFindingKind } from "./core/secret-env.js";
 export { MAX_EXEC_OUTPUT_BYTES, RollingTailBuffer, markTruncated } from "./core/exec-output-tail.js";
 export type { ExecutionEnv, FileInfo, Result, FileErrorCode, ExecutionErrorCode } from "./internal/harness.js";
 export type { ExecResult } from "./internal/harness.js";
@@ -172,7 +173,8 @@ export { FileBackgroundAgentStore, type FileBackgroundAgentStoreOptions } from "
 export { A2A_TASK_STATES, type A2ATaskState, type A2ATaskStateReversal, type A2ATaskStateReversalFaithful, type A2ATaskStateReversalLossy, toA2ATaskState, fromA2ATaskState, } from "./core/a2a-task-state.js";
 export { type WorkflowJournalStore, type WorkflowJournalEntry, InMemoryWorkflowJournalStore, callKeyOrdinal, JOURNAL_OVERSIZE_ERROR_CODE, } from "./core/workflow-journal-store.js";
 export { untrustedEgressForHuman, redactHostLeaks, redactSecrets, boundedRedactedSummary } from "./core/untrusted-egress.js";
-export type { RedactionFinding, RedactionReport, RedactionConfidence } from "./core/untrusted-egress.js";
+export type { RedactionFinding, RedactionReport, RedactionConfidence, RedactionSource, SummarizableFinding, } from "./core/untrusted-egress.js";
+export { summarizeRedactions } from "./core/untrusted-egress.js";
 export { MemoryRosterStore, FileRosterStore, type RosterStore, type RosterEntry, type RosterAccess, type RosterGcOptions } from "./agents/roster-store.js";
 export { CONFIG_CATALOG_VERSION, describeConfigCatalog, resolveEffectiveConfig, type ConfigKnob, type ConfigOverrideDeclaration, type ConfigProvenance, type EffectiveConfigField, } from "./config/catalog.js";
 export { normalizeAgentName } from "./core/task-registry.js";

package/dist/index.js

@@ -157,6 +157,7 @@ export { FileBackgroundAgentStore } from "./stores/file/background-agent-store.j
 export { A2A_TASK_STATES, toA2ATaskState, fromA2ATaskState, } from "./core/a2a-task-state.js";
 export { InMemoryWorkflowJournalStore, callKeyOrdinal, JOURNAL_OVERSIZE_ERROR_CODE, } from "./core/workflow-journal-store.js";
 export { untrustedEgressForHuman, redactHostLeaks, redactSecrets, boundedRedactedSummary } from "./core/untrusted-egress.js";
+export { summarizeRedactions } from "./core/untrusted-egress.js";
 export { MemoryRosterStore, FileRosterStore } from "./agents/roster-store.js";
 export { CONFIG_CATALOG_VERSION, describeConfigCatalog, resolveEffectiveConfig, } from "./config/catalog.js";
 export { normalizeAgentName } from "./core/task-registry.js";

package/dist/tools/scheduler-tools.js

@@ -27,9 +27,12 @@ The runtime clamps to [60, 3600], so you don't need to clamp yourself.
 
 One short sentence on what you chose and why. Goes to telemetry and is shown back to the user. "watching CI run" beats "waiting." The user reads this to understand what you're doing without having to predict your cadence in advance — make it specific.
 `;
-function toSchedulerContext(c) {
+function durableScopeOf(c) {
+    return c.principal ?? "default";
+}
+function toSchedulerContext(c, scope) {
     return {
-        scope: c.scope,
+        scope,
         ...(c.principal !== undefined ? { principal: c.principal } : {}),
         ...(c.sessionId !== undefined ? { sessionId: c.sessionId } : {}),
         ...(c.taskConfig !== undefined ? { taskConfig: c.taskConfig } : {}),
@@ -157,7 +160,9 @@ export function createSchedulerTools(env, ctx) {
     if (!hasScheduler(env))
         return [];
     const sched = env;
-    const schedCtx = toSchedulerContext(ctx);
+    const sessionCtx = toSchedulerContext(ctx, ctx.scope);
+    const durableCtx = toSchedulerContext(ctx, durableScopeOf(ctx));
+    const lanesDiffer = sessionCtx.scope !== durableCtx.scope;
     let cronCreateChain = Promise.resolve();
     const serializedCronCreateOp = (fn) => {
         const next = cronCreateChain.then(fn, fn);
@@ -255,9 +260,10 @@ Only use minute 0 or 30 when the user names that exact time and clearly means it
                 ...(!durable ? { lifetime: "session" } : {}),
                 ...(a.recurring !== undefined ? { recurring: a.recurring } : {}),
             };
-            const before = await sched.list(schedCtx);
+            const opCtx = durable ? durableCtx : sessionCtx;
+            const before = await sched.list(opCtx);
             const knownIds = before.ok ? new Set(before.value.map((s) => s.id)) : undefined;
-            const r = await sched.schedule(intent, schedCtx);
+            const r = await sched.schedule(intent, opCtx);
             if (!r.ok)
                 return errorResult(`Error (CronCreate): ${r.error.message}`);
             const replaced = knownIds?.has(r.value.id);
@@ -285,6 +291,16 @@ Only use minute 0 or 30 when the user names that exact time and clearly means it
             };
         }),
     });
+    const cancelLanesFor = async (id) => {
+        if (!lanesDiffer)
+            return [sessionCtx];
+        for (const lane of [sessionCtx, durableCtx]) {
+            const listed = await sched.list(lane);
+            if (listed.ok && listed.value.some((s) => s.id === id))
+                return [lane];
+        }
+        return [sessionCtx, durableCtx];
+    };
     const cronCancel = defineTool({
         name: "CronDelete",
         contract: { contractId: "core.cron_delete@1", implementationRevision: "1" },
@@ -293,7 +309,14 @@ Only use minute 0 or 30 when the user names that exact time and clearly means it
         effect: "idempotent",
         execute: async (args) => {
             const { id } = args;
-            const r = await sched.cancel(id, schedCtx);
+            const taskId = id;
+            const [firstLane, ...otherLanes] = await cancelLanesFor(taskId);
+            let r = await sched.cancel(taskId, firstLane);
+            for (const lane of otherLanes) {
+                if (r.ok || r.error.code !== "not_found")
+                    break;
+                r = await sched.cancel(taskId, lane);
+            }
             if (!r.ok) {
                 if (r.error.code === "not_found")
                     return `CronDelete: no scheduled task "${id}" (already gone or not yours).`;
@@ -309,13 +332,23 @@ Only use minute 0 or 30 when the user names that exact time and clearly means it
         parameters: Type.Object({}),
         effect: "read",
         execute: async () => {
-            const r = await sched.list(schedCtx);
-            if (!r.ok)
-                return errorResult(`Error (CronList): ${r.error.message}`);
-            if (r.value.length === 0) {
+            const rows = [];
+            const seen = new Set();
+            for (const lane of lanesDiffer ? [sessionCtx, durableCtx] : [sessionCtx]) {
+                const listed = await sched.list(lane);
+                if (!listed.ok)
+                    return errorResult(`Error (CronList): ${listed.error.message}`);
+                for (const s of listed.value) {
+                    if (seen.has(s.id))
+                        continue;
+                    seen.add(s.id);
+                    rows.push(s);
+                }
+            }
+            if (rows.length === 0) {
                 return { content: "No scheduled tasks.", details: { type: "cron-list", jobs: [] } };
             }
-            const content = r.value
+            const content = rows
                 .map((s) => {
                 const shown = cronExprFromSummary(s.when);
                 const human = cronToHuman(s.when);
@@ -324,7 +357,7 @@ Only use minute 0 or 30 when the user names that exact time and clearly means it
                 return `- ${s.id}: ${shown}${human !== s.when ? ` — ${human}` : ""}${s.label ? ` (${s.label})` : ""}${tier}${once}`;
             })
                 .join("\n");
-            const jobs = r.value.map((s) => {
+            const jobs = rows.map((s) => {
                 const human = cronToHuman(s.when);
                 return {
                     id: s.id,
@@ -339,7 +372,7 @@ Only use minute 0 or 30 when the user names that exact time and clearly means it
         },
     });
     const listPendingWakeups = async () => {
-        const r = await sched.list(schedCtx);
+        const r = await sched.list(sessionCtx);
         if (!r.ok)
             return { err: r.error.message };
         return {
@@ -351,7 +384,7 @@ Only use minute 0 or 30 when the user names that exact time and clearly means it
     const cancelWakeups = async (ids) => {
         let n = 0;
         for (const id of ids) {
-            const r = await sched.cancel(id, schedCtx);
+            const r = await sched.cancel(id, sessionCtx);
             if (r.ok)
                 n += 1;
         }
@@ -405,7 +438,7 @@ Only use minute 0 or 30 when the user names that exact time and clearly means it
             const pending = await listPendingWakeups();
             if (!("err" in pending))
                 await cancelWakeups(pending.ids);
-            const r = await sched.schedule({ prompt: a.prompt, when: { kind: "delay", delaySec: clampedDelaySeconds }, label: WAKEUP_LABEL, mode: "session-wakeup" }, schedCtx);
+            const r = await sched.schedule({ prompt: a.prompt, when: { kind: "delay", delaySec: clampedDelaySeconds }, label: WAKEUP_LABEL, mode: "session-wakeup" }, sessionCtx);
             if (!r.ok)
                 return errorResult(`Error (${SCHEDULE_WAKEUP_TOOL_NAME}): ${r.error.message}`);
             const scheduledFor = Date.now() + clampedDelaySeconds * 1000;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "5.4.0",
+  "version": "5.5.0",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",