@sema-agent/core 5.4.0 → 5.6.0

package/CHANGELOG.md

@@ -1,5 +1,32 @@
 # Changelog
 
+## 5.6.0 (2026-08-03)
+
+_A hardening tail: numeric knobs refuse what they cannot honor, the binary gate reads bytes instead of trusting statistics, and the MCP SDK takes its last zero-cost step before the v2 jump._
+
+### Fixed
+
+- Stall-timeout knobs (`connectTimeoutMs` / `firstTokenTimeoutMs` / `idleTimeoutMs`) refuse invalid numbers loudly (`config.stall_timeout_invalid`) instead of silently disarming — a NaN (units fumble: `"120s"` → `Number` → NaN) used to read as "unset", switching every watchdog OFF exactly when a deployment meant to tighten them. `0` stays legal as an explicit off; absent stays absent.
+
+- Read's binary-extension list gains magic-byte criteria of its own (~40 formats, one data-driven signature table): a file whose bytes carry a real binary header (ZIP/gzip/7z/ELF/tar/RIFF…) is now refused by CONTENT even when printable padding used to slip it past the statistical sniffer as mojibake "text". Names still never decide: a `.zip` holding plain text still reads. The Edit/Write/NotebookEdit read-refusal texts all name the same escape route (one constant; NotebookEdit used to render the bare sentence with no hint at all).
+
+### Changed
+
+- `@modelcontextprotocol/sdk` 1.29.0 → 1.30.0 (exact pin). Public surface is purely additive upstream (stdio `maxBufferSize`, SSE `keepAliveMs`); `types` is byte-identical; the only behavior delta is a richer zod parse-error message the engine never pins on. Groundwork for the v2 three-package migration (spiked, GO, waiting out the first patch release).
+
+## 5.5.0 (2026-08-03)
+
+_Three follow-through items: the deferred-placeholder wrong-guess round trip halves, durable cron jobs survive their creating session, and the redaction findings channel closes its last three audit gaps._
+
+### Fixed
+
+- Deferred-tool placeholders answer a wrong guess with the real schema. A placeholder card carries a name and one hint line, so a model that has to guess a shape copies the local pattern of the sibling tools it can see — and a wrong guess used to cost four rounds (call → a rejection teaching a `ToolSearch` round trip → search → real call). A shape-invalid direct call now comes back as structured invalid-arguments **with the real declared parameter schema inlined**, and activates the tool on the spot — the same activation the `ToolSearch` `select:` lane performs (full schema materialized into the next request, fingerprint/boundary-announce refresh, listing ride), because both lanes run one activation closure. Wrong guess: four rounds → two. Right guess: still zero — the schema-valid direct lane is untouched, the shape gate still refuses to run the real tool body on a call it never declared, and adjudication is unchanged (policy/approval decide before execute, so a denied call activates nothing). Two consequences stated plainly: the rejection is flagged as an error, so a later leg's transcript replay does not credit that activation (the name reverts to a placeholder and the corrected call re-activates it — self-healing, never a widening); and a withdrawn name, or a declaration that cannot be serialized, keeps the previous "activate it first" rejection.
+- Scheduler isolation keys fork by lifetime. A durable cron job was filed under the same key as a session-scoped one — minted `sessionId ?? principal ?? taskId ?? "default"` — so on any host with sessions a durable job belonged to the session that created it: it kept firing, but every later session got `not_found` from `CronList`/`CronDelete` and could not even learn it existed. Durable jobs are now isolated by the stable cross-session identity (`principal`, or a single `"default"` bucket where the deployment carries no principal); session-scoped jobs keep the session chain unchanged. `CronList` reads both lanes (deduplicated, and a lane whose listing fails surfaces the error instead of a half-empty list), `CronDelete` acts on the lane that actually holds the id, and `ScheduleWakeup` stays on the session lane (one session's `stop: true` never touches another's pending wakeup). The cross-tenant refusal is unchanged: another principal's durable job answers `not_found`, never an existence leak. **Deployment note**: durable rows written by earlier versions are still keyed by their originating session — a one-time re-key of existing rows belongs to the scheduler backend; the engine does no migration.
+
+### Added
+
+- The redaction findings channel completes (external-audit architecture item): findings now carry `source` (a closed provenance vocabulary — `arg-summary` / `untrusted-egress` / `secret-env` — stamped by the minting rule table, with no public finding constructor to forge); `summarizeRedactions(findings)` renders the one-line disclosure a host can announce ("3 redactions: prefixed-token (high) x1, …" — pure function, never auto-injected); and the env arm joins the channel (`scrubSecretEnv(env, findings?)` reports each deleted entry as a `SecretEnvFinding {key, kind, confidence, source}` — deletion, not replacement, so it is its own shape; one summarizer renders both). Absent the optional collector every path is byte-identical to before.
+
 ## 5.4.0 (2026-08-03)
 
 _The external-audit dunning batch closes end-to-end (small cases + all three cleared A-group debts), and the engine grows its outer brain-call guardrail. All additive or louder; major stays locked at 5._

package/dist/brain/stream-engine.js

@@ -2,7 +2,7 @@ import { createAssistantMessageEventStream, } from "../internal/llm.js";
 import { BrainError, classifyHttp, describeNetworkError } from "./errors.js";
 import { retryBackoffMs } from "./retry.js";
 import { emitBrainStatus, emitBrainTelemetry } from "./status-sink.js";
-import { createConnectController } from "./timeout.js";
+import { createConnectController, resolveStallTimeoutMs } from "./timeout.js";
 import { WALLTIME_CUTOFF_MESSAGE } from "./walltime.js";
 const DEFAULT_MAX_RETRIES = 10;
 const MAX_RETRIES_ENV_CEILING = 15;
@@ -113,9 +113,9 @@ export function runStreamingBrain(args) {
         const req = buildRequest();
         const maxRetries = resolveMaxRetries(config.maxRetries);
         const baseDelay = config.retryDelayMs ?? 500;
-        const firstTokenTimeoutMs = config.firstTokenTimeoutMs ?? stallTimeouts?.firstTokenMs;
-        const idleTimeoutMs = config.idleTimeoutMs ?? stallTimeouts?.idleMs;
-        const connectTimeoutMs = config.connectTimeoutMs ?? stallTimeouts?.connectMs;
+        const firstTokenTimeoutMs = resolveStallTimeoutMs(config.firstTokenTimeoutMs ?? stallTimeouts?.firstTokenMs, "firstTokenTimeoutMs");
+        const idleTimeoutMs = resolveStallTimeoutMs(config.idleTimeoutMs ?? stallTimeouts?.idleMs, "idleTimeoutMs");
+        const connectTimeoutMs = resolveStallTimeoutMs(config.connectTimeoutMs ?? stallTimeouts?.connectMs, "connectTimeoutMs");
         let attempt = 0;
         let thinkingRetries = 0;
         let startEmitted = false;

package/dist/brain/timeout.d.ts

@@ -1,4 +1,5 @@
 import type { StreamFn } from "../internal/llm.js";
+export declare function resolveStallTimeoutMs(value: number | undefined, knob: string): number | undefined;
 export interface BrainTimeoutConfig {
     connectTimeoutMs?: number;
     firstTokenTimeoutMs?: number;

package/dist/brain/timeout.js

@@ -1,3 +1,13 @@
+export function resolveStallTimeoutMs(value, knob) {
+    if (value === undefined)
+        return undefined;
+    if (!Number.isFinite(value) || value < 0) {
+        const e = new Error(`${knob} must be a non-negative finite number of milliseconds (got ${String(value)})`);
+        e.code = "config.stall_timeout_invalid";
+        throw e;
+    }
+    return value;
+}
 export function createConnectController(connectTimeoutMs, outerSignal, deadlineAtMs) {
     const ac = new AbortController();
     let timedOut = false;

package/dist/core/arg-summary.d.ts

@@ -1,10 +1,17 @@
 export type RedactionConfidence = "high" | "medium" | "low";
+export type RedactionSource = "arg-summary" | "untrusted-egress" | "secret-env";
 export interface RedactionFinding {
     kind: string;
     span: readonly [number, number];
     confidence: RedactionConfidence;
     marker: string;
+    source: RedactionSource;
 }
+export interface SummarizableFinding {
+    kind: string;
+    confidence: RedactionConfidence;
+}
+export declare function summarizeRedactions(findings: readonly SummarizableFinding[]): string;
 export interface RedactionReport {
     findings: RedactionFinding[];
     preexistingMarkers?: number;
@@ -13,6 +20,7 @@ export interface RedactionPass {
     kind: string;
     confidence: RedactionConfidence;
     marker: string;
+    source: RedactionSource;
     re: RegExp;
     replace: string | ((match: string, ...groups: string[]) => string);
 }

package/dist/core/arg-summary.js

@@ -1,5 +1,16 @@
 const ACTIVITY_ARG_MAX = 80;
 const SENSITIVE_KEY = /token|secret|key|password|passwd|credential|auth/i;
+export function summarizeRedactions(findings) {
+    if (findings.length === 0)
+        return "no redactions";
+    const counts = new Map();
+    for (const f of findings) {
+        const label = `${f.kind} (${f.confidence})`;
+        counts.set(label, (counts.get(label) ?? 0) + 1);
+    }
+    const parts = [...counts].map(([label, n]) => `${label} x${n}`);
+    return `${findings.length} redaction${findings.length === 1 ? "" : "s"}: ${parts.join(", ")}`;
+}
 function mapBackOnePass(edits, pos) {
     let delta = 0;
     for (const e of edits) {
@@ -37,7 +48,13 @@ export function runRedactionPasses(input, passes, report) {
                         s0 = mapBackOnePass(batches[i], s0);
                         e0 = mapBackOnePass(batches[i], e0);
                     }
-                    report.findings.push({ kind: pass.kind, confidence: pass.confidence, span: [s0, e0], marker: pass.marker });
+                    report.findings.push({
+                        kind: pass.kind,
+                        confidence: pass.confidence,
+                        span: [s0, e0],
+                        marker: pass.marker,
+                        source: pass.source,
+                    });
                 }
                 edits.push({ at: offset, removedLen: match.length, insertedLen: inserted.length });
             }
@@ -48,18 +65,19 @@ export function runRedactionPasses(input, passes, report) {
     return cur;
 }
 export const SECRET_PASSES = [
-    { kind: "prefixed-token", confidence: "high", marker: "[redacted]", re: /(?<![A-Za-z0-9])(?:sk|pk|rk|gh[opsur])[-_][A-Za-z0-9_-]{8,}/g, replace: "[redacted]" },
-    { kind: "prefixed-token", confidence: "high", marker: "[redacted]", re: /(?<![A-Za-z0-9])AIza[A-Za-z0-9_-]{20,}/g, replace: "[redacted]" },
-    { kind: "prefixed-token", confidence: "high", marker: "[redacted]", re: /(?<![A-Za-z0-9])xox[baprs]-[A-Za-z0-9-]{10,}/g, replace: "[redacted]" },
-    { kind: "prefixed-token", confidence: "high", marker: "[redacted]", re: /(?<![A-Za-z0-9])AKIA[0-9A-Z]{12,}/g, replace: "[redacted]" },
-    { kind: "prefixed-token", confidence: "high", marker: "[redacted]", re: /(?<![A-Za-z0-9])hf_[A-Za-z0-9]{20,}/g, replace: "[redacted]" },
-    { kind: "jwt", confidence: "high", marker: "[redacted]", re: /(?<![A-Za-z0-9])eyJ[A-Za-z0-9._-]{20,}/g, replace: "[redacted]" },
-    { kind: "private-key-block", confidence: "high", marker: "[redacted]", re: /-----BEGIN[ A-Z]*PRIVATE KEY-----[\s\S]*?(?:-----END[ A-Z]*PRIVATE KEY-----|$)/g, replace: "[redacted]" },
-    { kind: "bearer-token", confidence: "high", marker: "[redacted]", re: /(?<![A-Za-z0-9])Bearer\s+[A-Za-z0-9._~+/-]{8,}=*/gi, replace: "[redacted]" },
+    { kind: "prefixed-token", confidence: "high", marker: "[redacted]", source: "arg-summary", re: /(?<![A-Za-z0-9])(?:sk|pk|rk|gh[opsur])[-_][A-Za-z0-9_-]{8,}/g, replace: "[redacted]" },
+    { kind: "prefixed-token", confidence: "high", marker: "[redacted]", source: "arg-summary", re: /(?<![A-Za-z0-9])AIza[A-Za-z0-9_-]{20,}/g, replace: "[redacted]" },
+    { kind: "prefixed-token", confidence: "high", marker: "[redacted]", source: "arg-summary", re: /(?<![A-Za-z0-9])xox[baprs]-[A-Za-z0-9-]{10,}/g, replace: "[redacted]" },
+    { kind: "prefixed-token", confidence: "high", marker: "[redacted]", source: "arg-summary", re: /(?<![A-Za-z0-9])AKIA[0-9A-Z]{12,}/g, replace: "[redacted]" },
+    { kind: "prefixed-token", confidence: "high", marker: "[redacted]", source: "arg-summary", re: /(?<![A-Za-z0-9])hf_[A-Za-z0-9]{20,}/g, replace: "[redacted]" },
+    { kind: "jwt", confidence: "high", marker: "[redacted]", source: "arg-summary", re: /(?<![A-Za-z0-9])eyJ[A-Za-z0-9._-]{20,}/g, replace: "[redacted]" },
+    { kind: "private-key-block", confidence: "high", marker: "[redacted]", source: "arg-summary", re: /-----BEGIN[ A-Z]*PRIVATE KEY-----[\s\S]*?(?:-----END[ A-Z]*PRIVATE KEY-----|$)/g, replace: "[redacted]" },
+    { kind: "bearer-token", confidence: "high", marker: "[redacted]", source: "arg-summary", re: /(?<![A-Za-z0-9])Bearer\s+[A-Za-z0-9._~+/-]{8,}=*/gi, replace: "[redacted]" },
     {
         kind: "keyword-value",
         confidence: "medium",
         marker: "[redacted]",
+        source: "arg-summary",
         re: /(?<![A-Za-z0-9])((?:token|secret|key|password|passwd|credential|authorization)["']?\s*[=:]\s*["']?)[^\s"';|&]{4,}/gi,
         replace: "$1[redacted]",
     },

package/dist/core/runner/prepare-task.js

@@ -1469,9 +1469,9 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         if (spec.interactiveTools === true || (spec.interactiveTools !== false && (onQuestion !== undefined || durableQuestionFace)))
             tools.push(createAskUserQuestionTool(onQuestion, { principal: spec.principal, sourceTaskId: sessionId }));
         if (spec.handsReadOnly !== true) {
-            const schedScope = sessionId ?? spec.principal ?? spec.taskId ?? "default";
+            const sessionScope = sessionId ?? spec.principal ?? spec.taskId ?? "default";
             tools.push(...createSchedulerTools(executionEnv, {
-                scope: schedScope,
+                scope: sessionScope,
                 ...(spec.principal !== undefined ? { principal: spec.principal } : {}),
                 ...(sessionId !== undefined ? { sessionId } : {}),
                 requestStopAfterTurn,

package/dist/core/runner/tool-disclosure.js

@@ -1,6 +1,7 @@
 import { Type } from "typebox";
 import { Value } from "typebox/value";
 import { defineTool, errorResult } from "../tools.js";
+import { formatZodValidationError, truncateError } from "../tool-errors.js";
 export const TOOL_SEARCH_NAME = "ToolSearch";
 const DEFER_AUTO_FRACTION = 0.1;
 const CHARS_PER_TOKEN = 4;
@@ -61,12 +62,32 @@ export function buildDeferredRegistry(deferred, tools) {
     }
     return reg;
 }
+function renderSchemaForModel(schema) {
+    let json;
+    try {
+        json = JSON.stringify(schema);
+    }
+    catch {
+        return undefined;
+    }
+    return json === undefined ? undefined : truncateError(json);
+}
 export function createPlaceholderTool(info, direct) {
     const sn = safeName(info.name);
     const teachingRejection = () => {
         throw new Error(`Tool "${sn}" is not active yet. Call ${TOOL_SEARCH_NAME} with {"query":"select:${sn}"} ` +
             `(or a keyword \`query\`) to load its full schema, then call ${sn} with the proper arguments.`);
     };
+    const invalidArgumentsRejection = (target, params, schemaJson, ride) => {
+        const text = `Invalid arguments for \`${sn}\`: ${formatZodValidationError(target.parameters, params)} ` +
+            `\`${sn}\` is now active — its full parameter schema is below (and rides the next request). ` +
+            `Call \`${sn}\` again with arguments matching it.\nParameter schema: ${schemaJson}`;
+        return {
+            content: ride === undefined || ride === "" ? [{ type: "text", text }] : [{ type: "text", text }, { type: "text", text: ride }],
+            details: { invalidArguments: true },
+            isError: true,
+        };
+    };
     if (direct !== undefined) {
         return {
             name: info.name,
@@ -78,14 +99,20 @@ export function createPlaceholderTool(info, direct) {
             ...(direct.executionMode !== undefined ? { executionMode: direct.executionMode } : {}),
             execute: async (toolCallId, params, signal, onUpdate) => {
                 const real = direct.resolveReal();
-                if (real !== undefined && Value.Check(real.parameters, params)) {
+                if (real === undefined)
+                    return teachingRejection();
+                if (Value.Check(real.parameters, params)) {
                     const ride = await direct.activate();
                     const result = await real.invoke(toolCallId, params, signal, onUpdate);
                     if (ride === undefined || ride === "")
                         return result;
                     return { ...result, content: [...result.content, { type: "text", text: ride }] };
                 }
-                return teachingRejection();
+                const schemaJson = renderSchemaForModel(real.parameters);
+                if (schemaJson === undefined)
+                    return teachingRejection();
+                const ride = await direct.activate();
+                return invalidArgumentsRejection(real, params, schemaJson, ride);
             },
         };
     }

package/dist/core/secret-env.d.ts

@@ -1,2 +1,10 @@
+import type { RedactionConfidence, RedactionSource } from "./arg-summary.js";
+export type SecretEnvFindingKind = "suffix-rule" | "exact-name";
+export interface SecretEnvFinding {
+    key: string;
+    kind: SecretEnvFindingKind;
+    confidence: RedactionConfidence;
+    source: RedactionSource;
+}
 export declare function isSecretEnvKey(key: string): boolean;
-export declare function scrubSecretEnv(env: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+export declare function scrubSecretEnv(env: NodeJS.ProcessEnv, findings?: SecretEnvFinding[]): NodeJS.ProcessEnv;

package/dist/core/secret-env.js

@@ -4,14 +4,31 @@ const SECRET_ENV_EXACT_NAMES = new Set([
     "PGPASSWORD", "MYSQL_PWD", "SSHPASS", "GPG_PASSPHRASE", "GH_PAT", "GITHUB_PAT",
     "NPM_CONFIG__AUTH", "NPM_CONFIG__AUTHTOKEN",
 ]);
+const SECRET_ENV_KIND_CONFIDENCE = {
+    "exact-name": "high",
+    "suffix-rule": "medium",
+};
+function classifySecretEnvKey(key) {
+    if (SECRET_ENV_RE.test(key))
+        return "suffix-rule";
+    if (SECRET_ENV_EXACT_NAMES.has(key.toUpperCase()))
+        return "exact-name";
+    return undefined;
+}
 export function isSecretEnvKey(key) {
-    return SECRET_ENV_RE.test(key) || SECRET_ENV_EXACT_NAMES.has(key.toUpperCase());
+    return classifySecretEnvKey(key) !== undefined;
 }
-export function scrubSecretEnv(env) {
+export function scrubSecretEnv(env, findings) {
     const out = {};
     for (const k of Object.keys(env)) {
-        if (!isSecretEnvKey(k))
+        const kind = classifySecretEnvKey(k);
+        if (kind === undefined) {
             out[k] = env[k];
+            continue;
+        }
+        if (findings !== undefined) {
+            findings.push({ key: k, kind, confidence: SECRET_ENV_KIND_CONFIDENCE[kind], source: "secret-env" });
+        }
     }
     return out;
 }

package/dist/core/untrusted-egress.d.ts

@@ -1,5 +1,6 @@
 import { type RedactionReport } from "./arg-summary.js";
-export type { RedactionFinding, RedactionReport, RedactionConfidence } from "./arg-summary.js";
+export type { RedactionFinding, RedactionReport, RedactionConfidence, RedactionSource, SummarizableFinding, } from "./arg-summary.js";
+export { summarizeRedactions } from "./arg-summary.js";
 export declare function redactSecrets(s: string, report?: RedactionReport): string;
 export declare function redactHostLeaks(s: string, report?: RedactionReport): string;
 export declare function boundedRedactedSummary(value: unknown, max: number): string;

package/dist/core/untrusted-egress.js

@@ -1,6 +1,7 @@
 import { delimitUntrusted } from "./untrusted-text.js";
 import { scrubSecrets, SECRET_PASSES, runRedactionPasses } from "./arg-summary.js";
 import { sliceHeadSafe } from "./surrogate-safe-slice.js";
+export { summarizeRedactions } from "./arg-summary.js";
 const URI_SCHEME = String.raw `[A-Za-z][A-Za-z0-9+.\-_]{0,63}`;
 const CREDENTIALS_IN_AUTHORITY = new RegExp(String.raw `(${URI_SCHEME}:\/\/)((?:[^/\s"'@]*@)+)`, "gi");
 const URL_OF_ANY_PROTOCOL = new RegExp(String.raw `${URI_SCHEME}:\/\/[^\s"'\`]+`, "gi");
@@ -21,18 +22,19 @@ const SECRET_TIER_PASSES = [
         kind: "url-credentials",
         confidence: "medium",
         marker: "[redacted-credentials]",
+        source: "untrusted-egress",
         re: CREDENTIALS_IN_AUTHORITY,
         replace: (_m, scheme, userinfo) => redactUserinfo(scheme, userinfo),
     },
-    { kind: "signed-url-param", confidence: "high", marker: "[redacted]", re: /([?&#](?:sig|signature|sas|code)=)[^&\s"'#]+/gi, replace: "$1[redacted]" },
+    { kind: "signed-url-param", confidence: "high", marker: "[redacted]", source: "untrusted-egress", re: /([?&#](?:sig|signature|sas|code)=)[^&\s"'#]+/gi, replace: "$1[redacted]" },
 ];
 export function redactSecrets(s, report) {
     return runRedactionPasses(s, SECRET_TIER_PASSES, report);
 }
 const HOST_LEAK_PASSES = [
     ...SECRET_TIER_PASSES,
-    { kind: "url", confidence: "medium", marker: "[redacted-url]", re: URL_OF_ANY_PROTOCOL, replace: "[redacted-url]" },
-    { kind: "fs-path", confidence: "low", marker: "[redacted-path]", re: /(?:\/[A-Za-z0-9_.-]+){2,}/g, replace: "[redacted-path]" },
+    { kind: "url", confidence: "medium", marker: "[redacted-url]", source: "untrusted-egress", re: URL_OF_ANY_PROTOCOL, replace: "[redacted-url]" },
+    { kind: "fs-path", confidence: "low", marker: "[redacted-path]", source: "untrusted-egress", re: /(?:\/[A-Za-z0-9_.-]+){2,}/g, replace: "[redacted-path]" },
 ];
 export function redactHostLeaks(s, report) {
     return runRedactionPasses(s, HOST_LEAK_PASSES, report);

package/dist/index.d.ts

@@ -57,6 +57,7 @@ export { killProcessTree, signalProcessTree } from "./engine/execution-env/kill-
 export type { KillProcessTreeOptions } from "./engine/execution-env/kill-tree.js";
 export { getShellConfig, isWslBashLauncher } from "./engine/execution-env/node-execution-env.js";
 export { isSecretEnvKey, scrubSecretEnv } from "./core/secret-env.js";
+export type { SecretEnvFinding, SecretEnvFindingKind } from "./core/secret-env.js";
 export { MAX_EXEC_OUTPUT_BYTES, RollingTailBuffer, markTruncated } from "./core/exec-output-tail.js";
 export type { ExecutionEnv, FileInfo, Result, FileErrorCode, ExecutionErrorCode } from "./internal/harness.js";
 export type { ExecResult } from "./internal/harness.js";
@@ -172,7 +173,8 @@ export { FileBackgroundAgentStore, type FileBackgroundAgentStoreOptions } from "
 export { A2A_TASK_STATES, type A2ATaskState, type A2ATaskStateReversal, type A2ATaskStateReversalFaithful, type A2ATaskStateReversalLossy, toA2ATaskState, fromA2ATaskState, } from "./core/a2a-task-state.js";
 export { type WorkflowJournalStore, type WorkflowJournalEntry, InMemoryWorkflowJournalStore, callKeyOrdinal, JOURNAL_OVERSIZE_ERROR_CODE, } from "./core/workflow-journal-store.js";
 export { untrustedEgressForHuman, redactHostLeaks, redactSecrets, boundedRedactedSummary } from "./core/untrusted-egress.js";
-export type { RedactionFinding, RedactionReport, RedactionConfidence } from "./core/untrusted-egress.js";
+export type { RedactionFinding, RedactionReport, RedactionConfidence, RedactionSource, SummarizableFinding, } from "./core/untrusted-egress.js";
+export { summarizeRedactions } from "./core/untrusted-egress.js";
 export { MemoryRosterStore, FileRosterStore, type RosterStore, type RosterEntry, type RosterAccess, type RosterGcOptions } from "./agents/roster-store.js";
 export { CONFIG_CATALOG_VERSION, describeConfigCatalog, resolveEffectiveConfig, type ConfigKnob, type ConfigOverrideDeclaration, type ConfigProvenance, type EffectiveConfigField, } from "./config/catalog.js";
 export { normalizeAgentName } from "./core/task-registry.js";

package/dist/index.js

@@ -157,6 +157,7 @@ export { FileBackgroundAgentStore } from "./stores/file/background-agent-store.j
 export { A2A_TASK_STATES, toA2ATaskState, fromA2ATaskState, } from "./core/a2a-task-state.js";
 export { InMemoryWorkflowJournalStore, callKeyOrdinal, JOURNAL_OVERSIZE_ERROR_CODE, } from "./core/workflow-journal-store.js";
 export { untrustedEgressForHuman, redactHostLeaks, redactSecrets, boundedRedactedSummary } from "./core/untrusted-egress.js";
+export { summarizeRedactions } from "./core/untrusted-egress.js";
 export { MemoryRosterStore, FileRosterStore } from "./agents/roster-store.js";
 export { CONFIG_CATALOG_VERSION, describeConfigCatalog, resolveEffectiveConfig, } from "./config/catalog.js";
 export { normalizeAgentName } from "./core/task-registry.js";

package/dist/tools/fs/fs-read.js

@@ -1,6 +1,6 @@
 import { Type } from "typebox";
 import { defineTool, errorResult } from "../../core/tools.js";
-import { sha256, resolveKey, violationText, violationDetails, hasBinaryExtension, isBinaryContent, fileArgPath, imageMimeForRead, imageMagicMatches, } from "./safety.js";
+import { sha256, resolveKey, violationText, violationDetails, binaryMagicFormat, hasBinaryExtension, isBinaryContent, fileArgPath, imageMimeForRead, imageMagicMatches, } from "./safety.js";
 import { decodeTextBytes } from "./encoding.js";
 import { isNotebookPath, parseNotebookCells, renderNotebookCells, stripNotebookImageData, NOTEBOOK_IMAGE_BASE64_BUDGET } from "./notebook.js";
 import { MCP_IMAGE_MAX_BASE64, IMAGE_TARGET_RAW_SIZE } from "../../core/mcp.js";
@@ -166,6 +166,11 @@ export function createReadFileTool(env, state, rootCanonical, cwdRef, additional
             if (pdfMagicMatches(readBin.value)) {
                 return pdfResultToToolReturn(await readPdfFile(env, path, r.key, pages, ctx.signal, imageDownsampler, cwdRef?.current ?? rootCanonical, readBin.value, pdfCapabilities));
             }
+            const magicFormat = binaryMagicFormat(readBin.value);
+            if (magicFormat !== undefined) {
+                return errorResult(`Error (Read): "${path}" appears to be a binary file (${magicFormat}, identified by its file signature — whatever its extension says); ` +
+                    `this tool reads UTF-8 and BOM-marked UTF-16LE text only. Inspect or convert it with bash instead.`);
+            }
             const decoded = decodeTextBytes(readBin.value);
             if (decoded.malformed) {
                 return errorResult(`Error (Read): "${path}" has a UTF-16 BOM but a truncated (odd-length) body — the file is corrupt or mis-labelled; repair/convert it with bash (e.g. \`iconv\`) first.`);

package/dist/tools/fs/fs-write.js

@@ -1,7 +1,7 @@
 import { randomUUID } from "node:crypto";
 import { Type } from "typebox";
 import { defineTool, errorResult } from "../../core/tools.js";
-import { sha256, resolveKey, violationText, violationDetails, requireRead, checkStale, checkEditMatch, checkNoChange, fileArgPath, resolveQuoteMatch, adaptNewStringQuotes, resolveEscapeMatch, adaptNewStringEscapes, escapeMatchWasAttempted, ESCAPE_MATCH_MISS_NOTE, deletionOldString, countOccurrences, WRITE_ENCODING_DEADLOCK_ESCAPE_HINT, } from "./safety.js";
+import { sha256, resolveKey, violationText, violationDetails, requireRead, checkStale, checkEditMatch, checkNoChange, fileArgPath, resolveQuoteMatch, adaptNewStringQuotes, resolveEscapeMatch, adaptNewStringEscapes, escapeMatchWasAttempted, ESCAPE_MATCH_MISS_NOTE, deletionOldString, countOccurrences, READ_REFUSED_ESCAPE_HINT, } from "./safety.js";
 import { decodeTextBytes, encodeTextForFile, normalizeEditText, normalizeFileText } from "./encoding.js";
 import { MAX_EDIT_BYTES, formatByteSize, decodeEditBytes, persistedTextOf, notReadRefusalText, enoentMessage, FILE_STATE_TRAILER, FILE_PATH_PARAMS, ipynbRedirect, countLines, } from "./fs-shared.js";
 async function gateToolWrite(hook, tool, path, key, content) {
@@ -136,7 +136,7 @@ export function createEditFileTool(env, state, rootCanonical, cwdRef, additional
                 return errorResult(ipynb);
             const notRead = requireRead(state, r.key);
             if (notRead)
-                return errorResult(await notReadRefusalText(env, "Edit", r.key, notRead, ctx.signal));
+                return errorResult(await notReadRefusalText(env, "Edit", r.key, notRead, ctx.signal, READ_REFUSED_ESCAPE_HINT));
             const readBin = await env.readBinaryFile(r.key, ctx.signal);
             if (!readBin.ok)
                 return errorResult(`Error (Edit): cannot read "${path}": ${readBin.error.message}`);
@@ -249,7 +249,7 @@ export function createWriteFileTool(env, state, rootCanonical, cwdRef, additiona
             if (exists.value) {
                 const notRead = requireRead(state, r.key);
                 if (notRead) {
-                    return errorResult(await notReadRefusalText(env, "Write", r.key, notRead, ctx.signal, WRITE_ENCODING_DEADLOCK_ESCAPE_HINT));
+                    return errorResult(await notReadRefusalText(env, "Write", r.key, notRead, ctx.signal, READ_REFUSED_ESCAPE_HINT));
                 }
                 const readBin = await env.readBinaryFile(r.key, ctx.signal);
                 if (!readBin.ok)
@@ -334,7 +334,7 @@ export function createNotebookEditTool(env, state, rootCanonical, cwdRef, additi
                 return errorResult(violationText("NotebookEdit", r.violation), violationDetails(r.violation));
             const notRead = requireRead(state, r.key);
             if (notRead)
-                return errorResult(await notReadRefusalText(env, "NotebookEdit", r.key, notRead, ctx.signal));
+                return errorResult(await notReadRefusalText(env, "NotebookEdit", r.key, notRead, ctx.signal, READ_REFUSED_ESCAPE_HINT));
             const readBin = await env.readBinaryFile(r.key, ctx.signal);
             if (!readBin.ok)
                 return errorResult(`Error (NotebookEdit): cannot read "${notebook_path}": ${readBin.error.message}`);

package/dist/tools/fs/safety.d.ts

@@ -30,6 +30,16 @@ export declare function foldRedundantPathSegments(p: string): string;
 export declare function hasBinaryExtension(path: string): boolean;
 export declare function imageMimeForRead(path: string): string | undefined;
 export declare function imageMagicMatches(bytes: Uint8Array, mimeType: string): boolean;
+export interface BinaryMagicSegment {
+    readonly offset: number;
+    readonly bytes: readonly number[];
+}
+export interface BinaryMagicSignature {
+    readonly format: string;
+    readonly segments: readonly BinaryMagicSegment[];
+}
+export declare const BINARY_MAGIC_SIGNATURES: readonly BinaryMagicSignature[];
+export declare function binaryMagicFormat(bytes: Uint8Array): string | undefined;
 export declare function isBinaryContent(sample: string): boolean;
 export declare function isUncPath(path: string): boolean;
 export declare function resolveKey(env: ExecutionEnv, rootCanonical: string, path: string, signal?: AbortSignal, baseCwd?: string, additionalRootsCanonical?: readonly string[], exactFileReadExemption?: (canonicalKey: string) => boolean): Promise<{
@@ -59,7 +69,7 @@ export declare const PATH_NOT_IN_ROOT_ESCAPE_HINT = "(This boundary applies to t
 export declare function requireRead(state: ReadFileState, key: string): FsViolation | undefined;
 export declare const OVERSIZE_READ_ESCAPE_HINT = "(This file is over the Read tool's whole-file byte cap, so a default Read is refused \u2014 read it in slices with explicit offset/limit to satisfy the read-first rule, or inspect/transform it with bash (e.g. `sed -n`, `grep`) instead.)";
 export declare const PARTIAL_VIEW_READ_ESCAPE_HINT = "(Your last Read of this file returned only a PARTIAL view \u2014 the output token cap paginated it, so a default Read will keep returning the same page. Re-read it with explicit offset/limit (start from the page marker's next-page hint) until you have seen the part you are about to change; an explicit slice that fits satisfies the read-first rule. Or inspect/transform it with bash (e.g. `sed -n`, `grep`) instead.)";
-export declare const WRITE_ENCODING_DEADLOCK_ESCAPE_HINT = "(If the Read tool refuses this file (binary/unknown encoding), overwrite or convert it with bash instead \u2014 e.g. `rm` + rewrite, or `iconv`.)";
+export declare const READ_REFUSED_ESCAPE_HINT = "(If the Read tool refuses this file (binary/unknown encoding), overwrite or convert it with bash instead \u2014 e.g. `rm` + rewrite, or `iconv`.)";
 export declare function checkNoChange(oldString: string, newString: string): FsViolation | undefined;
 export declare function checkStale(entry: ReadEntry | undefined, currentHash: string): FsViolation | undefined;
 export declare function countOccurrences(haystack: string, needle: string): number;

package/dist/tools/fs/safety.js

@@ -150,6 +150,89 @@ export function imageMagicMatches(bytes, mimeType) {
             return false;
     }
 }
+const asciiBytes = (s) => Array.from(s, (c) => c.charCodeAt(0));
+export const BINARY_MAGIC_SIGNATURES = [
+    { format: "ZIP archive", segments: [{ offset: 0, bytes: [0x50, 0x4b, 0x03, 0x04] }] },
+    { format: "ZIP archive", segments: [{ offset: 0, bytes: [0x50, 0x4b, 0x05, 0x06] }] },
+    { format: "ZIP archive", segments: [{ offset: 0, bytes: [0x50, 0x4b, 0x07, 0x08] }] },
+    { format: "gzip archive", segments: [{ offset: 0, bytes: [0x1f, 0x8b, 0x08] }] },
+    ...[0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39].map((level) => ({
+        format: "bzip2 archive",
+        segments: [{ offset: 0, bytes: [0x42, 0x5a, 0x68, level] }],
+    })),
+    { format: "xz archive", segments: [{ offset: 0, bytes: [0xfd, 0x37, 0x7a, 0x58, 0x5a, 0x00] }] },
+    { format: "zstd archive", segments: [{ offset: 0, bytes: [0x28, 0xb5, 0x2f, 0xfd] }] },
+    { format: "lz4 archive", segments: [{ offset: 0, bytes: [0x04, 0x22, 0x4d, 0x18] }] },
+    { format: "compress archive", segments: [{ offset: 0, bytes: [0x1f, 0x9d] }] },
+    { format: "7-Zip archive", segments: [{ offset: 0, bytes: [0x37, 0x7a, 0xbc, 0xaf, 0x27, 0x1c] }] },
+    { format: "RAR archive", segments: [{ offset: 0, bytes: [0x52, 0x61, 0x72, 0x21, 0x1a, 0x07, 0x00] }] },
+    { format: "RAR archive", segments: [{ offset: 0, bytes: [0x52, 0x61, 0x72, 0x21, 0x1a, 0x07, 0x01, 0x00] }] },
+    { format: "tar archive", segments: [{ offset: 257, bytes: asciiBytes("ustar") }] },
+    { format: "ar archive (static library or Debian package)", segments: [{ offset: 0, bytes: asciiBytes("!<arch>\n") }] },
+    { format: "RPM package", segments: [{ offset: 0, bytes: [0xed, 0xab, 0xee, 0xdb] }] },
+    { format: "ISO 9660 disc image", segments: [{ offset: 32769, bytes: asciiBytes("CD001") }] },
+    { format: "PNG image", segments: [{ offset: 0, bytes: [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a] }] },
+    { format: "JPEG image", segments: [{ offset: 0, bytes: [0xff, 0xd8, 0xff] }] },
+    { format: "GIF image", segments: [{ offset: 0, bytes: asciiBytes("GIF87a") }] },
+    { format: "GIF image", segments: [{ offset: 0, bytes: asciiBytes("GIF89a") }] },
+    { format: "TIFF image", segments: [{ offset: 0, bytes: [0x49, 0x49, 0x2a, 0x00] }] },
+    { format: "TIFF image", segments: [{ offset: 0, bytes: [0x4d, 0x4d, 0x00, 0x2a] }] },
+    { format: "BMP image", segments: [{ offset: 0, bytes: asciiBytes("BM") }, { offset: 6, bytes: [0x00, 0x00, 0x00, 0x00] }] },
+    { format: "ICO image", segments: [{ offset: 0, bytes: [0x00, 0x00, 0x01, 0x00] }] },
+    { format: "Photoshop document", segments: [{ offset: 0, bytes: asciiBytes("8BPS") }] },
+    { format: "WebP image", segments: [{ offset: 0, bytes: asciiBytes("RIFF") }, { offset: 8, bytes: asciiBytes("WEBP") }] },
+    { format: "RIFF audio (WAV)", segments: [{ offset: 0, bytes: asciiBytes("RIFF") }, { offset: 8, bytes: asciiBytes("WAVE") }] },
+    { format: "RIFF video (AVI)", segments: [{ offset: 0, bytes: asciiBytes("RIFF") }, { offset: 8, bytes: asciiBytes("AVI ") }] },
+    { format: "AIFF audio", segments: [{ offset: 0, bytes: asciiBytes("FORM") }, { offset: 8, bytes: asciiBytes("AIFF") }] },
+    { format: "Ogg container", segments: [{ offset: 0, bytes: asciiBytes("OggS") }, { offset: 4, bytes: [0x00] }] },
+    { format: "FLAC audio", segments: [{ offset: 0, bytes: asciiBytes("fLaC") }] },
+    ...[0x02, 0x03, 0x04].map((major) => ({
+        format: "MP3 audio (ID3 tag)",
+        segments: [{ offset: 0, bytes: [0x49, 0x44, 0x33, major] }],
+    })),
+    { format: "ISO base media container (MP4/MOV/HEIC)", segments: [{ offset: 4, bytes: asciiBytes("ftyp") }] },
+    { format: "Matroska/WebM container", segments: [{ offset: 0, bytes: [0x1a, 0x45, 0xdf, 0xa3] }] },
+    { format: "ASF container (WMV/WMA)", segments: [{ offset: 0, bytes: [0x30, 0x26, 0xb2, 0x75, 0x8e, 0x66, 0xcf, 0x11, 0xa6, 0xd9, 0x00, 0xaa, 0x00, 0x62, 0xce, 0x6c] }] },
+    { format: "FLV video", segments: [{ offset: 0, bytes: [0x46, 0x4c, 0x56, 0x01] }] },
+    { format: "MPEG program stream", segments: [{ offset: 0, bytes: [0x00, 0x00, 0x01, 0xba] }] },
+    { format: "MPEG video stream", segments: [{ offset: 0, bytes: [0x00, 0x00, 0x01, 0xb3] }] },
+    { format: "ELF binary", segments: [{ offset: 0, bytes: [0x7f, 0x45, 0x4c, 0x46] }] },
+    { format: "Mach-O binary", segments: [{ offset: 0, bytes: [0xfe, 0xed, 0xfa, 0xce] }] },
+    { format: "Mach-O binary", segments: [{ offset: 0, bytes: [0xfe, 0xed, 0xfa, 0xcf] }] },
+    { format: "Mach-O binary", segments: [{ offset: 0, bytes: [0xce, 0xfa, 0xed, 0xfe] }] },
+    { format: "Mach-O binary", segments: [{ offset: 0, bytes: [0xcf, 0xfa, 0xed, 0xfe] }] },
+    { format: "Java class file or Mach-O universal binary", segments: [{ offset: 0, bytes: [0xca, 0xfe, 0xba, 0xbe] }] },
+    { format: "WebAssembly module", segments: [{ offset: 0, bytes: [0x00, 0x61, 0x73, 0x6d] }] },
+    { format: "OLE compound document (Office 97-2003 or MSI)", segments: [{ offset: 0, bytes: [0xd0, 0xcf, 0x11, 0xe0, 0xa1, 0xb1, 0x1a, 0xe1] }] },
+    { format: "SQLite database", segments: [{ offset: 0, bytes: [...asciiBytes("SQLite format 3"), 0x00] }] },
+    { format: "WOFF font", segments: [{ offset: 0, bytes: asciiBytes("wOFF") }] },
+    { format: "WOFF2 font", segments: [{ offset: 0, bytes: asciiBytes("wOF2") }] },
+    { format: "OpenType font", segments: [{ offset: 0, bytes: asciiBytes("OTTO") }] },
+    { format: "TrueType font", segments: [{ offset: 0, bytes: [0x00, 0x01, 0x00, 0x00] }] },
+    { format: "TrueType font collection", segments: [{ offset: 0, bytes: asciiBytes("ttcf") }] },
+];
+export function binaryMagicFormat(bytes) {
+    for (const signature of BINARY_MAGIC_SIGNATURES) {
+        let matched = true;
+        for (const segment of signature.segments) {
+            if (bytes.length < segment.offset + segment.bytes.length) {
+                matched = false;
+                break;
+            }
+            for (let i = 0; i < segment.bytes.length; i++) {
+                if (bytes[segment.offset + i] !== segment.bytes[i]) {
+                    matched = false;
+                    break;
+                }
+            }
+            if (!matched)
+                break;
+        }
+        if (matched)
+            return signature.format;
+    }
+    return undefined;
+}
 export function isBinaryContent(sample) {
     if (sample.length === 0)
         return false;
@@ -297,7 +380,7 @@ export function requireRead(state, key) {
 }
 export const OVERSIZE_READ_ESCAPE_HINT = "(This file is over the Read tool's whole-file byte cap, so a default Read is refused — read it in slices with explicit offset/limit to satisfy the read-first rule, or inspect/transform it with bash (e.g. `sed -n`, `grep`) instead.)";
 export const PARTIAL_VIEW_READ_ESCAPE_HINT = "(Your last Read of this file returned only a PARTIAL view — the output token cap paginated it, so a default Read will keep returning the same page. Re-read it with explicit offset/limit (start from the page marker's next-page hint) until you have seen the part you are about to change; an explicit slice that fits satisfies the read-first rule. Or inspect/transform it with bash (e.g. `sed -n`, `grep`) instead.)";
-export const WRITE_ENCODING_DEADLOCK_ESCAPE_HINT = "(If the Read tool refuses this file (binary/unknown encoding), overwrite or convert it with bash instead — e.g. `rm` + rewrite, or `iconv`.)";
+export const READ_REFUSED_ESCAPE_HINT = "(If the Read tool refuses this file (binary/unknown encoding), overwrite or convert it with bash instead — e.g. `rm` + rewrite, or `iconv`.)";
 export function checkNoChange(oldString, newString) {
     if (oldString === newString) {
         return { code: "invalid", message: "No changes to make: old_string and new_string are exactly the same." };

package/dist/tools/scheduler-tools.js

@@ -27,9 +27,12 @@ The runtime clamps to [60, 3600], so you don't need to clamp yourself.
 
 One short sentence on what you chose and why. Goes to telemetry and is shown back to the user. "watching CI run" beats "waiting." The user reads this to understand what you're doing without having to predict your cadence in advance — make it specific.
 `;
-function toSchedulerContext(c) {
+function durableScopeOf(c) {
+    return c.principal ?? "default";
+}
+function toSchedulerContext(c, scope) {
     return {
-        scope: c.scope,
+        scope,
         ...(c.principal !== undefined ? { principal: c.principal } : {}),
         ...(c.sessionId !== undefined ? { sessionId: c.sessionId } : {}),
         ...(c.taskConfig !== undefined ? { taskConfig: c.taskConfig } : {}),
@@ -157,7 +160,9 @@ export function createSchedulerTools(env, ctx) {
     if (!hasScheduler(env))
         return [];
     const sched = env;
-    const schedCtx = toSchedulerContext(ctx);
+    const sessionCtx = toSchedulerContext(ctx, ctx.scope);
+    const durableCtx = toSchedulerContext(ctx, durableScopeOf(ctx));
+    const lanesDiffer = sessionCtx.scope !== durableCtx.scope;
     let cronCreateChain = Promise.resolve();
     const serializedCronCreateOp = (fn) => {
         const next = cronCreateChain.then(fn, fn);
@@ -255,9 +260,10 @@ Only use minute 0 or 30 when the user names that exact time and clearly means it
                 ...(!durable ? { lifetime: "session" } : {}),
                 ...(a.recurring !== undefined ? { recurring: a.recurring } : {}),
             };
-            const before = await sched.list(schedCtx);
+            const opCtx = durable ? durableCtx : sessionCtx;
+            const before = await sched.list(opCtx);
             const knownIds = before.ok ? new Set(before.value.map((s) => s.id)) : undefined;
-            const r = await sched.schedule(intent, schedCtx);
+            const r = await sched.schedule(intent, opCtx);
             if (!r.ok)
                 return errorResult(`Error (CronCreate): ${r.error.message}`);
             const replaced = knownIds?.has(r.value.id);
@@ -285,6 +291,16 @@ Only use minute 0 or 30 when the user names that exact time and clearly means it
             };
         }),
     });
+    const cancelLanesFor = async (id) => {
+        if (!lanesDiffer)
+            return [sessionCtx];
+        for (const lane of [sessionCtx, durableCtx]) {
+            const listed = await sched.list(lane);
+            if (listed.ok && listed.value.some((s) => s.id === id))
+                return [lane];
+        }
+        return [sessionCtx, durableCtx];
+    };
     const cronCancel = defineTool({
         name: "CronDelete",
         contract: { contractId: "core.cron_delete@1", implementationRevision: "1" },
@@ -293,7 +309,14 @@ Only use minute 0 or 30 when the user names that exact time and clearly means it
         effect: "idempotent",
         execute: async (args) => {
             const { id } = args;
-            const r = await sched.cancel(id, schedCtx);
+            const taskId = id;
+            const [firstLane, ...otherLanes] = await cancelLanesFor(taskId);
+            let r = await sched.cancel(taskId, firstLane);
+            for (const lane of otherLanes) {
+                if (r.ok || r.error.code !== "not_found")
+                    break;
+                r = await sched.cancel(taskId, lane);
+            }
             if (!r.ok) {
                 if (r.error.code === "not_found")
                     return `CronDelete: no scheduled task "${id}" (already gone or not yours).`;
@@ -309,13 +332,23 @@ Only use minute 0 or 30 when the user names that exact time and clearly means it
         parameters: Type.Object({}),
         effect: "read",
         execute: async () => {
-            const r = await sched.list(schedCtx);
-            if (!r.ok)
-                return errorResult(`Error (CronList): ${r.error.message}`);
-            if (r.value.length === 0) {
+            const rows = [];
+            const seen = new Set();
+            for (const lane of lanesDiffer ? [sessionCtx, durableCtx] : [sessionCtx]) {
+                const listed = await sched.list(lane);
+                if (!listed.ok)
+                    return errorResult(`Error (CronList): ${listed.error.message}`);
+                for (const s of listed.value) {
+                    if (seen.has(s.id))
+                        continue;
+                    seen.add(s.id);
+                    rows.push(s);
+                }
+            }
+            if (rows.length === 0) {
                 return { content: "No scheduled tasks.", details: { type: "cron-list", jobs: [] } };
             }
-            const content = r.value
+            const content = rows
                 .map((s) => {
                 const shown = cronExprFromSummary(s.when);
                 const human = cronToHuman(s.when);
@@ -324,7 +357,7 @@ Only use minute 0 or 30 when the user names that exact time and clearly means it
                 return `- ${s.id}: ${shown}${human !== s.when ? ` — ${human}` : ""}${s.label ? ` (${s.label})` : ""}${tier}${once}`;
             })
                 .join("\n");
-            const jobs = r.value.map((s) => {
+            const jobs = rows.map((s) => {
                 const human = cronToHuman(s.when);
                 return {
                     id: s.id,
@@ -339,7 +372,7 @@ Only use minute 0 or 30 when the user names that exact time and clearly means it
         },
     });
     const listPendingWakeups = async () => {
-        const r = await sched.list(schedCtx);
+        const r = await sched.list(sessionCtx);
         if (!r.ok)
             return { err: r.error.message };
         return {
@@ -351,7 +384,7 @@ Only use minute 0 or 30 when the user names that exact time and clearly means it
     const cancelWakeups = async (ids) => {
         let n = 0;
         for (const id of ids) {
-            const r = await sched.cancel(id, schedCtx);
+            const r = await sched.cancel(id, sessionCtx);
             if (r.ok)
                 n += 1;
         }
@@ -405,7 +438,7 @@ Only use minute 0 or 30 when the user names that exact time and clearly means it
             const pending = await listPendingWakeups();
             if (!("err" in pending))
                 await cancelWakeups(pending.ids);
-            const r = await sched.schedule({ prompt: a.prompt, when: { kind: "delay", delaySec: clampedDelaySeconds }, label: WAKEUP_LABEL, mode: "session-wakeup" }, schedCtx);
+            const r = await sched.schedule({ prompt: a.prompt, when: { kind: "delay", delaySec: clampedDelaySeconds }, label: WAKEUP_LABEL, mode: "session-wakeup" }, sessionCtx);
             if (!r.ok)
                 return errorResult(`Error (${SCHEDULE_WAKEUP_TOOL_NAME}): ${r.error.message}`);
             const scheduledFor = Date.now() + clampedDelaySeconds * 1000;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "5.4.0",
+  "version": "5.6.0",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",
@@ -67,7 +67,7 @@
     "gate:single-mint": "node scripts/verify-single-mint.mjs"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "1.29.0",
+    "@modelcontextprotocol/sdk": "1.30.0",
     "typebox": "1.1.39"
   },
   "optionalDependencies": {