@sema-agent/core 5.47.0 → 5.48.0

package/dist/stores/file/session-store.js

@@ -1,4 +1,4 @@
-import { existsSync, readdirSync, rmSync } from "node:fs";
+import { existsSync, readdirSync, rmSync, statSync } from "node:fs";
 import { join } from "node:path";
 import { BaseSessionStorage, StoredSession, SessionError, getEntriesToFork, uuidv7, validateEntriesForImport, } from "../../internal/harness.js";
 import { canonicalStoreKey, AppendLog, atomicWriteFile, ensureDir, readJsonlRecords, sanitizePathComponent } from "./fs-atomic.js";
@@ -83,18 +83,20 @@ export class FileSessionRepo {
         const lines = readJsonlRecords(path, (info) => this.disclose(info.path, info.reason));
         let createdAt = "";
         let forkedFrom;
+        let placement;
         const entries = [];
         for (const line of lines) {
             if (line.kind === "meta") {
                 createdAt = line.createdAt;
                 forkedFrom = line.forkedFrom;
+                placement = line.placement;
             }
             else
                 entries.push(line.entry);
         }
-        return { createdAt, ...(forkedFrom !== undefined ? { forkedFrom } : {}), entries };
+        return { createdAt, ...(forkedFrom !== undefined ? { forkedFrom } : {}), ...(placement !== undefined ? { placement } : {}), entries };
     }
-    storage(id, createdAt, entries, forkedFrom) {
+    storage(id, createdAt, entries, forkedFrom, placement) {
         const canonical = canonicalStoreKey(this.pathFor(id));
         const live = sharedSessionStorages.get(canonical)?.deref();
         if (live !== undefined) {
@@ -103,7 +105,7 @@ export class FileSessionRepo {
             return live;
         }
         const log = new AppendLog(this.pathFor(id));
-        const created = new FileSessionStorage(log, { id, createdAt, ...(forkedFrom !== undefined ? { forkedFrom } : {}) }, entries, canonical);
+        const created = new FileSessionStorage(log, { id, createdAt, ...(forkedFrom !== undefined ? { forkedFrom } : {}), ...(placement !== undefined ? { placement } : {}) }, entries, canonical);
         sharedSessionStorages.set(canonical, new WeakRef(created));
         created.addHolder(this);
         this.joined.set(canonical, new WeakRef(created));
@@ -128,15 +130,16 @@ export class FileSessionRepo {
         const path = this.pathFor(id);
         if (!existsSync(path)) {
             evictSharedSessionStorage(canonicalStoreKey(path));
-            atomicWriteFile(this.tmpDir, path, `${JSON.stringify({ kind: "meta", id, createdAt })}\n`);
-            return new StoredSession(this.storage(id, createdAt, []));
+            const placement = options.placement !== undefined ? { ...options.placement, placedAt: options.placement.placedAt ?? Date.now() } : undefined;
+            atomicWriteFile(this.tmpDir, path, `${JSON.stringify({ kind: "meta", id, createdAt, ...(placement !== undefined ? { placement } : {}) })}\n`);
+            return new StoredSession(this.storage(id, createdAt, [], undefined, placement));
         }
-        const { createdAt: existingCreatedAt, forkedFrom, entries } = this.read(id);
-        return new StoredSession(this.storage(id, existingCreatedAt || createdAt, entries, forkedFrom));
+        const { createdAt: existingCreatedAt, forkedFrom, placement, entries } = this.read(id);
+        return new StoredSession(this.storage(id, existingCreatedAt || createdAt, entries, forkedFrom, placement));
     }
     async open(metadata) {
-        const { createdAt, forkedFrom, entries } = this.read(metadata.id);
-        return new StoredSession(this.storage(metadata.id, createdAt, entries, forkedFrom));
+        const { createdAt, forkedFrom, placement, entries } = this.read(metadata.id);
+        return new StoredSession(this.storage(metadata.id, createdAt, entries, forkedFrom, placement));
     }
     async list() {
         let names;
@@ -155,7 +158,9 @@ export class FileSessionRepo {
                 continue;
             const id = name.slice(0, -SUFFIX.length);
             try {
-                const { createdAt, forkedFrom } = this.read(id);
+                const { createdAt, forkedFrom, placement } = this.read(id);
+                if (placement !== undefined)
+                    continue;
                 out.push({ id, createdAt, ...(forkedFrom !== undefined ? { forkedFrom } : {}) });
             }
             catch (err) {
@@ -166,12 +171,68 @@ export class FileSessionRepo {
         }
         return out.sort((a, b) => a.createdAt.localeCompare(b.createdAt));
     }
+    async listPlaced(kind, opts) {
+        let names;
+        try {
+            names = readdirSync(this.dir);
+        }
+        catch (err) {
+            if (err.code !== "ENOENT") {
+                this.disclose(this.dir, `session directory unreadable (${err.code ?? "unknown"}) — placed listing degraded to empty`);
+            }
+            return [];
+        }
+        const now = Date.now();
+        const out = [];
+        for (const name of names) {
+            if (!name.endsWith(SUFFIX))
+                continue;
+            const id = name.slice(0, -SUFFIX.length);
+            let placement;
+            try {
+                placement = this.read(id).placement;
+            }
+            catch (err) {
+                if (!(err instanceof SessionError && err.code === "not_found")) {
+                    this.disclose(this.pathFor(id), `session log unreadable (${err instanceof Error ? err.message : String(err)}) — skipped from the placed listing`);
+                }
+                continue;
+            }
+            if (placement === undefined || placement.kind !== kind)
+                continue;
+            if (opts?.scope !== undefined && placement.scope !== opts.scope)
+                continue;
+            if (opts?.olderThanMs !== undefined) {
+                let ageAnchor = placement.placedAt;
+                try {
+                    ageAnchor = statSync(this.pathFor(id)).mtimeMs;
+                }
+                catch {
+                }
+                if (now - ageAnchor <= opts.olderThanMs)
+                    continue;
+            }
+            out.push(placement.scope !== undefined && placement.handle !== undefined
+                ? { sessionId: id, placedAt: placement.placedAt, scope: placement.scope, handle: placement.handle }
+                : { sessionId: id, placedAt: placement.placedAt, tupleIncomplete: true });
+        }
+        return out;
+    }
+    async placementOf(sessionId) {
+        try {
+            return this.read(sessionId).placement;
+        }
+        catch {
+            return undefined;
+        }
+    }
     async delete(metadata) {
         evictSharedSessionStorage(canonicalStoreKey(this.pathFor(metadata.id)));
         try {
             rmSync(this.pathFor(metadata.id), { force: true });
         }
-        catch {
+        catch (err) {
+            throw new SessionError("storage", `session ${metadata.id} could not be deleted: ${err instanceof Error ? err.message : String(err)}`, err instanceof Error ? err : undefined);
         }
     }
     async fork(sourceMetadata, options = {}) {

package/dist/tools/fs/fs-pdf.d.ts

@@ -3,6 +3,17 @@ import type { DocumentContent, ImageContent, TextContent } from "../../internal/
 import type { ExecutionEnv } from "../../internal/harness-types.js";
 import { type PdfModelCapabilities } from "./pdf.js";
 import { type ReadImageDownsamplerOption } from "./fs-shared.js";
+import { type ReminderDisclosureCounts } from "../../core/reminder-disclosure.js";
+/** design/319 (B ticket) — the Read tool's disclosure state, threaded into the PDF TEXT legs (the
+ *  two `pdftotext` extraction arms — the only PDF returns with a model-facing text projection of
+ *  the document; the native document block and rendered page images have no text to scan). Shares
+ *  the Read closure's throttle windows so a PDF and its text read dedup on the same file key. */
+export interface PdfReminderDisclosure {
+    mark: string | undefined;
+    windows: Map<string, number>;
+    key: string;
+    counts?: ReminderDisclosureCounts;
+}
 export { pdfModelCapabilitiesOf, type PdfModelCapabilities } from "./pdf.js";
 /** What the Read tool's PDF pipeline returns (document block, or rendered page images, or an error string). */
 type ReadPdfReturn = string | {
@@ -33,7 +44,7 @@ type ReadPdfReturn = string | {
  * Every degraded return carries `details.fallback = { level, reason }` (telemetry on the structured frame).
  * `caps` absent ⇒ fully capable (byte-compat: native document block; the brain placeholder still guards).
  */
-export declare function readPdfFile(env: ExecutionEnv, path: string, key: string, pages: string | undefined, signal: AbortSignal | undefined, downsamplerOpt: ReadImageDownsamplerOption, cwd: string, preRead?: Uint8Array, caps?: PdfModelCapabilities, readDeny?: import("./read-deny.js").ReadDenyMatcher): Promise<ReadPdfReturn>;
+export declare function readPdfFile(env: ExecutionEnv, path: string, key: string, pages: string | undefined, signal: AbortSignal | undefined, downsamplerOpt: ReadImageDownsamplerOption, cwd: string, preRead?: Uint8Array, caps?: PdfModelCapabilities, readDeny?: import("./read-deny.js").ReadDenyMatcher, disclosure?: PdfReminderDisclosure): Promise<ReadPdfReturn>;
 /** E1: readPdfFile's own return type stays `ReadPdfReturn` (its INTERNAL string-means-error dispatch
  *  contract, shared with pdfPagesToImageBlocks) — the isError flag is applied once, here, at the tool's
  *  actual execute() boundary, not inside the helper. */

package/dist/tools/fs/fs-pdf.js

@@ -3,6 +3,20 @@ import { delimitUntrusted } from "../../core/untrusted-text.js";
 import { MCP_IMAGE_MAX_BASE64 } from "../../core/mcp.js";
 import { PDF_FALLBACK_RENDER_PAGES, PDF_INLINE_PAGE_THRESHOLD, PDF_MAX_EXTRACT_SIZE, PDF_MAX_PAGES_PER_READ, PDF_TARGET_RAW_SIZE, extractPdfPagesAsImages, extractPdfTextLayer, getPdfPageCount, parsePdfPageRange, pdfMagicMatches, } from "./pdf.js";
 import { resolveAutoDownsampler, enoentMessage, MAX_READ_BYTES } from "./fs-shared.js";
+import { discloseReminderShaped } from "../../core/reminder-disclosure.js";
+function pdfDisclosureTrailer(body, d) {
+    if (d === undefined)
+        return "";
+    const out = discloseReminderShaped({
+        segments: [body],
+        mark: d.mark,
+        outlet: "pdf",
+        defuseExactMark: false,
+        throttle: { key: d.key, windows: d.windows },
+        counts: d.counts,
+    });
+    return out.trailer !== undefined ? `\n${out.trailer}` : "";
+}
 export { pdfModelCapabilitiesOf } from "./pdf.js";
 async function pdfPagesToImageBlocks(pages, path, downsamplerOpt) {
     const downsampler = downsamplerOpt === false ? undefined : (downsamplerOpt ?? (await resolveAutoDownsampler()));
@@ -30,7 +44,7 @@ function boundPdfExtractedText(text) {
         return { body: text, truncated: false };
     return { body: text.slice(0, MAX_READ_BYTES), truncated: true };
 }
-export async function readPdfFile(env, path, key, pages, signal, downsamplerOpt, cwd, preRead, caps, readDeny) {
+export async function readPdfFile(env, path, key, pages, signal, downsamplerOpt, cwd, preRead, caps, readDeny, disclosure) {
     const cap = caps ?? { document: true, vision: true };
     const meta = await env.fileInfo(key, signal);
     if (!meta.ok) {
@@ -83,7 +97,7 @@ export async function readPdfFile(env, path, key, pages, signal, downsamplerOpt,
                         {
                             type: "text",
                             text: `[PDF: ${path} — pages ${range.first}-${last}${pageCount !== undefined ? ` of ${pageCount}` : ""} extracted as text via pdftotext (the serving model does not support native PDF input)${timeoutNote}]` +
-                                `\n${delimitUntrusted("PDF text layer", body)}${truncated ? `\n[extracted text truncated at ${MAX_READ_BYTES} bytes; narrow the pages range]` : ""}`,
+                                `\n${delimitUntrusted("PDF text layer", body)}${truncated ? `\n[extracted text truncated at ${MAX_READ_BYTES} bytes; narrow the pages range]` : ""}${pdfDisclosureTrailer(body, disclosure)}`,
                         },
                     ],
                     details: {
@@ -166,7 +180,7 @@ export async function readPdfFile(env, path, key, pages, signal, downsamplerOpt,
                     {
                         type: "text",
                         text: `[PDF: ${path} — extracted text layer via pdftotext${pageCount !== undefined ? `; ${pageCount} page${pageCount === 1 ? "" : "s"}` : ""} (the serving model does not support native PDF input)${timeoutNote}]` +
-                            `\n${delimitUntrusted("PDF text layer", body)}${truncated ? `\n[extracted text truncated at ${MAX_READ_BYTES} bytes; use the pages parameter to read specific ranges]` : ""}`,
+                            `\n${delimitUntrusted("PDF text layer", body)}${truncated ? `\n[extracted text truncated at ${MAX_READ_BYTES} bytes; use the pages parameter to read specific ranges]` : ""}${pdfDisclosureTrailer(body, disclosure)}`,
                     },
                 ],
                 details: {

package/dist/tools/fs/fs-read.d.ts

@@ -2,7 +2,8 @@ import type { AgentTool, ExecutionEnv } from "../../internal/harness-types.js";
 import { type ReadFileState } from "./safety.js";
 import { type PdfModelCapabilities } from "./pdf.js";
 import { type ReadImageDownsamplerOption, type CwdRef } from "./fs-shared.js";
+import { type ReminderDisclosureCounts } from "../../core/reminder-disclosure.js";
 export declare function createReadFileTool(env: ExecutionEnv, state: ReadFileState, rootCanonical: string, cwdRef?: CwdRef, additionalRoots?: readonly string[], imageDownsampler?: ReadImageDownsamplerOption, pdfCapabilities?: PdfModelCapabilities, bgOutputReadExemption?: (canonicalKey: string, ctx: {
     taskId?: string;
     principal?: string;
-}) => boolean, readCyberReminder?: boolean, readDeny?: import("./read-deny.js").ReadDenyMatcher, readFace?: import("./read-face.js").ReadFace, reminderMark?: string): AgentTool;
+}) => boolean, readCyberReminder?: boolean, readDeny?: import("./read-deny.js").ReadDenyMatcher, readFace?: import("./read-face.js").ReadFace, reminderMark?: string, reminderDisclosureCounts?: ReminderDisclosureCounts): AgentTool;

package/dist/tools/fs/fs-read.js

@@ -8,8 +8,16 @@ import { PDF_MAX_PAGES_PER_READ, pdfMagicMatches } from "./pdf.js";
 import { MAX_READ_BYTES, SLICED_READ_MAX_BYTES, MAX_IMAGE_READ_BYTES, MAX_IMAGE_DOWNSAMPLE_INPUT_BYTES, NO_DOWNSAMPLER_IMAGE_CAP_HINT, resolveAutoDownsampler, MAX_READ_OUTPUT_CHARS, readCyberReminderText, FILE_PATH_PARAMS, countLines, seededFileUnchangedReminder, enoentMessage, } from "./fs-shared.js";
 import { readPdfFile, pdfResultToToolReturn } from "./fs-pdf.js";
 import { openSystemReminder } from "../../core/reminder-mint.js";
-export function createReadFileTool(env, state, rootCanonical, cwdRef, additionalRoots, imageDownsampler, pdfCapabilities, bgOutputReadExemption, readCyberReminder, readDeny, readFace, reminderMark) {
+import { discloseReminderShaped } from "../../core/reminder-disclosure.js";
+export function createReadFileTool(env, state, rootCanonical, cwdRef, additionalRoots, imageDownsampler, pdfCapabilities, bgOutputReadExemption, readCyberReminder, readDeny, readFace, reminderMark, reminderDisclosureCounts) {
     const cyberReminder = readCyberReminder === false ? "" : readCyberReminderText(reminderMark);
+    const reminderDisclosureWindows = new Map();
+    const pdfReminderDisclosure = (key) => ({
+        mark: reminderMark,
+        windows: reminderDisclosureWindows,
+        key,
+        counts: reminderDisclosureCounts,
+    });
     const pathBoundLine = readFace === "open"
         ? "- `file_path` may be relative (resolved against the tracked working directory) or absolute. Reads are not confined to the workspace roots; a small sensitive-path deny list applies.\n"
         : "- `file_path` may be relative (resolved against the tracked working directory) or absolute (within the configured roots).\n";
@@ -125,7 +133,7 @@ export function createReadFileTool(env, state, rootCanonical, cwdRef, additional
                 };
             }
             if (r.key.toLowerCase().endsWith(".pdf")) {
-                return pdfResultToToolReturn(await readPdfFile(env, path, r.key, pages, ctx.signal, imageDownsampler, cwdRef?.current ?? rootCanonical, undefined, pdfCapabilities, readDeny));
+                return pdfResultToToolReturn(await readPdfFile(env, path, r.key, pages, ctx.signal, imageDownsampler, cwdRef?.current ?? rootCanonical, undefined, pdfCapabilities, readDeny, pdfReminderDisclosure(r.key)));
             }
             const binaryExt = hasBinaryExtension(r.key);
             const binaryExtRefusal = () => errorResult(`Error (Read): "${path}" appears to be a binary file (by extension); this tool reads UTF-8 text only.`);
@@ -170,7 +178,7 @@ export function createReadFileTool(env, state, rootCanonical, cwdRef, additional
                 return errorResult(`Error (Read): "${path}" is too large to read in full (${readSize} bytes > ${MAX_READ_BYTES}-byte cap); pass an explicit offset/limit to read a slice, or use grep to search it instead.`);
             }
             if (pdfMagicMatches(readBin.value)) {
-                return pdfResultToToolReturn(await readPdfFile(env, path, r.key, pages, ctx.signal, imageDownsampler, cwdRef?.current ?? rootCanonical, readBin.value, pdfCapabilities, readDeny));
+                return pdfResultToToolReturn(await readPdfFile(env, path, r.key, pages, ctx.signal, imageDownsampler, cwdRef?.current ?? rootCanonical, readBin.value, pdfCapabilities, readDeny, pdfReminderDisclosure(r.key)));
             }
             const magicFormat = binaryMagicFormat(readBin.value);
             if (magicFormat !== undefined) {
@@ -225,8 +233,20 @@ export function createReadFileTool(env, state, rootCanonical, cwdRef, additional
                     }
                     state.set(r.key, { hash, totalLines: countLines(content), truncated: false, view: { start: 1, end: total }, lastReadAt: Date.now() });
                     const bodyBlocks = rendered.blocks.length > 0 ? rendered.blocks : [{ type: "text", text: "[notebook has 0 cells]" }];
+                    const nbDisclosure = discloseReminderShaped({
+                        segments: rendered.blocks.filter((b) => b.type === "text").map((b) => b.text),
+                        mark: reminderMark,
+                        outlet: "notebook",
+                        defuseExactMark: false,
+                        throttle: { key: r.key, windows: reminderDisclosureWindows },
+                        counts: reminderDisclosureCounts,
+                    });
                     return {
-                        content: cyberReminder ? [...bodyBlocks, { type: "text", text: cyberReminder }] : bodyBlocks,
+                        content: [
+                            ...bodyBlocks,
+                            ...(cyberReminder ? [{ type: "text", text: cyberReminder }] : []),
+                            ...(nbDisclosure.trailer !== undefined ? [{ type: "text", text: nbDisclosure.trailer }] : []),
+                        ],
                         details: { type: "notebook", file: { filePath: path, cells: parsed.cells.map(stripNotebookImageData) } },
                     };
                 }
@@ -291,8 +311,16 @@ export function createReadFileTool(env, state, rootCanonical, cwdRef, additional
             if (total === 0)
                 return `${openSystemReminder(reminderMark)}Warning: the file exists but the contents are empty.</system-reminder>`;
             const header = pageMarker ?? (truncated ? `[${path}: lines ${start}-${end} of ${total}${end < total ? " — use offset to see more" : ""}]\n` : "");
+            const disclosure = discloseReminderShaped({
+                segments: [body],
+                mark: reminderMark,
+                outlet: "read",
+                defuseExactMark: false,
+                throttle: { key: r.key, windows: reminderDisclosureWindows },
+                counts: reminderDisclosureCounts,
+            });
             return {
-                content: `${nbFallbackPrefix}${header}${body}${cyberReminder}`,
+                content: `${nbFallbackPrefix}${header}${body}${cyberReminder}${disclosure.trailer !== undefined ? `\n${disclosure.trailer}` : ""}`,
                 details: {
                     type: "text",
                     file: {

package/dist/tools/fs/fs-shared.d.ts

@@ -140,8 +140,12 @@ export declare const MAX_READ_OUTPUT_CHARS = 100000;
  *  COVERAGE, stated because the switch is easy to over-read: the reminder rides the plain-text read and
  *  the notebook projection. PDF text extraction returns through its own result builder and has never
  *  carried it, so extracted PDF text reaches the model without this mitigation whatever the switch says.
- *  That gap predates the switch and is left as an open item rather than closed silently — widening the
- *  reminder to a third surface is a change to what every PDF read costs, not a wiring fix.
+ *  That gap predates the switch; its IMPERSONATION half is now closed — design/319 (B ticket) gave the
+ *  PDF text legs the same detect-and-disclose trailer as this lane (reminder-shaped bytes in extracted
+ *  PDF text are disclosed at the outlet, fs-pdf.ts), and their bodies were already fenced. The CYBER
+ *  half (this malware-alertness sentence) still does not ride PDF text and stays an open item rather
+ *  than closed silently — widening it to a third surface is a change to what every PDF read costs,
+ *  not a wiring fix.
  *
  *  design/319 (A ticket): a FUNCTION over the session mark (formerly the `READ_CYBER_REMINDER`
  *  constant) — the open tag is rendered by the mint home so it carries the run's provenance mark;

package/dist/tools/fs/index.d.ts

@@ -161,6 +161,13 @@ export interface HandsToolkitOptions {
      *  the honest form). The tag is rendered by the mint home (core/reminder-mint.ts) — the content
      *  BODY next to it is byte-untouched. */
     reminderMark?: string;
+    /** design/319 (B ticket) — the per-run trailer/defuse trigger counters (observation seat, G9②):
+     *  the Read text/notebook/PDF-text disclosure trailers bump `read.*` / `notebook.*` / `pdf.*`
+     *  keys here (appended / marked / bare_throttled). Threaded by prepare-task, which folds the
+     *  non-zero result into `TaskResult.stats.mechanisms.reminderDisclosures`; a library-direct
+     *  mount may pass its own object or omit it (counting off — and the whole disclosure pipeline
+     *  is off anyway when `reminderMark` is absent). */
+    reminderDisclosureCounts?: import("../../core/reminder-disclosure.js").ReminderDisclosureCounts;
 }
 /**
  * Build the per-task hand tool band over an injected env + fresh per-task read state (design/44 §11 A).

package/dist/tools/fs/index.js

@@ -46,7 +46,7 @@ export function createHandsToolkit(env, readFileState, rootCanonical, opts = {})
         onDeploymentClamp: () => deliverEngineNotice(opts.onNotice, deploymentReadFaceClampNotice()),
     });
     const tools = [
-        createReadFileTool(env, readFileState, rootCanonical, readOnly ? undefined : cwdRef, readFaceRoots, opts.readImageDownsampler, opts.pdfModelCapabilities, bgOutputReadExemption, opts.readCyberReminder, readDeny, readFace, opts.reminderMark),
+        createReadFileTool(env, readFileState, rootCanonical, readOnly ? undefined : cwdRef, readFaceRoots, opts.readImageDownsampler, opts.pdfModelCapabilities, bgOutputReadExemption, opts.readCyberReminder, readDeny, readFace, opts.reminderMark, opts.reminderDisclosureCounts),
     ];
     if (!readOnly) {
         tools.push(createEditFileTool(env, readFileState, rootCanonical, cwdRef, additionalRoots, opts.beforeWrite), createWriteFileTool(env, readFileState, rootCanonical, cwdRef, additionalRoots, opts.beforeWrite), createNotebookEditTool(env, readFileState, rootCanonical, cwdRef, additionalRoots, opts.beforeWrite));

package/dist/tools/web.js

@@ -1,6 +1,7 @@
 import { Type } from "typebox";
 import { defineTool, errorResult } from "../core/tools.js";
 import { delimitUntrusted, inlineUntrusted } from "../core/untrusted-text.js";
+import { discloseReminderShaped } from "../core/reminder-disclosure.js";
 import { redactSecrets } from "../core/untrusted-egress.js";
 import { isPrivateHost } from "../core/runner/image.js";
 import { binaryMagicFormat } from "./fs/safety.js";
@@ -638,7 +639,17 @@ export function webFetchToolSpec(config = {}) {
             const partialNote = bodyCut
                 ? `\n\n[WebFetch: ${cutPhrase} — the content above is PARTIAL: ${bodyBytes?.length ?? 0} bytes were received before the cutoff and the tail is missing. Treat absent information as unfetched, not absent from the source.]`
                 : "";
-            const modelText = withNote + truncationNote + partialNote + sourceEcho;
+            let modelText = withNote + truncationNote + partialNote + sourceEcho;
+            {
+                const d = discloseReminderShaped({
+                    segments: [modelText],
+                    mark: ctx.reminderMark,
+                    outlet: "webFetch",
+                    defuseExactMark: true,
+                    ...(ctx.reminderDisclosureCounts !== undefined ? { counts: ctx.reminderDisclosureCounts } : {}),
+                });
+                modelText = d.trailer !== undefined ? `${d.segments[0]}\n\n${d.trailer}` : d.segments[0];
+            }
             const RESULT_PREVIEW_CHARS = 8_000;
             return {
                 content: modelText,
@@ -947,7 +958,15 @@ export function createWebSearchTool(config) {
             const tailReminder = shown.length > 0
                 ? "REMINDER: You MUST include the sources above in your response to the user using markdown hyperlinks."
                 : "REMINDER: this search returned ZERO usable sources — there is nothing above to cite. Do not fabricate sources, URLs or citations; tell the user the search returned no usable results (the notes above say why, when there is a why) and answer from what you already know, or try a different query.";
-            const modelText = `${fenced}${dropNote}${domainNote}${maxResultsNote}${schemeNote}${clipNote}\n\n${tailReminder}`;
+            const searchDisclosure = discloseReminderShaped({
+                segments: [fenced],
+                mark: ctx.reminderMark,
+                outlet: "webSearch",
+                defuseExactMark: true,
+                ...(ctx.reminderDisclosureCounts !== undefined ? { counts: ctx.reminderDisclosureCounts } : {}),
+            });
+            const searchDisclosureNote = searchDisclosure.trailer !== undefined ? `\n\n${searchDisclosure.trailer}` : "";
+            const modelText = `${searchDisclosure.segments[0]}${dropNote}${domainNote}${maxResultsNote}${schemeNote}${clipNote}${searchDisclosureNote}\n\n${tailReminder}`;
             return {
                 content: modelText,
                 details: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "5.47.0",
+  "version": "5.48.0",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",
@@ -66,7 +66,8 @@
     "gate:nuia": "node scripts/verify-nuia-baseline.mjs",
     "gate:field-liveness": "node scripts/verify-field-liveness.mjs",
     "gate:error-surface": "node scripts/verify-error-surface.mjs",
-    "gate:criteria": "node scripts/criteria-lint.mjs"
+    "gate:criteria": "node scripts/criteria-lint.mjs",
+    "gate:reminder-literal": "node scripts/verify-reminder-literal.mjs"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "1.30.0",

package/test/export-surface.snapshot.json

@@ -1,6 +1,6 @@
 {
   "_comment": "design/87 L3 — frozen public export surface of src/index.ts (name -> kind). DO NOT edit by hand to silence a red test. A removed/changed entry = a SemVer-BREAKING change; bump MAJOR and update this fixture in the SAME commit (design/87 §4.2 / §5.2). Regenerate via REGEN in test/export-surface.test.ts.",
-  "count": 1625,
+  "count": 1639,
   "exports": {
     "A2ATaskState": "type",
     "A2ATaskStateReversal": "type",
@@ -47,6 +47,7 @@
     "AdoptionSource": "type",
     "AdoptionStatus": "type",
     "AffectedDeploymentConfig": "interface",
+    "AgentContinuationReceipt": "interface",
     "AgentDefinition": "interface",
     "AgentDisplayStatus": "type",
     "AgentPollDetailsInput": "interface",
@@ -229,6 +230,8 @@
     "DEFAULT_TIER_ORDER": "variable",
     "DEFAULT_TOOL_RESULT_THRESHOLD_CHARS": "variable",
     "DEGRADED_DIAGNOSTIC_TYPE": "variable",
+    "DELEGATION_MAX_CONCURRENT_DEFAULT": "variable",
+    "DELEGATION_MAX_PER_SESSION_DEFAULT": "variable",
     "DESIGN_REVIEW_PROMPTS": "variable",
     "DISCUSSION_SCRIPT": "variable",
     "DISCUSSION_WORKFLOW_NAME": "variable",
@@ -547,6 +550,8 @@
     "ORG_ADMISSION_CHECKPOINT_VERSION": "variable",
     "ORG_RULE_DECISION_REASON": "variable",
     "ORG_UNAVAILABLE_DECISION_REASON": "variable",
+    "ORPHAN_ADOPT_MAX_DEFAULT": "variable",
+    "ORPHAN_ADOPT_WINDOW_MS_DEFAULT": "variable",
     "OUTPUT_EFFICIENCY": "variable",
     "OnAsk": "type",
     "OnElicit": "type",
@@ -636,6 +641,7 @@
     "PersistedRuleMatch": "type",
     "PersistedRuleTool": "type",
     "PersistedRuleUnreadable": "interface",
+    "PlacedSessionRow": "type",
     "PlatformLimitReason": "type",
     "PostCompactContext": "interface",
     "PostToolBatchCall": "interface",
@@ -748,6 +754,7 @@
     "ReportedFinding": "interface",
     "ResolveExpectation": "interface",
     "ResolvedAsk": "type",
+    "ResolvedDelegationEntryCaps": "interface",
     "ResolvedOutcome": "interface",
     "ResolvedReasoning": "interface",
     "ResolvedRole": "interface",
@@ -831,6 +838,7 @@
     "STUB_ARCHIVED_LINE": "variable",
     "SUBAGENT_PROMPT": "variable",
     "SUBAGENT_SYSTEM_NOTE": "variable",
+    "SUBAGENT_TRANSCRIPT_RETENTION_DAYS_DEFAULT": "variable",
     "SUMMARIZE_TOOL_RESULTS": "variable",
     "SUPERVISOR_PROMPT": "variable",
     "SafetyAxis": "interface",
@@ -869,6 +877,8 @@
     "SessionError": "class",
     "SessionMetadata": "interface",
     "SessionPermissionRules": "interface",
+    "SessionPlacement": "interface",
+    "SessionPlacementRecord": "interface",
     "SessionPolicyError": "class",
     "SessionPolicyStore": "interface",
     "SessionRepo": "interface",
@@ -930,6 +940,7 @@
     "SubagentSteerHandle": "interface",
     "SubagentStep": "interface",
     "SubagentToolOptions": "interface",
+    "SubagentTranscriptTier": "type",
     "SummarizableFinding": "interface",
     "SyncMemoryScopeOptions": "interface",
     "SyntheticContinuationReason": "type",
@@ -1206,6 +1217,7 @@
     "constraintChainEntryOf": "function",
     "cosineDistance": "function",
     "countElicitOptIns": "function",
+    "createAgentContinuationVerb": "function",
     "createAgentTranscriptTool": "function",
     "createAllowDenyPolicy": "function",
     "createAnthropicBrain": "function",
@@ -1499,6 +1511,7 @@
     "resolveComplianceDenies": "function",
     "resolveDataRoot": "function",
     "resolveDeclaredDurability": "function",
+    "resolveDelegationEntryCaps": "function",
     "resolveEffectiveConfig": "function",
     "resolveEffort": "function",
     "resolveFrozenPaths": "function",
@@ -1513,6 +1526,7 @@
     "resolveReadFace": "function",
     "resolveReasoning": "function",
     "resolveReasoningProfile": "function",
+    "resolveSubagentTranscriptTier": "function",
     "resolveTaskLimits": "function",
     "resolveTaskModel": "function",
     "resolveUsageWindows": "function",