@sema-agent/core 5.47.0 → 5.49.0

package/dist/stores/file/strategy-store.js

@@ -0,0 +1,340 @@
+import { accessSync, constants as FS, lstatSync, mkdirSync, readFileSync, readdirSync, renameSync, statSync, unlinkSync } from "node:fs";
+import { join } from "node:path";
+import { createHash } from "node:crypto";
+import { atomicWriteFile } from "./fs-atomic.js";
+import { createSafeNotifier, observeThenableRejection } from "../../core/safe-notify.js";
+import { MAX_STRATEGY_INJECTION_TOTAL_BYTES, MAX_STRATEGY_TEXT_BYTES, compileStrategyQuery, resolveCapacityCap, resolveFindLimit, scoreStoredStrategy, storedStrategyShapeIssue, strategyDedupKey, validateStrategyForWrite, } from "../../core/strategy-store.js";
+function configRefusal(message, code) {
+    const e = new Error(message);
+    e.code = code;
+    return e;
+}
+const SCOPE_SLUG_MAX = 40;
+const READ_FILE_CAP_FACTOR = 4;
+const STALE_TEMP_MS = 60 * 60 * 1000;
+const MAX_ENTRY_FILE_BYTES = 65536;
+const FILE_RE = /^([A-Za-z0-9_-]{1,64})\.json$/;
+export class FileStrategyStore {
+    root;
+    maxPerScope;
+    onIncident;
+    warnedOps = new Set();
+    sinkNotifier = createSafeNotifier();
+    sweptTemps = new Set();
+    constructor(opts) {
+        this.maxPerScope = resolveCapacityCap("maxPerScope", opts.maxPerScope ?? 100);
+        this.onIncident = opts.onIncident;
+        const root = opts.root;
+        if (typeof root !== "string" || root.length === 0) {
+            throw configRefusal("FileStrategyStore: root must be a non-empty path", "config.strategy_root_invalid");
+        }
+        try {
+            mkdirSync(root, { recursive: true, mode: 0o700 });
+        }
+        catch (err) {
+            throw configRefusal(`FileStrategyStore: cannot create root ${root}: ${String(err.message ?? err)}`, "config.strategy_root_invalid");
+        }
+        let st;
+        try {
+            st = statSync(root);
+        }
+        catch (err) {
+            throw configRefusal(`FileStrategyStore: cannot stat root ${root}: ${String(err.message ?? err)}`, "config.strategy_root_invalid");
+        }
+        if (!st.isDirectory()) {
+            throw configRefusal(`FileStrategyStore: root ${root} exists and is not a directory`, "config.strategy_root_invalid");
+        }
+        try {
+            accessSync(root, FS.W_OK);
+        }
+        catch {
+            throw configRefusal(`FileStrategyStore: root ${root} is not writable`, "config.strategy_root_invalid");
+        }
+        this.root = root;
+    }
+    scopeDirName(scope) {
+        const slug = scope
+            .toLowerCase()
+            .replace(/[^a-z0-9-]+/g, "-")
+            .replace(/^-+|-+$/g, "")
+            .slice(0, SCOPE_SLUG_MAX);
+        const h = createHash("sha256").update(scope, "utf8").digest("hex").slice(0, 24);
+        return `${slug || "s"}-${h}`;
+    }
+    scopeDirPath(scope) {
+        return join(this.root, this.scopeDirName(scope));
+    }
+    assertScopeDirSafe(dir) {
+        let st;
+        try {
+            st = lstatSync(dir);
+        }
+        catch (err) {
+            if (err.code === "ENOENT")
+                return;
+            throw err;
+        }
+        if (st.isSymbolicLink() || !st.isDirectory()) {
+            const e = new Error(`FileStrategyStore: scope directory ${dir} is not a plain directory (symlink or non-dir refused)`);
+            e.code = "strategy.scope_dir_invalid";
+            throw e;
+        }
+    }
+    incident(i) {
+        const sink = this.onIncident;
+        if (sink !== undefined) {
+            const site = `FileStrategyStore.onIncident.${i.op}`;
+            this.sinkNotifier.notify(() => observeThenableRejection(sink(i), this.sinkNotifier, site), site);
+            return;
+        }
+        if (!this.warnedOps.has(i.op)) {
+            this.warnedOps.add(i.op);
+            console.warn(`FileStrategyStore ${i.op} incident: ${i.error}${i.path !== undefined ? ` (${i.path})` : ""}`);
+        }
+    }
+    sweepStaleTemps(dir) {
+        if (this.sweptTemps.has(dir))
+            return;
+        this.sweptTemps.add(dir);
+        let names;
+        try {
+            names = readdirSync(dir);
+        }
+        catch {
+            return;
+        }
+        const cutoff = Date.now() - STALE_TEMP_MS;
+        for (const name of names) {
+            if (!name.endsWith(".tmp"))
+                continue;
+            const p = join(dir, name);
+            try {
+                if (statSync(p).mtimeMs < cutoff)
+                    unlinkSync(p);
+            }
+            catch {
+            }
+        }
+    }
+    loadScope(scope, dir, readCap) {
+        let names;
+        try {
+            names = readdirSync(dir);
+        }
+        catch (err) {
+            if (err.code === "ENOENT")
+                return [];
+            throw err;
+        }
+        let candidates = names.filter((n) => FILE_RE.test(n)).sort();
+        if (Number.isFinite(readCap) && candidates.length > readCap) {
+            this.incident({
+                op: "find",
+                error: `scope directory holds ${candidates.length} entry files, over the ${readCap} read cap — parsing the first ${readCap} only (an external writer likely inflated this directory)`,
+                path: dir,
+            });
+            candidates = candidates.slice(0, readCap);
+        }
+        const out = [];
+        for (const name of candidates) {
+            const p = join(dir, name);
+            let fst;
+            try {
+                fst = lstatSync(p);
+            }
+            catch (err) {
+                if (err.code === "ENOENT")
+                    continue;
+                this.incident({ op: "find", error: `unstat-able entry skipped: ${String(err.message ?? err)}`, path: p });
+                continue;
+            }
+            if (!fst.isFile()) {
+                this.incident({ op: "find", error: "non-regular entry skipped (symlink or special file refused)", path: p });
+                continue;
+            }
+            if (fst.size > MAX_ENTRY_FILE_BYTES) {
+                this.quarantine(p, `entry file is ${fst.size} bytes, over the ${MAX_ENTRY_FILE_BYTES} read bound`);
+                continue;
+            }
+            let raw;
+            try {
+                raw = readFileSync(p, "utf8");
+            }
+            catch (err) {
+                if (err.code === "ENOENT")
+                    continue;
+                this.incident({ op: "find", error: `unreadable entry skipped: ${String(err.message ?? err)}`, path: p });
+                continue;
+            }
+            let parsed;
+            try {
+                parsed = JSON.parse(raw);
+            }
+            catch {
+                this.quarantine(p, "unparseable JSON");
+                continue;
+            }
+            if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+                this.quarantine(p, "top-level JSON value is not an object");
+                continue;
+            }
+            const rec = parsed;
+            if (rec.v !== 1) {
+                this.incident({ op: "parse", error: `unknown schema version ${String(rec.v)} — entry skipped, file left in place`, path: p });
+                continue;
+            }
+            const { v: _v, ...candidate } = rec;
+            const issue = storedStrategyShapeIssue(candidate);
+            if (issue !== null) {
+                this.quarantine(p, issue);
+                continue;
+            }
+            const entry = candidate;
+            const fileId = FILE_RE.exec(name)[1];
+            if (entry.scope !== scope || entry.id !== fileId) {
+                this.incident({
+                    op: "find",
+                    error: `entry skipped: scope/id mismatch (file claims scope ${JSON.stringify(entry.scope)}, id ${JSON.stringify(entry.id)})`,
+                    id: fileId,
+                    path: p,
+                });
+                continue;
+            }
+            out.push({ entry, path: p });
+        }
+        const byKey = new Map();
+        for (const le of out) {
+            const key = strategyDedupKey(le.entry);
+            const prev = byKey.get(key);
+            if (prev === undefined || scoreStoredStrategy(le.entry) > scoreStoredStrategy(prev.entry))
+                byKey.set(key, le);
+        }
+        return [...byKey.values()];
+    }
+    quarantine(p, reason) {
+        try {
+            renameSync(p, `${p}.bad`);
+            this.incident({ op: "parse", error: `corrupt entry quarantined (${reason})`, path: p });
+        }
+        catch (err) {
+            this.incident({ op: "parse", error: `corrupt entry skipped (${reason}); quarantine rename failed: ${String(err.message ?? err)}`, path: p });
+        }
+    }
+    writeEntry(dir, path, entry) {
+        const record = {
+            v: 1,
+            id: entry.id,
+            problem: entry.problem,
+            strategy: entry.strategy,
+            confidence: entry.confidence,
+            scope: entry.scope,
+            ts: entry.ts,
+            ...(entry.teacherModel !== undefined ? { teacherModel: entry.teacherModel } : {}),
+            ...(entry.signature !== undefined ? { signature: entry.signature } : {}),
+            ...(entry.origin !== undefined ? { origin: entry.origin } : {}),
+        };
+        const bytes = JSON.stringify(record);
+        if (Buffer.byteLength(bytes, "utf8") > MAX_ENTRY_FILE_BYTES) {
+            const e = new Error(`FileStrategyStore: entry serializes over the ${MAX_ENTRY_FILE_BYTES}-byte read bound (JSON escaping expanded it past the field caps) — refusing a write the read side would quarantine`);
+            e.code = "strategy.entry_invalid";
+            throw e;
+        }
+        atomicWriteFile(dir, path, bytes);
+    }
+    save(s) {
+        validateStrategyForWrite(s);
+        const dir = this.scopeDirPath(s.scope);
+        this.assertScopeDirSafe(dir);
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+        this.sweepStaleTemps(dir);
+        const existing = this.loadScope(s.scope, dir, this.retrievalReadCap());
+        const key = strategyDedupKey(s);
+        const dup = existing.find((le) => strategyDedupKey(le.entry) === key);
+        let all;
+        if (dup !== undefined) {
+            const refreshed = {
+                ...dup.entry,
+                ...(s.confidence >= dup.entry.confidence ? { confidence: s.confidence, ts: s.ts } : {}),
+                ...(s.teacherModel !== undefined ? { teacherModel: s.teacherModel } : {}),
+            };
+            this.writeEntry(dir, dup.path, refreshed);
+            dup.entry = refreshed;
+            all = existing;
+        }
+        else {
+            const p = join(dir, `${s.id}.json`);
+            const byId = existing.find((le) => le.entry.id === s.id);
+            this.writeEntry(dir, p, s);
+            if (byId !== undefined) {
+                byId.entry = s;
+                all = existing;
+            }
+            else {
+                all = [...existing, { entry: s, path: p }];
+            }
+        }
+        if (all.length > this.maxPerScope) {
+            this.evict(all, this.maxPerScope);
+        }
+    }
+    evict(all, keep) {
+        const sorted = [...all].sort((a, b) => scoreStoredStrategy(b.entry) - scoreStoredStrategy(a.entry));
+        for (const le of sorted.slice(keep)) {
+            try {
+                unlinkSync(le.path);
+            }
+            catch (err) {
+                if (err.code === "ENOENT")
+                    continue;
+                this.incident({ op: "evict", error: String(err.message ?? err), id: le.entry.id, path: le.path });
+            }
+        }
+    }
+    find(scope, query, limit) {
+        const cap = resolveFindLimit(limit);
+        const dir = this.scopeDirPath(scope);
+        this.assertScopeDirSafe(dir);
+        const matches = compileStrategyQuery(query);
+        if (matches === null)
+            return [];
+        const ranked = this.loadScope(scope, dir, this.retrievalReadCap())
+            .map((le) => le.entry)
+            .filter((e) => matches(e.problem))
+            .sort((a, b) => scoreStoredStrategy(b) - scoreStoredStrategy(a))
+            .slice(0, cap);
+        let bytes = 0;
+        for (let i = 0; i < ranked.length; i++) {
+            bytes += Buffer.byteLength(ranked[i].strategy, "utf8");
+            if (bytes > MAX_STRATEGY_INJECTION_TOTAL_BYTES) {
+                this.incident({
+                    op: "find",
+                    error: `result truncated at ${i} of ${ranked.length} entries — combined strategy text exceeded ${MAX_STRATEGY_INJECTION_TOTAL_BYTES} bytes (per-entry cap ${MAX_STRATEGY_TEXT_BYTES})`,
+                });
+                return ranked.slice(0, i);
+            }
+        }
+        return ranked;
+    }
+    retrievalReadCap() {
+        return this.maxPerScope * READ_FILE_CAP_FACTOR;
+    }
+    prune(scope, maxSize) {
+        const n = resolveCapacityCap("maxSize", maxSize);
+        const dir = this.scopeDirPath(scope);
+        this.assertScopeDirSafe(dir);
+        const all = this.loadScope(scope, dir, Number.POSITIVE_INFINITY);
+        if (all.length > n)
+            this.evict(all, n);
+    }
+    scopeUsage(scope) {
+        const dir = this.scopeDirPath(scope);
+        this.assertScopeDirSafe(dir);
+        return { used: this.loadScope(scope, dir, Number.POSITIVE_INFINITY).length, capacity: this.maxPerScope };
+    }
+    hasStrategy(scope, entry) {
+        const dir = this.scopeDirPath(scope);
+        this.assertScopeDirSafe(dir);
+        const key = strategyDedupKey(entry);
+        return this.loadScope(scope, dir, this.retrievalReadCap()).some((le) => strategyDedupKey(le.entry) === key);
+    }
+}

package/dist/tools/fs/fs-pdf.d.ts

@@ -3,6 +3,17 @@ import type { DocumentContent, ImageContent, TextContent } from "../../internal/
 import type { ExecutionEnv } from "../../internal/harness-types.js";
 import { type PdfModelCapabilities } from "./pdf.js";
 import { type ReadImageDownsamplerOption } from "./fs-shared.js";
+import { type ReminderDisclosureCounts } from "../../core/reminder-disclosure.js";
+/** design/319 (B ticket) — the Read tool's disclosure state, threaded into the PDF TEXT legs (the
+ *  two `pdftotext` extraction arms — the only PDF returns with a model-facing text projection of
+ *  the document; the native document block and rendered page images have no text to scan). Shares
+ *  the Read closure's throttle windows so a PDF and its text read dedup on the same file key. */
+export interface PdfReminderDisclosure {
+    mark: string | undefined;
+    windows: Map<string, number>;
+    key: string;
+    counts?: ReminderDisclosureCounts;
+}
 export { pdfModelCapabilitiesOf, type PdfModelCapabilities } from "./pdf.js";
 /** What the Read tool's PDF pipeline returns (document block, or rendered page images, or an error string). */
 type ReadPdfReturn = string | {
@@ -33,7 +44,7 @@ type ReadPdfReturn = string | {
  * Every degraded return carries `details.fallback = { level, reason }` (telemetry on the structured frame).
  * `caps` absent ⇒ fully capable (byte-compat: native document block; the brain placeholder still guards).
  */
-export declare function readPdfFile(env: ExecutionEnv, path: string, key: string, pages: string | undefined, signal: AbortSignal | undefined, downsamplerOpt: ReadImageDownsamplerOption, cwd: string, preRead?: Uint8Array, caps?: PdfModelCapabilities, readDeny?: import("./read-deny.js").ReadDenyMatcher): Promise<ReadPdfReturn>;
+export declare function readPdfFile(env: ExecutionEnv, path: string, key: string, pages: string | undefined, signal: AbortSignal | undefined, downsamplerOpt: ReadImageDownsamplerOption, cwd: string, preRead?: Uint8Array, caps?: PdfModelCapabilities, readDeny?: import("./read-deny.js").ReadDenyMatcher, disclosure?: PdfReminderDisclosure): Promise<ReadPdfReturn>;
 /** E1: readPdfFile's own return type stays `ReadPdfReturn` (its INTERNAL string-means-error dispatch
  *  contract, shared with pdfPagesToImageBlocks) — the isError flag is applied once, here, at the tool's
  *  actual execute() boundary, not inside the helper. */

package/dist/tools/fs/fs-pdf.js

@@ -3,6 +3,20 @@ import { delimitUntrusted } from "../../core/untrusted-text.js";
 import { MCP_IMAGE_MAX_BASE64 } from "../../core/mcp.js";
 import { PDF_FALLBACK_RENDER_PAGES, PDF_INLINE_PAGE_THRESHOLD, PDF_MAX_EXTRACT_SIZE, PDF_MAX_PAGES_PER_READ, PDF_TARGET_RAW_SIZE, extractPdfPagesAsImages, extractPdfTextLayer, getPdfPageCount, parsePdfPageRange, pdfMagicMatches, } from "./pdf.js";
 import { resolveAutoDownsampler, enoentMessage, MAX_READ_BYTES } from "./fs-shared.js";
+import { discloseReminderShaped } from "../../core/reminder-disclosure.js";
+function pdfDisclosureTrailer(body, d) {
+    if (d === undefined)
+        return "";
+    const out = discloseReminderShaped({
+        segments: [body],
+        mark: d.mark,
+        outlet: "pdf",
+        defuseExactMark: false,
+        throttle: { key: d.key, windows: d.windows },
+        counts: d.counts,
+    });
+    return out.trailer !== undefined ? `\n${out.trailer}` : "";
+}
 export { pdfModelCapabilitiesOf } from "./pdf.js";
 async function pdfPagesToImageBlocks(pages, path, downsamplerOpt) {
     const downsampler = downsamplerOpt === false ? undefined : (downsamplerOpt ?? (await resolveAutoDownsampler()));
@@ -30,7 +44,7 @@ function boundPdfExtractedText(text) {
         return { body: text, truncated: false };
     return { body: text.slice(0, MAX_READ_BYTES), truncated: true };
 }
-export async function readPdfFile(env, path, key, pages, signal, downsamplerOpt, cwd, preRead, caps, readDeny) {
+export async function readPdfFile(env, path, key, pages, signal, downsamplerOpt, cwd, preRead, caps, readDeny, disclosure) {
     const cap = caps ?? { document: true, vision: true };
     const meta = await env.fileInfo(key, signal);
     if (!meta.ok) {
@@ -83,7 +97,7 @@ export async function readPdfFile(env, path, key, pages, signal, downsamplerOpt,
                         {
                             type: "text",
                             text: `[PDF: ${path} — pages ${range.first}-${last}${pageCount !== undefined ? ` of ${pageCount}` : ""} extracted as text via pdftotext (the serving model does not support native PDF input)${timeoutNote}]` +
-                                `\n${delimitUntrusted("PDF text layer", body)}${truncated ? `\n[extracted text truncated at ${MAX_READ_BYTES} bytes; narrow the pages range]` : ""}`,
+                                `\n${delimitUntrusted("PDF text layer", body)}${truncated ? `\n[extracted text truncated at ${MAX_READ_BYTES} bytes; narrow the pages range]` : ""}${pdfDisclosureTrailer(body, disclosure)}`,
                         },
                     ],
                     details: {
@@ -166,7 +180,7 @@ export async function readPdfFile(env, path, key, pages, signal, downsamplerOpt,
                     {
                         type: "text",
                         text: `[PDF: ${path} — extracted text layer via pdftotext${pageCount !== undefined ? `; ${pageCount} page${pageCount === 1 ? "" : "s"}` : ""} (the serving model does not support native PDF input)${timeoutNote}]` +
-                            `\n${delimitUntrusted("PDF text layer", body)}${truncated ? `\n[extracted text truncated at ${MAX_READ_BYTES} bytes; use the pages parameter to read specific ranges]` : ""}`,
+                            `\n${delimitUntrusted("PDF text layer", body)}${truncated ? `\n[extracted text truncated at ${MAX_READ_BYTES} bytes; use the pages parameter to read specific ranges]` : ""}${pdfDisclosureTrailer(body, disclosure)}`,
                     },
                 ],
                 details: {

package/dist/tools/fs/fs-read.d.ts

@@ -2,7 +2,8 @@ import type { AgentTool, ExecutionEnv } from "../../internal/harness-types.js";
 import { type ReadFileState } from "./safety.js";
 import { type PdfModelCapabilities } from "./pdf.js";
 import { type ReadImageDownsamplerOption, type CwdRef } from "./fs-shared.js";
+import { type ReminderDisclosureCounts } from "../../core/reminder-disclosure.js";
 export declare function createReadFileTool(env: ExecutionEnv, state: ReadFileState, rootCanonical: string, cwdRef?: CwdRef, additionalRoots?: readonly string[], imageDownsampler?: ReadImageDownsamplerOption, pdfCapabilities?: PdfModelCapabilities, bgOutputReadExemption?: (canonicalKey: string, ctx: {
     taskId?: string;
     principal?: string;
-}) => boolean, readCyberReminder?: boolean, readDeny?: import("./read-deny.js").ReadDenyMatcher, readFace?: import("./read-face.js").ReadFace, reminderMark?: string): AgentTool;
+}) => boolean, readCyberReminder?: boolean, readDeny?: import("./read-deny.js").ReadDenyMatcher, readFace?: import("./read-face.js").ReadFace, reminderMark?: string, reminderDisclosureCounts?: ReminderDisclosureCounts): AgentTool;

package/dist/tools/fs/fs-read.js

@@ -8,8 +8,16 @@ import { PDF_MAX_PAGES_PER_READ, pdfMagicMatches } from "./pdf.js";
 import { MAX_READ_BYTES, SLICED_READ_MAX_BYTES, MAX_IMAGE_READ_BYTES, MAX_IMAGE_DOWNSAMPLE_INPUT_BYTES, NO_DOWNSAMPLER_IMAGE_CAP_HINT, resolveAutoDownsampler, MAX_READ_OUTPUT_CHARS, readCyberReminderText, FILE_PATH_PARAMS, countLines, seededFileUnchangedReminder, enoentMessage, } from "./fs-shared.js";
 import { readPdfFile, pdfResultToToolReturn } from "./fs-pdf.js";
 import { openSystemReminder } from "../../core/reminder-mint.js";
-export function createReadFileTool(env, state, rootCanonical, cwdRef, additionalRoots, imageDownsampler, pdfCapabilities, bgOutputReadExemption, readCyberReminder, readDeny, readFace, reminderMark) {
+import { discloseReminderShaped } from "../../core/reminder-disclosure.js";
+export function createReadFileTool(env, state, rootCanonical, cwdRef, additionalRoots, imageDownsampler, pdfCapabilities, bgOutputReadExemption, readCyberReminder, readDeny, readFace, reminderMark, reminderDisclosureCounts) {
     const cyberReminder = readCyberReminder === false ? "" : readCyberReminderText(reminderMark);
+    const reminderDisclosureWindows = new Map();
+    const pdfReminderDisclosure = (key) => ({
+        mark: reminderMark,
+        windows: reminderDisclosureWindows,
+        key,
+        counts: reminderDisclosureCounts,
+    });
     const pathBoundLine = readFace === "open"
         ? "- `file_path` may be relative (resolved against the tracked working directory) or absolute. Reads are not confined to the workspace roots; a small sensitive-path deny list applies.\n"
         : "- `file_path` may be relative (resolved against the tracked working directory) or absolute (within the configured roots).\n";
@@ -125,7 +133,7 @@ export function createReadFileTool(env, state, rootCanonical, cwdRef, additional
                 };
             }
             if (r.key.toLowerCase().endsWith(".pdf")) {
-                return pdfResultToToolReturn(await readPdfFile(env, path, r.key, pages, ctx.signal, imageDownsampler, cwdRef?.current ?? rootCanonical, undefined, pdfCapabilities, readDeny));
+                return pdfResultToToolReturn(await readPdfFile(env, path, r.key, pages, ctx.signal, imageDownsampler, cwdRef?.current ?? rootCanonical, undefined, pdfCapabilities, readDeny, pdfReminderDisclosure(r.key)));
             }
             const binaryExt = hasBinaryExtension(r.key);
             const binaryExtRefusal = () => errorResult(`Error (Read): "${path}" appears to be a binary file (by extension); this tool reads UTF-8 text only.`);
@@ -170,7 +178,7 @@ export function createReadFileTool(env, state, rootCanonical, cwdRef, additional
                 return errorResult(`Error (Read): "${path}" is too large to read in full (${readSize} bytes > ${MAX_READ_BYTES}-byte cap); pass an explicit offset/limit to read a slice, or use grep to search it instead.`);
             }
             if (pdfMagicMatches(readBin.value)) {
-                return pdfResultToToolReturn(await readPdfFile(env, path, r.key, pages, ctx.signal, imageDownsampler, cwdRef?.current ?? rootCanonical, readBin.value, pdfCapabilities, readDeny));
+                return pdfResultToToolReturn(await readPdfFile(env, path, r.key, pages, ctx.signal, imageDownsampler, cwdRef?.current ?? rootCanonical, readBin.value, pdfCapabilities, readDeny, pdfReminderDisclosure(r.key)));
             }
             const magicFormat = binaryMagicFormat(readBin.value);
             if (magicFormat !== undefined) {
@@ -225,8 +233,20 @@ export function createReadFileTool(env, state, rootCanonical, cwdRef, additional
                     }
                     state.set(r.key, { hash, totalLines: countLines(content), truncated: false, view: { start: 1, end: total }, lastReadAt: Date.now() });
                     const bodyBlocks = rendered.blocks.length > 0 ? rendered.blocks : [{ type: "text", text: "[notebook has 0 cells]" }];
+                    const nbDisclosure = discloseReminderShaped({
+                        segments: rendered.blocks.filter((b) => b.type === "text").map((b) => b.text),
+                        mark: reminderMark,
+                        outlet: "notebook",
+                        defuseExactMark: false,
+                        throttle: { key: r.key, windows: reminderDisclosureWindows },
+                        counts: reminderDisclosureCounts,
+                    });
                     return {
-                        content: cyberReminder ? [...bodyBlocks, { type: "text", text: cyberReminder }] : bodyBlocks,
+                        content: [
+                            ...bodyBlocks,
+                            ...(cyberReminder ? [{ type: "text", text: cyberReminder }] : []),
+                            ...(nbDisclosure.trailer !== undefined ? [{ type: "text", text: nbDisclosure.trailer }] : []),
+                        ],
                         details: { type: "notebook", file: { filePath: path, cells: parsed.cells.map(stripNotebookImageData) } },
                     };
                 }
@@ -291,8 +311,16 @@ export function createReadFileTool(env, state, rootCanonical, cwdRef, additional
             if (total === 0)
                 return `${openSystemReminder(reminderMark)}Warning: the file exists but the contents are empty.</system-reminder>`;
             const header = pageMarker ?? (truncated ? `[${path}: lines ${start}-${end} of ${total}${end < total ? " — use offset to see more" : ""}]\n` : "");
+            const disclosure = discloseReminderShaped({
+                segments: [body],
+                mark: reminderMark,
+                outlet: "read",
+                defuseExactMark: false,
+                throttle: { key: r.key, windows: reminderDisclosureWindows },
+                counts: reminderDisclosureCounts,
+            });
             return {
-                content: `${nbFallbackPrefix}${header}${body}${cyberReminder}`,
+                content: `${nbFallbackPrefix}${header}${body}${cyberReminder}${disclosure.trailer !== undefined ? `\n${disclosure.trailer}` : ""}`,
                 details: {
                     type: "text",
                     file: {

package/dist/tools/fs/fs-shared.d.ts

@@ -140,8 +140,12 @@ export declare const MAX_READ_OUTPUT_CHARS = 100000;
  *  COVERAGE, stated because the switch is easy to over-read: the reminder rides the plain-text read and
  *  the notebook projection. PDF text extraction returns through its own result builder and has never
  *  carried it, so extracted PDF text reaches the model without this mitigation whatever the switch says.
- *  That gap predates the switch and is left as an open item rather than closed silently — widening the
- *  reminder to a third surface is a change to what every PDF read costs, not a wiring fix.
+ *  That gap predates the switch; its IMPERSONATION half is now closed — design/319 (B ticket) gave the
+ *  PDF text legs the same detect-and-disclose trailer as this lane (reminder-shaped bytes in extracted
+ *  PDF text are disclosed at the outlet, fs-pdf.ts), and their bodies were already fenced. The CYBER
+ *  half (this malware-alertness sentence) still does not ride PDF text and stays an open item rather
+ *  than closed silently — widening it to a third surface is a change to what every PDF read costs,
+ *  not a wiring fix.
  *
  *  design/319 (A ticket): a FUNCTION over the session mark (formerly the `READ_CYBER_REMINDER`
  *  constant) — the open tag is rendered by the mint home so it carries the run's provenance mark;

package/dist/tools/fs/index.d.ts

@@ -161,6 +161,13 @@ export interface HandsToolkitOptions {
      *  the honest form). The tag is rendered by the mint home (core/reminder-mint.ts) — the content
      *  BODY next to it is byte-untouched. */
     reminderMark?: string;
+    /** design/319 (B ticket) — the per-run trailer/defuse trigger counters (observation seat, G9②):
+     *  the Read text/notebook/PDF-text disclosure trailers bump `read.*` / `notebook.*` / `pdf.*`
+     *  keys here (appended / marked / bare_throttled). Threaded by prepare-task, which folds the
+     *  non-zero result into `TaskResult.stats.mechanisms.reminderDisclosures`; a library-direct
+     *  mount may pass its own object or omit it (counting off — and the whole disclosure pipeline
+     *  is off anyway when `reminderMark` is absent). */
+    reminderDisclosureCounts?: import("../../core/reminder-disclosure.js").ReminderDisclosureCounts;
 }
 /**
  * Build the per-task hand tool band over an injected env + fresh per-task read state (design/44 §11 A).

package/dist/tools/fs/index.js

@@ -46,7 +46,7 @@ export function createHandsToolkit(env, readFileState, rootCanonical, opts = {})
         onDeploymentClamp: () => deliverEngineNotice(opts.onNotice, deploymentReadFaceClampNotice()),
     });
     const tools = [
-        createReadFileTool(env, readFileState, rootCanonical, readOnly ? undefined : cwdRef, readFaceRoots, opts.readImageDownsampler, opts.pdfModelCapabilities, bgOutputReadExemption, opts.readCyberReminder, readDeny, readFace, opts.reminderMark),
+        createReadFileTool(env, readFileState, rootCanonical, readOnly ? undefined : cwdRef, readFaceRoots, opts.readImageDownsampler, opts.pdfModelCapabilities, bgOutputReadExemption, opts.readCyberReminder, readDeny, readFace, opts.reminderMark, opts.reminderDisclosureCounts),
     ];
     if (!readOnly) {
         tools.push(createEditFileTool(env, readFileState, rootCanonical, cwdRef, additionalRoots, opts.beforeWrite), createWriteFileTool(env, readFileState, rootCanonical, cwdRef, additionalRoots, opts.beforeWrite), createNotebookEditTool(env, readFileState, rootCanonical, cwdRef, additionalRoots, opts.beforeWrite));

package/dist/tools/web.js

@@ -1,6 +1,7 @@
 import { Type } from "typebox";
 import { defineTool, errorResult } from "../core/tools.js";
 import { delimitUntrusted, inlineUntrusted } from "../core/untrusted-text.js";
+import { discloseReminderShaped } from "../core/reminder-disclosure.js";
 import { redactSecrets } from "../core/untrusted-egress.js";
 import { isPrivateHost } from "../core/runner/image.js";
 import { binaryMagicFormat } from "./fs/safety.js";
@@ -638,7 +639,17 @@ export function webFetchToolSpec(config = {}) {
             const partialNote = bodyCut
                 ? `\n\n[WebFetch: ${cutPhrase} — the content above is PARTIAL: ${bodyBytes?.length ?? 0} bytes were received before the cutoff and the tail is missing. Treat absent information as unfetched, not absent from the source.]`
                 : "";
-            const modelText = withNote + truncationNote + partialNote + sourceEcho;
+            let modelText = withNote + truncationNote + partialNote + sourceEcho;
+            {
+                const d = discloseReminderShaped({
+                    segments: [modelText],
+                    mark: ctx.reminderMark,
+                    outlet: "webFetch",
+                    defuseExactMark: true,
+                    ...(ctx.reminderDisclosureCounts !== undefined ? { counts: ctx.reminderDisclosureCounts } : {}),
+                });
+                modelText = d.trailer !== undefined ? `${d.segments[0]}\n\n${d.trailer}` : d.segments[0];
+            }
             const RESULT_PREVIEW_CHARS = 8_000;
             return {
                 content: modelText,
@@ -947,7 +958,15 @@ export function createWebSearchTool(config) {
             const tailReminder = shown.length > 0
                 ? "REMINDER: You MUST include the sources above in your response to the user using markdown hyperlinks."
                 : "REMINDER: this search returned ZERO usable sources — there is nothing above to cite. Do not fabricate sources, URLs or citations; tell the user the search returned no usable results (the notes above say why, when there is a why) and answer from what you already know, or try a different query.";
-            const modelText = `${fenced}${dropNote}${domainNote}${maxResultsNote}${schemeNote}${clipNote}\n\n${tailReminder}`;
+            const searchDisclosure = discloseReminderShaped({
+                segments: [fenced],
+                mark: ctx.reminderMark,
+                outlet: "webSearch",
+                defuseExactMark: true,
+                ...(ctx.reminderDisclosureCounts !== undefined ? { counts: ctx.reminderDisclosureCounts } : {}),
+            });
+            const searchDisclosureNote = searchDisclosure.trailer !== undefined ? `\n\n${searchDisclosure.trailer}` : "";
+            const modelText = `${searchDisclosure.segments[0]}${dropNote}${domainNote}${maxResultsNote}${schemeNote}${clipNote}${searchDisclosureNote}\n\n${tailReminder}`;
             return {
                 content: modelText,
                 details: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "5.47.0",
+  "version": "5.49.0",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",
@@ -66,7 +66,8 @@
     "gate:nuia": "node scripts/verify-nuia-baseline.mjs",
     "gate:field-liveness": "node scripts/verify-field-liveness.mjs",
     "gate:error-surface": "node scripts/verify-error-surface.mjs",
-    "gate:criteria": "node scripts/criteria-lint.mjs"
+    "gate:criteria": "node scripts/criteria-lint.mjs",
+    "gate:reminder-literal": "node scripts/verify-reminder-literal.mjs"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "1.30.0",